@shware/security 4.1.0 → 5.0.0

package/dist/oauth2/client.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"client.cjs","names":["object","optional","string"],"sources":["../../src/oauth2/client.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { object, optional, string } from 'zod/v4-mini';\nimport type {\n  AuthorizationResponse,\n  NativeCredential,\n  OAuth2ClientConfig,\n  OAuth2Token,\n  OidcToken,\n  PkceParameters,\n} from './types';\n\nexport const oauth2RedirectQuerySchema = object({\n  code: optional(string()),\n  state: optional(string()),\n  error: optional(string()),\n  error_description: optional(string()),\n  error_uri: optional(string()),\n  // Apple's form_post: the user's name as JSON, first authorization only.\n  user: optional(string()),\n});\n\nexport const googleOneTapSchema = object({\n  // login_uri\n  code: optional(string()),\n  state: optional(string()),\n  error: optional(string()),\n  error_description: optional(string()),\n  error_uri: optional(string()),\n  nonce: optional(string()),\n  g_csrf_token: optional(string()),\n  hd: optional(string()),\n  // callback\n  credential: optional(string()),\n});\n\nexport class OAuth2Client {\n  private readonly config: OAuth2ClientConfig;\n  constructor(config: OAuth2ClientConfig) {\n    this.config = config;\n  }\n\n  get baseUri() {\n    return this.config.baseUri;\n  }\n\n  get successUri() {\n    return this.config.successUri;\n  }\n\n  get errorUri() {\n    return this.config.errorUri;\n  }\n\n  private async getClientConfig(registrationId: string) {\n    const registrations =\n      typeof this.config.registration === 'function'\n        ? await this.config.registration()\n        : this.config.registration;\n\n    const registration = registrations[registrationId];\n    invariant(registration, `Registration ${registrationId} not found`);\n\n    const provider = this.config.provider[registration.provider ?? registrationId];\n    invariant(provider, `Provider ${registration.provider ?? registrationId} not found`);\n    return { registration, provider };\n  }\n\n  async createAuthorizationUri({\n    registrationId,\n    state,\n    pkce,\n  }: {\n    registrationId: string;\n    state: string;\n    pkce?: PkceParameters;\n  }): Promise<URL> {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { scope, clientId, redirectUri } = registration;\n    return provider.createAuthorizationUri({\n      pkce,\n      state,\n      scope,\n      clientId,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async exchangeAuthorizationCode({\n    registrationId,\n    code,\n    pkce,\n  }: {\n    registrationId: string;\n    code: string;\n    pkce?: PkceParameters;\n  }): Promise<OAuth2Token> {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { clientId, clientSecret, redirectUri } = registration;\n    return provider.exchangeAuthorizationCode({\n      code,\n      pkce,\n      clientId,\n      clientSecret,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async getUserInfo({\n    registrationId,\n    token,\n    response,\n  }: {\n    registrationId: string;\n    token: OAuth2Token | OidcToken;\n    response?: AuthorizationResponse;\n  }) {\n    const { provider } = await this.getClientConfig(registrationId);\n    return provider.getUserInfo(token, response);\n  }\n\n  async refreshAccessToken({\n    registrationId,\n    refreshToken,\n  }: {\n    registrationId: string;\n    refreshToken: string;\n  }): Promise<OAuth2Token> {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.refreshAccessToken, 'Provider does not support refreshAccessToken');\n    return provider.refreshAccessToken({ refreshToken, clientId, clientSecret });\n  }\n\n  async revokeToken(registrationId: string, token: string) {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.revokeToken, 'Provider does not support revokeToken');\n    await provider.revokeToken({ token, clientId, clientSecret });\n  }\n\n  async loginOAuth2Native({\n    registrationId,\n    credentials,\n    pkce,\n  }: {\n    registrationId: string;\n    credentials: NativeCredential;\n    pkce?: PkceParameters;\n  }) {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n    invariant(provider.loginOAuth2Native, 'Provider does not support loginOAuth2Native');\n    const { baseUri } = this.config;\n    const { clientId, clientSecret, redirectUri } = registration;\n\n    return provider.loginOAuth2Native({\n      clientId,\n      clientSecret,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n      credentials,\n      pkce,\n    });\n  }\n}\n"],"mappings":";;;;AAWA,MAAa,6BAAA,GAA4BA,YAAAA,OAAAA,CAAO;CAC9C,OAAA,GAAMC,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACvB,QAAA,GAAOD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACxB,QAAA,GAAOD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACxB,oBAAA,GAAmBD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACpC,YAAA,GAAWD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CAE5B,OAAA,GAAMD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;AACzB,CAAC;AAED,MAAa,sBAAA,GAAqBF,YAAAA,OAAAA,CAAO;CAEvC,OAAA,GAAMC,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACvB,QAAA,GAAOD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACxB,QAAA,GAAOD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACxB,oBAAA,GAAmBD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACpC,YAAA,GAAWD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CAC5B,QAAA,GAAOD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACxB,eAAA,GAAcD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CAC/B,KAAA,GAAID,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CAErB,aAAA,GAAYD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;AAC/B,CAAC;AAED,IAAa,eAAb,MAA0B;CACxB;CACA,YAAY,QAA4B;EACtC,KAAK,SAAS;CAChB;CAEA,IAAI,UAAU;EACZ,OAAO,KAAK,OAAO;CACrB;CAEA,IAAI,aAAa;EACf,OAAO,KAAK,OAAO;CACrB;CAEA,IAAI,WAAW;EACb,OAAO,KAAK,OAAO;CACrB;CAEA,MAAc,gBAAgB,gBAAwB;EAMpD,MAAM,gBAJJ,OAAO,KAAK,OAAO,iBAAiB,aAChC,MAAM,KAAK,OAAO,aAAa,IAC/B,KAAK,OAAO,aAAA,CAEiB;EACnC,CAAA,GAAA,cAAA,UAAA,CAAU,cAAc,gBAAgB,eAAe,WAAW;EAElE,MAAM,WAAW,KAAK,OAAO,SAAS,aAAa,YAAY;EAC/D,CAAA,GAAA,cAAA,UAAA,CAAU,UAAU,YAAY,aAAa,YAAY,eAAe,WAAW;EACnF,OAAO;GAAE;GAAc;EAAS;CAClC;CAEA,MAAM,uBAAuB,EAC3B,gBACA,OACA,QAKe;EACf,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAE5E,MAAM,EAAE,YAAY,KAAK;EACzB,MAAM,EAAE,OAAO,UAAU,gBAAgB;EACzC,OAAO,SAAS,uBAAuB;GACrC;GACA;GACA;GACA;GACA,aAAa,eAAe,GAAG,QAAQ,qBAAqB;EAC9D,CAAC;CACH;CAEA,MAAM,0BAA0B,EAC9B,gBACA,MACA,QAKuB;EACvB,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAE5E,MAAM,EAAE,YAAY,KAAK;EACzB,MAAM,EAAE,UAAU,cAAc,gBAAgB;EAChD,OAAO,SAAS,0BAA0B;GACxC;GACA;GACA;GACA;GACA,aAAa,eAAe,GAAG,QAAQ,qBAAqB;EAC9D,CAAC;CACH;CAEA,MAAM,YAAY,EAChB,gBACA,OACA,YAKC;EACD,MAAM,EAAE,aAAa,MAAM,KAAK,gBAAgB,cAAc;EAC9D,OAAO,SAAS,YAAY,OAAO,QAAQ;CAC7C;CAEA,MAAM,mBAAmB,EACvB,gBACA,gBAIuB;EACvB,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAC5E,MAAM,EAAE,UAAU,iBAAiB;EAEnC,CAAA,GAAA,cAAA,UAAA,CAAU,SAAS,oBAAoB,8CAA8C;EACrF,OAAO,SAAS,mBAAmB;GAAE;GAAc;GAAU;EAAa,CAAC;CAC7E;CAEA,MAAM,YAAY,gBAAwB,OAAe;EACvD,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAC5E,MAAM,EAAE,UAAU,iBAAiB;EAEnC,CAAA,GAAA,cAAA,UAAA,CAAU,SAAS,aAAa,uCAAuC;EACvE,MAAM,SAAS,YAAY;GAAE;GAAO;GAAU;EAAa,CAAC;CAC9D;CAEA,MAAM,kBAAkB,EACtB,gBACA,aACA,QAKC;EACD,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAC5E,CAAA,GAAA,cAAA,UAAA,CAAU,SAAS,mBAAmB,6CAA6C;EACnF,MAAM,EAAE,YAAY,KAAK;EACzB,MAAM,EAAE,UAAU,cAAc,gBAAgB;EAEhD,OAAO,SAAS,kBAAkB;GAChC;GACA;GACA,aAAa,eAAe,GAAG,QAAQ,qBAAqB;GAC5D;GACA;EACF,CAAC;CACH;AACF"}
+{"version":3,"file":"client.cjs","names":["object","optional","string","OAuth2Error"],"sources":["../../src/oauth2/client.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { object, optional, string } from 'zod/v4-mini';\nimport { OAuth2Error } from './error';\nimport type {\n  AuthorizationResponse,\n  ClientSecret,\n  NativeClient,\n  NativeCredential,\n  OAuth2ClientConfig,\n  OAuth2Token,\n  OidcToken,\n  OneTapProvider,\n  PkceParameters,\n  Provider,\n  ProviderConfig,\n  WebClient,\n} from './types';\n\nexport const oauth2RedirectQuerySchema = object({\n  code: optional(string()),\n  state: optional(string()),\n  error: optional(string()),\n  error_description: optional(string()),\n  error_uri: optional(string()),\n  // Apple's form_post: the user's name as JSON, first authorization only.\n  user: optional(string()),\n});\n\nexport const googleOneTapSchema = object({\n  // login_uri\n  code: optional(string()),\n  state: optional(string()),\n  error: optional(string()),\n  error_description: optional(string()),\n  error_uri: optional(string()),\n  nonce: optional(string()),\n  g_csrf_token: optional(string()),\n  hd: optional(string()),\n  // callback\n  credential: optional(string()),\n});\n\nexport class OAuth2Client {\n  private readonly config: OAuth2ClientConfig;\n  constructor(config: OAuth2ClientConfig) {\n    this.config = config;\n  }\n\n  get baseUri() {\n    return this.config.baseUri;\n  }\n\n  get successUri() {\n    return this.config.successUri;\n  }\n\n  get errorUri() {\n    return this.config.errorUri;\n  }\n\n  /** The provider key comes from the request path, so an unknown one is the caller's error. */\n  private async getProviderConfig(provider: string): Promise<ProviderConfig> {\n    const providers =\n      typeof this.config.providers === 'function'\n        ? await this.config.providers()\n        : this.config.providers;\n    const config = Object.hasOwn(providers, provider) ? providers[provider] : undefined;\n    if (!config) throw new OAuth2Error(400, 'invalid_request', `Unknown provider: ${provider}`);\n    return config;\n  }\n\n  private defaultRedirectUri(provider: string) {\n    return `${this.config.baseUri}/login/oauth2/code/${provider}`;\n  }\n\n  /** The redirect flow and One Tap sign in as the provider's web client. */\n  private async getWebClient(provider: string) {\n    const config = await this.getProviderConfig(provider);\n    if (!config.web) {\n      throw new OAuth2Error(400, 'invalid_request', `Provider ${provider} has no web client`);\n    }\n    return { implementation: config.provider, client: config.web };\n  }\n\n  /**\n   * Any configured client of the provider, looked up by id: refresh and revoke use the client a\n   * token was issued to, and the native login the one the app names. The web client counts too:\n   * an Android app's server auth code and a Facebook app's tokens are issued to it.\n   */\n  private async getClient(provider: string, clientId: string) {\n    const config = await this.getProviderConfig(provider);\n    const client = [config.web, ...(config.native ?? [])].find((c) => c?.clientId === clientId);\n    if (!client) {\n      throw new OAuth2Error(400, 'invalid_client', `${clientId} is not a client of ${provider}`);\n    }\n    return { implementation: config.provider, client };\n  }\n\n  /**\n   * The client a native login signs in as: the one the app names with `client_id`, which must be\n   * configured; without one, the only native client, or the web client when there is no native\n   * one. Several native clients and no `client_id` is ambiguous and refused rather than guessed.\n   */\n  private async getNativeClient(provider: string, clientId: string | undefined) {\n    if (clientId !== undefined) return this.getClient(provider, clientId);\n    const config = await this.getProviderConfig(provider);\n    const native = config.native ?? [];\n    const client: WebClient | NativeClient | undefined =\n      native.length === 0 ? config.web : native.length === 1 ? native[0] : undefined;\n    if (!client) {\n      throw new OAuth2Error(400, 'invalid_request', `client_id is required for ${provider}`);\n    }\n    return { implementation: config.provider, client };\n  }\n\n  private async resolveSecret(secret: ClientSecret | undefined, clientId: string) {\n    return typeof secret === 'function' ? secret(clientId) : secret;\n  }\n\n  async createAuthorizationUri({\n    provider,\n    state,\n    pkce,\n  }: {\n    provider: string;\n    state: string;\n    pkce?: PkceParameters;\n  }): Promise<URL> {\n    const { implementation, client } = await this.getWebClient(provider);\n    return implementation.createAuthorizationUri({\n      pkce,\n      state,\n      scope: client.scope,\n      clientId: client.clientId,\n      redirectUri: client.redirectUri ?? this.defaultRedirectUri(provider),\n    });\n  }\n\n  /** Exchanges a code issued to the provider's web client: the redirect flow and One Tap. */\n  async exchangeAuthorizationCode({\n    provider,\n    code,\n    pkce,\n  }: {\n    provider: string;\n    code: string;\n    pkce?: PkceParameters;\n  }): Promise<{ clientId: string; token: OAuth2Token }> {\n    const { implementation, client } = await this.getWebClient(provider);\n    const { clientId } = client;\n    const token = await implementation.exchangeAuthorizationCode({\n      code,\n      pkce,\n      clientId,\n      clientSecret: await this.resolveSecret(client.clientSecret, clientId),\n      redirectUri: client.redirectUri ?? this.defaultRedirectUri(provider),\n    });\n    return { clientId, token };\n  }\n\n  /** `clientId` is the client the token was issued to, as `exchangeAuthorizationCode` returns it. */\n  async getUserInfo({\n    provider,\n    clientId,\n    token,\n    response,\n  }: {\n    provider: string;\n    clientId: string;\n    token: OAuth2Token | OidcToken;\n    response?: AuthorizationResponse;\n  }) {\n    const { implementation } = await this.getClient(provider, clientId);\n    return implementation.getUserInfo(token, { clientId, response });\n  }\n\n  /** Verifies a Google One Tap / FedCM credential, which is issued to the web client. */\n  async getTokenInfo({ provider, credential }: { provider: string; credential: string }) {\n    const { implementation, client } = await this.getWebClient(provider);\n    if (!isOneTapProvider(implementation)) {\n      throw new OAuth2Error(400, 'invalid_request', `Provider ${provider} has no One Tap`);\n    }\n    const { clientId } = client;\n    return { clientId, ...(await implementation.getTokenInfo(credential, clientId)) };\n  }\n\n  async refreshAccessToken({\n    provider,\n    clientId,\n    refreshToken,\n  }: {\n    provider: string;\n    clientId: string;\n    refreshToken: string;\n  }): Promise<OAuth2Token> {\n    const { implementation, client } = await this.getClient(provider, clientId);\n    invariant(implementation.refreshAccessToken, 'Provider does not support refreshAccessToken');\n    const clientSecret = await this.resolveSecret(client.clientSecret, clientId);\n    return implementation.refreshAccessToken({ refreshToken, clientId, clientSecret });\n  }\n\n  async revokeToken({\n    provider,\n    clientId,\n    token,\n  }: {\n    provider: string;\n    clientId: string;\n    token: string;\n  }) {\n    const { implementation, client } = await this.getClient(provider, clientId);\n    invariant(implementation.revokeToken, 'Provider does not support revokeToken');\n    const clientSecret = await this.resolveSecret(client.clientSecret, clientId);\n    await implementation.revokeToken({ token, clientId, clientSecret });\n  }\n\n  async loginOAuth2Native({\n    provider,\n    credentials,\n    pkce,\n  }: {\n    provider: string;\n    credentials: NativeCredential;\n    pkce?: PkceParameters;\n  }) {\n    const { implementation, client } = await this.getNativeClient(provider, credentials.client_id);\n    invariant(implementation.loginOAuth2Native, 'Provider does not support loginOAuth2Native');\n    const { clientId } = client;\n\n    const result = await implementation.loginOAuth2Native({\n      clientId,\n      clientSecret: await this.resolveSecret(client.clientSecret, clientId),\n      redirectUri: client.redirectUri ?? this.defaultRedirectUri(provider),\n      credentials,\n      pkce,\n    });\n    return { clientId, ...result };\n  }\n}\n\nfunction isOneTapProvider(provider: Provider): provider is OneTapProvider {\n  return typeof (provider as Partial<OneTapProvider>).getTokenInfo === 'function';\n}\n"],"mappings":";;;;;AAkBA,MAAa,6BAAA,GAA4BA,YAAAA,OAAAA,CAAO;CAC9C,OAAA,GAAMC,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACvB,QAAA,GAAOD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACxB,QAAA,GAAOD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACxB,oBAAA,GAAmBD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACpC,YAAA,GAAWD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CAE5B,OAAA,GAAMD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;AACzB,CAAC;AAED,MAAa,sBAAA,GAAqBF,YAAAA,OAAAA,CAAO;CAEvC,OAAA,GAAMC,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACvB,QAAA,GAAOD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACxB,QAAA,GAAOD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACxB,oBAAA,GAAmBD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACpC,YAAA,GAAWD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CAC5B,QAAA,GAAOD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACxB,eAAA,GAAcD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CAC/B,KAAA,GAAID,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CAErB,aAAA,GAAYD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;AAC/B,CAAC;AAED,IAAa,eAAb,MAA0B;CACxB;CACA,YAAY,QAA4B;EACtC,KAAK,SAAS;CAChB;CAEA,IAAI,UAAU;EACZ,OAAO,KAAK,OAAO;CACrB;CAEA,IAAI,aAAa;EACf,OAAO,KAAK,OAAO;CACrB;CAEA,IAAI,WAAW;EACb,OAAO,KAAK,OAAO;CACrB;;CAGA,MAAc,kBAAkB,UAA2C;EACzE,MAAM,YACJ,OAAO,KAAK,OAAO,cAAc,aAC7B,MAAM,KAAK,OAAO,UAAU,IAC5B,KAAK,OAAO;EAClB,MAAM,SAAS,OAAO,OAAO,WAAW,QAAQ,IAAI,UAAU,YAAY,KAAA;EAC1E,IAAI,CAAC,QAAQ,MAAM,IAAIC,qBAAAA,YAAY,KAAK,mBAAmB,qBAAqB,UAAU;EAC1F,OAAO;CACT;CAEA,mBAA2B,UAAkB;EAC3C,OAAO,GAAG,KAAK,OAAO,QAAQ,qBAAqB;CACrD;;CAGA,MAAc,aAAa,UAAkB;EAC3C,MAAM,SAAS,MAAM,KAAK,kBAAkB,QAAQ;EACpD,IAAI,CAAC,OAAO,KACV,MAAM,IAAIA,qBAAAA,YAAY,KAAK,mBAAmB,YAAY,SAAS,mBAAmB;EAExF,OAAO;GAAE,gBAAgB,OAAO;GAAU,QAAQ,OAAO;EAAI;CAC/D;;;;;;CAOA,MAAc,UAAU,UAAkB,UAAkB;EAC1D,MAAM,SAAS,MAAM,KAAK,kBAAkB,QAAQ;EACpD,MAAM,SAAS,CAAC,OAAO,KAAK,GAAI,OAAO,UAAU,CAAC,CAAE,CAAC,CAAC,MAAM,MAAM,GAAG,aAAa,QAAQ;EAC1F,IAAI,CAAC,QACH,MAAM,IAAIA,qBAAAA,YAAY,KAAK,kBAAkB,GAAG,SAAS,sBAAsB,UAAU;EAE3F,OAAO;GAAE,gBAAgB,OAAO;GAAU;EAAO;CACnD;;;;;;CAOA,MAAc,gBAAgB,UAAkB,UAA8B;EAC5E,IAAI,aAAa,KAAA,GAAW,OAAO,KAAK,UAAU,UAAU,QAAQ;EACpE,MAAM,SAAS,MAAM,KAAK,kBAAkB,QAAQ;EACpD,MAAM,SAAS,OAAO,UAAU,CAAC;EACjC,MAAM,SACJ,OAAO,WAAW,IAAI,OAAO,MAAM,OAAO,WAAW,IAAI,OAAO,KAAK,KAAA;EACvE,IAAI,CAAC,QACH,MAAM,IAAIA,qBAAAA,YAAY,KAAK,mBAAmB,6BAA6B,UAAU;EAEvF,OAAO;GAAE,gBAAgB,OAAO;GAAU;EAAO;CACnD;CAEA,MAAc,cAAc,QAAkC,UAAkB;EAC9E,OAAO,OAAO,WAAW,aAAa,OAAO,QAAQ,IAAI;CAC3D;CAEA,MAAM,uBAAuB,EAC3B,UACA,OACA,QAKe;EACf,MAAM,EAAE,gBAAgB,WAAW,MAAM,KAAK,aAAa,QAAQ;EACnE,OAAO,eAAe,uBAAuB;GAC3C;GACA;GACA,OAAO,OAAO;GACd,UAAU,OAAO;GACjB,aAAa,OAAO,eAAe,KAAK,mBAAmB,QAAQ;EACrE,CAAC;CACH;;CAGA,MAAM,0BAA0B,EAC9B,UACA,MACA,QAKoD;EACpD,MAAM,EAAE,gBAAgB,WAAW,MAAM,KAAK,aAAa,QAAQ;EACnE,MAAM,EAAE,aAAa;EAQrB,OAAO;GAAE;GAAU,OAAA,MAPC,eAAe,0BAA0B;IAC3D;IACA;IACA;IACA,cAAc,MAAM,KAAK,cAAc,OAAO,cAAc,QAAQ;IACpE,aAAa,OAAO,eAAe,KAAK,mBAAmB,QAAQ;GACrE,CAAC;EACwB;CAC3B;;CAGA,MAAM,YAAY,EAChB,UACA,UACA,OACA,YAMC;EACD,MAAM,EAAE,mBAAmB,MAAM,KAAK,UAAU,UAAU,QAAQ;EAClE,OAAO,eAAe,YAAY,OAAO;GAAE;GAAU;EAAS,CAAC;CACjE;;CAGA,MAAM,aAAa,EAAE,UAAU,cAAwD;EACrF,MAAM,EAAE,gBAAgB,WAAW,MAAM,KAAK,aAAa,QAAQ;EACnE,IAAI,CAAC,iBAAiB,cAAc,GAClC,MAAM,IAAIA,qBAAAA,YAAY,KAAK,mBAAmB,YAAY,SAAS,gBAAgB;EAErF,MAAM,EAAE,aAAa;EACrB,OAAO;GAAE;GAAU,GAAI,MAAM,eAAe,aAAa,YAAY,QAAQ;EAAG;CAClF;CAEA,MAAM,mBAAmB,EACvB,UACA,UACA,gBAKuB;EACvB,MAAM,EAAE,gBAAgB,WAAW,MAAM,KAAK,UAAU,UAAU,QAAQ;EAC1E,CAAA,GAAA,cAAA,UAAA,CAAU,eAAe,oBAAoB,8CAA8C;EAC3F,MAAM,eAAe,MAAM,KAAK,cAAc,OAAO,cAAc,QAAQ;EAC3E,OAAO,eAAe,mBAAmB;GAAE;GAAc;GAAU;EAAa,CAAC;CACnF;CAEA,MAAM,YAAY,EAChB,UACA,UACA,SAKC;EACD,MAAM,EAAE,gBAAgB,WAAW,MAAM,KAAK,UAAU,UAAU,QAAQ;EAC1E,CAAA,GAAA,cAAA,UAAA,CAAU,eAAe,aAAa,uCAAuC;EAC7E,MAAM,eAAe,MAAM,KAAK,cAAc,OAAO,cAAc,QAAQ;EAC3E,MAAM,eAAe,YAAY;GAAE;GAAO;GAAU;EAAa,CAAC;CACpE;CAEA,MAAM,kBAAkB,EACtB,UACA,aACA,QAKC;EACD,MAAM,EAAE,gBAAgB,WAAW,MAAM,KAAK,gBAAgB,UAAU,YAAY,SAAS;EAC7F,CAAA,GAAA,cAAA,UAAA,CAAU,eAAe,mBAAmB,6CAA6C;EACzF,MAAM,EAAE,aAAa;EASrB,OAAO;GAAE;GAAU,GAAG,MAPD,eAAe,kBAAkB;IACpD;IACA,cAAc,MAAM,KAAK,cAAc,OAAO,cAAc,QAAQ;IACpE,aAAa,OAAO,eAAe,KAAK,mBAAmB,QAAQ;IACnE;IACA;GACF,CAAC;EAC4B;CAC/B;AACF;AAEA,SAAS,iBAAiB,UAAgD;CACxE,OAAO,OAAQ,SAAqC,iBAAiB;AACvE"}

package/dist/oauth2/client.d.cts

@@ -25,34 +25,72 @@ export declare class OAuth2Client {
   get baseUri(): string;
   get successUri(): string;
   get errorUri(): string;
-  private getClientConfig;
-  createAuthorizationUri({ registrationId, state, pkce }: {
-    registrationId: string;
+  /** The provider key comes from the request path, so an unknown one is the caller's error. */
+  private getProviderConfig;
+  private defaultRedirectUri;
+  /** The redirect flow and One Tap sign in as the provider's web client. */
+  private getWebClient;
+  /**
+   * Any configured client of the provider, looked up by id: refresh and revoke use the client a
+   * token was issued to, and the native login the one the app names. The web client counts too:
+   * an Android app's server auth code and a Facebook app's tokens are issued to it.
+   */
+  private getClient;
+  /**
+   * The client a native login signs in as: the one the app names with `client_id`, which must be
+   * configured; without one, the only native client, or the web client when there is no native
+   * one. Several native clients and no `client_id` is ambiguous and refused rather than guessed.
+   */
+  private getNativeClient;
+  private resolveSecret;
+  createAuthorizationUri({ provider, state, pkce }: {
+    provider: string;
     state: string;
     pkce?: PkceParameters;
   }): Promise<URL>;
-  exchangeAuthorizationCode({ registrationId, code, pkce }: {
-    registrationId: string;
+  /** Exchanges a code issued to the provider's web client: the redirect flow and One Tap. */
+  exchangeAuthorizationCode({ provider, code, pkce }: {
+    provider: string;
     code: string;
     pkce?: PkceParameters;
-  }): Promise<OAuth2Token>;
-  getUserInfo({ registrationId, token, response }: {
-    registrationId: string;
+  }): Promise<{
+    clientId: string;
+    token: OAuth2Token;
+  }>;
+  /** `clientId` is the client the token was issued to, as `exchangeAuthorizationCode` returns it. */
+  getUserInfo({ provider, clientId, token, response }: {
+    provider: string;
+    clientId: string;
     token: OAuth2Token | OidcToken;
     response?: AuthorizationResponse;
   }): Promise<UserInfo<unknown>>;
-  refreshAccessToken({ registrationId, refreshToken }: {
-    registrationId: string;
+  /** Verifies a Google One Tap / FedCM credential, which is issued to the web client. */
+  getTokenInfo({ provider, credential }: {
+    provider: string;
+    credential: string;
+  }): Promise<{
+    token: OAuth2Token;
+    userInfo: UserInfo;
+    clientId: string;
+  }>;
+  refreshAccessToken({ provider, clientId, refreshToken }: {
+    provider: string;
+    clientId: string;
     refreshToken: string;
   }): Promise<OAuth2Token>;
-  revokeToken(registrationId: string, token: string): Promise<void>;
-  loginOAuth2Native({ registrationId, credentials, pkce }: {
-    registrationId: string;
+  revokeToken({ provider, clientId, token }: {
+    provider: string;
+    clientId: string;
+    token: string;
+  }): Promise<void>;
+  loginOAuth2Native({ provider, credentials, pkce }: {
+    provider: string;
     credentials: NativeCredential;
     pkce?: PkceParameters;
   }): Promise<{
     token: OAuth2Token;
     userInfo: UserInfo;
+    clientId: string;
   }>;
 }
 //#endregion

package/dist/oauth2/client.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.cts","names":["_$__types0.UserInfo"],"sources":["../../src/oauth2/client.ts"],"mappings":";;qBAWa,8CAAyB;;;;;;;yBAQpC;qBAEW,uCAAkB;;;;;;;;;;yBAY7B;qBAEW;mBACM;EACjB,YAAY,QAAQ;MAIhB;MAIA;MAIA;UAIU;EAcR,yBACJ,gBACA,OACA;IAEA;IACA;IACA,OAAO;MACL,QAAQ;EAcN,4BACJ,gBACA,MACA;IAEA;IACA;IACA,OAAO;MACL,QAAQ;EAcN,cACJ,gBACA,OACA;IAEA;IACA,OAAO,cAAc;IACrB,WAAW;MACZ,QADYA;EAMP,qBACJ,gBACA;IAEA;IACA;MACE,QAAQ;EAQN,YAAY,wBAAwB,gBAAa;EAQjD,oBACJ,gBACA,aACA;IAEA;IACA,aAAa;IACb,OAAO;MACR"}
+{"version":3,"file":"client.d.cts","names":["_$__types0.UserInfo"],"sources":["../../src/oauth2/client.ts"],"mappings":";;qBAkBa,8CAAyB;;;;;;;yBAQpC;qBAEW,uCAAkB;;;;;;;;;;yBAY7B;qBAEW;mBACM;EACjB,YAAY,QAAQ;MAIhB;MAIA;MAIA;;UAKU;UAUN;;UAKM;;;;;;UAaA;;;;;;UAcA;UAYA;EAIR,yBACJ,UACA,OACA;IAEA;IACA;IACA,OAAO;MACL,QAAQ;;EAYN,4BACJ,UACA,MACA;IAEA;IACA;IACA,OAAO;MACL;IAAU;IAAkB,OAAO;;;EAcjC,cACJ,UACA,UACA,OACA;IAEA;IACA;IACA,OAAO,cAAc;IACrB,WAAW;MACZ,QADYA;;EAOP,eAAe,UAAU;IAAgB;IAAkB;MAAoB;;;;;EAS/E,qBACJ,UACA,UACA;IAEA;IACA;IACA;MACE,QAAQ;EAON,cACJ,UACA,UACA;IAEA;IACA;IACA;MACD;EAOK,oBACJ,UACA,aACA;IAEA;IACA,aAAa;IACb,OAAO;MACR"}

package/dist/oauth2/client.d.mts

@@ -25,34 +25,72 @@ export declare class OAuth2Client {
   get baseUri(): string;
   get successUri(): string;
   get errorUri(): string;
-  private getClientConfig;
-  createAuthorizationUri({ registrationId, state, pkce }: {
-    registrationId: string;
+  /** The provider key comes from the request path, so an unknown one is the caller's error. */
+  private getProviderConfig;
+  private defaultRedirectUri;
+  /** The redirect flow and One Tap sign in as the provider's web client. */
+  private getWebClient;
+  /**
+   * Any configured client of the provider, looked up by id: refresh and revoke use the client a
+   * token was issued to, and the native login the one the app names. The web client counts too:
+   * an Android app's server auth code and a Facebook app's tokens are issued to it.
+   */
+  private getClient;
+  /**
+   * The client a native login signs in as: the one the app names with `client_id`, which must be
+   * configured; without one, the only native client, or the web client when there is no native
+   * one. Several native clients and no `client_id` is ambiguous and refused rather than guessed.
+   */
+  private getNativeClient;
+  private resolveSecret;
+  createAuthorizationUri({ provider, state, pkce }: {
+    provider: string;
     state: string;
     pkce?: PkceParameters;
   }): Promise<URL>;
-  exchangeAuthorizationCode({ registrationId, code, pkce }: {
-    registrationId: string;
+  /** Exchanges a code issued to the provider's web client: the redirect flow and One Tap. */
+  exchangeAuthorizationCode({ provider, code, pkce }: {
+    provider: string;
     code: string;
     pkce?: PkceParameters;
-  }): Promise<OAuth2Token>;
-  getUserInfo({ registrationId, token, response }: {
-    registrationId: string;
+  }): Promise<{
+    clientId: string;
+    token: OAuth2Token;
+  }>;
+  /** `clientId` is the client the token was issued to, as `exchangeAuthorizationCode` returns it. */
+  getUserInfo({ provider, clientId, token, response }: {
+    provider: string;
+    clientId: string;
     token: OAuth2Token | OidcToken;
     response?: AuthorizationResponse;
   }): Promise<UserInfo<unknown>>;
-  refreshAccessToken({ registrationId, refreshToken }: {
-    registrationId: string;
+  /** Verifies a Google One Tap / FedCM credential, which is issued to the web client. */
+  getTokenInfo({ provider, credential }: {
+    provider: string;
+    credential: string;
+  }): Promise<{
+    token: OAuth2Token;
+    userInfo: UserInfo;
+    clientId: string;
+  }>;
+  refreshAccessToken({ provider, clientId, refreshToken }: {
+    provider: string;
+    clientId: string;
     refreshToken: string;
   }): Promise<OAuth2Token>;
-  revokeToken(registrationId: string, token: string): Promise<void>;
-  loginOAuth2Native({ registrationId, credentials, pkce }: {
-    registrationId: string;
+  revokeToken({ provider, clientId, token }: {
+    provider: string;
+    clientId: string;
+    token: string;
+  }): Promise<void>;
+  loginOAuth2Native({ provider, credentials, pkce }: {
+    provider: string;
     credentials: NativeCredential;
     pkce?: PkceParameters;
   }): Promise<{
     token: OAuth2Token;
     userInfo: UserInfo;
+    clientId: string;
   }>;
 }
 //#endregion

package/dist/oauth2/client.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.mts","names":["_$__types0.UserInfo"],"sources":["../../src/oauth2/client.ts"],"mappings":";;qBAWa,8CAAyB;;;;;;;yBAQpC;qBAEW,uCAAkB;;;;;;;;;;yBAY7B;qBAEW;mBACM;EACjB,YAAY,QAAQ;MAIhB;MAIA;MAIA;UAIU;EAcR,yBACJ,gBACA,OACA;IAEA;IACA;IACA,OAAO;MACL,QAAQ;EAcN,4BACJ,gBACA,MACA;IAEA;IACA;IACA,OAAO;MACL,QAAQ;EAcN,cACJ,gBACA,OACA;IAEA;IACA,OAAO,cAAc;IACrB,WAAW;MACZ,QADYA;EAMP,qBACJ,gBACA;IAEA;IACA;MACE,QAAQ;EAQN,YAAY,wBAAwB,gBAAa;EAQjD,oBACJ,gBACA,aACA;IAEA;IACA,aAAa;IACb,OAAO;MACR"}
+{"version":3,"file":"client.d.mts","names":["_$__types0.UserInfo"],"sources":["../../src/oauth2/client.ts"],"mappings":";;qBAkBa,8CAAyB;;;;;;;yBAQpC;qBAEW,uCAAkB;;;;;;;;;;yBAY7B;qBAEW;mBACM;EACjB,YAAY,QAAQ;MAIhB;MAIA;MAIA;;UAKU;UAUN;;UAKM;;;;;;UAaA;;;;;;UAcA;UAYA;EAIR,yBACJ,UACA,OACA;IAEA;IACA;IACA,OAAO;MACL,QAAQ;;EAYN,4BACJ,UACA,MACA;IAEA;IACA;IACA,OAAO;MACL;IAAU;IAAkB,OAAO;;;EAcjC,cACJ,UACA,UACA,OACA;IAEA;IACA;IACA,OAAO,cAAc;IACrB,WAAW;MACZ,QADYA;;EAOP,eAAe,UAAU;IAAgB;IAAkB;MAAoB;;;;;EAS/E,qBACJ,UACA,UACA;IAEA;IACA;IACA;MACE,QAAQ;EAON,cACJ,UACA,UACA;IAEA;IACA;IACA;MACD;EAOK,oBACJ,UACA,aACA;IAEA;IACA,aAAa;IACb,OAAO;MACR"}

package/dist/oauth2/client.mjs

@@ -1,3 +1,4 @@
+import { OAuth2Error } from "./error.mjs";
 import { invariant } from "@shware/utils";
 import { object, optional, string } from "zod/v4-mini";
 //#region src/oauth2/client.ts
@@ -34,78 +35,140 @@ var OAuth2Client = class {
 	get errorUri() {
 		return this.config.errorUri;
 	}
-	async getClientConfig(registrationId) {
-		const registration = (typeof this.config.registration === "function" ? await this.config.registration() : this.config.registration)[registrationId];
-		invariant(registration, `Registration ${registrationId} not found`);
-		const provider = this.config.provider[registration.provider ?? registrationId];
-		invariant(provider, `Provider ${registration.provider ?? registrationId} not found`);
+	/** The provider key comes from the request path, so an unknown one is the caller's error. */
+	async getProviderConfig(provider) {
+		const providers = typeof this.config.providers === "function" ? await this.config.providers() : this.config.providers;
+		const config = Object.hasOwn(providers, provider) ? providers[provider] : void 0;
+		if (!config) throw new OAuth2Error(400, "invalid_request", `Unknown provider: ${provider}`);
+		return config;
+	}
+	defaultRedirectUri(provider) {
+		return `${this.config.baseUri}/login/oauth2/code/${provider}`;
+	}
+	/** The redirect flow and One Tap sign in as the provider's web client. */
+	async getWebClient(provider) {
+		const config = await this.getProviderConfig(provider);
+		if (!config.web) throw new OAuth2Error(400, "invalid_request", `Provider ${provider} has no web client`);
+		return {
+			implementation: config.provider,
+			client: config.web
+		};
+	}
+	/**
+	* Any configured client of the provider, looked up by id: refresh and revoke use the client a
+	* token was issued to, and the native login the one the app names. The web client counts too:
+	* an Android app's server auth code and a Facebook app's tokens are issued to it.
+	*/
+	async getClient(provider, clientId) {
+		const config = await this.getProviderConfig(provider);
+		const client = [config.web, ...config.native ?? []].find((c) => c?.clientId === clientId);
+		if (!client) throw new OAuth2Error(400, "invalid_client", `${clientId} is not a client of ${provider}`);
 		return {
-			registration,
-			provider
+			implementation: config.provider,
+			client
 		};
 	}
-	async createAuthorizationUri({ registrationId, state, pkce }) {
-		const { provider, registration } = await this.getClientConfig(registrationId);
-		const { baseUri } = this.config;
-		const { scope, clientId, redirectUri } = registration;
-		return provider.createAuthorizationUri({
+	/**
+	* The client a native login signs in as: the one the app names with `client_id`, which must be
+	* configured; without one, the only native client, or the web client when there is no native
+	* one. Several native clients and no `client_id` is ambiguous and refused rather than guessed.
+	*/
+	async getNativeClient(provider, clientId) {
+		if (clientId !== void 0) return this.getClient(provider, clientId);
+		const config = await this.getProviderConfig(provider);
+		const native = config.native ?? [];
+		const client = native.length === 0 ? config.web : native.length === 1 ? native[0] : void 0;
+		if (!client) throw new OAuth2Error(400, "invalid_request", `client_id is required for ${provider}`);
+		return {
+			implementation: config.provider,
+			client
+		};
+	}
+	async resolveSecret(secret, clientId) {
+		return typeof secret === "function" ? secret(clientId) : secret;
+	}
+	async createAuthorizationUri({ provider, state, pkce }) {
+		const { implementation, client } = await this.getWebClient(provider);
+		return implementation.createAuthorizationUri({
 			pkce,
 			state,
-			scope,
-			clientId,
-			redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`
+			scope: client.scope,
+			clientId: client.clientId,
+			redirectUri: client.redirectUri ?? this.defaultRedirectUri(provider)
 		});
 	}
-	async exchangeAuthorizationCode({ registrationId, code, pkce }) {
-		const { provider, registration } = await this.getClientConfig(registrationId);
-		const { baseUri } = this.config;
-		const { clientId, clientSecret, redirectUri } = registration;
-		return provider.exchangeAuthorizationCode({
-			code,
-			pkce,
+	/** Exchanges a code issued to the provider's web client: the redirect flow and One Tap. */
+	async exchangeAuthorizationCode({ provider, code, pkce }) {
+		const { implementation, client } = await this.getWebClient(provider);
+		const { clientId } = client;
+		return {
 			clientId,
-			clientSecret,
-			redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`
+			token: await implementation.exchangeAuthorizationCode({
+				code,
+				pkce,
+				clientId,
+				clientSecret: await this.resolveSecret(client.clientSecret, clientId),
+				redirectUri: client.redirectUri ?? this.defaultRedirectUri(provider)
+			})
+		};
+	}
+	/** `clientId` is the client the token was issued to, as `exchangeAuthorizationCode` returns it. */
+	async getUserInfo({ provider, clientId, token, response }) {
+		const { implementation } = await this.getClient(provider, clientId);
+		return implementation.getUserInfo(token, {
+			clientId,
+			response
 		});
 	}
-	async getUserInfo({ registrationId, token, response }) {
-		const { provider } = await this.getClientConfig(registrationId);
-		return provider.getUserInfo(token, response);
+	/** Verifies a Google One Tap / FedCM credential, which is issued to the web client. */
+	async getTokenInfo({ provider, credential }) {
+		const { implementation, client } = await this.getWebClient(provider);
+		if (!isOneTapProvider(implementation)) throw new OAuth2Error(400, "invalid_request", `Provider ${provider} has no One Tap`);
+		const { clientId } = client;
+		return {
+			clientId,
+			...await implementation.getTokenInfo(credential, clientId)
+		};
 	}
-	async refreshAccessToken({ registrationId, refreshToken }) {
-		const { provider, registration } = await this.getClientConfig(registrationId);
-		const { clientId, clientSecret } = registration;
-		invariant(provider.refreshAccessToken, "Provider does not support refreshAccessToken");
-		return provider.refreshAccessToken({
+	async refreshAccessToken({ provider, clientId, refreshToken }) {
+		const { implementation, client } = await this.getClient(provider, clientId);
+		invariant(implementation.refreshAccessToken, "Provider does not support refreshAccessToken");
+		const clientSecret = await this.resolveSecret(client.clientSecret, clientId);
+		return implementation.refreshAccessToken({
 			refreshToken,
 			clientId,
 			clientSecret
 		});
 	}
-	async revokeToken(registrationId, token) {
-		const { provider, registration } = await this.getClientConfig(registrationId);
-		const { clientId, clientSecret } = registration;
-		invariant(provider.revokeToken, "Provider does not support revokeToken");
-		await provider.revokeToken({
+	async revokeToken({ provider, clientId, token }) {
+		const { implementation, client } = await this.getClient(provider, clientId);
+		invariant(implementation.revokeToken, "Provider does not support revokeToken");
+		const clientSecret = await this.resolveSecret(client.clientSecret, clientId);
+		await implementation.revokeToken({
 			token,
 			clientId,
 			clientSecret
 		});
 	}
-	async loginOAuth2Native({ registrationId, credentials, pkce }) {
-		const { provider, registration } = await this.getClientConfig(registrationId);
-		invariant(provider.loginOAuth2Native, "Provider does not support loginOAuth2Native");
-		const { baseUri } = this.config;
-		const { clientId, clientSecret, redirectUri } = registration;
-		return provider.loginOAuth2Native({
+	async loginOAuth2Native({ provider, credentials, pkce }) {
+		const { implementation, client } = await this.getNativeClient(provider, credentials.client_id);
+		invariant(implementation.loginOAuth2Native, "Provider does not support loginOAuth2Native");
+		const { clientId } = client;
+		return {
 			clientId,
-			clientSecret,
-			redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,
-			credentials,
-			pkce
-		});
+			...await implementation.loginOAuth2Native({
+				clientId,
+				clientSecret: await this.resolveSecret(client.clientSecret, clientId),
+				redirectUri: client.redirectUri ?? this.defaultRedirectUri(provider),
+				credentials,
+				pkce
+			})
+		};
 	}
 };
+function isOneTapProvider(provider) {
+	return typeof provider.getTokenInfo === "function";
+}
 //#endregion
 export { OAuth2Client, googleOneTapSchema, oauth2RedirectQuerySchema };
 

package/dist/oauth2/client.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"client.mjs","names":[],"sources":["../../src/oauth2/client.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { object, optional, string } from 'zod/v4-mini';\nimport type {\n  AuthorizationResponse,\n  NativeCredential,\n  OAuth2ClientConfig,\n  OAuth2Token,\n  OidcToken,\n  PkceParameters,\n} from './types';\n\nexport const oauth2RedirectQuerySchema = object({\n  code: optional(string()),\n  state: optional(string()),\n  error: optional(string()),\n  error_description: optional(string()),\n  error_uri: optional(string()),\n  // Apple's form_post: the user's name as JSON, first authorization only.\n  user: optional(string()),\n});\n\nexport const googleOneTapSchema = object({\n  // login_uri\n  code: optional(string()),\n  state: optional(string()),\n  error: optional(string()),\n  error_description: optional(string()),\n  error_uri: optional(string()),\n  nonce: optional(string()),\n  g_csrf_token: optional(string()),\n  hd: optional(string()),\n  // callback\n  credential: optional(string()),\n});\n\nexport class OAuth2Client {\n  private readonly config: OAuth2ClientConfig;\n  constructor(config: OAuth2ClientConfig) {\n    this.config = config;\n  }\n\n  get baseUri() {\n    return this.config.baseUri;\n  }\n\n  get successUri() {\n    return this.config.successUri;\n  }\n\n  get errorUri() {\n    return this.config.errorUri;\n  }\n\n  private async getClientConfig(registrationId: string) {\n    const registrations =\n      typeof this.config.registration === 'function'\n        ? await this.config.registration()\n        : this.config.registration;\n\n    const registration = registrations[registrationId];\n    invariant(registration, `Registration ${registrationId} not found`);\n\n    const provider = this.config.provider[registration.provider ?? registrationId];\n    invariant(provider, `Provider ${registration.provider ?? registrationId} not found`);\n    return { registration, provider };\n  }\n\n  async createAuthorizationUri({\n    registrationId,\n    state,\n    pkce,\n  }: {\n    registrationId: string;\n    state: string;\n    pkce?: PkceParameters;\n  }): Promise<URL> {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { scope, clientId, redirectUri } = registration;\n    return provider.createAuthorizationUri({\n      pkce,\n      state,\n      scope,\n      clientId,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async exchangeAuthorizationCode({\n    registrationId,\n    code,\n    pkce,\n  }: {\n    registrationId: string;\n    code: string;\n    pkce?: PkceParameters;\n  }): Promise<OAuth2Token> {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { clientId, clientSecret, redirectUri } = registration;\n    return provider.exchangeAuthorizationCode({\n      code,\n      pkce,\n      clientId,\n      clientSecret,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async getUserInfo({\n    registrationId,\n    token,\n    response,\n  }: {\n    registrationId: string;\n    token: OAuth2Token | OidcToken;\n    response?: AuthorizationResponse;\n  }) {\n    const { provider } = await this.getClientConfig(registrationId);\n    return provider.getUserInfo(token, response);\n  }\n\n  async refreshAccessToken({\n    registrationId,\n    refreshToken,\n  }: {\n    registrationId: string;\n    refreshToken: string;\n  }): Promise<OAuth2Token> {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.refreshAccessToken, 'Provider does not support refreshAccessToken');\n    return provider.refreshAccessToken({ refreshToken, clientId, clientSecret });\n  }\n\n  async revokeToken(registrationId: string, token: string) {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.revokeToken, 'Provider does not support revokeToken');\n    await provider.revokeToken({ token, clientId, clientSecret });\n  }\n\n  async loginOAuth2Native({\n    registrationId,\n    credentials,\n    pkce,\n  }: {\n    registrationId: string;\n    credentials: NativeCredential;\n    pkce?: PkceParameters;\n  }) {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n    invariant(provider.loginOAuth2Native, 'Provider does not support loginOAuth2Native');\n    const { baseUri } = this.config;\n    const { clientId, clientSecret, redirectUri } = registration;\n\n    return provider.loginOAuth2Native({\n      clientId,\n      clientSecret,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n      credentials,\n      pkce,\n    });\n  }\n}\n"],"mappings":";;;AAWA,MAAa,4BAA4B,OAAO;CAC9C,MAAM,SAAS,OAAO,CAAC;CACvB,OAAO,SAAS,OAAO,CAAC;CACxB,OAAO,SAAS,OAAO,CAAC;CACxB,mBAAmB,SAAS,OAAO,CAAC;CACpC,WAAW,SAAS,OAAO,CAAC;CAE5B,MAAM,SAAS,OAAO,CAAC;AACzB,CAAC;AAED,MAAa,qBAAqB,OAAO;CAEvC,MAAM,SAAS,OAAO,CAAC;CACvB,OAAO,SAAS,OAAO,CAAC;CACxB,OAAO,SAAS,OAAO,CAAC;CACxB,mBAAmB,SAAS,OAAO,CAAC;CACpC,WAAW,SAAS,OAAO,CAAC;CAC5B,OAAO,SAAS,OAAO,CAAC;CACxB,cAAc,SAAS,OAAO,CAAC;CAC/B,IAAI,SAAS,OAAO,CAAC;CAErB,YAAY,SAAS,OAAO,CAAC;AAC/B,CAAC;AAED,IAAa,eAAb,MAA0B;CACxB;CACA,YAAY,QAA4B;EACtC,KAAK,SAAS;CAChB;CAEA,IAAI,UAAU;EACZ,OAAO,KAAK,OAAO;CACrB;CAEA,IAAI,aAAa;EACf,OAAO,KAAK,OAAO;CACrB;CAEA,IAAI,WAAW;EACb,OAAO,KAAK,OAAO;CACrB;CAEA,MAAc,gBAAgB,gBAAwB;EAMpD,MAAM,gBAJJ,OAAO,KAAK,OAAO,iBAAiB,aAChC,MAAM,KAAK,OAAO,aAAa,IAC/B,KAAK,OAAO,aAAA,CAEiB;EACnC,UAAU,cAAc,gBAAgB,eAAe,WAAW;EAElE,MAAM,WAAW,KAAK,OAAO,SAAS,aAAa,YAAY;EAC/D,UAAU,UAAU,YAAY,aAAa,YAAY,eAAe,WAAW;EACnF,OAAO;GAAE;GAAc;EAAS;CAClC;CAEA,MAAM,uBAAuB,EAC3B,gBACA,OACA,QAKe;EACf,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAE5E,MAAM,EAAE,YAAY,KAAK;EACzB,MAAM,EAAE,OAAO,UAAU,gBAAgB;EACzC,OAAO,SAAS,uBAAuB;GACrC;GACA;GACA;GACA;GACA,aAAa,eAAe,GAAG,QAAQ,qBAAqB;EAC9D,CAAC;CACH;CAEA,MAAM,0BAA0B,EAC9B,gBACA,MACA,QAKuB;EACvB,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAE5E,MAAM,EAAE,YAAY,KAAK;EACzB,MAAM,EAAE,UAAU,cAAc,gBAAgB;EAChD,OAAO,SAAS,0BAA0B;GACxC;GACA;GACA;GACA;GACA,aAAa,eAAe,GAAG,QAAQ,qBAAqB;EAC9D,CAAC;CACH;CAEA,MAAM,YAAY,EAChB,gBACA,OACA,YAKC;EACD,MAAM,EAAE,aAAa,MAAM,KAAK,gBAAgB,cAAc;EAC9D,OAAO,SAAS,YAAY,OAAO,QAAQ;CAC7C;CAEA,MAAM,mBAAmB,EACvB,gBACA,gBAIuB;EACvB,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAC5E,MAAM,EAAE,UAAU,iBAAiB;EAEnC,UAAU,SAAS,oBAAoB,8CAA8C;EACrF,OAAO,SAAS,mBAAmB;GAAE;GAAc;GAAU;EAAa,CAAC;CAC7E;CAEA,MAAM,YAAY,gBAAwB,OAAe;EACvD,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAC5E,MAAM,EAAE,UAAU,iBAAiB;EAEnC,UAAU,SAAS,aAAa,uCAAuC;EACvE,MAAM,SAAS,YAAY;GAAE;GAAO;GAAU;EAAa,CAAC;CAC9D;CAEA,MAAM,kBAAkB,EACtB,gBACA,aACA,QAKC;EACD,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAC5E,UAAU,SAAS,mBAAmB,6CAA6C;EACnF,MAAM,EAAE,YAAY,KAAK;EACzB,MAAM,EAAE,UAAU,cAAc,gBAAgB;EAEhD,OAAO,SAAS,kBAAkB;GAChC;GACA;GACA,aAAa,eAAe,GAAG,QAAQ,qBAAqB;GAC5D;GACA;EACF,CAAC;CACH;AACF"}
+{"version":3,"file":"client.mjs","names":[],"sources":["../../src/oauth2/client.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { object, optional, string } from 'zod/v4-mini';\nimport { OAuth2Error } from './error';\nimport type {\n  AuthorizationResponse,\n  ClientSecret,\n  NativeClient,\n  NativeCredential,\n  OAuth2ClientConfig,\n  OAuth2Token,\n  OidcToken,\n  OneTapProvider,\n  PkceParameters,\n  Provider,\n  ProviderConfig,\n  WebClient,\n} from './types';\n\nexport const oauth2RedirectQuerySchema = object({\n  code: optional(string()),\n  state: optional(string()),\n  error: optional(string()),\n  error_description: optional(string()),\n  error_uri: optional(string()),\n  // Apple's form_post: the user's name as JSON, first authorization only.\n  user: optional(string()),\n});\n\nexport const googleOneTapSchema = object({\n  // login_uri\n  code: optional(string()),\n  state: optional(string()),\n  error: optional(string()),\n  error_description: optional(string()),\n  error_uri: optional(string()),\n  nonce: optional(string()),\n  g_csrf_token: optional(string()),\n  hd: optional(string()),\n  // callback\n  credential: optional(string()),\n});\n\nexport class OAuth2Client {\n  private readonly config: OAuth2ClientConfig;\n  constructor(config: OAuth2ClientConfig) {\n    this.config = config;\n  }\n\n  get baseUri() {\n    return this.config.baseUri;\n  }\n\n  get successUri() {\n    return this.config.successUri;\n  }\n\n  get errorUri() {\n    return this.config.errorUri;\n  }\n\n  /** The provider key comes from the request path, so an unknown one is the caller's error. */\n  private async getProviderConfig(provider: string): Promise<ProviderConfig> {\n    const providers =\n      typeof this.config.providers === 'function'\n        ? await this.config.providers()\n        : this.config.providers;\n    const config = Object.hasOwn(providers, provider) ? providers[provider] : undefined;\n    if (!config) throw new OAuth2Error(400, 'invalid_request', `Unknown provider: ${provider}`);\n    return config;\n  }\n\n  private defaultRedirectUri(provider: string) {\n    return `${this.config.baseUri}/login/oauth2/code/${provider}`;\n  }\n\n  /** The redirect flow and One Tap sign in as the provider's web client. */\n  private async getWebClient(provider: string) {\n    const config = await this.getProviderConfig(provider);\n    if (!config.web) {\n      throw new OAuth2Error(400, 'invalid_request', `Provider ${provider} has no web client`);\n    }\n    return { implementation: config.provider, client: config.web };\n  }\n\n  /**\n   * Any configured client of the provider, looked up by id: refresh and revoke use the client a\n   * token was issued to, and the native login the one the app names. The web client counts too:\n   * an Android app's server auth code and a Facebook app's tokens are issued to it.\n   */\n  private async getClient(provider: string, clientId: string) {\n    const config = await this.getProviderConfig(provider);\n    const client = [config.web, ...(config.native ?? [])].find((c) => c?.clientId === clientId);\n    if (!client) {\n      throw new OAuth2Error(400, 'invalid_client', `${clientId} is not a client of ${provider}`);\n    }\n    return { implementation: config.provider, client };\n  }\n\n  /**\n   * The client a native login signs in as: the one the app names with `client_id`, which must be\n   * configured; without one, the only native client, or the web client when there is no native\n   * one. Several native clients and no `client_id` is ambiguous and refused rather than guessed.\n   */\n  private async getNativeClient(provider: string, clientId: string | undefined) {\n    if (clientId !== undefined) return this.getClient(provider, clientId);\n    const config = await this.getProviderConfig(provider);\n    const native = config.native ?? [];\n    const client: WebClient | NativeClient | undefined =\n      native.length === 0 ? config.web : native.length === 1 ? native[0] : undefined;\n    if (!client) {\n      throw new OAuth2Error(400, 'invalid_request', `client_id is required for ${provider}`);\n    }\n    return { implementation: config.provider, client };\n  }\n\n  private async resolveSecret(secret: ClientSecret | undefined, clientId: string) {\n    return typeof secret === 'function' ? secret(clientId) : secret;\n  }\n\n  async createAuthorizationUri({\n    provider,\n    state,\n    pkce,\n  }: {\n    provider: string;\n    state: string;\n    pkce?: PkceParameters;\n  }): Promise<URL> {\n    const { implementation, client } = await this.getWebClient(provider);\n    return implementation.createAuthorizationUri({\n      pkce,\n      state,\n      scope: client.scope,\n      clientId: client.clientId,\n      redirectUri: client.redirectUri ?? this.defaultRedirectUri(provider),\n    });\n  }\n\n  /** Exchanges a code issued to the provider's web client: the redirect flow and One Tap. */\n  async exchangeAuthorizationCode({\n    provider,\n    code,\n    pkce,\n  }: {\n    provider: string;\n    code: string;\n    pkce?: PkceParameters;\n  }): Promise<{ clientId: string; token: OAuth2Token }> {\n    const { implementation, client } = await this.getWebClient(provider);\n    const { clientId } = client;\n    const token = await implementation.exchangeAuthorizationCode({\n      code,\n      pkce,\n      clientId,\n      clientSecret: await this.resolveSecret(client.clientSecret, clientId),\n      redirectUri: client.redirectUri ?? this.defaultRedirectUri(provider),\n    });\n    return { clientId, token };\n  }\n\n  /** `clientId` is the client the token was issued to, as `exchangeAuthorizationCode` returns it. */\n  async getUserInfo({\n    provider,\n    clientId,\n    token,\n    response,\n  }: {\n    provider: string;\n    clientId: string;\n    token: OAuth2Token | OidcToken;\n    response?: AuthorizationResponse;\n  }) {\n    const { implementation } = await this.getClient(provider, clientId);\n    return implementation.getUserInfo(token, { clientId, response });\n  }\n\n  /** Verifies a Google One Tap / FedCM credential, which is issued to the web client. */\n  async getTokenInfo({ provider, credential }: { provider: string; credential: string }) {\n    const { implementation, client } = await this.getWebClient(provider);\n    if (!isOneTapProvider(implementation)) {\n      throw new OAuth2Error(400, 'invalid_request', `Provider ${provider} has no One Tap`);\n    }\n    const { clientId } = client;\n    return { clientId, ...(await implementation.getTokenInfo(credential, clientId)) };\n  }\n\n  async refreshAccessToken({\n    provider,\n    clientId,\n    refreshToken,\n  }: {\n    provider: string;\n    clientId: string;\n    refreshToken: string;\n  }): Promise<OAuth2Token> {\n    const { implementation, client } = await this.getClient(provider, clientId);\n    invariant(implementation.refreshAccessToken, 'Provider does not support refreshAccessToken');\n    const clientSecret = await this.resolveSecret(client.clientSecret, clientId);\n    return implementation.refreshAccessToken({ refreshToken, clientId, clientSecret });\n  }\n\n  async revokeToken({\n    provider,\n    clientId,\n    token,\n  }: {\n    provider: string;\n    clientId: string;\n    token: string;\n  }) {\n    const { implementation, client } = await this.getClient(provider, clientId);\n    invariant(implementation.revokeToken, 'Provider does not support revokeToken');\n    const clientSecret = await this.resolveSecret(client.clientSecret, clientId);\n    await implementation.revokeToken({ token, clientId, clientSecret });\n  }\n\n  async loginOAuth2Native({\n    provider,\n    credentials,\n    pkce,\n  }: {\n    provider: string;\n    credentials: NativeCredential;\n    pkce?: PkceParameters;\n  }) {\n    const { implementation, client } = await this.getNativeClient(provider, credentials.client_id);\n    invariant(implementation.loginOAuth2Native, 'Provider does not support loginOAuth2Native');\n    const { clientId } = client;\n\n    const result = await implementation.loginOAuth2Native({\n      clientId,\n      clientSecret: await this.resolveSecret(client.clientSecret, clientId),\n      redirectUri: client.redirectUri ?? this.defaultRedirectUri(provider),\n      credentials,\n      pkce,\n    });\n    return { clientId, ...result };\n  }\n}\n\nfunction isOneTapProvider(provider: Provider): provider is OneTapProvider {\n  return typeof (provider as Partial<OneTapProvider>).getTokenInfo === 'function';\n}\n"],"mappings":";;;;AAkBA,MAAa,4BAA4B,OAAO;CAC9C,MAAM,SAAS,OAAO,CAAC;CACvB,OAAO,SAAS,OAAO,CAAC;CACxB,OAAO,SAAS,OAAO,CAAC;CACxB,mBAAmB,SAAS,OAAO,CAAC;CACpC,WAAW,SAAS,OAAO,CAAC;CAE5B,MAAM,SAAS,OAAO,CAAC;AACzB,CAAC;AAED,MAAa,qBAAqB,OAAO;CAEvC,MAAM,SAAS,OAAO,CAAC;CACvB,OAAO,SAAS,OAAO,CAAC;CACxB,OAAO,SAAS,OAAO,CAAC;CACxB,mBAAmB,SAAS,OAAO,CAAC;CACpC,WAAW,SAAS,OAAO,CAAC;CAC5B,OAAO,SAAS,OAAO,CAAC;CACxB,cAAc,SAAS,OAAO,CAAC;CAC/B,IAAI,SAAS,OAAO,CAAC;CAErB,YAAY,SAAS,OAAO,CAAC;AAC/B,CAAC;AAED,IAAa,eAAb,MAA0B;CACxB;CACA,YAAY,QAA4B;EACtC,KAAK,SAAS;CAChB;CAEA,IAAI,UAAU;EACZ,OAAO,KAAK,OAAO;CACrB;CAEA,IAAI,aAAa;EACf,OAAO,KAAK,OAAO;CACrB;CAEA,IAAI,WAAW;EACb,OAAO,KAAK,OAAO;CACrB;;CAGA,MAAc,kBAAkB,UAA2C;EACzE,MAAM,YACJ,OAAO,KAAK,OAAO,cAAc,aAC7B,MAAM,KAAK,OAAO,UAAU,IAC5B,KAAK,OAAO;EAClB,MAAM,SAAS,OAAO,OAAO,WAAW,QAAQ,IAAI,UAAU,YAAY,KAAA;EAC1E,IAAI,CAAC,QAAQ,MAAM,IAAI,YAAY,KAAK,mBAAmB,qBAAqB,UAAU;EAC1F,OAAO;CACT;CAEA,mBAA2B,UAAkB;EAC3C,OAAO,GAAG,KAAK,OAAO,QAAQ,qBAAqB;CACrD;;CAGA,MAAc,aAAa,UAAkB;EAC3C,MAAM,SAAS,MAAM,KAAK,kBAAkB,QAAQ;EACpD,IAAI,CAAC,OAAO,KACV,MAAM,IAAI,YAAY,KAAK,mBAAmB,YAAY,SAAS,mBAAmB;EAExF,OAAO;GAAE,gBAAgB,OAAO;GAAU,QAAQ,OAAO;EAAI;CAC/D;;;;;;CAOA,MAAc,UAAU,UAAkB,UAAkB;EAC1D,MAAM,SAAS,MAAM,KAAK,kBAAkB,QAAQ;EACpD,MAAM,SAAS,CAAC,OAAO,KAAK,GAAI,OAAO,UAAU,CAAC,CAAE,CAAC,CAAC,MAAM,MAAM,GAAG,aAAa,QAAQ;EAC1F,IAAI,CAAC,QACH,MAAM,IAAI,YAAY,KAAK,kBAAkB,GAAG,SAAS,sBAAsB,UAAU;EAE3F,OAAO;GAAE,gBAAgB,OAAO;GAAU;EAAO;CACnD;;;;;;CAOA,MAAc,gBAAgB,UAAkB,UAA8B;EAC5E,IAAI,aAAa,KAAA,GAAW,OAAO,KAAK,UAAU,UAAU,QAAQ;EACpE,MAAM,SAAS,MAAM,KAAK,kBAAkB,QAAQ;EACpD,MAAM,SAAS,OAAO,UAAU,CAAC;EACjC,MAAM,SACJ,OAAO,WAAW,IAAI,OAAO,MAAM,OAAO,WAAW,IAAI,OAAO,KAAK,KAAA;EACvE,IAAI,CAAC,QACH,MAAM,IAAI,YAAY,KAAK,mBAAmB,6BAA6B,UAAU;EAEvF,OAAO;GAAE,gBAAgB,OAAO;GAAU;EAAO;CACnD;CAEA,MAAc,cAAc,QAAkC,UAAkB;EAC9E,OAAO,OAAO,WAAW,aAAa,OAAO,QAAQ,IAAI;CAC3D;CAEA,MAAM,uBAAuB,EAC3B,UACA,OACA,QAKe;EACf,MAAM,EAAE,gBAAgB,WAAW,MAAM,KAAK,aAAa,QAAQ;EACnE,OAAO,eAAe,uBAAuB;GAC3C;GACA;GACA,OAAO,OAAO;GACd,UAAU,OAAO;GACjB,aAAa,OAAO,eAAe,KAAK,mBAAmB,QAAQ;EACrE,CAAC;CACH;;CAGA,MAAM,0BAA0B,EAC9B,UACA,MACA,QAKoD;EACpD,MAAM,EAAE,gBAAgB,WAAW,MAAM,KAAK,aAAa,QAAQ;EACnE,MAAM,EAAE,aAAa;EAQrB,OAAO;GAAE;GAAU,OAAA,MAPC,eAAe,0BAA0B;IAC3D;IACA;IACA;IACA,cAAc,MAAM,KAAK,cAAc,OAAO,cAAc,QAAQ;IACpE,aAAa,OAAO,eAAe,KAAK,mBAAmB,QAAQ;GACrE,CAAC;EACwB;CAC3B;;CAGA,MAAM,YAAY,EAChB,UACA,UACA,OACA,YAMC;EACD,MAAM,EAAE,mBAAmB,MAAM,KAAK,UAAU,UAAU,QAAQ;EAClE,OAAO,eAAe,YAAY,OAAO;GAAE;GAAU;EAAS,CAAC;CACjE;;CAGA,MAAM,aAAa,EAAE,UAAU,cAAwD;EACrF,MAAM,EAAE,gBAAgB,WAAW,MAAM,KAAK,aAAa,QAAQ;EACnE,IAAI,CAAC,iBAAiB,cAAc,GAClC,MAAM,IAAI,YAAY,KAAK,mBAAmB,YAAY,SAAS,gBAAgB;EAErF,MAAM,EAAE,aAAa;EACrB,OAAO;GAAE;GAAU,GAAI,MAAM,eAAe,aAAa,YAAY,QAAQ;EAAG;CAClF;CAEA,MAAM,mBAAmB,EACvB,UACA,UACA,gBAKuB;EACvB,MAAM,EAAE,gBAAgB,WAAW,MAAM,KAAK,UAAU,UAAU,QAAQ;EAC1E,UAAU,eAAe,oBAAoB,8CAA8C;EAC3F,MAAM,eAAe,MAAM,KAAK,cAAc,OAAO,cAAc,QAAQ;EAC3E,OAAO,eAAe,mBAAmB;GAAE;GAAc;GAAU;EAAa,CAAC;CACnF;CAEA,MAAM,YAAY,EAChB,UACA,UACA,SAKC;EACD,MAAM,EAAE,gBAAgB,WAAW,MAAM,KAAK,UAAU,UAAU,QAAQ;EAC1E,UAAU,eAAe,aAAa,uCAAuC;EAC7E,MAAM,eAAe,MAAM,KAAK,cAAc,OAAO,cAAc,QAAQ;EAC3E,MAAM,eAAe,YAAY;GAAE;GAAO;GAAU;EAAa,CAAC;CACpE;CAEA,MAAM,kBAAkB,EACtB,UACA,aACA,QAKC;EACD,MAAM,EAAE,gBAAgB,WAAW,MAAM,KAAK,gBAAgB,UAAU,YAAY,SAAS;EAC7F,UAAU,eAAe,mBAAmB,6CAA6C;EACzF,MAAM,EAAE,aAAa;EASrB,OAAO;GAAE;GAAU,GAAG,MAPD,eAAe,kBAAkB;IACpD;IACA,cAAc,MAAM,KAAK,cAAc,OAAO,cAAc,QAAQ;IACpE,aAAa,OAAO,eAAe,KAAK,mBAAmB,QAAQ;IACnE;IACA;GACF,CAAC;EAC4B;CAC/B;AACF;AAEA,SAAS,iBAAiB,UAAgD;CACxE,OAAO,OAAQ,SAAqC,iBAAiB;AACvE"}

package/dist/oauth2/provider/apple-client-secret.cjs

@@ -8,9 +8,9 @@ let jose = require("jose");
 * differ only in `sub`.
 *
 * Returns `clientId => secret`, signing on demand and caching per client id until `renewBefore`
-* seconds before expiry, so the secret can be minted by the server at runtime (an
-* `OAuth2ClientConfig.registration` function) instead of being generated by hand and stored, and
-* rotated, as a static secret.
+* seconds before expiry. Pass it as the `clientSecret` of every Apple client (web and native): it
+* is called with each client's own id on every use, so the server mints the secrets at runtime
+* instead of generating, storing and rotating static ones by hand.
 */
 function createAppleClientSecret(options) {
 	const { teamId, keyId, privateKey, expiresIn = 3600, renewBefore = 300 } = options;

package/dist/oauth2/provider/apple-client-secret.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"apple-client-secret.cjs","names":["importPKCS8","SignJWT"],"sources":["../../../src/oauth2/provider/apple-client-secret.ts"],"sourcesContent":["import { SignJWT, importPKCS8 } from 'jose';\n\nexport interface AppleClientSecretOptions {\n  /** Apple Developer Team ID (Membership details). */\n  teamId: string;\n  /** Key ID of a key with Sign in with Apple enabled (Certificates, Identifiers & Profiles → Keys). */\n  keyId: string;\n  /** Contents of that key's `.p8` file: a PKCS#8 PEM. */\n  privateKey: string;\n  /** Lifetime of each signed secret, in seconds. Apple caps it at six months. Default: one hour. */\n  expiresIn?: number;\n  /** Re-sign once fewer than this many seconds remain, so a cached secret never reaches Apple expired. Default: five minutes. */\n  renewBefore?: number;\n}\n\n/**\n * Sign in with Apple has no static client secret: the secret is a JWT the server signs with its\n * Sign in with Apple key (ES256, `iss` = team, `sub` = client id, `aud` = appleid.apple.com), and\n * a team signs one per client id — the app's bundle id and the web Services ID share the key and\n * differ only in `sub`.\n *\n * Returns `clientId => secret`, signing on demand and caching per client id until `renewBefore`\n * seconds before expiry, so the secret can be minted by the server at runtime (an\n * `OAuth2ClientConfig.registration` function) instead of being generated by hand and stored, and\n * rotated, as a static secret.\n */\nexport function createAppleClientSecret(options: AppleClientSecretOptions) {\n  const { teamId, keyId, privateKey, expiresIn = 3600, renewBefore = 300 } = options;\n  if (renewBefore >= expiresIn) {\n    throw new Error('renewBefore must be shorter than expiresIn');\n  }\n\n  // The import is cached as a promise so concurrent first calls share one; a failed import is\n  // dropped so the next call retries instead of failing forever.\n  let key: Promise<CryptoKey> | undefined;\n  const cache = new Map<string, { secret: string; exp: number }>();\n\n  function getKey() {\n    key ??= importPKCS8(privateKey, 'ES256').catch((error: unknown) => {\n      key = undefined;\n      throw error;\n    });\n    return key;\n  }\n\n  return async function appleClientSecret(clientId: string): Promise<string> {\n    const now = Math.floor(Date.now() / 1000);\n    const cached = cache.get(clientId);\n    if (cached && cached.exp - now > renewBefore) return cached.secret;\n\n    const exp = now + expiresIn;\n    const secret = await new SignJWT({})\n      .setProtectedHeader({ alg: 'ES256', kid: keyId })\n      .setIssuer(teamId)\n      .setSubject(clientId)\n      .setAudience('https://appleid.apple.com')\n      .setIssuedAt(now)\n      .setExpirationTime(exp)\n      .sign(await getKey());\n    cache.set(clientId, { secret, exp });\n    return secret;\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;AA0BA,SAAgB,wBAAwB,SAAmC;CACzE,MAAM,EAAE,QAAQ,OAAO,YAAY,YAAY,MAAM,cAAc,QAAQ;CAC3E,IAAI,eAAe,WACjB,MAAM,IAAI,MAAM,4CAA4C;CAK9D,IAAI;CACJ,MAAM,wBAAQ,IAAI,IAA6C;CAE/D,SAAS,SAAS;EAChB,SAAA,GAAQA,KAAAA,YAAAA,CAAY,YAAY,OAAO,CAAC,CAAC,OAAO,UAAmB;GACjE,MAAM,KAAA;GACN,MAAM;EACR,CAAC;EACD,OAAO;CACT;CAEA,OAAO,eAAe,kBAAkB,UAAmC;EACzE,MAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;EACxC,MAAM,SAAS,MAAM,IAAI,QAAQ;EACjC,IAAI,UAAU,OAAO,MAAM,MAAM,aAAa,OAAO,OAAO;EAE5D,MAAM,MAAM,MAAM;EAClB,MAAM,SAAS,MAAM,IAAIC,KAAAA,QAAQ,CAAC,CAAC,CAAC,CACjC,mBAAmB;GAAE,KAAK;GAAS,KAAK;EAAM,CAAC,CAAC,CAChD,UAAU,MAAM,CAAC,CACjB,WAAW,QAAQ,CAAC,CACpB,YAAY,2BAA2B,CAAC,CACxC,YAAY,GAAG,CAAC,CAChB,kBAAkB,GAAG,CAAC,CACtB,KAAK,MAAM,OAAO,CAAC;EACtB,MAAM,IAAI,UAAU;GAAE;GAAQ;EAAI,CAAC;EACnC,OAAO;CACT;AACF"}
+{"version":3,"file":"apple-client-secret.cjs","names":["importPKCS8","SignJWT"],"sources":["../../../src/oauth2/provider/apple-client-secret.ts"],"sourcesContent":["import { SignJWT, importPKCS8 } from 'jose';\n\nexport interface AppleClientSecretOptions {\n  /** Apple Developer Team ID (Membership details). */\n  teamId: string;\n  /** Key ID of a key with Sign in with Apple enabled (Certificates, Identifiers & Profiles → Keys). */\n  keyId: string;\n  /** Contents of that key's `.p8` file: a PKCS#8 PEM. */\n  privateKey: string;\n  /** Lifetime of each signed secret, in seconds. Apple caps it at six months. Default: one hour. */\n  expiresIn?: number;\n  /** Re-sign once fewer than this many seconds remain, so a cached secret never reaches Apple expired. Default: five minutes. */\n  renewBefore?: number;\n}\n\n/**\n * Sign in with Apple has no static client secret: the secret is a JWT the server signs with its\n * Sign in with Apple key (ES256, `iss` = team, `sub` = client id, `aud` = appleid.apple.com), and\n * a team signs one per client id — the app's bundle id and the web Services ID share the key and\n * differ only in `sub`.\n *\n * Returns `clientId => secret`, signing on demand and caching per client id until `renewBefore`\n * seconds before expiry. Pass it as the `clientSecret` of every Apple client (web and native): it\n * is called with each client's own id on every use, so the server mints the secrets at runtime\n * instead of generating, storing and rotating static ones by hand.\n */\nexport function createAppleClientSecret(options: AppleClientSecretOptions) {\n  const { teamId, keyId, privateKey, expiresIn = 3600, renewBefore = 300 } = options;\n  if (renewBefore >= expiresIn) {\n    throw new Error('renewBefore must be shorter than expiresIn');\n  }\n\n  // The import is cached as a promise so concurrent first calls share one; a failed import is\n  // dropped so the next call retries instead of failing forever.\n  let key: Promise<CryptoKey> | undefined;\n  const cache = new Map<string, { secret: string; exp: number }>();\n\n  function getKey() {\n    key ??= importPKCS8(privateKey, 'ES256').catch((error: unknown) => {\n      key = undefined;\n      throw error;\n    });\n    return key;\n  }\n\n  return async function appleClientSecret(clientId: string): Promise<string> {\n    const now = Math.floor(Date.now() / 1000);\n    const cached = cache.get(clientId);\n    if (cached && cached.exp - now > renewBefore) return cached.secret;\n\n    const exp = now + expiresIn;\n    const secret = await new SignJWT({})\n      .setProtectedHeader({ alg: 'ES256', kid: keyId })\n      .setIssuer(teamId)\n      .setSubject(clientId)\n      .setAudience('https://appleid.apple.com')\n      .setIssuedAt(now)\n      .setExpirationTime(exp)\n      .sign(await getKey());\n    cache.set(clientId, { secret, exp });\n    return secret;\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;AA0BA,SAAgB,wBAAwB,SAAmC;CACzE,MAAM,EAAE,QAAQ,OAAO,YAAY,YAAY,MAAM,cAAc,QAAQ;CAC3E,IAAI,eAAe,WACjB,MAAM,IAAI,MAAM,4CAA4C;CAK9D,IAAI;CACJ,MAAM,wBAAQ,IAAI,IAA6C;CAE/D,SAAS,SAAS;EAChB,SAAA,GAAQA,KAAAA,YAAAA,CAAY,YAAY,OAAO,CAAC,CAAC,OAAO,UAAmB;GACjE,MAAM,KAAA;GACN,MAAM;EACR,CAAC;EACD,OAAO;CACT;CAEA,OAAO,eAAe,kBAAkB,UAAmC;EACzE,MAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;EACxC,MAAM,SAAS,MAAM,IAAI,QAAQ;EACjC,IAAI,UAAU,OAAO,MAAM,MAAM,aAAa,OAAO,OAAO;EAE5D,MAAM,MAAM,MAAM;EAClB,MAAM,SAAS,MAAM,IAAIC,KAAAA,QAAQ,CAAC,CAAC,CAAC,CACjC,mBAAmB;GAAE,KAAK;GAAS,KAAK;EAAM,CAAC,CAAC,CAChD,UAAU,MAAM,CAAC,CACjB,WAAW,QAAQ,CAAC,CACpB,YAAY,2BAA2B,CAAC,CACxC,YAAY,GAAG,CAAC,CAChB,kBAAkB,GAAG,CAAC,CACtB,KAAK,MAAM,OAAO,CAAC;EACtB,MAAM,IAAI,UAAU;GAAE;GAAQ;EAAI,CAAC;EACnC,OAAO;CACT;AACF"}

package/dist/oauth2/provider/apple-client-secret.d.cts

@@ -18,9 +18,9 @@ export interface AppleClientSecretOptions {
  * differ only in `sub`.
  *
  * Returns `clientId => secret`, signing on demand and caching per client id until `renewBefore`
- * seconds before expiry, so the secret can be minted by the server at runtime (an
- * `OAuth2ClientConfig.registration` function) instead of being generated by hand and stored, and
- * rotated, as a static secret.
+ * seconds before expiry. Pass it as the `clientSecret` of every Apple client (web and native): it
+ * is called with each client's own id on every use, so the server mints the secrets at runtime
+ * instead of generating, storing and rotating static ones by hand.
  */
 export declare function createAppleClientSecret(options: AppleClientSecretOptions): (clientId: string) => Promise<string>;
 //#endregion

package/dist/oauth2/provider/apple-client-secret.d.mts

@@ -18,9 +18,9 @@ export interface AppleClientSecretOptions {
  * differ only in `sub`.
  *
  * Returns `clientId => secret`, signing on demand and caching per client id until `renewBefore`
- * seconds before expiry, so the secret can be minted by the server at runtime (an
- * `OAuth2ClientConfig.registration` function) instead of being generated by hand and stored, and
- * rotated, as a static secret.
+ * seconds before expiry. Pass it as the `clientSecret` of every Apple client (web and native): it
+ * is called with each client's own id on every use, so the server mints the secrets at runtime
+ * instead of generating, storing and rotating static ones by hand.
  */
 export declare function createAppleClientSecret(options: AppleClientSecretOptions): (clientId: string) => Promise<string>;
 //#endregion

package/dist/oauth2/provider/apple-client-secret.mjs

@@ -7,9 +7,9 @@ import { SignJWT, importPKCS8 } from "jose";
 * differ only in `sub`.
 *
 * Returns `clientId => secret`, signing on demand and caching per client id until `renewBefore`
-* seconds before expiry, so the secret can be minted by the server at runtime (an
-* `OAuth2ClientConfig.registration` function) instead of being generated by hand and stored, and
-* rotated, as a static secret.
+* seconds before expiry. Pass it as the `clientSecret` of every Apple client (web and native): it
+* is called with each client's own id on every use, so the server mints the secrets at runtime
+* instead of generating, storing and rotating static ones by hand.
 */
 function createAppleClientSecret(options) {
 	const { teamId, keyId, privateKey, expiresIn = 3600, renewBefore = 300 } = options;

package/dist/oauth2/provider/apple-client-secret.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"apple-client-secret.mjs","names":[],"sources":["../../../src/oauth2/provider/apple-client-secret.ts"],"sourcesContent":["import { SignJWT, importPKCS8 } from 'jose';\n\nexport interface AppleClientSecretOptions {\n  /** Apple Developer Team ID (Membership details). */\n  teamId: string;\n  /** Key ID of a key with Sign in with Apple enabled (Certificates, Identifiers & Profiles → Keys). */\n  keyId: string;\n  /** Contents of that key's `.p8` file: a PKCS#8 PEM. */\n  privateKey: string;\n  /** Lifetime of each signed secret, in seconds. Apple caps it at six months. Default: one hour. */\n  expiresIn?: number;\n  /** Re-sign once fewer than this many seconds remain, so a cached secret never reaches Apple expired. Default: five minutes. */\n  renewBefore?: number;\n}\n\n/**\n * Sign in with Apple has no static client secret: the secret is a JWT the server signs with its\n * Sign in with Apple key (ES256, `iss` = team, `sub` = client id, `aud` = appleid.apple.com), and\n * a team signs one per client id — the app's bundle id and the web Services ID share the key and\n * differ only in `sub`.\n *\n * Returns `clientId => secret`, signing on demand and caching per client id until `renewBefore`\n * seconds before expiry, so the secret can be minted by the server at runtime (an\n * `OAuth2ClientConfig.registration` function) instead of being generated by hand and stored, and\n * rotated, as a static secret.\n */\nexport function createAppleClientSecret(options: AppleClientSecretOptions) {\n  const { teamId, keyId, privateKey, expiresIn = 3600, renewBefore = 300 } = options;\n  if (renewBefore >= expiresIn) {\n    throw new Error('renewBefore must be shorter than expiresIn');\n  }\n\n  // The import is cached as a promise so concurrent first calls share one; a failed import is\n  // dropped so the next call retries instead of failing forever.\n  let key: Promise<CryptoKey> | undefined;\n  const cache = new Map<string, { secret: string; exp: number }>();\n\n  function getKey() {\n    key ??= importPKCS8(privateKey, 'ES256').catch((error: unknown) => {\n      key = undefined;\n      throw error;\n    });\n    return key;\n  }\n\n  return async function appleClientSecret(clientId: string): Promise<string> {\n    const now = Math.floor(Date.now() / 1000);\n    const cached = cache.get(clientId);\n    if (cached && cached.exp - now > renewBefore) return cached.secret;\n\n    const exp = now + expiresIn;\n    const secret = await new SignJWT({})\n      .setProtectedHeader({ alg: 'ES256', kid: keyId })\n      .setIssuer(teamId)\n      .setSubject(clientId)\n      .setAudience('https://appleid.apple.com')\n      .setIssuedAt(now)\n      .setExpirationTime(exp)\n      .sign(await getKey());\n    cache.set(clientId, { secret, exp });\n    return secret;\n  };\n}\n"],"mappings":";;;;;;;;;;;;;AA0BA,SAAgB,wBAAwB,SAAmC;CACzE,MAAM,EAAE,QAAQ,OAAO,YAAY,YAAY,MAAM,cAAc,QAAQ;CAC3E,IAAI,eAAe,WACjB,MAAM,IAAI,MAAM,4CAA4C;CAK9D,IAAI;CACJ,MAAM,wBAAQ,IAAI,IAA6C;CAE/D,SAAS,SAAS;EAChB,QAAQ,YAAY,YAAY,OAAO,CAAC,CAAC,OAAO,UAAmB;GACjE,MAAM,KAAA;GACN,MAAM;EACR,CAAC;EACD,OAAO;CACT;CAEA,OAAO,eAAe,kBAAkB,UAAmC;EACzE,MAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;EACxC,MAAM,SAAS,MAAM,IAAI,QAAQ;EACjC,IAAI,UAAU,OAAO,MAAM,MAAM,aAAa,OAAO,OAAO;EAE5D,MAAM,MAAM,MAAM;EAClB,MAAM,SAAS,MAAM,IAAI,QAAQ,CAAC,CAAC,CAAC,CACjC,mBAAmB;GAAE,KAAK;GAAS,KAAK;EAAM,CAAC,CAAC,CAChD,UAAU,MAAM,CAAC,CACjB,WAAW,QAAQ,CAAC,CACpB,YAAY,2BAA2B,CAAC,CACxC,YAAY,GAAG,CAAC,CAChB,kBAAkB,GAAG,CAAC,CACtB,KAAK,MAAM,OAAO,CAAC;EACtB,MAAM,IAAI,UAAU;GAAE;GAAQ;EAAI,CAAC;EACnC,OAAO;CACT;AACF"}
+{"version":3,"file":"apple-client-secret.mjs","names":[],"sources":["../../../src/oauth2/provider/apple-client-secret.ts"],"sourcesContent":["import { SignJWT, importPKCS8 } from 'jose';\n\nexport interface AppleClientSecretOptions {\n  /** Apple Developer Team ID (Membership details). */\n  teamId: string;\n  /** Key ID of a key with Sign in with Apple enabled (Certificates, Identifiers & Profiles → Keys). */\n  keyId: string;\n  /** Contents of that key's `.p8` file: a PKCS#8 PEM. */\n  privateKey: string;\n  /** Lifetime of each signed secret, in seconds. Apple caps it at six months. Default: one hour. */\n  expiresIn?: number;\n  /** Re-sign once fewer than this many seconds remain, so a cached secret never reaches Apple expired. Default: five minutes. */\n  renewBefore?: number;\n}\n\n/**\n * Sign in with Apple has no static client secret: the secret is a JWT the server signs with its\n * Sign in with Apple key (ES256, `iss` = team, `sub` = client id, `aud` = appleid.apple.com), and\n * a team signs one per client id — the app's bundle id and the web Services ID share the key and\n * differ only in `sub`.\n *\n * Returns `clientId => secret`, signing on demand and caching per client id until `renewBefore`\n * seconds before expiry. Pass it as the `clientSecret` of every Apple client (web and native): it\n * is called with each client's own id on every use, so the server mints the secrets at runtime\n * instead of generating, storing and rotating static ones by hand.\n */\nexport function createAppleClientSecret(options: AppleClientSecretOptions) {\n  const { teamId, keyId, privateKey, expiresIn = 3600, renewBefore = 300 } = options;\n  if (renewBefore >= expiresIn) {\n    throw new Error('renewBefore must be shorter than expiresIn');\n  }\n\n  // The import is cached as a promise so concurrent first calls share one; a failed import is\n  // dropped so the next call retries instead of failing forever.\n  let key: Promise<CryptoKey> | undefined;\n  const cache = new Map<string, { secret: string; exp: number }>();\n\n  function getKey() {\n    key ??= importPKCS8(privateKey, 'ES256').catch((error: unknown) => {\n      key = undefined;\n      throw error;\n    });\n    return key;\n  }\n\n  return async function appleClientSecret(clientId: string): Promise<string> {\n    const now = Math.floor(Date.now() / 1000);\n    const cached = cache.get(clientId);\n    if (cached && cached.exp - now > renewBefore) return cached.secret;\n\n    const exp = now + expiresIn;\n    const secret = await new SignJWT({})\n      .setProtectedHeader({ alg: 'ES256', kid: keyId })\n      .setIssuer(teamId)\n      .setSubject(clientId)\n      .setAudience('https://appleid.apple.com')\n      .setIssuedAt(now)\n      .setExpirationTime(exp)\n      .sign(await getKey());\n    cache.set(clientId, { secret, exp });\n    return secret;\n  };\n}\n"],"mappings":";;;;;;;;;;;;;AA0BA,SAAgB,wBAAwB,SAAmC;CACzE,MAAM,EAAE,QAAQ,OAAO,YAAY,YAAY,MAAM,cAAc,QAAQ;CAC3E,IAAI,eAAe,WACjB,MAAM,IAAI,MAAM,4CAA4C;CAK9D,IAAI;CACJ,MAAM,wBAAQ,IAAI,IAA6C;CAE/D,SAAS,SAAS;EAChB,QAAQ,YAAY,YAAY,OAAO,CAAC,CAAC,OAAO,UAAmB;GACjE,MAAM,KAAA;GACN,MAAM;EACR,CAAC;EACD,OAAO;CACT;CAEA,OAAO,eAAe,kBAAkB,UAAmC;EACzE,MAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;EACxC,MAAM,SAAS,MAAM,IAAI,QAAQ;EACjC,IAAI,UAAU,OAAO,MAAM,MAAM,aAAa,OAAO,OAAO;EAE5D,MAAM,MAAM,MAAM;EAClB,MAAM,SAAS,MAAM,IAAI,QAAQ,CAAC,CAAC,CAAC,CACjC,mBAAmB;GAAE,KAAK;GAAS,KAAK;EAAM,CAAC,CAAC,CAChD,UAAU,MAAM,CAAC,CACjB,WAAW,QAAQ,CAAC,CACpB,YAAY,2BAA2B,CAAC,CACxC,YAAY,GAAG,CAAC,CAChB,kBAAkB,GAAG,CAAC,CACtB,KAAK,MAAM,OAAO,CAAC;EACtB,MAAM,IAAI,UAAU;GAAE;GAAQ;EAAI,CAAC;EACnC,OAAO;CACT;AACF"}

package/dist/oauth2/provider/apple.cjs

@@ -4,6 +4,8 @@ const require_oauth2_name = require("../name.cjs");
 const require_oauth2_provider_common = require("./common.cjs");
 let _shware_utils = require("@shware/utils");
 //#region src/oauth2/provider/apple.ts
+/** `iss` of every Apple id token (https://appleid.apple.com/.well-known/openid-configuration). */
+const APPLE_ISSUER = "https://appleid.apple.com";
 function createAppleProvider() {
 	return {
 		authorizationUri: "https://appleid.apple.com/auth/authorize?response_mode=form_post",
@@ -33,10 +35,14 @@ function createAppleProvider() {
 			}
 			return await response.json();
 		},
-		async getUserInfo({ id_token }, response) {
+		async getUserInfo({ id_token }, { clientId, response }) {
 			(0, _shware_utils.invariant)(id_token, "id_token is required");
 			(0, _shware_utils.invariant)(this.jwkSetUri, "jwkSetUri is required");
-			const token = await require_oauth2_provider_common.verifyIdToken(id_token, this.jwkSetUri);
+			const token = await require_oauth2_provider_common.verifyIdToken(id_token, {
+				jwkSetUri: this.jwkSetUri,
+				issuer: APPLE_ISSUER,
+				audience: clientId
+			});
 			const user = require_oauth2_name.parseAppleUser(response?.user);
 			return {
 				data: user ? {
@@ -68,7 +74,7 @@ function createAppleProvider() {
 				throw new require_oauth2_error.OAuth2Error(response.status, error);
 			}
 			const token = await response.json();
-			const { data, claims } = await this.getUserInfo(token);
+			const { data, claims } = await this.getUserInfo(token, { clientId: params.clientId });
 			const fullName = require_oauth2_name.cleanPersonName(credentials.fullName);
 			const name = require_oauth2_name.nameClaims({
 				given_name: fullName?.givenName ?? void 0,