@kaapi/oauth2-auth-design 0.0.14 → 0.0.15

package/kaukau.config.mjs

@@ -0,0 +1,20 @@
+import { defineConfig } from 'kaukau/config'
+
+export default defineConfig({
+  enableLogs: true,
+  exitOnFail: true,
+  files: 'test/',
+  ext: '.test.ts',
+  options: {
+    bail: false,
+    fullTrace: true,
+    grep: '',
+    ignoreLeaks: false,
+    reporter: 'spec',
+    retries: 0,
+    slow: 10000,
+    timeout: 30000,
+    ui: 'bdd',
+    color: true,
+  }
+});

package/lib/cli.js

@@ -70,10 +70,10 @@ export const ${tslib_1.__classPrivateFieldGet(this, _OAuth2FileGenerator_values,
             }),
         tokenRoute: OAuth2ACTokenRoute.buildDefault()
             .setPath('/oauth2/token')
-            .generateToken(async ({ clientId, clientSecret, code, codeVerifier, redirectUri, ttl, createIDToken }, _req) => {
+            .generateToken(async ({ clientId, clientSecret, code, codeVerifier, redirectUri, ttl, createIdToken }, _req) => {
 
                 if (!clientSecret && !codeVerifier) {
-                    return { error: 'invalid_request', error_description: 'Token Request was missing the \\'client_secret\\' parameter.' }
+                    return { error:  OAuth2ErrorCode.INVALID_REQUEST, error_description: 'Token Request was missing the \\'client_secret\\' parameter.' }
                 }
                 try {
                     //#region @TODO: validation + token
@@ -84,8 +84,8 @@ export const ${tslib_1.__classPrivateFieldGet(this, _OAuth2FileGenerator_values,
                         .setExpiresIn(ttl)
                         .setRefreshToken(refreshToken)
                         .setScope(scope)
-                        .setIDToken(
-                            await createIDToken?.({
+                        .setIdToken(
+                            await createIdToken?.({
                                 sub: '248289761001',
                                 name: 'Jane Doe',
                                 given_name: 'Jane',
@@ -112,11 +112,11 @@ export const ${tslib_1.__classPrivateFieldGet(this, _OAuth2FileGenerator_values,
 
                 //#endregion @TODO: validation + refresh token
 
-                return h.response({ error: 'invalid_token' }).code(400)
+                return h.response({ error: OAuth2ErrorCode.INVALID_GRANT }).code(400)
             }) as OAuth2RefreshTokenHandler,
         ),
         options: {
-            async validate(req, token, h) {
+            async validate(req, { token }, h) {
                 if (token) {
                     //#region @TODO: validation
                     if (token != 'generated_access_token') {

package/lib/flows/auth-code/authorization-route.d.ts

@@ -1,5 +1,5 @@
 import { Lifecycle, ReqRef, ReqRefDefaults, Request, ResponseToolkit } from '@kaapi/kaapi';
-import { OAuth2Error, PathValue } from '../common';
+import { AnyOAuth2ErrorCodeType, PathValue } from '../common';
 export interface OAuth2ACAuthorizationParams {
     clientId: string;
     responseType: string;
@@ -25,27 +25,78 @@ export declare class OAuth2ACAuthorizationRoute<GetRefs extends ReqRef = ReqRefD
     get postHandler(): OAuth2ACAuthorizationHandler<PostRefs, Lifecycle.ReturnValue<PostRefs>>;
     constructor(path: string, handler: OAuth2ACAuthorizationHandler<GetRefs>, postHandler: OAuth2ACAuthorizationHandler<PostRefs>);
 }
-export type AuthErrorType = OAuth2Error | 'credentials' | 'unknown';
-export type AuthResponseRenderer<Refs extends ReqRef = ReqRefDefaults> = (reason: {
-    code: number;
+export type AuthResponseRenderer<Refs extends ReqRef = ReqRefDefaults> = (context: {
+    statusCode: number;
     emailField: string;
     passwordField: string;
-    error?: AuthErrorType;
+    error?: AnyOAuth2ErrorCodeType;
     errorMessage?: string;
-}, params: OAuth2ACAuthorizationParams, req: Request<Refs>) => Promise<string | object> | string | object;
+}, params: OAuth2ACAuthorizationParams, req: Request<Refs>, h: ResponseToolkit<Refs>) => Promise<string | object> | string | object;
+export type AuthCodeGeneratorResult = {
+    type: 'code';
+    value: string;
+} | {
+    type: 'continue';
+    value?: unknown;
+} | {
+    type: 'deny';
+    value?: unknown;
+};
 /**
  * Return null for invalid code
  */
-export type AuthCodeGenerator<Refs extends ReqRef = ReqRefDefaults> = (params: OAuth2ACAuthorizationParams, req: Request<Refs>) => Promise<string | null> | string | null;
+export type AuthCodeGenerator<Refs extends ReqRef = ReqRefDefaults> = (params: OAuth2ACAuthorizationParams, req: Request<Refs>, h: ResponseToolkit<Refs>) => Promise<AuthCodeGeneratorResult | null> | AuthCodeGeneratorResult | null;
+export type AuthResponseHandler<Refs extends ReqRef = ReqRefDefaults, R extends Lifecycle.ReturnValue<any> = Lifecycle.ReturnValue<Refs>> = (context: {
+    authorizationResult: AuthCodeGeneratorResult;
+    emailField: string;
+    passwordField: string;
+    /**
+     * The full redirect URI that the user should be sent to after authorization.
+     * This URL includes the appropriate query parameters based on the outcome —
+     * either an authorization `code` (on success) or `error`/`error_description` (on failure).
+     *
+     * Automatically constructed from the original `redirect_uri` and the `authorizationResult`.
+     */
+    fullRedirectUri: string;
+}, params: OAuth2ACAuthorizationParams, req: Request<Refs>, h: ResponseToolkit<Refs>) => R;
 export declare class DefaultOAuth2ACAuthorizationRoute<GetRefs extends ReqRef = ReqRefDefaults, PostRefs extends ReqRef = ReqRefDefaults> extends OAuth2ACAuthorizationRoute<GetRefs, PostRefs> {
     #private;
     constructor();
+    /**
+     * Creates a new `DefaultOAuth2ACAuthorizationRoute` instance from the provided configuration.
+     */
+    static fromConfig<GetRefs extends ReqRef = ReqRefDefaults, PostRefs extends ReqRef = ReqRefDefaults>(config: {
+        path?: PathValue;
+        clientId?: string;
+        redirectUri?: string;
+        emailField?: string;
+        passwordField?: string;
+        codeGenerator?: AuthCodeGenerator<PostRefs>;
+        responseRenderer?: AuthResponseRenderer<GetRefs>;
+        postResponseRenderer?: AuthResponseRenderer<PostRefs>;
+        finalizeAuthorization?: AuthResponseHandler<PostRefs>;
+    }): DefaultOAuth2ACAuthorizationRoute<GetRefs, PostRefs>;
+    private validateClientParams;
     setPath(path: PathValue): this;
     validateGET(handler: OAuth2ACAuthorizationHandler<GetRefs>): this;
     validatePOST(handler: OAuth2ACAuthorizationHandler<PostRefs>): this;
     setGETResponseRenderer(renderer: AuthResponseRenderer<GetRefs>): this;
     setPOSTResponseRenderer(renderer: AuthResponseRenderer<PostRefs>): this;
     generateCode(handler: AuthCodeGenerator<PostRefs>): this;
+    /**
+     *
+     * finalizeAuthorization() is called after the authorization code is generated.
+     *
+     * It must redirect the user back to the client's redirect_uri, or respond with an OAuth2 error.
+     *
+     * example:
+     * ```ts
+     * route.finalizeAuthorization(async (ctx, params, req, h) => {
+     *   return h.redirect(ctx.fullRedirectUri)
+     * })
+     * ```
+     */
+    finalizeAuthorization(handler: AuthResponseHandler<PostRefs>): this;
     setClientId(value: string | null): this;
     setRedirectUri(value: string | null): this;
     setEmailField(value: string): this;

package/lib/flows/auth-code/authorization-route.js

@@ -1,9 +1,10 @@
 "use strict";
-var _DefaultOAuth2ACAuthorizationRoute_clientId, _DefaultOAuth2ACAuthorizationRoute_redirectUri, _DefaultOAuth2ACAuthorizationRoute_emailField, _DefaultOAuth2ACAuthorizationRoute_passwordField, _DefaultOAuth2ACAuthorizationRoute_generateCode, _DefaultOAuth2ACAuthorizationRoute_renderResponse, _DefaultOAuth2ACAuthorizationRoute_renderPOSTResponse;
+var _DefaultOAuth2ACAuthorizationRoute_clientId, _DefaultOAuth2ACAuthorizationRoute_redirectUri, _DefaultOAuth2ACAuthorizationRoute_emailField, _DefaultOAuth2ACAuthorizationRoute_passwordField, _DefaultOAuth2ACAuthorizationRoute_generateCode, _DefaultOAuth2ACAuthorizationRoute_renderResponse, _DefaultOAuth2ACAuthorizationRoute_renderPOSTResponse, _DefaultOAuth2ACAuthorizationRoute_authorizationResponseHandler;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DefaultOAuth2ACAuthorizationRoute = exports.OAuth2ACAuthorizationRoute = void 0;
 const tslib_1 = require("tslib");
 const html_entities_1 = require("html-entities");
+const common_1 = require("../common");
 class OAuth2ACAuthorizationRoute {
     static buildDefault() {
         return new DefaultOAuth2ACAuthorizationRoute();
@@ -63,80 +64,93 @@ const render = ({ error, errorMessage, emailField, passwordField }) => {
  </body>
 </html>`;
 };
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+const authResponseHandler = (ctx, _params, _req, h) => tslib_1.__awaiter(void 0, void 0, void 0, function* () {
+    return h.redirect(`${ctx.fullRedirectUri}`);
+});
+function buildRedirectUri(base, params) {
+    const searchParams = new URLSearchParams();
+    for (const [key, value] of Object.entries(params)) {
+        if (value !== undefined && value !== null) {
+            searchParams.append(key, value);
+        }
+    }
+    return `${base}?${searchParams.toString()}`;
+}
 class DefaultOAuth2ACAuthorizationRoute extends OAuth2ACAuthorizationRoute {
     constructor() {
         super('/oauth2/authorize', (_a, req, h) => tslib_1.__awaiter(this, void 0, void 0, function* () {
             var { clientId, redirectUri } = _a, props = tslib_1.__rest(_a, ["clientId", "redirectUri"]);
-            if (tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_clientId, "f") && tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_clientId, "f") != clientId) {
-                return h.response(yield tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_renderResponse, "f").call(this, {
-                    emailField: tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_emailField, "f"),
-                    passwordField: tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_passwordField, "f"),
-                    code: 400,
-                    error: 'invalid_client',
-                    errorMessage: 'Bad \'client_id\' parameter'
-                }, Object.assign({ clientId, redirectUri }, props), req)).code(400);
-            }
-            if (tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_redirectUri, "f") && tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_redirectUri, "f") != redirectUri) {
-                return h.response(yield tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_renderResponse, "f").call(this, {
-                    emailField: tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_emailField, "f"),
-                    passwordField: tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_passwordField, "f"),
-                    code: 400,
-                    error: 'invalid_client',
-                    errorMessage: 'Bad \'redirect_uri\' parameter'
-                }, Object.assign({ clientId, redirectUri }, props), req)).code(400);
-            }
+            const validationError = yield this.validateClientParams(clientId, redirectUri, Object.assign({ clientId, redirectUri }, props), req, h, tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_renderResponse, "f"));
+            if (validationError)
+                return validationError;
             // render form
             return h.response(yield tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_renderResponse, "f").call(this, {
                 emailField: tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_emailField, "f"),
                 passwordField: tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_passwordField, "f"),
-                code: 200
-            }, Object.assign({ clientId, redirectUri }, props), req)).code(200);
+                statusCode: 200
+            }, Object.assign({ clientId, redirectUri }, props), req, h)).code(200);
         }), (props, req, h) => tslib_1.__awaiter(this, void 0, void 0, function* () {
-            if (tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_clientId, "f") && tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_clientId, "f") != props.clientId) {
-                return h.response(yield tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_renderPOSTResponse, "f").call(this, {
-                    emailField: tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_emailField, "f"),
-                    passwordField: tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_passwordField, "f"),
-                    code: 400,
-                    error: 'invalid_client',
-                    errorMessage: 'Bad \'client_id\' parameter'
-                }, props, req)).code(400);
-            }
-            if (tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_redirectUri, "f") && tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_redirectUri, "f") != props.redirectUri) {
-                return h.response(yield tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_renderPOSTResponse, "f").call(this, {
-                    emailField: tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_emailField, "f"),
-                    passwordField: tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_passwordField, "f"),
-                    code: 400,
-                    error: 'invalid_client',
-                    errorMessage: 'Bad \'redirect_uri\' parameter'
-                }, props, req)).code(400);
-            }
-            let error = 'unknown';
-            let errorMessage = 'someting went wrong';
+            var _a, _b, _c;
+            const validationError = yield this.validateClientParams(props.clientId, props.redirectUri, props, req, h, tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_renderResponse, "f"));
+            if (validationError)
+                return validationError;
+            let error = common_1.OAuth2ErrorCode.SERVER_ERROR;
+            let errorMessage = 'something went wrong';
             if (props.clientId &&
                 req.payload &&
                 typeof req.payload === 'object' &&
-                tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_emailField, "f") in req.payload &&
-                tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_passwordField, "f") in req.payload) {
-                const code = yield tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_generateCode, "f").call(this, props, req);
+                !Array.isArray(req.payload) /*&&
+            this.#emailField in req.payload &&
+            this.#passwordField in req.payload
+            */) {
+                const code = yield tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_generateCode, "f").call(this, props, req, h);
                 if (code) {
-                    return h.redirect(`${props.redirectUri}?code=${code}${props.state ? `&state=${props.state}` : ''}`);
+                    let fullRedirectUri = '';
+                    if (code.type === 'code' && code.value) {
+                        fullRedirectUri = buildRedirectUri(props.redirectUri, {
+                            code: code.value,
+                            state: (_a = props.state) !== null && _a !== void 0 ? _a : ''
+                        });
+                    }
+                    else if (code.type === 'deny') {
+                        fullRedirectUri = buildRedirectUri(props.redirectUri, {
+                            error: common_1.OAuth2ErrorCode.ACCESS_DENIED,
+                            error_description: 'User denied consent',
+                            state: (_b = props.state) !== null && _b !== void 0 ? _b : ''
+                        });
+                    }
+                    else {
+                        fullRedirectUri = buildRedirectUri(props.redirectUri, {
+                            error: common_1.OAuth2ErrorCode.INVALID_REQUEST,
+                            error_description: 'No code',
+                            state: (_c = props.state) !== null && _c !== void 0 ? _c : ''
+                        });
+                    }
+                    return tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_authorizationResponseHandler, "f").call(this, {
+                        authorizationResult: code,
+                        emailField: tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_emailField, "f"),
+                        passwordField: tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_passwordField, "f"),
+                        fullRedirectUri
+                    }, props, req, h);
                 }
                 else {
-                    error = 'credentials';
+                    error = common_1.OAuth2ErrorCode.ACCESS_DENIED;
                     errorMessage = 'wrong credentials';
                 }
             }
             else {
-                error = 'invalid_request';
+                error = common_1.OAuth2ErrorCode.INVALID_REQUEST;
+                errorMessage = 'Missing or invalid request payload';
             }
             // render form
             return h.response(yield tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_renderPOSTResponse, "f").call(this, {
                 emailField: tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_emailField, "f"),
                 passwordField: tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_passwordField, "f"),
-                code: 400,
+                statusCode: 400,
                 error: error,
                 errorMessage
-            }, props, req)).code(400);
+            }, props, req, h)).code(400);
         }));
         _DefaultOAuth2ACAuthorizationRoute_clientId.set(this, void 0);
         _DefaultOAuth2ACAuthorizationRoute_redirectUri.set(this, void 0);
@@ -145,10 +159,66 @@ class DefaultOAuth2ACAuthorizationRoute extends OAuth2ACAuthorizationRoute {
         _DefaultOAuth2ACAuthorizationRoute_generateCode.set(this, void 0);
         _DefaultOAuth2ACAuthorizationRoute_renderResponse.set(this, void 0);
         _DefaultOAuth2ACAuthorizationRoute_renderPOSTResponse.set(this, void 0);
+        _DefaultOAuth2ACAuthorizationRoute_authorizationResponseHandler.set(this, void 0);
         // @TODO: generate id for user, store it in-memory, generate jwt code ?
         tslib_1.__classPrivateFieldSet(this, _DefaultOAuth2ACAuthorizationRoute_generateCode, () => tslib_1.__awaiter(this, void 0, void 0, function* () { return null; }), "f");
         tslib_1.__classPrivateFieldSet(this, _DefaultOAuth2ACAuthorizationRoute_renderResponse, render, "f");
         tslib_1.__classPrivateFieldSet(this, _DefaultOAuth2ACAuthorizationRoute_renderPOSTResponse, render, "f");
+        tslib_1.__classPrivateFieldSet(this, _DefaultOAuth2ACAuthorizationRoute_authorizationResponseHandler, authResponseHandler, "f");
+    }
+    /**
+     * Creates a new `DefaultOAuth2ACAuthorizationRoute` instance from the provided configuration.
+     */
+    static fromConfig(config) {
+        const instance = new DefaultOAuth2ACAuthorizationRoute();
+        if (config.path)
+            instance.setPath(config.path);
+        if (config.clientId)
+            instance.setClientId(config.clientId);
+        if (config.redirectUri)
+            instance.setRedirectUri(config.redirectUri);
+        if (config.emailField)
+            instance.setEmailField(config.emailField);
+        if (config.passwordField)
+            instance.setPasswordField(config.passwordField);
+        if (config.codeGenerator)
+            instance.generateCode(config.codeGenerator);
+        if (config.responseRenderer)
+            instance.setGETResponseRenderer(config.responseRenderer);
+        if (config.postResponseRenderer)
+            instance.setPOSTResponseRenderer(config.postResponseRenderer);
+        if (config.finalizeAuthorization)
+            instance.finalizeAuthorization(config.finalizeAuthorization);
+        return instance;
+    }
+    validateClientParams(clientId, redirectUri, props, 
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    req, 
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    h, 
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    renderer) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            if (tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_clientId, "f") && tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_clientId, "f") !== clientId) {
+                return h.response(yield renderer({
+                    emailField: tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_emailField, "f"),
+                    passwordField: tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_passwordField, "f"),
+                    statusCode: 400,
+                    error: common_1.OAuth2ErrorCode.INVALID_CLIENT,
+                    errorMessage: 'Bad \'client_id\' parameter'
+                }, props, req, h)).code(400);
+            }
+            if (tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_redirectUri, "f") && tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_redirectUri, "f") !== redirectUri) {
+                return h.response(yield renderer({
+                    emailField: tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_emailField, "f"),
+                    passwordField: tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_passwordField, "f"),
+                    statusCode: 400,
+                    error: common_1.OAuth2ErrorCode.INVALID_CLIENT,
+                    errorMessage: 'Bad \'redirect_uri\' parameter'
+                }, props, req, h)).code(400);
+            }
+            return null;
+        });
     }
     setPath(path) {
         if (path)
@@ -175,6 +245,23 @@ class DefaultOAuth2ACAuthorizationRoute extends OAuth2ACAuthorizationRoute {
         tslib_1.__classPrivateFieldSet(this, _DefaultOAuth2ACAuthorizationRoute_generateCode, handler, "f");
         return this;
     }
+    /**
+     *
+     * finalizeAuthorization() is called after the authorization code is generated.
+     *
+     * It must redirect the user back to the client's redirect_uri, or respond with an OAuth2 error.
+     *
+     * example:
+     * ```ts
+     * route.finalizeAuthorization(async (ctx, params, req, h) => {
+     *   return h.redirect(ctx.fullRedirectUri)
+     * })
+     * ```
+     */
+    finalizeAuthorization(handler) {
+        tslib_1.__classPrivateFieldSet(this, _DefaultOAuth2ACAuthorizationRoute_authorizationResponseHandler, handler, "f");
+        return this;
+    }
     setClientId(value) {
         tslib_1.__classPrivateFieldSet(this, _DefaultOAuth2ACAuthorizationRoute_clientId, value, "f");
         return this;
@@ -184,19 +271,19 @@ class DefaultOAuth2ACAuthorizationRoute extends OAuth2ACAuthorizationRoute {
         return this;
     }
     setEmailField(value) {
-        const escaped = encodeURIComponent((0, html_entities_1.encode)(value));
+        const escaped = (0, html_entities_1.encode)(value); // For HTML rendering, use encode() (from html-entities)
         if (escaped)
             tslib_1.__classPrivateFieldSet(this, _DefaultOAuth2ACAuthorizationRoute_emailField, escaped, "f");
         return this;
     }
     setPasswordField(value) {
-        const escaped = encodeURIComponent((0, html_entities_1.encode)(value));
+        const escaped = (0, html_entities_1.encode)(value); // For HTML rendering, use encode() (from html-entities)
         if (escaped)
             tslib_1.__classPrivateFieldSet(this, _DefaultOAuth2ACAuthorizationRoute_passwordField, escaped, "f");
         return this;
     }
 }
 exports.DefaultOAuth2ACAuthorizationRoute = DefaultOAuth2ACAuthorizationRoute;
-_DefaultOAuth2ACAuthorizationRoute_clientId = new WeakMap(), _DefaultOAuth2ACAuthorizationRoute_redirectUri = new WeakMap(), _DefaultOAuth2ACAuthorizationRoute_emailField = new WeakMap(), _DefaultOAuth2ACAuthorizationRoute_passwordField = new WeakMap(), _DefaultOAuth2ACAuthorizationRoute_generateCode = new WeakMap(), _DefaultOAuth2ACAuthorizationRoute_renderResponse = new WeakMap(), _DefaultOAuth2ACAuthorizationRoute_renderPOSTResponse = new WeakMap();
+_DefaultOAuth2ACAuthorizationRoute_clientId = new WeakMap(), _DefaultOAuth2ACAuthorizationRoute_redirectUri = new WeakMap(), _DefaultOAuth2ACAuthorizationRoute_emailField = new WeakMap(), _DefaultOAuth2ACAuthorizationRoute_passwordField = new WeakMap(), _DefaultOAuth2ACAuthorizationRoute_generateCode = new WeakMap(), _DefaultOAuth2ACAuthorizationRoute_renderResponse = new WeakMap(), _DefaultOAuth2ACAuthorizationRoute_renderPOSTResponse = new WeakMap(), _DefaultOAuth2ACAuthorizationRoute_authorizationResponseHandler = new WeakMap();
 //#endregion Defaults
 //# sourceMappingURL=authorization-route.js.map

package/lib/flows/auth-code/authorization-route.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-route.js","sourceRoot":"","sources":["../../../src/flows/auth-code/authorization-route.ts"],"names":[],"mappings":";;;;;AAOA,iDAAsC;AA8BtC,MAAa,0BAA0B;IAKnC,MAAM,CAAC,YAAY;QAIf,OAAO,IAAI,iCAAiC,EAAqB,CAAA;IACrE,CAAC;IAMD,IAAI,IAAI;QACJ,OAAO,IAAI,CAAC,KAAK,CAAA;IACrB,CAAC;IAED,IAAI,OAAO;QACP,OAAO,IAAI,CAAC,QAAQ,CAAA;IACxB,CAAC;IAED,IAAI,WAAW;QACX,OAAO,IAAI,CAAC,YAAY,CAAA;IAC5B,CAAC;IAED,YACI,IAAY,EACZ,OAA8C,EAC9C,WAAmD;QAEnD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;IACpC,CAAC;CACJ;AArCD,gEAqCC;AA4BD,8DAA8D;AAC9D,MAAM,MAAM,GAA8B,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,EAAE,EAAE;IAC7F,IAAI,KAAK,IAAI,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAqB,CAAA;IACxE,CAAC;IACD,OAAO;;;;;;;;;;;;;;;;;;;MAmBL,YAAY,IAAI,EAAE;;;4BAGI,UAAU,WAAW,UAAU,kBAAkB,UAAU,mBAAmB,UAAU;+BACrF,aAAa,WAAW,aAAa,kBAAkB,aAAa;;;;;;;;;QAS3F,CAAA;AACR,CAAC,CAAA;AAED,MAAa,iCAGX,SAAQ,0BAA6C;IAWnD;QACI,KAAK,CAAC,mBAAmB,EAAE,CAAO,EAAmC,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;gBAA/C,EAAE,QAAQ,EAAE,WAAW,OAAY,EAAP,KAAK,sBAAjC,2BAAmC,CAAF;YAC/D,IAAI,+BAAA,IAAI,mDAAU,IAAI,+BAAA,IAAI,mDAAU,IAAI,QAAQ,EAAE,CAAC;gBAC/C,OAAO,CAAC,CAAC,QAAQ,CACb,MAAM,+BAAA,IAAI,yDAAgB,MAApB,IAAI,EACN;oBACI,UAAU,EAAE,+BAAA,IAAI,qDAAY;oBAC5B,aAAa,EAAE,+BAAA,IAAI,wDAAe;oBAClC,IAAI,EAAE,GAAG;oBACT,KAAK,EAAE,gBAAgB;oBACvB,YAAY,EAAE,6BAA6B;iBAC9C,kBACC,QAAQ,EAAE,WAAW,IAAK,KAAK,GACjC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAC3B,CAAC;YACD,IAAI,+BAAA,IAAI,sDAAa,IAAI,+BAAA,IAAI,sDAAa,IAAI,WAAW,EAAE,CAAC;gBACxD,OAAO,CAAC,CAAC,QAAQ,CACb,MAAM,+BAAA,IAAI,yDAAgB,MAApB,IAAI,EACN;oBACI,UAAU,EAAE,+BAAA,IAAI,qDAAY;oBAC5B,aAAa,EAAE,+BAAA,IAAI,wDAAe;oBAClC,IAAI,EAAE,GAAG;oBACT,KAAK,EAAE,gBAAgB;oBACvB,YAAY,EAAE,gCAAgC;iBACjD,kBACC,QAAQ,EAAE,WAAW,IAAK,KAAK,GACjC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAC3B,CAAC;YAED,cAAc;YACd,OAAO,CAAC,CAAC,QAAQ,CACb,MAAM,+BAAA,IAAI,yDAAgB,MAApB,IAAI,EAAiB;gBACvB,UAAU,EAAE,+BAAA,IAAI,qDAAY;gBAC5B,aAAa,EAAE,+BAAA,IAAI,wDAAe;gBAClC,IAAI,EAAE,GAAG;aACZ,kBAAI,QAAQ,EAAE,WAAW,IAAK,KAAK,GAAI,GAAG,CAAC,CAC/C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACf,CAAC,CAAA,EAAE,CAAO,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;YACvB,IAAI,+BAAA,IAAI,mDAAU,IAAI,+BAAA,IAAI,mDAAU,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACrD,OAAO,CAAC,CAAC,QAAQ,CACb,MAAM,+BAAA,IAAI,6DAAoB,MAAxB,IAAI,EACN;oBACI,UAAU,EAAE,+BAAA,IAAI,qDAAY;oBAC5B,aAAa,EAAE,+BAAA,IAAI,wDAAe;oBAClC,IAAI,EAAE,GAAG;oBACT,KAAK,EAAE,gBAAgB;oBACvB,YAAY,EAAE,6BAA6B;iBAC9C,EACD,KAAK,EACL,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAC3B,CAAC;YACD,IAAI,+BAAA,IAAI,sDAAa,IAAI,+BAAA,IAAI,sDAAa,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;gBAC9D,OAAO,CAAC,CAAC,QAAQ,CACb,MAAM,+BAAA,IAAI,6DAAoB,MAAxB,IAAI,EACN;oBACI,UAAU,EAAE,+BAAA,IAAI,qDAAY;oBAC5B,aAAa,EAAE,+BAAA,IAAI,wDAAe;oBAClC,IAAI,EAAE,GAAG;oBACT,KAAK,EAAE,gBAAgB;oBACvB,YAAY,EAAE,gCAAgC;iBACjD,EACD,KAAK,EACL,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAC3B,CAAC;YAED,IAAI,KAAK,GAAkB,SAAS,CAAA;YACpC,IAAI,YAAY,GAAG,qBAAqB,CAAA;YAExC,IACI,KAAK,CAAC,QAAQ;gBACd,GAAG,CAAC,OAAO;gBACX,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;gBAC/B,+BAAA,IAAI,qDAAY,IAAI,GAAG,CAAC,OAAO;gBAC/B,+BAAA,IAAI,wDAAe,IAAI,GAAG,CAAC,OAAO,EACpC,CAAC;gBACC,MAAM,IAAI,GAAG,MAAM,+BAAA,IAAI,uDAAc,MAAlB,IAAI,EAAe,KAAK,EAAE,GAAG,CAAC,CAAA;gBACjD,IAAI,IAAI,EAAE,CAAC;oBACP,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,WAAW,SAAS,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;gBACvG,CAAC;qBAAM,CAAC;oBACJ,KAAK,GAAG,aAAa,CAAA;oBACrB,YAAY,GAAG,mBAAmB,CAAA;gBACtC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACJ,KAAK,GAAG,iBAAiB,CAAA;YAC7B,CAAC;YAED,cAAc;YACd,OAAO,CAAC,CAAC,QAAQ,CACb,MAAM,+BAAA,IAAI,6DAAoB,MAAxB,IAAI,EACN;gBACI,UAAU,EAAE,+BAAA,IAAI,qDAAY;gBAC5B,aAAa,EAAE,+BAAA,IAAI,wDAAe;gBAClC,IAAI,EAAE,GAAG;gBACT,KAAK,EAAE,KAAK;gBACZ,YAAY;aACf,EACD,KAAK,EACL,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC3B,CAAC,CAAA,CAAC,CAAA;QA5GN,8DAAyB;QACzB,iEAA4B;QAE5B,wDAAc,OAAO,EAAA;QACrB,2DAAiB,UAAU,EAAA;QAE3B,kEAA0C;QAC1C,oEAA8C;QAC9C,wEAAmD;QAsG/C,uEAAuE;QACvE,+BAAA,IAAI,mDAAiB,GAAS,EAAE,wDAAC,OAAA,IAAI,CAAA,GAAA,MAAA,CAAA;QACrC,+BAAA,IAAI,qDAAmB,MAAM,MAAA,CAAA;QAC7B,+BAAA,IAAI,yDAAuB,MAAM,MAAA,CAAA;IACrC,CAAC;IAED,OAAO,CAAC,IAAe;QACnB,IAAI,IAAI;YACJ,IAAI,CAAC,KAAK,GAAG,IAAI,CAAA;QACrB,OAAO,IAAI,CAAA;IACf,CAAC;IAED,WAAW,CAAC,OAA8C;QACtD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAA;QACvB,OAAO,IAAI,CAAA;IACf,CAAC;IAED,YAAY,CAAC,OAA+C;QACxD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAA;QAC3B,OAAO,IAAI,CAAA;IACf,CAAC;IAED,sBAAsB,CAAC,QAAuC;QAC1D,+BAAA,IAAI,qDAAmB,QAAQ,MAAA,CAAA;QAC/B,OAAO,IAAI,CAAA;IACf,CAAC;IAED,uBAAuB,CAAC,QAAwC;QAC5D,+BAAA,IAAI,yDAAuB,QAAQ,MAAA,CAAA;QACnC,OAAO,IAAI,CAAA;IACf,CAAC;IAED,YAAY,CAAC,OAAoC;QAC7C,+BAAA,IAAI,mDAAiB,OAAO,MAAA,CAAA;QAC5B,OAAO,IAAI,CAAA;IACf,CAAC;IAED,WAAW,CAAC,KAAoB;QAC5B,+BAAA,IAAI,+CAAa,KAAK,MAAA,CAAA;QACtB,OAAO,IAAI,CAAA;IACf,CAAC;IAED,cAAc,CAAC,KAAoB;QAC/B,+BAAA,IAAI,kDAAgB,KAAK,MAAA,CAAA;QACzB,OAAO,IAAI,CAAA;IACf,CAAC;IAED,aAAa,CAAC,KAAa;QACvB,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAA,sBAAM,EAAC,KAAK,CAAC,CAAC,CAAA;QACjD,IAAI,OAAO;YACP,+BAAA,IAAI,iDAAe,OAAO,MAAA,CAAA;QAC9B,OAAO,IAAI,CAAA;IACf,CAAC;IAED,gBAAgB,CAAC,KAAa;QAC1B,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAA,sBAAM,EAAC,KAAK,CAAC,CAAC,CAAA;QACjD,IAAI,OAAO;YACP,+BAAA,IAAI,oDAAkB,OAAO,MAAA,CAAA;QACjC,OAAO,IAAI,CAAA;IACf,CAAC;CACJ;AA9KD,8EA8KC;;AAED,qBAAqB"}
+{"version":3,"file":"authorization-route.js","sourceRoot":"","sources":["../../../src/flows/auth-code/authorization-route.ts"],"names":[],"mappings":";;;;;AAOA,iDAAsC;AACtC,sCAA+F;AA6B/F,MAAa,0BAA0B;IAKnC,MAAM,CAAC,YAAY;QAIf,OAAO,IAAI,iCAAiC,EAAqB,CAAA;IACrE,CAAC;IAMD,IAAI,IAAI;QACJ,OAAO,IAAI,CAAC,KAAK,CAAA;IACrB,CAAC;IAED,IAAI,OAAO;QACP,OAAO,IAAI,CAAC,QAAQ,CAAA;IACxB,CAAC;IAED,IAAI,WAAW;QACX,OAAO,IAAI,CAAC,YAAY,CAAA;IAC5B,CAAC;IAED,YACI,IAAY,EACZ,OAA8C,EAC9C,WAAmD;QAEnD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;IACpC,CAAC;CACJ;AArCD,gEAqCC;AAuDD,8DAA8D;AAC9D,MAAM,MAAM,GAA8B,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,EAAE,EAAE;IAC7F,IAAI,KAAK,IAAI,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAqB,CAAA;IACxE,CAAC;IACD,OAAO;;;;;;;;;;;;;;;;;;;MAmBL,YAAY,IAAI,EAAE;;;4BAGI,UAAU,WAAW,UAAU,kBAAkB,UAAU,mBAAmB,UAAU;+BACrF,aAAa,WAAW,aAAa,kBAAkB,aAAa;;;;;;;;;QAS3F,CAAA;AACR,CAAC,CAAA;AAED,8DAA8D;AAC9D,MAAM,mBAAmB,GAA6B,CAAO,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE;IAClF,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,eAAe,EAAE,CAAC,CAAA;AAC/C,CAAC,CAAA,CAAA;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,MAA8B;IAClE,MAAM,YAAY,GAAG,IAAI,eAAe,EAAE,CAAA;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACxC,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACnC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,IAAI,IAAI,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAA;AAC/C,CAAC;AAED,MAAa,iCAGX,SAAQ,0BAA6C;IAYnD;QACI,KAAK,CAAC,mBAAmB,EAAE,CAAO,EAAmC,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;gBAA/C,EAAE,QAAQ,EAAE,WAAW,OAAY,EAAP,KAAK,sBAAjC,2BAAmC,CAAF;YAC/D,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,WAAW,kBAAI,QAAQ,EAAE,WAAW,IAAK,KAAK,GAAI,GAAG,EAAE,CAAC,EAAE,+BAAA,IAAI,yDAAgB,CAAC,CAAA;YACjJ,IAAI,eAAe;gBAAE,OAAO,eAAe,CAAA;YAE3C,cAAc;YACd,OAAO,CAAC,CAAC,QAAQ,CACb,MAAM,+BAAA,IAAI,yDAAgB,MAApB,IAAI,EAAiB;gBACvB,UAAU,EAAE,+BAAA,IAAI,qDAAY;gBAC5B,aAAa,EAAE,+BAAA,IAAI,wDAAe;gBAClC,UAAU,EAAE,GAAG;aAClB,kBAAI,QAAQ,EAAE,WAAW,IAAK,KAAK,GAAI,GAAG,EAAE,CAAC,CAAC,CAClD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACf,CAAC,CAAA,EAAE,CAAO,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;;YACvB,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,+BAAA,IAAI,yDAAgB,CAAC,CAAA;YAC/H,IAAI,eAAe;gBAAE,OAAO,eAAe,CAAA;YAE3C,IAAI,KAAK,GAA2B,wBAAe,CAAC,YAAY,CAAA;YAChE,IAAI,YAAY,GAAG,sBAAsB,CAAA;YAEzC,IACI,KAAK,CAAC,QAAQ;gBACd,GAAG,CAAC,OAAO;gBACX,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;gBAC/B,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;;;cAGzB,EACJ,CAAC;gBACC,MAAM,IAAI,GAAG,MAAM,+BAAA,IAAI,uDAAc,MAAlB,IAAI,EAAe,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;gBACrD,IAAI,IAAI,EAAE,CAAC;oBACP,IAAI,eAAe,GAAG,EAAE,CAAC;oBACzB,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;wBACrC,eAAe,GAAG,gBAAgB,CAAC,KAAK,CAAC,WAAW,EAAE;4BAClD,IAAI,EAAE,IAAI,CAAC,KAAK;4BAChB,KAAK,EAAE,MAAA,KAAK,CAAC,KAAK,mCAAI,EAAE;yBAC3B,CAAC,CAAC;oBACP,CAAC;yBAAM,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;wBAC9B,eAAe,GAAG,gBAAgB,CAAC,KAAK,CAAC,WAAW,EAAE;4BAClD,KAAK,EAAE,wBAAe,CAAC,aAAa;4BACpC,iBAAiB,EAAE,qBAAqB;4BACxC,KAAK,EAAE,MAAA,KAAK,CAAC,KAAK,mCAAI,EAAE;yBAC3B,CAAC,CAAC;oBACP,CAAC;yBAAM,CAAC;wBACJ,eAAe,GAAG,gBAAgB,CAAC,KAAK,CAAC,WAAW,EAAE;4BAClD,KAAK,EAAE,wBAAe,CAAC,eAAe;4BACtC,iBAAiB,EAAE,SAAS;4BAC5B,KAAK,EAAE,MAAA,KAAK,CAAC,KAAK,mCAAI,EAAE;yBAC3B,CAAC,CAAC;oBACP,CAAC;oBACD,OAAO,+BAAA,IAAI,uEAA8B,MAAlC,IAAI,EAA+B;wBACtC,mBAAmB,EAAE,IAAI;wBACzB,UAAU,EAAE,+BAAA,IAAI,qDAAY;wBAC5B,aAAa,EAAE,+BAAA,IAAI,wDAAe;wBAClC,eAAe;qBAClB,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;gBACrB,CAAC;qBAAM,CAAC;oBACJ,KAAK,GAAG,wBAAe,CAAC,aAAa,CAAA;oBACrC,YAAY,GAAG,mBAAmB,CAAA;gBACtC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACJ,KAAK,GAAG,wBAAe,CAAC,eAAe,CAAA;gBACvC,YAAY,GAAG,oCAAoC,CAAA;YACvD,CAAC;YAED,cAAc;YACd,OAAO,CAAC,CAAC,QAAQ,CACb,MAAM,+BAAA,IAAI,6DAAoB,MAAxB,IAAI,EACN;gBACI,UAAU,EAAE,+BAAA,IAAI,qDAAY;gBAC5B,aAAa,EAAE,+BAAA,IAAI,wDAAe;gBAClC,UAAU,EAAE,GAAG;gBACf,KAAK,EAAE,KAAK;gBACZ,YAAY;aACf,EACD,KAAK,EACL,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC9B,CAAC,CAAA,CAAC,CAAA;QAxFN,8DAAyB;QACzB,iEAA4B;QAE5B,wDAAc,OAAO,EAAA;QACrB,2DAAiB,UAAU,EAAA;QAE3B,kEAA0C;QAC1C,oEAA8C;QAC9C,wEAAmD;QACnD,kFAA4D;QAiFxD,uEAAuE;QACvE,+BAAA,IAAI,mDAAiB,GAAS,EAAE,wDAAC,OAAA,IAAI,CAAA,GAAA,MAAA,CAAA;QACrC,+BAAA,IAAI,qDAAmB,MAAM,MAAA,CAAA;QAC7B,+BAAA,IAAI,yDAAuB,MAAM,MAAA,CAAA;QACjC,+BAAA,IAAI,mEAAiC,mBAAmB,MAAA,CAAA;IAC5D,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,UAAU,CAGf,MAUD;QACG,MAAM,QAAQ,GAAG,IAAI,iCAAiC,EAAqB,CAAA;QAC3E,IAAI,MAAM,CAAC,IAAI;YAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC9C,IAAI,MAAM,CAAC,QAAQ;YAAE,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QAC1D,IAAI,MAAM,CAAC,WAAW;YAAE,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;QACnE,IAAI,MAAM,CAAC,UAAU;YAAE,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QAChE,IAAI,MAAM,CAAC,aAAa;YAAE,QAAQ,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;QACzE,IAAI,MAAM,CAAC,aAAa;YAAE,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;QACrE,IAAI,MAAM,CAAC,gBAAgB;YAAE,QAAQ,CAAC,sBAAsB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAA;QACrF,IAAI,MAAM,CAAC,oBAAoB;YAAE,QAAQ,CAAC,uBAAuB,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAA;QAC9F,IAAI,MAAM,CAAC,qBAAqB;YAAE,QAAQ,CAAC,qBAAqB,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAA;QAC9F,OAAO,QAAQ,CAAA;IACnB,CAAC;IAEa,oBAAoB,CAC9B,QAAgB,EAChB,WAAmB,EACnB,KAAkC;IAClC,8DAA8D;IAC9D,GAAiB;IACjB,8DAA8D;IAC9D,CAAuB;IACvB,8DAA8D;IAC9D,QAAmC;;YAEnC,IAAI,+BAAA,IAAI,mDAAU,IAAI,+BAAA,IAAI,mDAAU,KAAK,QAAQ,EAAE,CAAC;gBAChD,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,QAAQ,CAAC;oBAC7B,UAAU,EAAE,+BAAA,IAAI,qDAAY;oBAC5B,aAAa,EAAE,+BAAA,IAAI,wDAAe;oBAClC,UAAU,EAAE,GAAG;oBACf,KAAK,EAAE,wBAAe,CAAC,cAAc;oBACrC,YAAY,EAAE,6BAA6B;iBAC9C,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAChC,CAAC;YAED,IAAI,+BAAA,IAAI,sDAAa,IAAI,+BAAA,IAAI,sDAAa,KAAK,WAAW,EAAE,CAAC;gBACzD,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,QAAQ,CAAC;oBAC7B,UAAU,EAAE,+BAAA,IAAI,qDAAY;oBAC5B,aAAa,EAAE,+BAAA,IAAI,wDAAe;oBAClC,UAAU,EAAE,GAAG;oBACf,KAAK,EAAE,wBAAe,CAAC,cAAc;oBACrC,YAAY,EAAE,gCAAgC;iBACjD,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAChC,CAAC;YAED,OAAO,IAAI,CAAA;QACf,CAAC;KAAA;IAED,OAAO,CAAC,IAAe;QACnB,IAAI,IAAI;YACJ,IAAI,CAAC,KAAK,GAAG,IAAI,CAAA;QACrB,OAAO,IAAI,CAAA;IACf,CAAC;IAED,WAAW,CAAC,OAA8C;QACtD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAA;QACvB,OAAO,IAAI,CAAA;IACf,CAAC;IAED,YAAY,CAAC,OAA+C;QACxD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAA;QAC3B,OAAO,IAAI,CAAA;IACf,CAAC;IAED,sBAAsB,CAAC,QAAuC;QAC1D,+BAAA,IAAI,qDAAmB,QAAQ,MAAA,CAAA;QAC/B,OAAO,IAAI,CAAA;IACf,CAAC;IAED,uBAAuB,CAAC,QAAwC;QAC5D,+BAAA,IAAI,yDAAuB,QAAQ,MAAA,CAAA;QACnC,OAAO,IAAI,CAAA;IACf,CAAC;IAED,YAAY,CAAC,OAAoC;QAC7C,+BAAA,IAAI,mDAAiB,OAAO,MAAA,CAAA;QAC5B,OAAO,IAAI,CAAA;IACf,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,qBAAqB,CAAC,OAAsC;QACxD,+BAAA,IAAI,mEAAiC,OAAO,MAAA,CAAA;QAC5C,OAAO,IAAI,CAAA;IACf,CAAC;IAED,WAAW,CAAC,KAAoB;QAC5B,+BAAA,IAAI,+CAAa,KAAK,MAAA,CAAA;QACtB,OAAO,IAAI,CAAA;IACf,CAAC;IAED,cAAc,CAAC,KAAoB;QAC/B,+BAAA,IAAI,kDAAgB,KAAK,MAAA,CAAA;QACzB,OAAO,IAAI,CAAA;IACf,CAAC;IAED,aAAa,CAAC,KAAa;QACvB,MAAM,OAAO,GAAG,IAAA,sBAAM,EAAC,KAAK,CAAC,CAAA,CAAC,wDAAwD;QACtF,IAAI,OAAO;YACP,+BAAA,IAAI,iDAAe,OAAO,MAAA,CAAA;QAC9B,OAAO,IAAI,CAAA;IACf,CAAC;IAED,gBAAgB,CAAC,KAAa;QAC1B,MAAM,OAAO,GAAG,IAAA,sBAAM,EAAC,KAAK,CAAC,CAAA,CAAC,wDAAwD;QACtF,IAAI,OAAO;YACP,+BAAA,IAAI,oDAAkB,OAAO,MAAA,CAAA;QACjC,OAAO,IAAI,CAAA;IACf,CAAC;CACJ;AA7OD,8EA6OC;;AAED,qBAAqB"}

package/lib/flows/auth-code/authorization-utils.d.ts

@@ -0,0 +1,35 @@
+import type { AuthCodeGeneratorResult } from './authorization-route';
+declare function isCode(r: AuthCodeGeneratorResult): r is {
+    type: 'code';
+    value: string;
+};
+declare function isContinue<Value = unknown>(r: AuthCodeGeneratorResult): r is {
+    type: 'continue';
+    value?: Value;
+};
+declare function isDeny<Value = unknown>(r: AuthCodeGeneratorResult): r is {
+    type: 'deny';
+    value?: Value;
+};
+export declare const AuthCodeResult: Readonly<{
+    /**
+     * Check if result is a 'code' result
+     */
+    isCode: typeof isCode;
+    /**
+     * Check if result is a 'continue' result
+     */
+    isContinue: typeof isContinue;
+    /**
+     * Check if result is a 'deny' result
+     */
+    isDeny: typeof isDeny;
+}>;
+export type AuthCodeResultMatchHandlers<Continue = unknown, Deny = unknown, Return = unknown> = {
+    code: (value: string) => Return;
+    continue: (value?: Continue) => Return;
+    deny: (value?: Deny) => Return;
+};
+export declare function matchAuthCodeResult<Continue = unknown, Deny = unknown, Return = unknown>(result: AuthCodeGeneratorResult, handlers: AuthCodeResultMatchHandlers<Continue, Deny, Return>): Return;
+export declare function createMatchAuthCodeResult<Continue, Deny, Return>(handlers: AuthCodeResultMatchHandlers<Continue, Deny, Return>): (result: AuthCodeGeneratorResult) => Return;
+export {};

package/lib/flows/auth-code/authorization-utils.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthCodeResult = void 0;
+exports.matchAuthCodeResult = matchAuthCodeResult;
+exports.createMatchAuthCodeResult = createMatchAuthCodeResult;
+function isCode(r) {
+    return r.type === 'code';
+}
+function isContinue(r) {
+    return r.type === 'continue';
+}
+function isDeny(r) {
+    return r.type === 'deny';
+}
+exports.AuthCodeResult = Object.freeze({
+    /**
+     * Check if result is a 'code' result
+     */
+    isCode,
+    /**
+     * Check if result is a 'continue' result
+     */
+    isContinue,
+    /**
+     * Check if result is a 'deny' result
+     */
+    isDeny,
+});
+function matchAuthCodeResult(result, handlers) {
+    switch (result.type) {
+        case 'code':
+            return handlers.code(result.value);
+        case 'continue':
+            return handlers.continue(result.value);
+        case 'deny':
+            return handlers.deny(result.value);
+    }
+}
+function createMatchAuthCodeResult(handlers) {
+    return (result) => {
+        return matchAuthCodeResult(result, handlers);
+    };
+}
+//# sourceMappingURL=authorization-utils.js.map

package/lib/flows/auth-code/authorization-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-utils.js","sourceRoot":"","sources":["../../../src/flows/auth-code/authorization-utils.ts"],"names":[],"mappings":";;;AA0CA,kDAgBC;AAED,8DAUC;AAjED,SAAS,MAAM,CAAC,CAA0B;IACxC,OAAO,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC;AAC3B,CAAC;AAED,SAAS,UAAU,CAAkB,CAA0B;IAC7D,OAAO,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC;AAC/B,CAAC;AAED,SAAS,MAAM,CAAkB,CAA0B;IACzD,OAAO,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC;AAC3B,CAAC;AAEY,QAAA,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1C;;OAEG;IACH,MAAM;IACN;;OAEG;IACH,UAAU;IACV;;OAEG;IACH,MAAM;CACP,CAAC,CAAC;AAYH,SAAgB,mBAAmB,CAKjC,MAA+B,EAC/B,QAA6D;IAE7D,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,MAAM;YACT,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrC,KAAK,UAAU;YACb,OAAO,QAAQ,CAAC,QAAQ,CAAE,MAAmD,CAAC,KAAiB,CAAC,CAAC;QACnG,KAAK,MAAM;YACT,OAAO,QAAQ,CAAC,IAAI,CAAE,MAA+C,CAAC,KAAa,CAAC,CAAC;IACzF,CAAC;AACH,CAAC;AAED,SAAgB,yBAAyB,CAKvC,QAA6D;IAE7D,OAAO,CAAC,MAA+B,EAAU,EAAE;QACjD,OAAO,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/C,CAAC,CAAC;AACJ,CAAC"}

package/lib/flows/auth-code/token-route.d.ts

@@ -1,32 +1,24 @@
-import { Lifecycle, ReqRef, ReqRefDefaults, Request, ResponseToolkit } from '@kaapi/kaapi';
-import { IOAuth2TokenResponse, OAuth2TokenResponseBody, OAuth2ErrorBody, OpenIDHelpers, PathValue } from '../common';
-export interface OAuth2ACTokenParams extends Partial<OpenIDHelpers> {
-    grantType: string;
+import { Lifecycle, ReqRef, ReqRefDefaults } from '@kaapi/kaapi';
+import { PathValue, TokenGenerator, OAuth2TokenParams, OAuth2TokenHandler, IOAuth2TokenRoute, OAuth2TokenRoute, DefaultOAuth2TokenRoute } from '../common';
+import { verifyCodeVerifier } from '../../utils/verify-code-verifier';
+export interface OAuth2ACTokenParams extends OAuth2TokenParams {
     code: string;
     clientId: string;
     clientSecret?: string;
     codeVerifier?: string;
     redirectUri?: string;
-    readonly ttl?: number;
+    verifyCodeVerifier: typeof verifyCodeVerifier;
 }
-export type OAuth2ACTokenHandler<Refs extends ReqRef = ReqRefDefaults, R extends Lifecycle.ReturnValue<any> = Lifecycle.ReturnValue<Refs>> = (params: OAuth2ACTokenParams, request: Request<Refs>, h: ResponseToolkit<Refs>) => R;
-export interface IOAuth2ACTokenRoute<Refs extends ReqRef = ReqRefDefaults> {
-    path: string;
-    handler: OAuth2ACTokenHandler<Refs>;
-}
-export declare class OAuth2ACTokenRoute<Refs extends ReqRef = ReqRefDefaults> implements IOAuth2ACTokenRoute<Refs> {
+export type OAuth2ACTokenHandler<Refs extends ReqRef = ReqRefDefaults, R extends Lifecycle.ReturnValue<any> = Lifecycle.ReturnValue<Refs>> = OAuth2TokenHandler<OAuth2ACTokenParams, Refs, R>;
+export type IOAuth2ACTokenRoute<Refs extends ReqRef = ReqRefDefaults> = IOAuth2TokenRoute<OAuth2ACTokenParams, Refs>;
+export declare class OAuth2ACTokenRoute<Refs extends ReqRef = ReqRefDefaults> extends OAuth2TokenRoute<OAuth2ACTokenParams, Refs> implements IOAuth2ACTokenRoute<Refs> {
     static buildDefault<Refs extends ReqRef = ReqRefDefaults>(): DefaultOAuth2ACTokenRoute<Refs>;
-    protected _path: string;
-    protected _handler: OAuth2ACTokenHandler<Refs>;
-    get path(): string;
-    get handler(): OAuth2ACTokenHandler<Refs, Lifecycle.ReturnValue<Refs>>;
-    constructor(path: string, handler: OAuth2ACTokenHandler<Refs>);
 }
 /**
  * Return null for invalid request
  */
-export type AuthCodeTokenGenerator<Refs extends ReqRef = ReqRefDefaults> = (params: OAuth2ACTokenParams, req: Request<Refs>) => Promise<OAuth2TokenResponseBody | IOAuth2TokenResponse | OAuth2ErrorBody | null> | OAuth2TokenResponseBody | IOAuth2TokenResponse | OAuth2ErrorBody | null;
-export declare class DefaultOAuth2ACTokenRoute<Refs extends ReqRef = ReqRefDefaults> extends OAuth2ACTokenRoute<Refs> {
+export type AuthCodeTokenGenerator<Refs extends ReqRef = ReqRefDefaults> = TokenGenerator<OAuth2ACTokenParams, Refs>;
+export declare class DefaultOAuth2ACTokenRoute<Refs extends ReqRef = ReqRefDefaults> extends OAuth2ACTokenRoute<Refs> implements DefaultOAuth2TokenRoute<OAuth2ACTokenParams, Refs> {
     #private;
     constructor();
     setPath(path: PathValue): this;