@shware/security 8.0.1 → 9.1.0

package/dist/oauth2/client.d.cts

@@ -42,10 +42,16 @@ export declare class OAuth2Client {
    */
   private getNativeClient;
   private resolveSecret;
-  createAuthorizationUri({ provider, state, pkce }: {
+  /** Which of the provider's flows echo a nonce in the id token (`Provider.nonce`). */
+  nonceSupport(provider: string): Promise<{
+    web: boolean;
+    native: boolean;
+  }>;
+  createAuthorizationUri({ provider, state, pkce, nonce }: {
     provider: string;
     state: string;
     pkce?: PkceParameters;
+    nonce?: string;
   }): Promise<URL>;
   /** Exchanges a code issued to the provider's web client: the redirect flow and One Tap. */
   exchangeAuthorizationCode({ provider, code, pkce }: {

package/dist/oauth2/client.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.cts","names":["_$__types0.UserInfo"],"sources":["../../src/oauth2/client.ts"],"mappings":";qBAkBa,8CAAyB;;;;;;;yBAQpC;qBAEW,uCAAkB;;;;;;;;;;yBAY7B;qBAEW;mBACM;EACjB,YAAY,QAAQ;MAIhB;MAIA;MAIA;;UAKU;UAUN;;UAKM;;;;;;UAaA;;;;;;UAcA;UAYA;EAIR,yBACJ,UACA,OACA;IAEA;IACA;IACA,OAAO;MACL,QAAQ;;EAYN,4BACJ,UACA,MACA;IAEA;IACA;IACA,OAAO;MACL;IAAU;IAAkB,OAAO;;;EAcjC,cACJ,UACA,UACA,OACA;IAEA;IACA;IACA,OAAO,cAAc;IACrB,WAAW;MACZ,QADYA;;EAOP,eAAe,UAAU;IAAgB;IAAkB;MAAoB;;;;;EAS/E,qBACJ,UACA,UACA;IAEA;IACA;IACA;MACE,QAAQ;EAON,cACJ,UACA,UACA;IAEA;IACA;IACA;MACD;;;;;EAWK,oBACJ,UACA,eAAe,kBAAkB,eACjC;IAEA;IACA,aAAa;IACb,OAAO,KAAK;MACb"}
+{"version":3,"file":"client.d.cts","names":["_$__types0.UserInfo"],"sources":["../../src/oauth2/client.ts"],"mappings":";qBAkBa,8CAAyB;;;;;;;yBAQpC;qBAEW,uCAAkB;;;;;;;;;;yBAY7B;qBAEW;mBACM;EACjB,YAAY,QAAQ;MAIhB;MAIA;MAIA;;UAKU;UAUN;;UAKM;;;;;;UAaA;;;;;;UAcA;UAYA;;EAKR,aAAa,mBAAmB;IAAU;IAAc;;EAKxD,yBACJ,UACA,OACA,MACA;IAEA;IACA;IACA,OAAO;IACP;MACE,QAAQ;;EAaN,4BACJ,UACA,MACA;IAEA;IACA;IACA,OAAO;MACL;IAAU;IAAkB,OAAO;;;EAcjC,cACJ,UACA,UACA,OACA;IAEA;IACA;IACA,OAAO,cAAc;IACrB,WAAW;MACZ,QADYA;;EAOP,eAAe,UAAU;IAAgB;IAAkB;MAAoB;;;;;EAS/E,qBACJ,UACA,UACA;IAEA;IACA;IACA;MACE,QAAQ;EAON,cACJ,UACA,UACA;IAEA;IACA;IACA;MACD;;;;;EAWK,oBACJ,UACA,eAAe,kBAAkB,eACjC;IAEA;IACA,aAAa;IACb,OAAO,KAAK;MACb"}

package/dist/oauth2/client.d.mts

@@ -42,10 +42,16 @@ export declare class OAuth2Client {
    */
   private getNativeClient;
   private resolveSecret;
-  createAuthorizationUri({ provider, state, pkce }: {
+  /** Which of the provider's flows echo a nonce in the id token (`Provider.nonce`). */
+  nonceSupport(provider: string): Promise<{
+    web: boolean;
+    native: boolean;
+  }>;
+  createAuthorizationUri({ provider, state, pkce, nonce }: {
     provider: string;
     state: string;
     pkce?: PkceParameters;
+    nonce?: string;
   }): Promise<URL>;
   /** Exchanges a code issued to the provider's web client: the redirect flow and One Tap. */
   exchangeAuthorizationCode({ provider, code, pkce }: {

package/dist/oauth2/client.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.mts","names":["_$__types0.UserInfo"],"sources":["../../src/oauth2/client.ts"],"mappings":";qBAkBa,8CAAyB;;;;;;;yBAQpC;qBAEW,uCAAkB;;;;;;;;;;yBAY7B;qBAEW;mBACM;EACjB,YAAY,QAAQ;MAIhB;MAIA;MAIA;;UAKU;UAUN;;UAKM;;;;;;UAaA;;;;;;UAcA;UAYA;EAIR,yBACJ,UACA,OACA;IAEA;IACA;IACA,OAAO;MACL,QAAQ;;EAYN,4BACJ,UACA,MACA;IAEA;IACA;IACA,OAAO;MACL;IAAU;IAAkB,OAAO;;;EAcjC,cACJ,UACA,UACA,OACA;IAEA;IACA;IACA,OAAO,cAAc;IACrB,WAAW;MACZ,QADYA;;EAOP,eAAe,UAAU;IAAgB;IAAkB;MAAoB;;;;;EAS/E,qBACJ,UACA,UACA;IAEA;IACA;IACA;MACE,QAAQ;EAON,cACJ,UACA,UACA;IAEA;IACA;IACA;MACD;;;;;EAWK,oBACJ,UACA,eAAe,kBAAkB,eACjC;IAEA;IACA,aAAa;IACb,OAAO,KAAK;MACb"}
+{"version":3,"file":"client.d.mts","names":["_$__types0.UserInfo"],"sources":["../../src/oauth2/client.ts"],"mappings":";qBAkBa,8CAAyB;;;;;;;yBAQpC;qBAEW,uCAAkB;;;;;;;;;;yBAY7B;qBAEW;mBACM;EACjB,YAAY,QAAQ;MAIhB;MAIA;MAIA;;UAKU;UAUN;;UAKM;;;;;;UAaA;;;;;;UAcA;UAYA;;EAKR,aAAa,mBAAmB;IAAU;IAAc;;EAKxD,yBACJ,UACA,OACA,MACA;IAEA;IACA;IACA,OAAO;IACP;MACE,QAAQ;;EAaN,4BACJ,UACA,MACA;IAEA;IACA;IACA,OAAO;MACL;IAAU;IAAkB,OAAO;;;EAcjC,cACJ,UACA,UACA,OACA;IAEA;IACA;IACA,OAAO,cAAc;IACrB,WAAW;MACZ,QADYA;;EAOP,eAAe,UAAU;IAAgB;IAAkB;MAAoB;;;;;EAS/E,qBACJ,UACA,UACA;IAEA;IACA;IACA;MACE,QAAQ;EAON,cACJ,UACA,UACA;IAEA;IACA;IACA;MACD;;;;;EAWK,oBACJ,UACA,eAAe,kBAAkB,eACjC;IAEA;IACA,aAAa;IACb,OAAO,KAAK;MACb"}

package/dist/oauth2/client.mjs

@@ -87,11 +87,20 @@ var OAuth2Client = class {
 	async resolveSecret(secret, clientId) {
 		return typeof secret === "function" ? secret(clientId) : secret;
 	}
-	async createAuthorizationUri({ provider, state, pkce }) {
+	/** Which of the provider's flows echo a nonce in the id token (`Provider.nonce`). */
+	async nonceSupport(provider) {
+		const { nonce } = (await this.getProviderConfig(provider)).provider;
+		return {
+			web: nonce?.web ?? false,
+			native: nonce?.native ?? false
+		};
+	}
+	async createAuthorizationUri({ provider, state, pkce, nonce }) {
 		const { implementation, client } = await this.getWebClient(provider);
 		return implementation.createAuthorizationUri({
 			pkce,
 			state,
+			nonce,
 			scope: client.scope,
 			clientId: client.clientId,
 			redirectUri: client.redirectUri ?? this.defaultRedirectUri(provider)

package/dist/oauth2/client.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"client.mjs","names":[],"sources":["../../src/oauth2/client.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { object, optional, string } from 'zod/v4-mini';\nimport { OAuth2Error } from './error';\nimport type {\n  AuthorizationResponse,\n  ClientSecret,\n  NativeClient,\n  NativeCredential,\n  OAuth2ClientConfig,\n  OAuth2Token,\n  OidcToken,\n  OneTapProvider,\n  PkceParameters,\n  Provider,\n  ProviderConfig,\n  WebClient,\n} from './types';\n\nexport const oauth2RedirectQuerySchema = object({\n  code: optional(string()),\n  state: optional(string()),\n  error: optional(string()),\n  error_description: optional(string()),\n  error_uri: optional(string()),\n  // Apple's form_post: the user's name as JSON, first authorization only.\n  user: optional(string()),\n});\n\nexport const googleOneTapSchema = object({\n  // login_uri\n  code: optional(string()),\n  state: optional(string()),\n  error: optional(string()),\n  error_description: optional(string()),\n  error_uri: optional(string()),\n  nonce: optional(string()),\n  g_csrf_token: optional(string()),\n  hd: optional(string()),\n  // callback\n  credential: optional(string()),\n});\n\nexport class OAuth2Client {\n  private readonly config: OAuth2ClientConfig;\n  constructor(config: OAuth2ClientConfig) {\n    this.config = config;\n  }\n\n  get baseUri() {\n    return this.config.baseUri;\n  }\n\n  get successUri() {\n    return this.config.successUri;\n  }\n\n  get errorUri() {\n    return this.config.errorUri;\n  }\n\n  /** The provider key comes from the request path, so an unknown one is the caller's error. */\n  private async getProviderConfig(provider: string): Promise<ProviderConfig> {\n    const providers =\n      typeof this.config.providers === 'function'\n        ? await this.config.providers()\n        : this.config.providers;\n    const config = Object.hasOwn(providers, provider) ? providers[provider] : undefined;\n    if (!config) throw new OAuth2Error(400, 'invalid_request', `Unknown provider: ${provider}`);\n    return config;\n  }\n\n  private defaultRedirectUri(provider: string) {\n    return `${this.config.baseUri}/login/oauth2/code/${provider}`;\n  }\n\n  /** The redirect flow and One Tap sign in as the provider's web client. */\n  private async getWebClient(provider: string) {\n    const config = await this.getProviderConfig(provider);\n    if (!config.web) {\n      throw new OAuth2Error(400, 'invalid_request', `Provider ${provider} has no web client`);\n    }\n    return { implementation: config.provider, client: config.web };\n  }\n\n  /**\n   * Any configured client of the provider, looked up by id: refresh and revoke use the client a\n   * token was issued to, and the native login the one the app names. The web client counts too:\n   * an Android app's server auth code and a Facebook app's tokens are issued to it.\n   */\n  private async getClient(provider: string, clientId: string) {\n    const config = await this.getProviderConfig(provider);\n    const client = [config.web, ...(config.native ?? [])].find((c) => c?.clientId === clientId);\n    if (!client) {\n      throw new OAuth2Error(400, 'invalid_client', `${clientId} is not a client of ${provider}`);\n    }\n    return { implementation: config.provider, client };\n  }\n\n  /**\n   * The client a native login signs in as: the one the app names with `client_id`, which must be\n   * configured; without one, the only native client, or the web client when there is no native\n   * one. Several native clients and no `client_id` is ambiguous and refused rather than guessed.\n   */\n  private async getNativeClient(provider: string, clientId: string | undefined) {\n    if (clientId !== undefined) return this.getClient(provider, clientId);\n    const config = await this.getProviderConfig(provider);\n    const native = config.native ?? [];\n    const client: WebClient | NativeClient | undefined =\n      native.length === 0 ? config.web : native.length === 1 ? native[0] : undefined;\n    if (!client) {\n      throw new OAuth2Error(400, 'invalid_request', `client_id is required for ${provider}`);\n    }\n    return { implementation: config.provider, client };\n  }\n\n  private async resolveSecret(secret: ClientSecret | undefined, clientId: string) {\n    return typeof secret === 'function' ? secret(clientId) : secret;\n  }\n\n  async createAuthorizationUri({\n    provider,\n    state,\n    pkce,\n  }: {\n    provider: string;\n    state: string;\n    pkce?: PkceParameters;\n  }): Promise<URL> {\n    const { implementation, client } = await this.getWebClient(provider);\n    return implementation.createAuthorizationUri({\n      pkce,\n      state,\n      scope: client.scope,\n      clientId: client.clientId,\n      redirectUri: client.redirectUri ?? this.defaultRedirectUri(provider),\n    });\n  }\n\n  /** Exchanges a code issued to the provider's web client: the redirect flow and One Tap. */\n  async exchangeAuthorizationCode({\n    provider,\n    code,\n    pkce,\n  }: {\n    provider: string;\n    code: string;\n    pkce?: PkceParameters;\n  }): Promise<{ clientId: string; token: OAuth2Token }> {\n    const { implementation, client } = await this.getWebClient(provider);\n    const { clientId } = client;\n    const token = await implementation.exchangeAuthorizationCode({\n      code,\n      pkce,\n      clientId,\n      clientSecret: await this.resolveSecret(client.clientSecret, clientId),\n      redirectUri: client.redirectUri ?? this.defaultRedirectUri(provider),\n    });\n    return { clientId, token };\n  }\n\n  /** `clientId` is the client the token was issued to, as `exchangeAuthorizationCode` returns it. */\n  async getUserInfo({\n    provider,\n    clientId,\n    token,\n    response,\n  }: {\n    provider: string;\n    clientId: string;\n    token: OAuth2Token | OidcToken;\n    response?: AuthorizationResponse;\n  }) {\n    const { implementation } = await this.getClient(provider, clientId);\n    return implementation.getUserInfo(token, { clientId, response });\n  }\n\n  /** Verifies a Google One Tap / FedCM credential, which is issued to the web client. */\n  async getTokenInfo({ provider, credential }: { provider: string; credential: string }) {\n    const { implementation, client } = await this.getWebClient(provider);\n    if (!isOneTapProvider(implementation)) {\n      throw new OAuth2Error(400, 'invalid_request', `Provider ${provider} has no One Tap`);\n    }\n    const { clientId } = client;\n    return { clientId, ...(await implementation.getTokenInfo(credential, clientId)) };\n  }\n\n  async refreshAccessToken({\n    provider,\n    clientId,\n    refreshToken,\n  }: {\n    provider: string;\n    clientId: string;\n    refreshToken: string;\n  }): Promise<OAuth2Token> {\n    const { implementation, client } = await this.getClient(provider, clientId);\n    invariant(implementation.refreshAccessToken, 'Provider does not support refreshAccessToken');\n    const clientSecret = await this.resolveSecret(client.clientSecret, clientId);\n    return implementation.refreshAccessToken({ refreshToken, clientId, clientSecret });\n  }\n\n  async revokeToken({\n    provider,\n    clientId,\n    token,\n  }: {\n    provider: string;\n    clientId: string;\n    token: string;\n  }) {\n    const { implementation, client } = await this.getClient(provider, clientId);\n    invariant(implementation.revokeToken, 'Provider does not support revokeToken');\n    const clientSecret = await this.resolveSecret(client.clientSecret, clientId);\n    await implementation.revokeToken({ token, clientId, clientSecret });\n  }\n\n  /**\n   * Signs in with what a native app posted. `credentials.code_verifier`, when present, is the PKCE\n   * verifier for the code exchange and reaches the provider as `pkce`, not in `credentials`.\n   */\n  async loginOAuth2Native({\n    provider,\n    credentials: { code_verifier, ...credentials },\n    pkce = code_verifier === undefined ? undefined : { code_verifier },\n  }: {\n    provider: string;\n    credentials: NativeCredential;\n    pkce?: Omit<PkceParameters, 'code_challenge' | 'code_challenge_method'>;\n  }) {\n    const { implementation, client } = await this.getNativeClient(provider, credentials.client_id);\n    invariant(implementation.loginOAuth2Native, 'Provider does not support loginOAuth2Native');\n    const { clientId } = client;\n\n    const result = await implementation.loginOAuth2Native({\n      clientId,\n      clientSecret: await this.resolveSecret(client.clientSecret, clientId),\n      redirectUri: client.redirectUri ?? this.defaultRedirectUri(provider),\n      credentials,\n      pkce,\n    });\n    return { clientId, ...result };\n  }\n}\n\nfunction isOneTapProvider(provider: Provider): provider is OneTapProvider {\n  return typeof (provider as Partial<OneTapProvider>).getTokenInfo === 'function';\n}\n"],"mappings":";;;;AAkBA,MAAa,4BAA4B,OAAO;CAC9C,MAAM,SAAS,OAAO,CAAC;CACvB,OAAO,SAAS,OAAO,CAAC;CACxB,OAAO,SAAS,OAAO,CAAC;CACxB,mBAAmB,SAAS,OAAO,CAAC;CACpC,WAAW,SAAS,OAAO,CAAC;CAE5B,MAAM,SAAS,OAAO,CAAC;AACzB,CAAC;AAED,MAAa,qBAAqB,OAAO;CAEvC,MAAM,SAAS,OAAO,CAAC;CACvB,OAAO,SAAS,OAAO,CAAC;CACxB,OAAO,SAAS,OAAO,CAAC;CACxB,mBAAmB,SAAS,OAAO,CAAC;CACpC,WAAW,SAAS,OAAO,CAAC;CAC5B,OAAO,SAAS,OAAO,CAAC;CACxB,cAAc,SAAS,OAAO,CAAC;CAC/B,IAAI,SAAS,OAAO,CAAC;CAErB,YAAY,SAAS,OAAO,CAAC;AAC/B,CAAC;AAED,IAAa,eAAb,MAA0B;CACxB;CACA,YAAY,QAA4B;EACtC,KAAK,SAAS;CAChB;CAEA,IAAI,UAAU;EACZ,OAAO,KAAK,OAAO;CACrB;CAEA,IAAI,aAAa;EACf,OAAO,KAAK,OAAO;CACrB;CAEA,IAAI,WAAW;EACb,OAAO,KAAK,OAAO;CACrB;;CAGA,MAAc,kBAAkB,UAA2C;EACzE,MAAM,YACJ,OAAO,KAAK,OAAO,cAAc,aAC7B,MAAM,KAAK,OAAO,UAAU,IAC5B,KAAK,OAAO;EAClB,MAAM,SAAS,OAAO,OAAO,WAAW,QAAQ,IAAI,UAAU,YAAY,KAAA;EAC1E,IAAI,CAAC,QAAQ,MAAM,IAAI,YAAY,KAAK,mBAAmB,qBAAqB,UAAU;EAC1F,OAAO;CACT;CAEA,mBAA2B,UAAkB;EAC3C,OAAO,GAAG,KAAK,OAAO,QAAQ,qBAAqB;CACrD;;CAGA,MAAc,aAAa,UAAkB;EAC3C,MAAM,SAAS,MAAM,KAAK,kBAAkB,QAAQ;EACpD,IAAI,CAAC,OAAO,KACV,MAAM,IAAI,YAAY,KAAK,mBAAmB,YAAY,SAAS,mBAAmB;EAExF,OAAO;GAAE,gBAAgB,OAAO;GAAU,QAAQ,OAAO;EAAI;CAC/D;;;;;;CAOA,MAAc,UAAU,UAAkB,UAAkB;EAC1D,MAAM,SAAS,MAAM,KAAK,kBAAkB,QAAQ;EACpD,MAAM,SAAS,CAAC,OAAO,KAAK,GAAI,OAAO,UAAU,CAAC,CAAE,CAAC,CAAC,MAAM,MAAM,GAAG,aAAa,QAAQ;EAC1F,IAAI,CAAC,QACH,MAAM,IAAI,YAAY,KAAK,kBAAkB,GAAG,SAAS,sBAAsB,UAAU;EAE3F,OAAO;GAAE,gBAAgB,OAAO;GAAU;EAAO;CACnD;;;;;;CAOA,MAAc,gBAAgB,UAAkB,UAA8B;EAC5E,IAAI,aAAa,KAAA,GAAW,OAAO,KAAK,UAAU,UAAU,QAAQ;EACpE,MAAM,SAAS,MAAM,KAAK,kBAAkB,QAAQ;EACpD,MAAM,SAAS,OAAO,UAAU,CAAC;EACjC,MAAM,SACJ,OAAO,WAAW,IAAI,OAAO,MAAM,OAAO,WAAW,IAAI,OAAO,KAAK,KAAA;EACvE,IAAI,CAAC,QACH,MAAM,IAAI,YAAY,KAAK,mBAAmB,6BAA6B,UAAU;EAEvF,OAAO;GAAE,gBAAgB,OAAO;GAAU;EAAO;CACnD;CAEA,MAAc,cAAc,QAAkC,UAAkB;EAC9E,OAAO,OAAO,WAAW,aAAa,OAAO,QAAQ,IAAI;CAC3D;CAEA,MAAM,uBAAuB,EAC3B,UACA,OACA,QAKe;EACf,MAAM,EAAE,gBAAgB,WAAW,MAAM,KAAK,aAAa,QAAQ;EACnE,OAAO,eAAe,uBAAuB;GAC3C;GACA;GACA,OAAO,OAAO;GACd,UAAU,OAAO;GACjB,aAAa,OAAO,eAAe,KAAK,mBAAmB,QAAQ;EACrE,CAAC;CACH;;CAGA,MAAM,0BAA0B,EAC9B,UACA,MACA,QAKoD;EACpD,MAAM,EAAE,gBAAgB,WAAW,MAAM,KAAK,aAAa,QAAQ;EACnE,MAAM,EAAE,aAAa;EAQrB,OAAO;GAAE;GAAU,OAAA,MAPC,eAAe,0BAA0B;IAC3D;IACA;IACA;IACA,cAAc,MAAM,KAAK,cAAc,OAAO,cAAc,QAAQ;IACpE,aAAa,OAAO,eAAe,KAAK,mBAAmB,QAAQ;GACrE,CAAC;EACwB;CAC3B;;CAGA,MAAM,YAAY,EAChB,UACA,UACA,OACA,YAMC;EACD,MAAM,EAAE,mBAAmB,MAAM,KAAK,UAAU,UAAU,QAAQ;EAClE,OAAO,eAAe,YAAY,OAAO;GAAE;GAAU;EAAS,CAAC;CACjE;;CAGA,MAAM,aAAa,EAAE,UAAU,cAAwD;EACrF,MAAM,EAAE,gBAAgB,WAAW,MAAM,KAAK,aAAa,QAAQ;EACnE,IAAI,CAAC,iBAAiB,cAAc,GAClC,MAAM,IAAI,YAAY,KAAK,mBAAmB,YAAY,SAAS,gBAAgB;EAErF,MAAM,EAAE,aAAa;EACrB,OAAO;GAAE;GAAU,GAAI,MAAM,eAAe,aAAa,YAAY,QAAQ;EAAG;CAClF;CAEA,MAAM,mBAAmB,EACvB,UACA,UACA,gBAKuB;EACvB,MAAM,EAAE,gBAAgB,WAAW,MAAM,KAAK,UAAU,UAAU,QAAQ;EAC1E,UAAU,eAAe,oBAAoB,8CAA8C;EAC3F,MAAM,eAAe,MAAM,KAAK,cAAc,OAAO,cAAc,QAAQ;EAC3E,OAAO,eAAe,mBAAmB;GAAE;GAAc;GAAU;EAAa,CAAC;CACnF;CAEA,MAAM,YAAY,EAChB,UACA,UACA,SAKC;EACD,MAAM,EAAE,gBAAgB,WAAW,MAAM,KAAK,UAAU,UAAU,QAAQ;EAC1E,UAAU,eAAe,aAAa,uCAAuC;EAC7E,MAAM,eAAe,MAAM,KAAK,cAAc,OAAO,cAAc,QAAQ;EAC3E,MAAM,eAAe,YAAY;GAAE;GAAO;GAAU;EAAa,CAAC;CACpE;;;;;CAMA,MAAM,kBAAkB,EACtB,UACA,aAAa,EAAE,eAAe,GAAG,eACjC,OAAO,kBAAkB,KAAA,IAAY,KAAA,IAAY,EAAE,cAAc,KAKhE;EACD,MAAM,EAAE,gBAAgB,WAAW,MAAM,KAAK,gBAAgB,UAAU,YAAY,SAAS;EAC7F,UAAU,eAAe,mBAAmB,6CAA6C;EACzF,MAAM,EAAE,aAAa;EASrB,OAAO;GAAE;GAAU,GAAG,MAPD,eAAe,kBAAkB;IACpD;IACA,cAAc,MAAM,KAAK,cAAc,OAAO,cAAc,QAAQ;IACpE,aAAa,OAAO,eAAe,KAAK,mBAAmB,QAAQ;IACnE;IACA;GACF,CAAC;EAC4B;CAC/B;AACF;AAEA,SAAS,iBAAiB,UAAgD;CACxE,OAAO,OAAQ,SAAqC,iBAAiB;AACvE"}
+{"version":3,"file":"client.mjs","names":[],"sources":["../../src/oauth2/client.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { object, optional, string } from 'zod/v4-mini';\nimport { OAuth2Error } from './error';\nimport type {\n  AuthorizationResponse,\n  ClientSecret,\n  NativeClient,\n  NativeCredential,\n  OAuth2ClientConfig,\n  OAuth2Token,\n  OidcToken,\n  OneTapProvider,\n  PkceParameters,\n  Provider,\n  ProviderConfig,\n  WebClient,\n} from './types';\n\nexport const oauth2RedirectQuerySchema = object({\n  code: optional(string()),\n  state: optional(string()),\n  error: optional(string()),\n  error_description: optional(string()),\n  error_uri: optional(string()),\n  // Apple's form_post: the user's name as JSON, first authorization only.\n  user: optional(string()),\n});\n\nexport const googleOneTapSchema = object({\n  // login_uri\n  code: optional(string()),\n  state: optional(string()),\n  error: optional(string()),\n  error_description: optional(string()),\n  error_uri: optional(string()),\n  nonce: optional(string()),\n  g_csrf_token: optional(string()),\n  hd: optional(string()),\n  // callback\n  credential: optional(string()),\n});\n\nexport class OAuth2Client {\n  private readonly config: OAuth2ClientConfig;\n  constructor(config: OAuth2ClientConfig) {\n    this.config = config;\n  }\n\n  get baseUri() {\n    return this.config.baseUri;\n  }\n\n  get successUri() {\n    return this.config.successUri;\n  }\n\n  get errorUri() {\n    return this.config.errorUri;\n  }\n\n  /** The provider key comes from the request path, so an unknown one is the caller's error. */\n  private async getProviderConfig(provider: string): Promise<ProviderConfig> {\n    const providers =\n      typeof this.config.providers === 'function'\n        ? await this.config.providers()\n        : this.config.providers;\n    const config = Object.hasOwn(providers, provider) ? providers[provider] : undefined;\n    if (!config) throw new OAuth2Error(400, 'invalid_request', `Unknown provider: ${provider}`);\n    return config;\n  }\n\n  private defaultRedirectUri(provider: string) {\n    return `${this.config.baseUri}/login/oauth2/code/${provider}`;\n  }\n\n  /** The redirect flow and One Tap sign in as the provider's web client. */\n  private async getWebClient(provider: string) {\n    const config = await this.getProviderConfig(provider);\n    if (!config.web) {\n      throw new OAuth2Error(400, 'invalid_request', `Provider ${provider} has no web client`);\n    }\n    return { implementation: config.provider, client: config.web };\n  }\n\n  /**\n   * Any configured client of the provider, looked up by id: refresh and revoke use the client a\n   * token was issued to, and the native login the one the app names. The web client counts too:\n   * an Android app's server auth code and a Facebook app's tokens are issued to it.\n   */\n  private async getClient(provider: string, clientId: string) {\n    const config = await this.getProviderConfig(provider);\n    const client = [config.web, ...(config.native ?? [])].find((c) => c?.clientId === clientId);\n    if (!client) {\n      throw new OAuth2Error(400, 'invalid_client', `${clientId} is not a client of ${provider}`);\n    }\n    return { implementation: config.provider, client };\n  }\n\n  /**\n   * The client a native login signs in as: the one the app names with `client_id`, which must be\n   * configured; without one, the only native client, or the web client when there is no native\n   * one. Several native clients and no `client_id` is ambiguous and refused rather than guessed.\n   */\n  private async getNativeClient(provider: string, clientId: string | undefined) {\n    if (clientId !== undefined) return this.getClient(provider, clientId);\n    const config = await this.getProviderConfig(provider);\n    const native = config.native ?? [];\n    const client: WebClient | NativeClient | undefined =\n      native.length === 0 ? config.web : native.length === 1 ? native[0] : undefined;\n    if (!client) {\n      throw new OAuth2Error(400, 'invalid_request', `client_id is required for ${provider}`);\n    }\n    return { implementation: config.provider, client };\n  }\n\n  private async resolveSecret(secret: ClientSecret | undefined, clientId: string) {\n    return typeof secret === 'function' ? secret(clientId) : secret;\n  }\n\n  /** Which of the provider's flows echo a nonce in the id token (`Provider.nonce`). */\n  async nonceSupport(provider: string): Promise<{ web: boolean; native: boolean }> {\n    const { nonce } = (await this.getProviderConfig(provider)).provider;\n    return { web: nonce?.web ?? false, native: nonce?.native ?? false };\n  }\n\n  async createAuthorizationUri({\n    provider,\n    state,\n    pkce,\n    nonce,\n  }: {\n    provider: string;\n    state: string;\n    pkce?: PkceParameters;\n    nonce?: string;\n  }): Promise<URL> {\n    const { implementation, client } = await this.getWebClient(provider);\n    return implementation.createAuthorizationUri({\n      pkce,\n      state,\n      nonce,\n      scope: client.scope,\n      clientId: client.clientId,\n      redirectUri: client.redirectUri ?? this.defaultRedirectUri(provider),\n    });\n  }\n\n  /** Exchanges a code issued to the provider's web client: the redirect flow and One Tap. */\n  async exchangeAuthorizationCode({\n    provider,\n    code,\n    pkce,\n  }: {\n    provider: string;\n    code: string;\n    pkce?: PkceParameters;\n  }): Promise<{ clientId: string; token: OAuth2Token }> {\n    const { implementation, client } = await this.getWebClient(provider);\n    const { clientId } = client;\n    const token = await implementation.exchangeAuthorizationCode({\n      code,\n      pkce,\n      clientId,\n      clientSecret: await this.resolveSecret(client.clientSecret, clientId),\n      redirectUri: client.redirectUri ?? this.defaultRedirectUri(provider),\n    });\n    return { clientId, token };\n  }\n\n  /** `clientId` is the client the token was issued to, as `exchangeAuthorizationCode` returns it. */\n  async getUserInfo({\n    provider,\n    clientId,\n    token,\n    response,\n  }: {\n    provider: string;\n    clientId: string;\n    token: OAuth2Token | OidcToken;\n    response?: AuthorizationResponse;\n  }) {\n    const { implementation } = await this.getClient(provider, clientId);\n    return implementation.getUserInfo(token, { clientId, response });\n  }\n\n  /** Verifies a Google One Tap / FedCM credential, which is issued to the web client. */\n  async getTokenInfo({ provider, credential }: { provider: string; credential: string }) {\n    const { implementation, client } = await this.getWebClient(provider);\n    if (!isOneTapProvider(implementation)) {\n      throw new OAuth2Error(400, 'invalid_request', `Provider ${provider} has no One Tap`);\n    }\n    const { clientId } = client;\n    return { clientId, ...(await implementation.getTokenInfo(credential, clientId)) };\n  }\n\n  async refreshAccessToken({\n    provider,\n    clientId,\n    refreshToken,\n  }: {\n    provider: string;\n    clientId: string;\n    refreshToken: string;\n  }): Promise<OAuth2Token> {\n    const { implementation, client } = await this.getClient(provider, clientId);\n    invariant(implementation.refreshAccessToken, 'Provider does not support refreshAccessToken');\n    const clientSecret = await this.resolveSecret(client.clientSecret, clientId);\n    return implementation.refreshAccessToken({ refreshToken, clientId, clientSecret });\n  }\n\n  async revokeToken({\n    provider,\n    clientId,\n    token,\n  }: {\n    provider: string;\n    clientId: string;\n    token: string;\n  }) {\n    const { implementation, client } = await this.getClient(provider, clientId);\n    invariant(implementation.revokeToken, 'Provider does not support revokeToken');\n    const clientSecret = await this.resolveSecret(client.clientSecret, clientId);\n    await implementation.revokeToken({ token, clientId, clientSecret });\n  }\n\n  /**\n   * Signs in with what a native app posted. `credentials.code_verifier`, when present, is the PKCE\n   * verifier for the code exchange and reaches the provider as `pkce`, not in `credentials`.\n   */\n  async loginOAuth2Native({\n    provider,\n    credentials: { code_verifier, ...credentials },\n    pkce = code_verifier === undefined ? undefined : { code_verifier },\n  }: {\n    provider: string;\n    credentials: NativeCredential;\n    pkce?: Omit<PkceParameters, 'code_challenge' | 'code_challenge_method'>;\n  }) {\n    const { implementation, client } = await this.getNativeClient(provider, credentials.client_id);\n    invariant(implementation.loginOAuth2Native, 'Provider does not support loginOAuth2Native');\n    const { clientId } = client;\n\n    const result = await implementation.loginOAuth2Native({\n      clientId,\n      clientSecret: await this.resolveSecret(client.clientSecret, clientId),\n      redirectUri: client.redirectUri ?? this.defaultRedirectUri(provider),\n      credentials,\n      pkce,\n    });\n    return { clientId, ...result };\n  }\n}\n\nfunction isOneTapProvider(provider: Provider): provider is OneTapProvider {\n  return typeof (provider as Partial<OneTapProvider>).getTokenInfo === 'function';\n}\n"],"mappings":";;;;AAkBA,MAAa,4BAA4B,OAAO;CAC9C,MAAM,SAAS,OAAO,CAAC;CACvB,OAAO,SAAS,OAAO,CAAC;CACxB,OAAO,SAAS,OAAO,CAAC;CACxB,mBAAmB,SAAS,OAAO,CAAC;CACpC,WAAW,SAAS,OAAO,CAAC;CAE5B,MAAM,SAAS,OAAO,CAAC;AACzB,CAAC;AAED,MAAa,qBAAqB,OAAO;CAEvC,MAAM,SAAS,OAAO,CAAC;CACvB,OAAO,SAAS,OAAO,CAAC;CACxB,OAAO,SAAS,OAAO,CAAC;CACxB,mBAAmB,SAAS,OAAO,CAAC;CACpC,WAAW,SAAS,OAAO,CAAC;CAC5B,OAAO,SAAS,OAAO,CAAC;CACxB,cAAc,SAAS,OAAO,CAAC;CAC/B,IAAI,SAAS,OAAO,CAAC;CAErB,YAAY,SAAS,OAAO,CAAC;AAC/B,CAAC;AAED,IAAa,eAAb,MAA0B;CACxB;CACA,YAAY,QAA4B;EACtC,KAAK,SAAS;CAChB;CAEA,IAAI,UAAU;EACZ,OAAO,KAAK,OAAO;CACrB;CAEA,IAAI,aAAa;EACf,OAAO,KAAK,OAAO;CACrB;CAEA,IAAI,WAAW;EACb,OAAO,KAAK,OAAO;CACrB;;CAGA,MAAc,kBAAkB,UAA2C;EACzE,MAAM,YACJ,OAAO,KAAK,OAAO,cAAc,aAC7B,MAAM,KAAK,OAAO,UAAU,IAC5B,KAAK,OAAO;EAClB,MAAM,SAAS,OAAO,OAAO,WAAW,QAAQ,IAAI,UAAU,YAAY,KAAA;EAC1E,IAAI,CAAC,QAAQ,MAAM,IAAI,YAAY,KAAK,mBAAmB,qBAAqB,UAAU;EAC1F,OAAO;CACT;CAEA,mBAA2B,UAAkB;EAC3C,OAAO,GAAG,KAAK,OAAO,QAAQ,qBAAqB;CACrD;;CAGA,MAAc,aAAa,UAAkB;EAC3C,MAAM,SAAS,MAAM,KAAK,kBAAkB,QAAQ;EACpD,IAAI,CAAC,OAAO,KACV,MAAM,IAAI,YAAY,KAAK,mBAAmB,YAAY,SAAS,mBAAmB;EAExF,OAAO;GAAE,gBAAgB,OAAO;GAAU,QAAQ,OAAO;EAAI;CAC/D;;;;;;CAOA,MAAc,UAAU,UAAkB,UAAkB;EAC1D,MAAM,SAAS,MAAM,KAAK,kBAAkB,QAAQ;EACpD,MAAM,SAAS,CAAC,OAAO,KAAK,GAAI,OAAO,UAAU,CAAC,CAAE,CAAC,CAAC,MAAM,MAAM,GAAG,aAAa,QAAQ;EAC1F,IAAI,CAAC,QACH,MAAM,IAAI,YAAY,KAAK,kBAAkB,GAAG,SAAS,sBAAsB,UAAU;EAE3F,OAAO;GAAE,gBAAgB,OAAO;GAAU;EAAO;CACnD;;;;;;CAOA,MAAc,gBAAgB,UAAkB,UAA8B;EAC5E,IAAI,aAAa,KAAA,GAAW,OAAO,KAAK,UAAU,UAAU,QAAQ;EACpE,MAAM,SAAS,MAAM,KAAK,kBAAkB,QAAQ;EACpD,MAAM,SAAS,OAAO,UAAU,CAAC;EACjC,MAAM,SACJ,OAAO,WAAW,IAAI,OAAO,MAAM,OAAO,WAAW,IAAI,OAAO,KAAK,KAAA;EACvE,IAAI,CAAC,QACH,MAAM,IAAI,YAAY,KAAK,mBAAmB,6BAA6B,UAAU;EAEvF,OAAO;GAAE,gBAAgB,OAAO;GAAU;EAAO;CACnD;CAEA,MAAc,cAAc,QAAkC,UAAkB;EAC9E,OAAO,OAAO,WAAW,aAAa,OAAO,QAAQ,IAAI;CAC3D;;CAGA,MAAM,aAAa,UAA8D;EAC/E,MAAM,EAAE,WAAW,MAAM,KAAK,kBAAkB,QAAQ,EAAA,CAAG;EAC3D,OAAO;GAAE,KAAK,OAAO,OAAO;GAAO,QAAQ,OAAO,UAAU;EAAM;CACpE;CAEA,MAAM,uBAAuB,EAC3B,UACA,OACA,MACA,SAMe;EACf,MAAM,EAAE,gBAAgB,WAAW,MAAM,KAAK,aAAa,QAAQ;EACnE,OAAO,eAAe,uBAAuB;GAC3C;GACA;GACA;GACA,OAAO,OAAO;GACd,UAAU,OAAO;GACjB,aAAa,OAAO,eAAe,KAAK,mBAAmB,QAAQ;EACrE,CAAC;CACH;;CAGA,MAAM,0BAA0B,EAC9B,UACA,MACA,QAKoD;EACpD,MAAM,EAAE,gBAAgB,WAAW,MAAM,KAAK,aAAa,QAAQ;EACnE,MAAM,EAAE,aAAa;EAQrB,OAAO;GAAE;GAAU,OAAA,MAPC,eAAe,0BAA0B;IAC3D;IACA;IACA;IACA,cAAc,MAAM,KAAK,cAAc,OAAO,cAAc,QAAQ;IACpE,aAAa,OAAO,eAAe,KAAK,mBAAmB,QAAQ;GACrE,CAAC;EACwB;CAC3B;;CAGA,MAAM,YAAY,EAChB,UACA,UACA,OACA,YAMC;EACD,MAAM,EAAE,mBAAmB,MAAM,KAAK,UAAU,UAAU,QAAQ;EAClE,OAAO,eAAe,YAAY,OAAO;GAAE;GAAU;EAAS,CAAC;CACjE;;CAGA,MAAM,aAAa,EAAE,UAAU,cAAwD;EACrF,MAAM,EAAE,gBAAgB,WAAW,MAAM,KAAK,aAAa,QAAQ;EACnE,IAAI,CAAC,iBAAiB,cAAc,GAClC,MAAM,IAAI,YAAY,KAAK,mBAAmB,YAAY,SAAS,gBAAgB;EAErF,MAAM,EAAE,aAAa;EACrB,OAAO;GAAE;GAAU,GAAI,MAAM,eAAe,aAAa,YAAY,QAAQ;EAAG;CAClF;CAEA,MAAM,mBAAmB,EACvB,UACA,UACA,gBAKuB;EACvB,MAAM,EAAE,gBAAgB,WAAW,MAAM,KAAK,UAAU,UAAU,QAAQ;EAC1E,UAAU,eAAe,oBAAoB,8CAA8C;EAC3F,MAAM,eAAe,MAAM,KAAK,cAAc,OAAO,cAAc,QAAQ;EAC3E,OAAO,eAAe,mBAAmB;GAAE;GAAc;GAAU;EAAa,CAAC;CACnF;CAEA,MAAM,YAAY,EAChB,UACA,UACA,SAKC;EACD,MAAM,EAAE,gBAAgB,WAAW,MAAM,KAAK,UAAU,UAAU,QAAQ;EAC1E,UAAU,eAAe,aAAa,uCAAuC;EAC7E,MAAM,eAAe,MAAM,KAAK,cAAc,OAAO,cAAc,QAAQ;EAC3E,MAAM,eAAe,YAAY;GAAE;GAAO;GAAU;EAAa,CAAC;CACpE;;;;;CAMA,MAAM,kBAAkB,EACtB,UACA,aAAa,EAAE,eAAe,GAAG,eACjC,OAAO,kBAAkB,KAAA,IAAY,KAAA,IAAY,EAAE,cAAc,KAKhE;EACD,MAAM,EAAE,gBAAgB,WAAW,MAAM,KAAK,gBAAgB,UAAU,YAAY,SAAS;EAC7F,UAAU,eAAe,mBAAmB,6CAA6C;EACzF,MAAM,EAAE,aAAa;EASrB,OAAO;GAAE;GAAU,GAAG,MAPD,eAAe,kBAAkB;IACpD;IACA,cAAc,MAAM,KAAK,cAAc,OAAO,cAAc,QAAQ;IACpE,aAAa,OAAO,eAAe,KAAK,mBAAmB,QAAQ;IACnE;IACA;GACF,CAAC;EAC4B;CAC/B;AACF;AAEA,SAAS,iBAAiB,UAAgD;CACxE,OAAO,OAAQ,SAAqC,iBAAiB;AACvE"}

package/dist/oauth2/provider/apple.cjs

@@ -17,6 +17,10 @@ function createAppleProvider() {
 			"name",
 			"email"
 		],
+		nonce: {
+			web: true,
+			native: true
+		},
 		createAuthorizationUri({ pkce: _, ...params }) {
 			return require_oauth2_provider_common.createAuthorizationUri({
 				...params,

package/dist/oauth2/provider/apple.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"apple.cjs","names":["createAuthorizationUri","exchangeAuthorizationCode","OAuth2Error","verifyIdToken","parseAppleUser","nameClaims","cleanPersonName"],"sources":["../../../src/oauth2/provider/apple.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport { type AppleUser, cleanPersonName, nameClaims, parseAppleUser } from '../name';\nimport type {\n  LoginOAuth2NativeParams,\n  NativeCredential,\n  OAuth2Token,\n  PersonNameComponents,\n  Provider,\n  UserInfo,\n} from '../types';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\n/** `iss` of every Apple id token (https://appleid.apple.com/.well-known/openid-configuration). */\nconst APPLE_ISSUER = 'https://appleid.apple.com';\n\n// ref: https://account.apple.com/.well-known/openid-configuration\nexport function createAppleProvider(): Provider {\n  return {\n    // important notice: response_mode=form_post is required for apple\n    authorizationUri: 'https://appleid.apple.com/auth/authorize?response_mode=form_post',\n    tokenUri: 'https://appleid.apple.com/auth/token',\n    jwkSetUri: 'https://appleid.apple.com/auth/keys',\n    userNameAttribute: 'sub',\n    defaultScope: ['openid', 'name', 'email'],\n    createAuthorizationUri({ pkce: _, ...params }) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode({ pkce: _, ...params }) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error } = (await response.json()) as AppleErrorResponse;\n        throw new OAuth2Error(response.status, error);\n      }\n      return (await response.json()) as AppleToken;\n    },\n    async getUserInfo({ id_token }, { clientId, response }) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      // The audience is the client the code was exchanged as: the bundle id for an app, the\n      // Services ID for the web.\n      const token = await verifyIdToken<AppleIdToken>(id_token, {\n        jwkSetUri: this.jwkSetUri,\n        issuer: APPLE_ISSUER,\n        audience: clientId,\n      });\n      // Apple's id token never carries a name; on the first authorization of the web flow the\n      // name comes in the form_post `user` instead, unsigned, so only its name parts are used\n      // and the signed id token's email always wins over the one beside them.\n      const user = parseAppleUser(response?.user);\n      const data: AppleUserInfo = user ? { ...token, user } : token;\n      return {\n        data,\n        claims: {\n          sub: token.sub,\n          email: token.email,\n          email_verified: true,\n          ...nameClaims({\n            given_name: user?.name?.firstName,\n            family_name: user?.name?.lastName,\n          }),\n        },\n      };\n    },\n    async loginOAuth2Native({ pkce: _, credentials, ...params }: LoginOAuth2NativeParams) {\n      invariant(credentials.code, 'code is required');\n      const { tokenUri } = this;\n      const { code } = credentials;\n      const response = await exchangeAuthorizationCode({ code, tokenUri, ...params });\n      if (!response.ok) {\n        const { error } = (await response.json()) as AppleErrorResponse;\n        throw new OAuth2Error(response.status, error);\n      }\n      const token = (await response.json()) as AppleToken;\n      const { data, claims } = await this.getUserInfo(token, { clientId: params.clientId });\n      // The app gets the name from Apple on the first authorization only and passes it along in\n      // the login body as the platform's `fullName`.\n      const fullName = cleanPersonName(credentials.fullName);\n      const name = nameClaims({\n        given_name: fullName?.givenName ?? undefined,\n        family_name: fullName?.familyName ?? undefined,\n        middle_name: fullName?.middleName ?? undefined,\n        nickname: fullName?.nickname ?? undefined,\n      });\n      const userInfo: UserInfo<AppleUserInfo> = {\n        data: fullName ? { ...(data as AppleUserInfo), fullName } : (data as AppleUserInfo),\n        claims: { ...claims, ...name },\n      };\n      return { token, userInfo };\n    },\n  };\n}\n\nexport const apple = createAppleProvider();\n\n// Claims of Apple's id token. It carries no name or picture, not even on the first authorization.\n// https://developer.apple.com/documentation/signinwithapple/authenticating-users-with-sign-in-with-apple\nexport interface AppleIdToken {\n  iss: string;\n  aud: string;\n  exp: number;\n  iat: number;\n  sub: string;\n  email: string;\n  email_verified: true | 'true';\n  is_private_email: boolean;\n  /** Native flow, first authorization only: 0 unsupported, 1 unknown, 2 likely real. */\n  real_user_status?: number;\n  nonce?: string;\n  nonce_supported?: boolean;\n}\n\n/**\n * `userInfo.data` of an Apple login: the id token's claims, plus the unsigned name the client\n * passed on the first authorization, cleaned (see `nameClaims` for the standard claims made of it).\n */\nexport interface AppleUserInfo extends AppleIdToken {\n  /** Web flow: Apple's form_post `user`, as Apple names it. */\n  user?: AppleUser;\n  /** Native flow: the login body's `fullName`, which alone keeps `namePrefix` / `nameSuffix`. */\n  fullName?: PersonNameComponents;\n}\n\n// https://developer.apple.com/documentation/devicemanagement/implementing-the-oauth2-authentication-user-enrollment-flow\n// https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens\nexport interface AppleToken extends OAuth2Token {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token: string;\n  id_token: string;\n}\n\nexport interface AppleNativeCredential extends NativeCredential {\n  state: string;\n  code: string;\n  id_token: string;\n}\n\n// https://developer.apple.com/documentation/sign_in_with_apple/errorresponse\nexport interface AppleErrorResponse {\n  error:\n    | 'invalid_request'\n    | 'invalid_client'\n    | 'invalid_grant'\n    | 'unauthorized_client'\n    | 'unsupported_grant_type'\n    | 'invalid_scope';\n}\n"],"mappings":";;;;;;;AAcA,MAAM,eAAe;AAGrB,SAAgB,sBAAgC;CAC9C,OAAO;EAEL,kBAAkB;EAClB,UAAU;EACV,WAAW;EACX,mBAAmB;EACnB,cAAc;GAAC;GAAU;GAAQ;EAAO;EACxC,uBAAuB,EAAE,MAAM,GAAG,GAAG,UAAU;GAC7C,OAAOA,+BAAAA,uBAAuB;IAC5B,GAAG;IACH,OAAO,OAAO,SAAS,KAAK;IAC5B,kBAAkB,KAAK;GACzB,CAAC;EACH;EACA,MAAM,0BAA0B,EAAE,MAAM,GAAG,GAAG,UAAU;GACtD,MAAM,WAAW,MAAMC,+BAAAA,0BAA0B;IAAE,GAAG;IAAQ,UAAU,KAAK;GAAS,CAAC;GACvF,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,UAAW,MAAM,SAAS,KAAK;IACvC,MAAM,IAAIC,qBAAAA,YAAY,SAAS,QAAQ,KAAK;GAC9C;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,EAAE,YAAY,EAAE,UAAU,YAAY;GACtD,CAAA,GAAA,cAAA,UAAA,CAAU,UAAU,sBAAsB;GAC1C,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,WAAW,uBAAuB;GAGjD,MAAM,QAAQ,MAAMC,+BAAAA,cAA4B,UAAU;IACxD,WAAW,KAAK;IAChB,QAAQ;IACR,UAAU;GACZ,CAAC;GAID,MAAM,OAAOC,oBAAAA,eAAe,UAAU,IAAI;GAE1C,OAAO;IACL,MAF0B,OAAO;KAAE,GAAG;KAAO;IAAK,IAAI;IAGtD,QAAQ;KACN,KAAK,MAAM;KACX,OAAO,MAAM;KACb,gBAAgB;KAChB,GAAGC,oBAAAA,WAAW;MACZ,YAAY,MAAM,MAAM;MACxB,aAAa,MAAM,MAAM;KAC3B,CAAC;IACH;GACF;EACF;EACA,MAAM,kBAAkB,EAAE,MAAM,GAAG,aAAa,GAAG,UAAmC;GACpF,CAAA,GAAA,cAAA,UAAA,CAAU,YAAY,MAAM,kBAAkB;GAC9C,MAAM,EAAE,aAAa;GACrB,MAAM,EAAE,SAAS;GACjB,MAAM,WAAW,MAAMJ,+BAAAA,0BAA0B;IAAE;IAAM;IAAU,GAAG;GAAO,CAAC;GAC9E,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,UAAW,MAAM,SAAS,KAAK;IACvC,MAAM,IAAIC,qBAAAA,YAAY,SAAS,QAAQ,KAAK;GAC9C;GACA,MAAM,QAAS,MAAM,SAAS,KAAK;GACnC,MAAM,EAAE,MAAM,WAAW,MAAM,KAAK,YAAY,OAAO,EAAE,UAAU,OAAO,SAAS,CAAC;GAGpF,MAAM,WAAWI,oBAAAA,gBAAgB,YAAY,QAAQ;GACrD,MAAM,OAAOD,oBAAAA,WAAW;IACtB,YAAY,UAAU,aAAa,KAAA;IACnC,aAAa,UAAU,cAAc,KAAA;IACrC,aAAa,UAAU,cAAc,KAAA;IACrC,UAAU,UAAU,YAAY,KAAA;GAClC,CAAC;GAKD,OAAO;IAAE;IAAO,UAAA;KAHd,MAAM,WAAW;MAAE,GAAI;MAAwB;KAAS,IAAK;KAC7D,QAAQ;MAAE,GAAG;MAAQ,GAAG;KAAK;IAER;GAAE;EAC3B;CACF;AACF;AAEA,MAAa,QAAQ,oBAAoB"}
+{"version":3,"file":"apple.cjs","names":["createAuthorizationUri","exchangeAuthorizationCode","OAuth2Error","verifyIdToken","parseAppleUser","nameClaims","cleanPersonName"],"sources":["../../../src/oauth2/provider/apple.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport { type AppleUser, cleanPersonName, nameClaims, parseAppleUser } from '../name';\nimport type {\n  LoginOAuth2NativeParams,\n  NativeCredential,\n  OAuth2Token,\n  PersonNameComponents,\n  Provider,\n  UserInfo,\n} from '../types';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\n/** `iss` of every Apple id token (https://appleid.apple.com/.well-known/openid-configuration). */\nconst APPLE_ISSUER = 'https://appleid.apple.com';\n\n// ref: https://account.apple.com/.well-known/openid-configuration\nexport function createAppleProvider(): Provider {\n  return {\n    // important notice: response_mode=form_post is required for apple\n    authorizationUri: 'https://appleid.apple.com/auth/authorize?response_mode=form_post',\n    tokenUri: 'https://appleid.apple.com/auth/token',\n    jwkSetUri: 'https://appleid.apple.com/auth/keys',\n    userNameAttribute: 'sub',\n    defaultScope: ['openid', 'name', 'email'],\n    // The web flow's id token echoes the request's nonce; the app's carries the one bound into\n    // ASAuthorizationAppleIDRequest, hashed or not (`nonce_supported`).\n    nonce: { web: true, native: true },\n    createAuthorizationUri({ pkce: _, ...params }) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode({ pkce: _, ...params }) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error } = (await response.json()) as AppleErrorResponse;\n        throw new OAuth2Error(response.status, error);\n      }\n      return (await response.json()) as AppleToken;\n    },\n    async getUserInfo({ id_token }, { clientId, response }) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      // The audience is the client the code was exchanged as: the bundle id for an app, the\n      // Services ID for the web.\n      const token = await verifyIdToken<AppleIdToken>(id_token, {\n        jwkSetUri: this.jwkSetUri,\n        issuer: APPLE_ISSUER,\n        audience: clientId,\n      });\n      // Apple's id token never carries a name; on the first authorization of the web flow the\n      // name comes in the form_post `user` instead, unsigned, so only its name parts are used\n      // and the signed id token's email always wins over the one beside them.\n      const user = parseAppleUser(response?.user);\n      const data: AppleUserInfo = user ? { ...token, user } : token;\n      return {\n        data,\n        claims: {\n          sub: token.sub,\n          email: token.email,\n          email_verified: true,\n          ...nameClaims({\n            given_name: user?.name?.firstName,\n            family_name: user?.name?.lastName,\n          }),\n        },\n      };\n    },\n    async loginOAuth2Native({ pkce: _, credentials, ...params }: LoginOAuth2NativeParams) {\n      invariant(credentials.code, 'code is required');\n      const { tokenUri } = this;\n      const { code } = credentials;\n      const response = await exchangeAuthorizationCode({ code, tokenUri, ...params });\n      if (!response.ok) {\n        const { error } = (await response.json()) as AppleErrorResponse;\n        throw new OAuth2Error(response.status, error);\n      }\n      const token = (await response.json()) as AppleToken;\n      const { data, claims } = await this.getUserInfo(token, { clientId: params.clientId });\n      // The app gets the name from Apple on the first authorization only and passes it along in\n      // the login body as the platform's `fullName`.\n      const fullName = cleanPersonName(credentials.fullName);\n      const name = nameClaims({\n        given_name: fullName?.givenName ?? undefined,\n        family_name: fullName?.familyName ?? undefined,\n        middle_name: fullName?.middleName ?? undefined,\n        nickname: fullName?.nickname ?? undefined,\n      });\n      const userInfo: UserInfo<AppleUserInfo> = {\n        data: fullName ? { ...(data as AppleUserInfo), fullName } : (data as AppleUserInfo),\n        claims: { ...claims, ...name },\n      };\n      return { token, userInfo };\n    },\n  };\n}\n\nexport const apple = createAppleProvider();\n\n// Claims of Apple's id token. It carries no name or picture, not even on the first authorization.\n// https://developer.apple.com/documentation/signinwithapple/authenticating-users-with-sign-in-with-apple\nexport interface AppleIdToken {\n  iss: string;\n  aud: string;\n  exp: number;\n  iat: number;\n  sub: string;\n  email: string;\n  email_verified: true | 'true';\n  is_private_email: boolean;\n  /** Native flow, first authorization only: 0 unsupported, 1 unknown, 2 likely real. */\n  real_user_status?: number;\n  nonce?: string;\n  nonce_supported?: boolean;\n}\n\n/**\n * `userInfo.data` of an Apple login: the id token's claims, plus the unsigned name the client\n * passed on the first authorization, cleaned (see `nameClaims` for the standard claims made of it).\n */\nexport interface AppleUserInfo extends AppleIdToken {\n  /** Web flow: Apple's form_post `user`, as Apple names it. */\n  user?: AppleUser;\n  /** Native flow: the login body's `fullName`, which alone keeps `namePrefix` / `nameSuffix`. */\n  fullName?: PersonNameComponents;\n}\n\n// https://developer.apple.com/documentation/devicemanagement/implementing-the-oauth2-authentication-user-enrollment-flow\n// https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens\nexport interface AppleToken extends OAuth2Token {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token: string;\n  id_token: string;\n}\n\nexport interface AppleNativeCredential extends NativeCredential {\n  state: string;\n  code: string;\n  id_token: string;\n}\n\n// https://developer.apple.com/documentation/sign_in_with_apple/errorresponse\nexport interface AppleErrorResponse {\n  error:\n    | 'invalid_request'\n    | 'invalid_client'\n    | 'invalid_grant'\n    | 'unauthorized_client'\n    | 'unsupported_grant_type'\n    | 'invalid_scope';\n}\n"],"mappings":";;;;;;;AAcA,MAAM,eAAe;AAGrB,SAAgB,sBAAgC;CAC9C,OAAO;EAEL,kBAAkB;EAClB,UAAU;EACV,WAAW;EACX,mBAAmB;EACnB,cAAc;GAAC;GAAU;GAAQ;EAAO;EAGxC,OAAO;GAAE,KAAK;GAAM,QAAQ;EAAK;EACjC,uBAAuB,EAAE,MAAM,GAAG,GAAG,UAAU;GAC7C,OAAOA,+BAAAA,uBAAuB;IAC5B,GAAG;IACH,OAAO,OAAO,SAAS,KAAK;IAC5B,kBAAkB,KAAK;GACzB,CAAC;EACH;EACA,MAAM,0BAA0B,EAAE,MAAM,GAAG,GAAG,UAAU;GACtD,MAAM,WAAW,MAAMC,+BAAAA,0BAA0B;IAAE,GAAG;IAAQ,UAAU,KAAK;GAAS,CAAC;GACvF,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,UAAW,MAAM,SAAS,KAAK;IACvC,MAAM,IAAIC,qBAAAA,YAAY,SAAS,QAAQ,KAAK;GAC9C;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,EAAE,YAAY,EAAE,UAAU,YAAY;GACtD,CAAA,GAAA,cAAA,UAAA,CAAU,UAAU,sBAAsB;GAC1C,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,WAAW,uBAAuB;GAGjD,MAAM,QAAQ,MAAMC,+BAAAA,cAA4B,UAAU;IACxD,WAAW,KAAK;IAChB,QAAQ;IACR,UAAU;GACZ,CAAC;GAID,MAAM,OAAOC,oBAAAA,eAAe,UAAU,IAAI;GAE1C,OAAO;IACL,MAF0B,OAAO;KAAE,GAAG;KAAO;IAAK,IAAI;IAGtD,QAAQ;KACN,KAAK,MAAM;KACX,OAAO,MAAM;KACb,gBAAgB;KAChB,GAAGC,oBAAAA,WAAW;MACZ,YAAY,MAAM,MAAM;MACxB,aAAa,MAAM,MAAM;KAC3B,CAAC;IACH;GACF;EACF;EACA,MAAM,kBAAkB,EAAE,MAAM,GAAG,aAAa,GAAG,UAAmC;GACpF,CAAA,GAAA,cAAA,UAAA,CAAU,YAAY,MAAM,kBAAkB;GAC9C,MAAM,EAAE,aAAa;GACrB,MAAM,EAAE,SAAS;GACjB,MAAM,WAAW,MAAMJ,+BAAAA,0BAA0B;IAAE;IAAM;IAAU,GAAG;GAAO,CAAC;GAC9E,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,UAAW,MAAM,SAAS,KAAK;IACvC,MAAM,IAAIC,qBAAAA,YAAY,SAAS,QAAQ,KAAK;GAC9C;GACA,MAAM,QAAS,MAAM,SAAS,KAAK;GACnC,MAAM,EAAE,MAAM,WAAW,MAAM,KAAK,YAAY,OAAO,EAAE,UAAU,OAAO,SAAS,CAAC;GAGpF,MAAM,WAAWI,oBAAAA,gBAAgB,YAAY,QAAQ;GACrD,MAAM,OAAOD,oBAAAA,WAAW;IACtB,YAAY,UAAU,aAAa,KAAA;IACnC,aAAa,UAAU,cAAc,KAAA;IACrC,aAAa,UAAU,cAAc,KAAA;IACrC,UAAU,UAAU,YAAY,KAAA;GAClC,CAAC;GAKD,OAAO;IAAE;IAAO,UAAA;KAHd,MAAM,WAAW;MAAE,GAAI;MAAwB;KAAS,IAAK;KAC7D,QAAQ;MAAE,GAAG;MAAQ,GAAG;KAAK;IAER;GAAE;EAC3B;CACF;AACF;AAEA,MAAa,QAAQ,oBAAoB"}

package/dist/oauth2/provider/apple.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"apple.d.cts","names":[],"sources":["../../../src/oauth2/provider/apple.ts"],"mappings":";;wBAiBgB,uBAAuB;qBAgF1B,OAAK;iBAID;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;EAEA;EACA;EACA;;;;;;iBAOe,sBAAsB;;EAErC,OAAO;;EAEP,WAAW;;iBAKI,mBAAmB;EAClC;EACA;EACA;EACA;EACA;;iBAGe,8BAA8B;EAC7C;EACA;EACA;;iBAIe;EACf"}
+{"version":3,"file":"apple.d.cts","names":[],"sources":["../../../src/oauth2/provider/apple.ts"],"mappings":";;wBAiBgB,uBAAuB;qBAmF1B,OAAK;iBAID;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;EAEA;EACA;EACA;;;;;;iBAOe,sBAAsB;;EAErC,OAAO;;EAEP,WAAW;;iBAKI,mBAAmB;EAClC;EACA;EACA;EACA;EACA;;iBAGe,8BAA8B;EAC7C;EACA;EACA;;iBAIe;EACf"}

package/dist/oauth2/provider/apple.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"apple.d.mts","names":[],"sources":["../../../src/oauth2/provider/apple.ts"],"mappings":";;wBAiBgB,uBAAuB;qBAgF1B,OAAK;iBAID;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;EAEA;EACA;EACA;;;;;;iBAOe,sBAAsB;;EAErC,OAAO;;EAEP,WAAW;;iBAKI,mBAAmB;EAClC;EACA;EACA;EACA;EACA;;iBAGe,8BAA8B;EAC7C;EACA;EACA;;iBAIe;EACf"}
+{"version":3,"file":"apple.d.mts","names":[],"sources":["../../../src/oauth2/provider/apple.ts"],"mappings":";;wBAiBgB,uBAAuB;qBAmF1B,OAAK;iBAID;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;EAEA;EACA;EACA;;;;;;iBAOe,sBAAsB;;EAErC,OAAO;;EAEP,WAAW;;iBAKI,mBAAmB;EAClC;EACA;EACA;EACA;EACA;;iBAGe,8BAA8B;EAC7C;EACA;EACA;;iBAIe;EACf"}

package/dist/oauth2/provider/apple.mjs

@@ -16,6 +16,10 @@ function createAppleProvider() {
 			"name",
 			"email"
 		],
+		nonce: {
+			web: true,
+			native: true
+		},
 		createAuthorizationUri({ pkce: _, ...params }) {
 			return createAuthorizationUri({
 				...params,

package/dist/oauth2/provider/apple.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"apple.mjs","names":[],"sources":["../../../src/oauth2/provider/apple.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport { type AppleUser, cleanPersonName, nameClaims, parseAppleUser } from '../name';\nimport type {\n  LoginOAuth2NativeParams,\n  NativeCredential,\n  OAuth2Token,\n  PersonNameComponents,\n  Provider,\n  UserInfo,\n} from '../types';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\n/** `iss` of every Apple id token (https://appleid.apple.com/.well-known/openid-configuration). */\nconst APPLE_ISSUER = 'https://appleid.apple.com';\n\n// ref: https://account.apple.com/.well-known/openid-configuration\nexport function createAppleProvider(): Provider {\n  return {\n    // important notice: response_mode=form_post is required for apple\n    authorizationUri: 'https://appleid.apple.com/auth/authorize?response_mode=form_post',\n    tokenUri: 'https://appleid.apple.com/auth/token',\n    jwkSetUri: 'https://appleid.apple.com/auth/keys',\n    userNameAttribute: 'sub',\n    defaultScope: ['openid', 'name', 'email'],\n    createAuthorizationUri({ pkce: _, ...params }) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode({ pkce: _, ...params }) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error } = (await response.json()) as AppleErrorResponse;\n        throw new OAuth2Error(response.status, error);\n      }\n      return (await response.json()) as AppleToken;\n    },\n    async getUserInfo({ id_token }, { clientId, response }) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      // The audience is the client the code was exchanged as: the bundle id for an app, the\n      // Services ID for the web.\n      const token = await verifyIdToken<AppleIdToken>(id_token, {\n        jwkSetUri: this.jwkSetUri,\n        issuer: APPLE_ISSUER,\n        audience: clientId,\n      });\n      // Apple's id token never carries a name; on the first authorization of the web flow the\n      // name comes in the form_post `user` instead, unsigned, so only its name parts are used\n      // and the signed id token's email always wins over the one beside them.\n      const user = parseAppleUser(response?.user);\n      const data: AppleUserInfo = user ? { ...token, user } : token;\n      return {\n        data,\n        claims: {\n          sub: token.sub,\n          email: token.email,\n          email_verified: true,\n          ...nameClaims({\n            given_name: user?.name?.firstName,\n            family_name: user?.name?.lastName,\n          }),\n        },\n      };\n    },\n    async loginOAuth2Native({ pkce: _, credentials, ...params }: LoginOAuth2NativeParams) {\n      invariant(credentials.code, 'code is required');\n      const { tokenUri } = this;\n      const { code } = credentials;\n      const response = await exchangeAuthorizationCode({ code, tokenUri, ...params });\n      if (!response.ok) {\n        const { error } = (await response.json()) as AppleErrorResponse;\n        throw new OAuth2Error(response.status, error);\n      }\n      const token = (await response.json()) as AppleToken;\n      const { data, claims } = await this.getUserInfo(token, { clientId: params.clientId });\n      // The app gets the name from Apple on the first authorization only and passes it along in\n      // the login body as the platform's `fullName`.\n      const fullName = cleanPersonName(credentials.fullName);\n      const name = nameClaims({\n        given_name: fullName?.givenName ?? undefined,\n        family_name: fullName?.familyName ?? undefined,\n        middle_name: fullName?.middleName ?? undefined,\n        nickname: fullName?.nickname ?? undefined,\n      });\n      const userInfo: UserInfo<AppleUserInfo> = {\n        data: fullName ? { ...(data as AppleUserInfo), fullName } : (data as AppleUserInfo),\n        claims: { ...claims, ...name },\n      };\n      return { token, userInfo };\n    },\n  };\n}\n\nexport const apple = createAppleProvider();\n\n// Claims of Apple's id token. It carries no name or picture, not even on the first authorization.\n// https://developer.apple.com/documentation/signinwithapple/authenticating-users-with-sign-in-with-apple\nexport interface AppleIdToken {\n  iss: string;\n  aud: string;\n  exp: number;\n  iat: number;\n  sub: string;\n  email: string;\n  email_verified: true | 'true';\n  is_private_email: boolean;\n  /** Native flow, first authorization only: 0 unsupported, 1 unknown, 2 likely real. */\n  real_user_status?: number;\n  nonce?: string;\n  nonce_supported?: boolean;\n}\n\n/**\n * `userInfo.data` of an Apple login: the id token's claims, plus the unsigned name the client\n * passed on the first authorization, cleaned (see `nameClaims` for the standard claims made of it).\n */\nexport interface AppleUserInfo extends AppleIdToken {\n  /** Web flow: Apple's form_post `user`, as Apple names it. */\n  user?: AppleUser;\n  /** Native flow: the login body's `fullName`, which alone keeps `namePrefix` / `nameSuffix`. */\n  fullName?: PersonNameComponents;\n}\n\n// https://developer.apple.com/documentation/devicemanagement/implementing-the-oauth2-authentication-user-enrollment-flow\n// https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens\nexport interface AppleToken extends OAuth2Token {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token: string;\n  id_token: string;\n}\n\nexport interface AppleNativeCredential extends NativeCredential {\n  state: string;\n  code: string;\n  id_token: string;\n}\n\n// https://developer.apple.com/documentation/sign_in_with_apple/errorresponse\nexport interface AppleErrorResponse {\n  error:\n    | 'invalid_request'\n    | 'invalid_client'\n    | 'invalid_grant'\n    | 'unauthorized_client'\n    | 'unsupported_grant_type'\n    | 'invalid_scope';\n}\n"],"mappings":";;;;;;AAcA,MAAM,eAAe;AAGrB,SAAgB,sBAAgC;CAC9C,OAAO;EAEL,kBAAkB;EAClB,UAAU;EACV,WAAW;EACX,mBAAmB;EACnB,cAAc;GAAC;GAAU;GAAQ;EAAO;EACxC,uBAAuB,EAAE,MAAM,GAAG,GAAG,UAAU;GAC7C,OAAO,uBAAuB;IAC5B,GAAG;IACH,OAAO,OAAO,SAAS,KAAK;IAC5B,kBAAkB,KAAK;GACzB,CAAC;EACH;EACA,MAAM,0BAA0B,EAAE,MAAM,GAAG,GAAG,UAAU;GACtD,MAAM,WAAW,MAAM,0BAA0B;IAAE,GAAG;IAAQ,UAAU,KAAK;GAAS,CAAC;GACvF,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,UAAW,MAAM,SAAS,KAAK;IACvC,MAAM,IAAI,YAAY,SAAS,QAAQ,KAAK;GAC9C;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,EAAE,YAAY,EAAE,UAAU,YAAY;GACtD,UAAU,UAAU,sBAAsB;GAC1C,UAAU,KAAK,WAAW,uBAAuB;GAGjD,MAAM,QAAQ,MAAM,cAA4B,UAAU;IACxD,WAAW,KAAK;IAChB,QAAQ;IACR,UAAU;GACZ,CAAC;GAID,MAAM,OAAO,eAAe,UAAU,IAAI;GAE1C,OAAO;IACL,MAF0B,OAAO;KAAE,GAAG;KAAO;IAAK,IAAI;IAGtD,QAAQ;KACN,KAAK,MAAM;KACX,OAAO,MAAM;KACb,gBAAgB;KAChB,GAAG,WAAW;MACZ,YAAY,MAAM,MAAM;MACxB,aAAa,MAAM,MAAM;KAC3B,CAAC;IACH;GACF;EACF;EACA,MAAM,kBAAkB,EAAE,MAAM,GAAG,aAAa,GAAG,UAAmC;GACpF,UAAU,YAAY,MAAM,kBAAkB;GAC9C,MAAM,EAAE,aAAa;GACrB,MAAM,EAAE,SAAS;GACjB,MAAM,WAAW,MAAM,0BAA0B;IAAE;IAAM;IAAU,GAAG;GAAO,CAAC;GAC9E,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,UAAW,MAAM,SAAS,KAAK;IACvC,MAAM,IAAI,YAAY,SAAS,QAAQ,KAAK;GAC9C;GACA,MAAM,QAAS,MAAM,SAAS,KAAK;GACnC,MAAM,EAAE,MAAM,WAAW,MAAM,KAAK,YAAY,OAAO,EAAE,UAAU,OAAO,SAAS,CAAC;GAGpF,MAAM,WAAW,gBAAgB,YAAY,QAAQ;GACrD,MAAM,OAAO,WAAW;IACtB,YAAY,UAAU,aAAa,KAAA;IACnC,aAAa,UAAU,cAAc,KAAA;IACrC,aAAa,UAAU,cAAc,KAAA;IACrC,UAAU,UAAU,YAAY,KAAA;GAClC,CAAC;GAKD,OAAO;IAAE;IAAO,UAAA;KAHd,MAAM,WAAW;MAAE,GAAI;MAAwB;KAAS,IAAK;KAC7D,QAAQ;MAAE,GAAG;MAAQ,GAAG;KAAK;IAER;GAAE;EAC3B;CACF;AACF;AAEA,MAAa,QAAQ,oBAAoB"}
+{"version":3,"file":"apple.mjs","names":[],"sources":["../../../src/oauth2/provider/apple.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport { type AppleUser, cleanPersonName, nameClaims, parseAppleUser } from '../name';\nimport type {\n  LoginOAuth2NativeParams,\n  NativeCredential,\n  OAuth2Token,\n  PersonNameComponents,\n  Provider,\n  UserInfo,\n} from '../types';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\n/** `iss` of every Apple id token (https://appleid.apple.com/.well-known/openid-configuration). */\nconst APPLE_ISSUER = 'https://appleid.apple.com';\n\n// ref: https://account.apple.com/.well-known/openid-configuration\nexport function createAppleProvider(): Provider {\n  return {\n    // important notice: response_mode=form_post is required for apple\n    authorizationUri: 'https://appleid.apple.com/auth/authorize?response_mode=form_post',\n    tokenUri: 'https://appleid.apple.com/auth/token',\n    jwkSetUri: 'https://appleid.apple.com/auth/keys',\n    userNameAttribute: 'sub',\n    defaultScope: ['openid', 'name', 'email'],\n    // The web flow's id token echoes the request's nonce; the app's carries the one bound into\n    // ASAuthorizationAppleIDRequest, hashed or not (`nonce_supported`).\n    nonce: { web: true, native: true },\n    createAuthorizationUri({ pkce: _, ...params }) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode({ pkce: _, ...params }) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error } = (await response.json()) as AppleErrorResponse;\n        throw new OAuth2Error(response.status, error);\n      }\n      return (await response.json()) as AppleToken;\n    },\n    async getUserInfo({ id_token }, { clientId, response }) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      // The audience is the client the code was exchanged as: the bundle id for an app, the\n      // Services ID for the web.\n      const token = await verifyIdToken<AppleIdToken>(id_token, {\n        jwkSetUri: this.jwkSetUri,\n        issuer: APPLE_ISSUER,\n        audience: clientId,\n      });\n      // Apple's id token never carries a name; on the first authorization of the web flow the\n      // name comes in the form_post `user` instead, unsigned, so only its name parts are used\n      // and the signed id token's email always wins over the one beside them.\n      const user = parseAppleUser(response?.user);\n      const data: AppleUserInfo = user ? { ...token, user } : token;\n      return {\n        data,\n        claims: {\n          sub: token.sub,\n          email: token.email,\n          email_verified: true,\n          ...nameClaims({\n            given_name: user?.name?.firstName,\n            family_name: user?.name?.lastName,\n          }),\n        },\n      };\n    },\n    async loginOAuth2Native({ pkce: _, credentials, ...params }: LoginOAuth2NativeParams) {\n      invariant(credentials.code, 'code is required');\n      const { tokenUri } = this;\n      const { code } = credentials;\n      const response = await exchangeAuthorizationCode({ code, tokenUri, ...params });\n      if (!response.ok) {\n        const { error } = (await response.json()) as AppleErrorResponse;\n        throw new OAuth2Error(response.status, error);\n      }\n      const token = (await response.json()) as AppleToken;\n      const { data, claims } = await this.getUserInfo(token, { clientId: params.clientId });\n      // The app gets the name from Apple on the first authorization only and passes it along in\n      // the login body as the platform's `fullName`.\n      const fullName = cleanPersonName(credentials.fullName);\n      const name = nameClaims({\n        given_name: fullName?.givenName ?? undefined,\n        family_name: fullName?.familyName ?? undefined,\n        middle_name: fullName?.middleName ?? undefined,\n        nickname: fullName?.nickname ?? undefined,\n      });\n      const userInfo: UserInfo<AppleUserInfo> = {\n        data: fullName ? { ...(data as AppleUserInfo), fullName } : (data as AppleUserInfo),\n        claims: { ...claims, ...name },\n      };\n      return { token, userInfo };\n    },\n  };\n}\n\nexport const apple = createAppleProvider();\n\n// Claims of Apple's id token. It carries no name or picture, not even on the first authorization.\n// https://developer.apple.com/documentation/signinwithapple/authenticating-users-with-sign-in-with-apple\nexport interface AppleIdToken {\n  iss: string;\n  aud: string;\n  exp: number;\n  iat: number;\n  sub: string;\n  email: string;\n  email_verified: true | 'true';\n  is_private_email: boolean;\n  /** Native flow, first authorization only: 0 unsupported, 1 unknown, 2 likely real. */\n  real_user_status?: number;\n  nonce?: string;\n  nonce_supported?: boolean;\n}\n\n/**\n * `userInfo.data` of an Apple login: the id token's claims, plus the unsigned name the client\n * passed on the first authorization, cleaned (see `nameClaims` for the standard claims made of it).\n */\nexport interface AppleUserInfo extends AppleIdToken {\n  /** Web flow: Apple's form_post `user`, as Apple names it. */\n  user?: AppleUser;\n  /** Native flow: the login body's `fullName`, which alone keeps `namePrefix` / `nameSuffix`. */\n  fullName?: PersonNameComponents;\n}\n\n// https://developer.apple.com/documentation/devicemanagement/implementing-the-oauth2-authentication-user-enrollment-flow\n// https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens\nexport interface AppleToken extends OAuth2Token {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token: string;\n  id_token: string;\n}\n\nexport interface AppleNativeCredential extends NativeCredential {\n  state: string;\n  code: string;\n  id_token: string;\n}\n\n// https://developer.apple.com/documentation/sign_in_with_apple/errorresponse\nexport interface AppleErrorResponse {\n  error:\n    | 'invalid_request'\n    | 'invalid_client'\n    | 'invalid_grant'\n    | 'unauthorized_client'\n    | 'unsupported_grant_type'\n    | 'invalid_scope';\n}\n"],"mappings":";;;;;;AAcA,MAAM,eAAe;AAGrB,SAAgB,sBAAgC;CAC9C,OAAO;EAEL,kBAAkB;EAClB,UAAU;EACV,WAAW;EACX,mBAAmB;EACnB,cAAc;GAAC;GAAU;GAAQ;EAAO;EAGxC,OAAO;GAAE,KAAK;GAAM,QAAQ;EAAK;EACjC,uBAAuB,EAAE,MAAM,GAAG,GAAG,UAAU;GAC7C,OAAO,uBAAuB;IAC5B,GAAG;IACH,OAAO,OAAO,SAAS,KAAK;IAC5B,kBAAkB,KAAK;GACzB,CAAC;EACH;EACA,MAAM,0BAA0B,EAAE,MAAM,GAAG,GAAG,UAAU;GACtD,MAAM,WAAW,MAAM,0BAA0B;IAAE,GAAG;IAAQ,UAAU,KAAK;GAAS,CAAC;GACvF,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,UAAW,MAAM,SAAS,KAAK;IACvC,MAAM,IAAI,YAAY,SAAS,QAAQ,KAAK;GAC9C;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,EAAE,YAAY,EAAE,UAAU,YAAY;GACtD,UAAU,UAAU,sBAAsB;GAC1C,UAAU,KAAK,WAAW,uBAAuB;GAGjD,MAAM,QAAQ,MAAM,cAA4B,UAAU;IACxD,WAAW,KAAK;IAChB,QAAQ;IACR,UAAU;GACZ,CAAC;GAID,MAAM,OAAO,eAAe,UAAU,IAAI;GAE1C,OAAO;IACL,MAF0B,OAAO;KAAE,GAAG;KAAO;IAAK,IAAI;IAGtD,QAAQ;KACN,KAAK,MAAM;KACX,OAAO,MAAM;KACb,gBAAgB;KAChB,GAAG,WAAW;MACZ,YAAY,MAAM,MAAM;MACxB,aAAa,MAAM,MAAM;KAC3B,CAAC;IACH;GACF;EACF;EACA,MAAM,kBAAkB,EAAE,MAAM,GAAG,aAAa,GAAG,UAAmC;GACpF,UAAU,YAAY,MAAM,kBAAkB;GAC9C,MAAM,EAAE,aAAa;GACrB,MAAM,EAAE,SAAS;GACjB,MAAM,WAAW,MAAM,0BAA0B;IAAE;IAAM;IAAU,GAAG;GAAO,CAAC;GAC9E,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,UAAW,MAAM,SAAS,KAAK;IACvC,MAAM,IAAI,YAAY,SAAS,QAAQ,KAAK;GAC9C;GACA,MAAM,QAAS,MAAM,SAAS,KAAK;GACnC,MAAM,EAAE,MAAM,WAAW,MAAM,KAAK,YAAY,OAAO,EAAE,UAAU,OAAO,SAAS,CAAC;GAGpF,MAAM,WAAW,gBAAgB,YAAY,QAAQ;GACrD,MAAM,OAAO,WAAW;IACtB,YAAY,UAAU,aAAa,KAAA;IACnC,aAAa,UAAU,cAAc,KAAA;IACrC,aAAa,UAAU,cAAc,KAAA;IACrC,UAAU,UAAU,YAAY,KAAA;GAClC,CAAC;GAKD,OAAO;IAAE;IAAO,UAAA;KAHd,MAAM,WAAW;MAAE,GAAI;MAAwB;KAAS,IAAK;KAC7D,QAAQ;MAAE,GAAG;MAAQ,GAAG;KAAK;IAER;GAAE;EAC3B;CACF;AACF;AAEA,MAAa,QAAQ,oBAAoB"}

package/dist/oauth2/provider/common.cjs

@@ -7,6 +7,7 @@ function createAuthorizationUri(options) {
 	url.searchParams.append("response_type", "code");
 	url.searchParams.append("client_id", options.clientId);
 	url.searchParams.append("state", options.state);
+	if (options.nonce) url.searchParams.append("nonce", options.nonce);
 	url.searchParams.append("scope", options.scope.join(" "));
 	url.searchParams.append("redirect_uri", options.redirectUri);
 	if (options.pkce) {

package/dist/oauth2/provider/common.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"common.cjs","names":["OAuth2Error","createRemoteJWKSet","jwtVerify"],"sources":["../../../src/oauth2/provider/common.ts"],"sourcesContent":["import { createRemoteJWKSet, jwtVerify } from 'jose';\nimport { OAuth2Error } from '../error';\nimport type { ExchangeCodeParams, PkceParameters, RefreshTokenParams } from '../types';\n\nexport function createAuthorizationUri(options: {\n  state: string;\n  scope: string[];\n  clientId: string;\n  redirectUri: string;\n  authorizationUri: string;\n  pkce?: Omit<PkceParameters, 'code_verifier'>;\n}) {\n  const url = new URL(options.authorizationUri);\n  url.searchParams.append('response_type', 'code');\n  url.searchParams.append('client_id', options.clientId);\n  url.searchParams.append('state', options.state);\n  url.searchParams.append('scope', options.scope.join(' '));\n  url.searchParams.append('redirect_uri', options.redirectUri);\n  if (options.pkce) {\n    url.searchParams.append('code_challenge_method', options.pkce.code_challenge_method);\n    url.searchParams.append('code_challenge', options.pkce.code_challenge);\n  }\n  return url;\n}\n\nexport async function exchangeAuthorizationCode(\n  params: ExchangeCodeParams & {\n    tokenUri: string;\n    authentication?: 'basic' | 'post';\n    /** Extra request headers some providers require, e.g. GitHub's `User-Agent`. */\n    headers?: Record<string, string>;\n  }\n) {\n  const body = new URLSearchParams();\n  body.append('code', params.code);\n  body.append('redirect_uri', params.redirectUri);\n  body.append('grant_type', 'authorization_code');\n  if (params.pkce) body.append('code_verifier', params.pkce.code_verifier);\n\n  const headers: Record<string, string> = {\n    ...params.headers,\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret ?? ''}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    // Public clients (Google's installed-app clients, PKCE-only clients) have no secret.\n    if (params.clientSecret) body.append('client_secret', params.clientSecret);\n  }\n\n  return fetch(params.tokenUri, { method: 'POST', headers, body });\n}\n\nexport async function refreshAccessToken(\n  params: RefreshTokenParams & {\n    tokenUri: string;\n    authentication?: 'basic' | 'post';\n  }\n) {\n  const body = new URLSearchParams();\n  body.append('grant_type', 'refresh_token');\n  body.append('refresh_token', params.refreshToken);\n\n  const headers: Record<string, string> = {\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret ?? ''}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    if (params.clientSecret) body.append('client_secret', params.clientSecret);\n  }\n\n  return fetch(params.tokenUri, { method: 'POST', headers, body });\n}\n\ninterface RevokeTokenParams {\n  token: string;\n  clientId: string;\n  clientSecret?: string;\n  tokenRevokeUri: string;\n  authentication?: 'basic' | 'post';\n}\n\nexport async function revokeToken(params: RevokeTokenParams) {\n  const body = new URLSearchParams();\n  body.append('token', params.token);\n  const headers: Record<string, string> = {\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret ?? ''}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    if (params.clientSecret) body.append('client_secret', params.clientSecret);\n  }\n\n  const response = await fetch(params.tokenRevokeUri, { method: 'POST', headers, body });\n  if (!response.ok) {\n    const error = await response.json();\n    console.error('Revoke token error:', error);\n    throw new OAuth2Error(response.status, 'invalid_request', 'Failed to revoke token');\n  }\n}\n\nexport interface VerifyIdTokenOptions {\n  jwkSetUri: string;\n  /** The `iss` values the provider signs with; anything else is refused. */\n  issuer: string | string[];\n  /**\n   * The client the token must be issued to. An id token proves who the user is only to the client\n   * it names in `aud`: any other app on the same identity provider can obtain a validly signed one\n   * for the same user, so a token for a foreign client must never sign anyone in here.\n   */\n  audience: string;\n}\n\n/**\n * One key set per JWKS endpoint for the life of the process: jose caches the fetched keys,\n * refetches on an unknown `kid` (with a cooldown) and when they go stale, so a set created per\n * call would refetch the keys for every id token.\n */\nconst jwkSets = new Map<string, ReturnType<typeof createRemoteJWKSet>>();\n\nfunction remoteJWKSet(jwkSetUri: string) {\n  let jwks = jwkSets.get(jwkSetUri);\n  if (!jwks) {\n    jwks = createRemoteJWKSet(new URL(jwkSetUri));\n    jwkSets.set(jwkSetUri, jwks);\n  }\n  return jwks;\n}\n\nexport async function verifyIdToken<T>(idToken: string, options: VerifyIdTokenOptions) {\n  const { jwkSetUri, issuer, audience } = options;\n  try {\n    const jwks = remoteJWKSet(jwkSetUri);\n    const { payload } = await jwtVerify(idToken, jwks, { issuer, audience });\n    return payload as T;\n  } catch (error) {\n    console.error('Failed to verify id_token', error);\n    // The token is the grant here: one for another audience or issuer is an invalid grant, not a\n    // malformed request.\n    throw new OAuth2Error(400, 'invalid_grant', 'Failed to verify id_token');\n  }\n}\n"],"mappings":";;;;AAIA,SAAgB,uBAAuB,SAOpC;CACD,MAAM,MAAM,IAAI,IAAI,QAAQ,gBAAgB;CAC5C,IAAI,aAAa,OAAO,iBAAiB,MAAM;CAC/C,IAAI,aAAa,OAAO,aAAa,QAAQ,QAAQ;CACrD,IAAI,aAAa,OAAO,SAAS,QAAQ,KAAK;CAC9C,IAAI,aAAa,OAAO,SAAS,QAAQ,MAAM,KAAK,GAAG,CAAC;CACxD,IAAI,aAAa,OAAO,gBAAgB,QAAQ,WAAW;CAC3D,IAAI,QAAQ,MAAM;EAChB,IAAI,aAAa,OAAO,yBAAyB,QAAQ,KAAK,qBAAqB;EACnF,IAAI,aAAa,OAAO,kBAAkB,QAAQ,KAAK,cAAc;CACvE;CACA,OAAO;AACT;AAEA,eAAsB,0BACpB,QAMA;CACA,MAAM,OAAO,IAAI,gBAAgB;CACjC,KAAK,OAAO,QAAQ,OAAO,IAAI;CAC/B,KAAK,OAAO,gBAAgB,OAAO,WAAW;CAC9C,KAAK,OAAO,cAAc,oBAAoB;CAC9C,IAAI,OAAO,MAAM,KAAK,OAAO,iBAAiB,OAAO,KAAK,aAAa;CAEvE,MAAM,UAAkC;EACtC,GAAG,OAAO;EACV,QAAQ;EACR,gBAAgB;CAClB;CACA,IAAI,OAAO,mBAAmB,SAE5B,QAAQ,gBAAgB,SADV,OAAO,KAAK,GAAG,OAAO,SAAS,GAAG,OAAO,gBAAgB,IAAI,CAAC,CAAC,SAAS,QACjD;MAChC;EACL,KAAK,OAAO,aAAa,OAAO,QAAQ;EAExC,IAAI,OAAO,cAAc,KAAK,OAAO,iBAAiB,OAAO,YAAY;CAC3E;CAEA,OAAO,MAAM,OAAO,UAAU;EAAE,QAAQ;EAAQ;EAAS;CAAK,CAAC;AACjE;AAEA,eAAsB,mBACpB,QAIA;CACA,MAAM,OAAO,IAAI,gBAAgB;CACjC,KAAK,OAAO,cAAc,eAAe;CACzC,KAAK,OAAO,iBAAiB,OAAO,YAAY;CAEhD,MAAM,UAAkC;EACtC,QAAQ;EACR,gBAAgB;CAClB;CAEA,IAAI,OAAO,mBAAmB,SAE5B,QAAQ,gBAAgB,SADV,OAAO,KAAK,GAAG,OAAO,SAAS,GAAG,OAAO,gBAAgB,IAAI,CAAC,CAAC,SAAS,QACjD;MAChC;EACL,KAAK,OAAO,aAAa,OAAO,QAAQ;EACxC,IAAI,OAAO,cAAc,KAAK,OAAO,iBAAiB,OAAO,YAAY;CAC3E;CAEA,OAAO,MAAM,OAAO,UAAU;EAAE,QAAQ;EAAQ;EAAS;CAAK,CAAC;AACjE;AAUA,eAAsB,YAAY,QAA2B;CAC3D,MAAM,OAAO,IAAI,gBAAgB;CACjC,KAAK,OAAO,SAAS,OAAO,KAAK;CACjC,MAAM,UAAkC;EACtC,QAAQ;EACR,gBAAgB;CAClB;CAEA,IAAI,OAAO,mBAAmB,SAE5B,QAAQ,gBAAgB,SADV,OAAO,KAAK,GAAG,OAAO,SAAS,GAAG,OAAO,gBAAgB,IAAI,CAAC,CAAC,SAAS,QACjD;MAChC;EACL,KAAK,OAAO,aAAa,OAAO,QAAQ;EACxC,IAAI,OAAO,cAAc,KAAK,OAAO,iBAAiB,OAAO,YAAY;CAC3E;CAEA,MAAM,WAAW,MAAM,MAAM,OAAO,gBAAgB;EAAE,QAAQ;EAAQ;EAAS;CAAK,CAAC;CACrF,IAAI,CAAC,SAAS,IAAI;EAChB,MAAM,QAAQ,MAAM,SAAS,KAAK;EAClC,QAAQ,MAAM,uBAAuB,KAAK;EAC1C,MAAM,IAAIA,qBAAAA,YAAY,SAAS,QAAQ,mBAAmB,wBAAwB;CACpF;AACF;;;;;;AAmBA,MAAM,0BAAU,IAAI,IAAmD;AAEvE,SAAS,aAAa,WAAmB;CACvC,IAAI,OAAO,QAAQ,IAAI,SAAS;CAChC,IAAI,CAAC,MAAM;EACT,QAAA,GAAOC,KAAAA,mBAAAA,CAAmB,IAAI,IAAI,SAAS,CAAC;EAC5C,QAAQ,IAAI,WAAW,IAAI;CAC7B;CACA,OAAO;AACT;AAEA,eAAsB,cAAiB,SAAiB,SAA+B;CACrF,MAAM,EAAE,WAAW,QAAQ,aAAa;CACxC,IAAI;EACF,MAAM,OAAO,aAAa,SAAS;EACnC,MAAM,EAAE,YAAY,OAAA,GAAMC,KAAAA,UAAAA,CAAU,SAAS,MAAM;GAAE;GAAQ;EAAS,CAAC;EACvE,OAAO;CACT,SAAS,OAAO;EACd,QAAQ,MAAM,6BAA6B,KAAK;EAGhD,MAAM,IAAIF,qBAAAA,YAAY,KAAK,iBAAiB,2BAA2B;CACzE;AACF"}
+{"version":3,"file":"common.cjs","names":["OAuth2Error","createRemoteJWKSet","jwtVerify"],"sources":["../../../src/oauth2/provider/common.ts"],"sourcesContent":["import { createRemoteJWKSet, jwtVerify } from 'jose';\nimport { OAuth2Error } from '../error';\nimport type { ExchangeCodeParams, PkceParameters, RefreshTokenParams } from '../types';\n\nexport function createAuthorizationUri(options: {\n  state: string;\n  scope: string[];\n  clientId: string;\n  redirectUri: string;\n  authorizationUri: string;\n  pkce?: Omit<PkceParameters, 'code_verifier'>;\n  nonce?: string;\n}) {\n  const url = new URL(options.authorizationUri);\n  url.searchParams.append('response_type', 'code');\n  url.searchParams.append('client_id', options.clientId);\n  url.searchParams.append('state', options.state);\n  if (options.nonce) url.searchParams.append('nonce', options.nonce);\n  url.searchParams.append('scope', options.scope.join(' '));\n  url.searchParams.append('redirect_uri', options.redirectUri);\n  if (options.pkce) {\n    url.searchParams.append('code_challenge_method', options.pkce.code_challenge_method);\n    url.searchParams.append('code_challenge', options.pkce.code_challenge);\n  }\n  return url;\n}\n\nexport async function exchangeAuthorizationCode(\n  params: ExchangeCodeParams & {\n    tokenUri: string;\n    authentication?: 'basic' | 'post';\n    /** Extra request headers some providers require, e.g. GitHub's `User-Agent`. */\n    headers?: Record<string, string>;\n  }\n) {\n  const body = new URLSearchParams();\n  body.append('code', params.code);\n  body.append('redirect_uri', params.redirectUri);\n  body.append('grant_type', 'authorization_code');\n  if (params.pkce) body.append('code_verifier', params.pkce.code_verifier);\n\n  const headers: Record<string, string> = {\n    ...params.headers,\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret ?? ''}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    // Public clients (Google's installed-app clients, PKCE-only clients) have no secret.\n    if (params.clientSecret) body.append('client_secret', params.clientSecret);\n  }\n\n  return fetch(params.tokenUri, { method: 'POST', headers, body });\n}\n\nexport async function refreshAccessToken(\n  params: RefreshTokenParams & {\n    tokenUri: string;\n    authentication?: 'basic' | 'post';\n  }\n) {\n  const body = new URLSearchParams();\n  body.append('grant_type', 'refresh_token');\n  body.append('refresh_token', params.refreshToken);\n\n  const headers: Record<string, string> = {\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret ?? ''}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    if (params.clientSecret) body.append('client_secret', params.clientSecret);\n  }\n\n  return fetch(params.tokenUri, { method: 'POST', headers, body });\n}\n\ninterface RevokeTokenParams {\n  token: string;\n  clientId: string;\n  clientSecret?: string;\n  tokenRevokeUri: string;\n  authentication?: 'basic' | 'post';\n}\n\nexport async function revokeToken(params: RevokeTokenParams) {\n  const body = new URLSearchParams();\n  body.append('token', params.token);\n  const headers: Record<string, string> = {\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret ?? ''}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    if (params.clientSecret) body.append('client_secret', params.clientSecret);\n  }\n\n  const response = await fetch(params.tokenRevokeUri, { method: 'POST', headers, body });\n  if (!response.ok) {\n    const error = await response.json();\n    console.error('Revoke token error:', error);\n    throw new OAuth2Error(response.status, 'invalid_request', 'Failed to revoke token');\n  }\n}\n\nexport interface VerifyIdTokenOptions {\n  jwkSetUri: string;\n  /** The `iss` values the provider signs with; anything else is refused. */\n  issuer: string | string[];\n  /**\n   * The client the token must be issued to. An id token proves who the user is only to the client\n   * it names in `aud`: any other app on the same identity provider can obtain a validly signed one\n   * for the same user, so a token for a foreign client must never sign anyone in here.\n   */\n  audience: string;\n}\n\n/**\n * One key set per JWKS endpoint for the life of the process: jose caches the fetched keys,\n * refetches on an unknown `kid` (with a cooldown) and when they go stale, so a set created per\n * call would refetch the keys for every id token.\n */\nconst jwkSets = new Map<string, ReturnType<typeof createRemoteJWKSet>>();\n\nfunction remoteJWKSet(jwkSetUri: string) {\n  let jwks = jwkSets.get(jwkSetUri);\n  if (!jwks) {\n    jwks = createRemoteJWKSet(new URL(jwkSetUri));\n    jwkSets.set(jwkSetUri, jwks);\n  }\n  return jwks;\n}\n\nexport async function verifyIdToken<T>(idToken: string, options: VerifyIdTokenOptions) {\n  const { jwkSetUri, issuer, audience } = options;\n  try {\n    const jwks = remoteJWKSet(jwkSetUri);\n    const { payload } = await jwtVerify(idToken, jwks, { issuer, audience });\n    return payload as T;\n  } catch (error) {\n    console.error('Failed to verify id_token', error);\n    // The token is the grant here: one for another audience or issuer is an invalid grant, not a\n    // malformed request.\n    throw new OAuth2Error(400, 'invalid_grant', 'Failed to verify id_token');\n  }\n}\n"],"mappings":";;;;AAIA,SAAgB,uBAAuB,SAQpC;CACD,MAAM,MAAM,IAAI,IAAI,QAAQ,gBAAgB;CAC5C,IAAI,aAAa,OAAO,iBAAiB,MAAM;CAC/C,IAAI,aAAa,OAAO,aAAa,QAAQ,QAAQ;CACrD,IAAI,aAAa,OAAO,SAAS,QAAQ,KAAK;CAC9C,IAAI,QAAQ,OAAO,IAAI,aAAa,OAAO,SAAS,QAAQ,KAAK;CACjE,IAAI,aAAa,OAAO,SAAS,QAAQ,MAAM,KAAK,GAAG,CAAC;CACxD,IAAI,aAAa,OAAO,gBAAgB,QAAQ,WAAW;CAC3D,IAAI,QAAQ,MAAM;EAChB,IAAI,aAAa,OAAO,yBAAyB,QAAQ,KAAK,qBAAqB;EACnF,IAAI,aAAa,OAAO,kBAAkB,QAAQ,KAAK,cAAc;CACvE;CACA,OAAO;AACT;AAEA,eAAsB,0BACpB,QAMA;CACA,MAAM,OAAO,IAAI,gBAAgB;CACjC,KAAK,OAAO,QAAQ,OAAO,IAAI;CAC/B,KAAK,OAAO,gBAAgB,OAAO,WAAW;CAC9C,KAAK,OAAO,cAAc,oBAAoB;CAC9C,IAAI,OAAO,MAAM,KAAK,OAAO,iBAAiB,OAAO,KAAK,aAAa;CAEvE,MAAM,UAAkC;EACtC,GAAG,OAAO;EACV,QAAQ;EACR,gBAAgB;CAClB;CACA,IAAI,OAAO,mBAAmB,SAE5B,QAAQ,gBAAgB,SADV,OAAO,KAAK,GAAG,OAAO,SAAS,GAAG,OAAO,gBAAgB,IAAI,CAAC,CAAC,SAAS,QACjD;MAChC;EACL,KAAK,OAAO,aAAa,OAAO,QAAQ;EAExC,IAAI,OAAO,cAAc,KAAK,OAAO,iBAAiB,OAAO,YAAY;CAC3E;CAEA,OAAO,MAAM,OAAO,UAAU;EAAE,QAAQ;EAAQ;EAAS;CAAK,CAAC;AACjE;AAEA,eAAsB,mBACpB,QAIA;CACA,MAAM,OAAO,IAAI,gBAAgB;CACjC,KAAK,OAAO,cAAc,eAAe;CACzC,KAAK,OAAO,iBAAiB,OAAO,YAAY;CAEhD,MAAM,UAAkC;EACtC,QAAQ;EACR,gBAAgB;CAClB;CAEA,IAAI,OAAO,mBAAmB,SAE5B,QAAQ,gBAAgB,SADV,OAAO,KAAK,GAAG,OAAO,SAAS,GAAG,OAAO,gBAAgB,IAAI,CAAC,CAAC,SAAS,QACjD;MAChC;EACL,KAAK,OAAO,aAAa,OAAO,QAAQ;EACxC,IAAI,OAAO,cAAc,KAAK,OAAO,iBAAiB,OAAO,YAAY;CAC3E;CAEA,OAAO,MAAM,OAAO,UAAU;EAAE,QAAQ;EAAQ;EAAS;CAAK,CAAC;AACjE;AAUA,eAAsB,YAAY,QAA2B;CAC3D,MAAM,OAAO,IAAI,gBAAgB;CACjC,KAAK,OAAO,SAAS,OAAO,KAAK;CACjC,MAAM,UAAkC;EACtC,QAAQ;EACR,gBAAgB;CAClB;CAEA,IAAI,OAAO,mBAAmB,SAE5B,QAAQ,gBAAgB,SADV,OAAO,KAAK,GAAG,OAAO,SAAS,GAAG,OAAO,gBAAgB,IAAI,CAAC,CAAC,SAAS,QACjD;MAChC;EACL,KAAK,OAAO,aAAa,OAAO,QAAQ;EACxC,IAAI,OAAO,cAAc,KAAK,OAAO,iBAAiB,OAAO,YAAY;CAC3E;CAEA,MAAM,WAAW,MAAM,MAAM,OAAO,gBAAgB;EAAE,QAAQ;EAAQ;EAAS;CAAK,CAAC;CACrF,IAAI,CAAC,SAAS,IAAI;EAChB,MAAM,QAAQ,MAAM,SAAS,KAAK;EAClC,QAAQ,MAAM,uBAAuB,KAAK;EAC1C,MAAM,IAAIA,qBAAAA,YAAY,SAAS,QAAQ,mBAAmB,wBAAwB;CACpF;AACF;;;;;;AAmBA,MAAM,0BAAU,IAAI,IAAmD;AAEvE,SAAS,aAAa,WAAmB;CACvC,IAAI,OAAO,QAAQ,IAAI,SAAS;CAChC,IAAI,CAAC,MAAM;EACT,QAAA,GAAOC,KAAAA,mBAAAA,CAAmB,IAAI,IAAI,SAAS,CAAC;EAC5C,QAAQ,IAAI,WAAW,IAAI;CAC7B;CACA,OAAO;AACT;AAEA,eAAsB,cAAiB,SAAiB,SAA+B;CACrF,MAAM,EAAE,WAAW,QAAQ,aAAa;CACxC,IAAI;EACF,MAAM,OAAO,aAAa,SAAS;EACnC,MAAM,EAAE,YAAY,OAAA,GAAMC,KAAAA,UAAAA,CAAU,SAAS,MAAM;GAAE;GAAQ;EAAS,CAAC;EACvE,OAAO;CACT,SAAS,OAAO;EACd,QAAQ,MAAM,6BAA6B,KAAK;EAGhD,MAAM,IAAIF,qBAAAA,YAAY,KAAK,iBAAiB,2BAA2B;CACzE;AACF"}

package/dist/oauth2/provider/common.d.cts

@@ -6,6 +6,7 @@ export declare function createAuthorizationUri(options: {
   redirectUri: string;
   authorizationUri: string;
   pkce?: Omit<PkceParameters, 'code_verifier'>;
+  nonce?: string;
 }): URL;
 export declare function exchangeAuthorizationCode(params: ExchangeCodeParams & {
   tokenUri: string;

package/dist/oauth2/provider/common.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"common.d.cts","names":[],"sources":["../../../src/oauth2/provider/common.ts"],"mappings":";wBAIgB,uBAAuB;EACrC;EACA;EACA;EACA;EACA;EACA,OAAO,KAAK;IACb;wBAcqB,0BACpB,QAAQ;EACN;EACA;;EAEA,UAAU;IACX,QAAA;wBAyBmB,mBACpB,QAAQ;EACN;EACA;IACD,QAAA;UAsBO;EACR;EACA;EACA;EACA;EACA;;wBAGoB,YAAY,QAAQ,oBAAiB;iBAwB1C;EACf;;EAEA;;;;;;EAMA;;wBAmBoB,cAAc,GAAG,iBAAiB,SAAS,uBAAoB,QAAA"}
+{"version":3,"file":"common.d.cts","names":[],"sources":["../../../src/oauth2/provider/common.ts"],"mappings":";wBAIgB,uBAAuB;EACrC;EACA;EACA;EACA;EACA;EACA,OAAO,KAAK;EACZ;IACD;wBAeqB,0BACpB,QAAQ;EACN;EACA;;EAEA,UAAU;IACX,QAAA;wBAyBmB,mBACpB,QAAQ;EACN;EACA;IACD,QAAA;UAsBO;EACR;EACA;EACA;EACA;EACA;;wBAGoB,YAAY,QAAQ,oBAAiB;iBAwB1C;EACf;;EAEA;;;;;;EAMA;;wBAmBoB,cAAc,GAAG,iBAAiB,SAAS,uBAAoB,QAAA"}

package/dist/oauth2/provider/common.d.mts

@@ -6,6 +6,7 @@ export declare function createAuthorizationUri(options: {
   redirectUri: string;
   authorizationUri: string;
   pkce?: Omit<PkceParameters, 'code_verifier'>;
+  nonce?: string;
 }): URL;
 export declare function exchangeAuthorizationCode(params: ExchangeCodeParams & {
   tokenUri: string;

package/dist/oauth2/provider/common.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"common.d.mts","names":[],"sources":["../../../src/oauth2/provider/common.ts"],"mappings":";wBAIgB,uBAAuB;EACrC;EACA;EACA;EACA;EACA;EACA,OAAO,KAAK;IACb;wBAcqB,0BACpB,QAAQ;EACN;EACA;;EAEA,UAAU;IACX,QAAA;wBAyBmB,mBACpB,QAAQ;EACN;EACA;IACD,QAAA;UAsBO;EACR;EACA;EACA;EACA;EACA;;wBAGoB,YAAY,QAAQ,oBAAiB;iBAwB1C;EACf;;EAEA;;;;;;EAMA;;wBAmBoB,cAAc,GAAG,iBAAiB,SAAS,uBAAoB,QAAA"}
+{"version":3,"file":"common.d.mts","names":[],"sources":["../../../src/oauth2/provider/common.ts"],"mappings":";wBAIgB,uBAAuB;EACrC;EACA;EACA;EACA;EACA;EACA,OAAO,KAAK;EACZ;IACD;wBAeqB,0BACpB,QAAQ;EACN;EACA;;EAEA,UAAU;IACX,QAAA;wBAyBmB,mBACpB,QAAQ;EACN;EACA;IACD,QAAA;UAsBO;EACR;EACA;EACA;EACA;EACA;;wBAGoB,YAAY,QAAQ,oBAAiB;iBAwB1C;EACf;;EAEA;;;;;;EAMA;;wBAmBoB,cAAc,GAAG,iBAAiB,SAAS,uBAAoB,QAAA"}

package/dist/oauth2/provider/common.mjs

@@ -6,6 +6,7 @@ function createAuthorizationUri(options) {
 	url.searchParams.append("response_type", "code");
 	url.searchParams.append("client_id", options.clientId);
 	url.searchParams.append("state", options.state);
+	if (options.nonce) url.searchParams.append("nonce", options.nonce);
 	url.searchParams.append("scope", options.scope.join(" "));
 	url.searchParams.append("redirect_uri", options.redirectUri);
 	if (options.pkce) {

package/dist/oauth2/provider/common.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"common.mjs","names":[],"sources":["../../../src/oauth2/provider/common.ts"],"sourcesContent":["import { createRemoteJWKSet, jwtVerify } from 'jose';\nimport { OAuth2Error } from '../error';\nimport type { ExchangeCodeParams, PkceParameters, RefreshTokenParams } from '../types';\n\nexport function createAuthorizationUri(options: {\n  state: string;\n  scope: string[];\n  clientId: string;\n  redirectUri: string;\n  authorizationUri: string;\n  pkce?: Omit<PkceParameters, 'code_verifier'>;\n}) {\n  const url = new URL(options.authorizationUri);\n  url.searchParams.append('response_type', 'code');\n  url.searchParams.append('client_id', options.clientId);\n  url.searchParams.append('state', options.state);\n  url.searchParams.append('scope', options.scope.join(' '));\n  url.searchParams.append('redirect_uri', options.redirectUri);\n  if (options.pkce) {\n    url.searchParams.append('code_challenge_method', options.pkce.code_challenge_method);\n    url.searchParams.append('code_challenge', options.pkce.code_challenge);\n  }\n  return url;\n}\n\nexport async function exchangeAuthorizationCode(\n  params: ExchangeCodeParams & {\n    tokenUri: string;\n    authentication?: 'basic' | 'post';\n    /** Extra request headers some providers require, e.g. GitHub's `User-Agent`. */\n    headers?: Record<string, string>;\n  }\n) {\n  const body = new URLSearchParams();\n  body.append('code', params.code);\n  body.append('redirect_uri', params.redirectUri);\n  body.append('grant_type', 'authorization_code');\n  if (params.pkce) body.append('code_verifier', params.pkce.code_verifier);\n\n  const headers: Record<string, string> = {\n    ...params.headers,\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret ?? ''}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    // Public clients (Google's installed-app clients, PKCE-only clients) have no secret.\n    if (params.clientSecret) body.append('client_secret', params.clientSecret);\n  }\n\n  return fetch(params.tokenUri, { method: 'POST', headers, body });\n}\n\nexport async function refreshAccessToken(\n  params: RefreshTokenParams & {\n    tokenUri: string;\n    authentication?: 'basic' | 'post';\n  }\n) {\n  const body = new URLSearchParams();\n  body.append('grant_type', 'refresh_token');\n  body.append('refresh_token', params.refreshToken);\n\n  const headers: Record<string, string> = {\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret ?? ''}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    if (params.clientSecret) body.append('client_secret', params.clientSecret);\n  }\n\n  return fetch(params.tokenUri, { method: 'POST', headers, body });\n}\n\ninterface RevokeTokenParams {\n  token: string;\n  clientId: string;\n  clientSecret?: string;\n  tokenRevokeUri: string;\n  authentication?: 'basic' | 'post';\n}\n\nexport async function revokeToken(params: RevokeTokenParams) {\n  const body = new URLSearchParams();\n  body.append('token', params.token);\n  const headers: Record<string, string> = {\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret ?? ''}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    if (params.clientSecret) body.append('client_secret', params.clientSecret);\n  }\n\n  const response = await fetch(params.tokenRevokeUri, { method: 'POST', headers, body });\n  if (!response.ok) {\n    const error = await response.json();\n    console.error('Revoke token error:', error);\n    throw new OAuth2Error(response.status, 'invalid_request', 'Failed to revoke token');\n  }\n}\n\nexport interface VerifyIdTokenOptions {\n  jwkSetUri: string;\n  /** The `iss` values the provider signs with; anything else is refused. */\n  issuer: string | string[];\n  /**\n   * The client the token must be issued to. An id token proves who the user is only to the client\n   * it names in `aud`: any other app on the same identity provider can obtain a validly signed one\n   * for the same user, so a token for a foreign client must never sign anyone in here.\n   */\n  audience: string;\n}\n\n/**\n * One key set per JWKS endpoint for the life of the process: jose caches the fetched keys,\n * refetches on an unknown `kid` (with a cooldown) and when they go stale, so a set created per\n * call would refetch the keys for every id token.\n */\nconst jwkSets = new Map<string, ReturnType<typeof createRemoteJWKSet>>();\n\nfunction remoteJWKSet(jwkSetUri: string) {\n  let jwks = jwkSets.get(jwkSetUri);\n  if (!jwks) {\n    jwks = createRemoteJWKSet(new URL(jwkSetUri));\n    jwkSets.set(jwkSetUri, jwks);\n  }\n  return jwks;\n}\n\nexport async function verifyIdToken<T>(idToken: string, options: VerifyIdTokenOptions) {\n  const { jwkSetUri, issuer, audience } = options;\n  try {\n    const jwks = remoteJWKSet(jwkSetUri);\n    const { payload } = await jwtVerify(idToken, jwks, { issuer, audience });\n    return payload as T;\n  } catch (error) {\n    console.error('Failed to verify id_token', error);\n    // The token is the grant here: one for another audience or issuer is an invalid grant, not a\n    // malformed request.\n    throw new OAuth2Error(400, 'invalid_grant', 'Failed to verify id_token');\n  }\n}\n"],"mappings":";;;AAIA,SAAgB,uBAAuB,SAOpC;CACD,MAAM,MAAM,IAAI,IAAI,QAAQ,gBAAgB;CAC5C,IAAI,aAAa,OAAO,iBAAiB,MAAM;CAC/C,IAAI,aAAa,OAAO,aAAa,QAAQ,QAAQ;CACrD,IAAI,aAAa,OAAO,SAAS,QAAQ,KAAK;CAC9C,IAAI,aAAa,OAAO,SAAS,QAAQ,MAAM,KAAK,GAAG,CAAC;CACxD,IAAI,aAAa,OAAO,gBAAgB,QAAQ,WAAW;CAC3D,IAAI,QAAQ,MAAM;EAChB,IAAI,aAAa,OAAO,yBAAyB,QAAQ,KAAK,qBAAqB;EACnF,IAAI,aAAa,OAAO,kBAAkB,QAAQ,KAAK,cAAc;CACvE;CACA,OAAO;AACT;AAEA,eAAsB,0BACpB,QAMA;CACA,MAAM,OAAO,IAAI,gBAAgB;CACjC,KAAK,OAAO,QAAQ,OAAO,IAAI;CAC/B,KAAK,OAAO,gBAAgB,OAAO,WAAW;CAC9C,KAAK,OAAO,cAAc,oBAAoB;CAC9C,IAAI,OAAO,MAAM,KAAK,OAAO,iBAAiB,OAAO,KAAK,aAAa;CAEvE,MAAM,UAAkC;EACtC,GAAG,OAAO;EACV,QAAQ;EACR,gBAAgB;CAClB;CACA,IAAI,OAAO,mBAAmB,SAE5B,QAAQ,gBAAgB,SADV,OAAO,KAAK,GAAG,OAAO,SAAS,GAAG,OAAO,gBAAgB,IAAI,CAAC,CAAC,SAAS,QACjD;MAChC;EACL,KAAK,OAAO,aAAa,OAAO,QAAQ;EAExC,IAAI,OAAO,cAAc,KAAK,OAAO,iBAAiB,OAAO,YAAY;CAC3E;CAEA,OAAO,MAAM,OAAO,UAAU;EAAE,QAAQ;EAAQ;EAAS;CAAK,CAAC;AACjE;AAEA,eAAsB,mBACpB,QAIA;CACA,MAAM,OAAO,IAAI,gBAAgB;CACjC,KAAK,OAAO,cAAc,eAAe;CACzC,KAAK,OAAO,iBAAiB,OAAO,YAAY;CAEhD,MAAM,UAAkC;EACtC,QAAQ;EACR,gBAAgB;CAClB;CAEA,IAAI,OAAO,mBAAmB,SAE5B,QAAQ,gBAAgB,SADV,OAAO,KAAK,GAAG,OAAO,SAAS,GAAG,OAAO,gBAAgB,IAAI,CAAC,CAAC,SAAS,QACjD;MAChC;EACL,KAAK,OAAO,aAAa,OAAO,QAAQ;EACxC,IAAI,OAAO,cAAc,KAAK,OAAO,iBAAiB,OAAO,YAAY;CAC3E;CAEA,OAAO,MAAM,OAAO,UAAU;EAAE,QAAQ;EAAQ;EAAS;CAAK,CAAC;AACjE;AAUA,eAAsB,YAAY,QAA2B;CAC3D,MAAM,OAAO,IAAI,gBAAgB;CACjC,KAAK,OAAO,SAAS,OAAO,KAAK;CACjC,MAAM,UAAkC;EACtC,QAAQ;EACR,gBAAgB;CAClB;CAEA,IAAI,OAAO,mBAAmB,SAE5B,QAAQ,gBAAgB,SADV,OAAO,KAAK,GAAG,OAAO,SAAS,GAAG,OAAO,gBAAgB,IAAI,CAAC,CAAC,SAAS,QACjD;MAChC;EACL,KAAK,OAAO,aAAa,OAAO,QAAQ;EACxC,IAAI,OAAO,cAAc,KAAK,OAAO,iBAAiB,OAAO,YAAY;CAC3E;CAEA,MAAM,WAAW,MAAM,MAAM,OAAO,gBAAgB;EAAE,QAAQ;EAAQ;EAAS;CAAK,CAAC;CACrF,IAAI,CAAC,SAAS,IAAI;EAChB,MAAM,QAAQ,MAAM,SAAS,KAAK;EAClC,QAAQ,MAAM,uBAAuB,KAAK;EAC1C,MAAM,IAAI,YAAY,SAAS,QAAQ,mBAAmB,wBAAwB;CACpF;AACF;;;;;;AAmBA,MAAM,0BAAU,IAAI,IAAmD;AAEvE,SAAS,aAAa,WAAmB;CACvC,IAAI,OAAO,QAAQ,IAAI,SAAS;CAChC,IAAI,CAAC,MAAM;EACT,OAAO,mBAAmB,IAAI,IAAI,SAAS,CAAC;EAC5C,QAAQ,IAAI,WAAW,IAAI;CAC7B;CACA,OAAO;AACT;AAEA,eAAsB,cAAiB,SAAiB,SAA+B;CACrF,MAAM,EAAE,WAAW,QAAQ,aAAa;CACxC,IAAI;EACF,MAAM,OAAO,aAAa,SAAS;EACnC,MAAM,EAAE,YAAY,MAAM,UAAU,SAAS,MAAM;GAAE;GAAQ;EAAS,CAAC;EACvE,OAAO;CACT,SAAS,OAAO;EACd,QAAQ,MAAM,6BAA6B,KAAK;EAGhD,MAAM,IAAI,YAAY,KAAK,iBAAiB,2BAA2B;CACzE;AACF"}
+{"version":3,"file":"common.mjs","names":[],"sources":["../../../src/oauth2/provider/common.ts"],"sourcesContent":["import { createRemoteJWKSet, jwtVerify } from 'jose';\nimport { OAuth2Error } from '../error';\nimport type { ExchangeCodeParams, PkceParameters, RefreshTokenParams } from '../types';\n\nexport function createAuthorizationUri(options: {\n  state: string;\n  scope: string[];\n  clientId: string;\n  redirectUri: string;\n  authorizationUri: string;\n  pkce?: Omit<PkceParameters, 'code_verifier'>;\n  nonce?: string;\n}) {\n  const url = new URL(options.authorizationUri);\n  url.searchParams.append('response_type', 'code');\n  url.searchParams.append('client_id', options.clientId);\n  url.searchParams.append('state', options.state);\n  if (options.nonce) url.searchParams.append('nonce', options.nonce);\n  url.searchParams.append('scope', options.scope.join(' '));\n  url.searchParams.append('redirect_uri', options.redirectUri);\n  if (options.pkce) {\n    url.searchParams.append('code_challenge_method', options.pkce.code_challenge_method);\n    url.searchParams.append('code_challenge', options.pkce.code_challenge);\n  }\n  return url;\n}\n\nexport async function exchangeAuthorizationCode(\n  params: ExchangeCodeParams & {\n    tokenUri: string;\n    authentication?: 'basic' | 'post';\n    /** Extra request headers some providers require, e.g. GitHub's `User-Agent`. */\n    headers?: Record<string, string>;\n  }\n) {\n  const body = new URLSearchParams();\n  body.append('code', params.code);\n  body.append('redirect_uri', params.redirectUri);\n  body.append('grant_type', 'authorization_code');\n  if (params.pkce) body.append('code_verifier', params.pkce.code_verifier);\n\n  const headers: Record<string, string> = {\n    ...params.headers,\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret ?? ''}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    // Public clients (Google's installed-app clients, PKCE-only clients) have no secret.\n    if (params.clientSecret) body.append('client_secret', params.clientSecret);\n  }\n\n  return fetch(params.tokenUri, { method: 'POST', headers, body });\n}\n\nexport async function refreshAccessToken(\n  params: RefreshTokenParams & {\n    tokenUri: string;\n    authentication?: 'basic' | 'post';\n  }\n) {\n  const body = new URLSearchParams();\n  body.append('grant_type', 'refresh_token');\n  body.append('refresh_token', params.refreshToken);\n\n  const headers: Record<string, string> = {\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret ?? ''}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    if (params.clientSecret) body.append('client_secret', params.clientSecret);\n  }\n\n  return fetch(params.tokenUri, { method: 'POST', headers, body });\n}\n\ninterface RevokeTokenParams {\n  token: string;\n  clientId: string;\n  clientSecret?: string;\n  tokenRevokeUri: string;\n  authentication?: 'basic' | 'post';\n}\n\nexport async function revokeToken(params: RevokeTokenParams) {\n  const body = new URLSearchParams();\n  body.append('token', params.token);\n  const headers: Record<string, string> = {\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret ?? ''}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    if (params.clientSecret) body.append('client_secret', params.clientSecret);\n  }\n\n  const response = await fetch(params.tokenRevokeUri, { method: 'POST', headers, body });\n  if (!response.ok) {\n    const error = await response.json();\n    console.error('Revoke token error:', error);\n    throw new OAuth2Error(response.status, 'invalid_request', 'Failed to revoke token');\n  }\n}\n\nexport interface VerifyIdTokenOptions {\n  jwkSetUri: string;\n  /** The `iss` values the provider signs with; anything else is refused. */\n  issuer: string | string[];\n  /**\n   * The client the token must be issued to. An id token proves who the user is only to the client\n   * it names in `aud`: any other app on the same identity provider can obtain a validly signed one\n   * for the same user, so a token for a foreign client must never sign anyone in here.\n   */\n  audience: string;\n}\n\n/**\n * One key set per JWKS endpoint for the life of the process: jose caches the fetched keys,\n * refetches on an unknown `kid` (with a cooldown) and when they go stale, so a set created per\n * call would refetch the keys for every id token.\n */\nconst jwkSets = new Map<string, ReturnType<typeof createRemoteJWKSet>>();\n\nfunction remoteJWKSet(jwkSetUri: string) {\n  let jwks = jwkSets.get(jwkSetUri);\n  if (!jwks) {\n    jwks = createRemoteJWKSet(new URL(jwkSetUri));\n    jwkSets.set(jwkSetUri, jwks);\n  }\n  return jwks;\n}\n\nexport async function verifyIdToken<T>(idToken: string, options: VerifyIdTokenOptions) {\n  const { jwkSetUri, issuer, audience } = options;\n  try {\n    const jwks = remoteJWKSet(jwkSetUri);\n    const { payload } = await jwtVerify(idToken, jwks, { issuer, audience });\n    return payload as T;\n  } catch (error) {\n    console.error('Failed to verify id_token', error);\n    // The token is the grant here: one for another audience or issuer is an invalid grant, not a\n    // malformed request.\n    throw new OAuth2Error(400, 'invalid_grant', 'Failed to verify id_token');\n  }\n}\n"],"mappings":";;;AAIA,SAAgB,uBAAuB,SAQpC;CACD,MAAM,MAAM,IAAI,IAAI,QAAQ,gBAAgB;CAC5C,IAAI,aAAa,OAAO,iBAAiB,MAAM;CAC/C,IAAI,aAAa,OAAO,aAAa,QAAQ,QAAQ;CACrD,IAAI,aAAa,OAAO,SAAS,QAAQ,KAAK;CAC9C,IAAI,QAAQ,OAAO,IAAI,aAAa,OAAO,SAAS,QAAQ,KAAK;CACjE,IAAI,aAAa,OAAO,SAAS,QAAQ,MAAM,KAAK,GAAG,CAAC;CACxD,IAAI,aAAa,OAAO,gBAAgB,QAAQ,WAAW;CAC3D,IAAI,QAAQ,MAAM;EAChB,IAAI,aAAa,OAAO,yBAAyB,QAAQ,KAAK,qBAAqB;EACnF,IAAI,aAAa,OAAO,kBAAkB,QAAQ,KAAK,cAAc;CACvE;CACA,OAAO;AACT;AAEA,eAAsB,0BACpB,QAMA;CACA,MAAM,OAAO,IAAI,gBAAgB;CACjC,KAAK,OAAO,QAAQ,OAAO,IAAI;CAC/B,KAAK,OAAO,gBAAgB,OAAO,WAAW;CAC9C,KAAK,OAAO,cAAc,oBAAoB;CAC9C,IAAI,OAAO,MAAM,KAAK,OAAO,iBAAiB,OAAO,KAAK,aAAa;CAEvE,MAAM,UAAkC;EACtC,GAAG,OAAO;EACV,QAAQ;EACR,gBAAgB;CAClB;CACA,IAAI,OAAO,mBAAmB,SAE5B,QAAQ,gBAAgB,SADV,OAAO,KAAK,GAAG,OAAO,SAAS,GAAG,OAAO,gBAAgB,IAAI,CAAC,CAAC,SAAS,QACjD;MAChC;EACL,KAAK,OAAO,aAAa,OAAO,QAAQ;EAExC,IAAI,OAAO,cAAc,KAAK,OAAO,iBAAiB,OAAO,YAAY;CAC3E;CAEA,OAAO,MAAM,OAAO,UAAU;EAAE,QAAQ;EAAQ;EAAS;CAAK,CAAC;AACjE;AAEA,eAAsB,mBACpB,QAIA;CACA,MAAM,OAAO,IAAI,gBAAgB;CACjC,KAAK,OAAO,cAAc,eAAe;CACzC,KAAK,OAAO,iBAAiB,OAAO,YAAY;CAEhD,MAAM,UAAkC;EACtC,QAAQ;EACR,gBAAgB;CAClB;CAEA,IAAI,OAAO,mBAAmB,SAE5B,QAAQ,gBAAgB,SADV,OAAO,KAAK,GAAG,OAAO,SAAS,GAAG,OAAO,gBAAgB,IAAI,CAAC,CAAC,SAAS,QACjD;MAChC;EACL,KAAK,OAAO,aAAa,OAAO,QAAQ;EACxC,IAAI,OAAO,cAAc,KAAK,OAAO,iBAAiB,OAAO,YAAY;CAC3E;CAEA,OAAO,MAAM,OAAO,UAAU;EAAE,QAAQ;EAAQ;EAAS;CAAK,CAAC;AACjE;AAUA,eAAsB,YAAY,QAA2B;CAC3D,MAAM,OAAO,IAAI,gBAAgB;CACjC,KAAK,OAAO,SAAS,OAAO,KAAK;CACjC,MAAM,UAAkC;EACtC,QAAQ;EACR,gBAAgB;CAClB;CAEA,IAAI,OAAO,mBAAmB,SAE5B,QAAQ,gBAAgB,SADV,OAAO,KAAK,GAAG,OAAO,SAAS,GAAG,OAAO,gBAAgB,IAAI,CAAC,CAAC,SAAS,QACjD;MAChC;EACL,KAAK,OAAO,aAAa,OAAO,QAAQ;EACxC,IAAI,OAAO,cAAc,KAAK,OAAO,iBAAiB,OAAO,YAAY;CAC3E;CAEA,MAAM,WAAW,MAAM,MAAM,OAAO,gBAAgB;EAAE,QAAQ;EAAQ;EAAS;CAAK,CAAC;CACrF,IAAI,CAAC,SAAS,IAAI;EAChB,MAAM,QAAQ,MAAM,SAAS,KAAK;EAClC,QAAQ,MAAM,uBAAuB,KAAK;EAC1C,MAAM,IAAI,YAAY,SAAS,QAAQ,mBAAmB,wBAAwB;CACpF;AACF;;;;;;AAmBA,MAAM,0BAAU,IAAI,IAAmD;AAEvE,SAAS,aAAa,WAAmB;CACvC,IAAI,OAAO,QAAQ,IAAI,SAAS;CAChC,IAAI,CAAC,MAAM;EACT,OAAO,mBAAmB,IAAI,IAAI,SAAS,CAAC;EAC5C,QAAQ,IAAI,WAAW,IAAI;CAC7B;CACA,OAAO;AACT;AAEA,eAAsB,cAAiB,SAAiB,SAA+B;CACrF,MAAM,EAAE,WAAW,QAAQ,aAAa;CACxC,IAAI;EACF,MAAM,OAAO,aAAa,SAAS;EACnC,MAAM,EAAE,YAAY,MAAM,UAAU,SAAS,MAAM;GAAE;GAAQ;EAAS,CAAC;EACvE,OAAO;CACT,SAAS,OAAO;EACd,QAAQ,MAAM,6BAA6B,KAAK;EAGhD,MAAM,IAAI,YAAY,KAAK,iBAAiB,2BAA2B;CACzE;AACF"}

package/dist/oauth2/provider/facebook.cjs

@@ -21,6 +21,10 @@ function createFacebookProvider() {
 		jwkSetUri: "https://limited.facebook.com/.well-known/oauth/openid/jwks/",
 		userNameAttribute: "id",
 		defaultScope: ["profile", "email"],
+		nonce: {
+			web: false,
+			native: true
+		},
 		createAuthorizationUri({ pkce: _, ...params }) {
 			return require_oauth2_provider_common.createAuthorizationUri({
 				...params,

package/dist/oauth2/provider/facebook.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"facebook.cjs","names":["createAuthorizationUri","exchangeAuthorizationCode","OAuth2Error","verifyIdToken","createHmac"],"sources":["../../../src/oauth2/provider/facebook.ts"],"sourcesContent":["import { createHmac } from 'node:crypto';\nimport { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport type { LoginOAuth2NativeParams, OAuth2Token, Provider, UserInfo } from '../types';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\n/**\n * `iss` of Limited Login id tokens, per https://limited.facebook.com/.well-known/openid-configuration/\n * (their `aud` is the app id).\n */\nconst FACEBOOK_ISSUER = 'https://www.facebook.com';\n\n/**\n * ref: https://developers.facebook.com/docs/facebook-login/guides/advanced/manual-flow/\n * ref: https://developers.facebook.com/tools/explorer\n * */\nexport function createFacebookProvider(): Provider {\n  return {\n    authorizationUri: 'https://www.facebook.com/v21.0/dialog/oauth',\n    tokenUri: 'https://graph.facebook.com/v19.0/oauth/access_token',\n    userInfoUri: 'https://graph.facebook.com/me',\n    jwkSetUri: 'https://limited.facebook.com/.well-known/oauth/openid/jwks/',\n    userNameAttribute: 'id',\n    defaultScope: ['profile', 'email'],\n    createAuthorizationUri({ pkce: _, ...params }) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode({ pkce: _, ...params }) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error } = (await response.json()) as FacebookErrorResponse;\n        throw new OAuth2Error(response.status, 'invalid_request', error.message);\n      }\n      return (await response.json()) as FacebookToken;\n    },\n    async getUserInfo({ id_token, access_token }, { clientId }) {\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      if (id_token) {\n        const data = await verifyIdToken<FacebookDecodedIdToken>(id_token, {\n          jwkSetUri: this.jwkSetUri,\n          issuer: FACEBOOK_ISSUER,\n          audience: clientId,\n        });\n        return {\n          data,\n          claims: {\n            sub: data.sub,\n            name: data.name,\n            picture: data.picture,\n            email: data.email,\n            // Facebook does not say whether the address is verified: left unset, so a host that\n            // trusts only `email_verified === true` treats it as unverified.\n          },\n        };\n      }\n      invariant(access_token, 'access_token is required');\n      invariant(this.userInfoUri, 'userInfoUri is required');\n      return fetchUserInfo(this.userInfoUri, access_token);\n    },\n    async loginOAuth2Native({ clientId, clientSecret, credentials }: LoginOAuth2NativeParams) {\n      const { id_token, access_token } = credentials;\n      let userInfo: UserInfo;\n      if (id_token) {\n        // Limited Login: the id token's `aud` must be this app.\n        userInfo = await this.getUserInfo(\n          { token_type: 'bearer', access_token: '', id_token },\n          {\n            clientId,\n          }\n        );\n      } else if (access_token) {\n        // The Graph API serves any app's user access token, so `/me` alone would accept a token a\n        // foreign app obtained for the same user. With `appsecret_proof` Facebook refuses tokens\n        // not issued to the app whose secret signed the proof, binding the token to this client.\n        if (!clientSecret) {\n          throw new OAuth2Error(400, 'invalid_client', 'access_token login needs the app secret');\n        }\n        invariant(this.userInfoUri, 'userInfoUri is required');\n        const proof = createHmac('sha256', clientSecret).update(access_token).digest('hex');\n        userInfo = await fetchUserInfo(this.userInfoUri, access_token, proof);\n      } else {\n        throw new OAuth2Error(400, 'invalid_request', 'id_token or access_token is required');\n      }\n      const token: OAuth2Token = {\n        token_type: 'bearer',\n        access_token: access_token ?? '',\n        id_token,\n      };\n      return { token, userInfo };\n    },\n  };\n}\n\nexport const facebook = createFacebookProvider();\n\nasync function fetchUserInfo(\n  userInfoUri: string,\n  accessToken: string,\n  appSecretProof?: string\n): Promise<UserInfo<FacebookUserInfo>> {\n  const url = new URL(userInfoUri);\n  const fields = ['id', 'name', 'email', 'picture.width(320).height(320)'];\n  url.searchParams.append('access_token', accessToken);\n  url.searchParams.append('fields', fields.join(','));\n  if (appSecretProof) url.searchParams.append('appsecret_proof', appSecretProof);\n  const headers = { Accept: 'application/json' };\n  const response = await fetch(url.href, { headers });\n  if (!response.ok) {\n    throw new OAuth2Error(response.status, 'invalid_request', 'Failed to fetch user info');\n  }\n  const data = (await response.json()) as FacebookUserInfo;\n  return {\n    data,\n    claims: {\n      sub: data.id,\n      name: data.name,\n      email: data.email,\n      picture: data.picture.data.url,\n      // Not stated by the Graph API either; see the Limited Login path above.\n    },\n  };\n}\n\nexport interface FacebookDecodedIdToken {\n  sub: string;\n  name: string;\n  email: string;\n  picture: string;\n  nonce?: string;\n}\n\nexport interface FacebookUserInfo {\n  id: string;\n  name: string;\n  email: string;\n  picture: {\n    data: {\n      url: string;\n      width: number;\n      height: number;\n      is_silhouette: boolean;\n    };\n  };\n}\n\nexport interface FacebookToken extends OAuth2Token {\n  access_token: string;\n  token_type: 'bearer';\n  expires_in: number;\n  id_token?: string;\n}\n\nexport type FacebookAppCredential =\n  | { state: string; id_token: string } // platform=ios and tracking=limited\n  | { state: string; access_token: string }; // tracking=enabled\n\ninterface FacebookErrorResponse {\n  error: {\n    message: string;\n    type: 'OAuthException';\n    code: number;\n    error_subcode: number;\n    fbtrace_id: string;\n  };\n}\n"],"mappings":";;;;;;;;;;AAUA,MAAM,kBAAkB;;;;;AAMxB,SAAgB,yBAAmC;CACjD,OAAO;EACL,kBAAkB;EAClB,UAAU;EACV,aAAa;EACb,WAAW;EACX,mBAAmB;EACnB,cAAc,CAAC,WAAW,OAAO;EACjC,uBAAuB,EAAE,MAAM,GAAG,GAAG,UAAU;GAC7C,OAAOA,+BAAAA,uBAAuB;IAC5B,GAAG;IACH,OAAO,OAAO,SAAS,KAAK;IAC5B,kBAAkB,KAAK;GACzB,CAAC;EACH;EACA,MAAM,0BAA0B,EAAE,MAAM,GAAG,GAAG,UAAU;GACtD,MAAM,WAAW,MAAMC,+BAAAA,0BAA0B;IAAE,GAAG;IAAQ,UAAU,KAAK;GAAS,CAAC;GACvF,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,UAAW,MAAM,SAAS,KAAK;IACvC,MAAM,IAAIC,qBAAAA,YAAY,SAAS,QAAQ,mBAAmB,MAAM,OAAO;GACzE;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,EAAE,UAAU,gBAAgB,EAAE,YAAY;GAC1D,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,WAAW,uBAAuB;GACjD,IAAI,UAAU;IACZ,MAAM,OAAO,MAAMC,+BAAAA,cAAsC,UAAU;KACjE,WAAW,KAAK;KAChB,QAAQ;KACR,UAAU;IACZ,CAAC;IACD,OAAO;KACL;KACA,QAAQ;MACN,KAAK,KAAK;MACV,MAAM,KAAK;MACX,SAAS,KAAK;MACd,OAAO,KAAK;KAGd;IACF;GACF;GACA,CAAA,GAAA,cAAA,UAAA,CAAU,cAAc,0BAA0B;GAClD,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,aAAa,yBAAyB;GACrD,OAAO,cAAc,KAAK,aAAa,YAAY;EACrD;EACA,MAAM,kBAAkB,EAAE,UAAU,cAAc,eAAwC;GACxF,MAAM,EAAE,UAAU,iBAAiB;GACnC,IAAI;GACJ,IAAI,UAEF,WAAW,MAAM,KAAK,YACpB;IAAE,YAAY;IAAU,cAAc;IAAI;GAAS,GACnD,EACE,SACF,CACF;QACK,IAAI,cAAc;IAIvB,IAAI,CAAC,cACH,MAAM,IAAID,qBAAAA,YAAY,KAAK,kBAAkB,yCAAyC;IAExF,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,aAAa,yBAAyB;IACrD,MAAM,SAAA,GAAQE,YAAAA,WAAAA,CAAW,UAAU,YAAY,CAAC,CAAC,OAAO,YAAY,CAAC,CAAC,OAAO,KAAK;IAClF,WAAW,MAAM,cAAc,KAAK,aAAa,cAAc,KAAK;GACtE,OACE,MAAM,IAAIF,qBAAAA,YAAY,KAAK,mBAAmB,sCAAsC;GAOtF,OAAO;IAAE,OAAA;KAJP,YAAY;KACZ,cAAc,gBAAgB;KAC9B;IAEW;IAAG;GAAS;EAC3B;CACF;AACF;AAEA,MAAa,WAAW,uBAAuB;AAE/C,eAAe,cACb,aACA,aACA,gBACqC;CACrC,MAAM,MAAM,IAAI,IAAI,WAAW;CAC/B,MAAM,SAAS;EAAC;EAAM;EAAQ;EAAS;CAAgC;CACvE,IAAI,aAAa,OAAO,gBAAgB,WAAW;CACnD,IAAI,aAAa,OAAO,UAAU,OAAO,KAAK,GAAG,CAAC;CAClD,IAAI,gBAAgB,IAAI,aAAa,OAAO,mBAAmB,cAAc;CAE7E,MAAM,WAAW,MAAM,MAAM,IAAI,MAAM,EAAE,SAAA,EADvB,QAAQ,mBACqB,EAAE,CAAC;CAClD,IAAI,CAAC,SAAS,IACZ,MAAM,IAAIA,qBAAAA,YAAY,SAAS,QAAQ,mBAAmB,2BAA2B;CAEvF,MAAM,OAAQ,MAAM,SAAS,KAAK;CAClC,OAAO;EACL;EACA,QAAQ;GACN,KAAK,KAAK;GACV,MAAM,KAAK;GACX,OAAO,KAAK;GACZ,SAAS,KAAK,QAAQ,KAAK;EAE7B;CACF;AACF"}
+{"version":3,"file":"facebook.cjs","names":["createAuthorizationUri","exchangeAuthorizationCode","OAuth2Error","verifyIdToken","createHmac"],"sources":["../../../src/oauth2/provider/facebook.ts"],"sourcesContent":["import { createHmac } from 'node:crypto';\nimport { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport type { LoginOAuth2NativeParams, OAuth2Token, Provider, UserInfo } from '../types';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\n/**\n * `iss` of Limited Login id tokens, per https://limited.facebook.com/.well-known/openid-configuration/\n * (their `aud` is the app id).\n */\nconst FACEBOOK_ISSUER = 'https://www.facebook.com';\n\n/**\n * ref: https://developers.facebook.com/docs/facebook-login/guides/advanced/manual-flow/\n * ref: https://developers.facebook.com/tools/explorer\n * */\nexport function createFacebookProvider(): Provider {\n  return {\n    authorizationUri: 'https://www.facebook.com/v21.0/dialog/oauth',\n    tokenUri: 'https://graph.facebook.com/v19.0/oauth/access_token',\n    userInfoUri: 'https://graph.facebook.com/me',\n    jwkSetUri: 'https://limited.facebook.com/.well-known/oauth/openid/jwks/',\n    userNameAttribute: 'id',\n    defaultScope: ['profile', 'email'],\n    // The web flow reads the Graph API, no id token; Limited Login's id token must carry the\n    // nonce the app set (an `access_token` login has no id token and is exempt).\n    nonce: { web: false, native: true },\n    createAuthorizationUri({ pkce: _, ...params }) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode({ pkce: _, ...params }) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error } = (await response.json()) as FacebookErrorResponse;\n        throw new OAuth2Error(response.status, 'invalid_request', error.message);\n      }\n      return (await response.json()) as FacebookToken;\n    },\n    async getUserInfo({ id_token, access_token }, { clientId }) {\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      if (id_token) {\n        const data = await verifyIdToken<FacebookDecodedIdToken>(id_token, {\n          jwkSetUri: this.jwkSetUri,\n          issuer: FACEBOOK_ISSUER,\n          audience: clientId,\n        });\n        return {\n          data,\n          claims: {\n            sub: data.sub,\n            name: data.name,\n            picture: data.picture,\n            email: data.email,\n            // Facebook does not say whether the address is verified: left unset, so a host that\n            // trusts only `email_verified === true` treats it as unverified.\n          },\n        };\n      }\n      invariant(access_token, 'access_token is required');\n      invariant(this.userInfoUri, 'userInfoUri is required');\n      return fetchUserInfo(this.userInfoUri, access_token);\n    },\n    async loginOAuth2Native({ clientId, clientSecret, credentials }: LoginOAuth2NativeParams) {\n      const { id_token, access_token } = credentials;\n      let userInfo: UserInfo;\n      if (id_token) {\n        // Limited Login: the id token's `aud` must be this app.\n        userInfo = await this.getUserInfo(\n          { token_type: 'bearer', access_token: '', id_token },\n          {\n            clientId,\n          }\n        );\n      } else if (access_token) {\n        // The Graph API serves any app's user access token, so `/me` alone would accept a token a\n        // foreign app obtained for the same user. With `appsecret_proof` Facebook refuses tokens\n        // not issued to the app whose secret signed the proof, binding the token to this client.\n        if (!clientSecret) {\n          throw new OAuth2Error(400, 'invalid_client', 'access_token login needs the app secret');\n        }\n        invariant(this.userInfoUri, 'userInfoUri is required');\n        const proof = createHmac('sha256', clientSecret).update(access_token).digest('hex');\n        userInfo = await fetchUserInfo(this.userInfoUri, access_token, proof);\n      } else {\n        throw new OAuth2Error(400, 'invalid_request', 'id_token or access_token is required');\n      }\n      const token: OAuth2Token = {\n        token_type: 'bearer',\n        access_token: access_token ?? '',\n        id_token,\n      };\n      return { token, userInfo };\n    },\n  };\n}\n\nexport const facebook = createFacebookProvider();\n\nasync function fetchUserInfo(\n  userInfoUri: string,\n  accessToken: string,\n  appSecretProof?: string\n): Promise<UserInfo<FacebookUserInfo>> {\n  const url = new URL(userInfoUri);\n  const fields = ['id', 'name', 'email', 'picture.width(320).height(320)'];\n  url.searchParams.append('access_token', accessToken);\n  url.searchParams.append('fields', fields.join(','));\n  if (appSecretProof) url.searchParams.append('appsecret_proof', appSecretProof);\n  const headers = { Accept: 'application/json' };\n  const response = await fetch(url.href, { headers });\n  if (!response.ok) {\n    throw new OAuth2Error(response.status, 'invalid_request', 'Failed to fetch user info');\n  }\n  const data = (await response.json()) as FacebookUserInfo;\n  return {\n    data,\n    claims: {\n      sub: data.id,\n      name: data.name,\n      email: data.email,\n      picture: data.picture.data.url,\n      // Not stated by the Graph API either; see the Limited Login path above.\n    },\n  };\n}\n\nexport interface FacebookDecodedIdToken {\n  sub: string;\n  name: string;\n  email: string;\n  picture: string;\n  nonce?: string;\n}\n\nexport interface FacebookUserInfo {\n  id: string;\n  name: string;\n  email: string;\n  picture: {\n    data: {\n      url: string;\n      width: number;\n      height: number;\n      is_silhouette: boolean;\n    };\n  };\n}\n\nexport interface FacebookToken extends OAuth2Token {\n  access_token: string;\n  token_type: 'bearer';\n  expires_in: number;\n  id_token?: string;\n}\n\nexport type FacebookAppCredential =\n  | { state: string; id_token: string } // platform=ios and tracking=limited\n  | { state: string; access_token: string }; // tracking=enabled\n\ninterface FacebookErrorResponse {\n  error: {\n    message: string;\n    type: 'OAuthException';\n    code: number;\n    error_subcode: number;\n    fbtrace_id: string;\n  };\n}\n"],"mappings":";;;;;;;;;;AAUA,MAAM,kBAAkB;;;;;AAMxB,SAAgB,yBAAmC;CACjD,OAAO;EACL,kBAAkB;EAClB,UAAU;EACV,aAAa;EACb,WAAW;EACX,mBAAmB;EACnB,cAAc,CAAC,WAAW,OAAO;EAGjC,OAAO;GAAE,KAAK;GAAO,QAAQ;EAAK;EAClC,uBAAuB,EAAE,MAAM,GAAG,GAAG,UAAU;GAC7C,OAAOA,+BAAAA,uBAAuB;IAC5B,GAAG;IACH,OAAO,OAAO,SAAS,KAAK;IAC5B,kBAAkB,KAAK;GACzB,CAAC;EACH;EACA,MAAM,0BAA0B,EAAE,MAAM,GAAG,GAAG,UAAU;GACtD,MAAM,WAAW,MAAMC,+BAAAA,0BAA0B;IAAE,GAAG;IAAQ,UAAU,KAAK;GAAS,CAAC;GACvF,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,UAAW,MAAM,SAAS,KAAK;IACvC,MAAM,IAAIC,qBAAAA,YAAY,SAAS,QAAQ,mBAAmB,MAAM,OAAO;GACzE;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,EAAE,UAAU,gBAAgB,EAAE,YAAY;GAC1D,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,WAAW,uBAAuB;GACjD,IAAI,UAAU;IACZ,MAAM,OAAO,MAAMC,+BAAAA,cAAsC,UAAU;KACjE,WAAW,KAAK;KAChB,QAAQ;KACR,UAAU;IACZ,CAAC;IACD,OAAO;KACL;KACA,QAAQ;MACN,KAAK,KAAK;MACV,MAAM,KAAK;MACX,SAAS,KAAK;MACd,OAAO,KAAK;KAGd;IACF;GACF;GACA,CAAA,GAAA,cAAA,UAAA,CAAU,cAAc,0BAA0B;GAClD,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,aAAa,yBAAyB;GACrD,OAAO,cAAc,KAAK,aAAa,YAAY;EACrD;EACA,MAAM,kBAAkB,EAAE,UAAU,cAAc,eAAwC;GACxF,MAAM,EAAE,UAAU,iBAAiB;GACnC,IAAI;GACJ,IAAI,UAEF,WAAW,MAAM,KAAK,YACpB;IAAE,YAAY;IAAU,cAAc;IAAI;GAAS,GACnD,EACE,SACF,CACF;QACK,IAAI,cAAc;IAIvB,IAAI,CAAC,cACH,MAAM,IAAID,qBAAAA,YAAY,KAAK,kBAAkB,yCAAyC;IAExF,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,aAAa,yBAAyB;IACrD,MAAM,SAAA,GAAQE,YAAAA,WAAAA,CAAW,UAAU,YAAY,CAAC,CAAC,OAAO,YAAY,CAAC,CAAC,OAAO,KAAK;IAClF,WAAW,MAAM,cAAc,KAAK,aAAa,cAAc,KAAK;GACtE,OACE,MAAM,IAAIF,qBAAAA,YAAY,KAAK,mBAAmB,sCAAsC;GAOtF,OAAO;IAAE,OAAA;KAJP,YAAY;KACZ,cAAc,gBAAgB;KAC9B;IAEW;IAAG;GAAS;EAC3B;CACF;AACF;AAEA,MAAa,WAAW,uBAAuB;AAE/C,eAAe,cACb,aACA,aACA,gBACqC;CACrC,MAAM,MAAM,IAAI,IAAI,WAAW;CAC/B,MAAM,SAAS;EAAC;EAAM;EAAQ;EAAS;CAAgC;CACvE,IAAI,aAAa,OAAO,gBAAgB,WAAW;CACnD,IAAI,aAAa,OAAO,UAAU,OAAO,KAAK,GAAG,CAAC;CAClD,IAAI,gBAAgB,IAAI,aAAa,OAAO,mBAAmB,cAAc;CAE7E,MAAM,WAAW,MAAM,MAAM,IAAI,MAAM,EAAE,SAAA,EADvB,QAAQ,mBACqB,EAAE,CAAC;CAClD,IAAI,CAAC,SAAS,IACZ,MAAM,IAAIA,qBAAAA,YAAY,SAAS,QAAQ,mBAAmB,2BAA2B;CAEvF,MAAM,OAAQ,MAAM,SAAS,KAAK;CAClC,OAAO;EACL;EACA,QAAQ;GACN,KAAK,KAAK;GACV,MAAM,KAAK;GACX,OAAO,KAAK;GACZ,SAAS,KAAK,QAAQ,KAAK;EAE7B;CACF;AACF"}

package/dist/oauth2/provider/facebook.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"facebook.d.cts","names":[],"sources":["../../../src/oauth2/provider/facebook.ts"],"mappings":";;;;;wBAgBgB,0BAA0B;qBAiF7B,UAAQ;iBA8BJ;EACf;EACA;EACA;EACA;EACA;;iBAGe;EACf;EACA;EACA;EACA;IACE;MACE;MACA;MACA;MACA;;;;iBAKW,sBAAsB;EACrC;EACA;EACA;EACA;;YAGU;EACN;EAAe;;EACf;EAAe"}
+{"version":3,"file":"facebook.d.cts","names":[],"sources":["../../../src/oauth2/provider/facebook.ts"],"mappings":";;;;;wBAgBgB,0BAA0B;qBAoF7B,UAAQ;iBA8BJ;EACf;EACA;EACA;EACA;EACA;;iBAGe;EACf;EACA;EACA;EACA;IACE;MACE;MACA;MACA;MACA;;;;iBAKW,sBAAsB;EACrC;EACA;EACA;EACA;;YAGU;EACN;EAAe;;EACf;EAAe"}

package/dist/oauth2/provider/facebook.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"facebook.d.mts","names":[],"sources":["../../../src/oauth2/provider/facebook.ts"],"mappings":";;;;;wBAgBgB,0BAA0B;qBAiF7B,UAAQ;iBA8BJ;EACf;EACA;EACA;EACA;EACA;;iBAGe;EACf;EACA;EACA;EACA;IACE;MACE;MACA;MACA;MACA;;;;iBAKW,sBAAsB;EACrC;EACA;EACA;EACA;;YAGU;EACN;EAAe;;EACf;EAAe"}
+{"version":3,"file":"facebook.d.mts","names":[],"sources":["../../../src/oauth2/provider/facebook.ts"],"mappings":";;;;;wBAgBgB,0BAA0B;qBAoF7B,UAAQ;iBA8BJ;EACf;EACA;EACA;EACA;EACA;;iBAGe;EACf;EACA;EACA;EACA;IACE;MACE;MACA;MACA;MACA;;;;iBAKW,sBAAsB;EACrC;EACA;EACA;EACA;;YAGU;EACN;EAAe;;EACf;EAAe"}

package/dist/oauth2/provider/facebook.mjs

@@ -20,6 +20,10 @@ function createFacebookProvider() {
 		jwkSetUri: "https://limited.facebook.com/.well-known/oauth/openid/jwks/",
 		userNameAttribute: "id",
 		defaultScope: ["profile", "email"],
+		nonce: {
+			web: false,
+			native: true
+		},
 		createAuthorizationUri({ pkce: _, ...params }) {
 			return createAuthorizationUri({
 				...params,

package/dist/oauth2/provider/facebook.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"facebook.mjs","names":[],"sources":["../../../src/oauth2/provider/facebook.ts"],"sourcesContent":["import { createHmac } from 'node:crypto';\nimport { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport type { LoginOAuth2NativeParams, OAuth2Token, Provider, UserInfo } from '../types';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\n/**\n * `iss` of Limited Login id tokens, per https://limited.facebook.com/.well-known/openid-configuration/\n * (their `aud` is the app id).\n */\nconst FACEBOOK_ISSUER = 'https://www.facebook.com';\n\n/**\n * ref: https://developers.facebook.com/docs/facebook-login/guides/advanced/manual-flow/\n * ref: https://developers.facebook.com/tools/explorer\n * */\nexport function createFacebookProvider(): Provider {\n  return {\n    authorizationUri: 'https://www.facebook.com/v21.0/dialog/oauth',\n    tokenUri: 'https://graph.facebook.com/v19.0/oauth/access_token',\n    userInfoUri: 'https://graph.facebook.com/me',\n    jwkSetUri: 'https://limited.facebook.com/.well-known/oauth/openid/jwks/',\n    userNameAttribute: 'id',\n    defaultScope: ['profile', 'email'],\n    createAuthorizationUri({ pkce: _, ...params }) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode({ pkce: _, ...params }) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error } = (await response.json()) as FacebookErrorResponse;\n        throw new OAuth2Error(response.status, 'invalid_request', error.message);\n      }\n      return (await response.json()) as FacebookToken;\n    },\n    async getUserInfo({ id_token, access_token }, { clientId }) {\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      if (id_token) {\n        const data = await verifyIdToken<FacebookDecodedIdToken>(id_token, {\n          jwkSetUri: this.jwkSetUri,\n          issuer: FACEBOOK_ISSUER,\n          audience: clientId,\n        });\n        return {\n          data,\n          claims: {\n            sub: data.sub,\n            name: data.name,\n            picture: data.picture,\n            email: data.email,\n            // Facebook does not say whether the address is verified: left unset, so a host that\n            // trusts only `email_verified === true` treats it as unverified.\n          },\n        };\n      }\n      invariant(access_token, 'access_token is required');\n      invariant(this.userInfoUri, 'userInfoUri is required');\n      return fetchUserInfo(this.userInfoUri, access_token);\n    },\n    async loginOAuth2Native({ clientId, clientSecret, credentials }: LoginOAuth2NativeParams) {\n      const { id_token, access_token } = credentials;\n      let userInfo: UserInfo;\n      if (id_token) {\n        // Limited Login: the id token's `aud` must be this app.\n        userInfo = await this.getUserInfo(\n          { token_type: 'bearer', access_token: '', id_token },\n          {\n            clientId,\n          }\n        );\n      } else if (access_token) {\n        // The Graph API serves any app's user access token, so `/me` alone would accept a token a\n        // foreign app obtained for the same user. With `appsecret_proof` Facebook refuses tokens\n        // not issued to the app whose secret signed the proof, binding the token to this client.\n        if (!clientSecret) {\n          throw new OAuth2Error(400, 'invalid_client', 'access_token login needs the app secret');\n        }\n        invariant(this.userInfoUri, 'userInfoUri is required');\n        const proof = createHmac('sha256', clientSecret).update(access_token).digest('hex');\n        userInfo = await fetchUserInfo(this.userInfoUri, access_token, proof);\n      } else {\n        throw new OAuth2Error(400, 'invalid_request', 'id_token or access_token is required');\n      }\n      const token: OAuth2Token = {\n        token_type: 'bearer',\n        access_token: access_token ?? '',\n        id_token,\n      };\n      return { token, userInfo };\n    },\n  };\n}\n\nexport const facebook = createFacebookProvider();\n\nasync function fetchUserInfo(\n  userInfoUri: string,\n  accessToken: string,\n  appSecretProof?: string\n): Promise<UserInfo<FacebookUserInfo>> {\n  const url = new URL(userInfoUri);\n  const fields = ['id', 'name', 'email', 'picture.width(320).height(320)'];\n  url.searchParams.append('access_token', accessToken);\n  url.searchParams.append('fields', fields.join(','));\n  if (appSecretProof) url.searchParams.append('appsecret_proof', appSecretProof);\n  const headers = { Accept: 'application/json' };\n  const response = await fetch(url.href, { headers });\n  if (!response.ok) {\n    throw new OAuth2Error(response.status, 'invalid_request', 'Failed to fetch user info');\n  }\n  const data = (await response.json()) as FacebookUserInfo;\n  return {\n    data,\n    claims: {\n      sub: data.id,\n      name: data.name,\n      email: data.email,\n      picture: data.picture.data.url,\n      // Not stated by the Graph API either; see the Limited Login path above.\n    },\n  };\n}\n\nexport interface FacebookDecodedIdToken {\n  sub: string;\n  name: string;\n  email: string;\n  picture: string;\n  nonce?: string;\n}\n\nexport interface FacebookUserInfo {\n  id: string;\n  name: string;\n  email: string;\n  picture: {\n    data: {\n      url: string;\n      width: number;\n      height: number;\n      is_silhouette: boolean;\n    };\n  };\n}\n\nexport interface FacebookToken extends OAuth2Token {\n  access_token: string;\n  token_type: 'bearer';\n  expires_in: number;\n  id_token?: string;\n}\n\nexport type FacebookAppCredential =\n  | { state: string; id_token: string } // platform=ios and tracking=limited\n  | { state: string; access_token: string }; // tracking=enabled\n\ninterface FacebookErrorResponse {\n  error: {\n    message: string;\n    type: 'OAuthException';\n    code: number;\n    error_subcode: number;\n    fbtrace_id: string;\n  };\n}\n"],"mappings":";;;;;;;;;AAUA,MAAM,kBAAkB;;;;;AAMxB,SAAgB,yBAAmC;CACjD,OAAO;EACL,kBAAkB;EAClB,UAAU;EACV,aAAa;EACb,WAAW;EACX,mBAAmB;EACnB,cAAc,CAAC,WAAW,OAAO;EACjC,uBAAuB,EAAE,MAAM,GAAG,GAAG,UAAU;GAC7C,OAAO,uBAAuB;IAC5B,GAAG;IACH,OAAO,OAAO,SAAS,KAAK;IAC5B,kBAAkB,KAAK;GACzB,CAAC;EACH;EACA,MAAM,0BAA0B,EAAE,MAAM,GAAG,GAAG,UAAU;GACtD,MAAM,WAAW,MAAM,0BAA0B;IAAE,GAAG;IAAQ,UAAU,KAAK;GAAS,CAAC;GACvF,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,UAAW,MAAM,SAAS,KAAK;IACvC,MAAM,IAAI,YAAY,SAAS,QAAQ,mBAAmB,MAAM,OAAO;GACzE;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,EAAE,UAAU,gBAAgB,EAAE,YAAY;GAC1D,UAAU,KAAK,WAAW,uBAAuB;GACjD,IAAI,UAAU;IACZ,MAAM,OAAO,MAAM,cAAsC,UAAU;KACjE,WAAW,KAAK;KAChB,QAAQ;KACR,UAAU;IACZ,CAAC;IACD,OAAO;KACL;KACA,QAAQ;MACN,KAAK,KAAK;MACV,MAAM,KAAK;MACX,SAAS,KAAK;MACd,OAAO,KAAK;KAGd;IACF;GACF;GACA,UAAU,cAAc,0BAA0B;GAClD,UAAU,KAAK,aAAa,yBAAyB;GACrD,OAAO,cAAc,KAAK,aAAa,YAAY;EACrD;EACA,MAAM,kBAAkB,EAAE,UAAU,cAAc,eAAwC;GACxF,MAAM,EAAE,UAAU,iBAAiB;GACnC,IAAI;GACJ,IAAI,UAEF,WAAW,MAAM,KAAK,YACpB;IAAE,YAAY;IAAU,cAAc;IAAI;GAAS,GACnD,EACE,SACF,CACF;QACK,IAAI,cAAc;IAIvB,IAAI,CAAC,cACH,MAAM,IAAI,YAAY,KAAK,kBAAkB,yCAAyC;IAExF,UAAU,KAAK,aAAa,yBAAyB;IACrD,MAAM,QAAQ,WAAW,UAAU,YAAY,CAAC,CAAC,OAAO,YAAY,CAAC,CAAC,OAAO,KAAK;IAClF,WAAW,MAAM,cAAc,KAAK,aAAa,cAAc,KAAK;GACtE,OACE,MAAM,IAAI,YAAY,KAAK,mBAAmB,sCAAsC;GAOtF,OAAO;IAAE,OAAA;KAJP,YAAY;KACZ,cAAc,gBAAgB;KAC9B;IAEW;IAAG;GAAS;EAC3B;CACF;AACF;AAEA,MAAa,WAAW,uBAAuB;AAE/C,eAAe,cACb,aACA,aACA,gBACqC;CACrC,MAAM,MAAM,IAAI,IAAI,WAAW;CAC/B,MAAM,SAAS;EAAC;EAAM;EAAQ;EAAS;CAAgC;CACvE,IAAI,aAAa,OAAO,gBAAgB,WAAW;CACnD,IAAI,aAAa,OAAO,UAAU,OAAO,KAAK,GAAG,CAAC;CAClD,IAAI,gBAAgB,IAAI,aAAa,OAAO,mBAAmB,cAAc;CAE7E,MAAM,WAAW,MAAM,MAAM,IAAI,MAAM,EAAE,SAAA,EADvB,QAAQ,mBACqB,EAAE,CAAC;CAClD,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,YAAY,SAAS,QAAQ,mBAAmB,2BAA2B;CAEvF,MAAM,OAAQ,MAAM,SAAS,KAAK;CAClC,OAAO;EACL;EACA,QAAQ;GACN,KAAK,KAAK;GACV,MAAM,KAAK;GACX,OAAO,KAAK;GACZ,SAAS,KAAK,QAAQ,KAAK;EAE7B;CACF;AACF"}
+{"version":3,"file":"facebook.mjs","names":[],"sources":["../../../src/oauth2/provider/facebook.ts"],"sourcesContent":["import { createHmac } from 'node:crypto';\nimport { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport type { LoginOAuth2NativeParams, OAuth2Token, Provider, UserInfo } from '../types';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\n/**\n * `iss` of Limited Login id tokens, per https://limited.facebook.com/.well-known/openid-configuration/\n * (their `aud` is the app id).\n */\nconst FACEBOOK_ISSUER = 'https://www.facebook.com';\n\n/**\n * ref: https://developers.facebook.com/docs/facebook-login/guides/advanced/manual-flow/\n * ref: https://developers.facebook.com/tools/explorer\n * */\nexport function createFacebookProvider(): Provider {\n  return {\n    authorizationUri: 'https://www.facebook.com/v21.0/dialog/oauth',\n    tokenUri: 'https://graph.facebook.com/v19.0/oauth/access_token',\n    userInfoUri: 'https://graph.facebook.com/me',\n    jwkSetUri: 'https://limited.facebook.com/.well-known/oauth/openid/jwks/',\n    userNameAttribute: 'id',\n    defaultScope: ['profile', 'email'],\n    // The web flow reads the Graph API, no id token; Limited Login's id token must carry the\n    // nonce the app set (an `access_token` login has no id token and is exempt).\n    nonce: { web: false, native: true },\n    createAuthorizationUri({ pkce: _, ...params }) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode({ pkce: _, ...params }) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error } = (await response.json()) as FacebookErrorResponse;\n        throw new OAuth2Error(response.status, 'invalid_request', error.message);\n      }\n      return (await response.json()) as FacebookToken;\n    },\n    async getUserInfo({ id_token, access_token }, { clientId }) {\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      if (id_token) {\n        const data = await verifyIdToken<FacebookDecodedIdToken>(id_token, {\n          jwkSetUri: this.jwkSetUri,\n          issuer: FACEBOOK_ISSUER,\n          audience: clientId,\n        });\n        return {\n          data,\n          claims: {\n            sub: data.sub,\n            name: data.name,\n            picture: data.picture,\n            email: data.email,\n            // Facebook does not say whether the address is verified: left unset, so a host that\n            // trusts only `email_verified === true` treats it as unverified.\n          },\n        };\n      }\n      invariant(access_token, 'access_token is required');\n      invariant(this.userInfoUri, 'userInfoUri is required');\n      return fetchUserInfo(this.userInfoUri, access_token);\n    },\n    async loginOAuth2Native({ clientId, clientSecret, credentials }: LoginOAuth2NativeParams) {\n      const { id_token, access_token } = credentials;\n      let userInfo: UserInfo;\n      if (id_token) {\n        // Limited Login: the id token's `aud` must be this app.\n        userInfo = await this.getUserInfo(\n          { token_type: 'bearer', access_token: '', id_token },\n          {\n            clientId,\n          }\n        );\n      } else if (access_token) {\n        // The Graph API serves any app's user access token, so `/me` alone would accept a token a\n        // foreign app obtained for the same user. With `appsecret_proof` Facebook refuses tokens\n        // not issued to the app whose secret signed the proof, binding the token to this client.\n        if (!clientSecret) {\n          throw new OAuth2Error(400, 'invalid_client', 'access_token login needs the app secret');\n        }\n        invariant(this.userInfoUri, 'userInfoUri is required');\n        const proof = createHmac('sha256', clientSecret).update(access_token).digest('hex');\n        userInfo = await fetchUserInfo(this.userInfoUri, access_token, proof);\n      } else {\n        throw new OAuth2Error(400, 'invalid_request', 'id_token or access_token is required');\n      }\n      const token: OAuth2Token = {\n        token_type: 'bearer',\n        access_token: access_token ?? '',\n        id_token,\n      };\n      return { token, userInfo };\n    },\n  };\n}\n\nexport const facebook = createFacebookProvider();\n\nasync function fetchUserInfo(\n  userInfoUri: string,\n  accessToken: string,\n  appSecretProof?: string\n): Promise<UserInfo<FacebookUserInfo>> {\n  const url = new URL(userInfoUri);\n  const fields = ['id', 'name', 'email', 'picture.width(320).height(320)'];\n  url.searchParams.append('access_token', accessToken);\n  url.searchParams.append('fields', fields.join(','));\n  if (appSecretProof) url.searchParams.append('appsecret_proof', appSecretProof);\n  const headers = { Accept: 'application/json' };\n  const response = await fetch(url.href, { headers });\n  if (!response.ok) {\n    throw new OAuth2Error(response.status, 'invalid_request', 'Failed to fetch user info');\n  }\n  const data = (await response.json()) as FacebookUserInfo;\n  return {\n    data,\n    claims: {\n      sub: data.id,\n      name: data.name,\n      email: data.email,\n      picture: data.picture.data.url,\n      // Not stated by the Graph API either; see the Limited Login path above.\n    },\n  };\n}\n\nexport interface FacebookDecodedIdToken {\n  sub: string;\n  name: string;\n  email: string;\n  picture: string;\n  nonce?: string;\n}\n\nexport interface FacebookUserInfo {\n  id: string;\n  name: string;\n  email: string;\n  picture: {\n    data: {\n      url: string;\n      width: number;\n      height: number;\n      is_silhouette: boolean;\n    };\n  };\n}\n\nexport interface FacebookToken extends OAuth2Token {\n  access_token: string;\n  token_type: 'bearer';\n  expires_in: number;\n  id_token?: string;\n}\n\nexport type FacebookAppCredential =\n  | { state: string; id_token: string } // platform=ios and tracking=limited\n  | { state: string; access_token: string }; // tracking=enabled\n\ninterface FacebookErrorResponse {\n  error: {\n    message: string;\n    type: 'OAuthException';\n    code: number;\n    error_subcode: number;\n    fbtrace_id: string;\n  };\n}\n"],"mappings":";;;;;;;;;AAUA,MAAM,kBAAkB;;;;;AAMxB,SAAgB,yBAAmC;CACjD,OAAO;EACL,kBAAkB;EAClB,UAAU;EACV,aAAa;EACb,WAAW;EACX,mBAAmB;EACnB,cAAc,CAAC,WAAW,OAAO;EAGjC,OAAO;GAAE,KAAK;GAAO,QAAQ;EAAK;EAClC,uBAAuB,EAAE,MAAM,GAAG,GAAG,UAAU;GAC7C,OAAO,uBAAuB;IAC5B,GAAG;IACH,OAAO,OAAO,SAAS,KAAK;IAC5B,kBAAkB,KAAK;GACzB,CAAC;EACH;EACA,MAAM,0BAA0B,EAAE,MAAM,GAAG,GAAG,UAAU;GACtD,MAAM,WAAW,MAAM,0BAA0B;IAAE,GAAG;IAAQ,UAAU,KAAK;GAAS,CAAC;GACvF,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,UAAW,MAAM,SAAS,KAAK;IACvC,MAAM,IAAI,YAAY,SAAS,QAAQ,mBAAmB,MAAM,OAAO;GACzE;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,EAAE,UAAU,gBAAgB,EAAE,YAAY;GAC1D,UAAU,KAAK,WAAW,uBAAuB;GACjD,IAAI,UAAU;IACZ,MAAM,OAAO,MAAM,cAAsC,UAAU;KACjE,WAAW,KAAK;KAChB,QAAQ;KACR,UAAU;IACZ,CAAC;IACD,OAAO;KACL;KACA,QAAQ;MACN,KAAK,KAAK;MACV,MAAM,KAAK;MACX,SAAS,KAAK;MACd,OAAO,KAAK;KAGd;IACF;GACF;GACA,UAAU,cAAc,0BAA0B;GAClD,UAAU,KAAK,aAAa,yBAAyB;GACrD,OAAO,cAAc,KAAK,aAAa,YAAY;EACrD;EACA,MAAM,kBAAkB,EAAE,UAAU,cAAc,eAAwC;GACxF,MAAM,EAAE,UAAU,iBAAiB;GACnC,IAAI;GACJ,IAAI,UAEF,WAAW,MAAM,KAAK,YACpB;IAAE,YAAY;IAAU,cAAc;IAAI;GAAS,GACnD,EACE,SACF,CACF;QACK,IAAI,cAAc;IAIvB,IAAI,CAAC,cACH,MAAM,IAAI,YAAY,KAAK,kBAAkB,yCAAyC;IAExF,UAAU,KAAK,aAAa,yBAAyB;IACrD,MAAM,QAAQ,WAAW,UAAU,YAAY,CAAC,CAAC,OAAO,YAAY,CAAC,CAAC,OAAO,KAAK;IAClF,WAAW,MAAM,cAAc,KAAK,aAAa,cAAc,KAAK;GACtE,OACE,MAAM,IAAI,YAAY,KAAK,mBAAmB,sCAAsC;GAOtF,OAAO;IAAE,OAAA;KAJP,YAAY;KACZ,cAAc,gBAAgB;KAC9B;IAEW;IAAG;GAAS;EAC3B;CACF;AACF;AAEA,MAAa,WAAW,uBAAuB;AAE/C,eAAe,cACb,aACA,aACA,gBACqC;CACrC,MAAM,MAAM,IAAI,IAAI,WAAW;CAC/B,MAAM,SAAS;EAAC;EAAM;EAAQ;EAAS;CAAgC;CACvE,IAAI,aAAa,OAAO,gBAAgB,WAAW;CACnD,IAAI,aAAa,OAAO,UAAU,OAAO,KAAK,GAAG,CAAC;CAClD,IAAI,gBAAgB,IAAI,aAAa,OAAO,mBAAmB,cAAc;CAE7E,MAAM,WAAW,MAAM,MAAM,IAAI,MAAM,EAAE,SAAA,EADvB,QAAQ,mBACqB,EAAE,CAAC;CAClD,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,YAAY,SAAS,QAAQ,mBAAmB,2BAA2B;CAEvF,MAAM,OAAQ,MAAM,SAAS,KAAK;CAClC,OAAO;EACL;EACA,QAAQ;GACN,KAAK,KAAK;GACV,MAAM,KAAK;GACX,OAAO,KAAK;GACZ,SAAS,KAAK,QAAQ,KAAK;EAE7B;CACF;AACF"}

package/dist/oauth2/provider/google.cjs

@@ -29,6 +29,10 @@ function createGoogleProvider() {
 			"https://www.googleapis.com/auth/userinfo.profile",
 			"openid"
 		],
+		nonce: {
+			web: true,
+			native: false
+		},
 		createAuthorizationUri(params) {
 			return require_oauth2_provider_common.createAuthorizationUri({
 				...params,

package/dist/oauth2/provider/google.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"google.cjs","names":["createAuthorizationUri","exchangeAuthorizationCode","OAuth2Error","verifyIdToken"],"sources":["../../../src/oauth2/provider/google.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport type {\n  LoginOAuth2NativeParams,\n  NativeCredential,\n  OAuth2Token,\n  OneTapProvider,\n} from '../types';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\n/** Google signs id tokens with either `iss`, the URL or the bare host. */\nconst GOOGLE_ISSUERS = ['https://accounts.google.com', 'accounts.google.com'];\n\nfunction claims(data: GoogleUserInfo) {\n  return {\n    sub: data.sub,\n    name: data.name,\n    picture: data.picture,\n    email: data.email,\n    email_verified: data.email_verified,\n    given_name: data.given_name,\n    family_name: data.family_name,\n    locale: data.locale,\n  };\n}\n\nexport function createGoogleProvider(): OneTapProvider {\n  return {\n    authorizationUri: 'https://accounts.google.com/o/oauth2/v2/auth',\n    tokenUri: 'https://oauth2.googleapis.com/token',\n    userInfoUri: 'https://www.googleapis.com/oauth2/v3/userinfo',\n    userNameAttribute: 'sub',\n    jwkSetUri: 'https://www.googleapis.com/oauth2/v3/certs',\n    // https://developers.google.com/identity/protocols/oauth2/scopes#oauth2\n    defaultScope: [\n      'https://www.googleapis.com/auth/userinfo.email',\n      'https://www.googleapis.com/auth/userinfo.profile',\n      'openid',\n    ],\n    createAuthorizationUri(params) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode(params) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as GoogleErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as GoogleToken;\n    },\n    async getUserInfo({ id_token }, { clientId }) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      const data = await verifyIdToken<GoogleUserInfo>(id_token, {\n        jwkSetUri: this.jwkSetUri,\n        issuer: GOOGLE_ISSUERS,\n        audience: clientId,\n      });\n      return { data, claims: claims(data) };\n    },\n    async loginOAuth2Native({ pkce, credentials, ...params }: LoginOAuth2NativeParams) {\n      invariant(credentials.code, 'code is required');\n      const { code } = credentials;\n      const { tokenUri } = this;\n      // An app signs in as its own installed-app client (the iOS / Android client id, custom-scheme\n      // redirect), and Google only exchanges a code for the client it was issued to, so the exchange\n      // runs as the client the app names, which the OAuth2 client has already checked is one of this\n      // provider's configured clients. Installed-app clients have no secret. The redirect URI is the\n      // one the app used, which only the app knows. So is the PKCE verifier, when the app sent a\n      // challenge: Google then refuses the code without it.\n      const { redirect_uri = params.redirectUri } = credentials;\n      const response = await exchangeAuthorizationCode({\n        code,\n        pkce,\n        tokenUri,\n        clientId: params.clientId,\n        clientSecret: params.clientSecret,\n        redirectUri: redirect_uri,\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as GoogleErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      const token = (await response.json()) as GoogleToken;\n      const userInfo = await this.getUserInfo(token, { clientId: params.clientId });\n      return { token, userInfo };\n    },\n    async getTokenInfo(id_token: string, clientId: string) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      // One Tap and FedCM issue the credential to the web client.\n      const data = await verifyIdToken<GoogleUserInfo>(id_token, {\n        jwkSetUri: this.jwkSetUri,\n        issuer: GOOGLE_ISSUERS,\n        audience: clientId,\n      });\n      return {\n        token: {\n          id_token,\n          access_token: '',\n          token_type: '',\n          expires_in: 0,\n          refresh_token: '',\n          scope: '',\n        },\n        userInfo: { data, claims: claims(data) },\n      };\n    },\n  };\n}\n\nexport const google = createGoogleProvider();\n\nexport interface GoogleUserInfo {\n  aud: string;\n  azp: string;\n  email: string;\n  email_verified: boolean;\n  exp: number;\n  family_name: string;\n  given_name: string;\n  hd?: string;\n  iat: number;\n  iss: string;\n  jti?: string;\n  locale?: string;\n  name: string;\n  nbf?: number;\n  picture: string;\n  sub: string;\n  nonce?: string;\n}\n\nexport interface GoogleToken extends OAuth2Token {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token: string;\n  id_token: string;\n  scope: string;\n}\n\n// android,ios has different client_id and redirect_uri\nexport interface GoogleAppCredential extends NativeCredential {\n  state: string;\n  code: string;\n  client_id: string;\n  redirect_uri: string;\n}\n\nexport interface GoogleErrorResponse {\n  error:\n    | 'invalid_request'\n    | 'invalid_client'\n    | 'invalid_grant'\n    | 'invalid_token'\n    | 'invalid_scope'\n    | 'unauthorized_client'\n    | 'unsupported_grant_type'\n    | 'access_denied'\n    | 'server_error';\n  error_description: string;\n}\n"],"mappings":";;;;;;AAWA,MAAM,iBAAiB,CAAC,+BAA+B,qBAAqB;AAE5E,SAAS,OAAO,MAAsB;CACpC,OAAO;EACL,KAAK,KAAK;EACV,MAAM,KAAK;EACX,SAAS,KAAK;EACd,OAAO,KAAK;EACZ,gBAAgB,KAAK;EACrB,YAAY,KAAK;EACjB,aAAa,KAAK;EAClB,QAAQ,KAAK;CACf;AACF;AAEA,SAAgB,uBAAuC;CACrD,OAAO;EACL,kBAAkB;EAClB,UAAU;EACV,aAAa;EACb,mBAAmB;EACnB,WAAW;EAEX,cAAc;GACZ;GACA;GACA;EACF;EACA,uBAAuB,QAAQ;GAC7B,OAAOA,+BAAAA,uBAAuB;IAC5B,GAAG;IACH,OAAO,OAAO,SAAS,KAAK;IAC5B,kBAAkB,KAAK;GACzB,CAAC;EACH;EACA,MAAM,0BAA0B,QAAQ;GACtC,MAAM,WAAW,MAAMC,+BAAAA,0BAA0B;IAAE,GAAG;IAAQ,UAAU,KAAK;GAAS,CAAC;GACvF,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,OAAO,sBAAuB,MAAM,SAAS,KAAK;IAC1D,MAAM,IAAIC,qBAAAA,YAAY,SAAS,QAAQ,OAAO,iBAAiB;GACjE;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,EAAE,YAAY,EAAE,YAAY;GAC5C,CAAA,GAAA,cAAA,UAAA,CAAU,UAAU,sBAAsB;GAC1C,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,WAAW,uBAAuB;GACjD,MAAM,OAAO,MAAMC,+BAAAA,cAA8B,UAAU;IACzD,WAAW,KAAK;IAChB,QAAQ;IACR,UAAU;GACZ,CAAC;GACD,OAAO;IAAE;IAAM,QAAQ,OAAO,IAAI;GAAE;EACtC;EACA,MAAM,kBAAkB,EAAE,MAAM,aAAa,GAAG,UAAmC;GACjF,CAAA,GAAA,cAAA,UAAA,CAAU,YAAY,MAAM,kBAAkB;GAC9C,MAAM,EAAE,SAAS;GACjB,MAAM,EAAE,aAAa;GAOrB,MAAM,EAAE,eAAe,OAAO,gBAAgB;GAC9C,MAAM,WAAW,MAAMF,+BAAAA,0BAA0B;IAC/C;IACA;IACA;IACA,UAAU,OAAO;IACjB,cAAc,OAAO;IACrB,aAAa;GACf,CAAC;GACD,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,OAAO,sBAAuB,MAAM,SAAS,KAAK;IAC1D,MAAM,IAAIC,qBAAAA,YAAY,SAAS,QAAQ,OAAO,iBAAiB;GACjE;GACA,MAAM,QAAS,MAAM,SAAS,KAAK;GAEnC,OAAO;IAAE;IAAO,UAAA,MADO,KAAK,YAAY,OAAO,EAAE,UAAU,OAAO,SAAS,CAAC;GACnD;EAC3B;EACA,MAAM,aAAa,UAAkB,UAAkB;GACrD,CAAA,GAAA,cAAA,UAAA,CAAU,UAAU,sBAAsB;GAC1C,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,WAAW,uBAAuB;GAEjD,MAAM,OAAO,MAAMC,+BAAAA,cAA8B,UAAU;IACzD,WAAW,KAAK;IAChB,QAAQ;IACR,UAAU;GACZ,CAAC;GACD,OAAO;IACL,OAAO;KACL;KACA,cAAc;KACd,YAAY;KACZ,YAAY;KACZ,eAAe;KACf,OAAO;IACT;IACA,UAAU;KAAE;KAAM,QAAQ,OAAO,IAAI;IAAE;GACzC;EACF;CACF;AACF;AAEA,MAAa,SAAS,qBAAqB"}
+{"version":3,"file":"google.cjs","names":["createAuthorizationUri","exchangeAuthorizationCode","OAuth2Error","verifyIdToken"],"sources":["../../../src/oauth2/provider/google.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport type {\n  LoginOAuth2NativeParams,\n  NativeCredential,\n  OAuth2Token,\n  OneTapProvider,\n} from '../types';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\n/** Google signs id tokens with either `iss`, the URL or the bare host. */\nconst GOOGLE_ISSUERS = ['https://accounts.google.com', 'accounts.google.com'];\n\nfunction claims(data: GoogleUserInfo) {\n  return {\n    sub: data.sub,\n    name: data.name,\n    picture: data.picture,\n    email: data.email,\n    email_verified: data.email_verified,\n    given_name: data.given_name,\n    family_name: data.family_name,\n    locale: data.locale,\n  };\n}\n\nexport function createGoogleProvider(): OneTapProvider {\n  return {\n    authorizationUri: 'https://accounts.google.com/o/oauth2/v2/auth',\n    tokenUri: 'https://oauth2.googleapis.com/token',\n    userInfoUri: 'https://www.googleapis.com/oauth2/v3/userinfo',\n    userNameAttribute: 'sub',\n    jwkSetUri: 'https://www.googleapis.com/oauth2/v3/certs',\n    // https://developers.google.com/identity/protocols/oauth2/scopes#oauth2\n    defaultScope: [\n      'https://www.googleapis.com/auth/userinfo.email',\n      'https://www.googleapis.com/auth/userinfo.profile',\n      'openid',\n    ],\n    // The web flow and One Tap echo the nonce; an app signs in with a code it exchanges here,\n    // bound by PKCE, and Google's native SDKs put no nonce in that id token.\n    nonce: { web: true, native: false },\n    createAuthorizationUri(params) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode(params) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as GoogleErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as GoogleToken;\n    },\n    async getUserInfo({ id_token }, { clientId }) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      const data = await verifyIdToken<GoogleUserInfo>(id_token, {\n        jwkSetUri: this.jwkSetUri,\n        issuer: GOOGLE_ISSUERS,\n        audience: clientId,\n      });\n      return { data, claims: claims(data) };\n    },\n    async loginOAuth2Native({ pkce, credentials, ...params }: LoginOAuth2NativeParams) {\n      invariant(credentials.code, 'code is required');\n      const { code } = credentials;\n      const { tokenUri } = this;\n      // An app signs in as its own installed-app client (the iOS / Android client id, custom-scheme\n      // redirect), and Google only exchanges a code for the client it was issued to, so the exchange\n      // runs as the client the app names, which the OAuth2 client has already checked is one of this\n      // provider's configured clients. Installed-app clients have no secret. The redirect URI is the\n      // one the app used, which only the app knows. So is the PKCE verifier, when the app sent a\n      // challenge: Google then refuses the code without it.\n      const { redirect_uri = params.redirectUri } = credentials;\n      const response = await exchangeAuthorizationCode({\n        code,\n        pkce,\n        tokenUri,\n        clientId: params.clientId,\n        clientSecret: params.clientSecret,\n        redirectUri: redirect_uri,\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as GoogleErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      const token = (await response.json()) as GoogleToken;\n      const userInfo = await this.getUserInfo(token, { clientId: params.clientId });\n      return { token, userInfo };\n    },\n    async getTokenInfo(id_token: string, clientId: string) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      // One Tap and FedCM issue the credential to the web client.\n      const data = await verifyIdToken<GoogleUserInfo>(id_token, {\n        jwkSetUri: this.jwkSetUri,\n        issuer: GOOGLE_ISSUERS,\n        audience: clientId,\n      });\n      return {\n        token: {\n          id_token,\n          access_token: '',\n          token_type: '',\n          expires_in: 0,\n          refresh_token: '',\n          scope: '',\n        },\n        userInfo: { data, claims: claims(data) },\n      };\n    },\n  };\n}\n\nexport const google = createGoogleProvider();\n\nexport interface GoogleUserInfo {\n  aud: string;\n  azp: string;\n  email: string;\n  email_verified: boolean;\n  exp: number;\n  family_name: string;\n  given_name: string;\n  hd?: string;\n  iat: number;\n  iss: string;\n  jti?: string;\n  locale?: string;\n  name: string;\n  nbf?: number;\n  picture: string;\n  sub: string;\n  nonce?: string;\n}\n\nexport interface GoogleToken extends OAuth2Token {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token: string;\n  id_token: string;\n  scope: string;\n}\n\n// android,ios has different client_id and redirect_uri\nexport interface GoogleAppCredential extends NativeCredential {\n  state: string;\n  code: string;\n  client_id: string;\n  redirect_uri: string;\n}\n\nexport interface GoogleErrorResponse {\n  error:\n    | 'invalid_request'\n    | 'invalid_client'\n    | 'invalid_grant'\n    | 'invalid_token'\n    | 'invalid_scope'\n    | 'unauthorized_client'\n    | 'unsupported_grant_type'\n    | 'access_denied'\n    | 'server_error';\n  error_description: string;\n}\n"],"mappings":";;;;;;AAWA,MAAM,iBAAiB,CAAC,+BAA+B,qBAAqB;AAE5E,SAAS,OAAO,MAAsB;CACpC,OAAO;EACL,KAAK,KAAK;EACV,MAAM,KAAK;EACX,SAAS,KAAK;EACd,OAAO,KAAK;EACZ,gBAAgB,KAAK;EACrB,YAAY,KAAK;EACjB,aAAa,KAAK;EAClB,QAAQ,KAAK;CACf;AACF;AAEA,SAAgB,uBAAuC;CACrD,OAAO;EACL,kBAAkB;EAClB,UAAU;EACV,aAAa;EACb,mBAAmB;EACnB,WAAW;EAEX,cAAc;GACZ;GACA;GACA;EACF;EAGA,OAAO;GAAE,KAAK;GAAM,QAAQ;EAAM;EAClC,uBAAuB,QAAQ;GAC7B,OAAOA,+BAAAA,uBAAuB;IAC5B,GAAG;IACH,OAAO,OAAO,SAAS,KAAK;IAC5B,kBAAkB,KAAK;GACzB,CAAC;EACH;EACA,MAAM,0BAA0B,QAAQ;GACtC,MAAM,WAAW,MAAMC,+BAAAA,0BAA0B;IAAE,GAAG;IAAQ,UAAU,KAAK;GAAS,CAAC;GACvF,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,OAAO,sBAAuB,MAAM,SAAS,KAAK;IAC1D,MAAM,IAAIC,qBAAAA,YAAY,SAAS,QAAQ,OAAO,iBAAiB;GACjE;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,EAAE,YAAY,EAAE,YAAY;GAC5C,CAAA,GAAA,cAAA,UAAA,CAAU,UAAU,sBAAsB;GAC1C,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,WAAW,uBAAuB;GACjD,MAAM,OAAO,MAAMC,+BAAAA,cAA8B,UAAU;IACzD,WAAW,KAAK;IAChB,QAAQ;IACR,UAAU;GACZ,CAAC;GACD,OAAO;IAAE;IAAM,QAAQ,OAAO,IAAI;GAAE;EACtC;EACA,MAAM,kBAAkB,EAAE,MAAM,aAAa,GAAG,UAAmC;GACjF,CAAA,GAAA,cAAA,UAAA,CAAU,YAAY,MAAM,kBAAkB;GAC9C,MAAM,EAAE,SAAS;GACjB,MAAM,EAAE,aAAa;GAOrB,MAAM,EAAE,eAAe,OAAO,gBAAgB;GAC9C,MAAM,WAAW,MAAMF,+BAAAA,0BAA0B;IAC/C;IACA;IACA;IACA,UAAU,OAAO;IACjB,cAAc,OAAO;IACrB,aAAa;GACf,CAAC;GACD,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,OAAO,sBAAuB,MAAM,SAAS,KAAK;IAC1D,MAAM,IAAIC,qBAAAA,YAAY,SAAS,QAAQ,OAAO,iBAAiB;GACjE;GACA,MAAM,QAAS,MAAM,SAAS,KAAK;GAEnC,OAAO;IAAE;IAAO,UAAA,MADO,KAAK,YAAY,OAAO,EAAE,UAAU,OAAO,SAAS,CAAC;GACnD;EAC3B;EACA,MAAM,aAAa,UAAkB,UAAkB;GACrD,CAAA,GAAA,cAAA,UAAA,CAAU,UAAU,sBAAsB;GAC1C,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,WAAW,uBAAuB;GAEjD,MAAM,OAAO,MAAMC,+BAAAA,cAA8B,UAAU;IACzD,WAAW,KAAK;IAChB,QAAQ;IACR,UAAU;GACZ,CAAC;GACD,OAAO;IACL,OAAO;KACL;KACA,cAAc;KACd,YAAY;KACZ,YAAY;KACZ,eAAe;KACf,OAAO;IACT;IACA,UAAU;KAAE;KAAM,QAAQ,OAAO,IAAI;IAAE;GACzC;EACF;CACF;AACF;AAEA,MAAa,SAAS,qBAAqB"}

package/dist/oauth2/provider/google.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"google.d.cts","names":[],"sources":["../../../src/oauth2/provider/google.ts"],"mappings":";wBA0BgB,wBAAwB;qBAyF3B,QAAM;iBAEF;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;iBAGe,oBAAoB;EACnC;EACA;EACA;EACA;EACA;EACA;;iBAIe,4BAA4B;EAC3C;EACA;EACA;EACA;;iBAGe;EACf;EAUA"}
+{"version":3,"file":"google.d.cts","names":[],"sources":["../../../src/oauth2/provider/google.ts"],"mappings":";wBA0BgB,wBAAwB;qBA4F3B,QAAM;iBAEF;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;iBAGe,oBAAoB;EACnC;EACA;EACA;EACA;EACA;EACA;;iBAIe,4BAA4B;EAC3C;EACA;EACA;EACA;;iBAGe;EACf;EAUA"}