@nocobase/plugin-idp-oauth 2.3.0-beta.9 → 2.4.0-alpha.10

package/dist/node_modules/oidc-provider/lib/actions/discovery.js

@@ -1,5 +1,3 @@
-/* eslint-disable max-len */
-
 import defaults from '../helpers/_/defaults.js';
 import instance from '../helpers/weak_cache.js';
 
@@ -141,6 +139,17 @@ export default function discovery(ctx) {
 
   if (features.attestClientAuth.enabled) {
     ctx.body.challenge_endpoint = ctx.oidc.urlFor('challenge');
+    ctx.body.client_attestation_signing_alg_values_supported = configuration.attestSigningAlgValues;
+    ctx.body.client_attestation_pop_signing_alg_values_supported = configuration.attestSigningAlgValues;
+    switch (features.attestClientAuth.additionalSecuritySignal) {
+      case 'optional':
+        ctx.body.client_attestation_pop_methods_supported = ['attestation_pop_jwt', 'none'];
+        break;
+      case 'required':
+        ctx.body.client_attestation_pop_methods_supported = ['attestation_pop_jwt'];
+        break;
+      default:
+    }
   }
 
   if (features.clientIdMetadataDocument.enabled) {

package/dist/node_modules/oidc-provider/lib/actions/end_session.js

@@ -3,7 +3,7 @@ import * as JWT from '../helpers/jwt.js';
 import redirectUri from '../helpers/redirect_uri.js';
 import instance from '../helpers/weak_cache.js';
 import rejectDupes from '../shared/reject_dupes.js';
-import bodyParser from '../shared/conditional_body.js';
+import { urlencoded as parseBody } from '../shared/selective_body.js';
 import paramsMiddleware from '../shared/assemble_params.js';
 import sessionMiddleware from '../shared/session.js';
 import revoke from '../helpers/revoke.js';
@@ -11,7 +11,16 @@ import noCache from '../shared/no_cache.js';
 import formPost from '../response_modes/form_post.js';
 import { generateXsrf, checkXsrf } from '../shared/xsrf.js';
 
-const parseBody = bodyParser.bind(undefined, 'application/x-www-form-urlencoded');
+async function clientForLogout(ctx, clientId) {
+  try {
+    return await ctx.oidc.provider.Client.find(clientId);
+  } catch (err) {
+    if (err instanceof InvalidClient) {
+      return undefined;
+    }
+    throw err;
+  }
+}
 
 export const init = [
   noCache,
@@ -28,8 +37,8 @@ export const init = [
       try {
         const idTokenHint = JWT.decode(params.id_token_hint);
         ctx.oidc.entity('IdTokenHint', idTokenHint);
-      } catch (err) {
-        throw new InvalidRequest('could not decode id_token_hint', undefined, err.message);
+      } catch (cause) {
+        throw new InvalidRequest('could not decode id_token_hint', undefined, { cause });
       }
       const { payload: { aud: clientId } } = ctx.oidc.entities.IdTokenHint;
 
@@ -42,12 +51,12 @@ export const init = [
       }
       try {
         await ctx.oidc.provider.IdToken.validate(params.id_token_hint, client);
-      } catch (err) {
-        if (err instanceof OIDCProviderError) {
-          throw err;
+      } catch (cause) {
+        if (cause instanceof OIDCProviderError) {
+          throw cause;
         }
 
-        throw new InvalidRequest('could not validate id_token_hint', undefined, err.message);
+        throw new InvalidRequest('could not validate id_token_hint', undefined, { cause });
       }
       ctx.oidc.entity('Client', client);
     } else if (params.client_id) {
@@ -120,7 +129,7 @@ export const confirm = [
 
       for (const clientId of clientIds) {
         if (params.logout || clientId === state.clientId) {
-          const client = await ctx.oidc.provider.Client.find(clientId);
+          const client = await clientForLogout(ctx, clientId);
           if (client) {
             const sid = session.sidFor(client.clientId);
             if (client.backchannelLogoutUri) {
@@ -140,16 +149,16 @@ export const confirm = [
     }
 
     if (state.clientId) {
-      ctx.oidc.entity('Client', await ctx.oidc.provider.Client.find(state.clientId));
+      ctx.oidc.entity('Client', await clientForLogout(ctx, state.clientId));
     }
 
     if (params.logout) {
       if (session.authorizations) {
         await Promise.all(
           Object.entries(session.authorizations).map(async ([clientId, { grantId }]) => {
-            // Drop the grants without offline_access
-            // Note: tokens that don't get dropped due to offline_access having being added
-            // later will still not work, as such they will be orphaned until their TTL hits
+            
+            
+            
             if (grantId && !session.authorizationFor(clientId).persistsLogout) {
               await revoke(ctx, grantId);
             }
@@ -168,7 +177,6 @@ export const confirm = [
       const grantId = session.grantIdFor(state.clientId);
       if (grantId && !session.authorizationFor(state.clientId).persistsLogout) {
         await revoke(ctx, grantId);
-        ctx.oidc.provider.emit('grant.revoked', ctx, grantId);
       }
       session.state = undefined;
       if (session.authorizations) {
@@ -183,7 +191,7 @@ export const confirm = [
       usePostLogoutUri ? state.postLogoutRedirectUri : ctx.oidc.urlFor('end_session_success'),
       {
         ...(usePostLogoutUri && state.state != null
-          ? { state: state.state } : undefined), // != intended
+          ? { state: state.state } : undefined), 
         ...(forwardClientId ? { client_id: state.clientId } : undefined),
       },
     );

package/dist/node_modules/oidc-provider/lib/actions/grants/authorization_code.js

@@ -2,44 +2,27 @@ import { InvalidGrant } from '../../helpers/errors.js';
 import presence from '../../helpers/validate_presence.js';
 import instance from '../../helpers/weak_cache.js';
 import checkPKCE from '../../helpers/pkce.js';
-import revoke from '../../helpers/revoke.js';
-import dpopValidate from '../../helpers/validate_dpop.js';
-import checkRar from '../../shared/check_rar.js';
 import { checkAttestBinding } from '../../helpers/check_attest_binding.js';
-import {
-  checkMtlsCert,
-  checkDpopRequired,
-  validateGrant,
-  validateAccount,
-  checkAccountMismatch,
-  createAccessToken,
-  applyMtlsBinding,
-  applyDpopBinding,
-  resolveAndApplyResource,
-  createRefreshToken,
-  issueIdToken,
-  buildTokenResponse,
-} from '../../helpers/grant_common.js';
+import { issueTokens } from '../../helpers/grant_common.js';
 
 const gty = 'authorization_code';
 
-export const handler = async function authorizationCodeHandler(ctx) {
+export const handler = async function authorizationCodeHandler(provider, helpers, ctx) {
+  const {
+    checkDpopRequired,
+    checkMtlsCert,
+    validateDpop,
+    findGrantSource,
+    consumeGrantSource,
+    validateGrant,
+  } = helpers;
+
   const {
-    findAccount,
-    issueRefreshToken,
     allowOmittingSingleRegisteredRedirectUri,
-    conformIdTokenClaims,
-    features: {
-      userinfo,
-      mTLS: { getCertificate },
-      resourceIndicators,
-      richAuthorizationRequests,
-      dPoP: { allowReplay },
-    },
-  } = instance(ctx.oidc.provider).configuration;
+  } = instance(provider).configuration;
 
   if (allowOmittingSingleRegisteredRedirectUri && ctx.oidc.params.redirect_uri === undefined) {
-    // It is permitted to omit the redirect_uri if only ONE is registered on the client
+    
     const { 0: uri, length } = ctx.oidc.client.redirectUris;
     if (uri && length === 1) {
       ctx.oidc.params.redirect_uri = uri;
@@ -48,19 +31,14 @@ export const handler = async function authorizationCodeHandler(ctx) {
 
   presence(ctx, 'code', 'redirect_uri');
 
-  const dPoP = await dpopValidate(ctx);
-
-  const code = await ctx.oidc.provider.AuthorizationCode.find(ctx.oidc.params.code, {
-    ignoreExpiration: true,
-  });
-
-  if (!code) {
-    throw new InvalidGrant('authorization code not found');
-  }
+  const dPoP = await validateDpop(ctx);
 
-  if (code.clientId !== ctx.oidc.client.clientId) {
-    throw new InvalidGrant('client mismatch');
-  }
+  const code = await findGrantSource(
+    ctx,
+    provider.AuthorizationCode,
+    ctx.oidc.params.code,
+    'authorization code',
+  );
 
   if (code.isExpired) {
     throw new InvalidGrant('authorization code is expired');
@@ -70,7 +48,7 @@ export const handler = async function authorizationCodeHandler(ctx) {
 
   checkPKCE(ctx.oidc.params.code_verifier, code.codeChallenge, code.codeChallengeMethod);
 
-  const cert = checkMtlsCert(ctx, getCertificate);
+  const cert = checkMtlsCert(ctx);
   checkDpopRequired(ctx, dPoP);
 
   if (code.redirectUri !== ctx.oidc.params.redirect_uri) {
@@ -81,61 +59,13 @@ export const handler = async function authorizationCodeHandler(ctx) {
     await checkAttestBinding(ctx, code);
   }
 
-  if (code.consumed) {
-    await revoke(ctx, code.grantId);
-    throw new InvalidGrant('authorization code already consumed');
-  }
-
-  await code.consume();
+  await consumeGrantSource(ctx, code, 'authorization code');
 
   ctx.oidc.entity('AuthorizationCode', code);
   ctx.oidc.entity('Grant', grant);
 
-  const account = await validateAccount(ctx, findAccount, code, 'authorization code');
-  checkAccountMismatch(code, grant);
-
-  ctx.oidc.entity('Account', account);
-
-  const { RefreshToken } = ctx.oidc.provider;
-
-  const at = createAccessToken(
-    ctx,
-    ctx.oidc.provider.AccessToken,
-    { ...code, accountId: account.accountId },
-    gty,
-  );
-  applyMtlsBinding(at, cert);
-
-  if (code.dpopJkt && !dPoP) {
-    throw new InvalidGrant('missing DPoP proof JWT');
-  }
-
-  await applyDpopBinding(ctx, dPoP, at, allowReplay);
-
-  if (dPoP && code.dpopJkt && code.dpopJkt !== dPoP.thumbprint) {
-    throw new InvalidGrant('DPoP proof key thumbprint does not match dpop_jkt');
-  }
-
-  await checkRar(ctx, () => {});
-  await resolveAndApplyResource(ctx, code, at, grant, { userinfo, resourceIndicators });
-
-  if (richAuthorizationRequests.enabled && at.resourceServer) {
-    at.rar = await richAuthorizationRequests.rarForCodeResponse(ctx, at.resourceServer);
-  }
-
-  ctx.oidc.entity('AccessToken', at);
-  const accessToken = await at.save();
-
-  const refreshToken = await createRefreshToken(ctx, code, at, gty, {
-    issueRefreshToken, RefreshToken,
-  });
-
-  const idToken = await issueIdToken(ctx, code, at, grant, {
-    conformIdTokenClaims, userinfo,
-  });
-
-  ctx.body = buildTokenResponse(at, accessToken, {
-    idToken, refreshToken, source: code, rar: at.rar,
+  await issueTokens(provider, helpers, ctx, code, grant, {
+    gty, entityLabel: 'authorization code', cert, dPoP,
   });
 };
 

package/dist/node_modules/oidc-provider/lib/actions/grants/ciba.js

@@ -1,60 +1,35 @@
-import { AuthorizationPending, ExpiredToken, InvalidGrant } from '../../helpers/errors.js';
+import { AuthorizationPending, ExpiredToken } from '../../helpers/errors.js';
 import presence from '../../helpers/validate_presence.js';
-import instance from '../../helpers/weak_cache.js';
-import revoke from '../../helpers/revoke.js';
-import dpopValidate from '../../helpers/validate_dpop.js';
 import { checkAttestBinding } from '../../helpers/check_attest_binding.js';
-import checkRar from '../../shared/check_rar.js';
 import {
   throwIfAsyncGrantError,
-  checkMtlsCert,
-  checkDpopRequired,
-  validateGrant,
-  validateAccount,
-  checkAccountMismatch,
-  createAccessToken,
-  applyMtlsBinding,
-  applyDpopBinding,
-  resolveAndApplyResource,
-  createRefreshToken,
-  issueIdToken,
-  buildTokenResponse,
+  issueTokens,
 } from '../../helpers/grant_common.js';
 
 export const gty = 'ciba';
 
-export const handler = async function cibaHandler(ctx) {
+export const handler = async function cibaHandler(provider, helpers, ctx) {
+  const {
+    checkDpopRequired,
+    checkMtlsCert,
+    validateDpop,
+    findGrantSource,
+    consumeGrantSource,
+    validateGrant,
+  } = helpers;
+
   presence(ctx, 'auth_req_id');
 
-  const {
-    findAccount,
-    issueRefreshToken,
-    conformIdTokenClaims,
-    features: {
-      userinfo,
-      mTLS: { getCertificate },
-      dPoP: { allowReplay },
-      resourceIndicators,
-      richAuthorizationRequests,
-    },
-  } = instance(ctx.oidc.provider).configuration;
-
-  const dPoP = await dpopValidate(ctx);
-
-  const request = await ctx.oidc.provider.BackchannelAuthenticationRequest.find(
+  const dPoP = await validateDpop(ctx);
+
+  const request = await findGrantSource(
+    ctx,
+    provider.BackchannelAuthenticationRequest,
     ctx.oidc.params.auth_req_id,
-    { ignoreExpiration: true },
+    'backchannel authentication request',
   );
 
-  if (!request) {
-    throw new InvalidGrant('backchannel authentication request not found');
-  }
-
-  if (request.clientId !== ctx.oidc.client.clientId) {
-    throw new InvalidGrant('client mismatch');
-  }
-
-  const cert = checkMtlsCert(ctx, getCertificate);
+  const cert = checkMtlsCert(ctx);
   checkDpopRequired(ctx, dPoP);
 
   if (request.isExpired) {
@@ -69,12 +44,7 @@ export const handler = async function cibaHandler(ctx) {
     await checkAttestBinding(ctx, request);
   }
 
-  if (request.consumed) {
-    await revoke(ctx, request.grantId);
-    throw new InvalidGrant('backchannel authentication request already consumed');
-  }
-
-  await request.consume();
+  await consumeGrantSource(ctx, request, 'backchannel authentication request');
 
   throwIfAsyncGrantError(request);
 
@@ -83,42 +53,8 @@ export const handler = async function cibaHandler(ctx) {
   ctx.oidc.entity('BackchannelAuthenticationRequest', request);
   ctx.oidc.entity('Grant', grant);
 
-  const account = await validateAccount(ctx, findAccount, request, 'backchannel authentication request');
-  checkAccountMismatch(request, grant);
-
-  ctx.oidc.entity('Account', account);
-
-  const { RefreshToken } = ctx.oidc.provider;
-
-  const at = createAccessToken(
-    ctx,
-    ctx.oidc.provider.AccessToken,
-    { ...request, accountId: account.accountId },
-    gty,
-  );
-  applyMtlsBinding(at, cert);
-  await applyDpopBinding(ctx, dPoP, at, allowReplay);
-
-  await checkRar(ctx, () => {});
-  await resolveAndApplyResource(ctx, request, at, grant, { userinfo, resourceIndicators });
-
-  if (richAuthorizationRequests.enabled && at.resourceServer) {
-    at.rar = await richAuthorizationRequests.rarForBackchannelResponse(ctx, at.resourceServer);
-  }
-
-  ctx.oidc.entity('AccessToken', at);
-  const accessToken = await at.save();
-
-  const refreshToken = await createRefreshToken(ctx, request, at, gty, {
-    issueRefreshToken, RefreshToken,
-  });
-
-  const idToken = await issueIdToken(ctx, request, at, grant, {
-    conformIdTokenClaims, userinfo,
-  });
-
-  ctx.body = buildTokenResponse(at, accessToken, {
-    idToken, refreshToken, source: request, rar: at.rar,
+  await issueTokens(provider, helpers, ctx, request, grant, {
+    gty, entityLabel: 'backchannel authentication request', cert, dPoP,
   });
 };
 

package/dist/node_modules/oidc-provider/lib/actions/grants/client_credentials.js

@@ -1,52 +1,31 @@
-import instance from '../../helpers/weak_cache.js';
-import {
-  InvalidTarget, InvalidScope, InvalidRequest,
-} from '../../helpers/errors.js';
-import dpopValidate from '../../helpers/validate_dpop.js';
-import checkResource from '../../shared/check_resource.js';
-import {
-  checkMtlsCert,
-  applyDpopBinding,
-  checkDpopRequired,
-} from '../../helpers/grant_common.js';
+import { InvalidTarget } from '../../helpers/errors.js';
+import { applyDpopBinding } from '../../helpers/grant_common.js';
 
-export const handler = async function clientCredentialsHandler(ctx) {
-  const { client } = ctx.oidc;
-  const { ClientCredentials } = ctx.oidc.provider;
+export const handler = async function clientCredentialsHandler(provider, helpers, ctx) {
   const {
-    features: {
-      mTLS: { getCertificate },
-      dPoP: { allowReplay },
-    },
-    scopes: statics,
-  } = instance(ctx.oidc.provider).configuration;
-
-  const dPoP = await dpopValidate(ctx);
-
-  if (ctx.oidc.params.authorization_details) {
-    throw new InvalidRequest('authorization_details is unsupported for this grant_type');
-  }
-
-  await checkResource(ctx, () => {});
+    checkDpopRequired,
+    checkMtlsCert,
+    validateDpop,
+    applyAuthorizationDetails,
+    buildTokenResponse,
+    resolveRequestedResources,
+    validateClientScope,
+  } = helpers;
 
-  const scopes = [...new Set(ctx.oidc.params.scope?.split(' '))];
+  const { client } = ctx.oidc;
+  const { ClientCredentials } = provider;
 
-  if (client.scope) {
-    const allowList = new Set(client.scope.split(' '));
+  const dPoP = await validateDpop(ctx);
 
-    for (const scope of scopes.filter(Set.prototype.has.bind(statics))) {
-      if (!allowList.has(scope)) {
-        throw new InvalidScope('requested scope is not allowed', scope);
-      }
-    }
-  }
+  const resourceServers = await resolveRequestedResources(ctx);
+  const scopes = [...validateClientScope(ctx)];
 
   const token = new ClientCredentials({
     client,
     scope: scopes.join(' ') || undefined,
   });
 
-  const { 0: resourceServer, length } = Object.values(ctx.oidc.resourceServers);
+  const { 0: resourceServer, length } = resourceServers;
   if (resourceServer) {
     if (length !== 1) {
       throw new InvalidTarget('only a single resource indicator value is supported for this grant type');
@@ -55,23 +34,25 @@ export const handler = async function clientCredentialsHandler(ctx) {
     token.scope = scopes.filter(Set.prototype.has.bind(new Set(resourceServer.scope.split(' ')))).join(' ') || undefined;
   }
 
-  const cert = checkMtlsCert(ctx, getCertificate);
+  const cert = checkMtlsCert(ctx);
   if (cert) {
     token.setThumbprint('x5t', cert);
   }
 
-  await applyDpopBinding(ctx, dPoP, token, allowReplay);
+  await applyDpopBinding(provider, ctx, dPoP, token);
   checkDpopRequired(ctx, dPoP);
+  await applyAuthorizationDetails(ctx, token);
 
   ctx.oidc.entity('ClientCredentials', token);
   const value = await token.save();
 
-  ctx.body = {
-    access_token: value,
-    expires_in: token.expiration,
-    token_type: token.tokenType,
+  ctx.body = buildTokenResponse({
+    accessToken: value,
+    authorizationDetails: token.rar,
+    expiresIn: token.expiration,
     scope: token.scope || undefined,
-  };
+    tokenType: token.tokenType,
+  });
 };
 
 export const parameters = new Set(['scope']);

package/dist/node_modules/oidc-provider/lib/actions/grants/device_code.js

@@ -1,67 +1,41 @@
 import {
-  AuthorizationPending, ExpiredToken, InvalidGrant, InvalidRequest,
+  AuthorizationPending, ExpiredToken,
 } from '../../helpers/errors.js';
 import presence from '../../helpers/validate_presence.js';
-import instance from '../../helpers/weak_cache.js';
-import revoke from '../../helpers/revoke.js';
-import dpopValidate from '../../helpers/validate_dpop.js';
 import { checkAttestBinding } from '../../helpers/check_attest_binding.js';
 import {
   throwIfAsyncGrantError,
-  checkMtlsCert,
-  checkDpopRequired,
-  validateGrant,
-  validateAccount,
-  checkAccountMismatch,
-  createAccessToken,
-  applyMtlsBinding,
-  applyDpopBinding,
-  resolveAndApplyResource,
-  createRefreshToken,
-  issueIdToken,
-  buildTokenResponse,
+  issueTokens,
 } from '../../helpers/grant_common.js';
 
 export const gty = 'device_code';
 
-export const handler = async function deviceCodeHandler(ctx) {
-  presence(ctx, 'device_code');
-
-  if (ctx.oidc.params.authorization_details) {
-    throw new InvalidRequest('authorization_details is unsupported for this grant_type');
-  }
-
+export const handler = async function deviceCodeHandler(provider, helpers, ctx) {
   const {
-    findAccount,
-    issueRefreshToken,
-    conformIdTokenClaims,
-    features: {
-      userinfo,
-      mTLS: { getCertificate },
-      dPoP: { allowReplay },
-      resourceIndicators,
-    },
-  } = instance(ctx.oidc.provider).configuration;
-
-  const dPoP = await dpopValidate(ctx);
-
-  const code = await ctx.oidc.provider.DeviceCode.find(ctx.oidc.params.device_code, {
-    ignoreExpiration: true,
-  });
+    checkDpopRequired,
+    checkMtlsCert,
+    validateDpop,
+    findGrantSource,
+    consumeGrantSource,
+    validateGrant,
+  } = helpers;
 
-  if (!code) {
-    throw new InvalidGrant('device code not found');
-  }
+  presence(ctx, 'device_code');
 
-  if (code.clientId !== ctx.oidc.client.clientId) {
-    throw new InvalidGrant('client mismatch');
-  }
+  const dPoP = await validateDpop(ctx);
+
+  const code = await findGrantSource(
+    ctx,
+    provider.DeviceCode,
+    ctx.oidc.params.device_code,
+    'device code',
+  );
 
   if (ctx.oidc.client.clientAuthMethod === 'attest_jwt_client_auth') {
     await checkAttestBinding(ctx, code);
   }
 
-  const cert = checkMtlsCert(ctx, getCertificate);
+  const cert = checkMtlsCert(ctx);
   checkDpopRequired(ctx, dPoP);
 
   if (code.isExpired) {
@@ -72,12 +46,7 @@ export const handler = async function deviceCodeHandler(ctx) {
     throw new AuthorizationPending();
   }
 
-  if (code.consumed) {
-    await revoke(ctx, code.grantId);
-    throw new InvalidGrant('device code already consumed');
-  }
-
-  await code.consume();
+  await consumeGrantSource(ctx, code, 'device code');
 
   throwIfAsyncGrantError(code);
 
@@ -86,37 +55,8 @@ export const handler = async function deviceCodeHandler(ctx) {
   ctx.oidc.entity('DeviceCode', code);
   ctx.oidc.entity('Grant', grant);
 
-  const account = await validateAccount(ctx, findAccount, code, 'device code');
-  checkAccountMismatch(code, grant);
-
-  ctx.oidc.entity('Account', account);
-
-  const { RefreshToken } = ctx.oidc.provider;
-
-  const at = createAccessToken(
-    ctx,
-    ctx.oidc.provider.AccessToken,
-    { ...code, accountId: account.accountId },
-    gty,
-  );
-  applyMtlsBinding(at, cert);
-  await applyDpopBinding(ctx, dPoP, at, allowReplay);
-
-  await resolveAndApplyResource(ctx, code, at, grant, { userinfo, resourceIndicators });
-
-  ctx.oidc.entity('AccessToken', at);
-  const accessToken = await at.save();
-
-  const refreshToken = await createRefreshToken(ctx, code, at, gty, {
-    issueRefreshToken, RefreshToken,
-  });
-
-  const idToken = await issueIdToken(ctx, code, at, grant, {
-    conformIdTokenClaims, userinfo,
-  });
-
-  ctx.body = buildTokenResponse(at, accessToken, {
-    idToken, refreshToken, source: code,
+  await issueTokens(provider, helpers, ctx, code, grant, {
+    gty, entityLabel: 'device code', cert, dPoP,
   });
 };
 

package/dist/node_modules/oidc-provider/lib/actions/grants/index.js

@@ -1,7 +1,6 @@
-/* eslint-disable camelcase, import/export */
-
 export * as authorization_code from './authorization_code.js';
 export * as client_credentials from './client_credentials.js';
 export * as refresh_token from './refresh_token.js';
 export * as device_code from './device_code.js';
 export * as ciba from './ciba.js';
+export * as pre_authorized_code from './pre_authorized_code.js';