@strapi/plugin-users-permissions 5.50.1 → 5.51.0

package/dist/server/utils/oauth-connect/providers.js

@@ -0,0 +1,109 @@
+'use strict';
+
+var providers;
+var hasRequiredProviders;
+function requireProviders() {
+    if (hasRequiredProviders) return providers;
+    hasRequiredProviders = 1;
+    /**
+	 * OAuth endpoint definitions for built-in users-permissions providers.
+	 * Derived from grant's oauth.json (MIT) — inlined to drop the grant dependency.
+	 */ providers = {
+        discord: {
+            oauth: 2,
+            authorize_url: 'https://discord.com/api/oauth2/authorize',
+            access_url: 'https://discord.com/api/oauth2/token',
+            scope_delimiter: ' '
+        },
+        facebook: {
+            oauth: 2,
+            authorize_url: 'https://www.facebook.com/dialog/oauth',
+            access_url: 'https://graph.facebook.com/oauth/access_token'
+        },
+        google: {
+            oauth: 2,
+            authorize_url: 'https://accounts.google.com/o/oauth2/v2/auth',
+            access_url: 'https://oauth2.googleapis.com/token',
+            scope_delimiter: ' '
+        },
+        github: {
+            oauth: 2,
+            authorize_url: 'https://github.com/login/oauth/authorize',
+            access_url: 'https://github.com/login/oauth/access_token'
+        },
+        microsoft: {
+            oauth: 2,
+            authorize_url: 'https://login.microsoftonline.com/common/oauth2/v2.0/authorize',
+            access_url: 'https://login.microsoftonline.com/common/oauth2/v2.0/token',
+            scope_delimiter: ' '
+        },
+        twitter: {
+            oauth: 1,
+            request_url: 'https://api.twitter.com/oauth/request_token',
+            authorize_url: 'https://api.twitter.com/oauth/authenticate',
+            access_url: 'https://api.twitter.com/oauth/access_token'
+        },
+        instagram: {
+            oauth: 2,
+            authorize_url: 'https://api.instagram.com/oauth/authorize',
+            access_url: 'https://api.instagram.com/oauth/access_token',
+            scope_delimiter: ' '
+        },
+        vk: {
+            oauth: 2,
+            authorize_url: 'https://oauth.vk.com/authorize',
+            access_url: 'https://oauth.vk.com/access_token'
+        },
+        twitch: {
+            oauth: 2,
+            authorize_url: 'https://id.twitch.tv/oauth2/authorize',
+            access_url: 'https://id.twitch.tv/oauth2/token',
+            scope_delimiter: ' '
+        },
+        linkedin: {
+            oauth: 2,
+            authorize_url: 'https://www.linkedin.com/oauth/v2/authorization',
+            access_url: 'https://www.linkedin.com/oauth/v2/accessToken',
+            scope_delimiter: ' '
+        },
+        cognito: {
+            oauth: 2,
+            authorize_url: 'https://[subdomain]/oauth2/authorize',
+            access_url: 'https://[subdomain]/oauth2/token',
+            scope_delimiter: ' '
+        },
+        reddit: {
+            oauth: 2,
+            authorize_url: 'https://ssl.reddit.com/api/v1/authorize',
+            access_url: 'https://ssl.reddit.com/api/v1/access_token',
+            token_endpoint_auth_method: 'client_secret_basic'
+        },
+        auth0: {
+            oauth: 2,
+            authorize_url: 'https://[subdomain].auth0.com/authorize',
+            access_url: 'https://[subdomain].auth0.com/oauth/token',
+            scope_delimiter: ' '
+        },
+        cas: {
+            oauth: 2,
+            authorize_url: 'https://[subdomain]/oidc/authorize',
+            access_url: 'https://[subdomain]/oidc/token'
+        },
+        patreon: {
+            oauth: 2,
+            authorize_url: 'https://www.patreon.com/oauth2/authorize',
+            access_url: 'https://www.patreon.com/api/oauth2/token',
+            scope_delimiter: ' '
+        },
+        keycloak: {
+            oauth: 2,
+            authorize_url: 'https://[subdomain]/protocol/openid-connect/auth',
+            access_url: 'https://[subdomain]/protocol/openid-connect/token',
+            scope_delimiter: ' '
+        }
+    };
+    return providers;
+}
+
+exports.__require = requireProviders;
+//# sourceMappingURL=providers.js.map

package/dist/server/utils/oauth-connect/providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.js","sources":["../../../../server/utils/oauth-connect/providers.js"],"sourcesContent":["'use strict';\n\n/**\n * OAuth endpoint definitions for built-in users-permissions providers.\n * Derived from grant's oauth.json (MIT) — inlined to drop the grant dependency.\n */\nmodule.exports = {\n  discord: {\n    oauth: 2,\n    authorize_url: 'https://discord.com/api/oauth2/authorize',\n    access_url: 'https://discord.com/api/oauth2/token',\n    scope_delimiter: ' ',\n  },\n  facebook: {\n    oauth: 2,\n    authorize_url: 'https://www.facebook.com/dialog/oauth',\n    access_url: 'https://graph.facebook.com/oauth/access_token',\n  },\n  google: {\n    oauth: 2,\n    authorize_url: 'https://accounts.google.com/o/oauth2/v2/auth',\n    access_url: 'https://oauth2.googleapis.com/token',\n    scope_delimiter: ' ',\n  },\n  github: {\n    oauth: 2,\n    authorize_url: 'https://github.com/login/oauth/authorize',\n    access_url: 'https://github.com/login/oauth/access_token',\n  },\n  microsoft: {\n    oauth: 2,\n    authorize_url: 'https://login.microsoftonline.com/common/oauth2/v2.0/authorize',\n    access_url: 'https://login.microsoftonline.com/common/oauth2/v2.0/token',\n    scope_delimiter: ' ',\n  },\n  twitter: {\n    oauth: 1,\n    request_url: 'https://api.twitter.com/oauth/request_token',\n    authorize_url: 'https://api.twitter.com/oauth/authenticate',\n    access_url: 'https://api.twitter.com/oauth/access_token',\n  },\n  instagram: {\n    oauth: 2,\n    authorize_url: 'https://api.instagram.com/oauth/authorize',\n    access_url: 'https://api.instagram.com/oauth/access_token',\n    scope_delimiter: ' ',\n  },\n  vk: {\n    oauth: 2,\n    authorize_url: 'https://oauth.vk.com/authorize',\n    access_url: 'https://oauth.vk.com/access_token',\n  },\n  twitch: {\n    oauth: 2,\n    authorize_url: 'https://id.twitch.tv/oauth2/authorize',\n    access_url: 'https://id.twitch.tv/oauth2/token',\n    scope_delimiter: ' ',\n  },\n  linkedin: {\n    oauth: 2,\n    authorize_url: 'https://www.linkedin.com/oauth/v2/authorization',\n    access_url: 'https://www.linkedin.com/oauth/v2/accessToken',\n    scope_delimiter: ' ',\n  },\n  cognito: {\n    oauth: 2,\n    authorize_url: 'https://[subdomain]/oauth2/authorize',\n    access_url: 'https://[subdomain]/oauth2/token',\n    scope_delimiter: ' ',\n  },\n  reddit: {\n    oauth: 2,\n    authorize_url: 'https://ssl.reddit.com/api/v1/authorize',\n    access_url: 'https://ssl.reddit.com/api/v1/access_token',\n    token_endpoint_auth_method: 'client_secret_basic',\n  },\n  auth0: {\n    oauth: 2,\n    authorize_url: 'https://[subdomain].auth0.com/authorize',\n    access_url: 'https://[subdomain].auth0.com/oauth/token',\n    scope_delimiter: ' ',\n  },\n  cas: {\n    oauth: 2,\n    authorize_url: 'https://[subdomain]/oidc/authorize',\n    access_url: 'https://[subdomain]/oidc/token',\n  },\n  patreon: {\n    oauth: 2,\n    authorize_url: 'https://www.patreon.com/oauth2/authorize',\n    access_url: 'https://www.patreon.com/api/oauth2/token',\n    scope_delimiter: ' ',\n  },\n  keycloak: {\n    oauth: 2,\n    authorize_url: 'https://[subdomain]/protocol/openid-connect/auth',\n    access_url: 'https://[subdomain]/protocol/openid-connect/token',\n    scope_delimiter: ' ',\n  },\n};\n"],"names":["providers","discord","oauth","authorize_url","access_url","scope_delimiter","facebook","google","github","microsoft","twitter","request_url","instagram","vk","twitch","linkedin","cognito","reddit","token_endpoint_auth_method","auth0","cas","patreon","keycloak"],"mappings":";;;;;;;AAEA;;;AAGA,KACAA,SAAAA,GAAiB;QACfC,OAAAA,EAAS;YACPC,KAAAA,EAAO,CAAA;YACPC,aAAAA,EAAe,0CAAA;YACfC,UAAAA,EAAY,sCAAA;YACZC,eAAAA,EAAiB;AACrB,SAAA;QACEC,QAAAA,EAAU;YACRJ,KAAAA,EAAO,CAAA;YACPC,aAAAA,EAAe,uCAAA;YACfC,UAAAA,EAAY;AAChB,SAAA;QACEG,MAAAA,EAAQ;YACNL,KAAAA,EAAO,CAAA;YACPC,aAAAA,EAAe,8CAAA;YACfC,UAAAA,EAAY,qCAAA;YACZC,eAAAA,EAAiB;AACrB,SAAA;QACEG,MAAAA,EAAQ;YACNN,KAAAA,EAAO,CAAA;YACPC,aAAAA,EAAe,0CAAA;YACfC,UAAAA,EAAY;AAChB,SAAA;QACEK,SAAAA,EAAW;YACTP,KAAAA,EAAO,CAAA;YACPC,aAAAA,EAAe,gEAAA;YACfC,UAAAA,EAAY,4DAAA;YACZC,eAAAA,EAAiB;AACrB,SAAA;QACEK,OAAAA,EAAS;YACPR,KAAAA,EAAO,CAAA;YACPS,WAAAA,EAAa,6CAAA;YACbR,aAAAA,EAAe,4CAAA;YACfC,UAAAA,EAAY;AAChB,SAAA;QACEQ,SAAAA,EAAW;YACTV,KAAAA,EAAO,CAAA;YACPC,aAAAA,EAAe,2CAAA;YACfC,UAAAA,EAAY,8CAAA;YACZC,eAAAA,EAAiB;AACrB,SAAA;QACEQ,EAAAA,EAAI;YACFX,KAAAA,EAAO,CAAA;YACPC,aAAAA,EAAe,gCAAA;YACfC,UAAAA,EAAY;AAChB,SAAA;QACEU,MAAAA,EAAQ;YACNZ,KAAAA,EAAO,CAAA;YACPC,aAAAA,EAAe,uCAAA;YACfC,UAAAA,EAAY,mCAAA;YACZC,eAAAA,EAAiB;AACrB,SAAA;QACEU,QAAAA,EAAU;YACRb,KAAAA,EAAO,CAAA;YACPC,aAAAA,EAAe,iDAAA;YACfC,UAAAA,EAAY,+CAAA;YACZC,eAAAA,EAAiB;AACrB,SAAA;QACEW,OAAAA,EAAS;YACPd,KAAAA,EAAO,CAAA;YACPC,aAAAA,EAAe,sCAAA;YACfC,UAAAA,EAAY,kCAAA;YACZC,eAAAA,EAAiB;AACrB,SAAA;QACEY,MAAAA,EAAQ;YACNf,KAAAA,EAAO,CAAA;YACPC,aAAAA,EAAe,yCAAA;YACfC,UAAAA,EAAY,4CAAA;YACZc,0BAAAA,EAA4B;AAChC,SAAA;QACEC,KAAAA,EAAO;YACLjB,KAAAA,EAAO,CAAA;YACPC,aAAAA,EAAe,yCAAA;YACfC,UAAAA,EAAY,2CAAA;YACZC,eAAAA,EAAiB;AACrB,SAAA;QACEe,GAAAA,EAAK;YACHlB,KAAAA,EAAO,CAAA;YACPC,aAAAA,EAAe,oCAAA;YACfC,UAAAA,EAAY;AAChB,SAAA;QACEiB,OAAAA,EAAS;YACPnB,KAAAA,EAAO,CAAA;YACPC,aAAAA,EAAe,0CAAA;YACfC,UAAAA,EAAY,0CAAA;YACZC,eAAAA,EAAiB;AACrB,SAAA;QACEiB,QAAAA,EAAU;YACRpB,KAAAA,EAAO,CAAA;YACPC,aAAAA,EAAe,kDAAA;YACfC,UAAAA,EAAY,mDAAA;YACZC,eAAAA,EAAiB;AACrB;AACA,KAAA;;;;;;"}

package/dist/server/utils/oauth-connect/providers.mjs

@@ -0,0 +1,107 @@
+var providers;
+var hasRequiredProviders;
+function requireProviders() {
+    if (hasRequiredProviders) return providers;
+    hasRequiredProviders = 1;
+    /**
+	 * OAuth endpoint definitions for built-in users-permissions providers.
+	 * Derived from grant's oauth.json (MIT) — inlined to drop the grant dependency.
+	 */ providers = {
+        discord: {
+            oauth: 2,
+            authorize_url: 'https://discord.com/api/oauth2/authorize',
+            access_url: 'https://discord.com/api/oauth2/token',
+            scope_delimiter: ' '
+        },
+        facebook: {
+            oauth: 2,
+            authorize_url: 'https://www.facebook.com/dialog/oauth',
+            access_url: 'https://graph.facebook.com/oauth/access_token'
+        },
+        google: {
+            oauth: 2,
+            authorize_url: 'https://accounts.google.com/o/oauth2/v2/auth',
+            access_url: 'https://oauth2.googleapis.com/token',
+            scope_delimiter: ' '
+        },
+        github: {
+            oauth: 2,
+            authorize_url: 'https://github.com/login/oauth/authorize',
+            access_url: 'https://github.com/login/oauth/access_token'
+        },
+        microsoft: {
+            oauth: 2,
+            authorize_url: 'https://login.microsoftonline.com/common/oauth2/v2.0/authorize',
+            access_url: 'https://login.microsoftonline.com/common/oauth2/v2.0/token',
+            scope_delimiter: ' '
+        },
+        twitter: {
+            oauth: 1,
+            request_url: 'https://api.twitter.com/oauth/request_token',
+            authorize_url: 'https://api.twitter.com/oauth/authenticate',
+            access_url: 'https://api.twitter.com/oauth/access_token'
+        },
+        instagram: {
+            oauth: 2,
+            authorize_url: 'https://api.instagram.com/oauth/authorize',
+            access_url: 'https://api.instagram.com/oauth/access_token',
+            scope_delimiter: ' '
+        },
+        vk: {
+            oauth: 2,
+            authorize_url: 'https://oauth.vk.com/authorize',
+            access_url: 'https://oauth.vk.com/access_token'
+        },
+        twitch: {
+            oauth: 2,
+            authorize_url: 'https://id.twitch.tv/oauth2/authorize',
+            access_url: 'https://id.twitch.tv/oauth2/token',
+            scope_delimiter: ' '
+        },
+        linkedin: {
+            oauth: 2,
+            authorize_url: 'https://www.linkedin.com/oauth/v2/authorization',
+            access_url: 'https://www.linkedin.com/oauth/v2/accessToken',
+            scope_delimiter: ' '
+        },
+        cognito: {
+            oauth: 2,
+            authorize_url: 'https://[subdomain]/oauth2/authorize',
+            access_url: 'https://[subdomain]/oauth2/token',
+            scope_delimiter: ' '
+        },
+        reddit: {
+            oauth: 2,
+            authorize_url: 'https://ssl.reddit.com/api/v1/authorize',
+            access_url: 'https://ssl.reddit.com/api/v1/access_token',
+            token_endpoint_auth_method: 'client_secret_basic'
+        },
+        auth0: {
+            oauth: 2,
+            authorize_url: 'https://[subdomain].auth0.com/authorize',
+            access_url: 'https://[subdomain].auth0.com/oauth/token',
+            scope_delimiter: ' '
+        },
+        cas: {
+            oauth: 2,
+            authorize_url: 'https://[subdomain]/oidc/authorize',
+            access_url: 'https://[subdomain]/oidc/token'
+        },
+        patreon: {
+            oauth: 2,
+            authorize_url: 'https://www.patreon.com/oauth2/authorize',
+            access_url: 'https://www.patreon.com/api/oauth2/token',
+            scope_delimiter: ' '
+        },
+        keycloak: {
+            oauth: 2,
+            authorize_url: 'https://[subdomain]/protocol/openid-connect/auth',
+            access_url: 'https://[subdomain]/protocol/openid-connect/token',
+            scope_delimiter: ' '
+        }
+    };
+    return providers;
+}
+
+export { requireProviders as __require };
+//# sourceMappingURL=providers.mjs.map

package/dist/server/utils/oauth-connect/providers.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.mjs","sources":["../../../../server/utils/oauth-connect/providers.js"],"sourcesContent":["'use strict';\n\n/**\n * OAuth endpoint definitions for built-in users-permissions providers.\n * Derived from grant's oauth.json (MIT) — inlined to drop the grant dependency.\n */\nmodule.exports = {\n  discord: {\n    oauth: 2,\n    authorize_url: 'https://discord.com/api/oauth2/authorize',\n    access_url: 'https://discord.com/api/oauth2/token',\n    scope_delimiter: ' ',\n  },\n  facebook: {\n    oauth: 2,\n    authorize_url: 'https://www.facebook.com/dialog/oauth',\n    access_url: 'https://graph.facebook.com/oauth/access_token',\n  },\n  google: {\n    oauth: 2,\n    authorize_url: 'https://accounts.google.com/o/oauth2/v2/auth',\n    access_url: 'https://oauth2.googleapis.com/token',\n    scope_delimiter: ' ',\n  },\n  github: {\n    oauth: 2,\n    authorize_url: 'https://github.com/login/oauth/authorize',\n    access_url: 'https://github.com/login/oauth/access_token',\n  },\n  microsoft: {\n    oauth: 2,\n    authorize_url: 'https://login.microsoftonline.com/common/oauth2/v2.0/authorize',\n    access_url: 'https://login.microsoftonline.com/common/oauth2/v2.0/token',\n    scope_delimiter: ' ',\n  },\n  twitter: {\n    oauth: 1,\n    request_url: 'https://api.twitter.com/oauth/request_token',\n    authorize_url: 'https://api.twitter.com/oauth/authenticate',\n    access_url: 'https://api.twitter.com/oauth/access_token',\n  },\n  instagram: {\n    oauth: 2,\n    authorize_url: 'https://api.instagram.com/oauth/authorize',\n    access_url: 'https://api.instagram.com/oauth/access_token',\n    scope_delimiter: ' ',\n  },\n  vk: {\n    oauth: 2,\n    authorize_url: 'https://oauth.vk.com/authorize',\n    access_url: 'https://oauth.vk.com/access_token',\n  },\n  twitch: {\n    oauth: 2,\n    authorize_url: 'https://id.twitch.tv/oauth2/authorize',\n    access_url: 'https://id.twitch.tv/oauth2/token',\n    scope_delimiter: ' ',\n  },\n  linkedin: {\n    oauth: 2,\n    authorize_url: 'https://www.linkedin.com/oauth/v2/authorization',\n    access_url: 'https://www.linkedin.com/oauth/v2/accessToken',\n    scope_delimiter: ' ',\n  },\n  cognito: {\n    oauth: 2,\n    authorize_url: 'https://[subdomain]/oauth2/authorize',\n    access_url: 'https://[subdomain]/oauth2/token',\n    scope_delimiter: ' ',\n  },\n  reddit: {\n    oauth: 2,\n    authorize_url: 'https://ssl.reddit.com/api/v1/authorize',\n    access_url: 'https://ssl.reddit.com/api/v1/access_token',\n    token_endpoint_auth_method: 'client_secret_basic',\n  },\n  auth0: {\n    oauth: 2,\n    authorize_url: 'https://[subdomain].auth0.com/authorize',\n    access_url: 'https://[subdomain].auth0.com/oauth/token',\n    scope_delimiter: ' ',\n  },\n  cas: {\n    oauth: 2,\n    authorize_url: 'https://[subdomain]/oidc/authorize',\n    access_url: 'https://[subdomain]/oidc/token',\n  },\n  patreon: {\n    oauth: 2,\n    authorize_url: 'https://www.patreon.com/oauth2/authorize',\n    access_url: 'https://www.patreon.com/api/oauth2/token',\n    scope_delimiter: ' ',\n  },\n  keycloak: {\n    oauth: 2,\n    authorize_url: 'https://[subdomain]/protocol/openid-connect/auth',\n    access_url: 'https://[subdomain]/protocol/openid-connect/token',\n    scope_delimiter: ' ',\n  },\n};\n"],"names":["providers","discord","oauth","authorize_url","access_url","scope_delimiter","facebook","google","github","microsoft","twitter","request_url","instagram","vk","twitch","linkedin","cognito","reddit","token_endpoint_auth_method","auth0","cas","patreon","keycloak"],"mappings":";;;;;AAEA;;;AAGA,KACAA,SAAAA,GAAiB;QACfC,OAAAA,EAAS;YACPC,KAAAA,EAAO,CAAA;YACPC,aAAAA,EAAe,0CAAA;YACfC,UAAAA,EAAY,sCAAA;YACZC,eAAAA,EAAiB;AACrB,SAAA;QACEC,QAAAA,EAAU;YACRJ,KAAAA,EAAO,CAAA;YACPC,aAAAA,EAAe,uCAAA;YACfC,UAAAA,EAAY;AAChB,SAAA;QACEG,MAAAA,EAAQ;YACNL,KAAAA,EAAO,CAAA;YACPC,aAAAA,EAAe,8CAAA;YACfC,UAAAA,EAAY,qCAAA;YACZC,eAAAA,EAAiB;AACrB,SAAA;QACEG,MAAAA,EAAQ;YACNN,KAAAA,EAAO,CAAA;YACPC,aAAAA,EAAe,0CAAA;YACfC,UAAAA,EAAY;AAChB,SAAA;QACEK,SAAAA,EAAW;YACTP,KAAAA,EAAO,CAAA;YACPC,aAAAA,EAAe,gEAAA;YACfC,UAAAA,EAAY,4DAAA;YACZC,eAAAA,EAAiB;AACrB,SAAA;QACEK,OAAAA,EAAS;YACPR,KAAAA,EAAO,CAAA;YACPS,WAAAA,EAAa,6CAAA;YACbR,aAAAA,EAAe,4CAAA;YACfC,UAAAA,EAAY;AAChB,SAAA;QACEQ,SAAAA,EAAW;YACTV,KAAAA,EAAO,CAAA;YACPC,aAAAA,EAAe,2CAAA;YACfC,UAAAA,EAAY,8CAAA;YACZC,eAAAA,EAAiB;AACrB,SAAA;QACEQ,EAAAA,EAAI;YACFX,KAAAA,EAAO,CAAA;YACPC,aAAAA,EAAe,gCAAA;YACfC,UAAAA,EAAY;AAChB,SAAA;QACEU,MAAAA,EAAQ;YACNZ,KAAAA,EAAO,CAAA;YACPC,aAAAA,EAAe,uCAAA;YACfC,UAAAA,EAAY,mCAAA;YACZC,eAAAA,EAAiB;AACrB,SAAA;QACEU,QAAAA,EAAU;YACRb,KAAAA,EAAO,CAAA;YACPC,aAAAA,EAAe,iDAAA;YACfC,UAAAA,EAAY,+CAAA;YACZC,eAAAA,EAAiB;AACrB,SAAA;QACEW,OAAAA,EAAS;YACPd,KAAAA,EAAO,CAAA;YACPC,aAAAA,EAAe,sCAAA;YACfC,UAAAA,EAAY,kCAAA;YACZC,eAAAA,EAAiB;AACrB,SAAA;QACEY,MAAAA,EAAQ;YACNf,KAAAA,EAAO,CAAA;YACPC,aAAAA,EAAe,yCAAA;YACfC,UAAAA,EAAY,4CAAA;YACZc,0BAAAA,EAA4B;AAChC,SAAA;QACEC,KAAAA,EAAO;YACLjB,KAAAA,EAAO,CAAA;YACPC,aAAAA,EAAe,yCAAA;YACfC,UAAAA,EAAY,2CAAA;YACZC,eAAAA,EAAiB;AACrB,SAAA;QACEe,GAAAA,EAAK;YACHlB,KAAAA,EAAO,CAAA;YACPC,aAAAA,EAAe,oCAAA;YACfC,UAAAA,EAAY;AAChB,SAAA;QACEiB,OAAAA,EAAS;YACPnB,KAAAA,EAAO,CAAA;YACPC,aAAAA,EAAe,0CAAA;YACfC,UAAAA,EAAY,0CAAA;YACZC,eAAAA,EAAiB;AACrB,SAAA;QACEiB,QAAAA,EAAU;YACRpB,KAAAA,EAAO,CAAA;YACPC,aAAAA,EAAe,kDAAA;YACfC,UAAAA,EAAY,mDAAA;YACZC,eAAAA,EAAiB;AACrB;AACA,KAAA;;;;;;"}

package/dist/server/utils/provider-http.js

@@ -0,0 +1,52 @@
+'use strict';
+
+var providerHttp;
+var hasRequiredProviderHttp;
+function requireProviderHttp() {
+    if (hasRequiredProviderHttp) return providerHttp;
+    hasRequiredProviderHttp = 1;
+    const fetchJson = async (url, options = {})=>{
+        const response = await fetch(url, options);
+        const contentType = response.headers.get('content-type') || '';
+        let body;
+        if (contentType.includes('application/json')) {
+            body = await response.json();
+        } else {
+            const text = await response.text();
+            try {
+                body = JSON.parse(text);
+            } catch  {
+                body = text;
+            }
+        }
+        if (!response.ok) {
+            const message = typeof body === 'object' && body !== null ? body.error_description || body.error || body.message : body;
+            throw new Error(message || `HTTP ${response.status}`);
+        }
+        return {
+            body
+        };
+    };
+    const bearerGet = (url, accessToken, { headers = {}, qs = {} } = {})=>{
+        const target = new URL(url);
+        Object.entries(qs).forEach(([key, value])=>{
+            if (value !== undefined && value !== null) {
+                target.searchParams.set(key, String(value));
+            }
+        });
+        return fetchJson(target, {
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+                ...headers
+            }
+        });
+    };
+    providerHttp = {
+        fetchJson,
+        bearerGet
+    };
+    return providerHttp;
+}
+
+exports.__require = requireProviderHttp;
+//# sourceMappingURL=provider-http.js.map

package/dist/server/utils/provider-http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-http.js","sources":["../../../server/utils/provider-http.js"],"sourcesContent":["'use strict';\n\nconst fetchJson = async (url, options = {}) => {\n  const response = await fetch(url, options);\n  const contentType = response.headers.get('content-type') || '';\n\n  let body;\n  if (contentType.includes('application/json')) {\n    body = await response.json();\n  } else {\n    const text = await response.text();\n    try {\n      body = JSON.parse(text);\n    } catch {\n      body = text;\n    }\n  }\n\n  if (!response.ok) {\n    const message =\n      typeof body === 'object' && body !== null\n        ? body.error_description || body.error || body.message\n        : body;\n    throw new Error(message || `HTTP ${response.status}`);\n  }\n\n  return { body };\n};\n\nconst bearerGet = (url, accessToken, { headers = {}, qs = {} } = {}) => {\n  const target = new URL(url);\n  Object.entries(qs).forEach(([key, value]) => {\n    if (value !== undefined && value !== null) {\n      target.searchParams.set(key, String(value));\n    }\n  });\n\n  return fetchJson(target, {\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n      ...headers,\n    },\n  });\n};\n\nmodule.exports = {\n  fetchJson,\n  bearerGet,\n};\n"],"names":["fetchJson","url","options","response","fetch","contentType","headers","get","body","includes","json","text","JSON","parse","ok","message","error_description","error","Error","status","bearerGet","accessToken","qs","target","URL","Object","entries","forEach","key","value","undefined","searchParams","set","String","Authorization","providerHttp"],"mappings":";;;;;;;AAEA,IAAA,MAAMA,SAAAA,GAAY,OAAOC,GAAAA,EAAKC,OAAAA,GAAU,EAAE,GAAA;QACxC,MAAMC,QAAAA,GAAW,MAAMC,KAAAA,CAAMH,GAAAA,EAAKC,OAAAA,CAAAA;AAClC,QAAA,MAAMG,cAAcF,QAAAA,CAASG,OAAO,CAACC,GAAG,CAAC,cAAA,CAAA,IAAmB,EAAA;QAE5D,IAAIC,IAAAA;QACJ,IAAIH,WAAAA,CAAYI,QAAQ,CAAC,kBAAA,CAAA,EAAqB;YAC5CD,IAAAA,GAAO,MAAML,SAASO,IAAI,EAAA;QAC9B,CAAA,MAAS;YACL,MAAMC,IAAAA,GAAO,MAAMR,QAAAA,CAASQ,IAAI,EAAA;YAChC,IAAI;gBACFH,IAAAA,GAAOI,IAAAA,CAAKC,KAAK,CAACF,IAAAA,CAAAA;AACxB,YAAA,CAAA,CAAM,OAAM;gBACNH,IAAAA,GAAOG,IAAAA;AACb,YAAA;AACA,QAAA;QAEE,IAAI,CAACR,QAAAA,CAASW,EAAE,EAAE;AAChB,YAAA,MAAMC,OAAAA,GACJ,OAAOP,IAAAA,KAAS,QAAA,IAAYA,SAAS,IAAA,GACjCA,IAAAA,CAAKQ,iBAAiB,IAAIR,IAAAA,CAAKS,KAAK,IAAIT,IAAAA,CAAKO,OAAO,GACpDP,IAAAA;YACN,MAAM,IAAIU,MAAMH,OAAAA,IAAW,CAAC,KAAK,EAAEZ,QAAAA,CAASgB,MAAM,CAAA,CAAE,CAAA;AACxD,QAAA;QAEE,OAAO;AAAEX,YAAAA;AAAI,SAAA;AACf,IAAA,CAAA;AAEA,IAAA,MAAMY,SAAAA,GAAY,CAACnB,GAAAA,EAAKoB,WAAAA,EAAa,EAAEf,OAAAA,GAAU,EAAE,EAAEgB,KAAK,EAAE,EAAE,GAAG,EAAE,GAAA;QACjE,MAAMC,MAAAA,GAAS,IAAIC,GAAAA,CAAIvB,GAAAA,CAAAA;QACvBwB,MAAAA,CAAOC,OAAO,CAACJ,EAAAA,CAAAA,CAAIK,OAAO,CAAC,CAAC,CAACC,KAAKC,KAAAA,CAAM,GAAA;YACtC,IAAIA,KAAAA,KAAUC,SAAAA,IAAaD,KAAAA,KAAU,IAAA,EAAM;AACzCN,gBAAAA,MAAAA,CAAOQ,YAAY,CAACC,GAAG,CAACJ,KAAKK,MAAAA,CAAOJ,KAAAA,CAAAA,CAAAA;AAC1C,YAAA;AACA,QAAA,CAAA,CAAA;AAEE,QAAA,OAAO7B,UAAUuB,MAAAA,EAAQ;YACvBjB,OAAAA,EAAS;gBACP4B,aAAAA,EAAe,CAAC,OAAO,EAAEb,WAAAA,CAAAA,CAAa;AACtC,gBAAA,GAAGf;AACT;AACA,SAAA,CAAA;AACA,IAAA,CAAA;IAEA6B,YAAAA,GAAiB;AACfnC,QAAAA,SAAAA;AACAoB,QAAAA;AACF,KAAA;;;;;;"}

package/dist/server/utils/provider-http.mjs

@@ -0,0 +1,50 @@
+var providerHttp;
+var hasRequiredProviderHttp;
+function requireProviderHttp() {
+    if (hasRequiredProviderHttp) return providerHttp;
+    hasRequiredProviderHttp = 1;
+    const fetchJson = async (url, options = {})=>{
+        const response = await fetch(url, options);
+        const contentType = response.headers.get('content-type') || '';
+        let body;
+        if (contentType.includes('application/json')) {
+            body = await response.json();
+        } else {
+            const text = await response.text();
+            try {
+                body = JSON.parse(text);
+            } catch  {
+                body = text;
+            }
+        }
+        if (!response.ok) {
+            const message = typeof body === 'object' && body !== null ? body.error_description || body.error || body.message : body;
+            throw new Error(message || `HTTP ${response.status}`);
+        }
+        return {
+            body
+        };
+    };
+    const bearerGet = (url, accessToken, { headers = {}, qs = {} } = {})=>{
+        const target = new URL(url);
+        Object.entries(qs).forEach(([key, value])=>{
+            if (value !== undefined && value !== null) {
+                target.searchParams.set(key, String(value));
+            }
+        });
+        return fetchJson(target, {
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+                ...headers
+            }
+        });
+    };
+    providerHttp = {
+        fetchJson,
+        bearerGet
+    };
+    return providerHttp;
+}
+
+export { requireProviderHttp as __require };
+//# sourceMappingURL=provider-http.mjs.map

package/dist/server/utils/provider-http.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-http.mjs","sources":["../../../server/utils/provider-http.js"],"sourcesContent":["'use strict';\n\nconst fetchJson = async (url, options = {}) => {\n  const response = await fetch(url, options);\n  const contentType = response.headers.get('content-type') || '';\n\n  let body;\n  if (contentType.includes('application/json')) {\n    body = await response.json();\n  } else {\n    const text = await response.text();\n    try {\n      body = JSON.parse(text);\n    } catch {\n      body = text;\n    }\n  }\n\n  if (!response.ok) {\n    const message =\n      typeof body === 'object' && body !== null\n        ? body.error_description || body.error || body.message\n        : body;\n    throw new Error(message || `HTTP ${response.status}`);\n  }\n\n  return { body };\n};\n\nconst bearerGet = (url, accessToken, { headers = {}, qs = {} } = {}) => {\n  const target = new URL(url);\n  Object.entries(qs).forEach(([key, value]) => {\n    if (value !== undefined && value !== null) {\n      target.searchParams.set(key, String(value));\n    }\n  });\n\n  return fetchJson(target, {\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n      ...headers,\n    },\n  });\n};\n\nmodule.exports = {\n  fetchJson,\n  bearerGet,\n};\n"],"names":["fetchJson","url","options","response","fetch","contentType","headers","get","body","includes","json","text","JSON","parse","ok","message","error_description","error","Error","status","bearerGet","accessToken","qs","target","URL","Object","entries","forEach","key","value","undefined","searchParams","set","String","Authorization","providerHttp"],"mappings":";;;;;AAEA,IAAA,MAAMA,SAAAA,GAAY,OAAOC,GAAAA,EAAKC,OAAAA,GAAU,EAAE,GAAA;QACxC,MAAMC,QAAAA,GAAW,MAAMC,KAAAA,CAAMH,GAAAA,EAAKC,OAAAA,CAAAA;AAClC,QAAA,MAAMG,cAAcF,QAAAA,CAASG,OAAO,CAACC,GAAG,CAAC,cAAA,CAAA,IAAmB,EAAA;QAE5D,IAAIC,IAAAA;QACJ,IAAIH,WAAAA,CAAYI,QAAQ,CAAC,kBAAA,CAAA,EAAqB;YAC5CD,IAAAA,GAAO,MAAML,SAASO,IAAI,EAAA;QAC9B,CAAA,MAAS;YACL,MAAMC,IAAAA,GAAO,MAAMR,QAAAA,CAASQ,IAAI,EAAA;YAChC,IAAI;gBACFH,IAAAA,GAAOI,IAAAA,CAAKC,KAAK,CAACF,IAAAA,CAAAA;AACxB,YAAA,CAAA,CAAM,OAAM;gBACNH,IAAAA,GAAOG,IAAAA;AACb,YAAA;AACA,QAAA;QAEE,IAAI,CAACR,QAAAA,CAASW,EAAE,EAAE;AAChB,YAAA,MAAMC,OAAAA,GACJ,OAAOP,IAAAA,KAAS,QAAA,IAAYA,SAAS,IAAA,GACjCA,IAAAA,CAAKQ,iBAAiB,IAAIR,IAAAA,CAAKS,KAAK,IAAIT,IAAAA,CAAKO,OAAO,GACpDP,IAAAA;YACN,MAAM,IAAIU,MAAMH,OAAAA,IAAW,CAAC,KAAK,EAAEZ,QAAAA,CAASgB,MAAM,CAAA,CAAE,CAAA;AACxD,QAAA;QAEE,OAAO;AAAEX,YAAAA;AAAI,SAAA;AACf,IAAA,CAAA;AAEA,IAAA,MAAMY,SAAAA,GAAY,CAACnB,GAAAA,EAAKoB,WAAAA,EAAa,EAAEf,OAAAA,GAAU,EAAE,EAAEgB,KAAK,EAAE,EAAE,GAAG,EAAE,GAAA;QACjE,MAAMC,MAAAA,GAAS,IAAIC,GAAAA,CAAIvB,GAAAA,CAAAA;QACvBwB,MAAAA,CAAOC,OAAO,CAACJ,EAAAA,CAAAA,CAAIK,OAAO,CAAC,CAAC,CAACC,KAAKC,KAAAA,CAAM,GAAA;YACtC,IAAIA,KAAAA,KAAUC,SAAAA,IAAaD,KAAAA,KAAU,IAAA,EAAM;AACzCN,gBAAAA,MAAAA,CAAOQ,YAAY,CAACC,GAAG,CAACJ,KAAKK,MAAAA,CAAOJ,KAAAA,CAAAA,CAAAA;AAC1C,YAAA;AACA,QAAA,CAAA,CAAA;AAEE,QAAA,OAAO7B,UAAUuB,MAAAA,EAAQ;YACvBjB,OAAAA,EAAS;gBACP4B,aAAAA,EAAe,CAAC,OAAO,EAAEb,WAAAA,CAAAA,CAAa;AACtC,gBAAA,GAAGf;AACT;AACA,SAAA,CAAA;AACA,IAAA,CAAA;IAEA6B,YAAAA,GAAiB;AACfnC,QAAAA,SAAAA;AACAoB,QAAAA;AACF,KAAA;;;;;;"}

package/dist/server/utils/verify-jwt-with-jwks.js

@@ -0,0 +1,60 @@
+'use strict';
+
+var _node_crypto_commonjsExternal = require('../_virtual/_node_crypto.js');
+var require$$1 = require('jsonwebtoken');
+
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+var require$$1__default = /*#__PURE__*/_interopDefault(require$$1);
+
+var verifyJwtWithJwks_1;
+var hasRequiredVerifyJwtWithJwks;
+function requireVerifyJwtWithJwks() {
+    if (hasRequiredVerifyJwtWithJwks) return verifyJwtWithJwks_1;
+    hasRequiredVerifyJwtWithJwks = 1;
+    const crypto = _node_crypto_commonjsExternal.__require();
+    const jwt = require$$1__default.default;
+    const jwkToKeyObject = (jwk)=>crypto.createPublicKey({
+            key: jwk,
+            format: 'jwk'
+        });
+    const verifyJwtWithJwks = async ({ idToken, jwksUrl })=>{
+        const decoded = jwt.decode(idToken, {
+            complete: true
+        });
+        if (!decoded?.header?.kid || !decoded.payload) {
+            throw new Error('The provided token is not valid');
+        }
+        const response = await fetch(jwksUrl.toString());
+        if (!response.ok) {
+            throw new Error('There was an error verifying the token');
+        }
+        const jwk = await response.json();
+        const key = jwk.keys?.find(({ kid })=>kid === decoded.header.kid);
+        if (!key) {
+            throw new Error('There was an error verifying the token');
+        }
+        const publicKey = jwkToKeyObject(key);
+        return new Promise((resolve, reject)=>{
+            jwt.verify(idToken, publicKey, {
+                algorithms: [
+                    'RS256'
+                ]
+            }, (err, tokenPayload)=>{
+                if (err) {
+                    reject(new Error('There was an error verifying the token'));
+                    return;
+                }
+                resolve(tokenPayload);
+            });
+        });
+    };
+    verifyJwtWithJwks_1 = {
+        jwkToKeyObject,
+        verifyJwtWithJwks
+    };
+    return verifyJwtWithJwks_1;
+}
+
+exports.__require = requireVerifyJwtWithJwks;
+//# sourceMappingURL=verify-jwt-with-jwks.js.map

package/dist/server/utils/verify-jwt-with-jwks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-jwt-with-jwks.js","sources":["../../../server/utils/verify-jwt-with-jwks.js"],"sourcesContent":["'use strict';\n\nconst crypto = require('node:crypto');\nconst jwt = require('jsonwebtoken');\n\nconst jwkToKeyObject = (jwk) => crypto.createPublicKey({ key: jwk, format: 'jwk' });\n\nconst verifyJwtWithJwks = async ({ idToken, jwksUrl }) => {\n  const decoded = jwt.decode(idToken, { complete: true });\n\n  if (!decoded?.header?.kid || !decoded.payload) {\n    throw new Error('The provided token is not valid');\n  }\n\n  const response = await fetch(jwksUrl.toString());\n  if (!response.ok) {\n    throw new Error('There was an error verifying the token');\n  }\n\n  const jwk = await response.json();\n  const key = jwk.keys?.find(({ kid }) => kid === decoded.header.kid);\n\n  if (!key) {\n    throw new Error('There was an error verifying the token');\n  }\n\n  const publicKey = jwkToKeyObject(key);\n\n  return new Promise((resolve, reject) => {\n    jwt.verify(idToken, publicKey, { algorithms: ['RS256'] }, (err, tokenPayload) => {\n      if (err) {\n        reject(new Error('There was an error verifying the token'));\n        return;\n      }\n      resolve(tokenPayload);\n    });\n  });\n};\n\nmodule.exports = {\n  jwkToKeyObject,\n  verifyJwtWithJwks,\n};\n"],"names":["crypto","require$$0","jwt","require$$1","jwkToKeyObject","jwk","createPublicKey","key","format","verifyJwtWithJwks","idToken","jwksUrl","decoded","decode","complete","header","kid","payload","Error","response","fetch","toString","ok","json","keys","find","publicKey","Promise","resolve","reject","verify","algorithms","err","tokenPayload","verifyJwtWithJwks_1"],"mappings":";;;;;;;;;;;;;;AAEA,IAAA,MAAMA,MAAAA,GAASC,uCAAAA,EAAAA;AACf,IAAA,MAAMC,GAAAA,GAAMC,2BAAAA;AAEZ,IAAA,MAAMC,cAAAA,GAAiB,CAACC,GAAAA,GAAQL,MAAAA,CAAOM,eAAe,CAAC;YAAEC,GAAAA,EAAKF,GAAAA;YAAKG,MAAAA,EAAQ;AAAK,SAAA,CAAA;AAEhF,IAAA,MAAMC,oBAAoB,OAAO,EAAEC,OAAO,EAAEC,OAAO,EAAE,GAAA;AACnD,QAAA,MAAMC,OAAAA,GAAUV,GAAAA,CAAIW,MAAM,CAACH,OAAAA,EAAS;YAAEI,QAAAA,EAAU;AAAI,SAAA,CAAA;AAEpD,QAAA,IAAI,CAACF,OAAAA,EAASG,MAAAA,EAAQC,OAAO,CAACJ,OAAAA,CAAQK,OAAO,EAAE;AAC7C,YAAA,MAAM,IAAIC,KAAAA,CAAM,iCAAA,CAAA;AACpB,QAAA;AAEE,QAAA,MAAMC,QAAAA,GAAW,MAAMC,KAAAA,CAAMT,OAAAA,CAAQU,QAAQ,EAAA,CAAA;QAC7C,IAAI,CAACF,QAAAA,CAASG,EAAE,EAAE;AAChB,YAAA,MAAM,IAAIJ,KAAAA,CAAM,wCAAA,CAAA;AACpB,QAAA;QAEE,MAAMb,GAAAA,GAAM,MAAMc,QAAAA,CAASI,IAAI,EAAA;AAC/B,QAAA,MAAMhB,GAAAA,GAAMF,GAAAA,CAAImB,IAAI,EAAEC,KAAK,CAAC,EAAET,GAAG,EAAE,GAAKA,GAAAA,KAAQJ,OAAAA,CAAQG,MAAM,CAACC,GAAG,CAAA;AAElE,QAAA,IAAI,CAACT,GAAAA,EAAK;AACR,YAAA,MAAM,IAAIW,KAAAA,CAAM,wCAAA,CAAA;AACpB,QAAA;AAEE,QAAA,MAAMQ,YAAYtB,cAAAA,CAAeG,GAAAA,CAAAA;QAEjC,OAAO,IAAIoB,OAAAA,CAAQ,CAACC,OAAAA,EAASC,MAAAA,GAAAA;YAC3B3B,GAAAA,CAAI4B,MAAM,CAACpB,OAAAA,EAASgB,SAAAA,EAAW;gBAAEK,UAAAA,EAAY;AAAC,oBAAA;AAAQ;AAAA,aAAA,EAAI,CAACC,GAAAA,EAAKC,YAAAA,GAAAA;AAC9D,gBAAA,IAAID,GAAAA,EAAK;AACPH,oBAAAA,MAAAA,CAAO,IAAIX,KAAAA,CAAM,wCAAA,CAAA,CAAA;AACjB,oBAAA;AACR,gBAAA;gBACMU,OAAAA,CAAQK,YAAAA,CAAAA;AACd,YAAA,CAAA,CAAA;AACA,QAAA,CAAA,CAAA;AACA,IAAA,CAAA;IAEAC,mBAAAA,GAAiB;AACf9B,QAAAA,cAAAA;AACAK,QAAAA;AACF,KAAA;;;;;;"}

package/dist/server/utils/verify-jwt-with-jwks.mjs

@@ -0,0 +1,54 @@
+import { __require } from '../_virtual/_node_crypto.mjs';
+import require$$1 from 'jsonwebtoken';
+
+var verifyJwtWithJwks_1;
+var hasRequiredVerifyJwtWithJwks;
+function requireVerifyJwtWithJwks() {
+    if (hasRequiredVerifyJwtWithJwks) return verifyJwtWithJwks_1;
+    hasRequiredVerifyJwtWithJwks = 1;
+    const crypto = __require();
+    const jwt = require$$1;
+    const jwkToKeyObject = (jwk)=>crypto.createPublicKey({
+            key: jwk,
+            format: 'jwk'
+        });
+    const verifyJwtWithJwks = async ({ idToken, jwksUrl })=>{
+        const decoded = jwt.decode(idToken, {
+            complete: true
+        });
+        if (!decoded?.header?.kid || !decoded.payload) {
+            throw new Error('The provided token is not valid');
+        }
+        const response = await fetch(jwksUrl.toString());
+        if (!response.ok) {
+            throw new Error('There was an error verifying the token');
+        }
+        const jwk = await response.json();
+        const key = jwk.keys?.find(({ kid })=>kid === decoded.header.kid);
+        if (!key) {
+            throw new Error('There was an error verifying the token');
+        }
+        const publicKey = jwkToKeyObject(key);
+        return new Promise((resolve, reject)=>{
+            jwt.verify(idToken, publicKey, {
+                algorithms: [
+                    'RS256'
+                ]
+            }, (err, tokenPayload)=>{
+                if (err) {
+                    reject(new Error('There was an error verifying the token'));
+                    return;
+                }
+                resolve(tokenPayload);
+            });
+        });
+    };
+    verifyJwtWithJwks_1 = {
+        jwkToKeyObject,
+        verifyJwtWithJwks
+    };
+    return verifyJwtWithJwks_1;
+}
+
+export { requireVerifyJwtWithJwks as __require };
+//# sourceMappingURL=verify-jwt-with-jwks.mjs.map

package/dist/server/utils/verify-jwt-with-jwks.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-jwt-with-jwks.mjs","sources":["../../../server/utils/verify-jwt-with-jwks.js"],"sourcesContent":["'use strict';\n\nconst crypto = require('node:crypto');\nconst jwt = require('jsonwebtoken');\n\nconst jwkToKeyObject = (jwk) => crypto.createPublicKey({ key: jwk, format: 'jwk' });\n\nconst verifyJwtWithJwks = async ({ idToken, jwksUrl }) => {\n  const decoded = jwt.decode(idToken, { complete: true });\n\n  if (!decoded?.header?.kid || !decoded.payload) {\n    throw new Error('The provided token is not valid');\n  }\n\n  const response = await fetch(jwksUrl.toString());\n  if (!response.ok) {\n    throw new Error('There was an error verifying the token');\n  }\n\n  const jwk = await response.json();\n  const key = jwk.keys?.find(({ kid }) => kid === decoded.header.kid);\n\n  if (!key) {\n    throw new Error('There was an error verifying the token');\n  }\n\n  const publicKey = jwkToKeyObject(key);\n\n  return new Promise((resolve, reject) => {\n    jwt.verify(idToken, publicKey, { algorithms: ['RS256'] }, (err, tokenPayload) => {\n      if (err) {\n        reject(new Error('There was an error verifying the token'));\n        return;\n      }\n      resolve(tokenPayload);\n    });\n  });\n};\n\nmodule.exports = {\n  jwkToKeyObject,\n  verifyJwtWithJwks,\n};\n"],"names":["crypto","require$$0","jwt","require$$1","jwkToKeyObject","jwk","createPublicKey","key","format","verifyJwtWithJwks","idToken","jwksUrl","decoded","decode","complete","header","kid","payload","Error","response","fetch","toString","ok","json","keys","find","publicKey","Promise","resolve","reject","verify","algorithms","err","tokenPayload","verifyJwtWithJwks_1"],"mappings":";;;;;;;;AAEA,IAAA,MAAMA,MAAAA,GAASC,SAAAA,EAAAA;AACf,IAAA,MAAMC,GAAAA,GAAMC,UAAAA;AAEZ,IAAA,MAAMC,cAAAA,GAAiB,CAACC,GAAAA,GAAQL,MAAAA,CAAOM,eAAe,CAAC;YAAEC,GAAAA,EAAKF,GAAAA;YAAKG,MAAAA,EAAQ;AAAK,SAAA,CAAA;AAEhF,IAAA,MAAMC,oBAAoB,OAAO,EAAEC,OAAO,EAAEC,OAAO,EAAE,GAAA;AACnD,QAAA,MAAMC,OAAAA,GAAUV,GAAAA,CAAIW,MAAM,CAACH,OAAAA,EAAS;YAAEI,QAAAA,EAAU;AAAI,SAAA,CAAA;AAEpD,QAAA,IAAI,CAACF,OAAAA,EAASG,MAAAA,EAAQC,OAAO,CAACJ,OAAAA,CAAQK,OAAO,EAAE;AAC7C,YAAA,MAAM,IAAIC,KAAAA,CAAM,iCAAA,CAAA;AACpB,QAAA;AAEE,QAAA,MAAMC,QAAAA,GAAW,MAAMC,KAAAA,CAAMT,OAAAA,CAAQU,QAAQ,EAAA,CAAA;QAC7C,IAAI,CAACF,QAAAA,CAASG,EAAE,EAAE;AAChB,YAAA,MAAM,IAAIJ,KAAAA,CAAM,wCAAA,CAAA;AACpB,QAAA;QAEE,MAAMb,GAAAA,GAAM,MAAMc,QAAAA,CAASI,IAAI,EAAA;AAC/B,QAAA,MAAMhB,GAAAA,GAAMF,GAAAA,CAAImB,IAAI,EAAEC,KAAK,CAAC,EAAET,GAAG,EAAE,GAAKA,GAAAA,KAAQJ,OAAAA,CAAQG,MAAM,CAACC,GAAG,CAAA;AAElE,QAAA,IAAI,CAACT,GAAAA,EAAK;AACR,YAAA,MAAM,IAAIW,KAAAA,CAAM,wCAAA,CAAA;AACpB,QAAA;AAEE,QAAA,MAAMQ,YAAYtB,cAAAA,CAAeG,GAAAA,CAAAA;QAEjC,OAAO,IAAIoB,OAAAA,CAAQ,CAACC,OAAAA,EAASC,MAAAA,GAAAA;YAC3B3B,GAAAA,CAAI4B,MAAM,CAACpB,OAAAA,EAASgB,SAAAA,EAAW;gBAAEK,UAAAA,EAAY;AAAC,oBAAA;AAAQ;AAAA,aAAA,EAAI,CAACC,GAAAA,EAAKC,YAAAA,GAAAA;AAC9D,gBAAA,IAAID,GAAAA,EAAK;AACPH,oBAAAA,MAAAA,CAAO,IAAIX,KAAAA,CAAM,wCAAA,CAAA,CAAA;AACjB,oBAAA;AACR,gBAAA;gBACMU,OAAAA,CAAQK,YAAAA,CAAAA;AACd,YAAA,CAAA,CAAA;AACA,QAAA,CAAA,CAAA;AACA,IAAA,CAAA;IAEAC,mBAAAA,GAAiB;AACf9B,QAAAA,cAAAA;AACAK,QAAAA;AACF,KAAA;;;;;;"}

package/jsconfig.json

@@ -0,0 +1,7 @@
+{
+  "compilerOptions": {
+    "module": "commonjs",
+    "target": "es6"
+  },
+  "exclude": ["node_modules", "dist"]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@strapi/plugin-users-permissions",
-  "version": "5.50.1",
+  "version": "5.51.0",
   "description": "Protect your API with a full-authentication process based on JWT",
   "homepage": "https://strapi.io",
   "bugs": {
@@ -43,7 +43,7 @@
     "build": "run -T npm-run-all clean build:code",
     "build:code": "run -T rollup -c",
     "clean": "run -T rimraf dist",
-    "lint": "run -T eslint .",
+    "lint": "run -T eslint . --max-warnings=0",
     "test:front": "run -T cross-env IS_EE=true jest --config ./jest.config.front.js",
     "test:front:ce": "run -T cross-env IS_EE=false jest --config ./jest.config.front.js",
     "test:front:watch": "run -T cross-env IS_EE=true jest --config ./jest.config.front.js --watchAll",
@@ -53,32 +53,32 @@
     "watch": "run -T rollup -c -w"
   },
   "dependencies": {
-    "@strapi/design-system": "2.2.1",
-    "@strapi/icons": "2.2.1",
-    "@strapi/utils": "5.50.1",
+    "@strapi/design-system": "2.2.3",
+    "@strapi/icons": "2.2.3",
+    "@strapi/utils": "5.51.0",
     "bcryptjs": "2.4.3",
-    "formik": "2.4.5",
-    "grant": "5.4.24",
+    "formik": "2.4.9",
     "immer": "9.0.21",
-    "jsonwebtoken": "9.0.0",
-    "jwk-to-pem": "2.0.7",
+    "jsonwebtoken": "9.0.3",
     "koa": "2.16.4",
     "koa2-ratelimit": "^1.1.3",
     "lodash": "4.18.1",
     "prop-types": "^15.8.1",
-    "purest": "4.0.2",
     "react-intl": "6.6.2",
     "react-query": "3.39.3",
     "react-redux": "8.1.3",
     "url-join": "4.0.1",
     "yup": "0.32.9",
-    "zod": "3.25.67"
+    "zod": "3.25.76"
   },
   "devDependencies": {
-    "@strapi/strapi": "5.50.1",
+    "@strapi/strapi": "5.51.0",
     "@testing-library/dom": "10.4.1",
+    "@testing-library/jest-dom": "6.9.1",
     "@testing-library/react": "16.3.2",
     "@testing-library/user-event": "14.6.1",
+    "@types/jest": "29.5.2",
+    "jest": "29.6.0",
     "msw": "2.13.4",
     "react": "18.3.1",
     "react-dom": "18.3.1",

package/server/controllers/auth.js

@@ -418,24 +418,14 @@ module.exports = ({ strapi }) => ({
     return ctx.send({ data: {} });
   },
   async connect(ctx, next) {
-    const grant = require('grant').koa();
-
     const providers = await strapi
       .store({ type: 'plugin', name: 'users-permissions', key: 'grant' })
       .get();
 
-    const apiPrefix = strapi.config.get('api.rest.prefix');
-    const grantConfig = {
-      defaults: {
-        prefix: `${apiPrefix}/connect`,
-      },
-      ...providers,
-    };
-
     const [requestPath] = ctx.request.url.split('?');
     const provider = requestPath.split('/connect/')[1].split('/')[0];
 
-    if (!_.get(grantConfig[provider], 'enabled')) {
+    if (!_.get(providers, [provider, 'enabled'])) {
       throw new ApplicationError('This provider is disabled');
     }
 
@@ -445,32 +435,35 @@ module.exports = ({ strapi }) => ({
       );
     }
 
-    // Ability to pass OAuth callback dynamically
     const queryCustomCallback = _.get(ctx, 'query.callback');
     const dynamicSessionCallback = _.get(ctx, 'session.grant.dynamic.callback');
-
     const customCallback = queryCustomCallback ?? dynamicSessionCallback;
 
-    // The custom callback is validated to make sure it's not redirecting to an unwanted actor.
     if (customCallback !== undefined) {
       try {
-        // We're extracting the callback validator from the plugin config since it can be user-customized
         const { validate: validateCallback } = strapi
           .plugin('users-permissions')
           .config('callback');
 
-        await validateCallback(customCallback, grantConfig[provider]);
+        await validateCallback(customCallback, providers[provider]);
 
-        grantConfig[provider].callback = customCallback;
+        // Persist across the provider redirect round-trip (request state alone is lost).
+        ctx.session = ctx.session || {};
+        ctx.session.grant = ctx.session.grant || {};
+        ctx.session.grant.dynamic = {
+          ...(ctx.session.grant.dynamic || {}),
+          callback: customCallback,
+        };
+        ctx.state.oauthConnect = { callback: customCallback };
       } catch (e) {
         throw new ValidationError('Invalid callback URL provided', { callback: customCallback });
       }
     }
 
-    // Build a valid redirect URI for the current provider
-    grantConfig[provider].redirect_uri = getService('providers').buildRedirectUri(provider);
+    const { createOAuthConnectMiddleware } = require('../utils/oauth-connect');
+    const oauthConnect = createOAuthConnectMiddleware();
 
-    return grant(grantConfig)(ctx, next);
+    return oauthConnect(ctx, next);
   },
 
   async forgotPassword(ctx) {