@contember/engine-tenant-api 2.1.0-rc.3 → 2.2.0-alpha.10

package/dist/production/src/model/service/idp/PersonIdentityProviderManager.cjs

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Response = require("../../utils/Response.cjs");
+require("../../queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../../type/ApiKey.cjs");
+const ConfigurationQuery = require("../../queries/configuration/ConfigurationQuery.cjs");
+const PersonIdentityProvidersQuery = require("../../queries/idp/PersonIdentityProvidersQuery.cjs");
+require("../../authorization/PermissionActions.cjs");
+require("@contember/authorization");
+require("../../authorization/CustomRolePermissions.cjs");
+require("../../authorization/PermissionContext.cjs");
+require("../../authorization/TargetIdentityPermission.cjs");
+require("@contember/schema");
+const DisconnectPersonIdentityProviderCommand = require("../../commands/idp/DisconnectPersonIdentityProviderCommand.cjs");
+const isPasswordlessEnabled = require("../helpers/isPasswordlessEnabled.cjs");
+class PersonIdentityProviderManager {
+  async listPersonIdentityProviders(db, personId) {
+    return await db.queryHandler.fetch(new PersonIdentityProvidersQuery.PersonIdentityProvidersQuery(personId));
+  }
+  async disconnectIdentityProvider(db, person, connectionId) {
+    return await db.transaction(async (db2) => {
+      const connections = await db2.queryHandler.fetch(new PersonIdentityProvidersQuery.PersonIdentityProvidersQuery(person.id));
+      const connection = connections.find((it) => it.id === connectionId);
+      if (!connection) {
+        return new Response.ResponseError("NOT_FOUND", `You are not connected to the identity provider connection "${connectionId}".`);
+      }
+      if (connection.identityProviderDisableLocalAuthentication) {
+        return new Response.ResponseError(
+          "IDP_REQUIRED",
+          `The identity provider "${connection.identityProviderSlug}" is the only way you may sign in; its connection cannot be removed.`
+        );
+      }
+      const configuration = await db2.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery(db2.providers));
+      const hasPassword = person.password_hash !== null;
+      const hasPasswordless = isPasswordlessEnabled.isPasswordlessEnabled(configuration.passwordless.enabled, person.passwordless_enabled);
+      const otherUsableConnections = connections.filter((it) => it.id !== connection.id && it.identityProviderDisabledAt === null);
+      const wouldLockOut = !hasPassword && !hasPasswordless && otherUsableConnections.length === 0;
+      if (wouldLockOut) {
+        return new Response.ResponseError(
+          "LAST_AUTH_METHOD",
+          "Cannot disconnect the only remaining sign-in method. Set up a password or another sign-in method first."
+        );
+      }
+      await db2.commandBus.execute(new DisconnectPersonIdentityProviderCommand.DisconnectPersonIdentityProviderCommand(person.id, connection.id));
+      return new Response.ResponseOk({ slug: connection.identityProviderSlug });
+    });
+  }
+}
+exports.PersonIdentityProviderManager = PersonIdentityProviderManager;
+//# sourceMappingURL=PersonIdentityProviderManager.cjs.map

package/dist/production/src/model/service/idp/PersonIdentityProviderManager.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PersonIdentityProviderManager.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/PersonIdentityProviderManager.ts"],"sourcesContent":["import { Response, ResponseError, ResponseOk } from '../../utils/Response.js'\nimport { DisconnectIdpErrorCode } from '../../../schema/index.js'\nimport { DatabaseContext } from '../../utils/index.js'\nimport { ConfigurationQuery, PersonIdentityProviderRow, PersonIdentityProvidersQuery, PersonRow } from '../../queries/index.js'\nimport { DisconnectPersonIdentityProviderCommand } from '../../commands/idp/DisconnectPersonIdentityProviderCommand.js'\nimport { isPasswordlessEnabled } from '../helpers/isPasswordlessEnabled.js'\n\n/**\n * Manages the external IdP connections of the *currently authenticated* person.\n *\n * Lock-out policy: a person may always disconnect a provider as long as it does\n * not remove their last remaining sign-in method. A connection is refused only\n * when, after removal, the person would have no password, no passwordless\n * sign-in enabled and no other *usable* IdP connection left — which would lock\n * them out of their account entirely. Whether passwordless counts is decided by\n * the same tenant policy the sign-in flow applies, and connections to disabled\n * providers are not counted as a usable fallback (they cannot sign in).\n */\nexport class PersonIdentityProviderManager {\n\tpublic async listPersonIdentityProviders(db: DatabaseContext, personId: string): Promise<PersonIdentityProviderRow[]> {\n\t\treturn await db.queryHandler.fetch(new PersonIdentityProvidersQuery(personId))\n\t}\n\n\tpublic async disconnectIdentityProvider(db: DatabaseContext, person: PersonRow, connectionId: string): Promise<DisconnectIDPResponse> {\n\t\treturn await db.transaction(async db => {\n\t\t\tconst connections = await db.queryHandler.fetch(new PersonIdentityProvidersQuery(person.id))\n\t\t\tconst connection = connections.find(it => it.id === connectionId)\n\t\t\tif (!connection) {\n\t\t\t\treturn new ResponseError('NOT_FOUND', `You are not connected to the identity provider connection \"${connectionId}\".`)\n\t\t\t}\n\n\t\t\t// The link is what binds the person to the provider's policy, so they cannot remove it themselves.\n\t\t\tif (connection.identityProviderDisableLocalAuthentication) {\n\t\t\t\treturn new ResponseError(\n\t\t\t\t\t'IDP_REQUIRED',\n\t\t\t\t\t`The identity provider \"${connection.identityProviderSlug}\" is the only way you may sign in; its connection cannot be removed.`,\n\t\t\t\t)\n\t\t\t}\n\n\t\t\tconst configuration = await db.queryHandler.fetch(new ConfigurationQuery(db.providers))\n\t\t\tconst hasPassword = person.password_hash !== null\n\t\t\tconst hasPasswordless = isPasswordlessEnabled(configuration.passwordless.enabled, person.passwordless_enabled)\n\t\t\tconst otherUsableConnections = connections.filter(it => it.id !== connection.id && it.identityProviderDisabledAt === null)\n\t\t\tconst wouldLockOut = !hasPassword && !hasPasswordless && otherUsableConnections.length === 0\n\t\t\tif (wouldLockOut) {\n\t\t\t\treturn new ResponseError(\n\t\t\t\t\t'LAST_AUTH_METHOD',\n\t\t\t\t\t'Cannot disconnect the only remaining sign-in method. Set up a password or another sign-in method first.',\n\t\t\t\t)\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(new DisconnectPersonIdentityProviderCommand(person.id, connection.id))\n\t\t\treturn new ResponseOk({ slug: connection.identityProviderSlug })\n\t\t})\n\t}\n}\n\nexport interface DisconnectIDPResult {\n\treadonly slug: string\n}\n\nexport type DisconnectIDPResponse = Response<DisconnectIDPResult, DisconnectIdpErrorCode>\n"],"names":["PersonIdentityProvidersQuery","db","ResponseError","ConfigurationQuery","isPasswordlessEnabled","DisconnectPersonIdentityProviderCommand","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;AAkBO,MAAM,8BAA8B;AAAA,EAC1C,MAAa,4BAA4B,IAAqB,UAAwD;AACrH,WAAO,MAAM,GAAG,aAAa,MAAM,IAAIA,6BAAAA,6BAA6B,QAAQ,CAAC;AAAA,EAC9E;AAAA,EAEA,MAAa,2BAA2B,IAAqB,QAAmB,cAAsD;AACrI,WAAO,MAAM,GAAG,YAAY,OAAMC,QAAM;AACvC,YAAM,cAAc,MAAMA,IAAG,aAAa,MAAM,IAAID,6BAAAA,6BAA6B,OAAO,EAAE,CAAC;AAC3F,YAAM,aAAa,YAAY,KAAK,CAAA,OAAM,GAAG,OAAO,YAAY;AAChE,UAAI,CAAC,YAAY;AAChB,eAAO,IAAIE,SAAAA,cAAc,aAAa,8DAA8D,YAAY,IAAI;AAAA,MACrH;AAGA,UAAI,WAAW,4CAA4C;AAC1D,eAAO,IAAIA,SAAAA;AAAAA,UACV;AAAA,UACA,0BAA0B,WAAW,oBAAoB;AAAA,QAAA;AAAA,MAE3D;AAEA,YAAM,gBAAgB,MAAMD,IAAG,aAAa,MAAM,IAAIE,mBAAAA,mBAAmBF,IAAG,SAAS,CAAC;AACtF,YAAM,cAAc,OAAO,kBAAkB;AAC7C,YAAM,kBAAkBG,sBAAAA,sBAAsB,cAAc,aAAa,SAAS,OAAO,oBAAoB;AAC7G,YAAM,yBAAyB,YAAY,OAAO,CAAA,OAAM,GAAG,OAAO,WAAW,MAAM,GAAG,+BAA+B,IAAI;AACzH,YAAM,eAAe,CAAC,eAAe,CAAC,mBAAmB,uBAAuB,WAAW;AAC3F,UAAI,cAAc;AACjB,eAAO,IAAIF,SAAAA;AAAAA,UACV;AAAA,UACA;AAAA,QAAA;AAAA,MAEF;AAEA,YAAMD,IAAG,WAAW,QAAQ,IAAII,wCAAAA,wCAAwC,OAAO,IAAI,WAAW,EAAE,CAAC;AACjG,aAAO,IAAIC,SAAAA,WAAW,EAAE,MAAM,WAAW,sBAAsB;AAAA,IAChE,CAAC;AAAA,EACF;AACD;;"}

package/dist/production/src/model/service/idp/PersonIdentityProviderManager.js

@@ -0,0 +1,51 @@
+import { ResponseError, ResponseOk } from "../../utils/Response.js";
+import "../../queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../type/ApiKey.js";
+import { ConfigurationQuery } from "../../queries/configuration/ConfigurationQuery.js";
+import { PersonIdentityProvidersQuery } from "../../queries/idp/PersonIdentityProvidersQuery.js";
+import "../../authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../../authorization/CustomRolePermissions.js";
+import "../../authorization/PermissionContext.js";
+import "../../authorization/TargetIdentityPermission.js";
+import "@contember/schema";
+import { DisconnectPersonIdentityProviderCommand } from "../../commands/idp/DisconnectPersonIdentityProviderCommand.js";
+import { isPasswordlessEnabled } from "../helpers/isPasswordlessEnabled.js";
+class PersonIdentityProviderManager {
+  async listPersonIdentityProviders(db, personId) {
+    return await db.queryHandler.fetch(new PersonIdentityProvidersQuery(personId));
+  }
+  async disconnectIdentityProvider(db, person, connectionId) {
+    return await db.transaction(async (db2) => {
+      const connections = await db2.queryHandler.fetch(new PersonIdentityProvidersQuery(person.id));
+      const connection = connections.find((it) => it.id === connectionId);
+      if (!connection) {
+        return new ResponseError("NOT_FOUND", `You are not connected to the identity provider connection "${connectionId}".`);
+      }
+      if (connection.identityProviderDisableLocalAuthentication) {
+        return new ResponseError(
+          "IDP_REQUIRED",
+          `The identity provider "${connection.identityProviderSlug}" is the only way you may sign in; its connection cannot be removed.`
+        );
+      }
+      const configuration = await db2.queryHandler.fetch(new ConfigurationQuery(db2.providers));
+      const hasPassword = person.password_hash !== null;
+      const hasPasswordless = isPasswordlessEnabled(configuration.passwordless.enabled, person.passwordless_enabled);
+      const otherUsableConnections = connections.filter((it) => it.id !== connection.id && it.identityProviderDisabledAt === null);
+      const wouldLockOut = !hasPassword && !hasPasswordless && otherUsableConnections.length === 0;
+      if (wouldLockOut) {
+        return new ResponseError(
+          "LAST_AUTH_METHOD",
+          "Cannot disconnect the only remaining sign-in method. Set up a password or another sign-in method first."
+        );
+      }
+      await db2.commandBus.execute(new DisconnectPersonIdentityProviderCommand(person.id, connection.id));
+      return new ResponseOk({ slug: connection.identityProviderSlug });
+    });
+  }
+}
+export {
+  PersonIdentityProviderManager
+};
+//# sourceMappingURL=PersonIdentityProviderManager.js.map

package/dist/production/src/model/service/idp/PersonIdentityProviderManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PersonIdentityProviderManager.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/PersonIdentityProviderManager.ts"],"sourcesContent":["import { Response, ResponseError, ResponseOk } from '../../utils/Response.js'\nimport { DisconnectIdpErrorCode } from '../../../schema/index.js'\nimport { DatabaseContext } from '../../utils/index.js'\nimport { ConfigurationQuery, PersonIdentityProviderRow, PersonIdentityProvidersQuery, PersonRow } from '../../queries/index.js'\nimport { DisconnectPersonIdentityProviderCommand } from '../../commands/idp/DisconnectPersonIdentityProviderCommand.js'\nimport { isPasswordlessEnabled } from '../helpers/isPasswordlessEnabled.js'\n\n/**\n * Manages the external IdP connections of the *currently authenticated* person.\n *\n * Lock-out policy: a person may always disconnect a provider as long as it does\n * not remove their last remaining sign-in method. A connection is refused only\n * when, after removal, the person would have no password, no passwordless\n * sign-in enabled and no other *usable* IdP connection left — which would lock\n * them out of their account entirely. Whether passwordless counts is decided by\n * the same tenant policy the sign-in flow applies, and connections to disabled\n * providers are not counted as a usable fallback (they cannot sign in).\n */\nexport class PersonIdentityProviderManager {\n\tpublic async listPersonIdentityProviders(db: DatabaseContext, personId: string): Promise<PersonIdentityProviderRow[]> {\n\t\treturn await db.queryHandler.fetch(new PersonIdentityProvidersQuery(personId))\n\t}\n\n\tpublic async disconnectIdentityProvider(db: DatabaseContext, person: PersonRow, connectionId: string): Promise<DisconnectIDPResponse> {\n\t\treturn await db.transaction(async db => {\n\t\t\tconst connections = await db.queryHandler.fetch(new PersonIdentityProvidersQuery(person.id))\n\t\t\tconst connection = connections.find(it => it.id === connectionId)\n\t\t\tif (!connection) {\n\t\t\t\treturn new ResponseError('NOT_FOUND', `You are not connected to the identity provider connection \"${connectionId}\".`)\n\t\t\t}\n\n\t\t\t// The link is what binds the person to the provider's policy, so they cannot remove it themselves.\n\t\t\tif (connection.identityProviderDisableLocalAuthentication) {\n\t\t\t\treturn new ResponseError(\n\t\t\t\t\t'IDP_REQUIRED',\n\t\t\t\t\t`The identity provider \"${connection.identityProviderSlug}\" is the only way you may sign in; its connection cannot be removed.`,\n\t\t\t\t)\n\t\t\t}\n\n\t\t\tconst configuration = await db.queryHandler.fetch(new ConfigurationQuery(db.providers))\n\t\t\tconst hasPassword = person.password_hash !== null\n\t\t\tconst hasPasswordless = isPasswordlessEnabled(configuration.passwordless.enabled, person.passwordless_enabled)\n\t\t\tconst otherUsableConnections = connections.filter(it => it.id !== connection.id && it.identityProviderDisabledAt === null)\n\t\t\tconst wouldLockOut = !hasPassword && !hasPasswordless && otherUsableConnections.length === 0\n\t\t\tif (wouldLockOut) {\n\t\t\t\treturn new ResponseError(\n\t\t\t\t\t'LAST_AUTH_METHOD',\n\t\t\t\t\t'Cannot disconnect the only remaining sign-in method. Set up a password or another sign-in method first.',\n\t\t\t\t)\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(new DisconnectPersonIdentityProviderCommand(person.id, connection.id))\n\t\t\treturn new ResponseOk({ slug: connection.identityProviderSlug })\n\t\t})\n\t}\n}\n\nexport interface DisconnectIDPResult {\n\treadonly slug: string\n}\n\nexport type DisconnectIDPResponse = Response<DisconnectIDPResult, DisconnectIdpErrorCode>\n"],"names":["db"],"mappings":";;;;;;;;;;;;;;AAkBO,MAAM,8BAA8B;AAAA,EAC1C,MAAa,4BAA4B,IAAqB,UAAwD;AACrH,WAAO,MAAM,GAAG,aAAa,MAAM,IAAI,6BAA6B,QAAQ,CAAC;AAAA,EAC9E;AAAA,EAEA,MAAa,2BAA2B,IAAqB,QAAmB,cAAsD;AACrI,WAAO,MAAM,GAAG,YAAY,OAAMA,QAAM;AACvC,YAAM,cAAc,MAAMA,IAAG,aAAa,MAAM,IAAI,6BAA6B,OAAO,EAAE,CAAC;AAC3F,YAAM,aAAa,YAAY,KAAK,CAAA,OAAM,GAAG,OAAO,YAAY;AAChE,UAAI,CAAC,YAAY;AAChB,eAAO,IAAI,cAAc,aAAa,8DAA8D,YAAY,IAAI;AAAA,MACrH;AAGA,UAAI,WAAW,4CAA4C;AAC1D,eAAO,IAAI;AAAA,UACV;AAAA,UACA,0BAA0B,WAAW,oBAAoB;AAAA,QAAA;AAAA,MAE3D;AAEA,YAAM,gBAAgB,MAAMA,IAAG,aAAa,MAAM,IAAI,mBAAmBA,IAAG,SAAS,CAAC;AACtF,YAAM,cAAc,OAAO,kBAAkB;AAC7C,YAAM,kBAAkB,sBAAsB,cAAc,aAAa,SAAS,OAAO,oBAAoB;AAC7G,YAAM,yBAAyB,YAAY,OAAO,CAAA,OAAM,GAAG,OAAO,WAAW,MAAM,GAAG,+BAA+B,IAAI;AACzH,YAAM,eAAe,CAAC,eAAe,CAAC,mBAAmB,uBAAuB,WAAW;AAC3F,UAAI,cAAc;AACjB,eAAO,IAAI;AAAA,UACV;AAAA,UACA;AAAA,QAAA;AAAA,MAEF;AAEA,YAAMA,IAAG,WAAW,QAAQ,IAAI,wCAAwC,OAAO,IAAI,WAAW,EAAE,CAAC;AACjG,aAAO,IAAI,WAAW,EAAE,MAAM,WAAW,sBAAsB;AAAA,IAChE,CAAC;AAAA,EACF;AACD;"}

package/dist/production/src/model/service/idp/providers/AppleProvider.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"AppleProvider.cjs","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/AppleProvider.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'\nimport { OIDCConfiguration, OIDCConfigurationOptions, OIDCInitData, OIDCResponseData, OIDCSessionData } from './OIDCTypes'\nimport { catchTypesafe } from './helpers'\nimport { IDPValidationError } from '../IDPValidationError'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers'\nimport { Client, Issuer } from 'openid-client'\nimport { importPKCS8, SignJWT } from 'jose'\n\nexport const AppleConfiguration = Typesafe.intersection(\n\tTypesafe.object({\n\t\tkeyId: Typesafe.string,\n\t\tteamId: Typesafe.string,\n\t\tclientId: Typesafe.string,\n\t\tprivateKey: Typesafe.string,\n\t}),\n\tOIDCConfigurationOptions,\n)\n\ntype AppleConfiguration = ReturnType<typeof AppleConfiguration>\n\nconst APPLE_OIDC_CONFIGURATION_ENDPOINT = 'https://appleid.apple.com/.well-known/openid-configuration'\n\nexport class AppleProvider implements IdentityProviderHandler<AppleConfiguration> {\n\tprivate issuer: Issuer<Client> | undefined\n\n\tvalidateConfiguration = catchTypesafe(AppleConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: AppleConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tscope: configuration.scope ?? configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: AppleConfiguration, data: unknown): Promise<IDPResponse> {\n\t\tconst responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await handleOIDCResponse(client, responseData)\n\t}\n\n\tgetPublicConfiguration({ privateKey, ...config }: AppleConfiguration): Partial<AppleConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: AppleConfiguration): Promise<Client> {\n\t\tthis.issuer ??= await Issuer.discover(APPLE_OIDC_CONFIGURATION_ENDPOINT)\n\t\tconst privateKey = await importPKCS8(configuration.privateKey, 'ES256')\n\n\t\tconst jwt = await new SignJWT({})\n\t\t\t.setProtectedHeader({ alg: 'ES256', typ: 'JWT', kid: configuration.keyId })\n\t\t\t.setIssuedAt()\n\t\t\t.setIssuer(configuration.teamId)\n\t\t\t.setAudience('https://appleid.apple.com')\n\t\t\t.setSubject(configuration.clientId)\n\t\t\t.setExpirationTime('10m')\n\t\t\t.sign(privateKey)\n\n\t\treturn new this.issuer.Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: jwt,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\t}\n}\n"],"names":["Typesafe","OIDCConfigurationOptions","catchTypesafe","InvalidIDPConfigurationError","OIDCInitData","IDPValidationError","initOIDCAuth","OIDCResponseData","handleOIDCResponse","Issuer","importPKCS8","SignJWT"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAUO,MAAM,qBAAqBA,oBAAS;AAAA,EAC1CA,oBAAS,OAAO;AAAA,IACf,OAAOA,oBAAS;AAAA,IAChB,QAAQA,oBAAS;AAAA,IACjB,UAAUA,oBAAS;AAAA,IACnB,YAAYA,oBAAS;AAAA,EAAA,CACrB;AAAA,EACDC,UAAAA;AACD;AAIA,MAAM,oCAAoC;AAEnC,MAAM,cAAqE;AAAA,EAA3E,cAAA;AACN,kBAAA,MAAQ,QAAA;AAER,kBAAA,MAAA,yBAAwBC,QAAAA,cAAc,oBAAoBC,6BAAAA,4BAA4B,CAAA;AAAA,EAAA;AAAA,EAEtF,MAAa,SAAS,eAAmC,MAA2C;AACnG,UAAM,WAAWD,QAAAA,cAAcE,UAAAA,cAAcC,mBAAAA,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAMC,YAAAA,aAAa,QAAQ;AAAA,MACjC,OAAO,cAAc,SAAS,cAAc;AAAA,MAC5C,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAmC,MAAqC;AACpG,UAAM,eAAeJ,QAAAA,cAAcK,UAAAA,kBAAkBF,mBAAAA,kBAAkB,EAAE,IAAI;AAC7E,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAMG,YAAAA,mBAAmB,QAAQ,YAAY;AAAA,EACrD;AAAA,EAEA,uBAAuB,EAAE,YAAY,GAAG,UAA2D;AAClG,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAoD;AAClF,SAAK,WAAL,KAAK,SAAW,MAAMC,oBAAO,SAAS,iCAAiC;AACvE,UAAM,aAAa,MAAMC,KAAAA,YAAY,cAAc,YAAY,OAAO;AAEtE,UAAM,MAAM,MAAM,IAAIC,KAAAA,QAAQ,CAAA,CAAE,EAC9B,mBAAmB,EAAE,KAAK,SAAS,KAAK,OAAO,KAAK,cAAc,MAAA,CAAO,EACzE,YAAA,EACA,UAAU,cAAc,MAAM,EAC9B,YAAY,2BAA2B,EACvC,WAAW,cAAc,QAAQ,EACjC,kBAAkB,KAAK,EACvB,KAAK,UAAU;AAEjB,WAAO,IAAI,KAAK,OAAO;AAAA,MACtB;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe;AAAA,QACf,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,MAAA;AAAA,MAEtD;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MAAA;AAAA,IACnF;AAAA,EAEF;AACD;;;"}
+{"version":3,"file":"AppleProvider.cjs","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/AppleProvider.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler.js'\nimport { OIDCConfiguration, OIDCConfigurationOptions, OIDCInitData, OIDCResponseData, OIDCSessionData } from './OIDCTypes.js'\nimport { catchTypesafe } from './helpers.js'\nimport { IDPValidationError } from '../IDPValidationError.js'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError.js'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers.js'\nimport { Client, Issuer } from 'openid-client'\nimport { importPKCS8, SignJWT } from 'jose'\n\nexport const AppleConfiguration = Typesafe.intersection(\n\tTypesafe.object({\n\t\tkeyId: Typesafe.string,\n\t\tteamId: Typesafe.string,\n\t\tclientId: Typesafe.string,\n\t\tprivateKey: Typesafe.string,\n\t}),\n\tOIDCConfigurationOptions,\n)\n\ntype AppleConfiguration = ReturnType<typeof AppleConfiguration>\n\nconst APPLE_OIDC_CONFIGURATION_ENDPOINT = 'https://appleid.apple.com/.well-known/openid-configuration'\n\nexport class AppleProvider implements IdentityProviderHandler<AppleConfiguration> {\n\tprivate issuer: Issuer<Client> | undefined\n\n\tvalidateConfiguration = catchTypesafe(AppleConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: AppleConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tscope: configuration.scope ?? configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: AppleConfiguration, data: unknown): Promise<IDPResponse> {\n\t\tconst responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await handleOIDCResponse(client, responseData)\n\t}\n\n\tgetPublicConfiguration({ privateKey, ...config }: AppleConfiguration): Partial<AppleConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: AppleConfiguration): Promise<Client> {\n\t\tthis.issuer ??= await Issuer.discover(APPLE_OIDC_CONFIGURATION_ENDPOINT)\n\t\tconst privateKey = await importPKCS8(configuration.privateKey, 'ES256')\n\n\t\tconst jwt = await new SignJWT({})\n\t\t\t.setProtectedHeader({ alg: 'ES256', typ: 'JWT', kid: configuration.keyId })\n\t\t\t.setIssuedAt()\n\t\t\t.setIssuer(configuration.teamId)\n\t\t\t.setAudience('https://appleid.apple.com')\n\t\t\t.setSubject(configuration.clientId)\n\t\t\t.setExpirationTime('10m')\n\t\t\t.sign(privateKey)\n\n\t\treturn new this.issuer.Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: jwt,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\t}\n}\n"],"names":["Typesafe","OIDCConfigurationOptions","catchTypesafe","InvalidIDPConfigurationError","OIDCInitData","IDPValidationError","initOIDCAuth","OIDCResponseData","handleOIDCResponse","Issuer","importPKCS8","SignJWT"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAUO,MAAM,qBAAqBA,oBAAS;AAAA,EAC1CA,oBAAS,OAAO;AAAA,IACf,OAAOA,oBAAS;AAAA,IAChB,QAAQA,oBAAS;AAAA,IACjB,UAAUA,oBAAS;AAAA,IACnB,YAAYA,oBAAS;AAAA,EAAA,CACrB;AAAA,EACDC,UAAAA;AACD;AAIA,MAAM,oCAAoC;AAEnC,MAAM,cAAqE;AAAA,EAA3E,cAAA;AACN,kBAAA,MAAQ,QAAA;AAER,kBAAA,MAAA,yBAAwBC,QAAAA,cAAc,oBAAoBC,6BAAAA,4BAA4B,CAAA;AAAA,EAAA;AAAA,EAEtF,MAAa,SAAS,eAAmC,MAA2C;AACnG,UAAM,WAAWD,QAAAA,cAAcE,UAAAA,cAAcC,mBAAAA,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAMC,YAAAA,aAAa,QAAQ;AAAA,MACjC,OAAO,cAAc,SAAS,cAAc;AAAA,MAC5C,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAmC,MAAqC;AACpG,UAAM,eAAeJ,QAAAA,cAAcK,UAAAA,kBAAkBF,mBAAAA,kBAAkB,EAAE,IAAI;AAC7E,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAMG,YAAAA,mBAAmB,QAAQ,YAAY;AAAA,EACrD;AAAA,EAEA,uBAAuB,EAAE,YAAY,GAAG,UAA2D;AAClG,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAoD;AAClF,SAAK,WAAL,KAAK,SAAW,MAAMC,oBAAO,SAAS,iCAAiC;AACvE,UAAM,aAAa,MAAMC,KAAAA,YAAY,cAAc,YAAY,OAAO;AAEtE,UAAM,MAAM,MAAM,IAAIC,KAAAA,QAAQ,CAAA,CAAE,EAC9B,mBAAmB,EAAE,KAAK,SAAS,KAAK,OAAO,KAAK,cAAc,MAAA,CAAO,EACzE,YAAA,EACA,UAAU,cAAc,MAAM,EAC9B,YAAY,2BAA2B,EACvC,WAAW,cAAc,QAAQ,EACjC,kBAAkB,KAAK,EACvB,KAAK,UAAU;AAEjB,WAAO,IAAI,KAAK,OAAO;AAAA,MACtB;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe;AAAA,QACf,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,MAAA;AAAA,MAEtD;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MAAA;AAAA,IACnF;AAAA,EAEF;AACD;;;"}

package/dist/production/src/model/service/idp/providers/AppleProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"AppleProvider.js","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/AppleProvider.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'\nimport { OIDCConfiguration, OIDCConfigurationOptions, OIDCInitData, OIDCResponseData, OIDCSessionData } from './OIDCTypes'\nimport { catchTypesafe } from './helpers'\nimport { IDPValidationError } from '../IDPValidationError'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers'\nimport { Client, Issuer } from 'openid-client'\nimport { importPKCS8, SignJWT } from 'jose'\n\nexport const AppleConfiguration = Typesafe.intersection(\n\tTypesafe.object({\n\t\tkeyId: Typesafe.string,\n\t\tteamId: Typesafe.string,\n\t\tclientId: Typesafe.string,\n\t\tprivateKey: Typesafe.string,\n\t}),\n\tOIDCConfigurationOptions,\n)\n\ntype AppleConfiguration = ReturnType<typeof AppleConfiguration>\n\nconst APPLE_OIDC_CONFIGURATION_ENDPOINT = 'https://appleid.apple.com/.well-known/openid-configuration'\n\nexport class AppleProvider implements IdentityProviderHandler<AppleConfiguration> {\n\tprivate issuer: Issuer<Client> | undefined\n\n\tvalidateConfiguration = catchTypesafe(AppleConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: AppleConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tscope: configuration.scope ?? configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: AppleConfiguration, data: unknown): Promise<IDPResponse> {\n\t\tconst responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await handleOIDCResponse(client, responseData)\n\t}\n\n\tgetPublicConfiguration({ privateKey, ...config }: AppleConfiguration): Partial<AppleConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: AppleConfiguration): Promise<Client> {\n\t\tthis.issuer ??= await Issuer.discover(APPLE_OIDC_CONFIGURATION_ENDPOINT)\n\t\tconst privateKey = await importPKCS8(configuration.privateKey, 'ES256')\n\n\t\tconst jwt = await new SignJWT({})\n\t\t\t.setProtectedHeader({ alg: 'ES256', typ: 'JWT', kid: configuration.keyId })\n\t\t\t.setIssuedAt()\n\t\t\t.setIssuer(configuration.teamId)\n\t\t\t.setAudience('https://appleid.apple.com')\n\t\t\t.setSubject(configuration.clientId)\n\t\t\t.setExpirationTime('10m')\n\t\t\t.sign(privateKey)\n\n\t\treturn new this.issuer.Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: jwt,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;AAUO,MAAM,qBAAqB,SAAS;AAAA,EAC1C,SAAS,OAAO;AAAA,IACf,OAAO,SAAS;AAAA,IAChB,QAAQ,SAAS;AAAA,IACjB,UAAU,SAAS;AAAA,IACnB,YAAY,SAAS;AAAA,EAAA,CACrB;AAAA,EACD;AACD;AAIA,MAAM,oCAAoC;AAEnC,MAAM,cAAqE;AAAA,EAA3E,cAAA;AACN,kBAAA,MAAQ,QAAA;AAER,kBAAA,MAAA,yBAAwB,cAAc,oBAAoB,4BAA4B,CAAA;AAAA,EAAA;AAAA,EAEtF,MAAa,SAAS,eAAmC,MAA2C;AACnG,UAAM,WAAW,cAAc,cAAc,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAM,aAAa,QAAQ;AAAA,MACjC,OAAO,cAAc,SAAS,cAAc;AAAA,MAC5C,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAmC,MAAqC;AACpG,UAAM,eAAe,cAAc,kBAAkB,kBAAkB,EAAE,IAAI;AAC7E,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAM,mBAAmB,QAAQ,YAAY;AAAA,EACrD;AAAA,EAEA,uBAAuB,EAAE,YAAY,GAAG,UAA2D;AAClG,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAoD;AAClF,SAAK,WAAL,KAAK,SAAW,MAAM,OAAO,SAAS,iCAAiC;AACvE,UAAM,aAAa,MAAM,YAAY,cAAc,YAAY,OAAO;AAEtE,UAAM,MAAM,MAAM,IAAI,QAAQ,CAAA,CAAE,EAC9B,mBAAmB,EAAE,KAAK,SAAS,KAAK,OAAO,KAAK,cAAc,MAAA,CAAO,EACzE,YAAA,EACA,UAAU,cAAc,MAAM,EAC9B,YAAY,2BAA2B,EACvC,WAAW,cAAc,QAAQ,EACjC,kBAAkB,KAAK,EACvB,KAAK,UAAU;AAEjB,WAAO,IAAI,KAAK,OAAO;AAAA,MACtB;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe;AAAA,QACf,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,MAAA;AAAA,MAEtD;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MAAA;AAAA,IACnF;AAAA,EAEF;AACD;"}
+{"version":3,"file":"AppleProvider.js","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/AppleProvider.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler.js'\nimport { OIDCConfiguration, OIDCConfigurationOptions, OIDCInitData, OIDCResponseData, OIDCSessionData } from './OIDCTypes.js'\nimport { catchTypesafe } from './helpers.js'\nimport { IDPValidationError } from '../IDPValidationError.js'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError.js'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers.js'\nimport { Client, Issuer } from 'openid-client'\nimport { importPKCS8, SignJWT } from 'jose'\n\nexport const AppleConfiguration = Typesafe.intersection(\n\tTypesafe.object({\n\t\tkeyId: Typesafe.string,\n\t\tteamId: Typesafe.string,\n\t\tclientId: Typesafe.string,\n\t\tprivateKey: Typesafe.string,\n\t}),\n\tOIDCConfigurationOptions,\n)\n\ntype AppleConfiguration = ReturnType<typeof AppleConfiguration>\n\nconst APPLE_OIDC_CONFIGURATION_ENDPOINT = 'https://appleid.apple.com/.well-known/openid-configuration'\n\nexport class AppleProvider implements IdentityProviderHandler<AppleConfiguration> {\n\tprivate issuer: Issuer<Client> | undefined\n\n\tvalidateConfiguration = catchTypesafe(AppleConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: AppleConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tscope: configuration.scope ?? configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: AppleConfiguration, data: unknown): Promise<IDPResponse> {\n\t\tconst responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await handleOIDCResponse(client, responseData)\n\t}\n\n\tgetPublicConfiguration({ privateKey, ...config }: AppleConfiguration): Partial<AppleConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: AppleConfiguration): Promise<Client> {\n\t\tthis.issuer ??= await Issuer.discover(APPLE_OIDC_CONFIGURATION_ENDPOINT)\n\t\tconst privateKey = await importPKCS8(configuration.privateKey, 'ES256')\n\n\t\tconst jwt = await new SignJWT({})\n\t\t\t.setProtectedHeader({ alg: 'ES256', typ: 'JWT', kid: configuration.keyId })\n\t\t\t.setIssuedAt()\n\t\t\t.setIssuer(configuration.teamId)\n\t\t\t.setAudience('https://appleid.apple.com')\n\t\t\t.setSubject(configuration.clientId)\n\t\t\t.setExpirationTime('10m')\n\t\t\t.sign(privateKey)\n\n\t\treturn new this.issuer.Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: jwt,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;AAUO,MAAM,qBAAqB,SAAS;AAAA,EAC1C,SAAS,OAAO;AAAA,IACf,OAAO,SAAS;AAAA,IAChB,QAAQ,SAAS;AAAA,IACjB,UAAU,SAAS;AAAA,IACnB,YAAY,SAAS;AAAA,EAAA,CACrB;AAAA,EACD;AACD;AAIA,MAAM,oCAAoC;AAEnC,MAAM,cAAqE;AAAA,EAA3E,cAAA;AACN,kBAAA,MAAQ,QAAA;AAER,kBAAA,MAAA,yBAAwB,cAAc,oBAAoB,4BAA4B,CAAA;AAAA,EAAA;AAAA,EAEtF,MAAa,SAAS,eAAmC,MAA2C;AACnG,UAAM,WAAW,cAAc,cAAc,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAM,aAAa,QAAQ;AAAA,MACjC,OAAO,cAAc,SAAS,cAAc;AAAA,MAC5C,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAmC,MAAqC;AACpG,UAAM,eAAe,cAAc,kBAAkB,kBAAkB,EAAE,IAAI;AAC7E,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAM,mBAAmB,QAAQ,YAAY;AAAA,EACrD;AAAA,EAEA,uBAAuB,EAAE,YAAY,GAAG,UAA2D;AAClG,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAoD;AAClF,SAAK,WAAL,KAAK,SAAW,MAAM,OAAO,SAAS,iCAAiC;AACvE,UAAM,aAAa,MAAM,YAAY,cAAc,YAAY,OAAO;AAEtE,UAAM,MAAM,MAAM,IAAI,QAAQ,CAAA,CAAE,EAC9B,mBAAmB,EAAE,KAAK,SAAS,KAAK,OAAO,KAAK,cAAc,MAAA,CAAO,EACzE,YAAA,EACA,UAAU,cAAc,MAAM,EAC9B,YAAY,2BAA2B,EACvC,WAAW,cAAc,QAAQ,EACjC,kBAAkB,KAAK,EACvB,KAAK,UAAU;AAEjB,WAAO,IAAI,KAAK,OAAO;AAAA,MACtB;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe;AAAA,QACf,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,MAAA;AAAA,MAEtD;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MAAA;AAAA,IACnF;AAAA,EAEF;AACD;"}

package/dist/production/src/model/service/idp/providers/FacebookProvider.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"FacebookProvider.cjs","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/FacebookProvider.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { Client, Issuer } from 'openid-client'\nimport { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'\nimport { IDPValidationError } from '../IDPValidationError'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'\nimport { catchTypesafe } from './helpers'\nimport { BaseOIDCConfiguration, OIDCConfiguration, OIDCInitData, OIDCResponseData } from './OIDCTypes'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers'\nimport { createHmac } from 'node:crypto'\nimport { IDPResponseError } from '../IDPResponseError'\n\nconst FacebookConfiguration = BaseOIDCConfiguration\ntype FacebookConfiguration = ReturnType<typeof FacebookConfiguration>\n\nconst FacebookResponseData = Typesafe.union(\n\tOIDCResponseData,\n\tTypesafe.object({\n\t\tauthResponse: Typesafe.object({\n\t\t\taccessToken: Typesafe.string,\n\t\t\tsignedRequest: Typesafe.string,\n\t\t}),\n\t}),\n)\nconst FacebookResponsePayload = Typesafe.object({\n\tuser_id: Typesafe.string,\n\tcode: Typesafe.string,\n})\n\ntype FacebookResponseData = ReturnType<typeof FacebookResponseData>\n\nexport class FacebookProvider implements IdentityProviderHandler<FacebookConfiguration> {\n\t// based on https://www.facebook.com/.well-known/openid-configuration/\n\t// facebook .well-known endpoint does have \"token_endpoint\" field\n\tprivate facebookIssuer = new Issuer({\n\t\tissuer: 'https://www.facebook.com',\n\t\tauthorization_endpoint: 'https://facebook.com/dialog/oauth/',\n\t\tjwks_uri: 'https://www.facebook.com/.well-known/oauth/openid/jwks/',\n\t\tresponse_types_supported: [\n\t\t\t'id_token',\n\t\t\t'token id_token',\n\t\t],\n\t\tsubject_types_supported: [\n\t\t\t'pairwise',\n\t\t],\n\t\tid_token_signing_alg_values_supported: [\n\t\t\t'RS256',\n\t\t],\n\t\tclaims_supported: [\n\t\t\t'iss',\n\t\t\t'aud',\n\t\t\t'sub',\n\t\t\t'iat',\n\t\t\t'exp',\n\t\t\t'jti',\n\t\t\t'nonce',\n\t\t\t'at_hash',\n\t\t\t'name',\n\t\t\t'given_name',\n\t\t\t'middle_name',\n\t\t\t'family_name',\n\t\t\t'email',\n\t\t\t'picture',\n\t\t\t'user_friends',\n\t\t\t'user_birthday',\n\t\t\t'user_age_range',\n\t\t\t'user_link',\n\t\t\t'user_hometown',\n\t\t\t'user_location',\n\t\t\t'user_gender',\n\t\t],\n\t\ttoken_endpoint: 'https://graph.facebook.com/v11.0/oauth/access_token',\n\t})\n\n\tvalidateConfiguration = catchTypesafe(FacebookConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: FacebookConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tscope: configuration.scope ?? configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: FacebookConfiguration, data: unknown): Promise<IDPResponse> {\n\t\tconst responseData = catchTypesafe(FacebookResponseData, IDPValidationError)(data)\n\n\t\tif (!('authResponse' in responseData)) {\n\t\t\tconst client = await this.createOIDCClient(configuration)\n\t\t\treturn await handleOIDCResponse(client, responseData)\n\t\t} else {\n\t\t\tconst [sig, payload] = responseData.authResponse.signedRequest.split('.')\n\t\t\tconst data = catchTypesafe(FacebookResponsePayload, IDPValidationError)(JSON.parse(Buffer.from(payload, 'base64').toString('utf8')))\n\t\t\tconst hmac = createHmac('sha256', configuration.clientSecret)\n\t\t\tconst signature = hmac.update(payload).digest()\n\t\t\tconst isSignatureValid = signature.compare(Buffer.from(sig, 'base64')) === 0\n\t\t\tif (!isSignatureValid) {\n\t\t\t\tthrow new IDPValidationError('Invalid signature')\n\t\t\t}\n\t\t\tconst url = `https://graph.facebook.com/${data.user_id}?fields=id,email,name&access_token=${responseData.authResponse.accessToken}`\n\t\t\tconst response = await fetch(url)\n\t\t\tif (!response.ok) {\n\t\t\t\tthrow new IDPResponseError(`Invalid Facebook response: [${response.status}] ${await response.text()}`)\n\t\t\t}\n\t\t\tconst apiData = await response.json()\n\n\t\t\treturn {\n\t\t\t\texternalIdentifier: data.user_id,\n\t\t\t\tname: apiData.name,\n\t\t\t\temail: apiData.email,\n\t\t\t}\n\t\t}\n\t}\n\n\tgetPublicConfiguration({ clientSecret, ...config }: FacebookConfiguration): Partial<FacebookConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: FacebookConfiguration): Promise<Client> {\n\t\treturn new this.facebookIssuer.Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: configuration.clientSecret,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\t}\n}\n"],"names":["BaseOIDCConfiguration","Typesafe","OIDCResponseData","Issuer","catchTypesafe","InvalidIDPConfigurationError","OIDCInitData","IDPValidationError","initOIDCAuth","handleOIDCResponse","data","createHmac","IDPResponseError"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWA,MAAM,wBAAwBA,UAAAA;AAG9B,MAAM,uBAAuBC,oBAAS;AAAA,EACrCC,UAAAA;AAAAA,EACAD,oBAAS,OAAO;AAAA,IACf,cAAcA,oBAAS,OAAO;AAAA,MAC7B,aAAaA,oBAAS;AAAA,MACtB,eAAeA,oBAAS;AAAA,IAAA,CACxB;AAAA,EAAA,CACD;AACF;AACA,MAAM,0BAA0BA,oBAAS,OAAO;AAAA,EAC/C,SAASA,oBAAS;AAAA,EAClB,MAAMA,oBAAS;AAChB,CAAC;AAIM,MAAM,iBAA2E;AAAA,EAAjF,cAAA;AAGN,kBAAA,MAAQ,kBAAiB,IAAIE,oBAAO;AAAA,MACnC,QAAQ;AAAA,MACR,wBAAwB;AAAA,MACxB,UAAU;AAAA,MACV,0BAA0B;AAAA,QACzB;AAAA,QACA;AAAA,MAAA;AAAA,MAED,yBAAyB;AAAA,QACxB;AAAA,MAAA;AAAA,MAED,uCAAuC;AAAA,QACtC;AAAA,MAAA;AAAA,MAED,kBAAkB;AAAA,QACjB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MAAA;AAAA,MAED,gBAAgB;AAAA,IAAA,CAChB,CAAA;AAED,kBAAA,MAAA,yBAAwBC,QAAAA,cAAc,uBAAuBC,6BAAAA,4BAA4B,CAAA;AAAA,EAAA;AAAA,EAEzF,MAAa,SAAS,eAAsC,MAA2C;AACtG,UAAM,WAAWD,QAAAA,cAAcE,UAAAA,cAAcC,mBAAAA,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAMC,YAAAA,aAAa,QAAQ;AAAA,MACjC,OAAO,cAAc,SAAS,cAAc;AAAA,MAC5C,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAsC,MAAqC;AACvG,UAAM,eAAeJ,QAAAA,cAAc,sBAAsBG,mBAAAA,kBAAkB,EAAE,IAAI;AAEjF,QAAI,EAAE,kBAAkB,eAAe;AACtC,YAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,aAAO,MAAME,YAAAA,mBAAmB,QAAQ,YAAY;AAAA,IACrD,OAAO;AACN,YAAM,CAAC,KAAK,OAAO,IAAI,aAAa,aAAa,cAAc,MAAM,GAAG;AACxE,YAAMC,QAAON,QAAAA,cAAc,yBAAyBG,mBAAAA,kBAAkB,EAAE,KAAK,MAAM,OAAO,KAAK,SAAS,QAAQ,EAAE,SAAS,MAAM,CAAC,CAAC;AACnI,YAAM,OAAOI,OAAAA,WAAW,UAAU,cAAc,YAAY;AAC5D,YAAM,YAAY,KAAK,OAAO,OAAO,EAAE,OAAA;AACvC,YAAM,mBAAmB,UAAU,QAAQ,OAAO,KAAK,KAAK,QAAQ,CAAC,MAAM;AAC3E,UAAI,CAAC,kBAAkB;AACtB,cAAM,IAAIJ,mBAAAA,mBAAmB,mBAAmB;AAAA,MACjD;AACA,YAAM,MAAM,8BAA8BG,MAAK,OAAO,sCAAsC,aAAa,aAAa,WAAW;AACjI,YAAM,WAAW,MAAM,MAAM,GAAG;AAChC,UAAI,CAAC,SAAS,IAAI;AACjB,cAAM,IAAIE,iBAAAA,iBAAiB,+BAA+B,SAAS,MAAM,KAAK,MAAM,SAAS,KAAA,CAAM,EAAE;AAAA,MACtG;AACA,YAAM,UAAU,MAAM,SAAS,KAAA;AAE/B,aAAO;AAAA,QACN,oBAAoBF,MAAK;AAAA,QACzB,MAAM,QAAQ;AAAA,QACd,OAAO,QAAQ;AAAA,MAAA;AAAA,IAEjB;AAAA,EACD;AAAA,EAEA,uBAAuB,EAAE,cAAc,GAAG,UAAiE;AAC1G,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAuD;AACrF,WAAO,IAAI,KAAK,eAAe;AAAA,MAC9B;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe,cAAc;AAAA,QAC7B,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,MAAA;AAAA,MAEtD;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MAAA;AAAA,IACnF;AAAA,EAEF;AACD;;"}
+{"version":3,"file":"FacebookProvider.cjs","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/FacebookProvider.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { Client, Issuer } from 'openid-client'\nimport { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler.js'\nimport { IDPValidationError } from '../IDPValidationError.js'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError.js'\nimport { catchTypesafe } from './helpers.js'\nimport { BaseOIDCConfiguration, OIDCConfiguration, OIDCInitData, OIDCResponseData } from './OIDCTypes.js'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers.js'\nimport { createHmac } from 'node:crypto'\nimport { IDPResponseError } from '../IDPResponseError.js'\n\nconst FacebookConfiguration = BaseOIDCConfiguration\ntype FacebookConfiguration = ReturnType<typeof FacebookConfiguration>\n\nconst FacebookResponseData = Typesafe.union(\n\tOIDCResponseData,\n\tTypesafe.object({\n\t\tauthResponse: Typesafe.object({\n\t\t\taccessToken: Typesafe.string,\n\t\t\tsignedRequest: Typesafe.string,\n\t\t}),\n\t}),\n)\nconst FacebookResponsePayload = Typesafe.object({\n\tuser_id: Typesafe.string,\n\tcode: Typesafe.string,\n})\n\ntype FacebookResponseData = ReturnType<typeof FacebookResponseData>\n\nexport class FacebookProvider implements IdentityProviderHandler<FacebookConfiguration> {\n\t// based on https://www.facebook.com/.well-known/openid-configuration/\n\t// facebook .well-known endpoint does have \"token_endpoint\" field\n\tprivate facebookIssuer = new Issuer({\n\t\tissuer: 'https://www.facebook.com',\n\t\tauthorization_endpoint: 'https://facebook.com/dialog/oauth/',\n\t\tjwks_uri: 'https://www.facebook.com/.well-known/oauth/openid/jwks/',\n\t\tresponse_types_supported: [\n\t\t\t'id_token',\n\t\t\t'token id_token',\n\t\t],\n\t\tsubject_types_supported: [\n\t\t\t'pairwise',\n\t\t],\n\t\tid_token_signing_alg_values_supported: [\n\t\t\t'RS256',\n\t\t],\n\t\tclaims_supported: [\n\t\t\t'iss',\n\t\t\t'aud',\n\t\t\t'sub',\n\t\t\t'iat',\n\t\t\t'exp',\n\t\t\t'jti',\n\t\t\t'nonce',\n\t\t\t'at_hash',\n\t\t\t'name',\n\t\t\t'given_name',\n\t\t\t'middle_name',\n\t\t\t'family_name',\n\t\t\t'email',\n\t\t\t'picture',\n\t\t\t'user_friends',\n\t\t\t'user_birthday',\n\t\t\t'user_age_range',\n\t\t\t'user_link',\n\t\t\t'user_hometown',\n\t\t\t'user_location',\n\t\t\t'user_gender',\n\t\t],\n\t\ttoken_endpoint: 'https://graph.facebook.com/v11.0/oauth/access_token',\n\t})\n\n\tvalidateConfiguration = catchTypesafe(FacebookConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: FacebookConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tscope: configuration.scope ?? configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: FacebookConfiguration, data: unknown): Promise<IDPResponse> {\n\t\tconst responseData = catchTypesafe(FacebookResponseData, IDPValidationError)(data)\n\n\t\tif (!('authResponse' in responseData)) {\n\t\t\tconst client = await this.createOIDCClient(configuration)\n\t\t\treturn await handleOIDCResponse(client, responseData)\n\t\t} else {\n\t\t\tconst [sig, payload] = responseData.authResponse.signedRequest.split('.')\n\t\t\tconst data = catchTypesafe(FacebookResponsePayload, IDPValidationError)(JSON.parse(Buffer.from(payload, 'base64').toString('utf8')))\n\t\t\tconst hmac = createHmac('sha256', configuration.clientSecret)\n\t\t\tconst signature = hmac.update(payload).digest()\n\t\t\tconst isSignatureValid = signature.compare(Buffer.from(sig, 'base64')) === 0\n\t\t\tif (!isSignatureValid) {\n\t\t\t\tthrow new IDPValidationError('Invalid signature')\n\t\t\t}\n\t\t\tconst url = `https://graph.facebook.com/${data.user_id}?fields=id,email,name&access_token=${responseData.authResponse.accessToken}`\n\t\t\tconst response = await fetch(url)\n\t\t\tif (!response.ok) {\n\t\t\t\tthrow new IDPResponseError(`Invalid Facebook response: [${response.status}] ${await response.text()}`)\n\t\t\t}\n\t\t\tconst apiData = await response.json()\n\n\t\t\treturn {\n\t\t\t\texternalIdentifier: data.user_id,\n\t\t\t\tname: apiData.name,\n\t\t\t\temail: apiData.email,\n\t\t\t}\n\t\t}\n\t}\n\n\tgetPublicConfiguration({ clientSecret, ...config }: FacebookConfiguration): Partial<FacebookConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: FacebookConfiguration): Promise<Client> {\n\t\treturn new this.facebookIssuer.Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: configuration.clientSecret,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\t}\n}\n"],"names":["BaseOIDCConfiguration","Typesafe","OIDCResponseData","Issuer","catchTypesafe","InvalidIDPConfigurationError","OIDCInitData","IDPValidationError","initOIDCAuth","handleOIDCResponse","data","createHmac","IDPResponseError"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWA,MAAM,wBAAwBA,UAAAA;AAG9B,MAAM,uBAAuBC,oBAAS;AAAA,EACrCC,UAAAA;AAAAA,EACAD,oBAAS,OAAO;AAAA,IACf,cAAcA,oBAAS,OAAO;AAAA,MAC7B,aAAaA,oBAAS;AAAA,MACtB,eAAeA,oBAAS;AAAA,IAAA,CACxB;AAAA,EAAA,CACD;AACF;AACA,MAAM,0BAA0BA,oBAAS,OAAO;AAAA,EAC/C,SAASA,oBAAS;AAAA,EAClB,MAAMA,oBAAS;AAChB,CAAC;AAIM,MAAM,iBAA2E;AAAA,EAAjF,cAAA;AAGN,kBAAA,MAAQ,kBAAiB,IAAIE,oBAAO;AAAA,MACnC,QAAQ;AAAA,MACR,wBAAwB;AAAA,MACxB,UAAU;AAAA,MACV,0BAA0B;AAAA,QACzB;AAAA,QACA;AAAA,MAAA;AAAA,MAED,yBAAyB;AAAA,QACxB;AAAA,MAAA;AAAA,MAED,uCAAuC;AAAA,QACtC;AAAA,MAAA;AAAA,MAED,kBAAkB;AAAA,QACjB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MAAA;AAAA,MAED,gBAAgB;AAAA,IAAA,CAChB,CAAA;AAED,kBAAA,MAAA,yBAAwBC,QAAAA,cAAc,uBAAuBC,6BAAAA,4BAA4B,CAAA;AAAA,EAAA;AAAA,EAEzF,MAAa,SAAS,eAAsC,MAA2C;AACtG,UAAM,WAAWD,QAAAA,cAAcE,UAAAA,cAAcC,mBAAAA,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAMC,YAAAA,aAAa,QAAQ;AAAA,MACjC,OAAO,cAAc,SAAS,cAAc;AAAA,MAC5C,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAsC,MAAqC;AACvG,UAAM,eAAeJ,QAAAA,cAAc,sBAAsBG,mBAAAA,kBAAkB,EAAE,IAAI;AAEjF,QAAI,EAAE,kBAAkB,eAAe;AACtC,YAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,aAAO,MAAME,YAAAA,mBAAmB,QAAQ,YAAY;AAAA,IACrD,OAAO;AACN,YAAM,CAAC,KAAK,OAAO,IAAI,aAAa,aAAa,cAAc,MAAM,GAAG;AACxE,YAAMC,QAAON,QAAAA,cAAc,yBAAyBG,mBAAAA,kBAAkB,EAAE,KAAK,MAAM,OAAO,KAAK,SAAS,QAAQ,EAAE,SAAS,MAAM,CAAC,CAAC;AACnI,YAAM,OAAOI,OAAAA,WAAW,UAAU,cAAc,YAAY;AAC5D,YAAM,YAAY,KAAK,OAAO,OAAO,EAAE,OAAA;AACvC,YAAM,mBAAmB,UAAU,QAAQ,OAAO,KAAK,KAAK,QAAQ,CAAC,MAAM;AAC3E,UAAI,CAAC,kBAAkB;AACtB,cAAM,IAAIJ,mBAAAA,mBAAmB,mBAAmB;AAAA,MACjD;AACA,YAAM,MAAM,8BAA8BG,MAAK,OAAO,sCAAsC,aAAa,aAAa,WAAW;AACjI,YAAM,WAAW,MAAM,MAAM,GAAG;AAChC,UAAI,CAAC,SAAS,IAAI;AACjB,cAAM,IAAIE,iBAAAA,iBAAiB,+BAA+B,SAAS,MAAM,KAAK,MAAM,SAAS,KAAA,CAAM,EAAE;AAAA,MACtG;AACA,YAAM,UAAU,MAAM,SAAS,KAAA;AAE/B,aAAO;AAAA,QACN,oBAAoBF,MAAK;AAAA,QACzB,MAAM,QAAQ;AAAA,QACd,OAAO,QAAQ;AAAA,MAAA;AAAA,IAEjB;AAAA,EACD;AAAA,EAEA,uBAAuB,EAAE,cAAc,GAAG,UAAiE;AAC1G,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAuD;AACrF,WAAO,IAAI,KAAK,eAAe;AAAA,MAC9B;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe,cAAc;AAAA,QAC7B,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,MAAA;AAAA,MAEtD;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MAAA;AAAA,IACnF;AAAA,EAEF;AACD;;"}

package/dist/production/src/model/service/idp/providers/FacebookProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"FacebookProvider.js","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/FacebookProvider.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { Client, Issuer } from 'openid-client'\nimport { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'\nimport { IDPValidationError } from '../IDPValidationError'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'\nimport { catchTypesafe } from './helpers'\nimport { BaseOIDCConfiguration, OIDCConfiguration, OIDCInitData, OIDCResponseData } from './OIDCTypes'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers'\nimport { createHmac } from 'node:crypto'\nimport { IDPResponseError } from '../IDPResponseError'\n\nconst FacebookConfiguration = BaseOIDCConfiguration\ntype FacebookConfiguration = ReturnType<typeof FacebookConfiguration>\n\nconst FacebookResponseData = Typesafe.union(\n\tOIDCResponseData,\n\tTypesafe.object({\n\t\tauthResponse: Typesafe.object({\n\t\t\taccessToken: Typesafe.string,\n\t\t\tsignedRequest: Typesafe.string,\n\t\t}),\n\t}),\n)\nconst FacebookResponsePayload = Typesafe.object({\n\tuser_id: Typesafe.string,\n\tcode: Typesafe.string,\n})\n\ntype FacebookResponseData = ReturnType<typeof FacebookResponseData>\n\nexport class FacebookProvider implements IdentityProviderHandler<FacebookConfiguration> {\n\t// based on https://www.facebook.com/.well-known/openid-configuration/\n\t// facebook .well-known endpoint does have \"token_endpoint\" field\n\tprivate facebookIssuer = new Issuer({\n\t\tissuer: 'https://www.facebook.com',\n\t\tauthorization_endpoint: 'https://facebook.com/dialog/oauth/',\n\t\tjwks_uri: 'https://www.facebook.com/.well-known/oauth/openid/jwks/',\n\t\tresponse_types_supported: [\n\t\t\t'id_token',\n\t\t\t'token id_token',\n\t\t],\n\t\tsubject_types_supported: [\n\t\t\t'pairwise',\n\t\t],\n\t\tid_token_signing_alg_values_supported: [\n\t\t\t'RS256',\n\t\t],\n\t\tclaims_supported: [\n\t\t\t'iss',\n\t\t\t'aud',\n\t\t\t'sub',\n\t\t\t'iat',\n\t\t\t'exp',\n\t\t\t'jti',\n\t\t\t'nonce',\n\t\t\t'at_hash',\n\t\t\t'name',\n\t\t\t'given_name',\n\t\t\t'middle_name',\n\t\t\t'family_name',\n\t\t\t'email',\n\t\t\t'picture',\n\t\t\t'user_friends',\n\t\t\t'user_birthday',\n\t\t\t'user_age_range',\n\t\t\t'user_link',\n\t\t\t'user_hometown',\n\t\t\t'user_location',\n\t\t\t'user_gender',\n\t\t],\n\t\ttoken_endpoint: 'https://graph.facebook.com/v11.0/oauth/access_token',\n\t})\n\n\tvalidateConfiguration = catchTypesafe(FacebookConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: FacebookConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tscope: configuration.scope ?? configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: FacebookConfiguration, data: unknown): Promise<IDPResponse> {\n\t\tconst responseData = catchTypesafe(FacebookResponseData, IDPValidationError)(data)\n\n\t\tif (!('authResponse' in responseData)) {\n\t\t\tconst client = await this.createOIDCClient(configuration)\n\t\t\treturn await handleOIDCResponse(client, responseData)\n\t\t} else {\n\t\t\tconst [sig, payload] = responseData.authResponse.signedRequest.split('.')\n\t\t\tconst data = catchTypesafe(FacebookResponsePayload, IDPValidationError)(JSON.parse(Buffer.from(payload, 'base64').toString('utf8')))\n\t\t\tconst hmac = createHmac('sha256', configuration.clientSecret)\n\t\t\tconst signature = hmac.update(payload).digest()\n\t\t\tconst isSignatureValid = signature.compare(Buffer.from(sig, 'base64')) === 0\n\t\t\tif (!isSignatureValid) {\n\t\t\t\tthrow new IDPValidationError('Invalid signature')\n\t\t\t}\n\t\t\tconst url = `https://graph.facebook.com/${data.user_id}?fields=id,email,name&access_token=${responseData.authResponse.accessToken}`\n\t\t\tconst response = await fetch(url)\n\t\t\tif (!response.ok) {\n\t\t\t\tthrow new IDPResponseError(`Invalid Facebook response: [${response.status}] ${await response.text()}`)\n\t\t\t}\n\t\t\tconst apiData = await response.json()\n\n\t\t\treturn {\n\t\t\t\texternalIdentifier: data.user_id,\n\t\t\t\tname: apiData.name,\n\t\t\t\temail: apiData.email,\n\t\t\t}\n\t\t}\n\t}\n\n\tgetPublicConfiguration({ clientSecret, ...config }: FacebookConfiguration): Partial<FacebookConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: FacebookConfiguration): Promise<Client> {\n\t\treturn new this.facebookIssuer.Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: configuration.clientSecret,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\t}\n}\n"],"names":["data"],"mappings":";;;;;;;;;;;;AAWA,MAAM,wBAAwB;AAG9B,MAAM,uBAAuB,SAAS;AAAA,EACrC;AAAA,EACA,SAAS,OAAO;AAAA,IACf,cAAc,SAAS,OAAO;AAAA,MAC7B,aAAa,SAAS;AAAA,MACtB,eAAe,SAAS;AAAA,IAAA,CACxB;AAAA,EAAA,CACD;AACF;AACA,MAAM,0BAA0B,SAAS,OAAO;AAAA,EAC/C,SAAS,SAAS;AAAA,EAClB,MAAM,SAAS;AAChB,CAAC;AAIM,MAAM,iBAA2E;AAAA,EAAjF,cAAA;AAGN,kBAAA,MAAQ,kBAAiB,IAAI,OAAO;AAAA,MACnC,QAAQ;AAAA,MACR,wBAAwB;AAAA,MACxB,UAAU;AAAA,MACV,0BAA0B;AAAA,QACzB;AAAA,QACA;AAAA,MAAA;AAAA,MAED,yBAAyB;AAAA,QACxB;AAAA,MAAA;AAAA,MAED,uCAAuC;AAAA,QACtC;AAAA,MAAA;AAAA,MAED,kBAAkB;AAAA,QACjB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MAAA;AAAA,MAED,gBAAgB;AAAA,IAAA,CAChB,CAAA;AAED,kBAAA,MAAA,yBAAwB,cAAc,uBAAuB,4BAA4B,CAAA;AAAA,EAAA;AAAA,EAEzF,MAAa,SAAS,eAAsC,MAA2C;AACtG,UAAM,WAAW,cAAc,cAAc,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAM,aAAa,QAAQ;AAAA,MACjC,OAAO,cAAc,SAAS,cAAc;AAAA,MAC5C,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAsC,MAAqC;AACvG,UAAM,eAAe,cAAc,sBAAsB,kBAAkB,EAAE,IAAI;AAEjF,QAAI,EAAE,kBAAkB,eAAe;AACtC,YAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,aAAO,MAAM,mBAAmB,QAAQ,YAAY;AAAA,IACrD,OAAO;AACN,YAAM,CAAC,KAAK,OAAO,IAAI,aAAa,aAAa,cAAc,MAAM,GAAG;AACxE,YAAMA,QAAO,cAAc,yBAAyB,kBAAkB,EAAE,KAAK,MAAM,OAAO,KAAK,SAAS,QAAQ,EAAE,SAAS,MAAM,CAAC,CAAC;AACnI,YAAM,OAAO,WAAW,UAAU,cAAc,YAAY;AAC5D,YAAM,YAAY,KAAK,OAAO,OAAO,EAAE,OAAA;AACvC,YAAM,mBAAmB,UAAU,QAAQ,OAAO,KAAK,KAAK,QAAQ,CAAC,MAAM;AAC3E,UAAI,CAAC,kBAAkB;AACtB,cAAM,IAAI,mBAAmB,mBAAmB;AAAA,MACjD;AACA,YAAM,MAAM,8BAA8BA,MAAK,OAAO,sCAAsC,aAAa,aAAa,WAAW;AACjI,YAAM,WAAW,MAAM,MAAM,GAAG;AAChC,UAAI,CAAC,SAAS,IAAI;AACjB,cAAM,IAAI,iBAAiB,+BAA+B,SAAS,MAAM,KAAK,MAAM,SAAS,KAAA,CAAM,EAAE;AAAA,MACtG;AACA,YAAM,UAAU,MAAM,SAAS,KAAA;AAE/B,aAAO;AAAA,QACN,oBAAoBA,MAAK;AAAA,QACzB,MAAM,QAAQ;AAAA,QACd,OAAO,QAAQ;AAAA,MAAA;AAAA,IAEjB;AAAA,EACD;AAAA,EAEA,uBAAuB,EAAE,cAAc,GAAG,UAAiE;AAC1G,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAuD;AACrF,WAAO,IAAI,KAAK,eAAe;AAAA,MAC9B;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe,cAAc;AAAA,QAC7B,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,MAAA;AAAA,MAEtD;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MAAA;AAAA,IACnF;AAAA,EAEF;AACD;"}
+{"version":3,"file":"FacebookProvider.js","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/FacebookProvider.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { Client, Issuer } from 'openid-client'\nimport { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler.js'\nimport { IDPValidationError } from '../IDPValidationError.js'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError.js'\nimport { catchTypesafe } from './helpers.js'\nimport { BaseOIDCConfiguration, OIDCConfiguration, OIDCInitData, OIDCResponseData } from './OIDCTypes.js'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers.js'\nimport { createHmac } from 'node:crypto'\nimport { IDPResponseError } from '../IDPResponseError.js'\n\nconst FacebookConfiguration = BaseOIDCConfiguration\ntype FacebookConfiguration = ReturnType<typeof FacebookConfiguration>\n\nconst FacebookResponseData = Typesafe.union(\n\tOIDCResponseData,\n\tTypesafe.object({\n\t\tauthResponse: Typesafe.object({\n\t\t\taccessToken: Typesafe.string,\n\t\t\tsignedRequest: Typesafe.string,\n\t\t}),\n\t}),\n)\nconst FacebookResponsePayload = Typesafe.object({\n\tuser_id: Typesafe.string,\n\tcode: Typesafe.string,\n})\n\ntype FacebookResponseData = ReturnType<typeof FacebookResponseData>\n\nexport class FacebookProvider implements IdentityProviderHandler<FacebookConfiguration> {\n\t// based on https://www.facebook.com/.well-known/openid-configuration/\n\t// facebook .well-known endpoint does have \"token_endpoint\" field\n\tprivate facebookIssuer = new Issuer({\n\t\tissuer: 'https://www.facebook.com',\n\t\tauthorization_endpoint: 'https://facebook.com/dialog/oauth/',\n\t\tjwks_uri: 'https://www.facebook.com/.well-known/oauth/openid/jwks/',\n\t\tresponse_types_supported: [\n\t\t\t'id_token',\n\t\t\t'token id_token',\n\t\t],\n\t\tsubject_types_supported: [\n\t\t\t'pairwise',\n\t\t],\n\t\tid_token_signing_alg_values_supported: [\n\t\t\t'RS256',\n\t\t],\n\t\tclaims_supported: [\n\t\t\t'iss',\n\t\t\t'aud',\n\t\t\t'sub',\n\t\t\t'iat',\n\t\t\t'exp',\n\t\t\t'jti',\n\t\t\t'nonce',\n\t\t\t'at_hash',\n\t\t\t'name',\n\t\t\t'given_name',\n\t\t\t'middle_name',\n\t\t\t'family_name',\n\t\t\t'email',\n\t\t\t'picture',\n\t\t\t'user_friends',\n\t\t\t'user_birthday',\n\t\t\t'user_age_range',\n\t\t\t'user_link',\n\t\t\t'user_hometown',\n\t\t\t'user_location',\n\t\t\t'user_gender',\n\t\t],\n\t\ttoken_endpoint: 'https://graph.facebook.com/v11.0/oauth/access_token',\n\t})\n\n\tvalidateConfiguration = catchTypesafe(FacebookConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: FacebookConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tscope: configuration.scope ?? configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: FacebookConfiguration, data: unknown): Promise<IDPResponse> {\n\t\tconst responseData = catchTypesafe(FacebookResponseData, IDPValidationError)(data)\n\n\t\tif (!('authResponse' in responseData)) {\n\t\t\tconst client = await this.createOIDCClient(configuration)\n\t\t\treturn await handleOIDCResponse(client, responseData)\n\t\t} else {\n\t\t\tconst [sig, payload] = responseData.authResponse.signedRequest.split('.')\n\t\t\tconst data = catchTypesafe(FacebookResponsePayload, IDPValidationError)(JSON.parse(Buffer.from(payload, 'base64').toString('utf8')))\n\t\t\tconst hmac = createHmac('sha256', configuration.clientSecret)\n\t\t\tconst signature = hmac.update(payload).digest()\n\t\t\tconst isSignatureValid = signature.compare(Buffer.from(sig, 'base64')) === 0\n\t\t\tif (!isSignatureValid) {\n\t\t\t\tthrow new IDPValidationError('Invalid signature')\n\t\t\t}\n\t\t\tconst url = `https://graph.facebook.com/${data.user_id}?fields=id,email,name&access_token=${responseData.authResponse.accessToken}`\n\t\t\tconst response = await fetch(url)\n\t\t\tif (!response.ok) {\n\t\t\t\tthrow new IDPResponseError(`Invalid Facebook response: [${response.status}] ${await response.text()}`)\n\t\t\t}\n\t\t\tconst apiData = await response.json()\n\n\t\t\treturn {\n\t\t\t\texternalIdentifier: data.user_id,\n\t\t\t\tname: apiData.name,\n\t\t\t\temail: apiData.email,\n\t\t\t}\n\t\t}\n\t}\n\n\tgetPublicConfiguration({ clientSecret, ...config }: FacebookConfiguration): Partial<FacebookConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: FacebookConfiguration): Promise<Client> {\n\t\treturn new this.facebookIssuer.Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: configuration.clientSecret,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\t}\n}\n"],"names":["data"],"mappings":";;;;;;;;;;;;AAWA,MAAM,wBAAwB;AAG9B,MAAM,uBAAuB,SAAS;AAAA,EACrC;AAAA,EACA,SAAS,OAAO;AAAA,IACf,cAAc,SAAS,OAAO;AAAA,MAC7B,aAAa,SAAS;AAAA,MACtB,eAAe,SAAS;AAAA,IAAA,CACxB;AAAA,EAAA,CACD;AACF;AACA,MAAM,0BAA0B,SAAS,OAAO;AAAA,EAC/C,SAAS,SAAS;AAAA,EAClB,MAAM,SAAS;AAChB,CAAC;AAIM,MAAM,iBAA2E;AAAA,EAAjF,cAAA;AAGN,kBAAA,MAAQ,kBAAiB,IAAI,OAAO;AAAA,MACnC,QAAQ;AAAA,MACR,wBAAwB;AAAA,MACxB,UAAU;AAAA,MACV,0BAA0B;AAAA,QACzB;AAAA,QACA;AAAA,MAAA;AAAA,MAED,yBAAyB;AAAA,QACxB;AAAA,MAAA;AAAA,MAED,uCAAuC;AAAA,QACtC;AAAA,MAAA;AAAA,MAED,kBAAkB;AAAA,QACjB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MAAA;AAAA,MAED,gBAAgB;AAAA,IAAA,CAChB,CAAA;AAED,kBAAA,MAAA,yBAAwB,cAAc,uBAAuB,4BAA4B,CAAA;AAAA,EAAA;AAAA,EAEzF,MAAa,SAAS,eAAsC,MAA2C;AACtG,UAAM,WAAW,cAAc,cAAc,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAM,aAAa,QAAQ;AAAA,MACjC,OAAO,cAAc,SAAS,cAAc;AAAA,MAC5C,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAsC,MAAqC;AACvG,UAAM,eAAe,cAAc,sBAAsB,kBAAkB,EAAE,IAAI;AAEjF,QAAI,EAAE,kBAAkB,eAAe;AACtC,YAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,aAAO,MAAM,mBAAmB,QAAQ,YAAY;AAAA,IACrD,OAAO;AACN,YAAM,CAAC,KAAK,OAAO,IAAI,aAAa,aAAa,cAAc,MAAM,GAAG;AACxE,YAAMA,QAAO,cAAc,yBAAyB,kBAAkB,EAAE,KAAK,MAAM,OAAO,KAAK,SAAS,QAAQ,EAAE,SAAS,MAAM,CAAC,CAAC;AACnI,YAAM,OAAO,WAAW,UAAU,cAAc,YAAY;AAC5D,YAAM,YAAY,KAAK,OAAO,OAAO,EAAE,OAAA;AACvC,YAAM,mBAAmB,UAAU,QAAQ,OAAO,KAAK,KAAK,QAAQ,CAAC,MAAM;AAC3E,UAAI,CAAC,kBAAkB;AACtB,cAAM,IAAI,mBAAmB,mBAAmB;AAAA,MACjD;AACA,YAAM,MAAM,8BAA8BA,MAAK,OAAO,sCAAsC,aAAa,aAAa,WAAW;AACjI,YAAM,WAAW,MAAM,MAAM,GAAG;AAChC,UAAI,CAAC,SAAS,IAAI;AACjB,cAAM,IAAI,iBAAiB,+BAA+B,SAAS,MAAM,KAAK,MAAM,SAAS,KAAA,CAAM,EAAE;AAAA,MACtG;AACA,YAAM,UAAU,MAAM,SAAS,KAAA;AAE/B,aAAO;AAAA,QACN,oBAAoBA,MAAK;AAAA,QACzB,MAAM,QAAQ;AAAA,QACd,OAAO,QAAQ;AAAA,MAAA;AAAA,IAEjB;AAAA,EACD;AAAA,EAEA,uBAAuB,EAAE,cAAc,GAAG,UAAiE;AAC1G,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAuD;AACrF,WAAO,IAAI,KAAK,eAAe;AAAA,MAC9B;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe,cAAc;AAAA,QAC7B,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,MAAA;AAAA,MAEtD;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MAAA;AAAA,IACnF;AAAA,EAEF;AACD;"}

package/dist/production/src/model/service/idp/providers/OIDCHelpers.cjs

@@ -1,8 +1,22 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const openidClient = require("openid-client");
+const jose = require("jose");
 const IDPValidationError = require("../IDPValidationError.cjs");
 const IDPResponseError = require("../IDPResponseError.cjs");
+const tokenSetToSessionState = (tokenSet, sessionId, prevTokens) => {
+  const refreshToken = tokenSet.refresh_token ?? (typeof prevTokens?.refresh_token === "string" ? prevTokens.refresh_token : void 0);
+  const idToken = tokenSet.id_token ?? (typeof prevTokens?.id_token === "string" ? prevTokens.id_token : void 0);
+  return {
+    sessionId,
+    tokens: {
+      ...refreshToken ? { refresh_token: refreshToken } : {},
+      ...tokenSet.access_token ? { access_token: tokenSet.access_token } : {},
+      ...idToken ? { id_token: idToken } : {}
+    },
+    expiresAt: tokenSet.expires_at ? new Date(tokenSet.expires_at * 1e3) : void 0
+  };
+};
 const initOIDCAuth = async (client, { redirectUrl, scope, responseMode }) => {
   const nonce = openidClient.generators.nonce();
   const state = openidClient.generators.state();
@@ -18,7 +32,58 @@ const initOIDCAuth = async (client, { redirectUrl, scope, responseMode }) => {
     sessionData: { nonce, state }
   };
 };
-const handleOIDCResponse = async (client, { sessionData, redirectUrl, ...otherData }, fetchUserInfo, returnOIDCResult) => {
+const getClaim = (source, path) => path.split(".").reduce(
+  (acc, key) => acc != null && typeof acc === "object" && Object.prototype.hasOwnProperty.call(acc, key) ? acc[key] : void 0,
+  source
+);
+const liftNestedClaims = (source, attributesKey) => {
+  if (!attributesKey) {
+    return source;
+  }
+  const nested = Object.prototype.hasOwnProperty.call(source, attributesKey) ? source[attributesKey] : void 0;
+  if (nested !== null && typeof nested === "object" && !Array.isArray(nested)) {
+    return { ...nested, ...source };
+  }
+  return source;
+};
+const normalizeClaims = (rawSource, claimMapping, subFallback) => {
+  const source = liftNestedClaims(rawSource, claimMapping?.attributesKey);
+  const rawEmailVerified = source.email_verified;
+  const emailVerified = rawEmailVerified === true || rawEmailVerified === "true";
+  const mappedSubject = getClaim(source, claimMapping?.externalIdentifier ?? "sub");
+  let externalIdentifier;
+  if (mappedSubject === void 0 || mappedSubject === null) {
+    externalIdentifier = subFallback ?? "";
+  } else if (typeof mappedSubject === "string" || typeof mappedSubject === "number") {
+    externalIdentifier = String(mappedSubject);
+  } else {
+    throw new IDPValidationError.IDPValidationError(`The mapped externalIdentifier claim is not a scalar value`);
+  }
+  if (externalIdentifier === "") {
+    throw new IDPValidationError.IDPValidationError(`The mapped externalIdentifier claim resolved to an empty value`);
+  }
+  const email = getClaim(source, claimMapping?.email ?? "email");
+  const name = resolveName(source, claimMapping);
+  return {
+    ...source,
+    externalIdentifier,
+    email: typeof email === "string" ? email : void 0,
+    name,
+    emailVerified
+  };
+};
+const resolveName = (source, claimMapping) => {
+  const mapped = getClaim(source, claimMapping?.name ?? "name");
+  if (typeof mapped === "string" && mapped.trim() !== "") {
+    return mapped;
+  }
+  if (claimMapping?.name !== void 0) {
+    return void 0;
+  }
+  const parts = [getClaim(source, "given_name"), getClaim(source, "family_name")].filter((part) => typeof part === "string" && part.trim() !== "").map((part) => part.trim());
+  return parts.length > 0 ? parts.join(" ") : void 0;
+};
+const handleOIDCResponse = async (client, { sessionData, redirectUrl, ...otherData }, { fetchUserInfo, returnOIDCResult, captureSession, claimMapping } = {}) => {
   const params = "parameters" in otherData ? otherData.parameters : client.callbackParams(otherData.url);
   if (params.state && !sessionData?.state) {
     throw new IDPValidationError.IDPValidationError(`state is present in parameters, but missing in session data`);
@@ -29,11 +94,12 @@ const handleOIDCResponse = async (client, { sessionData, redirectUrl, ...otherDa
     const { at_hash, c_hash, nonce, ...claimsWithoutHashes } = claims;
     const userInfo = result.access_token && fetchUserInfo ? await client.userinfo(result) : {};
     const oidcResult = returnOIDCResult ? result : {};
+    const idpSession = captureSession ? tokenSetToSessionState(result, typeof claims.sid === "string" ? claims.sid : void 0) : void 0;
+    const normalized = normalizeClaims({ ...claimsWithoutHashes, ...userInfo }, claimMapping, claims.sub);
     return {
-      externalIdentifier: claims.sub,
       ...oidcResult,
-      ...claimsWithoutHashes,
-      ...userInfo
+      ...normalized,
+      ...idpSession ? { idpSession } : {}
     };
   } catch (e) {
     if (e instanceof openidClient.errors.RPError) {
@@ -49,6 +115,143 @@ const handleOIDCResponse = async (client, { sessionData, redirectUrl, ...otherDa
     throw e;
   }
 };
+const REVOKED_OIDC_ERRORS = /* @__PURE__ */ new Set(["invalid_grant", "invalid_token", "expired_token"]);
+const revalidateOIDC = async (client, method, session, options = {}) => {
+  const { claimMapping, fetchUserInfo } = options;
+  const tokens = session.tokens ?? {};
+  const refreshToken = typeof tokens.refresh_token === "string" ? tokens.refresh_token : void 0;
+  const accessToken = typeof tokens.access_token === "string" ? tokens.access_token : void 0;
+  try {
+    if (method === "refresh") {
+      if (!refreshToken) {
+        return { status: "revoked", reason: "no_refresh_token" };
+      }
+      const tokenSet = await client.refresh(refreshToken);
+      let claims;
+      let claimsComplete = false;
+      try {
+        if (tokenSet.id_token) {
+          const idClaims = tokenSet.claims();
+          const userInfo = tokenSet.access_token && fetchUserInfo ? await client.userinfo(tokenSet) : {};
+          claims = normalizeClaims({ ...idClaims, ...userInfo }, claimMapping, typeof idClaims.sub === "string" ? idClaims.sub : void 0);
+          claimsComplete = true;
+        }
+      } catch {
+        claims = void 0;
+        claimsComplete = false;
+      }
+      return {
+        status: "valid",
+        claims,
+        claimsComplete,
+        // carry the stored tokens forward: a non-rotating IdP omits the refresh token here
+        idpSession: tokenSetToSessionState(tokenSet, session.sessionId, tokens)
+      };
+    }
+    if (method === "userinfo") {
+      if (!accessToken) {
+        return { status: "revoked", reason: "no_access_token" };
+      }
+      const userInfo = await client.userinfo(accessToken);
+      let claims;
+      try {
+        claims = normalizeClaims(userInfo, claimMapping, typeof userInfo.sub === "string" ? userInfo.sub : void 0);
+      } catch {
+        claims = void 0;
+      }
+      return { status: "valid", claims, claimsComplete: false };
+    }
+    const token = accessToken ?? refreshToken;
+    if (!token) {
+      return { status: "revoked", reason: "no_token" };
+    }
+    const result = await client.introspect(token, accessToken ? "access_token" : "refresh_token");
+    if (!result.active) {
+      return { status: "revoked", reason: "inactive" };
+    }
+    return { status: "valid" };
+  } catch (e) {
+    if (e instanceof openidClient.errors.OPError) {
+      if (typeof e.error === "string" && REVOKED_OIDC_ERRORS.has(e.error)) {
+        return { status: "revoked", reason: e.error };
+      }
+      if (method === "userinfo" && e.response?.statusCode === 401) {
+        return { status: "revoked", reason: "userinfo_unauthorized" };
+      }
+    }
+    throw e;
+  }
+};
+const buildOIDCLogoutUrl = (client, { idToken, postLogoutRedirectUri }) => {
+  if (!client.issuer.metadata.end_session_endpoint) {
+    return null;
+  }
+  return client.endSessionUrl({
+    ...idToken ? { id_token_hint: idToken } : {},
+    ...postLogoutRedirectUri ? { post_logout_redirect_uri: postLogoutRedirectUri } : {}
+  });
+};
+const BACKCHANNEL_LOGOUT_EVENT = "http://schemas.openid.net/event/backchannel-logout";
+const LOGOUT_TOKEN_MAX_AGE_SECONDS = 120;
+const LOGOUT_TOKEN_CLOCK_TOLERANCE_SECONDS = 5;
+const remoteJwksCache = /* @__PURE__ */ new Map();
+const getRemoteJwks = (jwksUri) => {
+  let jwks = remoteJwksCache.get(jwksUri);
+  if (!jwks) {
+    jwks = jose.createRemoteJWKSet(new URL(jwksUri));
+    remoteJwksCache.set(jwksUri, jwks);
+  }
+  return jwks;
+};
+const validateOIDCLogoutToken = async (client, issuer, logoutToken) => {
+  const jwksUri = issuer.metadata.jwks_uri;
+  if (!jwksUri) {
+    throw new IDPValidationError.IDPValidationError("IdP has no jwks_uri; cannot verify logout token");
+  }
+  const clientId = client.metadata.client_id;
+  if (typeof clientId !== "string" || clientId === "") {
+    throw new IDPValidationError.IDPValidationError("cannot verify logout token audience: client_id is missing");
+  }
+  const expectedAlg = typeof client.metadata.id_token_signed_response_alg === "string" ? client.metadata.id_token_signed_response_alg : "RS256";
+  const jwks = getRemoteJwks(jwksUri);
+  let payload;
+  try {
+    const verified = await jose.jwtVerify(logoutToken, jwks, {
+      issuer: issuer.metadata.issuer,
+      audience: clientId,
+      // pin to the provider's configured signing alg so a JWKS containing a symmetric/none key
+      // can never be selected (defence-in-depth on top of jose's own key-type check).
+      algorithms: [expectedAlg],
+      // §2.4: `iat` and `exp` are REQUIRED. `maxTokenAge` makes `iat` required + bounds freshness;
+      // `requiredClaims` makes `exp` required (jose only checks `exp` when present).
+      maxTokenAge: LOGOUT_TOKEN_MAX_AGE_SECONDS,
+      requiredClaims: ["exp"],
+      clockTolerance: LOGOUT_TOKEN_CLOCK_TOLERANCE_SECONDS
+    });
+    payload = verified.payload;
+  } catch (e) {
+    throw new IDPValidationError.IDPValidationError(`Invalid logout token: ${e?.message ?? "verification failed"}`);
+  }
+  if ("nonce" in payload) {
+    throw new IDPValidationError.IDPValidationError("Logout token must not contain a nonce");
+  }
+  const events = payload.events;
+  const hasLogoutEvent = typeof events === "object" && events !== null && BACKCHANNEL_LOGOUT_EVENT in events;
+  if (!hasLogoutEvent) {
+    throw new IDPValidationError.IDPValidationError("Logout token is missing the back-channel-logout event");
+  }
+  const sid = typeof payload.sid === "string" ? payload.sid : void 0;
+  const sub = typeof payload.sub === "string" ? payload.sub : void 0;
+  if (!sid && !sub) {
+    throw new IDPValidationError.IDPValidationError("Logout token must contain a sid or sub claim");
+  }
+  return { sid, sub };
+};
+exports.buildOIDCLogoutUrl = buildOIDCLogoutUrl;
 exports.handleOIDCResponse = handleOIDCResponse;
 exports.initOIDCAuth = initOIDCAuth;
+exports.liftNestedClaims = liftNestedClaims;
+exports.revalidateOIDC = revalidateOIDC;
+exports.tokenSetToSessionState = tokenSetToSessionState;
+exports.validateOIDCLogoutToken = validateOIDCLogoutToken;
 //# sourceMappingURL=OIDCHelpers.cjs.map

package/dist/production/src/model/service/idp/providers/OIDCHelpers.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"OIDCHelpers.cjs","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCHelpers.ts"],"sourcesContent":["import { Client, custom, errors, generators } from 'openid-client'\nimport { OIDCResponseData } from './OIDCTypes'\nimport { IDPValidationError } from '../IDPValidationError'\nimport { IDPResponseError } from '../IDPResponseError'\nimport { IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'\n\nexport const initOIDCAuth = async (\n\tclient: Client,\n\t{ redirectUrl, scope, responseMode }: { redirectUrl: string; scope?: string; responseMode?: string },\n): Promise<InitIDPAuthResult> => {\n\tconst nonce = generators.nonce()\n\tconst state = generators.state()\n\tconst url = client.authorizationUrl({\n\t\tredirect_uri: redirectUrl,\n\t\tresponse_mode: responseMode,\n\t\tscope: scope ?? 'openid email',\n\t\tnonce,\n\t\tstate,\n\t})\n\n\treturn {\n\t\tauthUrl: url,\n\t\tsessionData: { nonce, state },\n\t}\n}\n\nexport const handleOIDCResponse = async (\n\tclient: Client,\n\t{ sessionData, redirectUrl, ...otherData }: OIDCResponseData,\n\tfetchUserInfo?: boolean,\n\treturnOIDCResult?: boolean,\n): Promise<IDPResponse> => {\n\tconst params = 'parameters' in otherData ? otherData.parameters : client.callbackParams(otherData.url)\n\tif (params.state && !sessionData?.state) {\n\t\tthrow new IDPValidationError(`state is present in parameters, but missing in session data`)\n\t}\n\ttry {\n\t\tconst result = await client.callback(redirectUrl, params, sessionData)\n\t\tconst claims = result.claims()\n\t\tconst { at_hash, c_hash, nonce, ...claimsWithoutHashes } = claims\n\t\tconst userInfo = result.access_token && fetchUserInfo ? await client.userinfo(result) : {}\n\t\tconst oidcResult = returnOIDCResult ? result : {}\n\n\t\treturn {\n\t\t\texternalIdentifier: claims.sub,\n\t\t\t...oidcResult,\n\t\t\t...claimsWithoutHashes,\n\t\t\t...userInfo,\n\t\t}\n\t} catch (e: any) {\n\t\tif (e instanceof errors.RPError) {\n\t\t\tthrow new IDPValidationError(e.message)\n\t\t}\n\t\tif (e instanceof errors.OPError) {\n\t\t\tconst body = e.response?.body as any\n\t\t\tif (typeof body === 'object' && typeof body?.error === 'object' && typeof body.error?.message === 'string') {\n\t\t\t\tthrow new IDPResponseError(body.error.message)\n\t\t\t}\n\t\t\tthrow new IDPResponseError(e.message)\n\t\t}\n\t\tthrow e\n\t}\n}\n"],"names":["generators","IDPValidationError","errors","IDPResponseError"],"mappings":";;;;;AAMO,MAAM,eAAe,OAC3B,QACA,EAAE,aAAa,OAAO,mBACU;AAChC,QAAM,QAAQA,aAAAA,WAAW,MAAA;AACzB,QAAM,QAAQA,aAAAA,WAAW,MAAA;AACzB,QAAM,MAAM,OAAO,iBAAiB;AAAA,IACnC,cAAc;AAAA,IACd,eAAe;AAAA,IACf,OAAO,SAAS;AAAA,IAChB;AAAA,IACA;AAAA,EAAA,CACA;AAED,SAAO;AAAA,IACN,SAAS;AAAA,IACT,aAAa,EAAE,OAAO,MAAA;AAAA,EAAM;AAE9B;AAEO,MAAM,qBAAqB,OACjC,QACA,EAAE,aAAa,aAAa,GAAG,UAAA,GAC/B,eACA,qBAC0B;AAC1B,QAAM,SAAS,gBAAgB,YAAY,UAAU,aAAa,OAAO,eAAe,UAAU,GAAG;AACrG,MAAI,OAAO,SAAS,CAAC,aAAa,OAAO;AACxC,UAAM,IAAIC,mBAAAA,mBAAmB,6DAA6D;AAAA,EAC3F;AACA,MAAI;AACH,UAAM,SAAS,MAAM,OAAO,SAAS,aAAa,QAAQ,WAAW;AACrE,UAAM,SAAS,OAAO,OAAA;AACtB,UAAM,EAAE,SAAS,QAAQ,OAAO,GAAG,wBAAwB;AAC3D,UAAM,WAAW,OAAO,gBAAgB,gBAAgB,MAAM,OAAO,SAAS,MAAM,IAAI,CAAA;AACxF,UAAM,aAAa,mBAAmB,SAAS,CAAA;AAE/C,WAAO;AAAA,MACN,oBAAoB,OAAO;AAAA,MAC3B,GAAG;AAAA,MACH,GAAG;AAAA,MACH,GAAG;AAAA,IAAA;AAAA,EAEL,SAAS,GAAQ;AAChB,QAAI,aAAaC,aAAAA,OAAO,SAAS;AAChC,YAAM,IAAID,mBAAAA,mBAAmB,EAAE,OAAO;AAAA,IACvC;AACA,QAAI,aAAaC,aAAAA,OAAO,SAAS;AAChC,YAAM,OAAO,EAAE,UAAU;AACzB,UAAI,OAAO,SAAS,YAAY,OAAO,MAAM,UAAU,YAAY,OAAO,KAAK,OAAO,YAAY,UAAU;AAC3G,cAAM,IAAIC,iBAAAA,iBAAiB,KAAK,MAAM,OAAO;AAAA,MAC9C;AACA,YAAM,IAAIA,iBAAAA,iBAAiB,EAAE,OAAO;AAAA,IACrC;AACA,UAAM;AAAA,EACP;AACD;;;"}
+{"version":3,"file":"OIDCHelpers.cjs","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCHelpers.ts"],"sourcesContent":["import { Client, custom, errors, generators, Issuer, TokenSet } from 'openid-client'\nimport { createRemoteJWKSet, jwtVerify } from 'jose'\nimport { OIDCClaimMapping, OIDCResponseData } from './OIDCTypes.js'\nimport { IDPValidationError } from '../IDPValidationError.js'\nimport { IDPResponseError } from '../IDPResponseError.js'\nimport {\n\tIDPResponse,\n\tIDPSessionState,\n\tInitIDPAuthResult,\n\tLogoutTokenClaims,\n\tLogoutUrlRequest,\n\tRevalidationResult,\n} from '../IdentityProviderHandler.js'\n\n/**\n * Build the persisted session state from an OIDC token set. Stores the tokens needed for\n * later re-validation (refresh/access) and SLO (id_token); the whole `tokens` blob is\n * encrypted at rest by the command layer.\n *\n * `prevTokens` carries the previously stored tokens forward: a refresh-grant response MAY omit\n * the refresh token (RFC 6749 §6 — IdPs that don't rotate just don't re-send it), in which case\n * the client must keep using the old one. Without this fallback a non-rotating IdP would persist\n * a session with no refresh token and be revoked (`no_refresh_token`) on the very next tick.\n */\nexport const tokenSetToSessionState = (tokenSet: TokenSet, sessionId?: string, prevTokens?: Record<string, unknown>): IDPSessionState => {\n\tconst refreshToken = tokenSet.refresh_token ?? (typeof prevTokens?.refresh_token === 'string' ? prevTokens.refresh_token : undefined)\n\tconst idToken = tokenSet.id_token ?? (typeof prevTokens?.id_token === 'string' ? prevTokens.id_token : undefined)\n\treturn {\n\t\tsessionId,\n\t\ttokens: {\n\t\t\t...(refreshToken ? { refresh_token: refreshToken } : {}),\n\t\t\t...(tokenSet.access_token ? { access_token: tokenSet.access_token } : {}),\n\t\t\t...(idToken ? { id_token: idToken } : {}),\n\t\t},\n\t\texpiresAt: tokenSet.expires_at ? new Date(tokenSet.expires_at * 1000) : undefined,\n\t}\n}\n\nexport const initOIDCAuth = async (\n\tclient: Client,\n\t{ redirectUrl, scope, responseMode }: { redirectUrl: string; scope?: string; responseMode?: string },\n): Promise<InitIDPAuthResult> => {\n\tconst nonce = generators.nonce()\n\tconst state = generators.state()\n\tconst url = client.authorizationUrl({\n\t\tredirect_uri: redirectUrl,\n\t\tresponse_mode: responseMode,\n\t\tscope: scope ?? 'openid email',\n\t\tnonce,\n\t\tstate,\n\t})\n\n\treturn {\n\t\tauthUrl: url,\n\t\tsessionData: { nonce, state },\n\t}\n}\n\nexport type HandleOIDCResponseOptions = {\n\tfetchUserInfo?: boolean\n\treturnOIDCResult?: boolean\n\tcaptureSession?: boolean\n\tclaimMapping?: OIDCClaimMapping\n}\n\n/**\n * Read a claim by name, supporting dot-paths into nested objects (`a.b.c`). Own-property only at every\n * segment (mirrors `ClaimMappingEvaluator.resolvePath`): a configured path must never descend into an\n * inherited member, so a `__proto__` / `constructor` segment cannot surface an `Object.prototype` value\n * as the externalIdentifier / email / name.\n */\nconst getClaim = (source: Record<string, unknown>, path: string): unknown =>\n\tpath.split('.').reduce<unknown>(\n\t\t(\n\t\t\tacc,\n\t\t\tkey,\n\t\t) => (acc != null && typeof acc === 'object' && Object.prototype.hasOwnProperty.call(acc, key) ? (acc as Record<string, unknown>)[key] : undefined),\n\t\tsource,\n\t)\n\n/**\n * Lift a configured nested attributes object (`attributesKey`, notably Apereo CAS's `attributes`) to the\n * top level so providers that nest their claims map without a code change. The nested attributes are\n * UNSIGNED, so they are spread UNDER `source` — a signed top-level claim keeps precedence over an\n * attributes-level value. Shared by the sign-in response handler ({@link handleOIDCResponse}) and the\n * session-refresh path ({@link revalidateOIDC}) so BOTH see the same claim surface; without this, an\n * `attributesKey` provider's A09 claim mapping would resolve at sign-in but silently not on refresh.\n */\nexport const liftNestedClaims = (source: Record<string, unknown>, attributesKey: string | undefined): Record<string, unknown> => {\n\tif (!attributesKey) {\n\t\treturn source\n\t}\n\tconst nested = Object.prototype.hasOwnProperty.call(source, attributesKey) ? source[attributesKey] : undefined\n\tif (nested !== null && typeof nested === 'object' && !Array.isArray(nested)) {\n\t\treturn { ...nested, ...source }\n\t}\n\treturn source\n}\n\ntype NormalizedClaims = Record<string, unknown> & {\n\texternalIdentifier: string\n\temail: string | undefined\n\tname: string | undefined\n\temailVerified: boolean\n}\n\n/**\n * Build the normalized claim surface shared by sign-in ({@link handleOIDCResponse}) and session refresh\n * ({@link revalidateOIDC}): lift any configured nested attributes object to the top level, then layer the\n * mapped identity fields (`externalIdentifier` / `email` / `name` / `emailVerified`) over the raw claims.\n * BOTH paths run this SAME normalization so an A09 claim-mapping rule resolves identically whether it\n * targets a raw provider claim or one of the normalized identity fields — without it the two surfaces\n * diverged (refresh saw the raw claim, sign-in the mapped value).\n *\n * `subFallback` is the signature-verified ID-token `sub`, used when a custom `externalIdentifier` mapping\n * resolves to nothing: at sign-in it is guaranteed present; on refresh it is the refreshed id-token's `sub`\n * (or, for the userinfo method, the userinfo `sub`). Throws (account-takeover guard) when the mapped\n * subject is a non-scalar or resolves empty — the refresh caller catches this and skips the sync.\n */\nconst normalizeClaims = (\n\trawSource: Record<string, unknown>,\n\tclaimMapping: OIDCClaimMapping | undefined,\n\tsubFallback: string | undefined,\n): NormalizedClaims => {\n\tconst source = liftNestedClaims(rawSource, claimMapping?.attributesKey)\n\n\t// The OIDC `email_verified` claim is a boolean per spec, but some providers send the\n\t// string \"true\". userInfo (and any unwrapped attributes) take precedence over the ID token.\n\tconst rawEmailVerified = source.email_verified\n\tconst emailVerified = rawEmailVerified === true || rawEmailVerified === 'true'\n\n\t// `externalIdentifier` is the federation key persisted in `person_identity_provider` and\n\t// matched on the next sign-in, so it must be a stable scalar. A `claimMapping` that pointed\n\t// it at an object/array would otherwise be coerced by `String(...)` to `'[object Object]'` /\n\t// a comma-join — collapsing every user of the provider onto one key (account takeover). Fail\n\t// closed instead. The default `sub` path is safe (openid-client guarantees `sub` is a string).\n\tconst mappedSubject = getClaim(source, claimMapping?.externalIdentifier ?? 'sub')\n\tlet externalIdentifier: string\n\tif (mappedSubject === undefined || mappedSubject === null) {\n\t\texternalIdentifier = subFallback ?? ''\n\t} else if (typeof mappedSubject === 'string' || typeof mappedSubject === 'number') {\n\t\texternalIdentifier = String(mappedSubject)\n\t} else {\n\t\tthrow new IDPValidationError(`The mapped externalIdentifier claim is not a scalar value`)\n\t}\n\tif (externalIdentifier === '') {\n\t\tthrow new IDPValidationError(`The mapped externalIdentifier claim resolved to an empty value`)\n\t}\n\n\t// `email` / `name` are typed `string | undefined` on IDPResponse and feed the by-e-mail\n\t// account lookup (which crashes on a non-string). `...source` already placed the raw claim\n\t// of whatever type, so OVERWRITE (don't conditionally add) with the mapped value when it is\n\t// a string, otherwise `undefined` — a non-string claim must not leak through `...source`.\n\tconst email = getClaim(source, claimMapping?.email ?? 'email')\n\tconst name = resolveName(source, claimMapping)\n\n\treturn {\n\t\t...source,\n\t\texternalIdentifier,\n\t\temail: typeof email === 'string' ? email : undefined,\n\t\tname,\n\t\temailVerified,\n\t}\n}\n\n/**\n * Resolve the display name, falling back to `given_name` + `family_name` when there is no usable\n * `name` claim.\n *\n * `name` is optional in OIDC core and plenty of providers omit it while sending the parts — Apereo\n * CAS and Entra ID do, and so does Keycloak under its default mappers. Without the fallback,\n * `CreatePersonCommand` lands on its own last-resort default and a federated person ends up named\n * after the local part of their e-mail (`jan.novak`) despite the IdP having reported \"Jan Novák\".\n * A single-path `claimMapping.name` cannot express this: the value has to be composed from two\n * claims, not selected from one.\n *\n * An explicitly configured `claimMapping.name` is honoured as-is, fallback included — mapping a\n * claim is a statement about where the name lives, and quietly substituting a different source\n * would defeat it. A blank claim counts as absent: an empty string is not a display name, and\n * treating it as one would keep the fallback (and `CreatePersonCommand`'s) from ever running.\n */\nconst resolveName = (source: Record<string, unknown>, claimMapping: OIDCClaimMapping | undefined): string | undefined => {\n\tconst mapped = getClaim(source, claimMapping?.name ?? 'name')\n\tif (typeof mapped === 'string' && mapped.trim() !== '') {\n\t\treturn mapped\n\t}\n\tif (claimMapping?.name !== undefined) {\n\t\treturn undefined\n\t}\n\tconst parts = [getClaim(source, 'given_name'), getClaim(source, 'family_name')]\n\t\t.filter((part): part is string => typeof part === 'string' && part.trim() !== '')\n\t\t.map(part => part.trim())\n\treturn parts.length > 0 ? parts.join(' ') : undefined\n}\n\nexport const handleOIDCResponse = async (\n\tclient: Client,\n\t{ sessionData, redirectUrl, ...otherData }: OIDCResponseData,\n\t{ fetchUserInfo, returnOIDCResult, captureSession, claimMapping }: HandleOIDCResponseOptions = {},\n): Promise<IDPResponse> => {\n\tconst params = 'parameters' in otherData ? otherData.parameters : client.callbackParams(otherData.url)\n\tif (params.state && !sessionData?.state) {\n\t\tthrow new IDPValidationError(`state is present in parameters, but missing in session data`)\n\t}\n\ttry {\n\t\tconst result = await client.callback(redirectUrl, params, sessionData)\n\t\tconst claims = result.claims()\n\t\tconst { at_hash, c_hash, nonce, ...claimsWithoutHashes } = claims\n\t\tconst userInfo = result.access_token && fetchUserInfo ? await client.userinfo(result) : {}\n\t\tconst oidcResult = returnOIDCResult ? result : {}\n\t\tconst idpSession = captureSession ? tokenSetToSessionState(result, typeof claims.sid === 'string' ? claims.sid : undefined) : undefined\n\n\t\t// Merge ID-token claims with userInfo (userInfo wins, per spec), then normalize the surface (lift\n\t\t// nested attributes + map the identity fields). The refresh path runs the SAME normalization, so a\n\t\t// claim mapping resolves identically at sign-in and on refresh. The default `sub` fallback is safe —\n\t\t// openid-client guarantees `sub` is a string.\n\t\tconst normalized = normalizeClaims({ ...claimsWithoutHashes, ...userInfo }, claimMapping, claims.sub)\n\n\t\treturn {\n\t\t\t...oidcResult,\n\t\t\t...normalized,\n\t\t\t...(idpSession ? { idpSession } : {}),\n\t\t}\n\t} catch (e: any) {\n\t\tif (e instanceof errors.RPError) {\n\t\t\tthrow new IDPValidationError(e.message)\n\t\t}\n\t\tif (e instanceof errors.OPError) {\n\t\t\tconst body = e.response?.body as any\n\t\t\tif (typeof body === 'object' && typeof body?.error === 'object' && typeof body.error?.message === 'string') {\n\t\t\t\tthrow new IDPResponseError(body.error.message)\n\t\t\t}\n\t\t\tthrow new IDPResponseError(e.message)\n\t\t}\n\t\tthrow e\n\t}\n}\n\n/** OIDC errors that definitively mean \"this session is no longer valid at the IdP\". */\nconst REVOKED_OIDC_ERRORS = new Set(['invalid_grant', 'invalid_token', 'expired_token'])\n\n/**\n * Re-validate a stored OIDC session against the IdP. Returns `revoked` only for definitive\n * IdP responses (invalid/expired grant or inactive introspection). Transient failures\n * (network, IdP down) re-throw so the caller can fail-open and keep the session — IdP\n * downtime must not log everyone out.\n */\nexport const revalidateOIDC = async (\n\tclient: Client,\n\tmethod: 'refresh' | 'userinfo' | 'introspection',\n\tsession: IDPSessionState,\n\toptions: { claimMapping?: OIDCClaimMapping; fetchUserInfo?: boolean } = {},\n): Promise<RevalidationResult> => {\n\tconst { claimMapping, fetchUserInfo } = options\n\tconst tokens = session.tokens ?? {}\n\tconst refreshToken = typeof tokens.refresh_token === 'string' ? tokens.refresh_token : undefined\n\tconst accessToken = typeof tokens.access_token === 'string' ? tokens.access_token : undefined\n\ttry {\n\t\tif (method === 'refresh') {\n\t\t\tif (!refreshToken) {\n\t\t\t\treturn { status: 'revoked', reason: 'no_refresh_token' }\n\t\t\t}\n\t\t\tconst tokenSet = await client.refresh(refreshToken)\n\t\t\tlet claims: Record<string, unknown> | undefined\n\t\t\tlet claimsComplete = false\n\t\t\ttry {\n\t\t\t\t// Reconstruct the SAME claim surface sign-in builds (handleOIDCResponse): the refreshed id-token\n\t\t\t\t// claims merged with userInfo when `fetchUserInfo` is set — exactly as at sign-in — then the shared\n\t\t\t\t// normalization (lift nested attributes + map identity fields). An `always` mapping therefore\n\t\t\t\t// reconciles against an identical surface on refresh, so `claimsComplete` lets the caller enable\n\t\t\t\t// `unmatched: \"remove\"` reconciliation here too (see IdpSessionRevalidator).\n\t\t\t\tif (tokenSet.id_token) {\n\t\t\t\t\tconst idClaims = tokenSet.claims()\n\t\t\t\t\tconst userInfo = tokenSet.access_token && fetchUserInfo ? await client.userinfo(tokenSet) : {}\n\t\t\t\t\tclaims = normalizeClaims({ ...idClaims, ...userInfo }, claimMapping, typeof idClaims.sub === 'string' ? idClaims.sub : undefined)\n\t\t\t\t\tclaimsComplete = true\n\t\t\t\t}\n\t\t\t} catch {\n\t\t\t\t// Building the surface failed (userinfo unreachable, a non-scalar `externalIdentifier`, …). The IdP\n\t\t\t\t// already vouched for the session via the successful refresh, so KEEP it — just skip the claim sync\n\t\t\t\t// this tick (no claims → no grant, no removal) and retry on a later refresh. Leaving claimsComplete\n\t\t\t\t// false also guarantees a half-built surface can never drive a removal.\n\t\t\t\tclaims = undefined\n\t\t\t\tclaimsComplete = false\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tstatus: 'valid',\n\t\t\t\tclaims,\n\t\t\t\tclaimsComplete,\n\t\t\t\t// carry the stored tokens forward: a non-rotating IdP omits the refresh token here\n\t\t\t\tidpSession: tokenSetToSessionState(tokenSet, session.sessionId, tokens),\n\t\t\t}\n\t\t}\n\t\tif (method === 'userinfo') {\n\t\t\tif (!accessToken) {\n\t\t\t\treturn { status: 'revoked', reason: 'no_access_token' }\n\t\t\t}\n\t\t\tconst userInfo = await client.userinfo(accessToken)\n\t\t\tlet claims: Record<string, unknown> | undefined\n\t\t\ttry {\n\t\t\t\tclaims = normalizeClaims(userInfo, claimMapping, typeof userInfo.sub === 'string' ? userInfo.sub : undefined)\n\t\t\t} catch {\n\t\t\t\tclaims = undefined\n\t\t\t}\n\t\t\t// A userinfo probe carries no id-token claims, so its surface is NARROWER than sign-in's (id-token +\n\t\t\t// userinfo): a rule keyed on an id-token-only claim would miss here. Keep refresh-time sync additive-only\n\t\t\t// (`claimsComplete: false`) so `unmatched: \"remove\"` never strips a membership off this partial surface.\n\t\t\treturn { status: 'valid', claims, claimsComplete: false }\n\t\t}\n\t\t// introspection\n\t\tconst token = accessToken ?? refreshToken\n\t\tif (!token) {\n\t\t\treturn { status: 'revoked', reason: 'no_token' }\n\t\t}\n\t\tconst result = await client.introspect(token, accessToken ? 'access_token' : 'refresh_token')\n\t\tif (!result.active) {\n\t\t\treturn { status: 'revoked', reason: 'inactive' }\n\t\t}\n\t\treturn { status: 'valid' }\n\t} catch (e: any) {\n\t\tif (e instanceof errors.OPError) {\n\t\t\tif (typeof e.error === 'string' && REVOKED_OIDC_ERRORS.has(e.error)) {\n\t\t\t\treturn { status: 'revoked', reason: e.error }\n\t\t\t}\n\t\t\t// The userinfo endpoint signals a rejected access token with a bare HTTP 401 — per\n\t\t\t// RFC 6750 the `WWW-Authenticate` error code is optional, so openid-client may not\n\t\t\t// surface a parseable `error` here. A 401 is still definitive: the token is no\n\t\t\t// longer accepted → revoked. (Introspection is NOT treated this way: it returns 200\n\t\t\t// `{active:false}` for revoked tokens, so a 401/400 there means client-auth/config\n\t\t\t// failure — transient, must not log users out.)\n\t\t\tif (method === 'userinfo' && e.response?.statusCode === 401) {\n\t\t\t\treturn { status: 'revoked', reason: 'userinfo_unauthorized' }\n\t\t\t}\n\t\t}\n\t\t// transient (network / IdP unavailable) — propagate, do not revoke\n\t\tthrow e\n\t}\n}\n\n/**\n * Build an RP-initiated (front-channel) logout URL (OIDC RP-Initiated Logout 1.0). Returns null\n * when the IdP advertises no `end_session_endpoint` — the caller then degrades to a local-only\n * logout (legacy-IdP graceful fallback). The `id_token_hint` lets the IdP identify and confirm the\n * session to terminate; `post_logout_redirect_uri` is where the IdP returns the browser afterwards.\n */\nexport const buildOIDCLogoutUrl = (client: Client, { idToken, postLogoutRedirectUri }: LogoutUrlRequest): string | null => {\n\tif (!client.issuer.metadata.end_session_endpoint) {\n\t\treturn null\n\t}\n\treturn client.endSessionUrl({\n\t\t...(idToken ? { id_token_hint: idToken } : {}),\n\t\t...(postLogoutRedirectUri ? { post_logout_redirect_uri: postLogoutRedirectUri } : {}),\n\t})\n}\n\n/**\n * The OIDC Back-Channel Logout 1.0 event member that MUST be present in a logout token's `events`\n * claim. Its presence (and the absence of a `nonce`) is what distinguishes a logout token from an\n * ID token — both are signed by the same IdP, so without this check an ID token could be replayed\n * to forcibly log a user out.\n */\nconst BACKCHANNEL_LOGOUT_EVENT = 'http://schemas.openid.net/event/backchannel-logout'\n\n/**\n * Max accepted age of a back-channel logout token, derived from its `iat`. OIDC Back-Channel Logout\n * tokens are single-use and short-lived; bounding the age (together with requiring `exp`) limits the\n * window in which a captured token could be replayed to force a logout.\n */\nconst LOGOUT_TOKEN_MAX_AGE_SECONDS = 120\nconst LOGOUT_TOKEN_CLOCK_TOLERANCE_SECONDS = 5\n\n/**\n * Remote JWKS sets keyed by `jwks_uri`. `createRemoteJWKSet` returns a function with its own internal\n * key cache + fetch cooldown, so it MUST be reused across requests — re-creating it per call (as the\n * unauthenticated back-channel endpoint would otherwise do) defeats the cache and turns every request\n * into a potential outbound JWKS fetch. Keyed by URL, so two providers sharing an IdP share the set.\n */\nconst remoteJwksCache = new Map<string, ReturnType<typeof createRemoteJWKSet>>()\n\nconst getRemoteJwks = (jwksUri: string): ReturnType<typeof createRemoteJWKSet> => {\n\tlet jwks = remoteJwksCache.get(jwksUri)\n\tif (!jwks) {\n\t\tjwks = createRemoteJWKSet(new URL(jwksUri))\n\t\tremoteJwksCache.set(jwksUri, jwks)\n\t}\n\treturn jwks\n}\n\n/**\n * Validate an OIDC back-channel logout token (OIDC Back-Channel Logout 1.0 §2.4–2.6) and extract\n * the targeted `sid` / `sub`. The token is a JWT signed by the IdP; we verify the signature against\n * the issuer's JWKS and enforce the issuer + audience (client_id) the same way ID tokens are\n * verified, pinning the signing algorithm to the provider's configured one, then assert the\n * back-channel-specific claims:\n *   - `iat` is present and recent and `exp` is present (§2.4 requires both) — bounds the replay window;\n *   - `events` contains the back-channel-logout member (it really is a logout token);\n *   - it carries a `sid` and/or `sub` (otherwise there is nothing to act on);\n *   - it does NOT carry a `nonce` (a `nonce` means it is an ID token being replayed).\n * Throws {@link IDPValidationError} on any failure so the caller can answer 400.\n */\nexport const validateOIDCLogoutToken = async (client: Client, issuer: Issuer<Client>, logoutToken: string): Promise<LogoutTokenClaims> => {\n\tconst jwksUri = issuer.metadata.jwks_uri\n\tif (!jwksUri) {\n\t\tthrow new IDPValidationError('IdP has no jwks_uri; cannot verify logout token')\n\t}\n\tconst clientId = client.metadata.client_id\n\tif (typeof clientId !== 'string' || clientId === '') {\n\t\t// The `aud` check is a core anti-token-substitution defence on this unauthenticated endpoint.\n\t\t// jose treats `audience: undefined` as \"skip the aud check entirely\", so a missing client_id\n\t\t// must fail closed (reject the token) rather than fall through and accept any audience.\n\t\tthrow new IDPValidationError('cannot verify logout token audience: client_id is missing')\n\t}\n\tconst expectedAlg = typeof client.metadata.id_token_signed_response_alg === 'string'\n\t\t? client.metadata.id_token_signed_response_alg\n\t\t: 'RS256'\n\tconst jwks = getRemoteJwks(jwksUri)\n\tlet payload: Record<string, unknown>\n\ttry {\n\t\tconst verified = await jwtVerify(logoutToken, jwks, {\n\t\t\tissuer: issuer.metadata.issuer,\n\t\t\taudience: clientId,\n\t\t\t// pin to the provider's configured signing alg so a JWKS containing a symmetric/none key\n\t\t\t// can never be selected (defence-in-depth on top of jose's own key-type check).\n\t\t\talgorithms: [expectedAlg],\n\t\t\t// §2.4: `iat` and `exp` are REQUIRED. `maxTokenAge` makes `iat` required + bounds freshness;\n\t\t\t// `requiredClaims` makes `exp` required (jose only checks `exp` when present).\n\t\t\tmaxTokenAge: LOGOUT_TOKEN_MAX_AGE_SECONDS,\n\t\t\trequiredClaims: ['exp'],\n\t\t\tclockTolerance: LOGOUT_TOKEN_CLOCK_TOLERANCE_SECONDS,\n\t\t})\n\t\tpayload = verified.payload as Record<string, unknown>\n\t} catch (e: any) {\n\t\tthrow new IDPValidationError(`Invalid logout token: ${e?.message ?? 'verification failed'}`)\n\t}\n\n\t// A logout token MUST NOT contain a nonce; its presence means an ID token is being replayed.\n\tif ('nonce' in payload) {\n\t\tthrow new IDPValidationError('Logout token must not contain a nonce')\n\t}\n\n\tconst events = payload.events\n\tconst hasLogoutEvent = typeof events === 'object' && events !== null && BACKCHANNEL_LOGOUT_EVENT in (events as Record<string, unknown>)\n\tif (!hasLogoutEvent) {\n\t\tthrow new IDPValidationError('Logout token is missing the back-channel-logout event')\n\t}\n\n\tconst sid = typeof payload.sid === 'string' ? payload.sid : undefined\n\tconst sub = typeof payload.sub === 'string' ? payload.sub : undefined\n\tif (!sid && !sub) {\n\t\tthrow new IDPValidationError('Logout token must contain a sid or sub claim')\n\t}\n\n\treturn { sid, sub }\n}\n"],"names":["generators","IDPValidationError","errors","IDPResponseError","createRemoteJWKSet","jwtVerify"],"mappings":";;;;;;AAwBO,MAAM,yBAAyB,CAAC,UAAoB,WAAoB,eAA0D;AACxI,QAAM,eAAe,SAAS,kBAAkB,OAAO,YAAY,kBAAkB,WAAW,WAAW,gBAAgB;AAC3H,QAAM,UAAU,SAAS,aAAa,OAAO,YAAY,aAAa,WAAW,WAAW,WAAW;AACvG,SAAO;AAAA,IACN;AAAA,IACA,QAAQ;AAAA,MACP,GAAI,eAAe,EAAE,eAAe,aAAA,IAAiB,CAAA;AAAA,MACrD,GAAI,SAAS,eAAe,EAAE,cAAc,SAAS,aAAA,IAAiB,CAAA;AAAA,MACtE,GAAI,UAAU,EAAE,UAAU,YAAY,CAAA;AAAA,IAAC;AAAA,IAExC,WAAW,SAAS,aAAa,IAAI,KAAK,SAAS,aAAa,GAAI,IAAI;AAAA,EAAA;AAE1E;AAEO,MAAM,eAAe,OAC3B,QACA,EAAE,aAAa,OAAO,mBACU;AAChC,QAAM,QAAQA,aAAAA,WAAW,MAAA;AACzB,QAAM,QAAQA,aAAAA,WAAW,MAAA;AACzB,QAAM,MAAM,OAAO,iBAAiB;AAAA,IACnC,cAAc;AAAA,IACd,eAAe;AAAA,IACf,OAAO,SAAS;AAAA,IAChB;AAAA,IACA;AAAA,EAAA,CACA;AAED,SAAO;AAAA,IACN,SAAS;AAAA,IACT,aAAa,EAAE,OAAO,MAAA;AAAA,EAAM;AAE9B;AAeA,MAAM,WAAW,CAAC,QAAiC,SAClD,KAAK,MAAM,GAAG,EAAE;AAAA,EACf,CACC,KACA,QACK,OAAO,QAAQ,OAAO,QAAQ,YAAY,OAAO,UAAU,eAAe,KAAK,KAAK,GAAG,IAAK,IAAgC,GAAG,IAAI;AAAA,EACzI;AACD;AAUM,MAAM,mBAAmB,CAAC,QAAiC,kBAA+D;AAChI,MAAI,CAAC,eAAe;AACnB,WAAO;AAAA,EACR;AACA,QAAM,SAAS,OAAO,UAAU,eAAe,KAAK,QAAQ,aAAa,IAAI,OAAO,aAAa,IAAI;AACrG,MAAI,WAAW,QAAQ,OAAO,WAAW,YAAY,CAAC,MAAM,QAAQ,MAAM,GAAG;AAC5E,WAAO,EAAE,GAAG,QAAQ,GAAG,OAAA;AAAA,EACxB;AACA,SAAO;AACR;AAsBA,MAAM,kBAAkB,CACvB,WACA,cACA,gBACsB;AACtB,QAAM,SAAS,iBAAiB,WAAW,cAAc,aAAa;AAItE,QAAM,mBAAmB,OAAO;AAChC,QAAM,gBAAgB,qBAAqB,QAAQ,qBAAqB;AAOxE,QAAM,gBAAgB,SAAS,QAAQ,cAAc,sBAAsB,KAAK;AAChF,MAAI;AACJ,MAAI,kBAAkB,UAAa,kBAAkB,MAAM;AAC1D,yBAAqB,eAAe;AAAA,EACrC,WAAW,OAAO,kBAAkB,YAAY,OAAO,kBAAkB,UAAU;AAClF,yBAAqB,OAAO,aAAa;AAAA,EAC1C,OAAO;AACN,UAAM,IAAIC,mBAAAA,mBAAmB,2DAA2D;AAAA,EACzF;AACA,MAAI,uBAAuB,IAAI;AAC9B,UAAM,IAAIA,mBAAAA,mBAAmB,gEAAgE;AAAA,EAC9F;AAMA,QAAM,QAAQ,SAAS,QAAQ,cAAc,SAAS,OAAO;AAC7D,QAAM,OAAO,YAAY,QAAQ,YAAY;AAE7C,SAAO;AAAA,IACN,GAAG;AAAA,IACH;AAAA,IACA,OAAO,OAAO,UAAU,WAAW,QAAQ;AAAA,IAC3C;AAAA,IACA;AAAA,EAAA;AAEF;AAkBA,MAAM,cAAc,CAAC,QAAiC,iBAAmE;AACxH,QAAM,SAAS,SAAS,QAAQ,cAAc,QAAQ,MAAM;AAC5D,MAAI,OAAO,WAAW,YAAY,OAAO,KAAA,MAAW,IAAI;AACvD,WAAO;AAAA,EACR;AACA,MAAI,cAAc,SAAS,QAAW;AACrC,WAAO;AAAA,EACR;AACA,QAAM,QAAQ,CAAC,SAAS,QAAQ,YAAY,GAAG,SAAS,QAAQ,aAAa,CAAC,EAC5E,OAAO,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,WAAW,EAAE,EAC/E,IAAI,CAAA,SAAQ,KAAK,KAAA,CAAM;AACzB,SAAO,MAAM,SAAS,IAAI,MAAM,KAAK,GAAG,IAAI;AAC7C;AAEO,MAAM,qBAAqB,OACjC,QACA,EAAE,aAAa,aAAa,GAAG,aAC/B,EAAE,eAAe,kBAAkB,gBAAgB,aAAA,IAA4C,CAAA,MACrE;AAC1B,QAAM,SAAS,gBAAgB,YAAY,UAAU,aAAa,OAAO,eAAe,UAAU,GAAG;AACrG,MAAI,OAAO,SAAS,CAAC,aAAa,OAAO;AACxC,UAAM,IAAIA,mBAAAA,mBAAmB,6DAA6D;AAAA,EAC3F;AACA,MAAI;AACH,UAAM,SAAS,MAAM,OAAO,SAAS,aAAa,QAAQ,WAAW;AACrE,UAAM,SAAS,OAAO,OAAA;AACtB,UAAM,EAAE,SAAS,QAAQ,OAAO,GAAG,wBAAwB;AAC3D,UAAM,WAAW,OAAO,gBAAgB,gBAAgB,MAAM,OAAO,SAAS,MAAM,IAAI,CAAA;AACxF,UAAM,aAAa,mBAAmB,SAAS,CAAA;AAC/C,UAAM,aAAa,iBAAiB,uBAAuB,QAAQ,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM,MAAS,IAAI;AAM9H,UAAM,aAAa,gBAAgB,EAAE,GAAG,qBAAqB,GAAG,YAAY,cAAc,OAAO,GAAG;AAEpG,WAAO;AAAA,MACN,GAAG;AAAA,MACH,GAAG;AAAA,MACH,GAAI,aAAa,EAAE,eAAe,CAAA;AAAA,IAAC;AAAA,EAErC,SAAS,GAAQ;AAChB,QAAI,aAAaC,aAAAA,OAAO,SAAS;AAChC,YAAM,IAAID,mBAAAA,mBAAmB,EAAE,OAAO;AAAA,IACvC;AACA,QAAI,aAAaC,aAAAA,OAAO,SAAS;AAChC,YAAM,OAAO,EAAE,UAAU;AACzB,UAAI,OAAO,SAAS,YAAY,OAAO,MAAM,UAAU,YAAY,OAAO,KAAK,OAAO,YAAY,UAAU;AAC3G,cAAM,IAAIC,iBAAAA,iBAAiB,KAAK,MAAM,OAAO;AAAA,MAC9C;AACA,YAAM,IAAIA,iBAAAA,iBAAiB,EAAE,OAAO;AAAA,IACrC;AACA,UAAM;AAAA,EACP;AACD;AAGA,MAAM,sBAAsB,oBAAI,IAAI,CAAC,iBAAiB,iBAAiB,eAAe,CAAC;AAQhF,MAAM,iBAAiB,OAC7B,QACA,QACA,SACA,UAAwE,CAAA,MACvC;AACjC,QAAM,EAAE,cAAc,cAAA,IAAkB;AACxC,QAAM,SAAS,QAAQ,UAAU,CAAA;AACjC,QAAM,eAAe,OAAO,OAAO,kBAAkB,WAAW,OAAO,gBAAgB;AACvF,QAAM,cAAc,OAAO,OAAO,iBAAiB,WAAW,OAAO,eAAe;AACpF,MAAI;AACH,QAAI,WAAW,WAAW;AACzB,UAAI,CAAC,cAAc;AAClB,eAAO,EAAE,QAAQ,WAAW,QAAQ,mBAAA;AAAA,MACrC;AACA,YAAM,WAAW,MAAM,OAAO,QAAQ,YAAY;AAClD,UAAI;AACJ,UAAI,iBAAiB;AACrB,UAAI;AAMH,YAAI,SAAS,UAAU;AACtB,gBAAM,WAAW,SAAS,OAAA;AAC1B,gBAAM,WAAW,SAAS,gBAAgB,gBAAgB,MAAM,OAAO,SAAS,QAAQ,IAAI,CAAA;AAC5F,mBAAS,gBAAgB,EAAE,GAAG,UAAU,GAAG,SAAA,GAAY,cAAc,OAAO,SAAS,QAAQ,WAAW,SAAS,MAAM,MAAS;AAChI,2BAAiB;AAAA,QAClB;AAAA,MACD,QAAQ;AAKP,iBAAS;AACT,yBAAiB;AAAA,MAClB;AACA,aAAO;AAAA,QACN,QAAQ;AAAA,QACR;AAAA,QACA;AAAA;AAAA,QAEA,YAAY,uBAAuB,UAAU,QAAQ,WAAW,MAAM;AAAA,MAAA;AAAA,IAExE;AACA,QAAI,WAAW,YAAY;AAC1B,UAAI,CAAC,aAAa;AACjB,eAAO,EAAE,QAAQ,WAAW,QAAQ,kBAAA;AAAA,MACrC;AACA,YAAM,WAAW,MAAM,OAAO,SAAS,WAAW;AAClD,UAAI;AACJ,UAAI;AACH,iBAAS,gBAAgB,UAAU,cAAc,OAAO,SAAS,QAAQ,WAAW,SAAS,MAAM,MAAS;AAAA,MAC7G,QAAQ;AACP,iBAAS;AAAA,MACV;AAIA,aAAO,EAAE,QAAQ,SAAS,QAAQ,gBAAgB,MAAA;AAAA,IACnD;AAEA,UAAM,QAAQ,eAAe;AAC7B,QAAI,CAAC,OAAO;AACX,aAAO,EAAE,QAAQ,WAAW,QAAQ,WAAA;AAAA,IACrC;AACA,UAAM,SAAS,MAAM,OAAO,WAAW,OAAO,cAAc,iBAAiB,eAAe;AAC5F,QAAI,CAAC,OAAO,QAAQ;AACnB,aAAO,EAAE,QAAQ,WAAW,QAAQ,WAAA;AAAA,IACrC;AACA,WAAO,EAAE,QAAQ,QAAA;AAAA,EAClB,SAAS,GAAQ;AAChB,QAAI,aAAaD,aAAAA,OAAO,SAAS;AAChC,UAAI,OAAO,EAAE,UAAU,YAAY,oBAAoB,IAAI,EAAE,KAAK,GAAG;AACpE,eAAO,EAAE,QAAQ,WAAW,QAAQ,EAAE,MAAA;AAAA,MACvC;AAOA,UAAI,WAAW,cAAc,EAAE,UAAU,eAAe,KAAK;AAC5D,eAAO,EAAE,QAAQ,WAAW,QAAQ,wBAAA;AAAA,MACrC;AAAA,IACD;AAEA,UAAM;AAAA,EACP;AACD;AAQO,MAAM,qBAAqB,CAAC,QAAgB,EAAE,SAAS,4BAA6D;AAC1H,MAAI,CAAC,OAAO,OAAO,SAAS,sBAAsB;AACjD,WAAO;AAAA,EACR;AACA,SAAO,OAAO,cAAc;AAAA,IAC3B,GAAI,UAAU,EAAE,eAAe,QAAA,IAAY,CAAA;AAAA,IAC3C,GAAI,wBAAwB,EAAE,0BAA0B,0BAA0B,CAAA;AAAA,EAAC,CACnF;AACF;AAQA,MAAM,2BAA2B;AAOjC,MAAM,+BAA+B;AACrC,MAAM,uCAAuC;AAQ7C,MAAM,sCAAsB,IAAA;AAE5B,MAAM,gBAAgB,CAAC,YAA2D;AACjF,MAAI,OAAO,gBAAgB,IAAI,OAAO;AACtC,MAAI,CAAC,MAAM;AACV,WAAOE,KAAAA,mBAAmB,IAAI,IAAI,OAAO,CAAC;AAC1C,oBAAgB,IAAI,SAAS,IAAI;AAAA,EAClC;AACA,SAAO;AACR;AAcO,MAAM,0BAA0B,OAAO,QAAgB,QAAwB,gBAAoD;AACzI,QAAM,UAAU,OAAO,SAAS;AAChC,MAAI,CAAC,SAAS;AACb,UAAM,IAAIH,mBAAAA,mBAAmB,iDAAiD;AAAA,EAC/E;AACA,QAAM,WAAW,OAAO,SAAS;AACjC,MAAI,OAAO,aAAa,YAAY,aAAa,IAAI;AAIpD,UAAM,IAAIA,mBAAAA,mBAAmB,2DAA2D;AAAA,EACzF;AACA,QAAM,cAAc,OAAO,OAAO,SAAS,iCAAiC,WACzE,OAAO,SAAS,+BAChB;AACH,QAAM,OAAO,cAAc,OAAO;AAClC,MAAI;AACJ,MAAI;AACH,UAAM,WAAW,MAAMI,eAAU,aAAa,MAAM;AAAA,MACnD,QAAQ,OAAO,SAAS;AAAA,MACxB,UAAU;AAAA;AAAA;AAAA,MAGV,YAAY,CAAC,WAAW;AAAA;AAAA;AAAA,MAGxB,aAAa;AAAA,MACb,gBAAgB,CAAC,KAAK;AAAA,MACtB,gBAAgB;AAAA,IAAA,CAChB;AACD,cAAU,SAAS;AAAA,EACpB,SAAS,GAAQ;AAChB,UAAM,IAAIJ,mBAAAA,mBAAmB,yBAAyB,GAAG,WAAW,qBAAqB,EAAE;AAAA,EAC5F;AAGA,MAAI,WAAW,SAAS;AACvB,UAAM,IAAIA,mBAAAA,mBAAmB,uCAAuC;AAAA,EACrE;AAEA,QAAM,SAAS,QAAQ;AACvB,QAAM,iBAAiB,OAAO,WAAW,YAAY,WAAW,QAAQ,4BAA6B;AACrG,MAAI,CAAC,gBAAgB;AACpB,UAAM,IAAIA,mBAAAA,mBAAmB,uDAAuD;AAAA,EACrF;AAEA,QAAM,MAAM,OAAO,QAAQ,QAAQ,WAAW,QAAQ,MAAM;AAC5D,QAAM,MAAM,OAAO,QAAQ,QAAQ,WAAW,QAAQ,MAAM;AAC5D,MAAI,CAAC,OAAO,CAAC,KAAK;AACjB,UAAM,IAAIA,mBAAAA,mBAAmB,8CAA8C;AAAA,EAC5E;AAEA,SAAO,EAAE,KAAK,IAAA;AACf;;;;;;;;"}