@tinyrack/tinyauth-server 0.3.1 → 0.5.0

package/dist/routes/oauth/.well-known/openid-configuration/get.js

@@ -2,6 +2,75 @@ import { Hono } from 'hono';
 import { describeRoute, resolver } from 'hono-openapi';
 import { z } from 'zod';
 import { TAGS } from '#server/lib/swagger-tags.js';
+export function buildOpenidConfiguration(config) {
+    const baseUrl = config.server.public_origin;
+    const scopesSupported = new Set([
+        'openid',
+        'profile',
+        'email',
+        'offline_access',
+    ]);
+    for (const client of config.clients) {
+        for (const scope of client.scope.split(' ')) {
+            scopesSupported.add(scope);
+        }
+    }
+    return {
+        issuer: baseUrl,
+        authorization_endpoint: `${baseUrl}/oauth/authorize`,
+        token_endpoint: `${baseUrl}/oauth/token`,
+        jwks_uri: `${baseUrl}/oauth/.well-known/jwks`,
+        response_types_supported: ['code', 'id_token'],
+        response_modes_supported: ['query', 'fragment', 'form_post'],
+        subject_types_supported: ['public'],
+        id_token_signing_alg_values_supported: ['RS256'],
+        userinfo_signing_alg_values_supported: ['none'],
+        userinfo_endpoint: `${baseUrl}/oauth/userinfo`,
+        scopes_supported: [...scopesSupported],
+        claims_supported: [
+            'sub',
+            'iss',
+            'aud',
+            'exp',
+            'iat',
+            'nonce',
+            'auth_time',
+            'at_hash',
+            'email',
+            'email_verified',
+            'name',
+        ],
+        grant_types_supported: [
+            'authorization_code',
+            'implicit',
+            'refresh_token',
+            'client_credentials',
+            'urn:ietf:params:oauth:grant-type:device_code',
+        ],
+        token_endpoint_auth_methods_supported: [
+            'client_secret_basic',
+            'client_secret_post',
+            'none',
+        ],
+        introspection_endpoint_auth_methods_supported: [
+            'client_secret_basic',
+            'client_secret_post',
+        ],
+        revocation_endpoint_auth_methods_supported: [
+            'client_secret_basic',
+            'client_secret_post',
+        ],
+        code_challenge_methods_supported: ['S256'],
+        introspection_endpoint: `${baseUrl}/oauth/introspect`,
+        revocation_endpoint: `${baseUrl}/oauth/revoke`,
+        end_session_endpoint: `${baseUrl}/oauth/end_session`,
+        device_authorization_endpoint: `${baseUrl}/oauth/device_authorization`,
+        ui_locales_supported: config.i18n.supported_languages,
+        request_parameter_supported: false,
+        request_uri_parameter_supported: false,
+        claims_parameter_supported: false,
+    };
+}
 export const oidcConfigGet = new Hono().get('/.well-known/openid-configuration', describeRoute({
     tags: [TAGS.OPENID],
     summary: 'OpenID Provider Configuration',
@@ -56,6 +125,14 @@ export const oidcConfigGet = new Hono().get('/.well-known/openid-configuration',
                             .array(z.string())
                             .optional()
                             .describe('JSON array containing a list of Client Authentication methods'),
+                        introspection_endpoint_auth_methods_supported: z
+                            .array(z.string())
+                            .optional()
+                            .describe('JSON array containing a list of Token Introspection Client Authentication methods'),
+                        revocation_endpoint_auth_methods_supported: z
+                            .array(z.string())
+                            .optional()
+                            .describe('JSON array containing a list of Token Revocation Client Authentication methods'),
                         code_challenge_methods_supported: z
                             .array(z.string())
                             .optional()
@@ -96,47 +173,8 @@ export const oidcConfigGet = new Hono().get('/.well-known/openid-configuration',
     },
 }), async (c) => {
     const { config } = c.var.services;
-    const baseUrl = config.server.public_origin;
-    const configuration = {
-        issuer: baseUrl,
-        authorization_endpoint: `${baseUrl}/oauth/authorize`,
-        token_endpoint: `${baseUrl}/oauth/token`,
-        jwks_uri: `${baseUrl}/oauth/.well-known/jwks`,
-        response_types_supported: ['code', 'id_token'],
-        response_modes_supported: ['query', 'fragment'],
-        subject_types_supported: ['public'],
-        id_token_signing_alg_values_supported: ['RS256'],
-        userinfo_endpoint: `${baseUrl}/oauth/userinfo`,
-        scopes_supported: ['openid', 'profile', 'email', 'offline_access'],
-        claims_supported: [
-            'sub',
-            'iss',
-            'aud',
-            'exp',
-            'iat',
-            'nonce',
-            'auth_time',
-            'at_hash',
-            'email',
-            'email_verified',
-            'name',
-        ],
-        grant_types_supported: ['authorization_code', 'refresh_token'],
-        token_endpoint_auth_methods_supported: [
-            'client_secret_basic',
-            'client_secret_post',
-            'none',
-        ],
-        code_challenge_methods_supported: ['S256'],
-        introspection_endpoint: `${baseUrl}/oauth/introspect`,
-        revocation_endpoint: `${baseUrl}/oauth/revoke`,
-        ui_locales_supported: config.i18n.supported_languages,
-        request_parameter_supported: false,
-        request_uri_parameter_supported: false,
-        claims_parameter_supported: false,
-    };
     // Set Cache-Control header
     c.header('Cache-Control', 'public, max-age=3600');
-    return c.json(configuration, 200);
+    return c.json(buildOpenidConfiguration(config), 200);
 });
 //# sourceMappingURL=get.js.map

package/dist/routes/oauth/.well-known/openid-configuration/get.js.map

@@ -1 +1 @@
-{"version":3,"file":"get.js","sourceRoot":"","sources":["../../../../../src/routes/oauth/.well-known/openid-configuration/get.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,IAAI,EAAE,MAAM,6BAA6B,CAAC;AAEnD,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,IAAI,EAAU,CAAC,GAAG,CACjD,mCAAmC,EACnC,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;IACnB,OAAO,EAAE,+BAA+B;IACxC,WAAW,EACT,kFAAkF;IACpF,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CACd,CAAC,CAAC,MAAM,CAAC;wBACP,MAAM,EAAE,CAAC;6BACN,MAAM,EAAE;6BACR,QAAQ,CACP,gEAAgE,CACjE;wBACH,sBAAsB,EAAE,CAAC;6BACtB,MAAM,EAAE;6BACR,QAAQ,CAAC,kDAAkD,CAAC;wBAC/D,cAAc,EAAE,CAAC;6BACd,MAAM,EAAE;6BACR,QAAQ,CAAC,0CAA0C,CAAC;wBACvD,QAAQ,EAAE,CAAC;6BACR,MAAM,EAAE;6BACR,QAAQ,CAAC,2CAA2C,CAAC;wBACxD,wBAAwB,EAAE,CAAC;6BACxB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;6BACjB,QAAQ,CACP,oEAAoE,CACrE;wBACH,wBAAwB,EAAE,CAAC;6BACxB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;6BACjB,QAAQ,EAAE;6BACV,QAAQ,CACP,gEAAgE,CACjE;wBACH,uBAAuB,EAAE,CAAC;6BACvB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;6BACjB,QAAQ,CACP,8DAA8D,CAC/D;wBACH,qCAAqC,EAAE,CAAC;6BACrC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;6BACjB,QAAQ,CACP,sEAAsE,CACvE;wBACH,iBAAiB,EAAE,CAAC;6BACjB,MAAM,EAAE;6BACR,QAAQ,EAAE;6BACV,QAAQ,CAAC,mCAAmC,CAAC;wBAChD,gBAAgB,EAAE,CAAC;6BAChB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;6BACjB,QAAQ,EAAE;6BACV,QAAQ,CACP,4DAA4D,CAC7D;wBACH,gBAAgB,EAAE,CAAC;6BAChB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;6BACjB,QAAQ,EAAE;6BACV,QAAQ,CAAC,iDAAiD,CAAC;wBAC9D,qBAAqB,EAAE,CAAC;6BACrB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;6BACjB,QAAQ,EAAE;6BACV,QAAQ,CACP,iEAAiE,CAClE;wBACH,qCAAqC,EAAE,CAAC;6BACrC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;6BACjB,QAAQ,EAAE;6BACV,QAAQ,CACP,+DAA+D,CAChE;wBACH,gCAAgC,EAAE,CAAC;6BAChC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;6BACjB,QAAQ,EAAE;6BACV,QAAQ,CACP,6DAA6D,CAC9D;wBACH,sBAAsB,EAAE,CAAC;6BACtB,MAAM,EAAE;6BACR,QAAQ,EAAE;6BACV,QAAQ,CACP,wDAAwD,CACzD;wBACH,mBAAmB,EAAE,CAAC;6BACnB,MAAM,EAAE;6BACR,QAAQ,EAAE;6BACV,QAAQ,CACP,qDAAqD,CACtD;wBACH,qBAAqB,EAAE,CAAC;6BACrB,MAAM,EAAE;6BACR,QAAQ,EAAE;6BACV,QAAQ,CACP,qDAAqD,CACtD;wBACH,oBAAoB,EAAE,CAAC;6BACpB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;6BACjB,QAAQ,EAAE;6BACV,QAAQ,CACP,wDAAwD,CACzD;wBACH,2BAA2B,EAAE,CAAC;6BAC3B,OAAO,EAAE;6BACT,QAAQ,EAAE;6BACV,QAAQ,CAAC,8CAA8C,CAAC;wBAC3D,+BAA+B,EAAE,CAAC;6BAC/B,OAAO,EAAE;6BACT,QAAQ,EAAE;6BACV,QAAQ,CAAC,kDAAkD,CAAC;wBAC/D,0BAA0B,EAAE,CAAC;6BAC1B,OAAO,EAAE;6BACT,QAAQ,EAAE;6BACV,QAAQ,CACP,mDAAmD,CACpD;qBACJ,CAAC,CACH;iBACF;aACF;YACD,WAAW,EAAE,sBAAsB;SACpC;KACF;CACF,CAAC,EACF,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC;IAE5C,MAAM,aAAa,GAAG;QACpB,MAAM,EAAE,OAAO;QACf,sBAAsB,EAAE,GAAG,OAAO,kBAAkB;QACpD,cAAc,EAAE,GAAG,OAAO,cAAc;QACxC,QAAQ,EAAE,GAAG,OAAO,yBAAyB;QAC7C,wBAAwB,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;QAC9C,wBAAwB,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC;QAC/C,uBAAuB,EAAE,CAAC,QAAQ,CAAC;QACnC,qCAAqC,EAAE,CAAC,OAAO,CAAC;QAChD,iBAAiB,EAAE,GAAG,OAAO,iBAAiB;QAC9C,gBAAgB,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,CAAC;QAClE,gBAAgB,EAAE;YAChB,KAAK;YACL,KAAK;YACL,KAAK;YACL,KAAK;YACL,KAAK;YACL,OAAO;YACP,WAAW;YACX,SAAS;YACT,OAAO;YACP,gBAAgB;YAChB,MAAM;SACP;QACD,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAC9D,qCAAqC,EAAE;YACrC,qBAAqB;YACrB,oBAAoB;YACpB,MAAM;SACP;QACD,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,sBAAsB,EAAE,GAAG,OAAO,mBAAmB;QACrD,mBAAmB,EAAE,GAAG,OAAO,eAAe;QAC9C,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB;QACrD,2BAA2B,EAAE,KAAK;QAClC,+BAA+B,EAAE,KAAK;QACtC,0BAA0B,EAAE,KAAK;KAClC,CAAC;IAEF,2BAA2B;IAC3B,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;IAElD,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;AACpC,CAAC,CACF,CAAC"}
+{"version":3,"file":"get.js","sourceRoot":"","sources":["../../../../../src/routes/oauth/.well-known/openid-configuration/get.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,IAAI,EAAE,MAAM,6BAA6B,CAAC;AAEnD,MAAM,UAAU,wBAAwB,CAAC,MAA6B;IACpE,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC;IAC5C,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;QAC9B,QAAQ;QACR,SAAS;QACT,OAAO;QACP,gBAAgB;KACjB,CAAC,CAAC;IACH,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5C,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,OAAO;QACf,sBAAsB,EAAE,GAAG,OAAO,kBAAkB;QACpD,cAAc,EAAE,GAAG,OAAO,cAAc;QACxC,QAAQ,EAAE,GAAG,OAAO,yBAAyB;QAC7C,wBAAwB,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;QAC9C,wBAAwB,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC;QAC5D,uBAAuB,EAAE,CAAC,QAAQ,CAAC;QACnC,qCAAqC,EAAE,CAAC,OAAO,CAAC;QAChD,qCAAqC,EAAE,CAAC,MAAM,CAAC;QAC/C,iBAAiB,EAAE,GAAG,OAAO,iBAAiB;QAC9C,gBAAgB,EAAE,CAAC,GAAG,eAAe,CAAC;QACtC,gBAAgB,EAAE;YAChB,KAAK;YACL,KAAK;YACL,KAAK;YACL,KAAK;YACL,KAAK;YACL,OAAO;YACP,WAAW;YACX,SAAS;YACT,OAAO;YACP,gBAAgB;YAChB,MAAM;SACP;QACD,qBAAqB,EAAE;YACrB,oBAAoB;YACpB,UAAU;YACV,eAAe;YACf,oBAAoB;YACpB,8CAA8C;SAC/C;QACD,qCAAqC,EAAE;YACrC,qBAAqB;YACrB,oBAAoB;YACpB,MAAM;SACP;QACD,6CAA6C,EAAE;YAC7C,qBAAqB;YACrB,oBAAoB;SACrB;QACD,0CAA0C,EAAE;YAC1C,qBAAqB;YACrB,oBAAoB;SACrB;QACD,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,sBAAsB,EAAE,GAAG,OAAO,mBAAmB;QACrD,mBAAmB,EAAE,GAAG,OAAO,eAAe;QAC9C,oBAAoB,EAAE,GAAG,OAAO,oBAAoB;QACpD,6BAA6B,EAAE,GAAG,OAAO,6BAA6B;QACtE,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB;QACrD,2BAA2B,EAAE,KAAK;QAClC,+BAA+B,EAAE,KAAK;QACtC,0BAA0B,EAAE,KAAK;KAClC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,IAAI,EAAU,CAAC,GAAG,CACjD,mCAAmC,EACnC,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;IACnB,OAAO,EAAE,+BAA+B;IACxC,WAAW,EACT,kFAAkF;IACpF,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CACd,CAAC,CAAC,MAAM,CAAC;wBACP,MAAM,EAAE,CAAC;6BACN,MAAM,EAAE;6BACR,QAAQ,CACP,gEAAgE,CACjE;wBACH,sBAAsB,EAAE,CAAC;6BACtB,MAAM,EAAE;6BACR,QAAQ,CAAC,kDAAkD,CAAC;wBAC/D,cAAc,EAAE,CAAC;6BACd,MAAM,EAAE;6BACR,QAAQ,CAAC,0CAA0C,CAAC;wBACvD,QAAQ,EAAE,CAAC;6BACR,MAAM,EAAE;6BACR,QAAQ,CAAC,2CAA2C,CAAC;wBACxD,wBAAwB,EAAE,CAAC;6BACxB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;6BACjB,QAAQ,CACP,oEAAoE,CACrE;wBACH,wBAAwB,EAAE,CAAC;6BACxB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;6BACjB,QAAQ,EAAE;6BACV,QAAQ,CACP,gEAAgE,CACjE;wBACH,uBAAuB,EAAE,CAAC;6BACvB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;6BACjB,QAAQ,CACP,8DAA8D,CAC/D;wBACH,qCAAqC,EAAE,CAAC;6BACrC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;6BACjB,QAAQ,CACP,sEAAsE,CACvE;wBACH,iBAAiB,EAAE,CAAC;6BACjB,MAAM,EAAE;6BACR,QAAQ,EAAE;6BACV,QAAQ,CAAC,mCAAmC,CAAC;wBAChD,gBAAgB,EAAE,CAAC;6BAChB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;6BACjB,QAAQ,EAAE;6BACV,QAAQ,CACP,4DAA4D,CAC7D;wBACH,gBAAgB,EAAE,CAAC;6BAChB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;6BACjB,QAAQ,EAAE;6BACV,QAAQ,CAAC,iDAAiD,CAAC;wBAC9D,qBAAqB,EAAE,CAAC;6BACrB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;6BACjB,QAAQ,EAAE;6BACV,QAAQ,CACP,iEAAiE,CAClE;wBACH,qCAAqC,EAAE,CAAC;6BACrC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;6BACjB,QAAQ,EAAE;6BACV,QAAQ,CACP,+DAA+D,CAChE;wBACH,6CAA6C,EAAE,CAAC;6BAC7C,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;6BACjB,QAAQ,EAAE;6BACV,QAAQ,CACP,mFAAmF,CACpF;wBACH,0CAA0C,EAAE,CAAC;6BAC1C,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;6BACjB,QAAQ,EAAE;6BACV,QAAQ,CACP,gFAAgF,CACjF;wBACH,gCAAgC,EAAE,CAAC;6BAChC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;6BACjB,QAAQ,EAAE;6BACV,QAAQ,CACP,6DAA6D,CAC9D;wBACH,sBAAsB,EAAE,CAAC;6BACtB,MAAM,EAAE;6BACR,QAAQ,EAAE;6BACV,QAAQ,CACP,wDAAwD,CACzD;wBACH,mBAAmB,EAAE,CAAC;6BACnB,MAAM,EAAE;6BACR,QAAQ,EAAE;6BACV,QAAQ,CACP,qDAAqD,CACtD;wBACH,qBAAqB,EAAE,CAAC;6BACrB,MAAM,EAAE;6BACR,QAAQ,EAAE;6BACV,QAAQ,CACP,qDAAqD,CACtD;wBACH,oBAAoB,EAAE,CAAC;6BACpB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;6BACjB,QAAQ,EAAE;6BACV,QAAQ,CACP,wDAAwD,CACzD;wBACH,2BAA2B,EAAE,CAAC;6BAC3B,OAAO,EAAE;6BACT,QAAQ,EAAE;6BACV,QAAQ,CAAC,8CAA8C,CAAC;wBAC3D,+BAA+B,EAAE,CAAC;6BAC/B,OAAO,EAAE;6BACT,QAAQ,EAAE;6BACV,QAAQ,CAAC,kDAAkD,CAAC;wBAC/D,0BAA0B,EAAE,CAAC;6BAC1B,OAAO,EAAE;6BACT,QAAQ,EAAE;6BACV,QAAQ,CACP,mDAAmD,CACpD;qBACJ,CAAC,CACH;iBACF;aACF;YACD,WAAW,EAAE,sBAAsB;SACpC;KACF;CACF,CAAC,EACF,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAElC,2BAA2B;IAC3B,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;IAElD,OAAO,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;AACvD,CAAC,CACF,CAAC"}

package/dist/routes/oauth/authorize/get.d.ts

@@ -16,34 +16,16 @@ export declare const authorizeGet: import("hono/hono-base").HonoBase<AppEnv, {
                     max_age?: string | string[];
                     reauthenticated?: string | string[];
                     display?: string | string[];
+                    response_mode?: string | string[];
+                    login_hint?: string | string[];
+                    ui_locales?: string | string[];
+                    id_token_hint?: string | string[];
+                    acr_values?: string | string[];
                 };
             };
-            output: undefined;
-            outputFormat: "redirect";
-            status: 302;
-        } | {
-            input: {
-                query: {
-                    response_type: string | string[];
-                    redirect_uri: string | string[];
-                    client_id: string | string[];
-                    state?: string | string[];
-                    code_challenge?: string | string[];
-                    code_challenge_method?: string | string[];
-                    scope?: string | string[];
-                    nonce?: string | string[];
-                    prompt?: string | string[];
-                    max_age?: string | string[];
-                    reauthenticated?: string | string[];
-                    display?: string | string[];
-                };
-            };
-            output: {
-                error: string;
-                error_description: string;
-            };
-            outputFormat: "json";
-            status: 400;
+            output: {};
+            outputFormat: string;
+            status: import("hono/utils/http-status").StatusCode;
         };
     };
 }, "/", "/authorize">;

package/dist/routes/oauth/authorize/get.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../../../src/routes/oauth/authorize/get.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAStD,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBA6KxB,CAAC"}
+{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../../../src/routes/oauth/authorize/get.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAUtD,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBAuMxB,CAAC"}

package/dist/routes/oauth/authorize/get.js

@@ -1,6 +1,7 @@
 import { Hono } from 'hono';
 import { describeRoute, resolver, validator } from 'hono-openapi';
 import { z } from 'zod';
+import { escapeHtml } from '../../../lib/escape-html.js';
 import { OPENAPI_SECURITY } from "../../../lib/openapi.js";
 import { TAGS } from "../../../lib/swagger-tags.js";
 import { verifyAuth } from "../../../middleware/auth.js";
@@ -38,6 +39,11 @@ export const authorizeGet = new Hono().get('/authorize', describeRoute({
     max_age: f.maxAge.optional(),
     reauthenticated: z.literal('1').optional(),
     display: f.display.optional(),
+    response_mode: z.enum(['query', 'fragment', 'form_post']).optional(),
+    login_hint: z.string().min(1).max(1000).optional(),
+    ui_locales: z.string().min(1).max(1000).optional(),
+    id_token_hint: z.string().min(1).max(4000).optional(),
+    acr_values: z.string().min(1).max(1000).optional(),
 })), verifyAuth({ optional: true }), async (c) => {
     const query = c.req.valid('query');
     const { oauthAuthorizeService } = c.var.services;
@@ -49,8 +55,19 @@ export const authorizeGet = new Hono().get('/authorize', describeRoute({
                 error_description: errorDescription,
             }, 400);
         }
+        if (query.response_mode === 'form_post') {
+            const params = {
+                error,
+                error_description: errorDescription,
+            };
+            if (query.state) {
+                params['state'] = query.state;
+            }
+            return c.html(buildFormPostResponse(redirectUri, params));
+        }
         const url = new URL(redirectUri);
-        const useFragment = query.response_type === 'id_token';
+        const useFragment = query.response_mode === 'fragment' ||
+            (query.response_type === 'id_token' && query.response_mode !== 'query');
         const params = useFragment ? new URLSearchParams() : url.searchParams;
         params.set('error', error);
         params.set('error_description', errorDescription);
@@ -75,6 +92,9 @@ export const authorizeGet = new Hono().get('/authorize', describeRoute({
             };
         }
         const result = await oauthAuthorizeService.authorize(authorizeParams);
+        if (result.type === 'form_post') {
+            return c.html(buildFormPostResponse(result.url, result.params ?? {}));
+        }
         // Redirect based on result
         return c.redirect(result.url);
     }
@@ -106,9 +126,20 @@ export const authorizeGet = new Hono().get('/authorize', describeRoute({
         if (error instanceof e.InvalidPrompt.Error) {
             return redirectWithError('invalid_request', error.message, query.redirect_uri);
         }
-        // Log unexpected errors
+        // Log unexpected errors. Do not redirect unexpected failures to the
+        // client-supplied redirect_uri because this handler cannot prove that
+        // redirect_uri validation completed successfully.
         c.var.logger.error({ err: error }, 'Unexpected authorize error');
-        return redirectWithError('server_error', 'An unexpected error occurred', query.redirect_uri);
+        return c.json({
+            error: 'server_error',
+            error_description: 'An unexpected error occurred',
+        }, 500);
     }
 });
+function buildFormPostResponse(action, params) {
+    const inputs = Object.entries(params)
+        .map(([name, value]) => `<input type="hidden" name="${escapeHtml(name)}" value="${escapeHtml(value)}">`)
+        .join('');
+    return `<!doctype html><html><head><title>Submit Authorization Response</title></head><body><form method="post" action="${escapeHtml(action)}">${inputs}<noscript><button type="submit">Continue</button></noscript></form><script>document.forms[0].submit();</script></body></html>`;
+}
 //# sourceMappingURL=get.js.map

package/dist/routes/oauth/authorize/get.js.map

@@ -1 +1 @@
-{"version":3,"file":"get.js","sourceRoot":"","sources":["../../../../src/routes/oauth/authorize/get.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,8BAA8B,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,CAAC,EAAE,MAAM,2BAA2B,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,2BAA2B,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,8BAA8B,CAAC;AAGjD,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,IAAI,EAAU,CAAC,GAAG,CAChD,YAAY,EACZ,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;IACnB,QAAQ,EAAE,gBAAgB,CAAC,qBAAqB;IAChD,OAAO,EAAE,WAAW;IACpB,WAAW,EAAE,+BAA+B;IAC5C,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,UAAU;SACxB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;iBAC/B;aACF;YACD,WAAW,EAAE,aAAa;SAC3B;KACF;CACF,CAAC,EACF,SAAS,CACP,OAAO,EACP,CAAC,CAAC,MAAM,CAAC;IACP,aAAa,EAAE,CAAC,CAAC,YAAY;IAC7B,YAAY,EAAE,CAAC,CAAC,WAAW;IAC3B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,QAAQ;IACrB,cAAc,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,EAAE;IAC1C,qBAAqB,EAAE,CAAC,CAAC,mBAAmB,CAAC,QAAQ,EAAE;IACvD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE;IACzB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE;IACzB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE;IAC5B,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE;CAC9B,CAAC,CACH,EACD,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAC9B,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,EAAE,qBAAqB,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAEjD,yCAAyC;IACzC,MAAM,iBAAiB,GAAG,CACxB,KAAa,EACb,gBAAwB,EACxB,WAAoB,EACpB,EAAE;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK;gBACL,iBAAiB,EAAE,gBAAgB;aACpC,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACjC,MAAM,WAAW,GAAG,KAAK,CAAC,aAAa,KAAK,UAAU,CAAC;QACvD,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;QACtE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,CAAC;QAClD,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;QAED,IAAI,WAAW,EAAE,CAAC;YAChB,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC/B,CAAC;QAED,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;QAExC,yBAAyB;QACzB,MAAM,eAAe,GAMjB;YACF,KAAK,EAAE,KAAK;SACb,CAAC;QAEF,IAAI,YAAY,EAAE,CAAC;YACjB,eAAe,CAAC,WAAW,GAAG;gBAC5B,GAAG,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG;gBAC1B,gBAAgB,EAAE,YAAY,CAAC,eAAe;aAC/C,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAEtE,2BAA2B;QAC3B,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,+EAA+E;QAC/E,+CAA+C;QAC/C,IAAI,KAAK,YAAY,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;YACjD,OAAO,iBAAiB,CACtB,qBAAqB,EACrB,KAAK,CAAC,OAAO,EACb,SAAS,CACV,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,YAAY,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;YACjD,OAAO,iBAAiB,CACtB,qBAAqB,EACrB,KAAK,CAAC,OAAO,EACb,SAAS,CACV,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,YAAY,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;YAChD,OAAO,iBAAiB,CAAC,iBAAiB,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACxE,CAAC;QAED,oFAAoF;QACpF,IAAI,KAAK,YAAY,CAAC,CAAC,uBAAuB,CAAC,KAAK,EAAE,CAAC;YACrD,OAAO,iBAAiB,CACtB,2BAA2B,EAC3B,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CACnB,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,YAAY,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;YAC1C,OAAO,iBAAiB,CACtB,eAAe,EACf,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CACnB,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,YAAY,CAAC,CAAC,0BAA0B,CAAC,KAAK,EAAE,CAAC;YACxD,OAAO,iBAAiB,CACtB,iBAAiB,EACjB,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CACnB,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,YAAY,CAAC,CAAC,2BAA2B,CAAC,KAAK,EAAE,CAAC;YACzD,OAAO,iBAAiB,CACtB,iBAAiB,EACjB,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CACnB,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,YAAY,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;YAC3C,OAAO,iBAAiB,CACtB,iBAAiB,EACjB,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CACnB,CAAC;QACJ,CAAC;QAED,wBAAwB;QACxB,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,4BAA4B,CAAC,CAAC;QACjE,OAAO,iBAAiB,CACtB,cAAc,EACd,8BAA8B,EAC9B,KAAK,CAAC,YAAY,CACnB,CAAC;IACJ,CAAC;AACH,CAAC,CACF,CAAC"}
+{"version":3,"file":"get.js","sourceRoot":"","sources":["../../../../src/routes/oauth/authorize/get.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,8BAA8B,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,CAAC,EAAE,MAAM,2BAA2B,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,2BAA2B,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,8BAA8B,CAAC;AAGjD,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,IAAI,EAAU,CAAC,GAAG,CAChD,YAAY,EACZ,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;IACnB,QAAQ,EAAE,gBAAgB,CAAC,qBAAqB;IAChD,OAAO,EAAE,WAAW;IACpB,WAAW,EAAE,+BAA+B;IAC5C,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,UAAU;SACxB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;iBAC/B;aACF;YACD,WAAW,EAAE,aAAa;SAC3B;KACF;CACF,CAAC,EACF,SAAS,CACP,OAAO,EACP,CAAC,CAAC,MAAM,CAAC;IACP,aAAa,EAAE,CAAC,CAAC,YAAY;IAC7B,YAAY,EAAE,CAAC,CAAC,WAAW;IAC3B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,QAAQ;IACrB,cAAc,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,EAAE;IAC1C,qBAAqB,EAAE,CAAC,CAAC,mBAAmB,CAAC,QAAQ,EAAE;IACvD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE;IACzB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE;IACzB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE;IAC5B,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE;IAC7B,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAClD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAClD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IACrD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CACnD,CAAC,CACH,EACD,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAC9B,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,EAAE,qBAAqB,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAEjD,yCAAyC;IACzC,MAAM,iBAAiB,GAAG,CACxB,KAAa,EACb,gBAAwB,EACxB,WAAoB,EACpB,EAAE;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK;gBACL,iBAAiB,EAAE,gBAAgB;aACpC,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,aAAa,KAAK,WAAW,EAAE,CAAC;YACxC,MAAM,MAAM,GAA2B;gBACrC,KAAK;gBACL,iBAAiB,EAAE,gBAAgB;aACpC,CAAC;YACF,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;gBAChB,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;YAChC,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACjC,MAAM,WAAW,GACf,KAAK,CAAC,aAAa,KAAK,UAAU;YAClC,CAAC,KAAK,CAAC,aAAa,KAAK,UAAU,IAAI,KAAK,CAAC,aAAa,KAAK,OAAO,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;QACtE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,CAAC;QAClD,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;QAED,IAAI,WAAW,EAAE,CAAC;YAChB,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC/B,CAAC;QAED,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;QAExC,yBAAyB;QACzB,MAAM,eAAe,GAMjB;YACF,KAAK,EAAE,KAAK;SACb,CAAC;QAEF,IAAI,YAAY,EAAE,CAAC;YACjB,eAAe,CAAC,WAAW,GAAG;gBAC5B,GAAG,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG;gBAC1B,gBAAgB,EAAE,YAAY,CAAC,eAAe;aAC/C,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAEtE,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,OAAO,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;QACxE,CAAC;QAED,2BAA2B;QAC3B,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,+EAA+E;QAC/E,+CAA+C;QAC/C,IAAI,KAAK,YAAY,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;YACjD,OAAO,iBAAiB,CACtB,qBAAqB,EACrB,KAAK,CAAC,OAAO,EACb,SAAS,CACV,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,YAAY,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;YACjD,OAAO,iBAAiB,CACtB,qBAAqB,EACrB,KAAK,CAAC,OAAO,EACb,SAAS,CACV,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,YAAY,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;YAChD,OAAO,iBAAiB,CAAC,iBAAiB,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACxE,CAAC;QAED,oFAAoF;QACpF,IAAI,KAAK,YAAY,CAAC,CAAC,uBAAuB,CAAC,KAAK,EAAE,CAAC;YACrD,OAAO,iBAAiB,CACtB,2BAA2B,EAC3B,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CACnB,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,YAAY,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;YAC1C,OAAO,iBAAiB,CACtB,eAAe,EACf,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CACnB,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,YAAY,CAAC,CAAC,0BAA0B,CAAC,KAAK,EAAE,CAAC;YACxD,OAAO,iBAAiB,CACtB,iBAAiB,EACjB,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CACnB,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,YAAY,CAAC,CAAC,2BAA2B,CAAC,KAAK,EAAE,CAAC;YACzD,OAAO,iBAAiB,CACtB,iBAAiB,EACjB,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CACnB,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,YAAY,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;YAC3C,OAAO,iBAAiB,CACtB,iBAAiB,EACjB,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CACnB,CAAC;QACJ,CAAC;QAED,oEAAoE;QACpE,sEAAsE;QACtE,kDAAkD;QAClD,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,4BAA4B,CAAC,CAAC;QACjE,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE,cAAc;YACrB,iBAAiB,EAAE,8BAA8B;SAClD,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;AACH,CAAC,CACF,CAAC;AAEF,SAAS,qBAAqB,CAAC,MAAc,EAAE,MAA8B;IAC3E,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;SAClC,GAAG,CACF,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAChB,8BAA8B,UAAU,CAAC,IAAI,CAAC,YAAY,UAAU,CAAC,KAAK,CAAC,IAAI,CAClF;SACA,IAAI,CAAC,EAAE,CAAC,CAAC;IAEZ,OAAO,mHAAmH,UAAU,CAAC,MAAM,CAAC,KAAK,MAAM,+HAA+H,CAAC;AACzR,CAAC"}

package/dist/routes/oauth/cors.d.ts

@@ -0,0 +1,9 @@
+import type { Context, Next } from 'hono';
+import type { AppEnv } from '../../lib/app-env.js';
+type OAuthCorsClient = {
+    webOrigins: string[];
+};
+export declare function oauthCorsMiddleware(c: Context<AppEnv>, next: Next): Promise<Response | undefined>;
+export declare function setOAuthClientCorsHeaders(c: Context<AppEnv>, client: OAuthCorsClient): void;
+export {};
+//# sourceMappingURL=cors.d.ts.map

package/dist/routes/oauth/cors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../../src/routes/oauth/cors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAEnD,KAAK,eAAe,GAAG;IACrB,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB,CAAC;AASF,wBAAsB,mBAAmB,CACvC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,EAClB,IAAI,EAAE,IAAI,GACT,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAa/B;AAED,wBAAgB,yBAAyB,CACvC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,EAClB,MAAM,EAAE,eAAe,GACtB,IAAI,CAeN"}

package/dist/routes/oauth/cors.js

@@ -0,0 +1,50 @@
+const PUBLIC_METADATA_PATHS = [
+    '/oauth/.well-known/openid-configuration',
+    '/oauth/.well-known/jwks',
+];
+const PREFLIGHT_PATHS = ['/oauth/token', '/oauth/revoke'];
+export async function oauthCorsMiddleware(c, next) {
+    if (c.req.method === 'OPTIONS') {
+        return handleOAuthPreflight(c);
+    }
+    await next();
+    if (isPublicMetadataPath(c.req.path) && c.req.header('origin')) {
+        c.res.headers.delete('Access-Control-Allow-Credentials');
+        c.header('Access-Control-Allow-Origin', '*');
+    }
+    return undefined;
+}
+export function setOAuthClientCorsHeaders(c, client) {
+    const origin = c.req.header('origin');
+    c.res.headers.delete('Access-Control-Allow-Origin');
+    c.res.headers.delete('Access-Control-Allow-Credentials');
+    if (!origin) {
+        return;
+    }
+    c.header('Vary', 'Origin', { append: true });
+    if (!client.webOrigins.includes(origin)) {
+        return;
+    }
+    c.header('Access-Control-Allow-Origin', origin);
+}
+async function handleOAuthPreflight(c) {
+    const origin = c.req.header('origin');
+    if (origin && PREFLIGHT_PATHS.includes(c.req.path)) {
+        const { oauthClientService } = c.var.services;
+        if (await oauthClientService.isAllowedWebOrigin(origin)) {
+            c.header('Access-Control-Allow-Origin', origin);
+            c.header('Vary', 'Origin');
+            c.header('Access-Control-Allow-Methods', 'POST');
+            const requestHeaders = c.req.header('access-control-request-headers');
+            if (requestHeaders) {
+                c.header('Access-Control-Allow-Headers', requestHeaders);
+                c.header('Vary', 'Access-Control-Request-Headers', { append: true });
+            }
+        }
+    }
+    return c.body(null, 204);
+}
+function isPublicMetadataPath(path) {
+    return PUBLIC_METADATA_PATHS.includes(path);
+}
+//# sourceMappingURL=cors.js.map

package/dist/routes/oauth/cors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../../src/routes/oauth/cors.ts"],"names":[],"mappings":"AAOA,MAAM,qBAAqB,GAAG;IAC5B,yCAAyC;IACzC,yBAAyB;CAC1B,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;AAE1D,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,CAAkB,EAClB,IAAU;IAEV,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,oBAAoB,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,IAAI,EAAE,CAAC;IAEb,IAAI,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/D,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,kCAAkC,CAAC,CAAC;QACzD,CAAC,CAAC,MAAM,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;IAC/C,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,CAAkB,EAClB,MAAuB;IAEvB,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC;IACpD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,kCAAkC,CAAC,CAAC;IAEzD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;IACT,CAAC;IAED,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACxC,OAAO;IACT,CAAC;IAED,CAAC,CAAC,MAAM,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,CAAkB;IACpD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,MAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,MAAM,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC9C,IAAI,MAAM,kBAAkB,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;YACxD,CAAC,CAAC,MAAM,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;YAChD,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC3B,CAAC,CAAC,MAAM,CAAC,8BAA8B,EAAE,MAAM,CAAC,CAAC;YACjD,MAAM,cAAc,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gCAAgC,CAAC,CAAC;YACtE,IAAI,cAAc,EAAE,CAAC;gBACnB,CAAC,CAAC,MAAM,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC;gBACzD,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,gCAAgC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY;IACxC,OAAO,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC"}

package/dist/routes/oauth/device/get-post.d.ts

@@ -0,0 +1,28 @@
+import type { AppEnv } from '../../../lib/app-env.ts';
+export declare const deviceGetPost: import("hono/hono-base").HonoBase<AppEnv, {
+    "/device": {
+        $get: {
+            input: {};
+            output: {};
+            outputFormat: string;
+            status: import("hono/utils/http-status").StatusCode;
+        };
+    };
+} & {
+    "/device": {
+        $post: {
+            input: {
+                form: {
+                    user_code: string;
+                };
+            };
+            output: {
+                status: string;
+                client_id: string;
+            };
+            outputFormat: "json";
+            status: import("hono/utils/http-status").ContentfulStatusCode;
+        };
+    };
+}, "/", "/device">;
+//# sourceMappingURL=get-post.d.ts.map

package/dist/routes/oauth/device/get-post.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-post.d.ts","sourceRoot":"","sources":["../../../../src/routes/oauth/device/get-post.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAUtD,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;kBAmFvB,CAAC"}

package/dist/routes/oauth/device/get-post.js

@@ -0,0 +1,67 @@
+import { Hono } from 'hono';
+import { describeRoute, validator } from 'hono-openapi';
+import { z } from 'zod';
+import { escapeHtml } from '../../../lib/escape-html.js';
+import { TAGS } from "../../../lib/swagger-tags.js";
+import { verifyAuth } from "../../../middleware/auth.js";
+import { e } from "../../../schemas/error.js";
+const DeviceVerificationRequestBody = z.object({
+    user_code: z.string().min(1).max(64),
+});
+export const deviceGetPost = new Hono()
+    .get('/device', describeRoute({
+    tags: [TAGS.OPENID],
+    summary: 'Device Verification',
+    description: 'User-facing OAuth device verification page',
+    responses: {
+        200: { description: 'Device verification form' },
+    },
+}), verifyAuth({ optional: true }), async (c) => {
+    const userCode = c.req.query('user_code') ?? '';
+    const verifiedUser = c.var.verifiedUser;
+    if (!verifiedUser) {
+        const loginUrl = `/login?return_to=${encodeURIComponent(`/oauth/device?user_code=${encodeURIComponent(userCode)}`)}`;
+        return c.html(`<!doctype html><html><body><p>Sign in to approve the device.</p><p><a href="${escapeHtml(loginUrl)}">Sign in</a></p></body></html>`);
+    }
+    const { mikro, securityService } = c.var.services;
+    let deviceDetails = '';
+    if (userCode) {
+        const userCodeHash = await securityService.hashOpaqueToken('oauth-device-user-code', userCode.toUpperCase());
+        const deviceCode = await mikro.oauthDeviceCode.findPendingByUserCodeHash(userCodeHash);
+        if (deviceCode) {
+            await mikro.em.populate(deviceCode, ['client']);
+            const scopes = deviceCode.scope
+                .map((scope) => `<li>${escapeHtml(scope)}</li>`)
+                .join('');
+            deviceDetails = `<section><h2>${escapeHtml(deviceCode.client.name)}</h2><p>Requested scopes:</p><ul>${scopes}</ul></section>`;
+        }
+    }
+    return c.html(`<!doctype html><html><body>${deviceDetails}<form method="post"><input name="user_code" value="${escapeHtml(userCode)}"><button type="submit">Approve</button></form></body></html>`);
+})
+    .post('/device', describeRoute({
+    tags: [TAGS.OPENID],
+    summary: 'Approve Device Authorization',
+    description: 'Approves a pending OAuth device authorization request',
+    responses: {
+        200: { description: 'Device authorization approved' },
+        400: { description: 'Invalid device user code' },
+    },
+}), validator('form', DeviceVerificationRequestBody), verifyAuth(), async (c) => {
+    const { user_code: userCode } = c.req.valid('form');
+    const { mikro, securityService } = c.var.services;
+    const userCodeHash = await securityService.hashOpaqueToken('oauth-device-user-code', userCode.toUpperCase());
+    const user = c.var.verifiedUser.user;
+    const deviceCode = await mikro.oauthDeviceCode.approvePendingByUserCodeHash({
+        userCodeHash,
+        userSub: user.sub,
+        approvedAt: new Date(),
+    });
+    if (!deviceCode) {
+        throw new e.InvalidDeviceCode.Error();
+    }
+    return c.json({
+        status: 'approved',
+        client_id: deviceCode.client.clientId,
+    });
+});
+//# sourceMappingURL=get-post.js.map

package/dist/routes/oauth/device/get-post.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-post.js","sourceRoot":"","sources":["../../../../src/routes/oauth/device/get-post.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,MAAM,8BAA8B,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,CAAC,EAAE,MAAM,2BAA2B,CAAC;AAE9C,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CACrC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,IAAI,EAAU;KAC5C,GAAG,CACF,SAAS,EACT,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;IACnB,OAAO,EAAE,qBAAqB;IAC9B,WAAW,EAAE,4CAA4C;IACzD,SAAS,EAAE;QACT,GAAG,EAAE,EAAE,WAAW,EAAE,0BAA0B,EAAE;KACjD;CACF,CAAC,EACF,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAC9B,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IAChD,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;IAExC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,QAAQ,GAAG,oBAAoB,kBAAkB,CAAC,2BAA2B,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QACrH,OAAO,CAAC,CAAC,IAAI,CACX,+EAA+E,UAAU,CAAC,QAAQ,CAAC,iCAAiC,CACrI,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClD,IAAI,aAAa,GAAG,EAAE,CAAC;IACvB,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,eAAe,CACxD,wBAAwB,EACxB,QAAQ,CAAC,WAAW,EAAE,CACvB,CAAC;QACF,MAAM,UAAU,GACd,MAAM,KAAK,CAAC,eAAe,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAC;QACtE,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;YAChD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK;iBAC5B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC;iBAC/C,IAAI,CAAC,EAAE,CAAC,CAAC;YACZ,aAAa,GAAG,gBAAgB,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,MAAM,iBAAiB,CAAC;QAChI,CAAC;IACH,CAAC;IAED,OAAO,CAAC,CAAC,IAAI,CACX,8BAA8B,aAAa,sDAAsD,UAAU,CAAC,QAAQ,CAAC,+DAA+D,CACrL,CAAC;AACJ,CAAC,CACF;KACA,IAAI,CACH,SAAS,EACT,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;IACnB,OAAO,EAAE,8BAA8B;IACvC,WAAW,EAAE,uDAAuD;IACpE,SAAS,EAAE;QACT,GAAG,EAAE,EAAE,WAAW,EAAE,+BAA+B,EAAE;QACrD,GAAG,EAAE,EAAE,WAAW,EAAE,0BAA0B,EAAE;KACjD;CACF,CAAC,EACF,SAAS,CAAC,MAAM,EAAE,6BAA6B,CAAC,EAChD,UAAU,EAAE,EACZ,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClD,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,eAAe,CACxD,wBAAwB,EACxB,QAAQ,CAAC,WAAW,EAAE,CACvB,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC;IACrC,MAAM,UAAU,GACd,MAAM,KAAK,CAAC,eAAe,CAAC,4BAA4B,CAAC;QACvD,YAAY;QACZ,OAAO,EAAE,IAAI,CAAC,GAAG;QACjB,UAAU,EAAE,IAAI,IAAI,EAAE;KACvB,CAAC,CAAC;IAEL,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;IACxC,CAAC;IAED,OAAO,CAAC,CAAC,IAAI,CAAC;QACZ,MAAM,EAAE,UAAU;QAClB,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,QAAQ;KACtC,CAAC,CAAC;AACL,CAAC,CACF,CAAC"}

package/dist/routes/oauth/device-authorization/post.d.ts

@@ -0,0 +1,25 @@
+import type { AppEnv } from '../../../lib/app-env.js';
+export declare const deviceAuthorizationPost: import("hono/hono-base").HonoBase<AppEnv, {
+    "/device_authorization": {
+        $post: {
+            input: {
+                form: {
+                    client_id?: import("hono/types").ParsedFormValue | import("hono/types").ParsedFormValue[];
+                    client_secret?: import("hono/types").ParsedFormValue | import("hono/types").ParsedFormValue[];
+                    scope?: import("hono/types").ParsedFormValue | import("hono/types").ParsedFormValue[];
+                };
+            };
+            output: {
+                device_code: string;
+                user_code: string;
+                verification_uri: string;
+                verification_uri_complete: string;
+                expires_in: number;
+                interval: number;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+}, "/", "/device_authorization">;
+//# sourceMappingURL=post.d.ts.map

package/dist/routes/oauth/device-authorization/post.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../../../src/routes/oauth/device-authorization/post.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AA0BtD,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;gCA2FnC,CAAC"}

package/dist/routes/oauth/device-authorization/post.js

@@ -0,0 +1,87 @@
+import { Hono } from 'hono';
+import { describeRoute, validator } from 'hono-openapi';
+import { z } from 'zod';
+import { getRandomBytes, toBase64Url } from '../../../lib/base64url.js';
+import { TAGS } from '../../../lib/swagger-tags.js';
+import { f } from '../../../schemas/field.js';
+import { parseBasicClientCredentials, setBasicClientAuthChallengeIfInvalidClientCredentials, throwInvalidClientCredentialsWithBasicChallenge, } from '../client-auth.js';
+const DEVICE_CODE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:device_code';
+const DEVICE_CODE_EXPIRES_IN = 600;
+const DEVICE_CODE_INTERVAL = 5;
+const DeviceAuthorizationRequestBody = z
+    .object({
+    client_id: f.clientId.optional(),
+    client_secret: f.clientSecret.optional(),
+    scope: f.scope.optional(),
+})
+    .describe('OAuth2 device authorization request payload');
+function createUserCode() {
+    return toBase64Url(getRandomBytes(8)).toUpperCase();
+}
+export const deviceAuthorizationPost = new Hono().post('/device_authorization', describeRoute({
+    tags: [TAGS.OPENID],
+    summary: 'Device Authorization',
+    description: 'OAuth 2.0 Device Authorization endpoint',
+    responses: {
+        200: { description: 'Device authorization response' },
+        401: { description: 'Invalid client credentials' },
+    },
+}), validator('form', DeviceAuthorizationRequestBody), async (c) => {
+    const body = c.req.valid('form');
+    const { config, oauthClientService, securityService, mikro } = c.var.services;
+    const authorizationHeader = c.req.header('authorization');
+    const basicCredentials = parseBasicClientCredentials(authorizationHeader);
+    if (basicCredentials === null) {
+        throwInvalidClientCredentialsWithBasicChallenge(c);
+    }
+    if (basicCredentials && body.client_secret) {
+        throwInvalidClientCredentialsWithBasicChallenge(c);
+    }
+    if (basicCredentials && body.client_id) {
+        if (basicCredentials.clientId !== body.client_id) {
+            throwInvalidClientCredentialsWithBasicChallenge(c);
+        }
+    }
+    const clientId = basicCredentials?.clientId ?? body.client_id;
+    if (!clientId) {
+        throwInvalidClientCredentialsWithBasicChallenge(c);
+    }
+    const client = await oauthClientService.findByClientId(clientId);
+    oauthClientService.validateEnabled(client);
+    oauthClientService.validateGrantType(client, DEVICE_CODE_GRANT_TYPE);
+    const clientSecret = basicCredentials?.clientSecret ?? body.client_secret;
+    try {
+        await oauthClientService.validateClientSecretIfRequired(clientId, clientSecret);
+    }
+    catch (err) {
+        if (authorizationHeader) {
+            setBasicClientAuthChallengeIfInvalidClientCredentials(c, err);
+        }
+        throw err;
+    }
+    const requestedScopes = body.scope ? body.scope.split(' ') : [];
+    oauthClientService.validateScopes(client, requestedScopes);
+    const deviceCode = toBase64Url(getRandomBytes(32));
+    const userCode = createUserCode();
+    const deviceCodeHash = await securityService.hashOpaqueToken('oauth-device-code', deviceCode);
+    const userCodeHash = await securityService.hashOpaqueToken('oauth-device-user-code', userCode);
+    await mikro.oauthDeviceCode.createDeviceAuthorization({
+        clientId: client.id,
+        deviceCodeHash,
+        userCodeHash,
+        scope: requestedScopes,
+        expiresInSeconds: DEVICE_CODE_EXPIRES_IN,
+    });
+    const verificationUri = `${config.server.public_origin}/oauth/device`;
+    const verificationUriComplete = new URL(verificationUri);
+    verificationUriComplete.searchParams.set('user_code', userCode);
+    return c.json({
+        device_code: deviceCode,
+        user_code: userCode,
+        verification_uri: verificationUri,
+        verification_uri_complete: verificationUriComplete.toString(),
+        expires_in: DEVICE_CODE_EXPIRES_IN,
+        interval: DEVICE_CODE_INTERVAL,
+    }, 200);
+});
+//# sourceMappingURL=post.js.map

package/dist/routes/oauth/device-authorization/post.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"post.js","sourceRoot":"","sources":["../../../../src/routes/oauth/device-authorization/post.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,MAAM,8BAA8B,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,2BAA2B,CAAC;AAC9C,OAAO,EACL,2BAA2B,EAC3B,qDAAqD,EACrD,+CAA+C,GAChD,MAAM,mBAAmB,CAAC;AAE3B,MAAM,sBAAsB,GAAG,8CAA8C,CAAC;AAC9E,MAAM,sBAAsB,GAAG,GAAG,CAAC;AACnC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAE/B,MAAM,8BAA8B,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE;IAChC,aAAa,EAAE,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE;IACxC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE;CAC1B,CAAC;KACD,QAAQ,CAAC,6CAA6C,CAAC,CAAC;AAE3D,SAAS,cAAc;IACrB,OAAO,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,IAAI,EAAU,CAAC,IAAI,CAC5D,uBAAuB,EACvB,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;IACnB,OAAO,EAAE,sBAAsB;IAC/B,WAAW,EAAE,yCAAyC;IACtD,SAAS,EAAE;QACT,GAAG,EAAE,EAAE,WAAW,EAAE,+BAA+B,EAAE;QACrD,GAAG,EAAE,EAAE,WAAW,EAAE,4BAA4B,EAAE;KACnD;CACF,CAAC,EACF,SAAS,CAAC,MAAM,EAAE,8BAA8B,CAAC,EACjD,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,eAAe,EAAE,KAAK,EAAE,GAC1D,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IACjB,MAAM,mBAAmB,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC1D,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,mBAAmB,CAAC,CAAC;IAE1E,IAAI,gBAAgB,KAAK,IAAI,EAAE,CAAC;QAC9B,+CAA+C,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,gBAAgB,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3C,+CAA+C,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,gBAAgB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACvC,IAAI,gBAAgB,CAAC,QAAQ,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YACjD,+CAA+C,CAAC,CAAC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,EAAE,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC;IAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,+CAA+C,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACjE,kBAAkB,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IAC3C,kBAAkB,CAAC,iBAAiB,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAErE,MAAM,YAAY,GAAG,gBAAgB,EAAE,YAAY,IAAI,IAAI,CAAC,aAAa,CAAC;IAC1E,IAAI,CAAC;QACH,MAAM,kBAAkB,CAAC,8BAA8B,CACrD,QAAQ,EACR,YAAY,CACb,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,mBAAmB,EAAE,CAAC;YACxB,qDAAqD,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,kBAAkB,CAAC,cAAc,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAE3D,MAAM,UAAU,GAAG,WAAW,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC,eAAe,CAC1D,mBAAmB,EACnB,UAAU,CACX,CAAC;IACF,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,eAAe,CACxD,wBAAwB,EACxB,QAAQ,CACT,CAAC;IAEF,MAAM,KAAK,CAAC,eAAe,CAAC,yBAAyB,CAAC;QACpD,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,cAAc;QACd,YAAY;QACZ,KAAK,EAAE,eAAe;QACtB,gBAAgB,EAAE,sBAAsB;KACzC,CAAC,CAAC;IAEH,MAAM,eAAe,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,eAAe,CAAC;IACtE,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IACzD,uBAAuB,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAEhE,OAAO,CAAC,CAAC,IAAI,CACX;QACE,WAAW,EAAE,UAAU;QACvB,SAAS,EAAE,QAAQ;QACnB,gBAAgB,EAAE,eAAe;QACjC,yBAAyB,EAAE,uBAAuB,CAAC,QAAQ,EAAE;QAC7D,UAAU,EAAE,sBAAsB;QAClC,QAAQ,EAAE,oBAAoB;KAC/B,EACD,GAAG,CACJ,CAAC;AACJ,CAAC,CACF,CAAC"}