@frontmcp/sdk 0.4.1 → 0.5.1

package/src/auth/flows/well-known.oauth-authorization-server.flow.d.ts

@@ -2,27 +2,11 @@ import 'reflect-metadata';
 import { z } from 'zod';
 import { FlowBase, FlowRunOptions, ScopeEntry, ServerRequest } from '../../common';
 declare const inputSchema: z.ZodObject<{
-    request: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
-    response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
-    next: z.ZodOptional<z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>>;
-}, "strip", z.ZodTypeAny, {
-    request: {} & {
-        [k: string]: unknown;
-    };
-    response: {} & {
-        [k: string]: unknown;
-    };
-    next?: ((...args: unknown[]) => unknown) | undefined;
-}, {
-    request: {} & {
-        [k: string]: unknown;
-    };
-    response: {} & {
-        [k: string]: unknown;
-    };
-    next?: ((...args: unknown[]) => unknown) | undefined;
-}>;
-export declare const outputSchema: z.ZodUnion<[z.ZodObject<{
+    request: z.ZodObject<{}, z.core.$loose>;
+    response: z.ZodObject<{}, z.core.$loose>;
+    next: z.ZodOptional<z.ZodFunction<z.core.$ZodFunctionArgs, z.core.$ZodFunctionOut>>;
+}, z.core.$strip>;
+export declare const outputSchema: z.ZodUnion<readonly [z.ZodObject<{
     kind: z.ZodLiteral<"json">;
     status: z.ZodLiteral<200>;
     contentType: z.ZodLiteral<"application/json; charset=utf-8">;
@@ -33,80 +17,28 @@ export declare const outputSchema: z.ZodUnion<[z.ZodObject<{
         userinfo_endpoint: z.ZodOptional<z.ZodString>;
         jwks_uri: z.ZodString;
         registration_endpoint: z.ZodOptional<z.ZodString>;
-        token_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodEnum<["client_secret_basic", "client_secret_post", "private_key_jwt"]>, "many">>;
-        response_types_supported: z.ZodDefault<z.ZodArray<z.ZodEnum<["code"]>, "many">>;
-        grant_types_supported: z.ZodDefault<z.ZodArray<z.ZodEnum<["authorization_code", "refresh_token"]>, "many">>;
-        scopes_supported: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-        code_challenge_methods_supported: z.ZodDefault<z.ZodArray<z.ZodEnum<["S256"]>, "many">>;
-    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-        issuer: z.ZodString;
-        authorization_endpoint: z.ZodString;
-        token_endpoint: z.ZodString;
-        userinfo_endpoint: z.ZodOptional<z.ZodString>;
-        jwks_uri: z.ZodString;
-        registration_endpoint: z.ZodOptional<z.ZodString>;
-        token_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodEnum<["client_secret_basic", "client_secret_post", "private_key_jwt"]>, "many">>;
-        response_types_supported: z.ZodDefault<z.ZodArray<z.ZodEnum<["code"]>, "many">>;
-        grant_types_supported: z.ZodDefault<z.ZodArray<z.ZodEnum<["authorization_code", "refresh_token"]>, "many">>;
-        scopes_supported: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-        code_challenge_methods_supported: z.ZodDefault<z.ZodArray<z.ZodEnum<["S256"]>, "many">>;
-    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-        issuer: z.ZodString;
-        authorization_endpoint: z.ZodString;
-        token_endpoint: z.ZodString;
-        userinfo_endpoint: z.ZodOptional<z.ZodString>;
-        jwks_uri: z.ZodString;
-        registration_endpoint: z.ZodOptional<z.ZodString>;
-        token_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodEnum<["client_secret_basic", "client_secret_post", "private_key_jwt"]>, "many">>;
-        response_types_supported: z.ZodDefault<z.ZodArray<z.ZodEnum<["code"]>, "many">>;
-        grant_types_supported: z.ZodDefault<z.ZodArray<z.ZodEnum<["authorization_code", "refresh_token"]>, "many">>;
-        scopes_supported: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-        code_challenge_methods_supported: z.ZodDefault<z.ZodArray<z.ZodEnum<["S256"]>, "many">>;
-    }, z.ZodTypeAny, "passthrough">>;
-}, "strip", z.ZodTypeAny, {
-    status: 200;
-    kind: "json";
-    body: {
-        scopes_supported: string[];
-        issuer: string;
-        authorization_endpoint: string;
-        token_endpoint: string;
-        jwks_uri: string;
-        response_types_supported: "code"[];
-        grant_types_supported: ("authorization_code" | "refresh_token")[];
-        code_challenge_methods_supported: "S256"[];
-        userinfo_endpoint?: string | undefined;
-        registration_endpoint?: string | undefined;
-        token_endpoint_auth_methods_supported?: ("client_secret_basic" | "client_secret_post" | "private_key_jwt")[] | undefined;
-    } & {
-        [k: string]: unknown;
-    };
-    contentType: "application/json; charset=utf-8";
-}, {
-    status: 200;
-    kind: "json";
-    body: {
-        issuer: string;
-        authorization_endpoint: string;
-        token_endpoint: string;
-        jwks_uri: string;
-        scopes_supported?: string[] | undefined;
-        userinfo_endpoint?: string | undefined;
-        registration_endpoint?: string | undefined;
-        token_endpoint_auth_methods_supported?: ("client_secret_basic" | "client_secret_post" | "private_key_jwt")[] | undefined;
-        response_types_supported?: "code"[] | undefined;
-        grant_types_supported?: ("authorization_code" | "refresh_token")[] | undefined;
-        code_challenge_methods_supported?: "S256"[] | undefined;
-    } & {
-        [k: string]: unknown;
-    };
-    contentType: "application/json; charset=utf-8";
-}>, z.ZodObject<{
+        token_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+            client_secret_basic: "client_secret_basic";
+            client_secret_post: "client_secret_post";
+            private_key_jwt: "private_key_jwt";
+        }>>>;
+        response_types_supported: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+            code: "code";
+        }>>>;
+        grant_types_supported: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+            authorization_code: "authorization_code";
+            refresh_token: "refresh_token";
+        }>>>;
+        scopes_supported: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        code_challenge_methods_supported: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+            S256: "S256";
+        }>>>;
+    }, z.core.$loose>;
+}, z.core.$strip>, z.ZodObject<{
     kind: z.ZodLiteral<"redirect">;
-    status: z.ZodDefault<z.ZodType<301 | 302 | 303 | 307 | 308, z.ZodTypeDef, 301 | 302 | 303 | 307 | 308>>;
+    status: z.ZodDefault<z.ZodType<301 | 302 | 303 | 307 | 308, unknown, z.core.$ZodTypeInternals<301 | 302 | 303 | 307 | 308, unknown>>>;
     location: z.ZodString;
-} & {
-    headers: z.ZodOptional<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>]>>>>;
+    headers: z.ZodOptional<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>]>>>>;
     cookies: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
         name: z.ZodString;
         value: z.ZodString;
@@ -114,69 +46,20 @@ export declare const outputSchema: z.ZodUnion<[z.ZodObject<{
         domain: z.ZodOptional<z.ZodString>;
         httpOnly: z.ZodDefault<z.ZodBoolean>;
         secure: z.ZodOptional<z.ZodBoolean>;
-        sameSite: z.ZodOptional<z.ZodEnum<["lax", "strict", "none"]>>;
+        sameSite: z.ZodOptional<z.ZodEnum<{
+            lax: "lax";
+            strict: "strict";
+            none: "none";
+        }>>;
         maxAge: z.ZodOptional<z.ZodNumber>;
         expires: z.ZodOptional<z.ZodDate>;
-    }, "strip", z.ZodTypeAny, {
-        value: string;
-        path: string;
-        name: string;
-        httpOnly: boolean;
-        domain?: string | undefined;
-        secure?: boolean | undefined;
-        sameSite?: "strict" | "lax" | "none" | undefined;
-        maxAge?: number | undefined;
-        expires?: Date | undefined;
-    }, {
-        value: string;
-        name: string;
-        path?: string | undefined;
-        domain?: string | undefined;
-        httpOnly?: boolean | undefined;
-        secure?: boolean | undefined;
-        sameSite?: "strict" | "lax" | "none" | undefined;
-        maxAge?: number | undefined;
-        expires?: Date | undefined;
-    }>, "many">>>;
-}, "strip", z.ZodTypeAny, {
-    status: 301 | 302 | 303 | 307 | 308;
-    kind: "redirect";
-    location: string;
-    headers?: Record<string, string | string[]> | undefined;
-    cookies?: {
-        value: string;
-        path: string;
-        name: string;
-        httpOnly: boolean;
-        domain?: string | undefined;
-        secure?: boolean | undefined;
-        sameSite?: "strict" | "lax" | "none" | undefined;
-        maxAge?: number | undefined;
-        expires?: Date | undefined;
-    }[] | undefined;
-}, {
-    kind: "redirect";
-    location: string;
-    status?: 301 | 302 | 303 | 307 | 308 | undefined;
-    headers?: Record<string, string | string[]> | undefined;
-    cookies?: {
-        value: string;
-        name: string;
-        path?: string | undefined;
-        domain?: string | undefined;
-        httpOnly?: boolean | undefined;
-        secure?: boolean | undefined;
-        sameSite?: "strict" | "lax" | "none" | undefined;
-        maxAge?: number | undefined;
-        expires?: Date | undefined;
-    }[] | undefined;
-}>, z.ZodObject<{
+    }, z.core.$strip>>>>;
+}, z.core.$strip>, z.ZodObject<{
     kind: z.ZodLiteral<"text">;
-    status: z.ZodEffects<z.ZodNumber, number, number>;
+    status: z.ZodNumber;
     body: z.ZodString;
     contentType: z.ZodDefault<z.ZodString>;
-} & {
-    headers: z.ZodOptional<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>]>>>>;
+    headers: z.ZodOptional<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>]>>>>;
     cookies: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
         name: z.ZodString;
         value: z.ZodString;
@@ -184,84 +67,26 @@ export declare const outputSchema: z.ZodUnion<[z.ZodObject<{
         domain: z.ZodOptional<z.ZodString>;
         httpOnly: z.ZodDefault<z.ZodBoolean>;
         secure: z.ZodOptional<z.ZodBoolean>;
-        sameSite: z.ZodOptional<z.ZodEnum<["lax", "strict", "none"]>>;
+        sameSite: z.ZodOptional<z.ZodEnum<{
+            lax: "lax";
+            strict: "strict";
+            none: "none";
+        }>>;
         maxAge: z.ZodOptional<z.ZodNumber>;
         expires: z.ZodOptional<z.ZodDate>;
-    }, "strip", z.ZodTypeAny, {
-        value: string;
-        path: string;
-        name: string;
-        httpOnly: boolean;
-        domain?: string | undefined;
-        secure?: boolean | undefined;
-        sameSite?: "strict" | "lax" | "none" | undefined;
-        maxAge?: number | undefined;
-        expires?: Date | undefined;
-    }, {
-        value: string;
-        name: string;
-        path?: string | undefined;
-        domain?: string | undefined;
-        httpOnly?: boolean | undefined;
-        secure?: boolean | undefined;
-        sameSite?: "strict" | "lax" | "none" | undefined;
-        maxAge?: number | undefined;
-        expires?: Date | undefined;
-    }>, "many">>>;
-}, "strip", z.ZodTypeAny, {
-    status: number;
-    kind: "text";
-    body: string;
-    contentType: string;
-    headers?: Record<string, string | string[]> | undefined;
-    cookies?: {
-        value: string;
-        path: string;
-        name: string;
-        httpOnly: boolean;
-        domain?: string | undefined;
-        secure?: boolean | undefined;
-        sameSite?: "strict" | "lax" | "none" | undefined;
-        maxAge?: number | undefined;
-        expires?: Date | undefined;
-    }[] | undefined;
-}, {
-    status: number;
-    kind: "text";
-    body: string;
-    headers?: Record<string, string | string[]> | undefined;
-    cookies?: {
-        value: string;
-        name: string;
-        path?: string | undefined;
-        domain?: string | undefined;
-        httpOnly?: boolean | undefined;
-        secure?: boolean | undefined;
-        sameSite?: "strict" | "lax" | "none" | undefined;
-        maxAge?: number | undefined;
-        expires?: Date | undefined;
-    }[] | undefined;
-    contentType?: string | undefined;
-}>]>;
+    }, z.core.$strip>>>>;
+}, z.core.$strip>]>;
 export declare const wellKnownAsStateSchema: z.ZodObject<{
     baseUrl: z.ZodString;
-    scopesSupported: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    tokenEndpointAuthMethods: z.ZodDefault<z.ZodArray<z.ZodEnum<["client_secret_basic", "client_secret_post", "private_key_jwt"]>, "many">>;
+    scopesSupported: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    tokenEndpointAuthMethods: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+        client_secret_basic: "client_secret_basic";
+        client_secret_post: "client_secret_post";
+        private_key_jwt: "private_key_jwt";
+    }>>>;
     dcrEnabled: z.ZodDefault<z.ZodBoolean>;
     isOrchestrated: z.ZodBoolean;
-}, "strip", z.ZodTypeAny, {
-    baseUrl: string;
-    dcrEnabled: boolean;
-    scopesSupported: string[];
-    isOrchestrated: boolean;
-    tokenEndpointAuthMethods: ("client_secret_basic" | "client_secret_post" | "private_key_jwt")[];
-}, {
-    baseUrl: string;
-    isOrchestrated: boolean;
-    dcrEnabled?: boolean | undefined;
-    scopesSupported?: string[] | undefined;
-    tokenEndpointAuthMethods?: ("client_secret_basic" | "client_secret_post" | "private_key_jwt")[] | undefined;
-}>;
+}, z.core.$strip>;
 declare const wellKnownAsPlan: {
     readonly pre: ["parseInput"];
     readonly execute: ["collectData"];

package/src/auth/flows/well-known.oauth-authorization-server.flow.js

@@ -6,7 +6,6 @@ const tslib_1 = require("tslib");
 require("reflect-metadata");
 const zod_1 = require("zod");
 const common_1 = require("../../common");
-const path_utils_1 = require("../path.utils");
 const inputSchema = common_1.httpInputSchema;
 // ===== Result =====
 const AuthServerMetadataSchema = zod_1.z.object({
@@ -51,13 +50,13 @@ const name = 'well-known.oauth-authorization-server';
 const Stage = (0, common_1.StageHookOf)(name);
 let WellKnownAsFlow = class WellKnownAsFlow extends common_1.FlowBase {
     static canActivate(request, scope) {
-        return (0, path_utils_1.makeWellKnownPaths)('oauth-authorization-server', scope.entryPath, scope.routeBase).has(request.path);
+        return (0, common_1.makeWellKnownPaths)('oauth-authorization-server', scope.entryPath, scope.routeBase).has(request.path);
     }
     async parseInput() {
         const { request } = this.rawInput;
         if (!request)
             throw new Error('Request is undefined');
-        const baseUrl = (0, path_utils_1.getRequestBaseUrl)(request, this.scope.entryPath);
+        const baseUrl = (0, common_1.getRequestBaseUrl)(request, this.scope.entryPath);
         this.state.set(exports.wellKnownAsStateSchema.parse({
             baseUrl,
             scopesSupported: [],

package/src/auth/flows/well-known.oauth-authorization-server.flow.js.map

@@ -1 +1 @@
-{"version":3,"file":"well-known.oauth-authorization-server.flow.js","sourceRoot":"","sources":["../../../../src/auth/flows/well-known.oauth-authorization-server.flow.ts"],"names":[],"mappings":";;;;AAAA,2DAA2D;AAC3D,4BAA0B;AAC1B,6BAAsB;AACtB,yCAUsB;AACtB,8CAAoE;AAGpE,MAAM,WAAW,GAAG,wBAAe,CAAC;AAGpC,qBAAqB;AACrB,MAAM,wBAAwB,GAAG,OAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACvB,MAAM,EAAE,OAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACtB,WAAW,EAAE,OAAC,CAAC,OAAO,CAAC,iCAAiC,CAAC;IACzD,IAAI,EAAE,OAAC;SACJ,MAAM,CAAC;QACN,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,sBAAsB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACzC,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACjC,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAC/C,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,qBAAqB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACnD,qCAAqC,EAAE,OAAC;aACrC,KAAK,CAAC,OAAC,CAAC,IAAI,CAAC,CAAC,qBAAqB,EAAE,oBAAoB,EAAE,iBAAiB,CAAC,CAAC,CAAC;aAC/E,QAAQ,EAAE;QACb,wBAAwB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;QACrE,qBAAqB,EAAE,OAAC;aACrB,KAAK,CAAC,OAAC,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC,CAAC;aACtD,OAAO,CAAC,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC;QACnD,gBAAgB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAC7E,gCAAgC,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;KAC9E,CAAC;SACD,WAAW,EAAE;CACjB,CAAC,CAAC;AAEU,QAAA,YAAY,GAAG,OAAC,CAAC,KAAK,CAAC,CAAC,wBAAwB,EAAE,2BAAkB,EAAE,uBAAc,CAAC,CAAC,CAAC;AAEvF,QAAA,sBAAsB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,qCAAqC;IACjE,eAAe,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC5E,wBAAwB,EAAE,OAAC;SACxB,KAAK,CAAC,OAAC,CAAC,IAAI,CAAC,CAAC,qBAAqB,EAAE,oBAAoB,EAAE,iBAAiB,CAAC,CAAC,CAAC;SAC/E,OAAO,CAAC,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,CAAC;IACzD,UAAU,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACrC,cAAc,EAAE,OAAC,CAAC,OAAO,EAAE;CAC5B,CAAC,CAAC;AAGH,MAAM,eAAe,GAAG;IACtB,GAAG,EAAE,CAAC,YAAY,CAAC;IACnB,OAAO,EAAE,CAAC,aAAa,CAAC;CACW,CAAC;AAiBtC,MAAM,IAAI,GAAG,uCAAgD,CAAC;AAC9D,MAAM,KAAK,GAAG,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;AAajB,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,iBAAqB;IAChE,MAAM,CAAC,WAAW,CAAC,OAAsB,EAAE,KAAiB;QAC1D,OAAO,IAAA,+BAAkB,EAAC,4BAA4B,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9G,CAAC;IAGK,AAAN,KAAK,CAAC,UAAU;QACd,MAAM,EAAC,OAAO,EAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAEtD,MAAM,OAAO,GAAG,IAAA,8BAAiB,EAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,8BAAsB,CAAC,KAAK,CAAC;YAC1C,OAAO;YACP,eAAe,EAAE,EAAE;YACnB,wBAAwB,EAAE,EAAE;YAC5B,UAAU,EAAE,KAAK,EAAE,yBAAyB;YAC5C,cAAc,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,sBAAsB;SAClE,CAAC,CAAC,CAAC;IACN,CAAC;IAGK,AAAN,KAAK,CAAC,WAAW;QACf,MAAM,EAAC,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,UAAU,EAAE,cAAc,EAAC,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC7G,oCAAoC;QACpC,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,UAAU,GAAG,GAAG,OAAO,EAAE,CAAC;YAChC,IAAI,CAAC,OAAO,CAAC;gBACX,IAAI,EAAE,MAAM;gBACZ,WAAW,EAAE,iCAAiC;gBAC9C,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE;oBACJ,MAAM,EAAE,UAAU;oBAClB,sBAAsB,EAAE,GAAG,UAAU,kBAAkB;oBACvD,cAAc,EAAE,GAAG,UAAU,cAAc;oBAC3C,iBAAiB,EAAE,GAAG,UAAU,iBAAiB;oBACjD,QAAQ,EAAE,GAAG,UAAU,wBAAwB;oBAC/C,qBAAqB,EAAE,GAAG,UAAU,iBAAiB;oBACrD,qCAAqC,EAAE,wBAAwB;oBAC/D,wBAAwB,EAAE,CAAC,MAAM,CAAC;oBAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;oBAC9D,gBAAgB,EAAE,eAAe;oBACjC,gCAAgC,EAAE,CAAC,MAAM,CAAC;iBAC3C;aACF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QAChC,IAAI,CAAC,OAAO,CAAC,oBAAW,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,MAAM,yCAAyC,CAAC,CAAC,CAAC;IACjG,CAAC;CACF,CAAA;AA3CO;IADL,KAAK,CAAC,YAAY,CAAC;;;;iDAanB;AAGK;IADL,KAAK,CAAC,aAAa,CAAC;;;;kDA4BpB;AAhDkB,eAAe;IAVnC,IAAA,aAAI,EAAC;QACJ,IAAI;QACJ,IAAI,EAAE,eAAe;QACrB,WAAW;QACX,YAAY,EAAZ,oBAAY;QACZ,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE;YACV,MAAM,EAAE,KAAK;SACd;KACF,CAAC;GACmB,eAAe,CAiDnC;kBAjDoB,eAAe","sourcesContent":["// auth/flows/well-known.oauth-authorization-server.flow.ts\nimport 'reflect-metadata';\nimport {z} from 'zod';\nimport {\n  HttpRedirectSchema,\n  httpRespond,\n  HttpTextSchema,\n  Flow,\n  FlowBase,\n  FlowRunOptions,\n  ScopeEntry,\n  ServerRequest,\n  StageHookOf, httpInputSchema, FlowPlan,\n} from '../../common';\nimport {getRequestBaseUrl, makeWellKnownPaths} from '../path.utils';\n\n\nconst inputSchema = httpInputSchema;\n\n\n// ===== Result =====\nconst AuthServerMetadataSchema = z.object({\n  kind: z.literal('json'),\n  status: z.literal(200),\n  contentType: z.literal('application/json; charset=utf-8'),\n  body: z\n    .object({\n      issuer: z.string().min(1),\n      authorization_endpoint: z.string().min(1),\n      token_endpoint: z.string().min(1),\n      userinfo_endpoint: z.string().min(1).optional(),\n      jwks_uri: z.string().min(1),\n      registration_endpoint: z.string().min(1).optional(),\n      token_endpoint_auth_methods_supported: z\n        .array(z.enum(['client_secret_basic', 'client_secret_post', 'private_key_jwt']))\n        .optional(),\n      response_types_supported: z.array(z.enum(['code'])).default(['code']),\n      grant_types_supported: z\n        .array(z.enum(['authorization_code', 'refresh_token']))\n        .default(['authorization_code', 'refresh_token']),\n      scopes_supported: z.array(z.string()).default(['openid', 'profile', 'email']),\n      code_challenge_methods_supported: z.array(z.enum(['S256'])).default(['S256']),\n    })\n    .passthrough(),\n});\n\nexport const outputSchema = z.union([AuthServerMetadataSchema, HttpRedirectSchema, HttpTextSchema]);\n\nexport const wellKnownAsStateSchema = z.object({\n  baseUrl: z.string().min(1), // baseUrl + entryPrefix (unsuffixed)\n  scopesSupported: z.array(z.string()).default(['openid', 'profile', 'email']),\n  tokenEndpointAuthMethods: z\n    .array(z.enum(['client_secret_basic', 'client_secret_post', 'private_key_jwt']))\n    .default(['client_secret_basic', 'client_secret_post']),\n  dcrEnabled: z.boolean().default(true),\n  isOrchestrated: z.boolean(),\n});\n\n\nconst wellKnownAsPlan = {\n  pre: ['parseInput'],\n  execute: ['collectData'],\n} as const satisfies FlowPlan<string>;\n\ntype WellKnownAsPlan = typeof wellKnownAsPlan;\ntype WellKnownAsFlowOptions = FlowRunOptions<\n  WellKnownAsFlow,\n  WellKnownAsPlan,\n  typeof inputSchema,\n  typeof outputSchema,\n  typeof wellKnownAsStateSchema\n>\n\ndeclare global {\n  interface ExtendFlows {\n    'well-known.oauth-authorization-server': WellKnownAsFlowOptions;\n  }\n}\n\nconst name = 'well-known.oauth-authorization-server' as const;\nconst Stage = StageHookOf(name);\n\n\n@Flow({\n  name,\n  plan: wellKnownAsPlan,\n  inputSchema,\n  outputSchema,\n  access: 'public',\n  middleware: {\n    method: 'GET',\n  },\n})\nexport default class WellKnownAsFlow extends FlowBase<typeof name> {\n  static canActivate(request: ServerRequest, scope: ScopeEntry) {\n    return makeWellKnownPaths('oauth-authorization-server', scope.entryPath, scope.routeBase).has(request.path);\n  }\n\n  @Stage('parseInput')\n  async parseInput() {\n    const {request} = this.rawInput;\n    if (!request) throw new Error('Request is undefined');\n\n    const baseUrl = getRequestBaseUrl(request, this.scope.entryPath);\n    this.state.set(wellKnownAsStateSchema.parse({\n      baseUrl,\n      scopesSupported: [],\n      tokenEndpointAuthMethods: [],\n      dcrEnabled: false, //scope.oauth.dcrEnabled,\n      isOrchestrated: !this.scope.metadata.auth, // scope.orchestrated,\n    }));\n  }\n\n  @Stage('collectData')\n  async collectData() {\n    const {baseUrl, scopesSupported, tokenEndpointAuthMethods, dcrEnabled, isOrchestrated} = this.state.required;\n    // Orchestrated => gateway is the AS\n    if (isOrchestrated) {\n      const baseIssuer = `${baseUrl}`;\n      this.respond({\n        kind: 'json',\n        contentType: 'application/json; charset=utf-8',\n        status: 200,\n        body: {\n          issuer: baseIssuer,\n          authorization_endpoint: `${baseIssuer}/oauth/authorize`,\n          token_endpoint: `${baseIssuer}/oauth/token`,\n          userinfo_endpoint: `${baseIssuer}/oauth/userinfo`,\n          jwks_uri: `${baseIssuer}/.well-known/jwks.json`,\n          registration_endpoint: `${baseIssuer}/oauth/register`,\n          token_endpoint_auth_methods_supported: tokenEndpointAuthMethods,\n          response_types_supported: ['code'],\n          grant_types_supported: ['authorization_code', 'refresh_token'],\n          scopes_supported: scopesSupported,\n          code_challenge_methods_supported: ['S256'],\n        },\n      });\n      return;\n    }\n    const primary = this.scope.auth;\n    this.respond(httpRespond.redirect(`${primary.issuer}/.well-known/oauth-authorization-server`));\n  }\n}\n"]}
+{"version":3,"file":"well-known.oauth-authorization-server.flow.js","sourceRoot":"","sources":["../../../../src/auth/flows/well-known.oauth-authorization-server.flow.ts"],"names":[],"mappings":";;;;AAAA,2DAA2D;AAC3D,4BAA0B;AAC1B,6BAAwB;AACxB,yCAcsB;AAEtB,MAAM,WAAW,GAAG,wBAAe,CAAC;AAEpC,qBAAqB;AACrB,MAAM,wBAAwB,GAAG,OAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACvB,MAAM,EAAE,OAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACtB,WAAW,EAAE,OAAC,CAAC,OAAO,CAAC,iCAAiC,CAAC;IACzD,IAAI,EAAE,OAAC;SACJ,MAAM,CAAC;QACN,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,sBAAsB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACzC,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACjC,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAC/C,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,qBAAqB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACnD,qCAAqC,EAAE,OAAC;aACrC,KAAK,CAAC,OAAC,CAAC,IAAI,CAAC,CAAC,qBAAqB,EAAE,oBAAoB,EAAE,iBAAiB,CAAC,CAAC,CAAC;aAC/E,QAAQ,EAAE;QACb,wBAAwB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;QACrE,qBAAqB,EAAE,OAAC;aACrB,KAAK,CAAC,OAAC,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC,CAAC;aACtD,OAAO,CAAC,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC;QACnD,gBAAgB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAC7E,gCAAgC,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;KAC9E,CAAC;SACD,WAAW,EAAE;CACjB,CAAC,CAAC;AAEU,QAAA,YAAY,GAAG,OAAC,CAAC,KAAK,CAAC,CAAC,wBAAwB,EAAE,2BAAkB,EAAE,uBAAc,CAAC,CAAC,CAAC;AAEvF,QAAA,sBAAsB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,qCAAqC;IACjE,eAAe,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC5E,wBAAwB,EAAE,OAAC;SACxB,KAAK,CAAC,OAAC,CAAC,IAAI,CAAC,CAAC,qBAAqB,EAAE,oBAAoB,EAAE,iBAAiB,CAAC,CAAC,CAAC;SAC/E,OAAO,CAAC,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,CAAC;IACzD,UAAU,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACrC,cAAc,EAAE,OAAC,CAAC,OAAO,EAAE;CAC5B,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG;IACtB,GAAG,EAAE,CAAC,YAAY,CAAC;IACnB,OAAO,EAAE,CAAC,aAAa,CAAC;CACW,CAAC;AAiBtC,MAAM,IAAI,GAAG,uCAAgD,CAAC;AAC9D,MAAM,KAAK,GAAG,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;AAYjB,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,iBAAqB;IAChE,MAAM,CAAC,WAAW,CAAC,OAAsB,EAAE,KAAiB;QAC1D,OAAO,IAAA,2BAAkB,EAAC,4BAA4B,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9G,CAAC;IAGK,AAAN,KAAK,CAAC,UAAU;QACd,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAClC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAEtD,MAAM,OAAO,GAAG,IAAA,0BAAiB,EAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK,CAAC,GAAG,CACZ,8BAAsB,CAAC,KAAK,CAAC;YAC3B,OAAO;YACP,eAAe,EAAE,EAAE;YACnB,wBAAwB,EAAE,EAAE;YAC5B,UAAU,EAAE,KAAK,EAAE,yBAAyB;YAC5C,cAAc,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,sBAAsB;SAClE,CAAC,CACH,CAAC;IACJ,CAAC;IAGK,AAAN,KAAK,CAAC,WAAW;QACf,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,UAAU,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC/G,oCAAoC;QACpC,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,UAAU,GAAG,GAAG,OAAO,EAAE,CAAC;YAChC,IAAI,CAAC,OAAO,CAAC;gBACX,IAAI,EAAE,MAAM;gBACZ,WAAW,EAAE,iCAAiC;gBAC9C,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE;oBACJ,MAAM,EAAE,UAAU;oBAClB,sBAAsB,EAAE,GAAG,UAAU,kBAAkB;oBACvD,cAAc,EAAE,GAAG,UAAU,cAAc;oBAC3C,iBAAiB,EAAE,GAAG,UAAU,iBAAiB;oBACjD,QAAQ,EAAE,GAAG,UAAU,wBAAwB;oBAC/C,qBAAqB,EAAE,GAAG,UAAU,iBAAiB;oBACrD,qCAAqC,EAAE,wBAAwB;oBAC/D,wBAAwB,EAAE,CAAC,MAAM,CAAC;oBAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;oBAC9D,gBAAgB,EAAE,eAAe;oBACjC,gCAAgC,EAAE,CAAC,MAAM,CAAC;iBAC3C;aACF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QAChC,IAAI,CAAC,OAAO,CAAC,oBAAW,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,MAAM,yCAAyC,CAAC,CAAC,CAAC;IACjG,CAAC;CACF,CAAA;AA7CO;IADL,KAAK,CAAC,YAAY,CAAC;;;;iDAenB;AAGK;IADL,KAAK,CAAC,aAAa,CAAC;;;;kDA4BpB;AAlDkB,eAAe;IAVnC,IAAA,aAAI,EAAC;QACJ,IAAI;QACJ,IAAI,EAAE,eAAe;QACrB,WAAW;QACX,YAAY,EAAZ,oBAAY;QACZ,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE;YACV,MAAM,EAAE,KAAK;SACd;KACF,CAAC;GACmB,eAAe,CAmDnC;kBAnDoB,eAAe","sourcesContent":["// auth/flows/well-known.oauth-authorization-server.flow.ts\nimport 'reflect-metadata';\nimport { z } from 'zod';\nimport {\n  HttpRedirectSchema,\n  httpRespond,\n  HttpTextSchema,\n  Flow,\n  FlowBase,\n  FlowRunOptions,\n  ScopeEntry,\n  ServerRequest,\n  StageHookOf,\n  httpInputSchema,\n  FlowPlan,\n  getRequestBaseUrl,\n  makeWellKnownPaths,\n} from '../../common';\n\nconst inputSchema = httpInputSchema;\n\n// ===== Result =====\nconst AuthServerMetadataSchema = z.object({\n  kind: z.literal('json'),\n  status: z.literal(200),\n  contentType: z.literal('application/json; charset=utf-8'),\n  body: z\n    .object({\n      issuer: z.string().min(1),\n      authorization_endpoint: z.string().min(1),\n      token_endpoint: z.string().min(1),\n      userinfo_endpoint: z.string().min(1).optional(),\n      jwks_uri: z.string().min(1),\n      registration_endpoint: z.string().min(1).optional(),\n      token_endpoint_auth_methods_supported: z\n        .array(z.enum(['client_secret_basic', 'client_secret_post', 'private_key_jwt']))\n        .optional(),\n      response_types_supported: z.array(z.enum(['code'])).default(['code']),\n      grant_types_supported: z\n        .array(z.enum(['authorization_code', 'refresh_token']))\n        .default(['authorization_code', 'refresh_token']),\n      scopes_supported: z.array(z.string()).default(['openid', 'profile', 'email']),\n      code_challenge_methods_supported: z.array(z.enum(['S256'])).default(['S256']),\n    })\n    .passthrough(),\n});\n\nexport const outputSchema = z.union([AuthServerMetadataSchema, HttpRedirectSchema, HttpTextSchema]);\n\nexport const wellKnownAsStateSchema = z.object({\n  baseUrl: z.string().min(1), // baseUrl + entryPrefix (unsuffixed)\n  scopesSupported: z.array(z.string()).default(['openid', 'profile', 'email']),\n  tokenEndpointAuthMethods: z\n    .array(z.enum(['client_secret_basic', 'client_secret_post', 'private_key_jwt']))\n    .default(['client_secret_basic', 'client_secret_post']),\n  dcrEnabled: z.boolean().default(true),\n  isOrchestrated: z.boolean(),\n});\n\nconst wellKnownAsPlan = {\n  pre: ['parseInput'],\n  execute: ['collectData'],\n} as const satisfies FlowPlan<string>;\n\ntype WellKnownAsPlan = typeof wellKnownAsPlan;\ntype WellKnownAsFlowOptions = FlowRunOptions<\n  WellKnownAsFlow,\n  WellKnownAsPlan,\n  typeof inputSchema,\n  typeof outputSchema,\n  typeof wellKnownAsStateSchema\n>;\n\ndeclare global {\n  interface ExtendFlows {\n    'well-known.oauth-authorization-server': WellKnownAsFlowOptions;\n  }\n}\n\nconst name = 'well-known.oauth-authorization-server' as const;\nconst Stage = StageHookOf(name);\n\n@Flow({\n  name,\n  plan: wellKnownAsPlan,\n  inputSchema,\n  outputSchema,\n  access: 'public',\n  middleware: {\n    method: 'GET',\n  },\n})\nexport default class WellKnownAsFlow extends FlowBase<typeof name> {\n  static canActivate(request: ServerRequest, scope: ScopeEntry) {\n    return makeWellKnownPaths('oauth-authorization-server', scope.entryPath, scope.routeBase).has(request.path);\n  }\n\n  @Stage('parseInput')\n  async parseInput() {\n    const { request } = this.rawInput;\n    if (!request) throw new Error('Request is undefined');\n\n    const baseUrl = getRequestBaseUrl(request, this.scope.entryPath);\n    this.state.set(\n      wellKnownAsStateSchema.parse({\n        baseUrl,\n        scopesSupported: [],\n        tokenEndpointAuthMethods: [],\n        dcrEnabled: false, //scope.oauth.dcrEnabled,\n        isOrchestrated: !this.scope.metadata.auth, // scope.orchestrated,\n      }),\n    );\n  }\n\n  @Stage('collectData')\n  async collectData() {\n    const { baseUrl, scopesSupported, tokenEndpointAuthMethods, dcrEnabled, isOrchestrated } = this.state.required;\n    // Orchestrated => gateway is the AS\n    if (isOrchestrated) {\n      const baseIssuer = `${baseUrl}`;\n      this.respond({\n        kind: 'json',\n        contentType: 'application/json; charset=utf-8',\n        status: 200,\n        body: {\n          issuer: baseIssuer,\n          authorization_endpoint: `${baseIssuer}/oauth/authorize`,\n          token_endpoint: `${baseIssuer}/oauth/token`,\n          userinfo_endpoint: `${baseIssuer}/oauth/userinfo`,\n          jwks_uri: `${baseIssuer}/.well-known/jwks.json`,\n          registration_endpoint: `${baseIssuer}/oauth/register`,\n          token_endpoint_auth_methods_supported: tokenEndpointAuthMethods,\n          response_types_supported: ['code'],\n          grant_types_supported: ['authorization_code', 'refresh_token'],\n          scopes_supported: scopesSupported,\n          code_challenge_methods_supported: ['S256'],\n        },\n      });\n      return;\n    }\n    const primary = this.scope.auth;\n    this.respond(httpRespond.redirect(`${primary.issuer}/.well-known/oauth-authorization-server`));\n  }\n}\n"]}

package/src/auth/flows/well-known.prm.flow.d.ts

@@ -2,47 +2,21 @@ import 'reflect-metadata';
 import { z } from 'zod';
 import { FlowBase, FlowRunOptions, ScopeEntry, ServerRequest } from '../../common';
 declare const inputSchema: z.ZodObject<{
-    request: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
-    response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
-    next: z.ZodOptional<z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>>;
-}, "strip", z.ZodTypeAny, {
-    request: {} & {
-        [k: string]: unknown;
-    };
-    response: {} & {
-        [k: string]: unknown;
-    };
-    next?: ((...args: unknown[]) => unknown) | undefined;
-}, {
-    request: {} & {
-        [k: string]: unknown;
-    };
-    response: {} & {
-        [k: string]: unknown;
-    };
-    next?: ((...args: unknown[]) => unknown) | undefined;
-}>;
+    request: z.ZodObject<{}, z.core.$loose>;
+    response: z.ZodObject<{}, z.core.$loose>;
+    next: z.ZodOptional<z.ZodFunction<z.core.$ZodFunctionArgs, z.core.$ZodFunctionOut>>;
+}, z.core.$strip>;
 declare const stateSchema: z.ZodObject<{
     resource: z.ZodString;
     baseUrl: z.ZodString;
-    scopesSupported: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    scopesSupported: z.ZodDefault<z.ZodArray<z.ZodString>>;
     isOrchestrated: z.ZodBoolean;
-}, "strip", z.ZodTypeAny, {
-    resource: string;
-    baseUrl: string;
-    scopesSupported: string[];
-    isOrchestrated: boolean;
-}, {
-    resource: string;
-    baseUrl: string;
-    isOrchestrated: boolean;
-    scopesSupported?: string[] | undefined;
-}>;
+}, z.core.$strip>;
 declare const outputSchema: z.ZodObject<{
     kind: z.ZodLiteral<"json">;
-    status: z.ZodEffects<z.ZodNumber, number, number>;
+    status: z.ZodNumber;
     contentType: z.ZodDefault<z.ZodString>;
-    headers: z.ZodOptional<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>]>>>>;
+    headers: z.ZodOptional<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>]>>>>;
     cookies: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
         name: z.ZodString;
         value: z.ZodString;
@@ -50,96 +24,21 @@ declare const outputSchema: z.ZodObject<{
         domain: z.ZodOptional<z.ZodString>;
         httpOnly: z.ZodDefault<z.ZodBoolean>;
         secure: z.ZodOptional<z.ZodBoolean>;
-        sameSite: z.ZodOptional<z.ZodEnum<["lax", "strict", "none"]>>;
+        sameSite: z.ZodOptional<z.ZodEnum<{
+            lax: "lax";
+            strict: "strict";
+            none: "none";
+        }>>;
         maxAge: z.ZodOptional<z.ZodNumber>;
         expires: z.ZodOptional<z.ZodDate>;
-    }, "strip", z.ZodTypeAny, {
-        value: string;
-        path: string;
-        name: string;
-        httpOnly: boolean;
-        domain?: string | undefined;
-        secure?: boolean | undefined;
-        sameSite?: "strict" | "lax" | "none" | undefined;
-        maxAge?: number | undefined;
-        expires?: Date | undefined;
-    }, {
-        value: string;
-        name: string;
-        path?: string | undefined;
-        domain?: string | undefined;
-        httpOnly?: boolean | undefined;
-        secure?: boolean | undefined;
-        sameSite?: "strict" | "lax" | "none" | undefined;
-        maxAge?: number | undefined;
-        expires?: Date | undefined;
-    }>, "many">>>;
-} & {
+    }, z.core.$strip>>>>;
     body: z.ZodObject<{
         resource: z.ZodString;
-        authorization_servers: z.ZodArray<z.ZodString, "many">;
-        scopes_supported: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-        bearer_methods_supported: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-        resource: z.ZodString;
-        authorization_servers: z.ZodArray<z.ZodString, "many">;
-        scopes_supported: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-        bearer_methods_supported: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-        resource: z.ZodString;
-        authorization_servers: z.ZodArray<z.ZodString, "many">;
-        scopes_supported: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-        bearer_methods_supported: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    }, z.ZodTypeAny, "passthrough">>;
-}, "strip", z.ZodTypeAny, {
-    status: number;
-    kind: "json";
-    body: {
-        resource: string;
-        authorization_servers: string[];
-        scopes_supported: string[];
-        bearer_methods_supported: string[];
-    } & {
-        [k: string]: unknown;
-    };
-    contentType: string;
-    headers?: Record<string, string | string[]> | undefined;
-    cookies?: {
-        value: string;
-        path: string;
-        name: string;
-        httpOnly: boolean;
-        domain?: string | undefined;
-        secure?: boolean | undefined;
-        sameSite?: "strict" | "lax" | "none" | undefined;
-        maxAge?: number | undefined;
-        expires?: Date | undefined;
-    }[] | undefined;
-}, {
-    status: number;
-    kind: "json";
-    body: {
-        resource: string;
-        authorization_servers: string[];
-        scopes_supported?: string[] | undefined;
-        bearer_methods_supported?: string[] | undefined;
-    } & {
-        [k: string]: unknown;
-    };
-    headers?: Record<string, string | string[]> | undefined;
-    cookies?: {
-        value: string;
-        name: string;
-        path?: string | undefined;
-        domain?: string | undefined;
-        httpOnly?: boolean | undefined;
-        secure?: boolean | undefined;
-        sameSite?: "strict" | "lax" | "none" | undefined;
-        maxAge?: number | undefined;
-        expires?: Date | undefined;
-    }[] | undefined;
-    contentType?: string | undefined;
-}>;
+        authorization_servers: z.ZodArray<z.ZodString>;
+        scopes_supported: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        bearer_methods_supported: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$loose>;
+}, z.core.$strip>;
 declare const plan: {
     readonly pre: ["parseInput"];
     readonly execute: ["collectData"];

package/src/auth/flows/well-known.prm.flow.js

@@ -5,7 +5,6 @@ const tslib_1 = require("tslib");
 require("reflect-metadata");
 const zod_1 = require("zod");
 const common_1 = require("../../common");
-const path_utils_1 = require("../path.utils");
 const inputSchema = common_1.httpInputSchema;
 const stateSchema = zod_1.z.object({
     resource: zod_1.z.string().min(1),
@@ -32,15 +31,15 @@ const name = 'well-known.oauth-protected-resource';
 const Stage = (0, common_1.StageHookOf)(name);
 let WellKnownPrmFlow = class WellKnownPrmFlow extends common_1.FlowBase {
     static canActivate(request, scope) {
-        return (0, path_utils_1.makeWellKnownPaths)('oauth-protected-resource', scope.entryPath, scope.routeBase).has(request.path);
+        return (0, common_1.makeWellKnownPaths)('oauth-protected-resource', scope.entryPath, scope.routeBase).has(request.path);
     }
     async parseInput() {
         const { request } = this.rawInput;
         const scope = this.scope;
         if (!request)
             throw new Error('Request is undefined');
-        const resource = (0, path_utils_1.computeResource)(request, scope.entryPath, scope.routeBase);
-        const baseUrl = (0, path_utils_1.getRequestBaseUrl)(request, scope.entryPath);
+        const resource = (0, common_1.computeResource)(request, scope.entryPath, scope.routeBase);
+        const baseUrl = (0, common_1.getRequestBaseUrl)(request, scope.entryPath);
         this.state.set(stateSchema.parse({
             resource,
             baseUrl,

package/src/auth/flows/well-known.prm.flow.js.map

@@ -1 +1 @@
-{"version":3,"file":"well-known.prm.flow.js","sourceRoot":"","sources":["../../../../src/auth/flows/well-known.prm.flow.ts"],"names":[],"mappings":";;;AAAA,oCAAoC;AACpC,4BAA0B;AAC1B,6BAAsB;AACtB,yCASsB;AACtB,8CAAqF;AAErF,MAAM,WAAW,GAAG,wBAAe,CAAC;AAEpC,MAAM,WAAW,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3B,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,eAAe,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC5E,cAAc,EAAE,OAAC,CAAC,OAAO,EAAE;CAC5B,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,uBAAc,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,OAAC;SACJ,MAAM,CAAC;QACN,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,qBAAqB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACxD,gBAAgB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAC7E,wBAAwB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC;KAClE,CAAC;SACD,WAAW,EAAE;CACjB,CAAC,CAAC;AAEH,MAAM,IAAI,GAAG;IACX,GAAG,EAAE,CAAC,YAAY,CAAC;IACnB,OAAO,EAAE,CAAC,aAAa,CAAC;IACxB,IAAI,EAAE,CAAC,gBAAgB,CAAC;CACW,CAAC;AActC,MAAM,IAAI,GAAG,qCAA8C,CAAC;AAC5D,MAAM,KAAK,GAAG,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;AAYjB,IAAM,gBAAgB,GAAtB,MAAM,gBAAiB,SAAQ,iBAAqB;IACjE,MAAM,CAAC,WAAW,CAAC,OAAsB,EAAE,KAAiB;QAC1D,OAAO,IAAA,+BAAkB,EAAC,0BAA0B,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5G,CAAC;IAGK,AAAN,KAAK,CAAC,UAAU;QACd,MAAM,EAAC,OAAO,EAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAEtD,MAAM,QAAQ,GAAG,IAAA,4BAAe,EAAC,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG,IAAA,8BAAiB,EAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC;YAC/B,QAAQ;YACR,OAAO;YACP,eAAe,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;YAC/C,cAAc,EAAE,KAAK,EAAC,iCAAiC;SACxD,CAAC,CAAC,CAAC;IACN,CAAC;IAE2B,AAAN,KAAK,CAAC,WAAW;QACrC,MAAM,EAAC,QAAQ,EAAE,OAAO,EAAE,eAAe,EAAE,cAAc,EAAC,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAEjF,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,OAAO,CAAC;gBACX,IAAI,EAAE,MAAM;gBACZ,WAAW,EAAE,iCAAiC;gBAC9C,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE;oBACJ,QAAQ;oBACR,qBAAqB,EAAE,CAAC,OAAO,CAAC;oBAChC,gBAAgB,EAAE,eAAe;oBACjC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;iBACrC;aACF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;QACtC,oBAAoB;QACpB,IAAI,CAAC,OAAO,CAAC;YACX,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,GAAG;YACX,WAAW,EAAE,iCAAiC;YAC9C,IAAI,EAAE;gBACJ,QAAQ;gBACR,qBAAqB,EAAE,CAAC,MAAM,CAAC;gBAC/B,gBAAgB,EAAE,eAAe;gBACjC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;aACrC;SACF,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AA9CO;IADL,KAAK,CAAC,YAAY,CAAC;;;;kDAcnB;AAE2B;IAA3B,KAAK,CAAC,aAAa,CAAC;;;;mDA8BpB;AAnDkB,gBAAgB;IAVpC,IAAA,aAAI,EAAC;QACJ,IAAI;QACJ,IAAI;QACJ,WAAW;QACX,YAAY;QACZ,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE;YACV,MAAM,EAAE,KAAK;SACd;KACF,CAAC;GACmB,gBAAgB,CAoDpC;kBApDoB,gBAAgB","sourcesContent":["// auth/flows/well-known.prm.flow.ts\nimport 'reflect-metadata';\nimport {z} from 'zod';\nimport {\n  Flow,\n  FlowBase, FlowPlan,\n  FlowRunOptions,\n  httpInputSchema,\n  HttpJsonSchema,\n  ScopeEntry,\n  ServerRequest,\n  StageHookOf,\n} from '../../common';\nimport {computeResource, getRequestBaseUrl, makeWellKnownPaths} from '../path.utils';\n\nconst inputSchema = httpInputSchema;\n\nconst stateSchema = z.object({\n  resource: z.string().min(1),\n  baseUrl: z.string().min(1),\n  scopesSupported: z.array(z.string()).default(['openid', 'profile', 'email']),\n  isOrchestrated: z.boolean(),\n});\n\nconst outputSchema = HttpJsonSchema.extend({\n  body: z\n    .object({\n      resource: z.string().min(1),\n      authorization_servers: z.array(z.string().min(1)).min(1),\n      scopes_supported: z.array(z.string()).default(['openid', 'profile', 'email']),\n      bearer_methods_supported: z.array(z.string()).default(['header']),\n    })\n    .passthrough(),\n});\n\nconst plan = {\n  pre: ['parseInput'],\n  execute: ['collectData'],\n  post: ['validateOutput'],\n} as const satisfies FlowPlan<string>;\n\ndeclare global {\n  interface ExtendFlows {\n    'well-known.oauth-protected-resource': FlowRunOptions<\n      WellKnownPrmFlow,\n      typeof plan,\n      typeof inputSchema,\n      typeof outputSchema,\n      typeof stateSchema\n    >;\n  }\n}\n\nconst name = 'well-known.oauth-protected-resource' as const;\nconst Stage = StageHookOf(name);\n\n@Flow({\n  name,\n  plan,\n  inputSchema,\n  outputSchema,\n  access: 'public',\n  middleware: {\n    method: 'GET',\n  },\n})\nexport default class WellKnownPrmFlow extends FlowBase<typeof name> {\n  static canActivate(request: ServerRequest, scope: ScopeEntry) {\n    return makeWellKnownPaths('oauth-protected-resource', scope.entryPath, scope.routeBase).has(request.path);\n  }\n\n  @Stage('parseInput')\n  async parseInput() {\n    const {request} = this.rawInput;\n    const scope = this.scope;\n    if (!request) throw new Error('Request is undefined');\n\n    const resource = computeResource(request, scope.entryPath, scope.routeBase);\n    const baseUrl = getRequestBaseUrl(request, scope.entryPath);\n    this.state.set(stateSchema.parse({\n      resource,\n      baseUrl,\n      scopesSupported: ['openid', 'profile', 'email'],\n      isOrchestrated: false,//scope.orchestrated,// TODO: fix\n    }));\n  }\n\n  @Stage('collectData') async collectData() {\n    const {resource, baseUrl, scopesSupported, isOrchestrated} = this.state.required;\n\n    if (isOrchestrated) {\n      this.respond({\n        kind: 'json',\n        contentType: 'application/json; charset=utf-8',\n        status: 200,\n        body: {\n          resource,\n          authorization_servers: [baseUrl],\n          scopes_supported: scopesSupported,\n          bearer_methods_supported: ['header'],\n        },\n      });\n      return;\n    }\n    const issuer = this.scope.auth.issuer;\n    // Transparent scope\n    this.respond({\n      kind: 'json',\n      status: 200,\n      contentType: 'application/json; charset=utf-8',\n      body: {\n        resource,\n        authorization_servers: [issuer],\n        scopes_supported: scopesSupported,\n        bearer_methods_supported: ['header'],\n      },\n    });\n  }\n}\n"]}
+{"version":3,"file":"well-known.prm.flow.js","sourceRoot":"","sources":["../../../../src/auth/flows/well-known.prm.flow.ts"],"names":[],"mappings":";;;AAAA,oCAAoC;AACpC,4BAA0B;AAC1B,6BAAwB;AACxB,yCAasB;AAEtB,MAAM,WAAW,GAAG,wBAAe,CAAC;AAEpC,MAAM,WAAW,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3B,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,eAAe,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC5E,cAAc,EAAE,OAAC,CAAC,OAAO,EAAE;CAC5B,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,uBAAc,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,OAAC;SACJ,MAAM,CAAC;QACN,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,qBAAqB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACxD,gBAAgB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAC7E,wBAAwB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC;KAClE,CAAC;SACD,WAAW,EAAE;CACjB,CAAC,CAAC;AAEH,MAAM,IAAI,GAAG;IACX,GAAG,EAAE,CAAC,YAAY,CAAC;IACnB,OAAO,EAAE,CAAC,aAAa,CAAC;IACxB,IAAI,EAAE,CAAC,gBAAgB,CAAC;CACW,CAAC;AActC,MAAM,IAAI,GAAG,qCAA8C,CAAC;AAC5D,MAAM,KAAK,GAAG,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;AAYjB,IAAM,gBAAgB,GAAtB,MAAM,gBAAiB,SAAQ,iBAAqB;IACjE,MAAM,CAAC,WAAW,CAAC,OAAsB,EAAE,KAAiB;QAC1D,OAAO,IAAA,2BAAkB,EAAC,0BAA0B,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5G,CAAC;IAGK,AAAN,KAAK,CAAC,UAAU;QACd,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAClC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAEtD,MAAM,QAAQ,GAAG,IAAA,wBAAe,EAAC,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG,IAAA,0BAAiB,EAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK,CAAC,GAAG,CACZ,WAAW,CAAC,KAAK,CAAC;YAChB,QAAQ;YACR,OAAO;YACP,eAAe,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;YAC/C,cAAc,EAAE,KAAK,EAAE,iCAAiC;SACzD,CAAC,CACH,CAAC;IACJ,CAAC;IAE2B,AAAN,KAAK,CAAC,WAAW;QACrC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAEnF,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,OAAO,CAAC;gBACX,IAAI,EAAE,MAAM;gBACZ,WAAW,EAAE,iCAAiC;gBAC9C,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE;oBACJ,QAAQ;oBACR,qBAAqB,EAAE,CAAC,OAAO,CAAC;oBAChC,gBAAgB,EAAE,eAAe;oBACjC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;iBACrC;aACF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;QACtC,oBAAoB;QACpB,IAAI,CAAC,OAAO,CAAC;YACX,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,GAAG;YACX,WAAW,EAAE,iCAAiC;YAC9C,IAAI,EAAE;gBACJ,QAAQ;gBACR,qBAAqB,EAAE,CAAC,MAAM,CAAC;gBAC/B,gBAAgB,EAAE,eAAe;gBACjC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;aACrC;SACF,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAhDO;IADL,KAAK,CAAC,YAAY,CAAC;;;;kDAgBnB;AAE2B;IAA3B,KAAK,CAAC,aAAa,CAAC;;;;mDA8BpB;AArDkB,gBAAgB;IAVpC,IAAA,aAAI,EAAC;QACJ,IAAI;QACJ,IAAI;QACJ,WAAW;QACX,YAAY;QACZ,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE;YACV,MAAM,EAAE,KAAK;SACd;KACF,CAAC;GACmB,gBAAgB,CAsDpC;kBAtDoB,gBAAgB","sourcesContent":["// auth/flows/well-known.prm.flow.ts\nimport 'reflect-metadata';\nimport { z } from 'zod';\nimport {\n  Flow,\n  FlowBase,\n  FlowPlan,\n  FlowRunOptions,\n  httpInputSchema,\n  HttpJsonSchema,\n  ScopeEntry,\n  ServerRequest,\n  StageHookOf,\n  computeResource,\n  getRequestBaseUrl,\n  makeWellKnownPaths,\n} from '../../common';\n\nconst inputSchema = httpInputSchema;\n\nconst stateSchema = z.object({\n  resource: z.string().min(1),\n  baseUrl: z.string().min(1),\n  scopesSupported: z.array(z.string()).default(['openid', 'profile', 'email']),\n  isOrchestrated: z.boolean(),\n});\n\nconst outputSchema = HttpJsonSchema.extend({\n  body: z\n    .object({\n      resource: z.string().min(1),\n      authorization_servers: z.array(z.string().min(1)).min(1),\n      scopes_supported: z.array(z.string()).default(['openid', 'profile', 'email']),\n      bearer_methods_supported: z.array(z.string()).default(['header']),\n    })\n    .passthrough(),\n});\n\nconst plan = {\n  pre: ['parseInput'],\n  execute: ['collectData'],\n  post: ['validateOutput'],\n} as const satisfies FlowPlan<string>;\n\ndeclare global {\n  interface ExtendFlows {\n    'well-known.oauth-protected-resource': FlowRunOptions<\n      WellKnownPrmFlow,\n      typeof plan,\n      typeof inputSchema,\n      typeof outputSchema,\n      typeof stateSchema\n    >;\n  }\n}\n\nconst name = 'well-known.oauth-protected-resource' as const;\nconst Stage = StageHookOf(name);\n\n@Flow({\n  name,\n  plan,\n  inputSchema,\n  outputSchema,\n  access: 'public',\n  middleware: {\n    method: 'GET',\n  },\n})\nexport default class WellKnownPrmFlow extends FlowBase<typeof name> {\n  static canActivate(request: ServerRequest, scope: ScopeEntry) {\n    return makeWellKnownPaths('oauth-protected-resource', scope.entryPath, scope.routeBase).has(request.path);\n  }\n\n  @Stage('parseInput')\n  async parseInput() {\n    const { request } = this.rawInput;\n    const scope = this.scope;\n    if (!request) throw new Error('Request is undefined');\n\n    const resource = computeResource(request, scope.entryPath, scope.routeBase);\n    const baseUrl = getRequestBaseUrl(request, scope.entryPath);\n    this.state.set(\n      stateSchema.parse({\n        resource,\n        baseUrl,\n        scopesSupported: ['openid', 'profile', 'email'],\n        isOrchestrated: false, //scope.orchestrated,// TODO: fix\n      }),\n    );\n  }\n\n  @Stage('collectData') async collectData() {\n    const { resource, baseUrl, scopesSupported, isOrchestrated } = this.state.required;\n\n    if (isOrchestrated) {\n      this.respond({\n        kind: 'json',\n        contentType: 'application/json; charset=utf-8',\n        status: 200,\n        body: {\n          resource,\n          authorization_servers: [baseUrl],\n          scopes_supported: scopesSupported,\n          bearer_methods_supported: ['header'],\n        },\n      });\n      return;\n    }\n    const issuer = this.scope.auth.issuer;\n    // Transparent scope\n    this.respond({\n      kind: 'json',\n      status: 200,\n      contentType: 'application/json; charset=utf-8',\n      body: {\n        resource,\n        authorization_servers: [issuer],\n        scopes_supported: scopesSupported,\n        bearer_methods_supported: ['header'],\n      },\n    });\n  }\n}\n"]}