@tinyrack/tinyauth-server 0.0.15 → 0.1.0

package/dist/entrypoints/app.d.ts

@@ -893,6 +893,25 @@ export declare function createApp(options: CreateAppOptions, runtimeOptions?: Cr
                 output: undefined;
                 outputFormat: "redirect";
                 status: 302;
+            } | {
+                input: {
+                    param: {
+                        provider: string;
+                    };
+                } & {
+                    query: {
+                        code?: string | string[];
+                        state?: string | string[];
+                        error?: string | string[];
+                        error_description?: string | string[];
+                    };
+                };
+                output: {
+                    code: any;
+                    message: any;
+                };
+                outputFormat: "json";
+                status: any;
             };
         };
     }, "/"> | import("hono/types").MergeSchemaPath<{
@@ -913,6 +932,25 @@ export declare function createApp(options: CreateAppOptions, runtimeOptions?: Cr
                 output: undefined;
                 outputFormat: "redirect";
                 status: 302;
+            } | {
+                input: {
+                    param: {
+                        provider: string;
+                    };
+                } & {
+                    form: {
+                        code?: import("hono/types").ParsedFormValue | import("hono/types").ParsedFormValue[];
+                        state?: import("hono/types").ParsedFormValue | import("hono/types").ParsedFormValue[];
+                        error?: import("hono/types").ParsedFormValue | import("hono/types").ParsedFormValue[];
+                        error_description?: import("hono/types").ParsedFormValue | import("hono/types").ParsedFormValue[];
+                    };
+                };
+                output: {
+                    code: any;
+                    message: any;
+                };
+                outputFormat: "json";
+                status: any;
             };
         };
     }, "/"> | import("hono/types").MergeSchemaPath<{
@@ -945,6 +983,7 @@ export declare function createApp(options: CreateAppOptions, runtimeOptions?: Cr
                         nonce?: string | string[];
                         prompt?: string | string[];
                         max_age?: string | string[];
+                        reauthenticated?: string | string[];
                         display?: string | string[];
                     };
                 };
@@ -964,6 +1003,7 @@ export declare function createApp(options: CreateAppOptions, runtimeOptions?: Cr
                         nonce?: string | string[];
                         prompt?: string | string[];
                         max_age?: string | string[];
+                        reauthenticated?: string | string[];
                         display?: string | string[];
                     };
                 };
@@ -981,9 +1021,9 @@ export declare function createApp(options: CreateAppOptions, runtimeOptions?: Cr
                 input: {
                     form: {
                         grant_type: import("hono/types").ParsedFormValue | import("hono/types").ParsedFormValue[];
-                        client_id: import("hono/types").ParsedFormValue | import("hono/types").ParsedFormValue[];
                         code?: import("hono/types").ParsedFormValue | import("hono/types").ParsedFormValue[];
                         redirect_uri?: import("hono/types").ParsedFormValue | import("hono/types").ParsedFormValue[];
+                        client_id?: import("hono/types").ParsedFormValue | import("hono/types").ParsedFormValue[];
                         client_secret?: import("hono/types").ParsedFormValue | import("hono/types").ParsedFormValue[];
                         code_verifier?: import("hono/types").ParsedFormValue | import("hono/types").ParsedFormValue[];
                         refresh_token?: import("hono/types").ParsedFormValue | import("hono/types").ParsedFormValue[];
@@ -993,7 +1033,7 @@ export declare function createApp(options: CreateAppOptions, runtimeOptions?: Cr
                     access_token: string;
                     token_type: "Bearer";
                     expires_in: number;
-                    refresh_token: string;
+                    refresh_token?: string | undefined | undefined;
                     id_token?: string | undefined | undefined;
                     scope: string;
                 };
@@ -1021,6 +1061,7 @@ export declare function createApp(options: CreateAppOptions, runtimeOptions?: Cr
                     iat?: number | undefined | undefined;
                     sub?: string | undefined | undefined;
                     iss?: string | undefined | undefined;
+                    aud?: string | undefined | undefined;
                 };
                 outputFormat: "json";
                 status: 200;
@@ -1093,6 +1134,7 @@ export declare function createApp(options: CreateAppOptions, runtimeOptions?: Cr
                     token_endpoint: string;
                     jwks_uri: string;
                     response_types_supported: string[];
+                    response_modes_supported: string[];
                     subject_types_supported: string[];
                     id_token_signing_alg_values_supported: string[];
                     userinfo_endpoint: string;
@@ -1104,6 +1146,9 @@ export declare function createApp(options: CreateAppOptions, runtimeOptions?: Cr
                     introspection_endpoint: string;
                     revocation_endpoint: string;
                     ui_locales_supported: ("en" | "ko" | "ja")[];
+                    request_parameter_supported: boolean;
+                    request_uri_parameter_supported: boolean;
+                    claims_parameter_supported: boolean;
                 };
                 outputFormat: "json";
                 status: 200;
@@ -1270,6 +1315,8 @@ export declare function createApp(options: CreateAppOptions, runtimeOptions?: Cr
                     picture?: string | undefined;
                 };
                 icon_url?: string | undefined;
+                jwks_url?: string | undefined;
+                issuer?: string | undefined;
                 email_url?: string | undefined;
                 response_mode?: string | undefined;
             }[];

package/dist/entrypoints/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../src/entrypoints/app.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,KAAK,0BAA0B,EAEhC,MAAM,wBAAwB,CAAC;AAUhC,OAAO,EACL,KAAK,yBAAyB,EAE/B,MAAM,0BAA0B,CAAC;AAElC;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,0BAA0B,CAAC;AAC1D,MAAM,MAAM,uBAAuB,GAAG,yBAAyB,CAAC;AAEhE,wBAAsB,SAAS,CAC7B,OAAO,EAAE,gBAAgB,EACzB,cAAc,GAAE,uBAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwE7C;AAED,MAAM,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../src/entrypoints/app.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,KAAK,0BAA0B,EAEhC,MAAM,wBAAwB,CAAC;AAWhC,OAAO,EACL,KAAK,yBAAyB,EAE/B,MAAM,0BAA0B,CAAC;AAElC;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,0BAA0B,CAAC;AAC1D,MAAM,MAAM,uBAAuB,GAAG,yBAAyB,CAAC;AAEhE,wBAAsB,SAAS,CAC7B,OAAO,EAAE,gBAAgB,EACzB,cAAc,GAAE,uBAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgF7C;AAED,MAAM,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC"}

package/dist/entrypoints/app.js

@@ -4,6 +4,7 @@ import { generateSpecs } from 'hono-openapi';
 import { TinyAuthRuntimeConfigSchema, } from "../lib/config/index.js";
 import { createLogger } from "../lib/logger.js";
 import { createOpenApiDocumentation } from "../lib/openapi.js";
+import { csrfProtection } from "../middleware/csrf.js";
 import { loggerMiddleware } from "../middleware/logger.js";
 import { mikroOrmMiddleware } from "../middleware/mikro-orm.js";
 import { servicesMiddleware } from "../middleware/services.js";
@@ -26,6 +27,9 @@ export async function createApp(options, runtimeOptions = {}) {
     const app = new Hono()
         .onError((err, c) => {
         if (err instanceof TinyAuthError) {
+            if (err.code === 'insufficient_scope') {
+                c.header('WWW-Authenticate', 'Bearer error="insufficient_scope", scope="openid"');
+            }
             return c.json(err.toJson(), err.status);
         }
         logger.error({ err }, 'Unhandled error');
@@ -39,6 +43,7 @@ export async function createApp(options, runtimeOptions = {}) {
     }))
         .use('*', sessionMiddleware(config.security.session_secret, config.server.public_origin.startsWith('https')))
         .use('*', trustedProxyGuard(config.server.trust_proxy))
+        .use('/api/*', csrfProtection(config.server.public_origin))
         .use('*', servicesMiddleware(services))
         .use('*', mikroOrmMiddleware)
         .route('/', routes)

package/dist/entrypoints/app.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.js","sourceRoot":"","sources":["../../src/entrypoints/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAEL,2BAA2B,GAC5B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,CAAC,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAEL,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAQlC,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAAyB,EACzB,iBAA0C,EAAE;IAE5C,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,oBAAoB,GAAG,0BAA0B,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAExE,sEAAsE;IACtE,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAEzD,sDAAsD;IACtD,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,kBAAkB,CACpD,MAAM,EACN,MAAM,EACN,cAAc,CACf,CAAC;IAEF,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE;SACnB,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QAClB,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,iBAAiB,CAAC,CAAC;QACzC,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;QACtD,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC1D,CAAC,CAAC;SACD,GAAG,CAAC,GAAG,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC;SAClC,GAAG,CACF,GAAG,EACH,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa;QACnC,WAAW,EAAE,IAAI;KAClB,CAAC,CACH;SACA,GAAG,CACF,GAAG,EACH,iBAAiB,CACf,MAAM,CAAC,QAAQ,CAAC,cAAc,EAC9B,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,CAChD,CACF;SACA,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;SACtD,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC;SACtC,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC;SAC5B,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC;SAClB,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QACpB,IAAI,eAAe,EAAE,CAAC;YACpB,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEL,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YAC5B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE;YACpC,aAAa,EAAE,oBAAoB;SACpC,CAAC,CAAC;QAEH,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,kBAAkB;IAClB,MAAM,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IAEjC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC5C,CAAC"}
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../../src/entrypoints/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAEL,2BAA2B,GAC5B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,CAAC,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAEL,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAQlC,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAAyB,EACzB,iBAA0C,EAAE;IAE5C,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,oBAAoB,GAAG,0BAA0B,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAExE,sEAAsE;IACtE,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAEzD,sDAAsD;IACtD,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,kBAAkB,CACpD,MAAM,EACN,MAAM,EACN,cAAc,CACf,CAAC;IAEF,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE;SACnB,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QAClB,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,IAAI,GAAG,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;gBACtC,CAAC,CAAC,MAAM,CACN,kBAAkB,EAClB,mDAAmD,CACpD,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,iBAAiB,CAAC,CAAC;QACzC,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;QACtD,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC1D,CAAC,CAAC;SACD,GAAG,CAAC,GAAG,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC;SAClC,GAAG,CACF,GAAG,EACH,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa;QACnC,WAAW,EAAE,IAAI;KAClB,CAAC,CACH;SACA,GAAG,CACF,GAAG,EACH,iBAAiB,CACf,MAAM,CAAC,QAAQ,CAAC,cAAc,EAC9B,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,CAChD,CACF;SACA,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;SACtD,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;SAC1D,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC;SACtC,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC;SAC5B,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC;SAClB,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QACpB,IAAI,eAAe,EAAE,CAAC;YACpB,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEL,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YAC5B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE;YACpC,aAAa,EAAE,oBAAoB;SACpC,CAAC,CAAC;QAEH,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,kBAAkB;IAClB,MAAM,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IAEjC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC5C,CAAC"}

package/dist/entrypoints/database/postgres/postgres.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"postgres.d.ts","sourceRoot":"","sources":["../../../../src/entrypoints/database/postgres/postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,KAAK,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAI5E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAKnE,KAAK,sBAAsB,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IACzC,KAAK,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1B,CAAC;AAEF,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,GAAG,cAAc,CA0BzE"}
+{"version":3,"file":"postgres.d.ts","sourceRoot":"","sources":["../../../../src/entrypoints/database/postgres/postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,KAAK,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAI5E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAKnE,KAAK,sBAAsB,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IACzC,KAAK,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1B,CAAC;AAEF,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,GAAG,cAAc,CA2BzE"}

package/dist/entrypoints/database/postgres/postgres.js

@@ -20,6 +20,7 @@ export function postgres(database) {
                 extensions: [SeedManager, Migrator],
                 migrations: {
                     migrationsList: POSTGRES_MIGRATIONS,
+                    snapshot: false,
                 },
                 driverOptions: database.driverOptions ?? {
                     ssl: true,

package/dist/entrypoints/database/postgres/postgres.js.map

@@ -1 +1 @@
-{"version":3,"file":"postgres.js","sourceRoot":"","sources":["../../../../src/entrypoints/database/postgres/postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA+B,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,iBAAiB,MAAM,yBAAyB,CAAC;AAYxD,MAAM,UAAU,QAAQ,CAAC,QAAgC;IACvD,OAAO;QACL,kBAAkB,EAAE,KAAK,IAAI,EAAE;YAC7B,OAAO,YAAY,CAAC;gBAClB,MAAM,EAAE,gBAAgB;gBACxB,iBAAiB,EAAE,iBAAiB;gBACpC,QAAQ,EAAE,CAAC,GAAG,mBAAmB,EAAE,CAAC;gBACpC,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,MAAM,EAAE,QAAQ,CAAC,IAAI;gBACrB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,UAAU,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAC;gBACnC,UAAU,EAAE;oBACV,cAAc,EAAE,mBAAmB;iBACpC;gBACD,aAAa,EAAE,QAAQ,CAAC,aAAa,IAAI;oBACvC,GAAG,EAAE,IAAI;iBACV;gBACD,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,KAAK;aAC/B,CAAC,CAAC;QACL,CAAC;QACD,UAAU,EAAE,KAAK,EAAE,GAAa,EAAE,EAAE;YAClC,MAAM,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAC1B,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"postgres.js","sourceRoot":"","sources":["../../../../src/entrypoints/database/postgres/postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA+B,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,iBAAiB,MAAM,yBAAyB,CAAC;AAYxD,MAAM,UAAU,QAAQ,CAAC,QAAgC;IACvD,OAAO;QACL,kBAAkB,EAAE,KAAK,IAAI,EAAE;YAC7B,OAAO,YAAY,CAAC;gBAClB,MAAM,EAAE,gBAAgB;gBACxB,iBAAiB,EAAE,iBAAiB;gBACpC,QAAQ,EAAE,CAAC,GAAG,mBAAmB,EAAE,CAAC;gBACpC,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,MAAM,EAAE,QAAQ,CAAC,IAAI;gBACrB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,UAAU,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAC;gBACnC,UAAU,EAAE;oBACV,cAAc,EAAE,mBAAmB;oBACnC,QAAQ,EAAE,KAAK;iBAChB;gBACD,aAAa,EAAE,QAAQ,CAAC,aAAa,IAAI;oBACvC,GAAG,EAAE,IAAI;iBACV;gBACD,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,KAAK;aAC/B,CAAC,CAAC;QACL,CAAC;QACD,UAAU,EAAE,KAAK,EAAE,GAAa,EAAE,EAAE;YAClC,MAAM,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAC1B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/entrypoints/database/sqlite/sqlite.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sqlite.d.ts","sourceRoot":"","sources":["../../../../src/entrypoints/database/sqlite/sqlite.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,KAAK,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAI5E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAKnE,KAAK,oBAAoB,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1B,CAAC;AAEF,wBAAgB,MAAM,CAAC,QAAQ,EAAE,oBAAoB,GAAG,cAAc,CA0BrE"}
+{"version":3,"file":"sqlite.d.ts","sourceRoot":"","sources":["../../../../src/entrypoints/database/sqlite/sqlite.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,KAAK,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAI5E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAKnE,KAAK,oBAAoB,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1B,CAAC;AAEF,wBAAgB,MAAM,CAAC,QAAQ,EAAE,oBAAoB,GAAG,cAAc,CA2BrE"}

package/dist/entrypoints/database/sqlite/sqlite.js

@@ -18,6 +18,7 @@ export function sqlite(database) {
                 extensions: [SeedManager, Migrator],
                 migrations: {
                     migrationsList: SQLITE_MIGRATIONS,
+                    snapshot: false,
                 },
                 debug: database.debug ?? false,
             });

package/dist/entrypoints/database/sqlite/sqlite.js.map

@@ -1 +1 @@
-{"version":3,"file":"sqlite.js","sourceRoot":"","sources":["../../../../src/entrypoints/database/sqlite/sqlite.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA+B,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,iBAAiB,MAAM,yBAAyB,CAAC;AAQxD,MAAM,UAAU,MAAM,CAAC,QAA8B;IACnD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;IAE1D,OAAO;QACL,kBAAkB,EAAE,KAAK,IAAI,EAAE;YAC7B,OAAO,YAAY,CAAC;gBAClB,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,MAAM;gBACd,aAAa,EAAE,IAAI,iBAAiB,CAAC,MAAM,CAAC;gBAC5C,iBAAiB,EAAE,iBAAiB;gBACpC,QAAQ,EAAE,CAAC,GAAG,mBAAmB,EAAE,CAAC;gBACpC,UAAU,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAC;gBACnC,UAAU,EAAE;oBACV,cAAc,EAAE,iBAAiB;iBAClC;gBACD,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,KAAK;aAC/B,CAAC,CAAC;QACL,CAAC;QACD,UAAU,EAAE,KAAK,EAAE,GAAa,EAAE,EAAE;YAClC,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAClB,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAC7B,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAC1B,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sqlite.js","sourceRoot":"","sources":["../../../../src/entrypoints/database/sqlite/sqlite.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA+B,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,iBAAiB,MAAM,yBAAyB,CAAC;AAQxD,MAAM,UAAU,MAAM,CAAC,QAA8B;IACnD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;IAE1D,OAAO;QACL,kBAAkB,EAAE,KAAK,IAAI,EAAE;YAC7B,OAAO,YAAY,CAAC;gBAClB,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,MAAM;gBACd,aAAa,EAAE,IAAI,iBAAiB,CAAC,MAAM,CAAC;gBAC5C,iBAAiB,EAAE,iBAAiB;gBACpC,QAAQ,EAAE,CAAC,GAAG,mBAAmB,EAAE,CAAC;gBACpC,UAAU,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAC;gBACnC,UAAU,EAAE;oBACV,cAAc,EAAE,iBAAiB;oBACjC,QAAQ,EAAE,KAAK;iBAChB;gBACD,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,KAAK;aAC/B,CAAC,CAAC;QACL,CAAC;QACD,UAAU,EAAE,KAAK,EAAE,GAAa,EAAE,EAAE;YAClC,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAClB,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAC7B,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAC1B,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/entrypoints/identity-providers/apple.d.ts

@@ -6,6 +6,7 @@ export interface AppleOAuthConfig {
     icon_url?: string | undefined;
     client_id: string;
     client_secret: string;
+    unsafe_jwks_url_for_tests?: string | undefined;
     scopes?: string[] | undefined;
     response_mode?: 'query' | 'fragment' | 'form_post' | undefined;
     email_conflict_strategy: 'auto_link' | 'require_link';

package/dist/entrypoints/identity-providers/apple.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apple.d.ts","sourceRoot":"","sources":["../../../src/entrypoints/identity-providers/apple.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAExE,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC9B,aAAa,CAAC,EAAE,OAAO,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,CAAC;IAC/D,uBAAuB,EAAE,WAAW,GAAG,cAAc,CAAC;CACvD;AAED,wBAAgB,KAAK,CAAC,MAAM,EAAE,gBAAgB,GAAG,sBAAsB,CAqBtE"}
+{"version":3,"file":"apple.d.ts","sourceRoot":"","sources":["../../../src/entrypoints/identity-providers/apple.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAExE,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,yBAAyB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/C,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC9B,aAAa,CAAC,EAAE,OAAO,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,CAAC;IAC/D,uBAAuB,EAAE,WAAW,GAAG,cAAc,CAAC;CACvD;AAED,wBAAgB,KAAK,CAAC,MAAM,EAAE,gBAAgB,GAAG,sBAAsB,CAsBtE"}

package/dist/entrypoints/identity-providers/apple.js

@@ -10,6 +10,7 @@ export function apple(config) {
         authorization_url: 'https://appleid.apple.com/auth/authorize',
         token_url: 'https://appleid.apple.com/auth/token',
         userinfo_url: null,
+        jwks_url: config.unsafe_jwks_url_for_tests,
         scopes: config.scopes || ['openid', 'email', 'name'],
         response_mode: config.response_mode || 'form_post',
         email_conflict_strategy: config.email_conflict_strategy,

package/dist/entrypoints/identity-providers/apple.js.map

@@ -1 +1 @@
-{"version":3,"file":"apple.js","sourceRoot":"","sources":["../../../src/entrypoints/identity-providers/apple.ts"],"names":[],"mappings":"AAcA,MAAM,UAAU,KAAK,CAAC,MAAwB;IAC5C,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,EAAE;QAC9C,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,iBAAiB,EAAE,0CAA0C;QAC7D,SAAS,EAAE,sCAAsC;QACjD,YAAY,EAAE,IAAI;QAClB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC;QACpD,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,WAAW;QAClD,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;QACvD,gBAAgB,EAAE;YAChB,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,OAAO;YACd,cAAc,EAAE,gBAAgB;SACjC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"apple.js","sourceRoot":"","sources":["../../../src/entrypoints/identity-providers/apple.ts"],"names":[],"mappings":"AAeA,MAAM,UAAU,KAAK,CAAC,MAAwB;IAC5C,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,EAAE;QAC9C,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,iBAAiB,EAAE,0CAA0C;QAC7D,SAAS,EAAE,sCAAsC;QACjD,YAAY,EAAE,IAAI;QAClB,QAAQ,EAAE,MAAM,CAAC,yBAAyB;QAC1C,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC;QACpD,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,WAAW;QAClD,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;QACvD,gBAAgB,EAAE;YAChB,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,OAAO;YACd,cAAc,EAAE,gBAAgB;SACjC;KACF,CAAC;AACJ,CAAC"}

package/dist/entrypoints/identity-providers/generic-oauth.d.ts

@@ -9,6 +9,8 @@ export interface GenericOAuthConfig {
     authorization_url: string;
     token_url: string;
     userinfo_url?: string | null | undefined;
+    jwks_url?: string | undefined;
+    issuer?: string | undefined;
     email_url?: string | undefined;
     scopes: string[];
     response_mode?: 'query' | 'fragment' | 'form_post' | undefined;

package/dist/entrypoints/identity-providers/generic-oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generic-oauth.d.ts","sourceRoot":"","sources":["../../../src/entrypoints/identity-providers/generic-oauth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAExE,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACzC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,CAAC,EAAE,OAAO,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,CAAC;IAC/D,uBAAuB,EAAE,WAAW,GAAG,cAAc,CAAC;IACtD,gBAAgB,EAAE;QAChB,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACpC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC1B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAC9B,CAAC;CACH;AAED,wBAAgB,YAAY,CAC1B,MAAM,EAAE,kBAAkB,GACzB,sBAAsB,CAkBxB"}
+{"version":3,"file":"generic-oauth.d.ts","sourceRoot":"","sources":["../../../src/entrypoints/identity-providers/generic-oauth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAExE,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,CAAC,EAAE,OAAO,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,CAAC;IAC/D,uBAAuB,EAAE,WAAW,GAAG,cAAc,CAAC;IACtD,gBAAgB,EAAE;QAChB,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACpC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC1B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAC9B,CAAC;CACH;AAED,wBAAgB,YAAY,CAC1B,MAAM,EAAE,kBAAkB,GACzB,sBAAsB,CAoBxB"}

package/dist/entrypoints/identity-providers/generic-oauth.js

@@ -10,6 +10,8 @@ export function genericOAuth(config) {
         authorization_url: config.authorization_url,
         token_url: config.token_url,
         userinfo_url: config.userinfo_url ?? null,
+        jwks_url: config.jwks_url,
+        issuer: config.issuer,
         email_url: config.email_url,
         scopes: config.scopes,
         response_mode: config.response_mode,

package/dist/entrypoints/identity-providers/generic-oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"generic-oauth.js","sourceRoot":"","sources":["../../../src/entrypoints/identity-providers/generic-oauth.ts"],"names":[],"mappings":"AAyBA,MAAM,UAAU,YAAY,CAC1B,MAA0B;IAE1B,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI;QACzC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;QACvD,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;KAC1C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"generic-oauth.js","sourceRoot":"","sources":["../../../src/entrypoints/identity-providers/generic-oauth.ts"],"names":[],"mappings":"AA2BA,MAAM,UAAU,YAAY,CAC1B,MAA0B;IAE1B,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI;QACzC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;QACvD,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;KAC1C,CAAC;AACJ,CAAC"}

package/dist/lib/config/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/lib/config/client.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAEpB;;;GAGG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;oBAuC4B,CAAC;AAE5D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,sBAAsB,EAAE,YAAY,EAAO,CAAC;AAEzD,eAAO,MAAM,mBAAmB;;;;;;;;;;sBAGiC,CAAC"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/lib/config/client.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAQpB;;;GAGG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;oBAuC4B,CAAC;AAE5D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,sBAAsB,EAAE,YAAY,EAAO,CAAC;AAEzD,eAAO,MAAM,mBAAmB;;;;;;;;;;sBAGiC,CAAC"}

package/dist/lib/config/client.js

@@ -1,4 +1,8 @@
 import z from 'zod';
+import { isSecureRedirectUri } from './url-policy.js';
+const RedirectUriSchema = z.string().refine(isSecureRedirectUri, {
+    message: 'Redirect URI must use HTTPS or local HTTP and must not contain fragments or wildcards.',
+});
 /**
  * OAuth/OIDC client configuration.
  * Defines applications that can authenticate through TinyAuth.
@@ -25,7 +29,7 @@ export const ClientConfigSchema = z
         .optional()
         .describe('OAuth client_secret for confidential clients. Omit for public clients.'),
     redirect_uris: z
-        .array(z.string())
+        .array(RedirectUriSchema)
         .describe('Allowed redirect URIs after authorization.'),
     response_types: z
         .array(z.string())

package/dist/lib/config/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/lib/config/client.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAEpB;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,EAAE,EAAE,CAAC;SACF,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,QAAQ,CAAC,qCAAqC,CAAC;IAClD,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,QAAQ,CAAC,iDAAiD,CAAC;IAC9D,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,qCAAqC,CAAC;IAClD,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,QAAQ,CAAC,iDAAiD,CAAC;IAC9D,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,wEAAwE,CACzE;IACH,aAAa,EAAE,CAAC;SACb,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,CAAC,4CAA4C,CAAC;IACzD,cAAc,EAAE,CAAC;SACd,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,CAAC,8CAA8C,CAAC;IAC3D,WAAW,EAAE,CAAC;SACX,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,CACP,0EAA0E,CAC3E;IACH,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,CAAC,yDAAyD,CAAC;CACvE,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,8CAA8C,CAAC,CAAC;AAI5D,MAAM,CAAC,MAAM,sBAAsB,GAAmB,EAAE,CAAC;AAEzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,KAAK,CAAC,kBAAkB,CAAC;KACzB,OAAO,CAAC,sBAAsB,CAAC;KAC/B,QAAQ,CAAC,oDAAoD,CAAC,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/lib/config/client.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AACpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEtD,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,mBAAmB,EAAE;IAC/D,OAAO,EACL,wFAAwF;CAC3F,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,EAAE,EAAE,CAAC;SACF,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,QAAQ,CAAC,qCAAqC,CAAC;IAClD,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,QAAQ,CAAC,iDAAiD,CAAC;IAC9D,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,qCAAqC,CAAC;IAClD,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,QAAQ,CAAC,iDAAiD,CAAC;IAC9D,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,wEAAwE,CACzE;IACH,aAAa,EAAE,CAAC;SACb,KAAK,CAAC,iBAAiB,CAAC;SACxB,QAAQ,CAAC,4CAA4C,CAAC;IACzD,cAAc,EAAE,CAAC;SACd,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,CAAC,8CAA8C,CAAC;IAC3D,WAAW,EAAE,CAAC;SACX,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,CACP,0EAA0E,CAC3E;IACH,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,CAAC,yDAAyD,CAAC;CACvE,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,8CAA8C,CAAC,CAAC;AAI5D,MAAM,CAAC,MAAM,sBAAsB,GAAmB,EAAE,CAAC;AAEzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,KAAK,CAAC,kBAAkB,CAAC;KACzB,OAAO,CAAC,sBAAsB,CAAC;KAC/B,QAAQ,CAAC,oDAAoD,CAAC,CAAC"}

package/dist/lib/config/identity-providers.d.ts

@@ -15,6 +15,8 @@ export declare const IdentityProviderConfigSchema: z.ZodObject<{
     authorization_url: z.ZodString;
     token_url: z.ZodString;
     userinfo_url: z.ZodNullable<z.ZodString>;
+    jwks_url: z.ZodOptional<z.ZodString>;
+    issuer: z.ZodOptional<z.ZodString>;
     email_url: z.ZodOptional<z.ZodString>;
     scopes: z.ZodArray<z.ZodString>;
     response_mode: z.ZodOptional<z.ZodString>;
@@ -48,6 +50,8 @@ export declare const IdentityProviderConfigsSchema: z.ZodDefault<z.ZodArray<z.Zo
     authorization_url: z.ZodString;
     token_url: z.ZodString;
     userinfo_url: z.ZodNullable<z.ZodString>;
+    jwks_url: z.ZodOptional<z.ZodString>;
+    issuer: z.ZodOptional<z.ZodString>;
     email_url: z.ZodOptional<z.ZodString>;
     scopes: z.ZodArray<z.ZodString>;
     response_mode: z.ZodOptional<z.ZodString>;

package/dist/lib/config/identity-providers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-providers.d.ts","sourceRoot":"","sources":["../../../src/lib/config/identity-providers.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AA8BpB,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBA0Ce,CAAC;AAEzD,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAC1C,OAAO,4BAA4B,CACpC,CAAC;AAEF,eAAO,MAAM,iCAAiC,EAAE,sBAAsB,EAAO,CAAC;AAE9E,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sBAGuB,CAAC"}
+{"version":3,"file":"identity-providers.d.ts","sourceRoot":"","sources":["../../../src/lib/config/identity-providers.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAuCpB,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBA+De,CAAC;AAEzD,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAC1C,OAAO,4BAA4B,CACpC,CAAC;AAEF,eAAO,MAAM,iCAAiC,EAAE,sBAAsB,EAAO,CAAC;AAE9E,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sBAGuB,CAAC"}

package/dist/lib/config/identity-providers.js

@@ -1,4 +1,9 @@
 import z from 'zod';
+import { isHttpsOrLocalHttpUrl } from './url-policy.js';
+const SecureEndpointUrlSchema = z.string().refine(isHttpsOrLocalHttpUrl, {
+    message: 'URL must use HTTPS or local HTTP.',
+});
+const JwksUrlSchema = SecureEndpointUrlSchema.describe('JWKS endpoint URL for providers that verify ID tokens.');
 const UserinfoMappingConfigSchema = z
     .object({
     id: z
@@ -38,16 +43,16 @@ export const IdentityProviderConfigSchema = z
     client_secret: z
         .string()
         .describe('OAuth client secret from the provider.'),
-    authorization_url: z.string().describe('OAuth authorization endpoint URL.'),
-    token_url: z.string().describe('OAuth token endpoint URL.'),
-    userinfo_url: z
-        .string()
-        .nullable()
-        .describe('OAuth userinfo endpoint URL.'),
-    email_url: z
+    authorization_url: SecureEndpointUrlSchema.describe('OAuth authorization endpoint URL.'),
+    token_url: SecureEndpointUrlSchema.describe('OAuth token endpoint URL.'),
+    userinfo_url: SecureEndpointUrlSchema.nullable().describe('OAuth userinfo endpoint URL.'),
+    jwks_url: JwksUrlSchema.optional(),
+    issuer: z
         .string()
+        .url()
         .optional()
-        .describe('Separate endpoint URL for fetching user email.'),
+        .describe('Expected issuer for ID tokens verified with JWKS.'),
+    email_url: SecureEndpointUrlSchema.optional().describe('Separate endpoint URL for fetching user email.'),
     scopes: z
         .array(z.string())
         .describe('OAuth scopes to request from the provider.'),
@@ -60,6 +65,18 @@ export const IdentityProviderConfigSchema = z
         .describe('Strategy when a matching email already exists. ' +
         '"auto_link" links automatically, "require_link" requires user confirmation.'),
     userinfo_mapping: UserinfoMappingConfigSchema,
+})
+    .superRefine((provider, ctx) => {
+    if (provider.type === 'generic_oauth' &&
+        provider.userinfo_url === null &&
+        provider.jwks_url &&
+        !provider.issuer) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['issuer'],
+            message: 'Issuer is required for generic ID-token-only providers with JWKS.',
+        });
+    }
 })
     .strict()
     .describe('Resolved identity provider configuration.');

package/dist/lib/config/identity-providers.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity-providers.js","sourceRoot":"","sources":["../../../src/lib/config/identity-providers.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAEpB,MAAM,2BAA2B,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,EAAE,EAAE,CAAC;SACF,MAAM,EAAE;SACR,QAAQ,CAAC,sDAAsD,CAAC;IACnE,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,CAAC,oDAAoD,CAAC;IACjE,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,kEAAkE,CACnE;IACH,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,2DAA2D,CAAC;IACxE,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,kEAAkE,CACnE;CACJ,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,yDAAyD,CAAC,CAAC;AAEvE,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KAC1C,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;IAC/D,IAAI,EAAE,CAAC;SACJ,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;SACpD,QAAQ,CAAC,yBAAyB,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;IAC3E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uCAAuC,CAAC;IAC1E,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,mDAAmD,CAAC;IAChE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IACpE,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,QAAQ,CAAC,wCAAwC,CAAC;IACrD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;IAC3E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,2BAA2B,CAAC;IAC3D,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,8BAA8B,CAAC;IAC3C,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,gDAAgD,CAAC;IAC7D,MAAM,EAAE,CAAC;SACN,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,CAAC,4CAA4C,CAAC;IACzD,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,qDAAqD,CAAC;IAClE,uBAAuB,EAAE,CAAC;SACvB,IAAI,CAAC,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;SACnC,QAAQ,CACP,iDAAiD;QAC/C,6EAA6E,CAChF;IACH,gBAAgB,EAAE,2BAA2B;CAC9C,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,2CAA2C,CAAC,CAAC;AAMzD,MAAM,CAAC,MAAM,iCAAiC,GAA6B,EAAE,CAAC;AAE9E,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC;KAC3C,KAAK,CAAC,4BAA4B,CAAC;KACnC,OAAO,CAAC,iCAAiC,CAAC;KAC1C,QAAQ,CAAC,oDAAoD,CAAC,CAAC"}
+{"version":3,"file":"identity-providers.js","sourceRoot":"","sources":["../../../src/lib/config/identity-providers.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AACpB,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAExD,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,qBAAqB,EAAE;IACvE,OAAO,EAAE,mCAAmC;CAC7C,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,uBAAuB,CAAC,QAAQ,CACpD,wDAAwD,CACzD,CAAC;AAEF,MAAM,2BAA2B,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,EAAE,EAAE,CAAC;SACF,MAAM,EAAE;SACR,QAAQ,CAAC,sDAAsD,CAAC;IACnE,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,CAAC,oDAAoD,CAAC;IACjE,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,kEAAkE,CACnE;IACH,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,2DAA2D,CAAC;IACxE,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,kEAAkE,CACnE;CACJ,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,yDAAyD,CAAC,CAAC;AAEvE,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KAC1C,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;IAC/D,IAAI,EAAE,CAAC;SACJ,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;SACpD,QAAQ,CAAC,yBAAyB,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;IAC3E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uCAAuC,CAAC;IAC1E,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,mDAAmD,CAAC;IAChE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IACpE,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,QAAQ,CAAC,wCAAwC,CAAC;IACrD,iBAAiB,EAAE,uBAAuB,CAAC,QAAQ,CACjD,mCAAmC,CACpC;IACD,SAAS,EAAE,uBAAuB,CAAC,QAAQ,CAAC,2BAA2B,CAAC;IACxE,YAAY,EAAE,uBAAuB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACvD,8BAA8B,CAC/B;IACD,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE;IAClC,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,CAAC,mDAAmD,CAAC;IAChE,SAAS,EAAE,uBAAuB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACpD,gDAAgD,CACjD;IACD,MAAM,EAAE,CAAC;SACN,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,CAAC,4CAA4C,CAAC;IACzD,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,qDAAqD,CAAC;IAClE,uBAAuB,EAAE,CAAC;SACvB,IAAI,CAAC,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;SACnC,QAAQ,CACP,iDAAiD;QAC/C,6EAA6E,CAChF;IACH,gBAAgB,EAAE,2BAA2B;CAC9C,CAAC;KACD,WAAW,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;IAC7B,IACE,QAAQ,CAAC,IAAI,KAAK,eAAe;QACjC,QAAQ,CAAC,YAAY,KAAK,IAAI;QAC9B,QAAQ,CAAC,QAAQ;QACjB,CAAC,QAAQ,CAAC,MAAM,EAChB,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,QAAQ,CAAC;YAChB,OAAO,EACL,mEAAmE;SACtE,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,2CAA2C,CAAC,CAAC;AAMzD,MAAM,CAAC,MAAM,iCAAiC,GAA6B,EAAE,CAAC;AAE9E,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC;KAC3C,KAAK,CAAC,4BAA4B,CAAC;KACnC,OAAO,CAAC,iCAAiC,CAAC;KAC1C,QAAQ,CAAC,oDAAoD,CAAC,CAAC"}

package/dist/lib/config/resolved.d.ts

@@ -253,6 +253,8 @@ export declare const TinyAuthRuntimeConfigSchema: z.ZodObject<{
         authorization_url: z.ZodString;
         token_url: z.ZodString;
         userinfo_url: z.ZodNullable<z.ZodString>;
+        jwks_url: z.ZodOptional<z.ZodString>;
+        issuer: z.ZodOptional<z.ZodString>;
         email_url: z.ZodOptional<z.ZodString>;
         scopes: z.ZodArray<z.ZodString>;
         response_mode: z.ZodOptional<z.ZodString>;

package/dist/lib/config/resolved.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolved.d.ts","sourceRoot":"","sources":["../../../src/lib/config/resolved.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAqBpB,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAyCM,CAAC;AAE/C,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,2BAA2B,CACnC,CAAC;AACF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAC1C,OAAO,2BAA2B,CACnC,CAAC"}
+{"version":3,"file":"resolved.d.ts","sourceRoot":"","sources":["../../../src/lib/config/resolved.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAqBpB,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAyCM,CAAC;AAE/C,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,2BAA2B,CACnC,CAAC;AACF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAC1C,OAAO,2BAA2B,CACnC,CAAC"}

package/dist/lib/config/url-policy.d.ts

@@ -0,0 +1,4 @@
+export declare function isLocalHttpHostname(hostname: string): boolean;
+export declare function isHttpsOrLocalHttpUrl(value: string): boolean;
+export declare function isSecureRedirectUri(value: string): boolean;
+//# sourceMappingURL=url-policy.d.ts.map

package/dist/lib/config/url-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-policy.d.ts","sourceRoot":"","sources":["../../../src/lib/config/url-policy.ts"],"names":[],"mappings":"AAeA,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAQ7D;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAY5D;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAU1D"}

package/dist/lib/config/url-policy.js

@@ -0,0 +1,38 @@
+import { parseIPv4 } from '../ip-utils.js';
+function parseUrl(value) {
+    try {
+        return new URL(value);
+    }
+    catch {
+        return null;
+    }
+}
+function isIPv4Loopback(hostname) {
+    const ipv4 = parseIPv4(hostname);
+    return ipv4 !== null && (ipv4 & 0xff000000) === 0x7f000000;
+}
+export function isLocalHttpHostname(hostname) {
+    return (hostname === 'localhost' ||
+        hostname.endsWith('.localhost') ||
+        isIPv4Loopback(hostname) ||
+        hostname === '[::1]' ||
+        hostname === '::1');
+}
+export function isHttpsOrLocalHttpUrl(value) {
+    const url = parseUrl(value);
+    if (!url) {
+        return false;
+    }
+    if (url.protocol === 'https:') {
+        return true;
+    }
+    return url.protocol === 'http:' && isLocalHttpHostname(url.hostname);
+}
+export function isSecureRedirectUri(value) {
+    const url = parseUrl(value);
+    if (!url) {
+        return false;
+    }
+    return (!value.includes('*') && url.hash === '' && isHttpsOrLocalHttpUrl(value));
+}
+//# sourceMappingURL=url-policy.js.map

package/dist/lib/config/url-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-policy.js","sourceRoot":"","sources":["../../../src/lib/config/url-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,SAAS,QAAQ,CAAC,KAAa;IAC7B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACjC,OAAO,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,KAAK,UAAU,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,OAAO,CACL,QAAQ,KAAK,WAAW;QACxB,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC/B,cAAc,CAAC,QAAQ,CAAC;QACxB,QAAQ,KAAK,OAAO;QACpB,QAAQ,KAAK,KAAK,CACnB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE5B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE5B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CACL,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,IAAI,qBAAqB,CAAC,KAAK,CAAC,CACxE,CAAC;AACJ,CAAC"}

package/dist/lib/pkce.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../src/lib/pkce.ts"],"names":[],"mappings":"AAiBA;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAAC,MAAM,GAAE,MAAW;;;;GAWrD;AAED;;;;;;;;;GASG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,MAAM,GAAE,MAAM,GAAG,OAAgB,oBAKlC"}
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../src/lib/pkce.ts"],"names":[],"mappings":"AAmBA;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAAC,MAAM,GAAE,MAAW;;;;GAWrD;AAED;;;;;;;;;GASG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,MAAM,GAAE,MAAM,GAAG,OAAgB,oBAalC"}

package/dist/lib/pkce.js

@@ -1,9 +1,10 @@
 import { base64url } from 'jose';
 import { e } from "../schemas/error.js";
+const CODE_VERIFIER_PATTERN = /^[A-Za-z0-9._~-]{43,128}$/;
 function generateVerifier(length) {
     const buffer = new Uint8Array(length);
     crypto.getRandomValues(buffer);
-    return base64url.encode(buffer);
+    return base64url.encode(buffer).slice(0, length);
 }
 async function generateChallenge(verifier, method) {
     if (method === 'plain')
@@ -45,6 +46,12 @@ export async function generatePKCE(length = 64) {
  * @see {@link https://datatracker.ietf.org/doc/html/rfc7636#section-4.6 | RFC 7636 §4.6 - Client Sends the Authorization Code and the Code Verifier to the Token Endpoint}
  */
 export async function validatePKCE(verifier, challenge, method = 'S256') {
+    if (method !== 'S256') {
+        return false;
+    }
+    if (!CODE_VERIFIER_PATTERN.test(verifier)) {
+        return false;
+    }
     const generatedChallenge = await generateChallenge(verifier, method);
     // timing safe equals?
     return generatedChallenge === challenge;

package/dist/lib/pkce.js.map

@@ -1 +1 @@
-{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../src/lib/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,qBAAqB,CAAC;AAExC,SAAS,gBAAgB,CAAC,MAAc;IACtC,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IAC/B,OAAO,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,QAAgB,EAAE,MAAwB;IACzE,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,QAAQ,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACzD,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,SAAiB,EAAE;IACpD,IAAI,MAAM,GAAG,EAAE,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;QAChC,MAAM,IAAI,CAAC,CAAC,yBAAyB,CAAC,KAAK,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5D,OAAO;QACL,QAAQ;QACR,SAAS;QACT,MAAM,EAAE,MAAM;KACf,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,SAAiB,EACjB,SAA2B,MAAM;IAEjC,MAAM,kBAAkB,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrE,sBAAsB;IACtB,OAAO,kBAAkB,KAAK,SAAS,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../src/lib/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,qBAAqB,CAAC;AAExC,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AAE1D,SAAS,gBAAgB,CAAC,MAAc;IACtC,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IAC/B,OAAO,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,QAAgB,EAAE,MAAwB;IACzE,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,QAAQ,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACzD,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,SAAiB,EAAE;IACpD,IAAI,MAAM,GAAG,EAAE,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;QAChC,MAAM,IAAI,CAAC,CAAC,yBAAyB,CAAC,KAAK,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5D,OAAO;QACL,QAAQ;QACR,SAAS;QACT,MAAM,EAAE,MAAM;KACf,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,SAAiB,EACjB,SAA2B,MAAM;IAEjC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,kBAAkB,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrE,sBAAsB;IACtB,OAAO,kBAAkB,KAAK,SAAS,CAAC;AAC1C,CAAC"}

package/dist/middleware/csrf.d.ts

@@ -0,0 +1,2 @@
+export declare function csrfProtection(publicOrigin: string): import("hono").MiddlewareHandler<any, string, {}, Response>;
+//# sourceMappingURL=csrf.d.ts.map

package/dist/middleware/csrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../src/middleware/csrf.ts"],"names":[],"mappings":"AAmBA,wBAAgB,cAAc,CAAC,YAAY,EAAE,MAAM,+DA0ClD"}

package/dist/middleware/csrf.js

@@ -0,0 +1,51 @@
+import { getCookie } from 'hono/cookie';
+import { createMiddleware } from 'hono/factory';
+import { e } from "../schemas/error.js";
+const SAFE_METHODS = new Set(['GET', 'HEAD', 'OPTIONS']);
+const OAUTH_PROVIDER_CALLBACK_PATTERN = /^\/api\/oauth\/[^/]+\/callback$/;
+function normalizeOrigin(value) {
+    try {
+        return new URL(value).origin;
+    }
+    catch {
+        return undefined;
+    }
+}
+function isOAuthProviderCallback(path) {
+    return OAUTH_PROVIDER_CALLBACK_PATTERN.test(path);
+}
+export function csrfProtection(publicOrigin) {
+    const trustedOrigin = normalizeOrigin(publicOrigin);
+    return createMiddleware(async (c, next) => {
+        if (SAFE_METHODS.has(c.req.method)) {
+            await next();
+            return;
+        }
+        if (isOAuthProviderCallback(c.req.path)) {
+            await next();
+            return;
+        }
+        if (!getCookie(c, 'session')) {
+            await next();
+            return;
+        }
+        const requestOrigin = c.req.header('Origin');
+        if (requestOrigin &&
+            trustedOrigin &&
+            normalizeOrigin(requestOrigin) === trustedOrigin) {
+            await next();
+            return;
+        }
+        const fetchSite = c.req.header('Sec-Fetch-Site');
+        if (!requestOrigin && fetchSite === 'same-origin') {
+            await next();
+            return;
+        }
+        if (!requestOrigin && !fetchSite && !c.req.header('User-Agent')) {
+            await next();
+            return;
+        }
+        throw new e.CsrfViolation.Error();
+    });
+}
+//# sourceMappingURL=csrf.js.map

package/dist/middleware/csrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../../src/middleware/csrf.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,CAAC,EAAE,MAAM,qBAAqB,CAAC;AAExC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AACzD,MAAM,+BAA+B,GAAG,iCAAiC,CAAC;AAE1E,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAY;IAC3C,OAAO,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,YAAoB;IACjD,MAAM,aAAa,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;IAEpD,OAAO,gBAAgB,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACxC,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,IAAI,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC7C,IACE,aAAa;YACb,aAAa;YACb,eAAe,CAAC,aAAa,CAAC,KAAK,aAAa,EAChD,CAAC;YACD,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACjD,IAAI,CAAC,aAAa,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YAClD,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,IAAI,CAAC,aAAa,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,IAAI,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/middleware/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/middleware/session.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,UAAU,GAAG;IAAE,SAAS,EAAE;QAAE,OAAO,EAAE,aAAa,CAAA;KAAE,CAAA;CAAE,CAAC;AAEnE,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,IAAI,CAAC,EAAE;QACL,GAAG,EAAE,MAAM,CAAC;QACZ,gBAAgB,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF;;;;OAIG;IACH,cAAc,CAAC,EAAE;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,gBAAgB,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF;;;;OAIG;IACH,eAAe,CAAC,EAAE;QAChB,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;IACF;;;;;OAKG;IACH,KAAK,CAAC,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;QACpC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAChC,CAAC;IACF;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,CAAC,SAAS,MAAM,WAAW,EAAE,GAAG,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IACzD,GAAG,CAAC,CAAC,SAAS,MAAM,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IACtE,MAAM,IAAI,IAAI,CAAC;IACf,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChE,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtE,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACjD,iBAAiB,IAAI,IAAI,CAAC;CAC3B;AAED,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,sEA0FxE"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/middleware/session.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,UAAU,GAAG;IAAE,SAAS,EAAE;QAAE,OAAO,EAAE,aAAa,CAAA;KAAE,CAAA;CAAE,CAAC;AAEnE,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,IAAI,CAAC,EAAE;QACL,GAAG,EAAE,MAAM,CAAC;QACZ,gBAAgB,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF;;;;OAIG;IACH,cAAc,CAAC,EAAE;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,gBAAgB,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF;;;;OAIG;IACH,eAAe,CAAC,EAAE;QAChB,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;IACF;;;;;OAKG;IACH,KAAK,CAAC,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;QACpC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAChC,CAAC;IACF;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,CAAC,SAAS,MAAM,WAAW,EAAE,GAAG,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IACzD,GAAG,CAAC,CAAC,SAAS,MAAM,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IACtE,MAAM,IAAI,IAAI,CAAC;IACf,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChE,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtE,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACjD,iBAAiB,IAAI,IAAI,CAAC;CAC3B;AAED,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,sEA4FxE"}