@flytedesk/app-kit 0.0.1 → 0.1.1

package/dist/auth/guards.d.ts

@@ -0,0 +1,5 @@
+import type { FastifyReply, FastifyRequest } from "fastify";
+export declare function requireAuth(request: FastifyRequest, reply: FastifyReply, done: () => void): void;
+/** Every route re-checks permissions server-side. 403s name the missing permission(s)
+ *  in `detail`, so a caller (or its UI) can tell exactly what was missing. */
+export declare function requirePermission(...permission: string[]): (request: FastifyRequest, reply: FastifyReply, done: () => void) => void;

package/dist/auth/guards.js

@@ -0,0 +1,28 @@
+export function requireAuth(request, reply, done) {
+    if (!request.authUser) {
+        reply.code(401).send({ error: "Authentication required", code: "unauthenticated" });
+        return;
+    }
+    done();
+}
+/** Every route re-checks permissions server-side. 403s name the missing permission(s)
+ *  in `detail`, so a caller (or its UI) can tell exactly what was missing. */
+export function requirePermission(...permission) {
+    return function permissionPreHandler(request, reply, done) {
+        if (!request.authUser) {
+            reply.code(401).send({ error: "Authentication required", code: "unauthenticated" });
+            return;
+        }
+        const missing = permission.filter((p) => !request.authUser.permissions.includes(p));
+        if (missing.length) {
+            reply.code(403).send({
+                error: "Missing permission",
+                code: "forbidden",
+                detail: missing.join(", "),
+            });
+            return;
+        }
+        done();
+    };
+}
+//# sourceMappingURL=guards.js.map

package/dist/auth/guards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guards.js","sourceRoot":"","sources":["../../src/auth/guards.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,WAAW,CAAC,OAAuB,EAAE,KAAmB,EAAE,IAAgB;IACxF,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACpF,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC;AAED;8EAC8E;AAC9E,MAAM,UAAU,iBAAiB,CAAC,GAAG,UAAoB;IACvD,OAAO,SAAS,oBAAoB,CAClC,OAAuB,EACvB,KAAmB,EACnB,IAAgB;QAEhB,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACpF,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAS,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACrF,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,oBAAoB;gBAC3B,IAAI,EAAE,WAAW;gBACjB,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;aAC3B,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/auth/index.d.ts

@@ -1,7 +1,35 @@
 /**
- * flytedesk-id BFF/OIDC client — placeholder for the real module (DEC-27).
- * Extraction target: media-planner's apps/api/src/{routes/auth.ts,lib/flytedeskId.ts,
- * plugins/auth.ts}, generalized so `clientId`/`issuer`/redirect URI are config, not
- * hardcoded to one app.
+ * flytedesk-id BFF/OIDC client (DEC-38) — a generic, reusable Fastify 5 plugin
+ * implementing Authorization Code + PKCE against flytedesk-id, the identity provider
+ * shared by every flytedesk app. Generalizes media-planner's apps/api
+ * src/{routes/auth.ts,lib/flytedeskId.ts,plugins/auth.ts} so client id/secret, issuer,
+ * redirect URI, and app id are config instead of hardcoded to one app.
+ *
+ * Usage:
+ *
+ *   import Fastify from "fastify";
+ *   import { flytedeskAuth, requireAuth, requirePermission } from "@flytedesk/app-kit/auth";
+ *
+ *   const app = Fastify();
+ *   await app.register(flytedeskAuth, {
+ *     clientId: "my-app",
+ *     clientSecret: process.env.FLYTEDESK_ID_CLIENT_SECRET!,
+ *     issuer: "https://id.flytedesk.com",
+ *     redirectUri: "https://my-app.flytedesk.com/api/v1/auth/callback",
+ *     appId: "my-app",
+ *     postLoginRedirect: "https://my-app.flytedesk.com/",
+ *     cookieSecret: process.env.COOKIE_SECRET!,
+ *     secureCookies: process.env.NODE_ENV === "production",
+ *     accessTokenSecret: process.env.JWT_SECRET!,
+ *     store: myPrismaBackedAuthStore,
+ *   });
+ *
+ *   app.get("/me", { preHandler: requireAuth }, async (request) => request.authUser);
  */
-export declare const APP_KIT_AUTH_PLACEHOLDER = true;
+export { flytedeskAuth } from "./plugin.js";
+export { requireAuth, requirePermission } from "./guards.js";
+export type { AuthedUser, AuthStore, CreateIdpSessionInput, CreateRefreshTokenInput, FlytedeskAuthOptions, IdpRole, IdpSessionRow, RefreshTokenRow, UpdateIdpSessionInput, UserinfoClaims, } from "./types.js";
+export type { IdpAuthorization, IdpTokenResponse, IdTokenClaims, OidcClient } from "./oidc-client.js";
+export { createOidcClient } from "./oidc-client.js";
+export { generatePkce, randomState, type PkcePair } from "./pkce.js";
+export { generateRefreshToken, hashRefreshToken, signAccessToken, verifyAccessToken, type AccessTokenClaims, } from "./tokens.js";

package/dist/auth/index.js

@@ -1,8 +1,34 @@
 /**
- * flytedesk-id BFF/OIDC client — placeholder for the real module (DEC-27).
- * Extraction target: media-planner's apps/api/src/{routes/auth.ts,lib/flytedeskId.ts,
- * plugins/auth.ts}, generalized so `clientId`/`issuer`/redirect URI are config, not
- * hardcoded to one app.
+ * flytedesk-id BFF/OIDC client (DEC-38) — a generic, reusable Fastify 5 plugin
+ * implementing Authorization Code + PKCE against flytedesk-id, the identity provider
+ * shared by every flytedesk app. Generalizes media-planner's apps/api
+ * src/{routes/auth.ts,lib/flytedeskId.ts,plugins/auth.ts} so client id/secret, issuer,
+ * redirect URI, and app id are config instead of hardcoded to one app.
+ *
+ * Usage:
+ *
+ *   import Fastify from "fastify";
+ *   import { flytedeskAuth, requireAuth, requirePermission } from "@flytedesk/app-kit/auth";
+ *
+ *   const app = Fastify();
+ *   await app.register(flytedeskAuth, {
+ *     clientId: "my-app",
+ *     clientSecret: process.env.FLYTEDESK_ID_CLIENT_SECRET!,
+ *     issuer: "https://id.flytedesk.com",
+ *     redirectUri: "https://my-app.flytedesk.com/api/v1/auth/callback",
+ *     appId: "my-app",
+ *     postLoginRedirect: "https://my-app.flytedesk.com/",
+ *     cookieSecret: process.env.COOKIE_SECRET!,
+ *     secureCookies: process.env.NODE_ENV === "production",
+ *     accessTokenSecret: process.env.JWT_SECRET!,
+ *     store: myPrismaBackedAuthStore,
+ *   });
+ *
+ *   app.get("/me", { preHandler: requireAuth }, async (request) => request.authUser);
  */
-export const APP_KIT_AUTH_PLACEHOLDER = true;
+export { flytedeskAuth } from "./plugin.js";
+export { requireAuth, requirePermission } from "./guards.js";
+export { createOidcClient } from "./oidc-client.js";
+export { generatePkce, randomState } from "./pkce.js";
+export { generateRefreshToken, hashRefreshToken, signAccessToken, verifyAccessToken, } from "./tokens.js";
 //# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAgB7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAiB,MAAM,WAAW,CAAC;AAErE,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,iBAAiB,GAElB,MAAM,aAAa,CAAC"}

package/dist/auth/oidc-client.d.ts

@@ -0,0 +1,47 @@
+import type { UserinfoClaims } from "./types.js";
+export interface OidcClientOptions {
+    issuer: string;
+    clientId: string;
+    clientSecret: string;
+    redirectUri: string;
+}
+export interface IdpTokenResponse {
+    access_token: string;
+    id_token: string;
+    refresh_token?: string;
+    token_type: string;
+    expires_in: number;
+}
+export interface IdTokenClaims {
+    sub: string;
+}
+export interface IdpAuthorization {
+    userId: string;
+    appId: string;
+    roles: Array<{
+        id: string;
+        key: string;
+        name: string;
+    }>;
+    permissions: string[];
+}
+export interface OidcClient {
+    buildAuthorizeUrl(opts: {
+        state: string;
+        challenge: string;
+    }): string;
+    exchangeCodeForTokens(code: string, verifier: string): Promise<IdpTokenResponse>;
+    refreshIdpTokens(refreshToken: string): Promise<IdpTokenResponse>;
+    verifyIdToken(idToken: string): Promise<IdTokenClaims>;
+    fetchUserinfo(idpAccessToken: string): Promise<UserinfoClaims>;
+    fetchAuthorization(idpAccessToken: string, appId: string): Promise<IdpAuthorization>;
+    /** Best-effort — never throws. Returns whether flytedesk-id accepted the revocation. */
+    revokeIdpToken(token: string): Promise<boolean>;
+}
+/**
+ * One instance per FlytedeskAuthOptions (i.e. per plugin registration), not a module
+ * singleton — keeps the JWKS/discovery caches below scoped to one issuer/client pair
+ * instead of leaking across consumers or test instances that register the plugin
+ * against different flytedesk-id deployments.
+ */
+export declare function createOidcClient(opts: OidcClientOptions): OidcClient;

package/dist/auth/oidc-client.js

@@ -0,0 +1,162 @@
+import { createRemoteJWKSet, jwtVerify } from "jose";
+/**
+ * One instance per FlytedeskAuthOptions (i.e. per plugin registration), not a module
+ * singleton — keeps the JWKS/discovery caches below scoped to one issuer/client pair
+ * instead of leaking across consumers or test instances that register the plugin
+ * against different flytedesk-id deployments.
+ */
+export function createOidcClient(opts) {
+    function issuerUrl(path) {
+        return new URL(path, opts.issuer).toString();
+    }
+    /**
+     * Per RFC 6749 Appendix B, client_id and client_secret each have to be
+     * application/x-www-form-urlencoded BEFORE being joined with `:` and base64'd — not
+     * concatenated raw. oidc-provider's token-auth decoder reverses exactly this
+     * encoding; a raw, un-encoded secret containing `+`, `/`, or a control character
+     * fails that decode and gets rejected with a generic "not properly encoded" error,
+     * not one that names the client_id/client_secret as the actual problem.
+     */
+    function basicAuthHeader() {
+        const clientId = encodeURIComponent(opts.clientId);
+        const clientSecret = encodeURIComponent(opts.clientSecret);
+        return "Basic " + Buffer.from(`${clientId}:${clientSecret}`).toString("base64");
+    }
+    async function tokenRequest(body) {
+        const res = await fetch(issuerUrl("/token"), {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/x-www-form-urlencoded",
+                Authorization: basicAuthHeader(),
+            },
+            body: new URLSearchParams(body).toString(),
+        });
+        if (!res.ok) {
+            const text = await res.text().catch(() => "");
+            throw new Error(`flytedesk-id /token returned ${res.status}: ${text}`);
+        }
+        return (await res.json());
+    }
+    let jwks;
+    function getJwks() {
+        jwks ??= createRemoteJWKSet(new URL(issuerUrl("/jwks")));
+        return jwks;
+    }
+    let discoveryCache;
+    function getDiscovery() {
+        discoveryCache ??= fetch(issuerUrl("/.well-known/openid-configuration")).then((res) => {
+            if (!res.ok)
+                throw new Error(`flytedesk-id discovery returned ${res.status}`);
+            return res.json();
+        });
+        return discoveryCache;
+    }
+    return {
+        buildAuthorizeUrl({ state, challenge }) {
+            const url = new URL(issuerUrl("/auth"));
+            url.searchParams.set("client_id", opts.clientId);
+            url.searchParams.set("redirect_uri", opts.redirectUri);
+            url.searchParams.set("response_type", "code");
+            url.searchParams.set("scope", "openid email profile");
+            url.searchParams.set("code_challenge", challenge);
+            url.searchParams.set("code_challenge_method", "S256");
+            url.searchParams.set("state", state);
+            return url.toString();
+        },
+        /** Authorization Code + PKCE exchange — the one moment this app's client_secret is used. */
+        exchangeCodeForTokens(code, verifier) {
+            return tokenRequest({
+                grant_type: "authorization_code",
+                code,
+                redirect_uri: opts.redirectUri,
+                code_verifier: verifier,
+                client_id: opts.clientId,
+            });
+        },
+        /** flytedesk-id rotates refresh tokens on every use — the caller must persist the
+         *  new one returned here. */
+        refreshIdpTokens(refreshToken) {
+            return tokenRequest({
+                grant_type: "refresh_token",
+                refresh_token: refreshToken,
+                client_id: opts.clientId,
+            });
+        },
+        /**
+         * Verifies the id_token's signature against flytedesk-id's own JWKS — confirms WHO
+         * signed in (the `sub`) with a local crypto check, no callback needed. Deliberately
+         * returns only `sub`: for the Authorization Code flow OIDC core 5.4 puts profile
+         * claims (email, name, ...) in the UserInfo response, not the ID Token, so an
+         * id_token here legitimately carries only sub/aud/iss/exp/iat even though
+         * `email profile` was requested and granted. See fetchUserinfo below for where
+         * those actually come from.
+         */
+        async verifyIdToken(idToken) {
+            const { payload } = await jwtVerify(idToken, getJwks(), {
+                issuer: opts.issuer,
+                audience: opts.clientId,
+            });
+            if (typeof payload.sub !== "string") {
+                throw new Error("flytedesk-id id_token is missing the required sub claim");
+            }
+            return { sub: payload.sub };
+        },
+        /** `GET {issuer}/me` — the profile claims (email/name/email_verified) the id_token
+         *  deliberately doesn't carry for the Authorization Code flow. */
+        async fetchUserinfo(idpAccessToken) {
+            const res = await fetch(issuerUrl("/me"), {
+                headers: { Authorization: `Bearer ${idpAccessToken}` },
+            });
+            if (!res.ok) {
+                throw new Error(`flytedesk-id userinfo (/me) returned ${res.status}`);
+            }
+            const body = (await res.json());
+            if (typeof body.sub !== "string" || typeof body.email !== "string") {
+                throw new Error("flytedesk-id userinfo (/me) is missing required sub/email claims");
+            }
+            return {
+                sub: body.sub,
+                email: body.email,
+                emailVerified: body.email_verified === true,
+                name: typeof body.name === "string" ? body.name : undefined,
+            };
+        },
+        /** `GET {issuer}/apps/{appId}/authorization` — computed fresh from flytedesk-id's
+         *  database on every call, never cached there. Callers must preserve that property
+         *  by calling this live rather than memoizing the result — see FlytedeskAuthOptions
+         *  authorizationCacheTtlMs's doc comment for the one sanctioned exception. */
+        async fetchAuthorization(idpAccessToken, appId) {
+            const res = await fetch(issuerUrl(`/apps/${appId}/authorization`), {
+                headers: { Authorization: `Bearer ${idpAccessToken}` },
+            });
+            if (!res.ok) {
+                throw new Error(`flytedesk-id authorization endpoint returned ${res.status}`);
+            }
+            return (await res.json());
+        },
+        /** Best-effort — revokes the IdP-side refresh token (and, transitively, its grant)
+         *  on logout if flytedesk-id exposes a revocation endpoint. Never throws: a failed
+         *  revocation attempt must not block local logout, since the local session is what
+         *  actually keeps a signed-out browser from calling the consuming app's API again. */
+        async revokeIdpToken(token) {
+            try {
+                const discovery = await getDiscovery();
+                if (!discovery.revocation_endpoint)
+                    return false;
+                const res = await fetch(discovery.revocation_endpoint, {
+                    method: "POST",
+                    headers: {
+                        "Content-Type": "application/x-www-form-urlencoded",
+                        Authorization: basicAuthHeader(),
+                    },
+                    body: new URLSearchParams({ token }).toString(),
+                });
+                return res.ok;
+            }
+            catch {
+                return false;
+            }
+        },
+    };
+}
+//# sourceMappingURL=oidc-client.js.map

package/dist/auth/oidc-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-client.js","sourceRoot":"","sources":["../../src/auth/oidc-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAwB,MAAM,MAAM,CAAC;AA6C3E;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAuB;IACtD,SAAS,SAAS,CAAC,IAAY;QAC7B,OAAO,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC/C,CAAC;IAED;;;;;;;OAOG;IACH,SAAS,eAAe;QACtB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,YAAY,GAAG,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3D,OAAO,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClF,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,IAA4B;QACtD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE;YAC3C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,aAAa,EAAE,eAAe,EAAE;aACjC;YACD,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;SAC3C,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqB,CAAC;IAChD,CAAC;IAED,IAAI,IAAiC,CAAC;IACtC,SAAS,OAAO;QACd,IAAI,KAAK,kBAAkB,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,cAAsD,CAAC;IAC3D,SAAS,YAAY;QACnB,cAAc,KAAK,KAAK,CAAC,SAAS,CAAC,mCAAmC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACpF,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAC9E,OAAO,GAAG,CAAC,IAAI,EAAgC,CAAC;QAClD,CAAC,CAAC,CAAC;QACH,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,OAAO;QACL,iBAAiB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE;YACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YACxC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;YACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;YAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;YACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACrC,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;QACxB,CAAC;QAED,4FAA4F;QAC5F,qBAAqB,CAAC,IAAI,EAAE,QAAQ;YAClC,OAAO,YAAY,CAAC;gBAClB,UAAU,EAAE,oBAAoB;gBAChC,IAAI;gBACJ,YAAY,EAAE,IAAI,CAAC,WAAW;gBAC9B,aAAa,EAAE,QAAQ;gBACvB,SAAS,EAAE,IAAI,CAAC,QAAQ;aACzB,CAAC,CAAC;QACL,CAAC;QAED;qCAC6B;QAC7B,gBAAgB,CAAC,YAAY;YAC3B,OAAO,YAAY,CAAC;gBAClB,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,YAAY;gBAC3B,SAAS,EAAE,IAAI,CAAC,QAAQ;aACzB,CAAC,CAAC;QACL,CAAC;QAED;;;;;;;;WAQG;QACH,KAAK,CAAC,aAAa,CAAC,OAAO;YACzB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;gBACtD,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC,CAAC;YACH,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;YAC7E,CAAC;YACD,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QAC9B,CAAC;QAED;0EACkE;QAClE,KAAK,CAAC,aAAa,CAAC,cAAc;YAChC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;gBACxC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,cAAc,EAAE,EAAE;aACvD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC3D,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACnE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;YACtF,CAAC;YACD,OAAO;gBACL,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,aAAa,EAAE,IAAI,CAAC,cAAc,KAAK,IAAI;gBAC3C,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;aAC5D,CAAC;QACJ,CAAC;QAED;;;sFAG8E;QAC9E,KAAK,CAAC,kBAAkB,CAAC,cAAc,EAAE,KAAK;YAC5C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,SAAS,KAAK,gBAAgB,CAAC,EAAE;gBACjE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,cAAc,EAAE,EAAE;aACvD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,gDAAgD,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAChF,CAAC;YACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqB,CAAC;QAChD,CAAC;QAED;;;8FAGsF;QACtF,KAAK,CAAC,cAAc,CAAC,KAAK;YACxB,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,YAAY,EAAE,CAAC;gBACvC,IAAI,CAAC,SAAS,CAAC,mBAAmB;oBAAE,OAAO,KAAK,CAAC;gBACjD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,mBAAmB,EAAE;oBACrD,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE;wBACP,cAAc,EAAE,mCAAmC;wBACnD,aAAa,EAAE,eAAe,EAAE;qBACjC;oBACD,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE;iBAChD,CAAC,CAAC;gBACH,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/pkce.d.ts

@@ -0,0 +1,8 @@
+export interface PkcePair {
+    verifier: string;
+    challenge: string;
+}
+/** PKCE S256, per RFC 7636 — flytedesk-id makes this mandatory for every client, and
+ *  this module never offers `plain` as an option. */
+export declare function generatePkce(): PkcePair;
+export declare function randomState(): string;

package/dist/auth/pkce.js

@@ -0,0 +1,12 @@
+import { randomBytes, createHash } from "node:crypto";
+/** PKCE S256, per RFC 7636 — flytedesk-id makes this mandatory for every client, and
+ *  this module never offers `plain` as an option. */
+export function generatePkce() {
+    const verifier = randomBytes(32).toString("base64url"); // 43 chars — within the 43-128 range RFC 7636 requires
+    const challenge = createHash("sha256").update(verifier).digest("base64url");
+    return { verifier, challenge };
+}
+export function randomState() {
+    return randomBytes(24).toString("base64url");
+}
+//# sourceMappingURL=pkce.js.map

package/dist/auth/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../src/auth/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAOtD;qDACqD;AACrD,MAAM,UAAU,YAAY;IAC1B,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,uDAAuD;IAC/G,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC"}

package/dist/auth/plugin.d.ts

@@ -0,0 +1,8 @@
+import type { FastifyPluginAsync } from "fastify";
+import type { AuthedUser, FlytedeskAuthOptions } from "./types.js";
+declare module "fastify" {
+    interface FastifyRequest {
+        authUser?: AuthedUser;
+    }
+}
+export declare const flytedeskAuth: FastifyPluginAsync<FlytedeskAuthOptions>;