@kaapi/oauth2-auth-design 0.0.13

package/lib/flows/auth-code/token-route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-route.js","sourceRoot":"","sources":["../../../src/flows/auth-code/token-route.ts"],"names":[],"mappings":";;;;;AAwCA,MAAa,kBAAkB;IAI3B,MAAM,CAAC,YAAY;QAGf,OAAO,IAAI,yBAAyB,EAAQ,CAAA;IAChD,CAAC;IAKD,IAAI,IAAI;QACJ,OAAO,IAAI,CAAC,KAAK,CAAA;IACrB,CAAC;IAED,IAAI,OAAO;QACP,OAAO,IAAI,CAAC,QAAQ,CAAA;IACxB,CAAC;IAED,YACI,IAAY,EACZ,OAAmC;QAEnC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;IAC5B,CAAC;CACJ;AA5BD,gDA4BC;AAcD,MAAa,yBAEX,SAAQ,kBAAwB;IAI9B;QACI,KAAK,CAAC,eAAe,EAAE,CAAO,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;YAC3C,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;gBAC7C,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,mEAAmE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACrJ,CAAC;YAED,IAAI,CAAC,GAA4E,IAAI,CAAA;YAErF,IAAI,CAAC;gBACD,CAAC,GAAG,MAAM,+BAAA,IAAI,gDAAe,MAAnB,IAAI,EAAgB,KAAK,EAAE,GAAG,CAAC,CAAA;YAC7C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAC1F,CAAC;YAED,IAAI,CAAC,CAAC;gBAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAEjE,IAAI,OAAO,IAAI,CAAC;gBAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAEhD,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAClC,CAAC,CAAA,CAAC,CAAA;QArBN,2DAA4C;QAuBxC,+BAAA,IAAI,4CAAkB,GAAS,EAAE,wDAAC,OAAA,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAA,GAAA,MAAA,CAAA;IACpE,CAAC;IAED,OAAO,CAAC,IAAe;QACnB,IAAI,IAAI;YACJ,IAAI,CAAC,KAAK,GAAG,IAAI,CAAA;QACrB,OAAO,IAAI,CAAA;IACf,CAAC;IAED,QAAQ,CAAC,OAAmC;QACxC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAA;QACvB,OAAO,IAAI,CAAA;IACf,CAAC;IAED,aAAa,CAAC,OAAqC;QAC/C,+BAAA,IAAI,4CAAkB,OAAO,MAAA,CAAA;QAC7B,OAAO,IAAI,CAAA;IACf,CAAC;CACJ;AA7CD,8DA6CC;;AAED,qBAAqB"}

package/lib/flows/auth-code.ts/open-id.d.ts

@@ -0,0 +1,52 @@
+import { SecuritySchemeObject } from '@novice1/api-doc-generator/lib/generators/openapi/definitions';
+import { OAuth2Util } from '@novice1/api-doc-generator';
+import { OAuth2AuthorizationCode, OAuth2AuthorizationCodeArg } from '../authentication-code';
+import { KaapiTools, Lifecycle, ReqRef, Request, ReqRefDefaults, ResponseToolkit } from '@kaapi/kaapi';
+import { JWKS } from '../../utils/jwks-store';
+export declare class OpenIDAuthUtil extends OAuth2Util {
+    toOpenAPI(): Record<string, SecuritySchemeObject>;
+}
+export interface OpenIDJWKSParams {
+    jwks: JWKS;
+}
+export type OpenIDJWKSHandler<Refs extends ReqRef = ReqRefDefaults, R extends Lifecycle.ReturnValue<any> = Lifecycle.ReturnValue<Refs>> = (params: OpenIDJWKSParams, request: Request<Refs>, h: ResponseToolkit<Refs>) => R;
+export interface IOpenIDJWKSRoute<Refs extends ReqRef = ReqRefDefaults> {
+    path: string;
+    handler?: OpenIDJWKSHandler<Refs>;
+}
+export declare class OpenIDJWKSRoute<Refs extends ReqRef = ReqRefDefaults> implements IOpenIDJWKSRoute<Refs> {
+    protected _path: string;
+    protected _handler: OpenIDJWKSHandler<Refs> | undefined;
+    get path(): string;
+    get handler(): OpenIDJWKSHandler<Refs, Lifecycle.ReturnValue<Refs>> | undefined;
+    constructor(path: string, handler?: OpenIDJWKSHandler<Refs>);
+}
+export type OpenIDUserInfoHandler<Refs extends ReqRef = ReqRefDefaults, R extends Lifecycle.ReturnValue<any> = Lifecycle.ReturnValue<Refs>> = (request: Request<Refs>, h: ResponseToolkit<Refs>) => R;
+export interface IOpenIDUserInfoRoute<Refs extends ReqRef = ReqRefDefaults> {
+    path: string;
+    handler?: OpenIDUserInfoHandler<Refs>;
+}
+export declare class OpenIDUserInfoRoute<Refs extends ReqRef = ReqRefDefaults> implements IOpenIDUserInfoRoute<Refs> {
+    protected _path: string;
+    protected _handler: OpenIDUserInfoHandler<Refs>;
+    get path(): string;
+    get handler(): OpenIDUserInfoHandler<Refs, Lifecycle.ReturnValue<Refs>>;
+    constructor(path: string, handler: OpenIDUserInfoHandler<Refs>);
+}
+export interface OpenIDAuthDesignArg extends OAuth2AuthorizationCodeArg {
+    jwksRoute: OpenIDJWKSRoute<any>;
+    userInfoRoute: OpenIDUserInfoRoute<any>;
+    /**
+     * Override the configuration served at /.well-known/openid-configuration
+     */
+    openidConfiguration?: Record<string, unknown>;
+}
+export declare class OpenIDAuthDesign extends OAuth2AuthorizationCode {
+    protected jwksRoute: OpenIDJWKSRoute<any>;
+    protected userInfoRoute: OpenIDUserInfoRoute<any>;
+    protected openidConfiguration: Record<string, unknown>;
+    constructor(params: OpenIDAuthDesignArg);
+    getScopes(): Record<string, string>;
+    integrateHook(t: KaapiTools): void;
+    docs(): OAuth2Util;
+}

package/lib/flows/auth-code.ts/open-id.js

@@ -0,0 +1,169 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OpenIDAuthDesign = exports.OpenIDUserInfoRoute = exports.OpenIDJWKSRoute = exports.OpenIDAuthUtil = void 0;
+const tslib_1 = require("tslib");
+const api_doc_generator_1 = require("@novice1/api-doc-generator");
+const authentication_code_1 = require("../authentication-code");
+//#region OpenIDAuthUtil
+class OpenIDAuthUtil extends api_doc_generator_1.OAuth2Util {
+    toOpenAPI() {
+        const host = this.getHost();
+        return {
+            [this.securitySchemeName]: {
+                type: 'openIdConnect',
+                openIdConnectUrl: `${host || ''}/.well-known/openid-configuration`
+            }
+        };
+    }
+}
+exports.OpenIDAuthUtil = OpenIDAuthUtil;
+class OpenIDJWKSRoute {
+    get path() {
+        return this._path;
+    }
+    get handler() {
+        return this._handler;
+    }
+    constructor(path, handler) {
+        this._path = path;
+        this._handler = handler;
+    }
+}
+exports.OpenIDJWKSRoute = OpenIDJWKSRoute;
+class OpenIDUserInfoRoute {
+    get path() {
+        return this._path;
+    }
+    get handler() {
+        return this._handler;
+    }
+    constructor(path, handler) {
+        this._path = path;
+        this._handler = handler;
+    }
+}
+exports.OpenIDUserInfoRoute = OpenIDUserInfoRoute;
+class OpenIDAuthDesign extends authentication_code_1.OAuth2AuthorizationCode {
+    constructor(params) {
+        const { strategyName, openidConfiguration, jwksRoute, userInfoRoute } = params, props = tslib_1.__rest(params, ["strategyName", "openidConfiguration", "jwksRoute", "userInfoRoute"]);
+        super(props);
+        this.openidConfiguration = {};
+        this.pkce = true;
+        this.strategyName = strategyName || 'open-id-auth-design';
+        this.jwksRoute = jwksRoute;
+        this.userInfoRoute = userInfoRoute;
+        if (openidConfiguration)
+            this.openidConfiguration = openidConfiguration;
+    }
+    getScopes() {
+        let scopes = {
+            openid: 'enable OpenID Connect'
+        };
+        if (this.scopes) {
+            if ('openid' in this.scopes) {
+                scopes = this.scopes;
+            }
+            else {
+                scopes = Object.assign(Object.assign({}, this.scopes), scopes);
+            }
+        }
+        return scopes;
+    }
+    integrateHook(t) {
+        var _a;
+        super.integrateHook(t);
+        const docs = this.docs();
+        const challengeAlgo = docs.getChallengeAlgorithm();
+        const host = ((_a = t.postman) === null || _a === void 0 ? void 0 : _a.getHost()[0]) || '';
+        t.route({
+            path: '/.well-known/openid-configuration',
+            method: 'GET',
+            options: {
+                plugins: {
+                    kaapi: {
+                        docs: false
+                    }
+                }
+            },
+            handler: () => {
+                return Object.assign({ issuer: host, authorization_endpoint: `${host}${this.authorizationRoute.path}`, token_endpoint: `${host}${this.tokenRoute.path}`, userinfo_endpoint: `${host}${this.userInfoRoute.path}`, jwks_uri: `${host}${this.jwksRoute.path}`, claims_supported: [
+                        'aud',
+                        'exp',
+                        'iat',
+                        'iss',
+                        'sub'
+                    ], grant_types_supported: [
+                        'authorization_code'
+                    ], response_types_supported: [
+                        'code',
+                        'token',
+                        'code token',
+                        'code token id_token'
+                    ], scopes_supported: Object.keys(docs.getScopes()), subject_types_supported: [
+                        'public'
+                    ], id_token_signing_alg_values_supported: [
+                        'RS256'
+                    ], code_challenge_methods_supported: challengeAlgo ? [
+                        challengeAlgo
+                    ] : [], token_endpoint_auth_methods_supported: [
+                        'client_secret_post'
+                    ] }, this.openidConfiguration);
+            }
+        });
+        t.route({
+            path: this.jwksRoute.path,
+            method: 'GET',
+            options: {
+                plugins: {
+                    kaapi: {
+                        docs: false
+                    }
+                }
+            },
+            handler: (req, h) => tslib_1.__awaiter(this, void 0, void 0, function* () {
+                const jwks = yield this.jwksGenerator.get();
+                if (this.jwksRoute.handler) {
+                    return this.jwksRoute.handler({
+                        jwks
+                    }, req, h);
+                }
+                return jwks;
+            })
+        });
+        t.route({
+            path: this.userInfoRoute.path,
+            method: 'GET',
+            options: {
+                auth: {
+                    strategy: this.strategyName,
+                    mode: 'required'
+                },
+                plugins: {
+                    kaapi: {
+                        docs: false
+                    }
+                }
+            },
+            handler: this.userInfoRoute.handler.bind(this.userInfoRoute)
+        });
+    }
+    docs() {
+        var _a;
+        const docs = new OpenIDAuthUtil(this.strategyName)
+            .setGrantType(this.isWithPkce() ? api_doc_generator_1.GrantType.authorizationCodeWithPkce : api_doc_generator_1.GrantType.authorizationCode)
+            .setScopes(this.getScopes())
+            .setAuthUrl(this.authorizationRoute.path)
+            .setAccessTokenUrl(this.tokenRoute.path || '')
+            .setChallengeAlgorithm(api_doc_generator_1.ChallengeAlgorithm.S256);
+        if ((_a = this.refreshTokenRoute) === null || _a === void 0 ? void 0 : _a.path) {
+            docs.setRefreshUrl(this.refreshTokenRoute.path);
+        }
+        if (this.description) {
+            docs.setDescription(this.description);
+        }
+        return docs;
+    }
+}
+exports.OpenIDAuthDesign = OpenIDAuthDesign;
+//#endregion OpenIDAuthDesign
+//# sourceMappingURL=open-id.js.map

package/lib/flows/auth-code.ts/open-id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-id.js","sourceRoot":"","sources":["../../../src/flows/auth-code.ts/open-id.ts"],"names":[],"mappings":";;;;AACA,kEAAuF;AACvF,gEAA6F;AAI7F,wBAAwB;AAExB,MAAa,cAAe,SAAQ,8BAAU;IAC1C,SAAS;QACL,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAA;QAC3B,OAAO;YACH,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE;gBACvB,IAAI,EAAE,eAAe;gBACrB,gBAAgB,EAAE,GAAG,IAAI,IAAI,EAAE,mCAAmC;aACrE;SACJ,CAAA;IACL,CAAC;CACJ;AAVD,wCAUC;AAuBD,MAAa,eAAe;IAMxB,IAAI,IAAI;QACJ,OAAO,IAAI,CAAC,KAAK,CAAA;IACrB,CAAC;IAED,IAAI,OAAO;QACP,OAAO,IAAI,CAAC,QAAQ,CAAA;IACxB,CAAC;IAED,YACI,IAAY,EACZ,OAAiC;QAEjC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;IAC5B,CAAC;CACJ;AArBD,0CAqBC;AAmBD,MAAa,mBAAmB;IAM5B,IAAI,IAAI;QACJ,OAAO,IAAI,CAAC,KAAK,CAAA;IACrB,CAAC;IAED,IAAI,OAAO;QACP,OAAO,IAAI,CAAC,QAAQ,CAAA;IACxB,CAAC;IAED,YACI,IAAY,EACZ,OAAoC;QAEpC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;IAC5B,CAAC;CACJ;AArBD,kDAqBC;AAmBD,MAAa,gBAAiB,SAAQ,6CAAuB;IASzD,YACI,MAA2B;QAE3B,MAAM,EAAE,YAAY,EAAE,mBAAmB,EAAE,SAAS,EAAE,aAAa,KAAe,MAAM,EAAhB,KAAK,kBAAK,MAAM,EAAlF,qEAAyE,CAAS,CAAA;QAExF,KAAK,CAAC,KAAK,CAAC,CAAA;QAPN,wBAAmB,GAA4B,EAAE,CAAA;QASvD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,YAAY,GAAG,YAAY,IAAI,qBAAqB,CAAA;QACzD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;QAC1B,IAAI,CAAC,aAAa,GAAG,aAAa,CAAA;QAElC,IAAI,mBAAmB;YACnB,IAAI,CAAC,mBAAmB,GAAG,mBAAmB,CAAA;IACtD,CAAC;IAED,SAAS;QACL,IAAI,MAAM,GAA2B;YACjC,MAAM,EAAE,uBAAuB;SAClC,CAAA;QACD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,IAAI,QAAQ,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC1B,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;YACxB,CAAC;iBAAM,CAAC;gBACJ,MAAM,mCAAQ,IAAI,CAAC,MAAM,GAAK,MAAM,CAAE,CAAA;YAC1C,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAA;IACjB,CAAC;IAED,aAAa,CAAC,CAAa;;QACvB,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAA;QAEtB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACxB,MAAM,aAAa,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAA;QAClD,MAAM,IAAI,GAAG,CAAA,MAAA,CAAC,CAAC,OAAO,0CAAE,OAAO,GAAG,CAAC,CAAC,KAAI,EAAE,CAAA;QAE1C,CAAC,CAAC,KAAK,CAAC;YACJ,IAAI,EAAE,mCAAmC;YACzC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACL,OAAO,EAAE;oBACL,KAAK,EAAE;wBACH,IAAI,EAAE,KAAK;qBACd;iBACJ;aACJ;YACD,OAAO,EAAE,GAAG,EAAE;gBACV,uBACI,MAAM,EAAE,IAAI,EACZ,sBAAsB,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,EAChE,cAAc,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAChD,iBAAiB,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,EACtD,QAAQ,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EACzC,gBAAgB,EAAE;wBACd,KAAK;wBACL,KAAK;wBACL,KAAK;wBACL,KAAK;wBACL,KAAK;qBACR,EACD,qBAAqB,EAAE;wBACnB,oBAAoB;qBACvB,EACD,wBAAwB,EAAE;wBACtB,MAAM;wBACN,OAAO;wBACP,YAAY;wBACZ,qBAAqB;qBACxB,EACD,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,EAC/C,uBAAuB,EAAE;wBACrB,QAAQ;qBACX,EACD,qCAAqC,EAAE;wBACnC,OAAO;qBACV,EACD,gCAAgC,EAAE,aAAa,CAAC,CAAC,CAAC;wBAC9C,aAAa;qBAChB,CAAC,CAAC,CAAC,EAAE,EACN,qCAAqC,EAAE;wBACnC,oBAAoB;qBACvB,IACE,IAAI,CAAC,mBAAmB,EAC9B;YACL,CAAC;SACJ,CAAC,CAAA;QAEF,CAAC,CAAC,KAAK,CAAC;YACJ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI;YACzB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACL,OAAO,EAAE;oBACL,KAAK,EAAE;wBACH,IAAI,EAAE,KAAK;qBACd;iBACJ;aACJ;YACD,OAAO,EAAE,CAAO,GAAG,EAAE,CAAC,EAAE,EAAE;gBAEtB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,EAAU,CAAA;gBAEnD,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;oBACzB,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;wBAC1B,IAAI;qBACP,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;gBACd,CAAC;gBAED,OAAO,IAAI,CAAA;YACf,CAAC,CAAA;SACJ,CAAC,CAAA;QAEF,CAAC,CAAC,KAAK,CAAC;YACJ,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI;YAC7B,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACL,IAAI,EAAE;oBACF,QAAQ,EAAE,IAAI,CAAC,YAAY;oBAC3B,IAAI,EAAE,UAAU;iBACnB;gBACD,OAAO,EAAE;oBACL,KAAK,EAAE;wBACH,IAAI,EAAE,KAAK;qBACd;iBACJ;aACJ;YACD,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;SAC/D,CAAC,CAAA;IACN,CAAC;IAED,IAAI;;QACA,MAAM,IAAI,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC;aAC7C,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,6BAAS,CAAC,yBAAyB,CAAC,CAAC,CAAC,6BAAS,CAAC,iBAAiB,CAAC;aACnG,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;aAC3B,UAAU,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC;aACxC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC;aAC7C,qBAAqB,CAAC,sCAAkB,CAAC,IAAI,CAAC,CAAC;QAEpD,IAAI,MAAA,IAAI,CAAC,iBAAiB,0CAAE,IAAI,EAAE,CAAC;YAC/B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAA;QACnD,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACzC,CAAC;QAED,OAAO,IAAI,CAAA;IACf,CAAC;CACJ;AA7JD,4CA6JC;AAED,6BAA6B"}

package/lib/flows/authentication-code.d.ts

@@ -0,0 +1,53 @@
+import { KaapiTools } from '@kaapi/kaapi';
+import { OAuth2Util } from '@novice1/api-doc-generator';
+import { IOAuth2RefreshTokenRoute, OAuth2WithJWKSAuthDesign, OAuth2AuthOptions } from './common';
+import { JWKSStore } from '../utils/jwks-store';
+import { IOAuth2ACAuthorizationRoute } from './auth-code/authorization-route';
+import { IOAuth2ACTokenRoute } from './auth-code/token-route';
+export interface OAuth2AuthorizationCodeArg {
+    authorizationRoute: IOAuth2ACAuthorizationRoute<any, any>;
+    tokenRoute: IOAuth2ACTokenRoute<any>;
+    refreshTokenRoute?: IOAuth2RefreshTokenRoute<any>;
+    options?: OAuth2AuthOptions;
+    strategyName?: string;
+    jwksStore?: JWKSStore;
+}
+export declare class OAuth2AuthorizationCode extends OAuth2WithJWKSAuthDesign {
+    protected strategyName: string;
+    protected description?: string;
+    protected scopes?: Record<string, string>;
+    protected options: OAuth2AuthOptions;
+    protected pkce: boolean;
+    protected clientAuthenticationMethods: {
+        header: boolean;
+        body: boolean;
+    };
+    protected authorizationRoute: IOAuth2ACAuthorizationRoute<any, any>;
+    protected tokenRoute: IOAuth2ACTokenRoute<any>;
+    protected refreshTokenRoute?: IOAuth2RefreshTokenRoute<any>;
+    constructor({ authorizationRoute, tokenRoute, refreshTokenRoute, options, strategyName, jwksStore }: OAuth2AuthorizationCodeArg);
+    withPkce(): this;
+    withoutPkce(): this;
+    isWithPkce(): boolean;
+    noneAuthenticationMethod(): this;
+    setDescription(description: string): this;
+    /**
+     *
+     * @param scopes The scopes of the access request.
+     * A map between the scope name and a short description for it. The map MAY be empty.
+     * @returns
+     */
+    setScopes(scopes: Record<string, string>): this;
+    getScopes(): Record<string, string> | undefined;
+    getStrategyName(): string;
+    getDescription(): string | undefined;
+    /**
+     * Returns the schema used for the documentation
+     */
+    docs(): OAuth2Util;
+    /**
+     * Where authentication schemes and strategies are registered.
+     */
+    integrateStrategy(t: KaapiTools): void;
+    integrateHook(t: KaapiTools): void;
+}

package/lib/flows/authentication-code.js

@@ -0,0 +1,380 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuth2AuthorizationCode = void 0;
+const tslib_1 = require("tslib");
+const api_doc_generator_1 = require("@novice1/api-doc-generator");
+const boom_1 = tslib_1.__importDefault(require("@hapi/boom"));
+const hoek_1 = tslib_1.__importDefault(require("@hapi/hoek"));
+const common_1 = require("./common");
+const jwks_generator_1 = require("../utils/jwks-generator");
+class OAuth2AuthorizationCode extends common_1.OAuth2WithJWKSAuthDesign {
+    constructor({ authorizationRoute, tokenRoute, refreshTokenRoute, options, strategyName, jwksStore }) {
+        super(jwksStore);
+        this.pkce = false;
+        this.clientAuthenticationMethods = {
+            header: false,
+            body: false
+        };
+        this.authorizationRoute = authorizationRoute;
+        this.tokenRoute = tokenRoute;
+        this.refreshTokenRoute = refreshTokenRoute;
+        this.strategyName = strategyName || 'oauth2-authorization-code';
+        this.options = options ? Object.assign({}, options) : {};
+    }
+    withPkce() {
+        this.pkce = true;
+        return super.noneAuthenticationMethod();
+    }
+    withoutPkce() {
+        this.pkce = false;
+        this._clientAuthMethods.none = undefined;
+        return this;
+    }
+    isWithPkce() {
+        return this.pkce;
+    }
+    noneAuthenticationMethod() {
+        return this.withPkce();
+    }
+    setDescription(description) {
+        this.description = description;
+        return this;
+    }
+    /**
+     *
+     * @param scopes The scopes of the access request.
+     * A map between the scope name and a short description for it. The map MAY be empty.
+     * @returns
+     */
+    setScopes(scopes) {
+        this.scopes = scopes;
+        return this;
+    }
+    getScopes() {
+        return this.scopes;
+    }
+    getStrategyName() {
+        return this.strategyName;
+    }
+    getDescription() {
+        return this.description;
+    }
+    /**
+     * Returns the schema used for the documentation
+     */
+    docs() {
+        var _a;
+        const docs = new api_doc_generator_1.OAuth2Util(this.strategyName)
+            .setGrantType(this.isWithPkce() ? api_doc_generator_1.GrantType.authorizationCodeWithPkce : api_doc_generator_1.GrantType.authorizationCode)
+            .setScopes(this.getScopes() || {})
+            .setAuthUrl(this.authorizationRoute.path)
+            .setAccessTokenUrl(this.tokenRoute.path || '');
+        const supported = this.getTokenEndpointAuthMethods();
+        if (supported.includes('client_secret_post')) {
+            docs.setChallengeAlgorithm(api_doc_generator_1.ClientAuthentication.body);
+        }
+        else if (supported.includes('client_secret_basic')) {
+            docs.setChallengeAlgorithm(api_doc_generator_1.ClientAuthentication.header);
+        }
+        if ((_a = this.refreshTokenRoute) === null || _a === void 0 ? void 0 : _a.path) {
+            docs.setRefreshUrl(this.refreshTokenRoute.path);
+        }
+        if (this.description) {
+            docs.setDescription(this.description);
+        }
+        return docs;
+    }
+    /**
+     * Where authentication schemes and strategies are registered.
+     */
+    integrateStrategy(t) {
+        const tokenTypePrefix = this.tokenType;
+        const tokenTypeInstance = this._tokenType;
+        t.scheme(this.strategyName, (_server, options) => {
+            return {
+                authenticate(request, h) {
+                    return tslib_1.__awaiter(this, void 0, void 0, function* () {
+                        var _a;
+                        const settings = hoek_1.default.applyToDefaults({}, options || {});
+                        const authorization = request.raw.req.headers.authorization;
+                        const authSplit = authorization ? authorization.split(/\s+/) : ['', ''];
+                        const tokenType = authSplit[0];
+                        let token = authSplit[1];
+                        if (tokenType.toLowerCase() !== tokenTypePrefix.toLowerCase()) {
+                            token = '';
+                            return boom_1.default.unauthorized(null, tokenTypePrefix);
+                        }
+                        if (!(yield tokenTypeInstance.isValid(request, token)).isValid) {
+                            return boom_1.default.unauthorized(null, tokenTypePrefix);
+                        }
+                        if (settings.validate) {
+                            try {
+                                const result = yield ((_a = settings.validate) === null || _a === void 0 ? void 0 : _a.call(settings, request, token, h));
+                                if (result && 'isAuth' in result) {
+                                    return result;
+                                }
+                                if (result && 'isBoom' in result) {
+                                    return result;
+                                }
+                                if (result) {
+                                    const { isValid, credentials, artifacts, message } = result;
+                                    if (isValid && credentials) {
+                                        return h.authenticated({ credentials, artifacts });
+                                    }
+                                    if (message) {
+                                        return h.unauthenticated(boom_1.default.unauthorized(message, tokenTypePrefix), {
+                                            credentials: credentials || {},
+                                            artifacts
+                                        });
+                                    }
+                                }
+                            }
+                            catch (err) {
+                                return boom_1.default.internal(err instanceof Error ? err : `${err}`);
+                            }
+                        }
+                        return boom_1.default.unauthorized(null, tokenTypePrefix);
+                    });
+                },
+            };
+        });
+        t.strategy(this.strategyName, this.strategyName, this.options);
+    }
+    integrateHook(t) {
+        var _a;
+        const hasOpenIDScope = () => { var _a; return typeof ((_a = this.getScopes()) === null || _a === void 0 ? void 0 : _a['openid']) != 'undefined'; };
+        const tokenTypeInstance = this._tokenType;
+        const supported = this.getTokenEndpointAuthMethods();
+        const authMethodsInstances = this.clientAuthMethods;
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const routesOptions = {
+            plugins: {
+                kaapi: {
+                    docs: false
+                }
+            }
+        };
+        t
+            .route({
+            options: routesOptions,
+            path: this.authorizationRoute.path,
+            method: ['GET', 'POST'],
+            handler: (req, h) => tslib_1.__awaiter(this, void 0, void 0, function* () {
+                // validating query
+                if (req.query.client_id && typeof req.query.client_id === 'string' &&
+                    req.query.response_type === 'code' &&
+                    req.query.redirect_uri && typeof req.query.redirect_uri === 'string') {
+                    const params = {
+                        clientId: req.query.client_id,
+                        redirectUri: req.query.redirect_uri,
+                        responseType: req.query.response_type
+                    };
+                    if (req.query.scope && typeof req.query.scope === 'string') {
+                        params.scope = req.query.scope;
+                    }
+                    if (req.query.state && typeof req.query.state === 'string') {
+                        params.state = req.query.state;
+                    }
+                    if (req.query.code_challenge && typeof req.query.code_challenge === 'string') {
+                        params.codeChallenge = req.query.code_challenge;
+                    }
+                    if (req.query.nonce && typeof req.query.nonce === 'string') {
+                        params.nonce = req.query.nonce;
+                    }
+                    if (req.method.toLowerCase() === 'get') {
+                        return this.authorizationRoute.handler(params, req, h);
+                    }
+                    else {
+                        return this.authorizationRoute.postHandler(params, req, h);
+                    }
+                }
+                else {
+                    let errorDescription = '';
+                    if (!(req.query.client_id && typeof req.query.client_id === 'string')) {
+                        errorDescription = 'Request was missing the \'client_id\' parameter.';
+                    }
+                    else if (!(req.query.response_type === 'code')) {
+                        errorDescription = `Request does not support the 'response_type' '${req.query.response_type}'.`;
+                    }
+                    else if (!(req.query.redirect_uri && typeof req.query.redirect_uri === 'string')) {
+                        errorDescription = 'Request was missing the \'redirect_uri\' parameter.';
+                    }
+                    return h.response({ error: 'invalid_request', error_description: errorDescription }).code(400);
+                }
+            })
+        })
+            .route({
+            options: routesOptions,
+            path: this.tokenRoute.path,
+            method: 'POST',
+            handler: (req, h) => tslib_1.__awaiter(this, void 0, void 0, function* () {
+                var _a, _b;
+                // Grant validation
+                const supportedGrants = ['authorization_code'];
+                if (this.tokenRoute.path == ((_a = this.refreshTokenRoute) === null || _a === void 0 ? void 0 : _a.path)) {
+                    supportedGrants.push('refresh_token');
+                }
+                if (!(typeof req.payload.grant_type === 'string' && supportedGrants.includes(req.payload.grant_type))) {
+                    return h.response({ error: 'unsupported_grant_type', error_description: `Request does not support the 'grant_type' '${req.payload.grant_type}'.` }).code(400);
+                }
+                // Client authentication is present?
+                const { clientId, clientSecret, error, errorDescription } = yield this._extractClientParams(req, authMethodsInstances, supported);
+                if (error) {
+                    return h.response({ error: error, error_description: errorDescription || undefined }).code(400);
+                }
+                if (!clientId) {
+                    return h
+                        .response({
+                        error: 'invalid_request',
+                        error_description: `Supported token endpoint authentication methods: ${supported.join(', ')}`
+                    }).code(400);
+                }
+                if (clientId &&
+                    req.payload.code && typeof req.payload.code === 'string' &&
+                    req.payload.grant_type === 'authorization_code') {
+                    const params = {
+                        clientId,
+                        grantType: req.payload.grant_type,
+                        code: req.payload.code,
+                        ttl: this.jwksGenerator.ttl,
+                        createIDToken: hasOpenIDScope() ? ((payload) => tslib_1.__awaiter(this, void 0, void 0, function* () {
+                            var _a;
+                            return yield (0, jwks_generator_1.createIDToken)(this.jwksGenerator, Object.assign({ aud: clientId, iss: ((_a = t.postman) === null || _a === void 0 ? void 0 : _a.getHost()[0]) || '' }, payload));
+                        })) : undefined
+                    };
+                    if (clientSecret) {
+                        params.clientSecret = clientSecret;
+                    }
+                    if (req.payload.code_verifier && typeof req.payload.code_verifier === 'string') {
+                        params.codeVerifier = req.payload.code_verifier;
+                    }
+                    if (req.payload.redirect_uri && typeof req.payload.redirect_uri === 'string') {
+                        params.redirectUri = req.payload.redirect_uri;
+                    }
+                    const ttR = tokenTypeInstance.isValidTokenRequest ? (yield tokenTypeInstance.isValidTokenRequest(req)) : { isValid: true };
+                    if (!ttR.isValid) {
+                        return h.response({ error: 'invalid_request', error_description: ttR.message || '' }).code(400);
+                    }
+                    return this.tokenRoute.handler(params, req, h);
+                }
+                else if (this.tokenRoute.path == ((_b = this.refreshTokenRoute) === null || _b === void 0 ? void 0 : _b.path) &&
+                    req.payload.grant_type === 'refresh_token') {
+                    const hasRefreshToken = req.payload.refresh_token && typeof req.payload.refresh_token === 'string';
+                    if (clientId &&
+                        hasRefreshToken) {
+                        const params = {
+                            clientId,
+                            grantType: req.payload.grant_type,
+                            refreshToken: `${req.payload.refresh_token}`,
+                            ttl: this.jwksGenerator.ttl,
+                            createIDToken: hasOpenIDScope() ? ((payload) => tslib_1.__awaiter(this, void 0, void 0, function* () {
+                                var _a;
+                                return yield (0, jwks_generator_1.createIDToken)(this.jwksGenerator, Object.assign({ aud: clientId, iss: ((_a = t.postman) === null || _a === void 0 ? void 0 : _a.getHost()[0]) || '' }, payload));
+                            })) : undefined
+                        };
+                        if (clientSecret) {
+                            params.clientSecret = clientSecret;
+                        }
+                        if (req.payload.scope && typeof req.payload.scope === 'string') {
+                            params.scope = req.payload.scope;
+                        }
+                        return this.refreshTokenRoute.handler(params, req, h);
+                    }
+                    else {
+                        let error = 'unauthorized_client';
+                        let errorDescription = '';
+                        if (!clientId) {
+                            error = 'invalid_request';
+                            errorDescription = 'Request was missing the \'client_id\' parameter.';
+                        }
+                        else if (!(req.payload.refresh_token && typeof req.payload.refresh_token === 'string')) {
+                            error = 'invalid_request';
+                            errorDescription = 'Request was missing the \'refresh_token\' parameter.';
+                        }
+                        return h.response({ error, error_description: errorDescription }).code(400);
+                    }
+                }
+                else {
+                    let error = 'unauthorized_client';
+                    let errorDescription = '';
+                    if (!clientId) {
+                        error = 'invalid_request';
+                        errorDescription = 'Request was missing the \'client_id\' parameter.';
+                    }
+                    else if (!(req.payload.code && typeof req.payload.code === 'string')) {
+                        error = 'invalid_request';
+                        errorDescription = 'Request was missing the \'code\' parameter.';
+                    }
+                    return h.response({ error, error_description: errorDescription }).code(400);
+                }
+            })
+        });
+        // refreshToken
+        if (((_a = this.refreshTokenRoute) === null || _a === void 0 ? void 0 : _a.path) && this.refreshTokenRoute.path != this.tokenRoute.path) {
+            t.route({
+                options: routesOptions,
+                path: this.refreshTokenRoute.path,
+                method: 'POST',
+                handler: (req, h) => tslib_1.__awaiter(this, void 0, void 0, function* () {
+                    var _a;
+                    // Grant validation
+                    const supportedGrants = ['refresh_token'];
+                    if (!(typeof req.payload.grant_type === 'string' && supportedGrants.includes(req.payload.grant_type))) {
+                        return h.response({ error: 'unsupported_grant_type', error_description: `Request does not support the 'grant_type' '${req.payload.grant_type}'.` }).code(400);
+                    }
+                    // Client authentication is present?
+                    const { clientId, clientSecret, error, errorDescription } = yield this._extractClientParams(req, authMethodsInstances, supported);
+                    if (error) {
+                        return h.response({ error: error, error_description: errorDescription || undefined }).code(400);
+                    }
+                    if (!clientId) {
+                        return h
+                            .response({
+                            error: 'invalid_request',
+                            error_description: `Supported token endpoint authentication methods: ${supported.join(', ')}`
+                        }).code(400);
+                    }
+                    const hasRefreshToken = req.payload.refresh_token && typeof req.payload.refresh_token === 'string';
+                    const isRefreshTokenGrantType = req.payload.grant_type === 'refresh_token';
+                    if (clientId &&
+                        hasRefreshToken &&
+                        isRefreshTokenGrantType) {
+                        const params = {
+                            clientId,
+                            grantType: `${req.payload.grant_type}`,
+                            refreshToken: `${req.payload.refresh_token}`,
+                            ttl: this.jwksGenerator.ttl,
+                            createIDToken: hasOpenIDScope() ? ((payload) => tslib_1.__awaiter(this, void 0, void 0, function* () {
+                                var _a;
+                                return yield (0, jwks_generator_1.createIDToken)(this.jwksGenerator, Object.assign({ aud: clientId, iss: ((_a = t.postman) === null || _a === void 0 ? void 0 : _a.getHost()[0]) || '' }, payload));
+                            })) : undefined
+                        };
+                        if (clientSecret) {
+                            params.clientSecret = clientSecret;
+                        }
+                        if (req.payload.scope && typeof req.payload.scope === 'string') {
+                            params.scope = req.payload.scope;
+                        }
+                        return (_a = this.refreshTokenRoute) === null || _a === void 0 ? void 0 : _a.handler(params, req, h);
+                    }
+                    else {
+                        let error = 'unauthorized_client';
+                        let errorDescription = '';
+                        if (!clientId) {
+                            error = 'invalid_request';
+                            errorDescription = 'Request was missing the \'client_id\' parameter.';
+                        }
+                        else if (!(req.payload.refresh_token && typeof req.payload.refresh_token === 'string')) {
+                            error = 'invalid_request';
+                            errorDescription = 'Request was missing the \'refresh_token\' parameter.';
+                        }
+                        return h.response({ error, error_description: errorDescription }).code(400);
+                    }
+                })
+            });
+        }
+    }
+}
+exports.OAuth2AuthorizationCode = OAuth2AuthorizationCode;
+//#endregion OAuth2AuthorizationCode
+//# sourceMappingURL=authentication-code.js.map