@tinyrack/issuary-server 0.20.0

package/dist/routes/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/routes/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAKhD,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mCAGsB,CAAC"}

package/dist/routes/index.js

@@ -0,0 +1,9 @@
+import { Hono } from 'hono';
+import { wellKnownRoutes } from "./.well-known/index.js";
+import { apiRoutes } from "./api/index.js";
+import { oauthApplicationRoutes } from "./oauth/index.js";
+export const routes = new Hono()
+    .route('/api', apiRoutes)
+    .route('/oauth', oauthApplicationRoutes)
+    .route('/.well-known', wellKnownRoutes);
+//# sourceMappingURL=index.js.map

package/dist/routes/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/routes/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,IAAI,EAAU;KACrC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC;KACxB,KAAK,CAAC,QAAQ,EAAE,sBAAsB,CAAC;KACvC,KAAK,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC"}

package/dist/routes/oauth/.well-known/jwks/get.d.ts

@@ -0,0 +1,24 @@
+import type { AppEnv } from '#server/lib/app-env.js';
+export declare const jwksGet: import("hono/hono-base").HonoBase<AppEnv, {
+    "/.well-known/jwks": {
+        $get: {
+            input: {};
+            output: {
+                keys: {
+                    kty: string;
+                    use: string;
+                    kid: string;
+                    alg: string;
+                    n?: string | undefined | undefined;
+                    e?: string | undefined | undefined;
+                    x?: string | undefined | undefined;
+                    y?: string | undefined | undefined;
+                    crv?: string | undefined | undefined;
+                }[];
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+}, "/", "/.well-known/jwks">;
+//# sourceMappingURL=get.d.ts.map

package/dist/routes/oauth/.well-known/jwks/get.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../../../../src/routes/oauth/.well-known/jwks/get.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAGrD,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;4BAiDnB,CAAC"}

package/dist/routes/oauth/.well-known/jwks/get.js

@@ -0,0 +1,41 @@
+import { Hono } from 'hono';
+import { describeRoute, resolver } from 'hono-openapi';
+import { z } from 'zod';
+import { TAGS } from '#server/lib/swagger-tags.js';
+export const jwksGet = new Hono().get('/.well-known/jwks', describeRoute({
+    tags: [TAGS.OPENID],
+    summary: 'JWKS',
+    description: 'JSON Web Key Set (JWKS) endpoint - Returns RSA public keys used for verifying tokens (RFC 7517). Supports automatic key rotation with multiple active keys.',
+    responses: {
+        200: {
+            content: {
+                'application/json': {
+                    schema: resolver(z.object({
+                        keys: z
+                            .array(z.object({
+                            kty: z.string().describe('Key Type'),
+                            use: z.string().describe('Public Key Use'),
+                            kid: z.string().describe('Key ID'),
+                            alg: z.string().describe('Algorithm'),
+                            n: z.string().optional().describe('RSA modulus'),
+                            e: z.string().optional().describe('RSA exponent'),
+                            x: z.string().optional().describe('EC x coordinate'),
+                            y: z.string().optional().describe('EC y coordinate'),
+                            crv: z.string().optional().describe('EC curve name'),
+                        }))
+                            .describe('Array of JWK objects representing public keys for token verification'),
+                    })),
+                },
+            },
+            description: 'JWKS response',
+        },
+    },
+}), async (c) => {
+    const { jwtService } = c.var.services;
+    // Get JWKS from JwtService
+    const jwks = await jwtService.getJWKS();
+    // Set cache headers
+    c.header('Cache-Control', 'public, max-age=3600');
+    return c.json(jwks, 200);
+});
+//# sourceMappingURL=get.js.map

package/dist/routes/oauth/.well-known/jwks/get.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get.js","sourceRoot":"","sources":["../../../../../src/routes/oauth/.well-known/jwks/get.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,IAAI,EAAE,MAAM,6BAA6B,CAAC;AAEnD,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,IAAI,EAAU,CAAC,GAAG,CAC3C,mBAAmB,EACnB,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM;IACf,WAAW,EACT,6JAA6J;IAC/J,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CACd,CAAC,CAAC,MAAM,CAAC;wBACP,IAAI,EAAE,CAAC;6BACJ,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;4BACP,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC;4BACpC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC;4BAC1C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;4BAClC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;4BACrC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC;4BAChD,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC;4BACjD,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC;4BACpD,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC;4BACpD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC;yBACrD,CAAC,CACH;6BACA,QAAQ,CACP,sEAAsE,CACvE;qBACJ,CAAC,CACH;iBACF;aACF;YACD,WAAW,EAAE,eAAe;SAC7B;KACF;CACF,CAAC,EACF,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAEtC,2BAA2B;IAC3B,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,CAAC;IAExC,oBAAoB;IACpB,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;IAElD,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC3B,CAAC,CACF,CAAC"}

package/dist/routes/oauth/.well-known/openid-configuration/get.d.ts

@@ -0,0 +1,68 @@
+import type { AppEnv } from '#server/lib/app-env.js';
+import type { IssuaryRuntimeConfig } from '#server/lib/config/index.js';
+export declare function buildOpenidConfiguration(config: IssuaryRuntimeConfig): {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    jwks_uri: string;
+    response_types_supported: string[];
+    response_modes_supported: string[];
+    subject_types_supported: string[];
+    id_token_signing_alg_values_supported: string[];
+    userinfo_signing_alg_values_supported: string[];
+    userinfo_endpoint: string;
+    scopes_supported: string[];
+    claims_supported: string[];
+    prompt_values_supported: string[];
+    grant_types_supported: string[];
+    token_endpoint_auth_methods_supported: string[];
+    introspection_endpoint_auth_methods_supported: string[];
+    revocation_endpoint_auth_methods_supported: string[];
+    code_challenge_methods_supported: string[];
+    introspection_endpoint: string;
+    revocation_endpoint: string;
+    end_session_endpoint: string;
+    device_authorization_endpoint: string;
+    ui_locales_supported: ("en" | "ko" | "ja")[];
+    request_parameter_supported: boolean;
+    request_uri_parameter_supported: boolean;
+    claims_parameter_supported: boolean;
+};
+export declare const oidcConfigGet: import("hono/hono-base").HonoBase<AppEnv, {
+    "/.well-known/openid-configuration": {
+        $get: {
+            input: {};
+            output: {
+                issuer: string;
+                authorization_endpoint: string;
+                token_endpoint: string;
+                jwks_uri: string;
+                response_types_supported: string[];
+                response_modes_supported: string[];
+                subject_types_supported: string[];
+                id_token_signing_alg_values_supported: string[];
+                userinfo_signing_alg_values_supported: string[];
+                userinfo_endpoint: string;
+                scopes_supported: string[];
+                claims_supported: string[];
+                prompt_values_supported: string[];
+                grant_types_supported: string[];
+                token_endpoint_auth_methods_supported: string[];
+                introspection_endpoint_auth_methods_supported: string[];
+                revocation_endpoint_auth_methods_supported: string[];
+                code_challenge_methods_supported: string[];
+                introspection_endpoint: string;
+                revocation_endpoint: string;
+                end_session_endpoint: string;
+                device_authorization_endpoint: string;
+                ui_locales_supported: ("en" | "ko" | "ja")[];
+                request_parameter_supported: boolean;
+                request_uri_parameter_supported: boolean;
+                claims_parameter_supported: boolean;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+}, "/", "/.well-known/openid-configuration">;
+//# sourceMappingURL=get.d.ts.map

package/dist/routes/oauth/.well-known/openid-configuration/get.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../../../../src/routes/oauth/.well-known/openid-configuration/get.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAUxE,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;EAwEpE;AAaD,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4CAkJzB,CAAC"}

package/dist/routes/oauth/.well-known/openid-configuration/get.js

@@ -0,0 +1,193 @@
+import { Hono } from 'hono';
+import { describeRoute, resolver } from 'hono-openapi';
+import { z } from 'zod';
+import { TAGS } from '#server/lib/swagger-tags.js';
+const openidConfigurationCache = new WeakMap();
+export function buildOpenidConfiguration(config) {
+    const baseUrl = config.server.public_origin;
+    const scopesSupported = new Set([
+        'openid',
+        'profile',
+        'email',
+        'offline_access',
+    ]);
+    for (const client of config.clients) {
+        for (const scope of client.scope.split(' ')) {
+            scopesSupported.add(scope);
+        }
+    }
+    return {
+        issuer: baseUrl,
+        authorization_endpoint: `${baseUrl}/oauth/authorize`,
+        token_endpoint: `${baseUrl}/oauth/token`,
+        jwks_uri: `${baseUrl}/oauth/.well-known/jwks`,
+        response_types_supported: ['code', 'id_token'],
+        response_modes_supported: ['query', 'fragment', 'form_post'],
+        subject_types_supported: ['public'],
+        id_token_signing_alg_values_supported: ['RS256'],
+        userinfo_signing_alg_values_supported: ['none'],
+        userinfo_endpoint: `${baseUrl}/oauth/userinfo`,
+        scopes_supported: [...scopesSupported],
+        claims_supported: [
+            'sub',
+            'iss',
+            'aud',
+            'exp',
+            'iat',
+            'nonce',
+            'auth_time',
+            'at_hash',
+            'email',
+            'email_verified',
+            'name',
+            'preferred_username',
+        ],
+        prompt_values_supported: ['none', 'login', 'consent', 'select_account'],
+        grant_types_supported: [
+            'authorization_code',
+            'implicit',
+            'refresh_token',
+            'client_credentials',
+            'urn:ietf:params:oauth:grant-type:device_code',
+        ],
+        token_endpoint_auth_methods_supported: [
+            'client_secret_basic',
+            'client_secret_post',
+            'none',
+        ],
+        introspection_endpoint_auth_methods_supported: [
+            'client_secret_basic',
+            'client_secret_post',
+        ],
+        revocation_endpoint_auth_methods_supported: [
+            'client_secret_basic',
+            'client_secret_post',
+            'none',
+        ],
+        code_challenge_methods_supported: ['S256'],
+        introspection_endpoint: `${baseUrl}/oauth/introspect`,
+        revocation_endpoint: `${baseUrl}/oauth/revoke`,
+        end_session_endpoint: `${baseUrl}/oauth/end_session`,
+        device_authorization_endpoint: `${baseUrl}/oauth/device_authorization`,
+        ui_locales_supported: config.i18n.supported_languages,
+        request_parameter_supported: false,
+        request_uri_parameter_supported: false,
+        claims_parameter_supported: false,
+    };
+}
+function getOpenidConfiguration(config) {
+    const cached = openidConfigurationCache.get(config);
+    if (cached) {
+        return cached;
+    }
+    const configuration = buildOpenidConfiguration(config);
+    openidConfigurationCache.set(config, configuration);
+    return configuration;
+}
+export const oidcConfigGet = new Hono().get('/.well-known/openid-configuration', describeRoute({
+    tags: [TAGS.OPENID],
+    summary: 'OpenID Provider Configuration',
+    description: 'Returns OpenID Provider Configuration Information (OpenID Connect Discovery 1.0)',
+    responses: {
+        200: {
+            content: {
+                'application/json': {
+                    schema: resolver(z.object({
+                        issuer: z
+                            .string()
+                            .describe('URL using the https scheme with no query or fragment component'),
+                        authorization_endpoint: z
+                            .string()
+                            .describe("URL of the OP's OAuth 2.0 Authorization Endpoint"),
+                        token_endpoint: z
+                            .string()
+                            .describe("URL of the OP's OAuth 2.0 Token Endpoint"),
+                        jwks_uri: z
+                            .string()
+                            .describe("URL of the OP's JSON Web Key Set document"),
+                        response_types_supported: z
+                            .array(z.string())
+                            .describe('JSON array containing a list of the OAuth 2.0 response_type values'),
+                        response_modes_supported: z
+                            .array(z.string())
+                            .optional()
+                            .describe('JSON array containing a list of supported response_mode values'),
+                        subject_types_supported: z
+                            .array(z.string())
+                            .describe('JSON array containing a list of the Subject Identifier types'),
+                        id_token_signing_alg_values_supported: z
+                            .array(z.string())
+                            .describe('JSON array containing a list of the JWS signing algorithms supported'),
+                        userinfo_endpoint: z
+                            .string()
+                            .optional()
+                            .describe("URL of the OP's UserInfo Endpoint"),
+                        scopes_supported: z
+                            .array(z.string())
+                            .optional()
+                            .describe('JSON array containing a list of the OAuth 2.0 scope values'),
+                        claims_supported: z
+                            .array(z.string())
+                            .optional()
+                            .describe('JSON array containing a list of the Claim Names'),
+                        grant_types_supported: z
+                            .array(z.string())
+                            .optional()
+                            .describe('JSON array containing a list of the OAuth 2.0 Grant Type values'),
+                        token_endpoint_auth_methods_supported: z
+                            .array(z.string())
+                            .optional()
+                            .describe('JSON array containing a list of Client Authentication methods'),
+                        introspection_endpoint_auth_methods_supported: z
+                            .array(z.string())
+                            .optional()
+                            .describe('JSON array containing a list of Token Introspection Client Authentication methods'),
+                        revocation_endpoint_auth_methods_supported: z
+                            .array(z.string())
+                            .optional()
+                            .describe('JSON array containing a list of Token Revocation Client Authentication methods'),
+                        code_challenge_methods_supported: z
+                            .array(z.string())
+                            .optional()
+                            .describe('JSON array containing a list of PKCE code challenge methods'),
+                        introspection_endpoint: z
+                            .string()
+                            .optional()
+                            .describe("URL of the OP's OAuth 2.0 Token Introspection Endpoint"),
+                        revocation_endpoint: z
+                            .string()
+                            .optional()
+                            .describe("URL of the OP's OAuth 2.0 Token Revocation Endpoint"),
+                        service_documentation: z
+                            .string()
+                            .optional()
+                            .describe('URL of a page containing human-readable information'),
+                        ui_locales_supported: z
+                            .array(z.string())
+                            .optional()
+                            .describe('Languages and scripts supported for the user interface'),
+                        request_parameter_supported: z
+                            .boolean()
+                            .optional()
+                            .describe('Whether request object by value is supported'),
+                        request_uri_parameter_supported: z
+                            .boolean()
+                            .optional()
+                            .describe('Whether request object by reference is supported'),
+                        claims_parameter_supported: z
+                            .boolean()
+                            .optional()
+                            .describe('Whether the claims request parameter is supported'),
+                    })),
+                },
+            },
+            description: 'OpenID Configuration',
+        },
+    },
+}), async (c) => {
+    const { config } = c.var.services;
+    // Set Cache-Control header
+    c.header('Cache-Control', 'public, max-age=3600');
+    return c.json(getOpenidConfiguration(config), 200);
+});
+//# sourceMappingURL=get.js.map

package/dist/routes/oauth/.well-known/openid-configuration/get.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get.js","sourceRoot":"","sources":["../../../../../src/routes/oauth/.well-known/openid-configuration/get.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,IAAI,EAAE,MAAM,6BAA6B,CAAC;AAInD,MAAM,wBAAwB,GAAG,IAAI,OAAO,EAGzC,CAAC;AAEJ,MAAM,UAAU,wBAAwB,CAAC,MAA4B;IACnE,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC;IAC5C,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;QAC9B,QAAQ;QACR,SAAS;QACT,OAAO;QACP,gBAAgB;KACjB,CAAC,CAAC;IACH,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5C,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,OAAO;QACf,sBAAsB,EAAE,GAAG,OAAO,kBAAkB;QACpD,cAAc,EAAE,GAAG,OAAO,cAAc;QACxC,QAAQ,EAAE,GAAG,OAAO,yBAAyB;QAC7C,wBAAwB,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;QAC9C,wBAAwB,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC;QAC5D,uBAAuB,EAAE,CAAC,QAAQ,CAAC;QACnC,qCAAqC,EAAE,CAAC,OAAO,CAAC;QAChD,qCAAqC,EAAE,CAAC,MAAM,CAAC;QAC/C,iBAAiB,EAAE,GAAG,OAAO,iBAAiB;QAC9C,gBAAgB,EAAE,CAAC,GAAG,eAAe,CAAC;QACtC,gBAAgB,EAAE;YAChB,KAAK;YACL,KAAK;YACL,KAAK;YACL,KAAK;YACL,KAAK;YACL,OAAO;YACP,WAAW;YACX,SAAS;YACT,OAAO;YACP,gBAAgB;YAChB,MAAM;YACN,oBAAoB;SACrB;QACD,uBAAuB,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,CAAC;QACvE,qBAAqB,EAAE;YACrB,oBAAoB;YACpB,UAAU;YACV,eAAe;YACf,oBAAoB;YACpB,8CAA8C;SAC/C;QACD,qCAAqC,EAAE;YACrC,qBAAqB;YACrB,oBAAoB;YACpB,MAAM;SACP;QACD,6CAA6C,EAAE;YAC7C,qBAAqB;YACrB,oBAAoB;SACrB;QACD,0CAA0C,EAAE;YAC1C,qBAAqB;YACrB,oBAAoB;YACpB,MAAM;SACP;QACD,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,sBAAsB,EAAE,GAAG,OAAO,mBAAmB;QACrD,mBAAmB,EAAE,GAAG,OAAO,eAAe;QAC9C,oBAAoB,EAAE,GAAG,OAAO,oBAAoB;QACpD,6BAA6B,EAAE,GAAG,OAAO,6BAA6B;QACtE,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB;QACrD,2BAA2B,EAAE,KAAK;QAClC,+BAA+B,EAAE,KAAK;QACtC,0BAA0B,EAAE,KAAK;KAClC,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,MAA4B;IAC1D,MAAM,MAAM,GAAG,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,aAAa,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACvD,wBAAwB,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACpD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,IAAI,EAAU,CAAC,GAAG,CACjD,mCAAmC,EACnC,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;IACnB,OAAO,EAAE,+BAA+B;IACxC,WAAW,EACT,kFAAkF;IACpF,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CACd,CAAC,CAAC,MAAM,CAAC;wBACP,MAAM,EAAE,CAAC;6BACN,MAAM,EAAE;6BACR,QAAQ,CACP,gEAAgE,CACjE;wBACH,sBAAsB,EAAE,CAAC;6BACtB,MAAM,EAAE;6BACR,QAAQ,CAAC,kDAAkD,CAAC;wBAC/D,cAAc,EAAE,CAAC;6BACd,MAAM,EAAE;6BACR,QAAQ,CAAC,0CAA0C,CAAC;wBACvD,QAAQ,EAAE,CAAC;6BACR,MAAM,EAAE;6BACR,QAAQ,CAAC,2CAA2C,CAAC;wBACxD,wBAAwB,EAAE,CAAC;6BACxB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;6BACjB,QAAQ,CACP,oEAAoE,CACrE;wBACH,wBAAwB,EAAE,CAAC;6BACxB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;6BACjB,QAAQ,EAAE;6BACV,QAAQ,CACP,gEAAgE,CACjE;wBACH,uBAAuB,EAAE,CAAC;6BACvB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;6BACjB,QAAQ,CACP,8DAA8D,CAC/D;wBACH,qCAAqC,EAAE,CAAC;6BACrC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;6BACjB,QAAQ,CACP,sEAAsE,CACvE;wBACH,iBAAiB,EAAE,CAAC;6BACjB,MAAM,EAAE;6BACR,QAAQ,EAAE;6BACV,QAAQ,CAAC,mCAAmC,CAAC;wBAChD,gBAAgB,EAAE,CAAC;6BAChB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;6BACjB,QAAQ,EAAE;6BACV,QAAQ,CACP,4DAA4D,CAC7D;wBACH,gBAAgB,EAAE,CAAC;6BAChB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;6BACjB,QAAQ,EAAE;6BACV,QAAQ,CAAC,iDAAiD,CAAC;wBAC9D,qBAAqB,EAAE,CAAC;6BACrB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;6BACjB,QAAQ,EAAE;6BACV,QAAQ,CACP,iEAAiE,CAClE;wBACH,qCAAqC,EAAE,CAAC;6BACrC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;6BACjB,QAAQ,EAAE;6BACV,QAAQ,CACP,+DAA+D,CAChE;wBACH,6CAA6C,EAAE,CAAC;6BAC7C,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;6BACjB,QAAQ,EAAE;6BACV,QAAQ,CACP,mFAAmF,CACpF;wBACH,0CAA0C,EAAE,CAAC;6BAC1C,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;6BACjB,QAAQ,EAAE;6BACV,QAAQ,CACP,gFAAgF,CACjF;wBACH,gCAAgC,EAAE,CAAC;6BAChC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;6BACjB,QAAQ,EAAE;6BACV,QAAQ,CACP,6DAA6D,CAC9D;wBACH,sBAAsB,EAAE,CAAC;6BACtB,MAAM,EAAE;6BACR,QAAQ,EAAE;6BACV,QAAQ,CACP,wDAAwD,CACzD;wBACH,mBAAmB,EAAE,CAAC;6BACnB,MAAM,EAAE;6BACR,QAAQ,EAAE;6BACV,QAAQ,CACP,qDAAqD,CACtD;wBACH,qBAAqB,EAAE,CAAC;6BACrB,MAAM,EAAE;6BACR,QAAQ,EAAE;6BACV,QAAQ,CACP,qDAAqD,CACtD;wBACH,oBAAoB,EAAE,CAAC;6BACpB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;6BACjB,QAAQ,EAAE;6BACV,QAAQ,CACP,wDAAwD,CACzD;wBACH,2BAA2B,EAAE,CAAC;6BAC3B,OAAO,EAAE;6BACT,QAAQ,EAAE;6BACV,QAAQ,CAAC,8CAA8C,CAAC;wBAC3D,+BAA+B,EAAE,CAAC;6BAC/B,OAAO,EAAE;6BACT,QAAQ,EAAE;6BACV,QAAQ,CAAC,kDAAkD,CAAC;wBAC/D,0BAA0B,EAAE,CAAC;6BAC1B,OAAO,EAAE;6BACT,QAAQ,EAAE;6BACV,QAAQ,CACP,mDAAmD,CACpD;qBACJ,CAAC,CACH;iBACF;aACF;YACD,WAAW,EAAE,sBAAsB;SACpC;KACF;CACF,CAAC,EACF,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAElC,2BAA2B;IAC3B,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;IAElD,OAAO,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;AACrD,CAAC,CACF,CAAC"}

package/dist/routes/oauth/authorize/get.d.ts

@@ -0,0 +1,34 @@
+import type { AppEnv } from '../../../lib/app-env.ts';
+export declare const authorizeGet: import("hono/hono-base").HonoBase<AppEnv, {
+    "/authorize": {
+        $get: {
+            input: {
+                query: {
+                    response_type: string | string[];
+                    redirect_uri: string | string[];
+                    client_id: string | string[];
+                    state?: string | undefined;
+                    code_challenge?: string | undefined;
+                    code_challenge_method?: "S256" | "plain" | undefined;
+                    scope?: string | undefined;
+                    nonce?: string | undefined;
+                    prompt?: string | undefined;
+                    max_age?: string | string[];
+                    reauthenticated?: string | string[];
+                    account_selected?: string | string[];
+                    account_selection_state?: string | undefined;
+                    display?: "page" | "popup" | "touch" | "wap" | undefined;
+                    response_mode?: string | undefined;
+                    login_hint?: string | undefined;
+                    ui_locales?: string | undefined;
+                    id_token_hint?: string | undefined;
+                    acr_values?: string | undefined;
+                };
+            };
+            output: {};
+            outputFormat: string;
+            status: import("hono/utils/http-status").StatusCode;
+        };
+    };
+}, "/", "/authorize">;
+//# sourceMappingURL=get.d.ts.map

package/dist/routes/oauth/authorize/get.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../../../src/routes/oauth/authorize/get.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAUtD,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBAoQxB,CAAC"}

package/dist/routes/oauth/authorize/get.js

@@ -0,0 +1,179 @@
+import { Hono } from 'hono';
+import { describeRoute, resolver, validator } from 'hono-openapi';
+import { z } from 'zod';
+import { escapeHtml } from '../../../lib/escape-html.js';
+import { OPENAPI_SECURITY } from "../../../lib/openapi.js";
+import { TAGS } from "../../../lib/swagger-tags.js";
+import { verifyAuth } from "../../../middleware/auth.js";
+import { e } from "../../../schemas/error.js";
+import { f } from "../../../schemas/field.js";
+import { r } from "../../../schemas/response.js";
+export const authorizeGet = new Hono().get('/authorize', describeRoute({
+    tags: [TAGS.OPENID],
+    security: OPENAPI_SECURITY.optionalCookieSession,
+    summary: 'Authorize',
+    description: 'OAuth2 Authorization Endpoint',
+    responses: {
+        302: {
+            description: 'Redirect',
+        },
+        400: {
+            content: {
+                'application/json': {
+                    schema: resolver(r.OAuthError),
+                },
+            },
+            description: 'OAuth error',
+        },
+    },
+}), validator('query', z.object({
+    response_type: f.responseType,
+    redirect_uri: f.redirectUri,
+    state: f.state.optional(),
+    client_id: f.clientId,
+    code_challenge: f.codeChallenge.optional(),
+    code_challenge_method: f.codeChallengeMethod.optional(),
+    scope: f.scope.optional(),
+    nonce: f.nonce.optional(),
+    prompt: f.prompt.optional(),
+    max_age: f.maxAge.optional(),
+    reauthenticated: z
+        .preprocess((value) => {
+        if (value === 1)
+            return '1';
+        if (typeof value !== 'string')
+            return value;
+        return decodeURIComponent(value)
+            .replaceAll('"', '')
+            .replaceAll('\\', '');
+    }, z.literal('1'))
+        .optional(),
+    account_selected: z
+        .preprocess((value) => {
+        if (value === 1)
+            return '1';
+        if (typeof value !== 'string')
+            return value;
+        return decodeURIComponent(value)
+            .replaceAll('"', '')
+            .replaceAll('\\', '');
+    }, z.literal('1'))
+        .optional(),
+    account_selection_state: z.string().min(1).max(200).optional(),
+    display: f.display.optional(),
+    response_mode: z.string().min(1).max(100).optional(),
+    login_hint: z.string().min(1).max(1000).optional(),
+    ui_locales: z.string().min(1).max(1000).optional(),
+    id_token_hint: z.string().min(1).max(4000).optional(),
+    acr_values: z.string().min(1).max(1000).optional(),
+})), verifyAuth({ optional: true }), async (c) => {
+    const query = c.req.valid('query');
+    const { oauthAuthorizeService } = c.var.services;
+    // Helper function to redirect with error
+    const redirectWithError = (error, errorDescription, redirectUri) => {
+        if (!redirectUri) {
+            return c.json({
+                error,
+                error_description: errorDescription,
+            }, 400);
+        }
+        if (query.response_mode === 'form_post') {
+            const params = {
+                error,
+                error_description: errorDescription,
+            };
+            if (query.state) {
+                params['state'] = query.state;
+            }
+            return c.html(buildFormPostResponse(redirectUri, params));
+        }
+        const url = new URL(redirectUri);
+        const useFragment = query.response_mode === 'fragment' ||
+            (query.response_type === 'id_token' && query.response_mode !== 'query');
+        const params = useFragment ? new URLSearchParams() : url.searchParams;
+        params.set('error', error);
+        params.set('error_description', errorDescription);
+        if (query.state) {
+            params.set('state', query.state);
+        }
+        if (useFragment) {
+            url.hash = params.toString();
+        }
+        return c.redirect(url.toString());
+    };
+    try {
+        const verifiedUser = c.var.verifiedUser;
+        // Call authorize service
+        const authorizeParams = {
+            query: query,
+        };
+        if (verifiedUser) {
+            authorizeParams.userSession = {
+                sub: verifiedUser.user.sub,
+                authenticated_at: verifiedUser.authenticatedAt,
+            };
+        }
+        const rememberedAccounts = c.var.session.get('accounts');
+        if (rememberedAccounts) {
+            authorizeParams.rememberedAccounts = rememberedAccounts;
+            authorizeParams.selectUserSession = (userSub) => c.var.session.selectUserSession(userSub);
+        }
+        authorizeParams.accountSelectionSession =
+            c.var.session.get('accountSelection');
+        authorizeParams.reauthenticationSession =
+            c.var.session.get('reauthentication');
+        authorizeParams.setAccountSelectionSession = (state) => c.var.session.set('accountSelection', state);
+        authorizeParams.setReauthenticationSession = (state) => c.var.session.set('reauthentication', state);
+        authorizeParams.clearAccountSelectionSession = () => c.var.session.set('accountSelection', undefined);
+        const result = await oauthAuthorizeService.authorize(authorizeParams);
+        if (result.type === 'form_post') {
+            return c.html(buildFormPostResponse(result.url, result.params ?? {}));
+        }
+        // Redirect based on result
+        return c.redirect(result.url);
+    }
+    catch (error) {
+        // RFC 6749 §4.1.2.1: If client_id is invalid or redirect_uri validation fails,
+        // do NOT redirect to the provided redirect_uri
+        if (error instanceof e.OAuthClientNotFound.Error) {
+            return redirectWithError('unauthorized_client', error.message, undefined);
+        }
+        if (error instanceof e.OAuthClientDisabled.Error) {
+            return redirectWithError('unauthorized_client', error.message, undefined);
+        }
+        if (error instanceof e.InvalidRedirectUri.Error) {
+            return redirectWithError('invalid_request', error.message, undefined);
+        }
+        // Only redirect errors that occur AFTER successful client + redirect_uri validation
+        if (error instanceof e.UnsupportedResponseType.Error) {
+            return redirectWithError('unsupported_response_type', error.message, query.redirect_uri);
+        }
+        if (error instanceof e.InvalidScope.Error) {
+            return redirectWithError('invalid_scope', error.message, query.redirect_uri);
+        }
+        if (error instanceof e.InvalidCodeChallengeMethod.Error) {
+            return redirectWithError('invalid_request', error.message, query.redirect_uri);
+        }
+        if (error instanceof e.InvalidAuthorizationRequest.Error) {
+            return redirectWithError('invalid_request', error.message, query.redirect_uri);
+        }
+        if (error instanceof e.InvalidPrompt.Error) {
+            return redirectWithError('invalid_request', error.message, query.redirect_uri);
+        }
+        // Log unexpected errors. Do not redirect unexpected failures to the
+        // client-supplied redirect_uri because this handler cannot prove that
+        // redirect_uri validation completed successfully.
+        c.var.logger.error({ err: error }, 'Unexpected authorize error');
+        return c.json({
+            error: 'server_error',
+            error_description: 'An unexpected error occurred',
+        }, 500);
+    }
+});
+function buildFormPostResponse(action, params) {
+    const inputs = Object.entries(params)
+        .map(([name, value]) => `<input type="hidden" name="${escapeHtml(name)}" value="${escapeHtml(value)}">`)
+        .join('');
+    return `<!doctype html><html><head><title>Submit Authorization Response</title></head><body><form method="post" action="${escapeHtml(action)}">${inputs}<noscript><button type="submit">Continue</button></noscript></form><script>document.forms[0].submit();</script></body></html>`;
+}
+//# sourceMappingURL=get.js.map

package/dist/routes/oauth/authorize/get.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get.js","sourceRoot":"","sources":["../../../../src/routes/oauth/authorize/get.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,8BAA8B,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,CAAC,EAAE,MAAM,2BAA2B,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,2BAA2B,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,8BAA8B,CAAC;AAGjD,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,IAAI,EAAU,CAAC,GAAG,CAChD,YAAY,EACZ,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;IACnB,QAAQ,EAAE,gBAAgB,CAAC,qBAAqB;IAChD,OAAO,EAAE,WAAW;IACpB,WAAW,EAAE,+BAA+B;IAC5C,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,UAAU;SACxB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;iBAC/B;aACF;YACD,WAAW,EAAE,aAAa;SAC3B;KACF;CACF,CAAC,EACF,SAAS,CACP,OAAO,EACP,CAAC,CAAC,MAAM,CAAC;IACP,aAAa,EAAE,CAAC,CAAC,YAAY;IAC7B,YAAY,EAAE,CAAC,CAAC,WAAW;IAC3B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,QAAQ;IACrB,cAAc,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,EAAE;IAC1C,qBAAqB,EAAE,CAAC,CAAC,mBAAmB,CAAC,QAAQ,EAAE;IACvD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE;IACzB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE;IACzB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE;IAC5B,eAAe,EAAE,CAAC;SACf,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE;QACpB,IAAI,KAAK,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5C,OAAO,kBAAkB,CAAC,KAAK,CAAC;aAC7B,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC;aACnB,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1B,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;SACjB,QAAQ,EAAE;IACb,gBAAgB,EAAE,CAAC;SAChB,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE;QACpB,IAAI,KAAK,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5C,OAAO,kBAAkB,CAAC,KAAK,CAAC;aAC7B,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC;aACnB,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1B,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;SACjB,QAAQ,EAAE;IACb,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC9D,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE;IAC7B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACpD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAClD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAClD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IACrD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CACnD,CAAC,CACH,EACD,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAC9B,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,EAAE,qBAAqB,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAEjD,yCAAyC;IACzC,MAAM,iBAAiB,GAAG,CACxB,KAAa,EACb,gBAAwB,EACxB,WAAoB,EACpB,EAAE;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK;gBACL,iBAAiB,EAAE,gBAAgB;aACpC,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,aAAa,KAAK,WAAW,EAAE,CAAC;YACxC,MAAM,MAAM,GAA2B;gBACrC,KAAK;gBACL,iBAAiB,EAAE,gBAAgB;aACpC,CAAC;YACF,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;gBAChB,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;YAChC,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACjC,MAAM,WAAW,GACf,KAAK,CAAC,aAAa,KAAK,UAAU;YAClC,CAAC,KAAK,CAAC,aAAa,KAAK,UAAU,IAAI,KAAK,CAAC,aAAa,KAAK,OAAO,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;QACtE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,CAAC;QAClD,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;QAED,IAAI,WAAW,EAAE,CAAC;YAChB,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC/B,CAAC;QAED,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;QAExC,yBAAyB;QACzB,MAAM,eAAe,GAiCjB;YACF,KAAK,EAAE,KAAK;SACb,CAAC;QAEF,IAAI,YAAY,EAAE,CAAC;YACjB,eAAe,CAAC,WAAW,GAAG;gBAC5B,GAAG,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG;gBAC1B,gBAAgB,EAAE,YAAY,CAAC,eAAe;aAC/C,CAAC;QACJ,CAAC;QACD,MAAM,kBAAkB,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,kBAAkB,EAAE,CAAC;YACvB,eAAe,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;YACxD,eAAe,CAAC,iBAAiB,GAAG,CAAC,OAAO,EAAE,EAAE,CAC9C,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC7C,CAAC;QACD,eAAe,CAAC,uBAAuB;YACrC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACxC,eAAe,CAAC,uBAAuB;YACrC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACxC,eAAe,CAAC,0BAA0B,GAAG,CAAC,KAAK,EAAE,EAAE,CACrD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;QAC/C,eAAe,CAAC,0BAA0B,GAAG,CAAC,KAAK,EAAE,EAAE,CACrD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;QAC/C,eAAe,CAAC,4BAA4B,GAAG,GAAG,EAAE,CAClD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;QAEnD,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAEtE,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,OAAO,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;QACxE,CAAC;QAED,2BAA2B;QAC3B,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,+EAA+E;QAC/E,+CAA+C;QAC/C,IAAI,KAAK,YAAY,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;YACjD,OAAO,iBAAiB,CACtB,qBAAqB,EACrB,KAAK,CAAC,OAAO,EACb,SAAS,CACV,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,YAAY,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;YACjD,OAAO,iBAAiB,CACtB,qBAAqB,EACrB,KAAK,CAAC,OAAO,EACb,SAAS,CACV,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,YAAY,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;YAChD,OAAO,iBAAiB,CAAC,iBAAiB,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACxE,CAAC;QAED,oFAAoF;QACpF,IAAI,KAAK,YAAY,CAAC,CAAC,uBAAuB,CAAC,KAAK,EAAE,CAAC;YACrD,OAAO,iBAAiB,CACtB,2BAA2B,EAC3B,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CACnB,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,YAAY,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;YAC1C,OAAO,iBAAiB,CACtB,eAAe,EACf,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CACnB,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,YAAY,CAAC,CAAC,0BAA0B,CAAC,KAAK,EAAE,CAAC;YACxD,OAAO,iBAAiB,CACtB,iBAAiB,EACjB,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CACnB,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,YAAY,CAAC,CAAC,2BAA2B,CAAC,KAAK,EAAE,CAAC;YACzD,OAAO,iBAAiB,CACtB,iBAAiB,EACjB,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CACnB,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,YAAY,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;YAC3C,OAAO,iBAAiB,CACtB,iBAAiB,EACjB,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CACnB,CAAC;QACJ,CAAC;QAED,oEAAoE;QACpE,sEAAsE;QACtE,kDAAkD;QAClD,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,4BAA4B,CAAC,CAAC;QACjE,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE,cAAc;YACrB,iBAAiB,EAAE,8BAA8B;SAClD,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;AACH,CAAC,CACF,CAAC;AAEF,SAAS,qBAAqB,CAAC,MAAc,EAAE,MAA8B;IAC3E,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;SAClC,GAAG,CACF,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAChB,8BAA8B,UAAU,CAAC,IAAI,CAAC,YAAY,UAAU,CAAC,KAAK,CAAC,IAAI,CAClF;SACA,IAAI,CAAC,EAAE,CAAC,CAAC;IAEZ,OAAO,mHAAmH,UAAU,CAAC,MAAM,CAAC,KAAK,MAAM,+HAA+H,CAAC;AACzR,CAAC"}

package/dist/routes/oauth/client-auth.d.ts

@@ -0,0 +1,10 @@
+import type { Context } from 'hono';
+export interface BasicClientCredentials {
+    clientId: string;
+    clientSecret: string;
+}
+export declare const BASIC_CLIENT_AUTH_CHALLENGE = "Basic realm=\"issuary\"";
+export declare function parseBasicClientCredentials(authorizationHeader: string | undefined): BasicClientCredentials | null | undefined;
+export declare function throwInvalidClientCredentialsWithBasicChallenge(c: Context): never;
+export declare function setBasicClientAuthChallengeIfInvalidClientCredentials(c: Context, err: unknown): void;
+//# sourceMappingURL=client-auth.d.ts.map

package/dist/routes/oauth/client-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-auth.d.ts","sourceRoot":"","sources":["../../../src/routes/oauth/client-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAGpC,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,eAAO,MAAM,2BAA2B,4BAA0B,CAAC;AAKnE,wBAAgB,2BAA2B,CACzC,mBAAmB,EAAE,MAAM,GAAG,SAAS,GACtC,sBAAsB,GAAG,IAAI,GAAG,SAAS,CAwC3C;AAED,wBAAgB,+CAA+C,CAC7D,CAAC,EAAE,OAAO,GACT,KAAK,CAGP;AAED,wBAAgB,qDAAqD,CACnE,CAAC,EAAE,OAAO,EACV,GAAG,EAAE,OAAO,GACX,IAAI,CAON"}