@nocobase/plugin-idp-oauth 2.2.17 → 2.2.19

package/dist/node_modules/oidc-provider/lib/helpers/errors.js

@@ -1,26 +1,37 @@
-/* eslint-disable camelcase */
-/* eslint-disable max-classes-per-file */
-
 import upperFirst from './_/upper_first.js';
 import camelCase from './_/camel_case.js';
 
 export class OIDCProviderError extends Error {
   allow_redirect = true;
 
-  constructor(status, message) {
-    super(message);
+  constructor(status, message, options = undefined) {
+    if (typeof options === 'string') {
+      options = { detail: options };
+    }
+
+    let detail = options?.detail;
+    if (detail === undefined && options?.cause instanceof Error) {
+      
+      detail = options.cause.message;
+    }
+
+    super(message, options);
     this.name = this.constructor.name;
     this.message = message;
     this.error = message;
     this.status = status;
     this.statusCode = status;
     this.expose = status < 500;
+
+    if (detail !== undefined) {
+      this.error_detail = detail;
+    }
   }
 }
 
 export class CustomOIDCProviderError extends OIDCProviderError {
-  constructor(message, description) {
-    super(400, message);
+  constructor(message, description, options = undefined) {
+    super(400, message, options);
     Error.captureStackTrace(this, this.constructor);
     Object.assign(this, { error_description: description });
   }
@@ -29,44 +40,44 @@ export class CustomOIDCProviderError extends OIDCProviderError {
 export class InvalidToken extends OIDCProviderError {
   error_description = 'invalid token provided';
 
-  constructor(detail) {
-    super(401, 'invalid_token');
+  constructor(options) {
+    super(401, 'invalid_token', options);
     Error.captureStackTrace(this, this.constructor);
-    Object.assign(this, { error_detail: detail });
+    Object.assign(this, { error_detail: this.error_detail });
   }
 }
 
 export class InvalidClientMetadata extends OIDCProviderError {
-  constructor(description, detail) {
+  constructor(description, options) {
     const message = description.startsWith('redirect_uris')
       ? 'invalid_redirect_uri' : 'invalid_client_metadata';
-    super(400, message);
+    super(400, message, options);
     Error.captureStackTrace(this, this.constructor);
-    Object.assign(this, { error_description: description, error_detail: detail });
+    Object.assign(this, { error_description: description, error_detail: this.error_detail });
   }
 }
 
 export class InvalidScope extends OIDCProviderError {
-  constructor(description, scope, detail) {
-    super(400, 'invalid_scope');
+  constructor(description, scope, options) {
+    super(400, 'invalid_scope', options);
     Error.captureStackTrace(this, this.constructor);
-    Object.assign(this, { scope, error_description: description, error_detail: detail });
+    Object.assign(this, { scope, error_description: description, error_detail: this.error_detail });
   }
 }
 
 export class InsufficientScope extends OIDCProviderError {
-  constructor(description, scope, detail) {
-    super(403, 'insufficient_scope');
+  constructor(description, scope, options) {
+    super(403, 'insufficient_scope', options);
     Error.captureStackTrace(this, this.constructor);
-    Object.assign(this, { scope, error_description: description, error_detail: detail });
+    Object.assign(this, { scope, error_description: description, error_detail: this.error_detail });
   }
 }
 
 export class InvalidRequest extends OIDCProviderError {
-  constructor(description, code, detail) {
-    super(code ?? 400, 'invalid_request');
+  constructor(description, code, options) {
+    super(code ?? 400, 'invalid_request', options);
     Error.captureStackTrace(this, this.constructor);
-    Object.assign(this, { error_description: description || 'request is invalid', error_detail: detail, expose: true });
+    Object.assign(this, { error_description: description || 'request is invalid', error_detail: this.error_detail, expose: true });
   }
 }
 
@@ -75,20 +86,20 @@ export class SessionNotFound extends InvalidRequest {}
 export class InvalidClientAuth extends OIDCProviderError {
   error_description = 'client authentication failed';
 
-  constructor(detail) {
-    super(401, 'invalid_client');
+  constructor(options) {
+    super(401, 'invalid_client', options);
     Error.captureStackTrace(this, this.constructor);
-    Object.assign(this, { error_detail: detail });
+    Object.assign(this, { error_detail: this.error_detail });
   }
 }
 
 export class InvalidGrant extends OIDCProviderError {
   error_description = 'grant request is invalid';
 
-  constructor(detail) {
-    super(400, 'invalid_grant');
+  constructor(options) {
+    super(400, 'invalid_grant', options);
     Error.captureStackTrace(this, this.constructor);
-    Object.assign(this, { error_detail: detail });
+    Object.assign(this, { error_detail: this.error_detail });
   }
 }
 
@@ -97,8 +108,8 @@ export class InvalidRedirectUri extends OIDCProviderError {
 
   allow_redirect = false;
 
-  constructor() {
-    super(400, 'invalid_redirect_uri');
+  constructor(options = undefined) {
+    super(400, 'invalid_redirect_uri', typeof options === 'object' ? options : undefined);
     Error.captureStackTrace(this, this.constructor);
   }
 }
@@ -108,16 +119,16 @@ function E(message, errorDescription) {
   const klass = class extends OIDCProviderError {
     error_description = errorDescription;
 
-    constructor(description, detail) {
-      super(400, message);
+    constructor(description, options) {
+      super(400, message, options);
       Error.captureStackTrace(this, this.constructor);
 
       if (description) {
         this.error_description = description;
       }
 
-      if (detail) {
-        this.error_detail = detail;
+      if (!this.error_detail) {
+        delete this.error_detail;
       }
     }
   };
@@ -133,12 +144,17 @@ export const ExpiredToken = E('expired_token');
 export const InteractionRequired = E('interaction_required');
 export const InvalidBindingMessage = E('invalid_binding_message');
 export const InvalidAuthorizationDetails = E('invalid_authorization_details');
+export const InvalidCredentialRequest = E('invalid_credential_request');
+export const InvalidNonce = E('invalid_nonce');
 export const InvalidClient = E('invalid_client');
 export const InvalidDpopProof = E('invalid_dpop_proof');
 export const InvalidRequestObject = E('invalid_request_object');
 export const InvalidRequestUri = E('invalid_request_uri');
+export const InvalidProof = E('invalid_proof');
 export const InvalidSoftwareStatement = E('invalid_software_statement');
 export const InvalidTarget = E('invalid_target', 'resource indicator is missing, or unknown');
+export const UnknownCredentialConfiguration = E('unknown_credential_configuration');
+export const UnknownCredentialIdentifier = E('unknown_credential_identifier');
 export const InvalidUserCode = E('invalid_user_code');
 export const LoginRequired = E('login_required');
 export const MissingUserCode = E('missing_user_code');
@@ -155,7 +171,9 @@ export const UnmetAuthenticationRequirements = E('unmet_authentication_requireme
 export const UnsupportedGrantType = E('unsupported_grant_type', 'unsupported grant_type requested');
 export const UnsupportedResponseMode = E('unsupported_response_mode', 'unsupported response_mode requested');
 export const UnsupportedResponseType = E('unsupported_response_type', 'unsupported response_type requested');
+export const CredentialRequestDenied = E('credential_request_denied');
 export const UseDpopNonce = E('use_dpop_nonce');
 export const UnsupportedTokenType = E('unsupported_token_type');
 export const UseAttestationChallenge = E('use_attestation_challenge');
+export const UseFreshAttestation = E('use_fresh_attestation');
 export const InvalidClientAttestation = E('invalid_client_attestation');

package/dist/node_modules/oidc-provider/lib/helpers/features.js

@@ -18,14 +18,16 @@ export const STABLE = new Set([
   'registrationManagement',
   'requestObjects',
   'resourceIndicators',
+  'richAuthorizationRequests',
   'revocation',
   'rpInitiatedLogout',
+  'rpMetadataChoices',
   'userinfo',
 ]);
 
 export const EXPERIMENTS = new Map(Object.entries({
-  richAuthorizationRequests: {
-    name: 'OAuth 2.0 Rich Authorization Requests',
+  openid4vci: {
+    name: 'OpenID for Verifiable Credential Issuance 1.0',
     version: ['experimental-01'],
   },
   webMessageResponseMode: {
@@ -36,16 +38,12 @@ export const EXPERIMENTS = new Map(Object.entries({
     name: 'External Signing Key Support',
     version: ['experimental-01'],
   },
-  rpMetadataChoices: {
-    name: 'OpenID Connect Relying Party Metadata Choices',
-    version: ['draft-02'],
-  },
   attestClientAuth: {
     name: 'OAuth 2.0 Attestation-Based Client Authentication',
-    version: 'draft-06',
+    version: 'draft-10',
   },
   clientIdMetadataDocument: {
     name: 'OAuth Client ID Metadata Document',
-    version: 'draft-01',
+    version: 'draft-02',
   },
 }));

package/dist/node_modules/oidc-provider/lib/helpers/fetch_request.js

@@ -1,56 +1,54 @@
-/* eslint-disable no-bitwise, no-plusplus */
-import * as undici from 'undici';
-
+import * as attention from './attention.js';
 import instance from './weak_cache.js';
 
-// IANA IPv4 Special-Purpose Address Space
-// https://www.iana.org/assignments/iana-ipv4-special-registry/
+
+
 const SPECIAL_USE_IPV4 = [
-  { prefix: 0x00000000, mask: 0xff000000 }, // 0.0.0.0/8 "This network" [RFC791]
-  { prefix: 0x0a000000, mask: 0xff000000 }, // 10.0.0.0/8 Private-Use [RFC1918]
-  { prefix: 0x64400000, mask: 0xffc00000 }, // 100.64.0.0/10 Shared Address Space [RFC6598]
-  { prefix: 0x7f000000, mask: 0xff000000 }, // 127.0.0.0/8 Loopback [RFC1122]
-  { prefix: 0xa9fe0000, mask: 0xffff0000 }, // 169.254.0.0/16 Link Local [RFC3927]
-  { prefix: 0xac100000, mask: 0xfff00000 }, // 172.16.0.0/12 Private-Use [RFC1918]
-  { prefix: 0xc0000000, mask: 0xffffff00 }, // 192.0.0.0/24 IETF Protocol Assignments [RFC6890]
-  { prefix: 0xc0000200, mask: 0xffffff00 }, // 192.0.2.0/24 Documentation (TEST-NET-1) [RFC5737]
-  { prefix: 0xc01fc400, mask: 0xffffff00 }, // 192.31.196.0/24 AS112-v4 [RFC7535]
-  { prefix: 0xc034c100, mask: 0xffffff00 }, // 192.52.193.0/24 AMT [RFC7450]
-  { prefix: 0xc0586300, mask: 0xffffff00 }, // 192.88.99.0/24 Deprecated (6to4 Relay Anycast) [RFC7526]
-  { prefix: 0xc0a80000, mask: 0xffff0000 }, // 192.168.0.0/16 Private-Use [RFC1918]
-  { prefix: 0xc0af3000, mask: 0xffffff00 }, // 192.175.48.0/24 Direct Delegation AS112 Service [RFC7534]
-  { prefix: 0xc6120000, mask: 0xfffe0000 }, // 198.18.0.0/15 Benchmarking [RFC2544]
-  { prefix: 0xc6336400, mask: 0xffffff00 }, // 198.51.100.0/24 Documentation (TEST-NET-2) [RFC5737]
-  { prefix: 0xcb007100, mask: 0xffffff00 }, // 203.0.113.0/24 Documentation (TEST-NET-3) [RFC5737]
-  { prefix: 0xf0000000, mask: 0xf0000000 }, // 240.0.0.0/4 Reserved [RFC1112]
-
-  // TCP cannot connect to multicast
-  // { prefix: 0xe0000000, mask: 0xf0000000 }, // 224.0.0.0/4 Multicast [RFC1112]
-  // TCP cannot connect to broadcast
-  // { prefix: 0xffffffff, mask: 0xffffffff }, // 255.255.255.255/32 Limited Broadcast [RFC919][RFC8190]
+  { prefix: 0x00000000, mask: 0xff000000 }, 
+  { prefix: 0x0a000000, mask: 0xff000000 }, 
+  { prefix: 0x64400000, mask: 0xffc00000 }, 
+  { prefix: 0x7f000000, mask: 0xff000000 }, 
+  { prefix: 0xa9fe0000, mask: 0xffff0000 }, 
+  { prefix: 0xac100000, mask: 0xfff00000 }, 
+  { prefix: 0xc0000000, mask: 0xffffff00 }, 
+  { prefix: 0xc0000200, mask: 0xffffff00 }, 
+  { prefix: 0xc01fc400, mask: 0xffffff00 }, 
+  { prefix: 0xc034c100, mask: 0xffffff00 }, 
+  { prefix: 0xc0586300, mask: 0xffffff00 }, 
+  { prefix: 0xc0a80000, mask: 0xffff0000 }, 
+  { prefix: 0xc0af3000, mask: 0xffffff00 }, 
+  { prefix: 0xc6120000, mask: 0xfffe0000 }, 
+  { prefix: 0xc6336400, mask: 0xffffff00 }, 
+  { prefix: 0xcb007100, mask: 0xffffff00 }, 
+  { prefix: 0xf0000000, mask: 0xf0000000 }, 
+
+  
+  
+  
+  
 ];
 
 function ipv4ToInt(ip) {
-  // Parses an IPv4 dotted-decimal string into an unsigned 32-bit integer
-  // without allocating a split('.') array. Walks the string character by
-  // character, accumulating each decimal octet then shifting it into the
-  // result. The final >>> 0 ensures an unsigned value.
+  
+  
+  
+  
   let result = 0;
   let octet = 0;
   for (let i = 0; i <= ip.length; i++) {
-    if (i === ip.length || ip.charCodeAt(i) === 46 /* '.' */) {
-      result = result * 256 + octet; // * 256 is equivalent to << 8
+    if (i === ip.length || ip.charCodeAt(i) === 46  ) {
+      result = result * 256 + octet; 
       octet = 0;
     } else {
-      octet = octet * 10 + ip.charCodeAt(i) - 48; // 48 is '0'.charCodeAt(0)
+      octet = octet * 10 + ip.charCodeAt(i) - 48; 
     }
   }
   return result >>> 0;
 }
 
 function expandIPv6(address) {
-  // Expands a potentially shortened IPv6 address into a 32-char lowercase
-  // hex string (8 groups x 4 hex digits) for prefix matching via startsWith.
+  
+  
   let parts;
   const dcIndex = address.indexOf('::');
   if (dcIndex !== -1) {
@@ -70,9 +68,9 @@ function expandIPv6(address) {
   return result;
 }
 
-// Group CIDR entries by first octet for fast rejection.
-// For each of the 256 possible first-octet values, only the entries whose
-// range can include that octet are stored, so non-special IPs skip most checks.
+
+
+
 const V4_OCTET_BUCKETS = new Array(256);
 for (let i = 0; i < 256; i++) V4_OCTET_BUCKETS[i] = [];
 for (const entry of SPECIAL_USE_IPV4) {
@@ -92,44 +90,44 @@ function isSpecialUseIPv4(address) {
   return false;
 }
 
-// IANA IPv6 Special-Purpose Address Space
-// https://www.iana.org/assignments/iana-ipv6-special-registry/
-// Entries are expanded hex string prefixes matched via startsWith.
-// Non-nibble-aligned CIDR ranges are split into nibble-aligned entries.
+
+
+
+
 const SPECIAL_USE_IPV6 = [
-  '0064ff9b0000000000000000', // 64:ff9b::/96 IPv4-IPv6 Translat. [RFC6052]
-  '0064ff9b0001', // 64:ff9b:1::/48 IPv4-IPv6 Translat. [RFC8215]
-  '0100000000000000', // 100::/64 Discard-Only [RFC6666]
-  '0100000000000001', // 100:0:0:1::/64 Dummy IPv6 Prefix [RFC9780]
-  '200100', // 2001::/23 IETF Protocol Assignments [RFC2928] (1/2)
-  '200101', // 2001::/23 IETF Protocol Assignments [RFC2928] (2/2)
-  '20010db8', // 2001:db8::/32 Documentation [RFC3849]
-  '2002', // 2002::/16 6to4 [RFC3056]
-  '2620004f8000', // 2620:4f:8000::/48 Direct Delegation AS112 Service [RFC7534]
-  '3fff0', // 3fff::/20 Documentation [RFC9637]
-  '5f00', // 5f00::/16 Segment Routing (SRv6) SIDs [RFC9602]
-  'fc', // fc00::/7 Unique-Local [RFC4193] (1/2)
-  'fd', // fc00::/7 Unique-Local [RFC4193] (2/2)
-  'fe8', // fe80::/10 Link-Local Unicast [RFC4291] (1/4)
-  'fe9', // fe80::/10 Link-Local Unicast [RFC4291] (2/4)
-  'fea', // fe80::/10 Link-Local Unicast [RFC4291] (3/4)
-  'feb', // fe80::/10 Link-Local Unicast [RFC4291] (4/4)
-
-  // TCP cannot connect to multicast, also not in the IANA special-use registry
-  // 'ff', // ff00::/8 Multicast [RFC4291]
-
-  // Handled explicitly in isSpecialUseIPv6 — cannot use startsWith matching
-  // ::1/128 Loopback [RFC4291]
-  // ::/128 Unspecified [RFC4291]
-  // ::ffff:0:0/96 IPv4-mapped [RFC4291] — delegates to isSpecialUseIPv4
+  '0064ff9b0000000000000000', 
+  '0064ff9b0001', 
+  '0100000000000000', 
+  '0100000000000001', 
+  '200100', 
+  '200101', 
+  '20010db8', 
+  '2002', 
+  '2620004f8000', 
+  '3fff0', 
+  '5f00', 
+  'fc', 
+  'fd', 
+  'fe8', 
+  'fe9', 
+  'fea', 
+  'feb', 
+
+  
+  
+
+  
+  
+  
+  
 ];
 
-// Character-level trie built from prefix strings. Walking the trie is
-// 2-3x faster than Map-bucketed startsWith checks because it exits as
-// soon as a terminal (matching) or dead-end (non-matching) node is reached.
+
+
+
 function hexCharToTrieIndex(code) {
-  // '0'-'9' => 0-9, 'a'-'f' => 10-15
-  return code <= 57 /* '9' */ ? code - 48 /* '0' */ : code - 87;
+  
+  return code <= 57   ? code - 48   : code - 87;
 }
 
 const TRIE_CHILDREN = [];
@@ -173,41 +171,78 @@ function isSpecialUseIPv6(address) {
 }
 
 function isSpecialUseIP(address) {
-  // socket.remoteAddress is always a valid IP; colons only appear in IPv6
+  
   if (!address.includes(':')) return isSpecialUseIPv4(address);
   return isSpecialUseIPv6(address);
 }
 
+
+
+function getAgent() {
+  
+  
+  Response;
+  return (
+    globalThis[Symbol.for('undici.globalDispatcher.2')]
+    ?? globalThis[Symbol.for('undici.globalDispatcher.1')]
+  )?.constructor;
+}
+
+function socketSymbolFor(target) {
+  if (target === null || target === undefined) return undefined;
+
+  return Object.getOwnPropertySymbols(target).find((s) => s.description === 'socket');
+}
+
+function destroySpecialUseSocket(target, socketSymbol = socketSymbolFor(target)) {
+  const socket = socketSymbol === undefined ? undefined : target[socketSymbol];
+  if (socket?.remoteAddress === undefined || !isSpecialUseIP(socket.remoteAddress)) {
+    return false;
+  }
+
+  socket.destroy(new Error('hostname resolves to a special-use IP address'));
+  return true;
+}
+
+function applySSRFProtection(dispatcher) {
+  dispatcher.on('connect', (_origin, targets) => {
+    const client = targets[targets.length - 1];
+    destroySpecialUseSocket(client);
+  });
+
+  return dispatcher;
+}
+
+function createSSRFProtectedDispatcher() {
+  const Agent = getAgent();
+  return applySSRFProtection(new Agent());
+}
+
+
 let dispatcher;
 
 export default async function fetchRequest(provider, url, options) {
-  /* eslint-disable no-param-reassign */
   options.signal = AbortSignal.timeout(2500);
   options.headers = new Headers(options.headers);
-  options.headers.set('user-agent', ''); // removes the default user-agent header
-
-  // SSRF protection: validate the connected socket's remote address rather than
-  // resolving DNS upfront via dns/promises. An upfront lookup is vulnerable to
-  // TOCTOU — the HTTP client resolves the hostname again independently, and the
-  // result can differ (DNS rebinding, round-robin, short TTL). Checking
-  // socket.remoteAddress in the connector inspects the actual IP the socket is
-  // bound to, which is the only reliable enforcement point.
-  dispatcher ??= new undici.Agent({
-    connect(opts, cb) {
-      undici.buildConnector({})(opts, (err, socket) => {
-        if (err) {
-          cb(err);
-        } else if (isSpecialUseIP(socket.remoteAddress)) {
-          socket.destroy();
-          cb(new Error('hostname resolves to a special-use IP address'));
-        } else {
-          cb(null, socket);
-        }
-      });
-    },
-  });
-  options.dispatcher = dispatcher;
-  /* eslint-enable no-param-reassign */
+  options.headers.set('user-agent', ''); 
+
+  
+  
+  
+  
+  
+  
+  if (dispatcher === undefined) {
+    try {
+      dispatcher = createSSRFProtectedDispatcher();
+    } catch {
+      attention.warn('failed to setup SSRF protection for fetch, outgoing requests will not be checked for special-use IP addresses');
+      dispatcher = null;
+    }
+  }
+  if (dispatcher) {
+    options.dispatcher = dispatcher;
+  }
 
   return instance(provider).configuration.fetch(url, options);
 }
@@ -218,4 +253,6 @@ export {
   isSpecialUseIPv4,
   isSpecialUseIPv6,
   isSpecialUseIP,
+  destroySpecialUseSocket,
+  applySSRFProtection,
 };

package/dist/node_modules/oidc-provider/lib/helpers/filter_claims.js

@@ -6,7 +6,6 @@ export default (source, target, grant) => {
   const granted = new Set(grant.getOIDCClaimsFiltered(new Set(requested)));
 
   for (const claim of requested) {
-    // eslint-disable-next-line no-continue
     if (NON_REJECTABLE_CLAIMS.has(claim)) continue;
     if (!granted.has(claim)) {
       delete claims[claim];

package/dist/node_modules/oidc-provider/lib/helpers/grant_authorization.js

@@ -0,0 +1,78 @@
+import { resolveRequestedResources as resolveResources } from '../shared/check_resource.js';
+import assertProviderContext from './assert_provider_context.js';
+import { resourceServer as validateResourceServer } from './configuration_result.js';
+import { InvalidScope } from './errors.js';
+import normalizeAuthorizationDetails from './normalize_authorization_details.js';
+import resolveResource from './resolve_resource.js';
+import instance from './weak_cache.js';
+
+export function validateClientScope(provider, ctx, scopes = ctx.oidc.requestParamScopes) {
+  assertProviderContext(provider, ctx);
+
+  if (typeof scopes === 'string') {
+    scopes = new Set(scopes.split(' '));
+  } else if (!(scopes instanceof Set)) {
+    scopes = new Set(scopes);
+  }
+
+  const { client } = ctx.oidc;
+  if (client.scope) {
+    const allowList = new Set(client.scope.split(' '));
+    const statics = instance(provider).configuration.scopes;
+
+    for (const scope of scopes) {
+      if (statics.has(scope) && !allowList.has(scope)) {
+        throw new InvalidScope('requested scope is not allowed', scope);
+      }
+    }
+  }
+
+  return scopes;
+}
+
+export function resolveRequestedResources(provider, ctx) {
+  return resolveResources(provider, ctx);
+}
+
+export async function resolveAndApplyResource(provider, ctx, source, token, grant, scope) {
+  assertProviderContext(provider, ctx);
+
+  const {
+    userinfo,
+    resourceIndicators,
+  } = instance(provider).configuration.features;
+
+  const resource = await resolveResource(ctx, source, { userinfo, resourceIndicators }, scope);
+
+  if (resource) {
+    const resourceServerInfo = validateResourceServer(
+      await resourceIndicators.getResourceServerInfo(ctx, resource, ctx.oidc.client),
+    );
+    token.resourceServer = new provider.ResourceServer(resource, resourceServerInfo);
+    token.scope = grant.getResourceScopeFiltered(resource, scope || source.scopes);
+  } else {
+    token.claims = source.claims;
+    token.scope = grant.getOIDCScopeFiltered(scope || source.scopes);
+  }
+
+  return resource;
+}
+
+export async function applyAuthorizationDetails(provider, ctx, token, source) {
+  assertProviderContext(provider, ctx);
+
+  if (
+    ctx.oidc.params.authorization_details !== undefined
+    || source?.rar !== undefined
+  ) {
+    const { richAuthorizationRequests } = instance(provider).configuration.features;
+    token.rar = normalizeAuthorizationDetails(
+      await richAuthorizationRequests.authorizationDetailsForAccessToken(
+        ctx,
+        token,
+        source,
+        ctx.oidc.params.grant_type,
+      ),
+    );
+  }
+}