@shware/security 1.3.3 → 1.3.5

package/dist/auth/index.cjs

@@ -329,6 +329,10 @@ var Auth = class {
     if (!name) return null;
     return { name: String(name) };
   };
+  listSessions = async (principal) => {
+    const sessions = await this.repository.findByPrincipalName(principal.name);
+    return Array.from(sessions.values());
+  };
   cleanupExpiredSessions = async (cleanupCount) => {
     await this.repository.cleanupExpiredSessions(cleanupCount);
     return Response.json({});

package/dist/auth/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/index.ts"],"sourcesContent":["import { createHash, randomUUID } from 'crypto';\nimport invariant from 'tiny-invariant';\nimport { PRINCIPAL_NAME_INDEX_NAME } from '../session/common';\nimport { param, query, getCookie, setCookie, deleteCookie } from '../utils/http';\nimport { OAuth2Client, oauth2RedirectQuerySchema } from '../oauth2/client';\nimport { OAuth2ErrorType } from '../oauth2/error';\nimport { timing } from '../utils/timing';\nimport { google } from '../oauth2/provider/index';\nimport type { CookieOptions } from '../utils/http';\nimport type { KVRepository, Session, SessionRepository } from '../session/types';\nimport type { NativeCredential, OAuth2AuthorizationRequest, PkceParameters } from '../oauth2/types';\nimport type { AuthConfig, AuthService, LoggedHandler, OAuth2AuthorizedHandler } from './types';\nimport type { Principal } from '../core';\n\nexport class Auth implements AuthService {\n  private readonly timing: boolean;\n  private readonly cookieName;\n  private readonly cookieOptions: CookieOptions;\n  private readonly kv: KVRepository;\n  private readonly repository: SessionRepository;\n\n  private readonly oauth2Client: OAuth2Client | null;\n  private readonly ATTR_OAUTH2_AUTHORIZATION_REQUEST = 'oauth2AuthorizationRequest';\n\n  public readonly PATH_CSRF = '/csrf' as const;\n  public readonly PATH_LOGOUT = '/logout' as const;\n  public readonly PATH_LOGGED = '/logged' as const;\n\n  public readonly PATH_OAUTH2_STATE = '/oauth2/state/:registrationId' as const;\n  public readonly PATH_OAUTH2_NONCE = '/oauth2/nonce/:registrationId' as const;\n  public readonly PATH_OAUTH2_AUTHORIZATION = '/oauth2/authorization/:registrationId' as const;\n  public readonly PATH_LOGIN_OAUTH2_CODE = '/login/oauth2/code/:registrationId' as const;\n  public readonly PATH_LOGIN_OAUTH2_NATIVE = '/login/oauth2/native/:registrationId' as const;\n  public readonly PATH_LOGIN_OAUTH2_ONETAP = '/login/oauth2/onetap/google' as const;\n\n  public readonly PATH_CLEANUP_EXPIRED_SESSIONS = '/sessions/expired/cleanup' as const;\n\n  constructor({ sessionRepository, kvRepository, oauth2, cookie, timing }: AuthConfig) {\n    this.timing = timing ?? false;\n    this.kv = kvRepository;\n    this.repository = sessionRepository;\n    const { name, ...cookieOptions } = cookie ?? {};\n    this.cookieName = name ?? 'SESSION';\n    this.cookieOptions = {\n      path: '/',\n      sameSite: 'none',\n      secure: true,\n      httpOnly: true,\n      ...cookieOptions,\n    };\n    this.oauth2Client = oauth2?.client ? new OAuth2Client(oauth2.client) : null;\n  }\n\n  logout = async (request: Request): Promise<Response> => {\n    const sessionId = getCookie(request, this.cookieName);\n    if (sessionId) await this.repository.deleteById(sessionId);\n    const response = Response.json({});\n    deleteCookie(response, this.cookieName);\n    return response;\n  };\n\n  logged = async (request: Request, onLogged?: LoggedHandler): Promise<Response> => {\n    // 1. get session from cookie\n    const sessionId = getCookie(request, this.cookieName);\n    if (!sessionId) return Response.json({ data: false });\n    const session = await this.repository.findById(sessionId);\n    if (!session) return Response.json({ data: false });\n\n    // 2. get principal name from session\n    const name = session.getAttribute(PRINCIPAL_NAME_INDEX_NAME);\n    session.setLastAccessedTime(Date.now());\n    await this.repository.save(session);\n\n    // 3. call onLogged\n    if (name !== null) await onLogged?.({ name: String(name) });\n\n    // 4. renew cookie\n    const response = Response.json({ data: name !== null });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    return response;\n  };\n\n  private createPkceParameters(): PkceParameters {\n    const code_verifier = randomUUID();\n    const code_challenge = createHash('sha256')\n      .update(code_verifier)\n      .digest()\n      .toString('base64url');\n\n    return { code_verifier, code_challenge, code_challenge_method: 'S256' };\n  }\n\n  private getOauth2StateKey(state: string) {\n    return `oauth2:state:${state}`;\n  }\n\n  private getOauth2NonceKey(nonce: string) {\n    return `oauth2:nonce:${nonce}`;\n  }\n\n  oauth2State = async (request: Request): Promise<Response> => {\n    const { registrationId } = param(request, this.PATH_OAUTH2_STATE);\n    const state = randomUUID();\n    await this.kv.setItem(this.getOauth2StateKey(state), registrationId, 10 * 60);\n    return Response.json({ state });\n  };\n\n  oauth2Nonce = async (request: Request): Promise<Response> => {\n    const { registrationId } = param(request, this.PATH_OAUTH2_NONCE);\n    const nonce = randomUUID();\n    await this.kv.setItem(this.getOauth2NonceKey(nonce), registrationId, 10 * 60);\n    return Response.json({ nonce });\n  };\n\n  oauth2Authorization = async (request: Request): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n    const { registrationId } = param(request, this.PATH_OAUTH2_AUTHORIZATION);\n    const state = randomUUID();\n    const pkce = this.createPkceParameters();\n    const uri = this.oauth2Client.createAuthorizationUri({ registrationId, state, pkce });\n    const sessionId = getCookie(request, this.cookieName);\n    const session = sessionId\n      ? ((await this.repository.findById(sessionId)) ?? this.repository.createSession())\n      : this.repository.createSession();\n    mark('fetch_session');\n\n    const authorizationRequest: OAuth2AuthorizationRequest = {\n      state,\n      registrationId,\n      authorizationRequestUri: uri.href,\n      additionalParameters: pkce,\n    };\n\n    const value = JSON.stringify(authorizationRequest);\n    session.setAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST, value);\n    await this.repository.save(session);\n    mark('save_session');\n\n    const response = new Response(null, { status: 302, headers: { location: uri.href } });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  private redirect = (error: OAuth2ErrorType, description?: string): Response => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const uri = new URL(this.oauth2Client.errorUri);\n    uri.searchParams.set('error', error);\n    if (description) uri.searchParams.set('error_description', description);\n    return Response.redirect(uri.href, 302);\n  };\n\n  loginOAuth2Code = async (\n    request: Request,\n    onAuthorized: OAuth2AuthorizedHandler\n  ): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n\n    // 1. get session from cookie\n    const sessionId = getCookie(request, this.cookieName);\n    const session = sessionId ? await this.repository.findById(sessionId) : null;\n    if (!session) {\n      return this.redirect('invalid_request', 'session not found');\n    }\n    mark('load_session');\n\n    // 2. get cached authorization request from session\n    const json = session.getAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST) as string | null;\n    if (!json) {\n      return this.redirect('invalid_request', 'authorization request not  found');\n    }\n    const cached: OAuth2AuthorizationRequest = JSON.parse(json);\n\n    // 3. validate redirect query/formdata\n    const { registrationId } = param(request, this.PATH_LOGIN_OAUTH2_CODE);\n    let data: Record<string, string>;\n    // apple redirect: response_mode=form_post\n    if (\n      request.method === 'POST' &&\n      request.headers.get('content-type')?.toLowerCase() === 'application/x-www-form-urlencoded'\n    ) {\n      const params = new URLSearchParams(await request.text());\n      data = Object.fromEntries(params.entries());\n    } else {\n      data = query(request);\n    }\n\n    const parsed = oauth2RedirectQuerySchema.safeParse(data);\n    if (!parsed.success) {\n      return this.redirect('invalid_request', 'invalid redirect query');\n    }\n    if (!parsed.data.code || !parsed.data.state) {\n      return this.redirect('invalid_request', 'invalid redirect query');\n    }\n    if (parsed.data.state !== cached.state) {\n      return this.redirect('invalid_request', 'redirect state mismatch');\n    }\n    if (registrationId !== cached.registrationId) {\n      return this.redirect('invalid_request', 'redirect registration mismatch');\n    }\n    mark('validate_session');\n\n    // 4. exchange authorization code for token and get user info\n    const { code } = parsed.data;\n\n    const token = await this.oauth2Client.exchangeAuthorizationCode({\n      registrationId,\n      code,\n      pkce: cached.additionalParameters,\n    });\n    const userInfo = await this.oauth2Client.getUserInfo({ registrationId, token });\n    mark('exchange_code');\n\n    // 5. create or update principal\n    const principal = await onAuthorized(request, registrationId, userInfo, token);\n    mark('save_principal');\n\n    // 6. update session\n    session.setLastAccessedTime(Date.now());\n    session.removeAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST);\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    mark('update_session');\n\n    const response = new Response(null, {\n      status: 302,\n      headers: { location: this.oauth2Client.successUri },\n    });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  loginOAuth2Native = async (\n    request: Request,\n    onAuthorized: OAuth2AuthorizedHandler\n  ): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n    const { registrationId } = param(request, this.PATH_LOGIN_OAUTH2_NATIVE);\n    const credentials = (await request.json()) as NativeCredential;\n    const { userInfo, token } = await this.oauth2Client.loginOAuth2Native({\n      registrationId,\n      credentials,\n    });\n    mark('login_oauth2_native');\n\n    const { nonce } = userInfo.data as { nonce?: string };\n    if (nonce) {\n      const value = await this.kv.getItem(this.getOauth2NonceKey(nonce));\n      if (value !== registrationId) {\n        const json = { error: 'invalid_request', error_description: 'nonce mismatch' };\n        return Response.json(json, { status: 400 });\n      }\n      await this.kv.removeItem(this.getOauth2NonceKey(nonce));\n      mark('check_nonce');\n    }\n\n    const principal = await onAuthorized(request, registrationId, userInfo, token);\n    mark('save_principal');\n\n    const session = this.repository.createSession();\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    const response = new Response(JSON.stringify(principal), {\n      status: 200,\n      headers: { 'Content-Type': 'application/json' },\n    });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  loginOAuth2Onetap = async (\n    request: Request,\n    onAuthorized: OAuth2AuthorizedHandler\n  ): Promise<Response> => {\n    const { mark, setTiming } = timing({ enabled: this.timing });\n    // should support application/x-www-form-urlencoded and application/json\n    let body: Record<string, string>;\n    if (request.headers.get('Content-Type') === 'application/x-www-form-urlencoded') {\n      const text = await request.text();\n      body = Object.fromEntries(new URLSearchParams(text));\n    } else if (request.headers.get('Content-Type') === 'application/json') {\n      body = (await request.json()) as Record<string, string>;\n    } else {\n      const json = { error: 'invalid_request', error_description: 'invalid content type' };\n      return Response.json(json, { status: 400 });\n    }\n\n    const csrf_cookie = getCookie(request, 'g_csrf_token');\n    if (csrf_cookie) {\n      const csrf_request = body['g_csrf_token'];\n      if (!csrf_request || csrf_cookie !== csrf_request) {\n        const json = { error: 'invalid_request', error_description: 'invalid csrf token' };\n        return Response.json(json, { status: 400 });\n      }\n    }\n    const { token, userInfo } = await google.getTokenInfo(body['credential']);\n    const principal = await onAuthorized(request, 'google', userInfo, token);\n    mark('save_principal');\n\n    const session = this.repository.createSession();\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    const response = new Response(JSON.stringify(principal), {\n      status: 200,\n      headers: { 'Content-Type': 'application/json' },\n    });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  kick = async (principal: Principal): Promise<void> => {\n    const sessions = await this.repository.findByPrincipalName(principal.name);\n    for (const sessionId of sessions.keys()) {\n      await this.repository.deleteById(sessionId);\n    }\n  };\n\n  isAuthenticated = async (request: Request): Promise<boolean> => {\n    const sessionId = getCookie(request, this.cookieName);\n    if (!sessionId) return false;\n    const session = await this.repository.findById(sessionId);\n    if (!session) return false;\n    const principalName = session.getAttribute(PRINCIPAL_NAME_INDEX_NAME);\n    if (!principalName) return false;\n    return true;\n  };\n\n  getSession = async <T extends boolean>(\n    request: Request,\n    create: T\n  ): Promise<T extends true ? Session : Session | null> => {\n    const sessionId = getCookie(request, this.cookieName);\n    if (!sessionId) {\n      if (create) {\n        const session = this.repository.createSession();\n        await this.repository.save(session);\n        return session;\n      } else {\n        return null as T extends true ? Session : Session | null;\n      }\n    }\n    const session = await this.repository.findById(sessionId);\n    if (!session) {\n      if (create) {\n        const session = this.repository.createSession();\n        await this.repository.save(session);\n        return session;\n      } else {\n        return null as T extends true ? Session : Session | null;\n      }\n    }\n    return session;\n  };\n\n  deleteSession = async (sessionId: string): Promise<void> => {\n    await this.repository.deleteById(sessionId);\n  };\n\n  getPrincipal = async (request: Request): Promise<Principal | null> => {\n    const sessionId = getCookie(request, this.cookieName);\n    if (!sessionId) return null;\n    const session = await this.repository.findById(sessionId);\n    if (!session) return null;\n    const name = session.getAttribute(PRINCIPAL_NAME_INDEX_NAME);\n    if (!name) return null;\n    return { name: String(name) };\n  };\n\n  cleanupExpiredSessions = async (cleanupCount?: number): Promise<Response> => {\n    await this.repository.cleanupExpiredSessions(cleanupCount);\n    return Response.json({});\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAAuC;AACvC,4BAAsB;AACtB,oBAA0C;AAC1C,kBAAiE;AACjE,oBAAwD;AAExD,oBAAuB;AACvB,sBAAuB;AAOhB,IAAM,OAAN,MAAkC;AAAA,EACtB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA,oCAAoC;AAAA,EAErC,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,cAAc;AAAA,EAEd,oBAAoB;AAAA,EACpB,oBAAoB;AAAA,EACpB,4BAA4B;AAAA,EAC5B,yBAAyB;AAAA,EACzB,2BAA2B;AAAA,EAC3B,2BAA2B;AAAA,EAE3B,gCAAgC;AAAA,EAEhD,YAAY,EAAE,mBAAmB,cAAc,QAAQ,QAAQ,QAAAA,QAAO,GAAe;AACnF,SAAK,SAASA,WAAU;AACxB,SAAK,KAAK;AACV,SAAK,aAAa;AAClB,UAAM,EAAE,MAAM,GAAG,cAAc,IAAI,UAAU,CAAC;AAC9C,SAAK,aAAa,QAAQ;AAC1B,SAAK,gBAAgB;AAAA,MACnB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,GAAG;AAAA,IACL;AACA,SAAK,eAAe,QAAQ,SAAS,IAAI,2BAAa,OAAO,MAAM,IAAI;AAAA,EACzE;AAAA,EAEA,SAAS,OAAO,YAAwC;AACtD,UAAM,gBAAY,uBAAU,SAAS,KAAK,UAAU;AACpD,QAAI,UAAW,OAAM,KAAK,WAAW,WAAW,SAAS;AACzD,UAAM,WAAW,SAAS,KAAK,CAAC,CAAC;AACjC,kCAAa,UAAU,KAAK,UAAU;AACtC,WAAO;AAAA,EACT;AAAA,EAEA,SAAS,OAAO,SAAkB,aAAgD;AAEhF,UAAM,gBAAY,uBAAU,SAAS,KAAK,UAAU;AACpD,QAAI,CAAC,UAAW,QAAO,SAAS,KAAK,EAAE,MAAM,MAAM,CAAC;AACpD,UAAM,UAAU,MAAM,KAAK,WAAW,SAAS,SAAS;AACxD,QAAI,CAAC,QAAS,QAAO,SAAS,KAAK,EAAE,MAAM,MAAM,CAAC;AAGlD,UAAM,OAAO,QAAQ,aAAa,uCAAyB;AAC3D,YAAQ,oBAAoB,KAAK,IAAI,CAAC;AACtC,UAAM,KAAK,WAAW,KAAK,OAAO;AAGlC,QAAI,SAAS,KAAM,OAAM,WAAW,EAAE,MAAM,OAAO,IAAI,EAAE,CAAC;AAG1D,UAAM,WAAW,SAAS,KAAK,EAAE,MAAM,SAAS,KAAK,CAAC;AACtD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,+BAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,WAAO;AAAA,EACT;AAAA,EAEQ,uBAAuC;AAC7C,UAAM,oBAAgB,0BAAW;AACjC,UAAM,qBAAiB,0BAAW,QAAQ,EACvC,OAAO,aAAa,EACpB,OAAO,EACP,SAAS,WAAW;AAEvB,WAAO,EAAE,eAAe,gBAAgB,uBAAuB,OAAO;AAAA,EACxE;AAAA,EAEQ,kBAAkB,OAAe;AACvC,WAAO,gBAAgB,KAAK;AAAA,EAC9B;AAAA,EAEQ,kBAAkB,OAAe;AACvC,WAAO,gBAAgB,KAAK;AAAA,EAC9B;AAAA,EAEA,cAAc,OAAO,YAAwC;AAC3D,UAAM,EAAE,eAAe,QAAI,mBAAM,SAAS,KAAK,iBAAiB;AAChE,UAAM,YAAQ,0BAAW;AACzB,UAAM,KAAK,GAAG,QAAQ,KAAK,kBAAkB,KAAK,GAAG,gBAAgB,KAAK,EAAE;AAC5E,WAAO,SAAS,KAAK,EAAE,MAAM,CAAC;AAAA,EAChC;AAAA,EAEA,cAAc,OAAO,YAAwC;AAC3D,UAAM,EAAE,eAAe,QAAI,mBAAM,SAAS,KAAK,iBAAiB;AAChE,UAAM,YAAQ,0BAAW;AACzB,UAAM,KAAK,GAAG,QAAQ,KAAK,kBAAkB,KAAK,GAAG,gBAAgB,KAAK,EAAE;AAC5E,WAAO,SAAS,KAAK,EAAE,MAAM,CAAC;AAAA,EAChC;AAAA,EAEA,sBAAsB,OAAO,YAAwC;AACnE,8BAAAC,SAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,QAAI,sBAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAC3D,UAAM,EAAE,eAAe,QAAI,mBAAM,SAAS,KAAK,yBAAyB;AACxE,UAAM,YAAQ,0BAAW;AACzB,UAAM,OAAO,KAAK,qBAAqB;AACvC,UAAM,MAAM,KAAK,aAAa,uBAAuB,EAAE,gBAAgB,OAAO,KAAK,CAAC;AACpF,UAAM,gBAAY,uBAAU,SAAS,KAAK,UAAU;AACpD,UAAM,UAAU,YACV,MAAM,KAAK,WAAW,SAAS,SAAS,KAAM,KAAK,WAAW,cAAc,IAC9E,KAAK,WAAW,cAAc;AAClC,SAAK,eAAe;AAEpB,UAAM,uBAAmD;AAAA,MACvD;AAAA,MACA;AAAA,MACA,yBAAyB,IAAI;AAAA,MAC7B,sBAAsB;AAAA,IACxB;AAEA,UAAM,QAAQ,KAAK,UAAU,oBAAoB;AACjD,YAAQ,aAAa,KAAK,mCAAmC,KAAK;AAClE,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,SAAK,cAAc;AAEnB,UAAM,WAAW,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,UAAU,IAAI,KAAK,EAAE,CAAC;AACpF,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,+BAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEQ,WAAW,CAAC,OAAwB,gBAAmC;AAC7E,8BAAAA,SAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,MAAM,IAAI,IAAI,KAAK,aAAa,QAAQ;AAC9C,QAAI,aAAa,IAAI,SAAS,KAAK;AACnC,QAAI,YAAa,KAAI,aAAa,IAAI,qBAAqB,WAAW;AACtE,WAAO,SAAS,SAAS,IAAI,MAAM,GAAG;AAAA,EACxC;AAAA,EAEA,kBAAkB,OAChB,SACA,iBACsB;AACtB,8BAAAA,SAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,QAAI,sBAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAG3D,UAAM,gBAAY,uBAAU,SAAS,KAAK,UAAU;AACpD,UAAM,UAAU,YAAY,MAAM,KAAK,WAAW,SAAS,SAAS,IAAI;AACxE,QAAI,CAAC,SAAS;AACZ,aAAO,KAAK,SAAS,mBAAmB,mBAAmB;AAAA,IAC7D;AACA,SAAK,cAAc;AAGnB,UAAM,OAAO,QAAQ,aAAa,KAAK,iCAAiC;AACxE,QAAI,CAAC,MAAM;AACT,aAAO,KAAK,SAAS,mBAAmB,kCAAkC;AAAA,IAC5E;AACA,UAAM,SAAqC,KAAK,MAAM,IAAI;AAG1D,UAAM,EAAE,eAAe,QAAI,mBAAM,SAAS,KAAK,sBAAsB;AACrE,QAAI;AAEJ,QACE,QAAQ,WAAW,UACnB,QAAQ,QAAQ,IAAI,cAAc,GAAG,YAAY,MAAM,qCACvD;AACA,YAAM,SAAS,IAAI,gBAAgB,MAAM,QAAQ,KAAK,CAAC;AACvD,aAAO,OAAO,YAAY,OAAO,QAAQ,CAAC;AAAA,IAC5C,OAAO;AACL,iBAAO,mBAAM,OAAO;AAAA,IACtB;AAEA,UAAM,SAAS,wCAA0B,UAAU,IAAI;AACvD,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,KAAK,SAAS,mBAAmB,wBAAwB;AAAA,IAClE;AACA,QAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,KAAK,OAAO;AAC3C,aAAO,KAAK,SAAS,mBAAmB,wBAAwB;AAAA,IAClE;AACA,QAAI,OAAO,KAAK,UAAU,OAAO,OAAO;AACtC,aAAO,KAAK,SAAS,mBAAmB,yBAAyB;AAAA,IACnE;AACA,QAAI,mBAAmB,OAAO,gBAAgB;AAC5C,aAAO,KAAK,SAAS,mBAAmB,gCAAgC;AAAA,IAC1E;AACA,SAAK,kBAAkB;AAGvB,UAAM,EAAE,KAAK,IAAI,OAAO;AAExB,UAAM,QAAQ,MAAM,KAAK,aAAa,0BAA0B;AAAA,MAC9D;AAAA,MACA;AAAA,MACA,MAAM,OAAO;AAAA,IACf,CAAC;AACD,UAAM,WAAW,MAAM,KAAK,aAAa,YAAY,EAAE,gBAAgB,MAAM,CAAC;AAC9E,SAAK,eAAe;AAGpB,UAAM,YAAY,MAAM,aAAa,SAAS,gBAAgB,UAAU,KAAK;AAC7E,SAAK,gBAAgB;AAGrB,YAAQ,oBAAoB,KAAK,IAAI,CAAC;AACtC,YAAQ,gBAAgB,KAAK,iCAAiC;AAC9D,YAAQ,aAAa,yCAA2B,UAAU,IAAI;AAC9D,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,SAAK,gBAAgB;AAErB,UAAM,WAAW,IAAI,SAAS,MAAM;AAAA,MAClC,QAAQ;AAAA,MACR,SAAS,EAAE,UAAU,KAAK,aAAa,WAAW;AAAA,IACpD,CAAC;AACD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,+BAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEA,oBAAoB,OAClB,SACA,iBACsB;AACtB,8BAAAA,SAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,QAAI,sBAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAC3D,UAAM,EAAE,eAAe,QAAI,mBAAM,SAAS,KAAK,wBAAwB;AACvE,UAAM,cAAe,MAAM,QAAQ,KAAK;AACxC,UAAM,EAAE,UAAU,MAAM,IAAI,MAAM,KAAK,aAAa,kBAAkB;AAAA,MACpE;AAAA,MACA;AAAA,IACF,CAAC;AACD,SAAK,qBAAqB;AAE1B,UAAM,EAAE,MAAM,IAAI,SAAS;AAC3B,QAAI,OAAO;AACT,YAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,KAAK,kBAAkB,KAAK,CAAC;AACjE,UAAI,UAAU,gBAAgB;AAC5B,cAAM,OAAO,EAAE,OAAO,mBAAmB,mBAAmB,iBAAiB;AAC7E,eAAO,SAAS,KAAK,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC5C;AACA,YAAM,KAAK,GAAG,WAAW,KAAK,kBAAkB,KAAK,CAAC;AACtD,WAAK,aAAa;AAAA,IACpB;AAEA,UAAM,YAAY,MAAM,aAAa,SAAS,gBAAgB,UAAU,KAAK;AAC7E,SAAK,gBAAgB;AAErB,UAAM,UAAU,KAAK,WAAW,cAAc;AAC9C,YAAQ,aAAa,yCAA2B,UAAU,IAAI;AAC9D,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,UAAM,WAAW,IAAI,SAAS,KAAK,UAAU,SAAS,GAAG;AAAA,MACvD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAChD,CAAC;AACD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,+BAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEA,oBAAoB,OAClB,SACA,iBACsB;AACtB,UAAM,EAAE,MAAM,UAAU,QAAI,sBAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAE3D,QAAI;AACJ,QAAI,QAAQ,QAAQ,IAAI,cAAc,MAAM,qCAAqC;AAC/E,YAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,aAAO,OAAO,YAAY,IAAI,gBAAgB,IAAI,CAAC;AAAA,IACrD,WAAW,QAAQ,QAAQ,IAAI,cAAc,MAAM,oBAAoB;AACrE,aAAQ,MAAM,QAAQ,KAAK;AAAA,IAC7B,OAAO;AACL,YAAM,OAAO,EAAE,OAAO,mBAAmB,mBAAmB,uBAAuB;AACnF,aAAO,SAAS,KAAK,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC5C;AAEA,UAAM,kBAAc,uBAAU,SAAS,cAAc;AACrD,QAAI,aAAa;AACf,YAAM,eAAe,KAAK,cAAc;AACxC,UAAI,CAAC,gBAAgB,gBAAgB,cAAc;AACjD,cAAM,OAAO,EAAE,OAAO,mBAAmB,mBAAmB,qBAAqB;AACjF,eAAO,SAAS,KAAK,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC5C;AAAA,IACF;AACA,UAAM,EAAE,OAAO,SAAS,IAAI,MAAM,uBAAO,aAAa,KAAK,YAAY,CAAC;AACxE,UAAM,YAAY,MAAM,aAAa,SAAS,UAAU,UAAU,KAAK;AACvE,SAAK,gBAAgB;AAErB,UAAM,UAAU,KAAK,WAAW,cAAc;AAC9C,YAAQ,aAAa,yCAA2B,UAAU,IAAI;AAC9D,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,UAAM,WAAW,IAAI,SAAS,KAAK,UAAU,SAAS,GAAG;AAAA,MACvD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAChD,CAAC;AACD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,+BAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEA,OAAO,OAAO,cAAwC;AACpD,UAAM,WAAW,MAAM,KAAK,WAAW,oBAAoB,UAAU,IAAI;AACzE,eAAW,aAAa,SAAS,KAAK,GAAG;AACvC,YAAM,KAAK,WAAW,WAAW,SAAS;AAAA,IAC5C;AAAA,EACF;AAAA,EAEA,kBAAkB,OAAO,YAAuC;AAC9D,UAAM,gBAAY,uBAAU,SAAS,KAAK,UAAU;AACpD,QAAI,CAAC,UAAW,QAAO;AACvB,UAAM,UAAU,MAAM,KAAK,WAAW,SAAS,SAAS;AACxD,QAAI,CAAC,QAAS,QAAO;AACrB,UAAM,gBAAgB,QAAQ,aAAa,uCAAyB;AACpE,QAAI,CAAC,cAAe,QAAO;AAC3B,WAAO;AAAA,EACT;AAAA,EAEA,aAAa,OACX,SACA,WACuD;AACvD,UAAM,gBAAY,uBAAU,SAAS,KAAK,UAAU;AACpD,QAAI,CAAC,WAAW;AACd,UAAI,QAAQ;AACV,cAAMC,WAAU,KAAK,WAAW,cAAc;AAC9C,cAAM,KAAK,WAAW,KAAKA,QAAO;AAClC,eAAOA;AAAA,MACT,OAAO;AACL,eAAO;AAAA,MACT;AAAA,IACF;AACA,UAAM,UAAU,MAAM,KAAK,WAAW,SAAS,SAAS;AACxD,QAAI,CAAC,SAAS;AACZ,UAAI,QAAQ;AACV,cAAMA,WAAU,KAAK,WAAW,cAAc;AAC9C,cAAM,KAAK,WAAW,KAAKA,QAAO;AAClC,eAAOA;AAAA,MACT,OAAO;AACL,eAAO;AAAA,MACT;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,gBAAgB,OAAO,cAAqC;AAC1D,UAAM,KAAK,WAAW,WAAW,SAAS;AAAA,EAC5C;AAAA,EAEA,eAAe,OAAO,YAAgD;AACpE,UAAM,gBAAY,uBAAU,SAAS,KAAK,UAAU;AACpD,QAAI,CAAC,UAAW,QAAO;AACvB,UAAM,UAAU,MAAM,KAAK,WAAW,SAAS,SAAS;AACxD,QAAI,CAAC,QAAS,QAAO;AACrB,UAAM,OAAO,QAAQ,aAAa,uCAAyB;AAC3D,QAAI,CAAC,KAAM,QAAO;AAClB,WAAO,EAAE,MAAM,OAAO,IAAI,EAAE;AAAA,EAC9B;AAAA,EAEA,yBAAyB,OAAO,iBAA6C;AAC3E,UAAM,KAAK,WAAW,uBAAuB,YAAY;AACzD,WAAO,SAAS,KAAK,CAAC,CAAC;AAAA,EACzB;AACF;","names":["timing","invariant","session"]}
+{"version":3,"sources":["../../src/auth/index.ts"],"sourcesContent":["import { createHash, randomUUID } from 'crypto';\nimport invariant from 'tiny-invariant';\nimport { PRINCIPAL_NAME_INDEX_NAME } from '../session/common';\nimport { param, query, getCookie, setCookie, deleteCookie } from '../utils/http';\nimport { OAuth2Client, oauth2RedirectQuerySchema } from '../oauth2/client';\nimport { OAuth2ErrorType } from '../oauth2/error';\nimport { timing } from '../utils/timing';\nimport { google } from '../oauth2/provider/index';\nimport type { CookieOptions } from '../utils/http';\nimport type { KVRepository, Session, SessionRepository } from '../session/types';\nimport type { NativeCredential, OAuth2AuthorizationRequest, PkceParameters } from '../oauth2/types';\nimport type { AuthConfig, AuthService, LoggedHandler, OAuth2AuthorizedHandler } from './types';\nimport type { Principal } from '../core';\n\nexport class Auth implements AuthService {\n  private readonly timing: boolean;\n  private readonly cookieName;\n  private readonly cookieOptions: CookieOptions;\n  private readonly kv: KVRepository;\n  private readonly repository: SessionRepository;\n\n  private readonly oauth2Client: OAuth2Client | null;\n  private readonly ATTR_OAUTH2_AUTHORIZATION_REQUEST = 'oauth2AuthorizationRequest';\n\n  public readonly PATH_CSRF = '/csrf' as const;\n  public readonly PATH_LOGOUT = '/logout' as const;\n  public readonly PATH_LOGGED = '/logged' as const;\n\n  public readonly PATH_OAUTH2_STATE = '/oauth2/state/:registrationId' as const;\n  public readonly PATH_OAUTH2_NONCE = '/oauth2/nonce/:registrationId' as const;\n  public readonly PATH_OAUTH2_AUTHORIZATION = '/oauth2/authorization/:registrationId' as const;\n  public readonly PATH_LOGIN_OAUTH2_CODE = '/login/oauth2/code/:registrationId' as const;\n  public readonly PATH_LOGIN_OAUTH2_NATIVE = '/login/oauth2/native/:registrationId' as const;\n  public readonly PATH_LOGIN_OAUTH2_ONETAP = '/login/oauth2/onetap/google' as const;\n\n  public readonly PATH_CLEANUP_EXPIRED_SESSIONS = '/sessions/expired/cleanup' as const;\n\n  constructor({ sessionRepository, kvRepository, oauth2, cookie, timing }: AuthConfig) {\n    this.timing = timing ?? false;\n    this.kv = kvRepository;\n    this.repository = sessionRepository;\n    const { name, ...cookieOptions } = cookie ?? {};\n    this.cookieName = name ?? 'SESSION';\n    this.cookieOptions = {\n      path: '/',\n      sameSite: 'none',\n      secure: true,\n      httpOnly: true,\n      ...cookieOptions,\n    };\n    this.oauth2Client = oauth2?.client ? new OAuth2Client(oauth2.client) : null;\n  }\n\n  logout = async (request: Request): Promise<Response> => {\n    const sessionId = getCookie(request, this.cookieName);\n    if (sessionId) await this.repository.deleteById(sessionId);\n    const response = Response.json({});\n    deleteCookie(response, this.cookieName);\n    return response;\n  };\n\n  logged = async (request: Request, onLogged?: LoggedHandler): Promise<Response> => {\n    // 1. get session from cookie\n    const sessionId = getCookie(request, this.cookieName);\n    if (!sessionId) return Response.json({ data: false });\n    const session = await this.repository.findById(sessionId);\n    if (!session) return Response.json({ data: false });\n\n    // 2. get principal name from session\n    const name = session.getAttribute(PRINCIPAL_NAME_INDEX_NAME);\n    session.setLastAccessedTime(Date.now());\n    await this.repository.save(session);\n\n    // 3. call onLogged\n    if (name !== null) await onLogged?.({ name: String(name) });\n\n    // 4. renew cookie\n    const response = Response.json({ data: name !== null });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    return response;\n  };\n\n  private createPkceParameters(): PkceParameters {\n    const code_verifier = randomUUID();\n    const code_challenge = createHash('sha256')\n      .update(code_verifier)\n      .digest()\n      .toString('base64url');\n\n    return { code_verifier, code_challenge, code_challenge_method: 'S256' };\n  }\n\n  private getOauth2StateKey(state: string) {\n    return `oauth2:state:${state}`;\n  }\n\n  private getOauth2NonceKey(nonce: string) {\n    return `oauth2:nonce:${nonce}`;\n  }\n\n  oauth2State = async (request: Request): Promise<Response> => {\n    const { registrationId } = param(request, this.PATH_OAUTH2_STATE);\n    const state = randomUUID();\n    await this.kv.setItem(this.getOauth2StateKey(state), registrationId, 10 * 60);\n    return Response.json({ state });\n  };\n\n  oauth2Nonce = async (request: Request): Promise<Response> => {\n    const { registrationId } = param(request, this.PATH_OAUTH2_NONCE);\n    const nonce = randomUUID();\n    await this.kv.setItem(this.getOauth2NonceKey(nonce), registrationId, 10 * 60);\n    return Response.json({ nonce });\n  };\n\n  oauth2Authorization = async (request: Request): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n    const { registrationId } = param(request, this.PATH_OAUTH2_AUTHORIZATION);\n    const state = randomUUID();\n    const pkce = this.createPkceParameters();\n    const uri = this.oauth2Client.createAuthorizationUri({ registrationId, state, pkce });\n    const sessionId = getCookie(request, this.cookieName);\n    const session = sessionId\n      ? ((await this.repository.findById(sessionId)) ?? this.repository.createSession())\n      : this.repository.createSession();\n    mark('fetch_session');\n\n    const authorizationRequest: OAuth2AuthorizationRequest = {\n      state,\n      registrationId,\n      authorizationRequestUri: uri.href,\n      additionalParameters: pkce,\n    };\n\n    const value = JSON.stringify(authorizationRequest);\n    session.setAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST, value);\n    await this.repository.save(session);\n    mark('save_session');\n\n    const response = new Response(null, { status: 302, headers: { location: uri.href } });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  private redirect = (error: OAuth2ErrorType, description?: string): Response => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const uri = new URL(this.oauth2Client.errorUri);\n    uri.searchParams.set('error', error);\n    if (description) uri.searchParams.set('error_description', description);\n    return Response.redirect(uri.href, 302);\n  };\n\n  loginOAuth2Code = async (\n    request: Request,\n    onAuthorized: OAuth2AuthorizedHandler\n  ): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n\n    // 1. get session from cookie\n    const sessionId = getCookie(request, this.cookieName);\n    const session = sessionId ? await this.repository.findById(sessionId) : null;\n    if (!session) {\n      return this.redirect('invalid_request', 'session not found');\n    }\n    mark('load_session');\n\n    // 2. get cached authorization request from session\n    const json = session.getAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST) as string | null;\n    if (!json) {\n      return this.redirect('invalid_request', 'authorization request not  found');\n    }\n    const cached: OAuth2AuthorizationRequest = JSON.parse(json);\n\n    // 3. validate redirect query/formdata\n    const { registrationId } = param(request, this.PATH_LOGIN_OAUTH2_CODE);\n    let data: Record<string, string>;\n    // apple redirect: response_mode=form_post\n    if (\n      request.method === 'POST' &&\n      request.headers.get('content-type')?.toLowerCase() === 'application/x-www-form-urlencoded'\n    ) {\n      const params = new URLSearchParams(await request.text());\n      data = Object.fromEntries(params.entries());\n    } else {\n      data = query(request);\n    }\n\n    const parsed = oauth2RedirectQuerySchema.safeParse(data);\n    if (!parsed.success) {\n      return this.redirect('invalid_request', 'invalid redirect query');\n    }\n    if (!parsed.data.code || !parsed.data.state) {\n      return this.redirect('invalid_request', 'invalid redirect query');\n    }\n    if (parsed.data.state !== cached.state) {\n      return this.redirect('invalid_request', 'redirect state mismatch');\n    }\n    if (registrationId !== cached.registrationId) {\n      return this.redirect('invalid_request', 'redirect registration mismatch');\n    }\n    mark('validate_session');\n\n    // 4. exchange authorization code for token and get user info\n    const { code } = parsed.data;\n\n    const token = await this.oauth2Client.exchangeAuthorizationCode({\n      registrationId,\n      code,\n      pkce: cached.additionalParameters,\n    });\n    const userInfo = await this.oauth2Client.getUserInfo({ registrationId, token });\n    mark('exchange_code');\n\n    // 5. create or update principal\n    const principal = await onAuthorized(request, registrationId, userInfo, token);\n    mark('save_principal');\n\n    // 6. update session\n    session.setLastAccessedTime(Date.now());\n    session.removeAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST);\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    mark('update_session');\n\n    const response = new Response(null, {\n      status: 302,\n      headers: { location: this.oauth2Client.successUri },\n    });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  loginOAuth2Native = async (\n    request: Request,\n    onAuthorized: OAuth2AuthorizedHandler\n  ): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n    const { registrationId } = param(request, this.PATH_LOGIN_OAUTH2_NATIVE);\n    const credentials = (await request.json()) as NativeCredential;\n    const { userInfo, token } = await this.oauth2Client.loginOAuth2Native({\n      registrationId,\n      credentials,\n    });\n    mark('login_oauth2_native');\n\n    const { nonce } = userInfo.data as { nonce?: string };\n    if (nonce) {\n      const value = await this.kv.getItem(this.getOauth2NonceKey(nonce));\n      if (value !== registrationId) {\n        const json = { error: 'invalid_request', error_description: 'nonce mismatch' };\n        return Response.json(json, { status: 400 });\n      }\n      await this.kv.removeItem(this.getOauth2NonceKey(nonce));\n      mark('check_nonce');\n    }\n\n    const principal = await onAuthorized(request, registrationId, userInfo, token);\n    mark('save_principal');\n\n    const session = this.repository.createSession();\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    const response = new Response(JSON.stringify(principal), {\n      status: 200,\n      headers: { 'Content-Type': 'application/json' },\n    });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  loginOAuth2Onetap = async (\n    request: Request,\n    onAuthorized: OAuth2AuthorizedHandler\n  ): Promise<Response> => {\n    const { mark, setTiming } = timing({ enabled: this.timing });\n    // should support application/x-www-form-urlencoded and application/json\n    let body: Record<string, string>;\n    if (request.headers.get('Content-Type') === 'application/x-www-form-urlencoded') {\n      const text = await request.text();\n      body = Object.fromEntries(new URLSearchParams(text));\n    } else if (request.headers.get('Content-Type') === 'application/json') {\n      body = (await request.json()) as Record<string, string>;\n    } else {\n      const json = { error: 'invalid_request', error_description: 'invalid content type' };\n      return Response.json(json, { status: 400 });\n    }\n\n    const csrf_cookie = getCookie(request, 'g_csrf_token');\n    if (csrf_cookie) {\n      const csrf_request = body['g_csrf_token'];\n      if (!csrf_request || csrf_cookie !== csrf_request) {\n        const json = { error: 'invalid_request', error_description: 'invalid csrf token' };\n        return Response.json(json, { status: 400 });\n      }\n    }\n    const { token, userInfo } = await google.getTokenInfo(body['credential']);\n    const principal = await onAuthorized(request, 'google', userInfo, token);\n    mark('save_principal');\n\n    const session = this.repository.createSession();\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    const response = new Response(JSON.stringify(principal), {\n      status: 200,\n      headers: { 'Content-Type': 'application/json' },\n    });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  kick = async (principal: Principal): Promise<void> => {\n    const sessions = await this.repository.findByPrincipalName(principal.name);\n    for (const sessionId of sessions.keys()) {\n      await this.repository.deleteById(sessionId);\n    }\n  };\n\n  isAuthenticated = async (request: Request): Promise<boolean> => {\n    const sessionId = getCookie(request, this.cookieName);\n    if (!sessionId) return false;\n    const session = await this.repository.findById(sessionId);\n    if (!session) return false;\n    const principalName = session.getAttribute(PRINCIPAL_NAME_INDEX_NAME);\n    if (!principalName) return false;\n    return true;\n  };\n\n  getSession = async <T extends boolean>(\n    request: Request,\n    create: T\n  ): Promise<T extends true ? Session : Session | null> => {\n    const sessionId = getCookie(request, this.cookieName);\n    if (!sessionId) {\n      if (create) {\n        const session = this.repository.createSession();\n        await this.repository.save(session);\n        return session;\n      } else {\n        return null as T extends true ? Session : Session | null;\n      }\n    }\n    const session = await this.repository.findById(sessionId);\n    if (!session) {\n      if (create) {\n        const session = this.repository.createSession();\n        await this.repository.save(session);\n        return session;\n      } else {\n        return null as T extends true ? Session : Session | null;\n      }\n    }\n    return session;\n  };\n\n  deleteSession = async (sessionId: string): Promise<void> => {\n    await this.repository.deleteById(sessionId);\n  };\n\n  getPrincipal = async (request: Request): Promise<Principal | null> => {\n    const sessionId = getCookie(request, this.cookieName);\n    if (!sessionId) return null;\n    const session = await this.repository.findById(sessionId);\n    if (!session) return null;\n    const name = session.getAttribute(PRINCIPAL_NAME_INDEX_NAME);\n    if (!name) return null;\n    return { name: String(name) };\n  };\n\n  listSessions = async (principal: Principal): Promise<Session[]> => {\n    const sessions = await this.repository.findByPrincipalName(principal.name);\n    return Array.from(sessions.values());\n  };\n\n  cleanupExpiredSessions = async (cleanupCount?: number): Promise<Response> => {\n    await this.repository.cleanupExpiredSessions(cleanupCount);\n    return Response.json({});\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAAuC;AACvC,4BAAsB;AACtB,oBAA0C;AAC1C,kBAAiE;AACjE,oBAAwD;AAExD,oBAAuB;AACvB,sBAAuB;AAOhB,IAAM,OAAN,MAAkC;AAAA,EACtB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA,oCAAoC;AAAA,EAErC,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,cAAc;AAAA,EAEd,oBAAoB;AAAA,EACpB,oBAAoB;AAAA,EACpB,4BAA4B;AAAA,EAC5B,yBAAyB;AAAA,EACzB,2BAA2B;AAAA,EAC3B,2BAA2B;AAAA,EAE3B,gCAAgC;AAAA,EAEhD,YAAY,EAAE,mBAAmB,cAAc,QAAQ,QAAQ,QAAAA,QAAO,GAAe;AACnF,SAAK,SAASA,WAAU;AACxB,SAAK,KAAK;AACV,SAAK,aAAa;AAClB,UAAM,EAAE,MAAM,GAAG,cAAc,IAAI,UAAU,CAAC;AAC9C,SAAK,aAAa,QAAQ;AAC1B,SAAK,gBAAgB;AAAA,MACnB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,GAAG;AAAA,IACL;AACA,SAAK,eAAe,QAAQ,SAAS,IAAI,2BAAa,OAAO,MAAM,IAAI;AAAA,EACzE;AAAA,EAEA,SAAS,OAAO,YAAwC;AACtD,UAAM,gBAAY,uBAAU,SAAS,KAAK,UAAU;AACpD,QAAI,UAAW,OAAM,KAAK,WAAW,WAAW,SAAS;AACzD,UAAM,WAAW,SAAS,KAAK,CAAC,CAAC;AACjC,kCAAa,UAAU,KAAK,UAAU;AACtC,WAAO;AAAA,EACT;AAAA,EAEA,SAAS,OAAO,SAAkB,aAAgD;AAEhF,UAAM,gBAAY,uBAAU,SAAS,KAAK,UAAU;AACpD,QAAI,CAAC,UAAW,QAAO,SAAS,KAAK,EAAE,MAAM,MAAM,CAAC;AACpD,UAAM,UAAU,MAAM,KAAK,WAAW,SAAS,SAAS;AACxD,QAAI,CAAC,QAAS,QAAO,SAAS,KAAK,EAAE,MAAM,MAAM,CAAC;AAGlD,UAAM,OAAO,QAAQ,aAAa,uCAAyB;AAC3D,YAAQ,oBAAoB,KAAK,IAAI,CAAC;AACtC,UAAM,KAAK,WAAW,KAAK,OAAO;AAGlC,QAAI,SAAS,KAAM,OAAM,WAAW,EAAE,MAAM,OAAO,IAAI,EAAE,CAAC;AAG1D,UAAM,WAAW,SAAS,KAAK,EAAE,MAAM,SAAS,KAAK,CAAC;AACtD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,+BAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,WAAO;AAAA,EACT;AAAA,EAEQ,uBAAuC;AAC7C,UAAM,oBAAgB,0BAAW;AACjC,UAAM,qBAAiB,0BAAW,QAAQ,EACvC,OAAO,aAAa,EACpB,OAAO,EACP,SAAS,WAAW;AAEvB,WAAO,EAAE,eAAe,gBAAgB,uBAAuB,OAAO;AAAA,EACxE;AAAA,EAEQ,kBAAkB,OAAe;AACvC,WAAO,gBAAgB,KAAK;AAAA,EAC9B;AAAA,EAEQ,kBAAkB,OAAe;AACvC,WAAO,gBAAgB,KAAK;AAAA,EAC9B;AAAA,EAEA,cAAc,OAAO,YAAwC;AAC3D,UAAM,EAAE,eAAe,QAAI,mBAAM,SAAS,KAAK,iBAAiB;AAChE,UAAM,YAAQ,0BAAW;AACzB,UAAM,KAAK,GAAG,QAAQ,KAAK,kBAAkB,KAAK,GAAG,gBAAgB,KAAK,EAAE;AAC5E,WAAO,SAAS,KAAK,EAAE,MAAM,CAAC;AAAA,EAChC;AAAA,EAEA,cAAc,OAAO,YAAwC;AAC3D,UAAM,EAAE,eAAe,QAAI,mBAAM,SAAS,KAAK,iBAAiB;AAChE,UAAM,YAAQ,0BAAW;AACzB,UAAM,KAAK,GAAG,QAAQ,KAAK,kBAAkB,KAAK,GAAG,gBAAgB,KAAK,EAAE;AAC5E,WAAO,SAAS,KAAK,EAAE,MAAM,CAAC;AAAA,EAChC;AAAA,EAEA,sBAAsB,OAAO,YAAwC;AACnE,8BAAAC,SAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,QAAI,sBAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAC3D,UAAM,EAAE,eAAe,QAAI,mBAAM,SAAS,KAAK,yBAAyB;AACxE,UAAM,YAAQ,0BAAW;AACzB,UAAM,OAAO,KAAK,qBAAqB;AACvC,UAAM,MAAM,KAAK,aAAa,uBAAuB,EAAE,gBAAgB,OAAO,KAAK,CAAC;AACpF,UAAM,gBAAY,uBAAU,SAAS,KAAK,UAAU;AACpD,UAAM,UAAU,YACV,MAAM,KAAK,WAAW,SAAS,SAAS,KAAM,KAAK,WAAW,cAAc,IAC9E,KAAK,WAAW,cAAc;AAClC,SAAK,eAAe;AAEpB,UAAM,uBAAmD;AAAA,MACvD;AAAA,MACA;AAAA,MACA,yBAAyB,IAAI;AAAA,MAC7B,sBAAsB;AAAA,IACxB;AAEA,UAAM,QAAQ,KAAK,UAAU,oBAAoB;AACjD,YAAQ,aAAa,KAAK,mCAAmC,KAAK;AAClE,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,SAAK,cAAc;AAEnB,UAAM,WAAW,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,UAAU,IAAI,KAAK,EAAE,CAAC;AACpF,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,+BAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEQ,WAAW,CAAC,OAAwB,gBAAmC;AAC7E,8BAAAA,SAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,MAAM,IAAI,IAAI,KAAK,aAAa,QAAQ;AAC9C,QAAI,aAAa,IAAI,SAAS,KAAK;AACnC,QAAI,YAAa,KAAI,aAAa,IAAI,qBAAqB,WAAW;AACtE,WAAO,SAAS,SAAS,IAAI,MAAM,GAAG;AAAA,EACxC;AAAA,EAEA,kBAAkB,OAChB,SACA,iBACsB;AACtB,8BAAAA,SAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,QAAI,sBAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAG3D,UAAM,gBAAY,uBAAU,SAAS,KAAK,UAAU;AACpD,UAAM,UAAU,YAAY,MAAM,KAAK,WAAW,SAAS,SAAS,IAAI;AACxE,QAAI,CAAC,SAAS;AACZ,aAAO,KAAK,SAAS,mBAAmB,mBAAmB;AAAA,IAC7D;AACA,SAAK,cAAc;AAGnB,UAAM,OAAO,QAAQ,aAAa,KAAK,iCAAiC;AACxE,QAAI,CAAC,MAAM;AACT,aAAO,KAAK,SAAS,mBAAmB,kCAAkC;AAAA,IAC5E;AACA,UAAM,SAAqC,KAAK,MAAM,IAAI;AAG1D,UAAM,EAAE,eAAe,QAAI,mBAAM,SAAS,KAAK,sBAAsB;AACrE,QAAI;AAEJ,QACE,QAAQ,WAAW,UACnB,QAAQ,QAAQ,IAAI,cAAc,GAAG,YAAY,MAAM,qCACvD;AACA,YAAM,SAAS,IAAI,gBAAgB,MAAM,QAAQ,KAAK,CAAC;AACvD,aAAO,OAAO,YAAY,OAAO,QAAQ,CAAC;AAAA,IAC5C,OAAO;AACL,iBAAO,mBAAM,OAAO;AAAA,IACtB;AAEA,UAAM,SAAS,wCAA0B,UAAU,IAAI;AACvD,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,KAAK,SAAS,mBAAmB,wBAAwB;AAAA,IAClE;AACA,QAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,KAAK,OAAO;AAC3C,aAAO,KAAK,SAAS,mBAAmB,wBAAwB;AAAA,IAClE;AACA,QAAI,OAAO,KAAK,UAAU,OAAO,OAAO;AACtC,aAAO,KAAK,SAAS,mBAAmB,yBAAyB;AAAA,IACnE;AACA,QAAI,mBAAmB,OAAO,gBAAgB;AAC5C,aAAO,KAAK,SAAS,mBAAmB,gCAAgC;AAAA,IAC1E;AACA,SAAK,kBAAkB;AAGvB,UAAM,EAAE,KAAK,IAAI,OAAO;AAExB,UAAM,QAAQ,MAAM,KAAK,aAAa,0BAA0B;AAAA,MAC9D;AAAA,MACA;AAAA,MACA,MAAM,OAAO;AAAA,IACf,CAAC;AACD,UAAM,WAAW,MAAM,KAAK,aAAa,YAAY,EAAE,gBAAgB,MAAM,CAAC;AAC9E,SAAK,eAAe;AAGpB,UAAM,YAAY,MAAM,aAAa,SAAS,gBAAgB,UAAU,KAAK;AAC7E,SAAK,gBAAgB;AAGrB,YAAQ,oBAAoB,KAAK,IAAI,CAAC;AACtC,YAAQ,gBAAgB,KAAK,iCAAiC;AAC9D,YAAQ,aAAa,yCAA2B,UAAU,IAAI;AAC9D,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,SAAK,gBAAgB;AAErB,UAAM,WAAW,IAAI,SAAS,MAAM;AAAA,MAClC,QAAQ;AAAA,MACR,SAAS,EAAE,UAAU,KAAK,aAAa,WAAW;AAAA,IACpD,CAAC;AACD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,+BAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEA,oBAAoB,OAClB,SACA,iBACsB;AACtB,8BAAAA,SAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,QAAI,sBAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAC3D,UAAM,EAAE,eAAe,QAAI,mBAAM,SAAS,KAAK,wBAAwB;AACvE,UAAM,cAAe,MAAM,QAAQ,KAAK;AACxC,UAAM,EAAE,UAAU,MAAM,IAAI,MAAM,KAAK,aAAa,kBAAkB;AAAA,MACpE;AAAA,MACA;AAAA,IACF,CAAC;AACD,SAAK,qBAAqB;AAE1B,UAAM,EAAE,MAAM,IAAI,SAAS;AAC3B,QAAI,OAAO;AACT,YAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,KAAK,kBAAkB,KAAK,CAAC;AACjE,UAAI,UAAU,gBAAgB;AAC5B,cAAM,OAAO,EAAE,OAAO,mBAAmB,mBAAmB,iBAAiB;AAC7E,eAAO,SAAS,KAAK,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC5C;AACA,YAAM,KAAK,GAAG,WAAW,KAAK,kBAAkB,KAAK,CAAC;AACtD,WAAK,aAAa;AAAA,IACpB;AAEA,UAAM,YAAY,MAAM,aAAa,SAAS,gBAAgB,UAAU,KAAK;AAC7E,SAAK,gBAAgB;AAErB,UAAM,UAAU,KAAK,WAAW,cAAc;AAC9C,YAAQ,aAAa,yCAA2B,UAAU,IAAI;AAC9D,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,UAAM,WAAW,IAAI,SAAS,KAAK,UAAU,SAAS,GAAG;AAAA,MACvD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAChD,CAAC;AACD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,+BAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEA,oBAAoB,OAClB,SACA,iBACsB;AACtB,UAAM,EAAE,MAAM,UAAU,QAAI,sBAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAE3D,QAAI;AACJ,QAAI,QAAQ,QAAQ,IAAI,cAAc,MAAM,qCAAqC;AAC/E,YAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,aAAO,OAAO,YAAY,IAAI,gBAAgB,IAAI,CAAC;AAAA,IACrD,WAAW,QAAQ,QAAQ,IAAI,cAAc,MAAM,oBAAoB;AACrE,aAAQ,MAAM,QAAQ,KAAK;AAAA,IAC7B,OAAO;AACL,YAAM,OAAO,EAAE,OAAO,mBAAmB,mBAAmB,uBAAuB;AACnF,aAAO,SAAS,KAAK,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC5C;AAEA,UAAM,kBAAc,uBAAU,SAAS,cAAc;AACrD,QAAI,aAAa;AACf,YAAM,eAAe,KAAK,cAAc;AACxC,UAAI,CAAC,gBAAgB,gBAAgB,cAAc;AACjD,cAAM,OAAO,EAAE,OAAO,mBAAmB,mBAAmB,qBAAqB;AACjF,eAAO,SAAS,KAAK,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC5C;AAAA,IACF;AACA,UAAM,EAAE,OAAO,SAAS,IAAI,MAAM,uBAAO,aAAa,KAAK,YAAY,CAAC;AACxE,UAAM,YAAY,MAAM,aAAa,SAAS,UAAU,UAAU,KAAK;AACvE,SAAK,gBAAgB;AAErB,UAAM,UAAU,KAAK,WAAW,cAAc;AAC9C,YAAQ,aAAa,yCAA2B,UAAU,IAAI;AAC9D,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,UAAM,WAAW,IAAI,SAAS,KAAK,UAAU,SAAS,GAAG;AAAA,MACvD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAChD,CAAC;AACD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,+BAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEA,OAAO,OAAO,cAAwC;AACpD,UAAM,WAAW,MAAM,KAAK,WAAW,oBAAoB,UAAU,IAAI;AACzE,eAAW,aAAa,SAAS,KAAK,GAAG;AACvC,YAAM,KAAK,WAAW,WAAW,SAAS;AAAA,IAC5C;AAAA,EACF;AAAA,EAEA,kBAAkB,OAAO,YAAuC;AAC9D,UAAM,gBAAY,uBAAU,SAAS,KAAK,UAAU;AACpD,QAAI,CAAC,UAAW,QAAO;AACvB,UAAM,UAAU,MAAM,KAAK,WAAW,SAAS,SAAS;AACxD,QAAI,CAAC,QAAS,QAAO;AACrB,UAAM,gBAAgB,QAAQ,aAAa,uCAAyB;AACpE,QAAI,CAAC,cAAe,QAAO;AAC3B,WAAO;AAAA,EACT;AAAA,EAEA,aAAa,OACX,SACA,WACuD;AACvD,UAAM,gBAAY,uBAAU,SAAS,KAAK,UAAU;AACpD,QAAI,CAAC,WAAW;AACd,UAAI,QAAQ;AACV,cAAMC,WAAU,KAAK,WAAW,cAAc;AAC9C,cAAM,KAAK,WAAW,KAAKA,QAAO;AAClC,eAAOA;AAAA,MACT,OAAO;AACL,eAAO;AAAA,MACT;AAAA,IACF;AACA,UAAM,UAAU,MAAM,KAAK,WAAW,SAAS,SAAS;AACxD,QAAI,CAAC,SAAS;AACZ,UAAI,QAAQ;AACV,cAAMA,WAAU,KAAK,WAAW,cAAc;AAC9C,cAAM,KAAK,WAAW,KAAKA,QAAO;AAClC,eAAOA;AAAA,MACT,OAAO;AACL,eAAO;AAAA,MACT;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,gBAAgB,OAAO,cAAqC;AAC1D,UAAM,KAAK,WAAW,WAAW,SAAS;AAAA,EAC5C;AAAA,EAEA,eAAe,OAAO,YAAgD;AACpE,UAAM,gBAAY,uBAAU,SAAS,KAAK,UAAU;AACpD,QAAI,CAAC,UAAW,QAAO;AACvB,UAAM,UAAU,MAAM,KAAK,WAAW,SAAS,SAAS;AACxD,QAAI,CAAC,QAAS,QAAO;AACrB,UAAM,OAAO,QAAQ,aAAa,uCAAyB;AAC3D,QAAI,CAAC,KAAM,QAAO;AAClB,WAAO,EAAE,MAAM,OAAO,IAAI,EAAE;AAAA,EAC9B;AAAA,EAEA,eAAe,OAAO,cAA6C;AACjE,UAAM,WAAW,MAAM,KAAK,WAAW,oBAAoB,UAAU,IAAI;AACzE,WAAO,MAAM,KAAK,SAAS,OAAO,CAAC;AAAA,EACrC;AAAA,EAEA,yBAAyB,OAAO,iBAA6C;AAC3E,UAAM,KAAK,WAAW,uBAAuB,YAAY;AACzD,WAAO,SAAS,KAAK,CAAC,CAAC;AAAA,EACzB;AACF;","names":["timing","invariant","session"]}

package/dist/auth/index.d.cts

@@ -41,6 +41,7 @@ declare class Auth implements AuthService {
     getSession: <T extends boolean>(request: Request, create: T) => Promise<T extends true ? Session : Session | null>;
     deleteSession: (sessionId: string) => Promise<void>;
     getPrincipal: (request: Request) => Promise<Principal | null>;
+    listSessions: (principal: Principal) => Promise<Session[]>;
     cleanupExpiredSessions: (cleanupCount?: number) => Promise<Response>;
 }
 

package/dist/auth/index.d.ts

@@ -41,6 +41,7 @@ declare class Auth implements AuthService {
     getSession: <T extends boolean>(request: Request, create: T) => Promise<T extends true ? Session : Session | null>;
     deleteSession: (sessionId: string) => Promise<void>;
     getPrincipal: (request: Request) => Promise<Principal | null>;
+    listSessions: (principal: Principal) => Promise<Session[]>;
     cleanupExpiredSessions: (cleanupCount?: number) => Promise<Response>;
 }
 

package/dist/auth/index.mjs

@@ -295,6 +295,10 @@ var Auth = class {
     if (!name) return null;
     return { name: String(name) };
   };
+  listSessions = async (principal) => {
+    const sessions = await this.repository.findByPrincipalName(principal.name);
+    return Array.from(sessions.values());
+  };
   cleanupExpiredSessions = async (cleanupCount) => {
     await this.repository.cleanupExpiredSessions(cleanupCount);
     return Response.json({});

package/dist/auth/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/index.ts"],"sourcesContent":["import { createHash, randomUUID } from 'crypto';\nimport invariant from 'tiny-invariant';\nimport { PRINCIPAL_NAME_INDEX_NAME } from '../session/common';\nimport { param, query, getCookie, setCookie, deleteCookie } from '../utils/http';\nimport { OAuth2Client, oauth2RedirectQuerySchema } from '../oauth2/client';\nimport { OAuth2ErrorType } from '../oauth2/error';\nimport { timing } from '../utils/timing';\nimport { google } from '../oauth2/provider/index';\nimport type { CookieOptions } from '../utils/http';\nimport type { KVRepository, Session, SessionRepository } from '../session/types';\nimport type { NativeCredential, OAuth2AuthorizationRequest, PkceParameters } from '../oauth2/types';\nimport type { AuthConfig, AuthService, LoggedHandler, OAuth2AuthorizedHandler } from './types';\nimport type { Principal } from '../core';\n\nexport class Auth implements AuthService {\n  private readonly timing: boolean;\n  private readonly cookieName;\n  private readonly cookieOptions: CookieOptions;\n  private readonly kv: KVRepository;\n  private readonly repository: SessionRepository;\n\n  private readonly oauth2Client: OAuth2Client | null;\n  private readonly ATTR_OAUTH2_AUTHORIZATION_REQUEST = 'oauth2AuthorizationRequest';\n\n  public readonly PATH_CSRF = '/csrf' as const;\n  public readonly PATH_LOGOUT = '/logout' as const;\n  public readonly PATH_LOGGED = '/logged' as const;\n\n  public readonly PATH_OAUTH2_STATE = '/oauth2/state/:registrationId' as const;\n  public readonly PATH_OAUTH2_NONCE = '/oauth2/nonce/:registrationId' as const;\n  public readonly PATH_OAUTH2_AUTHORIZATION = '/oauth2/authorization/:registrationId' as const;\n  public readonly PATH_LOGIN_OAUTH2_CODE = '/login/oauth2/code/:registrationId' as const;\n  public readonly PATH_LOGIN_OAUTH2_NATIVE = '/login/oauth2/native/:registrationId' as const;\n  public readonly PATH_LOGIN_OAUTH2_ONETAP = '/login/oauth2/onetap/google' as const;\n\n  public readonly PATH_CLEANUP_EXPIRED_SESSIONS = '/sessions/expired/cleanup' as const;\n\n  constructor({ sessionRepository, kvRepository, oauth2, cookie, timing }: AuthConfig) {\n    this.timing = timing ?? false;\n    this.kv = kvRepository;\n    this.repository = sessionRepository;\n    const { name, ...cookieOptions } = cookie ?? {};\n    this.cookieName = name ?? 'SESSION';\n    this.cookieOptions = {\n      path: '/',\n      sameSite: 'none',\n      secure: true,\n      httpOnly: true,\n      ...cookieOptions,\n    };\n    this.oauth2Client = oauth2?.client ? new OAuth2Client(oauth2.client) : null;\n  }\n\n  logout = async (request: Request): Promise<Response> => {\n    const sessionId = getCookie(request, this.cookieName);\n    if (sessionId) await this.repository.deleteById(sessionId);\n    const response = Response.json({});\n    deleteCookie(response, this.cookieName);\n    return response;\n  };\n\n  logged = async (request: Request, onLogged?: LoggedHandler): Promise<Response> => {\n    // 1. get session from cookie\n    const sessionId = getCookie(request, this.cookieName);\n    if (!sessionId) return Response.json({ data: false });\n    const session = await this.repository.findById(sessionId);\n    if (!session) return Response.json({ data: false });\n\n    // 2. get principal name from session\n    const name = session.getAttribute(PRINCIPAL_NAME_INDEX_NAME);\n    session.setLastAccessedTime(Date.now());\n    await this.repository.save(session);\n\n    // 3. call onLogged\n    if (name !== null) await onLogged?.({ name: String(name) });\n\n    // 4. renew cookie\n    const response = Response.json({ data: name !== null });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    return response;\n  };\n\n  private createPkceParameters(): PkceParameters {\n    const code_verifier = randomUUID();\n    const code_challenge = createHash('sha256')\n      .update(code_verifier)\n      .digest()\n      .toString('base64url');\n\n    return { code_verifier, code_challenge, code_challenge_method: 'S256' };\n  }\n\n  private getOauth2StateKey(state: string) {\n    return `oauth2:state:${state}`;\n  }\n\n  private getOauth2NonceKey(nonce: string) {\n    return `oauth2:nonce:${nonce}`;\n  }\n\n  oauth2State = async (request: Request): Promise<Response> => {\n    const { registrationId } = param(request, this.PATH_OAUTH2_STATE);\n    const state = randomUUID();\n    await this.kv.setItem(this.getOauth2StateKey(state), registrationId, 10 * 60);\n    return Response.json({ state });\n  };\n\n  oauth2Nonce = async (request: Request): Promise<Response> => {\n    const { registrationId } = param(request, this.PATH_OAUTH2_NONCE);\n    const nonce = randomUUID();\n    await this.kv.setItem(this.getOauth2NonceKey(nonce), registrationId, 10 * 60);\n    return Response.json({ nonce });\n  };\n\n  oauth2Authorization = async (request: Request): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n    const { registrationId } = param(request, this.PATH_OAUTH2_AUTHORIZATION);\n    const state = randomUUID();\n    const pkce = this.createPkceParameters();\n    const uri = this.oauth2Client.createAuthorizationUri({ registrationId, state, pkce });\n    const sessionId = getCookie(request, this.cookieName);\n    const session = sessionId\n      ? ((await this.repository.findById(sessionId)) ?? this.repository.createSession())\n      : this.repository.createSession();\n    mark('fetch_session');\n\n    const authorizationRequest: OAuth2AuthorizationRequest = {\n      state,\n      registrationId,\n      authorizationRequestUri: uri.href,\n      additionalParameters: pkce,\n    };\n\n    const value = JSON.stringify(authorizationRequest);\n    session.setAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST, value);\n    await this.repository.save(session);\n    mark('save_session');\n\n    const response = new Response(null, { status: 302, headers: { location: uri.href } });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  private redirect = (error: OAuth2ErrorType, description?: string): Response => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const uri = new URL(this.oauth2Client.errorUri);\n    uri.searchParams.set('error', error);\n    if (description) uri.searchParams.set('error_description', description);\n    return Response.redirect(uri.href, 302);\n  };\n\n  loginOAuth2Code = async (\n    request: Request,\n    onAuthorized: OAuth2AuthorizedHandler\n  ): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n\n    // 1. get session from cookie\n    const sessionId = getCookie(request, this.cookieName);\n    const session = sessionId ? await this.repository.findById(sessionId) : null;\n    if (!session) {\n      return this.redirect('invalid_request', 'session not found');\n    }\n    mark('load_session');\n\n    // 2. get cached authorization request from session\n    const json = session.getAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST) as string | null;\n    if (!json) {\n      return this.redirect('invalid_request', 'authorization request not  found');\n    }\n    const cached: OAuth2AuthorizationRequest = JSON.parse(json);\n\n    // 3. validate redirect query/formdata\n    const { registrationId } = param(request, this.PATH_LOGIN_OAUTH2_CODE);\n    let data: Record<string, string>;\n    // apple redirect: response_mode=form_post\n    if (\n      request.method === 'POST' &&\n      request.headers.get('content-type')?.toLowerCase() === 'application/x-www-form-urlencoded'\n    ) {\n      const params = new URLSearchParams(await request.text());\n      data = Object.fromEntries(params.entries());\n    } else {\n      data = query(request);\n    }\n\n    const parsed = oauth2RedirectQuerySchema.safeParse(data);\n    if (!parsed.success) {\n      return this.redirect('invalid_request', 'invalid redirect query');\n    }\n    if (!parsed.data.code || !parsed.data.state) {\n      return this.redirect('invalid_request', 'invalid redirect query');\n    }\n    if (parsed.data.state !== cached.state) {\n      return this.redirect('invalid_request', 'redirect state mismatch');\n    }\n    if (registrationId !== cached.registrationId) {\n      return this.redirect('invalid_request', 'redirect registration mismatch');\n    }\n    mark('validate_session');\n\n    // 4. exchange authorization code for token and get user info\n    const { code } = parsed.data;\n\n    const token = await this.oauth2Client.exchangeAuthorizationCode({\n      registrationId,\n      code,\n      pkce: cached.additionalParameters,\n    });\n    const userInfo = await this.oauth2Client.getUserInfo({ registrationId, token });\n    mark('exchange_code');\n\n    // 5. create or update principal\n    const principal = await onAuthorized(request, registrationId, userInfo, token);\n    mark('save_principal');\n\n    // 6. update session\n    session.setLastAccessedTime(Date.now());\n    session.removeAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST);\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    mark('update_session');\n\n    const response = new Response(null, {\n      status: 302,\n      headers: { location: this.oauth2Client.successUri },\n    });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  loginOAuth2Native = async (\n    request: Request,\n    onAuthorized: OAuth2AuthorizedHandler\n  ): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n    const { registrationId } = param(request, this.PATH_LOGIN_OAUTH2_NATIVE);\n    const credentials = (await request.json()) as NativeCredential;\n    const { userInfo, token } = await this.oauth2Client.loginOAuth2Native({\n      registrationId,\n      credentials,\n    });\n    mark('login_oauth2_native');\n\n    const { nonce } = userInfo.data as { nonce?: string };\n    if (nonce) {\n      const value = await this.kv.getItem(this.getOauth2NonceKey(nonce));\n      if (value !== registrationId) {\n        const json = { error: 'invalid_request', error_description: 'nonce mismatch' };\n        return Response.json(json, { status: 400 });\n      }\n      await this.kv.removeItem(this.getOauth2NonceKey(nonce));\n      mark('check_nonce');\n    }\n\n    const principal = await onAuthorized(request, registrationId, userInfo, token);\n    mark('save_principal');\n\n    const session = this.repository.createSession();\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    const response = new Response(JSON.stringify(principal), {\n      status: 200,\n      headers: { 'Content-Type': 'application/json' },\n    });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  loginOAuth2Onetap = async (\n    request: Request,\n    onAuthorized: OAuth2AuthorizedHandler\n  ): Promise<Response> => {\n    const { mark, setTiming } = timing({ enabled: this.timing });\n    // should support application/x-www-form-urlencoded and application/json\n    let body: Record<string, string>;\n    if (request.headers.get('Content-Type') === 'application/x-www-form-urlencoded') {\n      const text = await request.text();\n      body = Object.fromEntries(new URLSearchParams(text));\n    } else if (request.headers.get('Content-Type') === 'application/json') {\n      body = (await request.json()) as Record<string, string>;\n    } else {\n      const json = { error: 'invalid_request', error_description: 'invalid content type' };\n      return Response.json(json, { status: 400 });\n    }\n\n    const csrf_cookie = getCookie(request, 'g_csrf_token');\n    if (csrf_cookie) {\n      const csrf_request = body['g_csrf_token'];\n      if (!csrf_request || csrf_cookie !== csrf_request) {\n        const json = { error: 'invalid_request', error_description: 'invalid csrf token' };\n        return Response.json(json, { status: 400 });\n      }\n    }\n    const { token, userInfo } = await google.getTokenInfo(body['credential']);\n    const principal = await onAuthorized(request, 'google', userInfo, token);\n    mark('save_principal');\n\n    const session = this.repository.createSession();\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    const response = new Response(JSON.stringify(principal), {\n      status: 200,\n      headers: { 'Content-Type': 'application/json' },\n    });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  kick = async (principal: Principal): Promise<void> => {\n    const sessions = await this.repository.findByPrincipalName(principal.name);\n    for (const sessionId of sessions.keys()) {\n      await this.repository.deleteById(sessionId);\n    }\n  };\n\n  isAuthenticated = async (request: Request): Promise<boolean> => {\n    const sessionId = getCookie(request, this.cookieName);\n    if (!sessionId) return false;\n    const session = await this.repository.findById(sessionId);\n    if (!session) return false;\n    const principalName = session.getAttribute(PRINCIPAL_NAME_INDEX_NAME);\n    if (!principalName) return false;\n    return true;\n  };\n\n  getSession = async <T extends boolean>(\n    request: Request,\n    create: T\n  ): Promise<T extends true ? Session : Session | null> => {\n    const sessionId = getCookie(request, this.cookieName);\n    if (!sessionId) {\n      if (create) {\n        const session = this.repository.createSession();\n        await this.repository.save(session);\n        return session;\n      } else {\n        return null as T extends true ? Session : Session | null;\n      }\n    }\n    const session = await this.repository.findById(sessionId);\n    if (!session) {\n      if (create) {\n        const session = this.repository.createSession();\n        await this.repository.save(session);\n        return session;\n      } else {\n        return null as T extends true ? Session : Session | null;\n      }\n    }\n    return session;\n  };\n\n  deleteSession = async (sessionId: string): Promise<void> => {\n    await this.repository.deleteById(sessionId);\n  };\n\n  getPrincipal = async (request: Request): Promise<Principal | null> => {\n    const sessionId = getCookie(request, this.cookieName);\n    if (!sessionId) return null;\n    const session = await this.repository.findById(sessionId);\n    if (!session) return null;\n    const name = session.getAttribute(PRINCIPAL_NAME_INDEX_NAME);\n    if (!name) return null;\n    return { name: String(name) };\n  };\n\n  cleanupExpiredSessions = async (cleanupCount?: number): Promise<Response> => {\n    await this.repository.cleanupExpiredSessions(cleanupCount);\n    return Response.json({});\n  };\n}\n"],"mappings":";AAAA,SAAS,YAAY,kBAAkB;AACvC,OAAO,eAAe;AACtB,SAAS,iCAAiC;AAC1C,SAAS,OAAO,OAAO,WAAW,WAAW,oBAAoB;AACjE,SAAS,cAAc,iCAAiC;AAExD,SAAS,cAAc;AACvB,SAAS,cAAc;AAOhB,IAAM,OAAN,MAAkC;AAAA,EACtB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA,oCAAoC;AAAA,EAErC,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,cAAc;AAAA,EAEd,oBAAoB;AAAA,EACpB,oBAAoB;AAAA,EACpB,4BAA4B;AAAA,EAC5B,yBAAyB;AAAA,EACzB,2BAA2B;AAAA,EAC3B,2BAA2B;AAAA,EAE3B,gCAAgC;AAAA,EAEhD,YAAY,EAAE,mBAAmB,cAAc,QAAQ,QAAQ,QAAAA,QAAO,GAAe;AACnF,SAAK,SAASA,WAAU;AACxB,SAAK,KAAK;AACV,SAAK,aAAa;AAClB,UAAM,EAAE,MAAM,GAAG,cAAc,IAAI,UAAU,CAAC;AAC9C,SAAK,aAAa,QAAQ;AAC1B,SAAK,gBAAgB;AAAA,MACnB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,GAAG;AAAA,IACL;AACA,SAAK,eAAe,QAAQ,SAAS,IAAI,aAAa,OAAO,MAAM,IAAI;AAAA,EACzE;AAAA,EAEA,SAAS,OAAO,YAAwC;AACtD,UAAM,YAAY,UAAU,SAAS,KAAK,UAAU;AACpD,QAAI,UAAW,OAAM,KAAK,WAAW,WAAW,SAAS;AACzD,UAAM,WAAW,SAAS,KAAK,CAAC,CAAC;AACjC,iBAAa,UAAU,KAAK,UAAU;AACtC,WAAO;AAAA,EACT;AAAA,EAEA,SAAS,OAAO,SAAkB,aAAgD;AAEhF,UAAM,YAAY,UAAU,SAAS,KAAK,UAAU;AACpD,QAAI,CAAC,UAAW,QAAO,SAAS,KAAK,EAAE,MAAM,MAAM,CAAC;AACpD,UAAM,UAAU,MAAM,KAAK,WAAW,SAAS,SAAS;AACxD,QAAI,CAAC,QAAS,QAAO,SAAS,KAAK,EAAE,MAAM,MAAM,CAAC;AAGlD,UAAM,OAAO,QAAQ,aAAa,yBAAyB;AAC3D,YAAQ,oBAAoB,KAAK,IAAI,CAAC;AACtC,UAAM,KAAK,WAAW,KAAK,OAAO;AAGlC,QAAI,SAAS,KAAM,OAAM,WAAW,EAAE,MAAM,OAAO,IAAI,EAAE,CAAC;AAG1D,UAAM,WAAW,SAAS,KAAK,EAAE,MAAM,SAAS,KAAK,CAAC;AACtD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,cAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,WAAO;AAAA,EACT;AAAA,EAEQ,uBAAuC;AAC7C,UAAM,gBAAgB,WAAW;AACjC,UAAM,iBAAiB,WAAW,QAAQ,EACvC,OAAO,aAAa,EACpB,OAAO,EACP,SAAS,WAAW;AAEvB,WAAO,EAAE,eAAe,gBAAgB,uBAAuB,OAAO;AAAA,EACxE;AAAA,EAEQ,kBAAkB,OAAe;AACvC,WAAO,gBAAgB,KAAK;AAAA,EAC9B;AAAA,EAEQ,kBAAkB,OAAe;AACvC,WAAO,gBAAgB,KAAK;AAAA,EAC9B;AAAA,EAEA,cAAc,OAAO,YAAwC;AAC3D,UAAM,EAAE,eAAe,IAAI,MAAM,SAAS,KAAK,iBAAiB;AAChE,UAAM,QAAQ,WAAW;AACzB,UAAM,KAAK,GAAG,QAAQ,KAAK,kBAAkB,KAAK,GAAG,gBAAgB,KAAK,EAAE;AAC5E,WAAO,SAAS,KAAK,EAAE,MAAM,CAAC;AAAA,EAChC;AAAA,EAEA,cAAc,OAAO,YAAwC;AAC3D,UAAM,EAAE,eAAe,IAAI,MAAM,SAAS,KAAK,iBAAiB;AAChE,UAAM,QAAQ,WAAW;AACzB,UAAM,KAAK,GAAG,QAAQ,KAAK,kBAAkB,KAAK,GAAG,gBAAgB,KAAK,EAAE;AAC5E,WAAO,SAAS,KAAK,EAAE,MAAM,CAAC;AAAA,EAChC;AAAA,EAEA,sBAAsB,OAAO,YAAwC;AACnE,cAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,IAAI,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAC3D,UAAM,EAAE,eAAe,IAAI,MAAM,SAAS,KAAK,yBAAyB;AACxE,UAAM,QAAQ,WAAW;AACzB,UAAM,OAAO,KAAK,qBAAqB;AACvC,UAAM,MAAM,KAAK,aAAa,uBAAuB,EAAE,gBAAgB,OAAO,KAAK,CAAC;AACpF,UAAM,YAAY,UAAU,SAAS,KAAK,UAAU;AACpD,UAAM,UAAU,YACV,MAAM,KAAK,WAAW,SAAS,SAAS,KAAM,KAAK,WAAW,cAAc,IAC9E,KAAK,WAAW,cAAc;AAClC,SAAK,eAAe;AAEpB,UAAM,uBAAmD;AAAA,MACvD;AAAA,MACA;AAAA,MACA,yBAAyB,IAAI;AAAA,MAC7B,sBAAsB;AAAA,IACxB;AAEA,UAAM,QAAQ,KAAK,UAAU,oBAAoB;AACjD,YAAQ,aAAa,KAAK,mCAAmC,KAAK;AAClE,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,SAAK,cAAc;AAEnB,UAAM,WAAW,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,UAAU,IAAI,KAAK,EAAE,CAAC;AACpF,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,cAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEQ,WAAW,CAAC,OAAwB,gBAAmC;AAC7E,cAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,MAAM,IAAI,IAAI,KAAK,aAAa,QAAQ;AAC9C,QAAI,aAAa,IAAI,SAAS,KAAK;AACnC,QAAI,YAAa,KAAI,aAAa,IAAI,qBAAqB,WAAW;AACtE,WAAO,SAAS,SAAS,IAAI,MAAM,GAAG;AAAA,EACxC;AAAA,EAEA,kBAAkB,OAChB,SACA,iBACsB;AACtB,cAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,IAAI,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAG3D,UAAM,YAAY,UAAU,SAAS,KAAK,UAAU;AACpD,UAAM,UAAU,YAAY,MAAM,KAAK,WAAW,SAAS,SAAS,IAAI;AACxE,QAAI,CAAC,SAAS;AACZ,aAAO,KAAK,SAAS,mBAAmB,mBAAmB;AAAA,IAC7D;AACA,SAAK,cAAc;AAGnB,UAAM,OAAO,QAAQ,aAAa,KAAK,iCAAiC;AACxE,QAAI,CAAC,MAAM;AACT,aAAO,KAAK,SAAS,mBAAmB,kCAAkC;AAAA,IAC5E;AACA,UAAM,SAAqC,KAAK,MAAM,IAAI;AAG1D,UAAM,EAAE,eAAe,IAAI,MAAM,SAAS,KAAK,sBAAsB;AACrE,QAAI;AAEJ,QACE,QAAQ,WAAW,UACnB,QAAQ,QAAQ,IAAI,cAAc,GAAG,YAAY,MAAM,qCACvD;AACA,YAAM,SAAS,IAAI,gBAAgB,MAAM,QAAQ,KAAK,CAAC;AACvD,aAAO,OAAO,YAAY,OAAO,QAAQ,CAAC;AAAA,IAC5C,OAAO;AACL,aAAO,MAAM,OAAO;AAAA,IACtB;AAEA,UAAM,SAAS,0BAA0B,UAAU,IAAI;AACvD,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,KAAK,SAAS,mBAAmB,wBAAwB;AAAA,IAClE;AACA,QAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,KAAK,OAAO;AAC3C,aAAO,KAAK,SAAS,mBAAmB,wBAAwB;AAAA,IAClE;AACA,QAAI,OAAO,KAAK,UAAU,OAAO,OAAO;AACtC,aAAO,KAAK,SAAS,mBAAmB,yBAAyB;AAAA,IACnE;AACA,QAAI,mBAAmB,OAAO,gBAAgB;AAC5C,aAAO,KAAK,SAAS,mBAAmB,gCAAgC;AAAA,IAC1E;AACA,SAAK,kBAAkB;AAGvB,UAAM,EAAE,KAAK,IAAI,OAAO;AAExB,UAAM,QAAQ,MAAM,KAAK,aAAa,0BAA0B;AAAA,MAC9D;AAAA,MACA;AAAA,MACA,MAAM,OAAO;AAAA,IACf,CAAC;AACD,UAAM,WAAW,MAAM,KAAK,aAAa,YAAY,EAAE,gBAAgB,MAAM,CAAC;AAC9E,SAAK,eAAe;AAGpB,UAAM,YAAY,MAAM,aAAa,SAAS,gBAAgB,UAAU,KAAK;AAC7E,SAAK,gBAAgB;AAGrB,YAAQ,oBAAoB,KAAK,IAAI,CAAC;AACtC,YAAQ,gBAAgB,KAAK,iCAAiC;AAC9D,YAAQ,aAAa,2BAA2B,UAAU,IAAI;AAC9D,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,SAAK,gBAAgB;AAErB,UAAM,WAAW,IAAI,SAAS,MAAM;AAAA,MAClC,QAAQ;AAAA,MACR,SAAS,EAAE,UAAU,KAAK,aAAa,WAAW;AAAA,IACpD,CAAC;AACD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,cAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEA,oBAAoB,OAClB,SACA,iBACsB;AACtB,cAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,IAAI,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAC3D,UAAM,EAAE,eAAe,IAAI,MAAM,SAAS,KAAK,wBAAwB;AACvE,UAAM,cAAe,MAAM,QAAQ,KAAK;AACxC,UAAM,EAAE,UAAU,MAAM,IAAI,MAAM,KAAK,aAAa,kBAAkB;AAAA,MACpE;AAAA,MACA;AAAA,IACF,CAAC;AACD,SAAK,qBAAqB;AAE1B,UAAM,EAAE,MAAM,IAAI,SAAS;AAC3B,QAAI,OAAO;AACT,YAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,KAAK,kBAAkB,KAAK,CAAC;AACjE,UAAI,UAAU,gBAAgB;AAC5B,cAAM,OAAO,EAAE,OAAO,mBAAmB,mBAAmB,iBAAiB;AAC7E,eAAO,SAAS,KAAK,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC5C;AACA,YAAM,KAAK,GAAG,WAAW,KAAK,kBAAkB,KAAK,CAAC;AACtD,WAAK,aAAa;AAAA,IACpB;AAEA,UAAM,YAAY,MAAM,aAAa,SAAS,gBAAgB,UAAU,KAAK;AAC7E,SAAK,gBAAgB;AAErB,UAAM,UAAU,KAAK,WAAW,cAAc;AAC9C,YAAQ,aAAa,2BAA2B,UAAU,IAAI;AAC9D,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,UAAM,WAAW,IAAI,SAAS,KAAK,UAAU,SAAS,GAAG;AAAA,MACvD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAChD,CAAC;AACD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,cAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEA,oBAAoB,OAClB,SACA,iBACsB;AACtB,UAAM,EAAE,MAAM,UAAU,IAAI,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAE3D,QAAI;AACJ,QAAI,QAAQ,QAAQ,IAAI,cAAc,MAAM,qCAAqC;AAC/E,YAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,aAAO,OAAO,YAAY,IAAI,gBAAgB,IAAI,CAAC;AAAA,IACrD,WAAW,QAAQ,QAAQ,IAAI,cAAc,MAAM,oBAAoB;AACrE,aAAQ,MAAM,QAAQ,KAAK;AAAA,IAC7B,OAAO;AACL,YAAM,OAAO,EAAE,OAAO,mBAAmB,mBAAmB,uBAAuB;AACnF,aAAO,SAAS,KAAK,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC5C;AAEA,UAAM,cAAc,UAAU,SAAS,cAAc;AACrD,QAAI,aAAa;AACf,YAAM,eAAe,KAAK,cAAc;AACxC,UAAI,CAAC,gBAAgB,gBAAgB,cAAc;AACjD,cAAM,OAAO,EAAE,OAAO,mBAAmB,mBAAmB,qBAAqB;AACjF,eAAO,SAAS,KAAK,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC5C;AAAA,IACF;AACA,UAAM,EAAE,OAAO,SAAS,IAAI,MAAM,OAAO,aAAa,KAAK,YAAY,CAAC;AACxE,UAAM,YAAY,MAAM,aAAa,SAAS,UAAU,UAAU,KAAK;AACvE,SAAK,gBAAgB;AAErB,UAAM,UAAU,KAAK,WAAW,cAAc;AAC9C,YAAQ,aAAa,2BAA2B,UAAU,IAAI;AAC9D,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,UAAM,WAAW,IAAI,SAAS,KAAK,UAAU,SAAS,GAAG;AAAA,MACvD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAChD,CAAC;AACD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,cAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEA,OAAO,OAAO,cAAwC;AACpD,UAAM,WAAW,MAAM,KAAK,WAAW,oBAAoB,UAAU,IAAI;AACzE,eAAW,aAAa,SAAS,KAAK,GAAG;AACvC,YAAM,KAAK,WAAW,WAAW,SAAS;AAAA,IAC5C;AAAA,EACF;AAAA,EAEA,kBAAkB,OAAO,YAAuC;AAC9D,UAAM,YAAY,UAAU,SAAS,KAAK,UAAU;AACpD,QAAI,CAAC,UAAW,QAAO;AACvB,UAAM,UAAU,MAAM,KAAK,WAAW,SAAS,SAAS;AACxD,QAAI,CAAC,QAAS,QAAO;AACrB,UAAM,gBAAgB,QAAQ,aAAa,yBAAyB;AACpE,QAAI,CAAC,cAAe,QAAO;AAC3B,WAAO;AAAA,EACT;AAAA,EAEA,aAAa,OACX,SACA,WACuD;AACvD,UAAM,YAAY,UAAU,SAAS,KAAK,UAAU;AACpD,QAAI,CAAC,WAAW;AACd,UAAI,QAAQ;AACV,cAAMC,WAAU,KAAK,WAAW,cAAc;AAC9C,cAAM,KAAK,WAAW,KAAKA,QAAO;AAClC,eAAOA;AAAA,MACT,OAAO;AACL,eAAO;AAAA,MACT;AAAA,IACF;AACA,UAAM,UAAU,MAAM,KAAK,WAAW,SAAS,SAAS;AACxD,QAAI,CAAC,SAAS;AACZ,UAAI,QAAQ;AACV,cAAMA,WAAU,KAAK,WAAW,cAAc;AAC9C,cAAM,KAAK,WAAW,KAAKA,QAAO;AAClC,eAAOA;AAAA,MACT,OAAO;AACL,eAAO;AAAA,MACT;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,gBAAgB,OAAO,cAAqC;AAC1D,UAAM,KAAK,WAAW,WAAW,SAAS;AAAA,EAC5C;AAAA,EAEA,eAAe,OAAO,YAAgD;AACpE,UAAM,YAAY,UAAU,SAAS,KAAK,UAAU;AACpD,QAAI,CAAC,UAAW,QAAO;AACvB,UAAM,UAAU,MAAM,KAAK,WAAW,SAAS,SAAS;AACxD,QAAI,CAAC,QAAS,QAAO;AACrB,UAAM,OAAO,QAAQ,aAAa,yBAAyB;AAC3D,QAAI,CAAC,KAAM,QAAO;AAClB,WAAO,EAAE,MAAM,OAAO,IAAI,EAAE;AAAA,EAC9B;AAAA,EAEA,yBAAyB,OAAO,iBAA6C;AAC3E,UAAM,KAAK,WAAW,uBAAuB,YAAY;AACzD,WAAO,SAAS,KAAK,CAAC,CAAC;AAAA,EACzB;AACF;","names":["timing","session"]}
+{"version":3,"sources":["../../src/auth/index.ts"],"sourcesContent":["import { createHash, randomUUID } from 'crypto';\nimport invariant from 'tiny-invariant';\nimport { PRINCIPAL_NAME_INDEX_NAME } from '../session/common';\nimport { param, query, getCookie, setCookie, deleteCookie } from '../utils/http';\nimport { OAuth2Client, oauth2RedirectQuerySchema } from '../oauth2/client';\nimport { OAuth2ErrorType } from '../oauth2/error';\nimport { timing } from '../utils/timing';\nimport { google } from '../oauth2/provider/index';\nimport type { CookieOptions } from '../utils/http';\nimport type { KVRepository, Session, SessionRepository } from '../session/types';\nimport type { NativeCredential, OAuth2AuthorizationRequest, PkceParameters } from '../oauth2/types';\nimport type { AuthConfig, AuthService, LoggedHandler, OAuth2AuthorizedHandler } from './types';\nimport type { Principal } from '../core';\n\nexport class Auth implements AuthService {\n  private readonly timing: boolean;\n  private readonly cookieName;\n  private readonly cookieOptions: CookieOptions;\n  private readonly kv: KVRepository;\n  private readonly repository: SessionRepository;\n\n  private readonly oauth2Client: OAuth2Client | null;\n  private readonly ATTR_OAUTH2_AUTHORIZATION_REQUEST = 'oauth2AuthorizationRequest';\n\n  public readonly PATH_CSRF = '/csrf' as const;\n  public readonly PATH_LOGOUT = '/logout' as const;\n  public readonly PATH_LOGGED = '/logged' as const;\n\n  public readonly PATH_OAUTH2_STATE = '/oauth2/state/:registrationId' as const;\n  public readonly PATH_OAUTH2_NONCE = '/oauth2/nonce/:registrationId' as const;\n  public readonly PATH_OAUTH2_AUTHORIZATION = '/oauth2/authorization/:registrationId' as const;\n  public readonly PATH_LOGIN_OAUTH2_CODE = '/login/oauth2/code/:registrationId' as const;\n  public readonly PATH_LOGIN_OAUTH2_NATIVE = '/login/oauth2/native/:registrationId' as const;\n  public readonly PATH_LOGIN_OAUTH2_ONETAP = '/login/oauth2/onetap/google' as const;\n\n  public readonly PATH_CLEANUP_EXPIRED_SESSIONS = '/sessions/expired/cleanup' as const;\n\n  constructor({ sessionRepository, kvRepository, oauth2, cookie, timing }: AuthConfig) {\n    this.timing = timing ?? false;\n    this.kv = kvRepository;\n    this.repository = sessionRepository;\n    const { name, ...cookieOptions } = cookie ?? {};\n    this.cookieName = name ?? 'SESSION';\n    this.cookieOptions = {\n      path: '/',\n      sameSite: 'none',\n      secure: true,\n      httpOnly: true,\n      ...cookieOptions,\n    };\n    this.oauth2Client = oauth2?.client ? new OAuth2Client(oauth2.client) : null;\n  }\n\n  logout = async (request: Request): Promise<Response> => {\n    const sessionId = getCookie(request, this.cookieName);\n    if (sessionId) await this.repository.deleteById(sessionId);\n    const response = Response.json({});\n    deleteCookie(response, this.cookieName);\n    return response;\n  };\n\n  logged = async (request: Request, onLogged?: LoggedHandler): Promise<Response> => {\n    // 1. get session from cookie\n    const sessionId = getCookie(request, this.cookieName);\n    if (!sessionId) return Response.json({ data: false });\n    const session = await this.repository.findById(sessionId);\n    if (!session) return Response.json({ data: false });\n\n    // 2. get principal name from session\n    const name = session.getAttribute(PRINCIPAL_NAME_INDEX_NAME);\n    session.setLastAccessedTime(Date.now());\n    await this.repository.save(session);\n\n    // 3. call onLogged\n    if (name !== null) await onLogged?.({ name: String(name) });\n\n    // 4. renew cookie\n    const response = Response.json({ data: name !== null });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    return response;\n  };\n\n  private createPkceParameters(): PkceParameters {\n    const code_verifier = randomUUID();\n    const code_challenge = createHash('sha256')\n      .update(code_verifier)\n      .digest()\n      .toString('base64url');\n\n    return { code_verifier, code_challenge, code_challenge_method: 'S256' };\n  }\n\n  private getOauth2StateKey(state: string) {\n    return `oauth2:state:${state}`;\n  }\n\n  private getOauth2NonceKey(nonce: string) {\n    return `oauth2:nonce:${nonce}`;\n  }\n\n  oauth2State = async (request: Request): Promise<Response> => {\n    const { registrationId } = param(request, this.PATH_OAUTH2_STATE);\n    const state = randomUUID();\n    await this.kv.setItem(this.getOauth2StateKey(state), registrationId, 10 * 60);\n    return Response.json({ state });\n  };\n\n  oauth2Nonce = async (request: Request): Promise<Response> => {\n    const { registrationId } = param(request, this.PATH_OAUTH2_NONCE);\n    const nonce = randomUUID();\n    await this.kv.setItem(this.getOauth2NonceKey(nonce), registrationId, 10 * 60);\n    return Response.json({ nonce });\n  };\n\n  oauth2Authorization = async (request: Request): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n    const { registrationId } = param(request, this.PATH_OAUTH2_AUTHORIZATION);\n    const state = randomUUID();\n    const pkce = this.createPkceParameters();\n    const uri = this.oauth2Client.createAuthorizationUri({ registrationId, state, pkce });\n    const sessionId = getCookie(request, this.cookieName);\n    const session = sessionId\n      ? ((await this.repository.findById(sessionId)) ?? this.repository.createSession())\n      : this.repository.createSession();\n    mark('fetch_session');\n\n    const authorizationRequest: OAuth2AuthorizationRequest = {\n      state,\n      registrationId,\n      authorizationRequestUri: uri.href,\n      additionalParameters: pkce,\n    };\n\n    const value = JSON.stringify(authorizationRequest);\n    session.setAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST, value);\n    await this.repository.save(session);\n    mark('save_session');\n\n    const response = new Response(null, { status: 302, headers: { location: uri.href } });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  private redirect = (error: OAuth2ErrorType, description?: string): Response => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const uri = new URL(this.oauth2Client.errorUri);\n    uri.searchParams.set('error', error);\n    if (description) uri.searchParams.set('error_description', description);\n    return Response.redirect(uri.href, 302);\n  };\n\n  loginOAuth2Code = async (\n    request: Request,\n    onAuthorized: OAuth2AuthorizedHandler\n  ): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n\n    // 1. get session from cookie\n    const sessionId = getCookie(request, this.cookieName);\n    const session = sessionId ? await this.repository.findById(sessionId) : null;\n    if (!session) {\n      return this.redirect('invalid_request', 'session not found');\n    }\n    mark('load_session');\n\n    // 2. get cached authorization request from session\n    const json = session.getAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST) as string | null;\n    if (!json) {\n      return this.redirect('invalid_request', 'authorization request not  found');\n    }\n    const cached: OAuth2AuthorizationRequest = JSON.parse(json);\n\n    // 3. validate redirect query/formdata\n    const { registrationId } = param(request, this.PATH_LOGIN_OAUTH2_CODE);\n    let data: Record<string, string>;\n    // apple redirect: response_mode=form_post\n    if (\n      request.method === 'POST' &&\n      request.headers.get('content-type')?.toLowerCase() === 'application/x-www-form-urlencoded'\n    ) {\n      const params = new URLSearchParams(await request.text());\n      data = Object.fromEntries(params.entries());\n    } else {\n      data = query(request);\n    }\n\n    const parsed = oauth2RedirectQuerySchema.safeParse(data);\n    if (!parsed.success) {\n      return this.redirect('invalid_request', 'invalid redirect query');\n    }\n    if (!parsed.data.code || !parsed.data.state) {\n      return this.redirect('invalid_request', 'invalid redirect query');\n    }\n    if (parsed.data.state !== cached.state) {\n      return this.redirect('invalid_request', 'redirect state mismatch');\n    }\n    if (registrationId !== cached.registrationId) {\n      return this.redirect('invalid_request', 'redirect registration mismatch');\n    }\n    mark('validate_session');\n\n    // 4. exchange authorization code for token and get user info\n    const { code } = parsed.data;\n\n    const token = await this.oauth2Client.exchangeAuthorizationCode({\n      registrationId,\n      code,\n      pkce: cached.additionalParameters,\n    });\n    const userInfo = await this.oauth2Client.getUserInfo({ registrationId, token });\n    mark('exchange_code');\n\n    // 5. create or update principal\n    const principal = await onAuthorized(request, registrationId, userInfo, token);\n    mark('save_principal');\n\n    // 6. update session\n    session.setLastAccessedTime(Date.now());\n    session.removeAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST);\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    mark('update_session');\n\n    const response = new Response(null, {\n      status: 302,\n      headers: { location: this.oauth2Client.successUri },\n    });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  loginOAuth2Native = async (\n    request: Request,\n    onAuthorized: OAuth2AuthorizedHandler\n  ): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n    const { registrationId } = param(request, this.PATH_LOGIN_OAUTH2_NATIVE);\n    const credentials = (await request.json()) as NativeCredential;\n    const { userInfo, token } = await this.oauth2Client.loginOAuth2Native({\n      registrationId,\n      credentials,\n    });\n    mark('login_oauth2_native');\n\n    const { nonce } = userInfo.data as { nonce?: string };\n    if (nonce) {\n      const value = await this.kv.getItem(this.getOauth2NonceKey(nonce));\n      if (value !== registrationId) {\n        const json = { error: 'invalid_request', error_description: 'nonce mismatch' };\n        return Response.json(json, { status: 400 });\n      }\n      await this.kv.removeItem(this.getOauth2NonceKey(nonce));\n      mark('check_nonce');\n    }\n\n    const principal = await onAuthorized(request, registrationId, userInfo, token);\n    mark('save_principal');\n\n    const session = this.repository.createSession();\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    const response = new Response(JSON.stringify(principal), {\n      status: 200,\n      headers: { 'Content-Type': 'application/json' },\n    });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  loginOAuth2Onetap = async (\n    request: Request,\n    onAuthorized: OAuth2AuthorizedHandler\n  ): Promise<Response> => {\n    const { mark, setTiming } = timing({ enabled: this.timing });\n    // should support application/x-www-form-urlencoded and application/json\n    let body: Record<string, string>;\n    if (request.headers.get('Content-Type') === 'application/x-www-form-urlencoded') {\n      const text = await request.text();\n      body = Object.fromEntries(new URLSearchParams(text));\n    } else if (request.headers.get('Content-Type') === 'application/json') {\n      body = (await request.json()) as Record<string, string>;\n    } else {\n      const json = { error: 'invalid_request', error_description: 'invalid content type' };\n      return Response.json(json, { status: 400 });\n    }\n\n    const csrf_cookie = getCookie(request, 'g_csrf_token');\n    if (csrf_cookie) {\n      const csrf_request = body['g_csrf_token'];\n      if (!csrf_request || csrf_cookie !== csrf_request) {\n        const json = { error: 'invalid_request', error_description: 'invalid csrf token' };\n        return Response.json(json, { status: 400 });\n      }\n    }\n    const { token, userInfo } = await google.getTokenInfo(body['credential']);\n    const principal = await onAuthorized(request, 'google', userInfo, token);\n    mark('save_principal');\n\n    const session = this.repository.createSession();\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    const response = new Response(JSON.stringify(principal), {\n      status: 200,\n      headers: { 'Content-Type': 'application/json' },\n    });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  kick = async (principal: Principal): Promise<void> => {\n    const sessions = await this.repository.findByPrincipalName(principal.name);\n    for (const sessionId of sessions.keys()) {\n      await this.repository.deleteById(sessionId);\n    }\n  };\n\n  isAuthenticated = async (request: Request): Promise<boolean> => {\n    const sessionId = getCookie(request, this.cookieName);\n    if (!sessionId) return false;\n    const session = await this.repository.findById(sessionId);\n    if (!session) return false;\n    const principalName = session.getAttribute(PRINCIPAL_NAME_INDEX_NAME);\n    if (!principalName) return false;\n    return true;\n  };\n\n  getSession = async <T extends boolean>(\n    request: Request,\n    create: T\n  ): Promise<T extends true ? Session : Session | null> => {\n    const sessionId = getCookie(request, this.cookieName);\n    if (!sessionId) {\n      if (create) {\n        const session = this.repository.createSession();\n        await this.repository.save(session);\n        return session;\n      } else {\n        return null as T extends true ? Session : Session | null;\n      }\n    }\n    const session = await this.repository.findById(sessionId);\n    if (!session) {\n      if (create) {\n        const session = this.repository.createSession();\n        await this.repository.save(session);\n        return session;\n      } else {\n        return null as T extends true ? Session : Session | null;\n      }\n    }\n    return session;\n  };\n\n  deleteSession = async (sessionId: string): Promise<void> => {\n    await this.repository.deleteById(sessionId);\n  };\n\n  getPrincipal = async (request: Request): Promise<Principal | null> => {\n    const sessionId = getCookie(request, this.cookieName);\n    if (!sessionId) return null;\n    const session = await this.repository.findById(sessionId);\n    if (!session) return null;\n    const name = session.getAttribute(PRINCIPAL_NAME_INDEX_NAME);\n    if (!name) return null;\n    return { name: String(name) };\n  };\n\n  listSessions = async (principal: Principal): Promise<Session[]> => {\n    const sessions = await this.repository.findByPrincipalName(principal.name);\n    return Array.from(sessions.values());\n  };\n\n  cleanupExpiredSessions = async (cleanupCount?: number): Promise<Response> => {\n    await this.repository.cleanupExpiredSessions(cleanupCount);\n    return Response.json({});\n  };\n}\n"],"mappings":";AAAA,SAAS,YAAY,kBAAkB;AACvC,OAAO,eAAe;AACtB,SAAS,iCAAiC;AAC1C,SAAS,OAAO,OAAO,WAAW,WAAW,oBAAoB;AACjE,SAAS,cAAc,iCAAiC;AAExD,SAAS,cAAc;AACvB,SAAS,cAAc;AAOhB,IAAM,OAAN,MAAkC;AAAA,EACtB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA,oCAAoC;AAAA,EAErC,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,cAAc;AAAA,EAEd,oBAAoB;AAAA,EACpB,oBAAoB;AAAA,EACpB,4BAA4B;AAAA,EAC5B,yBAAyB;AAAA,EACzB,2BAA2B;AAAA,EAC3B,2BAA2B;AAAA,EAE3B,gCAAgC;AAAA,EAEhD,YAAY,EAAE,mBAAmB,cAAc,QAAQ,QAAQ,QAAAA,QAAO,GAAe;AACnF,SAAK,SAASA,WAAU;AACxB,SAAK,KAAK;AACV,SAAK,aAAa;AAClB,UAAM,EAAE,MAAM,GAAG,cAAc,IAAI,UAAU,CAAC;AAC9C,SAAK,aAAa,QAAQ;AAC1B,SAAK,gBAAgB;AAAA,MACnB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,GAAG;AAAA,IACL;AACA,SAAK,eAAe,QAAQ,SAAS,IAAI,aAAa,OAAO,MAAM,IAAI;AAAA,EACzE;AAAA,EAEA,SAAS,OAAO,YAAwC;AACtD,UAAM,YAAY,UAAU,SAAS,KAAK,UAAU;AACpD,QAAI,UAAW,OAAM,KAAK,WAAW,WAAW,SAAS;AACzD,UAAM,WAAW,SAAS,KAAK,CAAC,CAAC;AACjC,iBAAa,UAAU,KAAK,UAAU;AACtC,WAAO;AAAA,EACT;AAAA,EAEA,SAAS,OAAO,SAAkB,aAAgD;AAEhF,UAAM,YAAY,UAAU,SAAS,KAAK,UAAU;AACpD,QAAI,CAAC,UAAW,QAAO,SAAS,KAAK,EAAE,MAAM,MAAM,CAAC;AACpD,UAAM,UAAU,MAAM,KAAK,WAAW,SAAS,SAAS;AACxD,QAAI,CAAC,QAAS,QAAO,SAAS,KAAK,EAAE,MAAM,MAAM,CAAC;AAGlD,UAAM,OAAO,QAAQ,aAAa,yBAAyB;AAC3D,YAAQ,oBAAoB,KAAK,IAAI,CAAC;AACtC,UAAM,KAAK,WAAW,KAAK,OAAO;AAGlC,QAAI,SAAS,KAAM,OAAM,WAAW,EAAE,MAAM,OAAO,IAAI,EAAE,CAAC;AAG1D,UAAM,WAAW,SAAS,KAAK,EAAE,MAAM,SAAS,KAAK,CAAC;AACtD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,cAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,WAAO;AAAA,EACT;AAAA,EAEQ,uBAAuC;AAC7C,UAAM,gBAAgB,WAAW;AACjC,UAAM,iBAAiB,WAAW,QAAQ,EACvC,OAAO,aAAa,EACpB,OAAO,EACP,SAAS,WAAW;AAEvB,WAAO,EAAE,eAAe,gBAAgB,uBAAuB,OAAO;AAAA,EACxE;AAAA,EAEQ,kBAAkB,OAAe;AACvC,WAAO,gBAAgB,KAAK;AAAA,EAC9B;AAAA,EAEQ,kBAAkB,OAAe;AACvC,WAAO,gBAAgB,KAAK;AAAA,EAC9B;AAAA,EAEA,cAAc,OAAO,YAAwC;AAC3D,UAAM,EAAE,eAAe,IAAI,MAAM,SAAS,KAAK,iBAAiB;AAChE,UAAM,QAAQ,WAAW;AACzB,UAAM,KAAK,GAAG,QAAQ,KAAK,kBAAkB,KAAK,GAAG,gBAAgB,KAAK,EAAE;AAC5E,WAAO,SAAS,KAAK,EAAE,MAAM,CAAC;AAAA,EAChC;AAAA,EAEA,cAAc,OAAO,YAAwC;AAC3D,UAAM,EAAE,eAAe,IAAI,MAAM,SAAS,KAAK,iBAAiB;AAChE,UAAM,QAAQ,WAAW;AACzB,UAAM,KAAK,GAAG,QAAQ,KAAK,kBAAkB,KAAK,GAAG,gBAAgB,KAAK,EAAE;AAC5E,WAAO,SAAS,KAAK,EAAE,MAAM,CAAC;AAAA,EAChC;AAAA,EAEA,sBAAsB,OAAO,YAAwC;AACnE,cAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,IAAI,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAC3D,UAAM,EAAE,eAAe,IAAI,MAAM,SAAS,KAAK,yBAAyB;AACxE,UAAM,QAAQ,WAAW;AACzB,UAAM,OAAO,KAAK,qBAAqB;AACvC,UAAM,MAAM,KAAK,aAAa,uBAAuB,EAAE,gBAAgB,OAAO,KAAK,CAAC;AACpF,UAAM,YAAY,UAAU,SAAS,KAAK,UAAU;AACpD,UAAM,UAAU,YACV,MAAM,KAAK,WAAW,SAAS,SAAS,KAAM,KAAK,WAAW,cAAc,IAC9E,KAAK,WAAW,cAAc;AAClC,SAAK,eAAe;AAEpB,UAAM,uBAAmD;AAAA,MACvD;AAAA,MACA;AAAA,MACA,yBAAyB,IAAI;AAAA,MAC7B,sBAAsB;AAAA,IACxB;AAEA,UAAM,QAAQ,KAAK,UAAU,oBAAoB;AACjD,YAAQ,aAAa,KAAK,mCAAmC,KAAK;AAClE,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,SAAK,cAAc;AAEnB,UAAM,WAAW,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,UAAU,IAAI,KAAK,EAAE,CAAC;AACpF,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,cAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEQ,WAAW,CAAC,OAAwB,gBAAmC;AAC7E,cAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,MAAM,IAAI,IAAI,KAAK,aAAa,QAAQ;AAC9C,QAAI,aAAa,IAAI,SAAS,KAAK;AACnC,QAAI,YAAa,KAAI,aAAa,IAAI,qBAAqB,WAAW;AACtE,WAAO,SAAS,SAAS,IAAI,MAAM,GAAG;AAAA,EACxC;AAAA,EAEA,kBAAkB,OAChB,SACA,iBACsB;AACtB,cAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,IAAI,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAG3D,UAAM,YAAY,UAAU,SAAS,KAAK,UAAU;AACpD,UAAM,UAAU,YAAY,MAAM,KAAK,WAAW,SAAS,SAAS,IAAI;AACxE,QAAI,CAAC,SAAS;AACZ,aAAO,KAAK,SAAS,mBAAmB,mBAAmB;AAAA,IAC7D;AACA,SAAK,cAAc;AAGnB,UAAM,OAAO,QAAQ,aAAa,KAAK,iCAAiC;AACxE,QAAI,CAAC,MAAM;AACT,aAAO,KAAK,SAAS,mBAAmB,kCAAkC;AAAA,IAC5E;AACA,UAAM,SAAqC,KAAK,MAAM,IAAI;AAG1D,UAAM,EAAE,eAAe,IAAI,MAAM,SAAS,KAAK,sBAAsB;AACrE,QAAI;AAEJ,QACE,QAAQ,WAAW,UACnB,QAAQ,QAAQ,IAAI,cAAc,GAAG,YAAY,MAAM,qCACvD;AACA,YAAM,SAAS,IAAI,gBAAgB,MAAM,QAAQ,KAAK,CAAC;AACvD,aAAO,OAAO,YAAY,OAAO,QAAQ,CAAC;AAAA,IAC5C,OAAO;AACL,aAAO,MAAM,OAAO;AAAA,IACtB;AAEA,UAAM,SAAS,0BAA0B,UAAU,IAAI;AACvD,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,KAAK,SAAS,mBAAmB,wBAAwB;AAAA,IAClE;AACA,QAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,KAAK,OAAO;AAC3C,aAAO,KAAK,SAAS,mBAAmB,wBAAwB;AAAA,IAClE;AACA,QAAI,OAAO,KAAK,UAAU,OAAO,OAAO;AACtC,aAAO,KAAK,SAAS,mBAAmB,yBAAyB;AAAA,IACnE;AACA,QAAI,mBAAmB,OAAO,gBAAgB;AAC5C,aAAO,KAAK,SAAS,mBAAmB,gCAAgC;AAAA,IAC1E;AACA,SAAK,kBAAkB;AAGvB,UAAM,EAAE,KAAK,IAAI,OAAO;AAExB,UAAM,QAAQ,MAAM,KAAK,aAAa,0BAA0B;AAAA,MAC9D;AAAA,MACA;AAAA,MACA,MAAM,OAAO;AAAA,IACf,CAAC;AACD,UAAM,WAAW,MAAM,KAAK,aAAa,YAAY,EAAE,gBAAgB,MAAM,CAAC;AAC9E,SAAK,eAAe;AAGpB,UAAM,YAAY,MAAM,aAAa,SAAS,gBAAgB,UAAU,KAAK;AAC7E,SAAK,gBAAgB;AAGrB,YAAQ,oBAAoB,KAAK,IAAI,CAAC;AACtC,YAAQ,gBAAgB,KAAK,iCAAiC;AAC9D,YAAQ,aAAa,2BAA2B,UAAU,IAAI;AAC9D,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,SAAK,gBAAgB;AAErB,UAAM,WAAW,IAAI,SAAS,MAAM;AAAA,MAClC,QAAQ;AAAA,MACR,SAAS,EAAE,UAAU,KAAK,aAAa,WAAW;AAAA,IACpD,CAAC;AACD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,cAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEA,oBAAoB,OAClB,SACA,iBACsB;AACtB,cAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,IAAI,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAC3D,UAAM,EAAE,eAAe,IAAI,MAAM,SAAS,KAAK,wBAAwB;AACvE,UAAM,cAAe,MAAM,QAAQ,KAAK;AACxC,UAAM,EAAE,UAAU,MAAM,IAAI,MAAM,KAAK,aAAa,kBAAkB;AAAA,MACpE;AAAA,MACA;AAAA,IACF,CAAC;AACD,SAAK,qBAAqB;AAE1B,UAAM,EAAE,MAAM,IAAI,SAAS;AAC3B,QAAI,OAAO;AACT,YAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,KAAK,kBAAkB,KAAK,CAAC;AACjE,UAAI,UAAU,gBAAgB;AAC5B,cAAM,OAAO,EAAE,OAAO,mBAAmB,mBAAmB,iBAAiB;AAC7E,eAAO,SAAS,KAAK,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC5C;AACA,YAAM,KAAK,GAAG,WAAW,KAAK,kBAAkB,KAAK,CAAC;AACtD,WAAK,aAAa;AAAA,IACpB;AAEA,UAAM,YAAY,MAAM,aAAa,SAAS,gBAAgB,UAAU,KAAK;AAC7E,SAAK,gBAAgB;AAErB,UAAM,UAAU,KAAK,WAAW,cAAc;AAC9C,YAAQ,aAAa,2BAA2B,UAAU,IAAI;AAC9D,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,UAAM,WAAW,IAAI,SAAS,KAAK,UAAU,SAAS,GAAG;AAAA,MACvD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAChD,CAAC;AACD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,cAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEA,oBAAoB,OAClB,SACA,iBACsB;AACtB,UAAM,EAAE,MAAM,UAAU,IAAI,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAE3D,QAAI;AACJ,QAAI,QAAQ,QAAQ,IAAI,cAAc,MAAM,qCAAqC;AAC/E,YAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,aAAO,OAAO,YAAY,IAAI,gBAAgB,IAAI,CAAC;AAAA,IACrD,WAAW,QAAQ,QAAQ,IAAI,cAAc,MAAM,oBAAoB;AACrE,aAAQ,MAAM,QAAQ,KAAK;AAAA,IAC7B,OAAO;AACL,YAAM,OAAO,EAAE,OAAO,mBAAmB,mBAAmB,uBAAuB;AACnF,aAAO,SAAS,KAAK,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC5C;AAEA,UAAM,cAAc,UAAU,SAAS,cAAc;AACrD,QAAI,aAAa;AACf,YAAM,eAAe,KAAK,cAAc;AACxC,UAAI,CAAC,gBAAgB,gBAAgB,cAAc;AACjD,cAAM,OAAO,EAAE,OAAO,mBAAmB,mBAAmB,qBAAqB;AACjF,eAAO,SAAS,KAAK,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC5C;AAAA,IACF;AACA,UAAM,EAAE,OAAO,SAAS,IAAI,MAAM,OAAO,aAAa,KAAK,YAAY,CAAC;AACxE,UAAM,YAAY,MAAM,aAAa,SAAS,UAAU,UAAU,KAAK;AACvE,SAAK,gBAAgB;AAErB,UAAM,UAAU,KAAK,WAAW,cAAc;AAC9C,YAAQ,aAAa,2BAA2B,UAAU,IAAI;AAC9D,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,UAAM,WAAW,IAAI,SAAS,KAAK,UAAU,SAAS,GAAG;AAAA,MACvD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAChD,CAAC;AACD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,cAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEA,OAAO,OAAO,cAAwC;AACpD,UAAM,WAAW,MAAM,KAAK,WAAW,oBAAoB,UAAU,IAAI;AACzE,eAAW,aAAa,SAAS,KAAK,GAAG;AACvC,YAAM,KAAK,WAAW,WAAW,SAAS;AAAA,IAC5C;AAAA,EACF;AAAA,EAEA,kBAAkB,OAAO,YAAuC;AAC9D,UAAM,YAAY,UAAU,SAAS,KAAK,UAAU;AACpD,QAAI,CAAC,UAAW,QAAO;AACvB,UAAM,UAAU,MAAM,KAAK,WAAW,SAAS,SAAS;AACxD,QAAI,CAAC,QAAS,QAAO;AACrB,UAAM,gBAAgB,QAAQ,aAAa,yBAAyB;AACpE,QAAI,CAAC,cAAe,QAAO;AAC3B,WAAO;AAAA,EACT;AAAA,EAEA,aAAa,OACX,SACA,WACuD;AACvD,UAAM,YAAY,UAAU,SAAS,KAAK,UAAU;AACpD,QAAI,CAAC,WAAW;AACd,UAAI,QAAQ;AACV,cAAMC,WAAU,KAAK,WAAW,cAAc;AAC9C,cAAM,KAAK,WAAW,KAAKA,QAAO;AAClC,eAAOA;AAAA,MACT,OAAO;AACL,eAAO;AAAA,MACT;AAAA,IACF;AACA,UAAM,UAAU,MAAM,KAAK,WAAW,SAAS,SAAS;AACxD,QAAI,CAAC,SAAS;AACZ,UAAI,QAAQ;AACV,cAAMA,WAAU,KAAK,WAAW,cAAc;AAC9C,cAAM,KAAK,WAAW,KAAKA,QAAO;AAClC,eAAOA;AAAA,MACT,OAAO;AACL,eAAO;AAAA,MACT;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,gBAAgB,OAAO,cAAqC;AAC1D,UAAM,KAAK,WAAW,WAAW,SAAS;AAAA,EAC5C;AAAA,EAEA,eAAe,OAAO,YAAgD;AACpE,UAAM,YAAY,UAAU,SAAS,KAAK,UAAU;AACpD,QAAI,CAAC,UAAW,QAAO;AACvB,UAAM,UAAU,MAAM,KAAK,WAAW,SAAS,SAAS;AACxD,QAAI,CAAC,QAAS,QAAO;AACrB,UAAM,OAAO,QAAQ,aAAa,yBAAyB;AAC3D,QAAI,CAAC,KAAM,QAAO;AAClB,WAAO,EAAE,MAAM,OAAO,IAAI,EAAE;AAAA,EAC9B;AAAA,EAEA,eAAe,OAAO,cAA6C;AACjE,UAAM,WAAW,MAAM,KAAK,WAAW,oBAAoB,UAAU,IAAI;AACzE,WAAO,MAAM,KAAK,SAAS,OAAO,CAAC;AAAA,EACrC;AAAA,EAEA,yBAAyB,OAAO,iBAA6C;AAC3E,UAAM,KAAK,WAAW,uBAAuB,YAAY;AACzD,WAAO,SAAS,KAAK,CAAC,CAAC;AAAA,EACzB;AACF;","names":["timing","session"]}

package/dist/auth/types.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/types.ts"],"sourcesContent":["import type { Principal } from '../core';\nimport type { OAuth2Token, OAuth2ClientConfig, PkceParameters, UserInfo } from '../oauth2/types';\nimport type { KVRepository, Session, SessionRepository } from '../session/types';\nimport type { CookieOptions } from '../utils/http';\n\nexport type LoggedHandler = (principal: Principal) => Promise<void>;\nexport type OAuth2AuthorizedHandler = (\n  request: Request,\n  registrationId: string,\n  userInfo: UserInfo,\n  token: OAuth2Token\n) => Promise<Principal>;\n\nexport interface AuthConfig {\n  timing?: boolean;\n  kvRepository: KVRepository;\n  sessionRepository: SessionRepository;\n  cookie?: CookieOptions & { name?: string };\n  oauth2?: {\n    client?: OAuth2ClientConfig;\n  };\n}\n\nexport interface AuthService {\n  // basic\n  logout: (request: Request) => Promise<Response>;\n  logged: (request: Request, onLogged?: LoggedHandler) => Promise<Response>;\n\n  // oauth2\n  oauth2State: (request: Request) => Promise<Response>;\n  oauth2Nonce: (request: Request) => Promise<Response>;\n  oauth2Authorization: (request: Request) => Promise<Response>;\n  loginOAuth2Code: (request: Request, onAuthorized: OAuth2AuthorizedHandler) => Promise<Response>;\n  loginOAuth2Native: (request: Request, onAuthorized: OAuth2AuthorizedHandler) => Promise<Response>;\n  loginOAuth2Onetap: (request: Request, onAuthorized: OAuth2AuthorizedHandler) => Promise<Response>;\n\n  // session management\n  kick: (principal: Principal) => Promise<void>;\n  isAuthenticated: (request: Request) => Promise<boolean>;\n  getSession: <T extends boolean>(\n    request: Request,\n    create: T\n  ) => Promise<T extends true ? Session : Session | null>;\n  deleteSession: (sessionId: string) => Promise<void>;\n  getPrincipal: (request: Request) => Promise<Principal | null>;\n  cleanupExpiredSessions: (cleanupCount?: number) => Promise<Response>;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAAA;AAAA;","names":[]}
+{"version":3,"sources":["../../src/auth/types.ts"],"sourcesContent":["import type { Principal } from '../core';\nimport type { OAuth2Token, OAuth2ClientConfig, UserInfo } from '../oauth2/types';\nimport type { KVRepository, Session, SessionRepository } from '../session/types';\nimport type { CookieOptions } from '../utils/http';\n\nexport type LoggedHandler = (principal: Principal) => Promise<void>;\nexport type OAuth2AuthorizedHandler = (\n  request: Request,\n  registrationId: string,\n  userInfo: UserInfo,\n  token: OAuth2Token\n) => Promise<Principal>;\n\nexport interface AuthConfig {\n  timing?: boolean;\n  kvRepository: KVRepository;\n  sessionRepository: SessionRepository;\n  cookie?: CookieOptions & { name?: string };\n  oauth2?: {\n    client?: OAuth2ClientConfig;\n  };\n}\n\nexport interface AuthService {\n  // basic\n  logout: (request: Request) => Promise<Response>;\n  logged: (request: Request, onLogged?: LoggedHandler) => Promise<Response>;\n\n  // oauth2\n  oauth2State: (request: Request) => Promise<Response>;\n  oauth2Nonce: (request: Request) => Promise<Response>;\n  oauth2Authorization: (request: Request) => Promise<Response>;\n  loginOAuth2Code: (request: Request, onAuthorized: OAuth2AuthorizedHandler) => Promise<Response>;\n  loginOAuth2Native: (request: Request, onAuthorized: OAuth2AuthorizedHandler) => Promise<Response>;\n  loginOAuth2Onetap: (request: Request, onAuthorized: OAuth2AuthorizedHandler) => Promise<Response>;\n\n  // session management\n  kick: (principal: Principal) => Promise<void>;\n  isAuthenticated: (request: Request) => Promise<boolean>;\n  getSession: <T extends boolean>(\n    request: Request,\n    create: T\n  ) => Promise<T extends true ? Session : Session | null>;\n  deleteSession: (sessionId: string) => Promise<void>;\n  getPrincipal: (request: Request) => Promise<Principal | null>;\n  listSessions: (principal: Principal) => Promise<Session[]>;\n  cleanupExpiredSessions: (cleanupCount?: number) => Promise<Response>;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAAA;AAAA;","names":[]}

package/dist/auth/types.d.cts

@@ -31,6 +31,7 @@ interface AuthService {
     getSession: <T extends boolean>(request: Request, create: T) => Promise<T extends true ? Session : Session | null>;
     deleteSession: (sessionId: string) => Promise<void>;
     getPrincipal: (request: Request) => Promise<Principal | null>;
+    listSessions: (principal: Principal) => Promise<Session[]>;
     cleanupExpiredSessions: (cleanupCount?: number) => Promise<Response>;
 }
 

package/dist/auth/types.d.ts

@@ -31,6 +31,7 @@ interface AuthService {
     getSession: <T extends boolean>(request: Request, create: T) => Promise<T extends true ? Session : Session | null>;
     deleteSession: (sessionId: string) => Promise<void>;
     getPrincipal: (request: Request) => Promise<Principal | null>;
+    listSessions: (principal: Principal) => Promise<Session[]>;
     cleanupExpiredSessions: (cleanupCount?: number) => Promise<Response>;
 }
 

package/dist/oauth2/provider/common.d.cts

@@ -1,4 +1,3 @@
-import * as url from 'url';
 import { PkceParameters, ExchangeCodeParams, RefreshTokenParams } from '../types.cjs';
 
 declare function createAuthorizationUri(options: {
@@ -8,7 +7,7 @@ declare function createAuthorizationUri(options: {
     redirectUri: string;
     authorizationUri: string;
     pkce?: Omit<PkceParameters, 'code_verifier'>;
-}): url.URL;
+}): URL;
 declare function exchangeAuthorizationCode(params: ExchangeCodeParams & {
     tokenUri: string;
     authentication?: 'basic' | 'post';

package/dist/oauth2/provider/common.d.ts

@@ -1,4 +1,3 @@
-import * as url from 'url';
 import { PkceParameters, ExchangeCodeParams, RefreshTokenParams } from '../types.js';
 
 declare function createAuthorizationUri(options: {
@@ -8,7 +7,7 @@ declare function createAuthorizationUri(options: {
     redirectUri: string;
     authorizationUri: string;
     pkce?: Omit<PkceParameters, 'code_verifier'>;
-}): url.URL;
+}): URL;
 declare function exchangeAuthorizationCode(params: ExchangeCodeParams & {
     tokenUri: string;
     authentication?: 'basic' | 'post';

package/dist/oauth2/provider/index.cjs

@@ -24,6 +24,7 @@ __export(provider_exports, {
   facebook: () => import_facebook.facebook,
   github: () => import_github.github,
   google: () => import_google.google,
+  wechat: () => import_wechat.wechat,
   x: () => import_x.x
 });
 module.exports = __toCommonJS(provider_exports);
@@ -31,6 +32,7 @@ var import_apple = require("./apple.cjs");
 var import_facebook = require("./facebook.cjs");
 var import_github = require("./github.cjs");
 var import_google = require("./google.cjs");
+var import_wechat = require("./wechat.cjs");
 var import_x = require("./x.cjs");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
@@ -38,6 +40,7 @@ var import_x = require("./x.cjs");
   facebook,
   github,
   google,
+  wechat,
   x
 });
 //# sourceMappingURL=index.cjs.map

package/dist/oauth2/provider/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/oauth2/provider/index.ts"],"sourcesContent":["export { apple } from './apple';\nexport { facebook } from './facebook';\nexport { github } from './github';\nexport { google } from './google';\nexport { x } from './x';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mBAAsB;AACtB,sBAAyB;AACzB,oBAAuB;AACvB,oBAAuB;AACvB,eAAkB;","names":[]}
+{"version":3,"sources":["../../../src/oauth2/provider/index.ts"],"sourcesContent":["export { apple } from './apple';\nexport { facebook } from './facebook';\nexport { github } from './github';\nexport { google } from './google';\nexport { wechat } from './wechat';\nexport { x } from './x';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mBAAsB;AACtB,sBAAyB;AACzB,oBAAuB;AACvB,oBAAuB;AACvB,oBAAuB;AACvB,eAAkB;","names":[]}

package/dist/oauth2/provider/index.d.cts

@@ -2,5 +2,6 @@ export { apple } from './apple.cjs';
 export { facebook } from './facebook.cjs';
 export { github } from './github.cjs';
 export { google } from './google.cjs';
+export { wechat } from './wechat.cjs';
 export { x } from './x.cjs';
 import '../types.cjs';

package/dist/oauth2/provider/index.d.ts

@@ -2,5 +2,6 @@ export { apple } from './apple.js';
 export { facebook } from './facebook.js';
 export { github } from './github.js';
 export { google } from './google.js';
+export { wechat } from './wechat.js';
 export { x } from './x.js';
 import '../types.js';

package/dist/oauth2/provider/index.mjs

@@ -3,12 +3,14 @@ import { apple } from "./apple.mjs";
 import { facebook } from "./facebook.mjs";
 import { github } from "./github.mjs";
 import { google } from "./google.mjs";
+import { wechat } from "./wechat.mjs";
 import { x } from "./x.mjs";
 export {
   apple,
   facebook,
   github,
   google,
+  wechat,
   x
 };
 //# sourceMappingURL=index.mjs.map

package/dist/oauth2/provider/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/oauth2/provider/index.ts"],"sourcesContent":["export { apple } from './apple';\nexport { facebook } from './facebook';\nexport { github } from './github';\nexport { google } from './google';\nexport { x } from './x';\n"],"mappings":";AAAA,SAAS,aAAa;AACtB,SAAS,gBAAgB;AACzB,SAAS,cAAc;AACvB,SAAS,cAAc;AACvB,SAAS,SAAS;","names":[]}
+{"version":3,"sources":["../../../src/oauth2/provider/index.ts"],"sourcesContent":["export { apple } from './apple';\nexport { facebook } from './facebook';\nexport { github } from './github';\nexport { google } from './google';\nexport { wechat } from './wechat';\nexport { x } from './x';\n"],"mappings":";AAAA,SAAS,aAAa;AACtB,SAAS,gBAAgB;AACzB,SAAS,cAAc;AACvB,SAAS,cAAc;AACvB,SAAS,cAAc;AACvB,SAAS,SAAS;","names":[]}

package/dist/oauth2/provider/wechat.cjs

@@ -0,0 +1,112 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/oauth2/provider/wechat.ts
+var wechat_exports = {};
+__export(wechat_exports, {
+  createWechatProvider: () => createWechatProvider,
+  wechat: () => wechat
+});
+module.exports = __toCommonJS(wechat_exports);
+var import_tiny_invariant = __toESM(require("tiny-invariant"), 1);
+var import_error = require("../error.cjs");
+function createWechatProvider(options = { isWechatBrowser: false }) {
+  const { isWechatBrowser } = options;
+  return {
+    authorizationUri: isWechatBrowser ? "https://open.weixin.qq.com/connect/oauth2/authorize" : "https://open.weixin.qq.com/connect/qrconnect",
+    tokenUri: "https://api.weixin.qq.com/sns/oauth2/access_token",
+    tokenRefreshUri: "https://api.weixin.qq.com/sns/oauth2/refresh_token",
+    userInfoUri: "https://api.weixin.qq.com/sns/userinfo",
+    defaultScope: [isWechatBrowser ? "snsapi_userinfo" : "snsapi_login"],
+    createAuthorizationUri(params) {
+      const url = new URL(this.authorizationUri);
+      url.searchParams.set("appid", params.clientId);
+      url.searchParams.set("scope", (params.scope ?? this.defaultScope).join(","));
+      url.searchParams.set("redirect_uri", params.redirectUri);
+      url.searchParams.set("response_type", "code");
+      url.searchParams.set("state", params.state);
+      return url;
+    },
+    async exchangeAuthorizationCode(params) {
+      const url = new URL(this.tokenUri);
+      url.searchParams.set("appid", params.clientId);
+      url.searchParams.set("secret", params.clientSecret);
+      url.searchParams.set("code", params.code);
+      url.searchParams.set("grant_type", "authorization_code");
+      const response = await fetch(url.href);
+      if (!response.ok) {
+        const { errcode, errmsg } = await response.json();
+        throw new import_error.OAuth2Error(response.status, errmsg, `errcode: ${errcode}`);
+      }
+      return await response.json();
+    },
+    async getUserInfo({ access_token, openid }) {
+      (0, import_tiny_invariant.default)(this.userInfoUri, "userInfoUri is required");
+      (0, import_tiny_invariant.default)(openid && typeof openid === "string", "openid is required");
+      const url = new URL(this.userInfoUri);
+      url.searchParams.set("access_token", access_token);
+      url.searchParams.set("openid", openid);
+      const response = await fetch(url.href);
+      if (!response.ok) {
+        const { errcode, errmsg } = await response.json();
+        throw new import_error.OAuth2Error(response.status, errmsg, `errcode: ${errcode}`);
+      }
+      const data = await response.json();
+      return {
+        data,
+        claims: {
+          sub: data.unionid ?? data.openid,
+          name: data.nickname,
+          picture: data.headimgurl.split("/").slice(0, -1).join("/") + "/0",
+          gender: data.sex === 1 ? "male" : data.sex === 2 ? "female" : void 0
+        }
+      };
+    },
+    async refreshAccessToken(params) {
+      (0, import_tiny_invariant.default)(this.tokenRefreshUri, "tokenRefreshUri is required");
+      const url = new URL(this.tokenRefreshUri);
+      url.searchParams.set("appid", params.clientId);
+      url.searchParams.set("grant_type", "refresh_token");
+      url.searchParams.set("refresh_token", params.refreshToken);
+      const response = await fetch(url.href);
+      if (!response.ok) {
+        const { errcode, errmsg } = await response.json();
+        throw new import_error.OAuth2Error(response.status, errmsg, `errcode: ${errcode}`);
+      }
+      return await response.json();
+    }
+  };
+}
+var wechat = createWechatProvider();
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createWechatProvider,
+  wechat
+});
+//# sourceMappingURL=wechat.cjs.map

package/dist/oauth2/provider/wechat.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/oauth2/provider/wechat.ts"],"sourcesContent":["import invariant from 'tiny-invariant';\nimport type { OAuth2Token, Provider } from '../types';\nimport { OAuth2Error } from '../error';\n\nexport type Options = { isWechatBrowser: boolean };\n\n/**\n * reference: https://developers.weixin.qq.com/doc/offiaccount/en/OA_Web_Apps/Wechat_webpage_authorization.html\n */\nexport function createWechatProvider(options: Options = { isWechatBrowser: false }): Provider {\n  const { isWechatBrowser } = options;\n  return {\n    authorizationUri: isWechatBrowser\n      ? 'https://open.weixin.qq.com/connect/oauth2/authorize'\n      : 'https://open.weixin.qq.com/connect/qrconnect',\n    tokenUri: 'https://api.weixin.qq.com/sns/oauth2/access_token',\n    tokenRefreshUri: 'https://api.weixin.qq.com/sns/oauth2/refresh_token',\n    userInfoUri: 'https://api.weixin.qq.com/sns/userinfo',\n    defaultScope: [isWechatBrowser ? 'snsapi_userinfo' : 'snsapi_login'],\n    createAuthorizationUri(params) {\n      const url = new URL(this.authorizationUri);\n      url.searchParams.set('appid', params.clientId);\n      url.searchParams.set('scope', (params.scope ?? this.defaultScope).join(','));\n      url.searchParams.set('redirect_uri', params.redirectUri);\n      url.searchParams.set('response_type', 'code');\n      url.searchParams.set('state', params.state);\n      return url;\n    },\n    async exchangeAuthorizationCode(params) {\n      const url = new URL(this.tokenUri);\n      url.searchParams.set('appid', params.clientId);\n      url.searchParams.set('secret', params.clientSecret);\n      url.searchParams.set('code', params.code);\n      url.searchParams.set('grant_type', 'authorization_code');\n      const response = await fetch(url.href);\n      if (!response.ok) {\n        const { errcode, errmsg } = (await response.json()) as WechatErrorResponse;\n        throw new OAuth2Error(response.status, errmsg, `errcode: ${errcode}`);\n      }\n      return (await response.json()) as WechatToken;\n    },\n    async getUserInfo({ access_token, openid }) {\n      invariant(this.userInfoUri, 'userInfoUri is required');\n      invariant(openid && typeof openid === 'string', 'openid is required');\n      const url = new URL(this.userInfoUri);\n      url.searchParams.set('access_token', access_token);\n      url.searchParams.set('openid', openid);\n      const response = await fetch(url.href);\n      if (!response.ok) {\n        const { errcode, errmsg } = (await response.json()) as WechatErrorResponse;\n        throw new OAuth2Error(response.status, errmsg, `errcode: ${errcode}`);\n      }\n      const data = (await response.json()) as WechatUserInfo;\n\n      return {\n        data,\n        claims: {\n          sub: data.unionid ?? data.openid,\n          name: data.nickname,\n          picture: data.headimgurl.split('/').slice(0, -1).join('/') + '/0',\n          gender: data.sex === 1 ? 'male' : data.sex === 2 ? 'female' : undefined,\n        },\n      };\n    },\n    async refreshAccessToken(params) {\n      invariant(this.tokenRefreshUri, 'tokenRefreshUri is required');\n      const url = new URL(this.tokenRefreshUri);\n      url.searchParams.set('appid', params.clientId);\n      url.searchParams.set('grant_type', 'refresh_token');\n      url.searchParams.set('refresh_token', params.refreshToken);\n      const response = await fetch(url.href);\n      if (!response.ok) {\n        const { errcode, errmsg } = (await response.json()) as WechatErrorResponse;\n        throw new OAuth2Error(response.status, errmsg, `errcode: ${errcode}`);\n      }\n      return (await response.json()) as WechatToken;\n    },\n  };\n}\n\nexport const wechat = createWechatProvider();\n\nexport interface WechatUserInfo {\n  openid: string;\n  nickname: string;\n  sex: 0 | 1 | 2; // 0: unknown, 1: male, 2: female\n  province: string;\n  city: string;\n  country: string;\n  /**\n   * User's profile photo. The last numeric value represents the size of a square profile photo\n   * (The value can be 0, 46, 64, 96, or 132. The value 0 represents a 640*640 square profile\n   * photo). This parameter is left blank if a user has no profile photo. If the user changes the\n   * profile photo, the URL of the original profile photo will expire.\n   * e.g. http://thirdwx.qlogo.cn/mmopen/g3MonUZtNHkdmzicIlibx6iaFqAc56vxLSUfpb6n5WKSYVY0ChQKkiaJSgQ1dZuTOgvLLrhJbERQQ4eMsv84eavHiaiceqxibJxCfHe/46\n   */\n  headimgurl: string;\n  privilege: string[];\n  unionid?: string;\n}\n\nexport interface WechatToken extends OAuth2Token {\n  access_token: string;\n  expires_in: number;\n  refresh_token: string;\n  openid: string;\n  scope: string;\n  unionid?: string;\n}\n\ninterface WechatErrorResponse {\n  errcode: number;\n  errmsg: string;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,4BAAsB;AAEtB,mBAA4B;AAOrB,SAAS,qBAAqB,UAAmB,EAAE,iBAAiB,MAAM,GAAa;AAC5F,QAAM,EAAE,gBAAgB,IAAI;AAC5B,SAAO;AAAA,IACL,kBAAkB,kBACd,wDACA;AAAA,IACJ,UAAU;AAAA,IACV,iBAAiB;AAAA,IACjB,aAAa;AAAA,IACb,cAAc,CAAC,kBAAkB,oBAAoB,cAAc;AAAA,IACnE,uBAAuB,QAAQ;AAC7B,YAAM,MAAM,IAAI,IAAI,KAAK,gBAAgB;AACzC,UAAI,aAAa,IAAI,SAAS,OAAO,QAAQ;AAC7C,UAAI,aAAa,IAAI,UAAU,OAAO,SAAS,KAAK,cAAc,KAAK,GAAG,CAAC;AAC3E,UAAI,aAAa,IAAI,gBAAgB,OAAO,WAAW;AACvD,UAAI,aAAa,IAAI,iBAAiB,MAAM;AAC5C,UAAI,aAAa,IAAI,SAAS,OAAO,KAAK;AAC1C,aAAO;AAAA,IACT;AAAA,IACA,MAAM,0BAA0B,QAAQ;AACtC,YAAM,MAAM,IAAI,IAAI,KAAK,QAAQ;AACjC,UAAI,aAAa,IAAI,SAAS,OAAO,QAAQ;AAC7C,UAAI,aAAa,IAAI,UAAU,OAAO,YAAY;AAClD,UAAI,aAAa,IAAI,QAAQ,OAAO,IAAI;AACxC,UAAI,aAAa,IAAI,cAAc,oBAAoB;AACvD,YAAM,WAAW,MAAM,MAAM,IAAI,IAAI;AACrC,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,SAAS,OAAO,IAAK,MAAM,SAAS,KAAK;AACjD,cAAM,IAAI,yBAAY,SAAS,QAAQ,QAAQ,YAAY,OAAO,EAAE;AAAA,MACtE;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,EAAE,cAAc,OAAO,GAAG;AAC1C,gCAAAA,SAAU,KAAK,aAAa,yBAAyB;AACrD,gCAAAA,SAAU,UAAU,OAAO,WAAW,UAAU,oBAAoB;AACpE,YAAM,MAAM,IAAI,IAAI,KAAK,WAAW;AACpC,UAAI,aAAa,IAAI,gBAAgB,YAAY;AACjD,UAAI,aAAa,IAAI,UAAU,MAAM;AACrC,YAAM,WAAW,MAAM,MAAM,IAAI,IAAI;AACrC,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,SAAS,OAAO,IAAK,MAAM,SAAS,KAAK;AACjD,cAAM,IAAI,yBAAY,SAAS,QAAQ,QAAQ,YAAY,OAAO,EAAE;AAAA,MACtE;AACA,YAAM,OAAQ,MAAM,SAAS,KAAK;AAElC,aAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,UACN,KAAK,KAAK,WAAW,KAAK;AAAA,UAC1B,MAAM,KAAK;AAAA,UACX,SAAS,KAAK,WAAW,MAAM,GAAG,EAAE,MAAM,GAAG,EAAE,EAAE,KAAK,GAAG,IAAI;AAAA,UAC7D,QAAQ,KAAK,QAAQ,IAAI,SAAS,KAAK,QAAQ,IAAI,WAAW;AAAA,QAChE;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,mBAAmB,QAAQ;AAC/B,gCAAAA,SAAU,KAAK,iBAAiB,6BAA6B;AAC7D,YAAM,MAAM,IAAI,IAAI,KAAK,eAAe;AACxC,UAAI,aAAa,IAAI,SAAS,OAAO,QAAQ;AAC7C,UAAI,aAAa,IAAI,cAAc,eAAe;AAClD,UAAI,aAAa,IAAI,iBAAiB,OAAO,YAAY;AACzD,YAAM,WAAW,MAAM,MAAM,IAAI,IAAI;AACrC,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,SAAS,OAAO,IAAK,MAAM,SAAS,KAAK;AACjD,cAAM,IAAI,yBAAY,SAAS,QAAQ,QAAQ,YAAY,OAAO,EAAE;AAAA,MACtE;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,EACF;AACF;AAEO,IAAM,SAAS,qBAAqB;","names":["invariant"]}

package/dist/oauth2/provider/wechat.d.cts

@@ -0,0 +1,38 @@
+import { Provider, OAuth2Token } from '../types.cjs';
+
+type Options = {
+    isWechatBrowser: boolean;
+};
+/**
+ * reference: https://developers.weixin.qq.com/doc/offiaccount/en/OA_Web_Apps/Wechat_webpage_authorization.html
+ */
+declare function createWechatProvider(options?: Options): Provider;
+declare const wechat: Provider;
+interface WechatUserInfo {
+    openid: string;
+    nickname: string;
+    sex: 0 | 1 | 2;
+    province: string;
+    city: string;
+    country: string;
+    /**
+     * User's profile photo. The last numeric value represents the size of a square profile photo
+     * (The value can be 0, 46, 64, 96, or 132. The value 0 represents a 640*640 square profile
+     * photo). This parameter is left blank if a user has no profile photo. If the user changes the
+     * profile photo, the URL of the original profile photo will expire.
+     * e.g. http://thirdwx.qlogo.cn/mmopen/g3MonUZtNHkdmzicIlibx6iaFqAc56vxLSUfpb6n5WKSYVY0ChQKkiaJSgQ1dZuTOgvLLrhJbERQQ4eMsv84eavHiaiceqxibJxCfHe/46
+     */
+    headimgurl: string;
+    privilege: string[];
+    unionid?: string;
+}
+interface WechatToken extends OAuth2Token {
+    access_token: string;
+    expires_in: number;
+    refresh_token: string;
+    openid: string;
+    scope: string;
+    unionid?: string;
+}
+
+export { type Options, type WechatToken, type WechatUserInfo, createWechatProvider, wechat };

package/dist/oauth2/provider/wechat.d.ts

@@ -0,0 +1,38 @@
+import { Provider, OAuth2Token } from '../types.js';
+
+type Options = {
+    isWechatBrowser: boolean;
+};
+/**
+ * reference: https://developers.weixin.qq.com/doc/offiaccount/en/OA_Web_Apps/Wechat_webpage_authorization.html
+ */
+declare function createWechatProvider(options?: Options): Provider;
+declare const wechat: Provider;
+interface WechatUserInfo {
+    openid: string;
+    nickname: string;
+    sex: 0 | 1 | 2;
+    province: string;
+    city: string;
+    country: string;
+    /**
+     * User's profile photo. The last numeric value represents the size of a square profile photo
+     * (The value can be 0, 46, 64, 96, or 132. The value 0 represents a 640*640 square profile
+     * photo). This parameter is left blank if a user has no profile photo. If the user changes the
+     * profile photo, the URL of the original profile photo will expire.
+     * e.g. http://thirdwx.qlogo.cn/mmopen/g3MonUZtNHkdmzicIlibx6iaFqAc56vxLSUfpb6n5WKSYVY0ChQKkiaJSgQ1dZuTOgvLLrhJbERQQ4eMsv84eavHiaiceqxibJxCfHe/46
+     */
+    headimgurl: string;
+    privilege: string[];
+    unionid?: string;
+}
+interface WechatToken extends OAuth2Token {
+    access_token: string;
+    expires_in: number;
+    refresh_token: string;
+    openid: string;
+    scope: string;
+    unionid?: string;
+}
+
+export { type Options, type WechatToken, type WechatUserInfo, createWechatProvider, wechat };

package/dist/oauth2/provider/wechat.mjs

@@ -0,0 +1,76 @@
+// src/oauth2/provider/wechat.ts
+import invariant from "tiny-invariant";
+import { OAuth2Error } from "../error.mjs";
+function createWechatProvider(options = { isWechatBrowser: false }) {
+  const { isWechatBrowser } = options;
+  return {
+    authorizationUri: isWechatBrowser ? "https://open.weixin.qq.com/connect/oauth2/authorize" : "https://open.weixin.qq.com/connect/qrconnect",
+    tokenUri: "https://api.weixin.qq.com/sns/oauth2/access_token",
+    tokenRefreshUri: "https://api.weixin.qq.com/sns/oauth2/refresh_token",
+    userInfoUri: "https://api.weixin.qq.com/sns/userinfo",
+    defaultScope: [isWechatBrowser ? "snsapi_userinfo" : "snsapi_login"],
+    createAuthorizationUri(params) {
+      const url = new URL(this.authorizationUri);
+      url.searchParams.set("appid", params.clientId);
+      url.searchParams.set("scope", (params.scope ?? this.defaultScope).join(","));
+      url.searchParams.set("redirect_uri", params.redirectUri);
+      url.searchParams.set("response_type", "code");
+      url.searchParams.set("state", params.state);
+      return url;
+    },
+    async exchangeAuthorizationCode(params) {
+      const url = new URL(this.tokenUri);
+      url.searchParams.set("appid", params.clientId);
+      url.searchParams.set("secret", params.clientSecret);
+      url.searchParams.set("code", params.code);
+      url.searchParams.set("grant_type", "authorization_code");
+      const response = await fetch(url.href);
+      if (!response.ok) {
+        const { errcode, errmsg } = await response.json();
+        throw new OAuth2Error(response.status, errmsg, `errcode: ${errcode}`);
+      }
+      return await response.json();
+    },
+    async getUserInfo({ access_token, openid }) {
+      invariant(this.userInfoUri, "userInfoUri is required");
+      invariant(openid && typeof openid === "string", "openid is required");
+      const url = new URL(this.userInfoUri);
+      url.searchParams.set("access_token", access_token);
+      url.searchParams.set("openid", openid);
+      const response = await fetch(url.href);
+      if (!response.ok) {
+        const { errcode, errmsg } = await response.json();
+        throw new OAuth2Error(response.status, errmsg, `errcode: ${errcode}`);
+      }
+      const data = await response.json();
+      return {
+        data,
+        claims: {
+          sub: data.unionid ?? data.openid,
+          name: data.nickname,
+          picture: data.headimgurl.split("/").slice(0, -1).join("/") + "/0",
+          gender: data.sex === 1 ? "male" : data.sex === 2 ? "female" : void 0
+        }
+      };
+    },
+    async refreshAccessToken(params) {
+      invariant(this.tokenRefreshUri, "tokenRefreshUri is required");
+      const url = new URL(this.tokenRefreshUri);
+      url.searchParams.set("appid", params.clientId);
+      url.searchParams.set("grant_type", "refresh_token");
+      url.searchParams.set("refresh_token", params.refreshToken);
+      const response = await fetch(url.href);
+      if (!response.ok) {
+        const { errcode, errmsg } = await response.json();
+        throw new OAuth2Error(response.status, errmsg, `errcode: ${errcode}`);
+      }
+      return await response.json();
+    }
+  };
+}
+var wechat = createWechatProvider();
+export {
+  createWechatProvider,
+  wechat
+};
+//# sourceMappingURL=wechat.mjs.map

package/dist/oauth2/provider/wechat.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/oauth2/provider/wechat.ts"],"sourcesContent":["import invariant from 'tiny-invariant';\nimport type { OAuth2Token, Provider } from '../types';\nimport { OAuth2Error } from '../error';\n\nexport type Options = { isWechatBrowser: boolean };\n\n/**\n * reference: https://developers.weixin.qq.com/doc/offiaccount/en/OA_Web_Apps/Wechat_webpage_authorization.html\n */\nexport function createWechatProvider(options: Options = { isWechatBrowser: false }): Provider {\n  const { isWechatBrowser } = options;\n  return {\n    authorizationUri: isWechatBrowser\n      ? 'https://open.weixin.qq.com/connect/oauth2/authorize'\n      : 'https://open.weixin.qq.com/connect/qrconnect',\n    tokenUri: 'https://api.weixin.qq.com/sns/oauth2/access_token',\n    tokenRefreshUri: 'https://api.weixin.qq.com/sns/oauth2/refresh_token',\n    userInfoUri: 'https://api.weixin.qq.com/sns/userinfo',\n    defaultScope: [isWechatBrowser ? 'snsapi_userinfo' : 'snsapi_login'],\n    createAuthorizationUri(params) {\n      const url = new URL(this.authorizationUri);\n      url.searchParams.set('appid', params.clientId);\n      url.searchParams.set('scope', (params.scope ?? this.defaultScope).join(','));\n      url.searchParams.set('redirect_uri', params.redirectUri);\n      url.searchParams.set('response_type', 'code');\n      url.searchParams.set('state', params.state);\n      return url;\n    },\n    async exchangeAuthorizationCode(params) {\n      const url = new URL(this.tokenUri);\n      url.searchParams.set('appid', params.clientId);\n      url.searchParams.set('secret', params.clientSecret);\n      url.searchParams.set('code', params.code);\n      url.searchParams.set('grant_type', 'authorization_code');\n      const response = await fetch(url.href);\n      if (!response.ok) {\n        const { errcode, errmsg } = (await response.json()) as WechatErrorResponse;\n        throw new OAuth2Error(response.status, errmsg, `errcode: ${errcode}`);\n      }\n      return (await response.json()) as WechatToken;\n    },\n    async getUserInfo({ access_token, openid }) {\n      invariant(this.userInfoUri, 'userInfoUri is required');\n      invariant(openid && typeof openid === 'string', 'openid is required');\n      const url = new URL(this.userInfoUri);\n      url.searchParams.set('access_token', access_token);\n      url.searchParams.set('openid', openid);\n      const response = await fetch(url.href);\n      if (!response.ok) {\n        const { errcode, errmsg } = (await response.json()) as WechatErrorResponse;\n        throw new OAuth2Error(response.status, errmsg, `errcode: ${errcode}`);\n      }\n      const data = (await response.json()) as WechatUserInfo;\n\n      return {\n        data,\n        claims: {\n          sub: data.unionid ?? data.openid,\n          name: data.nickname,\n          picture: data.headimgurl.split('/').slice(0, -1).join('/') + '/0',\n          gender: data.sex === 1 ? 'male' : data.sex === 2 ? 'female' : undefined,\n        },\n      };\n    },\n    async refreshAccessToken(params) {\n      invariant(this.tokenRefreshUri, 'tokenRefreshUri is required');\n      const url = new URL(this.tokenRefreshUri);\n      url.searchParams.set('appid', params.clientId);\n      url.searchParams.set('grant_type', 'refresh_token');\n      url.searchParams.set('refresh_token', params.refreshToken);\n      const response = await fetch(url.href);\n      if (!response.ok) {\n        const { errcode, errmsg } = (await response.json()) as WechatErrorResponse;\n        throw new OAuth2Error(response.status, errmsg, `errcode: ${errcode}`);\n      }\n      return (await response.json()) as WechatToken;\n    },\n  };\n}\n\nexport const wechat = createWechatProvider();\n\nexport interface WechatUserInfo {\n  openid: string;\n  nickname: string;\n  sex: 0 | 1 | 2; // 0: unknown, 1: male, 2: female\n  province: string;\n  city: string;\n  country: string;\n  /**\n   * User's profile photo. The last numeric value represents the size of a square profile photo\n   * (The value can be 0, 46, 64, 96, or 132. The value 0 represents a 640*640 square profile\n   * photo). This parameter is left blank if a user has no profile photo. If the user changes the\n   * profile photo, the URL of the original profile photo will expire.\n   * e.g. http://thirdwx.qlogo.cn/mmopen/g3MonUZtNHkdmzicIlibx6iaFqAc56vxLSUfpb6n5WKSYVY0ChQKkiaJSgQ1dZuTOgvLLrhJbERQQ4eMsv84eavHiaiceqxibJxCfHe/46\n   */\n  headimgurl: string;\n  privilege: string[];\n  unionid?: string;\n}\n\nexport interface WechatToken extends OAuth2Token {\n  access_token: string;\n  expires_in: number;\n  refresh_token: string;\n  openid: string;\n  scope: string;\n  unionid?: string;\n}\n\ninterface WechatErrorResponse {\n  errcode: number;\n  errmsg: string;\n}\n"],"mappings":";AAAA,OAAO,eAAe;AAEtB,SAAS,mBAAmB;AAOrB,SAAS,qBAAqB,UAAmB,EAAE,iBAAiB,MAAM,GAAa;AAC5F,QAAM,EAAE,gBAAgB,IAAI;AAC5B,SAAO;AAAA,IACL,kBAAkB,kBACd,wDACA;AAAA,IACJ,UAAU;AAAA,IACV,iBAAiB;AAAA,IACjB,aAAa;AAAA,IACb,cAAc,CAAC,kBAAkB,oBAAoB,cAAc;AAAA,IACnE,uBAAuB,QAAQ;AAC7B,YAAM,MAAM,IAAI,IAAI,KAAK,gBAAgB;AACzC,UAAI,aAAa,IAAI,SAAS,OAAO,QAAQ;AAC7C,UAAI,aAAa,IAAI,UAAU,OAAO,SAAS,KAAK,cAAc,KAAK,GAAG,CAAC;AAC3E,UAAI,aAAa,IAAI,gBAAgB,OAAO,WAAW;AACvD,UAAI,aAAa,IAAI,iBAAiB,MAAM;AAC5C,UAAI,aAAa,IAAI,SAAS,OAAO,KAAK;AAC1C,aAAO;AAAA,IACT;AAAA,IACA,MAAM,0BAA0B,QAAQ;AACtC,YAAM,MAAM,IAAI,IAAI,KAAK,QAAQ;AACjC,UAAI,aAAa,IAAI,SAAS,OAAO,QAAQ;AAC7C,UAAI,aAAa,IAAI,UAAU,OAAO,YAAY;AAClD,UAAI,aAAa,IAAI,QAAQ,OAAO,IAAI;AACxC,UAAI,aAAa,IAAI,cAAc,oBAAoB;AACvD,YAAM,WAAW,MAAM,MAAM,IAAI,IAAI;AACrC,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,SAAS,OAAO,IAAK,MAAM,SAAS,KAAK;AACjD,cAAM,IAAI,YAAY,SAAS,QAAQ,QAAQ,YAAY,OAAO,EAAE;AAAA,MACtE;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,EAAE,cAAc,OAAO,GAAG;AAC1C,gBAAU,KAAK,aAAa,yBAAyB;AACrD,gBAAU,UAAU,OAAO,WAAW,UAAU,oBAAoB;AACpE,YAAM,MAAM,IAAI,IAAI,KAAK,WAAW;AACpC,UAAI,aAAa,IAAI,gBAAgB,YAAY;AACjD,UAAI,aAAa,IAAI,UAAU,MAAM;AACrC,YAAM,WAAW,MAAM,MAAM,IAAI,IAAI;AACrC,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,SAAS,OAAO,IAAK,MAAM,SAAS,KAAK;AACjD,cAAM,IAAI,YAAY,SAAS,QAAQ,QAAQ,YAAY,OAAO,EAAE;AAAA,MACtE;AACA,YAAM,OAAQ,MAAM,SAAS,KAAK;AAElC,aAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,UACN,KAAK,KAAK,WAAW,KAAK;AAAA,UAC1B,MAAM,KAAK;AAAA,UACX,SAAS,KAAK,WAAW,MAAM,GAAG,EAAE,MAAM,GAAG,EAAE,EAAE,KAAK,GAAG,IAAI;AAAA,UAC7D,QAAQ,KAAK,QAAQ,IAAI,SAAS,KAAK,QAAQ,IAAI,WAAW;AAAA,QAChE;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,mBAAmB,QAAQ;AAC/B,gBAAU,KAAK,iBAAiB,6BAA6B;AAC7D,YAAM,MAAM,IAAI,IAAI,KAAK,eAAe;AACxC,UAAI,aAAa,IAAI,SAAS,OAAO,QAAQ;AAC7C,UAAI,aAAa,IAAI,cAAc,eAAe;AAClD,UAAI,aAAa,IAAI,iBAAiB,OAAO,YAAY;AACzD,YAAM,WAAW,MAAM,MAAM,IAAI,IAAI;AACrC,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,SAAS,OAAO,IAAK,MAAM,SAAS,KAAK;AACjD,cAAM,IAAI,YAAY,SAAS,QAAQ,QAAQ,YAAY,OAAO,EAAE;AAAA,MACtE;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,EACF;AACF;AAEO,IAAM,SAAS,qBAAqB;","names":[]}

package/dist/oauth2/provider/x.cjs

@@ -50,6 +50,7 @@ function createXProvider(options) {
   return {
     authorizationUri: "https://x.com/i/oauth2/authorize",
     tokenUri: "https://api.x.com/2/oauth2/token",
+    tokenRefreshUri: "https://api.x.com/2/oauth2/token",
     tokenRevokeUri: "https://api.x.com/2/oauth2/revoke",
     // https://docs.x.com/x-api/users/user-lookup-me
     userInfoUri: "https://api.x.com/2/users/me",
@@ -107,9 +108,10 @@ function createXProvider(options) {
       };
     },
     async refreshAccessToken(params) {
+      (0, import_tiny_invariant.default)(this.tokenRefreshUri, "tokenRefreshUri is required");
       const response = await (0, import_common.refreshAccessToken)({
         ...params,
-        tokenUri: this.tokenUri,
+        tokenUri: this.tokenRefreshUri,
         authentication: "basic"
       });
       if (!response.ok) {

package/dist/oauth2/provider/x.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/oauth2/provider/x.ts"],"sourcesContent":["import invariant from 'tiny-invariant';\nimport { OAuth2Token, Provider } from '../types';\nimport { OAuth2Error } from '../error';\nimport {\n  createAuthorizationUri,\n  exchangeAuthorizationCode,\n  refreshAccessToken,\n  revokeToken,\n} from './common';\n\nexport interface XOptions {\n  userFields?: UserField[];\n}\n\nconst defaultUserFields = [\n  'id',\n  'name',\n  'profile_image_url',\n  'url',\n  'username',\n  'location',\n  'verified',\n];\n\nexport function createXProvider(options?: XOptions): Provider {\n  return {\n    authorizationUri: 'https://x.com/i/oauth2/authorize',\n    tokenUri: 'https://api.x.com/2/oauth2/token',\n    tokenRevokeUri: 'https://api.x.com/2/oauth2/revoke',\n    // https://docs.x.com/x-api/users/user-lookup-me\n    userInfoUri: 'https://api.x.com/2/users/me',\n    defaultScope: ['users.read', 'tweet.read', 'offline.access'],\n    createAuthorizationUri(params) {\n      if (!params.pkce) throw new Error('pkce is required for x');\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode(params) {\n      if (!params.pkce) throw new Error('pkce is required for x');\n      const response = await exchangeAuthorizationCode({\n        ...params,\n        tokenUri: this.tokenUri,\n        authentication: 'basic',\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as XErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as XToken;\n    },\n    async getUserInfo({ access_token }) {\n      invariant(access_token, 'access_token is required');\n      invariant(this.userInfoUri, 'userInfoUri is required');\n\n      const userFields = options?.userFields ?? defaultUserFields;\n      const headers = { Accept: 'application/json', Authorization: `Bearer ${access_token}` };\n\n      const url = new URL(this.userInfoUri);\n      userFields.forEach((field) => url.searchParams.append('user.fields', field));\n\n      const response = await fetch(this.userInfoUri, { headers });\n      if (!response.ok) {\n        const { errors } = (await response.json()) as XAPIErrorResponse;\n        throw new OAuth2Error(\n          response.status,\n          'invalid_request',\n          'Failed to fetch user info: ' + (errors.at(0)?.detail ?? errors.at(0)?.title)\n        );\n      }\n      const profile = (await response.json()) as XUserInfo;\n      return {\n        data: profile,\n        claims: {\n          sub: profile.data.id,\n          name: profile.data.name,\n          picture: profile.data.profile_image_url,\n          email: profile.data.email,\n          email_verified: profile.data.verified || false,\n          preferred_username: profile.data.username,\n          profile: `https://x.com/${profile.data.username}`,\n          website: profile.data.url,\n        },\n      };\n    },\n    async refreshAccessToken(params) {\n      const response = await refreshAccessToken({\n        ...params,\n        tokenUri: this.tokenUri,\n        authentication: 'basic',\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as XErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as XToken;\n    },\n    async revokeToken(params) {\n      invariant(this.tokenRevokeUri, 'tokenRevokeUri is required');\n      return revokeToken({\n        ...params,\n        tokenRevokeUri: this.tokenRevokeUri,\n        authentication: 'basic',\n      });\n    },\n  };\n}\n\nexport const x = createXProvider();\n\ntype UserField =\n  | 'affiliation'\n  | 'connection_status'\n  | 'created_at'\n  | 'description'\n  | 'entities'\n  | 'id'\n  | 'is_identity_verified'\n  | 'location'\n  | 'most_recent_tweet_id'\n  | 'name'\n  | 'parody'\n  | 'pinned_tweet_id'\n  | 'profile_banner_url'\n  | 'profile_image_url'\n  | 'protected'\n  | 'public_metrics'\n  | 'receives_your_dm'\n  | 'subscription'\n  | 'subscription_type'\n  | 'url'\n  | 'username'\n  | 'verified'\n  | 'verified_followers_count'\n  | 'verified_type'\n  | 'withheld';\n\nexport interface XUser {\n  id: string;\n  name: string;\n  email?: string;\n  username: string;\n  location?: string;\n  entities?: {\n    url: { urls: UrlEntity[] };\n    description: {\n      hashtags: HashtagEntity[];\n      cashtags: HashtagEntity[];\n      mentions: MentionEntity[];\n    };\n  };\n  verified?: boolean;\n  description?: string;\n  url?: string;\n  profile_image_url?: string;\n  protected?: boolean;\n  pinned_tweet_id?: string;\n  created_at?: string;\n}\n\nexport interface XUserInfo {\n  data: XUser;\n  includes?: { tweets?: { id: string; text: string }[]; users?: XUser[] };\n}\n\n// prettier-ignore\ntype UrlEntity = { start: number; end: number; url: string; display_url: string; expanded_url: string; }\ntype HashtagEntity = { start: number; end: number; tag: string };\ntype MentionEntity = { start: number; end: string; username: string };\n\nexport interface XToken extends OAuth2Token {\n  token_type: string;\n  expires_in: number;\n  access_token: string;\n  scope: string;\n  refresh_token: string;\n}\n\ntype XErrorResponse = { error: string; error_description: string };\ntype XAPIErrorResponse = {\n  errors: { title: string; type: string; detail?: string; status?: number }[];\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,4BAAsB;AAEtB,mBAA4B;AAC5B,oBAKO;AAMP,IAAM,oBAAoB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,gBAAgB,SAA8B;AAC5D,SAAO;AAAA,IACL,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,gBAAgB;AAAA;AAAA,IAEhB,aAAa;AAAA,IACb,cAAc,CAAC,cAAc,cAAc,gBAAgB;AAAA,IAC3D,uBAAuB,QAAQ;AAC7B,UAAI,CAAC,OAAO,KAAM,OAAM,IAAI,MAAM,wBAAwB;AAC1D,iBAAO,sCAAuB;AAAA,QAC5B,GAAG;AAAA,QACH,OAAO,OAAO,SAAS,KAAK;AAAA,QAC5B,kBAAkB,KAAK;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,0BAA0B,QAAQ;AACtC,UAAI,CAAC,OAAO,KAAM,OAAM,IAAI,MAAM,wBAAwB;AAC1D,YAAM,WAAW,UAAM,yCAA0B;AAAA,QAC/C,GAAG;AAAA,QACH,UAAU,KAAK;AAAA,QACf,gBAAgB;AAAA,MAClB,CAAC;AACD,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,OAAO,kBAAkB,IAAK,MAAM,SAAS,KAAK;AAC1D,cAAM,IAAI,yBAAY,SAAS,QAAQ,OAAO,iBAAiB;AAAA,MACjE;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,EAAE,aAAa,GAAG;AAClC,gCAAAA,SAAU,cAAc,0BAA0B;AAClD,gCAAAA,SAAU,KAAK,aAAa,yBAAyB;AAErD,YAAM,aAAa,SAAS,cAAc;AAC1C,YAAM,UAAU,EAAE,QAAQ,oBAAoB,eAAe,UAAU,YAAY,GAAG;AAEtF,YAAM,MAAM,IAAI,IAAI,KAAK,WAAW;AACpC,iBAAW,QAAQ,CAAC,UAAU,IAAI,aAAa,OAAO,eAAe,KAAK,CAAC;AAE3E,YAAM,WAAW,MAAM,MAAM,KAAK,aAAa,EAAE,QAAQ,CAAC;AAC1D,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,OAAO,IAAK,MAAM,SAAS,KAAK;AACxC,cAAM,IAAI;AAAA,UACR,SAAS;AAAA,UACT;AAAA,UACA,iCAAiC,OAAO,GAAG,CAAC,GAAG,UAAU,OAAO,GAAG,CAAC,GAAG;AAAA,QACzE;AAAA,MACF;AACA,YAAM,UAAW,MAAM,SAAS,KAAK;AACrC,aAAO;AAAA,QACL,MAAM;AAAA,QACN,QAAQ;AAAA,UACN,KAAK,QAAQ,KAAK;AAAA,UAClB,MAAM,QAAQ,KAAK;AAAA,UACnB,SAAS,QAAQ,KAAK;AAAA,UACtB,OAAO,QAAQ,KAAK;AAAA,UACpB,gBAAgB,QAAQ,KAAK,YAAY;AAAA,UACzC,oBAAoB,QAAQ,KAAK;AAAA,UACjC,SAAS,iBAAiB,QAAQ,KAAK,QAAQ;AAAA,UAC/C,SAAS,QAAQ,KAAK;AAAA,QACxB;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,mBAAmB,QAAQ;AAC/B,YAAM,WAAW,UAAM,kCAAmB;AAAA,QACxC,GAAG;AAAA,QACH,UAAU,KAAK;AAAA,QACf,gBAAgB;AAAA,MAClB,CAAC;AACD,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,OAAO,kBAAkB,IAAK,MAAM,SAAS,KAAK;AAC1D,cAAM,IAAI,yBAAY,SAAS,QAAQ,OAAO,iBAAiB;AAAA,MACjE;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,QAAQ;AACxB,gCAAAA,SAAU,KAAK,gBAAgB,4BAA4B;AAC3D,iBAAO,2BAAY;AAAA,QACjB,GAAG;AAAA,QACH,gBAAgB,KAAK;AAAA,QACrB,gBAAgB;AAAA,MAClB,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEO,IAAM,IAAI,gBAAgB;","names":["invariant"]}
+{"version":3,"sources":["../../../src/oauth2/provider/x.ts"],"sourcesContent":["import invariant from 'tiny-invariant';\nimport { OAuth2Token, Provider } from '../types';\nimport { OAuth2Error } from '../error';\nimport {\n  createAuthorizationUri,\n  exchangeAuthorizationCode,\n  refreshAccessToken,\n  revokeToken,\n} from './common';\n\nexport interface XOptions {\n  userFields?: UserField[];\n}\n\nconst defaultUserFields = [\n  'id',\n  'name',\n  'profile_image_url',\n  'url',\n  'username',\n  'location',\n  'verified',\n];\n\nexport function createXProvider(options?: XOptions): Provider {\n  return {\n    authorizationUri: 'https://x.com/i/oauth2/authorize',\n    tokenUri: 'https://api.x.com/2/oauth2/token',\n    tokenRefreshUri: 'https://api.x.com/2/oauth2/token',\n    tokenRevokeUri: 'https://api.x.com/2/oauth2/revoke',\n    // https://docs.x.com/x-api/users/user-lookup-me\n    userInfoUri: 'https://api.x.com/2/users/me',\n    defaultScope: ['users.read', 'tweet.read', 'offline.access'],\n    createAuthorizationUri(params) {\n      if (!params.pkce) throw new Error('pkce is required for x');\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode(params) {\n      if (!params.pkce) throw new Error('pkce is required for x');\n      const response = await exchangeAuthorizationCode({\n        ...params,\n        tokenUri: this.tokenUri,\n        authentication: 'basic',\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as XErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as XToken;\n    },\n    async getUserInfo({ access_token }) {\n      invariant(access_token, 'access_token is required');\n      invariant(this.userInfoUri, 'userInfoUri is required');\n\n      const userFields = options?.userFields ?? defaultUserFields;\n      const headers = { Accept: 'application/json', Authorization: `Bearer ${access_token}` };\n\n      const url = new URL(this.userInfoUri);\n      userFields.forEach((field) => url.searchParams.append('user.fields', field));\n\n      const response = await fetch(this.userInfoUri, { headers });\n      if (!response.ok) {\n        const { errors } = (await response.json()) as XAPIErrorResponse;\n        throw new OAuth2Error(\n          response.status,\n          'invalid_request',\n          'Failed to fetch user info: ' + (errors.at(0)?.detail ?? errors.at(0)?.title)\n        );\n      }\n      const profile = (await response.json()) as XUserInfo;\n      return {\n        data: profile,\n        claims: {\n          sub: profile.data.id,\n          name: profile.data.name,\n          picture: profile.data.profile_image_url,\n          email: profile.data.email,\n          email_verified: profile.data.verified || false,\n          preferred_username: profile.data.username,\n          profile: `https://x.com/${profile.data.username}`,\n          website: profile.data.url,\n        },\n      };\n    },\n    async refreshAccessToken(params) {\n      invariant(this.tokenRefreshUri, 'tokenRefreshUri is required');\n      const response = await refreshAccessToken({\n        ...params,\n        tokenUri: this.tokenRefreshUri,\n        authentication: 'basic',\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as XErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as XToken;\n    },\n    async revokeToken(params) {\n      invariant(this.tokenRevokeUri, 'tokenRevokeUri is required');\n      return revokeToken({\n        ...params,\n        tokenRevokeUri: this.tokenRevokeUri,\n        authentication: 'basic',\n      });\n    },\n  };\n}\n\nexport const x = createXProvider();\n\ntype UserField =\n  | 'affiliation'\n  | 'connection_status'\n  | 'created_at'\n  | 'description'\n  | 'entities'\n  | 'id'\n  | 'is_identity_verified'\n  | 'location'\n  | 'most_recent_tweet_id'\n  | 'name'\n  | 'parody'\n  | 'pinned_tweet_id'\n  | 'profile_banner_url'\n  | 'profile_image_url'\n  | 'protected'\n  | 'public_metrics'\n  | 'receives_your_dm'\n  | 'subscription'\n  | 'subscription_type'\n  | 'url'\n  | 'username'\n  | 'verified'\n  | 'verified_followers_count'\n  | 'verified_type'\n  | 'withheld';\n\nexport interface XUser {\n  id: string;\n  name: string;\n  email?: string;\n  username: string;\n  location?: string;\n  entities?: {\n    url: { urls: UrlEntity[] };\n    description: {\n      hashtags: HashtagEntity[];\n      cashtags: HashtagEntity[];\n      mentions: MentionEntity[];\n    };\n  };\n  verified?: boolean;\n  description?: string;\n  url?: string;\n  profile_image_url?: string;\n  protected?: boolean;\n  pinned_tweet_id?: string;\n  created_at?: string;\n}\n\nexport interface XUserInfo {\n  data: XUser;\n  includes?: { tweets?: { id: string; text: string }[]; users?: XUser[] };\n}\n\n// prettier-ignore\ntype UrlEntity = { start: number; end: number; url: string; display_url: string; expanded_url: string; }\ntype HashtagEntity = { start: number; end: number; tag: string };\ntype MentionEntity = { start: number; end: string; username: string };\n\nexport interface XToken extends OAuth2Token {\n  token_type: string;\n  expires_in: number;\n  access_token: string;\n  scope: string;\n  refresh_token: string;\n}\n\ntype XErrorResponse = { error: string; error_description: string };\ntype XAPIErrorResponse = {\n  errors: { title: string; type: string; detail?: string; status?: number }[];\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,4BAAsB;AAEtB,mBAA4B;AAC5B,oBAKO;AAMP,IAAM,oBAAoB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,gBAAgB,SAA8B;AAC5D,SAAO;AAAA,IACL,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,iBAAiB;AAAA,IACjB,gBAAgB;AAAA;AAAA,IAEhB,aAAa;AAAA,IACb,cAAc,CAAC,cAAc,cAAc,gBAAgB;AAAA,IAC3D,uBAAuB,QAAQ;AAC7B,UAAI,CAAC,OAAO,KAAM,OAAM,IAAI,MAAM,wBAAwB;AAC1D,iBAAO,sCAAuB;AAAA,QAC5B,GAAG;AAAA,QACH,OAAO,OAAO,SAAS,KAAK;AAAA,QAC5B,kBAAkB,KAAK;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,0BAA0B,QAAQ;AACtC,UAAI,CAAC,OAAO,KAAM,OAAM,IAAI,MAAM,wBAAwB;AAC1D,YAAM,WAAW,UAAM,yCAA0B;AAAA,QAC/C,GAAG;AAAA,QACH,UAAU,KAAK;AAAA,QACf,gBAAgB;AAAA,MAClB,CAAC;AACD,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,OAAO,kBAAkB,IAAK,MAAM,SAAS,KAAK;AAC1D,cAAM,IAAI,yBAAY,SAAS,QAAQ,OAAO,iBAAiB;AAAA,MACjE;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,EAAE,aAAa,GAAG;AAClC,gCAAAA,SAAU,cAAc,0BAA0B;AAClD,gCAAAA,SAAU,KAAK,aAAa,yBAAyB;AAErD,YAAM,aAAa,SAAS,cAAc;AAC1C,YAAM,UAAU,EAAE,QAAQ,oBAAoB,eAAe,UAAU,YAAY,GAAG;AAEtF,YAAM,MAAM,IAAI,IAAI,KAAK,WAAW;AACpC,iBAAW,QAAQ,CAAC,UAAU,IAAI,aAAa,OAAO,eAAe,KAAK,CAAC;AAE3E,YAAM,WAAW,MAAM,MAAM,KAAK,aAAa,EAAE,QAAQ,CAAC;AAC1D,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,OAAO,IAAK,MAAM,SAAS,KAAK;AACxC,cAAM,IAAI;AAAA,UACR,SAAS;AAAA,UACT;AAAA,UACA,iCAAiC,OAAO,GAAG,CAAC,GAAG,UAAU,OAAO,GAAG,CAAC,GAAG;AAAA,QACzE;AAAA,MACF;AACA,YAAM,UAAW,MAAM,SAAS,KAAK;AACrC,aAAO;AAAA,QACL,MAAM;AAAA,QACN,QAAQ;AAAA,UACN,KAAK,QAAQ,KAAK;AAAA,UAClB,MAAM,QAAQ,KAAK;AAAA,UACnB,SAAS,QAAQ,KAAK;AAAA,UACtB,OAAO,QAAQ,KAAK;AAAA,UACpB,gBAAgB,QAAQ,KAAK,YAAY;AAAA,UACzC,oBAAoB,QAAQ,KAAK;AAAA,UACjC,SAAS,iBAAiB,QAAQ,KAAK,QAAQ;AAAA,UAC/C,SAAS,QAAQ,KAAK;AAAA,QACxB;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,mBAAmB,QAAQ;AAC/B,gCAAAA,SAAU,KAAK,iBAAiB,6BAA6B;AAC7D,YAAM,WAAW,UAAM,kCAAmB;AAAA,QACxC,GAAG;AAAA,QACH,UAAU,KAAK;AAAA,QACf,gBAAgB;AAAA,MAClB,CAAC;AACD,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,OAAO,kBAAkB,IAAK,MAAM,SAAS,KAAK;AAC1D,cAAM,IAAI,yBAAY,SAAS,QAAQ,OAAO,iBAAiB;AAAA,MACjE;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,QAAQ;AACxB,gCAAAA,SAAU,KAAK,gBAAgB,4BAA4B;AAC3D,iBAAO,2BAAY;AAAA,QACjB,GAAG;AAAA,QACH,gBAAgB,KAAK;AAAA,QACrB,gBAAgB;AAAA,MAClB,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEO,IAAM,IAAI,gBAAgB;","names":["invariant"]}

package/dist/oauth2/provider/x.mjs

@@ -20,6 +20,7 @@ function createXProvider(options) {
   return {
     authorizationUri: "https://x.com/i/oauth2/authorize",
     tokenUri: "https://api.x.com/2/oauth2/token",
+    tokenRefreshUri: "https://api.x.com/2/oauth2/token",
     tokenRevokeUri: "https://api.x.com/2/oauth2/revoke",
     // https://docs.x.com/x-api/users/user-lookup-me
     userInfoUri: "https://api.x.com/2/users/me",
@@ -77,9 +78,10 @@ function createXProvider(options) {
       };
     },
     async refreshAccessToken(params) {
+      invariant(this.tokenRefreshUri, "tokenRefreshUri is required");
       const response = await refreshAccessToken({
         ...params,
-        tokenUri: this.tokenUri,
+        tokenUri: this.tokenRefreshUri,
         authentication: "basic"
       });
       if (!response.ok) {

package/dist/oauth2/provider/x.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/oauth2/provider/x.ts"],"sourcesContent":["import invariant from 'tiny-invariant';\nimport { OAuth2Token, Provider } from '../types';\nimport { OAuth2Error } from '../error';\nimport {\n  createAuthorizationUri,\n  exchangeAuthorizationCode,\n  refreshAccessToken,\n  revokeToken,\n} from './common';\n\nexport interface XOptions {\n  userFields?: UserField[];\n}\n\nconst defaultUserFields = [\n  'id',\n  'name',\n  'profile_image_url',\n  'url',\n  'username',\n  'location',\n  'verified',\n];\n\nexport function createXProvider(options?: XOptions): Provider {\n  return {\n    authorizationUri: 'https://x.com/i/oauth2/authorize',\n    tokenUri: 'https://api.x.com/2/oauth2/token',\n    tokenRevokeUri: 'https://api.x.com/2/oauth2/revoke',\n    // https://docs.x.com/x-api/users/user-lookup-me\n    userInfoUri: 'https://api.x.com/2/users/me',\n    defaultScope: ['users.read', 'tweet.read', 'offline.access'],\n    createAuthorizationUri(params) {\n      if (!params.pkce) throw new Error('pkce is required for x');\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode(params) {\n      if (!params.pkce) throw new Error('pkce is required for x');\n      const response = await exchangeAuthorizationCode({\n        ...params,\n        tokenUri: this.tokenUri,\n        authentication: 'basic',\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as XErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as XToken;\n    },\n    async getUserInfo({ access_token }) {\n      invariant(access_token, 'access_token is required');\n      invariant(this.userInfoUri, 'userInfoUri is required');\n\n      const userFields = options?.userFields ?? defaultUserFields;\n      const headers = { Accept: 'application/json', Authorization: `Bearer ${access_token}` };\n\n      const url = new URL(this.userInfoUri);\n      userFields.forEach((field) => url.searchParams.append('user.fields', field));\n\n      const response = await fetch(this.userInfoUri, { headers });\n      if (!response.ok) {\n        const { errors } = (await response.json()) as XAPIErrorResponse;\n        throw new OAuth2Error(\n          response.status,\n          'invalid_request',\n          'Failed to fetch user info: ' + (errors.at(0)?.detail ?? errors.at(0)?.title)\n        );\n      }\n      const profile = (await response.json()) as XUserInfo;\n      return {\n        data: profile,\n        claims: {\n          sub: profile.data.id,\n          name: profile.data.name,\n          picture: profile.data.profile_image_url,\n          email: profile.data.email,\n          email_verified: profile.data.verified || false,\n          preferred_username: profile.data.username,\n          profile: `https://x.com/${profile.data.username}`,\n          website: profile.data.url,\n        },\n      };\n    },\n    async refreshAccessToken(params) {\n      const response = await refreshAccessToken({\n        ...params,\n        tokenUri: this.tokenUri,\n        authentication: 'basic',\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as XErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as XToken;\n    },\n    async revokeToken(params) {\n      invariant(this.tokenRevokeUri, 'tokenRevokeUri is required');\n      return revokeToken({\n        ...params,\n        tokenRevokeUri: this.tokenRevokeUri,\n        authentication: 'basic',\n      });\n    },\n  };\n}\n\nexport const x = createXProvider();\n\ntype UserField =\n  | 'affiliation'\n  | 'connection_status'\n  | 'created_at'\n  | 'description'\n  | 'entities'\n  | 'id'\n  | 'is_identity_verified'\n  | 'location'\n  | 'most_recent_tweet_id'\n  | 'name'\n  | 'parody'\n  | 'pinned_tweet_id'\n  | 'profile_banner_url'\n  | 'profile_image_url'\n  | 'protected'\n  | 'public_metrics'\n  | 'receives_your_dm'\n  | 'subscription'\n  | 'subscription_type'\n  | 'url'\n  | 'username'\n  | 'verified'\n  | 'verified_followers_count'\n  | 'verified_type'\n  | 'withheld';\n\nexport interface XUser {\n  id: string;\n  name: string;\n  email?: string;\n  username: string;\n  location?: string;\n  entities?: {\n    url: { urls: UrlEntity[] };\n    description: {\n      hashtags: HashtagEntity[];\n      cashtags: HashtagEntity[];\n      mentions: MentionEntity[];\n    };\n  };\n  verified?: boolean;\n  description?: string;\n  url?: string;\n  profile_image_url?: string;\n  protected?: boolean;\n  pinned_tweet_id?: string;\n  created_at?: string;\n}\n\nexport interface XUserInfo {\n  data: XUser;\n  includes?: { tweets?: { id: string; text: string }[]; users?: XUser[] };\n}\n\n// prettier-ignore\ntype UrlEntity = { start: number; end: number; url: string; display_url: string; expanded_url: string; }\ntype HashtagEntity = { start: number; end: number; tag: string };\ntype MentionEntity = { start: number; end: string; username: string };\n\nexport interface XToken extends OAuth2Token {\n  token_type: string;\n  expires_in: number;\n  access_token: string;\n  scope: string;\n  refresh_token: string;\n}\n\ntype XErrorResponse = { error: string; error_description: string };\ntype XAPIErrorResponse = {\n  errors: { title: string; type: string; detail?: string; status?: number }[];\n};\n"],"mappings":";AAAA,OAAO,eAAe;AAEtB,SAAS,mBAAmB;AAC5B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAMP,IAAM,oBAAoB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,gBAAgB,SAA8B;AAC5D,SAAO;AAAA,IACL,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,gBAAgB;AAAA;AAAA,IAEhB,aAAa;AAAA,IACb,cAAc,CAAC,cAAc,cAAc,gBAAgB;AAAA,IAC3D,uBAAuB,QAAQ;AAC7B,UAAI,CAAC,OAAO,KAAM,OAAM,IAAI,MAAM,wBAAwB;AAC1D,aAAO,uBAAuB;AAAA,QAC5B,GAAG;AAAA,QACH,OAAO,OAAO,SAAS,KAAK;AAAA,QAC5B,kBAAkB,KAAK;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,0BAA0B,QAAQ;AACtC,UAAI,CAAC,OAAO,KAAM,OAAM,IAAI,MAAM,wBAAwB;AAC1D,YAAM,WAAW,MAAM,0BAA0B;AAAA,QAC/C,GAAG;AAAA,QACH,UAAU,KAAK;AAAA,QACf,gBAAgB;AAAA,MAClB,CAAC;AACD,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,OAAO,kBAAkB,IAAK,MAAM,SAAS,KAAK;AAC1D,cAAM,IAAI,YAAY,SAAS,QAAQ,OAAO,iBAAiB;AAAA,MACjE;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,EAAE,aAAa,GAAG;AAClC,gBAAU,cAAc,0BAA0B;AAClD,gBAAU,KAAK,aAAa,yBAAyB;AAErD,YAAM,aAAa,SAAS,cAAc;AAC1C,YAAM,UAAU,EAAE,QAAQ,oBAAoB,eAAe,UAAU,YAAY,GAAG;AAEtF,YAAM,MAAM,IAAI,IAAI,KAAK,WAAW;AACpC,iBAAW,QAAQ,CAAC,UAAU,IAAI,aAAa,OAAO,eAAe,KAAK,CAAC;AAE3E,YAAM,WAAW,MAAM,MAAM,KAAK,aAAa,EAAE,QAAQ,CAAC;AAC1D,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,OAAO,IAAK,MAAM,SAAS,KAAK;AACxC,cAAM,IAAI;AAAA,UACR,SAAS;AAAA,UACT;AAAA,UACA,iCAAiC,OAAO,GAAG,CAAC,GAAG,UAAU,OAAO,GAAG,CAAC,GAAG;AAAA,QACzE;AAAA,MACF;AACA,YAAM,UAAW,MAAM,SAAS,KAAK;AACrC,aAAO;AAAA,QACL,MAAM;AAAA,QACN,QAAQ;AAAA,UACN,KAAK,QAAQ,KAAK;AAAA,UAClB,MAAM,QAAQ,KAAK;AAAA,UACnB,SAAS,QAAQ,KAAK;AAAA,UACtB,OAAO,QAAQ,KAAK;AAAA,UACpB,gBAAgB,QAAQ,KAAK,YAAY;AAAA,UACzC,oBAAoB,QAAQ,KAAK;AAAA,UACjC,SAAS,iBAAiB,QAAQ,KAAK,QAAQ;AAAA,UAC/C,SAAS,QAAQ,KAAK;AAAA,QACxB;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,mBAAmB,QAAQ;AAC/B,YAAM,WAAW,MAAM,mBAAmB;AAAA,QACxC,GAAG;AAAA,QACH,UAAU,KAAK;AAAA,QACf,gBAAgB;AAAA,MAClB,CAAC;AACD,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,OAAO,kBAAkB,IAAK,MAAM,SAAS,KAAK;AAC1D,cAAM,IAAI,YAAY,SAAS,QAAQ,OAAO,iBAAiB;AAAA,MACjE;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,QAAQ;AACxB,gBAAU,KAAK,gBAAgB,4BAA4B;AAC3D,aAAO,YAAY;AAAA,QACjB,GAAG;AAAA,QACH,gBAAgB,KAAK;AAAA,QACrB,gBAAgB;AAAA,MAClB,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEO,IAAM,IAAI,gBAAgB;","names":[]}
+{"version":3,"sources":["../../../src/oauth2/provider/x.ts"],"sourcesContent":["import invariant from 'tiny-invariant';\nimport { OAuth2Token, Provider } from '../types';\nimport { OAuth2Error } from '../error';\nimport {\n  createAuthorizationUri,\n  exchangeAuthorizationCode,\n  refreshAccessToken,\n  revokeToken,\n} from './common';\n\nexport interface XOptions {\n  userFields?: UserField[];\n}\n\nconst defaultUserFields = [\n  'id',\n  'name',\n  'profile_image_url',\n  'url',\n  'username',\n  'location',\n  'verified',\n];\n\nexport function createXProvider(options?: XOptions): Provider {\n  return {\n    authorizationUri: 'https://x.com/i/oauth2/authorize',\n    tokenUri: 'https://api.x.com/2/oauth2/token',\n    tokenRefreshUri: 'https://api.x.com/2/oauth2/token',\n    tokenRevokeUri: 'https://api.x.com/2/oauth2/revoke',\n    // https://docs.x.com/x-api/users/user-lookup-me\n    userInfoUri: 'https://api.x.com/2/users/me',\n    defaultScope: ['users.read', 'tweet.read', 'offline.access'],\n    createAuthorizationUri(params) {\n      if (!params.pkce) throw new Error('pkce is required for x');\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode(params) {\n      if (!params.pkce) throw new Error('pkce is required for x');\n      const response = await exchangeAuthorizationCode({\n        ...params,\n        tokenUri: this.tokenUri,\n        authentication: 'basic',\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as XErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as XToken;\n    },\n    async getUserInfo({ access_token }) {\n      invariant(access_token, 'access_token is required');\n      invariant(this.userInfoUri, 'userInfoUri is required');\n\n      const userFields = options?.userFields ?? defaultUserFields;\n      const headers = { Accept: 'application/json', Authorization: `Bearer ${access_token}` };\n\n      const url = new URL(this.userInfoUri);\n      userFields.forEach((field) => url.searchParams.append('user.fields', field));\n\n      const response = await fetch(this.userInfoUri, { headers });\n      if (!response.ok) {\n        const { errors } = (await response.json()) as XAPIErrorResponse;\n        throw new OAuth2Error(\n          response.status,\n          'invalid_request',\n          'Failed to fetch user info: ' + (errors.at(0)?.detail ?? errors.at(0)?.title)\n        );\n      }\n      const profile = (await response.json()) as XUserInfo;\n      return {\n        data: profile,\n        claims: {\n          sub: profile.data.id,\n          name: profile.data.name,\n          picture: profile.data.profile_image_url,\n          email: profile.data.email,\n          email_verified: profile.data.verified || false,\n          preferred_username: profile.data.username,\n          profile: `https://x.com/${profile.data.username}`,\n          website: profile.data.url,\n        },\n      };\n    },\n    async refreshAccessToken(params) {\n      invariant(this.tokenRefreshUri, 'tokenRefreshUri is required');\n      const response = await refreshAccessToken({\n        ...params,\n        tokenUri: this.tokenRefreshUri,\n        authentication: 'basic',\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as XErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as XToken;\n    },\n    async revokeToken(params) {\n      invariant(this.tokenRevokeUri, 'tokenRevokeUri is required');\n      return revokeToken({\n        ...params,\n        tokenRevokeUri: this.tokenRevokeUri,\n        authentication: 'basic',\n      });\n    },\n  };\n}\n\nexport const x = createXProvider();\n\ntype UserField =\n  | 'affiliation'\n  | 'connection_status'\n  | 'created_at'\n  | 'description'\n  | 'entities'\n  | 'id'\n  | 'is_identity_verified'\n  | 'location'\n  | 'most_recent_tweet_id'\n  | 'name'\n  | 'parody'\n  | 'pinned_tweet_id'\n  | 'profile_banner_url'\n  | 'profile_image_url'\n  | 'protected'\n  | 'public_metrics'\n  | 'receives_your_dm'\n  | 'subscription'\n  | 'subscription_type'\n  | 'url'\n  | 'username'\n  | 'verified'\n  | 'verified_followers_count'\n  | 'verified_type'\n  | 'withheld';\n\nexport interface XUser {\n  id: string;\n  name: string;\n  email?: string;\n  username: string;\n  location?: string;\n  entities?: {\n    url: { urls: UrlEntity[] };\n    description: {\n      hashtags: HashtagEntity[];\n      cashtags: HashtagEntity[];\n      mentions: MentionEntity[];\n    };\n  };\n  verified?: boolean;\n  description?: string;\n  url?: string;\n  profile_image_url?: string;\n  protected?: boolean;\n  pinned_tweet_id?: string;\n  created_at?: string;\n}\n\nexport interface XUserInfo {\n  data: XUser;\n  includes?: { tweets?: { id: string; text: string }[]; users?: XUser[] };\n}\n\n// prettier-ignore\ntype UrlEntity = { start: number; end: number; url: string; display_url: string; expanded_url: string; }\ntype HashtagEntity = { start: number; end: number; tag: string };\ntype MentionEntity = { start: number; end: string; username: string };\n\nexport interface XToken extends OAuth2Token {\n  token_type: string;\n  expires_in: number;\n  access_token: string;\n  scope: string;\n  refresh_token: string;\n}\n\ntype XErrorResponse = { error: string; error_description: string };\ntype XAPIErrorResponse = {\n  errors: { title: string; type: string; detail?: string; status?: number }[];\n};\n"],"mappings":";AAAA,OAAO,eAAe;AAEtB,SAAS,mBAAmB;AAC5B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAMP,IAAM,oBAAoB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,gBAAgB,SAA8B;AAC5D,SAAO;AAAA,IACL,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,iBAAiB;AAAA,IACjB,gBAAgB;AAAA;AAAA,IAEhB,aAAa;AAAA,IACb,cAAc,CAAC,cAAc,cAAc,gBAAgB;AAAA,IAC3D,uBAAuB,QAAQ;AAC7B,UAAI,CAAC,OAAO,KAAM,OAAM,IAAI,MAAM,wBAAwB;AAC1D,aAAO,uBAAuB;AAAA,QAC5B,GAAG;AAAA,QACH,OAAO,OAAO,SAAS,KAAK;AAAA,QAC5B,kBAAkB,KAAK;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,0BAA0B,QAAQ;AACtC,UAAI,CAAC,OAAO,KAAM,OAAM,IAAI,MAAM,wBAAwB;AAC1D,YAAM,WAAW,MAAM,0BAA0B;AAAA,QAC/C,GAAG;AAAA,QACH,UAAU,KAAK;AAAA,QACf,gBAAgB;AAAA,MAClB,CAAC;AACD,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,OAAO,kBAAkB,IAAK,MAAM,SAAS,KAAK;AAC1D,cAAM,IAAI,YAAY,SAAS,QAAQ,OAAO,iBAAiB;AAAA,MACjE;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,EAAE,aAAa,GAAG;AAClC,gBAAU,cAAc,0BAA0B;AAClD,gBAAU,KAAK,aAAa,yBAAyB;AAErD,YAAM,aAAa,SAAS,cAAc;AAC1C,YAAM,UAAU,EAAE,QAAQ,oBAAoB,eAAe,UAAU,YAAY,GAAG;AAEtF,YAAM,MAAM,IAAI,IAAI,KAAK,WAAW;AACpC,iBAAW,QAAQ,CAAC,UAAU,IAAI,aAAa,OAAO,eAAe,KAAK,CAAC;AAE3E,YAAM,WAAW,MAAM,MAAM,KAAK,aAAa,EAAE,QAAQ,CAAC;AAC1D,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,OAAO,IAAK,MAAM,SAAS,KAAK;AACxC,cAAM,IAAI;AAAA,UACR,SAAS;AAAA,UACT;AAAA,UACA,iCAAiC,OAAO,GAAG,CAAC,GAAG,UAAU,OAAO,GAAG,CAAC,GAAG;AAAA,QACzE;AAAA,MACF;AACA,YAAM,UAAW,MAAM,SAAS,KAAK;AACrC,aAAO;AAAA,QACL,MAAM;AAAA,QACN,QAAQ;AAAA,UACN,KAAK,QAAQ,KAAK;AAAA,UAClB,MAAM,QAAQ,KAAK;AAAA,UACnB,SAAS,QAAQ,KAAK;AAAA,UACtB,OAAO,QAAQ,KAAK;AAAA,UACpB,gBAAgB,QAAQ,KAAK,YAAY;AAAA,UACzC,oBAAoB,QAAQ,KAAK;AAAA,UACjC,SAAS,iBAAiB,QAAQ,KAAK,QAAQ;AAAA,UAC/C,SAAS,QAAQ,KAAK;AAAA,QACxB;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,mBAAmB,QAAQ;AAC/B,gBAAU,KAAK,iBAAiB,6BAA6B;AAC7D,YAAM,WAAW,MAAM,mBAAmB;AAAA,QACxC,GAAG;AAAA,QACH,UAAU,KAAK;AAAA,QACf,gBAAgB;AAAA,MAClB,CAAC;AACD,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,OAAO,kBAAkB,IAAK,MAAM,SAAS,KAAK;AAC1D,cAAM,IAAI,YAAY,SAAS,QAAQ,OAAO,iBAAiB;AAAA,MACjE;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,QAAQ;AACxB,gBAAU,KAAK,gBAAgB,4BAA4B;AAC3D,aAAO,YAAY;AAAA,QACjB,GAAG;AAAA,QACH,gBAAgB,KAAK;AAAA,QACrB,gBAAgB;AAAA,MAClB,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEO,IAAM,IAAI,gBAAgB;","names":[]}

package/dist/oauth2/types.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/oauth2/types.ts"],"sourcesContent":["// reference: https://datatracker.ietf.org/doc/html/rfc7636\nexport interface PkceParameters {\n  code_verifier: string;\n  code_challenge: string;\n  code_challenge_method: 'S256' | 'plain';\n}\n\nexport interface OAuth2AuthorizationRequest {\n  state: string;\n  registrationId: string;\n  authorizationRequestUri: string;\n  additionalParameters: PkceParameters;\n}\n\ninterface CreateAuthorizationUriParams {\n  state: string;\n  clientId: string;\n  redirectUri: string;\n  scope: string[] | undefined;\n  pkce?: Omit<PkceParameters, 'code_verifier'>;\n}\n\nexport interface ExchangeCodeParams {\n  code: string;\n  clientId: string;\n  clientSecret: string;\n  redirectUri: string;\n  pkce?: Omit<PkceParameters, 'code_challenge' | 'code_challenge_method'>;\n}\n\nexport interface RefreshTokenParams {\n  clientId: string;\n  clientSecret: string;\n  refreshToken: string;\n}\n\nexport interface RevokeTokenParams {\n  token: string;\n  clientId: string;\n  clientSecret: string;\n}\n\nexport interface LoginOAuth2NativeParams {\n  clientId: string;\n  clientSecret: string;\n  redirectUri: string;\n  pkce?: PkceParameters;\n  credentials: NativeCredential;\n}\n\n// reference: https://datatracker.ietf.org/doc/html/rfc6749#section-5.1\nexport interface OAuth2Token {\n  /**\n   * REQUIRED.\n   * The access token issued by the authorization server.\n   */\n  access_token: string;\n\n  /**\n   * REQUIRED.\n   * The type of the token issued as described in Section 7.1.  Value is case insensitive.\n   */\n  token_type: 'Bearer' | 'bearer' | 'mac' | (string & {});\n\n  /**\n   * RECOMMENDED.\n   * The lifetime in seconds of the access token. For example, the value \"3600\" denotes that the\n   * access token will expire in one hour from the time the response was generated. If omitted, the\n   * authorization server SHOULD provide the expiration time via other means or document the default\n   * value.\n   */\n  expires_in?: number;\n\n  /**\n   * OPTIONAL.\n   * The refresh token, which can be used to obtain new access tokens using the same authorization\n   * grant as described in Section 6.\n   */\n  refresh_token?: string;\n\n  /**\n   * OPTIONAL.\n   * If identical to the scope requested by the client; otherwise, REQUIRED. The scope of the\n   * access token as described by Section 3.3.\n   */\n  scope?: string;\n\n  id_token?: string;\n}\n\nexport interface OidcToken extends OAuth2Token {\n  id_token: string;\n}\n\nexport type NativeCredential = {\n  state?: string;\n  code?: string;\n  client_id?: string;\n  redirect_uri?: string;\n  id_token?: string;\n  access_token?: string;\n};\n\nexport enum OidcScopes {\n  openid = 'openid',\n  profile = 'profile',\n  email = 'email',\n  phone = 'phone',\n  address = 'address',\n  offline_access = 'offline_access',\n}\n\n// https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims\nexport interface StandardClaims {\n  sub: string;\n  name?: string;\n  given_name?: string;\n  family_name?: string;\n  middle_name?: string;\n  nickname?: string;\n  preferred_username?: string;\n  profile?: string;\n  picture?: string;\n  website?: string;\n  email?: string;\n  email_verified?: boolean;\n  gender?: 'female' | 'male' | string;\n  birthdate?: string; // ISO 8601-1 [ISO8601‑1] YYYY-MM-DD format.\n  zoneinfo?: string; // IANA Time Zone Database [IANA.time‑zones]\n  locale?: string; // BCP47 [RFC5646] language tag.\n  phone_number?: string; // E.164\n  phone_number_verified?: boolean;\n  address?: {\n    formatted: string;\n    street_address: string;\n    locality: string;\n    region: string;\n    postal_code: string;\n    country: string;\n  }; // [RFC8259] JSON object\n  updated_at?: number;\n}\n\nexport interface UserInfo<T = unknown> {\n  claims: StandardClaims;\n  data: T;\n}\n\nexport interface Provider {\n  /** Authorization URI for the provider. */\n  authorizationUri: string;\n\n  /** Token URI for the provider. */\n  tokenUri: string;\n\n  tokenRevokeUri?: string;\n\n  /** User info URI for the provider. */\n  userInfoUri?: string;\n\n  /** User info authentication method for the provider. */\n  userInfoAuthenticationMethod?: string;\n\n  /**\n   * Name of the attribute that will be used to extract the username from the call to 'userInfoUri'.\n   * */\n  userNameAttribute?: string;\n\n  /** JWK set URI for the provider */\n  jwkSetUri?: string;\n\n  /**\n   * URI that can either be an OpenID Connect discovery endpoint or an OAuth 2.0 Authorization\n   * Server Metadata endpoint defined by RFC 8414.\n   * */\n  issuerUri?: string;\n\n  /** Default scopes for the provider. */\n  defaultScope: string[];\n\n  /** step 1: generate authorization uri and redirect user to it */\n  createAuthorizationUri: (params: CreateAuthorizationUriParams) => URL;\n\n  /** step 2: exchange code for token */\n  exchangeAuthorizationCode: (params: ExchangeCodeParams) => Promise<OAuth2Token>;\n\n  /** step 3: get user info */\n  getUserInfo: (token: OAuth2Token) => Promise<UserInfo>;\n\n  /** others: refresh access token */\n  refreshAccessToken?: (params: RefreshTokenParams) => Promise<OAuth2Token>;\n\n  /** others: revoke token */\n  revokeToken?: (params: RevokeTokenParams) => Promise<void>;\n\n  loginOAuth2Native?: (\n    params: LoginOAuth2NativeParams\n  ) => Promise<{ token: OAuth2Token; userInfo: UserInfo }>;\n}\n\nexport interface OneTapProvider extends Provider {\n  getTokenInfo: (id_token: string) => Promise<{ token: OAuth2Token; userInfo: UserInfo }>;\n}\n\nexport interface Registration {\n  /**\n   * Reference to the OAuth 2.0 provider to use. May reference an element from the 'provider'\n   * property or used one of the commonly used providers (google, github, facebook, okta).\n   * */\n  provider?: string;\n\n  /** Client ID for the registration. */\n  clientId: string;\n\n  /** Client secret of the registration. */\n  clientSecret: string;\n\n  /** Client authentication method. May be left blank when using a pre-defined provider. */\n  clientAuthenticationMethod?: string;\n\n  /** Authorization grant type. May be left blank when using a pre-defined provider. */\n  authorizationGrantType?:\n    | 'authorization_code' // default\n    | 'client_credentials'\n    | 'device_code'\n    | 'jwt_bearer'\n    // Deprecated. The latest OAuth 2.0 Security Best Current Practice disallows the use of the\n    // Resource Owner Password Credentials grant.\n    | 'password'\n    | 'refresh_token'\n    | 'token_exchange';\n\n  /** Redirect URI. May be left blank when using a pre-defined provider. */\n  redirectUri?: string;\n\n  /** Authorization scopes. When left blank the provider's default scopes, if any, will be used. */\n  scope?: string[];\n\n  /** Client name. May be left blank when using a pre-defined provider. */\n  clientName?: string;\n}\n\nexport interface OAuth2ClientConfig {\n  baseUri: string;\n  errorUri: string;\n  successUri: string;\n  provider: { [name: string]: Provider | undefined };\n  registration: { [name: string]: Registration | undefined };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAuGO,IAAK,aAAL,kBAAKA,gBAAL;AACL,EAAAA,YAAA,YAAS;AACT,EAAAA,YAAA,aAAU;AACV,EAAAA,YAAA,WAAQ;AACR,EAAAA,YAAA,WAAQ;AACR,EAAAA,YAAA,aAAU;AACV,EAAAA,YAAA,oBAAiB;AANP,SAAAA;AAAA,GAAA;","names":["OidcScopes"]}
+{"version":3,"sources":["../../src/oauth2/types.ts"],"sourcesContent":["// reference: https://datatracker.ietf.org/doc/html/rfc7636\nexport interface PkceParameters {\n  code_verifier: string;\n  code_challenge: string;\n  code_challenge_method: 'S256' | 'plain';\n}\n\nexport interface OAuth2AuthorizationRequest {\n  state: string;\n  registrationId: string;\n  authorizationRequestUri: string;\n  additionalParameters: PkceParameters;\n}\n\ninterface CreateAuthorizationUriParams {\n  state: string;\n  clientId: string;\n  redirectUri: string;\n  scope: string[] | undefined;\n  pkce?: Omit<PkceParameters, 'code_verifier'>;\n}\n\nexport interface ExchangeCodeParams {\n  code: string;\n  clientId: string;\n  clientSecret: string;\n  redirectUri: string;\n  pkce?: Omit<PkceParameters, 'code_challenge' | 'code_challenge_method'>;\n}\n\nexport interface RefreshTokenParams {\n  clientId: string;\n  clientSecret: string;\n  refreshToken: string;\n}\n\nexport interface RevokeTokenParams {\n  token: string;\n  clientId: string;\n  clientSecret: string;\n}\n\nexport interface LoginOAuth2NativeParams {\n  clientId: string;\n  clientSecret: string;\n  redirectUri: string;\n  pkce?: PkceParameters;\n  credentials: NativeCredential;\n}\n\n// reference: https://datatracker.ietf.org/doc/html/rfc6749#section-5.1\nexport interface OAuth2Token {\n  /**\n   * REQUIRED.\n   * The access token issued by the authorization server.\n   */\n  access_token: string;\n\n  /**\n   * REQUIRED.\n   * The type of the token issued as described in Section 7.1.  Value is case insensitive.\n   */\n  token_type: 'Bearer' | 'bearer' | 'mac' | (string & {});\n\n  /**\n   * RECOMMENDED.\n   * The lifetime in seconds of the access token. For example, the value \"3600\" denotes that the\n   * access token will expire in one hour from the time the response was generated. If omitted, the\n   * authorization server SHOULD provide the expiration time via other means or document the default\n   * value.\n   */\n  expires_in?: number;\n\n  /**\n   * OPTIONAL.\n   * The refresh token, which can be used to obtain new access tokens using the same authorization\n   * grant as described in Section 6.\n   */\n  refresh_token?: string;\n\n  /**\n   * OPTIONAL.\n   * If identical to the scope requested by the client; otherwise, REQUIRED. The scope of the\n   * access token as described by Section 3.3.\n   */\n  scope?: string;\n\n  id_token?: string;\n\n  [key: string]: unknown;\n}\n\nexport interface OidcToken extends OAuth2Token {\n  id_token: string;\n}\n\nexport type NativeCredential = {\n  state?: string;\n  code?: string;\n  client_id?: string;\n  redirect_uri?: string;\n  id_token?: string;\n  access_token?: string;\n};\n\nexport enum OidcScopes {\n  openid = 'openid',\n  profile = 'profile',\n  email = 'email',\n  phone = 'phone',\n  address = 'address',\n  offline_access = 'offline_access',\n}\n\n// https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims\nexport interface StandardClaims {\n  sub: string;\n  name?: string;\n  given_name?: string;\n  family_name?: string;\n  middle_name?: string;\n  nickname?: string;\n  preferred_username?: string;\n  profile?: string;\n  picture?: string;\n  website?: string;\n  email?: string;\n  email_verified?: boolean;\n  gender?: 'female' | 'male' | string;\n  birthdate?: string; // ISO 8601-1 [ISO8601‑1] YYYY-MM-DD format.\n  zoneinfo?: string; // IANA Time Zone Database [IANA.time‑zones]\n  locale?: string; // BCP47 [RFC5646] language tag.\n  phone_number?: string; // E.164\n  phone_number_verified?: boolean;\n  address?: {\n    formatted: string;\n    street_address: string;\n    locality: string;\n    region: string;\n    postal_code: string;\n    country: string;\n  }; // [RFC8259] JSON object\n  updated_at?: number;\n}\n\nexport interface UserInfo<T = unknown> {\n  claims: StandardClaims;\n  data: T;\n}\n\nexport interface Provider {\n  /** Authorization URI for the provider. */\n  authorizationUri: string;\n\n  /** Token URI for the provider. */\n  tokenUri: string;\n\n  /** Token revoke URI for the provider. */\n  tokenRevokeUri?: string;\n\n  /** Token refresh URI for the provider. */\n  tokenRefreshUri?: string;\n\n  /** User info URI for the provider. */\n  userInfoUri?: string;\n\n  /** User info authentication method for the provider. */\n  userInfoAuthenticationMethod?: string;\n\n  /**\n   * Name of the attribute that will be used to extract the username from the call to 'userInfoUri'.\n   * */\n  userNameAttribute?: string;\n\n  /** JWK set URI for the provider */\n  jwkSetUri?: string;\n\n  /**\n   * URI that can either be an OpenID Connect discovery endpoint or an OAuth 2.0 Authorization\n   * Server Metadata endpoint defined by RFC 8414.\n   * */\n  issuerUri?: string;\n\n  /** Default scopes for the provider. */\n  defaultScope: string[];\n\n  /** step 1: generate authorization uri and redirect user to it */\n  createAuthorizationUri: (params: CreateAuthorizationUriParams) => URL;\n\n  /** step 2: exchange code for token */\n  exchangeAuthorizationCode: (params: ExchangeCodeParams) => Promise<OAuth2Token>;\n\n  /** step 3: get user info */\n  getUserInfo: (token: OAuth2Token) => Promise<UserInfo>;\n\n  /** others: refresh access token */\n  refreshAccessToken?: (params: RefreshTokenParams) => Promise<OAuth2Token>;\n\n  /** others: revoke token */\n  revokeToken?: (params: RevokeTokenParams) => Promise<void>;\n\n  loginOAuth2Native?: (\n    params: LoginOAuth2NativeParams\n  ) => Promise<{ token: OAuth2Token; userInfo: UserInfo }>;\n}\n\nexport interface OneTapProvider extends Provider {\n  getTokenInfo: (id_token: string) => Promise<{ token: OAuth2Token; userInfo: UserInfo }>;\n}\n\nexport interface Registration {\n  /**\n   * Reference to the OAuth 2.0 provider to use. May reference an element from the 'provider'\n   * property or used one of the commonly used providers (google, github, facebook, okta).\n   * */\n  provider?: string;\n\n  /** Client ID for the registration. */\n  clientId: string;\n\n  /** Client secret of the registration. */\n  clientSecret: string;\n\n  /** Client authentication method. May be left blank when using a pre-defined provider. */\n  clientAuthenticationMethod?: string;\n\n  /** Authorization grant type. May be left blank when using a pre-defined provider. */\n  authorizationGrantType?:\n    | 'authorization_code' // default\n    | 'client_credentials'\n    | 'device_code'\n    | 'jwt_bearer'\n    // Deprecated. The latest OAuth 2.0 Security Best Current Practice disallows the use of the\n    // Resource Owner Password Credentials grant.\n    | 'password'\n    | 'refresh_token'\n    | 'token_exchange';\n\n  /** Redirect URI. May be left blank when using a pre-defined provider. */\n  redirectUri?: string;\n\n  /** Authorization scopes. When left blank the provider's default scopes, if any, will be used. */\n  scope?: string[];\n\n  /** Client name. May be left blank when using a pre-defined provider. */\n  clientName?: string;\n}\n\nexport interface OAuth2ClientConfig {\n  baseUri: string;\n  errorUri: string;\n  successUri: string;\n  provider: { [name: string]: Provider | undefined };\n  registration: { [name: string]: Registration | undefined };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAyGO,IAAK,aAAL,kBAAKA,gBAAL;AACL,EAAAA,YAAA,YAAS;AACT,EAAAA,YAAA,aAAU;AACV,EAAAA,YAAA,WAAQ;AACR,EAAAA,YAAA,WAAQ;AACR,EAAAA,YAAA,aAAU;AACV,EAAAA,YAAA,oBAAiB;AANP,SAAAA;AAAA,GAAA;","names":["OidcScopes"]}

package/dist/oauth2/types.d.cts

@@ -72,6 +72,7 @@ interface OAuth2Token {
      */
     scope?: string;
     id_token?: string;
+    [key: string]: unknown;
 }
 interface OidcToken extends OAuth2Token {
     id_token: string;
@@ -130,7 +131,10 @@ interface Provider {
     authorizationUri: string;
     /** Token URI for the provider. */
     tokenUri: string;
+    /** Token revoke URI for the provider. */
     tokenRevokeUri?: string;
+    /** Token refresh URI for the provider. */
+    tokenRefreshUri?: string;
     /** User info URI for the provider. */
     userInfoUri?: string;
     /** User info authentication method for the provider. */

package/dist/oauth2/types.d.ts

@@ -72,6 +72,7 @@ interface OAuth2Token {
      */
     scope?: string;
     id_token?: string;
+    [key: string]: unknown;
 }
 interface OidcToken extends OAuth2Token {
     id_token: string;
@@ -130,7 +131,10 @@ interface Provider {
     authorizationUri: string;
     /** Token URI for the provider. */
     tokenUri: string;
+    /** Token revoke URI for the provider. */
     tokenRevokeUri?: string;
+    /** Token refresh URI for the provider. */
+    tokenRefreshUri?: string;
     /** User info URI for the provider. */
     userInfoUri?: string;
     /** User info authentication method for the provider. */

package/dist/oauth2/types.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/oauth2/types.ts"],"sourcesContent":["// reference: https://datatracker.ietf.org/doc/html/rfc7636\nexport interface PkceParameters {\n  code_verifier: string;\n  code_challenge: string;\n  code_challenge_method: 'S256' | 'plain';\n}\n\nexport interface OAuth2AuthorizationRequest {\n  state: string;\n  registrationId: string;\n  authorizationRequestUri: string;\n  additionalParameters: PkceParameters;\n}\n\ninterface CreateAuthorizationUriParams {\n  state: string;\n  clientId: string;\n  redirectUri: string;\n  scope: string[] | undefined;\n  pkce?: Omit<PkceParameters, 'code_verifier'>;\n}\n\nexport interface ExchangeCodeParams {\n  code: string;\n  clientId: string;\n  clientSecret: string;\n  redirectUri: string;\n  pkce?: Omit<PkceParameters, 'code_challenge' | 'code_challenge_method'>;\n}\n\nexport interface RefreshTokenParams {\n  clientId: string;\n  clientSecret: string;\n  refreshToken: string;\n}\n\nexport interface RevokeTokenParams {\n  token: string;\n  clientId: string;\n  clientSecret: string;\n}\n\nexport interface LoginOAuth2NativeParams {\n  clientId: string;\n  clientSecret: string;\n  redirectUri: string;\n  pkce?: PkceParameters;\n  credentials: NativeCredential;\n}\n\n// reference: https://datatracker.ietf.org/doc/html/rfc6749#section-5.1\nexport interface OAuth2Token {\n  /**\n   * REQUIRED.\n   * The access token issued by the authorization server.\n   */\n  access_token: string;\n\n  /**\n   * REQUIRED.\n   * The type of the token issued as described in Section 7.1.  Value is case insensitive.\n   */\n  token_type: 'Bearer' | 'bearer' | 'mac' | (string & {});\n\n  /**\n   * RECOMMENDED.\n   * The lifetime in seconds of the access token. For example, the value \"3600\" denotes that the\n   * access token will expire in one hour from the time the response was generated. If omitted, the\n   * authorization server SHOULD provide the expiration time via other means or document the default\n   * value.\n   */\n  expires_in?: number;\n\n  /**\n   * OPTIONAL.\n   * The refresh token, which can be used to obtain new access tokens using the same authorization\n   * grant as described in Section 6.\n   */\n  refresh_token?: string;\n\n  /**\n   * OPTIONAL.\n   * If identical to the scope requested by the client; otherwise, REQUIRED. The scope of the\n   * access token as described by Section 3.3.\n   */\n  scope?: string;\n\n  id_token?: string;\n}\n\nexport interface OidcToken extends OAuth2Token {\n  id_token: string;\n}\n\nexport type NativeCredential = {\n  state?: string;\n  code?: string;\n  client_id?: string;\n  redirect_uri?: string;\n  id_token?: string;\n  access_token?: string;\n};\n\nexport enum OidcScopes {\n  openid = 'openid',\n  profile = 'profile',\n  email = 'email',\n  phone = 'phone',\n  address = 'address',\n  offline_access = 'offline_access',\n}\n\n// https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims\nexport interface StandardClaims {\n  sub: string;\n  name?: string;\n  given_name?: string;\n  family_name?: string;\n  middle_name?: string;\n  nickname?: string;\n  preferred_username?: string;\n  profile?: string;\n  picture?: string;\n  website?: string;\n  email?: string;\n  email_verified?: boolean;\n  gender?: 'female' | 'male' | string;\n  birthdate?: string; // ISO 8601-1 [ISO8601‑1] YYYY-MM-DD format.\n  zoneinfo?: string; // IANA Time Zone Database [IANA.time‑zones]\n  locale?: string; // BCP47 [RFC5646] language tag.\n  phone_number?: string; // E.164\n  phone_number_verified?: boolean;\n  address?: {\n    formatted: string;\n    street_address: string;\n    locality: string;\n    region: string;\n    postal_code: string;\n    country: string;\n  }; // [RFC8259] JSON object\n  updated_at?: number;\n}\n\nexport interface UserInfo<T = unknown> {\n  claims: StandardClaims;\n  data: T;\n}\n\nexport interface Provider {\n  /** Authorization URI for the provider. */\n  authorizationUri: string;\n\n  /** Token URI for the provider. */\n  tokenUri: string;\n\n  tokenRevokeUri?: string;\n\n  /** User info URI for the provider. */\n  userInfoUri?: string;\n\n  /** User info authentication method for the provider. */\n  userInfoAuthenticationMethod?: string;\n\n  /**\n   * Name of the attribute that will be used to extract the username from the call to 'userInfoUri'.\n   * */\n  userNameAttribute?: string;\n\n  /** JWK set URI for the provider */\n  jwkSetUri?: string;\n\n  /**\n   * URI that can either be an OpenID Connect discovery endpoint or an OAuth 2.0 Authorization\n   * Server Metadata endpoint defined by RFC 8414.\n   * */\n  issuerUri?: string;\n\n  /** Default scopes for the provider. */\n  defaultScope: string[];\n\n  /** step 1: generate authorization uri and redirect user to it */\n  createAuthorizationUri: (params: CreateAuthorizationUriParams) => URL;\n\n  /** step 2: exchange code for token */\n  exchangeAuthorizationCode: (params: ExchangeCodeParams) => Promise<OAuth2Token>;\n\n  /** step 3: get user info */\n  getUserInfo: (token: OAuth2Token) => Promise<UserInfo>;\n\n  /** others: refresh access token */\n  refreshAccessToken?: (params: RefreshTokenParams) => Promise<OAuth2Token>;\n\n  /** others: revoke token */\n  revokeToken?: (params: RevokeTokenParams) => Promise<void>;\n\n  loginOAuth2Native?: (\n    params: LoginOAuth2NativeParams\n  ) => Promise<{ token: OAuth2Token; userInfo: UserInfo }>;\n}\n\nexport interface OneTapProvider extends Provider {\n  getTokenInfo: (id_token: string) => Promise<{ token: OAuth2Token; userInfo: UserInfo }>;\n}\n\nexport interface Registration {\n  /**\n   * Reference to the OAuth 2.0 provider to use. May reference an element from the 'provider'\n   * property or used one of the commonly used providers (google, github, facebook, okta).\n   * */\n  provider?: string;\n\n  /** Client ID for the registration. */\n  clientId: string;\n\n  /** Client secret of the registration. */\n  clientSecret: string;\n\n  /** Client authentication method. May be left blank when using a pre-defined provider. */\n  clientAuthenticationMethod?: string;\n\n  /** Authorization grant type. May be left blank when using a pre-defined provider. */\n  authorizationGrantType?:\n    | 'authorization_code' // default\n    | 'client_credentials'\n    | 'device_code'\n    | 'jwt_bearer'\n    // Deprecated. The latest OAuth 2.0 Security Best Current Practice disallows the use of the\n    // Resource Owner Password Credentials grant.\n    | 'password'\n    | 'refresh_token'\n    | 'token_exchange';\n\n  /** Redirect URI. May be left blank when using a pre-defined provider. */\n  redirectUri?: string;\n\n  /** Authorization scopes. When left blank the provider's default scopes, if any, will be used. */\n  scope?: string[];\n\n  /** Client name. May be left blank when using a pre-defined provider. */\n  clientName?: string;\n}\n\nexport interface OAuth2ClientConfig {\n  baseUri: string;\n  errorUri: string;\n  successUri: string;\n  provider: { [name: string]: Provider | undefined };\n  registration: { [name: string]: Registration | undefined };\n}\n"],"mappings":";AAuGO,IAAK,aAAL,kBAAKA,gBAAL;AACL,EAAAA,YAAA,YAAS;AACT,EAAAA,YAAA,aAAU;AACV,EAAAA,YAAA,WAAQ;AACR,EAAAA,YAAA,WAAQ;AACR,EAAAA,YAAA,aAAU;AACV,EAAAA,YAAA,oBAAiB;AANP,SAAAA;AAAA,GAAA;","names":["OidcScopes"]}
+{"version":3,"sources":["../../src/oauth2/types.ts"],"sourcesContent":["// reference: https://datatracker.ietf.org/doc/html/rfc7636\nexport interface PkceParameters {\n  code_verifier: string;\n  code_challenge: string;\n  code_challenge_method: 'S256' | 'plain';\n}\n\nexport interface OAuth2AuthorizationRequest {\n  state: string;\n  registrationId: string;\n  authorizationRequestUri: string;\n  additionalParameters: PkceParameters;\n}\n\ninterface CreateAuthorizationUriParams {\n  state: string;\n  clientId: string;\n  redirectUri: string;\n  scope: string[] | undefined;\n  pkce?: Omit<PkceParameters, 'code_verifier'>;\n}\n\nexport interface ExchangeCodeParams {\n  code: string;\n  clientId: string;\n  clientSecret: string;\n  redirectUri: string;\n  pkce?: Omit<PkceParameters, 'code_challenge' | 'code_challenge_method'>;\n}\n\nexport interface RefreshTokenParams {\n  clientId: string;\n  clientSecret: string;\n  refreshToken: string;\n}\n\nexport interface RevokeTokenParams {\n  token: string;\n  clientId: string;\n  clientSecret: string;\n}\n\nexport interface LoginOAuth2NativeParams {\n  clientId: string;\n  clientSecret: string;\n  redirectUri: string;\n  pkce?: PkceParameters;\n  credentials: NativeCredential;\n}\n\n// reference: https://datatracker.ietf.org/doc/html/rfc6749#section-5.1\nexport interface OAuth2Token {\n  /**\n   * REQUIRED.\n   * The access token issued by the authorization server.\n   */\n  access_token: string;\n\n  /**\n   * REQUIRED.\n   * The type of the token issued as described in Section 7.1.  Value is case insensitive.\n   */\n  token_type: 'Bearer' | 'bearer' | 'mac' | (string & {});\n\n  /**\n   * RECOMMENDED.\n   * The lifetime in seconds of the access token. For example, the value \"3600\" denotes that the\n   * access token will expire in one hour from the time the response was generated. If omitted, the\n   * authorization server SHOULD provide the expiration time via other means or document the default\n   * value.\n   */\n  expires_in?: number;\n\n  /**\n   * OPTIONAL.\n   * The refresh token, which can be used to obtain new access tokens using the same authorization\n   * grant as described in Section 6.\n   */\n  refresh_token?: string;\n\n  /**\n   * OPTIONAL.\n   * If identical to the scope requested by the client; otherwise, REQUIRED. The scope of the\n   * access token as described by Section 3.3.\n   */\n  scope?: string;\n\n  id_token?: string;\n\n  [key: string]: unknown;\n}\n\nexport interface OidcToken extends OAuth2Token {\n  id_token: string;\n}\n\nexport type NativeCredential = {\n  state?: string;\n  code?: string;\n  client_id?: string;\n  redirect_uri?: string;\n  id_token?: string;\n  access_token?: string;\n};\n\nexport enum OidcScopes {\n  openid = 'openid',\n  profile = 'profile',\n  email = 'email',\n  phone = 'phone',\n  address = 'address',\n  offline_access = 'offline_access',\n}\n\n// https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims\nexport interface StandardClaims {\n  sub: string;\n  name?: string;\n  given_name?: string;\n  family_name?: string;\n  middle_name?: string;\n  nickname?: string;\n  preferred_username?: string;\n  profile?: string;\n  picture?: string;\n  website?: string;\n  email?: string;\n  email_verified?: boolean;\n  gender?: 'female' | 'male' | string;\n  birthdate?: string; // ISO 8601-1 [ISO8601‑1] YYYY-MM-DD format.\n  zoneinfo?: string; // IANA Time Zone Database [IANA.time‑zones]\n  locale?: string; // BCP47 [RFC5646] language tag.\n  phone_number?: string; // E.164\n  phone_number_verified?: boolean;\n  address?: {\n    formatted: string;\n    street_address: string;\n    locality: string;\n    region: string;\n    postal_code: string;\n    country: string;\n  }; // [RFC8259] JSON object\n  updated_at?: number;\n}\n\nexport interface UserInfo<T = unknown> {\n  claims: StandardClaims;\n  data: T;\n}\n\nexport interface Provider {\n  /** Authorization URI for the provider. */\n  authorizationUri: string;\n\n  /** Token URI for the provider. */\n  tokenUri: string;\n\n  /** Token revoke URI for the provider. */\n  tokenRevokeUri?: string;\n\n  /** Token refresh URI for the provider. */\n  tokenRefreshUri?: string;\n\n  /** User info URI for the provider. */\n  userInfoUri?: string;\n\n  /** User info authentication method for the provider. */\n  userInfoAuthenticationMethod?: string;\n\n  /**\n   * Name of the attribute that will be used to extract the username from the call to 'userInfoUri'.\n   * */\n  userNameAttribute?: string;\n\n  /** JWK set URI for the provider */\n  jwkSetUri?: string;\n\n  /**\n   * URI that can either be an OpenID Connect discovery endpoint or an OAuth 2.0 Authorization\n   * Server Metadata endpoint defined by RFC 8414.\n   * */\n  issuerUri?: string;\n\n  /** Default scopes for the provider. */\n  defaultScope: string[];\n\n  /** step 1: generate authorization uri and redirect user to it */\n  createAuthorizationUri: (params: CreateAuthorizationUriParams) => URL;\n\n  /** step 2: exchange code for token */\n  exchangeAuthorizationCode: (params: ExchangeCodeParams) => Promise<OAuth2Token>;\n\n  /** step 3: get user info */\n  getUserInfo: (token: OAuth2Token) => Promise<UserInfo>;\n\n  /** others: refresh access token */\n  refreshAccessToken?: (params: RefreshTokenParams) => Promise<OAuth2Token>;\n\n  /** others: revoke token */\n  revokeToken?: (params: RevokeTokenParams) => Promise<void>;\n\n  loginOAuth2Native?: (\n    params: LoginOAuth2NativeParams\n  ) => Promise<{ token: OAuth2Token; userInfo: UserInfo }>;\n}\n\nexport interface OneTapProvider extends Provider {\n  getTokenInfo: (id_token: string) => Promise<{ token: OAuth2Token; userInfo: UserInfo }>;\n}\n\nexport interface Registration {\n  /**\n   * Reference to the OAuth 2.0 provider to use. May reference an element from the 'provider'\n   * property or used one of the commonly used providers (google, github, facebook, okta).\n   * */\n  provider?: string;\n\n  /** Client ID for the registration. */\n  clientId: string;\n\n  /** Client secret of the registration. */\n  clientSecret: string;\n\n  /** Client authentication method. May be left blank when using a pre-defined provider. */\n  clientAuthenticationMethod?: string;\n\n  /** Authorization grant type. May be left blank when using a pre-defined provider. */\n  authorizationGrantType?:\n    | 'authorization_code' // default\n    | 'client_credentials'\n    | 'device_code'\n    | 'jwt_bearer'\n    // Deprecated. The latest OAuth 2.0 Security Best Current Practice disallows the use of the\n    // Resource Owner Password Credentials grant.\n    | 'password'\n    | 'refresh_token'\n    | 'token_exchange';\n\n  /** Redirect URI. May be left blank when using a pre-defined provider. */\n  redirectUri?: string;\n\n  /** Authorization scopes. When left blank the provider's default scopes, if any, will be used. */\n  scope?: string[];\n\n  /** Client name. May be left blank when using a pre-defined provider. */\n  clientName?: string;\n}\n\nexport interface OAuth2ClientConfig {\n  baseUri: string;\n  errorUri: string;\n  successUri: string;\n  provider: { [name: string]: Provider | undefined };\n  registration: { [name: string]: Registration | undefined };\n}\n"],"mappings":";AAyGO,IAAK,aAAL,kBAAKA,gBAAL;AACL,EAAAA,YAAA,YAAS;AACT,EAAAA,YAAA,aAAU;AACV,EAAAA,YAAA,WAAQ;AACR,EAAAA,YAAA,WAAQ;AACR,EAAAA,YAAA,aAAU;AACV,EAAAA,YAAA,oBAAiB;AANP,SAAAA;AAAA,GAAA;","names":["OidcScopes"]}

package/dist/utils/oauth2.cjs

@@ -0,0 +1,33 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/utils/oauth2.ts
+var oauth2_exports = {};
+__export(oauth2_exports, {
+  inWechatBrowser: () => inWechatBrowser
+});
+module.exports = __toCommonJS(oauth2_exports);
+function inWechatBrowser() {
+  return navigator.userAgent.includes("MicroMessenger");
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  inWechatBrowser
+});
+//# sourceMappingURL=oauth2.cjs.map

package/dist/utils/oauth2.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utils/oauth2.ts"],"sourcesContent":["export function inWechatBrowser() {\n  return navigator.userAgent.includes('MicroMessenger');\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAO,SAAS,kBAAkB;AAChC,SAAO,UAAU,UAAU,SAAS,gBAAgB;AACtD;","names":[]}

package/dist/utils/oauth2.d.cts

@@ -0,0 +1,3 @@
+declare function inWechatBrowser(): boolean;
+
+export { inWechatBrowser };

package/dist/utils/oauth2.d.ts

@@ -0,0 +1,3 @@
+declare function inWechatBrowser(): boolean;
+
+export { inWechatBrowser };

package/dist/utils/oauth2.mjs

@@ -0,0 +1,8 @@
+// src/utils/oauth2.ts
+function inWechatBrowser() {
+  return navigator.userAgent.includes("MicroMessenger");
+}
+export {
+  inWechatBrowser
+};
+//# sourceMappingURL=oauth2.mjs.map

package/dist/utils/oauth2.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utils/oauth2.ts"],"sourcesContent":["export function inWechatBrowser() {\n  return navigator.userAgent.includes('MicroMessenger');\n}\n"],"mappings":";AAAO,SAAS,kBAAkB;AAChC,SAAO,UAAU,UAAU,SAAS,gBAAgB;AACtD;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shware/security",
-  "version": "1.3.3",
+  "version": "1.3.5",
   "private": false,
   "type": "module",
   "scripts": {