@crossauth/fastify 0.0.29 → 0.0.32

package/dist/index.js

@@ -1,17 +1,17 @@
 var ke = Object.defineProperty;
-var Pe = (k, e, o) => e in k ? ke(k, e, { enumerable: !0, configurable: !0, writable: !0, value: o }) : k[e] = o;
-var u = (k, e, o) => Pe(k, typeof e != "symbol" ? e + "" : e, o);
+var Pe = (S, e, o) => e in S ? ke(S, e, { enumerable: !0, configurable: !0, writable: !0, value: o }) : S[e] = o;
+var u = (S, e, o) => Pe(S, typeof e != "symbol" ? e + "" : e, o);
 import Ee from "fastify";
 import Te from "@fastify/view";
-import ye from "@fastify/formbody";
-import be from "@fastify/cors";
+import be from "@fastify/formbody";
+import ye from "@fastify/cors";
 import _e from "@fastify/cookie";
 import ue from "nunjucks";
-import { setParameter as S, ParamType as C, Crypto as F, TokenEmailer as xe, OAuthClientManager as L, SessionManager as Ae, ApiKeyManager as Y, KeyStorage as Fe, OAuthAuthorizationServer as Ne, DoubleSubmitCsrfToken as Ue, OAuthClientBackend as Oe, OAuthResourceServer as Ie, OAuthTokenConsumer as Me } from "@crossauth/backend";
+import { setParameter as C, ParamType as k, Crypto as F, TokenEmailer as xe, OAuthClientManager as L, SessionManager as Ae, ApiKeyManager as Y, KeyStorage as Fe, OAuthAuthorizationServer as Ne, DoubleSubmitCsrfToken as Ue, OAuthClientBackend as Oe, OAuthResourceServer as Ie, OAuthTokenConsumer as Me } from "@crossauth/backend";
 import { CrossauthLogger as d, j as c, CrossauthError as l, ErrorCode as g, UserState as O, OAuthFlows as E } from "@crossauth/common";
 import { jwtDecode as J } from "jwt-decode";
 import Re from "qrcode";
-const N = ["Content-Type", "application/json; charset=utf-8"];
+const U = ["Content-Type", "application/json; charset=utf-8"];
 class De {
   /**
    * Constructor.
@@ -38,7 +38,7 @@ class De {
     u(this, "emailVerifiedPage", "emailverified.njk");
     u(this, "signupPage", "signup.njk");
     u(this, "deleteUserPage", "deleteuser.njk");
-    this.sessionServer = e, S("prefix", C.String, this, o, "PREFIX"), S("enableEmailVerification", C.Boolean, this, o, "ENABLE_EMAIL_VERIFICATION"), S("enablePasswordReset", C.Boolean, this, o, "ENABLE_PASSWORD_RESET"), S("updateUserPage", C.String, this, o, "UPDATE_USER_PAGE"), S("changeFactor2Page", C.String, this, o, "CHANGE_FACTOR2_PAGE"), S("configureFactor2Page", C.String, this, o, "SIGNUP_FACTOR2_PAGE"), S("changePasswordPage", C.String, this, o, "CHANGE_PASSWORD_PAGE"), S("resetPasswordPage", C.String, this, o, "RESET_PASSWORD_PAGE"), S("requestPasswordResetPage", C.String, this, o, "REQUEST_PASSWORD_RESET_PAGE"), S("emailVerifiedPage", C.String, this, o, "EMAIL_VERIFIED_PAGE"), S("signupPage", C.String, this, o, "SIGNUP_PAGE"), S("deleteUserPage", C.String, this, o, "DELETE_USER_PAGE");
+    this.sessionServer = e, C("prefix", k.String, this, o, "PREFIX"), C("enableEmailVerification", k.Boolean, this, o, "ENABLE_EMAIL_VERIFICATION"), C("enablePasswordReset", k.Boolean, this, o, "ENABLE_PASSWORD_RESET"), C("updateUserPage", k.String, this, o, "UPDATE_USER_PAGE"), C("changeFactor2Page", k.String, this, o, "CHANGE_FACTOR2_PAGE"), C("configureFactor2Page", k.String, this, o, "SIGNUP_FACTOR2_PAGE"), C("changePasswordPage", k.String, this, o, "CHANGE_PASSWORD_PAGE"), C("resetPasswordPage", k.String, this, o, "RESET_PASSWORD_PAGE"), C("requestPasswordResetPage", k.String, this, o, "REQUEST_PASSWORD_RESET_PAGE"), C("emailVerifiedPage", k.String, this, o, "EMAIL_VERIFIED_PAGE"), C("signupPage", k.String, this, o, "SIGNUP_PAGE"), C("deleteUserPage", k.String, this, o, "DELETE_USER_PAGE");
   }
   //////////////////////////////////////////////////////////////////
   // Endpoints
@@ -57,7 +57,7 @@ class De {
           ip: e.ip,
           user: (r = e.user) == null ? void 0 : r.username
         })), !e.user || !this.sessionServer.canEditUser(e))
-          return y.sendPageError(
+          return b.sendPageError(
             o,
             401,
             this.sessionServer.errorPage
@@ -82,7 +82,7 @@ class De {
           url: this.prefix + "updateuser",
           ip: e.ip,
           user: (r = e.user) == null ? void 0 : r.username
-        })), !this.sessionServer.canEditUser(e)) return y.sendPageError(
+        })), !this.sessionServer.canEditUser(e)) return b.sendPageError(
           o,
           401,
           this.sessionServer.errorPage
@@ -144,7 +144,7 @@ class De {
           return await this.updateUser(
             e,
             o,
-            (i, n, t) => i.header(...N).send({
+            (i, n, t) => i.header(...U).send({
               ok: !0,
               emailVerificationRequired: t
             })
@@ -157,7 +157,7 @@ class De {
             errorCodeName: n.codeName,
             errorCode: n.code
           })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => {
-            t.status(this.sessionServer.errorStatus(i)).header(...N).send({
+            t.status(this.sessionServer.errorStatus(i)).header(...U).send({
               ok: !1,
               errorMessage: a.message,
               errorMessages: a.messages,
@@ -186,7 +186,7 @@ class De {
         })), !this.sessionServer.isSessionUser(e) || !e.user) {
           const n = await this.sessionServer.getSessionData(e, "factor2change");
           if (!(n != null && n.username) && !this.sessionServer.isSessionUser(e))
-            return y.sendPageError(
+            return b.sendPageError(
               o,
               401,
               this.sessionServer.errorPage
@@ -215,7 +215,7 @@ class De {
         })), !this.sessionServer.isSessionUser(e) || !e.user) {
           const i = await this.sessionServer.getSessionData(e, "factor2change");
           if (!(i != null && i.username) && !this.sessionServer.isSessionUser(e))
-            return y.sendPageError(
+            return b.sendPageError(
               o,
               401,
               this.sessionServer.errorPage
@@ -280,7 +280,7 @@ class De {
           return await this.changeFactor2(
             e,
             o,
-            (i, n, t) => i.header(...N).send({
+            (i, n, t) => i.header(...U).send({
               ok: !0,
               ...n.userData
             })
@@ -292,7 +292,7 @@ class De {
             user: (s = e.user) == null ? void 0 : s.username,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => t.status(this.sessionServer.errorStatus(i)).header(...N).send({
+          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => t.status(this.sessionServer.errorStatus(i)).header(...U).send({
             ok: !1,
             errorMessage: a.message,
             errorMessages: a.messages,
@@ -320,7 +320,7 @@ class De {
         })), !this.sessionServer.isSessionUser(e) || !e.user) {
           const i = await this.sessionServer.getSessionData(e, "passwordchange");
           if ((i == null ? void 0 : i.username) == null && !this.sessionServer.isSessionUser(e))
-            return y.sendPageError(
+            return b.sendPageError(
               o,
               401,
               this.sessionServer.errorPage
@@ -397,7 +397,7 @@ class De {
           return await this.changePassword(
             e,
             o,
-            (i, n) => i.header(...N).send({
+            (i, n) => i.header(...U).send({
               ok: !0
             })
           );
@@ -408,7 +408,7 @@ class De {
             user: (s = e.user) == null ? void 0 : s.username,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => t.status(this.sessionServer.errorStatus(i)).header(...N).send({
+          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => t.status(this.sessionServer.errorStatus(i)).header(...U).send({
             ok: !1,
             errorMessage: a.message,
             errorMessages: a.messages,
@@ -542,7 +542,7 @@ class De {
           return await this.reconfigureFactor2(
             o,
             r,
-            (i, n, t) => i.header(...N).send({
+            (i, n, t) => i.header(...U).send({
               ok: !0,
               ...n
             })
@@ -555,7 +555,7 @@ class De {
             errorCodeName: n.codeName,
             errorCode: n.code
           })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, o, r, (t, a) => {
-            t.status(this.sessionServer.errorStatus(i)).header(...N).send({
+            t.status(this.sessionServer.errorStatus(i)).header(...U).send({
               ok: !1,
               errorMessage: a.message,
               errorMessages: a.messages,
@@ -584,7 +584,7 @@ class De {
                 ok: !0,
                 user: n
               };
-              return this.sessionServer.isSessionUser(o) || (t.emailVerificationNeeded = this.enableEmailVerification), i.header(...N).send(t);
+              return this.sessionServer.isSessionUser(o) || (t.emailVerificationNeeded = this.enableEmailVerification), i.header(...U).send(t);
             }
           );
         } catch (i) {
@@ -595,7 +595,7 @@ class De {
             errorCodeName: n.codeName,
             errorCode: n.code
           })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, o, r, (t, a) => {
-            t.status(this.sessionServer.errorStatus(i)).header(...N).send({
+            t.status(this.sessionServer.errorStatus(i)).header(...U).send({
               ok: !1,
               errorMessage: a.message,
               errorMessages: a.messages,
@@ -686,7 +686,7 @@ class De {
           return await this.requestPasswordReset(
             e,
             o,
-            (r, s) => r.header(...N).send({
+            (r, s) => r.header(...U).send({
               ok: !0
             })
           );
@@ -698,7 +698,7 @@ class De {
             errorCodeName: s.codeName,
             errorCode: s.code
           })), d.logger.debug(c({ err: r })), this.sessionServer.handleError(r, e, o, (i, n) => {
-            i.status(this.sessionServer.errorStatus(r)).header(...N).send({
+            i.status(this.sessionServer.errorStatus(r)).header(...U).send({
               ok: !1,
               errorMessage: n.message,
               errorMessages: n.messages,
@@ -794,7 +794,7 @@ class De {
           return await this.resetPassword(
             e,
             o,
-            (r, s) => r.header(...N).send({
+            (r, s) => r.header(...U).send({
               ok: !0
             })
           );
@@ -806,7 +806,7 @@ class De {
             errorCodeName: s.codeName,
             errorCode: s.code
           })), d.logger.debug(c({ err: r })), this.sessionServer.handleError(r, e, o, (i, n) => {
-            i.status(this.sessionServer.errorStatus(r)).header(...N).send({
+            i.status(this.sessionServer.errorStatus(r)).header(...U).send({
               ok: !1,
               errorMessage: n.message,
               errorMessages: n.messages,
@@ -875,7 +875,7 @@ class De {
           return await this.verifyEmail(
             e,
             o,
-            (r, s) => r.header(...N).send({
+            (r, s) => r.header(...U).send({
               ok: !0,
               user: s
             })
@@ -888,7 +888,7 @@ class De {
             errorCodeName: s.codeName,
             errorCode: s.code
           })), d.logger.debug(c({ err: r })), this.sessionServer.handleError(r, e, o, (i, n) => {
-            i.status(this.sessionServer.errorStatus(r)).header(...N).send({
+            i.status(this.sessionServer.errorStatus(r)).header(...U).send({
               ok: !1,
               errorMessage: n.message,
               errorMessages: n.messages,
@@ -1008,14 +1008,14 @@ class De {
           ip: e.ip,
           user: (r = e.user) == null ? void 0 : r.username
         })), !e.user)
-          return o.status(401).header(...N).send({ ok: !1 });
+          return o.status(401).header(...U).send({ ok: !1 });
         try {
           return await this.deleteUser(
             e,
             o,
             (i) => {
               var n;
-              return i.header(...N).send({
+              return i.header(...U).send({
                 ok: !0,
                 userid: (n = e.user) == null ? void 0 : n.id
               });
@@ -1029,7 +1029,7 @@ class De {
             errorCodeName: n.codeName,
             errorCode: n.code
           })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => {
-            t.status(this.sessionServer.errorStatus(i)).header(...N).send({
+            t.status(this.sessionServer.errorStatus(i)).header(...U).send({
               ok: !1,
               errorMessage: a.message,
               errorMessages: a.messages,
@@ -1257,17 +1257,17 @@ class De {
     return await this.sessionServer.userStorage.deleteUserById(e.user.id), r(o);
   }
 }
-async function ze(k, e) {
+async function ze(S, e) {
   let o = [];
   try {
-    const { user: r } = await e.getUserByUsername(k);
+    const { user: r } = await e.getUserByUsername(S);
     o.push(r);
   } catch (r) {
     const s = l.asCrossauthError(r);
     if (s.code != g.UserNotExist)
       throw d.logger.debug(c({ err: s })), s;
     try {
-      const { user: i } = await e.getUserByEmail(k);
+      const { user: i } = await e.getUserByEmail(S);
       o.push(i);
     } catch (i) {
       const n = l.asCrossauthError(i);
@@ -1290,7 +1290,7 @@ class He {
     u(this, "adminUpdateUserPage", "admin/updateuser.njk");
     u(this, "adminChangePasswordPage", "admin/changepassword.njk");
     u(this, "deleteUserPage", "deleteuser.njk");
-    this.sessionServer = e, S("adminPrefix", C.String, this, o, "ADMIN_PREFIX"), S("adminCreateUserPage", C.String, this, o, "ADMIN_CREATE_USER_PAGE"), S("adminSelectUserPage", C.String, this, o, "ADMIN_SELECT_USER_PAGE"), S("adminUpdateUserPage", C.String, this, o, "ADMIN_UPDATE_USER_PAGE"), S("adminChangePasswordPage", C.String, this, o, "ADMIN_CHANGE_PASSWORD_PAGE"), S("enableOAuthClientManagement", C.Boolean, this, o, "ENABLE_OAUTH_CLIENT_MANAGEMENT"), S("deleteUserPage", C.String, this, o, "DELETE_USER_PAGE"), this.adminPrefix.endsWith("/") || (this.adminPrefix += "/"), this.adminPrefix.startsWith("/") || "" + this.adminPrefix, o.userSearchFn && (this.userSearchFn = o.userSearchFn);
+    this.sessionServer = e, C("adminPrefix", k.String, this, o, "ADMIN_PREFIX"), C("adminCreateUserPage", k.String, this, o, "ADMIN_CREATE_USER_PAGE"), C("adminSelectUserPage", k.String, this, o, "ADMIN_SELECT_USER_PAGE"), C("adminUpdateUserPage", k.String, this, o, "ADMIN_UPDATE_USER_PAGE"), C("adminChangePasswordPage", k.String, this, o, "ADMIN_CHANGE_PASSWORD_PAGE"), C("enableOAuthClientManagement", k.Boolean, this, o, "ENABLE_OAUTH_CLIENT_MANAGEMENT"), C("deleteUserPage", k.String, this, o, "DELETE_USER_PAGE"), this.adminPrefix.endsWith("/") || (this.adminPrefix += "/"), this.adminPrefix.startsWith("/") || "" + this.adminPrefix, o.userSearchFn && (this.userSearchFn = o.userSearchFn);
   }
   ///////////////////////////////////////////////////////////////////
   // Endpoints
@@ -1306,7 +1306,7 @@ class He {
           method: "GET",
           url: this.adminPrefix + "createuser",
           ip: e.ip
-        })), !(e != null && e.user) || !y.isAdmin(e.user))
+        })), !(e != null && e.user) || !b.isAdmin(e.user))
           return this.accessDeniedPage(e, o);
         let r = {
           urlPrefix: this.adminPrefix,
@@ -1417,7 +1417,7 @@ class He {
           method: "GET",
           url: this.adminPrefix + "selectuser",
           ip: e.ip
-        })), !(e != null && e.user) || !y.isAdmin(e.user))
+        })), !(e != null && e.user) || !b.isAdmin(e.user))
           return this.accessDeniedPage(e, o);
         try {
           let r = [], s = Number(e.query.skip), i = Number(e.query.take);
@@ -1439,7 +1439,7 @@ class He {
           return e.query.next && (n.next = e.query.next), o.view(this.adminSelectUserPage, n);
         } catch (r) {
           const s = l.asCrossauthError(r);
-          return d.logger.error(c({ err: r })), y.sendPageError(
+          return d.logger.error(c({ err: r })), b.sendPageError(
             o,
             s.httpStatus,
             this.sessionServer.errorPage,
@@ -1463,7 +1463,7 @@ class He {
           method: "GET",
           url: this.adminPrefix + "updateuser",
           ip: e.ip
-        })), !(e != null && e.user) || !y.isAdmin(e.user))
+        })), !(e != null && e.user) || !b.isAdmin(e.user))
           return this.accessDeniedPage(e, o);
         try {
           const { user: r } = await this.sessionServer.userStorage.getUserById(e.params.id);
@@ -1477,7 +1477,7 @@ class He {
           return o.view(this.adminUpdateUserPage, s);
         } catch (r) {
           const s = l.asCrossauthError(r);
-          return d.logger.error(c({ err: r })), y.sendPageError(
+          return d.logger.error(c({ err: r })), b.sendPageError(
             o,
             s.httpStatus,
             this.sessionServer.errorPage,
@@ -1496,7 +1496,7 @@ class He {
           url: this.adminPrefix + "updateuser",
           ip: e.ip,
           user: (s = e.user) == null ? void 0 : s.username
-        })), !this.sessionServer.canEditUser(e)) return y.sendPageError(
+        })), !this.sessionServer.canEditUser(e)) return b.sendPageError(
           o,
           401,
           this.sessionServer.errorPage
@@ -1531,7 +1531,7 @@ class He {
             urlPrefix: this.adminPrefix,
             allowedFactor2: this.sessionServer.allowedFactor2Details(),
             ...e.body
-          }) : y.sendPageError(
+          }) : b.sendPageError(
             t,
             n.httpStatus,
             this.sessionServer.errorPage,
@@ -1556,7 +1556,7 @@ class He {
           ip: e.ip
         }));
         let r;
-        if (!(e != null && e.user) || !y.isAdmin(e.user))
+        if (!(e != null && e.user) || !b.isAdmin(e.user))
           return this.accessDeniedPage(e, o);
         try {
           if (!this.sessionServer.userStorage) throw new l(g.Configuration, "Cannot call deleteuser unless a user storage is provided");
@@ -1644,7 +1644,7 @@ class He {
           url: this.adminPrefix + "api/updateuser",
           ip: e.ip,
           user: (s = e.user) == null ? void 0 : s.username
-        })), !e.user || !y.isAdmin(e.user))
+        })), !e.user || !b.isAdmin(e.user))
           return this.sessionServer.sendJsonError(o, 401);
         let r;
         try {
@@ -1694,7 +1694,7 @@ class He {
           url: this.adminPrefix + "changepassword",
           ip: e.ip,
           user: (r = e.user) == null ? void 0 : r.username
-        })), !(e != null && e.user) || !y.isAdmin(e.user))
+        })), !(e != null && e.user) || !b.isAdmin(e.user))
           return this.accessDeniedPage(e, o);
         try {
           const { user: s } = await this.sessionServer.userStorage.getUserById(e.params.id);
@@ -1706,7 +1706,7 @@ class He {
           return o.view(this.adminChangePasswordPage, i);
         } catch (s) {
           const i = l.asCrossauthError(s);
-          return d.logger.error(c({ err: s })), y.sendPageError(
+          return d.logger.error(c({ err: s })), b.sendPageError(
             o,
             i.httpStatus,
             this.sessionServer.errorPage,
@@ -1776,7 +1776,7 @@ class He {
           url: this.adminPrefix + "api/changepassword",
           ip: e.ip,
           user: (s = e.user) == null ? void 0 : s.username
-        })), !e.user || !y.isAdmin(e.user))
+        })), !e.user || !b.isAdmin(e.user))
           return this.sessionServer.sendJsonError(o, 401);
         let r;
         try {
@@ -1859,7 +1859,7 @@ class He {
     if (!this.sessionServer.userStorage) throw new l(g.Configuration, "Cannot call createUser unless a user storage is provided");
     if (this.sessionServer.isSessionUser(e) && !e.csrfToken)
       throw new l(g.InvalidCsrf);
-    if (!e.user || !y.isAdmin(e.user))
+    if (!e.user || !b.isAdmin(e.user))
       throw new l(g.InsufficientPriviledges);
     if (e.body.factor2 || (e.body.factor2 = this.sessionServer.allowedFactor2[0]), e.body.factor2 && !this.sessionServer.allowedFactor2.includes(e.body.factor2 ?? "none"))
       throw new l(
@@ -1930,7 +1930,7 @@ class He {
   }
   async updateUser(e, o, r, s) {
     if (!this.sessionServer.userStorage) throw new l(g.Configuration, "Cannot call updateUser unless a user storage is provided");
-    if (!o.user || !y.isAdmin(o.user))
+    if (!o.user || !b.isAdmin(o.user))
       throw new l(g.Unauthorized);
     if (this.sessionServer.isSessionUser(o) && !o.csrfToken) throw new l(g.InvalidCsrf);
     const i = e.factor2, n = e.state;
@@ -1961,7 +1961,7 @@ class He {
   }
   async changePassword(e, o, r, s) {
     if (!this.sessionServer.userStorage) throw new l(g.Configuration, "Cannot call updateUser unless a user storage is provided");
-    if (!o.user || !y.isAdmin(o.user))
+    if (!o.user || !b.isAdmin(o.user))
       throw new l(g.Unauthorized);
     if (this.sessionServer.isSessionUser(o) && !o.csrfToken) throw new l(g.InvalidCsrf);
     const i = this.sessionServer.authenticators[e.factor1], n = i.secretNames();
@@ -1987,22 +1987,22 @@ class He {
     if (!this.sessionServer.userStorage) throw new l(g.Configuration, "Cannot call deleteUser unless a user storage is provided");
     if (this.sessionServer.isSessionUser(e) && !e.csrfToken)
       throw new l(g.InvalidCsrf);
-    if (!e.user || !y.isAdmin(e.user))
+    if (!e.user || !b.isAdmin(e.user))
       throw new l(g.InsufficientPriviledges);
     return await this.sessionServer.userStorage.deleteUserById(e.params.id), r(o);
   }
 }
-async function ve(k, e, o) {
+async function ve(S, e, o) {
   let r = [];
   try {
-    const s = await e.getClientById(k);
+    const s = await e.getClientById(S);
     r.push(s);
   } catch (s) {
     const i = l.asCrossauthError(s);
     if (i.code != g.UserNotExist)
       throw d.logger.debug(c({ err: i })), i;
     try {
-      r = await e.getClientByName(k, o);
+      r = await e.getClientByName(S, o);
     } catch (n) {
       const t = l.asCrossauthError(n);
       if (t.code != g.UserNotExist)
@@ -2029,7 +2029,7 @@ class Le {
       g.Configuration,
       "Must specify clientStorage if adding OAuth client endpoints"
     );
-    this.clientManager = new L(o), this.clientStorage = o.clientStorage, S("adminPrefix", C.String, this, o, "ADMIN_PREFIX"), S("createClientPage", C.String, this, o, "CREATE_CLIENT_PAGE"), S("updateClientPage", C.String, this, o, "UPDATE_CLIENT_PAGE"), S("selectClientPage", C.String, this, o, "SELECT_CLIENT_PAGE"), S("deleteClientPage", C.String, this, o, "DELETE_CLIENT_PAGE"), S("validFlows", C.JsonArray, this, o, "OAUTH_validFlows"), this.validFlows.length == 1 && this.validFlows[0] == E.All && (this.validFlows = E.allFlows()), o.clientSearchFn && (this.clientSearchFn = o.clientSearchFn);
+    this.clientManager = new L(o), this.clientStorage = o.clientStorage, C("adminPrefix", k.String, this, o, "ADMIN_PREFIX"), C("createClientPage", k.String, this, o, "CREATE_CLIENT_PAGE"), C("updateClientPage", k.String, this, o, "UPDATE_CLIENT_PAGE"), C("selectClientPage", k.String, this, o, "SELECT_CLIENT_PAGE"), C("deleteClientPage", k.String, this, o, "DELETE_CLIENT_PAGE"), C("validFlows", k.JsonArray, this, o, "OAUTH_validFlows"), this.validFlows.length == 1 && this.validFlows[0] == E.All && (this.validFlows = E.allFlows()), o.clientSearchFn && (this.clientSearchFn = o.clientSearchFn);
   }
   ///////////////////////////////////////////////////////////////////
   // Endpoints
@@ -2045,7 +2045,7 @@ class Le {
           method: "GET",
           url: this.adminPrefix + "selectclient",
           ip: e.ip
-        })), !(e != null && e.user) || !y.isAdmin(e.user))
+        })), !(e != null && e.user) || !b.isAdmin(e.user))
           return this.accessDeniedPage(e, o);
         const r = e.query.next ?? encodeURIComponent(e.url);
         try {
@@ -2079,7 +2079,7 @@ class Le {
           return e.query.next && (h.next = e.query.next), o.view(this.selectClientPage, h);
         } catch (s) {
           const i = l.asCrossauthError(s);
-          return d.logger.error(c({ err: s })), y.sendPageError(
+          return d.logger.error(c({ err: s })), b.sendPageError(
             o,
             i.httpStatus,
             this.sessionServer.errorPage,
@@ -2102,7 +2102,7 @@ class Le {
           method: "GET",
           url: this.adminPrefix + "createclient",
           ip: e.ip
-        })), !(e != null && e.user) || !y.isAdmin(e.user))
+        })), !(e != null && e.user) || !b.isAdmin(e.user))
           return this.accessDeniedPage(e, o);
         let r = e.query.next;
         r || (e.query.userid ? r = this.adminPrefix + "selectuser" : r = this.adminPrefix + "selectclient");
@@ -2207,7 +2207,7 @@ class Le {
           method: "GET",
           url: this.adminPrefix + "updateclient",
           ip: e.ip
-        })), !(e != null && e.user) || !y.isAdmin(e.user))
+        })), !(e != null && e.user) || !b.isAdmin(e.user))
           return this.accessDeniedPage(e, o);
         let r;
         try {
@@ -2338,7 +2338,7 @@ class Le {
           ip: e.ip
         }));
         let r;
-        if (!(e != null && e.user) || !y.isAdmin(e.user))
+        if (!(e != null && e.user) || !b.isAdmin(e.user))
           return this.accessDeniedPage(e, o);
         try {
           r = await this.clientStorage.getClientById(e.params.client_id);
@@ -2566,7 +2566,7 @@ class Le {
   async createClient(e, o, r, s) {
     if (this.sessionServer.isSessionUser(e) && !e.csrfToken)
       throw new l(g.InvalidCsrf);
-    if (!e.user || !y.isAdmin(e.user))
+    if (!e.user || !b.isAdmin(e.user))
       throw new l(g.InsufficientPriviledges);
     const i = e.body.confidential == "true", n = e.body.client_name, t = e.body.redirect_uris.trim().length == 0 ? [] : e.body.redirect_uris.trim().split(/[, ][ \t\n]*/);
     let a = [];
@@ -2596,7 +2596,7 @@ class Le {
   async updateClient(e, o, r) {
     if (this.sessionServer.isSessionUser(e) && !e.csrfToken)
       throw new l(g.InvalidCsrf);
-    if (!e.user || !y.isAdmin(e.user))
+    if (!e.user || !b.isAdmin(e.user))
       throw new l(g.InsufficientPriviledges);
     const s = e.body.redirect_uris.trim().length == 0 ? [] : e.body.redirect_uris.trim().split(/[, ][ \t\n]*/);
     let i = [];
@@ -2626,7 +2626,7 @@ class Le {
   async deleteClient(e, o, r) {
     if (this.sessionServer.isSessionUser(e) && !e.csrfToken)
       throw new l(g.InvalidCsrf);
-    if (!e.user || !y.isAdmin(e.user))
+    if (!e.user || !b.isAdmin(e.user))
       throw new l(g.InsufficientPriviledges);
     return await this.clientStorage.deleteClient(e.params.client_id), r(o);
   }
@@ -2654,7 +2654,7 @@ class Ge {
       g.Configuration,
       "Must specify clientStorage if adding OAuth client endpoints"
     );
-    this.clientManager = new L(o), this.clientStorage = o.clientStorage, S("prefix", C.String, this, o, "PREFIX"), S("createClientPage", C.String, this, o, "CREATE_CLIENT_PAGE"), S("updateClientPage", C.String, this, o, "UPDATE_CLIENT_PAGE"), S("selectClientPage", C.String, this, o, "SELECT_CLIENT_PAGE"), S("deleteClientPage", C.String, this, o, "DELETE_CLIENT_PAGE"), S("validFlows", C.JsonArray, this, o, "OAUTH_validFlows"), this.validFlows.length == 1 && this.validFlows[0] == E.All && (this.validFlows = E.allFlows()), o.clientSearchFn && (this.clientSearchFn = o.clientSearchFn);
+    this.clientManager = new L(o), this.clientStorage = o.clientStorage, C("prefix", k.String, this, o, "PREFIX"), C("createClientPage", k.String, this, o, "CREATE_CLIENT_PAGE"), C("updateClientPage", k.String, this, o, "UPDATE_CLIENT_PAGE"), C("selectClientPage", k.String, this, o, "SELECT_CLIENT_PAGE"), C("deleteClientPage", k.String, this, o, "DELETE_CLIENT_PAGE"), C("validFlows", k.JsonArray, this, o, "OAUTH_validFlows"), this.validFlows.length == 1 && this.validFlows[0] == E.All && (this.validFlows = E.allFlows()), o.clientSearchFn && (this.clientSearchFn = o.clientSearchFn);
   }
   ///////////////////////////////////////////////////////////////////
   // Endpoints
@@ -2698,7 +2698,7 @@ class Ge {
           return e.query.next && (t.next = e.query.next), o.view(this.selectClientPage, t);
         } catch (r) {
           const s = l.asCrossauthError(r);
-          return d.logger.error(c({ err: r })), y.sendPageError(
+          return d.logger.error(c({ err: r })), b.sendPageError(
             o,
             s.httpStatus,
             this.sessionServer.errorPage,
@@ -3323,29 +3323,29 @@ const A = ["Content-Type", "application/json; charset=utf-8"], re = [
   ...ge,
   ...oe
 ];
-function Ve(k) {
+function Ve(S) {
   let e = [];
-  return k.username == null ? e.push("Username must be given") : k.username.length < 2 ? e.push("Username must be at least 2 characters") : k.username.length > 254 && e.push("Username must be no longer than 254 characters"), e;
+  return S.username == null ? e.push("Username must be given") : S.username.length < 2 ? e.push("Username must be at least 2 characters") : S.username.length > 254 && e.push("Username must be no longer than 254 characters"), e;
 }
-function We(k, e) {
+function We(S, e) {
   let r = {
-    username: k.body.username,
+    username: S.body.username,
     state: "active"
   };
-  const s = k.user && y.isAdmin(k.user);
-  for (let i in k.body) {
+  const s = S.user && b.isAdmin(S.user);
+  for (let i in S.body) {
     let n = i.replace(/^user_/, "");
-    i.startsWith("user_") && (s || e.includes(n)) && (r[n] = k.body[i]);
+    i.startsWith("user_") && (s || e.includes(n)) && (r[n] = S.body[i]);
   }
-  return r.factor1 = "localpassword", r.factor2 = k.body.factor2, r;
+  return r.factor1 = "localpassword", r.factor2 = S.body.factor2, r;
 }
-function Je(k, e, o) {
-  const r = e.user && y.isAdmin(e.user);
+function Je(S, e, o) {
+  const r = e.user && b.isAdmin(e.user);
   for (let s in e.body) {
     let i = s.replace(/^user_/, "");
-    s.startsWith("user_") && (r || o.includes(i)) && (k[i] = e.body[s]);
+    s.startsWith("user_") && (r || o.includes(i)) && (S[i] = e.body[s]);
   }
-  return k;
+  return S;
 }
 class Ke {
   /**
@@ -3460,7 +3460,7 @@ class Ke {
     ]);
     u(this, "editUserScope");
     u(this, "enableCsrfProtection", !0);
-    this.app = e, this.userEndpoints = new De(this, s), this.adminEndpoints = new He(this, s), S("prefix", C.String, this, s, "PREFIX"), this.prefix.endsWith("/") || (this.prefix += "/"), this.prefix.startsWith("/") || "" + this.prefix, this.loginUrl = this.prefix + "login", S("signupPage", C.String, this, s, "SIGNUP_PAGE"), S("loginPage", C.String, this, s, "LOGIN_PAGE"), S("factor2Page", C.String, this, s, "FACTOR2_PAGE"), S("configureFactor2Page", C.String, this, s, "SIGNUP_FACTOR2_PAGE"), S("errorPage", C.String, this, s, "ERROR_PAGE"), S("emailFrom", C.String, this, s, "EMAIL_FROM"), S("allowedFactor2", C.JsonArray, this, s, "ALLOWED_FACTOR2"), S("enableEmailVerification", C.Boolean, this, s, "ENABLE_EMAIL_VERIFICATION"), S("enablePasswordReset", C.Boolean, this, s, "ENABLE_PASSWORD_RESET"), S("factor2ProtectedPageEndpoints", C.JsonArray, this, s, "FACTOR2_PROTECTED_PAGE_ENDPOINTS"), S("factor2ProtectedApiEndpoints", C.JsonArray, this, s, "FACTOR2_PROTECTED_API_ENDPOINTS"), S("enableAdminEndpoints", C.Boolean, this, s, "ENABLE_ADMIN_ENDPOINTS"), S("enableOAuthClientManagement", C.Boolean, this, s, "ENABLE_OAUTH_CLIENT_MANAGEMENT"), S("editUserScope", C.String, this, s, "EDIT_USER_SCOPE"), s.validateUserFn && (this.validateUserFn = s.validateUserFn), s.createUserFn && (this.createUserFn = s.createUserFn), s.updateUserFn && (this.updateUserFn = s.updateUserFn), s.addToSession && (this.addToSession = s.addToSession), s.validateSession && (this.validateSession = s.validateSession), this.endpoints = [...he, ...le], this.endpoints = [...this.endpoints, ...re, ...ie], this.enableAdminEndpoints && (this.endpoints = [...this.endpoints, ...se, ...te]), this.enableOAuthClientManagement && (this.endpoints = [...this.endpoints, ...Z, ...ee, ...Q, ...q]), this.enableEmailVerification && (this.endpoints = [...this.endpoints, ...ae, ...ne]), this.enablePasswordReset && (this.endpoints = [...this.endpoints, ...de, ...ce]), s.endpoints && (S("endpoints", C.JsonArray, this, s, "SESSION_ENDPOINTS"), this.endpoints.length == 1 && this.endpoints[0] == "all" && (this.endpoints = je), this.endpoints.length == 1 && this.endpoints[0] == "allMinusOAuth" && (this.endpoints = Be)), this.allowedFactor2.length > 0 && (this.endpoints = [...this.endpoints, ...ge, ...oe]);
+    this.app = e, this.userEndpoints = new De(this, s), this.adminEndpoints = new He(this, s), C("prefix", k.String, this, s, "PREFIX"), this.prefix.endsWith("/") || (this.prefix += "/"), this.prefix.startsWith("/") || "" + this.prefix, this.loginUrl = this.prefix + "login", C("signupPage", k.String, this, s, "SIGNUP_PAGE"), C("loginPage", k.String, this, s, "LOGIN_PAGE"), C("factor2Page", k.String, this, s, "FACTOR2_PAGE"), C("configureFactor2Page", k.String, this, s, "SIGNUP_FACTOR2_PAGE"), C("errorPage", k.String, this, s, "ERROR_PAGE"), C("emailFrom", k.String, this, s, "EMAIL_FROM"), C("allowedFactor2", k.JsonArray, this, s, "ALLOWED_FACTOR2"), C("enableEmailVerification", k.Boolean, this, s, "ENABLE_EMAIL_VERIFICATION"), C("enablePasswordReset", k.Boolean, this, s, "ENABLE_PASSWORD_RESET"), C("factor2ProtectedPageEndpoints", k.JsonArray, this, s, "FACTOR2_PROTECTED_PAGE_ENDPOINTS"), C("factor2ProtectedApiEndpoints", k.JsonArray, this, s, "FACTOR2_PROTECTED_API_ENDPOINTS"), C("enableAdminEndpoints", k.Boolean, this, s, "ENABLE_ADMIN_ENDPOINTS"), C("enableOAuthClientManagement", k.Boolean, this, s, "ENABLE_OAUTH_CLIENT_MANAGEMENT"), C("editUserScope", k.String, this, s, "EDIT_USER_SCOPE"), s.validateUserFn && (this.validateUserFn = s.validateUserFn), s.createUserFn && (this.createUserFn = s.createUserFn), s.updateUserFn && (this.updateUserFn = s.updateUserFn), s.addToSession && (this.addToSession = s.addToSession), s.validateSession && (this.validateSession = s.validateSession), this.endpoints = [...he, ...le], this.endpoints = [...this.endpoints, ...re, ...ie], this.enableAdminEndpoints && (this.endpoints = [...this.endpoints, ...se, ...te]), this.enableOAuthClientManagement && (this.endpoints = [...this.endpoints, ...Z, ...ee, ...Q, ...q]), this.enableEmailVerification && (this.endpoints = [...this.endpoints, ...ae, ...ne]), this.enablePasswordReset && (this.endpoints = [...this.endpoints, ...de, ...ce]), s.endpoints && (C("endpoints", k.JsonArray, this, s, "SESSION_ENDPOINTS"), this.endpoints.length == 1 && this.endpoints[0] == "all" && (this.endpoints = je), this.endpoints.length == 1 && this.endpoints[0] == "allMinusOAuth" && (this.endpoints = Be)), this.allowedFactor2.length > 0 && (this.endpoints = [...this.endpoints, ...ge, ...oe]);
     let i = !1;
     for (let t of this.endpoints)
       if (q.includes(t) || Q.includes(t)) {
@@ -3474,7 +3474,7 @@ class Ke {
         n = !0;
         break;
       }
-    n && (this.userClientEndpoints = new Ge(this, s)), this.addEndpoints(), S("endpoints", C.JsonArray, this, s, "ENDPOINTS"), s.userStorage && (this.userStorage = s.userStorage), this.authenticators = r, this.sessionManager = new Ae(o, r, s), e.addHook("preHandler", async (t, a) => {
+    n && (this.userClientEndpoints = new Ge(this, s)), this.addEndpoints(), C("endpoints", k.JsonArray, this, s, "ENDPOINTS"), s.userStorage && (this.userStorage = s.userStorage), this.authenticators = r, this.sessionManager = new Ae(o, r, s), e.addHook("preHandler", async (t, a) => {
       var v, m;
       d.logger.debug(c({ msg: "Getting session cookie" }));
       let h = this.getSessionCookieValue(t), f = {};
@@ -3555,8 +3555,8 @@ class Ke {
                 d.logger.debug("Cancelling 2FA");
                 try {
                   await this.sessionManager.cancelTwoFactorPageVisit(P);
-                } catch (U) {
-                  d.logger.debug(c({ err: U })), d.logger.error(c({ msg: "Failed cancelling 2FA", cerr: U, user: (v = t.user) == null ? void 0 : v.username, hashOfSessionId: this.getHashOfSessionId(t) }));
+                } catch (N) {
+                  d.logger.debug(c({ err: N })), d.logger.error(c({ msg: "Failed cancelling 2FA", cerr: N, user: (v = t.user) == null ? void 0 : v.username, hashOfSessionId: this.getHashOfSessionId(t) }));
                 }
               }
             }
@@ -3565,25 +3565,25 @@ class Ke {
             if ("pre2fa" in w) {
               d.logger.debug("Completing 2FA");
               const T = [...this.authenticators[w.pre2fa.factor2].transientSecretNames()];
-              let U = {};
+              let N = {};
               for (let M in t.body)
-                T.includes(M) && (U[M] = t.body[M]);
-              let _;
+                T.includes(M) && (N[M] = t.body[M]);
+              let y;
               try {
-                await this.sessionManager.completeTwoFactorPageVisit(U, m);
+                await this.sessionManager.completeTwoFactorPageVisit(N, m);
               } catch (M) {
-                _ = l.asCrossauthError(M), d.logger.debug(c({ err: M }));
+                y = l.asCrossauthError(M), d.logger.debug(c({ err: M }));
                 const I = l.asCrossauthError(M);
                 d.logger.error(c({
-                  msg: _.message,
+                  msg: y.message,
                   cerr: M,
                   user: t.body.username,
                   errorCode: I.code,
                   errorCodeName: I.codeName
                 }));
               }
-              if (t.body = w.pre2fa.body, _)
-                if (_.code == g.Expired) {
+              if (t.body = w.pre2fa.body, y)
+                if (y.code == g.Expired) {
                   d.logger.debug("Error - cancelling 2FA");
                   try {
                     await this.sessionManager.cancelTwoFactorPageVisit(m);
@@ -3592,18 +3592,18 @@ class Ke {
                   }
                   t.body = {
                     ...t.body,
-                    errorMessage: _.message,
-                    errorMessages: _.message,
-                    errorCode: "" + _.code,
-                    errorCodeName: g[_.code]
+                    errorMessage: y.message,
+                    errorMessages: y.message,
+                    errorCode: "" + y.code,
+                    errorCodeName: g[y.code]
                   };
                 } else
-                  return this.factor2ProtectedPageEndpoints.includes(t.url) ? a.redirect(this.prefix + "factor2?error=" + g[_.code]) : a.status(_.httpStatus).send(JSON.stringify({
+                  return this.factor2ProtectedPageEndpoints.includes(t.url) ? a.redirect(this.prefix + "factor2?error=" + g[y.code]) : a.status(y.httpStatus).send(JSON.stringify({
                     ok: !1,
-                    errorMessage: _.message,
-                    errorMessages: _.messages,
-                    errorCode: _.code,
-                    errorCodeName: g[_.code]
+                    errorMessage: y.message,
+                    errorMessages: y.messages,
+                    errorCode: y.code,
+                    errorCodeName: g[y.code]
                   }));
             } else
               return this.validateCsrfToken(t), d.logger.debug("Starting 2FA"), this.sessionManager.initiateTwoFactorPageVisit(t.user, m, t.body, t.url.replace(/\?.*$/, "")), this.factor2ProtectedPageEndpoints.includes(t.url) ? a.redirect(this.prefix + "factor2") : a.send(JSON.stringify({
@@ -4809,7 +4809,7 @@ class $e {
       s,
       i,
       n
-    ), S("prefix", C.String, this, n, "PREFIX"), this.prefix.endsWith("/") || (this.prefix += "/"), S("errorPage", C.String, this, n, "ERROR_PAGE"), S("devicePage", C.String, this, n, "OAUTH_DEVICE_PAGE"), S("loginUrl", C.String, this, n, "LOGIN_URL"), S("oauthAuthorizePage", C.String, this, n, "OAUTH_AUTHORIZE_PAGE"), S("refreshTokenType", C.String, this, n, "OAUTH_REFRESH_TOKEN_TYPE"), S("refreshTokenCookieName", C.String, this, n, "OAUTH_REFRESH_TOKEN_COOKIE_NAME"), S("refreshTokenCookieDomain", C.String, this, n, "OAUTH_REFRESH_TOKEN_COOKIE_DOMAIN"), S("refreshTokenCookieHttpOnly", C.Boolean, this, n, "OAUTH_REFRESH_TOKEN_COOKIE_HTTPONLY"), S("refreshTokenCookiePath", C.String, this, n, "OAUTH_REFRESH_TOKEN_COOKIE_PATH"), S("refreshTokenCookieSecure", C.Boolean, this, n, "OAUTH_REFRESH_TOKEN_COOKIE_SECURE"), S("refreshTokenCookieSameSite", C.String, this, n, "OAUTH_REFRESH_TOKEN_COOKIE_SAMESITE"), S("createGetCsrfTokenEndpoint", C.String, this, n, "OAUTH_CREATE_GET_CSRF_TOKEN_ENDPOINT"), this.refreshTokenType != "json" && (this.createGetCsrfTokenEndpoint ? this.csrfTokens = new Ue(n.doubleSubmitCookieOptions) : this.fastifyServer.sessionServer && (this.csrfTokens = this.fastifyServer.sessionServer.sessionManager.csrfTokens)), this.createGetCsrfTokenEndpoint && this.addApiGetCsrfTokenEndpoints(), e.get(
+    ), C("prefix", k.String, this, n, "PREFIX"), this.prefix.endsWith("/") || (this.prefix += "/"), C("errorPage", k.String, this, n, "ERROR_PAGE"), C("devicePage", k.String, this, n, "OAUTH_DEVICE_PAGE"), C("loginUrl", k.String, this, n, "LOGIN_URL"), C("oauthAuthorizePage", k.String, this, n, "OAUTH_AUTHORIZE_PAGE"), C("refreshTokenType", k.String, this, n, "OAUTH_REFRESH_TOKEN_TYPE"), C("refreshTokenCookieName", k.String, this, n, "OAUTH_REFRESH_TOKEN_COOKIE_NAME"), C("refreshTokenCookieDomain", k.String, this, n, "OAUTH_REFRESH_TOKEN_COOKIE_DOMAIN"), C("refreshTokenCookieHttpOnly", k.Boolean, this, n, "OAUTH_REFRESH_TOKEN_COOKIE_HTTPONLY"), C("refreshTokenCookiePath", k.String, this, n, "OAUTH_REFRESH_TOKEN_COOKIE_PATH"), C("refreshTokenCookieSecure", k.Boolean, this, n, "OAUTH_REFRESH_TOKEN_COOKIE_SECURE"), C("refreshTokenCookieSameSite", k.String, this, n, "OAUTH_REFRESH_TOKEN_COOKIE_SAMESITE"), C("createGetCsrfTokenEndpoint", k.String, this, n, "OAUTH_CREATE_GET_CSRF_TOKEN_ENDPOINT"), this.refreshTokenType != "json" && (this.createGetCsrfTokenEndpoint ? this.csrfTokens = new Ue(n.doubleSubmitCookieOptions) : this.fastifyServer.sessionServer && (this.csrfTokens = this.fastifyServer.sessionServer.sessionManager.csrfTokens)), this.createGetCsrfTokenEndpoint && this.addApiGetCsrfTokenEndpoints(), e.get(
       this.prefix + ".well-known/openid-configuration",
       async (t, a) => a.header(...x).status(200).send(
         this.authServer.oidcConfiguration({
@@ -4834,7 +4834,7 @@ class $e {
       this.prefix + "userauthorize",
       async (t, a) => {
         var p, v;
-        if (d.logger.info(c({ msg: "Page visit", method: "POST", url: this.prefix + "authorize", ip: t.ip, user: (p = t.user) == null ? void 0 : p.username })), !t.user) return y.sendPageError(
+        if (d.logger.info(c({ msg: "Page visit", method: "POST", url: this.prefix + "authorize", ip: t.ip, user: (p = t.user) == null ? void 0 : p.username })), !t.user) return b.sendPageError(
           a,
           401,
           this.errorPage
@@ -4903,8 +4903,8 @@ class $e {
           let w, P;
           const T = t.headers.authorization.split(" ");
           if (T.length == 2 && T[0].toLocaleLowerCase() == "basic") {
-            const _ = F.base64Decode(T[1]).split(":", 2);
-            _.length == 2 && (w = _[0], P = _[1]);
+            const y = F.base64Decode(T[1]).split(":", 2);
+            y.length == 2 && (w = y[0], P = y[1]);
           }
           w == null || P == null ? d.logger.warn(c({
             msg: "Ignoring malform authenization header " + t.headers.authorization
@@ -5007,8 +5007,8 @@ class $e {
           let m, w;
           const P = t.headers.authorization.split(" ");
           if (P.length == 2 && P[0].toLocaleLowerCase() == "basic") {
-            const U = F.base64Decode(P[1]).split(":", 2);
-            U.length == 2 && (m = U[0], w = U[1]);
+            const N = F.base64Decode(P[1]).split(":", 2);
+            N.length == 2 && (m = N[0], w = N[1]);
           }
           m == null || w == null ? d.logger.warn(c({
             msg: "Ignoring malform authenization header " + t.headers.authorization
@@ -5567,9 +5567,9 @@ class $e {
     }
   }
 }
-const b = ["Content-Type", "application/json; charset=utf-8"];
-async function pe(k, e, o, r) {
-  return d.logger.debug(c({ err: r })), o.header(...b).status(r.httpStatus).send({
+const _ = ["Content-Type", "application/json; charset=utf-8"];
+async function pe(S, e, o, r) {
+  return d.logger.debug(c({ err: r })), o.header(..._).status(r.httpStatus).send({
     ok: !1,
     status: r.httpStatus,
     errorMessage: r.message,
@@ -5578,75 +5578,79 @@ async function pe(k, e, o, r) {
     errorCodeName: r.codeName
   });
 }
-async function Xe(k, e, o, r) {
+async function Xe(S, e, o, r) {
   var s;
-  return d.logger.debug(c({ err: r })), o.status(r.httpStatus).view(((s = k.oAuthClient) == null ? void 0 : s.errorPage) ?? "error.njk", {
+  return d.logger.debug(c({ err: r })), o.status(r.httpStatus).view(((s = S.oAuthClient) == null ? void 0 : s.errorPage) ?? "error.njk", {
     status: r.httpStatus,
     errorMessage: r.message,
     errorMessages: r.messages,
     errorCodeName: r.codeName
   });
 }
-function j(k) {
+function j(S) {
   let e;
-  if (k)
+  if (S)
     try {
-      e = JSON.parse(F.base64Decode(k.split(".")[1]));
-    } catch {
-      d.logger.error(c({ msg: "Couldn't decode id token" }));
+      e = JSON.parse(F.base64Decode(S.split(".")[1]));
+    } catch (o) {
+      const r = l.asCrossauthError(o);
+      d.logger.debug(c({ err: r })), d.logger.error(c({ msg: "Couldn't decode id token", cerr: r }));
     }
   return e;
 }
-async function me(k, e, o, r) {
+async function me(S, e, o, r) {
   if (r) {
-    let s = { ok: !0, ...k };
-    return e.jwtTokens.includes("id") && (s.id_payload = j(k.id_token)), r.header(...b).status(200).send(s);
+    let s = { ok: !0, ...S };
+    return e.jwtTokens.includes("id") && (s.id_payload = S.id_payload ?? j(S.id_token)), r.header(..._).status(200).send(s);
   }
 }
-function fe(k, e) {
-  var o, r, s;
-  if (k.access_token)
+function fe(S, e) {
+  var o;
+  if (S.access_token)
     try {
-      if (k.access_token && e.includes("access")) {
-        const i = (o = J(k.access_token)) == null ? void 0 : o.jti, n = i ? F.hash(i) : void 0;
+      if (S.access_token && e.includes("access")) {
+        const r = J(S.access_token), s = r.jti ? r.jti : r.sid ? r.sid : "", i = s ? F.hash(s) : void 0;
         d.logger.debug(c({
           msg: "Got access token",
-          accessTokenHash: n
+          accessTokenHash: i
         }));
       }
-    } catch (i) {
-      d.logger.debug(c({ err: i }));
+    } catch (r) {
+      d.logger.debug(c({ err: r }));
     }
-  if (k.id_token)
+  if (S.id_token)
     try {
-      if (k.id_token && e.includes("id")) {
-        const i = (r = J(k.id_token)) == null ? void 0 : r.jti, n = i ? F.hash(i) : void 0;
-        d.logger.debug(c({
-          msg: "Got id token",
-          idTokenHash: n
-        }));
+      if (S.id_token && e.includes("id")) {
+        let r = S.id_payload ?? J(S.id_token);
+        if (r) {
+          const s = r.jti ? r.jti : r.sid ? r.sid : "", i = s ? F.hash(s) : void 0;
+          d.logger.debug(c({
+            msg: "Got id token",
+            idTokenHash: i
+          }));
+        }
       }
-    } catch (i) {
-      d.logger.debug(c({ err: i }));
+    } catch (r) {
+      d.logger.debug(c({ err: r }));
     }
-  if (k.refresh_token && e.includes("refresh"))
+  if (S.refresh_token && e.includes("refresh"))
     try {
-      if (k.refresh_token) {
-        const i = (s = J(k.refresh_token)) == null ? void 0 : s.jti, n = i ? F.hash(i) : void 0;
+      if (S.refresh_token) {
+        const r = (o = J(S.refresh_token)) == null ? void 0 : o.jti, s = r ? F.hash(r) : void 0;
         d.logger.debug(c({
           msg: "Got refresh token",
-          refreshTokenHash: n
+          refreshTokenHash: s
         }));
       }
-    } catch (i) {
-      d.logger.debug(c({ err: i }));
+    } catch (r) {
+      d.logger.debug(c({ err: r }));
     }
 }
-async function Qe(k, e, o, r) {
-  if (k.error) {
+async function Qe(S, e, o, r) {
+  if (S.error) {
     const s = l.fromOAuthError(
-      k.error,
-      k.error_description
+      S.error,
+      S.error_description
     );
     if (r)
       return r.status(s.httpStatus).view(e.errorPage, {
@@ -5656,10 +5660,10 @@ async function Qe(k, e, o, r) {
         errorCode: s.code
       });
   }
-  if (fe(k, e.jwtTokens), r)
+  if (fe(S, e.jwtTokens), r)
     try {
-      let s = { ...k };
-      return e.jwtTokens.includes("id") && (s.id_payload = j(k.id_token)), r.status(200).view(e.authorizedPage, s);
+      let s = { ...S };
+      return e.jwtTokens.includes("id") && S.id_token && (s.id_payload = S.id_payload ?? j(S.id_token)), r.status(200).view(e.authorizedPage, s);
     } catch (s) {
       const i = l.asCrossauthError(s);
       return r.status(i.httpStatus).view(e.errorPage, {
@@ -5669,11 +5673,11 @@ async function Qe(k, e, o, r) {
       });
     }
 }
-async function Ze(k, e, o, r) {
-  if (k.error) {
+async function Ze(S, e, o, r) {
+  if (S.error) {
     const s = l.fromOAuthError(
-      k.error,
-      k.error_description
+      S.error,
+      S.error_description
     );
     if (r)
       return r.status(s.httpStatus).view(e.errorPage, {
@@ -5683,9 +5687,9 @@ async function Ze(k, e, o, r) {
         errorCode: s.code
       });
   }
-  fe(k, e.jwtTokens);
+  fe(S, e.jwtTokens);
   try {
-    if ((k.access_token || k.id_token || k.refresh_token) && await Se(k, e, o, r), r) {
+    if ((S.access_token || S.id_token || S.refresh_token) && await Se(S, e, o, r), r) {
       if (!e.authorizedPage)
         return r.status(500).view(e.errorPage, {
           status: 500,
@@ -5693,8 +5697,8 @@ async function Ze(k, e, o, r) {
           errorCodeName: g[g.Configuration],
           errorCode: g.Configuration
         });
-      let s = { ...k };
-      return e.jwtTokens.includes("id") && (s.id_payload = j(k.id_token)), r.status(200).view(e.authorizedPage, s);
+      let s = { ...S };
+      return e.jwtTokens.includes("id") && (s.id_payload = S.id_payload ?? j(S.id_token)), r.status(200).view(e.authorizedPage, s);
     }
   } catch (s) {
     const i = l.asCrossauthError(s);
@@ -5706,14 +5710,14 @@ async function Ze(k, e, o, r) {
       });
   }
 }
-async function Se(k, e, o, r) {
+async function Se(S, e, o, r) {
   if (!e.server.sessionAdapter) throw new l(
     g.Configuration,
     "Cannot update session data if sessions not enabled"
   );
-  let s = k.expires_in;
-  if (!s && k.access_token && e.jwtTokens.includes("access")) {
-    const t = J(k.access_token);
+  let s = S.expires_in;
+  if (!s && S.access_token && e.jwtTokens.includes("access")) {
+    const t = J(S.access_token);
     t.exp && (s = t.exp);
   }
   if (!s)
@@ -5722,31 +5726,18 @@ async function Se(k, e, o, r) {
       "OAuth server did not return an expiry for the access token"
     );
   const i = Date.now() + s * 1e3;
-  let n = { ...k, expires_at: i };
-  if ("id_token" in k) {
-    let t = j(k.id_token);
+  let n = { ...S, expires_at: i };
+  if ("id_token" in S) {
+    let t = S.id_payload ?? j(S.id_token);
     t && (n.id_token = t);
   }
-  if (e.server.sessionServer) {
-    let t = e.server.sessionServer.getSessionCookieValue(o);
-    !t && r ? t = await e.server.createAnonymousSession(
-      o,
-      r,
-      { [e.sessionDataName]: n }
-    ) : await e.server.sessionAdapter.updateSessionData(o, e.sessionDataName, n);
-  } else {
-    if (!e.server.sessionAdapter) throw new l(
-      g.Configuration,
-      "Cannot get session data if sessions not enabled"
-    );
-    await e.server.sessionAdapter.updateSessionData(o, e.sessionDataName, n);
-  }
+  await e.storeSessionData(n, o, r);
 }
-async function qe(k, e, o, r) {
-  if (k.error) {
+async function qe(S, e, o, r) {
+  if (S.error) {
     const s = l.fromOAuthError(
-      k.error,
-      k.error_description
+      S.error,
+      S.error_description
     );
     if (r)
       return r.status(s.httpStatus).view(e.errorPage, {
@@ -5756,9 +5747,9 @@ async function qe(k, e, o, r) {
         errorCode: s.code
       });
   }
-  fe(k, e.jwtTokens);
+  fe(S, e.jwtTokens);
   try {
-    if ((k.access_token || k.id_token || k.refresh_token) && await Se(k, e, o, r), r)
+    if ((S.access_token || S.id_token || S.refresh_token) && await Se(S, e, o, r), r)
       return e.authorizedUrl ? r.redirect(e.authorizedUrl) : r.status(500).view(e.errorPage, {
         status: 500,
         errorMessage: "Authorized url not configured",
@@ -5823,7 +5814,7 @@ class we extends Oe {
     u(this, "bffEndpointName", "bff");
     u(this, "bffBaseUrl");
     u(this, "tokenEndpoints", []);
-    if (this.server = o, S("sessionDataName", C.String, this, s, "OAUTH_SESSION_DATA_NAME"), S("siteUrl", C.String, this, s, "SITE_URL", !0), S("tokenResponseType", C.String, this, s, "OAUTH_TOKEN_RESPONSE_TYPE"), S("errorResponseType", C.String, this, s, "OAUTH_ERROR_RESPONSE_TYPE"), S("prefix", C.String, this, s, "PREFIX"), this.prefix.endsWith("/") || (this.prefix += "/"), S("loginUrl", C.String, this, s, "LOGIN_URL"), S("errorPage", C.String, this, s, "ERROR_PAGE"), S("authorizedPage", C.String, this, s, "AUTHORIZED_PAGE"), S("authorizedUrl", C.String, this, s, "AUTHORIZED_URL"), S("loginProtectedFlows", C.JsonArray, this, s, "OAUTH_LOGIN_PROTECTED_FLOWS"), S("passwordFlowUrl", C.String, this, s, "OAUTH_PASSWORD_FLOW_URL"), S("passwordOtpUrl", C.String, this, s, "OAUTH_PASSWORD_OTP_URL"), S("passwordOobUrl", C.String, this, s, "OAUTH_PASSWORD_OOB_URL"), S("passwordFlowPage", C.String, this, s, "OAUTH_PASSWORD_FLOW_PAGE"), S("deviceCodeFlowPage", C.String, this, s, "OAUTH_DEVICECODE_FLOW_PAGE"), S("deleteTokensPage", C.String, this, s, "OAUTH_DELETE_TOKENS_PAGE"), S("deleteTokensGetUrl", C.String, this, s, "OAUTH_DELETE_TOKENS_GET_URL"), S("deleteTokensPostUrl", C.String, this, s, "OAUTH_DELETE_TOKENS_POST_URL"), S("apiDeleteTokensPostUrl", C.String, this, s, "OAUTHAPI__DELETE_TOKENS_POST_URL"), S("mfaOtpPage", C.String, this, s, "OAUTH_MFA_OTP_PAGE"), S("mfaOobPage", C.String, this, s, "OAUTH_MFA_OOB_PAGE"), S("deviceCodeFlowUrl", C.String, this, s, "OAUTH_DEVICECODE_FLOW_URL"), S("deviceCodePollUrl", C.String, this, s, "OAUTH_DEVICECODE_POLL_URL"), S("bffEndpointName", C.String, this, s, "OAUTH_BFF_ENDPOINT_NAME"), S("bffBaseUrl", C.String, this, s, "OAUTH_BFF_BASEURL"), S("validFlows", C.JsonArray, this, s, "OAUTH_VALIDFLOWS"), S("jwtTokens", C.JsonArray, this, s, "OAUTH_JWT_TOKENS"), (i = this.deleteTokensGetUrl) != null && i.startsWith("/") && (this.deleteTokensGetUrl = this.deleteTokensGetUrl.substring(1)), (n = this.deleteTokensPostUrl) != null && n.startsWith("/") && (this.deleteTokensPostUrl = this.deleteTokensPostUrl.substring(1)), (t = this.deleteTokensPostUrl) != null && t.startsWith("/") && (this.deleteTokensPostUrl = this.deleteTokensPostUrl.substring(1)), this.validFlows.length == 1 && this.validFlows[0] == E.All)
+    if (this.server = o, C("sessionDataName", k.String, this, s, "OAUTH_SESSION_DATA_NAME"), C("siteUrl", k.String, this, s, "SITE_URL", !0), C("tokenResponseType", k.String, this, s, "OAUTH_TOKEN_RESPONSE_TYPE"), C("errorResponseType", k.String, this, s, "OAUTH_ERROR_RESPONSE_TYPE"), C("prefix", k.String, this, s, "PREFIX"), this.prefix.endsWith("/") || (this.prefix += "/"), C("loginUrl", k.String, this, s, "LOGIN_URL"), C("errorPage", k.String, this, s, "ERROR_PAGE"), C("authorizedPage", k.String, this, s, "AUTHORIZED_PAGE"), C("authorizedUrl", k.String, this, s, "AUTHORIZED_URL"), C("loginProtectedFlows", k.JsonArray, this, s, "OAUTH_LOGIN_PROTECTED_FLOWS"), C("passwordFlowUrl", k.String, this, s, "OAUTH_PASSWORD_FLOW_URL"), C("passwordOtpUrl", k.String, this, s, "OAUTH_PASSWORD_OTP_URL"), C("passwordOobUrl", k.String, this, s, "OAUTH_PASSWORD_OOB_URL"), C("passwordFlowPage", k.String, this, s, "OAUTH_PASSWORD_FLOW_PAGE"), C("deviceCodeFlowPage", k.String, this, s, "OAUTH_DEVICECODE_FLOW_PAGE"), C("deleteTokensPage", k.String, this, s, "OAUTH_DELETE_TOKENS_PAGE"), C("deleteTokensGetUrl", k.String, this, s, "OAUTH_DELETE_TOKENS_GET_URL"), C("deleteTokensPostUrl", k.String, this, s, "OAUTH_DELETE_TOKENS_POST_URL"), C("apiDeleteTokensPostUrl", k.String, this, s, "OAUTHAPI__DELETE_TOKENS_POST_URL"), C("mfaOtpPage", k.String, this, s, "OAUTH_MFA_OTP_PAGE"), C("mfaOobPage", k.String, this, s, "OAUTH_MFA_OOB_PAGE"), C("deviceCodeFlowUrl", k.String, this, s, "OAUTH_DEVICECODE_FLOW_URL"), C("deviceCodePollUrl", k.String, this, s, "OAUTH_DEVICECODE_POLL_URL"), C("bffEndpointName", k.String, this, s, "OAUTH_BFF_ENDPOINT_NAME"), C("bffBaseUrl", k.String, this, s, "OAUTH_BFF_BASEURL"), C("validFlows", k.JsonArray, this, s, "OAUTH_VALIDFLOWS"), C("jwtTokens", k.JsonArray, this, s, "OAUTH_JWT_TOKENS"), (i = this.deleteTokensGetUrl) != null && i.startsWith("/") && (this.deleteTokensGetUrl = this.deleteTokensGetUrl.substring(1)), (n = this.deleteTokensPostUrl) != null && n.startsWith("/") && (this.deleteTokensPostUrl = this.deleteTokensPostUrl.substring(1)), (t = this.deleteTokensPostUrl) != null && t.startsWith("/") && (this.deleteTokensPostUrl = this.deleteTokensPostUrl.substring(1)), this.validFlows.length == 1 && this.validFlows[0] == E.All)
       this.validFlows = E.allFlows();
     else if (!E.areAllValidFlows(this.validFlows))
       throw new l(g.Configuration, "Invalid flows specificied in " + this.validFlows.join(","));
@@ -5852,30 +5843,36 @@ class we extends Oe {
     this.prefix.endsWith("/") || (this.prefix += "/"), this.redirect_uri = this.siteUrl + this.prefix + "authzcode", this.validFlows.includes(E.AuthorizationCode) && this.server.app.get(
       this.prefix + "authzcodeflow",
       async (a, h) => {
-        var m;
+        var P;
         if (d.logger.info(c({
           msg: "Page visit",
           method: "GET",
           url: this.prefix + "authzcodeflow",
           ip: a.ip,
-          user: (m = a.user) == null ? void 0 : m.username
-        })), !a.user && this.loginProtectedFlows.includes(E.AuthorizationCode))
-          return h.redirect(
-            302,
-            this.loginUrl + "?next=" + encodeURIComponent(a.url)
-          );
-        const { url: f, error: p, error_description: v } = await this.startAuthorizationCodeFlow(a.query.scope);
-        if (p || !f) {
-          const w = l.fromOAuthError(
-            p ?? "server_error",
-            v
+          user: (P = a.user) == null ? void 0 : P.username
+        })), !this.server.sessionAdapter) {
+          const T = new l(g.Configuration, "Need a session server or adapter for authorization code flow");
+          return await this.errorFn(this.server, a, h, T);
+        }
+        if (!a.user && this.loginProtectedFlows.includes(E.AuthorizationCode))
+          return h.redirect(this.loginUrl + "?next=" + encodeURIComponent(a.url), 302);
+        if (!this.server.sessionAdapter) {
+          const T = new l(g.Configuration, "Need a session server or adapter for authorization code flow");
+          return await this.errorFn(this.server, a, h, T);
+        }
+        const f = this.randomValue(this.stateLength), p = { scope: a.query.scope, state: f };
+        await this.storeSessionData(p, a, h);
+        const { url: v, error: m, error_description: w } = await this.startAuthorizationCodeFlow(f, a.query.scope);
+        if (m || !v) {
+          const T = l.fromOAuthError(
+            m ?? "server_error",
+            w
           );
-          return await this.errorFn(this.server, a, h, w);
+          return await this.errorFn(this.server, a, h, T);
         }
-        return d.logger.debug(c({
-          msg: "Authorization code flow: redirecting",
-          url: f
-        })), h.redirect(f);
+        return this.oauthLogFetch ? d.logger.debug(c({ msg: "OAuth redirect", url: v })) : d.logger.debug(c({
+          msg: "OAuth redirect"
+        })), h.redirect(v);
       }
     ), o.app.addHook("preHandler", async (a, h) => {
       if (a.user || !o.sessionAdapter) return;
@@ -5905,74 +5902,77 @@ class we extends Oe {
     }), this.validFlows.includes(E.AuthorizationCodeWithPKCE) && this.server.app.get(
       this.prefix + "authzcodeflowpkce",
       async (a, h) => {
-        var m;
+        var N;
         if (d.logger.info(c({
           msg: "Page visit",
           method: "GET",
           url: this.prefix + "authzcodeflowpkce",
           ip: a.ip,
-          user: (m = a.user) == null ? void 0 : m.username
+          user: (N = a.user) == null ? void 0 : N.username
         })), !a.user && this.loginProtectedFlows.includes(E.AuthorizationCodeWithPKCE))
-          return h.redirect(
-            302,
-            this.loginUrl + "?next=" + encodeURIComponent(a.url)
-          );
-        const { url: f, error: p, error_description: v } = await this.startAuthorizationCodeFlow(
+          return h.redirect(this.loginUrl + "?next=" + encodeURIComponent(a.url), 302);
+        const f = this.randomValue(this.stateLength), { codeChallenge: p, codeVerifier: v } = await this.codeChallengeAndVerifier(), m = { scope: a.query.scope, state: f, codeChallenge: p, codeVerifier: v };
+        await this.storeSessionData(m, a, h);
+        const { url: w, error: P, error_description: T } = await this.startAuthorizationCodeFlow(
+          f,
           a.query.scope,
+          p,
           !0
         );
-        if (p || !f) {
-          const w = l.fromOAuthError(
-            p ?? "server_error",
-            v
+        if (P || !w) {
+          const y = l.fromOAuthError(
+            P ?? "server_error",
+            T
           );
-          return await this.errorFn(this.server, a, h, w);
+          return await this.errorFn(this.server, a, h, y);
         }
-        return h.redirect(f);
+        return this.oauthLogFetch ? d.logger.debug(c({ msg: "OAuth redirect", url: w })) : d.logger.debug(c({
+          msg: "OAuth redirect"
+        })), h.redirect(w);
       }
     ), (this.validFlows.includes(E.AuthorizationCode) || this.validFlows.includes(E.AuthorizationCodeWithPKCE) || this.validFlows.includes(E.OidcAuthorizationCode)) && this.server.app.get(
       this.prefix + "authzcode",
       async (a, h) => {
-        var p, v;
+        var v, m, w;
         if (d.logger.info(c({
           msg: "Page visit",
           method: "GET",
           url: this.prefix + "authzcode",
           ip: a.ip,
-          user: (p = a.user) == null ? void 0 : p.username
-        })), !a.user && (this.loginProtectedFlows.includes(E.AuthorizationCodeWithPKCE) || this.loginProtectedFlows.includes(E.AuthorizationCode)))
-          return h.redirect(
-            302,
-            this.loginUrl + "?next=" + encodeURIComponent(a.url)
-          );
-        const f = await this.redirectEndpoint(
+          user: (v = a.user) == null ? void 0 : v.username
+        })), this.oauthLogFetch && d.logger.debug(c({ msg: "Received OAuth redirect", url: a.url })), !a.user && (this.loginProtectedFlows.includes(E.AuthorizationCodeWithPKCE) || this.loginProtectedFlows.includes(E.AuthorizationCode)))
+          return h.redirect(this.loginUrl + "?next=" + encodeURIComponent(a.url), 302);
+        const f = await ((m = this.server.sessionAdapter) == null ? void 0 : m.getSessionData(a, this.sessionDataName));
+        if (!(f != null && f.state) || (f == null ? void 0 : f.state) != a.query.state)
+          throw new l(g.Unauthorized, "State does not match");
+        let p = await this.redirectEndpoint(
           a.query.code,
-          a.query.state,
+          f == null ? void 0 : f.scope,
+          f == null ? void 0 : f.codeVerifier,
           a.query.error,
           a.query.error_description
         );
-        f.id_token && (this.validateIdToken(f.id_token) || (f.error = "access_denied", f.error_description = "Invalid ID token received"));
         try {
-          if (f.error) {
-            const m = l.fromOAuthError(
-              f.error,
-              f.error_description
+          if (p.error) {
+            const P = l.fromOAuthError(
+              p.error,
+              p.error_description
             );
             return await this.errorFn(
               this.server,
               a,
               h,
-              m
+              P
             );
           }
-          return await this.receiveTokenFn(f, this, a, h);
-        } catch (m) {
-          const w = l.asCrossauthError(m);
+          return await this.receiveTokenFn(p, this, a, h);
+        } catch (P) {
+          const T = l.asCrossauthError(P);
           return d.logger.error(c({
             msg: "Error receiving token",
-            cerr: w,
-            user: (v = a.user) == null ? void 0 : v.user
-          })), d.logger.debug(c({ err: m })), await this.errorFn(this.server, a, h, w);
+            cerr: T,
+            user: (w = a.user) == null ? void 0 : w.user
+          })), d.logger.debug(c({ err: P })), await this.errorFn(this.server, a, h, T);
         }
       }
     ), this.validFlows.includes(E.ClientCredentials) && this.server.app.post(
@@ -5994,10 +5994,10 @@ class we extends Oe {
           if (m) return w;
         }
         if (!a.user && this.loginProtectedFlows.includes(E.ClientCredentials))
-          return h.status(401).header(...b).send({ ok: !1, msg: "Access denied" });
+          return h.status(401).header(..._).send({ ok: !1, msg: "Access denied" });
         try {
           const m = await this.clientCredentialsFlow((p = a.body) == null ? void 0 : p.scope);
-          if (m.id_token && (this.validateIdToken(m.id_token) || (m.error = "access_denied", m.error_description = "Invalid ID token received")), m.error) {
+          if (m.error) {
             const w = l.fromOAuthError(
               m.error,
               m.error_description
@@ -6070,10 +6070,10 @@ class we extends Oe {
           );
         }
         if (!a.user && this.loginProtectedFlows.includes(E.RefreshToken))
-          return h.status(401).header(...b).send({ ok: !1, msg: "Access denied" });
+          return h.status(401).header(..._).send({ ok: !1, msg: "Access denied" });
         try {
           const P = await this.refreshTokenFlow(v);
-          if (P.id_token && (this.validateIdToken(P.id_token) || (P.error = "access_denied", P.error_description = "Invalid ID token received")), P.error) {
+          if (P.error) {
             const T = l.fromOAuthError(
               P.error,
               P.error_description
@@ -6311,10 +6311,10 @@ class we extends Oe {
           user: (f = a.user) == null ? void 0 : f.username
         }));
         try {
-          return await this.deleteTokens(a), h.header(...b).send('{"ok": true}');
+          return await this.deleteTokens(a), h.header(..._).send('{"ok": true}');
         } catch (p) {
           const v = l.asCrossauthError(p);
-          return d.logger.debug(c({ err: v })), d.logger.error(c({ msg: "Couldn't delete oauth tokens", cerr: v })), h.header(...b).status(v.httpStatus).send(JSON.stringify({
+          return d.logger.debug(c({ err: v })), d.logger.error(c({ msg: "Couldn't delete oauth tokens", cerr: v })), h.header(..._).status(v.httpStatus).send(JSON.stringify({
             ok: !1,
             errorMessage: v.message,
             errorCode: v.code,
@@ -6328,15 +6328,15 @@ class we extends Oe {
       this.server.app.post(
         this.prefix + a,
         async (h, f) => {
-          var U;
+          var N;
           if (d.logger.info(c({
             msg: "Page visit",
             method: "POST",
             url: this.prefix + a,
             ip: h.ip,
-            user: (U = h.user) == null ? void 0 : U.username
+            user: (N = h.user) == null ? void 0 : N.username
           })), !h.csrfToken)
-            return f.header(...b).status(401).send({ ok: !1, msg: "No csrf token given" });
+            return f.header(..._).status(401).send({ ok: !1, msg: "No csrf token given" });
           let p = !1, v = a;
           a.startsWith("have_") && (v = a.replace("have_", ""), p = !0);
           let m = v.replace("_token", ""), w = !1;
@@ -6346,9 +6346,9 @@ class we extends Oe {
           );
           const P = await this.server.sessionAdapter.getSessionData(h, this.sessionDataName);
           if (!P)
-            return p ? f.header(...b).status(200).send({ ok: !1 }) : f.header(...b).status(204).send();
+            return p ? f.header(..._).status(200).send({ ok: !1 }) : f.header(..._).status(204).send();
           let T = P[v];
-          return w && (T = j(P[v])), T ? p ? f.header(...b).status(200).send({ ok: !0 }) : f.header(...b).status(200).send({ ...T }) : p ? f.header(...b).status(200).send({ ok: !1 }) : f.header(...b).status(204).send();
+          return w && (T = j(P[v])), T ? p ? f.header(..._).status(200).send({ ok: !0 }) : f.header(..._).status(200).send({ ...T }) : p ? f.header(..._).status(200).send({ ok: !1 }) : f.header(..._).status(204).send();
         }
       );
     if (this.server.app.post(
@@ -6362,25 +6362,25 @@ class we extends Oe {
           ip: a.ip,
           user: (v = a.user) == null ? void 0 : v.username
         })), !a.csrfToken)
-          return h.header(...b).status(401).send({ ok: !1, msg: "No csrf token given" });
+          return h.header(..._).status(401).send({ ok: !1, msg: "No csrf token given" });
         if (!this.server.sessionAdapter) throw new l(
           g.Configuration,
           "Cannot get session data if sessions not enabled"
         );
         const f = await this.server.sessionAdapter.getSessionData(a, this.sessionDataName);
         if (!f)
-          return h.header(...b).status(204).send();
+          return h.header(..._).status(204).send();
         let p = {};
         for (let m of this.tokenEndpoints) {
           let w = !1, P = m;
           m.startsWith("have_") && (P = m.replace("have_", ""), w = !0);
-          let T = P.replace("_token", ""), U = !1;
-          if (this.jwtTokens.includes(T) && (U = a.body.decode ?? !0), P in f) {
-            let _ = f[P];
-            U && (_ = j(f[P])), _ && (p[m] = w ? !0 : _);
+          let T = P.replace("_token", ""), N = !1;
+          if (this.jwtTokens.includes(T) && (N = a.body.decode ?? !0), P in f) {
+            let y = f[P];
+            N && (y = j(f[P])), y && (p[m] = w ? !0 : y);
           } else w && (p[m] = !1);
         }
-        return h.header(...b).status(200).send({ ...p });
+        return h.header(..._).status(200).send({ ...p });
       }
     ), this.bffEndpoints.length > 0 && !this.bffBaseUrl)
       throw new l(g.Configuration, "If enabling BFF endpoints, must also define bffBaseUrl");
@@ -6400,18 +6400,18 @@ class we extends Oe {
           url: this.prefix + this.bffEndpointName + v,
           // was url
           handler: async (w, P) => {
-            var _, M;
+            var y, M;
             d.logger.info(c({
               msg: "Page visit",
               method: w.method,
               url: w.url,
               ip: w.ip,
-              user: (_ = w.user) == null ? void 0 : _.username
+              user: (y = w.user) == null ? void 0 : y.username
             }));
             const T = w.url.substring(this.prefix.length + this.bffEndpointName.length);
             d.logger.debug(c({ msg: "Resource server URL " + T }));
-            const U = f[m] != "GET" && f[m] != "HEAD" && f[m] != "OPTIONS";
-            if (this.server.sessionAdapter && U) {
+            const N = f[m] != "GET" && f[m] != "HEAD" && f[m] != "OPTIONS";
+            if (this.server.sessionAdapter && N) {
               const { error: I, reply: V } = await o.errorIfCsrfInvalid(
                 w,
                 P,
@@ -6426,7 +6426,7 @@ class we extends Oe {
               );
               const I = await this.server.sessionAdapter.getSessionData(w, this.sessionDataName);
               if (!I)
-                return P.header(...b).status(401).send({ ok: !1 });
+                return P.header(..._).status(401).send({ ok: !1 });
               let V = I == null ? void 0 : I.access_token;
               if (I && I.access_token) {
                 const H = await ((M = o.oAuthClient) == null ? void 0 : M.refresh(
@@ -6456,9 +6456,9 @@ class we extends Oe {
               const Ce = await W.json();
               for (const H of W.headers.entries())
                 P = P.header(H[0], H[1]);
-              return P.header(...b).status(W.status).send(Ce);
+              return P.header(..._).status(W.status).send(Ce);
             } catch (I) {
-              return d.logger.error(c({ err: I })), P.header(...b).status(500).send({});
+              return d.logger.error(c({ err: I })), P.header(..._).status(500).send({});
             }
           }
         });
@@ -6480,7 +6480,7 @@ class we extends Oe {
         r.body.password,
         r.body.scope
       );
-      if (n.id_token && (this.validateIdToken(n.id_token) || (n.error = "access_denied", n.error_description = "Invalid ID token received")), n.error == "mfa_required" && n.mfa_token && this.validFlows.includes(E.PasswordMfa)) {
+      if (n.error == "mfa_required" && n.mfa_token && this.validFlows.includes(E.PasswordMfa)) {
         const t = n.mfa_token;
         if (n = await this.passwordMfa(
           o,
@@ -6488,7 +6488,7 @@ class we extends Oe {
           r.body.scope,
           r,
           s
-        ), n.id_token && (this.validateIdToken(n.id_token) || (n.error = "access_denied", n.error_description = "Invalid ID token received")), n.error) {
+        ), n.error) {
           const a = l.fromOAuthError(
             n.error,
             n.error_description
@@ -6638,7 +6638,7 @@ class we extends Oe {
       r.body.oob_code,
       r.body.binding_code
     );
-    if (i.id_token && (this.validateIdToken(i.id_token) || (i.error = "access_denied", i.error_description = "Invalid ID token received")), i.error) {
+    if (i.error) {
       const t = l.fromOAuthError(
         i.error,
         i.error_description ?? "Error completing MFA"
@@ -6695,14 +6695,14 @@ class we extends Oe {
           error: t.error,
           error_description: t.error_description
         };
-        return o ? s.header(...b).status(h.httpStatus).send(t) : s.view(this.deviceCodeFlowPage, f);
+        return o ? s.header(..._).status(h.httpStatus).send(t) : s.view(this.deviceCodeFlowPage, f);
       }
       let a;
       return t.verification_uri_complete && await Re.toDataURL(t.verification_uri_complete).then((h) => {
         a = h;
       }).catch((h) => {
         d.logger.debug(c({ err: h })), d.logger.warn(c({ msg: "Couldn't generate verification URL QR Code" }));
-      }), o ? s.header(...b).send(t) : s.view(
+      }), o ? s.header(..._).send(t) : s.view(
         this.deviceCodeFlowPage,
         {
           user: r.user,
@@ -6723,7 +6723,7 @@ class we extends Oe {
         errorCode: t.code,
         errorCodeName: t.codeName
       };
-      return o ? s.header(...b).status(t.httpStatus).send(a) : s.view(this.deviceCodeFlowPage, {
+      return o ? s.header(..._).status(t.httpStatus).send(a) : s.view(this.deviceCodeFlowPage, {
         user: r.user,
         csrfToken: r.csrfToken,
         scope: r.body.scope,
@@ -6735,7 +6735,7 @@ class we extends Oe {
     var i;
     try {
       const n = await this.pollDeviceCodeFlow(r.body.device_code);
-      return n.id_token && (this.validateIdToken(n.id_token) || (n.error = "access_denied", n.error_description = "Invalid ID token received")), n.error ? s.header(...b).send(n) : await this.receiveTokenFn(
+      return n.error ? s.header(..._).send(n) : await this.receiveTokenFn(
         n,
         this,
         r,
@@ -6766,7 +6766,7 @@ class we extends Oe {
     if (!i || t <= Date.now())
       try {
         const a = await this.refreshTokenFlow(n);
-        if (a.id_token && (this.validateIdToken(a.id_token) || (a.error = "access_denied", a.error_description = "Invalid ID token received")), !a.error && !a.access_token && (a.error = "server_error", a.error_description = "Unexpectedly did not receive error or access token"), !a.error) {
+        if (!a.error && !a.access_token && (a.error = "server_error", a.error_description = "Unexpectedly did not receive error or access token"), !a.error) {
           const p = await this.receiveTokenFn(
             a,
             this,
@@ -6817,7 +6817,7 @@ class we extends Oe {
   }
   async refreshTokens(o, r, s, i) {
     if (!o.csrfToken)
-      return r.header(...b).status(401).send({ ok: !1, msg: "No csrf token given" });
+      return r.header(..._).status(401).send({ ok: !1, msg: "No csrf token given" });
     if (!this.server.sessionAdapter) throw new l(
       g.Configuration,
       "Cannot get session data if sessions not enabled"
@@ -6825,7 +6825,7 @@ class we extends Oe {
     const n = await this.server.sessionAdapter.getSessionData(o, this.sessionDataName);
     if (!(n != null && n.refresh_token)) {
       if (s)
-        return r.header(...b).status(204).send();
+        return r.header(..._).status(204).send();
       {
         const a = new l(
           g.InvalidSession,
@@ -6848,11 +6848,11 @@ class we extends Oe {
       //onlyIfExpired ? oauthData.expires_at : undefined
       n.expires_at
     );
-    if (t && t.id_token && (this.validateIdToken(t.id_token) || (t.error = "access_denied", t.error_description = "Invalid ID token received")), !s) {
+    if (!s) {
       if (t == null) return this.receiveTokenFn({}, this, o, r);
       if (t != null) return t;
     }
-    return r.header(...b).status(200).send({ ok: !0, expires_at: t == null ? void 0 : t.expires_at });
+    return r.header(..._).status(200).send({ ok: !0, expires_at: t == null ? void 0 : t.expires_at });
   }
   async deleteTokens(o) {
     if (!this.server.sessionAdapter) throw new l(
@@ -6870,6 +6870,23 @@ class we extends Oe {
     );
     await this.server.sessionAdapter.deleteSessionData(o, this.sessionDataName);
   }
+  async storeSessionData(o, r, s) {
+    var i;
+    if (this.server.sessionServer) {
+      let n = this.server.sessionServer.getSessionCookieValue(r);
+      !n && s ? n = await this.server.createAnonymousSession(
+        r,
+        s,
+        { [this.sessionDataName]: o }
+      ) : await ((i = this.server.sessionAdapter) == null ? void 0 : i.updateSessionData(r, this.sessionDataName, o));
+    } else {
+      if (!this.server.sessionAdapter) throw new l(
+        g.Configuration,
+        "Cannot get session data if sessions not enabled"
+      );
+      await this.server.sessionAdapter.updateSessionData(r, this.sessionDataName, o);
+    }
+  }
 }
 class er extends Ie {
   /**
@@ -6882,11 +6899,12 @@ class er extends Ie {
     super(r, s);
     u(this, "userStorage");
     u(this, "protectedEndpoints", {});
+    u(this, "protectedEndpointPrefixes", []);
     u(this, "errorBody", {});
     u(this, "sessionDataName", "oauth");
     u(this, "tokenLocations", ["header"]);
     u(this, "sessionAdapter");
-    if (S("errorBody", C.Json, this, s, "OAUTH_RESSERVER_ACCESS_DENIED_BODY"), S("tokenLocations", C.JsonArray, this, s, "OAUTH_TOKEN_LOCATIONS"), S("sessionDataName", C.String, this, s, "OAUTH_SESSION_DATA_NAME"), this.userStorage = s.userStorage, this.sessionAdapter = s.sessionAdapter, s.protectedEndpoints) {
+    if (C("errorBody", k.Json, this, s, "OAUTH_RESSERVER_ACCESS_DENIED_BODY"), C("tokenLocations", k.JsonArray, this, s, "OAUTH_TOKEN_LOCATIONS"), C("sessionDataName", k.String, this, s, "OAUTH_SESSION_DATA_NAME"), this.userStorage = s.userStorage, this.sessionAdapter = s.sessionAdapter, s.protectedEndpoints) {
       const i = /^[!#\$%&'\(\)\*\+,\.\/a-zA-Z\[\]\^_`-]+/;
       for (const [n, t] of Object.entries(s.protectedEndpoints)) {
         if (!n.startsWith("/"))
@@ -6895,47 +6913,57 @@ class er extends Ie {
           if (!i.test(a)) throw new l(g.Configuration, "Illegal characters in scope " + a);
         });
       }
-      this.protectedEndpoints = s.protectedEndpoints;
+      this.protectedEndpoints = { ...s.protectedEndpoints };
+      for (let n in s.protectedEndpoints) {
+        let t = this.protectedEndpoints[n];
+        t.suburls == !0 && (n.endsWith("/") || (n += "/", this.protectedEndpoints[n] = t), this.protectedEndpointPrefixes.push(n));
+      }
     }
     s.protectedEndpoints && o.addHook("preHandler", async (i, n) => {
-      var h, f;
+      var p, v;
       const t = i.url.split("?", 2)[0];
-      if (!(t in this.protectedEndpoints)) return;
-      const a = await this.authorized(i);
-      if (!(i.user && i.authType == "cookie" && this.protectedEndpoints[t].acceptSessionAuthorization != !0)) {
-        if (!a) {
+      let a = !1, h = "";
+      if (t in this.protectedEndpoints)
+        a = !0, h = t;
+      else
+        for (let m of this.protectedEndpointPrefixes)
+          t.startsWith(m) && (a = !0), h = m;
+      if (!a) return;
+      const f = await this.authorized(i);
+      if (!(i.user && i.authType == "cookie" && this.protectedEndpoints[h].acceptSessionAuthorization != !0)) {
+        if (!f) {
           i.authError = "access_denied", i.authErrorDescription = "No access token";
-          const p = this.authenticateHeader(i);
-          return n.header("WWW-Authenticate", p).status(401).send(this.errorBody);
+          const m = this.authenticateHeader(i);
+          return n.header("WWW-Authenticate", m).status(401).send(this.errorBody);
         }
-        if (!a.authorized) {
-          const p = this.authenticateHeader(i);
-          return n.header("WWW-Authenticate", p).status(401).send(this.errorBody);
+        if (!f.authorized) {
+          const m = this.authenticateHeader(i);
+          return n.header("WWW-Authenticate", m).status(401).send(this.errorBody);
         }
       }
-      if (a) {
-        if (i.accessTokenPayload = a.tokenPayload, i.user = a.user, (h = a.tokenPayload) != null && h.scope)
-          if (Array.isArray(a.tokenPayload.scope)) {
-            let p = [];
-            for (let v of a.tokenPayload.scope)
-              typeof v == "string" && p.push(v);
-            i.scope = p;
-          } else typeof a.tokenPayload.scope == "string" && (i.scope = a.tokenPayload.scope.split(" "));
-        if (this.protectedEndpoints[t].scope) {
-          for (let p of this.protectedEndpoints[t].scope ?? [])
-            if (!i.scope || !i.scope.includes(p) && this.protectedEndpoints[t].acceptSessionAuthorization != !0)
+      if (f) {
+        if (i.accessTokenPayload = f.tokenPayload, i.user = f.user, (p = f.tokenPayload) != null && p.scope)
+          if (Array.isArray(f.tokenPayload.scope)) {
+            let m = [];
+            for (let w of f.tokenPayload.scope)
+              typeof w == "string" && m.push(w);
+            i.scope = m;
+          } else typeof f.tokenPayload.scope == "string" && (i.scope = f.tokenPayload.scope.split(" "));
+        if (this.protectedEndpoints[h].scope) {
+          for (let m of this.protectedEndpoints[h].scope ?? [])
+            if (!i.scope || !i.scope.includes(m) && this.protectedEndpoints[h].acceptSessionAuthorization != !0)
               return d.logger.warn(c({
                 msg: "Access token does not have sufficient scope",
-                username: (f = i.user) == null ? void 0 : f.username,
+                username: (v = i.user) == null ? void 0 : v.username,
                 url: i.url
               })), i.scope = void 0, i.accessTokenPayload = void 0, i.user = void 0, i.authError = "access_denied", i.authErrorDescription = "Access token does not have sufficient scope", n.status(401).send(this.errorBody);
         }
-        if (i.authType = "oauth", i.authError = a == null ? void 0 : a.error, (a == null ? void 0 : a.error) == "access_denied") {
-          const p = this.authenticateHeader(i);
-          return n.header("WWW-Authenticate", p).status(401).send(this.errorBody);
-        } else if (a != null && a.error)
+        if (i.authType = "oauth", i.authError = f == null ? void 0 : f.error, (f == null ? void 0 : f.error) == "access_denied") {
+          const m = this.authenticateHeader(i);
+          return n.header("WWW-Authenticate", m).status(401).send(this.errorBody);
+        } else if (f != null && f.error)
           return n.status(500).send(this.errorBody);
-        i.authErrorDescription = a == null ? void 0 : a.error_description, d.logger.debug(c({ msg: "Resource server url", url: i.url, authorized: i.accessTokenPayload != null }));
+        i.authErrorDescription = f == null ? void 0 : f.error_description, d.logger.debug(c({ msg: "Resource server url", url: i.url, authorized: i.accessTokenPayload != null }));
       }
     });
   }
@@ -7037,8 +7065,8 @@ const rr = `<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
   401: z,
   500: G
 };
-function sr(k) {
-  return k.admin == !0;
+function sr(S) {
+  return S.admin == !0;
 }
 const K = class K {
   /**
@@ -7119,7 +7147,7 @@ const K = class K {
     /** Config for `@fastify/cors` */
     u(this, "cors");
     u(this, "audience", "");
-    S("views", C.String, this, a, "VIEWS"), S("cors", C.Json, this, a, "CORS"), a.isAdminFn && (K.isAdminFn = a.isAdminFn), a.app ? this.app = a.app : (this.views && ue.configure(this.views, {
+    C("views", k.String, this, a, "VIEWS"), C("cors", k.Json, this, a, "CORS"), a.isAdminFn && (K.isAdminFn = a.isAdminFn), a.app ? this.app = a.app : (this.views && ue.configure(this.views, {
       autoescape: !0
     }), this.app = Ee({ logger: !1 }), this.app.register(Te, {
       engine: {
@@ -7129,11 +7157,11 @@ const K = class K {
         "node_modules/shared-components",
         this.views
       ]
-    })), this.cors && this.app.register(be, this.cors), this.app.addContentTypeParser(
+    })), this.cors && this.app.register(ye, this.cors), this.app.addContentTypeParser(
       "text/json",
       { parseAs: "string" },
       this.app.getDefaultJsonParser("ignore", "ignore")
-    ), this.app.register(ye), this.app.register(_e, {
+    ), this.app.register(be), this.app.register(_e, {
       // secret: "my-secret", // for cookies signature
       parseOptions: {}
       // options for parsing cookies
@@ -7190,7 +7218,7 @@ const K = class K {
           )
         );
     }
-    t && (this.audience = "", S("audience", C.String, this, a, "OAUTH_AUDIENCE", !0), this.oAuthResServer = new er(
+    t && (this.audience = "", C("audience", k.String, this, a, "OAUTH_AUDIENCE", !0), this.oAuthResServer = new er(
       this.app,
       [new Me(this.audience, a)],
       { sessionAdapter: this.sessionAdapter, ...t.options, ...a }
@@ -7424,7 +7452,7 @@ const K = class K {
   }
 };
 u(K, "isAdminFn", sr);
-let y = K;
+let b = K;
 class ur {
 }
 export {
@@ -7434,7 +7462,7 @@ export {
   $e as FastifyAuthorizationServer,
   we as FastifyOAuthClient,
   er as FastifyOAuthResourceServer,
-  y as FastifyServer,
+  b as FastifyServer,
   ur as FastifySessionAdapter,
   Ke as FastifySessionServer,
   Ge as FastifyUserClientEndpoints,