@xemahq/oidc-session-nest 0.1.0

package/dist/http/cookie.d.ts

@@ -0,0 +1,12 @@
+export interface SetCookieOptions {
+    readonly httpOnly: boolean;
+    readonly secure: boolean;
+    readonly sameSite: 'lax' | 'strict' | 'none';
+    readonly path: string;
+    readonly domain?: string;
+    readonly maxAgeSeconds?: number;
+}
+export declare function readCookie(header: string | undefined, name: string): string | null;
+export declare function serializeCookie(name: string, value: string, options: SetCookieOptions): string;
+export declare function safeRelativePath(candidate: string | undefined): string | null;
+//# sourceMappingURL=cookie.d.ts.map

package/dist/http/cookie.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie.d.ts","sourceRoot":"","sources":["../../src/http/cookie.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAQD,wBAAgB,UAAU,CACxB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,IAAI,CAyBf;AAGD,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,gBAAgB,GACxB,MAAM,CAkBR;AA0CD,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAiB7E"}

package/dist/http/cookie.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readCookie = readCookie;
+exports.serializeCookie = serializeCookie;
+exports.safeRelativePath = safeRelativePath;
+function readCookie(header, name) {
+    if (header === undefined || header === '') {
+        return null;
+    }
+    for (const part of header.split(';')) {
+        const separator = part.indexOf('=');
+        if (separator === -1) {
+            continue;
+        }
+        if (part.slice(0, separator).trim() !== name) {
+            continue;
+        }
+        const raw = part.slice(separator + 1).trim();
+        if (raw === '') {
+            return null;
+        }
+        try {
+            return decodeURIComponent(raw);
+        }
+        catch {
+            return null;
+        }
+    }
+    return null;
+}
+function serializeCookie(name, value, options) {
+    const parts = [`${name}=${encodeURIComponent(value)}`, `Path=${options.path}`];
+    if (options.domain !== undefined) {
+        parts.push(`Domain=${options.domain}`);
+    }
+    if (options.maxAgeSeconds !== undefined) {
+        const seconds = Math.max(0, Math.floor(options.maxAgeSeconds));
+        parts.push(`Max-Age=${seconds}`);
+        parts.push(`Expires=${new Date(Date.now() + seconds * 1000).toUTCString()}`);
+    }
+    parts.push(`SameSite=${capitalize(options.sameSite)}`);
+    if (options.httpOnly) {
+        parts.push('HttpOnly');
+    }
+    if (options.secure) {
+        parts.push('Secure');
+    }
+    return parts.join('; ');
+}
+function capitalize(value) {
+    return `${value.charAt(0).toUpperCase()}${value.slice(1)}`;
+}
+const LAST_CONTROL_CODEPOINT = 0x1f;
+const DELETE_CODEPOINT = 0x7f;
+function containsControlCharacter(value) {
+    for (const character of value) {
+        const codepoint = character.codePointAt(0) ?? 0;
+        if (codepoint <= LAST_CONTROL_CODEPOINT || codepoint === DELETE_CODEPOINT) {
+            return true;
+        }
+    }
+    return false;
+}
+function safeRelativePath(candidate) {
+    if (candidate === undefined || candidate === '') {
+        return null;
+    }
+    if (!candidate.startsWith('/')) {
+        return null;
+    }
+    if (candidate.startsWith('//')) {
+        return null;
+    }
+    if (candidate.includes('\\')) {
+        return null;
+    }
+    if (containsControlCharacter(candidate)) {
+        return null;
+    }
+    return candidate;
+}
+//# sourceMappingURL=cookie.js.map

package/dist/http/cookie.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie.js","sourceRoot":"","sources":["../../src/http/cookie.ts"],"names":[],"mappings":";;AA2BA,gCA4BC;AAGD,0CAsBC;AA0CD,4CAiBC;AAhHD,SAAgB,UAAU,CACxB,MAA0B,EAC1B,IAAY;IAEZ,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;YACrB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAC7C,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YAGP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAGD,SAAgB,eAAe,CAC7B,IAAY,EACZ,KAAa,EACb,OAAyB;IAEzB,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/E,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;QAC/D,KAAK,CAAC,IAAI,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,YAAY,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7D,CAAC;AAGD,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAGpC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAU9B,SAAS,wBAAwB,CAAC,KAAa;IAC7C,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,SAAS,IAAI,sBAAsB,IAAI,SAAS,KAAK,gBAAgB,EAAE,CAAC;YAC1E,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAcD,SAAgB,gBAAgB,CAAC,SAA6B;IAC5D,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,wBAAwB,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/http/headers.d.ts

@@ -0,0 +1,2 @@
+export declare const PROJECT_HEADER_NAME = "X-Project-Id";
+//# sourceMappingURL=headers.d.ts.map

package/dist/http/headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"headers.d.ts","sourceRoot":"","sources":["../../src/http/headers.ts"],"names":[],"mappings":"AAuBA,eAAO,MAAM,mBAAmB,iBAAiB,CAAC"}

package/dist/http/headers.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PROJECT_HEADER_NAME = void 0;
+exports.PROJECT_HEADER_NAME = 'X-Project-Id';
+//# sourceMappingURL=headers.js.map

package/dist/http/headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"headers.js","sourceRoot":"","sources":["../../src/http/headers.ts"],"names":[],"mappings":";;;AAuBa,QAAA,mBAAmB,GAAG,cAAc,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,22 @@
+export { OidcSessionError, OidcSessionErrorCode, OidcCallbackRejectedError, OidcLoginStateUnknownError, OidcTokenEndpointFailedError, SessionExpiredError, SessionRefreshContendedError, SessionRequiredError, type OidcSessionErrorBody, } from './errors';
+export { assertOidcSessionOptions, OidcSessionConfigError, REQUIRED_OIDC_SCOPE, type OidcProviderOptions, type OidcSessionOptions, type SessionCookieOptions, type SessionTtlOptions, } from './config/oidc-session-options';
+export { loadOidcSessionOptionsFromEnv, OIDC_SESSION_OPTIONAL_ENV_VARS, OIDC_SESSION_REQUIRED_ENV_VARS, type EnvReader, } from './config/oidc-session-env';
+export { OidcDiscovery, type FetchLike, type OidcDiscoveryDocument, } from './oidc/discovery';
+export { createPkcePair, randomUrlSafeToken, type PkcePair } from './oidc/pkce';
+export { OidcClient, OidcInvalidGrantError, type AuthorizationRequest, type OidcClientDeps, type OidcTokenSet, } from './oidc/oidc-client';
+export type { PendingAuthorization, ReadSessionOptions, SessionRecord, SessionStore, } from './session/session-store';
+export { InMemorySessionStore, type InMemorySessionStoreOptions, } from './session/in-memory-session-store';
+export { ioredisScriptClient, RedisSessionStore, type IoredisLike, type RedisScriptClient, type RedisSessionStoreOptions, } from './session/redis-session-store';
+export { resolveInitialActiveOrgId, resolveSessionOrgRoles, toSessionActor, type SessionActor as SessionActorShape, } from './session/actor';
+export { SessionService, storeKeyFor, type EstablishedSession, type LiveSession, type ResolvedSession, type SessionServiceDeps, } from './session/session-service';
+export { PROJECT_HEADER_NAME } from './http/headers';
+export { readCookie, safeRelativePath, serializeCookie, type SetCookieOptions, } from './http/cookie';
+export { currentSession, currentSessionScope, runWithSessionScope, setCurrentProjectId, type OidcSessionScope, } from './nest/oidc-session-context';
+export { OIDC_SESSION_SCOPE, OidcSessionMiddleware, type SessionRequestLike, type SessionScopeCarrier, } from './nest/oidc-session.middleware';
+export { OidcSessionGuard } from './nest/oidc-session.guard';
+export { SessionActor } from './nest/session-actor.decorator';
+export { sessionClientTransport, type SessionClientTransport, } from './nest/session-client-transport';
+export { OidcSessionAuthController, type LogoutResponse, type SessionRequestShape, type SessionResponseLike, } from './nest/oidc-session-auth.controller';
+export { OIDC_SESSION_OPTIONS, OIDC_SESSION_STORE } from './nest/tokens';
+export { OidcSessionModule, type OidcSessionFactoryResult, type OidcSessionModuleAsyncOptions, } from './nest/oidc-session.module';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,yBAAyB,EACzB,0BAA0B,EAC1B,4BAA4B,EAC5B,mBAAmB,EACnB,4BAA4B,EAC5B,oBAAoB,EACpB,KAAK,oBAAoB,GAC1B,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,GACvB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,6BAA6B,EAC7B,8BAA8B,EAC9B,8BAA8B,EAC9B,KAAK,SAAS,GACf,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,aAAa,EACb,KAAK,SAAS,EACd,KAAK,qBAAqB,GAC3B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEhF,OAAO,EACL,UAAU,EACV,qBAAqB,EACrB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EACV,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,YAAY,GACb,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,oBAAoB,EACpB,KAAK,2BAA2B,GACjC,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,GAC9B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,cAAc,EACd,KAAK,YAAY,IAAI,iBAAiB,GACvC,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,cAAc,EACd,WAAW,EACX,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,kBAAkB,GACxB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,KAAK,gBAAgB,GACtB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,KAAK,gBAAgB,GACtB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,KAAK,kBAAkB,EAIvB,KAAK,mBAAmB,GACzB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAE9D,OAAO,EACL,sBAAsB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,yBAAyB,EACzB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,GACzB,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEzE,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,GACnC,MAAM,4BAA4B,CAAC"}

package/dist/index.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OidcSessionModule = exports.OIDC_SESSION_STORE = exports.OIDC_SESSION_OPTIONS = exports.OidcSessionAuthController = exports.sessionClientTransport = exports.SessionActor = exports.OidcSessionGuard = exports.OidcSessionMiddleware = exports.OIDC_SESSION_SCOPE = exports.setCurrentProjectId = exports.runWithSessionScope = exports.currentSessionScope = exports.currentSession = exports.serializeCookie = exports.safeRelativePath = exports.readCookie = exports.PROJECT_HEADER_NAME = exports.storeKeyFor = exports.SessionService = exports.toSessionActor = exports.resolveSessionOrgRoles = exports.resolveInitialActiveOrgId = exports.RedisSessionStore = exports.ioredisScriptClient = exports.InMemorySessionStore = exports.OidcInvalidGrantError = exports.OidcClient = exports.randomUrlSafeToken = exports.createPkcePair = exports.OidcDiscovery = exports.OIDC_SESSION_REQUIRED_ENV_VARS = exports.OIDC_SESSION_OPTIONAL_ENV_VARS = exports.loadOidcSessionOptionsFromEnv = exports.REQUIRED_OIDC_SCOPE = exports.OidcSessionConfigError = exports.assertOidcSessionOptions = exports.SessionRequiredError = exports.SessionRefreshContendedError = exports.SessionExpiredError = exports.OidcTokenEndpointFailedError = exports.OidcLoginStateUnknownError = exports.OidcCallbackRejectedError = exports.OidcSessionErrorCode = exports.OidcSessionError = void 0;
+var errors_1 = require("./errors");
+Object.defineProperty(exports, "OidcSessionError", { enumerable: true, get: function () { return errors_1.OidcSessionError; } });
+Object.defineProperty(exports, "OidcSessionErrorCode", { enumerable: true, get: function () { return errors_1.OidcSessionErrorCode; } });
+Object.defineProperty(exports, "OidcCallbackRejectedError", { enumerable: true, get: function () { return errors_1.OidcCallbackRejectedError; } });
+Object.defineProperty(exports, "OidcLoginStateUnknownError", { enumerable: true, get: function () { return errors_1.OidcLoginStateUnknownError; } });
+Object.defineProperty(exports, "OidcTokenEndpointFailedError", { enumerable: true, get: function () { return errors_1.OidcTokenEndpointFailedError; } });
+Object.defineProperty(exports, "SessionExpiredError", { enumerable: true, get: function () { return errors_1.SessionExpiredError; } });
+Object.defineProperty(exports, "SessionRefreshContendedError", { enumerable: true, get: function () { return errors_1.SessionRefreshContendedError; } });
+Object.defineProperty(exports, "SessionRequiredError", { enumerable: true, get: function () { return errors_1.SessionRequiredError; } });
+var oidc_session_options_1 = require("./config/oidc-session-options");
+Object.defineProperty(exports, "assertOidcSessionOptions", { enumerable: true, get: function () { return oidc_session_options_1.assertOidcSessionOptions; } });
+Object.defineProperty(exports, "OidcSessionConfigError", { enumerable: true, get: function () { return oidc_session_options_1.OidcSessionConfigError; } });
+Object.defineProperty(exports, "REQUIRED_OIDC_SCOPE", { enumerable: true, get: function () { return oidc_session_options_1.REQUIRED_OIDC_SCOPE; } });
+var oidc_session_env_1 = require("./config/oidc-session-env");
+Object.defineProperty(exports, "loadOidcSessionOptionsFromEnv", { enumerable: true, get: function () { return oidc_session_env_1.loadOidcSessionOptionsFromEnv; } });
+Object.defineProperty(exports, "OIDC_SESSION_OPTIONAL_ENV_VARS", { enumerable: true, get: function () { return oidc_session_env_1.OIDC_SESSION_OPTIONAL_ENV_VARS; } });
+Object.defineProperty(exports, "OIDC_SESSION_REQUIRED_ENV_VARS", { enumerable: true, get: function () { return oidc_session_env_1.OIDC_SESSION_REQUIRED_ENV_VARS; } });
+var discovery_1 = require("./oidc/discovery");
+Object.defineProperty(exports, "OidcDiscovery", { enumerable: true, get: function () { return discovery_1.OidcDiscovery; } });
+var pkce_1 = require("./oidc/pkce");
+Object.defineProperty(exports, "createPkcePair", { enumerable: true, get: function () { return pkce_1.createPkcePair; } });
+Object.defineProperty(exports, "randomUrlSafeToken", { enumerable: true, get: function () { return pkce_1.randomUrlSafeToken; } });
+var oidc_client_1 = require("./oidc/oidc-client");
+Object.defineProperty(exports, "OidcClient", { enumerable: true, get: function () { return oidc_client_1.OidcClient; } });
+Object.defineProperty(exports, "OidcInvalidGrantError", { enumerable: true, get: function () { return oidc_client_1.OidcInvalidGrantError; } });
+var in_memory_session_store_1 = require("./session/in-memory-session-store");
+Object.defineProperty(exports, "InMemorySessionStore", { enumerable: true, get: function () { return in_memory_session_store_1.InMemorySessionStore; } });
+var redis_session_store_1 = require("./session/redis-session-store");
+Object.defineProperty(exports, "ioredisScriptClient", { enumerable: true, get: function () { return redis_session_store_1.ioredisScriptClient; } });
+Object.defineProperty(exports, "RedisSessionStore", { enumerable: true, get: function () { return redis_session_store_1.RedisSessionStore; } });
+var actor_1 = require("./session/actor");
+Object.defineProperty(exports, "resolveInitialActiveOrgId", { enumerable: true, get: function () { return actor_1.resolveInitialActiveOrgId; } });
+Object.defineProperty(exports, "resolveSessionOrgRoles", { enumerable: true, get: function () { return actor_1.resolveSessionOrgRoles; } });
+Object.defineProperty(exports, "toSessionActor", { enumerable: true, get: function () { return actor_1.toSessionActor; } });
+var session_service_1 = require("./session/session-service");
+Object.defineProperty(exports, "SessionService", { enumerable: true, get: function () { return session_service_1.SessionService; } });
+Object.defineProperty(exports, "storeKeyFor", { enumerable: true, get: function () { return session_service_1.storeKeyFor; } });
+var headers_1 = require("./http/headers");
+Object.defineProperty(exports, "PROJECT_HEADER_NAME", { enumerable: true, get: function () { return headers_1.PROJECT_HEADER_NAME; } });
+var cookie_1 = require("./http/cookie");
+Object.defineProperty(exports, "readCookie", { enumerable: true, get: function () { return cookie_1.readCookie; } });
+Object.defineProperty(exports, "safeRelativePath", { enumerable: true, get: function () { return cookie_1.safeRelativePath; } });
+Object.defineProperty(exports, "serializeCookie", { enumerable: true, get: function () { return cookie_1.serializeCookie; } });
+var oidc_session_context_1 = require("./nest/oidc-session-context");
+Object.defineProperty(exports, "currentSession", { enumerable: true, get: function () { return oidc_session_context_1.currentSession; } });
+Object.defineProperty(exports, "currentSessionScope", { enumerable: true, get: function () { return oidc_session_context_1.currentSessionScope; } });
+Object.defineProperty(exports, "runWithSessionScope", { enumerable: true, get: function () { return oidc_session_context_1.runWithSessionScope; } });
+Object.defineProperty(exports, "setCurrentProjectId", { enumerable: true, get: function () { return oidc_session_context_1.setCurrentProjectId; } });
+var oidc_session_middleware_1 = require("./nest/oidc-session.middleware");
+Object.defineProperty(exports, "OIDC_SESSION_SCOPE", { enumerable: true, get: function () { return oidc_session_middleware_1.OIDC_SESSION_SCOPE; } });
+Object.defineProperty(exports, "OidcSessionMiddleware", { enumerable: true, get: function () { return oidc_session_middleware_1.OidcSessionMiddleware; } });
+var oidc_session_guard_1 = require("./nest/oidc-session.guard");
+Object.defineProperty(exports, "OidcSessionGuard", { enumerable: true, get: function () { return oidc_session_guard_1.OidcSessionGuard; } });
+var session_actor_decorator_1 = require("./nest/session-actor.decorator");
+Object.defineProperty(exports, "SessionActor", { enumerable: true, get: function () { return session_actor_decorator_1.SessionActor; } });
+var session_client_transport_1 = require("./nest/session-client-transport");
+Object.defineProperty(exports, "sessionClientTransport", { enumerable: true, get: function () { return session_client_transport_1.sessionClientTransport; } });
+var oidc_session_auth_controller_1 = require("./nest/oidc-session-auth.controller");
+Object.defineProperty(exports, "OidcSessionAuthController", { enumerable: true, get: function () { return oidc_session_auth_controller_1.OidcSessionAuthController; } });
+var tokens_1 = require("./nest/tokens");
+Object.defineProperty(exports, "OIDC_SESSION_OPTIONS", { enumerable: true, get: function () { return tokens_1.OIDC_SESSION_OPTIONS; } });
+Object.defineProperty(exports, "OIDC_SESSION_STORE", { enumerable: true, get: function () { return tokens_1.OIDC_SESSION_STORE; } });
+var oidc_session_module_1 = require("./nest/oidc-session.module");
+Object.defineProperty(exports, "OidcSessionModule", { enumerable: true, get: function () { return oidc_session_module_1.OidcSessionModule; } });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAWA,mCAUkB;AAThB,0GAAA,gBAAgB,OAAA;AAChB,8GAAA,oBAAoB,OAAA;AACpB,mHAAA,yBAAyB,OAAA;AACzB,oHAAA,0BAA0B,OAAA;AAC1B,sHAAA,4BAA4B,OAAA;AAC5B,6GAAA,mBAAmB,OAAA;AACnB,sHAAA,4BAA4B,OAAA;AAC5B,8GAAA,oBAAoB,OAAA;AAItB,sEAQuC;AAPrC,gIAAA,wBAAwB,OAAA;AACxB,8HAAA,sBAAsB,OAAA;AACtB,2HAAA,mBAAmB,OAAA;AAOrB,8DAKmC;AAJjC,iIAAA,6BAA6B,OAAA;AAC7B,kIAAA,8BAA8B,OAAA;AAC9B,kIAAA,8BAA8B,OAAA;AAIhC,8CAI0B;AAHxB,0GAAA,aAAa,OAAA;AAKf,oCAAgF;AAAvE,sGAAA,cAAc,OAAA;AAAE,0GAAA,kBAAkB,OAAA;AAE3C,kDAM4B;AAL1B,yGAAA,UAAU,OAAA;AACV,oHAAA,qBAAqB,OAAA;AAavB,6EAG2C;AAFzC,+HAAA,oBAAoB,OAAA;AAItB,qEAMuC;AALrC,0HAAA,mBAAmB,OAAA;AACnB,wHAAA,iBAAiB,OAAA;AAMnB,yCAKyB;AAJvB,kHAAA,yBAAyB,OAAA;AACzB,+GAAA,sBAAsB,OAAA;AACtB,uGAAA,cAAc,OAAA;AAIhB,6DAOmC;AANjC,iHAAA,cAAc,OAAA;AACd,8GAAA,WAAW,OAAA;AAOb,0CAAqD;AAA5C,8GAAA,mBAAmB,OAAA;AAE5B,wCAKuB;AAJrB,oGAAA,UAAU,OAAA;AACV,0GAAA,gBAAgB,OAAA;AAChB,yGAAA,eAAe,OAAA;AAIjB,oEAMqC;AALnC,sHAAA,cAAc,OAAA;AACd,2HAAA,mBAAmB,OAAA;AACnB,2HAAA,mBAAmB,OAAA;AACnB,2HAAA,mBAAmB,OAAA;AAIrB,0EAQwC;AAPtC,6HAAA,kBAAkB,OAAA;AAClB,gIAAA,qBAAqB,OAAA;AAQvB,gEAA6D;AAApD,sHAAA,gBAAgB,OAAA;AAEzB,0EAA8D;AAArD,uHAAA,YAAY,OAAA;AAErB,4EAGyC;AAFvC,kIAAA,sBAAsB,OAAA;AAIxB,oFAK6C;AAJ3C,yIAAA,yBAAyB,OAAA;AAM3B,wCAAyE;AAAhE,8GAAA,oBAAoB,OAAA;AAAE,4GAAA,kBAAkB,OAAA;AAEjD,kEAIoC;AAHlC,wHAAA,iBAAiB,OAAA"}

package/dist/nest/oidc-session-auth.controller.d.ts

@@ -0,0 +1,30 @@
+import { OidcClient } from '../oidc/oidc-client';
+import { SessionService } from '../session/session-service';
+import type { OidcSessionOptions } from '../config/oidc-session-options';
+export interface SessionResponseLike {
+    status(code: number): SessionResponseLike;
+    setHeader(name: string, value: string): unknown;
+    redirect(url: string): unknown;
+    json(body: unknown): unknown;
+    send(body?: unknown): unknown;
+    type(value: string): unknown;
+}
+export interface SessionRequestShape {
+    headers: Record<string, string | string[] | undefined>;
+}
+export interface LogoutResponse {
+    readonly endSessionUrl: string | null;
+}
+export declare class OidcSessionAuthController {
+    private readonly sessions;
+    private readonly client;
+    private readonly options;
+    constructor(sessions: SessionService, client: OidcClient, options: OidcSessionOptions);
+    login(returnTo: string | undefined, res: SessionResponseLike): Promise<void>;
+    callback(code: string | undefined, state: string | undefined, error: string | undefined, errorDescription: string | undefined, res: SessionResponseLike): Promise<void>;
+    logout(res: SessionResponseLike): Promise<void>;
+    me(_req: SessionRequestShape, res: SessionResponseLike): void;
+    private sessionCookie;
+    private clearedCookie;
+}
+//# sourceMappingURL=oidc-session-auth.controller.d.ts.map

package/dist/nest/oidc-session-auth.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-session-auth.controller.d.ts","sourceRoot":"","sources":["../../src/nest/oidc-session-auth.controller.ts"],"names":[],"mappings":"AAyCA,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAG5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAIzE,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,CAAC;IAC1C,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAChD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/B,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IAC7B,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;IAC9B,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAC9B;AAGD,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;CACxD;AAGD,MAAM,WAAW,cAAc;IAQ7B,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC;AAKD,qBACa,yBAAyB;IAElC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAIvB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBALP,QAAQ,EAAE,cAAc,EACxB,MAAM,EAAE,UAAU,EAIlB,OAAO,EAAE,kBAAkB;IAiBxC,KAAK,CACU,QAAQ,EAAE,MAAM,GAAG,SAAS,EACxC,GAAG,EAAE,mBAAmB,GAC9B,OAAO,CAAC,IAAI,CAAC;IAwBV,QAAQ,CACG,IAAI,EAAE,MAAM,GAAG,SAAS,EACvB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,KAAK,EAAE,MAAM,GAAG,SAAS,EACb,gBAAgB,EAAE,MAAM,GAAG,SAAS,EACzD,GAAG,EAAE,mBAAmB,GAC9B,OAAO,CAAC,IAAI,CAAC;IA4DV,MAAM,CAAQ,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAwB5D,EAAE,CAAQ,IAAI,EAAE,mBAAmB,EAAS,GAAG,EAAE,mBAAmB,GAAG,IAAI;IAqB3E,OAAO,CAAC,aAAa;IAYrB,OAAO,CAAC,aAAa;CAWtB"}

package/dist/nest/oidc-session-auth.controller.js

@@ -0,0 +1,182 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OidcSessionAuthController = void 0;
+const common_1 = require("@nestjs/common");
+const xema_decorators_1 = require("@xemahq/xema-decorators");
+const errors_1 = require("../errors");
+const oidc_session_context_1 = require("./oidc-session-context");
+const oidc_session_guard_1 = require("./oidc-session.guard");
+const tokens_1 = require("./tokens");
+const cookie_1 = require("../http/cookie");
+const oidc_client_1 = require("../oidc/oidc-client");
+const pkce_1 = require("../oidc/pkce");
+const session_service_1 = require("../session/session-service");
+const HTTP_FOUND = 302;
+const HTTP_OK = 200;
+let OidcSessionAuthController = class OidcSessionAuthController {
+    sessions;
+    client;
+    options;
+    constructor(sessions, client, options) {
+        this.sessions = sessions;
+        this.client = client;
+        this.options = options;
+    }
+    async login(returnTo, res) {
+        const pkce = (0, pkce_1.createPkcePair)();
+        const { authorizationUrl } = await this.sessions.beginAuthorization({
+            pkceVerifier: pkce.verifier,
+            codeChallenge: pkce.challenge,
+            returnTo: (0, cookie_1.safeRelativePath)(returnTo),
+        });
+        res.status(HTTP_FOUND).redirect(authorizationUrl);
+    }
+    async callback(code, state, error, errorDescription, res) {
+        if (error !== undefined && error !== '') {
+            throw new errors_1.OidcCallbackRejectedError(`The identity provider refused the sign-in (${error}` +
+                `${errorDescription === undefined ? '' : `: ${errorDescription}`}).`);
+        }
+        if (state === undefined || state === '') {
+            throw new errors_1.OidcCallbackRejectedError('The callback carried no state.');
+        }
+        if (code === undefined || code === '') {
+            throw new errors_1.OidcCallbackRejectedError('The callback carried no authorization code.');
+        }
+        const pending = await this.sessions.takePendingAuthorization(state);
+        if (pending === null) {
+            throw new errors_1.OidcLoginStateUnknownError();
+        }
+        const tokenSet = await this.client.exchangeCode({
+            code,
+            codeVerifier: pending.codeVerifier,
+            nonce: pending.nonce,
+        });
+        const scope = (0, oidc_session_context_1.currentSessionScope)();
+        if (scope !== undefined && scope.session !== null) {
+            await this.sessions.endSession(scope.session);
+        }
+        const established = await this.sessions.establishSession(tokenSet, pending.returnTo);
+        res.setHeader('Set-Cookie', this.sessionCookie(established.cookieValue));
+        res.status(HTTP_FOUND).redirect(established.returnTo ?? '/');
+    }
+    async logout(res) {
+        const scope = (0, oidc_session_context_1.currentSessionScope)();
+        const endSessionUrl = await this.sessions.endSession(scope?.session ?? null);
+        res.setHeader('Set-Cookie', this.clearedCookie());
+        const body = { endSessionUrl };
+        res.status(HTTP_OK).json(body);
+    }
+    me(_req, res) {
+        const scope = (0, oidc_session_context_1.currentSessionScope)();
+        if (scope !== undefined && scope.session !== null) {
+            const actor = scope.session.actor;
+            res.status(HTTP_OK).json(actor);
+            return;
+        }
+        if (scope?.expired === true) {
+            res.setHeader('Set-Cookie', this.clearedCookie());
+            throw new errors_1.SessionExpiredError();
+        }
+        res.status(HTTP_OK).type('application/json');
+        res.send('null');
+    }
+    sessionCookie(value) {
+        const { cookie, ttl } = this.options;
+        return (0, cookie_1.serializeCookie)(cookie.name, value, {
+            httpOnly: true,
+            secure: cookie.secure,
+            sameSite: cookie.sameSite,
+            path: cookie.path,
+            ...(cookie.domain === undefined ? {} : { domain: cookie.domain }),
+            maxAgeSeconds: ttl.absoluteTtlSeconds,
+        });
+    }
+    clearedCookie() {
+        const { cookie } = this.options;
+        return (0, cookie_1.serializeCookie)(cookie.name, '', {
+            httpOnly: true,
+            secure: cookie.secure,
+            sameSite: cookie.sameSite,
+            path: cookie.path,
+            ...(cookie.domain === undefined ? {} : { domain: cookie.domain }),
+            maxAgeSeconds: 0,
+        });
+    }
+};
+exports.OidcSessionAuthController = OidcSessionAuthController;
+__decorate([
+    (0, xema_decorators_1.XemaPublicRoute)({
+        reason: xema_decorators_1.PublicRouteReason.OAuthCallback,
+        notes: 'Begins the authorization-code flow. Unauthenticated by construction: it ' +
+            'is what a browser with no session calls to get one.',
+    }),
+    (0, common_1.Get)('login'),
+    __param(0, (0, common_1.Query)('returnTo')),
+    __param(1, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], OidcSessionAuthController.prototype, "login", null);
+__decorate([
+    (0, xema_decorators_1.XemaPublicRoute)({
+        reason: xema_decorators_1.PublicRouteReason.OAuthCallback,
+        notes: 'The registered OIDC redirect_uri. The identity provider navigates the ' +
+            'browser here with a code; there is no bearer at this point by definition.',
+    }),
+    (0, common_1.Get)('callback'),
+    __param(0, (0, common_1.Query)('code')),
+    __param(1, (0, common_1.Query)('state')),
+    __param(2, (0, common_1.Query)('error')),
+    __param(3, (0, common_1.Query)('error_description')),
+    __param(4, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, Object, Object, Object]),
+    __metadata("design:returntype", Promise)
+], OidcSessionAuthController.prototype, "callback", null);
+__decorate([
+    (0, xema_decorators_1.XemaPublicRoute)({
+        reason: xema_decorators_1.PublicRouteReason.ExternalDelegatedSession,
+        notes: 'Authenticated by the httpOnly session cookie and fenced by ' +
+            'OidcSessionGuard, NOT by a Xema bearer — the browser never holds one. ' +
+            'The global JWT guard is bypassed because the credential is a cookie; the ' +
+            'route is not open.',
+    }),
+    (0, common_1.UseGuards)(oidc_session_guard_1.OidcSessionGuard),
+    (0, common_1.Post)('logout'),
+    __param(0, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], OidcSessionAuthController.prototype, "logout", null);
+__decorate([
+    (0, xema_decorators_1.XemaPublicRoute)({
+        reason: xema_decorators_1.PublicRouteReason.ExternalDelegatedSession,
+        notes: 'Reads the httpOnly session cookie. Deliberately answers 200 with a null ' +
+            'body when nobody is signed in, so a first page load is not an exception.',
+    }),
+    (0, common_1.Get)('me'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", void 0)
+], OidcSessionAuthController.prototype, "me", null);
+exports.OidcSessionAuthController = OidcSessionAuthController = __decorate([
+    (0, common_1.Controller)('auth'),
+    __param(2, (0, common_1.Inject)(tokens_1.OIDC_SESSION_OPTIONS)),
+    __metadata("design:paramtypes", [session_service_1.SessionService,
+        oidc_client_1.OidcClient, Object])
+], OidcSessionAuthController);
+//# sourceMappingURL=oidc-session-auth.controller.js.map

package/dist/nest/oidc-session-auth.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-session-auth.controller.js","sourceRoot":"","sources":["../../src/nest/oidc-session-auth.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAiBA,2CASwB;AACxB,6DAA6E;AAE7E,sCAImB;AACnB,iEAA6D;AAC7D,6DAAwD;AACxD,qCAAgD;AAChD,2CAAmE;AAInE,qDAAiD;AACjD,uCAA8C;AAC9C,gEAA4D;AAiC5D,MAAM,UAAU,GAAG,GAAG,CAAC;AACvB,MAAM,OAAO,GAAG,GAAG,CAAC;AAGb,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IAEjB;IACA;IAIA;IANnB,YACmB,QAAwB,EACxB,MAAkB,EAIlB,OAA2B;QAL3B,aAAQ,GAAR,QAAQ,CAAgB;QACxB,WAAM,GAAN,MAAM,CAAY;QAIlB,YAAO,GAAP,OAAO,CAAoB;IAC3C,CAAC;IAgBE,AAAN,KAAK,CAAC,KAAK,CACU,QAA4B,EACxC,GAAwB;QAE/B,MAAM,IAAI,GAAG,IAAA,qBAAc,GAAE,CAAC;QAC9B,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YAClE,YAAY,EAAE,IAAI,CAAC,QAAQ;YAC3B,aAAa,EAAE,IAAI,CAAC,SAAS;YAC7B,QAAQ,EAAE,IAAA,yBAAgB,EAAC,QAAQ,CAAC;SACrC,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IACpD,CAAC;IAgBK,AAAN,KAAK,CAAC,QAAQ,CACG,IAAwB,EACvB,KAAyB,EACzB,KAAyB,EACb,gBAAoC,EACzD,GAAwB;QAE/B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,kCAAyB,CACjC,8CAA8C,KAAK,EAAE;gBACnD,GAAG,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,gBAAgB,EAAE,IAAI,CACvE,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,kCAAyB,CAAC,gCAAgC,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,kCAAyB,CACjC,6CAA6C,CAC9C,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;QACpE,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,mCAA0B,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YAC9C,IAAI;YACJ,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;QAKH,MAAM,KAAK,GAAG,IAAA,0CAAmB,GAAE,CAAC;QACpC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAClD,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CACtD,QAAQ,EACR,OAAO,CAAC,QAAQ,CACjB,CAAC;QACF,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;QACzE,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC;IAC/D,CAAC;IAmBK,AAAN,KAAK,CAAC,MAAM,CAAQ,GAAwB;QAC1C,MAAM,KAAK,GAAG,IAAA,0CAAmB,GAAE,CAAC;QACpC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC;QAC7E,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;QAClD,MAAM,IAAI,GAAmB,EAAE,aAAa,EAAE,CAAC;QAC/C,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAkBD,EAAE,CAAQ,IAAyB,EAAS,GAAwB;QAClE,MAAM,KAAK,GAAG,IAAA,0CAAmB,GAAE,CAAC;QACpC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAClD,MAAM,KAAK,GAAiB,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;QACD,IAAI,KAAK,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;YAC5B,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;YAIlD,MAAM,IAAI,4BAAmB,EAAE,CAAC;QAClC,CAAC;QAID,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC7C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnB,CAAC;IAEO,aAAa,CAAC,KAAa;QACjC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QACrC,OAAO,IAAA,wBAAe,EAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;YACzC,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;YACjE,aAAa,EAAE,GAAG,CAAC,kBAAkB;SACtC,CAAC,CAAC;IACL,CAAC;IAEO,aAAa;QACnB,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAChC,OAAO,IAAA,wBAAe,EAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE;YACtC,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;YACjE,aAAa,EAAE,CAAC;SACjB,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAzLY,8DAAyB;AAwB9B;IAPL,IAAA,iCAAe,EAAC;QACf,MAAM,EAAE,mCAAiB,CAAC,aAAa;QACvC,KAAK,EACH,0EAA0E;YAC1E,qDAAqD;KACxD,CAAC;IACD,IAAA,YAAG,EAAC,OAAO,CAAC;IAEV,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;IACjB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;sDASP;AAgBK;IAPL,IAAA,iCAAe,EAAC;QACf,MAAM,EAAE,mCAAiB,CAAC,aAAa;QACvC,KAAK,EACH,wEAAwE;YACxE,2EAA2E;KAC9E,CAAC;IACD,IAAA,YAAG,EAAC,UAAU,CAAC;IAEb,WAAA,IAAA,cAAK,EAAC,MAAM,CAAC,CAAA;IACb,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,WAAA,IAAA,cAAK,EAAC,mBAAmB,CAAC,CAAA;IAC1B,WAAA,IAAA,YAAG,GAAE,CAAA;;;;yDA0CP;AAmBK;IAVL,IAAA,iCAAe,EAAC;QACf,MAAM,EAAE,mCAAiB,CAAC,wBAAwB;QAClD,KAAK,EACH,6DAA6D;YAC7D,wEAAwE;YACxE,2EAA2E;YAC3E,oBAAoB;KACvB,CAAC;IACD,IAAA,kBAAS,EAAC,qCAAgB,CAAC;IAC3B,IAAA,aAAI,EAAC,QAAQ,CAAC;IACD,WAAA,IAAA,YAAG,GAAE,CAAA;;;;uDAMlB;AAkBD;IAPC,IAAA,iCAAe,EAAC;QACf,MAAM,EAAE,mCAAiB,CAAC,wBAAwB;QAClD,KAAK,EACH,0EAA0E;YAC1E,0EAA0E;KAC7E,CAAC;IACD,IAAA,YAAG,EAAC,IAAI,CAAC;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;IAA6B,WAAA,IAAA,YAAG,GAAE,CAAA;;;;mDAmB1C;oCAhKU,yBAAyB;IADrC,IAAA,mBAAU,EAAC,MAAM,CAAC;IAOd,WAAA,IAAA,eAAM,EAAC,6BAAoB,CAAC,CAAA;qCAJF,gCAAc;QAChB,wBAAU;GAH1B,yBAAyB,CAyLrC"}

package/dist/nest/oidc-session-context.d.ts

@@ -0,0 +1,11 @@
+import type { LiveSession } from '../session/session-service';
+export interface OidcSessionScope {
+    readonly session: LiveSession | null;
+    readonly expired: boolean;
+    projectId: string | null;
+}
+export declare function runWithSessionScope<T>(scope: OidcSessionScope, fn: () => T): T;
+export declare function currentSessionScope(): OidcSessionScope | undefined;
+export declare function currentSession(): LiveSession | null;
+export declare function setCurrentProjectId(projectId: string | null): void;
+//# sourceMappingURL=oidc-session-context.d.ts.map

package/dist/nest/oidc-session-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-session-context.d.ts","sourceRoot":"","sources":["../../src/nest/oidc-session-context.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAG9D,MAAM,WAAW,gBAAgB;IAE/B,QAAQ,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAOrC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAS1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAuBD,wBAAgB,mBAAmB,CAAC,CAAC,EACnC,KAAK,EAAE,gBAAgB,EACvB,EAAE,EAAE,MAAM,CAAC,GACV,CAAC,CAEH;AAGD,wBAAgB,mBAAmB,IAAI,gBAAgB,GAAG,SAAS,CAElE;AAUD,wBAAgB,cAAc,IAAI,WAAW,GAAG,IAAI,CAEnD;AASD,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAUlE"}

package/dist/nest/oidc-session-context.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runWithSessionScope = runWithSessionScope;
+exports.currentSessionScope = currentSessionScope;
+exports.currentSession = currentSession;
+exports.setCurrentProjectId = setCurrentProjectId;
+const node_async_hooks_1 = require("node:async_hooks");
+const SCOPE_STORAGE_KEY = Symbol.for('@xemahq/oidc-session-nest:scope-storage');
+function storage() {
+    const holder = globalThis;
+    const existing = holder[SCOPE_STORAGE_KEY];
+    if (existing !== undefined) {
+        return existing;
+    }
+    const created = new node_async_hooks_1.AsyncLocalStorage();
+    holder[SCOPE_STORAGE_KEY] = created;
+    return created;
+}
+function runWithSessionScope(scope, fn) {
+    return storage().run(scope, fn);
+}
+function currentSessionScope() {
+    return storage().getStore();
+}
+function currentSession() {
+    return currentSessionScope()?.session ?? null;
+}
+function setCurrentProjectId(projectId) {
+    const scope = currentSessionScope();
+    if (scope === undefined) {
+        throw new Error('[oidc-session-nest] setCurrentProjectId was called outside a request ' +
+            'scope. Mount OidcSessionModule so its middleware runs, or call this ' +
+            'inside runWithSessionScope.');
+    }
+    scope.projectId = projectId;
+}
+//# sourceMappingURL=oidc-session-context.js.map

package/dist/nest/oidc-session-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-session-context.js","sourceRoot":"","sources":["../../src/nest/oidc-session-context.ts"],"names":[],"mappings":";;AAkEA,kDAKC;AAGD,kDAEC;AAUD,wCAEC;AASD,kDAUC;AAxFD,uDAAqD;AA0BrD,MAAM,iBAAiB,GAAG,MAAM,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;AAMhF,SAAS,OAAO;IACd,MAAM,MAAM,GAAG,UAAoC,CAAC;IACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC3C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,oCAAiB,EAAoB,CAAC;IAC1D,MAAM,CAAC,iBAAiB,CAAC,GAAG,OAAO,CAAC;IACpC,OAAO,OAAO,CAAC;AACjB,CAAC;AAMD,SAAgB,mBAAmB,CACjC,KAAuB,EACvB,EAAW;IAEX,OAAO,OAAO,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC;AAGD,SAAgB,mBAAmB;IACjC,OAAO,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAUD,SAAgB,cAAc;IAC5B,OAAO,mBAAmB,EAAE,EAAE,OAAO,IAAI,IAAI,CAAC;AAChD,CAAC;AASD,SAAgB,mBAAmB,CAAC,SAAwB;IAC1D,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,uEAAuE;YACrE,sEAAsE;YACtE,6BAA6B,CAChC,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;AAC9B,CAAC"}

package/dist/nest/oidc-session.guard.d.ts

@@ -0,0 +1,5 @@
+import { type CanActivate, type ExecutionContext } from '@nestjs/common';
+export declare class OidcSessionGuard implements CanActivate {
+    canActivate(context: ExecutionContext): boolean;
+}
+//# sourceMappingURL=oidc-session.guard.d.ts.map

package/dist/nest/oidc-session.guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-session.guard.d.ts","sourceRoot":"","sources":["../../src/nest/oidc-session.guard.ts"],"names":[],"mappings":"AAWA,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACtB,MAAM,gBAAgB,CAAC;AAWxB,qBACa,gBAAiB,YAAW,WAAW;IAClD,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO;CAqBhD"}

package/dist/nest/oidc-session.guard.js

@@ -0,0 +1,43 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OidcSessionGuard = void 0;
+const common_1 = require("@nestjs/common");
+const errors_1 = require("../errors");
+const oidc_session_context_1 = require("./oidc-session-context");
+const oidc_session_middleware_1 = require("./oidc-session.middleware");
+let OidcSessionGuard = class OidcSessionGuard {
+    canActivate(context) {
+        const scope = readScope(context);
+        if (scope === undefined) {
+            throw new Error('[oidc-session-nest] OidcSessionGuard ran without a session scope. ' +
+                'OidcSessionModule was not mounted, or its middleware does not cover ' +
+                'this route, so no request has a session to check.');
+        }
+        if (scope.session !== null) {
+            return true;
+        }
+        if (scope.expired) {
+            throw new errors_1.SessionExpiredError();
+        }
+        throw new errors_1.SessionRequiredError();
+    }
+};
+exports.OidcSessionGuard = OidcSessionGuard;
+exports.OidcSessionGuard = OidcSessionGuard = __decorate([
+    (0, common_1.Injectable)()
+], OidcSessionGuard);
+function readScope(context) {
+    const ambient = (0, oidc_session_context_1.currentSessionScope)();
+    if (ambient !== undefined) {
+        return ambient;
+    }
+    const request = context.switchToHttp().getRequest();
+    return request[oidc_session_middleware_1.OIDC_SESSION_SCOPE];
+}
+//# sourceMappingURL=oidc-session.guard.js.map

package/dist/nest/oidc-session.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-session.guard.js","sourceRoot":"","sources":["../../src/nest/oidc-session.guard.ts"],"names":[],"mappings":";;;;;;;;;AAWA,2CAIwB;AAExB,sCAAsE;AACtE,iEAA6D;AAC7D,uEAGmC;AAK5B,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAC3B,WAAW,CAAC,OAAyB;QACnC,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAKxB,MAAM,IAAI,KAAK,CACb,oEAAoE;gBAClE,sEAAsE;gBACtE,mDAAmD,CACtD,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,4BAAmB,EAAE,CAAC;QAClC,CAAC;QACD,MAAM,IAAI,6BAAoB,EAAE,CAAC;IACnC,CAAC;CACF,CAAA;AAtBY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;GACA,gBAAgB,CAsB5B;AAED,SAAS,SAAS,CAAC,OAAyB;IAC1C,MAAM,OAAO,GAAG,IAAA,0CAAmB,GAAE,CAAC;IACtC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAuB,CAAC;IACzE,OAAO,OAAO,CAAC,4CAAkB,CAAC,CAAC;AACrC,CAAC"}

package/dist/nest/oidc-session.middleware.d.ts

@@ -0,0 +1,19 @@
+import { type NestMiddleware } from '@nestjs/common';
+import { type OidcSessionScope } from './oidc-session-context';
+import { SessionService } from '../session/session-service';
+import type { OidcSessionOptions } from '../config/oidc-session-options';
+export interface SessionRequestLike {
+    headers: Record<string, string | string[] | undefined>;
+}
+export declare const OIDC_SESSION_SCOPE: unique symbol;
+export interface SessionScopeCarrier {
+    [OIDC_SESSION_SCOPE]?: OidcSessionScope;
+}
+export declare class OidcSessionMiddleware implements NestMiddleware {
+    private readonly sessions;
+    private readonly options;
+    constructor(sessions: SessionService, options: OidcSessionOptions);
+    use(req: SessionRequestLike, _res: unknown, next: (error?: unknown) => void): Promise<void>;
+    private resolveScope;
+}
+//# sourceMappingURL=oidc-session.middleware.d.ts.map

package/dist/nest/oidc-session.middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-session.middleware.d.ts","sourceRoot":"","sources":["../../src/nest/oidc-session.middleware.ts"],"names":[],"mappings":"AAaA,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEzE,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AASzE,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;CACxD;AAUD,eAAO,MAAM,kBAAkB,EAAE,OAAO,MAEvC,CAAC;AAGF,MAAM,WAAW,mBAAmB;IAClC,CAAC,kBAAkB,CAAC,CAAC,EAAE,gBAAgB,CAAC;CACzC;AAED,qBACa,qBAAsB,YAAW,cAAc;IAExD,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAIzB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAJP,QAAQ,EAAE,cAAc,EAIxB,OAAO,EAAE,kBAAkB;IAGxC,GAAG,CACP,GAAG,EAAE,kBAAkB,EACvB,IAAI,EAAE,OAAO,EACb,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,GAC9B,OAAO,CAAC,IAAI,CAAC;YAYF,YAAY;CAgB3B"}