@nocobase/plugin-idp-oauth 2.4.0-alpha.7 → 2.4.0-alpha.9

package/dist/node_modules/oidc-provider/THIRD-PARTY-NOTICES.md

@@ -0,0 +1,184 @@
+# Third party notices
+
+`oidc-provider` carries code derived from the projects below. Each is MIT
+licensed, and each notice is reproduced here as that licence requires. These are
+not runtime dependencies - the code lives in this package.
+
+## nanoid
+
+https://github.com/ai/nanoid
+
+lib/helpers/nanoid.js transcribes its customAlphabet: the mask derivation,
+the rejection of out-of-range values, and the pooling of generated bytes.
+
+```
+MIT License
+
+Copyright 2017 Andrey Sitnik <andrey@sitnik.es>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+```
+
+## quick-lru
+
+https://github.com/sindresorhus/quick-lru
+
+lib/helpers/lru.js transcribes the subset used here: the two generation
+eviction scheme and lazy per entry expiry.
+
+```
+MIT License
+
+Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+```
+
+## @koa/cors
+
+https://github.com/koajs/cors
+
+lib/shared/cors.js transcribes the header handling for the options this
+application passed it.
+
+```
+MIT License
+
+Copyright (c) 2015 - present koajs and other contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+```
+
+## koa-compose
+
+https://github.com/koajs/compose
+
+The compose() in lib/helpers/router.js is its middleware dispatcher.
+
+```
+MIT License
+
+Copyright (c) 2019 Koa contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+```
+
+## @koa/router
+
+https://github.com/koajs/router
+
+lib/helpers/router.js reimplements the routing surface this application
+used, and reproduces its matching, reverse lookup and context contract.
+
+```
+MIT License
+
+Copyright (c) 2015 @koajs maintainers and contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+```
+
+## Eta
+
+https://github.com/eta-dev/eta
+
+lib/views/*.js are Eta compiler output, and lib/views/index.js reproduces
+Eta's default escape function and the small runtime those templates call.
+
+```
+MIT License
+
+Copyright 2025 Ben Gubler <nebrelbug@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+```

package/dist/node_modules/oidc-provider/lib/actions/authorization/ciba.js

@@ -0,0 +1,169 @@
+import presence from '../../helpers/validate_presence.js';
+import { InvalidRequest, UnknownUserId, InvalidRequestObject } from '../../helpers/errors.js';
+import omitBy from '../../helpers/_/omit_by.js';
+import { account as validateAccount } from '../../helpers/configuration_result.js';
+import instance from '../../helpers/weak_cache.js';
+import { checkIdTokenHint } from './claims.js';
+
+const CLIENT_NOTIFICATION_TOKEN = /^[A-Za-z0-9._~+\x2F-]+=*$/u;
+
+export function cibaRequired(ctx, next) {
+  const required = new Set(['scope']);
+  const callbackMode = ctx.oidc.client.backchannelTokenDeliveryMode !== 'poll';
+
+  if (callbackMode) {
+    required.add('client_notification_token');
+  }
+
+  presence(ctx, ...required);
+
+  if (callbackMode) {
+    const { client_notification_token: clientNotificationToken } = ctx.oidc.params;
+    if (!CLIENT_NOTIFICATION_TOKEN.test(clientNotificationToken)) {
+      throw new InvalidRequest('client_notification_token must be a valid Bearer token');
+    }
+
+    if (clientNotificationToken.length > 1024) {
+      throw new InvalidRequest('client_notification_token must not exceed 1024 characters');
+    }
+  } else {
+    ctx.oidc.params.client_notification_token = undefined;
+  }
+
+  return next();
+}
+
+export async function cibaLoadAccount(ctx, next) {
+  const mechanisms = omitBy({
+    login_hint_token: ctx.oidc.params.login_hint_token,
+    id_token_hint: ctx.oidc.params.id_token_hint,
+    login_hint: ctx.oidc.params.login_hint,
+  }, (value) => typeof value !== 'string' || !value);
+
+  let mechanism;
+  let length;
+  let value;
+
+  try {
+    ({ 0: [mechanism, value], length } = Object.entries(mechanisms));
+  } catch {}
+
+  if (!length) {
+    throw new InvalidRequest('missing one of required parameters login_hint_token, id_token_hint, or login_hint');
+  } else if (length !== 1) {
+    throw new InvalidRequest('only one of required parameters login_hint_token, id_token_hint, or login_hint must be provided');
+  }
+
+  const { findAccount, features } = instance(ctx.oidc.provider).configuration;
+  const { ciba } = features;
+
+  let accountId;
+  switch (mechanism) {
+    case 'id_token_hint':
+      await checkIdTokenHint(ctx, () => {});
+      ({ payload: { sub: accountId } } = ctx.oidc.entities.IdTokenHint);
+      break;
+    case 'login_hint_token':
+      accountId = await ciba.processLoginHintToken(ctx, value);
+      break;
+    case 'login_hint':
+      accountId = await ciba.processLoginHint(ctx, value);
+      break;
+  }
+
+  if (!accountId) {
+    throw new UnknownUserId('could not identify end-user');
+  }
+  const account = validateAccount(await findAccount(ctx, accountId));
+  if (!account) {
+    throw new UnknownUserId('could not identify end-user');
+  }
+  ctx.oidc.entity('Account', account);
+
+  await ciba.verifyUserCode(ctx, account, ctx.oidc.params.user_code);
+
+  return next();
+}
+
+
+
+
+export function checkRequestedExpiry(ctx, next) {
+  if (ctx.oidc.params.requested_expiry !== undefined) {
+    const requestedExpiry = +ctx.oidc.params.requested_expiry;
+
+    if (!Number.isSafeInteger(requestedExpiry) || Math.sign(requestedExpiry) !== 1) {
+      throw new InvalidRequest('invalid requested_expiry parameter value');
+    }
+  }
+
+  return next();
+}
+
+export async function checkCibaContext(ctx, next) {
+  const { ciba } = instance(ctx.oidc.provider).features;
+
+  await Promise.all([
+    ciba.validateRequestContext(ctx, ctx.oidc.params.request_context),
+    ciba.validateBindingMessage(ctx, ctx.oidc.params.binding_message),
+  ]);
+
+  return next();
+}
+
+export async function backchannelRequestResponse(ctx) {
+  const { BackchannelAuthenticationRequest } = ctx.oidc.provider;
+  const { ciba } = instance(ctx.oidc.provider).features;
+
+  const request = new BackchannelAuthenticationRequest({
+    accountId: ctx.oidc.account.accountId,
+    claims: ctx.oidc.claims,
+    client: ctx.oidc.client,
+    nonce: ctx.oidc.params.nonce,
+    params: ctx.oidc.params.toPlainObject(),
+    resource: Object.keys(ctx.oidc.resourceServers),
+    scope: [...ctx.oidc.requestParamScopes].join(' '),
+  });
+
+  if (ctx.oidc.client.clientAuthMethod === 'attest_jwt_client_auth') {
+    await request.setAttestBinding(ctx);
+  }
+
+  switch (request.resource.length) {
+    case 0:
+      delete request.resource;
+      break;
+    case 1:
+      [request.resource] = request.resource;
+      break;
+  }
+
+  ctx.oidc.entity('BackchannelAuthenticationRequest', request);
+
+  const id = await request.save();
+
+  ctx.body = {
+    expires_in: request.expiration,
+    auth_req_id: id,
+  };
+
+  await ciba.triggerAuthenticationDevice(ctx, request, ctx.oidc.account, ctx.oidc.client);
+}
+
+
+
+
+async function requestObjectRemapErrors(_ctx, next) {
+  return next().catch((err) => {
+    if (err instanceof InvalidRequestObject) {
+      Object.assign(err, {
+        message: 'invalid_request',
+        error: 'invalid_request',
+      });
+    }
+
+    throw err;
+  });
+}
+
+export { requestObjectRemapErrors as backchannelRequestRemapErrors };

package/dist/node_modules/oidc-provider/lib/actions/authorization/claims.js

@@ -0,0 +1,132 @@
+import { InvalidRequest, OIDCProviderError } from '../../helpers/errors.js';
+import instance from '../../helpers/weak_cache.js';
+import isJsonObject from '../../helpers/_/is_json_object.js';
+
+
+
+
+
+
+
+
+
+
+
+
+export async function checkClaims(ctx, next) {
+  const { params } = ctx.oidc;
+
+  if (params.claims !== undefined) {
+    const { claimsParameter, userinfo } = instance(ctx.oidc.provider).features;
+
+    if (claimsParameter.enabled) {
+      if (params.response_type === 'none') {
+        throw new InvalidRequest('claims parameter should not be combined with response_type none');
+      }
+
+      let claims;
+
+      try {
+        claims = JSON.parse(params.claims);
+      } catch (cause) {
+        throw new InvalidRequest('could not parse the claims parameter JSON', undefined, { cause });
+      }
+
+      if (!isJsonObject(claims)) {
+        throw new InvalidRequest('claims parameter should be a JSON object');
+      }
+
+      if (claims.userinfo === undefined && claims.id_token === undefined) {
+        throw new InvalidRequest('claims parameter should have userinfo or id_token properties');
+      }
+
+      if (claims.userinfo !== undefined && !isJsonObject(claims.userinfo)) {
+        throw new InvalidRequest('claims.userinfo should be an object');
+      }
+
+      if (claims.id_token !== undefined && !isJsonObject(claims.id_token)) {
+        throw new InvalidRequest('claims.id_token should be an object');
+      }
+
+      for (const container of ['userinfo', 'id_token']) {
+        if (claims[container] !== undefined) {
+          for (const value of Object.values(claims[container])) {
+            if (value !== null && !isJsonObject(value)) {
+              throw new InvalidRequest(`claims.${container} members must be null or objects`);
+            }
+          }
+        }
+      }
+
+      if (claims.userinfo && !userinfo.enabled) {
+        throw new InvalidRequest('claims.userinfo should not be used since userinfo endpoint is not supported');
+      }
+
+      if (params.response_type === 'id_token' && claims.userinfo) {
+        throw new InvalidRequest('claims.userinfo should not be used if access_token is not issued');
+      }
+
+      await claimsParameter.assertClaimsParameter?.(
+        ctx,
+        claims,
+        ctx.oidc.client,
+      );
+    }
+  }
+
+  return next();
+}
+
+function assignIdTokenClaim(ctx, claim, value) {
+  ctx.oidc.claims ||= {};
+  ctx.oidc.claims.id_token ||= {};
+  ctx.oidc.claims.id_token[claim] = value;
+}
+
+
+
+
+
+
+
+export function assignClaims(ctx, next) {
+  const { params } = ctx.oidc;
+
+  if (params.claims !== undefined && instance(ctx.oidc.provider).features.claimsParameter.enabled) {
+    ctx.oidc.claims = JSON.parse(params.claims);
+  }
+
+  if (params.max_age !== undefined || ctx.oidc.client.requireAuthTime || ctx.oidc.prompts.has('login')) {
+    assignIdTokenClaim(ctx, 'auth_time', { essential: true });
+  }
+
+  const acrValues = params.acr_values;
+
+  if (acrValues) {
+    assignIdTokenClaim(ctx, 'acr', { values: acrValues.split(' ') });
+  }
+
+  return next();
+}
+
+
+
+
+export async function checkIdTokenHint(ctx, next) {
+  const { oidc } = ctx;
+  if (oidc.params.id_token_hint !== undefined) {
+    let idTokenHint;
+    try {
+      idTokenHint = await oidc.provider.IdToken.validate(oidc.params.id_token_hint, oidc.client);
+    } catch (cause) {
+      if (cause instanceof OIDCProviderError) {
+        throw cause;
+      }
+
+      throw new InvalidRequest('could not validate id_token_hint', undefined, { cause });
+    }
+    ctx.oidc.entity('IdTokenHint', idTokenHint);
+  }
+
+  return next();
+}

package/dist/node_modules/oidc-provider/lib/actions/authorization/client.js

@@ -0,0 +1,50 @@
+import presence from '../../helpers/validate_presence.js';
+import { InvalidClient, InvalidRequest } from '../../helpers/errors.js';
+
+function deviceAuthorizationResponse(ctx, next) {
+  if (!ctx.oidc.body.client_id) {
+    ctx.oidc.body.client_id = ctx.oidc.client.clientId;
+  }
+  return next();
+}
+
+
+
+
+export async function checkClient(ctx, next) {
+  presence(ctx, 'client_id');
+
+  const client = await ctx.oidc.provider.Client.find(ctx.oidc.params.client_id);
+
+  if (!client) {
+    
+    ctx.oidc.noclient = true;
+    throw new InvalidClient('client is invalid', 'client not found');
+  }
+
+  ctx.oidc.entity('Client', client);
+
+  return next();
+}
+
+export function checkClientGrantType({ oidc: { route, client } }, next) {
+  let grantType;
+  switch (route) {
+    case 'device_authorization':
+      grantType = 'urn:ietf:params:oauth:grant-type:device_code';
+      break;
+    case 'backchannel_authentication':
+      grantType = 'urn:openid:params:grant-type:ciba';
+      break;
+    default:
+      throw new Error('not implemented');
+  }
+
+  if (!client.grantTypeAllowed(grantType)) {
+    throw new InvalidRequest(`${grantType} is not allowed for this client`);
+  }
+
+  return next();
+}
+
+export { deviceAuthorizationResponse as authenticatedClientId };

package/dist/node_modules/oidc-provider/lib/actions/authorization/device.js

@@ -0,0 +1,164 @@
+import Params from '../../helpers/params.js';
+import { NotFoundError, ExpiredError, AlreadyUsedError, ReRenderError, AbortedError } from '../../helpers/re_render_errors.js';
+import { AccessDenied } from '../../helpers/errors.js';
+import errOut from '../../helpers/err_out.js';
+import combinedScope from '../../helpers/combined_scope.js';
+import { boolean } from '../../helpers/configuration_result.js';
+import normalizeAuthorizationDetails from '../../helpers/normalize_authorization_details.js';
+import instance from '../../helpers/weak_cache.js';
+import { generate, normalize } from '../../helpers/user_codes.js';
+import { getAuthorizationParams } from './request_parameters.js';
+
+export async function deviceUserFlow(ctx, next) {
+  if (ctx.oidc.route === 'device_resume') {
+    const code = await ctx.oidc.provider.DeviceCode.find(
+      ctx.oidc.entities.Interaction.deviceCode,
+      { ignoreExpiration: true, ignoreSessionBinding: true },
+    );
+
+    if (!code) {
+      throw new NotFoundError();
+    }
+
+    if (code.isExpired) {
+      throw new ExpiredError();
+    }
+
+    if (code.error || code.accountId) {
+      throw new AlreadyUsedError();
+    }
+
+    ctx.oidc.entity('DeviceCode', code);
+  } else {
+    ctx.oidc.params = new Params(getAuthorizationParams(ctx), ctx.oidc.deviceCode.params);
+  }
+
+  await next();
+}
+
+export async function deviceUserFlowErrors(ctx, next) {
+  try {
+    await next();
+  } catch (cause) {
+    if (!(cause instanceof ReRenderError)) {
+      const out = errOut(cause);
+
+      let code = ctx.oidc.deviceCode;
+
+      if (!code && ctx.oidc.entities.Interaction?.deviceCode) {
+        code = await ctx.oidc.provider.DeviceCode.find(
+          ctx.oidc.entities.Interaction.deviceCode,
+          { ignoreExpiration: true, ignoreSessionBinding: true },
+        );
+      }
+
+      if (code) {
+        Object.assign(code, {
+          error: out.error,
+          errorDescription: out.error_description,
+        });
+        await code.save();
+        if (cause instanceof AccessDenied) {
+          throw new AbortedError({ cause });
+        }
+      }
+    }
+
+    throw cause;
+  }
+}
+
+async function deviceVerificationResponse(ctx) {
+  const { configuration, features } = instance(ctx.oidc.provider);
+  const code = ctx.oidc.deviceCode;
+
+  const scopeSet = combinedScope(
+    ctx.oidc.grant,
+    ctx.oidc.requestParamScopes,
+    ctx.oidc.resourceServers,
+  );
+
+  Object.assign(code, {
+    accountId: ctx.oidc.session.accountId,
+    acr: ctx.oidc.acr,
+    amr: ctx.oidc.amr,
+    authTime: ctx.oidc.session.authTime(),
+    claims: ctx.oidc.claims,
+    grantId: ctx.oidc.session.grantIdFor(ctx.oidc.client.clientId),
+    scope: [...scopeSet].join(' '),
+    sessionUid: ctx.oidc.session.uid,
+    resource: Object.keys(ctx.oidc.resourceServers),
+  });
+
+  if (Object.keys(code.claims).length === 0) {
+    delete code.claims;
+  }
+
+  switch (code.resource.length) {
+    case 0:
+      delete code.resource;
+      break;
+    case 1:
+      [code.resource] = code.resource;
+      break;
+  }
+
+  if (boolean(await configuration.expiresWithSession(ctx, code), 'expiresWithSession')) {
+    code.expiresWithSession = true;
+  } else {
+    ctx.oidc.session.authorizationFor(ctx.oidc.client.clientId).persistsLogout = true;
+  }
+
+  if (ctx.oidc.client.includeSid() || (ctx.oidc.claims.id_token && 'sid' in ctx.oidc.claims.id_token)) {
+    code.sid = ctx.oidc.session.sidFor(ctx.oidc.client.clientId);
+  }
+
+  if (
+    features.richAuthorizationRequests.enabled
+    && (
+      ctx.oidc.params.authorization_details !== undefined
+      || ctx.oidc.grant.rar?.length
+    )
+  ) {
+    code.rar = normalizeAuthorizationDetails(
+      await features.richAuthorizationRequests.authorizationDetailsForGrantSource(ctx, code),
+    );
+  }
+
+  await code.save();
+
+  await features.deviceFlow.successSource(ctx);
+
+  ctx.oidc.provider.emit('authorization.success', ctx);
+}
+
+export async function deviceAuthorizationResponse(ctx) {
+  const { charset, mask, deviceInfo } = instance(ctx.oidc.provider).features.deviceFlow;
+  const userCode = generate(charset, mask);
+
+  const dc = new ctx.oidc.provider.DeviceCode({
+    client: ctx.oidc.client,
+    deviceInfo: deviceInfo(ctx),
+    params: ctx.oidc.params.toPlainObject(),
+    userCode: normalize(userCode),
+  });
+
+  if (ctx.oidc.client.clientAuthMethod === 'attest_jwt_client_auth') {
+    await dc.setAttestBinding(ctx);
+  }
+
+  ctx.oidc.entity('DeviceCode', dc);
+  ctx.body = {
+    device_code: await dc.save(),
+    user_code: userCode,
+    verification_uri: ctx.oidc.urlFor('code_verification'),
+    verification_uri_complete: ctx.oidc.urlFor('code_verification', {
+      query: { user_code: userCode },
+    }),
+    expires_in: dc.expiration,
+  };
+
+  ctx.oidc.provider.emit('device_authorization.success', ctx, ctx.body);
+}
+
+export { deviceVerificationResponse as deviceUserFlowResponse };