@strapi/plugin-users-permissions 5.50.1 → 5.51.0

package/dist/server/services/providers-registry.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"providers-registry.mjs","sources":["../../../server/services/providers-registry.js"],"sourcesContent":["'use strict';\n\nconst { strict: assert } = require('assert');\nconst jwt = require('jsonwebtoken');\nconst urljoin = require('url-join');\nconst jwkToPem = require('jwk-to-pem');\n\nconst getCognitoPayload = async ({ idToken, jwksUrl, purest }) => {\n  const {\n    header: { kid },\n    payload,\n  } = jwt.decode(idToken, { complete: true });\n\n  if (!payload || !kid) {\n    throw new Error('The provided token is not valid');\n  }\n\n  const config = {\n    cognito: {\n      discovery: {\n        origin: jwksUrl.origin,\n        path: jwksUrl.pathname,\n      },\n    },\n  };\n  try {\n    const cognito = purest({ provider: 'cognito', config });\n    // get the JSON Web Key (JWK) for the user pool\n    const { body: jwk } = await cognito('discovery').request();\n    // Get the key with the same Key ID as the provided token\n    const key = jwk.keys.find(({ kid: jwkKid }) => jwkKid === kid);\n    const pem = jwkToPem(key);\n\n    // https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-tokens-verifying-a-jwt.html\n    const decodedToken = await new Promise((resolve, reject) => {\n      jwt.verify(idToken, pem, { algorithms: ['RS256'] }, (err, decodedToken) => {\n        if (err) {\n          reject();\n        }\n        resolve(decodedToken);\n      });\n    });\n    return decodedToken;\n  } catch (err) {\n    throw new Error('There was an error verifying the token');\n  }\n};\n\nconst initProviders = ({ baseURL, purest }) => ({\n  email: {\n    enabled: true,\n    icon: 'envelope',\n    grantConfig: {},\n  },\n  discord: {\n    enabled: false,\n    icon: 'discord',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/discord/callback`,\n      scope: ['identify', 'email'],\n    },\n    async authCallback({ accessToken }) {\n      const discord = purest({ provider: 'discord' });\n\n      return discord\n        .get('users/@me')\n        .auth(accessToken)\n        .request()\n        .then(({ body }) => {\n          // Combine username and discriminator (if discriminator exists and not equal to 0)\n          const username =\n            body.discriminator && body.discriminator !== '0'\n              ? `${body.username}#${body.discriminator}`\n              : body.username;\n          return {\n            username,\n            email: body.email,\n          };\n        });\n    },\n  },\n  facebook: {\n    enabled: false,\n    icon: 'facebook-square',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/facebook/callback`,\n      scope: ['email'],\n    },\n    async authCallback({ accessToken }) {\n      const facebook = purest({ provider: 'facebook' });\n\n      return facebook\n        .get('me')\n        .auth(accessToken)\n        .qs({ fields: 'name,email' })\n        .request()\n        .then(({ body }) => ({\n          username: body.name,\n          email: body.email,\n        }));\n    },\n  },\n  google: {\n    enabled: false,\n    icon: 'google',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/google/callback`,\n      scope: ['email'],\n    },\n    async authCallback({ accessToken }) {\n      const google = purest({ provider: 'google' });\n\n      return google\n        .query('oauth')\n        .get('tokeninfo')\n        .qs({ accessToken })\n        .request()\n        .then(({ body }) => ({\n          username: body.email.split('@')[0],\n          email: body.email,\n        }));\n    },\n  },\n  github: {\n    enabled: false,\n    icon: 'github',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/github/callback`,\n      scope: ['user', 'user:email'],\n    },\n    async authCallback({ accessToken }) {\n      const github = purest({\n        provider: 'github',\n        defaults: {\n          headers: {\n            'user-agent': 'strapi',\n          },\n        },\n      });\n\n      const { body: userBody } = await github.get('user').auth(accessToken).request();\n\n      // This is the public email on the github profile\n      if (userBody.email) {\n        return {\n          username: userBody.login,\n          email: userBody.email,\n        };\n      }\n      // Get the email with Github's user/emails API\n      const { body: emailBody } = await github.get('user/emails').auth(accessToken).request();\n\n      return {\n        username: userBody.login,\n        email: Array.isArray(emailBody)\n          ? emailBody.find((email) => email.primary === true).email\n          : null,\n      };\n    },\n  },\n  microsoft: {\n    enabled: false,\n    icon: 'windows',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/microsoft/callback`,\n      scope: ['user.read'],\n    },\n    async authCallback({ accessToken }) {\n      const microsoft = purest({ provider: 'microsoft' });\n\n      return microsoft\n        .get('me')\n        .auth(accessToken)\n        .request()\n        .then(({ body }) => ({\n          username: body.userPrincipalName,\n          email: body.userPrincipalName,\n        }));\n    },\n  },\n\n  twitter: {\n    enabled: false,\n    icon: 'twitter',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/twitter/callback`,\n    },\n    async authCallback({ accessToken, query, providers }) {\n      const twitter = purest({\n        provider: 'twitter',\n        defaults: {\n          oauth: {\n            consumer_key: providers.twitter.key,\n            consumer_secret: providers.twitter.secret,\n          },\n        },\n      });\n\n      return twitter\n        .get('account/verify_credentials')\n        .auth(accessToken, query.access_secret)\n        .qs({ screen_name: query['raw[screen_name]'], include_email: 'true' })\n        .request()\n        .then(({ body }) => ({\n          username: body.screen_name,\n          email: body.email,\n        }));\n    },\n  },\n  instagram: {\n    enabled: false,\n    icon: 'instagram',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/instagram/callback`,\n      scope: ['user_profile'],\n    },\n    async authCallback({ accessToken }) {\n      const instagram = purest({ provider: 'instagram' });\n\n      return instagram\n        .get('me')\n        .auth(accessToken)\n        .qs({ fields: 'id,username' })\n        .request()\n        .then(({ body }) => ({\n          username: body.username,\n          email: `${body.username}@strapi.io`, // dummy email as Instagram does not provide user email\n        }));\n    },\n  },\n  vk: {\n    enabled: false,\n    icon: 'vk',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/vk/callback`,\n      scope: ['email'],\n    },\n    async authCallback({ accessToken, query }) {\n      const vk = purest({ provider: 'vk' });\n\n      return vk\n        .get('users')\n        .auth(accessToken)\n        .qs({ id: query.raw.user_id, v: '5.122' })\n        .request()\n        .then(({ body }) => ({\n          username: `${body.response[0].last_name} ${body.response[0].first_name}`,\n          email: query.raw.email,\n        }));\n    },\n  },\n\n  twitch: {\n    enabled: false,\n    icon: 'twitch',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/twitch/callback`,\n      scope: ['user:read:email'],\n    },\n    async authCallback({ accessToken, providers }) {\n      const twitch = purest({\n        provider: 'twitch',\n        config: {\n          twitch: {\n            default: {\n              origin: 'https://api.twitch.tv',\n              path: 'helix/{path}',\n              headers: {\n                Authorization: 'Bearer {auth}',\n                'Client-Id': '{auth}',\n              },\n            },\n          },\n        },\n      });\n\n      return twitch\n        .get('users')\n        .auth(accessToken, providers.twitch.key)\n        .request()\n        .then(({ body }) => ({\n          username: body.data[0].login,\n          email: body.data[0].email,\n        }));\n    },\n  },\n\n  linkedin: {\n    enabled: false,\n    icon: 'linkedin',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/linkedin/callback`,\n      scope: ['r_liteprofile', 'r_emailaddress'],\n    },\n    async authCallback({ accessToken }) {\n      const linkedIn = purest({ provider: 'linkedin' });\n      const {\n        body: { localizedFirstName },\n      } = await linkedIn.get('me').auth(accessToken).request();\n      const {\n        body: { elements },\n      } = await linkedIn\n        .get('emailAddress?q=members&projection=(elements*(handle~))')\n        .auth(accessToken)\n        .request();\n\n      const email = elements[0]['handle~'];\n\n      return {\n        username: localizedFirstName,\n        email: email.emailAddress,\n      };\n    },\n  },\n\n  cognito: {\n    enabled: false,\n    icon: 'aws',\n    grantConfig: {\n      key: '',\n      secret: '',\n      subdomain: 'my.subdomain.com',\n      callback: `${baseURL}/cognito/callback`,\n      scope: ['email', 'openid', 'profile'],\n    },\n    async authCallback({ query, providers }) {\n      const jwksUrl = new URL(providers.cognito.jwksurl);\n      const idToken = query.id_token;\n      const tokenPayload = await getCognitoPayload({ idToken, jwksUrl, purest });\n      return {\n        username: tokenPayload['cognito:username'],\n        email: tokenPayload.email,\n      };\n    },\n  },\n\n  reddit: {\n    enabled: false,\n    icon: 'reddit',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callback: `${baseURL}/reddit/callback`,\n      scope: ['identity'],\n    },\n    async authCallback({ accessToken }) {\n      const reddit = purest({\n        provider: 'reddit',\n        config: {\n          reddit: {\n            default: {\n              origin: 'https://oauth.reddit.com',\n              path: 'api/{version}/{path}',\n              version: 'v1',\n              headers: {\n                Authorization: 'Bearer {auth}',\n                'user-agent': 'strapi',\n              },\n            },\n          },\n        },\n      });\n\n      return reddit\n        .get('me')\n        .auth(accessToken)\n        .request()\n        .then(({ body }) => ({\n          username: body.name,\n          email: `${body.name}@strapi.io`, // dummy email as Reddit does not provide user email\n        }));\n    },\n  },\n\n  auth0: {\n    enabled: false,\n    icon: '',\n    grantConfig: {\n      key: '',\n      secret: '',\n      subdomain: 'my-tenant.eu',\n      callback: `${baseURL}/auth0/callback`,\n      scope: ['openid', 'email', 'profile'],\n    },\n    async authCallback({ accessToken, providers }) {\n      const auth0 = purest({ provider: 'auth0' });\n\n      return auth0\n        .get('userinfo')\n        .subdomain(providers.auth0.subdomain)\n        .auth(accessToken)\n        .request()\n        .then(({ body }) => {\n          const username = body.username || body.nickname || body.name || body.email.split('@')[0];\n          const email = body.email || `${username.replace(/\\s+/g, '.')}@strapi.io`;\n\n          return {\n            username,\n            email,\n          };\n        });\n    },\n  },\n\n  cas: {\n    enabled: false,\n    icon: 'book',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callback: `${baseURL}/cas/callback`,\n      scope: ['openid email'], // scopes should be space delimited\n      subdomain: 'my.subdomain.com/cas',\n    },\n    async authCallback({ accessToken, providers }) {\n      const cas = purest({ provider: 'cas' });\n\n      return cas\n        .get('oidc/profile')\n        .subdomain(providers.cas.subdomain)\n        .auth(accessToken)\n        .request()\n        .then(({ body }) => {\n          // CAS attribute may be in body.attributes or \"FLAT\", depending on CAS config\n          const username = body.attributes\n            ? body.attributes.strapiusername || body.id || body.sub\n            : body.strapiusername || body.id || body.sub;\n          const email = body.attributes\n            ? body.attributes.strapiemail || body.attributes.email\n            : body.strapiemail || body.email;\n          if (!username || !email) {\n            strapi.log.warn(\n              `CAS Response Body did not contain required attributes: ${JSON.stringify(body)}`\n            );\n          }\n          return {\n            username,\n            email,\n          };\n        });\n    },\n  },\n\n  patreon: {\n    enabled: false,\n    icon: '',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callback: `${baseURL}/patreon/callback`,\n      scope: ['identity', 'identity[email]'],\n    },\n    async authCallback({ accessToken }) {\n      const patreon = purest({\n        provider: 'patreon',\n        config: {\n          patreon: {\n            default: {\n              origin: 'https://www.patreon.com',\n              path: 'api/oauth2/{path}',\n              headers: {\n                authorization: 'Bearer {auth}',\n              },\n            },\n          },\n        },\n      });\n\n      return patreon\n        .get('v2/identity')\n        .auth(accessToken)\n        .qs(new URLSearchParams({ 'fields[user]': 'full_name,email' }).toString())\n        .request()\n        .then(({ body }) => {\n          const patreonData = body.data.attributes;\n          return {\n            username: patreonData.full_name,\n            email: patreonData.email,\n          };\n        });\n    },\n  },\n  keycloak: {\n    enabled: false,\n    icon: '',\n    grantConfig: {\n      key: '',\n      secret: '',\n      subdomain: 'myKeycloakProvider.com/realms/myrealm',\n      callback: `${baseURL}/keycloak/callback`,\n      scope: ['openid', 'email', 'profile'],\n    },\n    async authCallback({ accessToken, providers }) {\n      const keycloak = purest({ provider: 'keycloak' });\n\n      return keycloak\n        .subdomain(providers.keycloak.subdomain)\n        .get('protocol/openid-connect/userinfo')\n        .auth(accessToken)\n        .request()\n        .then(({ body }) => {\n          return {\n            username: body.preferred_username,\n            email: body.email,\n          };\n        });\n    },\n  },\n});\n\nmodule.exports = () => {\n  const purest = require('purest');\n\n  const apiPrefix = strapi.config.get('api.rest.prefix');\n  const baseURL = urljoin(strapi.config.server.url, apiPrefix, 'auth');\n\n  const authProviders = initProviders({ baseURL, purest });\n\n  /**\n   * @public\n   */\n  return {\n    getAll() {\n      return authProviders;\n    },\n    get(name) {\n      return authProviders[name];\n    },\n    add(name, config) {\n      authProviders[name] = config;\n    },\n    remove(name) {\n      delete authProviders[name];\n    },\n\n    /**\n     * @internal\n     */\n    async run({ provider, accessToken, query, providers }) {\n      const authProvider = authProviders[provider];\n\n      assert(authProvider, 'Unknown auth provider');\n\n      return authProvider.authCallback({ accessToken, query, providers, purest });\n    },\n  };\n};\n"],"names":["strict","assert","require$$0","jwt","require$$1","urljoin","require$$2","jwkToPem","require$$3","getCognitoPayload","idToken","jwksUrl","purest","header","kid","payload","decode","complete","Error","config","cognito","discovery","origin","path","pathname","provider","body","jwk","request","key","keys","find","jwkKid","pem","decodedToken","Promise","resolve","reject","verify","algorithms","err","initProviders","baseURL","email","enabled","icon","grantConfig","discord","secret","callbackUrl","scope","authCallback","accessToken","get","auth","then","username","discriminator","facebook","qs","fields","name","google","query","split","github","defaults","headers","userBody","login","emailBody","Array","isArray","primary","microsoft","userPrincipalName","twitter","providers","oauth","consumer_key","consumer_secret","access_secret","screen_name","include_email","instagram","vk","id","raw","user_id","v","response","last_name","first_name","twitch","default","Authorization","data","linkedin","linkedIn","localizedFirstName","elements","emailAddress","subdomain","callback","URL","jwksurl","id_token","tokenPayload","reddit","version","auth0","nickname","replace","cas","attributes","strapiusername","sub","strapiemail","strapi","log","warn","JSON","stringify","patreon","authorization","URLSearchParams","toString","patreonData","full_name","keycloak","preferred_username","providersRegistry","require$$4","apiPrefix","server","url","authProviders","getAll","add","remove","run","authProvider"],"mappings":";;;;;;;;;;;AAEA,IAAA,MAAM,EAAEA,MAAAA,EAAQC,MAAM,EAAE,GAAGC,UAAAA;AAC3B,IAAA,MAAMC,GAAAA,GAAMC,UAAAA;AACZ,IAAA,MAAMC,OAAAA,GAAUC,UAAAA;AAChB,IAAA,MAAMC,QAAAA,GAAWC,UAAAA;IAEjB,MAAMC,iBAAAA,GAAoB,OAAO,EAAEC,OAAO,EAAEC,OAAO,EAAEC,MAAM,EAAE,GAAA;AAC3D,QAAA,MAAM,EACJC,MAAAA,EAAQ,EAAEC,GAAG,EAAE,EACfC,OAAO,EACR,GAAGZ,GAAAA,CAAIa,MAAM,CAACN,OAAAA,EAAS;YAAEO,QAAAA,EAAU;AAAI,SAAA,CAAA;QAExC,IAAI,CAACF,OAAAA,IAAW,CAACD,GAAAA,EAAK;AACpB,YAAA,MAAM,IAAII,KAAAA,CAAM,iCAAA,CAAA;AACpB,QAAA;AAEE,QAAA,MAAMC,MAAAA,GAAS;YACbC,OAAAA,EAAS;gBACPC,SAAAA,EAAW;AACTC,oBAAAA,MAAAA,EAAQX,QAAQW,MAAM;AACtBC,oBAAAA,IAAAA,EAAMZ,QAAQa;AACtB;AACA;AACA,SAAA;QACE,IAAI;AACF,YAAA,MAAMJ,UAAUR,MAAAA,CAAO;gBAAEa,QAAAA,EAAU,SAAA;AAAWN,gBAAAA;AAAM,aAAA,CAAA;;YAEpD,MAAM,EAAEO,MAAMC,GAAG,EAAE,GAAG,MAAMP,OAAAA,CAAQ,aAAaQ,OAAO,EAAA;;AAExD,YAAA,MAAMC,GAAAA,GAAMF,GAAAA,CAAIG,IAAI,CAACC,IAAI,CAAC,CAAC,EAAEjB,GAAAA,EAAKkB,MAAM,EAAE,GAAKA,MAAAA,KAAWlB,GAAAA,CAAAA;AAC1D,YAAA,MAAMmB,MAAM1B,QAAAA,CAASsB,GAAAA,CAAAA;;AAGrB,YAAA,MAAMK,YAAAA,GAAe,MAAM,IAAIC,OAAAA,CAAQ,CAACC,OAAAA,EAASC,MAAAA,GAAAA;gBAC/ClC,GAAAA,CAAImC,MAAM,CAAC5B,OAAAA,EAASuB,GAAAA,EAAK;oBAAEM,UAAAA,EAAY;AAAC,wBAAA;AAAQ;AAAA,iBAAA,EAAI,CAACC,GAAAA,EAAKN,YAAAA,GAAAA;AACxD,oBAAA,IAAIM,GAAAA,EAAK;AACPH,wBAAAA,MAAAA,EAAAA;AACV,oBAAA;oBACQD,OAAAA,CAAQF,YAAAA,CAAAA;AAChB,gBAAA,CAAA,CAAA;AACA,YAAA,CAAA,CAAA;YACI,OAAOA,YAAAA;AACX,QAAA,CAAA,CAAI,OAAOM,GAAAA,EAAK;AACZ,YAAA,MAAM,IAAItB,KAAAA,CAAM,wCAAA,CAAA;AACpB,QAAA;AACA,IAAA,CAAA;IAEA,MAAMuB,aAAAA,GAAgB,CAAC,EAAEC,OAAO,EAAE9B,MAAM,EAAE,IAAM;YAC9C+B,KAAAA,EAAO;gBACLC,OAAAA,EAAS,IAAA;gBACTC,IAAAA,EAAM,UAAA;AACNC,gBAAAA,WAAAA,EAAa;AACjB,aAAA;YACEC,OAAAA,EAAS;gBACPH,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,SAAA;gBACNC,WAAAA,EAAa;oBACXjB,GAAAA,EAAK,EAAA;oBACLmB,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGP,OAAAA,CAAQ,iBAAiB,CAAC;oBAC1CQ,KAAAA,EAAO;AAAC,wBAAA,UAAA;AAAY,wBAAA;AAAQ;AAClC,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAML,UAAUnC,MAAAA,CAAO;wBAAEa,QAAAA,EAAU;AAAS,qBAAA,CAAA;AAE5C,oBAAA,OAAOsB,OAAAA,CACJM,GAAG,CAAC,WAAA,CAAA,CACJC,IAAI,CAACF,WAAAA,CAAAA,CACLxB,OAAO,EAAA,CACP2B,IAAI,CAAC,CAAC,EAAE7B,IAAI,EAAE,GAAA;;AAEb,wBAAA,MAAM8B,WACJ9B,IAAAA,CAAK+B,aAAa,IAAI/B,IAAAA,CAAK+B,aAAa,KAAK,GAAA,GACzC,CAAA,EAAG/B,KAAK8B,QAAQ,CAAC,CAAC,EAAE9B,IAAAA,CAAK+B,aAAa,CAAA,CAAE,GACxC/B,KAAK8B,QAAQ;wBACnB,OAAO;AACLA,4BAAAA,QAAAA;AACAb,4BAAAA,KAAAA,EAAOjB,KAAKiB;AACxB,yBAAA;AACA,oBAAA,CAAA,CAAA;AACA,gBAAA;AACA,aAAA;YACEe,QAAAA,EAAU;gBACRd,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,iBAAA;gBACNC,WAAAA,EAAa;oBACXjB,GAAAA,EAAK,EAAA;oBACLmB,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGP,OAAAA,CAAQ,kBAAkB,CAAC;oBAC3CQ,KAAAA,EAAO;AAAC,wBAAA;AAAQ;AACtB,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAMM,WAAW9C,MAAAA,CAAO;wBAAEa,QAAAA,EAAU;AAAU,qBAAA,CAAA;oBAE9C,OAAOiC,QAAAA,CACJL,GAAG,CAAC,IAAA,CAAA,CACJC,IAAI,CAACF,WAAAA,CAAAA,CACLO,EAAE,CAAC;wBAAEC,MAAAA,EAAQ;uBACbhC,OAAO,GACP2B,IAAI,CAAC,CAAC,EAAE7B,IAAI,EAAE,IAAM;AACnB8B,4BAAAA,QAAAA,EAAU9B,KAAKmC,IAAI;AACnBlB,4BAAAA,KAAAA,EAAOjB,KAAKiB;yBACtB,CAAA,CAAA;AACA,gBAAA;AACA,aAAA;YACEmB,MAAAA,EAAQ;gBACNlB,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,QAAA;gBACNC,WAAAA,EAAa;oBACXjB,GAAAA,EAAK,EAAA;oBACLmB,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGP,OAAAA,CAAQ,gBAAgB,CAAC;oBACzCQ,KAAAA,EAAO;AAAC,wBAAA;AAAQ;AACtB,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAMU,SAASlD,MAAAA,CAAO;wBAAEa,QAAAA,EAAU;AAAQ,qBAAA,CAAA;oBAE1C,OAAOqC,MAAAA,CACJC,KAAK,CAAC,OAAA,CAAA,CACNV,GAAG,CAAC,WAAA,CAAA,CACJM,EAAE,CAAC;AAAEP,wBAAAA;uBACLxB,OAAO,GACP2B,IAAI,CAAC,CAAC,EAAE7B,IAAI,EAAE,IAAM;AACnB8B,4BAAAA,QAAAA,EAAU9B,KAAKiB,KAAK,CAACqB,KAAK,CAAC,GAAA,CAAI,CAAC,CAAA,CAAE;AAClCrB,4BAAAA,KAAAA,EAAOjB,KAAKiB;yBACtB,CAAA,CAAA;AACA,gBAAA;AACA,aAAA;YACEsB,MAAAA,EAAQ;gBACNrB,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,QAAA;gBACNC,WAAAA,EAAa;oBACXjB,GAAAA,EAAK,EAAA;oBACLmB,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGP,OAAAA,CAAQ,gBAAgB,CAAC;oBACzCQ,KAAAA,EAAO;AAAC,wBAAA,MAAA;AAAQ,wBAAA;AAAa;AACnC,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAMa,SAASrD,MAAAA,CAAO;wBACpBa,QAAAA,EAAU,QAAA;wBACVyC,QAAAA,EAAU;4BACRC,OAAAA,EAAS;gCACP,YAAA,EAAc;AAC1B;AACA;AACA,qBAAA,CAAA;AAEM,oBAAA,MAAM,EAAEzC,IAAAA,EAAM0C,QAAQ,EAAE,GAAG,MAAMH,MAAAA,CAAOZ,GAAG,CAAC,MAAA,CAAA,CAAQC,IAAI,CAACF,aAAaxB,OAAO,EAAA;;oBAG7E,IAAIwC,QAAAA,CAASzB,KAAK,EAAE;wBAClB,OAAO;AACLa,4BAAAA,QAAAA,EAAUY,SAASC,KAAK;AACxB1B,4BAAAA,KAAAA,EAAOyB,SAASzB;AAC1B,yBAAA;AACA,oBAAA;;AAEM,oBAAA,MAAM,EAAEjB,IAAAA,EAAM4C,SAAS,EAAE,GAAG,MAAML,MAAAA,CAAOZ,GAAG,CAAC,aAAA,CAAA,CAAeC,IAAI,CAACF,aAAaxB,OAAO,EAAA;oBAErF,OAAO;AACL4B,wBAAAA,QAAAA,EAAUY,SAASC,KAAK;AACxB1B,wBAAAA,KAAAA,EAAO4B,KAAAA,CAAMC,OAAO,CAACF,SAAAA,CAAAA,GACjBA,UAAUvC,IAAI,CAAC,CAACY,KAAAA,GAAUA,KAAAA,CAAM8B,OAAO,KAAK,IAAA,CAAA,CAAM9B,KAAK,GACvD;AACZ,qBAAA;AACA,gBAAA;AACA,aAAA;YACE+B,SAAAA,EAAW;gBACT9B,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,SAAA;gBACNC,WAAAA,EAAa;oBACXjB,GAAAA,EAAK,EAAA;oBACLmB,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGP,OAAAA,CAAQ,mBAAmB,CAAC;oBAC5CQ,KAAAA,EAAO;AAAC,wBAAA;AAAY;AAC1B,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAMsB,YAAY9D,MAAAA,CAAO;wBAAEa,QAAAA,EAAU;AAAW,qBAAA,CAAA;AAEhD,oBAAA,OAAOiD,UACJrB,GAAG,CAAC,IAAA,CAAA,CACJC,IAAI,CAACF,WAAAA,CAAAA,CACLxB,OAAO,EAAA,CACP2B,IAAI,CAAC,CAAC,EAAE7B,IAAI,EAAE,IAAM;AACnB8B,4BAAAA,QAAAA,EAAU9B,KAAKiD,iBAAiB;AAChChC,4BAAAA,KAAAA,EAAOjB,KAAKiD;yBACtB,CAAA,CAAA;AACA,gBAAA;AACA,aAAA;YAEEC,OAAAA,EAAS;gBACPhC,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,SAAA;gBACNC,WAAAA,EAAa;oBACXjB,GAAAA,EAAK,EAAA;oBACLmB,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGP,OAAAA,CAAQ,iBAAiB;AAC/C,iBAAA;AACI,gBAAA,MAAMS,cAAa,EAAEC,WAAW,EAAEW,KAAK,EAAEc,SAAS,EAAE,EAAA;AAClD,oBAAA,MAAMD,UAAUhE,MAAAA,CAAO;wBACrBa,QAAAA,EAAU,SAAA;wBACVyC,QAAAA,EAAU;4BACRY,KAAAA,EAAO;gCACLC,YAAAA,EAAcF,SAAAA,CAAUD,OAAO,CAAC/C,GAAG;gCACnCmD,eAAAA,EAAiBH,SAAAA,CAAUD,OAAO,CAAC5B;AAC/C;AACA;AACA,qBAAA,CAAA;oBAEM,OAAO4B,OAAAA,CACJvB,GAAG,CAAC,4BAAA,CAAA,CACJC,IAAI,CAACF,WAAAA,EAAaW,KAAAA,CAAMkB,aAAa,CAAA,CACrCtB,EAAE,CAAC;wBAAEuB,WAAAA,EAAanB,KAAK,CAAC,kBAAA,CAAmB;wBAAEoB,aAAAA,EAAe;uBAC5DvD,OAAO,GACP2B,IAAI,CAAC,CAAC,EAAE7B,IAAI,EAAE,IAAM;AACnB8B,4BAAAA,QAAAA,EAAU9B,KAAKwD,WAAW;AAC1BvC,4BAAAA,KAAAA,EAAOjB,KAAKiB;yBACtB,CAAA,CAAA;AACA,gBAAA;AACA,aAAA;YACEyC,SAAAA,EAAW;gBACTxC,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,WAAA;gBACNC,WAAAA,EAAa;oBACXjB,GAAAA,EAAK,EAAA;oBACLmB,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGP,OAAAA,CAAQ,mBAAmB,CAAC;oBAC5CQ,KAAAA,EAAO;AAAC,wBAAA;AAAe;AAC7B,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAMgC,YAAYxE,MAAAA,CAAO;wBAAEa,QAAAA,EAAU;AAAW,qBAAA,CAAA;oBAEhD,OAAO2D,SAAAA,CACJ/B,GAAG,CAAC,IAAA,CAAA,CACJC,IAAI,CAACF,WAAAA,CAAAA,CACLO,EAAE,CAAC;wBAAEC,MAAAA,EAAQ;uBACbhC,OAAO,GACP2B,IAAI,CAAC,CAAC,EAAE7B,IAAI,EAAE,IAAM;AACnB8B,4BAAAA,QAAAA,EAAU9B,KAAK8B,QAAQ;AACvBb,4BAAAA,KAAAA,EAAO,CAAA,EAAGjB,IAAAA,CAAK8B,QAAQ,CAAC,UAAU;yBAC5C,CAAA,CAAA;AACA,gBAAA;AACA,aAAA;YACE6B,EAAAA,EAAI;gBACFzC,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,IAAA;gBACNC,WAAAA,EAAa;oBACXjB,GAAAA,EAAK,EAAA;oBACLmB,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGP,OAAAA,CAAQ,YAAY,CAAC;oBACrCQ,KAAAA,EAAO;AAAC,wBAAA;AAAQ;AACtB,iBAAA;AACI,gBAAA,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAEW,KAAK,EAAE,EAAA;AACvC,oBAAA,MAAMsB,KAAKzE,MAAAA,CAAO;wBAAEa,QAAAA,EAAU;AAAI,qBAAA,CAAA;oBAElC,OAAO4D,EAAAA,CACJhC,GAAG,CAAC,OAAA,CAAA,CACJC,IAAI,CAACF,WAAAA,CAAAA,CACLO,EAAE,CAAC;wBAAE2B,EAAAA,EAAIvB,KAAAA,CAAMwB,GAAG,CAACC,OAAO;wBAAEC,CAAAA,EAAG;uBAC/B7D,OAAO,GACP2B,IAAI,CAAC,CAAC,EAAE7B,IAAI,EAAE,IAAM;AACnB8B,4BAAAA,QAAAA,EAAU,GAAG9B,IAAAA,CAAKgE,QAAQ,CAAC,CAAA,CAAE,CAACC,SAAS,CAAC,CAAC,EAAEjE,KAAKgE,QAAQ,CAAC,CAAA,CAAE,CAACE,UAAU,CAAA,CAAE;4BACxEjD,KAAAA,EAAOoB,KAAAA,CAAMwB,GAAG,CAAC5C;yBAC3B,CAAA,CAAA;AACA,gBAAA;AACA,aAAA;YAEEkD,MAAAA,EAAQ;gBACNjD,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,QAAA;gBACNC,WAAAA,EAAa;oBACXjB,GAAAA,EAAK,EAAA;oBACLmB,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGP,OAAAA,CAAQ,gBAAgB,CAAC;oBACzCQ,KAAAA,EAAO;AAAC,wBAAA;AAAkB;AAChC,iBAAA;AACI,gBAAA,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAEyB,SAAS,EAAE,EAAA;AAC3C,oBAAA,MAAMgB,SAASjF,MAAAA,CAAO;wBACpBa,QAAAA,EAAU,QAAA;wBACVN,MAAAA,EAAQ;4BACN0E,MAAAA,EAAQ;gCACNC,OAAAA,EAAS;oCACPxE,MAAAA,EAAQ,uBAAA;oCACRC,IAAAA,EAAM,cAAA;oCACN4C,OAAAA,EAAS;wCACP4B,aAAAA,EAAe,eAAA;wCACf,WAAA,EAAa;AAC7B;AACA;AACA;AACA;AACA,qBAAA,CAAA;oBAEM,OAAOF,MAAAA,CACJxC,GAAG,CAAC,OAAA,CAAA,CACJC,IAAI,CAACF,WAAAA,EAAayB,UAAUgB,MAAM,CAAChE,GAAG,CAAA,CACtCD,OAAO,GACP2B,IAAI,CAAC,CAAC,EAAE7B,IAAI,EAAE,IAAM;AACnB8B,4BAAAA,QAAAA,EAAU9B,IAAAA,CAAKsE,IAAI,CAAC,CAAA,CAAE,CAAC3B,KAAK;AAC5B1B,4BAAAA,KAAAA,EAAOjB,IAAAA,CAAKsE,IAAI,CAAC,CAAA,CAAE,CAACrD;yBAC9B,CAAA,CAAA;AACA,gBAAA;AACA,aAAA;YAEEsD,QAAAA,EAAU;gBACRrD,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,UAAA;gBACNC,WAAAA,EAAa;oBACXjB,GAAAA,EAAK,EAAA;oBACLmB,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGP,OAAAA,CAAQ,kBAAkB,CAAC;oBAC3CQ,KAAAA,EAAO;AAAC,wBAAA,eAAA;AAAiB,wBAAA;AAAiB;AAChD,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAM8C,WAAWtF,MAAAA,CAAO;wBAAEa,QAAAA,EAAU;AAAU,qBAAA,CAAA;AAC9C,oBAAA,MAAM,EACJC,IAAAA,EAAM,EAAEyE,kBAAkB,EAAE,EAC7B,GAAG,MAAMD,QAAAA,CAAS7C,GAAG,CAAC,IAAA,CAAA,CAAMC,IAAI,CAACF,aAAaxB,OAAO,EAAA;AACtD,oBAAA,MAAM,EACJF,IAAAA,EAAM,EAAE0E,QAAQ,EAAE,EACnB,GAAG,MAAMF,QAAAA,CACP7C,GAAG,CAAC,wDAAA,CAAA,CACJC,IAAI,CAACF,aACLxB,OAAO,EAAA;AAEV,oBAAA,MAAMe,KAAAA,GAAQyD,QAAQ,CAAC,CAAA,CAAE,CAAC,SAAA,CAAU;oBAEpC,OAAO;wBACL5C,QAAAA,EAAU2C,kBAAAA;AACVxD,wBAAAA,KAAAA,EAAOA,MAAM0D;AACrB,qBAAA;AACA,gBAAA;AACA,aAAA;YAEEjF,OAAAA,EAAS;gBACPwB,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,KAAA;gBACNC,WAAAA,EAAa;oBACXjB,GAAAA,EAAK,EAAA;oBACLmB,MAAAA,EAAQ,EAAA;oBACRsD,SAAAA,EAAW,kBAAA;oBACXC,QAAAA,EAAU,CAAA,EAAG7D,OAAAA,CAAQ,iBAAiB,CAAC;oBACvCQ,KAAAA,EAAO;AAAC,wBAAA,OAAA;AAAS,wBAAA,QAAA;AAAU,wBAAA;AAAU;AAC3C,iBAAA;AACI,gBAAA,MAAMC,YAAAA,CAAAA,CAAa,EAAEY,KAAK,EAAEc,SAAS,EAAE,EAAA;AACrC,oBAAA,MAAMlE,UAAU,IAAI6F,GAAAA,CAAI3B,SAAAA,CAAUzD,OAAO,CAACqF,OAAO,CAAA;oBACjD,MAAM/F,OAAAA,GAAUqD,MAAM2C,QAAQ;oBAC9B,MAAMC,YAAAA,GAAe,MAAMlG,iBAAAA,CAAkB;AAAEC,wBAAAA,OAAAA;AAASC,wBAAAA,OAAAA;AAASC,wBAAAA;AAAM,qBAAA,CAAA;oBACvE,OAAO;wBACL4C,QAAAA,EAAUmD,YAAY,CAAC,kBAAA,CAAmB;AAC1ChE,wBAAAA,KAAAA,EAAOgE,aAAahE;AAC5B,qBAAA;AACA,gBAAA;AACA,aAAA;YAEEiE,MAAAA,EAAQ;gBACNhE,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,QAAA;gBACNC,WAAAA,EAAa;oBACXjB,GAAAA,EAAK,EAAA;oBACLmB,MAAAA,EAAQ,EAAA;oBACRuD,QAAAA,EAAU,CAAA,EAAG7D,OAAAA,CAAQ,gBAAgB,CAAC;oBACtCQ,KAAAA,EAAO;AAAC,wBAAA;AAAW;AACzB,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAMwD,SAAShG,MAAAA,CAAO;wBACpBa,QAAAA,EAAU,QAAA;wBACVN,MAAAA,EAAQ;4BACNyF,MAAAA,EAAQ;gCACNd,OAAAA,EAAS;oCACPxE,MAAAA,EAAQ,0BAAA;oCACRC,IAAAA,EAAM,sBAAA;oCACNsF,OAAAA,EAAS,IAAA;oCACT1C,OAAAA,EAAS;wCACP4B,aAAAA,EAAe,eAAA;wCACf,YAAA,EAAc;AAC9B;AACA;AACA;AACA;AACA,qBAAA,CAAA;AAEM,oBAAA,OAAOa,OACJvD,GAAG,CAAC,IAAA,CAAA,CACJC,IAAI,CAACF,WAAAA,CAAAA,CACLxB,OAAO,EAAA,CACP2B,IAAI,CAAC,CAAC,EAAE7B,IAAI,EAAE,IAAM;AACnB8B,4BAAAA,QAAAA,EAAU9B,KAAKmC,IAAI;AACnBlB,4BAAAA,KAAAA,EAAO,CAAA,EAAGjB,IAAAA,CAAKmC,IAAI,CAAC,UAAU;yBACxC,CAAA,CAAA;AACA,gBAAA;AACA,aAAA;YAEEiD,KAAAA,EAAO;gBACLlE,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,EAAA;gBACNC,WAAAA,EAAa;oBACXjB,GAAAA,EAAK,EAAA;oBACLmB,MAAAA,EAAQ,EAAA;oBACRsD,SAAAA,EAAW,cAAA;oBACXC,QAAAA,EAAU,CAAA,EAAG7D,OAAAA,CAAQ,eAAe,CAAC;oBACrCQ,KAAAA,EAAO;AAAC,wBAAA,QAAA;AAAU,wBAAA,OAAA;AAAS,wBAAA;AAAU;AAC3C,iBAAA;AACI,gBAAA,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAEyB,SAAS,EAAE,EAAA;AAC3C,oBAAA,MAAMiC,QAAQlG,MAAAA,CAAO;wBAAEa,QAAAA,EAAU;AAAO,qBAAA,CAAA;oBAExC,OAAOqF,KAAAA,CACJzD,GAAG,CAAC,UAAA,CAAA,CACJiD,SAAS,CAACzB,SAAAA,CAAUiC,KAAK,CAACR,SAAS,EACnChD,IAAI,CAACF,aACLxB,OAAO,EAAA,CACP2B,IAAI,CAAC,CAAC,EAAE7B,IAAI,EAAE,GAAA;AACb,wBAAA,MAAM8B,WAAW9B,IAAAA,CAAK8B,QAAQ,IAAI9B,IAAAA,CAAKqF,QAAQ,IAAIrF,IAAAA,CAAKmC,IAAI,IAAInC,KAAKiB,KAAK,CAACqB,KAAK,CAAC,GAAA,CAAI,CAAC,CAAA,CAAE;wBACxF,MAAMrB,KAAAA,GAAQjB,IAAAA,CAAKiB,KAAK,IAAI,CAAA,EAAGa,QAAAA,CAASwD,OAAO,CAAC,MAAA,EAAQ,GAAA,CAAA,CAAK,UAAU,CAAC;wBAExE,OAAO;AACLxD,4BAAAA,QAAAA;AACAb,4BAAAA;AACZ,yBAAA;AACA,oBAAA,CAAA,CAAA;AACA,gBAAA;AACA,aAAA;YAEEsE,GAAAA,EAAK;gBACHrE,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,MAAA;gBACNC,WAAAA,EAAa;oBACXjB,GAAAA,EAAK,EAAA;oBACLmB,MAAAA,EAAQ,EAAA;oBACRuD,QAAAA,EAAU,CAAA,EAAG7D,OAAAA,CAAQ,aAAa,CAAC;oBACnCQ,KAAAA,EAAO;AAAC,wBAAA;AAAe,qBAAA;oBACvBoD,SAAAA,EAAW;AACjB,iBAAA;AACI,gBAAA,MAAMnD,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAEyB,SAAS,EAAE,EAAA;AAC3C,oBAAA,MAAMoC,MAAMrG,MAAAA,CAAO;wBAAEa,QAAAA,EAAU;AAAK,qBAAA,CAAA;oBAEpC,OAAOwF,GAAAA,CACJ5D,GAAG,CAAC,cAAA,CAAA,CACJiD,SAAS,CAACzB,SAAAA,CAAUoC,GAAG,CAACX,SAAS,EACjChD,IAAI,CAACF,aACLxB,OAAO,EAAA,CACP2B,IAAI,CAAC,CAAC,EAAE7B,IAAI,EAAE,GAAA;;wBAEb,MAAM8B,QAAAA,GAAW9B,KAAKwF,UAAU,GAC5BxF,KAAKwF,UAAU,CAACC,cAAc,IAAIzF,IAAAA,CAAK4D,EAAE,IAAI5D,IAAAA,CAAK0F,GAAG,GACrD1F,IAAAA,CAAKyF,cAAc,IAAIzF,IAAAA,CAAK4D,EAAE,IAAI5D,IAAAA,CAAK0F,GAAG;AAC9C,wBAAA,MAAMzE,QAAQjB,IAAAA,CAAKwF,UAAU,GACzBxF,IAAAA,CAAKwF,UAAU,CAACG,WAAW,IAAI3F,IAAAA,CAAKwF,UAAU,CAACvE,KAAK,GACpDjB,KAAK2F,WAAW,IAAI3F,KAAKiB,KAAK;wBAClC,IAAI,CAACa,QAAAA,IAAY,CAACb,KAAAA,EAAO;4BACvB2E,MAAAA,CAAOC,GAAG,CAACC,IAAI,CACb,CAAC,uDAAuD,EAAEC,IAAAA,CAAKC,SAAS,CAAChG,IAAAA,CAAAA,CAAAA,CAAO,CAAA;AAE9F,wBAAA;wBACU,OAAO;AACL8B,4BAAAA,QAAAA;AACAb,4BAAAA;AACZ,yBAAA;AACA,oBAAA,CAAA,CAAA;AACA,gBAAA;AACA,aAAA;YAEEgF,OAAAA,EAAS;gBACP/E,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,EAAA;gBACNC,WAAAA,EAAa;oBACXjB,GAAAA,EAAK,EAAA;oBACLmB,MAAAA,EAAQ,EAAA;oBACRuD,QAAAA,EAAU,CAAA,EAAG7D,OAAAA,CAAQ,iBAAiB,CAAC;oBACvCQ,KAAAA,EAAO;AAAC,wBAAA,UAAA;AAAY,wBAAA;AAAkB;AAC5C,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAMuE,UAAU/G,MAAAA,CAAO;wBACrBa,QAAAA,EAAU,SAAA;wBACVN,MAAAA,EAAQ;4BACNwG,OAAAA,EAAS;gCACP7B,OAAAA,EAAS;oCACPxE,MAAAA,EAAQ,yBAAA;oCACRC,IAAAA,EAAM,mBAAA;oCACN4C,OAAAA,EAAS;wCACPyD,aAAAA,EAAe;AAC/B;AACA;AACA;AACA;AACA,qBAAA,CAAA;oBAEM,OAAOD,OAAAA,CACJtE,GAAG,CAAC,aAAA,CAAA,CACJC,IAAI,CAACF,WAAAA,CAAAA,CACLO,EAAE,CAAC,IAAIkE,eAAAA,CAAgB;wBAAE,cAAA,EAAgB;qBAAiB,CAAA,CAAIC,QAAQ,IACtElG,OAAO,EAAA,CACP2B,IAAI,CAAC,CAAC,EAAE7B,IAAI,EAAE,GAAA;AACb,wBAAA,MAAMqG,WAAAA,GAAcrG,IAAAA,CAAKsE,IAAI,CAACkB,UAAU;wBACxC,OAAO;AACL1D,4BAAAA,QAAAA,EAAUuE,YAAYC,SAAS;AAC/BrF,4BAAAA,KAAAA,EAAOoF,YAAYpF;AAC/B,yBAAA;AACA,oBAAA,CAAA,CAAA;AACA,gBAAA;AACA,aAAA;YACEsF,QAAAA,EAAU;gBACRrF,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,EAAA;gBACNC,WAAAA,EAAa;oBACXjB,GAAAA,EAAK,EAAA;oBACLmB,MAAAA,EAAQ,EAAA;oBACRsD,SAAAA,EAAW,uCAAA;oBACXC,QAAAA,EAAU,CAAA,EAAG7D,OAAAA,CAAQ,kBAAkB,CAAC;oBACxCQ,KAAAA,EAAO;AAAC,wBAAA,QAAA;AAAU,wBAAA,OAAA;AAAS,wBAAA;AAAU;AAC3C,iBAAA;AACI,gBAAA,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAEyB,SAAS,EAAE,EAAA;AAC3C,oBAAA,MAAMoD,WAAWrH,MAAAA,CAAO;wBAAEa,QAAAA,EAAU;AAAU,qBAAA,CAAA;oBAE9C,OAAOwG,QAAAA,CACJ3B,SAAS,CAACzB,SAAAA,CAAUoD,QAAQ,CAAC3B,SAAS,EACtCjD,GAAG,CAAC,oCACJC,IAAI,CAACF,aACLxB,OAAO,EAAA,CACP2B,IAAI,CAAC,CAAC,EAAE7B,IAAI,EAAE,GAAA;wBACb,OAAO;AACL8B,4BAAAA,QAAAA,EAAU9B,KAAKwG,kBAAkB;AACjCvF,4BAAAA,KAAAA,EAAOjB,KAAKiB;AACxB,yBAAA;AACA,oBAAA,CAAA,CAAA;AACA,gBAAA;AACA;SACA,CAAA;IAEAwF,iBAAAA,GAAiB,IAAA;AACf,QAAA,MAAMvH,MAAAA,GAASwH,UAAAA;AAEf,QAAA,MAAMC,SAAAA,GAAYf,MAAAA,CAAOnG,MAAM,CAACkC,GAAG,CAAC,iBAAA,CAAA;QACpC,MAAMX,OAAAA,GAAUrC,QAAQiH,MAAAA,CAAOnG,MAAM,CAACmH,MAAM,CAACC,GAAG,EAAEF,SAAAA,EAAW,MAAA,CAAA;AAE7D,QAAA,MAAMG,gBAAgB/F,aAAAA,CAAc;AAAEC,YAAAA,OAAAA;AAAS9B,YAAAA;AAAM,SAAA,CAAA;AAEvD;;AAEA,OACE,OAAO;AACL6H,YAAAA,MAAAA,CAAAA,GAAAA;gBACE,OAAOD,aAAAA;AACb,YAAA,CAAA;AACInF,YAAAA,GAAAA,CAAAA,CAAIQ,IAAI,EAAA;gBACN,OAAO2E,aAAa,CAAC3E,IAAAA,CAAK;AAChC,YAAA,CAAA;YACI6E,GAAAA,CAAAA,CAAI7E,IAAI,EAAE1C,MAAM,EAAA;gBACdqH,aAAa,CAAC3E,KAAK,GAAG1C,MAAAA;AAC5B,YAAA,CAAA;AACIwH,YAAAA,MAAAA,CAAAA,CAAO9E,IAAI,EAAA;gBACT,OAAO2E,aAAa,CAAC3E,IAAAA,CAAK;AAChC,YAAA,CAAA;AAEA;;SAGI,MAAM+E,GAAAA,CAAAA,CAAI,EAAEnH,QAAQ,EAAE2B,WAAW,EAAEW,KAAK,EAAEc,SAAS,EAAE,EAAA;gBACnD,MAAMgE,YAAAA,GAAeL,aAAa,CAAC/G,QAAAA,CAAS;AAE5CxB,gBAAAA,MAAAA,CAAO4I,YAAAA,EAAc,uBAAA,CAAA;gBAErB,OAAOA,YAAAA,CAAa1F,YAAY,CAAC;AAAEC,oBAAAA,WAAAA;AAAaW,oBAAAA,KAAAA;AAAOc,oBAAAA,SAAAA;AAAWjE,oBAAAA;AAAM,iBAAA,CAAA;AAC9E,YAAA;AACA,SAAA;AACA,IAAA,CAAA;;;;;;"}
+{"version":3,"file":"providers-registry.mjs","sources":["../../../server/services/providers-registry.js"],"sourcesContent":["'use strict';\n\nconst { strict: assert } = require('assert');\nconst urljoin = require('url-join');\n\nconst { verifyJwtWithJwks } = require('../utils/verify-jwt-with-jwks');\nconst { bearerGet, fetchJson } = require('../utils/provider-http');\n\nconst initProviders = ({ baseURL }) => ({\n  email: {\n    enabled: true,\n    icon: 'envelope',\n    grantConfig: {},\n  },\n  discord: {\n    enabled: false,\n    icon: 'discord',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/discord/callback`,\n      scope: ['identify', 'email'],\n    },\n    async authCallback({ accessToken }) {\n      const { body } = await bearerGet('https://discord.com/api/users/@me', accessToken);\n      const username =\n        body.discriminator && body.discriminator !== '0'\n          ? `${body.username}#${body.discriminator}`\n          : body.username;\n      return {\n        username,\n        email: body.email,\n      };\n    },\n  },\n  facebook: {\n    enabled: false,\n    icon: 'facebook-square',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/facebook/callback`,\n      scope: ['email'],\n    },\n    async authCallback({ accessToken }) {\n      const { body } = await bearerGet('https://graph.facebook.com/me', accessToken, {\n        qs: { fields: 'name,email' },\n      });\n      return {\n        username: body.name,\n        email: body.email,\n      };\n    },\n  },\n  google: {\n    enabled: false,\n    icon: 'google',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/google/callback`,\n      scope: ['email'],\n    },\n    async authCallback({ accessToken }) {\n      const { body } = await fetchJson(\n        `https://oauth2.googleapis.com/tokeninfo?access_token=${encodeURIComponent(accessToken)}`\n      );\n      return {\n        username: body.email.split('@')[0],\n        email: body.email,\n      };\n    },\n  },\n  github: {\n    enabled: false,\n    icon: 'github',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/github/callback`,\n      scope: ['user', 'user:email'],\n    },\n    async authCallback({ accessToken }) {\n      const { body: userBody } = await bearerGet('https://api.github.com/user', accessToken, {\n        headers: { 'user-agent': 'strapi' },\n      });\n\n      if (userBody.email) {\n        return {\n          username: userBody.login,\n          email: userBody.email,\n        };\n      }\n\n      const { body: emailBody } = await bearerGet(\n        'https://api.github.com/user/emails',\n        accessToken,\n        {\n          headers: { 'user-agent': 'strapi' },\n        }\n      );\n\n      return {\n        username: userBody.login,\n        email: Array.isArray(emailBody)\n          ? emailBody.find((email) => email.primary === true).email\n          : null,\n      };\n    },\n  },\n  microsoft: {\n    enabled: false,\n    icon: 'windows',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/microsoft/callback`,\n      scope: ['user.read'],\n    },\n    async authCallback({ accessToken }) {\n      const { body } = await bearerGet('https://graph.microsoft.com/v1.0/me', accessToken);\n      return {\n        username: body.userPrincipalName,\n        email: body.userPrincipalName,\n      };\n    },\n  },\n\n  twitter: {\n    enabled: false,\n    icon: 'twitter',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/twitter/callback`,\n    },\n    async authCallback({ accessToken, query, providers }) {\n      const { twitterGet } = require('../utils/oauth-connect/oauth1');\n      const { body } = await twitterGet({\n        url: 'https://api.twitter.com/1.1/account/verify_credentials.json',\n        accessToken,\n        accessCredential: query.access_secret,\n        consumerKey: providers.twitter.key,\n        clientCredential: providers.twitter.secret,\n        qs: { include_email: 'true', screen_name: query['raw[screen_name]'] },\n      });\n\n      return {\n        username: body.screen_name,\n        email: body.email,\n      };\n    },\n  },\n  instagram: {\n    enabled: false,\n    icon: 'instagram',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/instagram/callback`,\n      scope: ['user_profile'],\n    },\n    async authCallback({ accessToken }) {\n      const { body } = await bearerGet('https://graph.instagram.com/me', accessToken, {\n        qs: { fields: 'id,username' },\n      });\n      return {\n        username: body.username,\n        email: `${body.username}@strapi.io`,\n      };\n    },\n  },\n  vk: {\n    enabled: false,\n    icon: 'vk',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/vk/callback`,\n      scope: ['email'],\n    },\n    async authCallback({ accessToken, query }) {\n      const { body } = await bearerGet('https://api.vk.com/method/users.get', accessToken, {\n        qs: { user_ids: query.raw.user_id, v: '5.122' },\n      });\n      return {\n        username: `${body.response[0].last_name} ${body.response[0].first_name}`,\n        email: query.raw.email,\n      };\n    },\n  },\n\n  twitch: {\n    enabled: false,\n    icon: 'twitch',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/twitch/callback`,\n      scope: ['user:read:email'],\n    },\n    async authCallback({ accessToken, providers }) {\n      const { body } = await bearerGet('https://api.twitch.tv/helix/users', accessToken, {\n        headers: {\n          'Client-Id': providers.twitch.key,\n        },\n      });\n      return {\n        username: body.data[0].login,\n        email: body.data[0].email,\n      };\n    },\n  },\n\n  linkedin: {\n    enabled: false,\n    icon: 'linkedin',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/linkedin/callback`,\n      scope: ['r_liteprofile', 'r_emailaddress'],\n    },\n    async authCallback({ accessToken }) {\n      const { body: profileBody } = await bearerGet('https://api.linkedin.com/v2/me', accessToken);\n      const { body: emailBody } = await bearerGet(\n        'https://api.linkedin.com/v2/emailAddress?q=members&projection=(elements*(handle~))',\n        accessToken\n      );\n\n      const email = emailBody.elements[0]['handle~'];\n\n      return {\n        username: profileBody.localizedFirstName,\n        email: email.emailAddress,\n      };\n    },\n  },\n\n  cognito: {\n    enabled: false,\n    icon: 'aws',\n    grantConfig: {\n      key: '',\n      secret: '',\n      subdomain: 'my.subdomain.com',\n      callback: `${baseURL}/cognito/callback`,\n      scope: ['email', 'openid', 'profile'],\n    },\n    async authCallback({ query, providers }) {\n      const jwksUrl = new URL(providers.cognito.jwksurl);\n      const idToken = query.id_token;\n      const tokenPayload = await verifyJwtWithJwks({ idToken, jwksUrl });\n      return {\n        username: tokenPayload['cognito:username'],\n        email: tokenPayload.email,\n      };\n    },\n  },\n\n  reddit: {\n    enabled: false,\n    icon: 'reddit',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callback: `${baseURL}/reddit/callback`,\n      scope: ['identity'],\n    },\n    async authCallback({ accessToken }) {\n      const { body } = await bearerGet('https://oauth.reddit.com/api/v1/me', accessToken, {\n        headers: { 'user-agent': 'strapi' },\n      });\n      return {\n        username: body.name,\n        email: `${body.name}@strapi.io`,\n      };\n    },\n  },\n\n  auth0: {\n    enabled: false,\n    icon: '',\n    grantConfig: {\n      key: '',\n      secret: '',\n      subdomain: 'my-tenant.eu',\n      callback: `${baseURL}/auth0/callback`,\n      scope: ['openid', 'email', 'profile'],\n    },\n    async authCallback({ accessToken, providers }) {\n      const { body } = await bearerGet(\n        `https://${providers.auth0.subdomain}.auth0.com/userinfo`,\n        accessToken\n      );\n      const username = body.username || body.nickname || body.name || body.email.split('@')[0];\n      const email = body.email || `${username.replace(/\\s+/g, '.')}@strapi.io`;\n\n      return {\n        username,\n        email,\n      };\n    },\n  },\n\n  cas: {\n    enabled: false,\n    icon: 'book',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callback: `${baseURL}/cas/callback`,\n      scope: ['openid email'],\n      subdomain: 'my.subdomain.com/cas',\n    },\n    async authCallback({ accessToken, providers }) {\n      const { body } = await bearerGet(\n        `https://${providers.cas.subdomain}/oidc/profile`,\n        accessToken\n      );\n      const username = body.attributes\n        ? body.attributes.strapiusername || body.id || body.sub\n        : body.strapiusername || body.id || body.sub;\n      const email = body.attributes\n        ? body.attributes.strapiemail || body.attributes.email\n        : body.strapiemail || body.email;\n      if (!username || !email) {\n        strapi.log.warn(\n          `CAS Response Body did not contain required attributes: ${JSON.stringify(body)}`\n        );\n      }\n      return {\n        username,\n        email,\n      };\n    },\n  },\n\n  patreon: {\n    enabled: false,\n    icon: '',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callback: `${baseURL}/patreon/callback`,\n      scope: ['identity', 'identity[email]'],\n    },\n    async authCallback({ accessToken }) {\n      const { body } = await bearerGet(\n        'https://www.patreon.com/api/oauth2/v2/identity?fields[user]=full_name,email',\n        accessToken\n      );\n      const patreonData = body.data.attributes;\n      return {\n        username: patreonData.full_name,\n        email: patreonData.email,\n      };\n    },\n  },\n  keycloak: {\n    enabled: false,\n    icon: '',\n    grantConfig: {\n      key: '',\n      secret: '',\n      subdomain: 'myKeycloakProvider.com/realms/myrealm',\n      callback: `${baseURL}/keycloak/callback`,\n      scope: ['openid', 'email', 'profile'],\n    },\n    async authCallback({ accessToken, providers }) {\n      const { body } = await bearerGet(\n        `https://${providers.keycloak.subdomain}/protocol/openid-connect/userinfo`,\n        accessToken\n      );\n      return {\n        username: body.preferred_username,\n        email: body.email,\n      };\n    },\n  },\n});\n\nmodule.exports = () => {\n  const apiPrefix = strapi.config.get('api.rest.prefix');\n  const baseURL = urljoin(strapi.config.server.url, apiPrefix, 'auth');\n\n  const authProviders = initProviders({ baseURL });\n\n  return {\n    getAll() {\n      return authProviders;\n    },\n    get(name) {\n      return authProviders[name];\n    },\n    add(name, config) {\n      authProviders[name] = config;\n    },\n    remove(name) {\n      delete authProviders[name];\n    },\n\n    async run({ provider, accessToken, query, providers }) {\n      const authProvider = authProviders[provider];\n\n      assert(authProvider, 'Unknown auth provider');\n\n      return authProvider.authCallback({ accessToken, query, providers });\n    },\n  };\n};\n"],"names":["strict","assert","require$$0","urljoin","require$$1","verifyJwtWithJwks","require$$2","bearerGet","fetchJson","require$$3","initProviders","baseURL","email","enabled","icon","grantConfig","discord","key","secret","callbackUrl","scope","authCallback","accessToken","body","username","discriminator","facebook","qs","fields","name","google","encodeURIComponent","split","github","userBody","headers","login","emailBody","Array","isArray","find","primary","microsoft","userPrincipalName","twitter","query","providers","twitterGet","require$$4","url","accessCredential","access_secret","consumerKey","clientCredential","include_email","screen_name","instagram","vk","user_ids","raw","user_id","v","response","last_name","first_name","twitch","data","linkedin","profileBody","elements","localizedFirstName","emailAddress","cognito","subdomain","callback","jwksUrl","URL","jwksurl","idToken","id_token","tokenPayload","reddit","auth0","nickname","replace","cas","attributes","strapiusername","id","sub","strapiemail","strapi","log","warn","JSON","stringify","patreon","patreonData","full_name","keycloak","preferred_username","providersRegistry","apiPrefix","config","get","server","authProviders","getAll","add","remove","run","provider","authProvider"],"mappings":";;;;;;;;;;;AAEA,IAAA,MAAM,EAAEA,MAAAA,EAAQC,MAAM,EAAE,GAAGC,UAAAA;AAC3B,IAAA,MAAMC,OAAAA,GAAUC,UAAAA;IAEhB,MAAM,EAAEC,iBAAiB,EAAE,GAAGC,wBAAAA,EAAAA;AAC9B,IAAA,MAAM,EAAEC,SAAS,EAAEC,SAAS,EAAE,GAAGC,mBAAAA,EAAAA;AAEjC,IAAA,MAAMC,gBAAgB,CAAC,EAAEC,OAAO,EAAE,IAAM;YACtCC,KAAAA,EAAO;gBACLC,OAAAA,EAAS,IAAA;gBACTC,IAAAA,EAAM,UAAA;AACNC,gBAAAA,WAAAA,EAAa;AACjB,aAAA;YACEC,OAAAA,EAAS;gBACPH,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,SAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,iBAAiB,CAAC;oBAC1CS,KAAAA,EAAO;AAAC,wBAAA,UAAA;AAAY,wBAAA;AAAQ;AAClC,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAM,EAAEC,IAAI,EAAE,GAAG,MAAMhB,UAAU,mCAAA,EAAqCe,WAAAA,CAAAA;AACtE,oBAAA,MAAME,WACJD,IAAAA,CAAKE,aAAa,IAAIF,IAAAA,CAAKE,aAAa,KAAK,GAAA,GACzC,CAAA,EAAGF,KAAKC,QAAQ,CAAC,CAAC,EAAED,IAAAA,CAAKE,aAAa,CAAA,CAAE,GACxCF,KAAKC,QAAQ;oBACnB,OAAO;AACLA,wBAAAA,QAAAA;AACAZ,wBAAAA,KAAAA,EAAOW,KAAKX;AACpB,qBAAA;AACA,gBAAA;AACA,aAAA;YACEc,QAAAA,EAAU;gBACRb,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,iBAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,kBAAkB,CAAC;oBAC3CS,KAAAA,EAAO;AAAC,wBAAA;AAAQ;AACtB,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAM,EAAEC,IAAI,EAAE,GAAG,MAAMhB,SAAAA,CAAU,iCAAiCe,WAAAA,EAAa;wBAC7EK,EAAAA,EAAI;4BAAEC,MAAAA,EAAQ;AAAY;AAClC,qBAAA,CAAA;oBACM,OAAO;AACLJ,wBAAAA,QAAAA,EAAUD,KAAKM,IAAI;AACnBjB,wBAAAA,KAAAA,EAAOW,KAAKX;AACpB,qBAAA;AACA,gBAAA;AACA,aAAA;YACEkB,MAAAA,EAAQ;gBACNjB,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,QAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,gBAAgB,CAAC;oBACzCS,KAAAA,EAAO;AAAC,wBAAA;AAAQ;AACtB,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;oBAChC,MAAM,EAAEC,IAAI,EAAE,GAAG,MAAMf,UACrB,CAAC,qDAAqD,EAAEuB,kBAAAA,CAAmBT,WAAAA,CAAAA,CAAAA,CAAc,CAAA;oBAE3F,OAAO;AACLE,wBAAAA,QAAAA,EAAUD,KAAKX,KAAK,CAACoB,KAAK,CAAC,GAAA,CAAI,CAAC,CAAA,CAAE;AAClCpB,wBAAAA,KAAAA,EAAOW,KAAKX;AACpB,qBAAA;AACA,gBAAA;AACA,aAAA;YACEqB,MAAAA,EAAQ;gBACNpB,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,QAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,gBAAgB,CAAC;oBACzCS,KAAAA,EAAO;AAAC,wBAAA,MAAA;AAAQ,wBAAA;AAAa;AACnC,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;oBAChC,MAAM,EAAEC,MAAMW,QAAQ,EAAE,GAAG,MAAM3B,SAAAA,CAAU,+BAA+Be,WAAAA,EAAa;wBACrFa,OAAAA,EAAS;4BAAE,YAAA,EAAc;AAAQ;AACzC,qBAAA,CAAA;oBAEM,IAAID,QAAAA,CAAStB,KAAK,EAAE;wBAClB,OAAO;AACLY,4BAAAA,QAAAA,EAAUU,SAASE,KAAK;AACxBxB,4BAAAA,KAAAA,EAAOsB,SAAStB;AAC1B,yBAAA;AACA,oBAAA;oBAEM,MAAM,EAAEW,MAAMc,SAAS,EAAE,GAAG,MAAM9B,SAAAA,CAChC,sCACAe,WAAAA,EACA;wBACEa,OAAAA,EAAS;4BAAE,YAAA,EAAc;AAAQ;AAC3C,qBAAA,CAAA;oBAGM,OAAO;AACLX,wBAAAA,QAAAA,EAAUU,SAASE,KAAK;AACxBxB,wBAAAA,KAAAA,EAAO0B,KAAAA,CAAMC,OAAO,CAACF,SAAAA,CAAAA,GACjBA,UAAUG,IAAI,CAAC,CAAC5B,KAAAA,GAAUA,KAAAA,CAAM6B,OAAO,KAAK,IAAA,CAAA,CAAM7B,KAAK,GACvD;AACZ,qBAAA;AACA,gBAAA;AACA,aAAA;YACE8B,SAAAA,EAAW;gBACT7B,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,SAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,mBAAmB,CAAC;oBAC5CS,KAAAA,EAAO;AAAC,wBAAA;AAAY;AAC1B,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAM,EAAEC,IAAI,EAAE,GAAG,MAAMhB,UAAU,qCAAA,EAAuCe,WAAAA,CAAAA;oBACxE,OAAO;AACLE,wBAAAA,QAAAA,EAAUD,KAAKoB,iBAAiB;AAChC/B,wBAAAA,KAAAA,EAAOW,KAAKoB;AACpB,qBAAA;AACA,gBAAA;AACA,aAAA;YAEEC,OAAAA,EAAS;gBACP/B,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,SAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,iBAAiB;AAC/C,iBAAA;AACI,gBAAA,MAAMU,cAAa,EAAEC,WAAW,EAAEuB,KAAK,EAAEC,SAAS,EAAE,EAAA;oBAClD,MAAM,EAAEC,UAAU,EAAE,GAAGC,aAAAA,EAAAA;AACvB,oBAAA,MAAM,EAAEzB,IAAI,EAAE,GAAG,MAAMwB,UAAAA,CAAW;wBAChCE,GAAAA,EAAK,6DAAA;AACL3B,wBAAAA,WAAAA;AACA4B,wBAAAA,gBAAAA,EAAkBL,MAAMM,aAAa;wBACrCC,WAAAA,EAAaN,SAAAA,CAAUF,OAAO,CAAC3B,GAAG;wBAClCoC,gBAAAA,EAAkBP,SAAAA,CAAUF,OAAO,CAAC1B,MAAM;wBAC1CS,EAAAA,EAAI;4BAAE2B,aAAAA,EAAe,MAAA;4BAAQC,WAAAA,EAAaV,KAAK,CAAC,kBAAA;AAAmB;AAC3E,qBAAA,CAAA;oBAEM,OAAO;AACLrB,wBAAAA,QAAAA,EAAUD,KAAKgC,WAAW;AAC1B3C,wBAAAA,KAAAA,EAAOW,KAAKX;AACpB,qBAAA;AACA,gBAAA;AACA,aAAA;YACE4C,SAAAA,EAAW;gBACT3C,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,WAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,mBAAmB,CAAC;oBAC5CS,KAAAA,EAAO;AAAC,wBAAA;AAAe;AAC7B,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAM,EAAEC,IAAI,EAAE,GAAG,MAAMhB,SAAAA,CAAU,kCAAkCe,WAAAA,EAAa;wBAC9EK,EAAAA,EAAI;4BAAEC,MAAAA,EAAQ;AAAa;AACnC,qBAAA,CAAA;oBACM,OAAO;AACLJ,wBAAAA,QAAAA,EAAUD,KAAKC,QAAQ;AACvBZ,wBAAAA,KAAAA,EAAO,CAAA,EAAGW,IAAAA,CAAKC,QAAQ,CAAC,UAAU;AAC1C,qBAAA;AACA,gBAAA;AACA,aAAA;YACEiC,EAAAA,EAAI;gBACF5C,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,IAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,YAAY,CAAC;oBACrCS,KAAAA,EAAO;AAAC,wBAAA;AAAQ;AACtB,iBAAA;AACI,gBAAA,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAEuB,KAAK,EAAE,EAAA;AACvC,oBAAA,MAAM,EAAEtB,IAAI,EAAE,GAAG,MAAMhB,SAAAA,CAAU,uCAAuCe,WAAAA,EAAa;wBACnFK,EAAAA,EAAI;4BAAE+B,QAAAA,EAAUb,KAAAA,CAAMc,GAAG,CAACC,OAAO;4BAAEC,CAAAA,EAAG;AAAO;AACrD,qBAAA,CAAA;oBACM,OAAO;AACLrC,wBAAAA,QAAAA,EAAU,GAAGD,IAAAA,CAAKuC,QAAQ,CAAC,CAAA,CAAE,CAACC,SAAS,CAAC,CAAC,EAAExC,KAAKuC,QAAQ,CAAC,CAAA,CAAE,CAACE,UAAU,CAAA,CAAE;wBACxEpD,KAAAA,EAAOiC,KAAAA,CAAMc,GAAG,CAAC/C;AACzB,qBAAA;AACA,gBAAA;AACA,aAAA;YAEEqD,MAAAA,EAAQ;gBACNpD,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,QAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,gBAAgB,CAAC;oBACzCS,KAAAA,EAAO;AAAC,wBAAA;AAAkB;AAChC,iBAAA;AACI,gBAAA,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAEwB,SAAS,EAAE,EAAA;AAC3C,oBAAA,MAAM,EAAEvB,IAAI,EAAE,GAAG,MAAMhB,SAAAA,CAAU,qCAAqCe,WAAAA,EAAa;wBACjFa,OAAAA,EAAS;4BACP,WAAA,EAAaW,SAAAA,CAAUmB,MAAM,CAAChD;AACxC;AACA,qBAAA,CAAA;oBACM,OAAO;AACLO,wBAAAA,QAAAA,EAAUD,IAAAA,CAAK2C,IAAI,CAAC,CAAA,CAAE,CAAC9B,KAAK;AAC5BxB,wBAAAA,KAAAA,EAAOW,IAAAA,CAAK2C,IAAI,CAAC,CAAA,CAAE,CAACtD;AAC5B,qBAAA;AACA,gBAAA;AACA,aAAA;YAEEuD,QAAAA,EAAU;gBACRtD,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,UAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,kBAAkB,CAAC;oBAC3CS,KAAAA,EAAO;AAAC,wBAAA,eAAA;AAAiB,wBAAA;AAAiB;AAChD,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAM,EAAEC,IAAAA,EAAM6C,WAAW,EAAE,GAAG,MAAM7D,UAAU,gCAAA,EAAkCe,WAAAA,CAAAA;AAChF,oBAAA,MAAM,EAAEC,IAAAA,EAAMc,SAAS,EAAE,GAAG,MAAM9B,UAChC,oFAAA,EACAe,WAAAA,CAAAA;AAGF,oBAAA,MAAMV,QAAQyB,SAAAA,CAAUgC,QAAQ,CAAC,CAAA,CAAE,CAAC,SAAA,CAAU;oBAE9C,OAAO;AACL7C,wBAAAA,QAAAA,EAAU4C,YAAYE,kBAAkB;AACxC1D,wBAAAA,KAAAA,EAAOA,MAAM2D;AACrB,qBAAA;AACA,gBAAA;AACA,aAAA;YAEEC,OAAAA,EAAS;gBACP3D,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,KAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRuD,SAAAA,EAAW,kBAAA;oBACXC,QAAAA,EAAU,CAAA,EAAG/D,OAAAA,CAAQ,iBAAiB,CAAC;oBACvCS,KAAAA,EAAO;AAAC,wBAAA,OAAA;AAAS,wBAAA,QAAA;AAAU,wBAAA;AAAU;AAC3C,iBAAA;AACI,gBAAA,MAAMC,YAAAA,CAAAA,CAAa,EAAEwB,KAAK,EAAEC,SAAS,EAAE,EAAA;AACrC,oBAAA,MAAM6B,UAAU,IAAIC,GAAAA,CAAI9B,SAAAA,CAAU0B,OAAO,CAACK,OAAO,CAAA;oBACjD,MAAMC,OAAAA,GAAUjC,MAAMkC,QAAQ;oBAC9B,MAAMC,YAAAA,GAAe,MAAM3E,iBAAAA,CAAkB;AAAEyE,wBAAAA,OAAAA;AAASH,wBAAAA;AAAO,qBAAA,CAAA;oBAC/D,OAAO;wBACLnD,QAAAA,EAAUwD,YAAY,CAAC,kBAAA,CAAmB;AAC1CpE,wBAAAA,KAAAA,EAAOoE,aAAapE;AAC5B,qBAAA;AACA,gBAAA;AACA,aAAA;YAEEqE,MAAAA,EAAQ;gBACNpE,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,QAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRwD,QAAAA,EAAU,CAAA,EAAG/D,OAAAA,CAAQ,gBAAgB,CAAC;oBACtCS,KAAAA,EAAO;AAAC,wBAAA;AAAW;AACzB,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAM,EAAEC,IAAI,EAAE,GAAG,MAAMhB,SAAAA,CAAU,sCAAsCe,WAAAA,EAAa;wBAClFa,OAAAA,EAAS;4BAAE,YAAA,EAAc;AAAQ;AACzC,qBAAA,CAAA;oBACM,OAAO;AACLX,wBAAAA,QAAAA,EAAUD,KAAKM,IAAI;AACnBjB,wBAAAA,KAAAA,EAAO,CAAA,EAAGW,IAAAA,CAAKM,IAAI,CAAC,UAAU;AACtC,qBAAA;AACA,gBAAA;AACA,aAAA;YAEEqD,KAAAA,EAAO;gBACLrE,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,EAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRuD,SAAAA,EAAW,cAAA;oBACXC,QAAAA,EAAU,CAAA,EAAG/D,OAAAA,CAAQ,eAAe,CAAC;oBACrCS,KAAAA,EAAO;AAAC,wBAAA,QAAA;AAAU,wBAAA,OAAA;AAAS,wBAAA;AAAU;AAC3C,iBAAA;AACI,gBAAA,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAEwB,SAAS,EAAE,EAAA;AAC3C,oBAAA,MAAM,EAAEvB,IAAI,EAAE,GAAG,MAAMhB,UACrB,CAAC,QAAQ,EAAEuC,SAAAA,CAAUoC,KAAK,CAACT,SAAS,CAAC,mBAAmB,CAAC,EACzDnD,WAAAA,CAAAA;AAEF,oBAAA,MAAME,WAAWD,IAAAA,CAAKC,QAAQ,IAAID,IAAAA,CAAK4D,QAAQ,IAAI5D,IAAAA,CAAKM,IAAI,IAAIN,KAAKX,KAAK,CAACoB,KAAK,CAAC,GAAA,CAAI,CAAC,CAAA,CAAE;oBACxF,MAAMpB,KAAAA,GAAQW,IAAAA,CAAKX,KAAK,IAAI,CAAA,EAAGY,QAAAA,CAAS4D,OAAO,CAAC,MAAA,EAAQ,GAAA,CAAA,CAAK,UAAU,CAAC;oBAExE,OAAO;AACL5D,wBAAAA,QAAAA;AACAZ,wBAAAA;AACR,qBAAA;AACA,gBAAA;AACA,aAAA;YAEEyE,GAAAA,EAAK;gBACHxE,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,MAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRwD,QAAAA,EAAU,CAAA,EAAG/D,OAAAA,CAAQ,aAAa,CAAC;oBACnCS,KAAAA,EAAO;AAAC,wBAAA;AAAe,qBAAA;oBACvBqD,SAAAA,EAAW;AACjB,iBAAA;AACI,gBAAA,MAAMpD,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAEwB,SAAS,EAAE,EAAA;AAC3C,oBAAA,MAAM,EAAEvB,IAAI,EAAE,GAAG,MAAMhB,UACrB,CAAC,QAAQ,EAAEuC,SAAAA,CAAUuC,GAAG,CAACZ,SAAS,CAAC,aAAa,CAAC,EACjDnD,WAAAA,CAAAA;oBAEF,MAAME,QAAAA,GAAWD,KAAK+D,UAAU,GAC5B/D,KAAK+D,UAAU,CAACC,cAAc,IAAIhE,IAAAA,CAAKiE,EAAE,IAAIjE,IAAAA,CAAKkE,GAAG,GACrDlE,IAAAA,CAAKgE,cAAc,IAAIhE,IAAAA,CAAKiE,EAAE,IAAIjE,IAAAA,CAAKkE,GAAG;AAC9C,oBAAA,MAAM7E,QAAQW,IAAAA,CAAK+D,UAAU,GACzB/D,IAAAA,CAAK+D,UAAU,CAACI,WAAW,IAAInE,IAAAA,CAAK+D,UAAU,CAAC1E,KAAK,GACpDW,KAAKmE,WAAW,IAAInE,KAAKX,KAAK;oBAClC,IAAI,CAACY,QAAAA,IAAY,CAACZ,KAAAA,EAAO;wBACvB+E,MAAAA,CAAOC,GAAG,CAACC,IAAI,CACb,CAAC,uDAAuD,EAAEC,IAAAA,CAAKC,SAAS,CAACxE,IAAAA,CAAAA,CAAAA,CAAO,CAAA;AAE1F,oBAAA;oBACM,OAAO;AACLC,wBAAAA,QAAAA;AACAZ,wBAAAA;AACR,qBAAA;AACA,gBAAA;AACA,aAAA;YAEEoF,OAAAA,EAAS;gBACPnF,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,EAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRwD,QAAAA,EAAU,CAAA,EAAG/D,OAAAA,CAAQ,iBAAiB,CAAC;oBACvCS,KAAAA,EAAO;AAAC,wBAAA,UAAA;AAAY,wBAAA;AAAkB;AAC5C,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAM,EAAEC,IAAI,EAAE,GAAG,MAAMhB,UACrB,6EAAA,EACAe,WAAAA,CAAAA;AAEF,oBAAA,MAAM2E,WAAAA,GAAc1E,IAAAA,CAAK2C,IAAI,CAACoB,UAAU;oBACxC,OAAO;AACL9D,wBAAAA,QAAAA,EAAUyE,YAAYC,SAAS;AAC/BtF,wBAAAA,KAAAA,EAAOqF,YAAYrF;AAC3B,qBAAA;AACA,gBAAA;AACA,aAAA;YACEuF,QAAAA,EAAU;gBACRtF,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,EAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRuD,SAAAA,EAAW,uCAAA;oBACXC,QAAAA,EAAU,CAAA,EAAG/D,OAAAA,CAAQ,kBAAkB,CAAC;oBACxCS,KAAAA,EAAO;AAAC,wBAAA,QAAA;AAAU,wBAAA,OAAA;AAAS,wBAAA;AAAU;AAC3C,iBAAA;AACI,gBAAA,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAEwB,SAAS,EAAE,EAAA;AAC3C,oBAAA,MAAM,EAAEvB,IAAI,EAAE,GAAG,MAAMhB,UACrB,CAAC,QAAQ,EAAEuC,SAAAA,CAAUqD,QAAQ,CAAC1B,SAAS,CAAC,iCAAiC,CAAC,EAC1EnD,WAAAA,CAAAA;oBAEF,OAAO;AACLE,wBAAAA,QAAAA,EAAUD,KAAK6E,kBAAkB;AACjCxF,wBAAAA,KAAAA,EAAOW,KAAKX;AACpB,qBAAA;AACA,gBAAA;AACA;SACA,CAAA;IAEAyF,iBAAAA,GAAiB,IAAA;AACf,QAAA,MAAMC,SAAAA,GAAYX,MAAAA,CAAOY,MAAM,CAACC,GAAG,CAAC,iBAAA,CAAA;QACpC,MAAM7F,OAAAA,GAAUR,QAAQwF,MAAAA,CAAOY,MAAM,CAACE,MAAM,CAACxD,GAAG,EAAEqD,SAAAA,EAAW,MAAA,CAAA;AAE7D,QAAA,MAAMI,gBAAgBhG,aAAAA,CAAc;AAAEC,YAAAA;AAAO,SAAA,CAAA;QAE7C,OAAO;AACLgG,YAAAA,MAAAA,CAAAA,GAAAA;gBACE,OAAOD,aAAAA;AACb,YAAA,CAAA;AACIF,YAAAA,GAAAA,CAAAA,CAAI3E,IAAI,EAAA;gBACN,OAAO6E,aAAa,CAAC7E,IAAAA,CAAK;AAChC,YAAA,CAAA;YACI+E,GAAAA,CAAAA,CAAI/E,IAAI,EAAE0E,MAAM,EAAA;gBACdG,aAAa,CAAC7E,KAAK,GAAG0E,MAAAA;AAC5B,YAAA,CAAA;AACIM,YAAAA,MAAAA,CAAAA,CAAOhF,IAAI,EAAA;gBACT,OAAO6E,aAAa,CAAC7E,IAAAA,CAAK;AAChC,YAAA,CAAA;YAEI,MAAMiF,GAAAA,CAAAA,CAAI,EAAEC,QAAQ,EAAEzF,WAAW,EAAEuB,KAAK,EAAEC,SAAS,EAAE,EAAA;gBACnD,MAAMkE,YAAAA,GAAeN,aAAa,CAACK,QAAAA,CAAS;AAE5C9G,gBAAAA,MAAAA,CAAO+G,YAAAA,EAAc,uBAAA,CAAA;gBAErB,OAAOA,YAAAA,CAAa3F,YAAY,CAAC;AAAEC,oBAAAA,WAAAA;AAAauB,oBAAAA,KAAAA;AAAOC,oBAAAA;AAAS,iBAAA,CAAA;AACtE,YAAA;AACA,SAAA;AACA,IAAA,CAAA;;;;;;"}

package/dist/server/utils/oauth-connect/index.js

@@ -0,0 +1,236 @@
+'use strict';
+
+var require$$1 = require('@strapi/utils');
+var providers = require('./providers.js');
+var oauth1 = require('./oauth1.js');
+var oauth2 = require('./oauth2.js');
+var index = require('../index.js');
+
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+var require$$1__default = /*#__PURE__*/_interopDefault(require$$1);
+
+var oauthConnect;
+var hasRequiredOauthConnect;
+function requireOauthConnect() {
+    if (hasRequiredOauthConnect) return oauthConnect;
+    hasRequiredOauthConnect = 1;
+    const { errors } = require$$1__default.default;
+    const builtinProviderEndpoints = providers.__require();
+    const oauth1$1 = oauth1.__require();
+    const oauth2$1 = oauth2.__require();
+    const CONNECT_PREFIX = '/connect';
+    const parseConnectPath = (requestPath, apiPrefix)=>{
+        const prefix = `${apiPrefix}${CONNECT_PREFIX}/`;
+        if (!requestPath.startsWith(prefix)) {
+            return null;
+        }
+        const remainder = requestPath.slice(prefix.length);
+        const [provider, segment] = remainder.split('/').filter(Boolean);
+        if (!provider) {
+            return null;
+        }
+        return {
+            provider,
+            isCallback: segment === 'callback'
+        };
+    };
+    /**
+	 * Resolve OAuth endpoint config from built-ins, falling back to store-defined
+	 * endpoints so custom providers registered via providers-registry still work.
+	 */ const buildProviderConfig = (providerName, storedConfig, redirectUri)=>{
+        const defaults = builtinProviderEndpoints[providerName];
+        const endpoints = defaults || {
+            oauth: storedConfig.oauth,
+            authorize_url: storedConfig.authorize_url,
+            access_url: storedConfig.access_url,
+            request_url: storedConfig.request_url,
+            scope_delimiter: storedConfig.scope_delimiter,
+            token_endpoint_auth_method: storedConfig.token_endpoint_auth_method
+        };
+        if (endpoints.oauth === 1) {
+            if (!endpoints.request_url || !endpoints.authorize_url || !endpoints.access_url) {
+                return null;
+            }
+        } else if (!endpoints.authorize_url || !endpoints.access_url) {
+            return null;
+        }
+        return {
+            name: providerName,
+            ...endpoints,
+            key: storedConfig.key,
+            secret: storedConfig.secret,
+            scope: storedConfig.scope,
+            subdomain: storedConfig.subdomain,
+            callback: storedConfig.callback,
+            redirect_uri: redirectUri
+        };
+    };
+    const redirectWithPayload = (ctx, callbackUrl, payload)=>{
+        const url = new URL(callbackUrl);
+        const params = new URLSearchParams();
+        Object.entries(payload).forEach(([key, value])=>{
+            if (key === 'raw') {
+                Object.entries(value).forEach(([rawKey, rawValue])=>{
+                    params.set(`raw[${rawKey}]`, String(rawValue));
+                });
+                return;
+            }
+            if (value !== undefined && value !== null) {
+                params.set(key, String(value));
+            }
+        });
+        url.search = params.toString();
+        ctx.redirect(url.toString());
+    };
+    const preserveGrantDynamic = (ctx)=>{
+        const dynamic = ctx.session.grant?.dynamic;
+        return dynamic ? {
+            dynamic
+        } : {};
+    };
+    const startOAuth1Flow = async (ctx, provider, parsed, redirectUri)=>{
+        const requestToken = await oauth1$1.requestToken({
+            requestUrl: provider.request_url,
+            redirectUri,
+            consumerKey: provider.key,
+            clientCredential: provider.secret
+        });
+        ctx.session.grant = {
+            ...preserveGrantDynamic(ctx),
+            provider: parsed.provider,
+            request: requestToken
+        };
+        const authorizeUrl = `${provider.authorize_url}?oauth_token=${encodeURIComponent(requestToken.oauth_token)}`;
+        return ctx.redirect(authorizeUrl);
+    };
+    const startOAuth2Flow = (ctx, provider, parsed, redirectUri)=>{
+        const state = oauth2$1.generateState();
+        ctx.session.grant = {
+            ...preserveGrantDynamic(ctx),
+            provider: parsed.provider,
+            state
+        };
+        let authorizeUrl = oauth2$1.buildAuthorizeUrl(provider, {
+            key: provider.key,
+            redirectUri,
+            scope: provider.scope,
+            subdomain: provider.subdomain
+        });
+        authorizeUrl += `&state=${encodeURIComponent(state)}`;
+        return ctx.redirect(authorizeUrl);
+    };
+    const handleOAuth1Callback = async (ctx, provider, callbackUrl)=>{
+        const session = ctx.session.grant || {};
+        const { oauth_token: oauthToken, oauth_verifier: oauthVerifier } = ctx.query;
+        const requestToken = session.request;
+        if (!requestToken?.oauth_token || oauthToken !== requestToken.oauth_token) {
+            throw new Error('OAuth1 token mismatch');
+        }
+        const tokenResponse = await oauth1$1.accessToken({
+            accessUrl: provider.access_url,
+            consumerKey: provider.key,
+            clientCredential: provider.secret,
+            oauthToken,
+            oauthVerifier,
+            oauthTokenCredential: requestToken.oauth_token_secret
+        });
+        const payload = oauth2$1.tokensToQueryPayload(provider, tokenResponse);
+        ctx.session.grant = {};
+        return redirectWithPayload(ctx, callbackUrl, payload);
+    };
+    const handleOAuth2Callback = async (ctx, provider, callbackUrl, redirectUri)=>{
+        const session = ctx.session.grant || {};
+        const { code, state: queryState, error, error_description: errorDescription } = ctx.query;
+        if (error) {
+            ctx.session.grant = {};
+            return redirectWithPayload(ctx, callbackUrl, {
+                error,
+                error_description: errorDescription
+            });
+        }
+        if (!code) {
+            throw new Error('OAuth2 missing code parameter');
+        }
+        // Reject when session state is missing (not only on mismatch) to close login-CSRF.
+        if (!session.state || queryState !== session.state) {
+            throw new Error('OAuth2 state mismatch');
+        }
+        const tokenResponse = await oauth2$1.exchangeAuthorizationCode(provider, {
+            key: provider.key,
+            secret: provider.secret,
+            redirectUri,
+            code,
+            subdomain: provider.subdomain
+        });
+        const payload = oauth2$1.tokensToQueryPayload(provider, tokenResponse);
+        ctx.session.grant = {};
+        return redirectWithPayload(ctx, callbackUrl, payload);
+    };
+    const createOAuthConnectMiddleware = ()=>{
+        return async (ctx, next)=>{
+            const apiPrefix = strapi.config.get('api.rest.prefix');
+            const [requestPath] = ctx.request.url.split('?');
+            const parsed = parseConnectPath(requestPath, apiPrefix);
+            if (!parsed) {
+                return next();
+            }
+            if (!ctx.session) {
+                ctx.throw(400, 'OAuth connect requires session middleware');
+            }
+            const storedProviders = await strapi.store({
+                type: 'plugin',
+                name: 'users-permissions',
+                key: 'grant'
+            }).get();
+            const storedConfig = storedProviders?.[parsed.provider];
+            if (!storedConfig?.enabled) {
+                throw new errors.ApplicationError('This provider is disabled');
+            }
+            const { getService } = index.__require();
+            const redirectUri = getService('providers').buildRedirectUri(parsed.provider);
+            const callbackOverride = ctx.state.oauthConnect?.callback ?? ctx.session.grant?.dynamic?.callback;
+            const effectiveConfig = callbackOverride ? {
+                ...storedConfig,
+                callback: callbackOverride
+            } : storedConfig;
+            const provider = buildProviderConfig(parsed.provider, effectiveConfig, redirectUri);
+            if (!provider) {
+                throw new errors.ApplicationError('Unknown OAuth provider');
+            }
+            ctx.session.grant = ctx.session.grant || {};
+            if (!parsed.isCallback) {
+                if (provider.oauth === 1) {
+                    return startOAuth1Flow(ctx, provider, parsed, redirectUri);
+                }
+                return startOAuth2Flow(ctx, provider, parsed, redirectUri);
+            }
+            const callbackUrl = effectiveConfig.callback;
+            if (!callbackUrl) {
+                throw new errors.ApplicationError('Provider callback URL is not configured');
+            }
+            try {
+                if (provider.oauth === 1) {
+                    return await handleOAuth1Callback(ctx, provider, callbackUrl);
+                }
+                return await handleOAuth2Callback(ctx, provider, callbackUrl, redirectUri);
+            } catch (err) {
+                ctx.session.grant = {};
+                return redirectWithPayload(ctx, callbackUrl, {
+                    error: 'oauth_error',
+                    error_description: err.message
+                });
+            }
+        };
+    };
+    oauthConnect = {
+        createOAuthConnectMiddleware,
+        parseConnectPath,
+        buildProviderConfig,
+        redirectWithPayload
+    };
+    return oauthConnect;
+}
+
+exports.__require = requireOauthConnect;
+//# sourceMappingURL=index.js.map

package/dist/server/utils/oauth-connect/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sources":["../../../../server/utils/oauth-connect/index.js"],"sourcesContent":["'use strict';\n\nconst { errors } = require('@strapi/utils');\n\nconst builtinProviderEndpoints = require('./providers');\nconst oauth1 = require('./oauth1');\nconst oauth2 = require('./oauth2');\n\nconst CONNECT_PREFIX = '/connect';\n\nconst parseConnectPath = (requestPath, apiPrefix) => {\n  const prefix = `${apiPrefix}${CONNECT_PREFIX}/`;\n  if (!requestPath.startsWith(prefix)) {\n    return null;\n  }\n\n  const remainder = requestPath.slice(prefix.length);\n  const [provider, segment] = remainder.split('/').filter(Boolean);\n\n  if (!provider) {\n    return null;\n  }\n\n  return {\n    provider,\n    isCallback: segment === 'callback',\n  };\n};\n\n/**\n * Resolve OAuth endpoint config from built-ins, falling back to store-defined\n * endpoints so custom providers registered via providers-registry still work.\n */\nconst buildProviderConfig = (providerName, storedConfig, redirectUri) => {\n  const defaults = builtinProviderEndpoints[providerName];\n  const endpoints = defaults || {\n    oauth: storedConfig.oauth,\n    authorize_url: storedConfig.authorize_url,\n    access_url: storedConfig.access_url,\n    request_url: storedConfig.request_url,\n    scope_delimiter: storedConfig.scope_delimiter,\n    token_endpoint_auth_method: storedConfig.token_endpoint_auth_method,\n  };\n\n  if (endpoints.oauth === 1) {\n    if (!endpoints.request_url || !endpoints.authorize_url || !endpoints.access_url) {\n      return null;\n    }\n  } else if (!endpoints.authorize_url || !endpoints.access_url) {\n    return null;\n  }\n\n  return {\n    name: providerName,\n    ...endpoints,\n    key: storedConfig.key,\n    secret: storedConfig.secret,\n    scope: storedConfig.scope,\n    subdomain: storedConfig.subdomain,\n    callback: storedConfig.callback,\n    redirect_uri: redirectUri,\n  };\n};\n\nconst redirectWithPayload = (ctx, callbackUrl, payload) => {\n  const url = new URL(callbackUrl);\n  const params = new URLSearchParams();\n\n  Object.entries(payload).forEach(([key, value]) => {\n    if (key === 'raw') {\n      Object.entries(value).forEach(([rawKey, rawValue]) => {\n        params.set(`raw[${rawKey}]`, String(rawValue));\n      });\n      return;\n    }\n    if (value !== undefined && value !== null) {\n      params.set(key, String(value));\n    }\n  });\n\n  url.search = params.toString();\n  ctx.redirect(url.toString());\n};\n\nconst preserveGrantDynamic = (ctx) => {\n  const dynamic = ctx.session.grant?.dynamic;\n  return dynamic ? { dynamic } : {};\n};\n\nconst startOAuth1Flow = async (ctx, provider, parsed, redirectUri) => {\n  const requestToken = await oauth1.requestToken({\n    requestUrl: provider.request_url,\n    redirectUri,\n    consumerKey: provider.key,\n    clientCredential: provider.secret,\n  });\n\n  ctx.session.grant = {\n    ...preserveGrantDynamic(ctx),\n    provider: parsed.provider,\n    request: requestToken,\n  };\n\n  const authorizeUrl = `${provider.authorize_url}?oauth_token=${encodeURIComponent(requestToken.oauth_token)}`;\n  return ctx.redirect(authorizeUrl);\n};\n\nconst startOAuth2Flow = (ctx, provider, parsed, redirectUri) => {\n  const state = oauth2.generateState();\n  ctx.session.grant = {\n    ...preserveGrantDynamic(ctx),\n    provider: parsed.provider,\n    state,\n  };\n\n  let authorizeUrl = oauth2.buildAuthorizeUrl(provider, {\n    key: provider.key,\n    redirectUri,\n    scope: provider.scope,\n    subdomain: provider.subdomain,\n  });\n\n  authorizeUrl += `&state=${encodeURIComponent(state)}`;\n  return ctx.redirect(authorizeUrl);\n};\n\nconst handleOAuth1Callback = async (ctx, provider, callbackUrl) => {\n  const session = ctx.session.grant || {};\n  const { oauth_token: oauthToken, oauth_verifier: oauthVerifier } = ctx.query;\n  const requestToken = session.request;\n\n  if (!requestToken?.oauth_token || oauthToken !== requestToken.oauth_token) {\n    throw new Error('OAuth1 token mismatch');\n  }\n\n  const tokenResponse = await oauth1.accessToken({\n    accessUrl: provider.access_url,\n    consumerKey: provider.key,\n    clientCredential: provider.secret,\n    oauthToken,\n    oauthVerifier,\n    oauthTokenCredential: requestToken.oauth_token_secret,\n  });\n\n  const payload = oauth2.tokensToQueryPayload(provider, tokenResponse);\n  ctx.session.grant = {};\n  return redirectWithPayload(ctx, callbackUrl, payload);\n};\n\nconst handleOAuth2Callback = async (ctx, provider, callbackUrl, redirectUri) => {\n  const session = ctx.session.grant || {};\n  const { code, state: queryState, error, error_description: errorDescription } = ctx.query;\n\n  if (error) {\n    ctx.session.grant = {};\n    return redirectWithPayload(ctx, callbackUrl, {\n      error,\n      error_description: errorDescription,\n    });\n  }\n\n  if (!code) {\n    throw new Error('OAuth2 missing code parameter');\n  }\n\n  // Reject when session state is missing (not only on mismatch) to close login-CSRF.\n  if (!session.state || queryState !== session.state) {\n    throw new Error('OAuth2 state mismatch');\n  }\n\n  const tokenResponse = await oauth2.exchangeAuthorizationCode(provider, {\n    key: provider.key,\n    secret: provider.secret,\n    redirectUri,\n    code,\n    subdomain: provider.subdomain,\n  });\n\n  const payload = oauth2.tokensToQueryPayload(provider, tokenResponse);\n  ctx.session.grant = {};\n  return redirectWithPayload(ctx, callbackUrl, payload);\n};\n\nconst createOAuthConnectMiddleware = () => {\n  return async (ctx, next) => {\n    const apiPrefix = strapi.config.get('api.rest.prefix');\n    const [requestPath] = ctx.request.url.split('?');\n    const parsed = parseConnectPath(requestPath, apiPrefix);\n\n    if (!parsed) {\n      return next();\n    }\n\n    if (!ctx.session) {\n      ctx.throw(400, 'OAuth connect requires session middleware');\n    }\n\n    const storedProviders = await strapi\n      .store({ type: 'plugin', name: 'users-permissions', key: 'grant' })\n      .get();\n\n    const storedConfig = storedProviders?.[parsed.provider];\n    if (!storedConfig?.enabled) {\n      throw new errors.ApplicationError('This provider is disabled');\n    }\n\n    const { getService } = require('..');\n    const redirectUri = getService('providers').buildRedirectUri(parsed.provider);\n\n    const callbackOverride =\n      ctx.state.oauthConnect?.callback ?? ctx.session.grant?.dynamic?.callback;\n    const effectiveConfig = callbackOverride\n      ? { ...storedConfig, callback: callbackOverride }\n      : storedConfig;\n\n    const provider = buildProviderConfig(parsed.provider, effectiveConfig, redirectUri);\n\n    if (!provider) {\n      throw new errors.ApplicationError('Unknown OAuth provider');\n    }\n\n    ctx.session.grant = ctx.session.grant || {};\n\n    if (!parsed.isCallback) {\n      if (provider.oauth === 1) {\n        return startOAuth1Flow(ctx, provider, parsed, redirectUri);\n      }\n      return startOAuth2Flow(ctx, provider, parsed, redirectUri);\n    }\n\n    const callbackUrl = effectiveConfig.callback;\n    if (!callbackUrl) {\n      throw new errors.ApplicationError('Provider callback URL is not configured');\n    }\n\n    try {\n      if (provider.oauth === 1) {\n        return await handleOAuth1Callback(ctx, provider, callbackUrl);\n      }\n      return await handleOAuth2Callback(ctx, provider, callbackUrl, redirectUri);\n    } catch (err) {\n      ctx.session.grant = {};\n      return redirectWithPayload(ctx, callbackUrl, {\n        error: 'oauth_error',\n        error_description: err.message,\n      });\n    }\n  };\n};\n\nmodule.exports = {\n  createOAuthConnectMiddleware,\n  parseConnectPath,\n  buildProviderConfig,\n  redirectWithPayload,\n};\n"],"names":["errors","require$$0","builtinProviderEndpoints","require$$1","oauth1","require$$2","oauth2","require$$3","CONNECT_PREFIX","parseConnectPath","requestPath","apiPrefix","prefix","startsWith","remainder","slice","length","provider","segment","split","filter","Boolean","isCallback","buildProviderConfig","providerName","storedConfig","redirectUri","defaults","endpoints","oauth","authorize_url","access_url","request_url","scope_delimiter","token_endpoint_auth_method","name","key","secret","scope","subdomain","callback","redirect_uri","redirectWithPayload","ctx","callbackUrl","payload","url","URL","params","URLSearchParams","Object","entries","forEach","value","rawKey","rawValue","set","String","undefined","search","toString","redirect","preserveGrantDynamic","dynamic","session","grant","startOAuth1Flow","parsed","requestToken","requestUrl","consumerKey","clientCredential","request","authorizeUrl","encodeURIComponent","oauth_token","startOAuth2Flow","state","generateState","buildAuthorizeUrl","handleOAuth1Callback","oauthToken","oauth_verifier","oauthVerifier","query","Error","tokenResponse","accessToken","accessUrl","oauthTokenCredential","oauth_token_secret","tokensToQueryPayload","handleOAuth2Callback","code","queryState","error","error_description","errorDescription","exchangeAuthorizationCode","createOAuthConnectMiddleware","next","strapi","config","get","throw","storedProviders","store","type","enabled","ApplicationError","getService","require$$4","buildRedirectUri","callbackOverride","oauthConnect","effectiveConfig","err","message"],"mappings":";;;;;;;;;;;;;;;;;IAEA,MAAM,EAAEA,MAAM,EAAE,GAAGC,2BAAAA;AAEnB,IAAA,MAAMC,wBAAAA,GAA2BC,mBAAAA,EAAAA;AACjC,IAAA,MAAMC,QAAAA,GAASC,gBAAAA,EAAAA;AACf,IAAA,MAAMC,QAAAA,GAASC,gBAAAA,EAAAA;AAEf,IAAA,MAAMC,cAAAA,GAAiB,UAAA;IAEvB,MAAMC,gBAAAA,GAAmB,CAACC,WAAAA,EAAaC,SAAAA,GAAAA;AACrC,QAAA,MAAMC,MAAAA,GAAS,CAAA,EAAGD,SAAAA,CAAAA,EAAYH,cAAAA,CAAe,CAAC,CAAC;AAC/C,QAAA,IAAI,CAACE,WAAAA,CAAYG,UAAU,CAACD,MAAAA,CAAAA,EAAS;YACnC,OAAO,IAAA;AACX,QAAA;AAEE,QAAA,MAAME,SAAAA,GAAYJ,WAAAA,CAAYK,KAAK,CAACH,OAAOI,MAAM,CAAA;QACjD,MAAM,CAACC,UAAUC,OAAAA,CAAQ,GAAGJ,UAAUK,KAAK,CAAC,GAAA,CAAA,CAAKC,MAAM,CAACC,OAAAA,CAAAA;AAExD,QAAA,IAAI,CAACJ,QAAAA,EAAU;YACb,OAAO,IAAA;AACX,QAAA;QAEE,OAAO;AACLA,YAAAA,QAAAA;AACAK,YAAAA,UAAAA,EAAYJ,OAAAA,KAAY;AAC5B,SAAA;AACA,IAAA,CAAA;AAEA;;;AAGA,KACA,MAAMK,mBAAAA,GAAsB,CAACC,YAAAA,EAAcC,YAAAA,EAAcC,WAAAA,GAAAA;QACvD,MAAMC,QAAAA,GAAWzB,wBAAwB,CAACsB,YAAAA,CAAa;AACvD,QAAA,MAAMI,YAAYD,QAAAA,IAAY;AAC5BE,YAAAA,KAAAA,EAAOJ,aAAaI,KAAK;AACzBC,YAAAA,aAAAA,EAAeL,aAAaK,aAAa;AACzCC,YAAAA,UAAAA,EAAYN,aAAaM,UAAU;AACnCC,YAAAA,WAAAA,EAAaP,aAAaO,WAAW;AACrCC,YAAAA,eAAAA,EAAiBR,aAAaQ,eAAe;AAC7CC,YAAAA,0BAAAA,EAA4BT,aAAaS;AAC7C,SAAA;QAEE,IAAIN,SAAAA,CAAUC,KAAK,KAAK,CAAA,EAAG;YACzB,IAAI,CAACD,SAAAA,CAAUI,WAAW,IAAI,CAACJ,SAAAA,CAAUE,aAAa,IAAI,CAACF,SAAAA,CAAUG,UAAU,EAAE;gBAC/E,OAAO,IAAA;AACb,YAAA;QACA,CAAA,MAAS,IAAI,CAACH,SAAAA,CAAUE,aAAa,IAAI,CAACF,SAAAA,CAAUG,UAAU,EAAE;YAC5D,OAAO,IAAA;AACX,QAAA;QAEE,OAAO;YACLI,IAAAA,EAAMX,YAAAA;AACN,YAAA,GAAGI,SAAS;AACZQ,YAAAA,GAAAA,EAAKX,aAAaW,GAAG;AACrBC,YAAAA,MAAAA,EAAQZ,aAAaY,MAAM;AAC3BC,YAAAA,KAAAA,EAAOb,aAAaa,KAAK;AACzBC,YAAAA,SAAAA,EAAWd,aAAac,SAAS;AACjCC,YAAAA,QAAAA,EAAUf,aAAae,QAAQ;YAC/BC,YAAAA,EAAcf;AAClB,SAAA;AACA,IAAA,CAAA;IAEA,MAAMgB,mBAAAA,GAAsB,CAACC,GAAAA,EAAKC,WAAAA,EAAaC,OAAAA,GAAAA;QAC7C,MAAMC,GAAAA,GAAM,IAAIC,GAAAA,CAAIH,WAAAA,CAAAA;AACpB,QAAA,MAAMI,SAAS,IAAIC,eAAAA,EAAAA;QAEnBC,MAAAA,CAAOC,OAAO,CAACN,OAAAA,CAAAA,CAASO,OAAO,CAAC,CAAC,CAAChB,KAAKiB,KAAAA,CAAM,GAAA;AAC3C,YAAA,IAAIjB,QAAQ,KAAA,EAAO;gBACjBc,MAAAA,CAAOC,OAAO,CAACE,KAAAA,CAAAA,CAAOD,OAAO,CAAC,CAAC,CAACE,QAAQC,QAAAA,CAAS,GAAA;oBAC/CP,MAAAA,CAAOQ,GAAG,CAAC,CAAC,IAAI,EAAEF,MAAAA,CAAO,CAAC,CAAC,EAAEG,MAAAA,CAAOF,QAAAA,CAAAA,CAAAA;AAC5C,gBAAA,CAAA,CAAA;AACM,gBAAA;AACN,YAAA;YACI,IAAIF,KAAAA,KAAUK,SAAAA,IAAaL,KAAAA,KAAU,IAAA,EAAM;gBACzCL,MAAAA,CAAOQ,GAAG,CAACpB,GAAAA,EAAKqB,MAAAA,CAAOJ,KAAAA,CAAAA,CAAAA;AAC7B,YAAA;AACA,QAAA,CAAA,CAAA;QAEEP,GAAAA,CAAIa,MAAM,GAAGX,MAAAA,CAAOY,QAAQ,EAAA;QAC5BjB,GAAAA,CAAIkB,QAAQ,CAACf,GAAAA,CAAIc,QAAQ,EAAA,CAAA;AAC3B,IAAA,CAAA;AAEA,IAAA,MAAME,uBAAuB,CAACnB,GAAAA,GAAAA;AAC5B,QAAA,MAAMoB,OAAAA,GAAUpB,GAAAA,CAAIqB,OAAO,CAACC,KAAK,EAAEF,OAAAA;AACnC,QAAA,OAAOA,OAAAA,GAAU;AAAEA,YAAAA;AAAO,SAAA,GAAK;AACjC,IAAA,CAAA;AAEA,IAAA,MAAMG,eAAAA,GAAkB,OAAOvB,GAAAA,EAAK1B,QAAAA,EAAUkD,MAAAA,EAAQzC,WAAAA,GAAAA;AACpD,QAAA,MAAM0C,YAAAA,GAAe,MAAMhE,QAAAA,CAAOgE,YAAY,CAAC;AAC7CC,YAAAA,UAAAA,EAAYpD,SAASe,WAAW;AAChCN,YAAAA,WAAAA;AACA4C,YAAAA,WAAAA,EAAarD,SAASmB,GAAG;AACzBmC,YAAAA,gBAAAA,EAAkBtD,SAASoB;AAC/B,SAAA,CAAA;QAEEM,GAAAA,CAAIqB,OAAO,CAACC,KAAK,GAAG;AAClB,YAAA,GAAGH,qBAAqBnB,GAAAA,CAAI;AAC5B1B,YAAAA,QAAAA,EAAUkD,OAAOlD,QAAQ;YACzBuD,OAAAA,EAASJ;AACb,SAAA;QAEE,MAAMK,YAAAA,GAAe,CAAA,EAAGxD,QAAAA,CAASa,aAAa,CAAC,aAAa,EAAE4C,kBAAAA,CAAmBN,YAAAA,CAAaO,WAAW,CAAA,CAAA,CAAG;QAC5G,OAAOhC,GAAAA,CAAIkB,QAAQ,CAACY,YAAAA,CAAAA;AACtB,IAAA,CAAA;AAEA,IAAA,MAAMG,eAAAA,GAAkB,CAACjC,GAAAA,EAAK1B,QAAAA,EAAUkD,MAAAA,EAAQzC,WAAAA,GAAAA;QAC9C,MAAMmD,KAAAA,GAAQvE,SAAOwE,aAAa,EAAA;QAClCnC,GAAAA,CAAIqB,OAAO,CAACC,KAAK,GAAG;AAClB,YAAA,GAAGH,qBAAqBnB,GAAAA,CAAI;AAC5B1B,YAAAA,QAAAA,EAAUkD,OAAOlD,QAAQ;AACzB4D,YAAAA;AACJ,SAAA;AAEE,QAAA,IAAIJ,YAAAA,GAAenE,QAAAA,CAAOyE,iBAAiB,CAAC9D,QAAAA,EAAU;AACpDmB,YAAAA,GAAAA,EAAKnB,SAASmB,GAAG;AACjBV,YAAAA,WAAAA;AACAY,YAAAA,KAAAA,EAAOrB,SAASqB,KAAK;AACrBC,YAAAA,SAAAA,EAAWtB,SAASsB;AACxB,SAAA,CAAA;AAEEkC,QAAAA,YAAAA,IAAgB,CAAC,OAAO,EAAEC,kBAAAA,CAAmBG,KAAAA,CAAAA,CAAAA,CAAQ;QACrD,OAAOlC,GAAAA,CAAIkB,QAAQ,CAACY,YAAAA,CAAAA;AACtB,IAAA,CAAA;IAEA,MAAMO,oBAAAA,GAAuB,OAAOrC,GAAAA,EAAK1B,QAAAA,EAAU2B,WAAAA,GAAAA;AACjD,QAAA,MAAMoB,UAAUrB,GAAAA,CAAIqB,OAAO,CAACC,KAAK,IAAI,EAAA;QACrC,MAAM,EAAEU,aAAaM,UAAU,EAAEC,gBAAgBC,aAAa,EAAE,GAAGxC,GAAAA,CAAIyC,KAAK;QAC5E,MAAMhB,YAAAA,GAAeJ,QAAQQ,OAAO;AAEpC,QAAA,IAAI,CAACJ,YAAAA,EAAcO,WAAAA,IAAeM,UAAAA,KAAeb,YAAAA,CAAaO,WAAW,EAAE;AACzE,YAAA,MAAM,IAAIU,KAAAA,CAAM,uBAAA,CAAA;AACpB,QAAA;AAEE,QAAA,MAAMC,aAAAA,GAAgB,MAAMlF,QAAAA,CAAOmF,WAAW,CAAC;AAC7CC,YAAAA,SAAAA,EAAWvE,SAASc,UAAU;AAC9BuC,YAAAA,WAAAA,EAAarD,SAASmB,GAAG;AACzBmC,YAAAA,gBAAAA,EAAkBtD,SAASoB,MAAM;AACjC4C,YAAAA,UAAAA;AACAE,YAAAA,aAAAA;AACAM,YAAAA,oBAAAA,EAAsBrB,aAAasB;AACvC,SAAA,CAAA;AAEE,QAAA,MAAM7C,OAAAA,GAAUvC,QAAAA,CAAOqF,oBAAoB,CAAC1E,QAAAA,EAAUqE,aAAAA,CAAAA;AACtD3C,QAAAA,GAAAA,CAAIqB,OAAO,CAACC,KAAK,GAAG;QACpB,OAAOvB,mBAAAA,CAAoBC,KAAKC,WAAAA,EAAaC,OAAAA,CAAAA;AAC/C,IAAA,CAAA;AAEA,IAAA,MAAM+C,oBAAAA,GAAuB,OAAOjD,GAAAA,EAAK1B,QAAAA,EAAU2B,WAAAA,EAAalB,WAAAA,GAAAA;AAC9D,QAAA,MAAMsC,UAAUrB,GAAAA,CAAIqB,OAAO,CAACC,KAAK,IAAI,EAAA;AACrC,QAAA,MAAM,EAAE4B,IAAI,EAAEhB,KAAAA,EAAOiB,UAAU,EAAEC,KAAK,EAAEC,iBAAAA,EAAmBC,gBAAgB,EAAE,GAAGtD,IAAIyC,KAAK;AAEzF,QAAA,IAAIW,KAAAA,EAAO;AACTpD,YAAAA,GAAAA,CAAIqB,OAAO,CAACC,KAAK,GAAG;YACpB,OAAOvB,mBAAAA,CAAoBC,KAAKC,WAAAA,EAAa;AAC3CmD,gBAAAA,KAAAA;gBACAC,iBAAAA,EAAmBC;AACzB,aAAA,CAAA;AACA,QAAA;AAEE,QAAA,IAAI,CAACJ,IAAAA,EAAM;AACT,YAAA,MAAM,IAAIR,KAAAA,CAAM,+BAAA,CAAA;AACpB,QAAA;;AAGE,QAAA,IAAI,CAACrB,OAAAA,CAAQa,KAAK,IAAIiB,UAAAA,KAAe9B,OAAAA,CAAQa,KAAK,EAAE;AAClD,YAAA,MAAM,IAAIQ,KAAAA,CAAM,uBAAA,CAAA;AACpB,QAAA;AAEE,QAAA,MAAMC,aAAAA,GAAgB,MAAMhF,QAAAA,CAAO4F,yBAAyB,CAACjF,QAAAA,EAAU;AACrEmB,YAAAA,GAAAA,EAAKnB,SAASmB,GAAG;AACjBC,YAAAA,MAAAA,EAAQpB,SAASoB,MAAM;AACvBX,YAAAA,WAAAA;AACAmE,YAAAA,IAAAA;AACAtD,YAAAA,SAAAA,EAAWtB,SAASsB;AACxB,SAAA,CAAA;AAEE,QAAA,MAAMM,OAAAA,GAAUvC,QAAAA,CAAOqF,oBAAoB,CAAC1E,QAAAA,EAAUqE,aAAAA,CAAAA;AACtD3C,QAAAA,GAAAA,CAAIqB,OAAO,CAACC,KAAK,GAAG;QACpB,OAAOvB,mBAAAA,CAAoBC,KAAKC,WAAAA,EAAaC,OAAAA,CAAAA;AAC/C,IAAA,CAAA;AAEA,IAAA,MAAMsD,4BAAAA,GAA+B,IAAA;AACnC,QAAA,OAAO,OAAOxD,GAAAA,EAAKyD,IAAAA,GAAAA;AACjB,YAAA,MAAMzF,SAAAA,GAAY0F,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,iBAAA,CAAA;YACpC,MAAM,CAAC7F,YAAY,GAAGiC,GAAAA,CAAI6B,OAAO,CAAC1B,GAAG,CAAC3B,KAAK,CAAC,GAAA,CAAA;YAC5C,MAAMgD,MAAAA,GAAS1D,iBAAiBC,WAAAA,EAAaC,SAAAA,CAAAA;AAE7C,YAAA,IAAI,CAACwD,MAAAA,EAAQ;gBACX,OAAOiC,IAAAA,EAAAA;AACb,YAAA;YAEI,IAAI,CAACzD,GAAAA,CAAIqB,OAAO,EAAE;gBAChBrB,GAAAA,CAAI6D,KAAK,CAAC,GAAA,EAAK,2CAAA,CAAA;AACrB,YAAA;AAEI,YAAA,MAAMC,eAAAA,GAAkB,MAAMJ,MAAAA,CAC3BK,KAAK,CAAC;gBAAEC,IAAAA,EAAM,QAAA;gBAAUxE,IAAAA,EAAM,mBAAA;gBAAqBC,GAAAA,EAAK;eACxDmE,GAAG,EAAA;AAEN,YAAA,MAAM9E,YAAAA,GAAegF,eAAAA,GAAkBtC,MAAAA,CAAOlD,QAAQ,CAAC;YACvD,IAAI,CAACQ,cAAcmF,OAAAA,EAAS;gBAC1B,MAAM,IAAI5G,MAAAA,CAAO6G,gBAAgB,CAAC,2BAAA,CAAA;AACxC,YAAA;YAEI,MAAM,EAAEC,UAAU,EAAE,GAAGC,eAAAA,EAAAA;AACvB,YAAA,MAAMrF,cAAcoF,UAAAA,CAAW,WAAA,CAAA,CAAaE,gBAAgB,CAAC7C,OAAOlD,QAAQ,CAAA;AAE5E,YAAA,MAAMgG,gBAAAA,GACJtE,GAAAA,CAAIkC,KAAK,CAACqC,YAAY,EAAE1E,QAAAA,IAAYG,GAAAA,CAAIqB,OAAO,CAACC,KAAK,EAAEF,OAAAA,EAASvB,QAAAA;AAClE,YAAA,MAAM2E,kBAAkBF,gBAAAA,GACpB;AAAE,gBAAA,GAAGxF,YAAY;gBAAEe,QAAAA,EAAUyE;aAAgB,GAC7CxF,YAAAA;AAEJ,YAAA,MAAMR,QAAAA,GAAWM,mBAAAA,CAAoB4C,MAAAA,CAAOlD,QAAQ,EAAEkG,eAAAA,EAAiBzF,WAAAA,CAAAA;AAEvE,YAAA,IAAI,CAACT,QAAAA,EAAU;gBACb,MAAM,IAAIjB,MAAAA,CAAO6G,gBAAgB,CAAC,wBAAA,CAAA;AACxC,YAAA;YAEIlE,GAAAA,CAAIqB,OAAO,CAACC,KAAK,GAAGtB,IAAIqB,OAAO,CAACC,KAAK,IAAI;YAEzC,IAAI,CAACE,MAAAA,CAAO7C,UAAU,EAAE;gBACtB,IAAIL,QAAAA,CAASY,KAAK,KAAK,CAAA,EAAG;oBACxB,OAAOqC,eAAAA,CAAgBvB,GAAAA,EAAK1B,QAAAA,EAAUkD,MAAAA,EAAQzC,WAAAA,CAAAA;AACtD,gBAAA;gBACM,OAAOkD,eAAAA,CAAgBjC,GAAAA,EAAK1B,QAAAA,EAAUkD,MAAAA,EAAQzC,WAAAA,CAAAA;AACpD,YAAA;YAEI,MAAMkB,WAAAA,GAAcuE,gBAAgB3E,QAAQ;AAC5C,YAAA,IAAI,CAACI,WAAAA,EAAa;gBAChB,MAAM,IAAI5C,MAAAA,CAAO6G,gBAAgB,CAAC,yCAAA,CAAA;AACxC,YAAA;YAEI,IAAI;gBACF,IAAI5F,QAAAA,CAASY,KAAK,KAAK,CAAA,EAAG;oBACxB,OAAO,MAAMmD,oBAAAA,CAAqBrC,GAAAA,EAAK1B,QAAAA,EAAU2B,WAAAA,CAAAA;AACzD,gBAAA;AACM,gBAAA,OAAO,MAAMgD,oBAAAA,CAAqBjD,GAAAA,EAAK1B,QAAAA,EAAU2B,WAAAA,EAAalB,WAAAA,CAAAA;AACpE,YAAA,CAAA,CAAM,OAAO0F,GAAAA,EAAK;AACZzE,gBAAAA,GAAAA,CAAIqB,OAAO,CAACC,KAAK,GAAG;gBACpB,OAAOvB,mBAAAA,CAAoBC,KAAKC,WAAAA,EAAa;oBAC3CmD,KAAAA,EAAO,aAAA;AACPC,oBAAAA,iBAAAA,EAAmBoB,IAAIC;AAC/B,iBAAA,CAAA;AACA,YAAA;AACA,QAAA,CAAA;AACA,IAAA,CAAA;IAEAH,YAAAA,GAAiB;AACff,QAAAA,4BAAAA;AACA1F,QAAAA,gBAAAA;AACAc,QAAAA,mBAAAA;AACAmB,QAAAA;AACF,KAAA;;;;;;"}

package/dist/server/utils/oauth-connect/index.mjs

@@ -0,0 +1,230 @@
+import require$$1 from '@strapi/utils';
+import { __require as requireProviders } from './providers.mjs';
+import { __require as requireOauth1 } from './oauth1.mjs';
+import { __require as requireOauth2 } from './oauth2.mjs';
+import { __require as requireUtils } from '../index.mjs';
+
+var oauthConnect;
+var hasRequiredOauthConnect;
+function requireOauthConnect() {
+    if (hasRequiredOauthConnect) return oauthConnect;
+    hasRequiredOauthConnect = 1;
+    const { errors } = require$$1;
+    const builtinProviderEndpoints = requireProviders();
+    const oauth1 = requireOauth1();
+    const oauth2 = requireOauth2();
+    const CONNECT_PREFIX = '/connect';
+    const parseConnectPath = (requestPath, apiPrefix)=>{
+        const prefix = `${apiPrefix}${CONNECT_PREFIX}/`;
+        if (!requestPath.startsWith(prefix)) {
+            return null;
+        }
+        const remainder = requestPath.slice(prefix.length);
+        const [provider, segment] = remainder.split('/').filter(Boolean);
+        if (!provider) {
+            return null;
+        }
+        return {
+            provider,
+            isCallback: segment === 'callback'
+        };
+    };
+    /**
+	 * Resolve OAuth endpoint config from built-ins, falling back to store-defined
+	 * endpoints so custom providers registered via providers-registry still work.
+	 */ const buildProviderConfig = (providerName, storedConfig, redirectUri)=>{
+        const defaults = builtinProviderEndpoints[providerName];
+        const endpoints = defaults || {
+            oauth: storedConfig.oauth,
+            authorize_url: storedConfig.authorize_url,
+            access_url: storedConfig.access_url,
+            request_url: storedConfig.request_url,
+            scope_delimiter: storedConfig.scope_delimiter,
+            token_endpoint_auth_method: storedConfig.token_endpoint_auth_method
+        };
+        if (endpoints.oauth === 1) {
+            if (!endpoints.request_url || !endpoints.authorize_url || !endpoints.access_url) {
+                return null;
+            }
+        } else if (!endpoints.authorize_url || !endpoints.access_url) {
+            return null;
+        }
+        return {
+            name: providerName,
+            ...endpoints,
+            key: storedConfig.key,
+            secret: storedConfig.secret,
+            scope: storedConfig.scope,
+            subdomain: storedConfig.subdomain,
+            callback: storedConfig.callback,
+            redirect_uri: redirectUri
+        };
+    };
+    const redirectWithPayload = (ctx, callbackUrl, payload)=>{
+        const url = new URL(callbackUrl);
+        const params = new URLSearchParams();
+        Object.entries(payload).forEach(([key, value])=>{
+            if (key === 'raw') {
+                Object.entries(value).forEach(([rawKey, rawValue])=>{
+                    params.set(`raw[${rawKey}]`, String(rawValue));
+                });
+                return;
+            }
+            if (value !== undefined && value !== null) {
+                params.set(key, String(value));
+            }
+        });
+        url.search = params.toString();
+        ctx.redirect(url.toString());
+    };
+    const preserveGrantDynamic = (ctx)=>{
+        const dynamic = ctx.session.grant?.dynamic;
+        return dynamic ? {
+            dynamic
+        } : {};
+    };
+    const startOAuth1Flow = async (ctx, provider, parsed, redirectUri)=>{
+        const requestToken = await oauth1.requestToken({
+            requestUrl: provider.request_url,
+            redirectUri,
+            consumerKey: provider.key,
+            clientCredential: provider.secret
+        });
+        ctx.session.grant = {
+            ...preserveGrantDynamic(ctx),
+            provider: parsed.provider,
+            request: requestToken
+        };
+        const authorizeUrl = `${provider.authorize_url}?oauth_token=${encodeURIComponent(requestToken.oauth_token)}`;
+        return ctx.redirect(authorizeUrl);
+    };
+    const startOAuth2Flow = (ctx, provider, parsed, redirectUri)=>{
+        const state = oauth2.generateState();
+        ctx.session.grant = {
+            ...preserveGrantDynamic(ctx),
+            provider: parsed.provider,
+            state
+        };
+        let authorizeUrl = oauth2.buildAuthorizeUrl(provider, {
+            key: provider.key,
+            redirectUri,
+            scope: provider.scope,
+            subdomain: provider.subdomain
+        });
+        authorizeUrl += `&state=${encodeURIComponent(state)}`;
+        return ctx.redirect(authorizeUrl);
+    };
+    const handleOAuth1Callback = async (ctx, provider, callbackUrl)=>{
+        const session = ctx.session.grant || {};
+        const { oauth_token: oauthToken, oauth_verifier: oauthVerifier } = ctx.query;
+        const requestToken = session.request;
+        if (!requestToken?.oauth_token || oauthToken !== requestToken.oauth_token) {
+            throw new Error('OAuth1 token mismatch');
+        }
+        const tokenResponse = await oauth1.accessToken({
+            accessUrl: provider.access_url,
+            consumerKey: provider.key,
+            clientCredential: provider.secret,
+            oauthToken,
+            oauthVerifier,
+            oauthTokenCredential: requestToken.oauth_token_secret
+        });
+        const payload = oauth2.tokensToQueryPayload(provider, tokenResponse);
+        ctx.session.grant = {};
+        return redirectWithPayload(ctx, callbackUrl, payload);
+    };
+    const handleOAuth2Callback = async (ctx, provider, callbackUrl, redirectUri)=>{
+        const session = ctx.session.grant || {};
+        const { code, state: queryState, error, error_description: errorDescription } = ctx.query;
+        if (error) {
+            ctx.session.grant = {};
+            return redirectWithPayload(ctx, callbackUrl, {
+                error,
+                error_description: errorDescription
+            });
+        }
+        if (!code) {
+            throw new Error('OAuth2 missing code parameter');
+        }
+        // Reject when session state is missing (not only on mismatch) to close login-CSRF.
+        if (!session.state || queryState !== session.state) {
+            throw new Error('OAuth2 state mismatch');
+        }
+        const tokenResponse = await oauth2.exchangeAuthorizationCode(provider, {
+            key: provider.key,
+            secret: provider.secret,
+            redirectUri,
+            code,
+            subdomain: provider.subdomain
+        });
+        const payload = oauth2.tokensToQueryPayload(provider, tokenResponse);
+        ctx.session.grant = {};
+        return redirectWithPayload(ctx, callbackUrl, payload);
+    };
+    const createOAuthConnectMiddleware = ()=>{
+        return async (ctx, next)=>{
+            const apiPrefix = strapi.config.get('api.rest.prefix');
+            const [requestPath] = ctx.request.url.split('?');
+            const parsed = parseConnectPath(requestPath, apiPrefix);
+            if (!parsed) {
+                return next();
+            }
+            if (!ctx.session) {
+                ctx.throw(400, 'OAuth connect requires session middleware');
+            }
+            const storedProviders = await strapi.store({
+                type: 'plugin',
+                name: 'users-permissions',
+                key: 'grant'
+            }).get();
+            const storedConfig = storedProviders?.[parsed.provider];
+            if (!storedConfig?.enabled) {
+                throw new errors.ApplicationError('This provider is disabled');
+            }
+            const { getService } = requireUtils();
+            const redirectUri = getService('providers').buildRedirectUri(parsed.provider);
+            const callbackOverride = ctx.state.oauthConnect?.callback ?? ctx.session.grant?.dynamic?.callback;
+            const effectiveConfig = callbackOverride ? {
+                ...storedConfig,
+                callback: callbackOverride
+            } : storedConfig;
+            const provider = buildProviderConfig(parsed.provider, effectiveConfig, redirectUri);
+            if (!provider) {
+                throw new errors.ApplicationError('Unknown OAuth provider');
+            }
+            ctx.session.grant = ctx.session.grant || {};
+            if (!parsed.isCallback) {
+                if (provider.oauth === 1) {
+                    return startOAuth1Flow(ctx, provider, parsed, redirectUri);
+                }
+                return startOAuth2Flow(ctx, provider, parsed, redirectUri);
+            }
+            const callbackUrl = effectiveConfig.callback;
+            if (!callbackUrl) {
+                throw new errors.ApplicationError('Provider callback URL is not configured');
+            }
+            try {
+                if (provider.oauth === 1) {
+                    return await handleOAuth1Callback(ctx, provider, callbackUrl);
+                }
+                return await handleOAuth2Callback(ctx, provider, callbackUrl, redirectUri);
+            } catch (err) {
+                ctx.session.grant = {};
+                return redirectWithPayload(ctx, callbackUrl, {
+                    error: 'oauth_error',
+                    error_description: err.message
+                });
+            }
+        };
+    };
+    oauthConnect = {
+        createOAuthConnectMiddleware,
+        parseConnectPath,
+        buildProviderConfig,
+        redirectWithPayload
+    };
+    return oauthConnect;
+}
+
+export { requireOauthConnect as __require };
+//# sourceMappingURL=index.mjs.map