@happyvertical/auth 0.80.0 → 0.80.2

package/dist/chunks/github-uNnnVjFZ.js

@@ -0,0 +1,311 @@
+import { S as ProviderError, a as ConfigurationError, b as NetworkError, c as InvalidClientError, t as AccessDeniedError, u as InvalidGrantError, v as InvalidTokenError, x as NotImplementedError } from "./errors-RgVH84_1.js";
+//#region src/shared/providers/github.ts
+/**
+* GitHub Provider - OAuth2 Authentication
+*
+* Implements OAuth2 authentication with GitHub.
+* Note: GitHub does NOT support full OIDC (no id_token).
+* User info must be fetched via GitHub API.
+*/
+/**
+* Generate a random string for state.
+*/
+function generateRandomString(length = 32) {
+	const array = new Uint8Array(length);
+	crypto.getRandomValues(array);
+	return Array.from(array, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+/**
+* GitHub authentication provider.
+*
+* Implements OAuth2 authentication with GitHub.
+* Key differences from OIDC providers:
+* - No ID token - user info fetched via API
+* - No JWKS - tokens are opaque
+* - No token introspection endpoint
+*/
+var GitHubProvider = class GitHubProvider {
+	options;
+	static AUTHORIZATION_URL = "https://github.com/login/oauth/authorize";
+	static TOKEN_URL = "https://github.com/login/oauth/access_token";
+	static API_URL = "https://api.github.com";
+	constructor(options) {
+		if (!options.clientId) throw new ConfigurationError("clientId is required", "github");
+		if (!options.clientSecret) throw new ConfigurationError("clientSecret is required", "github");
+		this.options = {
+			scopes: ["user:email", "read:user"],
+			timeout: 3e4,
+			maxRetries: 3,
+			...options
+		};
+	}
+	/**
+	* Make an HTTP request to GitHub API with error handling.
+	*/
+	async request(url, options = {}, token) {
+		const headers = {
+			Accept: "application/json",
+			"User-Agent": "happyvertical-auth",
+			...this.options.headers,
+			...options.headers
+		};
+		if (token) headers.Authorization = `Bearer ${token}`;
+		try {
+			const response = await fetch(url, {
+				...options,
+				headers,
+				signal: AbortSignal.timeout(this.options.timeout || 3e4)
+			});
+			if (!response.ok) {
+				const errorBody = await response.text().catch(() => "");
+				let errorData = {};
+				try {
+					errorData = JSON.parse(errorBody);
+				} catch {}
+				this.handleHttpError(response.status, errorData, errorBody);
+			}
+			const text = await response.text();
+			if (!text) return {};
+			return JSON.parse(text);
+		} catch (error) {
+			if (error instanceof Error && error.name === "TimeoutError") throw new NetworkError("Request timed out", "github", error);
+			if (error instanceof AccessDeniedError || error instanceof InvalidGrantError || error instanceof InvalidClientError || error instanceof ProviderError) throw error;
+			throw new NetworkError(`Network error: ${error instanceof Error ? error.message : "Unknown error"}`, "github", error instanceof Error ? error : void 0);
+		}
+	}
+	/**
+	* Handle HTTP error responses.
+	*/
+	handleHttpError(status, data, rawBody) {
+		const error = data.error;
+		const errorDescription = data.error_description || data.message || rawBody;
+		switch (status) {
+			case 400:
+				if (error === "bad_verification_code") throw new InvalidGrantError("Invalid or expired code", "github");
+				throw new ProviderError(`Bad request: ${errorDescription}`, "github");
+			case 401: throw new InvalidClientError("github");
+			case 403: throw new AccessDeniedError(errorDescription, "github");
+			default: throw new ProviderError(`GitHub error (${status}): ${errorDescription}`, "github");
+		}
+	}
+	/**
+	* Fetch user info from GitHub API.
+	*/
+	async fetchUser(token) {
+		return this.request(`${GitHubProvider.API_URL}/user`, { method: "GET" }, token);
+	}
+	/**
+	* Fetch user emails from GitHub API.
+	*/
+	async fetchEmails(token) {
+		return this.request(`${GitHubProvider.API_URL}/user/emails`, { method: "GET" }, token);
+	}
+	/**
+	* Get the primary verified email for a user.
+	*/
+	async getPrimaryEmail(token) {
+		try {
+			return (await this.fetchEmails(token)).find((e) => e.primary && e.verified)?.email;
+		} catch {
+			return;
+		}
+	}
+	async getAuthorizationUrl(options) {
+		const state = options?.state || generateRandomString();
+		const scopes = options?.scopes || this.options.scopes || ["user:email", "read:user"];
+		const redirectUri = options?.redirectUri || this.options.redirectUri;
+		if (!redirectUri) throw new ConfigurationError("redirectUri is required", "github");
+		const params = new URLSearchParams({
+			client_id: this.options.clientId,
+			redirect_uri: redirectUri,
+			scope: scopes.join(" "),
+			state
+		});
+		if (options?.loginHint) params.set("login", options.loginHint);
+		const nonce = options?.nonce || generateRandomString();
+		if (options?.extraParams) for (const [key, value] of Object.entries(options.extraParams)) params.set(key, value);
+		return {
+			url: `${GitHubProvider.AUTHORIZATION_URL}?${params.toString()}`,
+			state,
+			nonce,
+			codeVerifier: void 0
+		};
+	}
+	async exchangeCode(params) {
+		const redirectUri = params.redirectUri || this.options.redirectUri;
+		const body = new URLSearchParams({
+			client_id: this.options.clientId,
+			client_secret: this.options.clientSecret,
+			code: params.code
+		});
+		if (redirectUri) body.set("redirect_uri", redirectUri);
+		const data = await (await fetch(GitHubProvider.TOKEN_URL, {
+			method: "POST",
+			headers: {
+				Accept: "application/json",
+				"Content-Type": "application/x-www-form-urlencoded"
+			},
+			body: body.toString(),
+			signal: AbortSignal.timeout(this.options.timeout || 3e4)
+		})).json();
+		if (data.error) {
+			if (data.error === "bad_verification_code") throw new InvalidGrantError(data.error_description || "Invalid or expired code", "github");
+			throw new ProviderError(data.error_description || data.error, "github");
+		}
+		if (!data.access_token) throw new ProviderError("No access token received", "github");
+		const user = await this.fetchUser(data.access_token);
+		return {
+			accessToken: data.access_token,
+			tokenType: data.token_type || "Bearer",
+			expiresIn: 0,
+			scope: data.scope,
+			userId: user.id.toString()
+		};
+	}
+	async authenticate(_credentials) {
+		throw new NotImplementedError("authenticate", "github", { reason: "GitHub only supports authorization code flow. Use getAuthorizationUrl() and exchangeCode() instead." });
+	}
+	async refresh(_refreshToken) {
+		throw new NotImplementedError("refresh", "github", { reason: "GitHub OAuth tokens do not expire and cannot be refreshed. For expiring tokens, use GitHub Apps instead." });
+	}
+	async logout(options) {
+		if (options?.token) try {
+			await fetch(`${GitHubProvider.API_URL}/applications/${this.options.clientId}/token`, {
+				method: "DELETE",
+				headers: {
+					Accept: "application/json",
+					Authorization: `Basic ${btoa(`${this.options.clientId}:${this.options.clientSecret}`)}`,
+					"Content-Type": "application/json"
+				},
+				body: JSON.stringify({ access_token: options.token })
+			});
+		} catch {}
+	}
+	async validateToken(token, _options) {
+		try {
+			const user = await this.fetchUser(token);
+			const email = await this.getPrimaryEmail(token);
+			return {
+				sub: user.id.toString(),
+				iss: "https://github.com",
+				aud: this.options.clientId,
+				exp: 0,
+				iat: Math.floor(Date.now() / 1e3),
+				email,
+				email_verified: email ? true : void 0,
+				preferred_username: user.login,
+				name: user.name || void 0,
+				picture: user.avatar_url,
+				login: user.login,
+				html_url: user.html_url,
+				company: user.company,
+				location: user.location,
+				bio: user.bio
+			};
+		} catch {
+			return null;
+		}
+	}
+	decodeToken(_token) {
+		throw new InvalidTokenError("GitHub tokens are opaque and cannot be decoded", "github");
+	}
+	async introspectToken(token) {
+		const claims = await this.validateToken(token);
+		return {
+			active: claims !== null,
+			claims: claims || void 0
+		};
+	}
+	async getProfile(tokenOrSession) {
+		const user = await this.fetchUser(tokenOrSession);
+		const email = await this.getPrimaryEmail(tokenOrSession);
+		return {
+			id: user.id.toString(),
+			username: user.login,
+			email,
+			emailVerified: email ? true : void 0,
+			displayName: user.name || user.login,
+			picture: user.avatar_url,
+			attributes: {
+				html_url: user.html_url,
+				company: user.company || "",
+				blog: user.blog || "",
+				location: user.location || "",
+				bio: user.bio || "",
+				twitter_username: user.twitter_username || ""
+			}
+		};
+	}
+	async updateProfile(_tokenOrSession, _profile) {
+		throw new NotImplementedError("updateProfile", "github", { reason: "GitHub does not support profile updates via OAuth2" });
+	}
+	async getUser(_userId, _adminToken) {
+		throw new NotImplementedError("getUser", "github", { reason: "GitHub does not expose admin user management" });
+	}
+	async createUser(_user, _adminToken) {
+		throw new NotImplementedError("createUser", "github", { reason: "GitHub does not expose user creation" });
+	}
+	async updateUser(_userId, _updates, _adminToken) {
+		throw new NotImplementedError("updateUser", "github", { reason: "GitHub does not expose user management" });
+	}
+	async deleteUser(_userId, _adminToken) {
+		throw new NotImplementedError("deleteUser", "github", { reason: "GitHub does not expose user management" });
+	}
+	async listUsers(_query, _adminToken) {
+		throw new NotImplementedError("listUsers", "github", { reason: "GitHub does not expose user listing" });
+	}
+	async requestPasswordReset(_email) {
+		throw new NotImplementedError("requestPasswordReset", "github", { reason: "Password management is handled by GitHub" });
+	}
+	async resetPassword(_token, _newPassword) {
+		throw new NotImplementedError("resetPassword", "github", { reason: "Password management is handled by GitHub" });
+	}
+	async listSessions(_userId, _adminToken) {
+		throw new NotImplementedError("listSessions", "github", { reason: "Session management is handled by GitHub" });
+	}
+	async revokeSession(_sessionId, _adminToken) {
+		throw new NotImplementedError("revokeSession", "github", { reason: "Session management is handled by GitHub" });
+	}
+	async revokeAllSessions(_userId, _adminToken) {
+		throw new NotImplementedError("revokeAllSessions", "github", { reason: "Session management is handled by GitHub" });
+	}
+	async hasRole(_tokenOrUserId, _role) {
+		return false;
+	}
+	async hasPermission(_tokenOrUserId, _permission, _resource) {
+		return false;
+	}
+	async getRoles(_tokenOrUserId, _adminToken) {
+		return [];
+	}
+	async assignRole(_userId, _role, _adminToken) {
+		throw new NotImplementedError("assignRole", "github", { reason: "GitHub does not support role management" });
+	}
+	async removeRole(_userId, _role, _adminToken) {
+		throw new NotImplementedError("removeRole", "github", { reason: "GitHub does not support role management" });
+	}
+	async getCapabilities() {
+		return {
+			authorizationCode: true,
+			passwordGrant: false,
+			clientCredentials: false,
+			tokenRefresh: false,
+			oidc: false,
+			userManagement: false,
+			sessionManagement: false,
+			rbac: false,
+			passwordReset: false,
+			mfa: true,
+			socialLogin: true,
+			federation: false,
+			decentralized: false
+		};
+	}
+	async getDiscoveryDocument() {
+		return null;
+	}
+};
+//#endregion
+export { GitHubProvider };
+
+//# sourceMappingURL=github-uNnnVjFZ.js.map

package/dist/chunks/github-uNnnVjFZ.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-uNnnVjFZ.js","names":[],"sources":["../../src/shared/providers/github.ts"],"sourcesContent":["/**\n * GitHub Provider - OAuth2 Authentication\n *\n * Implements OAuth2 authentication with GitHub.\n * Note: GitHub does NOT support full OIDC (no id_token).\n * User info must be fetched via GitHub API.\n */\n\nimport {\n  AccessDeniedError,\n  ConfigurationError,\n  InvalidClientError,\n  InvalidGrantError,\n  InvalidTokenError,\n  NetworkError,\n  NotImplementedError,\n  ProviderError,\n} from '../errors.js';\nimport type {\n  AuthCapabilities,\n  AuthCredentials,\n  AuthInterface,\n  AuthorizationOptions,\n  AuthorizationResult,\n  AuthResult,\n  CodeExchangeParams,\n  CreateUserRequest,\n  GitHubOptions,\n  LogoutOptions,\n  OIDCDiscoveryDocument,\n  Session,\n  TokenClaims,\n  TokenIntrospection,\n  TokenPayload,\n  TokenValidationOptions,\n  UserListResult,\n  UserProfile,\n  UserQuery,\n} from '../types.js';\n\n/**\n * Generate a random string for state.\n */\nfunction generateRandomString(length = 32): string {\n  const array = new Uint8Array(length);\n  crypto.getRandomValues(array);\n  return Array.from(array, (byte) => byte.toString(16).padStart(2, '0')).join(\n    '',\n  );\n}\n\n/**\n * GitHub user response from API.\n */\ninterface GitHubUser {\n  id: number;\n  login: string;\n  name: string | null;\n  email: string | null;\n  avatar_url: string;\n  html_url: string;\n  company: string | null;\n  blog: string | null;\n  location: string | null;\n  bio: string | null;\n  twitter_username: string | null;\n  created_at: string;\n  updated_at: string;\n}\n\n/**\n * GitHub email response from API.\n */\ninterface GitHubEmail {\n  email: string;\n  primary: boolean;\n  verified: boolean;\n  visibility: string | null;\n}\n\n/**\n * GitHub authentication provider.\n *\n * Implements OAuth2 authentication with GitHub.\n * Key differences from OIDC providers:\n * - No ID token - user info fetched via API\n * - No JWKS - tokens are opaque\n * - No token introspection endpoint\n */\nexport class GitHubProvider implements AuthInterface {\n  private options: Required<Pick<GitHubOptions, 'clientId'>> & GitHubOptions;\n\n  private static readonly AUTHORIZATION_URL =\n    'https://github.com/login/oauth/authorize';\n  private static readonly TOKEN_URL =\n    'https://github.com/login/oauth/access_token';\n  private static readonly API_URL = 'https://api.github.com';\n\n  constructor(options: GitHubOptions) {\n    if (!options.clientId) {\n      throw new ConfigurationError('clientId is required', 'github');\n    }\n    if (!options.clientSecret) {\n      throw new ConfigurationError('clientSecret is required', 'github');\n    }\n\n    this.options = {\n      scopes: ['user:email', 'read:user'],\n      timeout: 30000,\n      maxRetries: 3,\n      ...options,\n    };\n  }\n\n  // ---------------------------------------------------------------------------\n  // INTERNAL HELPERS\n  // ---------------------------------------------------------------------------\n\n  /**\n   * Make an HTTP request to GitHub API with error handling.\n   */\n  private async request<T>(\n    url: string,\n    options: RequestInit = {},\n    token?: string,\n  ): Promise<T> {\n    const headers: Record<string, string> = {\n      Accept: 'application/json',\n      'User-Agent': 'happyvertical-auth',\n      ...this.options.headers,\n      ...(options.headers as Record<string, string>),\n    };\n\n    if (token) {\n      headers.Authorization = `Bearer ${token}`;\n    }\n\n    try {\n      const response = await fetch(url, {\n        ...options,\n        headers,\n        signal: AbortSignal.timeout(this.options.timeout || 30000),\n      });\n\n      if (!response.ok) {\n        const errorBody = await response.text().catch(() => '');\n        let errorData: Record<string, unknown> = {};\n        try {\n          errorData = JSON.parse(errorBody);\n        } catch {\n          // Not JSON\n        }\n\n        this.handleHttpError(response.status, errorData, errorBody);\n      }\n\n      const text = await response.text();\n      if (!text) return {} as T;\n      return JSON.parse(text) as T;\n    } catch (error) {\n      if (error instanceof Error && error.name === 'TimeoutError') {\n        throw new NetworkError('Request timed out', 'github', error);\n      }\n      if (\n        error instanceof AccessDeniedError ||\n        error instanceof InvalidGrantError ||\n        error instanceof InvalidClientError ||\n        error instanceof ProviderError\n      ) {\n        throw error;\n      }\n      throw new NetworkError(\n        `Network error: ${error instanceof Error ? error.message : 'Unknown error'}`,\n        'github',\n        error instanceof Error ? error : undefined,\n      );\n    }\n  }\n\n  /**\n   * Handle HTTP error responses.\n   */\n  private handleHttpError(\n    status: number,\n    data: Record<string, unknown>,\n    rawBody: string,\n  ): never {\n    const error = data.error as string | undefined;\n    const errorDescription = data.error_description || data.message || rawBody;\n\n    switch (status) {\n      case 400:\n        if (error === 'bad_verification_code') {\n          throw new InvalidGrantError('Invalid or expired code', 'github');\n        }\n        throw new ProviderError(`Bad request: ${errorDescription}`, 'github');\n\n      case 401:\n        throw new InvalidClientError('github');\n\n      case 403:\n        throw new AccessDeniedError(errorDescription as string, 'github');\n\n      default:\n        throw new ProviderError(\n          `GitHub error (${status}): ${errorDescription}`,\n          'github',\n        );\n    }\n  }\n\n  /**\n   * Fetch user info from GitHub API.\n   */\n  private async fetchUser(token: string): Promise<GitHubUser> {\n    return this.request<GitHubUser>(\n      `${GitHubProvider.API_URL}/user`,\n      { method: 'GET' },\n      token,\n    );\n  }\n\n  /**\n   * Fetch user emails from GitHub API.\n   */\n  private async fetchEmails(token: string): Promise<GitHubEmail[]> {\n    return this.request<GitHubEmail[]>(\n      `${GitHubProvider.API_URL}/user/emails`,\n      { method: 'GET' },\n      token,\n    );\n  }\n\n  /**\n   * Get the primary verified email for a user.\n   */\n  private async getPrimaryEmail(token: string): Promise<string | undefined> {\n    try {\n      const emails = await this.fetchEmails(token);\n      const primary = emails.find((e) => e.primary && e.verified);\n      return primary?.email;\n    } catch {\n      // Email scope may not be granted\n      return undefined;\n    }\n  }\n\n  // ---------------------------------------------------------------------------\n  // AUTHENTICATION FLOWS\n  // ---------------------------------------------------------------------------\n\n  async getAuthorizationUrl(\n    options?: AuthorizationOptions,\n  ): Promise<AuthorizationResult> {\n    const state = options?.state || generateRandomString();\n    const scopes = options?.scopes ||\n      this.options.scopes || ['user:email', 'read:user'];\n    const redirectUri = options?.redirectUri || this.options.redirectUri;\n\n    if (!redirectUri) {\n      throw new ConfigurationError('redirectUri is required', 'github');\n    }\n\n    const params = new URLSearchParams({\n      client_id: this.options.clientId,\n      redirect_uri: redirectUri,\n      scope: scopes.join(' '),\n      state,\n    });\n\n    if (options?.loginHint) {\n      params.set('login', options.loginHint);\n    }\n\n    // GitHub doesn't support PKCE for OAuth apps (only GitHub Apps)\n    // But we can still pass nonce for state management\n    const nonce = options?.nonce || generateRandomString();\n\n    // Add extra params\n    if (options?.extraParams) {\n      for (const [key, value] of Object.entries(options.extraParams)) {\n        params.set(key, value);\n      }\n    }\n\n    const url = `${GitHubProvider.AUTHORIZATION_URL}?${params.toString()}`;\n\n    return {\n      url,\n      state,\n      nonce,\n      // GitHub OAuth doesn't use PKCE\n      codeVerifier: undefined,\n    };\n  }\n\n  async exchangeCode(params: CodeExchangeParams): Promise<AuthResult> {\n    const redirectUri = params.redirectUri || this.options.redirectUri;\n\n    const body = new URLSearchParams({\n      client_id: this.options.clientId,\n      client_secret: this.options.clientSecret!,\n      code: params.code,\n    });\n\n    if (redirectUri) {\n      body.set('redirect_uri', redirectUri);\n    }\n\n    // GitHub token endpoint requires Accept: application/json\n    const response = await fetch(GitHubProvider.TOKEN_URL, {\n      method: 'POST',\n      headers: {\n        Accept: 'application/json',\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: body.toString(),\n      signal: AbortSignal.timeout(this.options.timeout || 30000),\n    });\n\n    const data = (await response.json()) as {\n      access_token?: string;\n      token_type?: string;\n      scope?: string;\n      error?: string;\n      error_description?: string;\n    };\n\n    if (data.error) {\n      if (data.error === 'bad_verification_code') {\n        throw new InvalidGrantError(\n          data.error_description || 'Invalid or expired code',\n          'github',\n        );\n      }\n      throw new ProviderError(data.error_description || data.error, 'github');\n    }\n\n    if (!data.access_token) {\n      throw new ProviderError('No access token received', 'github');\n    }\n\n    // Fetch user info to get user ID\n    const user = await this.fetchUser(data.access_token);\n\n    return {\n      accessToken: data.access_token,\n      tokenType: data.token_type || 'Bearer',\n      expiresIn: 0, // GitHub tokens don't expire by default\n      scope: data.scope,\n      userId: user.id.toString(),\n      // GitHub doesn't return refresh tokens or ID tokens\n    };\n  }\n\n  async authenticate(_credentials: AuthCredentials): Promise<AuthResult> {\n    throw new NotImplementedError('authenticate', 'github', {\n      reason:\n        'GitHub only supports authorization code flow. Use getAuthorizationUrl() and exchangeCode() instead.',\n    });\n  }\n\n  async refresh(_refreshToken: string): Promise<AuthResult> {\n    throw new NotImplementedError('refresh', 'github', {\n      reason:\n        'GitHub OAuth tokens do not expire and cannot be refreshed. For expiring tokens, use GitHub Apps instead.',\n    });\n  }\n\n  async logout(options?: LogoutOptions): Promise<void> {\n    // GitHub doesn't have a token revocation endpoint for OAuth apps\n    // The user must revoke access via GitHub settings\n    if (options?.token) {\n      // Best effort: try to revoke via GitHub Apps API (won't work for OAuth apps)\n      try {\n        await fetch(\n          `${GitHubProvider.API_URL}/applications/${this.options.clientId}/token`,\n          {\n            method: 'DELETE',\n            headers: {\n              Accept: 'application/json',\n              Authorization: `Basic ${btoa(`${this.options.clientId}:${this.options.clientSecret}`)}`,\n              'Content-Type': 'application/json',\n            },\n            body: JSON.stringify({ access_token: options.token }),\n          },\n        );\n      } catch {\n        // Ignore - revocation may not be supported\n      }\n    }\n  }\n\n  // ---------------------------------------------------------------------------\n  // TOKEN OPERATIONS\n  // ---------------------------------------------------------------------------\n\n  async validateToken(\n    token: string,\n    _options?: TokenValidationOptions,\n  ): Promise<TokenClaims | null> {\n    // GitHub tokens are opaque - validate by calling the API\n    try {\n      const user = await this.fetchUser(token);\n      const email = await this.getPrimaryEmail(token);\n\n      // Synthesize OIDC-like claims from GitHub user data\n      return {\n        sub: user.id.toString(),\n        iss: 'https://github.com',\n        aud: this.options.clientId,\n        exp: 0, // GitHub tokens don't expire\n        iat: Math.floor(Date.now() / 1000),\n        email,\n        email_verified: email ? true : undefined,\n        preferred_username: user.login,\n        name: user.name || undefined,\n        picture: user.avatar_url,\n        // GitHub-specific claims\n        login: user.login,\n        html_url: user.html_url,\n        company: user.company,\n        location: user.location,\n        bio: user.bio,\n      };\n    } catch {\n      return null;\n    }\n  }\n\n  decodeToken(_token: string): TokenPayload {\n    // GitHub tokens are opaque, not JWTs\n    throw new InvalidTokenError(\n      'GitHub tokens are opaque and cannot be decoded',\n      'github',\n    );\n  }\n\n  async introspectToken(token: string): Promise<TokenIntrospection> {\n    const claims = await this.validateToken(token);\n    return {\n      active: claims !== null,\n      claims: claims || undefined,\n    };\n  }\n\n  // ---------------------------------------------------------------------------\n  // USER OPERATIONS\n  // ---------------------------------------------------------------------------\n\n  async getProfile(tokenOrSession: string): Promise<UserProfile> {\n    const user = await this.fetchUser(tokenOrSession);\n    const email = await this.getPrimaryEmail(tokenOrSession);\n\n    return {\n      id: user.id.toString(),\n      username: user.login,\n      email,\n      emailVerified: email ? true : undefined,\n      displayName: user.name || user.login,\n      picture: user.avatar_url,\n      attributes: {\n        html_url: user.html_url,\n        company: user.company || '',\n        blog: user.blog || '',\n        location: user.location || '',\n        bio: user.bio || '',\n        twitter_username: user.twitter_username || '',\n      },\n    };\n  }\n\n  async updateProfile(\n    _tokenOrSession: string,\n    _profile: Partial<UserProfile>,\n  ): Promise<UserProfile> {\n    throw new NotImplementedError('updateProfile', 'github', {\n      reason: 'GitHub does not support profile updates via OAuth2',\n    });\n  }\n\n  async getUser(_userId: string, _adminToken?: string): Promise<UserProfile> {\n    throw new NotImplementedError('getUser', 'github', {\n      reason: 'GitHub does not expose admin user management',\n    });\n  }\n\n  async createUser(\n    _user: CreateUserRequest,\n    _adminToken: string,\n  ): Promise<UserProfile> {\n    throw new NotImplementedError('createUser', 'github', {\n      reason: 'GitHub does not expose user creation',\n    });\n  }\n\n  async updateUser(\n    _userId: string,\n    _updates: Partial<CreateUserRequest>,\n    _adminToken: string,\n  ): Promise<UserProfile> {\n    throw new NotImplementedError('updateUser', 'github', {\n      reason: 'GitHub does not expose user management',\n    });\n  }\n\n  async deleteUser(_userId: string, _adminToken: string): Promise<void> {\n    throw new NotImplementedError('deleteUser', 'github', {\n      reason: 'GitHub does not expose user management',\n    });\n  }\n\n  async listUsers(\n    _query: UserQuery,\n    _adminToken?: string,\n  ): Promise<UserListResult> {\n    throw new NotImplementedError('listUsers', 'github', {\n      reason: 'GitHub does not expose user listing',\n    });\n  }\n\n  async requestPasswordReset(_email: string): Promise<void> {\n    throw new NotImplementedError('requestPasswordReset', 'github', {\n      reason: 'Password management is handled by GitHub',\n    });\n  }\n\n  async resetPassword(_token: string, _newPassword: string): Promise<void> {\n    throw new NotImplementedError('resetPassword', 'github', {\n      reason: 'Password management is handled by GitHub',\n    });\n  }\n\n  // ---------------------------------------------------------------------------\n  // SESSION OPERATIONS\n  // ---------------------------------------------------------------------------\n\n  async listSessions(\n    _userId: string,\n    _adminToken?: string,\n  ): Promise<Session[]> {\n    throw new NotImplementedError('listSessions', 'github', {\n      reason: 'Session management is handled by GitHub',\n    });\n  }\n\n  async revokeSession(_sessionId: string, _adminToken?: string): Promise<void> {\n    throw new NotImplementedError('revokeSession', 'github', {\n      reason: 'Session management is handled by GitHub',\n    });\n  }\n\n  async revokeAllSessions(\n    _userId: string,\n    _adminToken?: string,\n  ): Promise<void> {\n    throw new NotImplementedError('revokeAllSessions', 'github', {\n      reason: 'Session management is handled by GitHub',\n    });\n  }\n\n  // ---------------------------------------------------------------------------\n  // AUTHORIZATION\n  // ---------------------------------------------------------------------------\n\n  async hasRole(_tokenOrUserId: string, _role: string): Promise<boolean> {\n    return false;\n  }\n\n  async hasPermission(\n    _tokenOrUserId: string,\n    _permission: string,\n    _resource?: string,\n  ): Promise<boolean> {\n    return false;\n  }\n\n  async getRoles(\n    _tokenOrUserId: string,\n    _adminToken?: string,\n  ): Promise<string[]> {\n    return [];\n  }\n\n  async assignRole(\n    _userId: string,\n    _role: string,\n    _adminToken: string,\n  ): Promise<void> {\n    throw new NotImplementedError('assignRole', 'github', {\n      reason: 'GitHub does not support role management',\n    });\n  }\n\n  async removeRole(\n    _userId: string,\n    _role: string,\n    _adminToken: string,\n  ): Promise<void> {\n    throw new NotImplementedError('removeRole', 'github', {\n      reason: 'GitHub does not support role management',\n    });\n  }\n\n  // ---------------------------------------------------------------------------\n  // PROVIDER INFORMATION\n  // ---------------------------------------------------------------------------\n\n  async getCapabilities(): Promise<AuthCapabilities> {\n    return {\n      authorizationCode: true,\n      passwordGrant: false,\n      clientCredentials: false,\n      tokenRefresh: false, // GitHub OAuth tokens don't expire\n      oidc: false, // GitHub is OAuth2, not OIDC\n      userManagement: false,\n      sessionManagement: false,\n      rbac: false,\n      passwordReset: false,\n      mfa: true, // GitHub supports 2FA\n      socialLogin: true,\n      federation: false,\n      decentralized: false,\n    };\n  }\n\n  async getDiscoveryDocument(): Promise<OIDCDiscoveryDocument | null> {\n    // GitHub doesn't have OIDC discovery\n    return null;\n  }\n}\n"],"mappings":";;;;;;;;;;;;AA2CA,SAAS,qBAAqB,SAAS,IAAY;CACjD,MAAM,QAAQ,IAAI,WAAW,MAAM;CACnC,OAAO,gBAAgB,KAAK;CAC5B,OAAO,MAAM,KAAK,QAAQ,SAAS,KAAK,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KACrE,EACF;AACF;;;;;;;;;;AAwCA,IAAa,iBAAb,MAAa,eAAwC;CACnD;CAEA,OAAwB,oBACtB;CACF,OAAwB,YACtB;CACF,OAAwB,UAAU;CAElC,YAAY,SAAwB;EAClC,IAAI,CAAC,QAAQ,UACX,MAAM,IAAI,mBAAmB,wBAAwB,QAAQ;EAE/D,IAAI,CAAC,QAAQ,cACX,MAAM,IAAI,mBAAmB,4BAA4B,QAAQ;EAGnE,KAAK,UAAU;GACb,QAAQ,CAAC,cAAc,WAAW;GAClC,SAAS;GACT,YAAY;GACZ,GAAG;EACL;CACF;;;;CASA,MAAc,QACZ,KACA,UAAuB,CAAC,GACxB,OACY;EACZ,MAAM,UAAkC;GACtC,QAAQ;GACR,cAAc;GACd,GAAG,KAAK,QAAQ;GAChB,GAAI,QAAQ;EACd;EAEA,IAAI,OACF,QAAQ,gBAAgB,UAAU;EAGpC,IAAI;GACF,MAAM,WAAW,MAAM,MAAM,KAAK;IAChC,GAAG;IACH;IACA,QAAQ,YAAY,QAAQ,KAAK,QAAQ,WAAW,GAAK;GAC3D,CAAC;GAED,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,YAAY,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,EAAE;IACtD,IAAI,YAAqC,CAAC;IAC1C,IAAI;KACF,YAAY,KAAK,MAAM,SAAS;IAClC,QAAQ,CAER;IAEA,KAAK,gBAAgB,SAAS,QAAQ,WAAW,SAAS;GAC5D;GAEA,MAAM,OAAO,MAAM,SAAS,KAAK;GACjC,IAAI,CAAC,MAAM,OAAO,CAAC;GACnB,OAAO,KAAK,MAAM,IAAI;EACxB,SAAS,OAAO;GACd,IAAI,iBAAiB,SAAS,MAAM,SAAS,gBAC3C,MAAM,IAAI,aAAa,qBAAqB,UAAU,KAAK;GAE7D,IACE,iBAAiB,qBACjB,iBAAiB,qBACjB,iBAAiB,sBACjB,iBAAiB,eAEjB,MAAM;GAER,MAAM,IAAI,aACR,kBAAkB,iBAAiB,QAAQ,MAAM,UAAU,mBAC3D,UACA,iBAAiB,QAAQ,QAAQ,KAAA,CACnC;EACF;CACF;;;;CAKA,gBACE,QACA,MACA,SACO;EACP,MAAM,QAAQ,KAAK;EACnB,MAAM,mBAAmB,KAAK,qBAAqB,KAAK,WAAW;EAEnE,QAAQ,QAAR;GACE,KAAK;IACH,IAAI,UAAU,yBACZ,MAAM,IAAI,kBAAkB,2BAA2B,QAAQ;IAEjE,MAAM,IAAI,cAAc,gBAAgB,oBAAoB,QAAQ;GAEtE,KAAK,KACH,MAAM,IAAI,mBAAmB,QAAQ;GAEvC,KAAK,KACH,MAAM,IAAI,kBAAkB,kBAA4B,QAAQ;GAElE,SACE,MAAM,IAAI,cACR,iBAAiB,OAAO,KAAK,oBAC7B,QACF;EACJ;CACF;;;;CAKA,MAAc,UAAU,OAAoC;EAC1D,OAAO,KAAK,QACV,GAAG,eAAe,QAAQ,QAC1B,EAAE,QAAQ,MAAM,GAChB,KACF;CACF;;;;CAKA,MAAc,YAAY,OAAuC;EAC/D,OAAO,KAAK,QACV,GAAG,eAAe,QAAQ,eAC1B,EAAE,QAAQ,MAAM,GAChB,KACF;CACF;;;;CAKA,MAAc,gBAAgB,OAA4C;EACxE,IAAI;GAGF,QADgB,MADK,KAAK,YAAY,KAAK,EAAA,CACpB,MAAM,MAAM,EAAE,WAAW,EAAE,QAC3C,CAAA,EAAS;EAClB,QAAQ;GAEN;EACF;CACF;CAMA,MAAM,oBACJ,SAC8B;EAC9B,MAAM,QAAQ,SAAS,SAAS,qBAAqB;EACrD,MAAM,SAAS,SAAS,UACtB,KAAK,QAAQ,UAAU,CAAC,cAAc,WAAW;EACnD,MAAM,cAAc,SAAS,eAAe,KAAK,QAAQ;EAEzD,IAAI,CAAC,aACH,MAAM,IAAI,mBAAmB,2BAA2B,QAAQ;EAGlE,MAAM,SAAS,IAAI,gBAAgB;GACjC,WAAW,KAAK,QAAQ;GACxB,cAAc;GACd,OAAO,OAAO,KAAK,GAAG;GACtB;EACF,CAAC;EAED,IAAI,SAAS,WACX,OAAO,IAAI,SAAS,QAAQ,SAAS;EAKvC,MAAM,QAAQ,SAAS,SAAS,qBAAqB;EAGrD,IAAI,SAAS,aACX,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,QAAQ,WAAW,GAC3D,OAAO,IAAI,KAAK,KAAK;EAMzB,OAAO;GACL,KAAA,GAHa,eAAe,kBAAkB,GAAG,OAAO,SAAS;GAIjE;GACA;GAEA,cAAc,KAAA;EAChB;CACF;CAEA,MAAM,aAAa,QAAiD;EAClE,MAAM,cAAc,OAAO,eAAe,KAAK,QAAQ;EAEvD,MAAM,OAAO,IAAI,gBAAgB;GAC/B,WAAW,KAAK,QAAQ;GACxB,eAAe,KAAK,QAAQ;GAC5B,MAAM,OAAO;EACf,CAAC;EAED,IAAI,aACF,KAAK,IAAI,gBAAgB,WAAW;EActC,MAAM,OAAQ,OAAM,MAVG,MAAM,eAAe,WAAW;GACrD,QAAQ;GACR,SAAS;IACP,QAAQ;IACR,gBAAgB;GAClB;GACA,MAAM,KAAK,SAAS;GACpB,QAAQ,YAAY,QAAQ,KAAK,QAAQ,WAAW,GAAK;EAC3D,CAAC,EAAA,CAE4B,KAAK;EAQlC,IAAI,KAAK,OAAO;GACd,IAAI,KAAK,UAAU,yBACjB,MAAM,IAAI,kBACR,KAAK,qBAAqB,2BAC1B,QACF;GAEF,MAAM,IAAI,cAAc,KAAK,qBAAqB,KAAK,OAAO,QAAQ;EACxE;EAEA,IAAI,CAAC,KAAK,cACR,MAAM,IAAI,cAAc,4BAA4B,QAAQ;EAI9D,MAAM,OAAO,MAAM,KAAK,UAAU,KAAK,YAAY;EAEnD,OAAO;GACL,aAAa,KAAK;GAClB,WAAW,KAAK,cAAc;GAC9B,WAAW;GACX,OAAO,KAAK;GACZ,QAAQ,KAAK,GAAG,SAAS;EAE3B;CACF;CAEA,MAAM,aAAa,cAAoD;EACrE,MAAM,IAAI,oBAAoB,gBAAgB,UAAU,EACtD,QACE,sGACJ,CAAC;CACH;CAEA,MAAM,QAAQ,eAA4C;EACxD,MAAM,IAAI,oBAAoB,WAAW,UAAU,EACjD,QACE,2GACJ,CAAC;CACH;CAEA,MAAM,OAAO,SAAwC;EAGnD,IAAI,SAAS,OAEX,IAAI;GACF,MAAM,MACJ,GAAG,eAAe,QAAQ,gBAAgB,KAAK,QAAQ,SAAS,SAChE;IACE,QAAQ;IACR,SAAS;KACP,QAAQ;KACR,eAAe,SAAS,KAAK,GAAG,KAAK,QAAQ,SAAS,GAAG,KAAK,QAAQ,cAAc;KACpF,gBAAgB;IAClB;IACA,MAAM,KAAK,UAAU,EAAE,cAAc,QAAQ,MAAM,CAAC;GACtD,CACF;EACF,QAAQ,CAER;CAEJ;CAMA,MAAM,cACJ,OACA,UAC6B;EAE7B,IAAI;GACF,MAAM,OAAO,MAAM,KAAK,UAAU,KAAK;GACvC,MAAM,QAAQ,MAAM,KAAK,gBAAgB,KAAK;GAG9C,OAAO;IACL,KAAK,KAAK,GAAG,SAAS;IACtB,KAAK;IACL,KAAK,KAAK,QAAQ;IAClB,KAAK;IACL,KAAK,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;IACjC;IACA,gBAAgB,QAAQ,OAAO,KAAA;IAC/B,oBAAoB,KAAK;IACzB,MAAM,KAAK,QAAQ,KAAA;IACnB,SAAS,KAAK;IAEd,OAAO,KAAK;IACZ,UAAU,KAAK;IACf,SAAS,KAAK;IACd,UAAU,KAAK;IACf,KAAK,KAAK;GACZ;EACF,QAAQ;GACN,OAAO;EACT;CACF;CAEA,YAAY,QAA8B;EAExC,MAAM,IAAI,kBACR,kDACA,QACF;CACF;CAEA,MAAM,gBAAgB,OAA4C;EAChE,MAAM,SAAS,MAAM,KAAK,cAAc,KAAK;EAC7C,OAAO;GACL,QAAQ,WAAW;GACnB,QAAQ,UAAU,KAAA;EACpB;CACF;CAMA,MAAM,WAAW,gBAA8C;EAC7D,MAAM,OAAO,MAAM,KAAK,UAAU,cAAc;EAChD,MAAM,QAAQ,MAAM,KAAK,gBAAgB,cAAc;EAEvD,OAAO;GACL,IAAI,KAAK,GAAG,SAAS;GACrB,UAAU,KAAK;GACf;GACA,eAAe,QAAQ,OAAO,KAAA;GAC9B,aAAa,KAAK,QAAQ,KAAK;GAC/B,SAAS,KAAK;GACd,YAAY;IACV,UAAU,KAAK;IACf,SAAS,KAAK,WAAW;IACzB,MAAM,KAAK,QAAQ;IACnB,UAAU,KAAK,YAAY;IAC3B,KAAK,KAAK,OAAO;IACjB,kBAAkB,KAAK,oBAAoB;GAC7C;EACF;CACF;CAEA,MAAM,cACJ,iBACA,UACsB;EACtB,MAAM,IAAI,oBAAoB,iBAAiB,UAAU,EACvD,QAAQ,qDACV,CAAC;CACH;CAEA,MAAM,QAAQ,SAAiB,aAA4C;EACzE,MAAM,IAAI,oBAAoB,WAAW,UAAU,EACjD,QAAQ,+CACV,CAAC;CACH;CAEA,MAAM,WACJ,OACA,aACsB;EACtB,MAAM,IAAI,oBAAoB,cAAc,UAAU,EACpD,QAAQ,uCACV,CAAC;CACH;CAEA,MAAM,WACJ,SACA,UACA,aACsB;EACtB,MAAM,IAAI,oBAAoB,cAAc,UAAU,EACpD,QAAQ,yCACV,CAAC;CACH;CAEA,MAAM,WAAW,SAAiB,aAAoC;EACpE,MAAM,IAAI,oBAAoB,cAAc,UAAU,EACpD,QAAQ,yCACV,CAAC;CACH;CAEA,MAAM,UACJ,QACA,aACyB;EACzB,MAAM,IAAI,oBAAoB,aAAa,UAAU,EACnD,QAAQ,sCACV,CAAC;CACH;CAEA,MAAM,qBAAqB,QAA+B;EACxD,MAAM,IAAI,oBAAoB,wBAAwB,UAAU,EAC9D,QAAQ,2CACV,CAAC;CACH;CAEA,MAAM,cAAc,QAAgB,cAAqC;EACvE,MAAM,IAAI,oBAAoB,iBAAiB,UAAU,EACvD,QAAQ,2CACV,CAAC;CACH;CAMA,MAAM,aACJ,SACA,aACoB;EACpB,MAAM,IAAI,oBAAoB,gBAAgB,UAAU,EACtD,QAAQ,0CACV,CAAC;CACH;CAEA,MAAM,cAAc,YAAoB,aAAqC;EAC3E,MAAM,IAAI,oBAAoB,iBAAiB,UAAU,EACvD,QAAQ,0CACV,CAAC;CACH;CAEA,MAAM,kBACJ,SACA,aACe;EACf,MAAM,IAAI,oBAAoB,qBAAqB,UAAU,EAC3D,QAAQ,0CACV,CAAC;CACH;CAMA,MAAM,QAAQ,gBAAwB,OAAiC;EACrE,OAAO;CACT;CAEA,MAAM,cACJ,gBACA,aACA,WACkB;EAClB,OAAO;CACT;CAEA,MAAM,SACJ,gBACA,aACmB;EACnB,OAAO,CAAC;CACV;CAEA,MAAM,WACJ,SACA,OACA,aACe;EACf,MAAM,IAAI,oBAAoB,cAAc,UAAU,EACpD,QAAQ,0CACV,CAAC;CACH;CAEA,MAAM,WACJ,SACA,OACA,aACe;EACf,MAAM,IAAI,oBAAoB,cAAc,UAAU,EACpD,QAAQ,0CACV,CAAC;CACH;CAMA,MAAM,kBAA6C;EACjD,OAAO;GACL,mBAAmB;GACnB,eAAe;GACf,mBAAmB;GACnB,cAAc;GACd,MAAM;GACN,gBAAgB;GAChB,mBAAmB;GACnB,MAAM;GACN,eAAe;GACf,KAAK;GACL,aAAa;GACb,YAAY;GACZ,eAAe;EACjB;CACF;CAEA,MAAM,uBAA8D;EAElE,OAAO;CACT;AACF"}