@tinyrack/issuary-server 0.31.0 → 0.32.2

package/dist/routes/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/routes/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAKhD,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAGsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/routes/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAKhD,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAGsB,CAAC"}

package/dist/routes/oauth/authorize/get.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../../../src/routes/oauth/authorize/get.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAUtD,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBAoQxB,CAAC"}
+{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../../../src/routes/oauth/authorize/get.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AActD,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBAiRxB,CAAC"}

package/dist/routes/oauth/authorize/get.js

@@ -2,17 +2,18 @@ import { Hono } from 'hono';
 import { describeRoute, resolver, validator } from 'hono-openapi';
 import { z } from 'zod';
 import { escapeHtml } from '../../../lib/escape-html.js';
-import { OPENAPI_SECURITY } from '../../../lib/openapi.js';
+import { OPENAPI_SECURITY, securityMutationDocumentation, } from '../../../lib/openapi.js';
 import { TAGS } from '../../../lib/swagger-tags.js';
 import { verifyAuth } from '../../../middleware/auth.js';
 import { e } from '../../../schemas/error.js';
 import { f } from '../../../schemas/field.js';
 import { r } from '../../../schemas/response.js';
+import { completeBrowserAuthorization } from '../../../services/authorization-browser.service.js';
 export const authorizeGet = new Hono().get('/authorize', describeRoute({
     tags: [TAGS.OPENID],
     security: OPENAPI_SECURITY.optionalCookieSession,
     summary: 'Authorize',
-    description: 'OAuth2 Authorization Endpoint',
+    description: 'OAuth2 Authorization Endpoint. Grant issuance and browser session persistence commit atomically; revoked browser authentication returns 401 without authorization credentials. Final issuance rechecks current scope consent, consent exemption and mandatory terms under policy locks. Newly required consent or terms returns to the corresponding screen, or an OAuth interaction error for prompt=none, without issuing authorization credentials.',
     responses: {
         302: {
             description: 'Redirect',
@@ -66,7 +67,7 @@ export const authorizeGet = new Hono().get('/authorize', describeRoute({
     ui_locales: z.string().min(1).max(1000).optional(),
     id_token_hint: z.string().min(1).max(4000).optional(),
     acr_values: z.string().min(1).max(1000).optional(),
-})), verifyAuth({ optional: true }), async (c) => {
+})), verifyAuth({ optional: true }), securityMutationDocumentation, async (c) => {
     const query = c.req.valid('query');
     const { oauthAuthorizeService } = c.var.services;
     // Helper function to redirect with error
@@ -125,7 +126,11 @@ export const authorizeGet = new Hono().get('/authorize', describeRoute({
         authorizeParams.setAccountSelectionSession = (state) => c.var.session.set('accountSelection', state);
         authorizeParams.setReauthenticationSession = (state) => c.var.session.set('reauthentication', state);
         authorizeParams.clearAccountSelectionSession = () => c.var.session.set('accountSelection', undefined);
-        const result = await oauthAuthorizeService.authorize(authorizeParams);
+        const result = await oauthAuthorizeService.authorize({
+            ...authorizeParams,
+            completeAuthorization: (proof, operation) => completeBrowserAuthorization(c, proof, operation),
+            authenticationEpochs: c.var.session.authorization.security?.grants ?? {},
+        });
         if (result.type === 'form_post') {
             return c.html(buildFormPostResponse(result.url, result.params ?? {}));
         }
@@ -133,6 +138,9 @@ export const authorizeGet = new Hono().get('/authorize', describeRoute({
         return c.redirect(result.url);
     }
     catch (error) {
+        if (error instanceof e.Unauthorized.Error ||
+            error instanceof e.ConcurrentSecurityChange.Error)
+            throw error;
         // RFC 6749 §4.1.2.1: If client_id is invalid or redirect_uri validation fails,
         // do NOT redirect to the provided redirect_uri
         if (error instanceof e.OAuthClientNotFound.Error) {

package/dist/routes/oauth/authorize/get.js.map

@@ -1 +1 @@
-{"version":3,"file":"get.js","sourceRoot":"","sources":["../../../../src/routes/oauth/authorize/get.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,8BAA8B,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,CAAC,EAAE,MAAM,2BAA2B,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,2BAA2B,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,8BAA8B,CAAC;AAGjD,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,IAAI,EAAU,CAAC,GAAG,CAChD,YAAY,EACZ,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;IACnB,QAAQ,EAAE,gBAAgB,CAAC,qBAAqB;IAChD,OAAO,EAAE,WAAW;IACpB,WAAW,EAAE,+BAA+B;IAC5C,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,UAAU;SACxB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;iBAC/B;aACF;YACD,WAAW,EAAE,aAAa;SAC3B;KACF;CACF,CAAC,EACF,SAAS,CACP,OAAO,EACP,CAAC,CAAC,MAAM,CAAC;IACP,aAAa,EAAE,CAAC,CAAC,YAAY;IAC7B,YAAY,EAAE,CAAC,CAAC,WAAW;IAC3B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,QAAQ;IACrB,cAAc,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,EAAE;IAC1C,qBAAqB,EAAE,CAAC,CAAC,mBAAmB,CAAC,QAAQ,EAAE;IACvD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE;IACzB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE;IACzB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE;IAC5B,eAAe,EAAE,CAAC;SACf,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE;QACpB,IAAI,KAAK,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5C,OAAO,kBAAkB,CAAC,KAAK,CAAC;aAC7B,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC;aACnB,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1B,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;SACjB,QAAQ,EAAE;IACb,gBAAgB,EAAE,CAAC;SAChB,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE;QACpB,IAAI,KAAK,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5C,OAAO,kBAAkB,CAAC,KAAK,CAAC;aAC7B,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC;aACnB,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1B,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;SACjB,QAAQ,EAAE;IACb,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC9D,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE;IAC7B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACpD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAClD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAClD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IACrD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CACnD,CAAC,CACH,EACD,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAC9B,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,EAAE,qBAAqB,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAEjD,yCAAyC;IACzC,MAAM,iBAAiB,GAAG,CACxB,KAAa,EACb,gBAAwB,EACxB,WAAoB,EACpB,EAAE;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK;gBACL,iBAAiB,EAAE,gBAAgB;aACpC,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,aAAa,KAAK,WAAW,EAAE,CAAC;YACxC,MAAM,MAAM,GAA2B;gBACrC,KAAK;gBACL,iBAAiB,EAAE,gBAAgB;aACpC,CAAC;YACF,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;gBAChB,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;YAChC,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACjC,MAAM,WAAW,GACf,KAAK,CAAC,aAAa,KAAK,UAAU;YAClC,CAAC,KAAK,CAAC,aAAa,KAAK,UAAU,IAAI,KAAK,CAAC,aAAa,KAAK,OAAO,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;QACtE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,CAAC;QAClD,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;QAED,IAAI,WAAW,EAAE,CAAC;YAChB,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC/B,CAAC;QAED,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;QAExC,yBAAyB;QACzB,MAAM,eAAe,GAiCjB;YACF,KAAK,EAAE,KAAK;SACb,CAAC;QAEF,IAAI,YAAY,EAAE,CAAC;YACjB,eAAe,CAAC,WAAW,GAAG;gBAC5B,GAAG,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG;gBAC1B,gBAAgB,EAAE,YAAY,CAAC,eAAe;aAC/C,CAAC;QACJ,CAAC;QACD,MAAM,kBAAkB,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,kBAAkB,EAAE,CAAC;YACvB,eAAe,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;YACxD,eAAe,CAAC,iBAAiB,GAAG,CAAC,OAAO,EAAE,EAAE,CAC9C,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC7C,CAAC;QACD,eAAe,CAAC,uBAAuB;YACrC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACxC,eAAe,CAAC,uBAAuB;YACrC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACxC,eAAe,CAAC,0BAA0B,GAAG,CAAC,KAAK,EAAE,EAAE,CACrD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;QAC/C,eAAe,CAAC,0BAA0B,GAAG,CAAC,KAAK,EAAE,EAAE,CACrD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;QAC/C,eAAe,CAAC,4BAA4B,GAAG,GAAG,EAAE,CAClD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;QAEnD,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAEtE,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,OAAO,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;QACxE,CAAC;QAED,2BAA2B;QAC3B,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,+EAA+E;QAC/E,+CAA+C;QAC/C,IAAI,KAAK,YAAY,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;YACjD,OAAO,iBAAiB,CACtB,qBAAqB,EACrB,KAAK,CAAC,OAAO,EACb,SAAS,CACV,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,YAAY,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;YACjD,OAAO,iBAAiB,CACtB,qBAAqB,EACrB,KAAK,CAAC,OAAO,EACb,SAAS,CACV,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,YAAY,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;YAChD,OAAO,iBAAiB,CAAC,iBAAiB,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACxE,CAAC;QAED,oFAAoF;QACpF,IAAI,KAAK,YAAY,CAAC,CAAC,uBAAuB,CAAC,KAAK,EAAE,CAAC;YACrD,OAAO,iBAAiB,CACtB,2BAA2B,EAC3B,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CACnB,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,YAAY,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;YAC1C,OAAO,iBAAiB,CACtB,eAAe,EACf,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CACnB,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,YAAY,CAAC,CAAC,0BAA0B,CAAC,KAAK,EAAE,CAAC;YACxD,OAAO,iBAAiB,CACtB,iBAAiB,EACjB,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CACnB,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,YAAY,CAAC,CAAC,2BAA2B,CAAC,KAAK,EAAE,CAAC;YACzD,OAAO,iBAAiB,CACtB,iBAAiB,EACjB,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CACnB,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,YAAY,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;YAC3C,OAAO,iBAAiB,CACtB,iBAAiB,EACjB,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CACnB,CAAC;QACJ,CAAC;QAED,oEAAoE;QACpE,sEAAsE;QACtE,kDAAkD;QAClD,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,4BAA4B,CAAC,CAAC;QACjE,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE,cAAc;YACrB,iBAAiB,EAAE,8BAA8B;SAClD,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;AACH,CAAC,CACF,CAAC;AAEF,SAAS,qBAAqB,CAAC,MAAc,EAAE,MAA8B;IAC3E,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;SAClC,GAAG,CACF,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAChB,8BAA8B,UAAU,CAAC,IAAI,CAAC,YAAY,UAAU,CAAC,KAAK,CAAC,IAAI,CAClF;SACA,IAAI,CAAC,EAAE,CAAC,CAAC;IAEZ,OAAO,mHAAmH,UAAU,CAAC,MAAM,CAAC,KAAK,MAAM,+HAA+H,CAAC;AACzR,CAAC"}
+{"version":3,"file":"get.js","sourceRoot":"","sources":["../../../../src/routes/oauth/authorize/get.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EACL,gBAAgB,EAChB,6BAA6B,GAC9B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,8BAA8B,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,CAAC,EAAE,MAAM,2BAA2B,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,2BAA2B,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,8BAA8B,CAAC;AACjD,OAAO,EAAE,4BAA4B,EAAE,MAAM,oDAAoD,CAAC;AAGlG,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,IAAI,EAAU,CAAC,GAAG,CAChD,YAAY,EACZ,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;IACnB,QAAQ,EAAE,gBAAgB,CAAC,qBAAqB;IAChD,OAAO,EAAE,WAAW;IACpB,WAAW,EACT,wbAAwb;IAC1b,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,UAAU;SACxB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;iBAC/B;aACF;YACD,WAAW,EAAE,aAAa;SAC3B;KACF;CACF,CAAC,EACF,SAAS,CACP,OAAO,EACP,CAAC,CAAC,MAAM,CAAC;IACP,aAAa,EAAE,CAAC,CAAC,YAAY;IAC7B,YAAY,EAAE,CAAC,CAAC,WAAW;IAC3B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,QAAQ;IACrB,cAAc,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,EAAE;IAC1C,qBAAqB,EAAE,CAAC,CAAC,mBAAmB,CAAC,QAAQ,EAAE;IACvD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE;IACzB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE;IACzB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE;IAC5B,eAAe,EAAE,CAAC;SACf,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE;QACpB,IAAI,KAAK,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5C,OAAO,kBAAkB,CAAC,KAAK,CAAC;aAC7B,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC;aACnB,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1B,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;SACjB,QAAQ,EAAE;IACb,gBAAgB,EAAE,CAAC;SAChB,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE;QACpB,IAAI,KAAK,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5C,OAAO,kBAAkB,CAAC,KAAK,CAAC;aAC7B,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC;aACnB,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1B,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;SACjB,QAAQ,EAAE;IACb,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC9D,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE;IAC7B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACpD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAClD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAClD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IACrD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CACnD,CAAC,CACH,EACD,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAC9B,6BAA6B,EAC7B,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,EAAE,qBAAqB,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAEjD,yCAAyC;IACzC,MAAM,iBAAiB,GAAG,CACxB,KAAa,EACb,gBAAwB,EACxB,WAAoB,EACpB,EAAE;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK;gBACL,iBAAiB,EAAE,gBAAgB;aACpC,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,aAAa,KAAK,WAAW,EAAE,CAAC;YACxC,MAAM,MAAM,GAA2B;gBACrC,KAAK;gBACL,iBAAiB,EAAE,gBAAgB;aACpC,CAAC;YACF,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;gBAChB,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;YAChC,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACjC,MAAM,WAAW,GACf,KAAK,CAAC,aAAa,KAAK,UAAU;YAClC,CAAC,KAAK,CAAC,aAAa,KAAK,UAAU,IAAI,KAAK,CAAC,aAAa,KAAK,OAAO,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;QACtE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,CAAC;QAClD,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;QAED,IAAI,WAAW,EAAE,CAAC;YAChB,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC/B,CAAC;QAED,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;QAExC,yBAAyB;QACzB,MAAM,eAAe,GAiCjB;YACF,KAAK,EAAE,KAAK;SACb,CAAC;QAEF,IAAI,YAAY,EAAE,CAAC;YACjB,eAAe,CAAC,WAAW,GAAG;gBAC5B,GAAG,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG;gBAC1B,gBAAgB,EAAE,YAAY,CAAC,eAAe;aAC/C,CAAC;QACJ,CAAC;QACD,MAAM,kBAAkB,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,kBAAkB,EAAE,CAAC;YACvB,eAAe,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;YACxD,eAAe,CAAC,iBAAiB,GAAG,CAAC,OAAO,EAAE,EAAE,CAC9C,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC7C,CAAC;QACD,eAAe,CAAC,uBAAuB;YACrC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACxC,eAAe,CAAC,uBAAuB;YACrC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACxC,eAAe,CAAC,0BAA0B,GAAG,CAAC,KAAK,EAAE,EAAE,CACrD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;QAC/C,eAAe,CAAC,0BAA0B,GAAG,CAAC,KAAK,EAAE,EAAE,CACrD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;QAC/C,eAAe,CAAC,4BAA4B,GAAG,GAAG,EAAE,CAClD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;QAEnD,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,SAAS,CAAC;YACnD,GAAG,eAAe;YAClB,qBAAqB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,CAC1C,4BAA4B,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC;YACnD,oBAAoB,EAClB,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE;SACrD,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,OAAO,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;QACxE,CAAC;QAED,2BAA2B;QAC3B,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,KAAK,YAAY,CAAC,CAAC,YAAY,CAAC,KAAK;YACrC,KAAK,YAAY,CAAC,CAAC,wBAAwB,CAAC,KAAK;YAEjD,MAAM,KAAK,CAAC;QACd,+EAA+E;QAC/E,+CAA+C;QAC/C,IAAI,KAAK,YAAY,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;YACjD,OAAO,iBAAiB,CACtB,qBAAqB,EACrB,KAAK,CAAC,OAAO,EACb,SAAS,CACV,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,YAAY,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;YACjD,OAAO,iBAAiB,CACtB,qBAAqB,EACrB,KAAK,CAAC,OAAO,EACb,SAAS,CACV,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,YAAY,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;YAChD,OAAO,iBAAiB,CAAC,iBAAiB,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACxE,CAAC;QAED,oFAAoF;QACpF,IAAI,KAAK,YAAY,CAAC,CAAC,uBAAuB,CAAC,KAAK,EAAE,CAAC;YACrD,OAAO,iBAAiB,CACtB,2BAA2B,EAC3B,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CACnB,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,YAAY,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;YAC1C,OAAO,iBAAiB,CACtB,eAAe,EACf,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CACnB,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,YAAY,CAAC,CAAC,0BAA0B,CAAC,KAAK,EAAE,CAAC;YACxD,OAAO,iBAAiB,CACtB,iBAAiB,EACjB,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CACnB,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,YAAY,CAAC,CAAC,2BAA2B,CAAC,KAAK,EAAE,CAAC;YACzD,OAAO,iBAAiB,CACtB,iBAAiB,EACjB,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CACnB,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,YAAY,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;YAC3C,OAAO,iBAAiB,CACtB,iBAAiB,EACjB,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CACnB,CAAC;QACJ,CAAC;QAED,oEAAoE;QACpE,sEAAsE;QACtE,kDAAkD;QAClD,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,4BAA4B,CAAC,CAAC;QACjE,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE,cAAc;YACrB,iBAAiB,EAAE,8BAA8B;SAClD,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;AACH,CAAC,CACF,CAAC;AAEF,SAAS,qBAAqB,CAAC,MAAc,EAAE,MAA8B;IAC3E,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;SAClC,GAAG,CACF,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAChB,8BAA8B,UAAU,CAAC,IAAI,CAAC,YAAY,UAAU,CAAC,KAAK,CAAC,IAAI,CAClF;SACA,IAAI,CAAC,EAAE,CAAC,CAAC;IAEZ,OAAO,mHAAmH,UAAU,CAAC,MAAM,CAAC,KAAK,MAAM,+HAA+H,CAAC;AACzR,CAAC"}

package/dist/routes/oauth/device/get-post.d.ts

@@ -11,6 +11,16 @@ export declare const deviceGetPost: import("hono/hono-base").HonoBase<AppEnv, {
 } & {
     "/device": {
         $post: {
+            output: undefined;
+            outputFormat: "redirect";
+            status: 303;
+            input: {
+                form: {
+                    user_code: import("hono/types").ParsedFormValue[] | import("hono/types").ParsedFormValue;
+                    decision?: "approve" | "deny" | undefined;
+                };
+            };
+        } | {
             output: {
                 status: string;
                 client_id: string;

package/dist/routes/oauth/device/get-post.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-post.d.ts","sourceRoot":"","sources":["../../../../src/routes/oauth/device/get-post.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAWtD,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;kBAwFvB,CAAC"}
+{"version":3,"file":"get-post.d.ts","sourceRoot":"","sources":["../../../../src/routes/oauth/device/get-post.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAkBtD,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAwIvB,CAAC"}

package/dist/routes/oauth/device/get-post.js

@@ -2,13 +2,19 @@ import { Hono } from 'hono';
 import { describeRoute, validator } from 'hono-openapi';
 import { z } from 'zod';
 import { escapeHtml } from '../../../lib/escape-html.js';
+import { securityMutationDocumentation } from '../../../lib/openapi.js';
 import { TAGS } from '../../../lib/swagger-tags.js';
 import { verifyAuth } from '../../../middleware/auth.js';
 import { e } from '../../../schemas/error.js';
+import { withBrowserSecurity } from '../../../services/browser-security.service.js';
 const DeviceVerificationRequestBody = z.object({
     user_code: z.string().min(1).max(64),
     decision: z.enum(['approve', 'deny']).default('approve'),
 });
+function deviceTermsLocation(userCode) {
+    const redirect = `/oauth/device?${new URLSearchParams({ user_code: userCode })}`;
+    return `/terms?${new URLSearchParams({ redirect })}`;
+}
 export const deviceGetPost = new Hono()
     .get('/device', describeRoute({
     tags: [TAGS.OPENID],
@@ -16,6 +22,9 @@ export const deviceGetPost = new Hono()
     description: 'User-facing OAuth device verification page',
     responses: {
         200: { description: 'Device verification form' },
+        303: {
+            description: 'Accept required terms and return to this device confirmation',
+        },
     },
 }), verifyAuth({ optional: true }), async (c) => {
     const userCode = c.req.query('user_code') ?? '';
@@ -30,6 +39,8 @@ export const deviceGetPost = new Hono()
         const userCodeHash = await securityService.hashOpaqueToken('oauth-device-user-code', userCode.toUpperCase());
         const deviceCode = await mikro.oauthDeviceCode.findPendingByUserCodeHash(userCodeHash);
         if (deviceCode) {
+            if ((await c.var.services.termsService.getPendingRequiredTerms(verifiedUser.user.sub)).length > 0)
+                return c.redirect(deviceTermsLocation(userCode), 303);
             await mikro.em.populate(deviceCode, ['client']);
             const scopes = deviceCode.scope
                 .map((scope) => `<li>${escapeHtml(scope)}</li>`)
@@ -37,7 +48,10 @@ export const deviceGetPost = new Hono()
             deviceDetails = `<section><h2>${escapeHtml(deviceCode.client.name)}</h2><p>Requested scopes:</p><ul>${scopes}</ul></section>`;
         }
     }
-    return c.html(`<!doctype html><html><body>${deviceDetails}<form method="post"><input name="user_code" value="${escapeHtml(userCode)}"><button type="submit" name="decision" value="approve">Approve</button><button type="submit" name="decision" value="deny">Deny</button></form></body></html>`);
+    // Native POST forms use an opaque Origin under no-referrer. Preserve
+    // the first-party Origin for CSRF without sending a cross-site referrer.
+    c.header('Referrer-Policy', 'same-origin');
+    return c.html(`<!doctype html><html><body>${deviceDetails}<form method="post" action="/oauth/device"><input name="user_code" value="${escapeHtml(userCode)}"><button type="submit" name="decision" value="approve">Approve</button><button type="submit" name="decision" value="deny">Deny</button></form></body></html>`);
 })
     .post('/device', describeRoute({
     tags: [TAGS.OPENID],
@@ -46,11 +60,21 @@ export const deviceGetPost = new Hono()
     responses: {
         200: { description: 'Device authorization approved' },
         400: { description: 'Invalid device user code' },
+        303: {
+            description: 'Accept required terms and return to device approval; the device remains pending',
+        },
     },
-}), validator('form', DeviceVerificationRequestBody), verifyAuth(), async (c) => {
+}), validator('form', DeviceVerificationRequestBody), verifyAuth(), securityMutationDocumentation, async (c) => withBrowserSecurity(c, async () => {
     const { decision, user_code: userCode } = c.req.valid('form');
     const { mikro, securityService } = c.var.services;
     const userCodeHash = await securityService.hashOpaqueToken('oauth-device-user-code', userCode.toUpperCase());
+    if (decision === 'approve') {
+        const pending = await mikro.oauthDeviceCode.findPendingByUserCodeHash(userCodeHash);
+        if (!pending)
+            throw new e.InvalidDeviceCode.Error();
+        if ((await c.var.services.termsService.getPendingRequiredTerms(c.var.verifiedUser.user.sub)).length > 0)
+            return c.redirect(deviceTermsLocation(userCode), 303);
+    }
     const now = new Date();
     const deviceCode = decision === 'deny'
         ? await mikro.oauthDeviceCode.denyPendingByUserCodeHash({
@@ -61,6 +85,7 @@ export const deviceGetPost = new Hono()
             userCodeHash,
             userSub: c.var.verifiedUser.user.sub,
             approvedAt: now,
+            userEpoch: c.var.session.authorization.security?.grants[c.var.verifiedUser.user.sub] ?? '',
         });
     if (!deviceCode) {
         throw new e.InvalidDeviceCode.Error();
@@ -69,5 +94,9 @@ export const deviceGetPost = new Hono()
         status: decision === 'deny' ? 'denied' : 'approved',
         client_id: deviceCode.client.clientId,
     });
-});
+}, {
+    ...(c.req.valid('form').decision === 'approve' && {
+        termsPolicy: 'read',
+    }),
+}));
 //# sourceMappingURL=get-post.js.map

package/dist/routes/oauth/device/get-post.js.map

@@ -1 +1 @@
-{"version":3,"file":"get-post.js","sourceRoot":"","sources":["../../../../src/routes/oauth/device/get-post.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,MAAM,8BAA8B,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,CAAC,EAAE,MAAM,2BAA2B,CAAC;AAE9C,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;CACzD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,IAAI,EAAU;KAC5C,GAAG,CACF,SAAS,EACT,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;IACnB,OAAO,EAAE,qBAAqB;IAC9B,WAAW,EAAE,4CAA4C;IACzD,SAAS,EAAE;QACT,GAAG,EAAE,EAAE,WAAW,EAAE,0BAA0B,EAAE;KACjD;CACF,CAAC,EACF,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAC9B,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IAChD,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;IAExC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,QAAQ,GAAG,oBAAoB,kBAAkB,CAAC,2BAA2B,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QACrH,OAAO,CAAC,CAAC,IAAI,CACX,+EAA+E,UAAU,CAAC,QAAQ,CAAC,iCAAiC,CACrI,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClD,IAAI,aAAa,GAAG,EAAE,CAAC;IACvB,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,eAAe,CACxD,wBAAwB,EACxB,QAAQ,CAAC,WAAW,EAAE,CACvB,CAAC;QACF,MAAM,UAAU,GACd,MAAM,KAAK,CAAC,eAAe,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAC;QACtE,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;YAChD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK;iBAC5B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC;iBAC/C,IAAI,CAAC,EAAE,CAAC,CAAC;YACZ,aAAa,GAAG,gBAAgB,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,MAAM,iBAAiB,CAAC;QAChI,CAAC;IACH,CAAC;IAED,OAAO,CAAC,CAAC,IAAI,CACX,8BAA8B,aAAa,sDAAsD,UAAU,CAAC,QAAQ,CAAC,+JAA+J,CACrR,CAAC;AACJ,CAAC,CACF;KACA,IAAI,CACH,SAAS,EACT,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;IACnB,OAAO,EAAE,8BAA8B;IACvC,WAAW,EAAE,uDAAuD;IACpE,SAAS,EAAE;QACT,GAAG,EAAE,EAAE,WAAW,EAAE,+BAA+B,EAAE;QACrD,GAAG,EAAE,EAAE,WAAW,EAAE,0BAA0B,EAAE;KACjD;CACF,CAAC,EACF,SAAS,CAAC,MAAM,EAAE,6BAA6B,CAAC,EAChD,UAAU,EAAE,EACZ,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClD,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,eAAe,CACxD,wBAAwB,EACxB,QAAQ,CAAC,WAAW,EAAE,CACvB,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,UAAU,GACd,QAAQ,KAAK,MAAM;QACjB,CAAC,CAAC,MAAM,KAAK,CAAC,eAAe,CAAC,yBAAyB,CAAC;YACpD,YAAY;YACZ,QAAQ,EAAE,GAAG;SACd,CAAC;QACJ,CAAC,CAAC,MAAM,KAAK,CAAC,eAAe,CAAC,4BAA4B,CAAC;YACvD,YAAY;YACZ,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG;YACpC,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IAET,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;IACxC,CAAC;IAED,OAAO,CAAC,CAAC,IAAI,CAAC;QACZ,MAAM,EAAE,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU;QACnD,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,QAAQ;KACtC,CAAC,CAAC;AACL,CAAC,CACF,CAAC"}
+{"version":3,"file":"get-post.js","sourceRoot":"","sources":["../../../../src/routes/oauth/device/get-post.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,MAAM,8BAA8B,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,CAAC,EAAE,MAAM,2BAA2B,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,+CAA+C,CAAC;AAEpF,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;CACzD,CAAC,CAAC;AAEH,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,QAAQ,GAAG,iBAAiB,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACjF,OAAO,UAAU,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,IAAI,EAAU;KAC5C,GAAG,CACF,SAAS,EACT,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;IACnB,OAAO,EAAE,qBAAqB;IAC9B,WAAW,EAAE,4CAA4C;IACzD,SAAS,EAAE;QACT,GAAG,EAAE,EAAE,WAAW,EAAE,0BAA0B,EAAE;QAChD,GAAG,EAAE;YACH,WAAW,EACT,8DAA8D;SACjE;KACF;CACF,CAAC,EACF,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAC9B,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IAChD,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;IAExC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,QAAQ,GAAG,oBAAoB,kBAAkB,CAAC,2BAA2B,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QACrH,OAAO,CAAC,CAAC,IAAI,CACX,+EAA+E,UAAU,CAAC,QAAQ,CAAC,iCAAiC,CACrI,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClD,IAAI,aAAa,GAAG,EAAE,CAAC;IACvB,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,eAAe,CACxD,wBAAwB,EACxB,QAAQ,CAAC,WAAW,EAAE,CACvB,CAAC;QACF,MAAM,UAAU,GACd,MAAM,KAAK,CAAC,eAAe,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAC;QACtE,IAAI,UAAU,EAAE,CAAC;YACf,IACE,CACE,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,uBAAuB,CACvD,YAAY,CAAC,IAAI,CAAC,GAAG,CACtB,CACF,CAAC,MAAM,GAAG,CAAC;gBAEZ,OAAO,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YACxD,MAAM,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;YAChD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK;iBAC5B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC;iBAC/C,IAAI,CAAC,EAAE,CAAC,CAAC;YACZ,aAAa,GAAG,gBAAgB,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,MAAM,iBAAiB,CAAC;QAChI,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,yEAAyE;IACzE,CAAC,CAAC,MAAM,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAC3C,OAAO,CAAC,CAAC,IAAI,CACX,8BAA8B,aAAa,6EAA6E,UAAU,CAAC,QAAQ,CAAC,+JAA+J,CAC5S,CAAC;AACJ,CAAC,CACF;KACA,IAAI,CACH,SAAS,EACT,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;IACnB,OAAO,EAAE,8BAA8B;IACvC,WAAW,EAAE,uDAAuD;IACpE,SAAS,EAAE;QACT,GAAG,EAAE,EAAE,WAAW,EAAE,+BAA+B,EAAE;QACrD,GAAG,EAAE,EAAE,WAAW,EAAE,0BAA0B,EAAE;QAChD,GAAG,EAAE;YACH,WAAW,EACT,iFAAiF;SACpF;KACF;CACF,CAAC,EACF,SAAS,CAAC,MAAM,EAAE,6BAA6B,CAAC,EAChD,UAAU,EAAE,EACZ,6BAA6B,EAC7B,KAAK,EAAE,CAAC,EAAE,EAAE,CACV,mBAAmB,CACjB,CAAC,EACD,KAAK,IAAI,EAAE;IACT,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClD,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,eAAe,CACxD,wBAAwB,EACxB,QAAQ,CAAC,WAAW,EAAE,CACvB,CAAC;IACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,OAAO,GACX,MAAM,KAAK,CAAC,eAAe,CAAC,yBAAyB,CACnD,YAAY,CACb,CAAC;QACJ,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;QACpD,IACE,CACE,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,uBAAuB,CACvD,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAC5B,CACF,CAAC,MAAM,GAAG,CAAC;YAEZ,OAAO,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,UAAU,GACd,QAAQ,KAAK,MAAM;QACjB,CAAC,CAAC,MAAM,KAAK,CAAC,eAAe,CAAC,yBAAyB,CAAC;YACpD,YAAY;YACZ,QAAQ,EAAE,GAAG;SACd,CAAC;QACJ,CAAC,CAAC,MAAM,KAAK,CAAC,eAAe,CAAC,4BAA4B,CAAC;YACvD,YAAY;YACZ,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG;YACpC,UAAU,EAAE,GAAG;YACf,SAAS,EACP,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAC1C,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAC5B,IAAI,EAAE;SACV,CAAC,CAAC;IAET,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;IACxC,CAAC;IAED,OAAO,CAAC,CAAC,IAAI,CAAC;QACZ,MAAM,EAAE,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU;QACnD,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,QAAQ;KACtC,CAAC,CAAC;AACL,CAAC,EACD;IACE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI;QAChD,WAAW,EAAE,MAAM;KACpB,CAAC;CACH,CACF,CACJ,CAAC"}

package/dist/routes/oauth/device-authorization/post.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../../../src/routes/oauth/device-authorization/post.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AA0BtD,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;gCA6FnC,CAAC"}
+{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../../../src/routes/oauth/device-authorization/post.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AA2BtD,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;gCAuGnC,CAAC"}

package/dist/routes/oauth/device-authorization/post.js

@@ -50,8 +50,9 @@ export const deviceAuthorizationPost = new Hono().post('/device_authorization',
     oauthClientService.validateEnabled(client);
     oauthClientService.validateGrantType(client, DEVICE_CODE_GRANT_TYPE);
     const clientSecret = basicCredentials?.clientSecret ?? body.client_secret;
+    let authentication;
     try {
-        await oauthClientService.validateClientSecretIfRequired(clientId, clientSecret);
+        authentication = await oauthClientService.validateClientSecretIfRequired(clientId, clientSecret);
     }
     catch (err) {
         if (authorizationHeader) {
@@ -65,12 +66,17 @@ export const deviceAuthorizationPost = new Hono().post('/device_authorization',
     const userCode = createUserCode();
     const deviceCodeHash = await securityService.hashOpaqueToken('oauth-device-code', deviceCode);
     const userCodeHash = await securityService.hashOpaqueToken('oauth-device-user-code', userCode);
-    await mikro.oauthDeviceCode.createDeviceAuthorization({
-        clientId: client.id,
-        deviceCodeHash,
-        userCodeHash,
-        scope: requestedScopes,
-        expiresInSeconds: DEVICE_CODE_EXPIRES_IN,
+    await mikro.em.transactional(async () => {
+        const current = await oauthClientService.lockAuthenticatedClient(authentication, clientId, DEVICE_CODE_GRANT_TYPE);
+        oauthClientService.validateScopes(current, requestedScopes);
+        await mikro.oauthDeviceCode.createDeviceAuthorization({
+            clientId: client.id,
+            clientEpoch: authentication.epoch,
+            deviceCodeHash,
+            userCodeHash,
+            scope: requestedScopes,
+            expiresInSeconds: DEVICE_CODE_EXPIRES_IN,
+        });
     });
     const verificationUri = `${config.server.public_origin}/oauth/device`;
     const verificationUriComplete = new URL(verificationUri);

package/dist/routes/oauth/device-authorization/post.js.map

@@ -1 +1 @@
-{"version":3,"file":"post.js","sourceRoot":"","sources":["../../../../src/routes/oauth/device-authorization/post.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,MAAM,8BAA8B,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,2BAA2B,CAAC;AAC9C,OAAO,EACL,2BAA2B,EAC3B,qDAAqD,EACrD,+CAA+C,GAChD,MAAM,mBAAmB,CAAC;AAE3B,MAAM,sBAAsB,GAAG,8CAA8C,CAAC;AAC9E,MAAM,sBAAsB,GAAG,GAAG,CAAC;AACnC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAE/B,MAAM,8BAA8B,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE;IAChC,aAAa,EAAE,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE;IACxC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE;CAC1B,CAAC;KACD,QAAQ,CAAC,6CAA6C,CAAC,CAAC;AAE3D,SAAS,cAAc;IACrB,OAAO,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,IAAI,EAAU,CAAC,IAAI,CAC5D,uBAAuB,EACvB,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;IACnB,OAAO,EAAE,sBAAsB;IAC/B,WAAW,EAAE,yCAAyC;IACtD,SAAS,EAAE;QACT,GAAG,EAAE,EAAE,WAAW,EAAE,+BAA+B,EAAE;QACrD,GAAG,EAAE,EAAE,WAAW,EAAE,4BAA4B,EAAE;KACnD;CACF,CAAC,EACF,SAAS,CAAC,MAAM,EAAE,8BAA8B,CAAC,EACjD,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,eAAe,EAAE,KAAK,EAAE,GAC1D,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IACjB,MAAM,mBAAmB,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC1D,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,mBAAmB,CAAC,CAAC;IAE1E,IAAI,gBAAgB,KAAK,IAAI,EAAE,CAAC;QAC9B,+CAA+C,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,gBAAgB,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3C,+CAA+C,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,gBAAgB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACvC,IAAI,gBAAgB,CAAC,QAAQ,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YACjD,+CAA+C,CAAC,CAAC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,EAAE,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC;IAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,+CAA+C,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACjE,kBAAkB,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IAC3C,kBAAkB,CAAC,iBAAiB,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAErE,MAAM,YAAY,GAAG,gBAAgB,EAAE,YAAY,IAAI,IAAI,CAAC,aAAa,CAAC;IAC1E,IAAI,CAAC;QACH,MAAM,kBAAkB,CAAC,8BAA8B,CACrD,QAAQ,EACR,YAAY,CACb,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,mBAAmB,EAAE,CAAC;YACxB,qDAAqD,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,kBAAkB,CAAC,cAAc,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAE3D,MAAM,UAAU,GAAG,WAAW,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC,eAAe,CAC1D,mBAAmB,EACnB,UAAU,CACX,CAAC;IACF,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,eAAe,CACxD,wBAAwB,EACxB,QAAQ,CACT,CAAC;IAEF,MAAM,KAAK,CAAC,eAAe,CAAC,yBAAyB,CAAC;QACpD,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,cAAc;QACd,YAAY;QACZ,KAAK,EAAE,eAAe;QACtB,gBAAgB,EAAE,sBAAsB;KACzC,CAAC,CAAC;IAEH,MAAM,eAAe,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,eAAe,CAAC;IACtE,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IACzD,uBAAuB,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAEhE,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IACtC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC/B,OAAO,CAAC,CAAC,IAAI,CACX;QACE,WAAW,EAAE,UAAU;QACvB,SAAS,EAAE,QAAQ;QACnB,gBAAgB,EAAE,eAAe;QACjC,yBAAyB,EAAE,uBAAuB,CAAC,QAAQ,EAAE;QAC7D,UAAU,EAAE,sBAAsB;QAClC,QAAQ,EAAE,oBAAoB;KAC/B,EACD,GAAG,CACJ,CAAC;AACJ,CAAC,CACF,CAAC"}
+{"version":3,"file":"post.js","sourceRoot":"","sources":["../../../../src/routes/oauth/device-authorization/post.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,MAAM,8BAA8B,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,2BAA2B,CAAC;AAE9C,OAAO,EACL,2BAA2B,EAC3B,qDAAqD,EACrD,+CAA+C,GAChD,MAAM,mBAAmB,CAAC;AAE3B,MAAM,sBAAsB,GAAG,8CAA8C,CAAC;AAC9E,MAAM,sBAAsB,GAAG,GAAG,CAAC;AACnC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAE/B,MAAM,8BAA8B,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE;IAChC,aAAa,EAAE,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE;IACxC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE;CAC1B,CAAC;KACD,QAAQ,CAAC,6CAA6C,CAAC,CAAC;AAE3D,SAAS,cAAc;IACrB,OAAO,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,IAAI,EAAU,CAAC,IAAI,CAC5D,uBAAuB,EACvB,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;IACnB,OAAO,EAAE,sBAAsB;IAC/B,WAAW,EAAE,yCAAyC;IACtD,SAAS,EAAE;QACT,GAAG,EAAE,EAAE,WAAW,EAAE,+BAA+B,EAAE;QACrD,GAAG,EAAE,EAAE,WAAW,EAAE,4BAA4B,EAAE;KACnD;CACF,CAAC,EACF,SAAS,CAAC,MAAM,EAAE,8BAA8B,CAAC,EACjD,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,eAAe,EAAE,KAAK,EAAE,GAC1D,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IACjB,MAAM,mBAAmB,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC1D,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,mBAAmB,CAAC,CAAC;IAE1E,IAAI,gBAAgB,KAAK,IAAI,EAAE,CAAC;QAC9B,+CAA+C,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,gBAAgB,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3C,+CAA+C,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,gBAAgB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACvC,IAAI,gBAAgB,CAAC,QAAQ,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YACjD,+CAA+C,CAAC,CAAC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,EAAE,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC;IAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,+CAA+C,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACjE,kBAAkB,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IAC3C,kBAAkB,CAAC,iBAAiB,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAErE,MAAM,YAAY,GAAG,gBAAgB,EAAE,YAAY,IAAI,IAAI,CAAC,aAAa,CAAC;IAC1E,IAAI,cAAyC,CAAC;IAC9C,IAAI,CAAC;QACH,cAAc,GAAG,MAAM,kBAAkB,CAAC,8BAA8B,CACtE,QAAQ,EACR,YAAY,CACb,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,mBAAmB,EAAE,CAAC;YACxB,qDAAqD,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,kBAAkB,CAAC,cAAc,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAE3D,MAAM,UAAU,GAAG,WAAW,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC,eAAe,CAC1D,mBAAmB,EACnB,UAAU,CACX,CAAC;IACF,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,eAAe,CACxD,wBAAwB,EACxB,QAAQ,CACT,CAAC;IAEF,MAAM,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,IAAI,EAAE;QACtC,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,uBAAuB,CAC9D,cAAc,EACd,QAAQ,EACR,sBAAsB,CACvB,CAAC;QACF,kBAAkB,CAAC,cAAc,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC5D,MAAM,KAAK,CAAC,eAAe,CAAC,yBAAyB,CAAC;YACpD,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,WAAW,EAAE,cAAc,CAAC,KAAK;YACjC,cAAc;YACd,YAAY;YACZ,KAAK,EAAE,eAAe;YACtB,gBAAgB,EAAE,sBAAsB;SACzC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,eAAe,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,eAAe,CAAC;IACtE,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IACzD,uBAAuB,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAEhE,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IACtC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC/B,OAAO,CAAC,CAAC,IAAI,CACX;QACE,WAAW,EAAE,UAAU;QACvB,SAAS,EAAE,QAAQ;QACnB,gBAAgB,EAAE,eAAe;QACjC,yBAAyB,EAAE,uBAAuB,CAAC,QAAQ,EAAE;QAC7D,UAAU,EAAE,sBAAsB;QAClC,QAAQ,EAAE,oBAAoB;KAC/B,EACD,GAAG,CACJ,CAAC;AACJ,CAAC,CACF,CAAC"}

package/dist/routes/oauth/end-session/get.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../../../src/routes/oauth/end-session/get.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAItD,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uBA+GzB,CAAC"}
+{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../../../src/routes/oauth/end-session/get.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAItD,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uBA+GzB,CAAC"}

package/dist/routes/oauth/end-session/get.js

@@ -1,5 +1,4 @@
 import { Hono } from 'hono';
-import { deleteCookie } from 'hono/cookie';
 import { describeRoute, resolver, validator } from 'hono-openapi';
 import { z } from 'zod';
 import { TAGS } from '../../../lib/swagger-tags.js';
@@ -28,7 +27,7 @@ export const endSessionGet = new Hono().get('/end_session', describeRoute({
     const query = c.req.valid('query');
     const { config, jwtService, oauthClientService } = c.var.services;
     if (!query.post_logout_redirect_uri) {
-        deleteCookie(c, 'session', { path: '/' });
+        c.var.session.delete();
         return c.redirect(config.server.public_origin);
     }
     let clientId = query.client_id;
@@ -77,7 +76,7 @@ export const endSessionGet = new Hono().get('/end_session', describeRoute({
     if (query.state) {
         redirectUrl.searchParams.set('state', query.state);
     }
-    deleteCookie(c, 'session', { path: '/' });
+    c.var.session.delete();
     return c.redirect(redirectUrl.toString());
 });
 //# sourceMappingURL=get.js.map

package/dist/routes/oauth/end-session/get.js.map

@@ -1 +1 @@
-{"version":3,"file":"get.js","sourceRoot":"","sources":["../../../../src/routes/oauth/end-session/get.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,IAAI,EAAE,MAAM,8BAA8B,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,8BAA8B,CAAC;AAEjD,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,IAAI,EAAU,CAAC,GAAG,CACjD,cAAc,EACd,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;IACnB,OAAO,EAAE,aAAa;IACtB,WAAW,EAAE,8BAA8B;IAC3C,SAAS,EAAE;QACT,GAAG,EAAE,EAAE,WAAW,EAAE,uBAAuB,EAAE;QAC7C,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;iBAC/B;aACF;YACD,WAAW,EAAE,wBAAwB;SACtC;KACF;CACF,CAAC,EACF,SAAS,CACP,OAAO,EACP,CAAC,CAAC,MAAM,CAAC;IACP,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,wBAAwB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC5C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACpC,CAAC,CACH,EACD,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAElE,IAAI,CAAC,KAAK,CAAC,wBAAwB,EAAE,CAAC;QACpC,YAAY,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1C,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IACjD,CAAC;IAED,IAAI,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC;IAC/B,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,MAAM,UAAU,CAAC,aAAa,CACnD,KAAK,CAAC,aAAa,CACpB,CAAC;YACF,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC;YACpC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACjC,OAAO,CAAC,CAAC,IAAI,CACX;oBACE,KAAK,EAAE,iBAAiB;oBACxB,iBAAiB,EACf,0DAA0D;iBAC7D,EACD,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,IAAI,QAAQ,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACtC,OAAO,CAAC,CAAC,IAAI,CACX;oBACE,KAAK,EAAE,iBAAiB;oBACxB,iBAAiB,EACf,kDAAkD;iBACrD,EACD,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,QAAQ,GAAG,QAAQ,IAAI,QAAQ,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,iBAAiB;gBACxB,iBAAiB,EAAE,wBAAwB;aAC5C,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE,iBAAiB;YACxB,iBAAiB,EACf,wFAAwF;SAC3F,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAEjE,IAAI,CAAC;QACH,kBAAkB,CAAC,6BAA6B,CAC9C,MAAM,EACN,KAAK,CAAC,wBAAwB,CAC/B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE,iBAAiB;YACxB,iBAAiB,EAAE,mCAAmC;SACvD,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5D,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC;IAED,YAAY,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC5C,CAAC,CACF,CAAC"}
+{"version":3,"file":"get.js","sourceRoot":"","sources":["../../../../src/routes/oauth/end-session/get.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,IAAI,EAAE,MAAM,8BAA8B,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,8BAA8B,CAAC;AAEjD,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,IAAI,EAAU,CAAC,GAAG,CACjD,cAAc,EACd,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;IACnB,OAAO,EAAE,aAAa;IACtB,WAAW,EAAE,8BAA8B;IAC3C,SAAS,EAAE;QACT,GAAG,EAAE,EAAE,WAAW,EAAE,uBAAuB,EAAE;QAC7C,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;iBAC/B;aACF;YACD,WAAW,EAAE,wBAAwB;SACtC;KACF;CACF,CAAC,EACF,SAAS,CACP,OAAO,EACP,CAAC,CAAC,MAAM,CAAC;IACP,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,wBAAwB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC5C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACpC,CAAC,CACH,EACD,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAElE,IAAI,CAAC,KAAK,CAAC,wBAAwB,EAAE,CAAC;QACpC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACvB,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IACjD,CAAC;IAED,IAAI,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC;IAC/B,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,MAAM,UAAU,CAAC,aAAa,CACnD,KAAK,CAAC,aAAa,CACpB,CAAC;YACF,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC;YACpC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACjC,OAAO,CAAC,CAAC,IAAI,CACX;oBACE,KAAK,EAAE,iBAAiB;oBACxB,iBAAiB,EACf,0DAA0D;iBAC7D,EACD,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,IAAI,QAAQ,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACtC,OAAO,CAAC,CAAC,IAAI,CACX;oBACE,KAAK,EAAE,iBAAiB;oBACxB,iBAAiB,EACf,kDAAkD;iBACrD,EACD,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,QAAQ,GAAG,QAAQ,IAAI,QAAQ,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,iBAAiB;gBACxB,iBAAiB,EAAE,wBAAwB;aAC5C,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE,iBAAiB;YACxB,iBAAiB,EACf,wFAAwF;SAC3F,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAEjE,IAAI,CAAC;QACH,kBAAkB,CAAC,6BAA6B,CAC9C,MAAM,EACN,KAAK,CAAC,wBAAwB,CAC/B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE,iBAAiB;YACxB,iBAAiB,EAAE,mCAAmC;SACvD,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5D,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC;IAED,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;IACvB,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC5C,CAAC,CACF,CAAC"}

package/dist/routes/oauth/index.d.ts

@@ -222,6 +222,16 @@ export declare const oauthApplicationRoutes: import("hono/hono-base").HonoBase<A
 } & {
     "/device": {
         $post: {
+            output: undefined;
+            outputFormat: "redirect";
+            status: 303;
+            input: {
+                form: {
+                    user_code: import("hono/types").ParsedFormValue[] | import("hono/types").ParsedFormValue;
+                    decision?: "approve" | "deny" | undefined;
+                };
+            };
+        } | {
             output: {
                 status: string;
                 client_id: string;

package/dist/routes/oauth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/oauth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAanD,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAWP,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/oauth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAanD,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAWP,CAAC"}

package/dist/routes/oauth/revoke/post.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../../../src/routes/oauth/revoke/post.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAoBtD;;GAEG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;kBA8GtB,CAAC"}
+{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../../../src/routes/oauth/revoke/post.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAqBtD;;GAEG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;kBAsHtB,CAAC"}

package/dist/routes/oauth/revoke/post.js

@@ -87,8 +87,9 @@ export const revokePost = new Hono().post('/revoke', describeRoute({
         throw new e.OAuthClientDisabled.Error();
     }
     const clientSecret = basicCredentials?.clientSecret ?? body.client_secret;
+    let authentication;
     try {
-        await oauthClientService.validateClientSecretIfRequired(clientId, clientSecret);
+        authentication = await oauthClientService.validateClientSecretIfRequired(clientId, clientSecret);
     }
     catch (err) {
         if (authorizationHeader) {
@@ -96,7 +97,14 @@ export const revokePost = new Hono().post('/revoke', describeRoute({
         }
         throw err;
     }
-    await oauthTokenService.revokeToken(body.token, body.token_type_hint, clientId);
+    try {
+        await oauthTokenService.revokeToken(body.token, body.token_type_hint, clientId, authentication);
+    }
+    catch (error) {
+        if (authorizationHeader)
+            setBasicClientAuthChallengeIfInvalidClientCredentials(c, error);
+        throw error;
+    }
     c.header('Cache-Control', 'no-store');
     c.header('Pragma', 'no-cache');
     return c.json({}, 200);

package/dist/routes/oauth/revoke/post.js.map

@@ -1 +1 @@
-{"version":3,"file":"post.js","sourceRoot":"","sources":["../../../../src/routes/oauth/revoke/post.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,IAAI,EAAE,MAAM,8BAA8B,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,2BAA2B,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,2BAA2B,CAAC;AAC9C,OAAO,EACL,2BAA2B,EAC3B,qDAAqD,EACrD,+CAA+C,GAChD,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAEvD,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,KAAK;IACd,eAAe,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,EAAE;IAC3C,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE;IAChC,aAAa,EAAE,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE;CACzC,CAAC;KACD,QAAQ,CAAC,yCAAyC,CAAC,CAAC;AAEvD;;GAEG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,IAAI,EAAU,CAAC,IAAI,CAC/C,SAAS,EACT,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;IACnB,OAAO,EAAE,kBAAkB;IAC3B,WAAW,EACT,mFAAmF;IACrF,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CACd,CAAC;yBACE,MAAM,CAAC,EAAE,CAAC;yBACV,QAAQ,CACP,0DAA0D,CAC3D,CACJ;iBACF;aACF;YACD,WAAW,EAAE,eAAe;SAC7B;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CACd,CAAC,CAAC,KAAK,CAAC;wBACN,CAAC,CAAC,mBAAmB,CAAC,MAAM;wBAC5B,CAAC,CAAC,mBAAmB,CAAC,MAAM;qBAC7B,CAAC,CACH;iBACF;aACF;YACD,WAAW,EAAE,oCAAoC;SAClD;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,MAAM,CAAC;iBACpD;aACF;YACD,WAAW,EAAE,4BAA4B;SAC1C;KACF;CACF,CAAC,EACF,SAAS,CAAC,MAAM,EAAE,iBAAiB,CAAC,EACpC,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IACjE,MAAM,mBAAmB,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC1D,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,mBAAmB,CAAC,CAAC;IAE1E,IAAI,gBAAgB,KAAK,IAAI,EAAE,CAAC;QAC9B,+CAA+C,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,gBAAgB,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3C,+CAA+C,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,gBAAgB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACvC,IAAI,gBAAgB,CAAC,QAAQ,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YACjD,+CAA+C,CAAC,CAAC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,EAAE,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC;IAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,CAAC,CAAC,wBAAwB,CAAC,KAAK,EAAE,CAAC;IAC/C,CAAC;IAED,IAAI,MAAqE,CAAC;IAC1E,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,kBAAkB,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,mBAAmB,EAAE,CAAC;YACxB,+CAA+C,CAAC,CAAC,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,yBAAyB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAErC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;IAC1C,CAAC;IAED,MAAM,YAAY,GAAG,gBAAgB,EAAE,YAAY,IAAI,IAAI,CAAC,aAAa,CAAC;IAE1E,IAAI,CAAC;QACH,MAAM,kBAAkB,CAAC,8BAA8B,CACrD,QAAQ,EACR,YAAY,CACb,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,mBAAmB,EAAE,CAAC;YACxB,qDAAqD,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,iBAAiB,CAAC,WAAW,CACjC,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,eAAe,EACpB,QAAQ,CACT,CAAC;IAEF,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IACtC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC/B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;AACzB,CAAC,CACF,CAAC"}
+{"version":3,"file":"post.js","sourceRoot":"","sources":["../../../../src/routes/oauth/revoke/post.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,IAAI,EAAE,MAAM,8BAA8B,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,2BAA2B,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,2BAA2B,CAAC;AAE9C,OAAO,EACL,2BAA2B,EAC3B,qDAAqD,EACrD,+CAA+C,GAChD,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAEvD,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,KAAK;IACd,eAAe,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,EAAE;IAC3C,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE;IAChC,aAAa,EAAE,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE;CACzC,CAAC;KACD,QAAQ,CAAC,yCAAyC,CAAC,CAAC;AAEvD;;GAEG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,IAAI,EAAU,CAAC,IAAI,CAC/C,SAAS,EACT,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;IACnB,OAAO,EAAE,kBAAkB;IAC3B,WAAW,EACT,mFAAmF;IACrF,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CACd,CAAC;yBACE,MAAM,CAAC,EAAE,CAAC;yBACV,QAAQ,CACP,0DAA0D,CAC3D,CACJ;iBACF;aACF;YACD,WAAW,EAAE,eAAe;SAC7B;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CACd,CAAC,CAAC,KAAK,CAAC;wBACN,CAAC,CAAC,mBAAmB,CAAC,MAAM;wBAC5B,CAAC,CAAC,mBAAmB,CAAC,MAAM;qBAC7B,CAAC,CACH;iBACF;aACF;YACD,WAAW,EAAE,oCAAoC;SAClD;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,MAAM,CAAC;iBACpD;aACF;YACD,WAAW,EAAE,4BAA4B;SAC1C;KACF;CACF,CAAC,EACF,SAAS,CAAC,MAAM,EAAE,iBAAiB,CAAC,EACpC,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IACjE,MAAM,mBAAmB,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC1D,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,mBAAmB,CAAC,CAAC;IAE1E,IAAI,gBAAgB,KAAK,IAAI,EAAE,CAAC;QAC9B,+CAA+C,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,gBAAgB,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3C,+CAA+C,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,gBAAgB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACvC,IAAI,gBAAgB,CAAC,QAAQ,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YACjD,+CAA+C,CAAC,CAAC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,EAAE,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC;IAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,CAAC,CAAC,wBAAwB,CAAC,KAAK,EAAE,CAAC;IAC/C,CAAC;IAED,IAAI,MAAqE,CAAC;IAC1E,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,kBAAkB,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,mBAAmB,EAAE,CAAC;YACxB,+CAA+C,CAAC,CAAC,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,yBAAyB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAErC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;IAC1C,CAAC;IAED,MAAM,YAAY,GAAG,gBAAgB,EAAE,YAAY,IAAI,IAAI,CAAC,aAAa,CAAC;IAE1E,IAAI,cAAyC,CAAC;IAC9C,IAAI,CAAC;QACH,cAAc,GAAG,MAAM,kBAAkB,CAAC,8BAA8B,CACtE,QAAQ,EACR,YAAY,CACb,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,mBAAmB,EAAE,CAAC;YACxB,qDAAqD,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,iBAAiB,CAAC,WAAW,CACjC,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,eAAe,EACpB,QAAQ,EACR,cAAc,CACf,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,mBAAmB;YACrB,qDAAqD,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAClE,MAAM,KAAK,CAAC;IACd,CAAC;IAED,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IACtC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC/B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;AACzB,CAAC,CACF,CAAC"}

package/dist/routes/oauth/token/post.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../../../src/routes/oauth/token/post.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAiCtD,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiLrB,CAAC"}
+{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../../../src/routes/oauth/token/post.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAkCtD,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4LrB,CAAC"}

package/dist/routes/oauth/token/post.js

@@ -52,7 +52,7 @@ export const tokenPost = new Hono().post('/token', describeRoute({
                     ])),
                 },
             },
-            description: 'Bad request, unsupported grant type, missing parameters, or disabled client',
+            description: 'Bad request, unsupported grant type, missing parameters, disabled client, or a code/device grant invalidated by a client generation change',
         },
         401: {
             content: {
@@ -91,8 +91,9 @@ export const tokenPost = new Hono().post('/token', describeRoute({
     }
     // 2. Confidential clients must authenticate; public clients must not.
     const clientSecret = basicCredentials?.clientSecret ?? body.client_secret;
+    let authentication;
     try {
-        await oauthClientService.validateClientSecretIfRequired(clientId, clientSecret);
+        authentication = await oauthClientService.validateClientSecretIfRequired(clientId, clientSecret);
     }
     catch (err) {
         if (authorizationHeader) {
@@ -105,67 +106,78 @@ export const tokenPost = new Hono().post('/token', describeRoute({
         throw new e.InvalidAuthorizationRequest.Error();
     }
     oauthClientService.validateGrantType(client, grantType);
-    // 3. Handle grant type
-    if (grantType === 'authorization_code') {
-        if (!body.code) {
-            throw new e.MissingAuthorizationCode.Error();
+    try {
+        // 3. Handle grant type
+        if (grantType === 'authorization_code') {
+            if (!body.code) {
+                throw new e.MissingAuthorizationCode.Error();
+            }
+            if (!body.redirect_uri) {
+                throw new e.MissingRedirectUri.Error();
+            }
+            const tokens = await oauthTokenService.exchangeAuthorizationCode({
+                authentication,
+                code: body.code,
+                redirectUri: body.redirect_uri,
+                clientId,
+                codeVerifier: body.code_verifier ?? undefined,
+            });
+            c.header('Cache-Control', 'no-store');
+            c.header('Pragma', 'no-cache');
+            return c.json(tokens, 200);
         }
-        if (!body.redirect_uri) {
-            throw new e.MissingRedirectUri.Error();
+        if (grantType === 'refresh_token') {
+            if (!body.refresh_token) {
+                throw new e.MissingRefreshToken.Error();
+            }
+            const tokens = await oauthTokenService.refreshAccessToken({
+                authentication,
+                refreshToken: body.refresh_token,
+                clientId,
+                scope: body.scope ? body.scope.split(' ') : undefined,
+            });
+            c.header('Cache-Control', 'no-store');
+            c.header('Pragma', 'no-cache');
+            return c.json(tokens, 200);
         }
-        const tokens = await oauthTokenService.exchangeAuthorizationCode({
-            code: body.code,
-            redirectUri: body.redirect_uri,
-            clientId,
-            codeVerifier: body.code_verifier ?? undefined,
-        });
-        c.header('Cache-Control', 'no-store');
-        c.header('Pragma', 'no-cache');
-        return c.json(tokens, 200);
-    }
-    if (grantType === 'refresh_token') {
-        if (!body.refresh_token) {
-            throw new e.MissingRefreshToken.Error();
+        if (grantType === 'client_credentials') {
+            await oauthClientService.validateConfidentialClient(clientId);
+            const requestedScopes = body.scope ? body.scope.split(' ') : [];
+            const endUserScopes = requestedScopes.filter((scope) => END_USER_SCOPES_FOR_CLIENT_CREDENTIALS.has(scope));
+            if (endUserScopes.length > 0) {
+                throw new e.InvalidScope.Error({
+                    invalidScopes: endUserScopes,
+                });
+            }
+            oauthClientService.validateScopes(client, requestedScopes);
+            const tokens = await oauthTokenService.issueClientCredentialsToken({
+                authentication,
+                clientId,
+                scope: requestedScopes,
+            });
+            c.header('Cache-Control', 'no-store');
+            c.header('Pragma', 'no-cache');
+            return c.json(tokens, 200);
         }
-        const tokens = await oauthTokenService.refreshAccessToken({
-            refreshToken: body.refresh_token,
-            clientId,
-            scope: body.scope ? body.scope.split(' ') : undefined,
-        });
-        c.header('Cache-Control', 'no-store');
-        c.header('Pragma', 'no-cache');
-        return c.json(tokens, 200);
-    }
-    if (grantType === 'client_credentials') {
-        await oauthClientService.validateConfidentialClient(clientId);
-        const requestedScopes = body.scope ? body.scope.split(' ') : [];
-        const endUserScopes = requestedScopes.filter((scope) => END_USER_SCOPES_FOR_CLIENT_CREDENTIALS.has(scope));
-        if (endUserScopes.length > 0) {
-            throw new e.InvalidScope.Error({
-                invalidScopes: endUserScopes,
+        if (grantType === 'urn:ietf:params:oauth:grant-type:device_code') {
+            if (!body.device_code) {
+                throw new e.MissingDeviceCode.Error();
+            }
+            const tokens = await oauthTokenService.exchangeDeviceCode({
+                authentication,
+                deviceCode: body.device_code,
+                clientId,
             });
+            c.header('Cache-Control', 'no-store');
+            c.header('Pragma', 'no-cache');
+            return c.json(tokens, 200);
         }
-        oauthClientService.validateScopes(client, requestedScopes);
-        const tokens = await oauthTokenService.issueClientCredentialsToken({
-            clientId,
-            scope: requestedScopes,
-        });
-        c.header('Cache-Control', 'no-store');
-        c.header('Pragma', 'no-cache');
-        return c.json(tokens, 200);
+        throw new e.UnsupportedGrantType.Error();
     }
-    if (grantType === 'urn:ietf:params:oauth:grant-type:device_code') {
-        if (!body.device_code) {
-            throw new e.MissingDeviceCode.Error();
-        }
-        const tokens = await oauthTokenService.exchangeDeviceCode({
-            deviceCode: body.device_code,
-            clientId,
-        });
-        c.header('Cache-Control', 'no-store');
-        c.header('Pragma', 'no-cache');
-        return c.json(tokens, 200);
+    catch (error) {
+        if (authorizationHeader)
+            setBasicClientAuthChallengeIfInvalidClientCredentials(c, error);
+        throw error;
     }
-    throw new e.UnsupportedGrantType.Error();
 });
 //# sourceMappingURL=post.js.map