@hilbras/keystone 1.1.0

package/dist/routes/helpers.js

@@ -0,0 +1,15 @@
+export function sendResultError(reply, result) {
+    return reply.status(result.error.statusCode ?? 400).send({ error: result.error.message, code: result.error.code });
+}
+/**
+ * Escape special XML characters to prevent XML injection.
+ */
+export function escapeXml(value) {
+    return value
+        .replace(/&/g, "&")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&apos;");
+}
+//# sourceMappingURL=helpers.js.map

package/dist/routes/helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.js","sourceRoot":"","sources":["../../src/routes/helpers.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,eAAe,CAAC,KAAmB,EAAE,MAAyF;IAC5I,OAAO,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AACrH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC"}

package/dist/routes/magicLinks.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyInstance } from "fastify";
+export default function magicLinkRoutes(app: FastifyInstance): Promise<void>;
+//# sourceMappingURL=magicLinks.d.ts.map

package/dist/routes/magicLinks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"magicLinks.d.ts","sourceRoot":"","sources":["../../src/routes/magicLinks.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAkB,MAAM,SAAS,CAAC;AA+B/D,wBAA8B,eAAe,CAAC,GAAG,EAAE,eAAe,iBA0EjE"}

package/dist/routes/magicLinks.js

@@ -0,0 +1,82 @@
+import { z } from "zod";
+import { findUserByEmail } from "../services/users.js";
+import { generateMagicLink, storeMagicLink, consumeMagicLink, magicLinkExpiresAt, } from "../services/magicLinks.js";
+import { createTokenSet } from "../services/tokens.js";
+import { fingerprintFromRequest, recordDevice } from "../services/devices.js";
+import { setSessionCookies } from "../plugins/auth.js";
+import { emailProvider } from "../services/email.js";
+import { toPublicUser } from "../types.js";
+import { config } from "../config.js";
+import { rateLimit } from "../plugins/rateLimit.js";
+const SendSchema = z.object({
+    email: z.string().email(),
+});
+function magicLinkUrl(token) {
+    // The link lands on the client app (Keystone admin UI or a client
+    // application), which exchanges the token via the verify endpoint.
+    const base = process.env.CLIENT_APP_URL || "http://localhost:5173";
+    return `${base}/#magic-link=${encodeURIComponent(token)}`;
+}
+function postLoginRedirect() {
+    return process.env.CLIENT_APP_URL || "http://localhost:5173";
+}
+export default async function magicLinkRoutes(app) {
+    app.post("/magic-link/send", {
+        preHandler: [
+            rateLimit({
+                keyPrefix: "magic-link",
+                maxAttempts: 3,
+                windowSeconds: 900,
+            }),
+        ],
+    }, async (request, reply) => {
+        const body = SendSchema.parse(request.body);
+        const user = await findUserByEmail(body.email);
+        if (!user) {
+            return reply.status(200).send({ success: true });
+        }
+        const { token, tokenHash } = generateMagicLink();
+        await storeMagicLink(user.id, tokenHash, magicLinkExpiresAt());
+        try {
+            const url = magicLinkUrl(token);
+            const ttlMinutes = Math.round(config.MAGIC_LINK_TTL_SECONDS / 60);
+            await emailProvider.send({
+                to: user.email,
+                subject: "Your sign-in link",
+                text: `Click the link to sign in:\n\n${url}\n\nThis link expires in ${ttlMinutes} minutes and can only be used once.`,
+                html: `<p>Click <a href="${url}">here</a> to sign in.</p><p>This link expires in ${ttlMinutes} minutes and can only be used once.</p>`,
+            });
+        }
+        catch (err) {
+            request.log.error({ err }, "Failed to send magic link email");
+        }
+        await request.audit("magic_link_sent", { userId: user.id });
+        return { success: true };
+    });
+    app.get("/magic-link/verify", async (request, reply) => {
+        const query = request.query;
+        if (!query.token) {
+            return reply.status(400).send({ error: "Missing token" });
+        }
+        const user = await consumeMagicLink(query.token);
+        if (!user) {
+            return reply.status(400).send({ error: "Invalid or expired token" });
+        }
+        const fingerprint = fingerprintFromRequest(request);
+        await recordDevice(user.id, fingerprint, request.ip, request.headers["user-agent"]);
+        const tokens = await createTokenSet(user, request.ip, request.headers["user-agent"], {}, fingerprint);
+        setSessionCookies(reply, tokens.accessToken, tokens.refreshToken);
+        await request.audit("magic_link_verified", { userId: user.id });
+        // Browser flow: redirect back to the app after setting session cookies.
+        const accept = request.headers.accept || "";
+        if (accept.includes("text/html")) {
+            return reply.redirect(postLoginRedirect());
+        }
+        return {
+            user: toPublicUser(user),
+            accessToken: tokens.accessToken,
+            refreshToken: tokens.refreshToken,
+        };
+    });
+}
+//# sourceMappingURL=magicLinks.js.map

package/dist/routes/magicLinks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"magicLinks.js","sourceRoot":"","sources":["../../src/routes/magicLinks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEpD,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;CAC1B,CAAC,CAAC;AAEH,SAAS,YAAY,CAAC,KAAa;IACjC,kEAAkE;IAClE,mEAAmE;IACnE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,uBAAuB,CAAC;IACnE,OAAO,GAAG,IAAI,gBAAgB,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,uBAAuB,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,eAAe,CAAC,GAAoB;IAChE,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE;QAC3B,UAAU,EAAE;YACV,SAAS,CAAC;gBACR,SAAS,EAAE,YAAY;gBACvB,WAAW,EAAE,CAAC;gBACd,aAAa,EAAE,GAAG;aACnB,CAAC;SACH;KACF,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC1B,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,iBAAiB,EAAE,CAAC;QACjD,MAAM,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAE/D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,GAAG,EAAE,CAAC,CAAC;YAClE,MAAM,aAAa,CAAC,IAAI,CAAC;gBACvB,EAAE,EAAE,IAAI,CAAC,KAAK;gBACd,OAAO,EAAE,mBAAmB;gBAC5B,IAAI,EAAE,iCAAiC,GAAG,4BAA4B,UAAU,qCAAqC;gBACrH,IAAI,EAAE,qBAAqB,GAAG,qDAAqD,UAAU,yCAAyC;aACvI,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,iCAAiC,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAE5D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAK,EAAE,EAAE;QACrE,MAAM,KAAK,GAAG,OAAO,CAAC,KAA8C,CAAC;QACrE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,WAAW,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;QAEpF,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,IAAI,EACJ,OAAO,CAAC,EAAE,EACV,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAC7B,EAAE,EACF,WAAW,CACZ,CAAC;QACF,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAElE,MAAM,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAEhE,wEAAwE;QACxE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;QAC5C,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAC7C,CAAC;QAED,OAAO;YACL,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC;YACxB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/routes/oauth.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyInstance } from "fastify";
+export default function oauthRoutes(app: FastifyInstance): Promise<void>;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/routes/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/routes/oauth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAoF7E,wBAA8B,WAAW,CAAC,GAAG,EAAE,eAAe,iBA0E7D"}

package/dist/routes/oauth.js

@@ -0,0 +1,146 @@
+import crypto from "node:crypto";
+import { config } from "../config.js";
+import { buildConnector, listSupportedProviders } from "../services/connectors/registry.js";
+import { upsertOAuthUser } from "../services/users.js";
+import { createTokenSet } from "../services/tokens.js";
+import { setSessionCookies, clearSessionCookies } from "../plugins/auth.js";
+import { findApplicationByClientId } from "../services/applications.js";
+import { buildOAuthErrorRedirect, buildOAuthErrorResponse } from "../lib/errors.js";
+const REDIRECT_TARGET = process.env.AUTH_SUCCESS_REDIRECT || "/chat";
+const OAuthStartSchema = {
+    querystring: {
+        type: "object",
+        properties: {
+            client_id: { type: "string" },
+        },
+    },
+};
+function isProvider(value) {
+    return listSupportedProviders().includes(value);
+}
+function randomState() {
+    return crypto.randomBytes(24).toString("base64url");
+}
+function setOAuthState(reply, state) {
+    reply.setCookie("oauth_state", state, {
+        path: "/",
+        httpOnly: true,
+        secure: config.COOKIE_SECURE,
+        sameSite: "lax",
+        domain: config.COOKIE_DOMAIN || undefined,
+        maxAge: 600,
+    });
+}
+function clearOAuthState(reply) {
+    reply.clearCookie("oauth_state", {
+        path: "/",
+        httpOnly: true,
+        secure: config.COOKIE_SECURE,
+        sameSite: "lax",
+        domain: config.COOKIE_DOMAIN || undefined,
+    });
+}
+function setOAuthClientId(reply, clientId) {
+    if (!clientId)
+        return;
+    reply.setCookie("oauth_client_id", clientId, {
+        path: "/",
+        httpOnly: true,
+        secure: config.COOKIE_SECURE,
+        sameSite: "lax",
+        domain: config.COOKIE_DOMAIN || undefined,
+        maxAge: 600,
+    });
+}
+function getOAuthClientId(request) {
+    return request.cookies.oauth_client_id;
+}
+function clearOAuthClientId(reply) {
+    reply.clearCookie("oauth_client_id", {
+        path: "/",
+        httpOnly: true,
+        secure: config.COOKIE_SECURE,
+        sameSite: "lax",
+        domain: config.COOKIE_DOMAIN || undefined,
+    });
+}
+function publicUrl() {
+    return config.AUTH_API_PUBLIC_URL || `http://localhost:${config.PORT}`;
+}
+function callbackRedirectUri(provider) {
+    return `${publicUrl()}/auth/callback/${provider}`;
+}
+export default async function oauthRoutes(app) {
+    app.get("/oauth/:provider", { schema: OAuthStartSchema }, async (request, reply) => {
+        const { provider } = request.params;
+        if (!isProvider(provider)) {
+            return reply.status(400).send({ error: "Unsupported provider" });
+        }
+        const query = request.query;
+        const state = randomState();
+        setOAuthState(reply, state);
+        setOAuthClientId(reply, query.client_id);
+        try {
+            const connector = buildConnector(provider);
+            const url = await connector.getAuthorizeUrl({
+                state,
+                redirectUri: callbackRedirectUri(provider),
+                scopes: ["openid", "profile", "email"],
+            });
+            return reply.redirect(url);
+        }
+        catch (err) {
+            request.log.error({ err }, "OAuth start failed");
+            const { statusCode, body } = buildOAuthErrorResponse(err);
+            return reply.status(statusCode).send(body);
+        }
+    });
+    app.get("/callback/:provider", async (request, reply) => {
+        const { provider } = request.params;
+        if (!isProvider(provider)) {
+            return reply.status(400).send({ error: "Unsupported provider" });
+        }
+        const { code, state } = request.query;
+        const cookieState = request.cookies.oauth_state;
+        const clientId = getOAuthClientId(request);
+        if (!code || !state || state !== cookieState) {
+            clearOAuthState(reply);
+            clearOAuthClientId(reply);
+            return reply.redirect(`${redirectTargetUrl(clientId)}?error=${encodeURIComponent("Invalid OAuth state")}`);
+        }
+        clearOAuthState(reply);
+        clearOAuthClientId(reply);
+        try {
+            const connector = buildConnector(provider);
+            const identity = await connector.exchangeCode(code, callbackRedirectUri(provider));
+            const user = await upsertOAuthUser(identity, provider);
+            const app = clientId ? await findApplicationByClientId(clientId) : undefined;
+            const tokens = await createTokenSet(user, request.ip, request.headers["user-agent"], {
+                appId: app?.id,
+                orgId: app?.orgId,
+                clientId: app?.clientId,
+            });
+            setSessionCookies(reply, tokens.accessToken, tokens.refreshToken, app?.clientId);
+            await request.audit("oauth_callback", {
+                provider,
+                externalSub: identity.sub,
+                appId: app?.id,
+                orgId: app?.orgId,
+            });
+            return reply.redirect(redirectTargetUrl(clientId, app));
+        }
+        catch (err) {
+            request.log.error({ err }, "OAuth callback failed");
+            clearSessionCookies(reply);
+            const url = buildOAuthErrorRedirect(err, redirectTargetUrl(clientId), { state });
+            return reply.redirect(url);
+        }
+    });
+}
+function redirectTargetUrl(clientId, app) {
+    if (app?.redirectUris?.length) {
+        return app.redirectUris[0];
+    }
+    return process.env.CLIENT_APP_URL || "http://localhost:5173";
+}
+//# sourceMappingURL=oauth.js.map

package/dist/routes/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/routes/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5F,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAExE,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAEpF,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,OAAO,CAAC;AAErE,MAAM,gBAAgB,GAAG;IACvB,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;SAC9B;KACF;CACF,CAAC;AAEF,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,sBAAsB,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,aAAa,CAAC,KAAmB,EAAE,KAAa;IACvD,KAAK,CAAC,SAAS,CAAC,aAAa,EAAE,KAAK,EAAE;QACpC,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,MAAM,CAAC,aAAa;QAC5B,QAAQ,EAAE,KAAc;QACxB,MAAM,EAAE,MAAM,CAAC,aAAa,IAAI,SAAS;QACzC,MAAM,EAAE,GAAG;KACZ,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,KAAmB;IAC1C,KAAK,CAAC,WAAW,CAAC,aAAa,EAAE;QAC/B,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,MAAM,CAAC,aAAa;QAC5B,QAAQ,EAAE,KAAc;QACxB,MAAM,EAAE,MAAM,CAAC,aAAa,IAAI,SAAS;KAC1C,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAmB,EAAE,QAAiB;IAC9D,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,KAAK,CAAC,SAAS,CAAC,iBAAiB,EAAE,QAAQ,EAAE;QAC3C,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,MAAM,CAAC,aAAa;QAC5B,QAAQ,EAAE,KAAc;QACxB,MAAM,EAAE,MAAM,CAAC,aAAa,IAAI,SAAS;QACzC,MAAM,EAAE,GAAG;KACZ,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAuB;IAC/C,OAAO,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC;AACzC,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAmB;IAC7C,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE;QACnC,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,MAAM,CAAC,aAAa;QAC5B,QAAQ,EAAE,KAAc;QACxB,MAAM,EAAE,MAAM,CAAC,aAAa,IAAI,SAAS;KAC1C,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,MAAM,CAAC,mBAAmB,IAAI,oBAAoB,MAAM,CAAC,IAAI,EAAE,CAAC;AACzE,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,OAAO,GAAG,SAAS,EAAE,kBAAkB,QAAQ,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,WAAW,CAAC,GAAoB;IAC5D,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACjF,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,MAA8B,CAAC;QAC5D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAA+B,CAAC;QACtD,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC5B,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAEzC,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,eAAe,CAAC;gBAC1C,KAAK;gBACL,WAAW,EAAE,mBAAmB,CAAC,QAAQ,CAAC;gBAC1C,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;aACvC,CAAC,CAAC;YACH,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,oBAAoB,CAAC,CAAC;YACjD,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACtD,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,MAA8B,CAAC;QAC5D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAA0C,CAAC;QAC3E,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC;QAChD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAE3C,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;YAC7C,eAAe,CAAC,KAAK,CAAC,CAAC;YACvB,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC1B,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,iBAAiB,CAAC,QAAQ,CAAC,UAAU,kBAAkB,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,eAAe,CAAC,KAAK,CAAC,CAAC;QACvB,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAE1B,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;YAC3C,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;YAEnF,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAEvD,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7E,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE;gBACnF,KAAK,EAAE,GAAG,EAAE,EAAE;gBACd,KAAK,EAAE,GAAG,EAAE,KAAK;gBACjB,QAAQ,EAAE,GAAG,EAAE,QAAQ;aACxB,CAAC,CAAC;YACH,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,YAAY,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YAEjF,MAAM,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE;gBACpC,QAAQ;gBACR,WAAW,EAAE,QAAQ,CAAC,GAAG;gBACzB,KAAK,EAAE,GAAG,EAAE,EAAE;gBACd,KAAK,EAAE,GAAG,EAAE,KAAK;aAClB,CAAC,CAAC;YAEH,OAAO,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,uBAAuB,CAAC,CAAC;YACpD,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC3B,MAAM,GAAG,GAAG,uBAAuB,CAAC,GAAG,EAAE,iBAAiB,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACjF,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAiB,EAAE,GAAiB;IAC7D,IAAI,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;QAC9B,OAAO,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,uBAAuB,CAAC;AAC/D,CAAC"}

package/dist/routes/oauth2.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyInstance } from "fastify";
+export default function oauth2Routes(app: FastifyInstance): Promise<void>;
+//# sourceMappingURL=oauth2.d.ts.map

package/dist/routes/oauth2.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth2.d.ts","sourceRoot":"","sources":["../../src/routes/oauth2.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAiE7E,wBAA8B,YAAY,CAAC,GAAG,EAAE,eAAe,iBAyN9D"}

package/dist/routes/oauth2.js

@@ -0,0 +1,219 @@
+import { z } from "zod";
+import { config } from "../config.js";
+import { storeAuthorizationCode, consumeAuthorizationCode, verifyPKCE, hasConsent, grantConsent, revokeConsent, createTokenResponse, findApplicationByClientId, verifyClientSecret, } from "../services/oauth2.js";
+import { findUserById } from "../services/users.js";
+import { revokeRefreshToken, createApplicationAccessToken, rotateRefreshToken } from "../services/tokens.js";
+import { fingerprintFromRequest } from "../services/devices.js";
+import { rateLimit } from "../plugins/rateLimit.js";
+const AuthorizeQuerySchema = z.object({
+    client_id: z.string(),
+    redirect_uri: z.string().url(),
+    response_type: z.literal("code"),
+    scope: z.string().optional(),
+    state: z.string().optional(),
+    code_challenge: z.string().min(43).max(128),
+    code_challenge_method: z.literal("S256"),
+    nonce: z.string().optional(),
+});
+const TokenBodySchema = z.object({
+    grant_type: z.enum(["authorization_code", "refresh_token", "client_credentials"]),
+    code: z.string().optional(),
+    redirect_uri: z.string().url().optional(),
+    code_verifier: z.string().min(43).max(128).optional(),
+    refresh_token: z.string().optional(),
+    client_id: z.string().optional(),
+    client_secret: z.string().optional(),
+    scope: z.string().optional(),
+});
+const ConsentBodySchema = z.object({
+    client_id: z.string(),
+    scopes: z.array(z.string()).default([]),
+    grant: z.boolean(),
+});
+function extractClientCredentials(request, body) {
+    const authHeader = request.headers.authorization;
+    if (authHeader?.toLowerCase().startsWith("basic ")) {
+        try {
+            const decoded = Buffer.from(authHeader.slice(6), "base64").toString("utf8");
+            const [clientId, clientSecret] = decoded.split(":");
+            return { clientId, clientSecret };
+        }
+        catch {
+            return body;
+        }
+    }
+    return body;
+}
+export default async function oauth2Routes(app) {
+    app.get("/authorize", {
+        preHandler: [
+            app.authenticate,
+            rateLimit({ keyPrefix: "oauth2_authorize", maxAttempts: 10, windowSeconds: 60 }),
+        ],
+    }, async (request, reply) => {
+        const query = AuthorizeQuerySchema.parse(request.query);
+        const application = await findApplicationByClientId(query.client_id);
+        if (!application) {
+            return reply.status(400).send({ error: "invalid_client", error_description: "Unknown client" });
+        }
+        if (!application.redirectUris.includes(query.redirect_uri)) {
+            return reply
+                .status(400)
+                .send({ error: "invalid_redirect_uri", error_description: "Redirect URI not registered" });
+        }
+        const scopes = query.scope ? query.scope.split(" ").filter(Boolean) : [];
+        const consent = await hasConsent(request.user.id, application.id, scopes);
+        if (!consent) {
+            return reply.status(403).send({
+                error: "consent_required",
+                error_description: "User consent required",
+            });
+        }
+        const stored = await storeAuthorizationCode({
+            appId: application.id,
+            userId: request.user.id,
+            challenge: query.code_challenge,
+            challengeMethod: query.code_challenge_method,
+            redirectUri: query.redirect_uri,
+            scopes,
+            nonce: query.nonce,
+        });
+        const url = new URL(query.redirect_uri);
+        url.searchParams.set("code", stored.code);
+        if (query.state)
+            url.searchParams.set("state", query.state);
+        await request.audit("oauth2_authorize", {
+            appId: application.id,
+            clientId: application.clientId,
+        });
+        return reply.redirect(url.toString());
+    });
+    app.post("/token", {
+        preHandler: [rateLimit({ keyPrefix: "oauth2_token", maxAttempts: 20, windowSeconds: 60 })],
+    }, async (request, reply) => {
+        const parsedBody = TokenBodySchema.parse(request.body);
+        const credentials = extractClientCredentials(request, {
+            clientId: parsedBody.client_id,
+            clientSecret: parsedBody.client_secret,
+        });
+        const body = { ...parsedBody, client_id: credentials.clientId, client_secret: credentials.clientSecret };
+        if (body.grant_type === "authorization_code") {
+            if (!body.code || !body.client_id || !body.redirect_uri) {
+                return reply
+                    .status(400)
+                    .send({ error: "invalid_request", error_description: "code, client_id, and redirect_uri are required" });
+            }
+            const application = await findApplicationByClientId(body.client_id);
+            if (!application) {
+                return reply.status(400).send({ error: "invalid_client" });
+            }
+            const record = await consumeAuthorizationCode(body.code, application.id, body.redirect_uri);
+            if (!record) {
+                return reply.status(400).send({ error: "invalid_grant" });
+            }
+            const verifier = body.code_verifier;
+            if (!verifier) {
+                return reply.status(400).send({ error: "invalid_request", error_description: "PKCE verifier required" });
+            }
+            if (!verifyPKCE(record.challenge, record.challengeMethod, verifier)) {
+                return reply.status(400).send({ error: "invalid_grant", error_description: "PKCE verification failed" });
+            }
+            const user = await findUserById(record.userId);
+            if (!user) {
+                return reply.status(400).send({ error: "invalid_grant" });
+            }
+            await request.audit("oauth2_token", {
+                appId: application.id,
+                clientId: application.clientId,
+                grantType: "authorization_code",
+            });
+            const fingerprint = fingerprintFromRequest(request);
+            return createTokenResponse(user, application, record.scopes, {
+                ip: request.ip,
+                userAgent: request.headers["user-agent"],
+                deviceFingerprint: fingerprint,
+                nonce: record.nonce ?? undefined,
+            });
+        }
+        if (body.grant_type === "refresh_token") {
+            if (!body.refresh_token) {
+                return reply.status(400).send({ error: "invalid_request" });
+            }
+            // Lazy import to avoid circular dependency.
+            const tokens = await rotateRefreshToken(body.refresh_token, request.ip, request.headers["user-agent"]);
+            if (!tokens) {
+                return reply.status(400).send({ error: "invalid_grant" });
+            }
+            return {
+                access_token: tokens.accessToken,
+                refresh_token: tokens.refreshToken,
+                token_type: "Bearer",
+                expires_in: config.ACCESS_TOKEN_TTL_SECONDS,
+            };
+        }
+        if (body.grant_type === "client_credentials") {
+            if (!body.client_id || !body.client_secret) {
+                return reply.status(400).send({ error: "invalid_request", error_description: "client credentials required" });
+            }
+            const application = await verifyClientSecret(body.client_id, body.client_secret);
+            if (!application) {
+                return reply.status(401).send({ error: "invalid_client" });
+            }
+            const scopes = body.scope ? body.scope.split(" ").filter(Boolean) : [];
+            const accessToken = await createApplicationAccessToken({
+                appId: application.id,
+                orgId: application.orgId,
+                clientId: application.clientId,
+                scopes,
+            });
+            await request.audit("oauth2_client_credentials", {
+                appId: application.id,
+                clientId: application.clientId,
+            });
+            return {
+                access_token: accessToken,
+                token_type: "Bearer",
+                expires_in: config.ACCESS_TOKEN_TTL_SECONDS,
+                scope: scopes.join(" "),
+            };
+        }
+        return reply.status(400).send({ error: "unsupported_grant_type" });
+    });
+    app.get("/userinfo", { preHandler: [app.authenticate] }, async (request) => {
+        const user = request.user;
+        return {
+            sub: user.id,
+            email: user.email,
+            email_verified: user.emailVerified,
+            username: user.username,
+            name: user.name,
+            picture: user.avatarUrl,
+        };
+    });
+    app.post("/revoke", async (request, reply) => {
+        const body = z.object({ token: z.string() }).parse(request.body);
+        await revokeRefreshToken(body.token);
+        await request.audit("oauth2_revoke", {});
+        return { success: true };
+    });
+    app.post("/consent", { preHandler: [app.authenticate] }, async (request, reply) => {
+        const body = ConsentBodySchema.parse(request.body);
+        const application = await findApplicationByClientId(body.client_id);
+        if (!application) {
+            return reply.status(400).send({ error: "invalid_client" });
+        }
+        if (body.grant) {
+            await grantConsent(request.user.id, application.id, body.scopes);
+        }
+        else {
+            await revokeConsent(request.user.id, application.id);
+        }
+        await request.audit("oauth2_consent", {
+            appId: application.id,
+            granted: body.grant,
+            scopes: body.scopes,
+        });
+        return { success: true };
+    });
+}
+//# sourceMappingURL=oauth2.js.map

package/dist/routes/oauth2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth2.js","sourceRoot":"","sources":["../../src/routes/oauth2.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,UAAU,EACV,UAAU,EACV,YAAY,EACZ,aAAa,EACb,mBAAmB,EACnB,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,4BAA4B,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC7G,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEpD,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC9B,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3C,qBAAqB,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,eAAe,EAAE,oBAAoB,CAAC,CAAC;IACjF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACzC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACrD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvC,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;CACnB,CAAC,CAAC;AAOH,SAAS,wBAAwB,CAAC,OAAuB,EAAE,IAAuB;IAChF,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;IACjD,IAAI,UAAU,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC5E,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACpD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,YAAY,CAAC,GAAoB;IAC7D,GAAG,CAAC,GAAG,CACL,YAAY,EACZ;QACE,UAAU,EAAE;YACV,GAAG,CAAC,YAAY;YAChB,SAAS,CAAC,EAAE,SAAS,EAAE,kBAAkB,EAAE,WAAW,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;SACjF;KACF,EACD,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,KAAK,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAExD,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAClG,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YAC3D,OAAO,KAAK;iBACT,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC/F,CAAC;QAED,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAEzE,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,IAAK,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,kBAAkB;gBACzB,iBAAiB,EAAE,uBAAuB;aAC3C,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC;YAC1C,KAAK,EAAE,WAAW,CAAC,EAAE;YACrB,MAAM,EAAE,OAAO,CAAC,IAAK,CAAC,EAAE;YACxB,SAAS,EAAE,KAAK,CAAC,cAAc;YAC/B,eAAe,EAAE,KAAK,CAAC,qBAAqB;YAC5C,WAAW,EAAE,KAAK,CAAC,YAAY;YAC/B,MAAM;YACN,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,KAAK;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAE5D,MAAM,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE;YACtC,KAAK,EAAE,WAAW,CAAC,EAAE;YACrB,QAAQ,EAAE,WAAW,CAAC,QAAQ;SAC/B,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxC,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,QAAQ,EACR;QACE,UAAU,EAAE,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;KAC3F,EACD,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,wBAAwB,CAAC,OAAO,EAAE;YACpD,QAAQ,EAAE,UAAU,CAAC,SAAS;YAC9B,YAAY,EAAE,UAAU,CAAC,aAAa;SACvC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,YAAY,EAAE,CAAC;QAEzG,IAAI,IAAI,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;YAC7C,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;gBACxD,OAAO,KAAK;qBACT,MAAM,CAAC,GAAG,CAAC;qBACX,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gDAAgD,EAAE,CAAC,CAAC;YAC7G,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACpE,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC7D,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YAC5F,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YAC5D,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC;YACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,CAAC,CAAC;YAC3G,CAAC;YAED,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,eAAe,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACpE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,CAAC,CAAC;YAC3G,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YAC5D,CAAC;YAED,MAAM,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE;gBAClC,KAAK,EAAE,WAAW,CAAC,EAAE;gBACrB,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,SAAS,EAAE,oBAAoB;aAChC,CAAC,CAAC;YAEH,MAAM,WAAW,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;YACpD,OAAO,mBAAmB,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE;gBAC3D,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;gBACxC,iBAAiB,EAAE,WAAW;gBAC9B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,SAAS;aACjC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;gBACxB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC9D,CAAC;YAED,4CAA4C;YAC5C,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;YACvG,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YAC5D,CAAC;YAED,OAAO;gBACL,YAAY,EAAE,MAAM,CAAC,WAAW;gBAChC,aAAa,EAAE,MAAM,CAAC,YAAY;gBAClC,UAAU,EAAE,QAAQ;gBACpB,UAAU,EAAE,MAAM,CAAC,wBAAwB;aAC5C,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;YAC7C,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC3C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,6BAA6B,EAAE,CAAC,CAAC;YAChH,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YACjF,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC7D,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,MAAM,WAAW,GAAG,MAAM,4BAA4B,CAAC;gBACrD,KAAK,EAAE,WAAW,CAAC,EAAE;gBACrB,KAAK,EAAE,WAAW,CAAC,KAAK;gBACxB,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,MAAM;aACP,CAAC,CAAC;YAEH,MAAM,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE;gBAC/C,KAAK,EAAE,WAAW,CAAC,EAAE;gBACrB,QAAQ,EAAE,WAAW,CAAC,QAAQ;aAC/B,CAAC,CAAC;YAEH,OAAO;gBACL,YAAY,EAAE,WAAW;gBACzB,UAAU,EAAE,QAAQ;gBACpB,UAAU,EAAE,MAAM,CAAC,wBAAwB;gBAC3C,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;aACxB,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;IACrE,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,WAAW,EACX,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAClC,KAAK,EAAE,OAAuB,EAAE,EAAE;QAChC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,OAAO;YACL,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,cAAc,EAAE,IAAI,CAAC,aAAa;YAClC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,SAAS;SACxB,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC3C,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CACN,UAAU,EACV,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAClC,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,YAAY,CAAC,OAAO,CAAC,IAAK,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACpE,CAAC;aAAM,CAAC;YACN,MAAM,aAAa,CAAC,OAAO,CAAC,IAAK,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE;YACpC,KAAK,EAAE,WAAW,CAAC,EAAE;YACrB,OAAO,EAAE,IAAI,CAAC,KAAK;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/routes/oidcEnterprise.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyInstance } from "fastify";
+export default function oidcEnterpriseRoutes(app: FastifyInstance): Promise<void>;
+//# sourceMappingURL=oidcEnterprise.d.ts.map

package/dist/routes/oidcEnterprise.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidcEnterprise.d.ts","sourceRoot":"","sources":["../../src/routes/oidcEnterprise.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAgC7E,wBAA8B,oBAAoB,CAAC,GAAG,EAAE,eAAe,iBAoItE"}