@turystack/nestjs-oauth 1.0.1

package/README.md

@@ -0,0 +1,34 @@
+# @turystack/nestjs-oauth
+
+Authorization Code + PKCE authorization server for NestJS. Issues the session as
+httpOnly cookies, so no token ever reaches the page.
+
+## Installation
+
+```bash
+pnpm add @turystack/nestjs-oauth
+```
+
+### Peer dependencies
+
+The host application provides these:
+
+```bash
+pnpm add @nestjs/common @nestjs/core @turystack/nestjs-config @turystack/nestjs-iam @turystack/nestjs-server reflect-metadata zod
+```
+
+## Documentation
+
+Options, API reference and examples:
+
+**https://tury.dev/libs/nestjs-oauth**
+
+## Development
+
+```bash
+pnpm install
+pnpm typecheck
+pnpm check
+pnpm test
+pnpm build
+```

package/dist/cookies.d.ts

@@ -0,0 +1,15 @@
+import type { OAuthCookieOptions, OAuthSession } from './oauth.types.js';
+type CookieWritable = {
+    getHeader?: (name: string) => number | string | string[] | undefined;
+    setHeader: (name: string, value: string | string[]) => unknown;
+};
+type SerializeOptions = OAuthCookieOptions & {
+    maxAge: number;
+};
+export declare function serializeCookie(name: string, value: string, options: SerializeOptions): string;
+export declare function writeSessionCookies(response: CookieWritable, session: OAuthSession, options: OAuthCookieOptions & {
+    refreshMaxAge: number;
+}): void;
+export declare function clearSessionCookies(response: CookieWritable, options: OAuthCookieOptions): void;
+export {};
+//# sourceMappingURL=cookies.d.ts.map

package/dist/cookies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../src/cookies.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAExE,KAAK,cAAc,GAAG;IACrB,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAA;IACpE,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,KAAK,OAAO,CAAA;CAC9D,CAAA;AAED,KAAK,gBAAgB,GAAG,kBAAkB,GAAG;IAE5C,MAAM,EAAE,MAAM,CAAA;CACd,CAAA;AAED,wBAAgB,eAAe,CAC9B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,gBAAgB,GACvB,MAAM,CAqBR;AAyBD,wBAAgB,mBAAmB,CAClC,QAAQ,EAAE,cAAc,EACxB,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,kBAAkB,GAAG;IAC7B,aAAa,EAAE,MAAM,CAAA;CACrB,GACC,IAAI,CAwBN;AAGD,wBAAgB,mBAAmB,CAClC,QAAQ,EAAE,cAAc,EACxB,OAAO,EAAE,kBAAkB,GACzB,IAAI,CAWN"}

package/dist/cookies.js

@@ -0,0 +1,57 @@
+import { DEFAULT_ACCESS_COOKIE, DEFAULT_REFRESH_COOKIE, } from './oauth.constants.js';
+export function serializeCookie(name, value, options) {
+    const parts = [
+        `${name}=${encodeURIComponent(value)}`,
+        `Path=${options.path ?? '/'}`,
+        `Max-Age=${Math.max(0, Math.floor(options.maxAge))}`,
+        `SameSite=${(options.sameSite ?? 'lax').replace(/^./u, (first) => first.toUpperCase())}`,
+        'HttpOnly',
+    ];
+    if (options.domain) {
+        parts.push(`Domain=${options.domain}`);
+    }
+    if (options.secure !== false) {
+        parts.push('Secure');
+    }
+    return parts.join('; ');
+}
+function append(response, cookies) {
+    const existing = response.getHeader?.('Set-Cookie');
+    const previous = Array.isArray(existing)
+        ? existing
+        : typeof existing === 'string'
+            ? [
+                existing,
+            ]
+            : [];
+    response.setHeader('Set-Cookie', [
+        ...previous,
+        ...cookies,
+    ]);
+}
+export function writeSessionCookies(response, session, options) {
+    const accessMaxAge = Math.max(0, Math.floor((session.expiresAt - Date.now()) / 1000));
+    append(response, [
+        serializeCookie(options.accessName ?? DEFAULT_ACCESS_COOKIE, session.accessToken, {
+            ...options,
+            maxAge: accessMaxAge,
+        }),
+        serializeCookie(options.refreshName ?? DEFAULT_REFRESH_COOKIE, session.refreshToken, {
+            ...options,
+            maxAge: options.refreshMaxAge,
+        }),
+    ]);
+}
+export function clearSessionCookies(response, options) {
+    append(response, [
+        serializeCookie(options.accessName ?? DEFAULT_ACCESS_COOKIE, '', {
+            ...options,
+            maxAge: 0,
+        }),
+        serializeCookie(options.refreshName ?? DEFAULT_REFRESH_COOKIE, '', {
+            ...options,
+            maxAge: 0,
+        }),
+    ]);
+}
+//# sourceMappingURL=cookies.js.map

package/dist/cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../src/cookies.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,qBAAqB,EACrB,sBAAsB,GACtB,MAAM,sBAAsB,CAAA;AAa7B,MAAM,UAAU,eAAe,CAC9B,IAAY,EACZ,KAAa,EACb,OAAyB;IAEzB,MAAM,KAAK,GAAG;QACb,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE;QACtC,QAAQ,OAAO,CAAC,IAAI,IAAI,GAAG,EAAE;QAC7B,WAAW,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE;QACpD,YAAY,CAAC,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE;QAIxF,UAAU;KACV,CAAA;IAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IACvC,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACrB,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACxB,CAAC;AAED,SAAS,MAAM,CAAC,QAAwB,EAAE,OAAiB;IAC1D,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAC,YAAY,CAAC,CAAA;IACnD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QACvC,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,OAAO,QAAQ,KAAK,QAAQ;YAC7B,CAAC,CAAC;gBACA,QAAQ;aACR;YACF,CAAC,CAAC,EAAE,CAAA;IAEN,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE;QAChC,GAAG,QAAQ;QACX,GAAG,OAAO;KACV,CAAC,CAAA;AACH,CAAC;AASD,MAAM,UAAU,mBAAmB,CAClC,QAAwB,EACxB,OAAqB,EACrB,OAEC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAC5B,CAAC,EACD,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CACnD,CAAA;IAED,MAAM,CAAC,QAAQ,EAAE;QAChB,eAAe,CACd,OAAO,CAAC,UAAU,IAAI,qBAAqB,EAC3C,OAAO,CAAC,WAAW,EACnB;YACC,GAAG,OAAO;YACV,MAAM,EAAE,YAAY;SACpB,CACD;QACD,eAAe,CACd,OAAO,CAAC,WAAW,IAAI,sBAAsB,EAC7C,OAAO,CAAC,YAAY,EACpB;YACC,GAAG,OAAO;YACV,MAAM,EAAE,OAAO,CAAC,aAAa;SAC7B,CACD;KACD,CAAC,CAAA;AACH,CAAC;AAGD,MAAM,UAAU,mBAAmB,CAClC,QAAwB,EACxB,OAA2B;IAE3B,MAAM,CAAC,QAAQ,EAAE;QAChB,eAAe,CAAC,OAAO,CAAC,UAAU,IAAI,qBAAqB,EAAE,EAAE,EAAE;YAChE,GAAG,OAAO;YACV,MAAM,EAAE,CAAC;SACT,CAAC;QACF,eAAe,CAAC,OAAO,CAAC,WAAW,IAAI,sBAAsB,EAAE,EAAE,EAAE;YAClE,GAAG,OAAO;YACV,MAAM,EAAE,CAAC;SACT,CAAC;KACF,CAAC,CAAA;AACH,CAAC"}

package/dist/exceptions/oauth.exceptions.d.ts

@@ -0,0 +1,8 @@
+import { BadRequestException, UnauthorizedException } from '@nestjs/common';
+export declare class OAuthInvalidRequestException extends BadRequestException {
+    constructor(message?: string);
+}
+export declare class OAuthInvalidGrantException extends UnauthorizedException {
+    constructor(message?: string);
+}
+//# sourceMappingURL=oauth.exceptions.d.ts.map

package/dist/exceptions/oauth.exceptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.exceptions.d.ts","sourceRoot":"","sources":["../../src/exceptions/oauth.exceptions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AAU3E,qBAAa,4BAA6B,SAAQ,mBAAmB;IACpE,YAAY,OAAO,SAAmC,EAGrD;CACD;AAGD,qBAAa,0BAA2B,SAAQ,qBAAqB;IACpE,YAAY,OAAO,SAA8B,EAGhD;CACD"}

package/dist/exceptions/oauth.exceptions.js

@@ -0,0 +1,14 @@
+import { BadRequestException, UnauthorizedException } from '@nestjs/common';
+export class OAuthInvalidRequestException extends BadRequestException {
+    constructor(message = 'Invalid authorization request.') {
+        super(message);
+        this.name = 'OAuthInvalidRequestException';
+    }
+}
+export class OAuthInvalidGrantException extends UnauthorizedException {
+    constructor(message = 'Invalid or expired grant.') {
+        super(message);
+        this.name = 'OAuthInvalidGrantException';
+    }
+}
+//# sourceMappingURL=oauth.exceptions.js.map

package/dist/exceptions/oauth.exceptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.exceptions.js","sourceRoot":"","sources":["../../src/exceptions/oauth.exceptions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AAU3E,MAAM,OAAO,4BAA6B,SAAQ,mBAAmB;IACpE,YAAY,OAAO,GAAG,gCAAgC;QACrD,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAA;IAC3C,CAAC;CACD;AAGD,MAAM,OAAO,0BAA2B,SAAQ,qBAAqB;IACpE,YAAY,OAAO,GAAG,2BAA2B;QAChD,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAA;IACzC,CAAC;CACD"}

package/dist/index.d.ts

@@ -0,0 +1,10 @@
+export { clearSessionCookies, serializeCookie, writeSessionCookies, } from './cookies.js';
+export { DEFAULT_ACCESS_COOKIE, DEFAULT_CODE_TTL, DEFAULT_REFRESH_COOKIE, DEFAULT_REFRESH_TTL, DEFAULT_TRANSACTION_TTL, OAUTH_CODE_STORE, OAUTH_OPTIONS, } from './oauth.constants.js';
+export { OAuthController } from './oauth.controller.js';
+export { OAuthModule } from './oauth.module.js';
+export { OAuthService } from './oauth.service.js';
+export type { OAuthAuthorizationCode, OAuthAuthorizeRequest, OAuthClient, OAuthCodeStore, OAuthCookieOptions, OAuthModuleFactoryOptions, OAuthModuleOptions, OAuthOptions, OAuthSession, OAuthTransaction, } from './oauth.types.js';
+export { CODE_CHALLENGE_METHOD, deriveChallenge, isValidCodeChallenge, isValidCodeVerifier, randomToken, verifyChallenge, } from './pkce.js';
+export { OAuthInvalidGrantException, OAuthInvalidRequestException, } from './exceptions/oauth.exceptions.js';
+export { MemoryOAuthCodeStore } from './store/memory-code-store.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,mBAAmB,EACnB,eAAe,EACf,mBAAmB,GACnB,MAAM,cAAc,CAAA;AACrB,OAAO,EACN,qBAAqB,EACrB,gBAAgB,EAChB,sBAAsB,EACtB,mBAAmB,EACnB,uBAAuB,EACvB,gBAAgB,EAChB,aAAa,GACb,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,YAAY,EACX,sBAAsB,EACtB,qBAAqB,EACrB,WAAW,EACX,cAAc,EACd,kBAAkB,EAClB,yBAAyB,EACzB,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,gBAAgB,GAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACN,qBAAqB,EACrB,eAAe,EACf,oBAAoB,EACpB,mBAAmB,EACnB,WAAW,EACX,eAAe,GACf,MAAM,WAAW,CAAA;AAElB,OAAO,EACN,0BAA0B,EAC1B,4BAA4B,GAC5B,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAA"}

package/dist/index.js

@@ -0,0 +1,9 @@
+export { clearSessionCookies, serializeCookie, writeSessionCookies, } from './cookies.js';
+export { DEFAULT_ACCESS_COOKIE, DEFAULT_CODE_TTL, DEFAULT_REFRESH_COOKIE, DEFAULT_REFRESH_TTL, DEFAULT_TRANSACTION_TTL, OAUTH_CODE_STORE, OAUTH_OPTIONS, } from './oauth.constants.js';
+export { OAuthController } from './oauth.controller.js';
+export { OAuthModule } from './oauth.module.js';
+export { OAuthService } from './oauth.service.js';
+export { CODE_CHALLENGE_METHOD, deriveChallenge, isValidCodeChallenge, isValidCodeVerifier, randomToken, verifyChallenge, } from './pkce.js';
+export { OAuthInvalidGrantException, OAuthInvalidRequestException, } from './exceptions/oauth.exceptions.js';
+export { MemoryOAuthCodeStore } from './store/memory-code-store.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,mBAAmB,EACnB,eAAe,EACf,mBAAmB,GACnB,MAAM,cAAc,CAAA;AACrB,OAAO,EACN,qBAAqB,EACrB,gBAAgB,EAChB,sBAAsB,EACtB,mBAAmB,EACnB,uBAAuB,EACvB,gBAAgB,EAChB,aAAa,GACb,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAajD,OAAO,EACN,qBAAqB,EACrB,eAAe,EACf,oBAAoB,EACpB,mBAAmB,EACnB,WAAW,EACX,eAAe,GACf,MAAM,WAAW,CAAA;AAElB,OAAO,EACN,0BAA0B,EAC1B,4BAA4B,GAC5B,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAA"}

package/dist/oauth.constants.d.ts

@@ -0,0 +1,8 @@
+export declare const OAUTH_OPTIONS: unique symbol;
+export declare const OAUTH_CODE_STORE: unique symbol;
+export declare const DEFAULT_CODE_TTL = 60;
+export declare const DEFAULT_TRANSACTION_TTL = 600;
+export declare const DEFAULT_REFRESH_TTL = 604800;
+export declare const DEFAULT_ACCESS_COOKIE = "session";
+export declare const DEFAULT_REFRESH_COOKIE = "refresh";
+//# sourceMappingURL=oauth.constants.d.ts.map

package/dist/oauth.constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.constants.d.ts","sourceRoot":"","sources":["../src/oauth.constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,aAAa,eAA0B,CAAA;AACpD,eAAO,MAAM,gBAAgB,eAA6B,CAAA;AAG1D,eAAO,MAAM,gBAAgB,KAAK,CAAA;AAGlC,eAAO,MAAM,uBAAuB,MAAM,CAAA;AAG1C,eAAO,MAAM,mBAAmB,SAAS,CAAA;AAEzC,eAAO,MAAM,qBAAqB,YAAY,CAAA;AAC9C,eAAO,MAAM,sBAAsB,YAAY,CAAA"}

package/dist/oauth.constants.js

@@ -0,0 +1,8 @@
+export const OAUTH_OPTIONS = Symbol('OAUTH_OPTIONS');
+export const OAUTH_CODE_STORE = Symbol('OAUTH_CODE_STORE');
+export const DEFAULT_CODE_TTL = 60;
+export const DEFAULT_TRANSACTION_TTL = 600;
+export const DEFAULT_REFRESH_TTL = 604800;
+export const DEFAULT_ACCESS_COOKIE = 'session';
+export const DEFAULT_REFRESH_COOKIE = 'refresh';
+//# sourceMappingURL=oauth.constants.js.map

package/dist/oauth.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.constants.js","sourceRoot":"","sources":["../src/oauth.constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,eAAe,CAAC,CAAA;AACpD,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAA;AAG1D,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAA;AAGlC,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAA;AAG1C,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAA;AAEzC,MAAM,CAAC,MAAM,qBAAqB,GAAG,SAAS,CAAA;AAC9C,MAAM,CAAC,MAAM,sBAAsB,GAAG,SAAS,CAAA"}

package/dist/oauth.controller.d.ts

@@ -0,0 +1,52 @@
+import { z } from 'zod';
+import { OAuthService } from './oauth.service.js';
+import type { OAuthOptions } from './oauth.types.js';
+declare const authorizeQuery: z.ZodObject<{
+    client_id: z.ZodString;
+    code_challenge: z.ZodString;
+    code_challenge_method: z.ZodString;
+    redirect_uri: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+    state: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+declare const transactionQuery: z.ZodObject<{
+    tx: z.ZodString;
+}, z.core.$strip>;
+declare const transactionResponse: z.ZodObject<{
+    clientId: z.ZodString;
+    redirectUri: z.ZodString;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+declare const tokenBody: z.ZodObject<{
+    client_id: z.ZodString;
+    code: z.ZodString;
+    code_verifier: z.ZodString;
+    redirect_uri: z.ZodString;
+}, z.core.$strip>;
+declare const sessionResponse: z.ZodObject<{
+    expiresAt: z.ZodNumber;
+}, z.core.$strip>;
+type ResponseLike = {
+    getHeader?: (name: string) => number | string | string[] | undefined;
+    redirect: (url: string) => void;
+    setHeader: (name: string, value: string | string[]) => unknown;
+    status: (code: number) => ResponseLike;
+    send: (body?: unknown) => unknown;
+};
+type RequestLike = {
+    cookies?: Record<string, string | undefined>;
+    headers?: Record<string, string | string[] | undefined>;
+};
+export declare class OAuthController {
+    private readonly options;
+    private readonly oauth;
+    constructor(options: OAuthOptions, oauth: OAuthService);
+    authorize(query: z.infer<typeof authorizeQuery>, response: ResponseLike): Promise<void>;
+    transaction(query: z.infer<typeof transactionQuery>): Promise<z.infer<typeof transactionResponse>>;
+    token(body: z.infer<typeof tokenBody>, response: ResponseLike): Promise<z.infer<typeof sessionResponse>>;
+    refresh(request: RequestLike, response: ResponseLike): Promise<z.infer<typeof sessionResponse>>;
+    signOut(response: ResponseLike): Promise<void>;
+    private deliver;
+}
+export {};
+//# sourceMappingURL=oauth.controller.d.ts.map

package/dist/oauth.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.controller.d.ts","sourceRoot":"","sources":["../src/oauth.controller.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAQvB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,KAAK,EAAE,YAAY,EAAgB,MAAM,kBAAkB,CAAA;AAIlE,QAAA,MAAM,cAAc;;;;;;;iBAOlB,CAAA;AAEF,QAAA,MAAM,gBAAgB;;iBAEpB,CAAA;AAEF,QAAA,MAAM,mBAAmB;;;;iBAIvB,CAAA;AAEF,QAAA,MAAM,SAAS;;;;;iBAKb,CAAA;AAUF,QAAA,MAAM,eAAe;;iBAEnB,CAAA;AAEF,KAAK,YAAY,GAAG;IACnB,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAA;IACpE,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;IAC/B,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,KAAK,OAAO,CAAA;IAC9D,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,YAAY,CAAA;IACtC,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,KAAK,OAAO,CAAA;CACjC,CAAA;AAED,KAAK,WAAW,GAAG;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAA;CACvD,CAAA;AAyCD,qBAIa,eAAe;IAG1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAExB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAJvB,YAEkB,OAAO,EAAE,YAAY,EAErB,KAAK,EAAE,YAAY,EACjC;IAYE,SAAS,CACL,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,EACvC,QAAQ,EAAE,YAAY,GAC3B,OAAO,CAAC,IAAI,CAAC,CAmBf;IAeK,WAAW,CACP,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,GAC9C,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC,CAY9C;IAeK,KAAK,CACF,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,EAIvC,QAAQ,EAAE,YAAY,GACpB,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC,CAS1C;IAYK,OAAO,CACL,OAAO,EAAE,WAAW,EAI3B,QAAQ,EAAE,YAAY,GACpB,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC,CAW1C;IAcK,OAAO,CAIZ,QAAQ,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC,CAEf;IAED,OAAO,CAAC,OAAO;CAef"}

package/dist/oauth.controller.js

@@ -0,0 +1,236 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Body, Inject, Query, Req, Res } from '@nestjs/common';
+import { Controller, Route } from '@turystack/nestjs-server';
+import { z } from 'zod';
+import { clearSessionCookies, writeSessionCookies } from './cookies.js';
+import { DEFAULT_REFRESH_COOKIE, DEFAULT_REFRESH_TTL, OAUTH_OPTIONS, } from './oauth.constants.js';
+import { OAuthService } from './oauth.service.js';
+import { OAuthInvalidGrantException } from './exceptions/oauth.exceptions.js';
+const authorizeQuery = z.object({
+    client_id: z.string().min(1),
+    code_challenge: z.string().min(1),
+    code_challenge_method: z.string().min(1),
+    redirect_uri: z.string().url(),
+    scope: z.string().optional(),
+    state: z.string().optional(),
+});
+const transactionQuery = z.object({
+    tx: z.string().min(1),
+});
+const transactionResponse = z.object({
+    clientId: z.string(),
+    redirectUri: z.string(),
+    scopes: z.array(z.string()).optional(),
+});
+const tokenBody = z.object({
+    client_id: z.string().min(1),
+    code: z.string().min(1),
+    code_verifier: z.string().min(1),
+    redirect_uri: z.string().url(),
+});
+const sessionResponse = z.object({
+    expiresAt: z.number(),
+});
+function readCookie(request, name) {
+    const parsed = request.cookies?.[name];
+    if (parsed) {
+        return parsed;
+    }
+    const header = request.headers?.cookie;
+    if (typeof header !== 'string') {
+        return undefined;
+    }
+    for (const part of header.split(';')) {
+        const separator = part.indexOf('=');
+        if (separator === -1) {
+            continue;
+        }
+        if (part.slice(0, separator).trim() !== name) {
+            continue;
+        }
+        const value = part.slice(separator + 1).trim();
+        return value.length > 0 ? decodeURIComponent(value) : undefined;
+    }
+    return undefined;
+}
+let OAuthController = class OAuthController {
+    options;
+    oauth;
+    constructor(options, oauth) {
+        this.options = options;
+        this.oauth = oauth;
+    }
+    async authorize(query, response) {
+        const target = await this.oauth.authorize({
+            clientId: query.client_id,
+            codeChallenge: query.code_challenge,
+            codeChallengeMethod: query.code_challenge_method,
+            redirectUri: query.redirect_uri,
+            ...(query.scope === undefined
+                ? {}
+                : {
+                    scope: query.scope,
+                }),
+            ...(query.state === undefined
+                ? {}
+                : {
+                    state: query.state,
+                }),
+        });
+        response.redirect(target);
+    }
+    async transaction(query) {
+        const transaction = await this.oauth.readTransaction(query.tx);
+        return {
+            clientId: transaction.clientId,
+            redirectUri: transaction.redirectUri,
+            ...(transaction.scopes === undefined
+                ? {}
+                : {
+                    scopes: transaction.scopes,
+                }),
+        };
+    }
+    async token(body, response) {
+        const session = await this.oauth.exchangeCode({
+            clientId: body.client_id,
+            code: body.code,
+            codeVerifier: body.code_verifier,
+            redirectUri: body.redirect_uri,
+        });
+        return this.deliver(response, session);
+    }
+    async refresh(request, response) {
+        const refreshToken = readCookie(request, this.options.cookie?.refreshName ?? DEFAULT_REFRESH_COOKIE);
+        if (!refreshToken) {
+            throw new OAuthInvalidGrantException('No session to refresh.');
+        }
+        return this.deliver(response, await this.oauth.refresh(refreshToken));
+    }
+    async signOut(response) {
+        clearSessionCookies(response, this.options.cookie ?? {});
+    }
+    deliver(response, session) {
+        writeSessionCookies(response, session, {
+            ...(this.options.cookie ?? {}),
+            refreshMaxAge: this.options.refreshTtl ?? DEFAULT_REFRESH_TTL,
+        });
+        return {
+            expiresAt: session.expiresAt,
+        };
+    }
+};
+__decorate([
+    Route({
+        description: 'Validates the client, the redirect target and the PKCE challenge, then sends the browser to the sign-in application.',
+        method: 'GET',
+        parameters: {
+            query: authorizeQuery,
+        },
+        path: 'authorize',
+        summary: 'Start an authorization',
+    }),
+    __param(0, Query()),
+    __param(1, Res()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], OAuthController.prototype, "authorize", null);
+__decorate([
+    Route({
+        description: 'What the sign-in application shows: which client is asking, and where the browser goes next.',
+        method: 'GET',
+        parameters: {
+            query: transactionQuery,
+        },
+        path: 'transaction',
+        responses: {
+            200: transactionResponse,
+        },
+        summary: 'Read a pending authorization',
+    }),
+    __param(0, Query()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], OAuthController.prototype, "transaction", null);
+__decorate([
+    Route({
+        description: 'Exchanges a single-use authorization code for a session, delivered as httpOnly cookies.',
+        method: 'POST',
+        parameters: {
+            body: tokenBody,
+        },
+        path: 'token',
+        responses: {
+            200: sessionResponse,
+        },
+        summary: 'Exchange an authorization code',
+    }),
+    __param(0, Body()),
+    __param(1, Res({
+        passthrough: true,
+    })),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], OAuthController.prototype, "token", null);
+__decorate([
+    Route({
+        description: 'Rotates the refresh cookie into a new session. The browser sends the cookie on its own.',
+        method: 'POST',
+        path: 'refresh',
+        responses: {
+            200: sessionResponse,
+        },
+        summary: 'Refresh the session',
+    }),
+    __param(0, Req()),
+    __param(1, Res({
+        passthrough: true,
+    })),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], OAuthController.prototype, "refresh", null);
+__decorate([
+    Route({
+        description: 'Expires both session cookies in the browser. Signing out has to reach the browser, not only the server.',
+        method: 'POST',
+        path: 'sign-out',
+        responses: {
+            204: {
+                description: 'The session cookies were expired.',
+            },
+        },
+        summary: 'Sign out',
+    }),
+    __param(0, Res({
+        passthrough: true,
+    })),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], OAuthController.prototype, "signOut", null);
+OAuthController = __decorate([
+    Controller({
+        prefix: 'auth',
+        tag: 'Auth',
+    }),
+    __param(0, Inject(OAUTH_OPTIONS)),
+    __param(1, Inject(OAuthService)),
+    __metadata("design:paramtypes", [Object, OAuthService])
+], OAuthController);
+export { OAuthController };
+//# sourceMappingURL=oauth.controller.js.map

package/dist/oauth.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.controller.js","sourceRoot":"","sources":["../src/oauth.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAA;AAC9D,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAA;AAC5D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AACvE,OAAO,EACN,sBAAsB,EACtB,mBAAmB,EACnB,aAAa,GACb,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAGjD,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAA;AAE7E,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAA;AAEF,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACrB,CAAC,CAAA;AAEF,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAA;AAEF,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;CAC9B,CAAC,CAAA;AAUF,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACrB,CAAC,CAAA;AAeF,SAAS,UAAU,CAAC,OAAoB,EAAE,IAAY;IACrD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAA;IAEtC,IAAI,MAAM,EAAE,CAAC;QACZ,OAAO,MAAM,CAAA;IACd,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,MAAM,CAAA;IAEtC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,SAAS,CAAA;IACjB,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAEnC,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;YACtB,SAAQ;QACT,CAAC;QAED,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAC9C,SAAQ;QACT,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAE9C,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAChE,CAAC;IAED,OAAO,SAAS,CAAA;AACjB,CAAC;AAaM,IAAM,eAAe,GAArB,MAAM,eAAe;IAGT,OAAO;IAEP,KAAK;IAJvB,YAEkB,OAAqB,EAErB,KAAmB;uBAFnB,OAAO;qBAEP,KAAK;IACpB,CAAC;IAYE,AAAN,KAAK,CAAC,SAAS,CACL,KAAqC,EACvC,QAAsB;QAE7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;YACzC,QAAQ,EAAE,KAAK,CAAC,SAAS;YACzB,aAAa,EAAE,KAAK,CAAC,cAAc;YACnC,mBAAmB,EAAE,KAAK,CAAC,qBAAqB;YAChD,WAAW,EAAE,KAAK,CAAC,YAAY;YAC/B,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS;gBAC5B,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC;oBACA,KAAK,EAAE,KAAK,CAAC,KAAK;iBAClB,CAAC;YACJ,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS;gBAC5B,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC;oBACA,KAAK,EAAE,KAAK,CAAC,KAAK;iBAClB,CAAC;SACJ,CAAC,CAAA;QAEF,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC1B,CAAC;IAeK,AAAN,KAAK,CAAC,WAAW,CACP,KAAuC;QAEhD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QAE9D,OAAO;YACN,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,WAAW,EAAE,WAAW,CAAC,WAAW;YACpC,GAAG,CAAC,WAAW,CAAC,MAAM,KAAK,SAAS;gBACnC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC;oBACA,MAAM,EAAE,WAAW,CAAC,MAAM;iBAC1B,CAAC;SACJ,CAAA;IACF,CAAC;IAeK,AAAN,KAAK,CAAC,KAAK,CACF,IAA+B,EAIvC,QAAsB;QAEtB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;YAC7C,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,WAAW,EAAE,IAAI,CAAC,YAAY;SAC9B,CAAC,CAAA;QAEF,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IACvC,CAAC;IAYK,AAAN,KAAK,CAAC,OAAO,CACL,OAAoB,EAI3B,QAAsB;QAEtB,MAAM,YAAY,GAAG,UAAU,CAC9B,OAAO,EACP,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,IAAI,sBAAsB,CAC1D,CAAA;QAED,IAAI,CAAC,YAAY,EAAE,CAAC;YACnB,MAAM,IAAI,0BAA0B,CAAC,wBAAwB,CAAC,CAAA;QAC/D,CAAC;QAED,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAA;IACtE,CAAC;IAcK,AAAN,KAAK,CAAC,OAAO,CAIZ,QAAsB;QAEtB,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAA;IACzD,CAAC;IAEO,OAAO,CACd,QAAsB,EACtB,OAAqB;QAIrB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE;YACtC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;YAC9B,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,mBAAmB;SAC7D,CAAC,CAAA;QAEF,OAAO;YACN,SAAS,EAAE,OAAO,CAAC,SAAS;SAC5B,CAAA;IACF,CAAC;CACD,CAAA;AApJM;IAVL,KAAK,CAAC;QACN,WAAW,EACV,sHAAsH;QACvH,MAAM,EAAE,KAAK;QACb,UAAU,EAAE;YACX,KAAK,EAAE,cAAc;SACrB;QACD,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,wBAAwB;KACjC,CAAC;IAEA,WAAA,KAAK,EAAE,CAAA;IACP,WAAA,GAAG,EAAE,CAAA;;;;gDAoBN;AAeK;IAbL,KAAK,CAAC;QACN,WAAW,EACV,8FAA8F;QAC/F,MAAM,EAAE,KAAK;QACb,UAAU,EAAE;YACX,KAAK,EAAE,gBAAgB;SACvB;QACD,IAAI,EAAE,aAAa;QACnB,SAAS,EAAE;YACV,GAAG,EAAE,mBAAmB;SACxB;QACD,OAAO,EAAE,8BAA8B;KACvC,CAAC;IAEA,WAAA,KAAK,EAAE,CAAA;;;;kDAaR;AAeK;IAbL,KAAK,CAAC;QACN,WAAW,EACV,yFAAyF;QAC1F,MAAM,EAAE,MAAM;QACd,UAAU,EAAE;YACX,IAAI,EAAE,SAAS;SACf;QACD,IAAI,EAAE,OAAO;QACb,SAAS,EAAE;YACV,GAAG,EAAE,eAAe;SACpB;QACD,OAAO,EAAE,gCAAgC;KACzC,CAAC;IAEA,WAAA,IAAI,EAAE,CAAA;IACN,WAAA,GAAG,CAAC;QACJ,WAAW,EAAE,IAAI;KACjB,CAAC,CAAA;;;;4CAWF;AAYK;IAVL,KAAK,CAAC;QACN,WAAW,EACV,yFAAyF;QAC1F,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,SAAS;QACf,SAAS,EAAE;YACV,GAAG,EAAE,eAAe;SACpB;QACD,OAAO,EAAE,qBAAqB;KAC9B,CAAC;IAEA,WAAA,GAAG,EAAE,CAAA;IACL,WAAA,GAAG,CAAC;QACJ,WAAW,EAAE,IAAI;KACjB,CAAC,CAAA;;;;8CAaF;AAcK;IAZL,KAAK,CAAC;QACN,WAAW,EACV,yGAAyG;QAC1G,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE;YACV,GAAG,EAAE;gBACJ,WAAW,EAAE,mCAAmC;aAChD;SACD;QACD,OAAO,EAAE,UAAU;KACnB,CAAC;IAEA,WAAA,GAAG,CAAC;QACJ,WAAW,EAAE,IAAI;KACjB,CAAC,CAAA;;;;8CAIF;AArJW,eAAe;IAJ3B,UAAU,CAAC;QACX,MAAM,EAAE,MAAM;QACd,GAAG,EAAE,MAAM;KACX,CAAC;IAGC,WAAA,MAAM,CAAC,aAAa,CAAC,CAAA;IAErB,WAAA,MAAM,CAAC,YAAY,CAAC,CAAA;6CACG,YAAY;GALzB,eAAe,CAsK3B"}

package/dist/oauth.module.d.ts

@@ -0,0 +1,9 @@
+import { type DynamicModule } from '@nestjs/common';
+import { ConfigService } from '@turystack/nestjs-config';
+import type { OAuthModuleFactoryOptions, OAuthModuleOptions } from './oauth.types.js';
+export declare class OAuthModule {
+    static register(options: OAuthModuleOptions | ((config: ConfigService) => OAuthModuleFactoryOptions)): DynamicModule;
+    private static _resolveOptions;
+    private static _resolveProviders;
+}
+//# sourceMappingURL=oauth.module.d.ts.map

package/dist/oauth.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.module.d.ts","sourceRoot":"","sources":["../src/oauth.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAyB,MAAM,gBAAgB,CAAA;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAKxD,OAAO,KAAK,EACX,yBAAyB,EACzB,kBAAkB,EAElB,MAAM,kBAAkB,CAAA;AAMzB,qBACa,WAAW;IAUvB,MAAM,CAAC,QAAQ,CACd,OAAO,EACJ,kBAAkB,GAClB,CAAC,CAAC,MAAM,EAAE,aAAa,KAAK,yBAAyB,CAAC,GACvD,aAAa,CAef;IAED,OAAO,CAAC,MAAM,CAAC,eAAe;IAmB9B,OAAO,CAAC,MAAM,CAAC,iBAAiB;CA2ChC"}

package/dist/oauth.module.js

@@ -0,0 +1,81 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var OAuthModule_1;
+import { Module } from '@nestjs/common';
+import { ConfigService } from '@turystack/nestjs-config';
+import { OAUTH_CODE_STORE, OAUTH_OPTIONS } from './oauth.constants.js';
+import { OAuthController } from './oauth.controller.js';
+import { OAuthService } from './oauth.service.js';
+import { MemoryOAuthCodeStore } from './store/memory-code-store.js';
+const OAUTH_RESOLVED_OPTIONS = Symbol('OAUTH_RESOLVED_OPTIONS');
+let OAuthModule = OAuthModule_1 = class OAuthModule {
+    static register(options) {
+        return {
+            controllers: [
+                OAuthController,
+            ],
+            exports: [
+                OAUTH_OPTIONS,
+                OAUTH_CODE_STORE,
+                OAuthService,
+            ],
+            global: true,
+            imports: typeof options === 'function' ? [] : (options.imports ?? []),
+            module: OAuthModule_1,
+            providers: OAuthModule_1._resolveProviders(options),
+        };
+    }
+    static _resolveOptions(optionsOrFactory, config) {
+        if (typeof optionsOrFactory !== 'function') {
+            return optionsOrFactory;
+        }
+        if (!config) {
+            throw new Error('[OAuthModule] register((config) => ...) requires ConfigModule (@turystack/nestjs-config) to be registered');
+        }
+        return optionsOrFactory(config);
+    }
+    static _resolveProviders(optionsOrFactory) {
+        const storeProvider = typeof optionsOrFactory !== 'function' && optionsOrFactory.store
+            ? {
+                provide: OAUTH_CODE_STORE,
+                useClass: optionsOrFactory.store,
+            }
+            : {
+                provide: OAUTH_CODE_STORE,
+                useClass: MemoryOAuthCodeStore,
+            };
+        return [
+            {
+                inject: [
+                    {
+                        optional: true,
+                        token: ConfigService,
+                    },
+                ],
+                provide: OAUTH_RESOLVED_OPTIONS,
+                useFactory: (config) => OAuthModule_1._resolveOptions(optionsOrFactory, config),
+            },
+            {
+                inject: [
+                    OAUTH_RESOLVED_OPTIONS,
+                ],
+                provide: OAUTH_OPTIONS,
+                useFactory: (options) => {
+                    const { imports, store, ...oauthOptions } = options;
+                    return oauthOptions;
+                },
+            },
+            storeProvider,
+            OAuthService,
+        ];
+    }
+};
+OAuthModule = OAuthModule_1 = __decorate([
+    Module({})
+], OAuthModule);
+export { OAuthModule };
+//# sourceMappingURL=oauth.module.js.map

package/dist/oauth.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.module.js","sourceRoot":"","sources":["../src/oauth.module.ts"],"names":[],"mappings":";;;;;;;AAAA,OAAO,EAAsB,MAAM,EAAiB,MAAM,gBAAgB,CAAA;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAExD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAOjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAA;AAEnE,MAAM,sBAAsB,GAAG,MAAM,CAAC,wBAAwB,CAAC,CAAA;AAGxD,IAAM,WAAW,mBAAjB,MAAM,WAAW;IAUhB,AAAP,MAAM,CAAC,QAAQ,CACd,OAEyD;QAEzD,OAAO;YACN,WAAW,EAAE;gBACZ,eAAe;aACf;YACD,OAAO,EAAE;gBACR,aAAa;gBACb,gBAAgB;gBAChB,YAAY;aACZ;YACD,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;YACrE,MAAM,eAAa;YACnB,SAAS,EAAE,cAAY,iBAAiB,CAAC,OAAO,CAAC;SACjD,CAAA;IACF,CAAC;IAEO,MAAM,CAAC,eAAe,CAC7B,gBAEyD,EACzD,MAAsB;QAEtB,IAAI,OAAO,gBAAgB,KAAK,UAAU,EAAE,CAAC;YAC5C,OAAO,gBAAgB,CAAA;QACxB,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACd,2GAA2G,CAC3G,CAAA;QACF,CAAC;QAED,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAA;IAChC,CAAC;IAEc,AAAP,MAAM,CAAC,iBAAiB,CAC/B,gBAEyD;QAEzD,MAAM,aAAa,GAClB,OAAO,gBAAgB,KAAK,UAAU,IAAI,gBAAgB,CAAC,KAAK;YAC/D,CAAC,CAAC;gBACA,OAAO,EAAE,gBAAgB;gBACzB,QAAQ,EAAE,gBAAgB,CAAC,KAAK;aAChC;YACF,CAAC,CAAC;gBACA,OAAO,EAAE,gBAAgB;gBACzB,QAAQ,EAAE,oBAAoB;aAC9B,CAAA;QAEJ,OAAO;YACN;gBACC,MAAM,EAAE;oBACP;wBACC,QAAQ,EAAE,IAAI;wBACd,KAAK,EAAE,aAAa;qBACpB;iBACD;gBACD,OAAO,EAAE,sBAAsB;gBAC/B,UAAU,EAAE,CAAC,MAAsB,EAAE,EAAE,CACtC,cAAY,eAAe,CAAC,gBAAgB,EAAE,MAAM,CAAC;aACtD;YACD;gBACC,MAAM,EAAE;oBACP,sBAAsB;iBACtB;gBACD,OAAO,EAAE,aAAa;gBACtB,UAAU,EAAE,CAAC,OAA2B,EAAgB,EAAE;oBACzD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,YAAY,EAAE,GAAG,OAAO,CAAA;oBAEnD,OAAO,YAAY,CAAA;gBACpB,CAAC;aACD;YACD,aAAa;YACb,YAAY;SACZ,CAAA;IACF,CAAC;CACD,CAAA;AA7FY,WAAW;IADvB,MAAM,CAAC,EAAE,CAAC;GACE,WAAW,CA6FvB"}

package/dist/oauth.service.d.ts

@@ -0,0 +1,23 @@
+import { IamTokenService } from '@turystack/nestjs-iam';
+import type { OAuthAuthorizeRequest, OAuthCodeStore, OAuthOptions, OAuthSession, OAuthTransaction } from './oauth.types.js';
+export declare class OAuthService {
+    private readonly options;
+    private readonly store;
+    private readonly tokens;
+    constructor(options: OAuthOptions, store: OAuthCodeStore, tokens: IamTokenService);
+    authorize(request: OAuthAuthorizeRequest): Promise<string>;
+    readTransaction(id: string): Promise<OAuthTransaction>;
+    completeAuthorization(transactionId: string, userId: string, options?: {
+        workspaceId?: string;
+    }): Promise<string>;
+    exchangeCode(input: {
+        clientId: string;
+        code: string;
+        codeVerifier: string;
+        redirectUri: string;
+    }): Promise<OAuthSession>;
+    refresh(refreshToken: string): Promise<OAuthSession>;
+    private issue;
+    private findClient;
+}
+//# sourceMappingURL=oauth.service.d.ts.map

package/dist/oauth.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.service.d.ts","sourceRoot":"","sources":["../src/oauth.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAQvD,OAAO,KAAK,EACX,qBAAqB,EAErB,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,MAAM,kBAAkB,CAAA;AAuBzB,qBACa,YAAY;IAGvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAExB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAKtB,OAAO,CAAC,QAAQ,CAAC,MAAM;IATxB,YAEkB,OAAO,EAAE,YAAY,EAErB,KAAK,EAAE,cAAc,EAKrB,MAAM,EAAE,eAAe,EACrC;IASE,SAAS,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CA6C/D;IAGK,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAU3D;IAMK,qBAAqB,CAC1B,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;QACT,WAAW,CAAC,EAAE,MAAM,CAAA;KACpB,GACC,OAAO,CAAC,MAAM,CAAC,CA6BjB;IAQK,YAAY,CAAC,KAAK,EAAE;QACzB,QAAQ,EAAE,MAAM,CAAA;QAChB,IAAI,EAAE,MAAM,CAAA;QACZ,YAAY,EAAE,MAAM,CAAA;QACpB,WAAW,EAAE,MAAM,CAAA;KACnB,GAAG,OAAO,CAAC,YAAY,CAAC,CAmBxB;IAGK,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAKzD;YAEa,KAAK;IAoBnB,OAAO,CAAC,UAAU;CAWlB"}

package/dist/oauth.service.js

@@ -0,0 +1,138 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from '@nestjs/common';
+import { IamTokenService } from '@turystack/nestjs-iam';
+import { DEFAULT_CODE_TTL, DEFAULT_TRANSACTION_TTL, OAUTH_CODE_STORE, OAUTH_OPTIONS, } from './oauth.constants.js';
+import { CODE_CHALLENGE_METHOD, isValidCodeChallenge, randomToken, verifyChallenge, } from './pkce.js';
+import { OAuthInvalidGrantException, OAuthInvalidRequestException, } from './exceptions/oauth.exceptions.js';
+let OAuthService = class OAuthService {
+    options;
+    store;
+    tokens;
+    constructor(options, store, tokens) {
+        this.options = options;
+        this.store = store;
+        this.tokens = tokens;
+    }
+    async authorize(request) {
+        if (request.codeChallengeMethod !== CODE_CHALLENGE_METHOD) {
+            throw new OAuthInvalidRequestException(`code_challenge_method must be ${CODE_CHALLENGE_METHOD}`);
+        }
+        if (!isValidCodeChallenge(request.codeChallenge)) {
+            throw new OAuthInvalidRequestException('code_challenge is malformed');
+        }
+        const client = this.findClient(request.clientId);
+        if (!client.redirectUris.includes(request.redirectUri)) {
+            throw new OAuthInvalidRequestException('redirect_uri is not registered for this client');
+        }
+        const transaction = {
+            clientId: client.id,
+            codeChallenge: request.codeChallenge,
+            expiresAt: Date.now() +
+                (this.options.transactionTtl ?? DEFAULT_TRANSACTION_TTL) * 1000,
+            id: randomToken(),
+            redirectUri: request.redirectUri,
+            ...(request.state === undefined
+                ? {}
+                : {
+                    state: request.state,
+                }),
+            ...(request.scope
+                ? {
+                    scopes: request.scope.split(' ').filter(Boolean),
+                }
+                : {}),
+        };
+        await this.store.saveTransaction(transaction);
+        const url = new URL(this.options.signInUrl);
+        url.searchParams.set('tx', transaction.id);
+        return url.toString();
+    }
+    async readTransaction(id) {
+        const transaction = await this.store.readTransaction(id);
+        if (!transaction) {
+            throw new OAuthInvalidGrantException('This sign-in request expired. Start again from the application.');
+        }
+        return transaction;
+    }
+    async completeAuthorization(transactionId, userId, options) {
+        const transaction = await this.readTransaction(transactionId);
+        const code = randomToken();
+        await this.store.saveCode({
+            clientId: transaction.clientId,
+            code,
+            codeChallenge: transaction.codeChallenge,
+            expiresAt: Date.now() + (this.options.codeTtl ?? DEFAULT_CODE_TTL) * 1000,
+            redirectUri: transaction.redirectUri,
+            userId,
+            ...(options?.workspaceId === undefined
+                ? {}
+                : {
+                    workspaceId: options.workspaceId,
+                }),
+        });
+        await this.store.deleteTransaction(transaction.id);
+        const url = new URL(transaction.redirectUri);
+        url.searchParams.set('code', code);
+        if (transaction.state !== undefined) {
+            url.searchParams.set('state', transaction.state);
+        }
+        return url.toString();
+    }
+    async exchangeCode(input) {
+        const grant = await this.store.takeCode(input.code);
+        if (!grant) {
+            throw new OAuthInvalidGrantException();
+        }
+        if (grant.clientId !== input.clientId ||
+            grant.redirectUri !== input.redirectUri) {
+            throw new OAuthInvalidGrantException();
+        }
+        if (!verifyChallenge(input.codeVerifier, grant.codeChallenge)) {
+            throw new OAuthInvalidGrantException();
+        }
+        return this.issue(grant.userId, grant.workspaceId);
+    }
+    async refresh(refreshToken) {
+        const { userId, workspaceId } = await this.tokens.verifyRefreshToken(refreshToken);
+        return this.issue(userId, workspaceId);
+    }
+    async issue(userId, workspaceId) {
+        const pair = await this.tokens.issueTokens(userId, workspaceId === undefined
+            ? undefined
+            : {
+                workspaceId,
+            });
+        return {
+            accessToken: pair.accessToken,
+            expiresAt: Date.now() + pair.expiresIn * 1000,
+            refreshToken: pair.refreshToken,
+        };
+    }
+    findClient(clientId) {
+        const client = this.options.clients.find((candidate) => candidate.id === clientId);
+        if (!client) {
+            throw new OAuthInvalidRequestException('Unknown client_id');
+        }
+        return client;
+    }
+};
+OAuthService = __decorate([
+    Injectable(),
+    __param(0, Inject(OAUTH_OPTIONS)),
+    __param(1, Inject(OAUTH_CODE_STORE)),
+    __param(2, Inject(IamTokenService)),
+    __metadata("design:paramtypes", [Object, Object, IamTokenService])
+], OAuthService);
+export { OAuthService };
+//# sourceMappingURL=oauth.service.js.map

package/dist/oauth.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.service.js","sourceRoot":"","sources":["../src/oauth.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvD,OAAO,EACN,gBAAgB,EAChB,uBAAuB,EACvB,gBAAgB,EAChB,aAAa,GACb,MAAM,sBAAsB,CAAA;AAS7B,OAAO,EACN,qBAAqB,EACrB,oBAAoB,EACpB,WAAW,EACX,eAAe,GACf,MAAM,WAAW,CAAA;AAElB,OAAO,EACN,0BAA0B,EAC1B,4BAA4B,GAC5B,MAAM,kCAAkC,CAAA;AAalC,IAAM,YAAY,GAAlB,MAAM,YAAY;IAGN,OAAO;IAEP,KAAK;IAKL,MAAM;IATxB,YAEkB,OAAqB,EAErB,KAAqB,EAKrB,MAAuB;uBAPvB,OAAO;qBAEP,KAAK;sBAKL,MAAM;IACrB,CAAC;IASJ,KAAK,CAAC,SAAS,CAAC,OAA8B;QAC7C,IAAI,OAAO,CAAC,mBAAmB,KAAK,qBAAqB,EAAE,CAAC;YAC3D,MAAM,IAAI,4BAA4B,CACrC,iCAAiC,qBAAqB,EAAE,CACxD,CAAA;QACF,CAAC;QAED,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,4BAA4B,CAAC,6BAA6B,CAAC,CAAA;QACtE,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QAEhD,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,4BAA4B,CACrC,gDAAgD,CAChD,CAAA;QACF,CAAC;QAED,MAAM,WAAW,GAAqB;YACrC,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,SAAS,EACR,IAAI,CAAC,GAAG,EAAE;gBACV,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,uBAAuB,CAAC,GAAG,IAAI;YAChE,EAAE,EAAE,WAAW,EAAE;YACjB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS;gBAC9B,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC;oBACA,KAAK,EAAE,OAAO,CAAC,KAAK;iBACpB,CAAC;YACJ,GAAG,CAAC,OAAO,CAAC,KAAK;gBAChB,CAAC,CAAC;oBACA,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;iBAChD;gBACF,CAAC,CAAC,EAAE,CAAC;SACN,CAAA;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,WAAW,CAAC,CAAA;QAE7C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAC3C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC,CAAA;QAE1C,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;IACtB,CAAC;IAGD,KAAK,CAAC,eAAe,CAAC,EAAU;QAC/B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC,CAAA;QAExD,IAAI,CAAC,WAAW,EAAE,CAAC;YAClB,MAAM,IAAI,0BAA0B,CACnC,iEAAiE,CACjE,CAAA;QACF,CAAC;QAED,OAAO,WAAW,CAAA;IACnB,CAAC;IAMD,KAAK,CAAC,qBAAqB,CAC1B,aAAqB,EACrB,MAAc,EACd,OAEC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,CAAA;QAC7D,MAAM,IAAI,GAAG,WAAW,EAAE,CAAA;QAE1B,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;YACzB,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,IAAI;YACJ,aAAa,EAAE,WAAW,CAAC,aAAa;YACxC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC,GAAG,IAAI;YACzE,WAAW,EAAE,WAAW,CAAC,WAAW;YACpC,MAAM;YACN,GAAG,CAAC,OAAO,EAAE,WAAW,KAAK,SAAS;gBACrC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC;oBACA,WAAW,EAAE,OAAO,CAAC,WAAW;iBAChC,CAAC;SACJ,CAAC,CAAA;QAGF,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;QAElD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,CAAA;QAC5C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAElC,IAAI,WAAW,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,CAAA;QACjD,CAAC;QAED,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;IACtB,CAAC;IAQD,KAAK,CAAC,YAAY,CAAC,KAKlB;QACA,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAEnD,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,MAAM,IAAI,0BAA0B,EAAE,CAAA;QACvC,CAAC;QAED,IACC,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;YACjC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,EACtC,CAAC;YACF,MAAM,IAAI,0BAA0B,EAAE,CAAA;QACvC,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,0BAA0B,EAAE,CAAA;QACvC,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAA;IACnD,CAAC;IAGD,KAAK,CAAC,OAAO,CAAC,YAAoB;QACjC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAC5B,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA;QAEnD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IACvC,CAAC;IAEO,KAAK,CAAC,KAAK,CAClB,MAAc,EACd,WAAoB;QAEpB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CACzC,MAAM,EACN,WAAW,KAAK,SAAS;YACxB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC;gBACA,WAAW;aACX,CACH,CAAA;QAED,OAAO;YACN,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI;YAC7C,YAAY,EAAE,IAAI,CAAC,YAAY;SAC/B,CAAA;IACF,CAAC;IAEO,UAAU,CAAC,QAAgB;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CACvC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,QAAQ,CACxC,CAAA;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,IAAI,4BAA4B,CAAC,mBAAmB,CAAC,CAAA;QAC5D,CAAC;QAED,OAAO,MAAM,CAAA;IACd,CAAC;CACD,CAAA;AAhMY,YAAY;IADxB,UAAU,EAAE;IAGV,WAAA,MAAM,CAAC,aAAa,CAAC,CAAA;IAErB,WAAA,MAAM,CAAC,gBAAgB,CAAC,CAAA;IAKxB,WAAA,MAAM,CAAC,eAAe,CAAC,CAAA;qDACC,eAAe;GAV7B,YAAY,CAgMxB"}

package/dist/oauth.types.d.ts

@@ -0,0 +1,66 @@
+import type { ModuleMetadata, Type } from '@nestjs/common';
+export type OAuthClient = {
+    id: string;
+    redirectUris: string[];
+    scopes?: string[];
+};
+export type OAuthCookieOptions = {
+    accessName?: string;
+    refreshName?: string;
+    domain?: string;
+    path?: string;
+    sameSite?: 'lax' | 'none' | 'strict';
+    secure?: boolean;
+};
+export type OAuthOptions = {
+    clients: OAuthClient[];
+    signInUrl: string;
+    codeTtl?: number;
+    transactionTtl?: number;
+    refreshTtl?: number;
+    cookie?: OAuthCookieOptions;
+};
+export type OAuthModuleOptions = OAuthOptions & {
+    store?: Type<OAuthCodeStore>;
+    imports?: ModuleMetadata['imports'];
+};
+export type OAuthModuleFactoryOptions = Omit<OAuthModuleOptions, 'imports'>;
+export type OAuthTransaction = {
+    id: string;
+    clientId: string;
+    redirectUri: string;
+    codeChallenge: string;
+    state?: string;
+    scopes?: string[];
+    expiresAt: number;
+};
+export type OAuthAuthorizationCode = {
+    code: string;
+    clientId: string;
+    redirectUri: string;
+    codeChallenge: string;
+    userId: string;
+    workspaceId?: string;
+    expiresAt: number;
+};
+export interface OAuthCodeStore {
+    saveTransaction(transaction: OAuthTransaction): Promise<void>;
+    readTransaction(id: string): Promise<OAuthTransaction | null>;
+    deleteTransaction(id: string): Promise<void>;
+    saveCode(code: OAuthAuthorizationCode): Promise<void>;
+    takeCode(code: string): Promise<OAuthAuthorizationCode | null>;
+}
+export type OAuthAuthorizeRequest = {
+    clientId: string;
+    redirectUri: string;
+    codeChallenge: string;
+    codeChallengeMethod: string;
+    state?: string;
+    scope?: string;
+};
+export type OAuthSession = {
+    accessToken: string;
+    refreshToken: string;
+    expiresAt: number;
+};
+//# sourceMappingURL=oauth.types.d.ts.map

package/dist/oauth.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.types.d.ts","sourceRoot":"","sources":["../src/oauth.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAA;AAU1D,MAAM,MAAM,WAAW,GAAG;IACzB,EAAE,EAAE,MAAM,CAAA;IAEV,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAEhC,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf,IAAI,CAAC,EAAE,MAAM,CAAA;IAEb,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAA;IAEpC,MAAM,CAAC,EAAE,OAAO,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IAC1B,OAAO,EAAE,WAAW,EAAE,CAAA;IAKtB,SAAS,EAAE,MAAM,CAAA;IAEjB,OAAO,CAAC,EAAE,MAAM,CAAA;IAEhB,cAAc,CAAC,EAAE,MAAM,CAAA;IAMvB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,kBAAkB,CAAA;CAC3B,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG,YAAY,GAAG;IAE/C,KAAK,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,CAAA;IAC5B,OAAO,CAAC,EAAE,cAAc,CAAC,SAAS,CAAC,CAAA;CACnC,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG,IAAI,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAA;AAG3E,MAAM,MAAM,gBAAgB,GAAG;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,CAAA;IACrB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IAEjB,SAAS,EAAE,MAAM,CAAA;CACjB,CAAA;AAGD,MAAM,MAAM,sBAAsB,GAAG;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,CAAA;IACrB,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,CAAC,EAAE,MAAM,CAAA;IAEpB,SAAS,EAAE,MAAM,CAAA;CACjB,CAAA;AAUD,MAAM,WAAW,cAAc;IAC9B,eAAe,CAAC,WAAW,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE7D,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAA;IAC7D,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5C,QAAQ,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAErD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAA;CAC9D;AAED,MAAM,MAAM,qBAAqB,GAAG;IACnC,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,CAAA;IACrB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;CACd,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IAC1B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IAEpB,SAAS,EAAE,MAAM,CAAA;CACjB,CAAA"}

package/dist/oauth.types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=oauth.types.js.map

package/dist/oauth.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.types.js","sourceRoot":"","sources":["../src/oauth.types.ts"],"names":[],"mappings":""}

package/dist/pkce.d.ts

@@ -0,0 +1,7 @@
+export declare const CODE_CHALLENGE_METHOD = "S256";
+export declare function isValidCodeVerifier(verifier: string): boolean;
+export declare function isValidCodeChallenge(challenge: string): boolean;
+export declare function deriveChallenge(verifier: string): string;
+export declare function verifyChallenge(verifier: string, challenge: string): boolean;
+export declare function randomToken(bytes?: number): string;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../src/pkce.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,qBAAqB,SAAS,CAAA;AAK3C,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAExD;AAUD,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAa5E;AAGD,wBAAgB,WAAW,CAAC,KAAK,SAAK,GAAG,MAAM,CAE9C"}

package/dist/pkce.js

@@ -0,0 +1,28 @@
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+export const CODE_CHALLENGE_METHOD = 'S256';
+const VERIFIER_PATTERN = /^[A-Za-z0-9\-._~]{43,128}$/u;
+const CHALLENGE_PATTERN = /^[A-Za-z0-9\-_]{43}$/u;
+export function isValidCodeVerifier(verifier) {
+    return VERIFIER_PATTERN.test(verifier);
+}
+export function isValidCodeChallenge(challenge) {
+    return CHALLENGE_PATTERN.test(challenge);
+}
+export function deriveChallenge(verifier) {
+    return createHash('sha256').update(verifier).digest('base64url');
+}
+export function verifyChallenge(verifier, challenge) {
+    if (!isValidCodeVerifier(verifier) || !isValidCodeChallenge(challenge)) {
+        return false;
+    }
+    const derived = Buffer.from(deriveChallenge(verifier));
+    const expected = Buffer.from(challenge);
+    if (derived.length !== expected.length) {
+        return false;
+    }
+    return timingSafeEqual(derived, expected);
+}
+export function randomToken(bytes = 32) {
+    return randomBytes(bytes).toString('base64url');
+}
+//# sourceMappingURL=pkce.js.map

package/dist/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../src/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAGtE,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAA;AAE3C,MAAM,gBAAgB,GAAG,6BAA6B,CAAA;AACtD,MAAM,iBAAiB,GAAG,uBAAuB,CAAA;AAEjD,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IACnD,OAAO,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AACvC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACrD,OAAO,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;AACzC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC/C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;AACjE,CAAC;AAUD,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,SAAiB;IAClE,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC,EAAE,CAAC;QACxE,OAAO,KAAK,CAAA;IACb,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAA;IACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAEvC,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACxC,OAAO,KAAK,CAAA;IACb,CAAC;IAED,OAAO,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;AAC1C,CAAC;AAGD,MAAM,UAAU,WAAW,CAAC,KAAK,GAAG,EAAE;IACrC,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AAChD,CAAC"}

package/dist/store/memory-code-store.d.ts

@@ -0,0 +1,12 @@
+import type { OAuthAuthorizationCode, OAuthCodeStore, OAuthTransaction } from '../oauth.types.js';
+export declare class MemoryOAuthCodeStore implements OAuthCodeStore {
+    private readonly transactions;
+    private readonly codes;
+    saveTransaction(transaction: OAuthTransaction): Promise<void>;
+    readTransaction(id: string): Promise<OAuthTransaction | null>;
+    deleteTransaction(id: string): Promise<void>;
+    saveCode(code: OAuthAuthorizationCode): Promise<void>;
+    takeCode(code: string): Promise<OAuthAuthorizationCode | null>;
+    private sweep;
+}
+//# sourceMappingURL=memory-code-store.d.ts.map

package/dist/store/memory-code-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-code-store.d.ts","sourceRoot":"","sources":["../../src/store/memory-code-store.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACX,sBAAsB,EACtB,cAAc,EACd,gBAAgB,EAChB,MAAM,kBAAkB,CAAA;AAczB,qBACa,oBAAqB,YAAW,cAAc;IAC1D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAsC;IACnE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA4C;IAE5D,eAAe,CAAC,WAAW,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAGlE;IAEK,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAclE;IAEK,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEjD;IAEK,QAAQ,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAG1D;IAEK,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAYnE;IAED,OAAO,CAAC,KAAK;CAeb"}

package/dist/store/memory-code-store.js

@@ -0,0 +1,59 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Injectable } from '@nestjs/common';
+let MemoryOAuthCodeStore = class MemoryOAuthCodeStore {
+    transactions = new Map();
+    codes = new Map();
+    async saveTransaction(transaction) {
+        this.sweep();
+        this.transactions.set(transaction.id, transaction);
+    }
+    async readTransaction(id) {
+        const transaction = this.transactions.get(id);
+        if (!transaction) {
+            return null;
+        }
+        if (transaction.expiresAt <= Date.now()) {
+            this.transactions.delete(id);
+            return null;
+        }
+        return transaction;
+    }
+    async deleteTransaction(id) {
+        this.transactions.delete(id);
+    }
+    async saveCode(code) {
+        this.sweep();
+        this.codes.set(code.code, code);
+    }
+    async takeCode(code) {
+        const found = this.codes.get(code);
+        this.codes.delete(code);
+        if (!found || found.expiresAt <= Date.now()) {
+            return null;
+        }
+        return found;
+    }
+    sweep() {
+        const now = Date.now();
+        for (const [id, transaction] of this.transactions) {
+            if (transaction.expiresAt <= now) {
+                this.transactions.delete(id);
+            }
+        }
+        for (const [value, code] of this.codes) {
+            if (code.expiresAt <= now) {
+                this.codes.delete(value);
+            }
+        }
+    }
+};
+MemoryOAuthCodeStore = __decorate([
+    Injectable()
+], MemoryOAuthCodeStore);
+export { MemoryOAuthCodeStore };
+//# sourceMappingURL=memory-code-store.js.map

package/dist/store/memory-code-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-code-store.js","sourceRoot":"","sources":["../../src/store/memory-code-store.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAqBpC,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IACf,YAAY,GAAG,IAAI,GAAG,EAA4B,CAAA;IAClD,KAAK,GAAG,IAAI,GAAG,EAAkC,CAAA;IAElE,KAAK,CAAC,eAAe,CAAC,WAA6B;QAClD,IAAI,CAAC,KAAK,EAAE,CAAA;QACZ,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,EAAE,WAAW,CAAC,CAAA;IACnD,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,EAAU;QAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAE7C,IAAI,CAAC,WAAW,EAAE,CAAC;YAClB,OAAO,IAAI,CAAA;QACZ,CAAC;QAED,IAAI,WAAW,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACzC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YAE5B,OAAO,IAAI,CAAA;QACZ,CAAC;QAED,OAAO,WAAW,CAAA;IACnB,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,EAAU;QACjC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IAC7B,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAA4B;QAC1C,IAAI,CAAC,KAAK,EAAE,CAAA;QACZ,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAChC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAIlC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAEvB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAA;QACZ,CAAC;QAED,OAAO,KAAK,CAAA;IACb,CAAC;IAEO,KAAK;QACZ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAEtB,KAAK,MAAM,CAAC,EAAE,EAAE,WAAW,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACnD,IAAI,WAAW,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;gBAClC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YAC7B,CAAC;QACF,CAAC;QAED,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACxC,IAAI,IAAI,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;gBAC3B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACzB,CAAC;QACF,CAAC;IACF,CAAC;CACD,CAAA;AA/DY,oBAAoB;IADhC,UAAU,EAAE;GACA,oBAAoB,CA+DhC"}

package/package.json

@@ -0,0 +1,67 @@
+{
+  "name": "@turystack/nestjs-oauth",
+  "description": "Authorization Code + PKCE authorization server for NestJS, issuing sessions as httpOnly cookies.",
+  "private": false,
+  "version": "1.0.1",
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "files": [
+    "dist"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/turystack/nestjs-oauth.git"
+  },
+  "peerDependencies": {
+    "@nestjs/common": "^11.0.0",
+    "@nestjs/core": "^11.0.0",
+    "@turystack/nestjs-config": "^1.0.0",
+    "@turystack/nestjs-iam": "^1.0.0",
+    "@turystack/nestjs-server": "^1.0.0",
+    "reflect-metadata": "^0.2.0",
+    "zod": "^4.0.0"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "2.5.4",
+    "@nestjs/common": "^11.0.0",
+    "@nestjs/core": "^11.0.0",
+    "@nestjs/testing": "^11.0.0",
+    "@turystack/nestjs-config": "^1.0.0",
+    "@turystack/nestjs-iam": "^1.0.0",
+    "@turystack/nestjs-server": "^1.0.0",
+    "@types/node": "^25.5.0",
+    "@vitest/coverage-v8": "^4.1.10",
+    "reflect-metadata": "^0.2.2",
+    "tsc-alias": "^1.9.1",
+    "typescript": "^7.0.2",
+    "vite": "^8.1.5",
+    "vitest": "^4.1.10",
+    "zod": "^4.0.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json && tsc-alias -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:cov": "vitest run --coverage",
+    "lint": "biome lint ./src",
+    "format": "biome format --write ./src",
+    "check": "biome check ./src",
+    "check:fix": "biome check --write ./src"
+  }
+}