@seamless-auth/core 0.7.0 → 0.10.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +16 -0
- package/dist/authFetch.d.ts.map +1 -1
- package/dist/authFetch.js +3 -5
- package/dist/authFetch.js.map +1 -1
- package/dist/authMessaging.d.ts +0 -13
- package/dist/authMessaging.d.ts.map +1 -1
- package/dist/createServiceToken.d.ts.map +1 -1
- package/dist/createServiceToken.js +2 -0
- package/dist/createServiceToken.js.map +1 -1
- package/dist/ensureCookies.d.ts.map +1 -1
- package/dist/ensureCookies.js +32 -4
- package/dist/ensureCookies.js.map +1 -1
- package/dist/getSeamlessUser.d.ts +17 -2
- package/dist/getSeamlessUser.d.ts.map +1 -1
- package/dist/getSeamlessUser.js +4 -1
- package/dist/getSeamlessUser.js.map +1 -1
- package/dist/handlers/admin.d.ts +1 -0
- package/dist/handlers/admin.d.ts.map +1 -1
- package/dist/handlers/admin.js +8 -7
- package/dist/handlers/admin.js.map +1 -1
- package/dist/handlers/finishLogin.d.ts +2 -0
- package/dist/handlers/finishLogin.d.ts.map +1 -1
- package/dist/handlers/finishLogin.js +2 -1
- package/dist/handlers/finishLogin.js.map +1 -1
- package/dist/handlers/finishRegister.d.ts +2 -0
- package/dist/handlers/finishRegister.d.ts.map +1 -1
- package/dist/handlers/finishRegister.js +2 -1
- package/dist/handlers/finishRegister.js.map +1 -1
- package/dist/handlers/internalMetrics.d.ts +2 -1
- package/dist/handlers/internalMetrics.d.ts.map +1 -1
- package/dist/handlers/internalMetrics.js +1 -0
- package/dist/handlers/internalMetrics.js.map +1 -1
- package/dist/handlers/login.d.ts +2 -0
- package/dist/handlers/login.d.ts.map +1 -1
- package/dist/handlers/login.js +2 -1
- package/dist/handlers/login.js.map +1 -1
- package/dist/handlers/logout.d.ts +1 -0
- package/dist/handlers/logout.d.ts.map +1 -1
- package/dist/handlers/logout.js +1 -0
- package/dist/handlers/logout.js.map +1 -1
- package/dist/handlers/me.d.ts +1 -0
- package/dist/handlers/me.d.ts.map +1 -1
- package/dist/handlers/me.js +1 -0
- package/dist/handlers/me.js.map +1 -1
- package/dist/handlers/oauthHandlers.d.ts +2 -0
- package/dist/handlers/oauthHandlers.d.ts.map +1 -1
- package/dist/handlers/oauthHandlers.js +3 -1
- package/dist/handlers/oauthHandlers.js.map +1 -1
- package/dist/handlers/pollMagicLinkConfirmationHandler.d.ts +1 -0
- package/dist/handlers/pollMagicLinkConfirmationHandler.d.ts.map +1 -1
- package/dist/handlers/pollMagicLinkConfirmationHandler.js +1 -2
- package/dist/handlers/pollMagicLinkConfirmationHandler.js.map +1 -1
- package/dist/handlers/sessions.d.ts +1 -0
- package/dist/handlers/sessions.d.ts.map +1 -1
- package/dist/handlers/sessions.js +2 -1
- package/dist/handlers/sessions.js.map +1 -1
- package/dist/handlers/switchOrganizationHandler.d.ts +2 -0
- package/dist/handlers/switchOrganizationHandler.d.ts.map +1 -1
- package/dist/handlers/switchOrganizationHandler.js +2 -1
- package/dist/handlers/switchOrganizationHandler.js.map +1 -1
- package/dist/handlers/systemConfig.d.ts +1 -0
- package/dist/handlers/systemConfig.d.ts.map +1 -1
- package/dist/handlers/systemConfig.js +3 -0
- package/dist/handlers/systemConfig.js.map +1 -1
- package/dist/handlers/verifyLoginOtpHandler.d.ts +2 -0
- package/dist/handlers/verifyLoginOtpHandler.d.ts.map +1 -1
- package/dist/handlers/verifyLoginOtpHandler.js +3 -2
- package/dist/handlers/verifyLoginOtpHandler.js.map +1 -1
- package/dist/handlers/verifyMagicLinkHandler.d.ts +1 -0
- package/dist/handlers/verifyMagicLinkHandler.d.ts.map +1 -1
- package/dist/handlers/verifyMagicLinkHandler.js +2 -1
- package/dist/handlers/verifyMagicLinkHandler.js.map +1 -1
- package/dist/index.d.ts +2 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +2 -0
- package/dist/index.js.map +1 -1
- package/dist/refreshAccessToken.d.ts.map +1 -1
- package/dist/refreshAccessToken.js +26 -1
- package/dist/refreshAccessToken.js.map +1 -1
- package/dist/validateSecrets.d.ts +7 -0
- package/dist/validateSecrets.d.ts.map +1 -0
- package/dist/validateSecrets.js +14 -0
- package/dist/validateSecrets.js.map +1 -0
- package/dist/verifySignedAuthResponse.d.ts +1 -1
- package/dist/verifySignedAuthResponse.d.ts.map +1 -1
- package/dist/verifySignedAuthResponse.js +15 -2
- package/dist/verifySignedAuthResponse.js.map +1 -1
- package/package.json +15 -3
- package/dist/handlers/bootstrapAdminInvite.d.ts +0 -20
- package/dist/handlers/bootstrapAdminInvite.d.ts.map +0 -1
- package/dist/handlers/bootstrapAdminInvite.js +0 -29
- package/dist/handlers/bootstrapAdminInvite.js.map +0 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/handlers/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;
|
|
1
|
+
{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/handlers/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AA+B1E,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAiB,EACjB,IAAkB;IAElB,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,QAAQ,EAAE;QACxD,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,KAAK,EAAE,IAAI;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAC7C,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,QAAQ,CACd,CAAC;IAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,QAAQ,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,IAAI,GAAG;QACX,GAAG,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ;YACzC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE;YACzC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC;YAClC,CAAC,CAAC;gBACE,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CACpC,CAAC,IAAa,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAC5C;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI;QACJ,UAAU,EAAE;YACV;gBACE,IAAI,EAAE,IAAI,CAAC,iBAAiB;gBAC5B,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;gBAC3C,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,MAAM,EAAE,IAAI,CAAC,YAAY;aAC1B;SACF;KACF,CAAC;AACJ,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../src/handlers/logout.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,KAAK,CAAC,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,MAAM,WAAW,GAAG,iBAAiB,GAAG,cAAc,CAAC;AAM7D,wBAAsB,aAAa,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,
|
|
1
|
+
{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../src/handlers/logout.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,KAAK,CAAC,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,MAAM,WAAW,GAAG,iBAAiB,GAAG,cAAc,CAAC;AAM7D,wBAAsB,aAAa,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAiB9E;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,yBAE7E;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,yBAE1E"}
|
package/dist/handlers/logout.js
CHANGED
|
@@ -7,6 +7,7 @@ export async function logoutHandler(opts) {
|
|
|
7
7
|
const upstream = await authFetch(`${opts.authServerUrl}${getLogoutPath(scope)}`, {
|
|
8
8
|
method: "DELETE",
|
|
9
9
|
authorization: opts.authorization,
|
|
10
|
+
serviceAuthorization: opts.serviceAuthorization,
|
|
10
11
|
forwardedClientIp: opts.forwardedClientIp,
|
|
11
12
|
});
|
|
12
13
|
return {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../src/handlers/logout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;
|
|
1
|
+
{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../src/handlers/logout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAoB5C,SAAS,aAAa,CAAC,KAAkB;IACvC,OAAO,KAAK,KAAK,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAmB;IACrD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,cAAc,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE;QAC/E,MAAM,EAAE,QAAQ;QAChB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CAAC,CAAC;IAEH,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM;QAC3C,YAAY,EAAE;YACZ,IAAI,CAAC,gBAAgB;YACrB,IAAI,CAAC,sBAAsB;YAC3B,IAAI,CAAC,iBAAiB;SACvB;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,IAAkC;IAC5E,OAAO,aAAa,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,IAAkC;IACzE,OAAO,aAAa,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;AAC3D,CAAC"}
|
package/dist/handlers/me.d.ts
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"me.d.ts","sourceRoot":"","sources":["../../src/handlers/me.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,SAAS;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE;QACL,IAAI,EAAE,OAAO,CAAC;QACd,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,CAAC;IACF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,
|
|
1
|
+
{"version":3,"file":"me.d.ts","sourceRoot":"","sources":["../../src/handlers/me.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,SAAS;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE;QACL,IAAI,EAAE,OAAO,CAAC;QACd,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,CAAC;IACF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CA2BlE"}
|
package/dist/handlers/me.js
CHANGED
|
@@ -3,6 +3,7 @@ export async function meHandler(opts) {
|
|
|
3
3
|
const up = await authFetch(`${opts.authServerUrl}/users/me`, {
|
|
4
4
|
method: "GET",
|
|
5
5
|
authorization: opts.authorization,
|
|
6
|
+
serviceAuthorization: opts.serviceAuthorization,
|
|
6
7
|
forwardedClientIp: opts.forwardedClientIp,
|
|
7
8
|
});
|
|
8
9
|
const data = await up.json();
|
package/dist/handlers/me.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"me.js","sourceRoot":"","sources":["../../src/handlers/me.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;
|
|
1
|
+
{"version":3,"file":"me.js","sourceRoot":"","sources":["../../src/handlers/me.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAoB5C,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAe;IAC7C,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,WAAW,EAAE;QAC3D,MAAM,EAAE,KAAK;QACb,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,YAAY,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAE9C,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;QAChB,OAAO;YACL,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,iBAAiB;YACxB,YAAY;SACb,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE;YACJ,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B;QACD,YAAY;KACb,CAAC;AACJ,CAAC"}
|
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
import type { CookiePayload } from "../ensureCookies.js";
|
|
2
2
|
export interface OAuthHandlerOptions {
|
|
3
3
|
authServerUrl: string;
|
|
4
|
+
audience: string;
|
|
4
5
|
cookieDomain?: string;
|
|
5
6
|
accessCookieName: string;
|
|
6
7
|
refreshCookieName: string;
|
|
@@ -8,6 +9,7 @@ export interface OAuthHandlerOptions {
|
|
|
8
9
|
export interface OAuthRequestInput {
|
|
9
10
|
providerId?: string;
|
|
10
11
|
body?: unknown;
|
|
12
|
+
serviceAuthorization?: string;
|
|
11
13
|
forwardedClientIp?: string;
|
|
12
14
|
}
|
|
13
15
|
export interface OAuthHandlerResult {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oauthHandlers.d.ts","sourceRoot":"","sources":["../../src/handlers/oauthHandlers.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGzD,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,aAAa,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;AAED,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,IAAI,CAAC,mBAAmB,EAAE,eAAe,CAAC;;;;;;GAYjD;AAED,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,iBAAiB,EACxB,IAAI,EAAE,IAAI,CAAC,mBAAmB,EAAE,eAAe,CAAC;;;;;;
|
|
1
|
+
{"version":3,"file":"oauthHandlers.d.ts","sourceRoot":"","sources":["../../src/handlers/oauthHandlers.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGzD,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,aAAa,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;AAED,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,IAAI,CAAC,mBAAmB,EAAE,eAAe,CAAC;;;;;;GAYjD;AAED,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,iBAAiB,EACxB,IAAI,EAAE,IAAI,CAAC,mBAAmB,EAAE,eAAe,CAAC;;;;;;GAkBjD;AAED,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,iBAAiB,EACxB,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,kBAAkB,CAAC,CAoE7B"}
|
|
@@ -14,6 +14,7 @@ export async function startOAuthLoginHandler(input, opts) {
|
|
|
14
14
|
const up = await authFetch(`${opts.authServerUrl}/oauth/${encodeURIComponent(input.providerId)}/start`, {
|
|
15
15
|
method: "POST",
|
|
16
16
|
body: input.body,
|
|
17
|
+
serviceAuthorization: input.serviceAuthorization,
|
|
17
18
|
forwardedClientIp: input.forwardedClientIp,
|
|
18
19
|
});
|
|
19
20
|
const data = await up.json();
|
|
@@ -26,6 +27,7 @@ export async function finishOAuthLoginHandler(input, opts) {
|
|
|
26
27
|
const up = await authFetch(`${opts.authServerUrl}/oauth/${encodeURIComponent(input.providerId)}/callback`, {
|
|
27
28
|
method: "POST",
|
|
28
29
|
body: input.body,
|
|
30
|
+
serviceAuthorization: input.serviceAuthorization,
|
|
29
31
|
forwardedClientIp: input.forwardedClientIp,
|
|
30
32
|
});
|
|
31
33
|
const data = await up.json();
|
|
@@ -35,7 +37,7 @@ export async function finishOAuthLoginHandler(input, opts) {
|
|
|
35
37
|
error: data,
|
|
36
38
|
};
|
|
37
39
|
}
|
|
38
|
-
const verifiedAccessToken = await verifySignedAuthResponse(data.token, opts.authServerUrl);
|
|
40
|
+
const verifiedAccessToken = await verifySignedAuthResponse(data.token, opts.authServerUrl, opts.audience);
|
|
39
41
|
if (!verifiedAccessToken) {
|
|
40
42
|
throw new Error("Invalid signed response from Auth Server");
|
|
41
43
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oauthHandlers.js","sourceRoot":"","sources":["../../src/handlers/oauthHandlers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;
|
|
1
|
+
{"version":3,"file":"oauthHandlers.js","sourceRoot":"","sources":["../../src/handlers/oauthHandlers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AA6B1E,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,IAAgD;IAEhD,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,kBAAkB,EAAE;QAClE,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAwB,EACxB,IAAgD;IAEhD,MAAM,EAAE,GAAG,MAAM,SAAS,CACxB,GAAG,IAAI,CAAC,aAAa,UAAU,kBAAkB,CAAC,KAAK,CAAC,UAAW,CAAC,QAAQ,EAC5E;QACE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CACF,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAwB,EACxB,IAAyB;IAEzB,MAAM,EAAE,GAAG,MAAM,SAAS,CACxB,GAAG,IAAI,CAAC,aAAa,UAAU,kBAAkB,CAAC,KAAK,CAAC,UAAW,CAAC,WAAW,EAC/E;QACE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CACF,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,KAAK,EAAE,IAAI;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,mBAAmB,GAAG,MAAM,wBAAwB,CACxD,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,QAAQ,CACd,CAAC;IAEF,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,mBAAmB,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,SAAS,GACb,OAAO,mBAAmB,CAAC,GAAG,KAAK,QAAQ;QACzC,CAAC,CAAC,mBAAmB,CAAC,GAAG;QACzB,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI,EAAE,IAAI;QACV,UAAU,EAAE;YACV;gBACE,IAAI,EAAE,IAAI,CAAC,gBAAgB;gBAC3B,KAAK,EAAE;oBACL,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;oBACjD,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,IAAI;iBAC5C;gBACD,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,MAAM,EAAE,IAAI,CAAC,YAAY;aAC1B;YACD;gBACE,IAAI,EAAE,IAAI,CAAC,iBAAiB;gBAC5B,KAAK,EAAE;oBACL,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,YAAY,EAAE,IAAI,CAAC,YAAY;iBAChC;gBACD,GAAG,EAAE,IAAI,CAAC,UAAU;gBACpB,MAAM,EAAE,IAAI,CAAC,YAAY;aAC1B;SACF;KACF,CAAC;AACJ,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"pollMagicLinkConfirmationHandler.d.ts","sourceRoot":"","sources":["../../src/handlers/pollMagicLinkConfirmationHandler.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGzD,MAAM,WAAW,8BAA8B;IAC7C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,gCAAgC;IAC/C,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,+BAA+B;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,aAAa,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;AAED,wBAAsB,gCAAgC,CACpD,KAAK,EAAE,8BAA8B,EACrC,IAAI,EAAE,gCAAgC,GACrC,OAAO,CAAC,+BAA+B,CAAC,CA8E1C"}
|
|
1
|
+
{"version":3,"file":"pollMagicLinkConfirmationHandler.d.ts","sourceRoot":"","sources":["../../src/handlers/pollMagicLinkConfirmationHandler.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGzD,MAAM,WAAW,8BAA8B;IAC7C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,gCAAgC;IAC/C,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,+BAA+B;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,aAAa,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;AAED,wBAAsB,gCAAgC,CACpD,KAAK,EAAE,8BAA8B,EACrC,IAAI,EAAE,gCAAgC,GACrC,OAAO,CAAC,+BAA+B,CAAC,CA8E1C"}
|
|
@@ -10,7 +10,6 @@ export async function pollMagicLinkConfirmationHandler(input, opts) {
|
|
|
10
10
|
if (up.status === 204) {
|
|
11
11
|
return {
|
|
12
12
|
status: 204,
|
|
13
|
-
body: { message: "Not verified." },
|
|
14
13
|
};
|
|
15
14
|
}
|
|
16
15
|
const data = await up.json();
|
|
@@ -26,7 +25,7 @@ export async function pollMagicLinkConfirmationHandler(input, opts) {
|
|
|
26
25
|
body: data,
|
|
27
26
|
};
|
|
28
27
|
}
|
|
29
|
-
const verifiedAccessToken = await verifySignedAuthResponse(data.token, opts.authServerUrl);
|
|
28
|
+
const verifiedAccessToken = await verifySignedAuthResponse(data.token, opts.authServerUrl, opts.audience);
|
|
30
29
|
if (!verifiedAccessToken) {
|
|
31
30
|
throw new Error("Invalid signed response from Auth Server");
|
|
32
31
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"pollMagicLinkConfirmationHandler.js","sourceRoot":"","sources":["../../src/handlers/pollMagicLinkConfirmationHandler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;
|
|
1
|
+
{"version":3,"file":"pollMagicLinkConfirmationHandler.js","sourceRoot":"","sources":["../../src/handlers/pollMagicLinkConfirmationHandler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AA4B1E,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAAqC,EACrC,IAAsC;IAEtC,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,mBAAmB,EAAE;QACnE,MAAM,EAAE,KAAK;QACb,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;KAChD,CAAC,CAAC;IAEH,IAAI,EAAE,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACtB,OAAO;YACL,MAAM,EAAE,GAAG;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,KAAK,EAAE,IAAI;SACZ,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,IAAI,EAAE,YAAY,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC;QACtD,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,IAAI,EAAE,IAAI;SACX,CAAC;IACJ,CAAC;IAED,MAAM,mBAAmB,GAAG,MAAM,wBAAwB,CACxD,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,QAAQ,CACd,CAAC;IAEF,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,mBAAmB,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,SAAS,GACb,OAAO,mBAAmB,CAAC,GAAG,KAAK,QAAQ;QACzC,CAAC,CAAC,mBAAmB,CAAC,GAAG;QACzB,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,IAAI;QACV,UAAU,EAAE;YACV;gBACE,IAAI,EAAE,IAAI,CAAC,gBAAgB;gBAC3B,KAAK,EAAE;oBACL,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;oBACjD,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,IAAI;iBAC5C;gBACD,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,MAAM,EAAE,IAAI,CAAC,YAAY;aAC1B;YACD;gBACE,IAAI,EAAE,IAAI,CAAC,iBAAiB;gBAC5B,KAAK,EAAE;oBACL,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,YAAY,EAAE,IAAI,CAAC,YAAY;iBAChC;gBACD,GAAG,EAAE,IAAI,CAAC,UAAU;gBACpB,MAAM,EAAE,IAAI,CAAC,YAAY;aAC1B;SACF;KACF,CAAC;AACJ,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/handlers/sessions.ts"],"names":[],"mappings":"AAEA,KAAK,QAAQ,GAAG;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,KAAK,MAAM,GAAG;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,GAAG,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;
|
|
1
|
+
{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/handlers/sessions.ts"],"names":[],"mappings":"AAEA,KAAK,QAAQ,GAAG;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,KAAK,MAAM,GAAG;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,GAAG,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AA6BF,eAAO,MAAM,mBAAmB,GAAI,MAAM,QAAQ,oBACf,CAAC;AAEpC,eAAO,MAAM,oBAAoB,GAAI,IAAI,MAAM,EAAE,MAAM,QAAQ,oBACC,CAAC;AAEjE,eAAO,MAAM,wBAAwB,GAAI,MAAM,QAAQ,oBACjB,CAAC"}
|
|
@@ -3,6 +3,7 @@ async function request(method, path, opts) {
|
|
|
3
3
|
const up = await authFetch(`${opts.authServerUrl}${path}`, {
|
|
4
4
|
method,
|
|
5
5
|
authorization: opts.authorization,
|
|
6
|
+
serviceAuthorization: opts.serviceAuthorization,
|
|
6
7
|
forwardedClientIp: opts.forwardedClientIp,
|
|
7
8
|
});
|
|
8
9
|
const data = await up.json();
|
|
@@ -18,6 +19,6 @@ async function request(method, path, opts) {
|
|
|
18
19
|
};
|
|
19
20
|
}
|
|
20
21
|
export const listSessionsHandler = (opts) => request("GET", "/sessions", opts);
|
|
21
|
-
export const revokeSessionHandler = (id, opts) => request("DELETE", `/sessions/${id}`, opts);
|
|
22
|
+
export const revokeSessionHandler = (id, opts) => request("DELETE", `/sessions/${encodeURIComponent(id)}`, opts);
|
|
22
23
|
export const revokeAllSessionsHandler = (opts) => request("DELETE", "/sessions", opts);
|
|
23
24
|
//# sourceMappingURL=sessions.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/handlers/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;
|
|
1
|
+
{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/handlers/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAe5C,KAAK,UAAU,OAAO,CACpB,MAAwB,EACxB,IAAY,EACZ,IAAc;IAEd,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,GAAG,IAAI,EAAE,EAAE;QACzD,MAAM;QACN,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,wBAAwB;SAC/C,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI,EAAE,IAAI;KACX,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,IAAc,EAAE,EAAE,CACpD,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;AAEpC,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,EAAU,EAAE,IAAc,EAAE,EAAE,CACjE,OAAO,CAAC,QAAQ,EAAE,aAAa,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;AAEjE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,IAAc,EAAE,EAAE,CACzD,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC"}
|
|
@@ -2,10 +2,12 @@ import type { CookiePayload } from "../ensureCookies.js";
|
|
|
2
2
|
export interface SwitchOrganizationInput {
|
|
3
3
|
organizationId: string;
|
|
4
4
|
authorization?: string;
|
|
5
|
+
serviceAuthorization?: string;
|
|
5
6
|
forwardedClientIp?: string;
|
|
6
7
|
}
|
|
7
8
|
export interface SwitchOrganizationOptions {
|
|
8
9
|
authServerUrl: string;
|
|
10
|
+
audience: string;
|
|
9
11
|
cookieDomain?: string;
|
|
10
12
|
accessCookieName: string;
|
|
11
13
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"switchOrganizationHandler.d.ts","sourceRoot":"","sources":["../../src/handlers/switchOrganizationHandler.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGzD,MAAM,WAAW,uBAAuB;IACtC,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,aAAa,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;AAED,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,uBAAuB,EAC9B,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,wBAAwB,CAAC,
|
|
1
|
+
{"version":3,"file":"switchOrganizationHandler.d.ts","sourceRoot":"","sources":["../../src/handlers/switchOrganizationHandler.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGzD,MAAM,WAAW,uBAAuB;IACtC,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,aAAa,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;AAED,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,uBAAuB,EAC9B,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,wBAAwB,CAAC,CAkEnC"}
|
|
@@ -4,6 +4,7 @@ export async function switchOrganizationHandler(input, opts) {
|
|
|
4
4
|
const up = await authFetch(`${opts.authServerUrl}/organizations/${encodeURIComponent(input.organizationId)}/switch`, {
|
|
5
5
|
method: "POST",
|
|
6
6
|
authorization: input.authorization,
|
|
7
|
+
serviceAuthorization: input.serviceAuthorization,
|
|
7
8
|
forwardedClientIp: input.forwardedClientIp,
|
|
8
9
|
});
|
|
9
10
|
const data = await up.json();
|
|
@@ -19,7 +20,7 @@ export async function switchOrganizationHandler(input, opts) {
|
|
|
19
20
|
body: data,
|
|
20
21
|
};
|
|
21
22
|
}
|
|
22
|
-
const verifiedAccessToken = await verifySignedAuthResponse(data.token, opts.authServerUrl);
|
|
23
|
+
const verifiedAccessToken = await verifySignedAuthResponse(data.token, opts.authServerUrl, opts.audience);
|
|
23
24
|
if (!verifiedAccessToken) {
|
|
24
25
|
throw new Error("Invalid signed response from Auth Server");
|
|
25
26
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"switchOrganizationHandler.js","sourceRoot":"","sources":["../../src/handlers/switchOrganizationHandler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;
|
|
1
|
+
{"version":3,"file":"switchOrganizationHandler.js","sourceRoot":"","sources":["../../src/handlers/switchOrganizationHandler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AA4B1E,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAA8B,EAC9B,IAA+B;IAE/B,MAAM,EAAE,GAAG,MAAM,SAAS,CACxB,GAAG,IAAI,CAAC,aAAa,kBAAkB,kBAAkB,CAAC,KAAK,CAAC,cAAc,CAAC,SAAS,EACxF;QACE,MAAM,EAAE,MAAM;QACd,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CACF,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,KAAK,EAAE,IAAI;SACZ,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC;QAC/B,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,IAAI,EAAE,IAAI;SACX,CAAC;IACJ,CAAC;IAED,MAAM,mBAAmB,GAAG,MAAM,wBAAwB,CACxD,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,QAAQ,CACd,CAAC;IAEF,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,mBAAmB,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,SAAS,GACb,OAAO,mBAAmB,CAAC,GAAG,KAAK,QAAQ;QACzC,CAAC,CAAC,mBAAmB,CAAC,GAAG;QACzB,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI,EAAE,IAAI;QACV,UAAU,EAAE;YACV;gBACE,IAAI,EAAE,IAAI,CAAC,gBAAgB;gBAC3B,KAAK,EAAE;oBACL,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;oBACjD,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,IAAI;iBAC5C;gBACD,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,MAAM,EAAE,IAAI,CAAC,YAAY;aAC1B;SACF;KACF,CAAC;AACJ,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"systemConfig.d.ts","sourceRoot":"","sources":["../../src/handlers/systemConfig.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,GAAG,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,kBAAkB,CAAC,
|
|
1
|
+
{"version":3,"file":"systemConfig.d.ts","sourceRoot":"","sources":["../../src/handlers/systemConfig.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,GAAG,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,kBAAkB,CAAC,CAqB7B;AAED,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,kBAAkB,CAAC,CAqB7B;AAED,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,mBAAmB,GAAG;IAAE,OAAO,EAAE,GAAG,CAAA;CAAE,GAC3C,OAAO,CAAC,kBAAkB,CAAC,CAsB7B"}
|
|
@@ -3,6 +3,7 @@ export async function getAvailableRolesHandler(opts) {
|
|
|
3
3
|
const up = await authFetch(`${opts.authServerUrl}/system-config/roles`, {
|
|
4
4
|
method: "GET",
|
|
5
5
|
authorization: opts.authorization,
|
|
6
|
+
serviceAuthorization: opts.serviceAuthorization,
|
|
6
7
|
forwardedClientIp: opts.forwardedClientIp,
|
|
7
8
|
});
|
|
8
9
|
const data = await up.json();
|
|
@@ -21,6 +22,7 @@ export async function getSystemConfigAdminHandler(opts) {
|
|
|
21
22
|
const up = await authFetch(`${opts.authServerUrl}/system-config/admin`, {
|
|
22
23
|
method: "GET",
|
|
23
24
|
authorization: opts.authorization,
|
|
25
|
+
serviceAuthorization: opts.serviceAuthorization,
|
|
24
26
|
forwardedClientIp: opts.forwardedClientIp,
|
|
25
27
|
});
|
|
26
28
|
const data = await up.json();
|
|
@@ -40,6 +42,7 @@ export async function updateSystemConfigHandler(opts) {
|
|
|
40
42
|
method: "PATCH",
|
|
41
43
|
authorization: opts.authorization,
|
|
42
44
|
body: opts.payload,
|
|
45
|
+
serviceAuthorization: opts.serviceAuthorization,
|
|
43
46
|
forwardedClientIp: opts.forwardedClientIp,
|
|
44
47
|
});
|
|
45
48
|
const data = await up.json();
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"systemConfig.js","sourceRoot":"","sources":["../../src/handlers/systemConfig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;
|
|
1
|
+
{"version":3,"file":"systemConfig.js","sourceRoot":"","sources":["../../src/handlers/systemConfig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAe5C,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAyB;IAEzB,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,sBAAsB,EAAE;QACtE,MAAM,EAAE,KAAK;QACb,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,uBAAuB;SAC9C,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI,EAAE,IAAI;KACX,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,IAAyB;IAEzB,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,sBAAsB,EAAE;QACtE,MAAM,EAAE,KAAK;QACb,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,wBAAwB;SAC/C,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI,EAAE,IAAI;KACX,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,IAA4C;IAE5C,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,sBAAsB,EAAE;QACtE,MAAM,EAAE,OAAO;QACf,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,IAAI,EAAE,IAAI,CAAC,OAAO;QAClB,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,yBAAyB;SAChD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI,EAAE,IAAI;KACX,CAAC;AACJ,CAAC"}
|
|
@@ -2,11 +2,13 @@ import type { CookiePayload } from "../ensureCookies.js";
|
|
|
2
2
|
export interface VerifyLoginOtpInput {
|
|
3
3
|
body: unknown;
|
|
4
4
|
authorization?: string;
|
|
5
|
+
serviceAuthorization?: string;
|
|
5
6
|
forwardedClientIp?: string;
|
|
6
7
|
kind: "email" | "phone";
|
|
7
8
|
}
|
|
8
9
|
export interface VerifyLoginOtpOptions {
|
|
9
10
|
authServerUrl: string;
|
|
11
|
+
audience: string;
|
|
10
12
|
cookieDomain?: string;
|
|
11
13
|
accessCookieName: string;
|
|
12
14
|
refreshCookieName: string;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verifyLoginOtpHandler.d.ts","sourceRoot":"","sources":["../../src/handlers/verifyLoginOtpHandler.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGzD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,OAAO,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,aAAa,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;
|
|
1
|
+
{"version":3,"file":"verifyLoginOtpHandler.d.ts","sourceRoot":"","sources":["../../src/handlers/verifyLoginOtpHandler.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGzD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,OAAO,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,aAAa,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;AAsFD,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,oBAAoB,CAAC,CAO/B;AAED,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,oBAAoB,CAAC,CAK/B"}
|
|
@@ -4,12 +4,13 @@ import { verifySignedAuthResponse } from "../verifySignedAuthResponse.js";
|
|
|
4
4
|
// auth-server path and, when the response carries a session, validate the signed
|
|
5
5
|
// access token and build the session cookies. Registration can complete without
|
|
6
6
|
// a session yet (e.g. a phone-first step before email is verified), in which case
|
|
7
|
-
// there is no token to turn into cookies
|
|
7
|
+
// there is no token to turn into cookies, so the body is returned as-is.
|
|
8
8
|
async function verifyOtp(path, input, opts) {
|
|
9
9
|
const up = await authFetch(`${opts.authServerUrl}/${path}`, {
|
|
10
10
|
method: "POST",
|
|
11
11
|
body: input.body,
|
|
12
12
|
authorization: input.authorization,
|
|
13
|
+
serviceAuthorization: input.serviceAuthorization,
|
|
13
14
|
forwardedClientIp: input.forwardedClientIp,
|
|
14
15
|
});
|
|
15
16
|
const data = await up.json();
|
|
@@ -25,7 +26,7 @@ async function verifyOtp(path, input, opts) {
|
|
|
25
26
|
body: data,
|
|
26
27
|
};
|
|
27
28
|
}
|
|
28
|
-
const verifiedAccessToken = await verifySignedAuthResponse(data.token, opts.authServerUrl);
|
|
29
|
+
const verifiedAccessToken = await verifySignedAuthResponse(data.token, opts.authServerUrl, opts.audience);
|
|
29
30
|
if (!verifiedAccessToken) {
|
|
30
31
|
throw new Error("Invalid signed response from Auth Server");
|
|
31
32
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verifyLoginOtpHandler.js","sourceRoot":"","sources":["../../src/handlers/verifyLoginOtpHandler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;
|
|
1
|
+
{"version":3,"file":"verifyLoginOtpHandler.js","sourceRoot":"","sources":["../../src/handlers/verifyLoginOtpHandler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AA8B1E,8EAA8E;AAC9E,iFAAiF;AACjF,gFAAgF;AAChF,kFAAkF;AAClF,yEAAyE;AACzE,KAAK,UAAU,SAAS,CACtB,IAAY,EACZ,KAA0B,EAC1B,IAA2B;IAE3B,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,EAAE,EAAE;QAC1D,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,KAAK,EAAE,IAAI;SACZ,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QACjB,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,IAAI,EAAE,IAAI;SACX,CAAC;IACJ,CAAC;IAED,MAAM,mBAAmB,GAAG,MAAM,wBAAwB,CACxD,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,QAAQ,CACd,CAAC;IAEF,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,mBAAmB,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,SAAS,GACb,OAAO,mBAAmB,CAAC,GAAG,KAAK,QAAQ;QACzC,CAAC,CAAC,mBAAmB,CAAC,GAAG;QACzB,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI,EAAE,IAAI;QACV,UAAU,EAAE;YACV;gBACE,IAAI,EAAE,IAAI,CAAC,gBAAgB;gBAC3B,KAAK,EAAE;oBACL,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;oBACjD,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,IAAI;iBAC5C;gBACD,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,MAAM,EAAE,IAAI,CAAC,YAAY;aAC1B;YACD;gBACE,IAAI,EAAE,IAAI,CAAC,iBAAiB;gBAC5B,KAAK,EAAE;oBACL,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,YAAY,EAAE,IAAI,CAAC,YAAY;iBAChC;gBACD,GAAG,EAAE,IAAI,CAAC,UAAU;gBACpB,MAAM,EAAE,IAAI,CAAC,YAAY;aAC1B;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAA0B,EAC1B,IAA2B;IAE3B,MAAM,IAAI,GACR,KAAK,CAAC,IAAI,KAAK,OAAO;QACpB,CAAC,CAAC,4BAA4B;QAC9B,CAAC,CAAC,4BAA4B,CAAC;IAEnC,OAAO,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,KAA0B,EAC1B,IAA2B;IAE3B,MAAM,IAAI,GACR,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,sBAAsB,CAAC;IAE3E,OAAO,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AACtC,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verifyMagicLinkHandler.d.ts","sourceRoot":"","sources":["../../src/handlers/verifyMagicLinkHandler.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,oBAAoB,EAC3B,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,qBAAqB,CAAC,
|
|
1
|
+
{"version":3,"file":"verifyMagicLinkHandler.d.ts","sourceRoot":"","sources":["../../src/handlers/verifyMagicLinkHandler.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,oBAAoB,EAC3B,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,qBAAqB,CAAC,CAuBhC"}
|
|
@@ -1,7 +1,8 @@
|
|
|
1
1
|
import { authFetch } from "../authFetch.js";
|
|
2
2
|
export async function verifyMagicLinkHandler(input, opts) {
|
|
3
|
-
const up = await authFetch(`${opts.authServerUrl}/magic-link/verify/${input.token}`, {
|
|
3
|
+
const up = await authFetch(`${opts.authServerUrl}/magic-link/verify/${encodeURIComponent(input.token)}`, {
|
|
4
4
|
method: "GET",
|
|
5
|
+
serviceAuthorization: opts.serviceAuthorization,
|
|
5
6
|
forwardedClientIp: opts.forwardedClientIp,
|
|
6
7
|
});
|
|
7
8
|
const data = await up.json();
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verifyMagicLinkHandler.js","sourceRoot":"","sources":["../../src/handlers/verifyMagicLinkHandler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;
|
|
1
|
+
{"version":3,"file":"verifyMagicLinkHandler.js","sourceRoot":"","sources":["../../src/handlers/verifyMagicLinkHandler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAkB5C,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAA2B,EAC3B,IAA4B;IAE5B,MAAM,EAAE,GAAG,MAAM,SAAS,CACxB,GAAG,IAAI,CAAC,aAAa,sBAAsB,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAC5E;QACE,MAAM,EAAE,KAAK;QACb,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CACF,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,KAAK,EAAE,IAAI;SACZ,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI,EAAE,IAAI;KACX,CAAC;AACJ,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -5,7 +5,9 @@ export * from "./verifyCookieJwt.js";
|
|
|
5
5
|
export * from "./refreshAccessToken.js";
|
|
6
6
|
export * from "./getSeamlessUser.js";
|
|
7
7
|
export * from "./createServiceToken.js";
|
|
8
|
+
export * from "./validateSecrets.js";
|
|
8
9
|
export * from "./scopedRoles.js";
|
|
10
|
+
export * from "./redaction.js";
|
|
9
11
|
export * from "./handlers/login.js";
|
|
10
12
|
export * from "./handlers/finishLogin.js";
|
|
11
13
|
export * from "./handlers/register.js";
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,kBAAkB,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAE/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,wBAAwB,CAAC;AACvC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iCAAiC,CAAC;AAChD,cAAc,qCAAqC,CAAC;AACpD,cAAc,sCAAsC,CAAC;AACrD,cAAc,uCAAuC,CAAC;AACtD,cAAc,gDAAgD,CAAC;AAC/D,cAAc,yCAAyC,CAAC;AACxD,cAAc,6BAA6B,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -5,7 +5,9 @@ export * from "./verifyCookieJwt.js";
|
|
|
5
5
|
export * from "./refreshAccessToken.js";
|
|
6
6
|
export * from "./getSeamlessUser.js";
|
|
7
7
|
export * from "./createServiceToken.js";
|
|
8
|
+
export * from "./validateSecrets.js";
|
|
8
9
|
export * from "./scopedRoles.js";
|
|
10
|
+
export * from "./redaction.js";
|
|
9
11
|
export * from "./handlers/login.js";
|
|
10
12
|
export * from "./handlers/finishLogin.js";
|
|
11
13
|
export * from "./handlers/register.js";
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,kBAAkB,CAAC;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAE/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,wBAAwB,CAAC;AACvC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iCAAiC,CAAC;AAChD,cAAc,qCAAqC,CAAC;AACpD,cAAc,sCAAsC,CAAC;AACrD,cAAc,uCAAuC,CAAC;AACtD,cAAc,gDAAgD,CAAC;AAC/D,cAAc,yCAAyC,CAAC;AACxD,cAAc,6BAA6B,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"refreshAccessToken.d.ts","sourceRoot":"","sources":["../src/refreshAccessToken.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"refreshAccessToken.d.ts","sourceRoot":"","sources":["../src/refreshAccessToken.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,KAAK,wBAAwB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AA+BF,wBAAsB,kBAAkB,CACtC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAyD1C"}
|
|
@@ -1,10 +1,33 @@
|
|
|
1
1
|
import { authFetch } from "./authFetch.js";
|
|
2
2
|
import { createServiceToken } from "./createServiceToken.js";
|
|
3
3
|
import { verifyRefreshCookie } from "./verifyRefreshCookie.js";
|
|
4
|
+
import { assertSecrets } from "./validateSecrets.js";
|
|
4
5
|
const inFlightRefreshes = new Map();
|
|
5
6
|
const recentRefreshResults = new Map();
|
|
6
7
|
const RECENT_REFRESH_RESULT_TTL_MS = 5000;
|
|
8
|
+
// Refresh cookies rotate, so a completed entry's key is never looked up again and
|
|
9
|
+
// would live forever without this. Sweep expired entries (throttled so it stays off
|
|
10
|
+
// the hot path) and cap total size as a backstop against a burst of distinct cookies.
|
|
11
|
+
const MAX_RECENT_REFRESH_RESULTS = 10_000;
|
|
12
|
+
let lastPruneAt = 0;
|
|
13
|
+
function pruneRecentRefreshResults(now) {
|
|
14
|
+
if (now - lastPruneAt >= RECENT_REFRESH_RESULT_TTL_MS) {
|
|
15
|
+
for (const [key, entry] of recentRefreshResults) {
|
|
16
|
+
if (entry.expiresAt <= now) {
|
|
17
|
+
recentRefreshResults.delete(key);
|
|
18
|
+
}
|
|
19
|
+
}
|
|
20
|
+
lastPruneAt = now;
|
|
21
|
+
}
|
|
22
|
+
while (recentRefreshResults.size > MAX_RECENT_REFRESH_RESULTS) {
|
|
23
|
+
const oldest = recentRefreshResults.keys().next().value;
|
|
24
|
+
if (oldest === undefined)
|
|
25
|
+
break;
|
|
26
|
+
recentRefreshResults.delete(oldest);
|
|
27
|
+
}
|
|
28
|
+
}
|
|
7
29
|
export async function refreshAccessToken(refreshCookie, opts) {
|
|
30
|
+
assertSecrets(opts);
|
|
8
31
|
const now = Date.now();
|
|
9
32
|
const recentRefresh = recentRefreshResults.get(refreshCookie);
|
|
10
33
|
if (recentRefresh && recentRefresh.expiresAt > now) {
|
|
@@ -43,9 +66,11 @@ export async function refreshAccessToken(refreshCookie, opts) {
|
|
|
43
66
|
try {
|
|
44
67
|
const result = await refreshPromise;
|
|
45
68
|
if (result) {
|
|
69
|
+
const insertedAt = Date.now();
|
|
70
|
+
pruneRecentRefreshResults(insertedAt);
|
|
46
71
|
recentRefreshResults.set(refreshCookie, {
|
|
47
72
|
result,
|
|
48
|
-
expiresAt:
|
|
73
|
+
expiresAt: insertedAt + RECENT_REFRESH_RESULT_TTL_MS,
|
|
49
74
|
});
|
|
50
75
|
}
|
|
51
76
|
return result;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"refreshAccessToken.js","sourceRoot":"","sources":["../src/refreshAccessToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;
|
|
1
|
+
{"version":3,"file":"refreshAccessToken.js","sourceRoot":"","sources":["../src/refreshAccessToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAyBrD,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAoD,CAAC;AACtF,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAGjC,CAAC;AACJ,MAAM,4BAA4B,GAAG,IAAI,CAAC;AAC1C,kFAAkF;AAClF,oFAAoF;AACpF,sFAAsF;AACtF,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAC1C,IAAI,WAAW,GAAG,CAAC,CAAC;AAEpB,SAAS,yBAAyB,CAAC,GAAW;IAC5C,IAAI,GAAG,GAAG,WAAW,IAAI,4BAA4B,EAAE,CAAC;QACtD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,oBAAoB,EAAE,CAAC;YAChD,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;gBAC3B,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QACD,WAAW,GAAG,GAAG,CAAC;IACpB,CAAC;IAED,OAAO,oBAAoB,CAAC,IAAI,GAAG,0BAA0B,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QACxD,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM;QAChC,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,aAAqB,EACrB,IAA+B;IAE/B,aAAa,CAAC,IAAI,CAAC,CAAC;IAEpB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,aAAa,GAAG,oBAAoB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC9D,IAAI,aAAa,IAAI,aAAa,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;QACnD,OAAO,aAAa,CAAC,MAAM,CAAC;IAC9B,CAAC;IACD,IAAI,aAAa,EAAE,CAAC;QAClB,oBAAoB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,eAAe,GAAG,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC7D,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,MAAM,cAAc,GAAG,CAAC,KAAK,IAAI,EAAE;QACjC,MAAM,OAAO,GAAG,mBAAmB,CAAC,aAAa,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACtE,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,YAAY,GAAG,kBAAkB,CAAC;YACtC,OAAO,EAAE,OAAO,CAAC,GAAG;YACpB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,UAAU,EAAE;YAChE,MAAM,EAAE,MAAM;YACd,aAAa,EAAE,UAAU,OAAO,CAAC,YAAY,EAAE;YAC/C,oBAAoB,EAAE,UAAU,YAAY,EAAE;YAC9C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;SAC1C,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAE9B,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC,CAAC,EAAE,CAAC;IAEL,iBAAiB,CAAC,GAAG,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;IAErD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;QACpC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC9B,yBAAyB,CAAC,UAAU,CAAC,CAAC;YACtC,oBAAoB,CAAC,GAAG,CAAC,aAAa,EAAE;gBACtC,MAAM;gBACN,SAAS,EAAE,UAAU,GAAG,4BAA4B;aACrD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,iBAAiB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC"}
|
|
@@ -0,0 +1,7 @@
|
|
|
1
|
+
export declare const MIN_SECRET_LENGTH = 32;
|
|
2
|
+
export declare function assertSecretStrength(name: string, value: unknown): void;
|
|
3
|
+
export declare function assertSecrets(opts: {
|
|
4
|
+
cookieSecret: unknown;
|
|
5
|
+
serviceSecret: unknown;
|
|
6
|
+
}): void;
|
|
7
|
+
//# sourceMappingURL=validateSecrets.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"validateSecrets.d.ts","sourceRoot":"","sources":["../src/validateSecrets.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAUvE;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAClC,YAAY,EAAE,OAAO,CAAC;IACtB,aAAa,EAAE,OAAO,CAAC;CACxB,GAAG,IAAI,CAGP"}
|
|
@@ -0,0 +1,14 @@
|
|
|
1
|
+
export const MIN_SECRET_LENGTH = 32;
|
|
2
|
+
export function assertSecretStrength(name, value) {
|
|
3
|
+
if (typeof value !== "string" || value.length === 0) {
|
|
4
|
+
throw new Error(`Missing ${name}`);
|
|
5
|
+
}
|
|
6
|
+
if (value.length < MIN_SECRET_LENGTH) {
|
|
7
|
+
throw new Error(`${name} must be at least ${MIN_SECRET_LENGTH} characters. A short secret can be brute forced offline, letting an attacker forge cookie sessions and service tokens. Generate one with: openssl rand -base64 48`);
|
|
8
|
+
}
|
|
9
|
+
}
|
|
10
|
+
export function assertSecrets(opts) {
|
|
11
|
+
assertSecretStrength("cookieSecret", opts.cookieSecret);
|
|
12
|
+
assertSecretStrength("serviceSecret", opts.serviceSecret);
|
|
13
|
+
}
|
|
14
|
+
//# sourceMappingURL=validateSecrets.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"validateSecrets.js","sourceRoot":"","sources":["../src/validateSecrets.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,KAAc;IAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,qBAAqB,iBAAiB,mKAAmK,CACjN,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAG7B;IACC,oBAAoB,CAAC,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACxD,oBAAoB,CAAC,eAAe,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;AAC5D,CAAC"}
|
|
@@ -1,2 +1,2 @@
|
|
|
1
|
-
export declare function verifySignedAuthResponse<T = any>(token: string, authServerUrl: string): Promise<T | null>;
|
|
1
|
+
export declare function verifySignedAuthResponse<T = any>(token: string, authServerUrl: string, audience: string): Promise<T | null>;
|
|
2
2
|
//# sourceMappingURL=verifySignedAuthResponse.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verifySignedAuthResponse.d.ts","sourceRoot":"","sources":["../src/verifySignedAuthResponse.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"verifySignedAuthResponse.d.ts","sourceRoot":"","sources":["../src/verifySignedAuthResponse.ts"],"names":[],"mappings":"AAgBA,wBAAsB,wBAAwB,CAAC,CAAC,GAAG,GAAG,EACpD,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAgBnB"}
|