@xemahq/oidc-session-nest 0.1.0

package/dist/oidc/oidc-client.js

@@ -0,0 +1,190 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OidcClient = exports.OidcInvalidGrantError = void 0;
+const errors_1 = require("../errors");
+class OidcInvalidGrantError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'OidcInvalidGrantError';
+    }
+}
+exports.OidcInvalidGrantError = OidcInvalidGrantError;
+const DEFAULT_EXPIRES_IN_SECONDS = 300;
+class OidcClient {
+    options;
+    discovery;
+    verifier;
+    fetchImpl;
+    jwksCacheKey;
+    constructor(deps) {
+        this.options = deps.options;
+        this.discovery = deps.discovery;
+        this.verifier = deps.verifier;
+        this.fetchImpl = deps.fetchImpl;
+        this.jwksCacheKey = `oidc-session-nest:${deps.options.issuerUrl}`;
+    }
+    async buildAuthorizationUrl(request) {
+        const document = await this.discovery.resolve();
+        const url = new URL(document.authorizationEndpoint);
+        url.searchParams.set('response_type', 'code');
+        url.searchParams.set('client_id', this.options.clientId);
+        url.searchParams.set('redirect_uri', this.options.redirectUri);
+        url.searchParams.set('scope', this.options.scope);
+        url.searchParams.set('state', request.state);
+        url.searchParams.set('nonce', request.nonce);
+        url.searchParams.set('code_challenge', request.codeChallenge);
+        url.searchParams.set('code_challenge_method', 'S256');
+        return url.toString();
+    }
+    async exchangeCode(input) {
+        const body = new URLSearchParams({
+            grant_type: 'authorization_code',
+            code: input.code,
+            redirect_uri: this.options.redirectUri,
+            client_id: this.options.clientId,
+            code_verifier: input.codeVerifier,
+        });
+        const response = await this.postToTokenEndpoint(body);
+        return this.toTokenSet(response, input.nonce);
+    }
+    async refresh(refreshToken) {
+        const body = new URLSearchParams({
+            grant_type: 'refresh_token',
+            refresh_token: refreshToken,
+            client_id: this.options.clientId,
+        });
+        const response = await this.postToTokenEndpoint(body);
+        return this.toTokenSet(response, undefined);
+    }
+    async buildEndSessionUrl(idToken) {
+        const document = await this.discovery.resolve();
+        if (document.endSessionEndpoint === undefined) {
+            return null;
+        }
+        const url = new URL(document.endSessionEndpoint);
+        url.searchParams.set('client_id', this.options.clientId);
+        if (idToken !== undefined) {
+            url.searchParams.set('id_token_hint', idToken);
+        }
+        if (this.options.postLogoutRedirectUri !== undefined) {
+            url.searchParams.set('post_logout_redirect_uri', this.options.postLogoutRedirectUri);
+        }
+        return url.toString();
+    }
+    async postToTokenEndpoint(body) {
+        const document = await this.discovery.resolve();
+        const headers = {
+            'content-type': 'application/x-www-form-urlencoded',
+            accept: 'application/json',
+        };
+        if (this.options.clientSecret !== undefined) {
+            const credentials = Buffer.from(`${encodeURIComponent(this.options.clientId)}:${encodeURIComponent(this.options.clientSecret)}`, 'utf8').toString('base64');
+            headers.authorization = `Basic ${credentials}`;
+        }
+        let ok;
+        let status;
+        let text;
+        try {
+            const response = await this.fetchImpl(document.tokenEndpoint, {
+                method: 'POST',
+                headers,
+                body: body.toString(),
+            });
+            ok = response.ok;
+            status = response.status;
+            text = await response.text();
+        }
+        catch (error) {
+            throw new errors_1.OidcTokenEndpointFailedError(`The token endpoint at ${document.tokenEndpoint} could not be reached: ` +
+                `${error instanceof Error ? error.message : String(error)}`);
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(text);
+        }
+        catch {
+            throw new errors_1.OidcTokenEndpointFailedError(`The token endpoint at ${document.tokenEndpoint} answered HTTP ${status} ` +
+                'with a body that is not JSON.');
+        }
+        if (parsed === null || typeof parsed !== 'object') {
+            throw new errors_1.OidcTokenEndpointFailedError(`The token endpoint at ${document.tokenEndpoint} answered HTTP ${status} ` +
+                'with a body that is not a JSON object.');
+        }
+        const payload = parsed;
+        if (!ok) {
+            const code = typeof payload.error === 'string' ? payload.error : 'unknown_error';
+            const description = typeof payload.error_description === 'string'
+                ? `: ${payload.error_description}`
+                : '';
+            if (code === 'invalid_grant') {
+                throw new OidcInvalidGrantError(`The identity provider rejected the grant (invalid_grant${description}).`);
+            }
+            throw new errors_1.OidcTokenEndpointFailedError(`The token endpoint answered HTTP ${status} (${code}${description}).`);
+        }
+        return payload;
+    }
+    async toTokenSet(payload, expectedNonce) {
+        const accessToken = payload.access_token;
+        if (typeof accessToken !== 'string' || accessToken === '') {
+            throw new errors_1.OidcTokenEndpointFailedError('The token endpoint returned no access_token.');
+        }
+        const document = await this.discovery.resolve();
+        let accessClaims;
+        try {
+            accessClaims = await this.verifier.verify(accessToken, {
+                jwksUrl: document.jwksUri,
+                cacheKey: this.jwksCacheKey,
+                expectedIssuers: [document.issuer],
+            });
+        }
+        catch (error) {
+            throw new errors_1.OidcCallbackRejectedError(`The access token did not verify: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        const rawIdToken = payload.id_token;
+        let idClaims;
+        if (typeof rawIdToken === 'string' && rawIdToken !== '') {
+            try {
+                idClaims = await this.verifier.verify(rawIdToken, {
+                    jwksUrl: document.jwksUri,
+                    cacheKey: this.jwksCacheKey,
+                    expectedIssuers: [document.issuer],
+                    expectedAudiences: [this.options.clientId],
+                });
+            }
+            catch (error) {
+                throw new errors_1.OidcCallbackRejectedError(`The id token did not verify: ${error instanceof Error ? error.message : String(error)}`);
+            }
+            if (expectedNonce !== undefined && idClaims.nonce !== expectedNonce) {
+                throw new errors_1.OidcCallbackRejectedError('The id token nonce does not match this sign-in attempt. Refusing: a ' +
+                    'valid token from a different attempt would otherwise be accepted.');
+            }
+        }
+        const expiresAt = resolveExpiry(payload, accessClaims);
+        const refreshToken = payload.refresh_token;
+        const tokenSet = {
+            accessToken,
+            ...(typeof refreshToken === 'string' && refreshToken !== ''
+                ? { refreshToken }
+                : {}),
+            ...(typeof rawIdToken === 'string' && rawIdToken !== ''
+                ? { idToken: rawIdToken }
+                : {}),
+            accessTokenExpiresAt: expiresAt,
+            accessClaims,
+            ...(idClaims === undefined ? {} : { idClaims }),
+        };
+        return tokenSet;
+    }
+}
+exports.OidcClient = OidcClient;
+function resolveExpiry(payload, claims) {
+    if (typeof claims.exp === 'number' && Number.isFinite(claims.exp)) {
+        return claims.exp * 1000;
+    }
+    const expiresIn = payload.expires_in;
+    const seconds = typeof expiresIn === 'number' && Number.isFinite(expiresIn) && expiresIn > 0
+        ? expiresIn
+        : DEFAULT_EXPIRES_IN_SECONDS;
+    return Date.now() + seconds * 1000;
+}
+//# sourceMappingURL=oidc-client.js.map

package/dist/oidc/oidc-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-client.js","sourceRoot":"","sources":["../../src/oidc/oidc-client.ts"],"names":[],"mappings":";;;AAaA,sCAGmB;AA+BnB,MAAa,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AALD,sDAKC;AAiBD,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAEvC,MAAa,UAAU;IACJ,OAAO,CAAsB;IAE7B,SAAS,CAAgB;IAEzB,QAAQ,CAAe;IAEvB,SAAS,CAAY;IAOrB,YAAY,CAAS;IAEtC,YAAY,IAAoB;QAC9B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,qBAAqB,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;IACpE,CAAC;IAGD,KAAK,CAAC,qBAAqB,CAAC,OAA6B;QACvD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;QACpD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC/D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;QAC9D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QACtD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IASD,KAAK,CAAC,YAAY,CAAC,KAIlB;QACC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,oBAAoB;YAChC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;YACtC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAChC,aAAa,EAAE,KAAK,CAAC,YAAY;SAClC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IAQD,KAAK,CAAC,OAAO,CAAC,YAAoB;QAChC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;YAC3B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;SACjC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAGtD,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC9C,CAAC;IASD,KAAK,CAAC,kBAAkB,CAAC,OAAgB;QACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QAChD,IAAI,QAAQ,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;QACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;YACrD,GAAG,CAAC,YAAY,CAAC,GAAG,CAClB,0BAA0B,EAC1B,IAAI,CAAC,OAAO,CAAC,qBAAqB,CACnC,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAC/B,IAAqB;QAErB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QAChD,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;SAC3B,CAAC;QACF,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAG5C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAC7B,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAC/F,MAAM,CACP,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACrB,OAAO,CAAC,aAAa,GAAG,SAAS,WAAW,EAAE,CAAC;QACjD,CAAC;QAED,IAAI,EAAW,CAAC;QAChB,IAAI,MAAc,CAAC;QACnB,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE;gBAC5D,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;aACtB,CAAC,CAAC;YACH,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;YACjB,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;YACzB,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,qCAA4B,CACpC,yBAAyB,QAAQ,CAAC,aAAa,yBAAyB;gBACtE,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9D,CAAC;QACJ,CAAC;QAED,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,qCAA4B,CACpC,yBAAyB,QAAQ,CAAC,aAAa,kBAAkB,MAAM,GAAG;gBACxE,+BAA+B,CAClC,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAClD,MAAM,IAAI,qCAA4B,CACpC,yBAAyB,QAAQ,CAAC,aAAa,kBAAkB,MAAM,GAAG;gBACxE,wCAAwC,CAC3C,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAiC,CAAC;QAElD,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,IAAI,GAAG,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC;YACjF,MAAM,WAAW,GACf,OAAO,OAAO,CAAC,iBAAiB,KAAK,QAAQ;gBAC3C,CAAC,CAAC,KAAK,OAAO,CAAC,iBAAiB,EAAE;gBAClC,CAAC,CAAC,EAAE,CAAC;YACT,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;gBAC7B,MAAM,IAAI,qBAAqB,CAC7B,0DAA0D,WAAW,IAAI,CAC1E,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,qCAA4B,CACpC,oCAAoC,MAAM,KAAK,IAAI,GAAG,WAAW,IAAI,CACtE,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,OAAgC,EAChC,aAAiC;QAEjC,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;QACzC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;YAC1D,MAAM,IAAI,qCAA4B,CACpC,8CAA8C,CAC/C,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QAMhD,IAAI,YAA+B,CAAC;QACpC,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE;gBACrD,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,QAAQ,EAAE,IAAI,CAAC,YAAY;gBAC3B,eAAe,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;aACnC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,kCAAyB,CACjC,oCAAoC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC7F,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC;QACpC,IAAI,QAAuC,CAAC;QAC5C,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;YACxD,IAAI,CAAC;gBAIH,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE;oBAChD,OAAO,EAAE,QAAQ,CAAC,OAAO;oBACzB,QAAQ,EAAE,IAAI,CAAC,YAAY;oBAC3B,eAAe,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAClC,iBAAiB,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;iBAC3C,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,kCAAyB,CACjC,gCAAgC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACzF,CAAC;YACJ,CAAC;YACD,IAAI,aAAa,KAAK,SAAS,IAAI,QAAQ,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;gBACpE,MAAM,IAAI,kCAAyB,CACjC,sEAAsE;oBACpE,mEAAmE,CACtE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACvD,MAAM,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC;QAC3C,MAAM,QAAQ,GAAiB;YAC7B,WAAW;YACX,GAAG,CAAC,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,EAAE;gBACzD,CAAC,CAAC,EAAE,YAAY,EAAE;gBAClB,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,EAAE;gBACrD,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE;gBACzB,CAAC,CAAC,EAAE,CAAC;YACP,oBAAoB,EAAE,SAAS;YAC/B,YAAY;YACZ,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;SAChD,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAzPD,gCAyPC;AAYD,SAAS,aAAa,CACpB,OAAgC,EAChC,MAAyB;IAEzB,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,OAAO,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC;IAC3B,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;IACrC,MAAM,OAAO,GACX,OAAO,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC;QAC1E,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,0BAA0B,CAAC;IACjC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC;AACrC,CAAC"}

package/dist/oidc/pkce.d.ts

@@ -0,0 +1,8 @@
+export interface PkcePair {
+    readonly verifier: string;
+    readonly challenge: string;
+    readonly method: 'S256';
+}
+export declare function randomUrlSafeToken(bytes?: number): string;
+export declare function createPkcePair(): PkcePair;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/oidc/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../src/oidc/pkce.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,QAAQ;IAEvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAYD,wBAAgB,kBAAkB,CAAC,KAAK,GAAE,MAAoB,GAAG,MAAM,CAEtE;AAGD,wBAAgB,cAAc,IAAI,QAAQ,CAIzC"}

package/dist/oidc/pkce.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.randomUrlSafeToken = randomUrlSafeToken;
+exports.createPkcePair = createPkcePair;
+const node_crypto_1 = require("node:crypto");
+const TOKEN_BYTES = 32;
+function randomUrlSafeToken(bytes = TOKEN_BYTES) {
+    return (0, node_crypto_1.randomBytes)(bytes).toString('base64url');
+}
+function createPkcePair() {
+    const verifier = randomUrlSafeToken();
+    const challenge = (0, node_crypto_1.createHash)('sha256').update(verifier).digest('base64url');
+    return { verifier, challenge, method: 'S256' };
+}
+//# sourceMappingURL=pkce.js.map

package/dist/oidc/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../src/oidc/pkce.ts"],"names":[],"mappings":";;AA6BA,gDAEC;AAGD,wCAIC;AA/BD,6CAAsD;AAatD,MAAM,WAAW,GAAG,EAAE,CAAC;AASvB,SAAgB,kBAAkB,CAAC,QAAgB,WAAW;IAC5D,OAAO,IAAA,yBAAW,EAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAClD,CAAC;AAGD,SAAgB,cAAc;IAC5B,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACjD,CAAC"}

package/dist/session/actor.d.ts

@@ -0,0 +1,14 @@
+import { type OrgRole } from '@xemahq/platform-common';
+import type { SessionRecord } from './session-store';
+export interface SessionActor {
+    readonly subjectId: string;
+    readonly activeOrgId: string | null;
+    readonly orgRoles: Readonly<Record<string, OrgRole>>;
+    readonly expiresAt: number;
+    readonly accessTokenExpiresAt: number;
+    readonly claims: Readonly<Record<string, unknown>>;
+}
+export declare function resolveInitialActiveOrgId(claims: Readonly<Record<string, unknown>>): string | null;
+export declare function resolveSessionOrgRoles(claims: Readonly<Record<string, unknown>>): Record<string, OrgRole>;
+export declare function toSessionActor(record: SessionRecord): SessionActor;
+//# sourceMappingURL=actor.d.ts.map

package/dist/session/actor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actor.d.ts","sourceRoot":"","sources":["../../src/session/actor.ts"],"names":[],"mappings":"AAUA,OAAO,EAGL,KAAK,OAAO,EACb,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAGrD,MAAM,WAAW,YAAY;IAE3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAQ3B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAEpC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAErD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IAEtC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACpD;AAiBD,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACxC,MAAM,GAAG,IAAI,CAgBf;AAGD,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACxC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzB;AAGD,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,GAAG,YAAY,CASlE"}

package/dist/session/actor.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveInitialActiveOrgId = resolveInitialActiveOrgId;
+exports.resolveSessionOrgRoles = resolveSessionOrgRoles;
+exports.toSessionActor = toSessionActor;
+const platform_common_1 = require("@xemahq/platform-common");
+function resolveInitialActiveOrgId(claims) {
+    const declared = (0, platform_common_1.resolveOrgClaim)(claims);
+    if (declared !== null) {
+        return declared.value;
+    }
+    const roles = (0, platform_common_1.resolveOrgRoles)(claims);
+    const orgIds = Object.keys(roles);
+    if (orgIds.length === 1) {
+        return orgIds[0] ?? null;
+    }
+    return null;
+}
+function resolveSessionOrgRoles(claims) {
+    return (0, platform_common_1.resolveOrgRoles)(claims);
+}
+function toSessionActor(record) {
+    return {
+        subjectId: record.subjectId,
+        activeOrgId: record.activeOrgId,
+        orgRoles: record.orgRoles,
+        expiresAt: record.absoluteExpiresAt,
+        accessTokenExpiresAt: record.accessTokenExpiresAt,
+        claims: record.claims,
+    };
+}
+//# sourceMappingURL=actor.js.map

package/dist/session/actor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actor.js","sourceRoot":"","sources":["../../src/session/actor.ts"],"names":[],"mappings":";;AAuDA,8DAkBC;AAGD,wDAIC;AAGD,wCASC;AAlFD,6DAIiC;AAyCjC,SAAgB,yBAAyB,CACvC,MAAyC;IAOzC,MAAM,QAAQ,GAAG,IAAA,iCAAe,EAAC,MAAM,CAAC,CAAC;IACzC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,QAAQ,CAAC,KAAK,CAAC;IACxB,CAAC;IACD,MAAM,KAAK,GAAG,IAAA,iCAAe,EAAC,MAAM,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAGD,SAAgB,sBAAsB,CACpC,MAAyC;IAEzC,OAAO,IAAA,iCAAe,EAAC,MAAM,CAAC,CAAC;AACjC,CAAC;AAGD,SAAgB,cAAc,CAAC,MAAqB;IAClD,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,MAAM,CAAC,iBAAiB;QACnC,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;QACjD,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC;AACJ,CAAC"}

package/dist/session/in-memory-session-store.d.ts

@@ -0,0 +1,21 @@
+import type { PendingAuthorization, ReadSessionOptions, SessionRecord, SessionStore } from './session-store';
+export interface InMemorySessionStoreOptions {
+    readonly now?: () => number;
+}
+export declare class InMemorySessionStore implements SessionStore {
+    private readonly sessions;
+    private readonly leases;
+    private readonly pending;
+    private readonly now;
+    constructor(options?: InMemorySessionStoreOptions);
+    createSession(key: string, record: SessionRecord, ttlMs: number): Promise<boolean>;
+    readSession(key: string, options: ReadSessionOptions): Promise<SessionRecord | null>;
+    replaceSession(key: string, expectedVersion: number, record: SessionRecord, ttlMs: number): Promise<boolean>;
+    deleteSession(key: string): Promise<void>;
+    acquireRefreshLease(key: string, ttlMs: number): Promise<boolean>;
+    releaseRefreshLease(key: string): Promise<void>;
+    putPendingAuthorization(state: string, pending: PendingAuthorization, ttlMs: number): Promise<void>;
+    takePendingAuthorization(state: string): Promise<PendingAuthorization | null>;
+    private live;
+}
+//# sourceMappingURL=in-memory-session-store.d.ts.map

package/dist/session/in-memory-session-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory-session-store.d.ts","sourceRoot":"","sources":["../../src/session/in-memory-session-store.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EACV,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,YAAY,EACb,MAAM,iBAAiB,CAAC;AAOzB,MAAM,WAAW,2BAA2B;IAE1C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED,qBAAa,oBAAqB,YAAW,YAAY;IACvD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA2C;IAEpE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkC;IAEzD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkD;IAE1E,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,OAAO,GAAE,2BAAgC;IAIrD,aAAa,CACX,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC;IAQnB,WAAW,CACT,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAiBhC,cAAc,CACZ,GAAG,EAAE,MAAM,EACX,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC;IAYnB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKzC,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQjE,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK/C,uBAAuB,CACrB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,oBAAoB,EAC7B,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC;IAKhB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAM7E,OAAO,CAAC,IAAI;CAWb"}

package/dist/session/in-memory-session-store.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InMemorySessionStore = void 0;
+class InMemorySessionStore {
+    sessions = new Map();
+    leases = new Map();
+    pending = new Map();
+    now;
+    constructor(options = {}) {
+        this.now = options.now ?? (() => Date.now());
+    }
+    createSession(key, record, ttlMs) {
+        if (this.live(this.sessions, key) !== null) {
+            return Promise.resolve(false);
+        }
+        this.sessions.set(key, { value: record, expiresAt: this.now() + ttlMs });
+        return Promise.resolve(true);
+    }
+    readSession(key, options) {
+        const entry = this.live(this.sessions, key);
+        if (entry === null) {
+            return Promise.resolve(null);
+        }
+        if (options.now >= entry.value.absoluteExpiresAt) {
+            this.sessions.delete(key);
+            return Promise.resolve(null);
+        }
+        entry.expiresAt = Math.min(options.now + options.idleTtlMs, entry.value.absoluteExpiresAt);
+        return Promise.resolve(entry.value);
+    }
+    replaceSession(key, expectedVersion, record, ttlMs) {
+        const entry = this.live(this.sessions, key);
+        if (entry === null || entry.value.version !== expectedVersion) {
+            return Promise.resolve(false);
+        }
+        this.sessions.set(key, {
+            value: record,
+            expiresAt: Math.min(this.now() + ttlMs, record.absoluteExpiresAt),
+        });
+        return Promise.resolve(true);
+    }
+    deleteSession(key) {
+        this.sessions.delete(key);
+        return Promise.resolve();
+    }
+    acquireRefreshLease(key, ttlMs) {
+        if (this.live(this.leases, key) !== null) {
+            return Promise.resolve(false);
+        }
+        this.leases.set(key, { value: true, expiresAt: this.now() + ttlMs });
+        return Promise.resolve(true);
+    }
+    releaseRefreshLease(key) {
+        this.leases.delete(key);
+        return Promise.resolve();
+    }
+    putPendingAuthorization(state, pending, ttlMs) {
+        this.pending.set(state, { value: pending, expiresAt: this.now() + ttlMs });
+        return Promise.resolve();
+    }
+    takePendingAuthorization(state) {
+        const entry = this.live(this.pending, state);
+        this.pending.delete(state);
+        return Promise.resolve(entry === null ? null : entry.value);
+    }
+    live(map, key) {
+        const entry = map.get(key);
+        if (entry === undefined) {
+            return null;
+        }
+        if (this.now() >= entry.expiresAt) {
+            map.delete(key);
+            return null;
+        }
+        return entry;
+    }
+}
+exports.InMemorySessionStore = InMemorySessionStore;
+//# sourceMappingURL=in-memory-session-store.js.map

package/dist/session/in-memory-session-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory-session-store.js","sourceRoot":"","sources":["../../src/session/in-memory-session-store.ts"],"names":[],"mappings":";;;AA8BA,MAAa,oBAAoB;IACd,QAAQ,GAAG,IAAI,GAAG,EAAgC,CAAC;IAEnD,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAExC,OAAO,GAAG,IAAI,GAAG,EAAuC,CAAC;IAEzD,GAAG,CAAe;IAEnC,YAAY,UAAuC,EAAE;QACnD,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,aAAa,CACX,GAAW,EACX,MAAqB,EACrB,KAAa;QAEb,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;YAC3C,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QACzE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,WAAW,CACT,GAAW,EACX,OAA2B;QAE3B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC5C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;YACjD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1B,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAED,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CACxB,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,SAAS,EAC/B,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAC9B,CAAC;QACF,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAED,cAAc,CACZ,GAAW,EACX,eAAuB,EACvB,MAAqB,EACrB,KAAa;QAEb,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC5C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,eAAe,EAAE,CAAC;YAC9D,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE;YACrB,KAAK,EAAE,MAAM;YACb,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,MAAM,CAAC,iBAAiB,CAAC;SAClE,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,aAAa,CAAC,GAAW;QACvB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED,mBAAmB,CAAC,GAAW,EAAE,KAAa;QAC5C,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;YACzC,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QACrE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,mBAAmB,CAAC,GAAW;QAC7B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACxB,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED,uBAAuB,CACrB,KAAa,EACb,OAA6B,EAC7B,KAAa;QAEb,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QAC3E,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED,wBAAwB,CAAC,KAAa;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC;IAEO,IAAI,CAAI,GAA0B,EAAE,GAAW;QACrD,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YAClC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AA1GD,oDA0GC"}

package/dist/session/redis-session-store.d.ts

@@ -0,0 +1,28 @@
+import type { PendingAuthorization, ReadSessionOptions, SessionRecord, SessionStore } from './session-store';
+export interface RedisScriptClient {
+    eval(script: string, keys: readonly string[], args?: readonly (string | number)[]): Promise<unknown>;
+}
+export interface IoredisLike {
+    eval(...args: unknown[]): Promise<unknown>;
+}
+export declare function ioredisScriptClient(client: IoredisLike): RedisScriptClient;
+export interface RedisSessionStoreOptions {
+    readonly keyPrefix: string;
+}
+export declare class RedisSessionStore implements SessionStore {
+    private readonly client;
+    private readonly options;
+    constructor(client: RedisScriptClient, options: RedisSessionStoreOptions);
+    createSession(key: string, record: SessionRecord, ttlMs: number): Promise<boolean>;
+    readSession(key: string, options: ReadSessionOptions): Promise<SessionRecord | null>;
+    replaceSession(key: string, expectedVersion: number, record: SessionRecord, ttlMs: number): Promise<boolean>;
+    deleteSession(key: string): Promise<void>;
+    acquireRefreshLease(key: string, ttlMs: number): Promise<boolean>;
+    releaseRefreshLease(key: string): Promise<void>;
+    putPendingAuthorization(state: string, pending: PendingAuthorization, ttlMs: number): Promise<void>;
+    takePendingAuthorization(state: string): Promise<PendingAuthorization | null>;
+    private sessionKey;
+    private leaseKey;
+    private pendingKey;
+}
+//# sourceMappingURL=redis-session-store.d.ts.map

package/dist/session/redis-session-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-session-store.d.ts","sourceRoot":"","sources":["../../src/session/redis-session-store.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EACV,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,YAAY,EACb,MAAM,iBAAiB,CAAC;AAQzB,MAAM,WAAW,iBAAiB;IAChC,IAAI,CACF,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,IAAI,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,GAClC,OAAO,CAAC,OAAO,CAAC,CAAC;CACrB;AAGD,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC5C;AAQD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,GAAG,iBAAiB,CAK1E;AA0DD,MAAM,WAAW,wBAAwB;IAEvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,qBAAa,iBAAkB,YAAW,YAAY;IAElD,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,MAAM,EAAE,iBAAiB,EACzB,OAAO,EAAE,wBAAwB;IAG9C,aAAa,CACjB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC;IASb,WAAW,CACf,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAS1B,cAAc,CAClB,GAAG,EAAE,MAAM,EACX,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC;IAeb,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMzC,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IASjE,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM/C,uBAAuB,CAC3B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,oBAAoB,EAC7B,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC;IAQV,wBAAwB,CAC5B,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAUvC,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,UAAU;CAGnB"}

package/dist/session/redis-session-store.js

@@ -0,0 +1,121 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RedisSessionStore = void 0;
+exports.ioredisScriptClient = ioredisScriptClient;
+function ioredisScriptClient(client) {
+    return {
+        eval: (script, keys, args = []) => client.eval(script, keys.length, ...keys, ...args),
+    };
+}
+const CREATE_SESSION = `
+if redis.call('SET', KEYS[1], ARGV[1], 'PX', tonumber(ARGV[2]), 'NX') then
+  return 1
+end
+return 0
+`;
+const READ_SESSION = `
+local raw = redis.call('GET', KEYS[1])
+if not raw then return nil end
+local record = cjson.decode(raw)
+local now = tonumber(ARGV[1])
+local idle = tonumber(ARGV[2])
+if now >= record.absoluteExpiresAt then
+  redis.call('DEL', KEYS[1])
+  return nil
+end
+local remaining = record.absoluteExpiresAt - now
+local ttl = idle
+if remaining < ttl then ttl = remaining end
+if ttl > 0 then redis.call('PEXPIRE', KEYS[1], ttl) end
+return raw
+`;
+const REPLACE_SESSION = `
+local raw = redis.call('GET', KEYS[1])
+if not raw then return 0 end
+local record = cjson.decode(raw)
+if tonumber(record.version) ~= tonumber(ARGV[1]) then return 0 end
+local ttl = tonumber(ARGV[3])
+local cap = tonumber(ARGV[4]) - tonumber(ARGV[5])
+if cap < ttl then ttl = cap end
+if ttl <= 0 then
+  redis.call('DEL', KEYS[1])
+  return 0
+end
+redis.call('SET', KEYS[1], ARGV[2], 'PX', ttl)
+return 1
+`;
+const TAKE_PENDING = `
+local raw = redis.call('GET', KEYS[1])
+if not raw then return nil end
+redis.call('DEL', KEYS[1])
+return raw
+`;
+class RedisSessionStore {
+    client;
+    options;
+    constructor(client, options) {
+        this.client = client;
+        this.options = options;
+    }
+    async createSession(key, record, ttlMs) {
+        const result = await this.client.eval(CREATE_SESSION, [this.sessionKey(key)], [JSON.stringify(record), Math.max(1, Math.floor(ttlMs))]);
+        return result === 1;
+    }
+    async readSession(key, options) {
+        const result = await this.client.eval(READ_SESSION, [this.sessionKey(key)], [Math.floor(options.now), Math.max(1, Math.floor(options.idleTtlMs))]);
+        return decodeRecord(result);
+    }
+    async replaceSession(key, expectedVersion, record, ttlMs) {
+        const result = await this.client.eval(REPLACE_SESSION, [this.sessionKey(key)], [
+            expectedVersion,
+            JSON.stringify(record),
+            Math.max(1, Math.floor(ttlMs)),
+            Math.floor(record.absoluteExpiresAt),
+            Math.floor(Date.now()),
+        ]);
+        return result === 1;
+    }
+    async deleteSession(key) {
+        await this.client.eval(`redis.call('DEL', KEYS[1]) return 1`, [
+            this.sessionKey(key),
+        ]);
+    }
+    async acquireRefreshLease(key, ttlMs) {
+        const result = await this.client.eval(CREATE_SESSION, [this.leaseKey(key)], ['1', Math.max(1, Math.floor(ttlMs))]);
+        return result === 1;
+    }
+    async releaseRefreshLease(key) {
+        await this.client.eval(`redis.call('DEL', KEYS[1]) return 1`, [
+            this.leaseKey(key),
+        ]);
+    }
+    async putPendingAuthorization(state, pending, ttlMs) {
+        await this.client.eval(`redis.call('SET', KEYS[1], ARGV[1], 'PX', tonumber(ARGV[2])) return 1`, [this.pendingKey(state)], [JSON.stringify(pending), Math.max(1, Math.floor(ttlMs))]);
+    }
+    async takePendingAuthorization(state) {
+        const result = await this.client.eval(TAKE_PENDING, [
+            this.pendingKey(state),
+        ]);
+        if (typeof result !== 'string') {
+            return null;
+        }
+        return JSON.parse(result);
+    }
+    sessionKey(key) {
+        return `${this.options.keyPrefix}:session:${key}`;
+    }
+    leaseKey(key) {
+        return `${this.options.keyPrefix}:refresh-lease:${key}`;
+    }
+    pendingKey(state) {
+        return `${this.options.keyPrefix}:pending:${state}`;
+    }
+}
+exports.RedisSessionStore = RedisSessionStore;
+function decodeRecord(result) {
+    if (typeof result !== 'string') {
+        return null;
+    }
+    return JSON.parse(result);
+}
+//# sourceMappingURL=redis-session-store.js.map

package/dist/session/redis-session-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-session-store.js","sourceRoot":"","sources":["../../src/session/redis-session-store.ts"],"names":[],"mappings":";;;AAqDA,kDAKC;AALD,SAAgB,mBAAmB,CAAC,MAAmB;IACrD,OAAO;QACL,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,EAAE,CAChC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;KACrD,CAAC;AACJ,CAAC;AAGD,MAAM,cAAc,GAAG;;;;;CAKtB,CAAC;AAQF,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;CAepB,CAAC;AAGF,MAAM,eAAe,GAAG;;;;;;;;;;;;;;CAcvB,CAAC;AAGF,MAAM,YAAY,GAAG;;;;;CAKpB,CAAC;AAOF,MAAa,iBAAiB;IAET;IACA;IAFnB,YACmB,MAAyB,EACzB,OAAiC;QADjC,WAAM,GAAN,MAAM,CAAmB;QACzB,YAAO,GAAP,OAAO,CAA0B;IACjD,CAAC;IAEJ,KAAK,CAAC,aAAa,CACjB,GAAW,EACX,MAAqB,EACrB,KAAa;QAEb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACnC,cAAc,EACd,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EACtB,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CACzD,CAAC;QACF,OAAO,MAAM,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,WAAW,CACf,GAAW,EACX,OAA2B;QAE3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACnC,YAAY,EACZ,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EACtB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CACtE,CAAC;QACF,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,GAAW,EACX,eAAuB,EACvB,MAAqB,EACrB,KAAa;QAEb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACnC,eAAe,EACf,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EACtB;YACE,eAAe;YACf,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YACtB,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC9B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC;YACpC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;SACvB,CACF,CAAC;QACF,OAAO,MAAM,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,GAAW;QAC7B,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE;YAC5D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;SACrB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,GAAW,EAAE,KAAa;QAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACnC,cAAc,EACd,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EACpB,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CACtC,CAAC;QACF,OAAO,MAAM,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,GAAW;QACnC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE;YAC5D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;SACnB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,uBAAuB,CAC3B,KAAa,EACb,OAA6B,EAC7B,KAAa;QAEb,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACpB,uEAAuE,EACvE,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EACxB,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAC1D,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,wBAAwB,CAC5B,KAAa;QAEb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE;YAClD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;SACvB,CAAC,CAAC;QACH,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAyB,CAAC;IACpD,CAAC;IAEO,UAAU,CAAC,GAAW;QAC5B,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,YAAY,GAAG,EAAE,CAAC;IACpD,CAAC;IAEO,QAAQ,CAAC,GAAW;QAC1B,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,kBAAkB,GAAG,EAAE,CAAC;IAC1D,CAAC;IAEO,UAAU,CAAC,KAAa;QAC9B,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,YAAY,KAAK,EAAE,CAAC;IACtD,CAAC;CACF;AA3GD,8CA2GC;AAED,SAAS,YAAY,CAAC,MAAe;IACnC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAkB,CAAC;AAC7C,CAAC"}

package/dist/session/session-service.d.ts

@@ -0,0 +1,55 @@
+import { type SessionActor } from './actor';
+import { type OidcClient, type OidcTokenSet } from '../oidc/oidc-client';
+import type { PendingAuthorization, SessionRecord, SessionStore } from './session-store';
+import type { OidcSessionOptions } from '../config/oidc-session-options';
+export interface ResolvedSession {
+    readonly session: LiveSession | null;
+    readonly expired: boolean;
+}
+export interface LiveSession {
+    readonly key: string;
+    readonly record: SessionRecord;
+    readonly actor: SessionActor;
+}
+export interface EstablishedSession {
+    readonly cookieValue: string;
+    readonly actor: SessionActor;
+    readonly returnTo: string | null;
+}
+export interface SessionServiceDeps {
+    readonly options: OidcSessionOptions;
+    readonly store: SessionStore;
+    readonly client: OidcClient;
+    readonly now?: () => number;
+    readonly sleep?: (ms: number) => Promise<void>;
+}
+export declare class SessionService {
+    private readonly options;
+    private readonly store;
+    private readonly client;
+    private readonly now;
+    private readonly sleep;
+    private readonly inFlightRefresh;
+    constructor(deps: SessionServiceDeps);
+    beginAuthorization(input: {
+        pkceVerifier: string;
+        codeChallenge: string;
+        returnTo: string | null;
+    }): Promise<{
+        authorizationUrl: string;
+        state: string;
+    }>;
+    takePendingAuthorization(state: string): Promise<PendingAuthorization | null>;
+    establishSession(tokenSet: OidcTokenSet, returnTo: string | null): Promise<EstablishedSession>;
+    resolveSession(cookieValue: string): Promise<ResolvedSession>;
+    setActiveOrg(session: LiveSession, orgId: string): Promise<SessionActor | null>;
+    endSession(session: LiveSession | null): Promise<string | null>;
+    storeKeyFor(cookieValue: string): string;
+    private idleTtlMs;
+    private ensureFreshAccessToken;
+    private refreshUnderLease;
+    private performRefresh;
+    private awaitAnotherRefresh;
+}
+export declare function storeKeyFor(cookieValue: string): string;
+//# sourceMappingURL=session-service.d.ts.map

package/dist/session/session-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-service.d.ts","sourceRoot":"","sources":["../../src/session/session-service.ts"],"names":[],"mappings":"AA2BA,OAAO,EAIL,KAAK,YAAY,EAClB,MAAM,SAAS,CAAC;AACjB,OAAO,EAEL,KAAK,UAAU,EACf,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,KAAK,EACV,oBAAoB,EACpB,aAAa,EACb,YAAY,EACb,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAazE,MAAM,WAAW,eAAe;IAE9B,QAAQ,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAUrC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAGD,MAAM,WAAW,WAAW;IAE1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;CAC9B;AAGD,MAAM,WAAW,kBAAkB;IAEjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAE7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAE5B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAE5B,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAE7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IAErC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IAEpC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IAEnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgC;IAGtD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAoD;gBAExE,IAAI,EAAE,kBAAkB;IAiB9B,kBAAkB,CAAC,KAAK,EAAE;QAC9B,YAAY,EAAE,MAAM,CAAC;QACrB,aAAa,EAAE,MAAM,CAAC;QACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;KACzB,GAAG,OAAO,CAAC;QAAE,gBAAgB,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAuBxD,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAWvE,gBAAgB,CACpB,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,OAAO,CAAC,kBAAkB,CAAC;IA+CxB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAiC7D,YAAY,CAChB,OAAO,EAAE,WAAW,EACpB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAuBzB,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAarE,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;IAIxC,OAAO,CAAC,SAAS;YAMH,sBAAsB;YA0BtB,iBAAiB;YAkBjB,cAAc;YAiEd,mBAAmB;CA+BlC;AAQD,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEvD"}