@shware/security 4.0.0 → 5.0.0

package/dist/oauth2/provider/facebook.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"facebook.mjs","names":[],"sources":["../../../src/oauth2/provider/facebook.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport type { LoginOAuth2NativeParams, OAuth2Token, Provider } from '../types';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\n/**\n * ref: https://developers.facebook.com/docs/facebook-login/guides/advanced/manual-flow/\n * ref: https://developers.facebook.com/tools/explorer\n * */\nexport function createFacebookProvider(): Provider {\n  return {\n    authorizationUri: 'https://www.facebook.com/v21.0/dialog/oauth',\n    tokenUri: 'https://graph.facebook.com/v19.0/oauth/access_token',\n    userInfoUri: 'https://graph.facebook.com/me',\n    jwkSetUri: 'https://limited.facebook.com/.well-known/oauth/openid/jwks/',\n    userNameAttribute: 'id',\n    defaultScope: ['profile', 'email'],\n    createAuthorizationUri({ pkce: _, ...params }) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode({ pkce: _, ...params }) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error } = (await response.json()) as FacebookErrorResponse;\n        throw new OAuth2Error(response.status, 'invalid_request', error.message);\n      }\n      return (await response.json()) as FacebookToken;\n    },\n    async getUserInfo({ id_token, access_token }) {\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      if (id_token) {\n        const data = await verifyIdToken<FacebookDecodedIdToken>(id_token, this.jwkSetUri);\n        return {\n          data,\n          claims: {\n            sub: data.sub,\n            name: data.name,\n            picture: data.picture,\n            email: data.email,\n            email_verified: true,\n          },\n        };\n      }\n      invariant(access_token, 'access_token is required');\n      invariant(this.userInfoUri, 'userInfoUri is required');\n\n      const url = new URL(this.userInfoUri);\n      const fields = ['id', 'name', 'email', 'picture.width(320).height(320)'];\n      url.searchParams.append('access_token', access_token);\n      url.searchParams.append('fields', fields.join(','));\n      const headers = { Accept: 'application/json' };\n      const response = await fetch(url.href, { headers });\n      if (!response.ok) {\n        throw new OAuth2Error(response.status, 'invalid_request', 'Failed to fetch user info');\n      }\n      const data = (await response.json()) as FacebookUserInfo;\n      return {\n        data,\n        claims: {\n          sub: data.id,\n          name: data.name,\n          email: data.email,\n          picture: data.picture.data.url,\n          email_verified: data.email_verified,\n        },\n      };\n    },\n    async loginOAuth2Native({ credentials }: LoginOAuth2NativeParams) {\n      if (credentials.id_token || credentials.access_token) {\n        const userInfo = await this.getUserInfo(credentials as unknown as OAuth2Token);\n        const token: OAuth2Token = {\n          token_type: 'bearer',\n          access_token: credentials.access_token ?? '',\n          id_token: credentials.id_token,\n        };\n        return { token, userInfo };\n      } else {\n        throw new OAuth2Error(400, 'invalid_request', 'id_token or access_token is required');\n      }\n    },\n  };\n}\n\nexport const facebook = createFacebookProvider();\n\nexport interface FacebookDecodedIdToken {\n  sub: string;\n  name: string;\n  email: string;\n  picture: string;\n  nonce?: string;\n}\n\nexport interface FacebookUserInfo {\n  id: string;\n  name: string;\n  email: string;\n  email_verified: boolean;\n  picture: {\n    data: {\n      url: string;\n      width: number;\n      height: number;\n      is_silhouette: boolean;\n    };\n  };\n}\n\nexport interface FacebookToken extends OAuth2Token {\n  access_token: string;\n  token_type: 'bearer';\n  expires_in: number;\n  id_token?: string;\n}\n\nexport type FacebookAppCredential =\n  | { state: string; id_token: string } // platform=ios and tracking=limited\n  | { state: string; access_token: string }; // tracking=enabled\n\ninterface FacebookErrorResponse {\n  error: {\n    message: string;\n    type: 'OAuthException';\n    code: number;\n    error_subcode: number;\n    fbtrace_id: string;\n  };\n}\n"],"mappings":";;;;;;;;AASA,SAAgB,yBAAmC;CACjD,OAAO;EACL,kBAAkB;EAClB,UAAU;EACV,aAAa;EACb,WAAW;EACX,mBAAmB;EACnB,cAAc,CAAC,WAAW,OAAO;EACjC,uBAAuB,EAAE,MAAM,GAAG,GAAG,UAAU;GAC7C,OAAO,uBAAuB;IAC5B,GAAG;IACH,OAAO,OAAO,SAAS,KAAK;IAC5B,kBAAkB,KAAK;GACzB,CAAC;EACH;EACA,MAAM,0BAA0B,EAAE,MAAM,GAAG,GAAG,UAAU;GACtD,MAAM,WAAW,MAAM,0BAA0B;IAAE,GAAG;IAAQ,UAAU,KAAK;GAAS,CAAC;GACvF,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,UAAW,MAAM,SAAS,KAAK;IACvC,MAAM,IAAI,YAAY,SAAS,QAAQ,mBAAmB,MAAM,OAAO;GACzE;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,EAAE,UAAU,gBAAgB;GAC5C,UAAU,KAAK,WAAW,uBAAuB;GACjD,IAAI,UAAU;IACZ,MAAM,OAAO,MAAM,cAAsC,UAAU,KAAK,SAAS;IACjF,OAAO;KACL;KACA,QAAQ;MACN,KAAK,KAAK;MACV,MAAM,KAAK;MACX,SAAS,KAAK;MACd,OAAO,KAAK;MACZ,gBAAgB;KAClB;IACF;GACF;GACA,UAAU,cAAc,0BAA0B;GAClD,UAAU,KAAK,aAAa,yBAAyB;GAErD,MAAM,MAAM,IAAI,IAAI,KAAK,WAAW;GACpC,MAAM,SAAS;IAAC;IAAM;IAAQ;IAAS;GAAgC;GACvE,IAAI,aAAa,OAAO,gBAAgB,YAAY;GACpD,IAAI,aAAa,OAAO,UAAU,OAAO,KAAK,GAAG,CAAC;GAElD,MAAM,WAAW,MAAM,MAAM,IAAI,MAAM,EAAE,SAAA,EADvB,QAAQ,mBACqB,EAAE,CAAC;GAClD,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,YAAY,SAAS,QAAQ,mBAAmB,2BAA2B;GAEvF,MAAM,OAAQ,MAAM,SAAS,KAAK;GAClC,OAAO;IACL;IACA,QAAQ;KACN,KAAK,KAAK;KACV,MAAM,KAAK;KACX,OAAO,KAAK;KACZ,SAAS,KAAK,QAAQ,KAAK;KAC3B,gBAAgB,KAAK;IACvB;GACF;EACF;EACA,MAAM,kBAAkB,EAAE,eAAwC;GAChE,IAAI,YAAY,YAAY,YAAY,cAAc;IACpD,MAAM,WAAW,MAAM,KAAK,YAAY,WAAqC;IAM7E,OAAO;KAAE,OAAA;MAJP,YAAY;MACZ,cAAc,YAAY,gBAAgB;MAC1C,UAAU,YAAY;KAEX;KAAG;IAAS;GAC3B,OACE,MAAM,IAAI,YAAY,KAAK,mBAAmB,sCAAsC;EAExF;CACF;AACF;AAEA,MAAa,WAAW,uBAAuB"}
+{"version":3,"file":"facebook.mjs","names":[],"sources":["../../../src/oauth2/provider/facebook.ts"],"sourcesContent":["import { createHmac } from 'node:crypto';\nimport { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport type { LoginOAuth2NativeParams, OAuth2Token, Provider, UserInfo } from '../types';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\n/**\n * `iss` of Limited Login id tokens, per https://limited.facebook.com/.well-known/openid-configuration/\n * (their `aud` is the app id).\n */\nconst FACEBOOK_ISSUER = 'https://www.facebook.com';\n\n/**\n * ref: https://developers.facebook.com/docs/facebook-login/guides/advanced/manual-flow/\n * ref: https://developers.facebook.com/tools/explorer\n * */\nexport function createFacebookProvider(): Provider {\n  return {\n    authorizationUri: 'https://www.facebook.com/v21.0/dialog/oauth',\n    tokenUri: 'https://graph.facebook.com/v19.0/oauth/access_token',\n    userInfoUri: 'https://graph.facebook.com/me',\n    jwkSetUri: 'https://limited.facebook.com/.well-known/oauth/openid/jwks/',\n    userNameAttribute: 'id',\n    defaultScope: ['profile', 'email'],\n    createAuthorizationUri({ pkce: _, ...params }) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode({ pkce: _, ...params }) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error } = (await response.json()) as FacebookErrorResponse;\n        throw new OAuth2Error(response.status, 'invalid_request', error.message);\n      }\n      return (await response.json()) as FacebookToken;\n    },\n    async getUserInfo({ id_token, access_token }, { clientId }) {\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      if (id_token) {\n        const data = await verifyIdToken<FacebookDecodedIdToken>(id_token, {\n          jwkSetUri: this.jwkSetUri,\n          issuer: FACEBOOK_ISSUER,\n          audience: clientId,\n        });\n        return {\n          data,\n          claims: {\n            sub: data.sub,\n            name: data.name,\n            picture: data.picture,\n            email: data.email,\n            email_verified: true,\n          },\n        };\n      }\n      invariant(access_token, 'access_token is required');\n      invariant(this.userInfoUri, 'userInfoUri is required');\n      return fetchUserInfo(this.userInfoUri, access_token);\n    },\n    async loginOAuth2Native({ clientId, clientSecret, credentials }: LoginOAuth2NativeParams) {\n      const { id_token, access_token } = credentials;\n      let userInfo: UserInfo;\n      if (id_token) {\n        // Limited Login: the id token's `aud` must be this app.\n        userInfo = await this.getUserInfo(\n          { token_type: 'bearer', access_token: '', id_token },\n          {\n            clientId,\n          }\n        );\n      } else if (access_token) {\n        // The Graph API serves any app's user access token, so `/me` alone would accept a token a\n        // foreign app obtained for the same user. With `appsecret_proof` Facebook refuses tokens\n        // not issued to the app whose secret signed the proof, binding the token to this client.\n        if (!clientSecret) {\n          throw new OAuth2Error(400, 'invalid_client', 'access_token login needs the app secret');\n        }\n        invariant(this.userInfoUri, 'userInfoUri is required');\n        const proof = createHmac('sha256', clientSecret).update(access_token).digest('hex');\n        userInfo = await fetchUserInfo(this.userInfoUri, access_token, proof);\n      } else {\n        throw new OAuth2Error(400, 'invalid_request', 'id_token or access_token is required');\n      }\n      const token: OAuth2Token = {\n        token_type: 'bearer',\n        access_token: access_token ?? '',\n        id_token,\n      };\n      return { token, userInfo };\n    },\n  };\n}\n\nexport const facebook = createFacebookProvider();\n\nasync function fetchUserInfo(\n  userInfoUri: string,\n  accessToken: string,\n  appSecretProof?: string\n): Promise<UserInfo<FacebookUserInfo>> {\n  const url = new URL(userInfoUri);\n  const fields = ['id', 'name', 'email', 'picture.width(320).height(320)'];\n  url.searchParams.append('access_token', accessToken);\n  url.searchParams.append('fields', fields.join(','));\n  if (appSecretProof) url.searchParams.append('appsecret_proof', appSecretProof);\n  const headers = { Accept: 'application/json' };\n  const response = await fetch(url.href, { headers });\n  if (!response.ok) {\n    throw new OAuth2Error(response.status, 'invalid_request', 'Failed to fetch user info');\n  }\n  const data = (await response.json()) as FacebookUserInfo;\n  return {\n    data,\n    claims: {\n      sub: data.id,\n      name: data.name,\n      email: data.email,\n      picture: data.picture.data.url,\n      email_verified: data.email_verified,\n    },\n  };\n}\n\nexport interface FacebookDecodedIdToken {\n  sub: string;\n  name: string;\n  email: string;\n  picture: string;\n  nonce?: string;\n}\n\nexport interface FacebookUserInfo {\n  id: string;\n  name: string;\n  email: string;\n  email_verified: boolean;\n  picture: {\n    data: {\n      url: string;\n      width: number;\n      height: number;\n      is_silhouette: boolean;\n    };\n  };\n}\n\nexport interface FacebookToken extends OAuth2Token {\n  access_token: string;\n  token_type: 'bearer';\n  expires_in: number;\n  id_token?: string;\n}\n\nexport type FacebookAppCredential =\n  | { state: string; id_token: string } // platform=ios and tracking=limited\n  | { state: string; access_token: string }; // tracking=enabled\n\ninterface FacebookErrorResponse {\n  error: {\n    message: string;\n    type: 'OAuthException';\n    code: number;\n    error_subcode: number;\n    fbtrace_id: string;\n  };\n}\n"],"mappings":";;;;;;;;;AAUA,MAAM,kBAAkB;;;;;AAMxB,SAAgB,yBAAmC;CACjD,OAAO;EACL,kBAAkB;EAClB,UAAU;EACV,aAAa;EACb,WAAW;EACX,mBAAmB;EACnB,cAAc,CAAC,WAAW,OAAO;EACjC,uBAAuB,EAAE,MAAM,GAAG,GAAG,UAAU;GAC7C,OAAO,uBAAuB;IAC5B,GAAG;IACH,OAAO,OAAO,SAAS,KAAK;IAC5B,kBAAkB,KAAK;GACzB,CAAC;EACH;EACA,MAAM,0BAA0B,EAAE,MAAM,GAAG,GAAG,UAAU;GACtD,MAAM,WAAW,MAAM,0BAA0B;IAAE,GAAG;IAAQ,UAAU,KAAK;GAAS,CAAC;GACvF,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,UAAW,MAAM,SAAS,KAAK;IACvC,MAAM,IAAI,YAAY,SAAS,QAAQ,mBAAmB,MAAM,OAAO;GACzE;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,EAAE,UAAU,gBAAgB,EAAE,YAAY;GAC1D,UAAU,KAAK,WAAW,uBAAuB;GACjD,IAAI,UAAU;IACZ,MAAM,OAAO,MAAM,cAAsC,UAAU;KACjE,WAAW,KAAK;KAChB,QAAQ;KACR,UAAU;IACZ,CAAC;IACD,OAAO;KACL;KACA,QAAQ;MACN,KAAK,KAAK;MACV,MAAM,KAAK;MACX,SAAS,KAAK;MACd,OAAO,KAAK;MACZ,gBAAgB;KAClB;IACF;GACF;GACA,UAAU,cAAc,0BAA0B;GAClD,UAAU,KAAK,aAAa,yBAAyB;GACrD,OAAO,cAAc,KAAK,aAAa,YAAY;EACrD;EACA,MAAM,kBAAkB,EAAE,UAAU,cAAc,eAAwC;GACxF,MAAM,EAAE,UAAU,iBAAiB;GACnC,IAAI;GACJ,IAAI,UAEF,WAAW,MAAM,KAAK,YACpB;IAAE,YAAY;IAAU,cAAc;IAAI;GAAS,GACnD,EACE,SACF,CACF;QACK,IAAI,cAAc;IAIvB,IAAI,CAAC,cACH,MAAM,IAAI,YAAY,KAAK,kBAAkB,yCAAyC;IAExF,UAAU,KAAK,aAAa,yBAAyB;IACrD,MAAM,QAAQ,WAAW,UAAU,YAAY,CAAC,CAAC,OAAO,YAAY,CAAC,CAAC,OAAO,KAAK;IAClF,WAAW,MAAM,cAAc,KAAK,aAAa,cAAc,KAAK;GACtE,OACE,MAAM,IAAI,YAAY,KAAK,mBAAmB,sCAAsC;GAOtF,OAAO;IAAE,OAAA;KAJP,YAAY;KACZ,cAAc,gBAAgB;KAC9B;IAEW;IAAG;GAAS;EAC3B;CACF;AACF;AAEA,MAAa,WAAW,uBAAuB;AAE/C,eAAe,cACb,aACA,aACA,gBACqC;CACrC,MAAM,MAAM,IAAI,IAAI,WAAW;CAC/B,MAAM,SAAS;EAAC;EAAM;EAAQ;EAAS;CAAgC;CACvE,IAAI,aAAa,OAAO,gBAAgB,WAAW;CACnD,IAAI,aAAa,OAAO,UAAU,OAAO,KAAK,GAAG,CAAC;CAClD,IAAI,gBAAgB,IAAI,aAAa,OAAO,mBAAmB,cAAc;CAE7E,MAAM,WAAW,MAAM,MAAM,IAAI,MAAM,EAAE,SAAA,EADvB,QAAQ,mBACqB,EAAE,CAAC;CAClD,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,YAAY,SAAS,QAAQ,mBAAmB,2BAA2B;CAEvF,MAAM,OAAQ,MAAM,SAAS,KAAK;CAClC,OAAO;EACL;EACA,QAAQ;GACN,KAAK,KAAK;GACV,MAAM,KAAK;GACX,OAAO,KAAK;GACZ,SAAS,KAAK,QAAQ,KAAK;GAC3B,gBAAgB,KAAK;EACvB;CACF;AACF"}

package/dist/oauth2/provider/google.cjs

@@ -3,9 +3,19 @@ const require_oauth2_error = require("../error.cjs");
 const require_oauth2_provider_common = require("./common.cjs");
 let _shware_utils = require("@shware/utils");
 //#region src/oauth2/provider/google.ts
-/** The Google Cloud project number every client id of a project starts with: `<number>-<hash>.apps.googleusercontent.com`. */
-function projectNumber(clientId) {
-	return clientId.split("-", 1)[0];
+/** Google signs id tokens with either `iss`, the URL or the bare host. */
+const GOOGLE_ISSUERS = ["https://accounts.google.com", "accounts.google.com"];
+function claims(data) {
+	return {
+		sub: data.sub,
+		name: data.name,
+		picture: data.picture,
+		email: data.email,
+		email_verified: data.email_verified,
+		given_name: data.given_name,
+		family_name: data.family_name,
+		locale: data.locale
+	};
 }
 function createGoogleProvider() {
 	return {
@@ -37,35 +47,29 @@ function createGoogleProvider() {
 			}
 			return await response.json();
 		},
-		async getUserInfo({ id_token }) {
+		async getUserInfo({ id_token }, { clientId }) {
 			(0, _shware_utils.invariant)(id_token, "id_token is required");
 			(0, _shware_utils.invariant)(this.jwkSetUri, "jwkSetUri is required");
-			const data = await require_oauth2_provider_common.verifyIdToken(id_token, this.jwkSetUri);
+			const data = await require_oauth2_provider_common.verifyIdToken(id_token, {
+				jwkSetUri: this.jwkSetUri,
+				issuer: GOOGLE_ISSUERS,
+				audience: clientId
+			});
 			return {
 				data,
-				claims: {
-					sub: data.sub,
-					name: data.name,
-					picture: data.picture,
-					email: data.email,
-					email_verified: data.email_verified,
-					given_name: data.given_name,
-					family_name: data.family_name,
-					locale: data.locale
-				}
+				claims: claims(data)
 			};
 		},
 		async loginOAuth2Native({ pkce: _, credentials, ...params }) {
 			(0, _shware_utils.invariant)(credentials.code, "code is required");
 			const { code } = credentials;
 			const { tokenUri } = this;
-			const { client_id = params.clientId, redirect_uri = params.redirectUri } = credentials;
-			if (projectNumber(client_id) !== projectNumber(params.clientId)) throw new require_oauth2_error.OAuth2Error(400, "invalid_client", "client_id belongs to another project");
+			const { redirect_uri = params.redirectUri } = credentials;
 			const response = await require_oauth2_provider_common.exchangeAuthorizationCode({
 				code,
 				tokenUri,
-				clientId: client_id,
-				clientSecret: client_id === params.clientId ? params.clientSecret : "",
+				clientId: params.clientId,
+				clientSecret: params.clientSecret,
 				redirectUri: redirect_uri
 			});
 			if (!response.ok) {
@@ -75,13 +79,17 @@ function createGoogleProvider() {
 			const token = await response.json();
 			return {
 				token,
-				userInfo: await this.getUserInfo(token)
+				userInfo: await this.getUserInfo(token, { clientId: params.clientId })
 			};
 		},
-		async getTokenInfo(id_token) {
+		async getTokenInfo(id_token, clientId) {
 			(0, _shware_utils.invariant)(id_token, "id_token is required");
 			(0, _shware_utils.invariant)(this.jwkSetUri, "jwkSetUri is required");
-			const data = await require_oauth2_provider_common.verifyIdToken(id_token, this.jwkSetUri);
+			const data = await require_oauth2_provider_common.verifyIdToken(id_token, {
+				jwkSetUri: this.jwkSetUri,
+				issuer: GOOGLE_ISSUERS,
+				audience: clientId
+			});
 			return {
 				token: {
 					id_token,
@@ -93,16 +101,7 @@ function createGoogleProvider() {
 				},
 				userInfo: {
 					data,
-					claims: {
-						sub: data.sub,
-						name: data.name,
-						picture: data.picture,
-						email: data.email,
-						email_verified: data.email_verified,
-						given_name: data.given_name,
-						family_name: data.family_name,
-						locale: data.locale
-					}
+					claims: claims(data)
 				}
 			};
 		}

package/dist/oauth2/provider/google.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"google.cjs","names":["createAuthorizationUri","exchangeAuthorizationCode","OAuth2Error","verifyIdToken"],"sources":["../../../src/oauth2/provider/google.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport type {\n  LoginOAuth2NativeParams,\n  NativeCredential,\n  OAuth2Token,\n  OneTapProvider,\n} from '../types';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\n/** The Google Cloud project number every client id of a project starts with: `<number>-<hash>.apps.googleusercontent.com`. */\nfunction projectNumber(clientId: string) {\n  return clientId.split('-', 1)[0];\n}\n\nexport function createGoogleProvider(): OneTapProvider {\n  return {\n    authorizationUri: 'https://accounts.google.com/o/oauth2/v2/auth',\n    tokenUri: 'https://oauth2.googleapis.com/token',\n    userInfoUri: 'https://www.googleapis.com/oauth2/v3/userinfo',\n    userNameAttribute: 'sub',\n    jwkSetUri: 'https://www.googleapis.com/oauth2/v3/certs',\n    // https://developers.google.com/identity/protocols/oauth2/scopes#oauth2\n    defaultScope: [\n      'https://www.googleapis.com/auth/userinfo.email',\n      'https://www.googleapis.com/auth/userinfo.profile',\n      'openid',\n    ],\n    createAuthorizationUri(params) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode(params) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as GoogleErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as GoogleToken;\n    },\n    async getUserInfo({ id_token }) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      const data = await verifyIdToken<GoogleUserInfo>(id_token, this.jwkSetUri);\n      return {\n        data,\n        claims: {\n          sub: data.sub,\n          name: data.name,\n          picture: data.picture,\n          email: data.email,\n          email_verified: data.email_verified,\n          given_name: data.given_name,\n          family_name: data.family_name,\n          locale: data.locale,\n        },\n      };\n    },\n    async loginOAuth2Native({ pkce: _, credentials, ...params }: LoginOAuth2NativeParams) {\n      invariant(credentials.code, 'code is required');\n      const { code } = credentials;\n      const { tokenUri } = this;\n      // An app signs in as its own installed-app client (the iOS / Android client id, custom-scheme\n      // redirect), and Google only exchanges a code for the client it was issued to, so the exchange\n      // uses the client the app names rather than the registration's web client. Installed-app\n      // clients have no secret; the registration's is sent only when the exchange is for that very\n      // client. Every client id carries its project number as prefix, which pins the app's client to\n      // the registration's Google Cloud project — codes from a foreign project's client are refused.\n      const { client_id = params.clientId, redirect_uri = params.redirectUri } = credentials;\n      if (projectNumber(client_id) !== projectNumber(params.clientId)) {\n        throw new OAuth2Error(400, 'invalid_client', 'client_id belongs to another project');\n      }\n      const response = await exchangeAuthorizationCode({\n        code,\n        tokenUri,\n        clientId: client_id,\n        clientSecret: client_id === params.clientId ? params.clientSecret : '',\n        redirectUri: redirect_uri,\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as GoogleErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      const token = (await response.json()) as GoogleToken;\n      const userInfo = await this.getUserInfo(token);\n      return { token, userInfo };\n    },\n    async getTokenInfo(id_token: string) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      const data = await verifyIdToken<GoogleUserInfo>(id_token, this.jwkSetUri);\n      return {\n        token: {\n          id_token,\n          access_token: '',\n          token_type: '',\n          expires_in: 0,\n          refresh_token: '',\n          scope: '',\n        },\n        userInfo: {\n          data,\n          claims: {\n            sub: data.sub,\n            name: data.name,\n            picture: data.picture,\n            email: data.email,\n            email_verified: data.email_verified,\n            given_name: data.given_name,\n            family_name: data.family_name,\n            locale: data.locale,\n          },\n        },\n      };\n    },\n  };\n}\n\nexport const google = createGoogleProvider();\n\nexport interface GoogleUserInfo {\n  aud: string;\n  azp: string;\n  email: string;\n  email_verified: boolean;\n  exp: number;\n  family_name: string;\n  given_name: string;\n  hd?: string;\n  iat: number;\n  iss: string;\n  jti?: string;\n  locale?: string;\n  name: string;\n  nbf?: number;\n  picture: string;\n  sub: string;\n  nonce?: string;\n}\n\nexport interface GoogleToken extends OAuth2Token {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token: string;\n  id_token: string;\n  scope: string;\n}\n\n// android,ios has different client_id and redirect_uri\nexport interface GoogleAppCredential extends NativeCredential {\n  state: string;\n  code: string;\n  client_id: string;\n  redirect_uri: string;\n}\n\nexport interface GoogleErrorResponse {\n  error:\n    | 'invalid_request'\n    | 'invalid_client'\n    | 'invalid_grant'\n    | 'invalid_token'\n    | 'invalid_scope'\n    | 'unauthorized_client'\n    | 'unsupported_grant_type'\n    | 'access_denied'\n    | 'server_error';\n  error_description: string;\n}\n"],"mappings":";;;;;;AAWA,SAAS,cAAc,UAAkB;CACvC,OAAO,SAAS,MAAM,KAAK,CAAC,CAAC,CAAC;AAChC;AAEA,SAAgB,uBAAuC;CACrD,OAAO;EACL,kBAAkB;EAClB,UAAU;EACV,aAAa;EACb,mBAAmB;EACnB,WAAW;EAEX,cAAc;GACZ;GACA;GACA;EACF;EACA,uBAAuB,QAAQ;GAC7B,OAAOA,+BAAAA,uBAAuB;IAC5B,GAAG;IACH,OAAO,OAAO,SAAS,KAAK;IAC5B,kBAAkB,KAAK;GACzB,CAAC;EACH;EACA,MAAM,0BAA0B,QAAQ;GACtC,MAAM,WAAW,MAAMC,+BAAAA,0BAA0B;IAAE,GAAG;IAAQ,UAAU,KAAK;GAAS,CAAC;GACvF,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,OAAO,sBAAuB,MAAM,SAAS,KAAK;IAC1D,MAAM,IAAIC,qBAAAA,YAAY,SAAS,QAAQ,OAAO,iBAAiB;GACjE;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,EAAE,YAAY;GAC9B,CAAA,GAAA,cAAA,UAAA,CAAU,UAAU,sBAAsB;GAC1C,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,WAAW,uBAAuB;GACjD,MAAM,OAAO,MAAMC,+BAAAA,cAA8B,UAAU,KAAK,SAAS;GACzE,OAAO;IACL;IACA,QAAQ;KACN,KAAK,KAAK;KACV,MAAM,KAAK;KACX,SAAS,KAAK;KACd,OAAO,KAAK;KACZ,gBAAgB,KAAK;KACrB,YAAY,KAAK;KACjB,aAAa,KAAK;KAClB,QAAQ,KAAK;IACf;GACF;EACF;EACA,MAAM,kBAAkB,EAAE,MAAM,GAAG,aAAa,GAAG,UAAmC;GACpF,CAAA,GAAA,cAAA,UAAA,CAAU,YAAY,MAAM,kBAAkB;GAC9C,MAAM,EAAE,SAAS;GACjB,MAAM,EAAE,aAAa;GAOrB,MAAM,EAAE,YAAY,OAAO,UAAU,eAAe,OAAO,gBAAgB;GAC3E,IAAI,cAAc,SAAS,MAAM,cAAc,OAAO,QAAQ,GAC5D,MAAM,IAAID,qBAAAA,YAAY,KAAK,kBAAkB,sCAAsC;GAErF,MAAM,WAAW,MAAMD,+BAAAA,0BAA0B;IAC/C;IACA;IACA,UAAU;IACV,cAAc,cAAc,OAAO,WAAW,OAAO,eAAe;IACpE,aAAa;GACf,CAAC;GACD,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,OAAO,sBAAuB,MAAM,SAAS,KAAK;IAC1D,MAAM,IAAIC,qBAAAA,YAAY,SAAS,QAAQ,OAAO,iBAAiB;GACjE;GACA,MAAM,QAAS,MAAM,SAAS,KAAK;GAEnC,OAAO;IAAE;IAAO,UAAA,MADO,KAAK,YAAY,KAAK;GACpB;EAC3B;EACA,MAAM,aAAa,UAAkB;GACnC,CAAA,GAAA,cAAA,UAAA,CAAU,UAAU,sBAAsB;GAC1C,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,WAAW,uBAAuB;GACjD,MAAM,OAAO,MAAMC,+BAAAA,cAA8B,UAAU,KAAK,SAAS;GACzE,OAAO;IACL,OAAO;KACL;KACA,cAAc;KACd,YAAY;KACZ,YAAY;KACZ,eAAe;KACf,OAAO;IACT;IACA,UAAU;KACR;KACA,QAAQ;MACN,KAAK,KAAK;MACV,MAAM,KAAK;MACX,SAAS,KAAK;MACd,OAAO,KAAK;MACZ,gBAAgB,KAAK;MACrB,YAAY,KAAK;MACjB,aAAa,KAAK;MAClB,QAAQ,KAAK;KACf;IACF;GACF;EACF;CACF;AACF;AAEA,MAAa,SAAS,qBAAqB"}
+{"version":3,"file":"google.cjs","names":["createAuthorizationUri","exchangeAuthorizationCode","OAuth2Error","verifyIdToken"],"sources":["../../../src/oauth2/provider/google.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport type {\n  LoginOAuth2NativeParams,\n  NativeCredential,\n  OAuth2Token,\n  OneTapProvider,\n} from '../types';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\n/** Google signs id tokens with either `iss`, the URL or the bare host. */\nconst GOOGLE_ISSUERS = ['https://accounts.google.com', 'accounts.google.com'];\n\nfunction claims(data: GoogleUserInfo) {\n  return {\n    sub: data.sub,\n    name: data.name,\n    picture: data.picture,\n    email: data.email,\n    email_verified: data.email_verified,\n    given_name: data.given_name,\n    family_name: data.family_name,\n    locale: data.locale,\n  };\n}\n\nexport function createGoogleProvider(): OneTapProvider {\n  return {\n    authorizationUri: 'https://accounts.google.com/o/oauth2/v2/auth',\n    tokenUri: 'https://oauth2.googleapis.com/token',\n    userInfoUri: 'https://www.googleapis.com/oauth2/v3/userinfo',\n    userNameAttribute: 'sub',\n    jwkSetUri: 'https://www.googleapis.com/oauth2/v3/certs',\n    // https://developers.google.com/identity/protocols/oauth2/scopes#oauth2\n    defaultScope: [\n      'https://www.googleapis.com/auth/userinfo.email',\n      'https://www.googleapis.com/auth/userinfo.profile',\n      'openid',\n    ],\n    createAuthorizationUri(params) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode(params) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as GoogleErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as GoogleToken;\n    },\n    async getUserInfo({ id_token }, { clientId }) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      const data = await verifyIdToken<GoogleUserInfo>(id_token, {\n        jwkSetUri: this.jwkSetUri,\n        issuer: GOOGLE_ISSUERS,\n        audience: clientId,\n      });\n      return { data, claims: claims(data) };\n    },\n    async loginOAuth2Native({ pkce: _, credentials, ...params }: LoginOAuth2NativeParams) {\n      invariant(credentials.code, 'code is required');\n      const { code } = credentials;\n      const { tokenUri } = this;\n      // An app signs in as its own installed-app client (the iOS / Android client id, custom-scheme\n      // redirect), and Google only exchanges a code for the client it was issued to, so the exchange\n      // runs as the client the app names, which the OAuth2 client has already checked is one of this\n      // provider's configured clients. Installed-app clients have no secret. The redirect URI is the\n      // one the app used, which only the app knows.\n      const { redirect_uri = params.redirectUri } = credentials;\n      const response = await exchangeAuthorizationCode({\n        code,\n        tokenUri,\n        clientId: params.clientId,\n        clientSecret: params.clientSecret,\n        redirectUri: redirect_uri,\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as GoogleErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      const token = (await response.json()) as GoogleToken;\n      const userInfo = await this.getUserInfo(token, { clientId: params.clientId });\n      return { token, userInfo };\n    },\n    async getTokenInfo(id_token: string, clientId: string) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      // One Tap and FedCM issue the credential to the web client.\n      const data = await verifyIdToken<GoogleUserInfo>(id_token, {\n        jwkSetUri: this.jwkSetUri,\n        issuer: GOOGLE_ISSUERS,\n        audience: clientId,\n      });\n      return {\n        token: {\n          id_token,\n          access_token: '',\n          token_type: '',\n          expires_in: 0,\n          refresh_token: '',\n          scope: '',\n        },\n        userInfo: { data, claims: claims(data) },\n      };\n    },\n  };\n}\n\nexport const google = createGoogleProvider();\n\nexport interface GoogleUserInfo {\n  aud: string;\n  azp: string;\n  email: string;\n  email_verified: boolean;\n  exp: number;\n  family_name: string;\n  given_name: string;\n  hd?: string;\n  iat: number;\n  iss: string;\n  jti?: string;\n  locale?: string;\n  name: string;\n  nbf?: number;\n  picture: string;\n  sub: string;\n  nonce?: string;\n}\n\nexport interface GoogleToken extends OAuth2Token {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token: string;\n  id_token: string;\n  scope: string;\n}\n\n// android,ios has different client_id and redirect_uri\nexport interface GoogleAppCredential extends NativeCredential {\n  state: string;\n  code: string;\n  client_id: string;\n  redirect_uri: string;\n}\n\nexport interface GoogleErrorResponse {\n  error:\n    | 'invalid_request'\n    | 'invalid_client'\n    | 'invalid_grant'\n    | 'invalid_token'\n    | 'invalid_scope'\n    | 'unauthorized_client'\n    | 'unsupported_grant_type'\n    | 'access_denied'\n    | 'server_error';\n  error_description: string;\n}\n"],"mappings":";;;;;;AAWA,MAAM,iBAAiB,CAAC,+BAA+B,qBAAqB;AAE5E,SAAS,OAAO,MAAsB;CACpC,OAAO;EACL,KAAK,KAAK;EACV,MAAM,KAAK;EACX,SAAS,KAAK;EACd,OAAO,KAAK;EACZ,gBAAgB,KAAK;EACrB,YAAY,KAAK;EACjB,aAAa,KAAK;EAClB,QAAQ,KAAK;CACf;AACF;AAEA,SAAgB,uBAAuC;CACrD,OAAO;EACL,kBAAkB;EAClB,UAAU;EACV,aAAa;EACb,mBAAmB;EACnB,WAAW;EAEX,cAAc;GACZ;GACA;GACA;EACF;EACA,uBAAuB,QAAQ;GAC7B,OAAOA,+BAAAA,uBAAuB;IAC5B,GAAG;IACH,OAAO,OAAO,SAAS,KAAK;IAC5B,kBAAkB,KAAK;GACzB,CAAC;EACH;EACA,MAAM,0BAA0B,QAAQ;GACtC,MAAM,WAAW,MAAMC,+BAAAA,0BAA0B;IAAE,GAAG;IAAQ,UAAU,KAAK;GAAS,CAAC;GACvF,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,OAAO,sBAAuB,MAAM,SAAS,KAAK;IAC1D,MAAM,IAAIC,qBAAAA,YAAY,SAAS,QAAQ,OAAO,iBAAiB;GACjE;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,EAAE,YAAY,EAAE,YAAY;GAC5C,CAAA,GAAA,cAAA,UAAA,CAAU,UAAU,sBAAsB;GAC1C,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,WAAW,uBAAuB;GACjD,MAAM,OAAO,MAAMC,+BAAAA,cAA8B,UAAU;IACzD,WAAW,KAAK;IAChB,QAAQ;IACR,UAAU;GACZ,CAAC;GACD,OAAO;IAAE;IAAM,QAAQ,OAAO,IAAI;GAAE;EACtC;EACA,MAAM,kBAAkB,EAAE,MAAM,GAAG,aAAa,GAAG,UAAmC;GACpF,CAAA,GAAA,cAAA,UAAA,CAAU,YAAY,MAAM,kBAAkB;GAC9C,MAAM,EAAE,SAAS;GACjB,MAAM,EAAE,aAAa;GAMrB,MAAM,EAAE,eAAe,OAAO,gBAAgB;GAC9C,MAAM,WAAW,MAAMF,+BAAAA,0BAA0B;IAC/C;IACA;IACA,UAAU,OAAO;IACjB,cAAc,OAAO;IACrB,aAAa;GACf,CAAC;GACD,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,OAAO,sBAAuB,MAAM,SAAS,KAAK;IAC1D,MAAM,IAAIC,qBAAAA,YAAY,SAAS,QAAQ,OAAO,iBAAiB;GACjE;GACA,MAAM,QAAS,MAAM,SAAS,KAAK;GAEnC,OAAO;IAAE;IAAO,UAAA,MADO,KAAK,YAAY,OAAO,EAAE,UAAU,OAAO,SAAS,CAAC;GACnD;EAC3B;EACA,MAAM,aAAa,UAAkB,UAAkB;GACrD,CAAA,GAAA,cAAA,UAAA,CAAU,UAAU,sBAAsB;GAC1C,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,WAAW,uBAAuB;GAEjD,MAAM,OAAO,MAAMC,+BAAAA,cAA8B,UAAU;IACzD,WAAW,KAAK;IAChB,QAAQ;IACR,UAAU;GACZ,CAAC;GACD,OAAO;IACL,OAAO;KACL;KACA,cAAc;KACd,YAAY;KACZ,YAAY;KACZ,eAAe;KACf,OAAO;IACT;IACA,UAAU;KAAE;KAAM,QAAQ,OAAO,IAAI;IAAE;GACzC;EACF;CACF;AACF;AAEA,MAAa,SAAS,qBAAqB"}

package/dist/oauth2/provider/google.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"google.d.cts","names":[],"sources":["../../../src/oauth2/provider/google.ts"],"mappings":";;wBAegB,wBAAwB;qBA0G3B,QAAM;iBAEF;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;iBAGe,oBAAoB;EACnC;EACA;EACA;EACA;EACA;EACA;;iBAIe,4BAA4B;EAC3C;EACA;EACA;EACA;;iBAGe;EACf;EAUA"}
+{"version":3,"file":"google.d.cts","names":[],"sources":["../../../src/oauth2/provider/google.ts"],"mappings":";;wBA0BgB,wBAAwB;qBAuF3B,QAAM;iBAEF;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;iBAGe,oBAAoB;EACnC;EACA;EACA;EACA;EACA;EACA;;iBAIe,4BAA4B;EAC3C;EACA;EACA;EACA;;iBAGe;EACf;EAUA"}

package/dist/oauth2/provider/google.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"google.d.mts","names":[],"sources":["../../../src/oauth2/provider/google.ts"],"mappings":";;wBAegB,wBAAwB;qBA0G3B,QAAM;iBAEF;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;iBAGe,oBAAoB;EACnC;EACA;EACA;EACA;EACA;EACA;;iBAIe,4BAA4B;EAC3C;EACA;EACA;EACA;;iBAGe;EACf;EAUA"}
+{"version":3,"file":"google.d.mts","names":[],"sources":["../../../src/oauth2/provider/google.ts"],"mappings":";;wBA0BgB,wBAAwB;qBAuF3B,QAAM;iBAEF;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;iBAGe,oBAAoB;EACnC;EACA;EACA;EACA;EACA;EACA;;iBAIe,4BAA4B;EAC3C;EACA;EACA;EACA;;iBAGe;EACf;EAUA"}

package/dist/oauth2/provider/google.mjs

@@ -2,9 +2,19 @@ import { OAuth2Error } from "../error.mjs";
 import { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from "./common.mjs";
 import { invariant } from "@shware/utils";
 //#region src/oauth2/provider/google.ts
-/** The Google Cloud project number every client id of a project starts with: `<number>-<hash>.apps.googleusercontent.com`. */
-function projectNumber(clientId) {
-	return clientId.split("-", 1)[0];
+/** Google signs id tokens with either `iss`, the URL or the bare host. */
+const GOOGLE_ISSUERS = ["https://accounts.google.com", "accounts.google.com"];
+function claims(data) {
+	return {
+		sub: data.sub,
+		name: data.name,
+		picture: data.picture,
+		email: data.email,
+		email_verified: data.email_verified,
+		given_name: data.given_name,
+		family_name: data.family_name,
+		locale: data.locale
+	};
 }
 function createGoogleProvider() {
 	return {
@@ -36,35 +46,29 @@ function createGoogleProvider() {
 			}
 			return await response.json();
 		},
-		async getUserInfo({ id_token }) {
+		async getUserInfo({ id_token }, { clientId }) {
 			invariant(id_token, "id_token is required");
 			invariant(this.jwkSetUri, "jwkSetUri is required");
-			const data = await verifyIdToken(id_token, this.jwkSetUri);
+			const data = await verifyIdToken(id_token, {
+				jwkSetUri: this.jwkSetUri,
+				issuer: GOOGLE_ISSUERS,
+				audience: clientId
+			});
 			return {
 				data,
-				claims: {
-					sub: data.sub,
-					name: data.name,
-					picture: data.picture,
-					email: data.email,
-					email_verified: data.email_verified,
-					given_name: data.given_name,
-					family_name: data.family_name,
-					locale: data.locale
-				}
+				claims: claims(data)
 			};
 		},
 		async loginOAuth2Native({ pkce: _, credentials, ...params }) {
 			invariant(credentials.code, "code is required");
 			const { code } = credentials;
 			const { tokenUri } = this;
-			const { client_id = params.clientId, redirect_uri = params.redirectUri } = credentials;
-			if (projectNumber(client_id) !== projectNumber(params.clientId)) throw new OAuth2Error(400, "invalid_client", "client_id belongs to another project");
+			const { redirect_uri = params.redirectUri } = credentials;
 			const response = await exchangeAuthorizationCode({
 				code,
 				tokenUri,
-				clientId: client_id,
-				clientSecret: client_id === params.clientId ? params.clientSecret : "",
+				clientId: params.clientId,
+				clientSecret: params.clientSecret,
 				redirectUri: redirect_uri
 			});
 			if (!response.ok) {
@@ -74,13 +78,17 @@ function createGoogleProvider() {
 			const token = await response.json();
 			return {
 				token,
-				userInfo: await this.getUserInfo(token)
+				userInfo: await this.getUserInfo(token, { clientId: params.clientId })
 			};
 		},
-		async getTokenInfo(id_token) {
+		async getTokenInfo(id_token, clientId) {
 			invariant(id_token, "id_token is required");
 			invariant(this.jwkSetUri, "jwkSetUri is required");
-			const data = await verifyIdToken(id_token, this.jwkSetUri);
+			const data = await verifyIdToken(id_token, {
+				jwkSetUri: this.jwkSetUri,
+				issuer: GOOGLE_ISSUERS,
+				audience: clientId
+			});
 			return {
 				token: {
 					id_token,
@@ -92,16 +100,7 @@ function createGoogleProvider() {
 				},
 				userInfo: {
 					data,
-					claims: {
-						sub: data.sub,
-						name: data.name,
-						picture: data.picture,
-						email: data.email,
-						email_verified: data.email_verified,
-						given_name: data.given_name,
-						family_name: data.family_name,
-						locale: data.locale
-					}
+					claims: claims(data)
 				}
 			};
 		}

package/dist/oauth2/provider/google.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"google.mjs","names":[],"sources":["../../../src/oauth2/provider/google.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport type {\n  LoginOAuth2NativeParams,\n  NativeCredential,\n  OAuth2Token,\n  OneTapProvider,\n} from '../types';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\n/** The Google Cloud project number every client id of a project starts with: `<number>-<hash>.apps.googleusercontent.com`. */\nfunction projectNumber(clientId: string) {\n  return clientId.split('-', 1)[0];\n}\n\nexport function createGoogleProvider(): OneTapProvider {\n  return {\n    authorizationUri: 'https://accounts.google.com/o/oauth2/v2/auth',\n    tokenUri: 'https://oauth2.googleapis.com/token',\n    userInfoUri: 'https://www.googleapis.com/oauth2/v3/userinfo',\n    userNameAttribute: 'sub',\n    jwkSetUri: 'https://www.googleapis.com/oauth2/v3/certs',\n    // https://developers.google.com/identity/protocols/oauth2/scopes#oauth2\n    defaultScope: [\n      'https://www.googleapis.com/auth/userinfo.email',\n      'https://www.googleapis.com/auth/userinfo.profile',\n      'openid',\n    ],\n    createAuthorizationUri(params) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode(params) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as GoogleErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as GoogleToken;\n    },\n    async getUserInfo({ id_token }) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      const data = await verifyIdToken<GoogleUserInfo>(id_token, this.jwkSetUri);\n      return {\n        data,\n        claims: {\n          sub: data.sub,\n          name: data.name,\n          picture: data.picture,\n          email: data.email,\n          email_verified: data.email_verified,\n          given_name: data.given_name,\n          family_name: data.family_name,\n          locale: data.locale,\n        },\n      };\n    },\n    async loginOAuth2Native({ pkce: _, credentials, ...params }: LoginOAuth2NativeParams) {\n      invariant(credentials.code, 'code is required');\n      const { code } = credentials;\n      const { tokenUri } = this;\n      // An app signs in as its own installed-app client (the iOS / Android client id, custom-scheme\n      // redirect), and Google only exchanges a code for the client it was issued to, so the exchange\n      // uses the client the app names rather than the registration's web client. Installed-app\n      // clients have no secret; the registration's is sent only when the exchange is for that very\n      // client. Every client id carries its project number as prefix, which pins the app's client to\n      // the registration's Google Cloud project — codes from a foreign project's client are refused.\n      const { client_id = params.clientId, redirect_uri = params.redirectUri } = credentials;\n      if (projectNumber(client_id) !== projectNumber(params.clientId)) {\n        throw new OAuth2Error(400, 'invalid_client', 'client_id belongs to another project');\n      }\n      const response = await exchangeAuthorizationCode({\n        code,\n        tokenUri,\n        clientId: client_id,\n        clientSecret: client_id === params.clientId ? params.clientSecret : '',\n        redirectUri: redirect_uri,\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as GoogleErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      const token = (await response.json()) as GoogleToken;\n      const userInfo = await this.getUserInfo(token);\n      return { token, userInfo };\n    },\n    async getTokenInfo(id_token: string) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      const data = await verifyIdToken<GoogleUserInfo>(id_token, this.jwkSetUri);\n      return {\n        token: {\n          id_token,\n          access_token: '',\n          token_type: '',\n          expires_in: 0,\n          refresh_token: '',\n          scope: '',\n        },\n        userInfo: {\n          data,\n          claims: {\n            sub: data.sub,\n            name: data.name,\n            picture: data.picture,\n            email: data.email,\n            email_verified: data.email_verified,\n            given_name: data.given_name,\n            family_name: data.family_name,\n            locale: data.locale,\n          },\n        },\n      };\n    },\n  };\n}\n\nexport const google = createGoogleProvider();\n\nexport interface GoogleUserInfo {\n  aud: string;\n  azp: string;\n  email: string;\n  email_verified: boolean;\n  exp: number;\n  family_name: string;\n  given_name: string;\n  hd?: string;\n  iat: number;\n  iss: string;\n  jti?: string;\n  locale?: string;\n  name: string;\n  nbf?: number;\n  picture: string;\n  sub: string;\n  nonce?: string;\n}\n\nexport interface GoogleToken extends OAuth2Token {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token: string;\n  id_token: string;\n  scope: string;\n}\n\n// android,ios has different client_id and redirect_uri\nexport interface GoogleAppCredential extends NativeCredential {\n  state: string;\n  code: string;\n  client_id: string;\n  redirect_uri: string;\n}\n\nexport interface GoogleErrorResponse {\n  error:\n    | 'invalid_request'\n    | 'invalid_client'\n    | 'invalid_grant'\n    | 'invalid_token'\n    | 'invalid_scope'\n    | 'unauthorized_client'\n    | 'unsupported_grant_type'\n    | 'access_denied'\n    | 'server_error';\n  error_description: string;\n}\n"],"mappings":";;;;;AAWA,SAAS,cAAc,UAAkB;CACvC,OAAO,SAAS,MAAM,KAAK,CAAC,CAAC,CAAC;AAChC;AAEA,SAAgB,uBAAuC;CACrD,OAAO;EACL,kBAAkB;EAClB,UAAU;EACV,aAAa;EACb,mBAAmB;EACnB,WAAW;EAEX,cAAc;GACZ;GACA;GACA;EACF;EACA,uBAAuB,QAAQ;GAC7B,OAAO,uBAAuB;IAC5B,GAAG;IACH,OAAO,OAAO,SAAS,KAAK;IAC5B,kBAAkB,KAAK;GACzB,CAAC;EACH;EACA,MAAM,0BAA0B,QAAQ;GACtC,MAAM,WAAW,MAAM,0BAA0B;IAAE,GAAG;IAAQ,UAAU,KAAK;GAAS,CAAC;GACvF,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,OAAO,sBAAuB,MAAM,SAAS,KAAK;IAC1D,MAAM,IAAI,YAAY,SAAS,QAAQ,OAAO,iBAAiB;GACjE;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,EAAE,YAAY;GAC9B,UAAU,UAAU,sBAAsB;GAC1C,UAAU,KAAK,WAAW,uBAAuB;GACjD,MAAM,OAAO,MAAM,cAA8B,UAAU,KAAK,SAAS;GACzE,OAAO;IACL;IACA,QAAQ;KACN,KAAK,KAAK;KACV,MAAM,KAAK;KACX,SAAS,KAAK;KACd,OAAO,KAAK;KACZ,gBAAgB,KAAK;KACrB,YAAY,KAAK;KACjB,aAAa,KAAK;KAClB,QAAQ,KAAK;IACf;GACF;EACF;EACA,MAAM,kBAAkB,EAAE,MAAM,GAAG,aAAa,GAAG,UAAmC;GACpF,UAAU,YAAY,MAAM,kBAAkB;GAC9C,MAAM,EAAE,SAAS;GACjB,MAAM,EAAE,aAAa;GAOrB,MAAM,EAAE,YAAY,OAAO,UAAU,eAAe,OAAO,gBAAgB;GAC3E,IAAI,cAAc,SAAS,MAAM,cAAc,OAAO,QAAQ,GAC5D,MAAM,IAAI,YAAY,KAAK,kBAAkB,sCAAsC;GAErF,MAAM,WAAW,MAAM,0BAA0B;IAC/C;IACA;IACA,UAAU;IACV,cAAc,cAAc,OAAO,WAAW,OAAO,eAAe;IACpE,aAAa;GACf,CAAC;GACD,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,OAAO,sBAAuB,MAAM,SAAS,KAAK;IAC1D,MAAM,IAAI,YAAY,SAAS,QAAQ,OAAO,iBAAiB;GACjE;GACA,MAAM,QAAS,MAAM,SAAS,KAAK;GAEnC,OAAO;IAAE;IAAO,UAAA,MADO,KAAK,YAAY,KAAK;GACpB;EAC3B;EACA,MAAM,aAAa,UAAkB;GACnC,UAAU,UAAU,sBAAsB;GAC1C,UAAU,KAAK,WAAW,uBAAuB;GACjD,MAAM,OAAO,MAAM,cAA8B,UAAU,KAAK,SAAS;GACzE,OAAO;IACL,OAAO;KACL;KACA,cAAc;KACd,YAAY;KACZ,YAAY;KACZ,eAAe;KACf,OAAO;IACT;IACA,UAAU;KACR;KACA,QAAQ;MACN,KAAK,KAAK;MACV,MAAM,KAAK;MACX,SAAS,KAAK;MACd,OAAO,KAAK;MACZ,gBAAgB,KAAK;MACrB,YAAY,KAAK;MACjB,aAAa,KAAK;MAClB,QAAQ,KAAK;KACf;IACF;GACF;EACF;CACF;AACF;AAEA,MAAa,SAAS,qBAAqB"}
+{"version":3,"file":"google.mjs","names":[],"sources":["../../../src/oauth2/provider/google.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport type {\n  LoginOAuth2NativeParams,\n  NativeCredential,\n  OAuth2Token,\n  OneTapProvider,\n} from '../types';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\n/** Google signs id tokens with either `iss`, the URL or the bare host. */\nconst GOOGLE_ISSUERS = ['https://accounts.google.com', 'accounts.google.com'];\n\nfunction claims(data: GoogleUserInfo) {\n  return {\n    sub: data.sub,\n    name: data.name,\n    picture: data.picture,\n    email: data.email,\n    email_verified: data.email_verified,\n    given_name: data.given_name,\n    family_name: data.family_name,\n    locale: data.locale,\n  };\n}\n\nexport function createGoogleProvider(): OneTapProvider {\n  return {\n    authorizationUri: 'https://accounts.google.com/o/oauth2/v2/auth',\n    tokenUri: 'https://oauth2.googleapis.com/token',\n    userInfoUri: 'https://www.googleapis.com/oauth2/v3/userinfo',\n    userNameAttribute: 'sub',\n    jwkSetUri: 'https://www.googleapis.com/oauth2/v3/certs',\n    // https://developers.google.com/identity/protocols/oauth2/scopes#oauth2\n    defaultScope: [\n      'https://www.googleapis.com/auth/userinfo.email',\n      'https://www.googleapis.com/auth/userinfo.profile',\n      'openid',\n    ],\n    createAuthorizationUri(params) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode(params) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as GoogleErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as GoogleToken;\n    },\n    async getUserInfo({ id_token }, { clientId }) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      const data = await verifyIdToken<GoogleUserInfo>(id_token, {\n        jwkSetUri: this.jwkSetUri,\n        issuer: GOOGLE_ISSUERS,\n        audience: clientId,\n      });\n      return { data, claims: claims(data) };\n    },\n    async loginOAuth2Native({ pkce: _, credentials, ...params }: LoginOAuth2NativeParams) {\n      invariant(credentials.code, 'code is required');\n      const { code } = credentials;\n      const { tokenUri } = this;\n      // An app signs in as its own installed-app client (the iOS / Android client id, custom-scheme\n      // redirect), and Google only exchanges a code for the client it was issued to, so the exchange\n      // runs as the client the app names, which the OAuth2 client has already checked is one of this\n      // provider's configured clients. Installed-app clients have no secret. The redirect URI is the\n      // one the app used, which only the app knows.\n      const { redirect_uri = params.redirectUri } = credentials;\n      const response = await exchangeAuthorizationCode({\n        code,\n        tokenUri,\n        clientId: params.clientId,\n        clientSecret: params.clientSecret,\n        redirectUri: redirect_uri,\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as GoogleErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      const token = (await response.json()) as GoogleToken;\n      const userInfo = await this.getUserInfo(token, { clientId: params.clientId });\n      return { token, userInfo };\n    },\n    async getTokenInfo(id_token: string, clientId: string) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      // One Tap and FedCM issue the credential to the web client.\n      const data = await verifyIdToken<GoogleUserInfo>(id_token, {\n        jwkSetUri: this.jwkSetUri,\n        issuer: GOOGLE_ISSUERS,\n        audience: clientId,\n      });\n      return {\n        token: {\n          id_token,\n          access_token: '',\n          token_type: '',\n          expires_in: 0,\n          refresh_token: '',\n          scope: '',\n        },\n        userInfo: { data, claims: claims(data) },\n      };\n    },\n  };\n}\n\nexport const google = createGoogleProvider();\n\nexport interface GoogleUserInfo {\n  aud: string;\n  azp: string;\n  email: string;\n  email_verified: boolean;\n  exp: number;\n  family_name: string;\n  given_name: string;\n  hd?: string;\n  iat: number;\n  iss: string;\n  jti?: string;\n  locale?: string;\n  name: string;\n  nbf?: number;\n  picture: string;\n  sub: string;\n  nonce?: string;\n}\n\nexport interface GoogleToken extends OAuth2Token {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token: string;\n  id_token: string;\n  scope: string;\n}\n\n// android,ios has different client_id and redirect_uri\nexport interface GoogleAppCredential extends NativeCredential {\n  state: string;\n  code: string;\n  client_id: string;\n  redirect_uri: string;\n}\n\nexport interface GoogleErrorResponse {\n  error:\n    | 'invalid_request'\n    | 'invalid_client'\n    | 'invalid_grant'\n    | 'invalid_token'\n    | 'invalid_scope'\n    | 'unauthorized_client'\n    | 'unsupported_grant_type'\n    | 'access_denied'\n    | 'server_error';\n  error_description: string;\n}\n"],"mappings":";;;;;AAWA,MAAM,iBAAiB,CAAC,+BAA+B,qBAAqB;AAE5E,SAAS,OAAO,MAAsB;CACpC,OAAO;EACL,KAAK,KAAK;EACV,MAAM,KAAK;EACX,SAAS,KAAK;EACd,OAAO,KAAK;EACZ,gBAAgB,KAAK;EACrB,YAAY,KAAK;EACjB,aAAa,KAAK;EAClB,QAAQ,KAAK;CACf;AACF;AAEA,SAAgB,uBAAuC;CACrD,OAAO;EACL,kBAAkB;EAClB,UAAU;EACV,aAAa;EACb,mBAAmB;EACnB,WAAW;EAEX,cAAc;GACZ;GACA;GACA;EACF;EACA,uBAAuB,QAAQ;GAC7B,OAAO,uBAAuB;IAC5B,GAAG;IACH,OAAO,OAAO,SAAS,KAAK;IAC5B,kBAAkB,KAAK;GACzB,CAAC;EACH;EACA,MAAM,0BAA0B,QAAQ;GACtC,MAAM,WAAW,MAAM,0BAA0B;IAAE,GAAG;IAAQ,UAAU,KAAK;GAAS,CAAC;GACvF,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,OAAO,sBAAuB,MAAM,SAAS,KAAK;IAC1D,MAAM,IAAI,YAAY,SAAS,QAAQ,OAAO,iBAAiB;GACjE;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,EAAE,YAAY,EAAE,YAAY;GAC5C,UAAU,UAAU,sBAAsB;GAC1C,UAAU,KAAK,WAAW,uBAAuB;GACjD,MAAM,OAAO,MAAM,cAA8B,UAAU;IACzD,WAAW,KAAK;IAChB,QAAQ;IACR,UAAU;GACZ,CAAC;GACD,OAAO;IAAE;IAAM,QAAQ,OAAO,IAAI;GAAE;EACtC;EACA,MAAM,kBAAkB,EAAE,MAAM,GAAG,aAAa,GAAG,UAAmC;GACpF,UAAU,YAAY,MAAM,kBAAkB;GAC9C,MAAM,EAAE,SAAS;GACjB,MAAM,EAAE,aAAa;GAMrB,MAAM,EAAE,eAAe,OAAO,gBAAgB;GAC9C,MAAM,WAAW,MAAM,0BAA0B;IAC/C;IACA;IACA,UAAU,OAAO;IACjB,cAAc,OAAO;IACrB,aAAa;GACf,CAAC;GACD,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,OAAO,sBAAuB,MAAM,SAAS,KAAK;IAC1D,MAAM,IAAI,YAAY,SAAS,QAAQ,OAAO,iBAAiB;GACjE;GACA,MAAM,QAAS,MAAM,SAAS,KAAK;GAEnC,OAAO;IAAE;IAAO,UAAA,MADO,KAAK,YAAY,OAAO,EAAE,UAAU,OAAO,SAAS,CAAC;GACnD;EAC3B;EACA,MAAM,aAAa,UAAkB,UAAkB;GACrD,UAAU,UAAU,sBAAsB;GAC1C,UAAU,KAAK,WAAW,uBAAuB;GAEjD,MAAM,OAAO,MAAM,cAA8B,UAAU;IACzD,WAAW,KAAK;IAChB,QAAQ;IACR,UAAU;GACZ,CAAC;GACD,OAAO;IACL,OAAO;KACL;KACA,cAAc;KACd,YAAY;KACZ,YAAY;KACZ,eAAe;KACf,OAAO;IACT;IACA,UAAU;KAAE;KAAM,QAAQ,OAAO,IAAI;IAAE;GACzC;EACF;CACF;AACF;AAEA,MAAa,SAAS,qBAAqB"}

package/dist/oauth2/provider/index.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_oauth2_provider_apple = require("./apple.cjs");
 const require_oauth2_provider_apple_client_secret = require("./apple-client-secret.cjs");
+const require_oauth2_provider_apple = require("./apple.cjs");
 const require_oauth2_provider_facebook = require("./facebook.cjs");
 const require_oauth2_provider_github = require("./github.cjs");
 const require_oauth2_provider_google = require("./google.cjs");

package/dist/oauth2/provider/index.mjs

@@ -1,5 +1,5 @@
-import { apple } from "./apple.mjs";
 import { createAppleClientSecret } from "./apple-client-secret.mjs";
+import { apple } from "./apple.mjs";
 import { facebook } from "./facebook.mjs";
 import { github } from "./github.mjs";
 import { google } from "./google.mjs";

package/dist/oauth2/provider/wechat.cjs

@@ -23,6 +23,7 @@ function createWechatProvider(options = { isWechatBrowser: false }) {
 			return url;
 		},
 		async exchangeAuthorizationCode(params) {
+			(0, _shware_utils.invariant)(params.clientSecret, "clientSecret is required for wechat");
 			const url = new URL(this.tokenUri);
 			url.searchParams.set("appid", params.clientId);
 			url.searchParams.set("secret", params.clientSecret);

package/dist/oauth2/provider/wechat.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"wechat.cjs","names":["OAuth2Error"],"sources":["../../../src/oauth2/provider/wechat.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport type { OAuth2Token, Provider } from '../types';\n\nexport type Options = { isWechatBrowser: boolean };\n\n/**\n * reference: https://developers.weixin.qq.com/doc/offiaccount/en/OA_Web_Apps/Wechat_webpage_authorization.html\n */\nexport function createWechatProvider(options: Options = { isWechatBrowser: false }): Provider {\n  const { isWechatBrowser } = options;\n  return {\n    authorizationUri: isWechatBrowser\n      ? 'https://open.weixin.qq.com/connect/oauth2/authorize'\n      : 'https://open.weixin.qq.com/connect/qrconnect',\n    tokenUri: 'https://api.weixin.qq.com/sns/oauth2/access_token',\n    tokenRefreshUri: 'https://api.weixin.qq.com/sns/oauth2/refresh_token',\n    userInfoUri: 'https://api.weixin.qq.com/sns/userinfo',\n    defaultScope: [isWechatBrowser ? 'snsapi_userinfo' : 'snsapi_login'],\n    createAuthorizationUri(params) {\n      const url = new URL(this.authorizationUri);\n      url.searchParams.set('appid', params.clientId);\n      url.searchParams.set('scope', (params.scope ?? this.defaultScope).join(','));\n      url.searchParams.set('redirect_uri', params.redirectUri);\n      url.searchParams.set('response_type', 'code');\n      url.searchParams.set('state', params.state);\n      return url;\n    },\n    async exchangeAuthorizationCode(params) {\n      const url = new URL(this.tokenUri);\n      url.searchParams.set('appid', params.clientId);\n      url.searchParams.set('secret', params.clientSecret);\n      url.searchParams.set('code', params.code);\n      url.searchParams.set('grant_type', 'authorization_code');\n      const response = await fetch(url.href);\n      if (!response.ok) {\n        const { errcode, errmsg } = (await response.json()) as WechatErrorResponse;\n        throw new OAuth2Error(response.status, errmsg, `errcode: ${errcode}`);\n      }\n      return (await response.json()) as WechatToken;\n    },\n    async getUserInfo({ access_token, openid }) {\n      invariant(this.userInfoUri, 'userInfoUri is required');\n      invariant(openid && typeof openid === 'string', 'openid is required');\n      const url = new URL(this.userInfoUri);\n      url.searchParams.set('access_token', access_token);\n      url.searchParams.set('openid', openid);\n      const response = await fetch(url.href);\n      if (!response.ok) {\n        const { errcode, errmsg } = (await response.json()) as WechatErrorResponse;\n        throw new OAuth2Error(response.status, errmsg, `errcode: ${errcode}`);\n      }\n      const data = (await response.json()) as WechatUserInfo;\n\n      return {\n        data,\n        claims: {\n          sub: data.unionid ?? data.openid,\n          name: data.nickname,\n          picture: `${data.headimgurl.split('/').slice(0, -1).join('/')}/0`,\n          gender: data.sex === 1 ? 'male' : data.sex === 2 ? 'female' : undefined,\n        },\n      };\n    },\n    async refreshAccessToken(params) {\n      invariant(this.tokenRefreshUri, 'tokenRefreshUri is required');\n      const url = new URL(this.tokenRefreshUri);\n      url.searchParams.set('appid', params.clientId);\n      url.searchParams.set('grant_type', 'refresh_token');\n      url.searchParams.set('refresh_token', params.refreshToken);\n      const response = await fetch(url.href);\n      if (!response.ok) {\n        const { errcode, errmsg } = (await response.json()) as WechatErrorResponse;\n        throw new OAuth2Error(response.status, errmsg, `errcode: ${errcode}`);\n      }\n      return (await response.json()) as WechatToken;\n    },\n  };\n}\n\nexport const wechat = createWechatProvider();\n\nexport interface WechatUserInfo {\n  openid: string;\n  nickname: string;\n  sex: 0 | 1 | 2; // 0: unknown, 1: male, 2: female\n  province: string;\n  city: string;\n  country: string;\n  /**\n   * User's profile photo. The last numeric value represents the size of a square profile photo\n   * (The value can be 0, 46, 64, 96, or 132. The value 0 represents a 640*640 square profile\n   * photo). This parameter is left blank if a user has no profile photo. If the user changes the\n   * profile photo, the URL of the original profile photo will expire.\n   * e.g. http://thirdwx.qlogo.cn/mmopen/g3MonUZtNHkdmzicIlibx6iaFqAc56vxLSUfpb6n5WKSYVY0ChQKkiaJSgQ1dZuTOgvLLrhJbERQQ4eMsv84eavHiaiceqxibJxCfHe/46\n   */\n  headimgurl: string;\n  privilege: string[];\n  unionid?: string;\n}\n\nexport interface WechatToken extends OAuth2Token {\n  access_token: string;\n  expires_in: number;\n  refresh_token: string;\n  openid: string;\n  scope: string;\n  unionid?: string;\n}\n\ninterface WechatErrorResponse {\n  errcode: number;\n  errmsg: string;\n}\n"],"mappings":";;;;;;;AASA,SAAgB,qBAAqB,UAAmB,EAAE,iBAAiB,MAAM,GAAa;CAC5F,MAAM,EAAE,oBAAoB;CAC5B,OAAO;EACL,kBAAkB,kBACd,wDACA;EACJ,UAAU;EACV,iBAAiB;EACjB,aAAa;EACb,cAAc,CAAC,kBAAkB,oBAAoB,cAAc;EACnE,uBAAuB,QAAQ;GAC7B,MAAM,MAAM,IAAI,IAAI,KAAK,gBAAgB;GACzC,IAAI,aAAa,IAAI,SAAS,OAAO,QAAQ;GAC7C,IAAI,aAAa,IAAI,UAAU,OAAO,SAAS,KAAK,aAAA,CAAc,KAAK,GAAG,CAAC;GAC3E,IAAI,aAAa,IAAI,gBAAgB,OAAO,WAAW;GACvD,IAAI,aAAa,IAAI,iBAAiB,MAAM;GAC5C,IAAI,aAAa,IAAI,SAAS,OAAO,KAAK;GAC1C,OAAO;EACT;EACA,MAAM,0BAA0B,QAAQ;GACtC,MAAM,MAAM,IAAI,IAAI,KAAK,QAAQ;GACjC,IAAI,aAAa,IAAI,SAAS,OAAO,QAAQ;GAC7C,IAAI,aAAa,IAAI,UAAU,OAAO,YAAY;GAClD,IAAI,aAAa,IAAI,QAAQ,OAAO,IAAI;GACxC,IAAI,aAAa,IAAI,cAAc,oBAAoB;GACvD,MAAM,WAAW,MAAM,MAAM,IAAI,IAAI;GACrC,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,SAAS,WAAY,MAAM,SAAS,KAAK;IACjD,MAAM,IAAIA,qBAAAA,YAAY,SAAS,QAAQ,QAAQ,YAAY,SAAS;GACtE;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,EAAE,cAAc,UAAU;GAC1C,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,aAAa,yBAAyB;GACrD,CAAA,GAAA,cAAA,UAAA,CAAU,UAAU,OAAO,WAAW,UAAU,oBAAoB;GACpE,MAAM,MAAM,IAAI,IAAI,KAAK,WAAW;GACpC,IAAI,aAAa,IAAI,gBAAgB,YAAY;GACjD,IAAI,aAAa,IAAI,UAAU,MAAM;GACrC,MAAM,WAAW,MAAM,MAAM,IAAI,IAAI;GACrC,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,SAAS,WAAY,MAAM,SAAS,KAAK;IACjD,MAAM,IAAIA,qBAAAA,YAAY,SAAS,QAAQ,QAAQ,YAAY,SAAS;GACtE;GACA,MAAM,OAAQ,MAAM,SAAS,KAAK;GAElC,OAAO;IACL;IACA,QAAQ;KACN,KAAK,KAAK,WAAW,KAAK;KAC1B,MAAM,KAAK;KACX,SAAS,GAAG,KAAK,WAAW,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,KAAK,GAAG,EAAE;KAC9D,QAAQ,KAAK,QAAQ,IAAI,SAAS,KAAK,QAAQ,IAAI,WAAW,KAAA;IAChE;GACF;EACF;EACA,MAAM,mBAAmB,QAAQ;GAC/B,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,iBAAiB,6BAA6B;GAC7D,MAAM,MAAM,IAAI,IAAI,KAAK,eAAe;GACxC,IAAI,aAAa,IAAI,SAAS,OAAO,QAAQ;GAC7C,IAAI,aAAa,IAAI,cAAc,eAAe;GAClD,IAAI,aAAa,IAAI,iBAAiB,OAAO,YAAY;GACzD,MAAM,WAAW,MAAM,MAAM,IAAI,IAAI;GACrC,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,SAAS,WAAY,MAAM,SAAS,KAAK;IACjD,MAAM,IAAIA,qBAAAA,YAAY,SAAS,QAAQ,QAAQ,YAAY,SAAS;GACtE;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;CACF;AACF;AAEA,MAAa,SAAS,qBAAqB"}
+{"version":3,"file":"wechat.cjs","names":["OAuth2Error"],"sources":["../../../src/oauth2/provider/wechat.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport type { OAuth2Token, Provider } from '../types';\n\nexport type Options = { isWechatBrowser: boolean };\n\n/**\n * reference: https://developers.weixin.qq.com/doc/offiaccount/en/OA_Web_Apps/Wechat_webpage_authorization.html\n */\nexport function createWechatProvider(options: Options = { isWechatBrowser: false }): Provider {\n  const { isWechatBrowser } = options;\n  return {\n    authorizationUri: isWechatBrowser\n      ? 'https://open.weixin.qq.com/connect/oauth2/authorize'\n      : 'https://open.weixin.qq.com/connect/qrconnect',\n    tokenUri: 'https://api.weixin.qq.com/sns/oauth2/access_token',\n    tokenRefreshUri: 'https://api.weixin.qq.com/sns/oauth2/refresh_token',\n    userInfoUri: 'https://api.weixin.qq.com/sns/userinfo',\n    defaultScope: [isWechatBrowser ? 'snsapi_userinfo' : 'snsapi_login'],\n    createAuthorizationUri(params) {\n      const url = new URL(this.authorizationUri);\n      url.searchParams.set('appid', params.clientId);\n      url.searchParams.set('scope', (params.scope ?? this.defaultScope).join(','));\n      url.searchParams.set('redirect_uri', params.redirectUri);\n      url.searchParams.set('response_type', 'code');\n      url.searchParams.set('state', params.state);\n      return url;\n    },\n    async exchangeAuthorizationCode(params) {\n      invariant(params.clientSecret, 'clientSecret is required for wechat');\n      const url = new URL(this.tokenUri);\n      url.searchParams.set('appid', params.clientId);\n      url.searchParams.set('secret', params.clientSecret);\n      url.searchParams.set('code', params.code);\n      url.searchParams.set('grant_type', 'authorization_code');\n      const response = await fetch(url.href);\n      if (!response.ok) {\n        const { errcode, errmsg } = (await response.json()) as WechatErrorResponse;\n        throw new OAuth2Error(response.status, errmsg, `errcode: ${errcode}`);\n      }\n      return (await response.json()) as WechatToken;\n    },\n    async getUserInfo({ access_token, openid }) {\n      invariant(this.userInfoUri, 'userInfoUri is required');\n      invariant(openid && typeof openid === 'string', 'openid is required');\n      const url = new URL(this.userInfoUri);\n      url.searchParams.set('access_token', access_token);\n      url.searchParams.set('openid', openid);\n      const response = await fetch(url.href);\n      if (!response.ok) {\n        const { errcode, errmsg } = (await response.json()) as WechatErrorResponse;\n        throw new OAuth2Error(response.status, errmsg, `errcode: ${errcode}`);\n      }\n      const data = (await response.json()) as WechatUserInfo;\n\n      return {\n        data,\n        claims: {\n          sub: data.unionid ?? data.openid,\n          name: data.nickname,\n          picture: `${data.headimgurl.split('/').slice(0, -1).join('/')}/0`,\n          gender: data.sex === 1 ? 'male' : data.sex === 2 ? 'female' : undefined,\n        },\n      };\n    },\n    async refreshAccessToken(params) {\n      invariant(this.tokenRefreshUri, 'tokenRefreshUri is required');\n      const url = new URL(this.tokenRefreshUri);\n      url.searchParams.set('appid', params.clientId);\n      url.searchParams.set('grant_type', 'refresh_token');\n      url.searchParams.set('refresh_token', params.refreshToken);\n      const response = await fetch(url.href);\n      if (!response.ok) {\n        const { errcode, errmsg } = (await response.json()) as WechatErrorResponse;\n        throw new OAuth2Error(response.status, errmsg, `errcode: ${errcode}`);\n      }\n      return (await response.json()) as WechatToken;\n    },\n  };\n}\n\nexport const wechat = createWechatProvider();\n\nexport interface WechatUserInfo {\n  openid: string;\n  nickname: string;\n  sex: 0 | 1 | 2; // 0: unknown, 1: male, 2: female\n  province: string;\n  city: string;\n  country: string;\n  /**\n   * User's profile photo. The last numeric value represents the size of a square profile photo\n   * (The value can be 0, 46, 64, 96, or 132. The value 0 represents a 640*640 square profile\n   * photo). This parameter is left blank if a user has no profile photo. If the user changes the\n   * profile photo, the URL of the original profile photo will expire.\n   * e.g. http://thirdwx.qlogo.cn/mmopen/g3MonUZtNHkdmzicIlibx6iaFqAc56vxLSUfpb6n5WKSYVY0ChQKkiaJSgQ1dZuTOgvLLrhJbERQQ4eMsv84eavHiaiceqxibJxCfHe/46\n   */\n  headimgurl: string;\n  privilege: string[];\n  unionid?: string;\n}\n\nexport interface WechatToken extends OAuth2Token {\n  access_token: string;\n  expires_in: number;\n  refresh_token: string;\n  openid: string;\n  scope: string;\n  unionid?: string;\n}\n\ninterface WechatErrorResponse {\n  errcode: number;\n  errmsg: string;\n}\n"],"mappings":";;;;;;;AASA,SAAgB,qBAAqB,UAAmB,EAAE,iBAAiB,MAAM,GAAa;CAC5F,MAAM,EAAE,oBAAoB;CAC5B,OAAO;EACL,kBAAkB,kBACd,wDACA;EACJ,UAAU;EACV,iBAAiB;EACjB,aAAa;EACb,cAAc,CAAC,kBAAkB,oBAAoB,cAAc;EACnE,uBAAuB,QAAQ;GAC7B,MAAM,MAAM,IAAI,IAAI,KAAK,gBAAgB;GACzC,IAAI,aAAa,IAAI,SAAS,OAAO,QAAQ;GAC7C,IAAI,aAAa,IAAI,UAAU,OAAO,SAAS,KAAK,aAAA,CAAc,KAAK,GAAG,CAAC;GAC3E,IAAI,aAAa,IAAI,gBAAgB,OAAO,WAAW;GACvD,IAAI,aAAa,IAAI,iBAAiB,MAAM;GAC5C,IAAI,aAAa,IAAI,SAAS,OAAO,KAAK;GAC1C,OAAO;EACT;EACA,MAAM,0BAA0B,QAAQ;GACtC,CAAA,GAAA,cAAA,UAAA,CAAU,OAAO,cAAc,qCAAqC;GACpE,MAAM,MAAM,IAAI,IAAI,KAAK,QAAQ;GACjC,IAAI,aAAa,IAAI,SAAS,OAAO,QAAQ;GAC7C,IAAI,aAAa,IAAI,UAAU,OAAO,YAAY;GAClD,IAAI,aAAa,IAAI,QAAQ,OAAO,IAAI;GACxC,IAAI,aAAa,IAAI,cAAc,oBAAoB;GACvD,MAAM,WAAW,MAAM,MAAM,IAAI,IAAI;GACrC,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,SAAS,WAAY,MAAM,SAAS,KAAK;IACjD,MAAM,IAAIA,qBAAAA,YAAY,SAAS,QAAQ,QAAQ,YAAY,SAAS;GACtE;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,EAAE,cAAc,UAAU;GAC1C,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,aAAa,yBAAyB;GACrD,CAAA,GAAA,cAAA,UAAA,CAAU,UAAU,OAAO,WAAW,UAAU,oBAAoB;GACpE,MAAM,MAAM,IAAI,IAAI,KAAK,WAAW;GACpC,IAAI,aAAa,IAAI,gBAAgB,YAAY;GACjD,IAAI,aAAa,IAAI,UAAU,MAAM;GACrC,MAAM,WAAW,MAAM,MAAM,IAAI,IAAI;GACrC,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,SAAS,WAAY,MAAM,SAAS,KAAK;IACjD,MAAM,IAAIA,qBAAAA,YAAY,SAAS,QAAQ,QAAQ,YAAY,SAAS;GACtE;GACA,MAAM,OAAQ,MAAM,SAAS,KAAK;GAElC,OAAO;IACL;IACA,QAAQ;KACN,KAAK,KAAK,WAAW,KAAK;KAC1B,MAAM,KAAK;KACX,SAAS,GAAG,KAAK,WAAW,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,KAAK,GAAG,EAAE;KAC9D,QAAQ,KAAK,QAAQ,IAAI,SAAS,KAAK,QAAQ,IAAI,WAAW,KAAA;IAChE;GACF;EACF;EACA,MAAM,mBAAmB,QAAQ;GAC/B,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,iBAAiB,6BAA6B;GAC7D,MAAM,MAAM,IAAI,IAAI,KAAK,eAAe;GACxC,IAAI,aAAa,IAAI,SAAS,OAAO,QAAQ;GAC7C,IAAI,aAAa,IAAI,cAAc,eAAe;GAClD,IAAI,aAAa,IAAI,iBAAiB,OAAO,YAAY;GACzD,MAAM,WAAW,MAAM,MAAM,IAAI,IAAI;GACrC,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,SAAS,WAAY,MAAM,SAAS,KAAK;IACjD,MAAM,IAAIA,qBAAAA,YAAY,SAAS,QAAQ,QAAQ,YAAY,SAAS;GACtE;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;CACF;AACF;AAEA,MAAa,SAAS,qBAAqB"}

package/dist/oauth2/provider/wechat.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"wechat.d.cts","names":[],"sources":["../../../src/oauth2/provider/wechat.ts"],"mappings":";;YAIY;EAAY;;;;;wBAKR,qBAAqB,UAAS,UAAuC;qBAuExE,QAAM;iBAEF;EACf;EACA;EACA;EACA;EACA;EACA;;;;;;;;EAQA;EACA;EACA;;iBAGe,oBAAoB;EACnC;EACA;EACA;EACA;EACA;EACA"}
+{"version":3,"file":"wechat.d.cts","names":[],"sources":["../../../src/oauth2/provider/wechat.ts"],"mappings":";;YAIY;EAAY;;;;;wBAKR,qBAAqB,UAAS,UAAuC;qBAwExE,QAAM;iBAEF;EACf;EACA;EACA;EACA;EACA;EACA;;;;;;;;EAQA;EACA;EACA;;iBAGe,oBAAoB;EACnC;EACA;EACA;EACA;EACA;EACA"}

package/dist/oauth2/provider/wechat.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"wechat.d.mts","names":[],"sources":["../../../src/oauth2/provider/wechat.ts"],"mappings":";;YAIY;EAAY;;;;;wBAKR,qBAAqB,UAAS,UAAuC;qBAuExE,QAAM;iBAEF;EACf;EACA;EACA;EACA;EACA;EACA;;;;;;;;EAQA;EACA;EACA;;iBAGe,oBAAoB;EACnC;EACA;EACA;EACA;EACA;EACA"}
+{"version":3,"file":"wechat.d.mts","names":[],"sources":["../../../src/oauth2/provider/wechat.ts"],"mappings":";;YAIY;EAAY;;;;;wBAKR,qBAAqB,UAAS,UAAuC;qBAwExE,QAAM;iBAEF;EACf;EACA;EACA;EACA;EACA;EACA;;;;;;;;EAQA;EACA;EACA;;iBAGe,oBAAoB;EACnC;EACA;EACA;EACA;EACA;EACA"}

package/dist/oauth2/provider/wechat.mjs

@@ -22,6 +22,7 @@ function createWechatProvider(options = { isWechatBrowser: false }) {
 			return url;
 		},
 		async exchangeAuthorizationCode(params) {
+			invariant(params.clientSecret, "clientSecret is required for wechat");
 			const url = new URL(this.tokenUri);
 			url.searchParams.set("appid", params.clientId);
 			url.searchParams.set("secret", params.clientSecret);

package/dist/oauth2/provider/wechat.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"wechat.mjs","names":[],"sources":["../../../src/oauth2/provider/wechat.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport type { OAuth2Token, Provider } from '../types';\n\nexport type Options = { isWechatBrowser: boolean };\n\n/**\n * reference: https://developers.weixin.qq.com/doc/offiaccount/en/OA_Web_Apps/Wechat_webpage_authorization.html\n */\nexport function createWechatProvider(options: Options = { isWechatBrowser: false }): Provider {\n  const { isWechatBrowser } = options;\n  return {\n    authorizationUri: isWechatBrowser\n      ? 'https://open.weixin.qq.com/connect/oauth2/authorize'\n      : 'https://open.weixin.qq.com/connect/qrconnect',\n    tokenUri: 'https://api.weixin.qq.com/sns/oauth2/access_token',\n    tokenRefreshUri: 'https://api.weixin.qq.com/sns/oauth2/refresh_token',\n    userInfoUri: 'https://api.weixin.qq.com/sns/userinfo',\n    defaultScope: [isWechatBrowser ? 'snsapi_userinfo' : 'snsapi_login'],\n    createAuthorizationUri(params) {\n      const url = new URL(this.authorizationUri);\n      url.searchParams.set('appid', params.clientId);\n      url.searchParams.set('scope', (params.scope ?? this.defaultScope).join(','));\n      url.searchParams.set('redirect_uri', params.redirectUri);\n      url.searchParams.set('response_type', 'code');\n      url.searchParams.set('state', params.state);\n      return url;\n    },\n    async exchangeAuthorizationCode(params) {\n      const url = new URL(this.tokenUri);\n      url.searchParams.set('appid', params.clientId);\n      url.searchParams.set('secret', params.clientSecret);\n      url.searchParams.set('code', params.code);\n      url.searchParams.set('grant_type', 'authorization_code');\n      const response = await fetch(url.href);\n      if (!response.ok) {\n        const { errcode, errmsg } = (await response.json()) as WechatErrorResponse;\n        throw new OAuth2Error(response.status, errmsg, `errcode: ${errcode}`);\n      }\n      return (await response.json()) as WechatToken;\n    },\n    async getUserInfo({ access_token, openid }) {\n      invariant(this.userInfoUri, 'userInfoUri is required');\n      invariant(openid && typeof openid === 'string', 'openid is required');\n      const url = new URL(this.userInfoUri);\n      url.searchParams.set('access_token', access_token);\n      url.searchParams.set('openid', openid);\n      const response = await fetch(url.href);\n      if (!response.ok) {\n        const { errcode, errmsg } = (await response.json()) as WechatErrorResponse;\n        throw new OAuth2Error(response.status, errmsg, `errcode: ${errcode}`);\n      }\n      const data = (await response.json()) as WechatUserInfo;\n\n      return {\n        data,\n        claims: {\n          sub: data.unionid ?? data.openid,\n          name: data.nickname,\n          picture: `${data.headimgurl.split('/').slice(0, -1).join('/')}/0`,\n          gender: data.sex === 1 ? 'male' : data.sex === 2 ? 'female' : undefined,\n        },\n      };\n    },\n    async refreshAccessToken(params) {\n      invariant(this.tokenRefreshUri, 'tokenRefreshUri is required');\n      const url = new URL(this.tokenRefreshUri);\n      url.searchParams.set('appid', params.clientId);\n      url.searchParams.set('grant_type', 'refresh_token');\n      url.searchParams.set('refresh_token', params.refreshToken);\n      const response = await fetch(url.href);\n      if (!response.ok) {\n        const { errcode, errmsg } = (await response.json()) as WechatErrorResponse;\n        throw new OAuth2Error(response.status, errmsg, `errcode: ${errcode}`);\n      }\n      return (await response.json()) as WechatToken;\n    },\n  };\n}\n\nexport const wechat = createWechatProvider();\n\nexport interface WechatUserInfo {\n  openid: string;\n  nickname: string;\n  sex: 0 | 1 | 2; // 0: unknown, 1: male, 2: female\n  province: string;\n  city: string;\n  country: string;\n  /**\n   * User's profile photo. The last numeric value represents the size of a square profile photo\n   * (The value can be 0, 46, 64, 96, or 132. The value 0 represents a 640*640 square profile\n   * photo). This parameter is left blank if a user has no profile photo. If the user changes the\n   * profile photo, the URL of the original profile photo will expire.\n   * e.g. http://thirdwx.qlogo.cn/mmopen/g3MonUZtNHkdmzicIlibx6iaFqAc56vxLSUfpb6n5WKSYVY0ChQKkiaJSgQ1dZuTOgvLLrhJbERQQ4eMsv84eavHiaiceqxibJxCfHe/46\n   */\n  headimgurl: string;\n  privilege: string[];\n  unionid?: string;\n}\n\nexport interface WechatToken extends OAuth2Token {\n  access_token: string;\n  expires_in: number;\n  refresh_token: string;\n  openid: string;\n  scope: string;\n  unionid?: string;\n}\n\ninterface WechatErrorResponse {\n  errcode: number;\n  errmsg: string;\n}\n"],"mappings":";;;;;;AASA,SAAgB,qBAAqB,UAAmB,EAAE,iBAAiB,MAAM,GAAa;CAC5F,MAAM,EAAE,oBAAoB;CAC5B,OAAO;EACL,kBAAkB,kBACd,wDACA;EACJ,UAAU;EACV,iBAAiB;EACjB,aAAa;EACb,cAAc,CAAC,kBAAkB,oBAAoB,cAAc;EACnE,uBAAuB,QAAQ;GAC7B,MAAM,MAAM,IAAI,IAAI,KAAK,gBAAgB;GACzC,IAAI,aAAa,IAAI,SAAS,OAAO,QAAQ;GAC7C,IAAI,aAAa,IAAI,UAAU,OAAO,SAAS,KAAK,aAAA,CAAc,KAAK,GAAG,CAAC;GAC3E,IAAI,aAAa,IAAI,gBAAgB,OAAO,WAAW;GACvD,IAAI,aAAa,IAAI,iBAAiB,MAAM;GAC5C,IAAI,aAAa,IAAI,SAAS,OAAO,KAAK;GAC1C,OAAO;EACT;EACA,MAAM,0BAA0B,QAAQ;GACtC,MAAM,MAAM,IAAI,IAAI,KAAK,QAAQ;GACjC,IAAI,aAAa,IAAI,SAAS,OAAO,QAAQ;GAC7C,IAAI,aAAa,IAAI,UAAU,OAAO,YAAY;GAClD,IAAI,aAAa,IAAI,QAAQ,OAAO,IAAI;GACxC,IAAI,aAAa,IAAI,cAAc,oBAAoB;GACvD,MAAM,WAAW,MAAM,MAAM,IAAI,IAAI;GACrC,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,SAAS,WAAY,MAAM,SAAS,KAAK;IACjD,MAAM,IAAI,YAAY,SAAS,QAAQ,QAAQ,YAAY,SAAS;GACtE;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,EAAE,cAAc,UAAU;GAC1C,UAAU,KAAK,aAAa,yBAAyB;GACrD,UAAU,UAAU,OAAO,WAAW,UAAU,oBAAoB;GACpE,MAAM,MAAM,IAAI,IAAI,KAAK,WAAW;GACpC,IAAI,aAAa,IAAI,gBAAgB,YAAY;GACjD,IAAI,aAAa,IAAI,UAAU,MAAM;GACrC,MAAM,WAAW,MAAM,MAAM,IAAI,IAAI;GACrC,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,SAAS,WAAY,MAAM,SAAS,KAAK;IACjD,MAAM,IAAI,YAAY,SAAS,QAAQ,QAAQ,YAAY,SAAS;GACtE;GACA,MAAM,OAAQ,MAAM,SAAS,KAAK;GAElC,OAAO;IACL;IACA,QAAQ;KACN,KAAK,KAAK,WAAW,KAAK;KAC1B,MAAM,KAAK;KACX,SAAS,GAAG,KAAK,WAAW,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,KAAK,GAAG,EAAE;KAC9D,QAAQ,KAAK,QAAQ,IAAI,SAAS,KAAK,QAAQ,IAAI,WAAW,KAAA;IAChE;GACF;EACF;EACA,MAAM,mBAAmB,QAAQ;GAC/B,UAAU,KAAK,iBAAiB,6BAA6B;GAC7D,MAAM,MAAM,IAAI,IAAI,KAAK,eAAe;GACxC,IAAI,aAAa,IAAI,SAAS,OAAO,QAAQ;GAC7C,IAAI,aAAa,IAAI,cAAc,eAAe;GAClD,IAAI,aAAa,IAAI,iBAAiB,OAAO,YAAY;GACzD,MAAM,WAAW,MAAM,MAAM,IAAI,IAAI;GACrC,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,SAAS,WAAY,MAAM,SAAS,KAAK;IACjD,MAAM,IAAI,YAAY,SAAS,QAAQ,QAAQ,YAAY,SAAS;GACtE;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;CACF;AACF;AAEA,MAAa,SAAS,qBAAqB"}
+{"version":3,"file":"wechat.mjs","names":[],"sources":["../../../src/oauth2/provider/wechat.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport type { OAuth2Token, Provider } from '../types';\n\nexport type Options = { isWechatBrowser: boolean };\n\n/**\n * reference: https://developers.weixin.qq.com/doc/offiaccount/en/OA_Web_Apps/Wechat_webpage_authorization.html\n */\nexport function createWechatProvider(options: Options = { isWechatBrowser: false }): Provider {\n  const { isWechatBrowser } = options;\n  return {\n    authorizationUri: isWechatBrowser\n      ? 'https://open.weixin.qq.com/connect/oauth2/authorize'\n      : 'https://open.weixin.qq.com/connect/qrconnect',\n    tokenUri: 'https://api.weixin.qq.com/sns/oauth2/access_token',\n    tokenRefreshUri: 'https://api.weixin.qq.com/sns/oauth2/refresh_token',\n    userInfoUri: 'https://api.weixin.qq.com/sns/userinfo',\n    defaultScope: [isWechatBrowser ? 'snsapi_userinfo' : 'snsapi_login'],\n    createAuthorizationUri(params) {\n      const url = new URL(this.authorizationUri);\n      url.searchParams.set('appid', params.clientId);\n      url.searchParams.set('scope', (params.scope ?? this.defaultScope).join(','));\n      url.searchParams.set('redirect_uri', params.redirectUri);\n      url.searchParams.set('response_type', 'code');\n      url.searchParams.set('state', params.state);\n      return url;\n    },\n    async exchangeAuthorizationCode(params) {\n      invariant(params.clientSecret, 'clientSecret is required for wechat');\n      const url = new URL(this.tokenUri);\n      url.searchParams.set('appid', params.clientId);\n      url.searchParams.set('secret', params.clientSecret);\n      url.searchParams.set('code', params.code);\n      url.searchParams.set('grant_type', 'authorization_code');\n      const response = await fetch(url.href);\n      if (!response.ok) {\n        const { errcode, errmsg } = (await response.json()) as WechatErrorResponse;\n        throw new OAuth2Error(response.status, errmsg, `errcode: ${errcode}`);\n      }\n      return (await response.json()) as WechatToken;\n    },\n    async getUserInfo({ access_token, openid }) {\n      invariant(this.userInfoUri, 'userInfoUri is required');\n      invariant(openid && typeof openid === 'string', 'openid is required');\n      const url = new URL(this.userInfoUri);\n      url.searchParams.set('access_token', access_token);\n      url.searchParams.set('openid', openid);\n      const response = await fetch(url.href);\n      if (!response.ok) {\n        const { errcode, errmsg } = (await response.json()) as WechatErrorResponse;\n        throw new OAuth2Error(response.status, errmsg, `errcode: ${errcode}`);\n      }\n      const data = (await response.json()) as WechatUserInfo;\n\n      return {\n        data,\n        claims: {\n          sub: data.unionid ?? data.openid,\n          name: data.nickname,\n          picture: `${data.headimgurl.split('/').slice(0, -1).join('/')}/0`,\n          gender: data.sex === 1 ? 'male' : data.sex === 2 ? 'female' : undefined,\n        },\n      };\n    },\n    async refreshAccessToken(params) {\n      invariant(this.tokenRefreshUri, 'tokenRefreshUri is required');\n      const url = new URL(this.tokenRefreshUri);\n      url.searchParams.set('appid', params.clientId);\n      url.searchParams.set('grant_type', 'refresh_token');\n      url.searchParams.set('refresh_token', params.refreshToken);\n      const response = await fetch(url.href);\n      if (!response.ok) {\n        const { errcode, errmsg } = (await response.json()) as WechatErrorResponse;\n        throw new OAuth2Error(response.status, errmsg, `errcode: ${errcode}`);\n      }\n      return (await response.json()) as WechatToken;\n    },\n  };\n}\n\nexport const wechat = createWechatProvider();\n\nexport interface WechatUserInfo {\n  openid: string;\n  nickname: string;\n  sex: 0 | 1 | 2; // 0: unknown, 1: male, 2: female\n  province: string;\n  city: string;\n  country: string;\n  /**\n   * User's profile photo. The last numeric value represents the size of a square profile photo\n   * (The value can be 0, 46, 64, 96, or 132. The value 0 represents a 640*640 square profile\n   * photo). This parameter is left blank if a user has no profile photo. If the user changes the\n   * profile photo, the URL of the original profile photo will expire.\n   * e.g. http://thirdwx.qlogo.cn/mmopen/g3MonUZtNHkdmzicIlibx6iaFqAc56vxLSUfpb6n5WKSYVY0ChQKkiaJSgQ1dZuTOgvLLrhJbERQQ4eMsv84eavHiaiceqxibJxCfHe/46\n   */\n  headimgurl: string;\n  privilege: string[];\n  unionid?: string;\n}\n\nexport interface WechatToken extends OAuth2Token {\n  access_token: string;\n  expires_in: number;\n  refresh_token: string;\n  openid: string;\n  scope: string;\n  unionid?: string;\n}\n\ninterface WechatErrorResponse {\n  errcode: number;\n  errmsg: string;\n}\n"],"mappings":";;;;;;AASA,SAAgB,qBAAqB,UAAmB,EAAE,iBAAiB,MAAM,GAAa;CAC5F,MAAM,EAAE,oBAAoB;CAC5B,OAAO;EACL,kBAAkB,kBACd,wDACA;EACJ,UAAU;EACV,iBAAiB;EACjB,aAAa;EACb,cAAc,CAAC,kBAAkB,oBAAoB,cAAc;EACnE,uBAAuB,QAAQ;GAC7B,MAAM,MAAM,IAAI,IAAI,KAAK,gBAAgB;GACzC,IAAI,aAAa,IAAI,SAAS,OAAO,QAAQ;GAC7C,IAAI,aAAa,IAAI,UAAU,OAAO,SAAS,KAAK,aAAA,CAAc,KAAK,GAAG,CAAC;GAC3E,IAAI,aAAa,IAAI,gBAAgB,OAAO,WAAW;GACvD,IAAI,aAAa,IAAI,iBAAiB,MAAM;GAC5C,IAAI,aAAa,IAAI,SAAS,OAAO,KAAK;GAC1C,OAAO;EACT;EACA,MAAM,0BAA0B,QAAQ;GACtC,UAAU,OAAO,cAAc,qCAAqC;GACpE,MAAM,MAAM,IAAI,IAAI,KAAK,QAAQ;GACjC,IAAI,aAAa,IAAI,SAAS,OAAO,QAAQ;GAC7C,IAAI,aAAa,IAAI,UAAU,OAAO,YAAY;GAClD,IAAI,aAAa,IAAI,QAAQ,OAAO,IAAI;GACxC,IAAI,aAAa,IAAI,cAAc,oBAAoB;GACvD,MAAM,WAAW,MAAM,MAAM,IAAI,IAAI;GACrC,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,SAAS,WAAY,MAAM,SAAS,KAAK;IACjD,MAAM,IAAI,YAAY,SAAS,QAAQ,QAAQ,YAAY,SAAS;GACtE;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,EAAE,cAAc,UAAU;GAC1C,UAAU,KAAK,aAAa,yBAAyB;GACrD,UAAU,UAAU,OAAO,WAAW,UAAU,oBAAoB;GACpE,MAAM,MAAM,IAAI,IAAI,KAAK,WAAW;GACpC,IAAI,aAAa,IAAI,gBAAgB,YAAY;GACjD,IAAI,aAAa,IAAI,UAAU,MAAM;GACrC,MAAM,WAAW,MAAM,MAAM,IAAI,IAAI;GACrC,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,SAAS,WAAY,MAAM,SAAS,KAAK;IACjD,MAAM,IAAI,YAAY,SAAS,QAAQ,QAAQ,YAAY,SAAS;GACtE;GACA,MAAM,OAAQ,MAAM,SAAS,KAAK;GAElC,OAAO;IACL;IACA,QAAQ;KACN,KAAK,KAAK,WAAW,KAAK;KAC1B,MAAM,KAAK;KACX,SAAS,GAAG,KAAK,WAAW,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,KAAK,GAAG,EAAE;KAC9D,QAAQ,KAAK,QAAQ,IAAI,SAAS,KAAK,QAAQ,IAAI,WAAW,KAAA;IAChE;GACF;EACF;EACA,MAAM,mBAAmB,QAAQ;GAC/B,UAAU,KAAK,iBAAiB,6BAA6B;GAC7D,MAAM,MAAM,IAAI,IAAI,KAAK,eAAe;GACxC,IAAI,aAAa,IAAI,SAAS,OAAO,QAAQ;GAC7C,IAAI,aAAa,IAAI,cAAc,eAAe;GAClD,IAAI,aAAa,IAAI,iBAAiB,OAAO,YAAY;GACzD,MAAM,WAAW,MAAM,MAAM,IAAI,IAAI;GACrC,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,SAAS,WAAY,MAAM,SAAS,KAAK;IACjD,MAAM,IAAI,YAAY,SAAS,QAAQ,QAAQ,YAAY,SAAS;GACtE;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;CACF;AACF;AAEA,MAAa,SAAS,qBAAqB"}

package/dist/oauth2/types.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.cjs","names":[],"sources":["../../src/oauth2/types.ts"],"sourcesContent":["// reference: https://datatracker.ietf.org/doc/html/rfc7636\nexport interface PkceParameters {\n  code_verifier: string;\n  code_challenge: string;\n  code_challenge_method: 'S256' | 'plain';\n}\n\nexport interface OAuth2AuthorizationRequest {\n  state: string;\n  registrationId: string;\n  authorizationRequestUri: string;\n  additionalParameters: PkceParameters;\n  /**\n   * What the host attached when the flow started (`oauth2Authorization` options), kept on the\n   * server and handed back to `onAuthorized` once the callback checks out. Never sent to the\n   * provider, unlike `additionalParameters`. Absent on requests stored before this field existed.\n   */\n  attributes?: Record<string, string>;\n}\n\ninterface CreateAuthorizationUriParams {\n  state: string;\n  clientId: string;\n  redirectUri: string;\n  scope: string[] | undefined;\n  pkce?: Omit<PkceParameters, 'code_verifier'>;\n}\n\nexport interface ExchangeCodeParams {\n  code: string;\n  clientId: string;\n  clientSecret: string;\n  redirectUri: string;\n  pkce?: Omit<PkceParameters, 'code_challenge' | 'code_challenge_method'>;\n}\n\nexport interface RefreshTokenParams {\n  clientId: string;\n  clientSecret: string;\n  refreshToken: string;\n}\n\nexport interface RevokeTokenParams {\n  token: string;\n  clientId: string;\n  clientSecret: string;\n}\n\nexport interface LoginOAuth2NativeParams {\n  clientId: string;\n  clientSecret: string;\n  redirectUri: string;\n  pkce?: PkceParameters;\n  credentials: NativeCredential;\n}\n\n// reference: https://datatracker.ietf.org/doc/html/rfc6749#section-5.1\nexport interface OAuth2Token {\n  /**\n   * REQUIRED.\n   * The access token issued by the authorization server.\n   */\n  access_token: string;\n\n  /**\n   * REQUIRED.\n   * The type of the token issued as described in Section 7.1.  Value is case insensitive.\n   */\n  token_type: 'Bearer' | 'bearer' | 'mac' | (string & {});\n\n  /**\n   * RECOMMENDED.\n   * The lifetime in seconds of the access token. For example, the value \"3600\" denotes that the\n   * access token will expire in one hour from the time the response was generated. If omitted, the\n   * authorization server SHOULD provide the expiration time via other means or document the default\n   * value.\n   */\n  expires_in?: number;\n\n  /**\n   * OPTIONAL.\n   * The refresh token, which can be used to obtain new access tokens using the same authorization\n   * grant as described in Section 6.\n   */\n  refresh_token?: string;\n\n  /**\n   * OPTIONAL.\n   * If identical to the scope requested by the client; otherwise, REQUIRED. The scope of the\n   * access token as described by Section 3.3.\n   */\n  scope?: string;\n\n  id_token?: string;\n\n  [key: string]: unknown;\n}\n\nexport interface OidcToken extends OAuth2Token {\n  id_token: string;\n}\n\nexport type NativeCredential = {\n  state?: string;\n  code?: string;\n  client_id?: string;\n  redirect_uri?: string;\n  id_token?: string;\n  access_token?: string;\n};\n\nexport const OIDC_SCOPES = [\n  'openid',\n  'profile',\n  'email',\n  'phone',\n  'address',\n  'offline_access',\n] as const;\n\nexport type OidcScope = (typeof OIDC_SCOPES)[number];\n\n// https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims\nexport interface StandardClaims {\n  sub: string;\n  name?: string;\n  given_name?: string;\n  family_name?: string;\n  middle_name?: string;\n  nickname?: string;\n  preferred_username?: string;\n  profile?: string;\n  picture?: string;\n  website?: string;\n  email?: string;\n  email_verified?: boolean;\n  gender?: 'female' | 'male' | (string & {});\n  birthdate?: string; // ISO 8601-1 [ISO8601‑1] YYYY-MM-DD format.\n  zoneinfo?: string; // IANA Time Zone Database [IANA.time‑zones]\n  locale?: string; // BCP47 [RFC5646] language tag.\n  phone_number?: string; // E.164\n  phone_number_verified?: boolean;\n  address?: {\n    formatted: string;\n    street_address: string;\n    locality: string;\n    region: string;\n    postal_code: string;\n    country: string;\n  }; // [RFC8259] JSON object\n  updated_at?: number;\n}\n\nexport interface UserInfo<T = unknown> {\n  claims: StandardClaims;\n  data: T;\n}\n\nexport interface Provider {\n  /** Authorization URI for the provider. */\n  authorizationUri: string;\n\n  /** Token URI for the provider. */\n  tokenUri: string;\n\n  /** Token revoke URI for the provider. */\n  tokenRevokeUri?: string;\n\n  /** Token refresh URI for the provider. */\n  tokenRefreshUri?: string;\n\n  /** User info URI for the provider. */\n  userInfoUri?: string;\n\n  /** User info authentication method for the provider. */\n  userInfoAuthenticationMethod?: string;\n\n  /**\n   * Name of the attribute that will be used to extract the username from the call to 'userInfoUri'.\n   * */\n  userNameAttribute?: string;\n\n  /** JWK set URI for the provider */\n  jwkSetUri?: string;\n\n  /**\n   * URI that can either be an OpenID Connect discovery endpoint or an OAuth 2.0 Authorization\n   * Server Metadata endpoint defined by RFC 8414.\n   * */\n  issuerUri?: string;\n\n  /** Default scopes for the provider. */\n  defaultScope: string[];\n\n  /** step 1: generate authorization uri and redirect user to it */\n  createAuthorizationUri: (params: CreateAuthorizationUriParams) => URL;\n\n  /** step 2: exchange code for token */\n  exchangeAuthorizationCode: (params: ExchangeCodeParams) => Promise<OAuth2Token>;\n\n  /** step 3: get user info */\n  getUserInfo: (token: OAuth2Token) => Promise<UserInfo>;\n\n  /** others: refresh access token */\n  refreshAccessToken?: (params: RefreshTokenParams) => Promise<OAuth2Token>;\n\n  /** others: revoke token */\n  revokeToken?: (params: RevokeTokenParams) => Promise<void>;\n\n  loginOAuth2Native?: (\n    params: LoginOAuth2NativeParams\n  ) => Promise<{ token: OAuth2Token; userInfo: UserInfo }>;\n}\n\nexport interface OneTapProvider extends Provider {\n  getTokenInfo: (id_token: string) => Promise<{ token: OAuth2Token; userInfo: UserInfo }>;\n}\n\nexport interface Registration {\n  /**\n   * Reference to the OAuth 2.0 provider to use. May reference an element from the 'provider'\n   * property or used one of the commonly used providers (google, github, facebook, okta).\n   * */\n  provider?: string;\n\n  /** Client ID for the registration. */\n  clientId: string;\n\n  /** Client secret of the registration. */\n  clientSecret: string;\n\n  /** Client authentication method. May be left blank when using a pre-defined provider. */\n  clientAuthenticationMethod?: string;\n\n  /** Authorization grant type. May be left blank when using a pre-defined provider. */\n  authorizationGrantType?:\n    | 'authorization_code' // default\n    | 'client_credentials'\n    | 'device_code'\n    | 'jwt_bearer'\n    // Deprecated. The latest OAuth 2.0 Security Best Current Practice disallows the use of the\n    // Resource Owner Password Credentials grant.\n    | 'password'\n    | 'refresh_token'\n    | 'token_exchange';\n\n  /** Redirect URI. May be left blank when using a pre-defined provider. */\n  redirectUri?: string;\n\n  /** Authorization scopes. When left blank the provider's default scopes, if any, will be used. */\n  scope?: string[];\n\n  /** Client name. May be left blank when using a pre-defined provider. */\n  clientName?: string;\n}\n\nexport interface OAuth2ClientConfig {\n  baseUri: string;\n  errorUri: string;\n  successUri: string;\n  provider: { [name: string]: Provider | undefined };\n  registration:\n    | { [name: string]: Registration | undefined }\n    | (() => Promise<{ [name: string]: Registration | undefined }>);\n}\n"],"mappings":";;AA+GA,MAAa,cAAc;CACzB;CACA;CACA;CACA;CACA;CACA;AACF"}
+{"version":3,"file":"types.cjs","names":[],"sources":["../../src/oauth2/types.ts"],"sourcesContent":["// reference: https://datatracker.ietf.org/doc/html/rfc7636\nexport interface PkceParameters {\n  code_verifier: string;\n  code_challenge: string;\n  code_challenge_method: 'S256' | 'plain';\n}\n\nexport interface OAuth2AuthorizationRequest {\n  state: string;\n  /** Key of the provider in `OAuth2ClientConfig.providers` the flow was started for. */\n  provider: string;\n  authorizationRequestUri: string;\n  additionalParameters: PkceParameters;\n  /**\n   * What the host attached when the flow started (`oauth2Authorization` options), kept on the\n   * server and handed back to `onAuthorized` once the callback checks out. Never sent to the\n   * provider, unlike `additionalParameters`. Absent on requests stored before this field existed.\n   */\n  attributes?: Record<string, string>;\n}\n\ninterface CreateAuthorizationUriParams {\n  state: string;\n  clientId: string;\n  redirectUri: string;\n  scope: string[] | undefined;\n  pkce?: Omit<PkceParameters, 'code_verifier'>;\n}\n\nexport interface ExchangeCodeParams {\n  code: string;\n  clientId: string;\n  /** Absent for public clients (Google's installed-app clients, PKCE-only clients). */\n  clientSecret?: string;\n  redirectUri: string;\n  pkce?: Omit<PkceParameters, 'code_challenge' | 'code_challenge_method'>;\n}\n\nexport interface RefreshTokenParams {\n  clientId: string;\n  clientSecret?: string;\n  refreshToken: string;\n}\n\nexport interface RevokeTokenParams {\n  token: string;\n  clientId: string;\n  clientSecret?: string;\n}\n\nexport interface LoginOAuth2NativeParams {\n  /**\n   * The configured client the app signs in as (its `client_id`, or the provider's default native\n   * client). Id tokens must be issued to it: it is the only audience accepted.\n   */\n  clientId: string;\n  clientSecret?: string;\n  redirectUri: string;\n  pkce?: PkceParameters;\n  credentials: NativeCredential;\n}\n\n// reference: https://datatracker.ietf.org/doc/html/rfc6749#section-5.1\nexport interface OAuth2Token {\n  /**\n   * REQUIRED.\n   * The access token issued by the authorization server.\n   */\n  access_token: string;\n\n  /**\n   * REQUIRED.\n   * The type of the token issued as described in Section 7.1.  Value is case insensitive.\n   */\n  token_type: 'Bearer' | 'bearer' | 'mac' | (string & {});\n\n  /**\n   * RECOMMENDED.\n   * The lifetime in seconds of the access token. For example, the value \"3600\" denotes that the\n   * access token will expire in one hour from the time the response was generated. If omitted, the\n   * authorization server SHOULD provide the expiration time via other means or document the default\n   * value.\n   */\n  expires_in?: number;\n\n  /**\n   * OPTIONAL.\n   * The refresh token, which can be used to obtain new access tokens using the same authorization\n   * grant as described in Section 6.\n   */\n  refresh_token?: string;\n\n  /**\n   * OPTIONAL.\n   * If identical to the scope requested by the client; otherwise, REQUIRED. The scope of the\n   * access token as described by Section 3.3.\n   */\n  scope?: string;\n\n  id_token?: string;\n\n  [key: string]: unknown;\n}\n\nexport interface OidcToken extends OAuth2Token {\n  id_token: string;\n}\n\nexport type NativeCredential = {\n  state?: string;\n  code?: string;\n  client_id?: string;\n  redirect_uri?: string;\n  id_token?: string;\n  access_token?: string;\n  /**\n   * The user's name as the platform hands it to the app, for providers whose id token carries none\n   * (Apple sends it on the first authorization only): iOS\n   * `ASAuthorizationAppleIDCredential.fullName`, expo-apple-authentication's `credential.fullName`.\n   * The snake_case fields above are OAuth / OIDC protocol parameters; this one is not, it is the\n   * platform's object passed through unchanged, so it keeps the platform's own name and apps send\n   * `fullName: credential.fullName` as is. Unsigned client input: the provider cleans each part and\n   * ignores anything that is not a string. Parts with a standard claim become `given_name`,\n   * `family_name`, `middle_name` and `nickname`; `namePrefix` / `nameSuffix` have none and are kept\n   * in `userInfo.data.fullName` only.\n   */\n  fullName?: PersonNameComponents;\n};\n\n/** iOS `PersonNameComponents` as JSON; every part may be missing or `null`. */\nexport interface PersonNameComponents {\n  givenName?: string | null;\n  familyName?: string | null;\n  middleName?: string | null;\n  namePrefix?: string | null;\n  nameSuffix?: string | null;\n  nickname?: string | null;\n}\n\n/**\n * Fields of the authorization response besides `code` and `state` that a provider uses to fill in\n * the user info: Apple posts the user's name as `user` (JSON) with the first authorization only,\n * since its id token never carries one. Unsigned, so treated as untrusted input.\n */\nexport interface AuthorizationResponse {\n  user?: string;\n}\n\nexport const OIDC_SCOPES = [\n  'openid',\n  'profile',\n  'email',\n  'phone',\n  'address',\n  'offline_access',\n] as const;\n\nexport type OidcScope = (typeof OIDC_SCOPES)[number];\n\n// https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims\nexport interface StandardClaims {\n  sub: string;\n  name?: string;\n  given_name?: string;\n  family_name?: string;\n  middle_name?: string;\n  nickname?: string;\n  preferred_username?: string;\n  profile?: string;\n  picture?: string;\n  website?: string;\n  email?: string;\n  email_verified?: boolean;\n  gender?: 'female' | 'male' | (string & {});\n  birthdate?: string; // ISO 8601-1 [ISO8601‑1] YYYY-MM-DD format.\n  zoneinfo?: string; // IANA Time Zone Database [IANA.time‑zones]\n  locale?: string; // BCP47 [RFC5646] language tag.\n  phone_number?: string; // E.164\n  phone_number_verified?: boolean;\n  address?: {\n    formatted: string;\n    street_address: string;\n    locality: string;\n    region: string;\n    postal_code: string;\n    country: string;\n  }; // [RFC8259] JSON object\n  updated_at?: number;\n}\n\nexport interface UserInfo<T = unknown> {\n  claims: StandardClaims;\n  data: T;\n}\n\nexport interface Provider {\n  /** Authorization URI for the provider. */\n  authorizationUri: string;\n\n  /** Token URI for the provider. */\n  tokenUri: string;\n\n  /** Token revoke URI for the provider. */\n  tokenRevokeUri?: string;\n\n  /** Token refresh URI for the provider. */\n  tokenRefreshUri?: string;\n\n  /** User info URI for the provider. */\n  userInfoUri?: string;\n\n  /** User info authentication method for the provider. */\n  userInfoAuthenticationMethod?: string;\n\n  /**\n   * Name of the attribute that will be used to extract the username from the call to 'userInfoUri'.\n   * */\n  userNameAttribute?: string;\n\n  /** JWK set URI for the provider */\n  jwkSetUri?: string;\n\n  /**\n   * URI that can either be an OpenID Connect discovery endpoint or an OAuth 2.0 Authorization\n   * Server Metadata endpoint defined by RFC 8414.\n   * */\n  issuerUri?: string;\n\n  /** Default scopes for the provider. */\n  defaultScope: string[];\n\n  /** step 1: generate authorization uri and redirect user to it */\n  createAuthorizationUri: (params: CreateAuthorizationUriParams) => URL;\n\n  /** step 2: exchange code for token */\n  exchangeAuthorizationCode: (params: ExchangeCodeParams) => Promise<OAuth2Token>;\n\n  /**\n   * step 3: get user info. `context.clientId` is the client the token was issued to, the only\n   * audience an id token may carry; `context.response` holds what the authorization response\n   * carried besides the code, for the providers that send user data there (Apple).\n   */\n  getUserInfo: (token: OAuth2Token, context: UserInfoContext) => Promise<UserInfo>;\n\n  /** others: refresh access token */\n  refreshAccessToken?: (params: RefreshTokenParams) => Promise<OAuth2Token>;\n\n  /** others: revoke token */\n  revokeToken?: (params: RevokeTokenParams) => Promise<void>;\n\n  loginOAuth2Native?: (\n    params: LoginOAuth2NativeParams\n  ) => Promise<{ token: OAuth2Token; userInfo: UserInfo }>;\n}\n\nexport interface UserInfoContext {\n  clientId: string;\n  response?: AuthorizationResponse;\n}\n\nexport interface OneTapProvider extends Provider {\n  /** Verifies a One Tap / FedCM credential, which must be issued to `clientId` (the web client). */\n  getTokenInfo: (\n    id_token: string,\n    clientId: string\n  ) => Promise<{ token: OAuth2Token; userInfo: UserInfo }>;\n}\n\n/**\n * A client secret: a fixed string, or a function minting one for the client id it is called with\n * (Sign in with Apple's signed JWT, see `createAppleClientSecret`), called on every use so it can\n * cache and renew on its own.\n */\nexport type ClientSecret = string | ((clientId: string) => string | Promise<string>);\n\n/** The client a provider's server-side flows sign in as: the redirect flow and Google One Tap. */\nexport interface WebClient {\n  clientId: string;\n  /** Absent for a public client. */\n  clientSecret?: ClientSecret;\n  /** Default: `${baseUri}/login/oauth2/code/<provider key>`. */\n  redirectUri?: string;\n  /** Authorization scopes. Default: the provider's `defaultScope`. */\n  scope?: string[];\n}\n\n/**\n * A client an app signs in as on the device (an iOS bundle id, a Google iOS / Android client) and\n * whose code or id token it posts to the native login route.\n */\nexport interface NativeClient {\n  clientId: string;\n  /** Absent for a public client (Google's installed-app clients have none). */\n  clientSecret?: ClientSecret;\n  /**\n   * Redirect URI sent with the code exchange when the app sends no `redirect_uri` of its own.\n   * Default: `${baseUri}/login/oauth2/code/<provider key>`.\n   */\n  redirectUri?: string;\n}\n\n/**\n * One identity source: every user it signs in has a `sub` unique within it, whichever client they\n * came through. The key in `OAuth2ClientConfig.providers` names it in the routes and in\n * `onAuthorized`. Two keys may share an implementation (two Google Cloud projects, one Okta per\n * tenant) when their subjects are separate namespaces.\n */\nexport interface ProviderConfig {\n  /** The implementation: `apple`, `google`, `github`, ... from `@shware/security/oauth2/provider`. */\n  provider: Provider;\n  /** The redirect flow's and One Tap's client. Required by those flows. */\n  web?: WebClient;\n  /**\n   * Clients the native login accepts besides `web`. An app names its client with `client_id`;\n   * without one, the only native client is used, or `web` when there is none.\n   */\n  native?: NativeClient[];\n}\n\nexport type ProvidersConfig = { [key: string]: ProviderConfig | undefined };\n\nexport interface OAuth2ClientConfig {\n  baseUri: string;\n  errorUri: string;\n  successUri: string;\n  /** Providers by key; a function is called per request, for secrets read at request time. */\n  providers: ProvidersConfig | (() => Promise<ProvidersConfig>);\n}\n"],"mappings":";;AAoJA,MAAa,cAAc;CACzB;CACA;CACA;CACA;CACA;CACA;AACF"}