@eventuras/fides-auth 0.4.0 → 0.6.0

package/dist/index.js

@@ -1,6 +1,6 @@
 import { configureLogger as e, createLogger as t } from "./logger.js";
-import { a as n, c as r, d as i, i as a, l as o, n as s, o as c, r as l, s as u, t as d, u as f } from "./utils-ByMRF7b2.js";
-import { n as p, t as m } from "./session-validation-BxObT3wC.js";
-import { refreshSession as h } from "./session-refresh.js";
+import { a as n, c as r, d as i, f as a, i as o, l as s, n as c, o as l, r as u, s as d, t as f, u as p } from "./utils-C0OavYxH.js";
+import { n as m, t as h } from "./session-validation-CHSsh4q_.js";
+import { refreshSession as g } from "./session-refresh.js";
 import "./types.js";
-export { d as accessTokenExpires, e as configureLogger, s as createEncryptedJWT, t as createLogger, l as decrypt, a as encrypt, n as generateToken, c as getSessionSecret, u as getSessionSecretUint8Array, r as hexToUint8Array, m as isSession, h as refreshSession, o as sha256, f as sha512, i as toHex, p as validateSessionJwt };
+export { f as accessTokenExpires, e as configureLogger, c as createEncryptedJWT, t as createLogger, u as decrypt, o as encrypt, n as generateToken, l as getSessionSecret, d as getSessionSecretUint8Array, r as hasScope, s as hexToUint8Array, h as isSession, g as refreshSession, p as sha256, i as sha512, a as toHex, m as validateSessionJwt };

package/dist/oauth.d.ts

@@ -10,6 +10,14 @@ export type OAuthConfig = {
     clientSecret: string;
     redirect_uri: string;
     scope: string;
+    /**
+     * Opt in to Pushed Authorization Requests (RFC 9126) when the provider
+     * supports it. When true, authorization parameters are posted to the
+     * provider's PAR endpoint ahead of the redirect, and only `client_id` +
+     * `request_uri` travel through the user-agent. The provider must advertise
+     * `pushed_authorization_request_endpoint` in its discovery metadata.
+     */
+    usePar?: boolean;
 };
 /**
  * Refreshes an access token using a refresh token grant.
@@ -46,8 +54,27 @@ export declare function buildPKCEOptions(config: OAuthConfig): Promise<PKCEOptio
  */
 export declare function buildAuthorizationUrl(config: openid.Configuration, pkceOptions: PKCEOptions): Promise<URL>;
 /**
- * Convenience function to discover OpenID configuration and build authorization URL.
- * This combines discovery + buildAuthorizationUrl in one call.
+ * Builds an authorization URL using Pushed Authorization Requests (RFC 9126).
+ *
+ * Posts the PKCE parameters to the provider's PAR endpoint and returns a URL
+ * containing only `client_id` and `request_uri`. The provider's discovery
+ * metadata must include `pushed_authorization_request_endpoint`.
+ *
+ * @param config - Discovered OpenID Configuration (use openid.discovery() to obtain)
+ * @param pkceOptions - The PKCE options (e.g., code challenge, state, parameters)
+ * @returns A Promise that resolves to the PAR-based authorization URL
+ */
+export declare function buildAuthorizationUrlWithPAR(config: openid.Configuration, pkceOptions: PKCEOptions): Promise<URL>;
+/**
+ * Convenience function to discover OpenID configuration and build an
+ * authorization URL. Routes through PAR when `oauthConfig.usePar` is true and
+ * the provider advertises `pushed_authorization_request_endpoint`.
+ *
+ * - `usePar === true` + provider advertises PAR → uses PAR.
+ * - `usePar === true` + provider does **not** advertise PAR → throws.
+ * - `usePar` unset/false + provider advertises PAR → standard flow + one-line
+ *   `info` advisory that PAR is available but not enabled.
+ * - `usePar` unset/false + no PAR endpoint → standard flow, no advisory.
  *
  * @param oauthConfig - Your OAuth configuration
  * @param pkceOptions - The PKCE options (e.g., code challenge, state, parameters)

package/dist/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAKvC,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAE1E,uFAAuF;AACvF,eAAO,MAAM,YAAY,wCAAwC,CAAC;AAElE,wDAAwD;AACxD,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,WAAW,EACxB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,CA6CvC;AAED,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAmBhF;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,CAAC,aAAa,EAC5B,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC,GAAG,CAAC,CASd;AAED;;;;;;;GAOG;AACH,wBAAsB,gCAAgC,CACpD,WAAW,EAAE,WAAW,EACxB,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC,GAAG,CAAC,CAgBd;AAED;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,+BAA+B;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,sBAAsB;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,0BAA0B;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,WAAW,EACxB,WAAW,EAAE,GAAG,EAChB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAiCvC;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,CAAC,qBAAqB,EACpC,UAAU,GAAE,MAAgB,GAC3B,YAAY,CAoBd;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,CAAC,qBAAqB,EACpC,UAAU,GAAE,MAAgB,GAC3B,OAAO,CAqBT;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACnC,iBAAiB,EAAE,MAAM,EACzB,WAAW,GAAE,MAAY,EACzB,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,GACvC,GAAG,CA+BL;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,WAAW,EACxB,qBAAqB,EAAE,MAAM,GAC5B,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAyBrB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,uBAAuB,GAC9B,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAgCvC"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAKvC,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAE1E,uFAAuF;AACvF,eAAO,MAAM,YAAY,wCAAwC,CAAC;AAElE,wDAAwD;AACxD,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,WAAW,EACxB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,CA6CvC;AAED,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAmBhF;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,CAAC,aAAa,EAC5B,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC,GAAG,CAAC,CASd;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,4BAA4B,CAChD,MAAM,EAAE,MAAM,CAAC,aAAa,EAC5B,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC,GAAG,CAAC,CAYd;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gCAAgC,CACpD,WAAW,EAAE,WAAW,EACxB,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC,GAAG,CAAC,CAkCd;AAED;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,+BAA+B;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,sBAAsB;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,0BAA0B;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,WAAW,EACxB,WAAW,EAAE,GAAG,EAChB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAiCvC;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,CAAC,qBAAqB,EACpC,UAAU,GAAE,MAAgB,GAC3B,YAAY,CAoBd;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,CAAC,qBAAqB,EACpC,UAAU,GAAE,MAAgB,GAC3B,OAAO,CA4BT;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACnC,iBAAiB,EAAE,MAAM,EACzB,WAAW,GAAE,MAAY,EACzB,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,GACvC,GAAG,CA+BL;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,WAAW,EACxB,qBAAqB,EAAE,MAAM,GAC5B,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAyBrB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,uBAAuB,GAC9B,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAgCvC"}

package/dist/oauth.js

@@ -1,85 +1,98 @@
 import { createLogger as e } from "./logger.js";
 import { t } from "./decode_jwt-1J26fl4I.js";
-import { a as n, c as r, i, n as a, o, r as s, s as c, t as l } from "./build-BnXr85C9.js";
+import { a as n, c as r, i, l as a, n as o, o as s, r as c, s as l, t as u } from "./build-nL2--iMi.js";
 //#region src/oauth.ts
-var u = e({ namespace: "fides-auth:oauth" }), d = "openid profile email offline_access";
-async function f(e, t) {
-	u.debug({ issuer: e.issuer }, "Starting token refresh");
+var d = e({ namespace: "fides-auth:oauth" }), f = "openid profile email offline_access";
+async function p(e, t) {
+	d.debug({ issuer: e.issuer }, "Starting token refresh");
 	try {
-		let i = await r(await n(new URL(e.issuer), e.clientId, e.clientSecret, l(e.clientSecret)), t, { scope: e.scope });
-		return u.info({
-			hasAccessToken: !!i.access_token,
-			hasRefreshToken: !!i.refresh_token,
-			expiresIn: i.expires_in
-		}, "Token refresh successful"), i;
+		let n = await a(await s(new URL(e.issuer), e.clientId, e.clientSecret, u(e.clientSecret)), t, { scope: e.scope });
+		return d.info({
+			hasAccessToken: !!n.access_token,
+			hasRefreshToken: !!n.refresh_token,
+			expiresIn: n.expires_in
+		}, "Token refresh successful"), n;
 	} catch (t) {
 		let n = t;
-		throw n?.code === "OAUTH_RESPONSE_BODY_ERROR" && n?.error === "invalid_grant" ? u.info({
+		throw n?.code === "OAUTH_RESPONSE_BODY_ERROR" && n?.error === "invalid_grant" ? d.info({
 			error: n.error,
 			error_description: n.error_description,
 			issuer: e.issuer
-		}, "Token refresh failed - refresh token expired or invalid") : u.error({
+		}, "Token refresh failed - refresh token expired or invalid") : d.error({
 			error: t,
 			issuer: e.issuer
 		}, "Token refresh failed"), t;
 	}
 }
-async function p(e) {
-	let t = o(), n = await i(t), r = c(), a = {
+async function m(e) {
+	let t = l(), i = await n(t), a = r(), o = {
 		redirect_uri: e.redirect_uri,
 		scope: e.scope ?? "openid profile email offline_access",
-		code_challenge: n,
+		code_challenge: i,
 		code_challenge_method: "S256",
-		state: r
+		state: a
 	};
-	return u.info({
+	return d.info({
 		redirectUri: e.redirect_uri,
-		scope: a.scope
+		scope: o.scope
 	}, "PKCE parameters generated"), {
 		code_verifier: t,
-		code_challenge: n,
-		state: r,
-		parameters: a
+		code_challenge: i,
+		state: a,
+		parameters: o
 	};
 }
-async function m(e, t) {
+async function h(e, t) {
 	try {
-		let n = s(e, t.parameters);
-		return u.info({ authUrl: n.origin }, "Authorization URL built successfully"), n;
+		let n = c(e, t.parameters);
+		return d.info("Authorization URL built successfully"), n;
 	} catch (e) {
-		throw u.error({ error: e }, "Failed to build authorization URL"), e;
+		throw d.error({ error: e }, "Failed to build authorization URL"), e;
 	}
 }
-async function h(e, t) {
-	u.debug({ issuer: e.issuer }, "Discovering OpenID configuration");
+async function g(e, t) {
+	try {
+		let n = await i(e, t.parameters);
+		return d.info("PAR authorization URL built successfully"), n;
+	} catch (e) {
+		throw d.error({ error: e }, "Failed to build PAR authorization URL"), e;
+	}
+}
+async function _(e, t) {
+	d.debug({ issuer: e.issuer }, "Discovering OpenID configuration");
 	try {
-		return m(await n(new URL(e.issuer), e.clientId, e.clientSecret, l(e.clientSecret)), t);
+		let n = await s(new URL(e.issuer), e.clientId, e.clientSecret, u(e.clientSecret)), r = n.serverMetadata().pushed_authorization_request_endpoint;
+		if (e.usePar) {
+			if (!r) throw Error("PAR requested (usePar=true) but provider does not advertise pushed_authorization_request_endpoint");
+			return g(n, t);
+		}
+		return r && d.info({ issuer: e.issuer }, "Provider advertises PAR but usePar is not enabled — set OAuthConfig.usePar=true to use it"), h(n, t);
 	} catch (t) {
-		throw u.error({
+		throw d.error({
 			error: t,
 			issuer: e.issuer
 		}, "Failed to discover config or build URL"), t;
 	}
 }
-async function g(e, t, r, i) {
-	u.debug({
+async function v(e, t, n, r) {
+	d.debug({
 		issuer: e.issuer,
 		clientId: e.clientId
 	}, "Exchanging authorization code for tokens");
-	let o = await a(await n(new URL(e.issuer), e.clientId, e.clientSecret, l(e.clientSecret)), t, {
-		pkceCodeVerifier: r,
-		expectedState: i
+	let i = await o(await s(new URL(e.issuer), e.clientId, e.clientSecret, u(e.clientSecret)), t, {
+		pkceCodeVerifier: n,
+		expectedState: r
 	}, { redirect_uri: e.redirect_uri });
-	return u.info({
-		hasAccessToken: !!o.access_token,
-		hasRefreshToken: !!o.refresh_token,
-		expiresIn: o.expires_in
-	}, "Authorization code exchange successful"), o;
+	return d.info({
+		hasAccessToken: !!i.access_token,
+		hasRefreshToken: !!i.refresh_token,
+		expiresIn: i.expires_in
+	}, "Authorization code exchange successful"), i;
 }
-function _(e, n = "roles") {
+function y(e, n = "roles") {
 	if (!e.id_token) throw Error("OIDC token response is missing id_token");
 	let r = t(e.id_token), i = r[n], a = typeof i == "string" ? [i] : [], o = Array.isArray(i) ? i : a;
-	return u.debug({
+	return d.debug({
 		sub: r.sub,
 		rolesClaim: n,
 		rolesCount: o.length
@@ -90,9 +103,13 @@ function _(e, n = "roles") {
 		roles: o
 	};
 }
-function v(e, t = "roles") {
+function b(e, t = "roles") {
 	if (!e.access_token) throw Error("OIDC token response is missing access_token");
-	let n = _(e, t);
+	let n = y(e, t), r;
+	if (typeof e.scope == "string") {
+		let t = e.scope.split(" ").filter((e) => e.length > 0);
+		t.length > 0 && (r = t);
+	}
 	return {
 		tokens: {
 			accessToken: e.access_token,
@@ -103,37 +120,38 @@ function v(e, t = "roles") {
 			name: n.name,
 			email: n.email,
 			roles: n.roles
-		}
+		},
+		scopes: r
 	};
 }
-function y(e, t, n = "/", r) {
+function x(e, t, n = "/", r) {
 	let i = e ?? n, a;
 	try {
 		a = new URL(i, t);
 	} catch {
-		return u.warn({ returnTo: i }, "Invalid returnTo URL, using default"), new URL(n, t);
+		return d.warn({ returnTo: i }, "Invalid returnTo URL, using default"), new URL(n, t);
 	}
 	let o = new URL(t);
-	return a.origin === o.origin ? r && !r(a.pathname) ? (u.warn({ pathname: a.pathname }, "returnTo failed custom validation, falling back to default"), new URL(n, t)) : a : (u.error({
+	return a.origin === o.origin ? r && !r(a.pathname) ? (d.warn({ pathname: a.pathname }, "returnTo failed custom validation, falling back to default"), new URL(n, t)) : a : (d.error({
 		returnTo: i,
 		redirectOrigin: a.origin,
 		applicationOrigin: o.origin
 	}, "Possible open redirect attack: returnTo points outside application origin"), new URL(n, t));
 }
-async function b(e, t) {
+async function S(e, t) {
 	try {
-		let r = (await n(new URL(e.issuer), e.clientId, e.clientSecret, l(e.clientSecret))).serverMetadata().end_session_endpoint;
-		if (!r) return u.info({ issuer: e.issuer }, "No end_session_endpoint found"), null;
-		let i = new URL(r);
-		return i.searchParams.set("client_id", e.clientId), i.searchParams.set("post_logout_redirect_uri", t), u.debug({ logoutUrl: i.toString() }, "Built OIDC logout URL"), i;
+		let n = (await s(new URL(e.issuer), e.clientId, e.clientSecret, u(e.clientSecret))).serverMetadata().end_session_endpoint;
+		if (!n) return d.info({ issuer: e.issuer }, "No end_session_endpoint found"), null;
+		let r = new URL(n);
+		return r.searchParams.set("client_id", e.clientId), r.searchParams.set("post_logout_redirect_uri", t), d.debug({ logoutUrl: r.toString() }, "Built OIDC logout URL"), r;
 	} catch (t) {
-		return u.warn({
+		return d.warn({
 			error: t,
 			issuer: e.issuer
 		}, "OIDC discovery failed for logout"), null;
 	}
 }
-async function x(e) {
+async function C(e) {
 	try {
 		let t = new URLSearchParams({
 			grant_type: "client_credentials",
@@ -148,18 +166,18 @@ async function x(e) {
 		});
 		if (!n.ok) {
 			let e = await n.text();
-			throw u.error({
+			throw d.error({
 				status: n.status,
 				error: e
 			}, "Client credentials grant failed"), Error(`Client credentials grant failed: ${n.status} - ${e}`);
 		}
 		return await n.json();
 	} catch (t) {
-		throw u.error({
+		throw d.error({
 			error: t,
 			tokenEndpoint: e.tokenEndpoint
 		}, "Client credentials grant error"), t;
 	}
 }
 //#endregion
-export { m as buildAuthorizationUrl, b as buildOidcLogoutUrl, p as buildPKCEOptions, v as buildSessionFromTokens, x as clientCredentialsGrant, d as defaultScope, h as discoverAndBuildAuthorizationUrl, g as exchangeAuthorizationCode, _ as extractUserFromTokens, f as refreshAccessToken, y as validateReturnUrl };
+export { h as buildAuthorizationUrl, g as buildAuthorizationUrlWithPAR, S as buildOidcLogoutUrl, m as buildPKCEOptions, b as buildSessionFromTokens, C as clientCredentialsGrant, f as defaultScope, _ as discoverAndBuildAuthorizationUrl, v as exchangeAuthorizationCode, y as extractUserFromTokens, p as refreshAccessToken, x as validateReturnUrl };

package/dist/providers/vipps/index.js

@@ -1,5 +1,5 @@
 import { createLogger as e } from "../../logger.js";
-import { a as t, c as n, n as r, t as i } from "../../build-BnXr85C9.js";
+import { l as t, n, o as r, t as i } from "../../build-nL2--iMi.js";
 import { buildAuthorizationUrl as a, buildPKCEOptions as o } from "../../oauth.js";
 //#region src/providers/vipps/types.ts
 var s = {
@@ -48,7 +48,7 @@ var d = e({
 		}, "VippsLoginClient initialized");
 	}
 	async getConfig() {
-		return this.configPromise ||= t(new URL(this.oauthConfig.issuer), this.oauthConfig.clientId, this.oauthConfig.clientSecret, i(this.oauthConfig.clientSecret)), this.configPromise;
+		return this.configPromise ||= r(new URL(this.oauthConfig.issuer), this.oauthConfig.clientId, this.oauthConfig.clientSecret, i(this.oauthConfig.clientSecret)), this.configPromise;
 	}
 	async buildPKCEOptions() {
 		return d.debug("Building PKCE options"), o(this.oauthConfig);
@@ -56,12 +56,12 @@ var d = e({
 	async buildAuthorizationUrl(e) {
 		return d.debug("Building authorization URL"), a(await this.getConfig(), e);
 	}
-	async exchangeCodeForTokens(e, t, n) {
+	async exchangeCodeForTokens(e, t, r) {
 		d.debug("Exchanging authorization code for tokens");
 		try {
-			let i = await r(await this.getConfig(), typeof e == "string" ? new URL(e) : e, {
+			let i = await n(await this.getConfig(), typeof e == "string" ? new URL(e) : e, {
 				pkceCodeVerifier: t,
-				expectedState: n,
+				expectedState: r,
 				idTokenExpected: !0
 			});
 			return d.info({
@@ -105,12 +105,12 @@ var d = e({
 	async refreshTokens(e) {
 		d.debug("Refreshing access token");
 		try {
-			let t = await n(await this.getConfig(), e);
+			let n = await t(await this.getConfig(), e);
 			return d.info({
-				hasAccessToken: !!t.access_token,
-				hasRefreshToken: !!t.refresh_token,
-				expiresIn: t.expires_in
-			}, "Successfully refreshed tokens"), t;
+				hasAccessToken: !!n.access_token,
+				hasRefreshToken: !!n.refresh_token,
+				expiresIn: n.expires_in
+			}, "Successfully refreshed tokens"), n;
 		} catch (e) {
 			throw d.error({ error: e }, "Failed to refresh tokens"), e;
 		}

package/dist/{session-validation-BxObT3wC.js → session-validation-CHSsh4q_.js}

@@ -1,7 +1,7 @@
 import { createLogger as e } from "./logger.js";
 import { y as t } from "./deflate-koSuX7FB.js";
 import { t as n } from "./decrypt-Cahlu_6Y.js";
-import { c as r, f as i } from "./utils-ByMRF7b2.js";
+import { l as r, p as i } from "./utils-C0OavYxH.js";
 import { t as a } from "./decode_jwt-1J26fl4I.js";
 //#region ../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/jwt/decrypt.js
 async function o(e, r, a) {

package/dist/session-validation.js

@@ -1,2 +1,2 @@
-import { n as e, t } from "./session-validation-BxObT3wC.js";
+import { n as e, t } from "./session-validation-CHSsh4q_.js";
 export { t as isSession, e as validateSessionJwt };

package/dist/silent-login.js

@@ -1,5 +1,5 @@
 import { createLogger as e } from "./logger.js";
-import { a as t, r as n, t as r } from "./build-BnXr85C9.js";
+import { o as t, r as n, t as r } from "./build-nL2--iMi.js";
 //#region src/silent-login.ts
 var i = e({ namespace: "fides-auth:silent-login" });
 async function a(e, a = {}) {

package/dist/types.d.ts

@@ -13,6 +13,8 @@ export interface Session<TData = Record<string, unknown>> {
         email: string;
         roles?: string[];
     };
+    /** OAuth scopes granted to this session (e.g. ["openid", "profile", "email"]). */
+    scopes?: string[];
     /** Application-specific data stored alongside the session. */
     data?: TData;
 }

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,MAAM,WAAW,MAAM;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,IAAI,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qBAAqB,CAAC,EAAE,IAAI,CAAC;CAC9B;AAED,mFAAmF;AACnF,MAAM,WAAW,OAAO,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC;IACF,8DAA8D;IAC9D,IAAI,CAAC,EAAE,KAAK,CAAC;CACd;AAED,oDAAoD;AACpD,MAAM,WAAW,oBAAoB;IACnC,oEAAoE;IACpE,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,MAAM,WAAW,MAAM;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,IAAI,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qBAAqB,CAAC,EAAE,IAAI,CAAC;CAC9B;AAED,mFAAmF;AACnF,MAAM,WAAW,OAAO,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC;IACF,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,KAAK,CAAC;CACd;AAED,oDAAoD;AACpD,MAAM,WAAW,oBAAoB;IACnC,oEAAoE;IACpE,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B"}

package/dist/{utils-ByMRF7b2.js → utils-C0OavYxH.js}

@@ -375,5 +375,8 @@ var Z = (e, t = 10) => {
 		return R.error({ error: e }, "Error decoding access token"), !0;
 	}
 };
+function Q(e, t) {
+	return e.scopes?.includes(t) ?? !1;
+}
 //#endregion
-export { X as a, z as c, Y as d, P as f, H as i, G as l, V as n, q as o, U as r, J as s, Z as t, K as u };
+export { X as a, Q as c, K as d, Y as f, H as i, z as l, V as n, q as o, P as p, U as r, J as s, Z as t, G as u };

package/dist/utils.d.ts

@@ -1,3 +1,4 @@
+import { Session } from './types';
 /**
  * Converts a hex string to a Uint8Array.
  *
@@ -80,4 +81,11 @@ export declare function generateToken(tokenLength?: number): string;
  * @returns True if the access token expires within the threshold; otherwise, false.
  */
 export declare const accessTokenExpires: (accessToken: string, seconds?: number) => boolean;
+/**
+ * Returns true if the session was granted the given scope.
+ *
+ * @param session - The session to check
+ * @param scope - The scope string to look for (e.g. "operations.read")
+ */
+export declare function hasScope(session: Session, scope: string): boolean;
 //# sourceMappingURL=utils.d.ts.map

package/dist/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAOA;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAYvD;AAaD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,GAAG,UAAU,GAC1B,OAAO,CAAC,MAAM,CAAC,CAKjB;AAGD;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAkCxF;AAED;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CA4CxF;AAcD;;;;GAIG;AACH,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAIvE;AAED;;;;GAIG;AACH,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAIvE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAMzC;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,IAAI,UAAU,CAKvD;AAED;;GAEG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAI/C;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,WAAW,GAAE,MAAW,GAAG,MAAM,CAI9D;AAGD;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,GAC7B,aAAa,MAAM,EACnB,UAAS,MAAW,KACnB,OAsBF,CAAC"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAKvC;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAYvD;AAaD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,GAAG,UAAU,GAC1B,OAAO,CAAC,MAAM,CAAC,CAKjB;AAGD;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAkCxF;AAED;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CA4CxF;AAcD;;;;GAIG;AACH,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAIvE;AAED;;;;GAIG;AACH,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAIvE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAMzC;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,IAAI,UAAU,CAKvD;AAED;;GAEG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAI/C;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,WAAW,GAAE,MAAW,GAAG,MAAM,CAI9D;AAGD;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,GAC7B,aAAa,MAAM,EACnB,UAAS,MAAW,KACnB,OAsBF,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAEjE"}

package/dist/utils.js

@@ -1,2 +1,2 @@
-import { a as e, c as t, d as n, i as r, l as i, n as a, o, r as s, s as c, t as l, u } from "./utils-ByMRF7b2.js";
-export { l as accessTokenExpires, a as createEncryptedJWT, s as decrypt, r as encrypt, e as generateToken, o as getSessionSecret, c as getSessionSecretUint8Array, t as hexToUint8Array, i as sha256, u as sha512, n as toHex };
+import { a as e, c as t, d as n, f as r, i, l as a, n as o, o as s, r as c, s as l, t as u, u as d } from "./utils-C0OavYxH.js";
+export { u as accessTokenExpires, o as createEncryptedJWT, c as decrypt, i as encrypt, e as generateToken, s as getSessionSecret, l as getSessionSecretUint8Array, t as hasScope, a as hexToUint8Array, d as sha256, n as sha512, r as toHex };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eventuras/fides-auth",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "Framework-agnostic OAuth/OIDC authentication library with PKCE, session management, and pluggable logging",
   "keywords": [
     "oauth",
@@ -87,8 +87,8 @@
     "@types/node": "^25.6.0",
     "vite": "^8.0.8",
     "vitest": "^4.1.4",
-    "@eventuras/typescript-config": "1.0.0",
-    "@eventuras/vite-config": "0.2.1"
+    "@eventuras/vite-config": "0.2.1",
+    "@eventuras/typescript-config": "1.0.0"
   },
   "engines": {
     "node": ">=18"