@julr/sesame 0.5.1 → 0.7.0

package/build/src/actions/issue_authorization_code.d.ts

@@ -0,0 +1,26 @@
+import type { SesameManager } from '../sesame_manager.ts';
+import type { OAuthClientRecord } from '../storage/types.ts';
+export interface AuthorizationCodeInput {
+    client: OAuthClientRecord;
+    userId: string;
+    scopes: string[];
+    redirectUri: string;
+    codeChallenge?: string;
+    codeChallengeMethod?: string;
+    nonce?: string;
+}
+/**
+ * Create and persist an authorization code in the database.
+ * Returns the raw (unhashed) code to be sent to the client.
+ *
+ * Shared between the authorize and consent flows to avoid
+ * duplicating the code-issuance logic.
+ */
+export declare class IssueAuthorizationCodeAction {
+    /**
+     * Generate an opaque authorization code, store its SHA-256
+     * hash in the database, and return the raw value for the
+     * client redirect.
+     */
+    execute(manager: SesameManager, input: AuthorizationCodeInput): Promise<string>;
+}

package/build/src/controllers/authorize_controller.d.ts

@@ -2,17 +2,10 @@ import type { HttpContext } from '@adonisjs/core/http';
 /**
  * Handles the OAuth 2.0 Authorization Endpoint (RFC 6749 §3.1).
  *
- * Implements the authorization code flow with PKCE support (RFC 7636).
- * Validates the client, requested scopes, and PKCE parameters, then
- * either redirects the user to the login/consent page or directly
- * issues an authorization code if consent was already granted.
- *
- * The `iss` response parameter is included per RFC 9207 to prevent
- * mix-up attacks.
+ * Validates HTTP parameters, delegates business logic to
+ * AuthorizeAction, and interprets the result as redirects.
  *
  * @see https://datatracker.ietf.org/doc/html/rfc6749#section-3.1
- * @see https://datatracker.ietf.org/doc/html/rfc7636
- * @see https://datatracker.ietf.org/doc/html/rfc9207
  */
 export default class AuthorizeController {
     #private;
@@ -24,30 +17,38 @@ export default class AuthorizeController {
         state: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine").VineString>;
         code_challenge: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine").VineString>;
         code_challenge_method: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine").VineString>;
+        nonce: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine").VineString>;
     }, {
-        scope?: string | null | undefined;
-        state?: string | null | undefined;
+        client_id: string;
         code_challenge?: string | null | undefined;
         code_challenge_method?: string | null | undefined;
+        nonce?: string | null | undefined;
         redirect_uri: string;
-        client_id: string;
         response_type: string;
+        scope?: string | null | undefined;
+        state?: string | null | undefined;
     }, {
-        scope?: string | undefined;
-        state?: string | undefined;
+        client_id: string;
         code_challenge?: string | undefined;
         code_challenge_method?: string | undefined;
+        nonce?: string | undefined;
         redirect_uri: string;
-        client_id: string;
         response_type: string;
-    }, {
         scope?: string | undefined;
         state?: string | undefined;
+    }, {
+        client_id: string;
         code_challenge?: string | undefined;
         code_challenge_method?: string | undefined;
+        nonce?: string | undefined;
         redirect_uri: string;
-        client_id: string;
         response_type: string;
+        scope?: string | undefined;
+        state?: string | undefined;
     }>, Record<string, any> | undefined>;
+    /**
+     * Validate the authorization request query params, run the
+     * authorize action, and redirect based on the result.
+     */
     handle(ctx: HttpContext): Promise<void>;
 }

package/build/src/controllers/consent_controller.d.ts

@@ -23,5 +23,10 @@ export default class ConsentController {
     }, {
         auth_token: string;
     }>, Record<string, any> | undefined>;
+    /**
+     * Validate the consent submission, consume the pending
+     * request, and redirect back to the client with either
+     * an authorization code or an access_denied error.
+     */
     handle(ctx: HttpContext): Promise<void>;
 }

package/build/src/controllers/jwks_controller.d.ts

@@ -0,0 +1,14 @@
+import type { HttpContext } from '@adonisjs/core/http';
+/**
+ * Serves the JSON Web Key Set (JWKS) containing public keys
+ * used to verify ID token signatures.
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc7517
+ */
+export default class JwksController {
+    handle(ctx: HttpContext): Promise<{
+        keys: import("jose").JWK[];
+    } | {
+        error: string;
+    }>;
+}

package/build/src/controllers/metadata_controller.d.ts

@@ -34,15 +34,14 @@ export default class MetadataController {
      * @see https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata
      */
     oidc(ctx: HttpContext): Promise<{
-        subject_types_supported: string[];
-        scopes_supported: string[];
+        error: string;
+    } | {
         issuer: string;
         authorization_endpoint: string;
         token_endpoint: string;
         registration_endpoint?: string;
         introspection_endpoint?: string;
         revocation_endpoint?: string;
-        response_types_supported: string[];
         response_modes_supported: string[];
         grant_types_supported: string[];
         token_endpoint_auth_methods_supported: string[];
@@ -50,6 +49,14 @@ export default class MetadataController {
         revocation_endpoint_auth_methods_supported?: string[];
         code_challenge_methods_supported: string[];
         authorization_response_iss_parameter_supported: boolean;
+        error?: undefined;
+        userinfo_endpoint: string;
+        jwks_uri: string;
+        subject_types_supported: string[];
+        id_token_signing_alg_values_supported: string[];
+        scopes_supported: string[];
+        claims_supported: string[];
+        response_types_supported: string[];
     }>;
     /**
      * OAuth 2.0 Protected Resource Metadata (RFC 9728).

package/build/src/controllers/register_controller.d.ts

@@ -28,70 +28,70 @@ export default class RegisterController {
         software_id: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine").VineString>;
         software_version: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine").VineString>;
     }, {
-        scope?: string | null | undefined;
-        token_endpoint_auth_method?: string | null | undefined;
-        grant_types?: string[] | null | undefined;
-        response_types?: string[] | null | undefined;
         client_name?: string | null | undefined;
         client_uri?: string | null | undefined;
+        contacts?: string[] | null | undefined;
+        grant_types?: string[] | null | undefined;
         logo_uri?: string | null | undefined;
-        tos_uri?: string | null | undefined;
         policy_uri?: string | null | undefined;
-        contacts?: string[] | null | undefined;
+        redirect_uris: string[];
+        response_types?: string[] | null | undefined;
+        scope?: string | null | undefined;
         software_id?: string | null | undefined;
         software_version?: string | null | undefined;
-        redirect_uris: string[];
+        token_endpoint_auth_method?: string | null | undefined;
+        tos_uri?: string | null | undefined;
     } & {
         [K: string]: unknown;
     }, {
-        scope?: string | undefined;
-        token_endpoint_auth_method?: string | undefined;
-        grant_types?: string[] | undefined;
-        response_types?: string[] | undefined;
         client_name?: string | undefined;
         client_uri?: string | undefined;
+        contacts?: string[] | undefined;
+        grant_types?: string[] | undefined;
         logo_uri?: string | undefined;
-        tos_uri?: string | undefined;
         policy_uri?: string | undefined;
-        contacts?: string[] | undefined;
+        redirect_uris: string[];
+        response_types?: string[] | undefined;
+        scope?: string | undefined;
         software_id?: string | undefined;
         software_version?: string | undefined;
-        redirect_uris: string[];
+        token_endpoint_auth_method?: string | undefined;
+        tos_uri?: string | undefined;
     } & {
         [K: string]: unknown;
     }, {
-        grantTypes?: string[] | undefined;
-        scope?: string | undefined;
-        contacts?: string[] | undefined;
-        tokenEndpointAuthMethod?: string | undefined;
-        responseTypes?: string[] | undefined;
         clientName?: string | undefined;
         clientUri?: string | undefined;
+        contacts?: string[] | undefined;
+        grantTypes?: string[] | undefined;
         logoUri?: string | undefined;
-        tosUri?: string | undefined;
         policyUri?: string | undefined;
+        redirectUris: string[];
+        responseTypes?: string[] | undefined;
+        scope?: string | undefined;
         softwareId?: string | undefined;
         softwareVersion?: string | undefined;
-        redirectUris: string[];
+        tokenEndpointAuthMethod?: string | undefined;
+        tosUri?: string | undefined;
     } & {
         [K: string]: unknown;
     }>, Record<string, any> | undefined>;
     handle(ctx: HttpContext): Promise<{
-        software_version?: string | undefined;
-        software_id?: string | undefined;
-        policy_uri?: string | undefined;
-        tos_uri?: string | undefined;
-        contacts?: string[] | undefined;
-        logo_uri?: string | undefined;
-        client_uri?: string | undefined;
         token_endpoint_auth_method: string;
         response_types: string[];
+        client_uri?: string | undefined;
+        logo_uri?: string | undefined;
+        contacts?: string[] | undefined;
+        tos_uri?: string | undefined;
+        policy_uri?: string | undefined;
+        software_id?: string | undefined;
+        software_version?: string | undefined;
+        client_id: string;
+        client_secret?: string | undefined;
         client_secret_expires_at: number;
         client_name: string;
         redirect_uris: string[];
         grant_types: string[];
         scope: string;
-        client_secret?: string | undefined;
-        client_id: string;
     }>;
 }

package/build/src/controllers/token_controller.d.ts

@@ -2,15 +2,14 @@ import type { HttpContext } from '@adonisjs/core/http';
 /**
  * Handles the OAuth 2.0 Token Endpoint (RFC 6749 §3.2).
  *
- * Dispatches to the appropriate grant handler based on the
- * `grant_type` parameter. Sets `Cache-Control: no-store` and
- * `Pragma: no-cache` headers on all token responses as required
- * by the spec.
+ * Authenticates the client, extracts grant-specific params,
+ * and dispatches to the appropriate action. Sets required
+ * cache headers on all token responses.
  *
  * @see https://datatracker.ietf.org/doc/html/rfc6749#section-3.2
- * @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.1
  */
 export default class TokenController {
+    #private;
     static validator: import("@vinejs/vine").VineValidator<import("@vinejs/vine").VineObject<{
         grant_type: import("@vinejs/vine").VineString;
     }, {
@@ -20,5 +19,9 @@ export default class TokenController {
     }, {
         grant_type: string;
     }>, Record<string, any> | undefined>;
+    /**
+     * Validate the grant type, authenticate the client,
+     * and dispatch to the appropriate grant action.
+     */
     handle(ctx: HttpContext): Promise<any>;
 }

package/build/src/controllers/userinfo_controller.d.ts

@@ -0,0 +1,14 @@
+import type { HttpContext } from '@adonisjs/core/http';
+/**
+ * OpenID Connect UserInfo endpoint (OIDC Core §5.3).
+ *
+ * Returns claims about the authenticated user based on the
+ * access token's scopes. Supports both GET and POST.
+ *
+ * @see https://openid.net/specs/openid-connect-core-1_0.html#UserInfo
+ */
+export default class UserinfoController {
+    handle(ctx: HttpContext): Promise<{
+        sub: string | null;
+    }>;
+}

package/build/src/guard/guard.d.ts

@@ -15,7 +15,7 @@ import type { OAuthGuardEvents, OAuthUserProviderContract } from './types.ts';
 export declare class OAuthGuard<UserProvider extends OAuthUserProviderContract<unknown>> implements GuardContract<UserProvider[typeof symbols.PROVIDER_REAL_USER]> {
     #private;
     [symbols.GUARD_KNOWN_EVENTS]: OAuthGuardEvents<UserProvider[typeof symbols.PROVIDER_REAL_USER]>;
-    driverName: "oauth";
+    driverName: 'oauth';
     authenticationAttempted: boolean;
     isAuthenticated: boolean;
     user?: UserProvider[typeof symbols.PROVIDER_REAL_USER];

package/build/src/guard/lucid.d.ts

@@ -0,0 +1,8 @@
+import type { LucidModel } from '@adonisjs/lucid/types/model';
+import { OAuthLucidUserProvider, type OAuthLucidUserProviderOptions } from './user_provider.ts';
+export { OAuthLucidUserProvider } from './user_provider.ts';
+export type { OAuthLucidUserProviderOptions } from './user_provider.ts';
+/**
+ * Create a Lucid-based user provider for the OAuth guard.
+ */
+export declare function oauthUserProvider<Model extends LucidModel>(options: OAuthLucidUserProviderOptions<Model>): OAuthLucidUserProvider<Model>;

package/build/src/guard/lucid.js

@@ -0,0 +1,46 @@
+import { RuntimeException } from "@adonisjs/core/exceptions";
+//#region src/guard/user_provider.ts
+/**
+* Lucid-based user provider for the OAuth guard.
+* Lazily loads the model and wraps instances as guard users.
+*/
+var OAuthLucidUserProvider = class {
+	#model;
+	#options;
+	constructor(options) {
+		this.#options = options;
+	}
+	async #getModel() {
+		if (this.#model && !("hot" in import.meta)) return this.#model;
+		this.#model = (await this.#options.model()).default;
+		return this.#model;
+	}
+	async createUserForGuard(user) {
+		const model = await this.#getModel();
+		if (user instanceof model === false) throw new RuntimeException(`Invalid user object. It must be an instance of the "${model.name}" model`);
+		return {
+			getId() {
+				if (!user.$primaryKeyValue) throw new RuntimeException(`Cannot use "${model.name}" model for authentication. The value of column "${model.primaryKey}" is undefined or null`);
+				return user.$primaryKeyValue;
+			},
+			getOriginal() {
+				return user;
+			}
+		};
+	}
+	async findById(identifier) {
+		const user = await (await this.#getModel()).find(identifier);
+		if (!user) return null;
+		return this.createUserForGuard(user);
+	}
+};
+//#endregion
+//#region src/guard/lucid.ts
+/**
+* Create a Lucid-based user provider for the OAuth guard.
+*/
+function oauthUserProvider(options) {
+	return new OAuthLucidUserProvider(options);
+}
+//#endregion
+export { OAuthLucidUserProvider, oauthUserProvider };

package/build/src/guard/main.d.ts

@@ -1,12 +1,9 @@
 import type { HttpContext } from '@adonisjs/core/http';
 import type { GuardConfigProvider } from '@adonisjs/auth/types';
-import type { LucidModel } from '@adonisjs/lucid/types/model';
 import { OAuthGuard } from './guard.ts';
-import { OAuthLucidUserProvider } from './user_provider.ts';
-import type { OAuthLucidUserProviderOptions, OAuthUserProviderContract } from './types.ts';
+import type { OAuthUserProviderContract } from './types.ts';
 export { OAuthGuard } from './guard.ts';
-export { OAuthLucidUserProvider } from './user_provider.ts';
-export type { OAuthGuardUser, OAuthGuardEvents, OAuthUserProviderContract, OAuthLucidUserProviderOptions, } from './types.ts';
+export type { OAuthGuardUser, OAuthGuardEvents, OAuthUserProviderContract } from './types.ts';
 /**
  * Configure the OAuth guard for `@adonisjs/auth`.
  */
@@ -14,7 +11,3 @@ export declare function oauthGuard<UserProvider extends OAuthUserProviderContrac
     provider: UserProvider;
     resource?: string;
 }): GuardConfigProvider<(ctx: HttpContext) => OAuthGuard<UserProvider>>;
-/**
- * Create a Lucid-based user provider for the OAuth guard.
- */
-export declare function oauthUserProvider<Model extends LucidModel>(options: OAuthLucidUserProviderOptions<Model>): OAuthLucidUserProvider<Model>;

package/build/src/guard/main.js

@@ -1,6 +1,2 @@
-import "../../decorate-BKZEjPRg.js";
-import "../../oauth_access_token-bsoM5KeU.js";
-import "../../oauth_client-BIoY5jBR.js";
-import "../../token_service-fhoA4slP.js";
-import { i as OAuthGuard, n as oauthUserProvider, r as OAuthLucidUserProvider, t as oauthGuard } from "../../main-EbeMS5S9.js";
-export { OAuthGuard, OAuthLucidUserProvider, oauthGuard, oauthUserProvider };
+import { n as OAuthGuard, t as oauthGuard } from "../../main-Dx9kZv07.js";
+export { OAuthGuard, oauthGuard };

package/build/src/guard/types.d.ts

@@ -1,6 +1,5 @@
 import type { HttpContext } from '@adonisjs/core/http';
 import type { Exception } from '@adonisjs/core/exceptions';
-import type { LucidModel } from '@adonisjs/lucid/types/model';
 import { symbols } from '@adonisjs/auth';
 /**
  * Guard user adapter between the user provider and the guard.
@@ -17,14 +16,6 @@ export interface OAuthUserProviderContract<RealUser> {
     createUserForGuard(user: RealUser): Promise<OAuthGuardUser<RealUser>>;
     findById(identifier: string | number | BigInt): Promise<OAuthGuardUser<RealUser> | null>;
 }
-/**
- * Options for the Lucid-based OAuth user provider.
- */
-export type OAuthLucidUserProviderOptions<Model extends LucidModel> = {
-    model: () => Promise<{
-        default: Model;
-    }>;
-};
 /**
  * Events emitted by the OAuth guard during authentication.
  */

package/build/src/guard/user_provider.d.ts

@@ -1,6 +1,14 @@
 import { symbols } from '@adonisjs/auth';
 import type { LucidModel } from '@adonisjs/lucid/types/model';
-import type { OAuthGuardUser, OAuthLucidUserProviderOptions, OAuthUserProviderContract } from './types.ts';
+import type { OAuthGuardUser, OAuthUserProviderContract } from './types.ts';
+/**
+ * Options for the Lucid-based OAuth user provider.
+ */
+export type OAuthLucidUserProviderOptions<Model extends LucidModel> = {
+    model: () => Promise<{
+        default: Model;
+    }>;
+};
 /**
  * Lucid-based user provider for the OAuth guard.
  * Lazily loads the model and wraps instances as guard users.

package/build/src/middleware/any_scope_middleware.js

@@ -1,4 +1,12 @@
-import { n as E_INSUFFICIENT_SCOPE } from "../../oauth_error-CnJ3L8tf.js";
+import { n as E_INSUFFICIENT_SCOPE } from "../../oauth_error-CvxtZvjp.js";
+//#region src/middleware/any_scope_middleware.ts
+/**
+* Any-scope middleware requires ANY of the listed scopes on the
+* authenticated OAuth token. Throws 403 if none match.
+*
+* @example
+* router.get('/data', [DataController]).use(middleware.anyScope({ scopes: ['read', 'read-all'] }))
+*/
 var AnyScopeMiddleware = class {
 	async handle(ctx, next, options) {
 		const guard = ctx.auth.use("oauth");
@@ -15,4 +23,5 @@ var AnyScopeMiddleware = class {
 		await guard.authenticate();
 	}
 };
+//#endregion
 export { AnyScopeMiddleware as default };

package/build/src/middleware/scope_middleware.js

@@ -1,4 +1,12 @@
-import { n as E_INSUFFICIENT_SCOPE } from "../../oauth_error-CnJ3L8tf.js";
+import { n as E_INSUFFICIENT_SCOPE } from "../../oauth_error-CvxtZvjp.js";
+//#region src/middleware/scope_middleware.ts
+/**
+* Scope middleware requires ALL listed scopes on the authenticated
+* OAuth token. Throws 403 if any scope is missing.
+*
+* @example
+* router.get('/admin', [AdminController]).use(middleware.scopes({ scopes: ['admin', 'manage'] }))
+*/
 var ScopeMiddleware = class {
 	async handle(ctx, next, options) {
 		const guard = ctx.auth.use("oauth");
@@ -15,4 +23,5 @@ var ScopeMiddleware = class {
 		await guard.authenticate();
 	}
 };
+//#endregion
 export { ScopeMiddleware as default };

package/build/src/models/oauth_authorization_code.d.ts

@@ -24,6 +24,7 @@ export declare class OAuthAuthorizationCode extends BaseModel {
     redirectUri: string;
     codeChallenge: string | null;
     codeChallengeMethod: string | null;
+    nonce: string | null;
     expiresAt: DateTime;
     createdAt: DateTime;
     updatedAt: DateTime;

package/build/src/models/oauth_pending_authorization_request.d.ts

@@ -24,6 +24,7 @@ export declare class OAuthPendingAuthorizationRequest extends BaseModel {
     state: string | null;
     codeChallenge: string | null;
     codeChallengeMethod: string | null;
+    nonce: string | null;
     expiresAt: DateTime;
     createdAt: DateTime;
 }