@xemahq/oidc-session-nest 1.0.1 → 1.2.0

package/dist/errors.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SessionRefreshContendedError = exports.OidcTokenEndpointFailedError = exports.OidcLoginStateUnknownError = exports.OidcCallbackRejectedError = exports.SessionExpiredError = exports.SessionRequiredError = exports.OidcSessionError = exports.OidcSessionErrorCode = void 0;
+exports.OidcLoginOriginMismatchError = exports.OidcRedirectOriginNotAllowedError = exports.SessionRefreshContendedError = exports.OidcTokenEndpointFailedError = exports.OidcLoginStateUnknownError = exports.OidcCallbackRejectedError = exports.SessionExpiredError = exports.SessionRequiredError = exports.OidcSessionError = exports.OidcSessionErrorCode = void 0;
 const common_1 = require("@nestjs/common");
 var OidcSessionErrorCode;
 (function (OidcSessionErrorCode) {
@@ -10,6 +10,8 @@ var OidcSessionErrorCode;
     OidcSessionErrorCode["OidcLoginStateUnknown"] = "OIDC_LOGIN_STATE_UNKNOWN";
     OidcSessionErrorCode["OidcTokenEndpointFailed"] = "OIDC_TOKEN_ENDPOINT_FAILED";
     OidcSessionErrorCode["SessionRefreshContended"] = "SESSION_REFRESH_CONTENDED";
+    OidcSessionErrorCode["OidcRedirectOriginNotAllowed"] = "OIDC_REDIRECT_ORIGIN_NOT_ALLOWED";
+    OidcSessionErrorCode["OidcLoginOriginMismatch"] = "OIDC_LOGIN_ORIGIN_MISMATCH";
 })(OidcSessionErrorCode || (exports.OidcSessionErrorCode = OidcSessionErrorCode = {}));
 class OidcSessionError extends common_1.HttpException {
     code;
@@ -57,4 +59,16 @@ class SessionRefreshContendedError extends OidcSessionError {
     }
 }
 exports.SessionRefreshContendedError = SessionRefreshContendedError;
+class OidcRedirectOriginNotAllowedError extends OidcSessionError {
+    constructor(detail) {
+        super(OidcSessionErrorCode.OidcRedirectOriginNotAllowed, common_1.HttpStatus.BAD_REQUEST, 'Address not approved for sign-in', detail);
+    }
+}
+exports.OidcRedirectOriginNotAllowedError = OidcRedirectOriginNotAllowedError;
+class OidcLoginOriginMismatchError extends OidcSessionError {
+    constructor(detail = 'This sign-in was started on a different address. Start again on the address you mean to use.') {
+        super(OidcSessionErrorCode.OidcLoginOriginMismatch, common_1.HttpStatus.BAD_REQUEST, 'Sign-in finished on a different address', detail);
+    }
+}
+exports.OidcLoginOriginMismatchError = OidcLoginOriginMismatchError;
 //# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":";;;AAyBA,2CAA2D;AAM3D,IAAY,oBA8BX;AA9BD,WAAY,oBAAoB;IAE9B,4DAAoC,CAAA;IAOpC,0DAAkC,CAAA;IAElC,uEAA+C,CAAA;IAM/C,0EAAkD,CAAA;IAMlD,8EAAsD,CAAA;IAMtD,6EAAqD,CAAA;AACvD,CAAC,EA9BW,oBAAoB,oCAApB,oBAAoB,QA8B/B;AAUD,MAAa,gBAAiB,SAAQ,sBAAa;IACxC,IAAI,CAAuB;IAEpC,YACE,IAA0B,EAC1B,MAAkB,EAClB,KAAa,EACb,MAAc;QAEd,MAAM,IAAI,GAAyB,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAC3D,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QAMjB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;CACF;AAnBD,4CAmBC;AAED,MAAa,oBAAqB,SAAQ,gBAAgB;IACxD,YAAY,MAAM,GAAG,6CAA6C;QAChE,KAAK,CACH,oBAAoB,CAAC,eAAe,EACpC,mBAAU,CAAC,YAAY,EACvB,kBAAkB,EAClB,MAAM,CACP,CAAC;IACJ,CAAC;CACF;AATD,oDASC;AAED,MAAa,mBAAoB,SAAQ,gBAAgB;IACvD,YAAY,MAAM,GAAG,mDAAmD;QACtE,KAAK,CACH,oBAAoB,CAAC,cAAc,EACnC,mBAAU,CAAC,YAAY,EACvB,iBAAiB,EACjB,MAAM,CACP,CAAC;IACJ,CAAC;CACF;AATD,kDASC;AAED,MAAa,yBAA0B,SAAQ,gBAAgB;IAC7D,YAAY,MAAc;QACxB,KAAK,CACH,oBAAoB,CAAC,oBAAoB,EACzC,mBAAU,CAAC,WAAW,EACtB,sBAAsB,EACtB,MAAM,CACP,CAAC;IACJ,CAAC;CACF;AATD,8DASC;AAED,MAAa,0BAA2B,SAAQ,gBAAgB;IAC9D,YACE,MAAM,GAAG,6EAA6E;QAEtF,KAAK,CACH,oBAAoB,CAAC,qBAAqB,EAC1C,mBAAU,CAAC,WAAW,EACtB,yBAAyB,EACzB,MAAM,CACP,CAAC;IACJ,CAAC;CACF;AAXD,gEAWC;AAED,MAAa,4BAA6B,SAAQ,gBAAgB;IAChE,YAAY,MAAc;QACxB,KAAK,CACH,oBAAoB,CAAC,uBAAuB,EAC5C,mBAAU,CAAC,WAAW,EACtB,+BAA+B,EAC/B,MAAM,CACP,CAAC;IACJ,CAAC;CACF;AATD,oEASC;AAED,MAAa,4BAA6B,SAAQ,gBAAgB;IAChE,YACE,MAAM,GAAG,4DAA4D;QAErE,KAAK,CACH,oBAAoB,CAAC,uBAAuB,EAC5C,mBAAU,CAAC,mBAAmB,EAC9B,6BAA6B,EAC7B,MAAM,CACP,CAAC;IACJ,CAAC;CACF;AAXD,oEAWC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":";;;AAyBA,2CAA2D;AAM3D,IAAY,oBA8CX;AA9CD,WAAY,oBAAoB;IAE9B,4DAAoC,CAAA;IAOpC,0DAAkC,CAAA;IAElC,uEAA+C,CAAA;IAM/C,0EAAkD,CAAA;IAMlD,8EAAsD,CAAA;IAMtD,6EAAqD,CAAA;IASrD,yFAAiE,CAAA;IAOjE,8EAAsD,CAAA;AACxD,CAAC,EA9CW,oBAAoB,oCAApB,oBAAoB,QA8C/B;AAUD,MAAa,gBAAiB,SAAQ,sBAAa;IACxC,IAAI,CAAuB;IAEpC,YACE,IAA0B,EAC1B,MAAkB,EAClB,KAAa,EACb,MAAc;QAEd,MAAM,IAAI,GAAyB,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAC3D,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QAMjB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;CACF;AAnBD,4CAmBC;AAED,MAAa,oBAAqB,SAAQ,gBAAgB;IACxD,YAAY,MAAM,GAAG,6CAA6C;QAChE,KAAK,CACH,oBAAoB,CAAC,eAAe,EACpC,mBAAU,CAAC,YAAY,EACvB,kBAAkB,EAClB,MAAM,CACP,CAAC;IACJ,CAAC;CACF;AATD,oDASC;AAED,MAAa,mBAAoB,SAAQ,gBAAgB;IACvD,YAAY,MAAM,GAAG,mDAAmD;QACtE,KAAK,CACH,oBAAoB,CAAC,cAAc,EACnC,mBAAU,CAAC,YAAY,EACvB,iBAAiB,EACjB,MAAM,CACP,CAAC;IACJ,CAAC;CACF;AATD,kDASC;AAED,MAAa,yBAA0B,SAAQ,gBAAgB;IAC7D,YAAY,MAAc;QACxB,KAAK,CACH,oBAAoB,CAAC,oBAAoB,EACzC,mBAAU,CAAC,WAAW,EACtB,sBAAsB,EACtB,MAAM,CACP,CAAC;IACJ,CAAC;CACF;AATD,8DASC;AAED,MAAa,0BAA2B,SAAQ,gBAAgB;IAC9D,YACE,MAAM,GAAG,6EAA6E;QAEtF,KAAK,CACH,oBAAoB,CAAC,qBAAqB,EAC1C,mBAAU,CAAC,WAAW,EACtB,yBAAyB,EACzB,MAAM,CACP,CAAC;IACJ,CAAC;CACF;AAXD,gEAWC;AAED,MAAa,4BAA6B,SAAQ,gBAAgB;IAChE,YAAY,MAAc;QACxB,KAAK,CACH,oBAAoB,CAAC,uBAAuB,EAC5C,mBAAU,CAAC,WAAW,EACtB,+BAA+B,EAC/B,MAAM,CACP,CAAC;IACJ,CAAC;CACF;AATD,oEASC;AAED,MAAa,4BAA6B,SAAQ,gBAAgB;IAChE,YACE,MAAM,GAAG,4DAA4D;QAErE,KAAK,CACH,oBAAoB,CAAC,uBAAuB,EAC5C,mBAAU,CAAC,mBAAmB,EAC9B,6BAA6B,EAC7B,MAAM,CACP,CAAC;IACJ,CAAC;CACF;AAXD,oEAWC;AAED,MAAa,iCAAkC,SAAQ,gBAAgB;IACrE,YAAY,MAAc;QACxB,KAAK,CACH,oBAAoB,CAAC,4BAA4B,EACjD,mBAAU,CAAC,WAAW,EACtB,kCAAkC,EAClC,MAAM,CACP,CAAC;IACJ,CAAC;CACF;AATD,8EASC;AAED,MAAa,4BAA6B,SAAQ,gBAAgB;IAChE,YACE,MAAM,GAAG,8FAA8F;QAEvG,KAAK,CACH,oBAAoB,CAAC,uBAAuB,EAC5C,mBAAU,CAAC,WAAW,EACtB,yCAAyC,EACzC,MAAM,CACP,CAAC;IACJ,CAAC;CACF;AAXD,oEAWC"}

package/dist/http/request-authority.d.ts

@@ -0,0 +1,19 @@
+import { BlockList } from 'node:net';
+export interface AuthorityRequestLike {
+    headers: Record<string, string | string[] | undefined>;
+    socket?: {
+        remoteAddress?: string | undefined;
+    } | undefined;
+}
+export type RequestAuthority = {
+    readonly kind: 'resolved';
+    readonly authority: string;
+} | {
+    readonly kind: 'unresolvable';
+    readonly reason: string;
+};
+export type TrustedProxySet = BlockList | null;
+export declare function parseTrustedProxies(entries: readonly string[]): TrustedProxySet;
+export declare function isTrustedPeer(trusted: TrustedProxySet, peer: string | undefined): boolean;
+export declare function resolveRequestAuthority(req: AuthorityRequestLike, trusted: TrustedProxySet): RequestAuthority;
+//# sourceMappingURL=request-authority.d.ts.map

package/dist/http/request-authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-authority.d.ts","sourceRoot":"","sources":["../../src/http/request-authority.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,SAAS,EAAQ,MAAM,UAAU,CAAC;AAK3C,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IAEvD,MAAM,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GAAG,SAAS,CAAC;CAC7D;AAGD,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAG/D,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,IAAI,CAAC;AAK/C,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,eAAe,CA6B/E;AAGD,wBAAgB,aAAa,CAC3B,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,OAAO,CAWT;AAGD,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,oBAAoB,EACzB,OAAO,EAAE,eAAe,GACvB,gBAAgB,CAwBlB"}

package/dist/http/request-authority.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseTrustedProxies = parseTrustedProxies;
+exports.isTrustedPeer = isTrustedPeer;
+exports.resolveRequestAuthority = resolveRequestAuthority;
+const node_net_1 = require("node:net");
+const oidc_session_config_error_1 = require("../config/oidc-session-config-error");
+const IPV4_MAPPED = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/iu;
+function parseTrustedProxies(entries) {
+    if (entries.length === 0) {
+        return null;
+    }
+    const list = new node_net_1.BlockList();
+    for (const raw of entries) {
+        const entry = raw.trim();
+        const [address, prefixText, extra] = entry.split('/');
+        const family = (0, node_net_1.isIP)(address ?? '');
+        if (address === undefined || family === 0 || extra !== undefined) {
+            throw new oidc_session_config_error_1.OidcSessionConfigError(`trusted proxy "${raw}" is not an IP address or CIDR.`);
+        }
+        const type = family === 4 ? 'ipv4' : 'ipv6';
+        if (prefixText === undefined) {
+            list.addAddress(address, type);
+            continue;
+        }
+        const prefix = Number(prefixText);
+        const max = family === 4 ? 32 : 128;
+        if (!/^\d{1,3}$/u.test(prefixText) || prefix > max) {
+            throw new oidc_session_config_error_1.OidcSessionConfigError(`trusted proxy "${raw}" has an invalid prefix length.`);
+        }
+        list.addSubnet(address, prefix, type);
+    }
+    return list;
+}
+function isTrustedPeer(trusted, peer) {
+    if (trusted === null || peer === undefined || peer === '') {
+        return false;
+    }
+    const mapped = IPV4_MAPPED.exec(peer);
+    const address = mapped?.[1] ?? peer;
+    const family = (0, node_net_1.isIP)(address);
+    if (family === 0) {
+        return false;
+    }
+    return trusted.check(address, family === 4 ? 'ipv4' : 'ipv6');
+}
+function resolveRequestAuthority(req, trusted) {
+    if (isTrustedPeer(trusted, req.socket?.remoteAddress)) {
+        const forwarded = req.headers['x-forwarded-host'];
+        if (forwarded !== undefined) {
+            const values = (Array.isArray(forwarded) ? forwarded : [forwarded])
+                .flatMap((value) => value.split(','))
+                .map((value) => value.trim())
+                .filter((value) => value !== '');
+            if (values.length !== 1) {
+                return {
+                    kind: 'unresolvable',
+                    reason: 'the trusted proxy sent X-Forwarded-Host with ' +
+                        `${String(values.length)} values; exactly one is required`,
+                };
+            }
+            return { kind: 'resolved', authority: values[0] ?? '' };
+        }
+    }
+    const host = req.headers.host;
+    if (typeof host !== 'string' || host.trim() === '') {
+        return { kind: 'unresolvable', reason: 'the request carried no Host header' };
+    }
+    return { kind: 'resolved', authority: host.trim() };
+}
+//# sourceMappingURL=request-authority.js.map

package/dist/http/request-authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-authority.js","sourceRoot":"","sources":["../../src/http/request-authority.ts"],"names":[],"mappings":";;AA4CA,kDA6BC;AAGD,sCAcC;AAGD,0DA2BC;AAlGD,uCAA2C;AAE3C,mFAA6E;AAiB7E,MAAM,WAAW,GAAG,sCAAsC,CAAC;AAG3D,SAAgB,mBAAmB,CAAC,OAA0B;IAC5D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,oBAAS,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,IAAA,eAAI,EAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QACnC,IAAI,OAAO,KAAK,SAAS,IAAI,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACjE,MAAM,IAAI,kDAAsB,CAC9B,kBAAkB,GAAG,iCAAiC,CACvD,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QAC5C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;QAClC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QACpC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;YACnD,MAAM,IAAI,kDAAsB,CAC9B,kBAAkB,GAAG,iCAAiC,CACvD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAGD,SAAgB,aAAa,CAC3B,OAAwB,EACxB,IAAwB;IAExB,IAAI,OAAO,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAC1D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACpC,MAAM,MAAM,GAAG,IAAA,eAAI,EAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAChE,CAAC;AAGD,SAAgB,uBAAuB,CACrC,GAAyB,EACzB,OAAwB;IAExB,IAAI,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC;QACtD,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAClD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;iBAChE,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;iBACpC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;iBAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO;oBACL,IAAI,EAAE,cAAc;oBACpB,MAAM,EACJ,+CAA+C;wBAC/C,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,kCAAkC;iBAC7D,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;IAChF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;AACtD,CAAC"}

package/dist/index.d.ts

@@ -1,6 +1,6 @@
-export { OidcSessionError, OidcSessionErrorCode, OidcCallbackRejectedError, OidcLoginStateUnknownError, OidcTokenEndpointFailedError, SessionExpiredError, SessionRefreshContendedError, SessionRequiredError, type OidcSessionErrorBody, } from './errors';
-export { assertOidcSessionOptions, OidcSessionConfigError, REQUIRED_OIDC_SCOPE, type OidcProviderOptions, type OidcSessionOptions, type SessionCookieOptions, type SessionTtlOptions, } from './config/oidc-session-options';
-export { loadOidcSessionOptionsFromEnv, OIDC_SESSION_OPTIONAL_ENV_VARS, OIDC_SESSION_REQUIRED_ENV_VARS, type EnvReader, } from './config/oidc-session-env';
+export { OidcSessionError, OidcSessionErrorCode, OidcCallbackRejectedError, OidcLoginOriginMismatchError, OidcLoginStateUnknownError, OidcRedirectOriginNotAllowedError, OidcTokenEndpointFailedError, SessionExpiredError, SessionRefreshContendedError, SessionRequiredError, type OidcSessionErrorBody, } from './errors';
+export { assertOidcSessionOptions, OidcSessionConfigError, REQUIRED_OIDC_SCOPE, type OidcProviderOptions, type OidcSessionOptions, type RequestOriginRedirectOptions, type SessionCookieOptions, type SessionTtlOptions, } from './config/oidc-session-options';
+export { loadOidcSessionOptionsFromEnv, OIDC_SESSION_OPTIONAL_ENV_VARS, OIDC_SESSION_REDIRECT_ENV_VARS, OIDC_SESSION_REQUIRED_ENV_VARS, type EnvReader, } from './config/oidc-session-env';
 export { OidcDiscovery, type FetchLike, type OidcDiscoveryDocument, } from './oidc/discovery';
 export { createPkcePair, randomUrlSafeToken, type PkcePair } from './oidc/pkce';
 export { OidcClient, OidcInvalidGrantError, type AuthorizationRequest, type OidcClientDeps, type OidcTokenSet, } from './oidc/oidc-client';
@@ -10,6 +10,9 @@ export { ioredisScriptClient, RedisSessionStore, type IoredisLike, type RedisScr
 export { resolveInitialActiveOrgId, resolveSessionOrgRoles, toSessionActor, type SessionActor as SessionActorShape, } from './session/actor';
 export { SessionService, storeKeyFor, type EstablishedSession, type LiveSession, type ResolvedSession, type SessionServiceDeps, } from './session/session-service';
 export { PROJECT_HEADER_NAME } from './http/headers';
+export { matchRedirectOrigin, parseRedirectOriginAllowlist, parseRedirectOriginPattern, type RedirectOriginPattern, } from './config/redirect-origin';
+export { isTrustedPeer, parseTrustedProxies, resolveRequestAuthority, type AuthorityRequestLike, type RequestAuthority, type TrustedProxySet, } from './http/request-authority';
+export { resolveRedirectTargets, type RedirectTargets, } from './nest/redirect-targets';
 export { readCookie, safeRelativePath, serializeCookie, type SetCookieOptions, } from './http/cookie';
 export { MAX_LOGIN_HINT_LENGTH, safeLoginHint } from './http/login-hint';
 export { currentSession, currentSessionScope, runWithSessionScope, setCurrentProjectId, type OidcSessionScope, } from './nest/oidc-session-context';
@@ -18,6 +21,7 @@ export { OidcSessionGuard } from './nest/oidc-session.guard';
 export { SessionActor } from './nest/session-actor.decorator';
 export { sessionClientTransport, type SessionClientTransport, } from './nest/session-client-transport';
 export { OidcSessionAuthController, type LogoutResponse, type SessionRequestShape, type SessionResponseLike, } from './nest/oidc-session-auth.controller';
+export { navigationErrorLocation, OIDC_NAVIGATION_ERROR_PARAM, } from './nest/navigation-refusal';
 export { LogoutResponseDto } from './nest/dto/logout-response.dto';
 export { SessionActorDto } from './nest/dto/session-actor.dto';
 export { OIDC_SESSION_OPTIONS, OIDC_SESSION_STORE } from './nest/tokens';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,yBAAyB,EACzB,0BAA0B,EAC1B,4BAA4B,EAC5B,mBAAmB,EACnB,4BAA4B,EAC5B,oBAAoB,EACpB,KAAK,oBAAoB,GAC1B,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,GACvB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,6BAA6B,EAC7B,8BAA8B,EAC9B,8BAA8B,EAC9B,KAAK,SAAS,GACf,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,aAAa,EACb,KAAK,SAAS,EACd,KAAK,qBAAqB,GAC3B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEhF,OAAO,EACL,UAAU,EACV,qBAAqB,EACrB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EACV,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,YAAY,GACb,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,oBAAoB,EACpB,KAAK,2BAA2B,GACjC,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,GAC9B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,cAAc,EACd,KAAK,YAAY,IAAI,iBAAiB,GACvC,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,cAAc,EACd,WAAW,EACX,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,kBAAkB,GACxB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,KAAK,gBAAgB,GACtB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEzE,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,KAAK,gBAAgB,GACtB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,KAAK,kBAAkB,EAIvB,KAAK,mBAAmB,GACzB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAE9D,OAAO,EACL,sBAAsB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,yBAAyB,EACzB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,GACzB,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAE/D,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEzE,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,GACnC,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,yBAAyB,EACzB,4BAA4B,EAC5B,0BAA0B,EAC1B,iCAAiC,EACjC,4BAA4B,EAC5B,mBAAmB,EACnB,4BAA4B,EAC5B,oBAAoB,EACpB,KAAK,oBAAoB,GAC1B,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,4BAA4B,EACjC,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,GACvB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,6BAA6B,EAC7B,8BAA8B,EAC9B,8BAA8B,EAC9B,8BAA8B,EAC9B,KAAK,SAAS,GACf,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,aAAa,EACb,KAAK,SAAS,EACd,KAAK,qBAAqB,GAC3B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEhF,OAAO,EACL,UAAU,EACV,qBAAqB,EACrB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EACV,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,YAAY,GACb,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,oBAAoB,EACpB,KAAK,2BAA2B,GACjC,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,GAC9B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,cAAc,EACd,KAAK,YAAY,IAAI,iBAAiB,GACvC,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,cAAc,EACd,WAAW,EACX,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,kBAAkB,GACxB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,OAAO,EACL,mBAAmB,EACnB,4BAA4B,EAC5B,0BAA0B,EAC1B,KAAK,qBAAqB,GAC3B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,uBAAuB,EACvB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,eAAe,GACrB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,sBAAsB,EACtB,KAAK,eAAe,GACrB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,KAAK,gBAAgB,GACtB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEzE,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,KAAK,gBAAgB,GACtB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,KAAK,kBAAkB,EAIvB,KAAK,mBAAmB,GACzB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAE9D,OAAO,EACL,sBAAsB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,yBAAyB,EACzB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,GACzB,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EACL,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAE/D,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEzE,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,GACnC,MAAM,4BAA4B,CAAC"}

package/dist/index.js

@@ -1,11 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OidcSessionModule = exports.OIDC_SESSION_STORE = exports.OIDC_SESSION_OPTIONS = exports.SessionActorDto = exports.LogoutResponseDto = exports.OidcSessionAuthController = exports.sessionClientTransport = exports.SessionActor = exports.OidcSessionGuard = exports.OidcSessionMiddleware = exports.OIDC_SESSION_SCOPE = exports.setCurrentProjectId = exports.runWithSessionScope = exports.currentSessionScope = exports.currentSession = exports.safeLoginHint = exports.MAX_LOGIN_HINT_LENGTH = exports.serializeCookie = exports.safeRelativePath = exports.readCookie = exports.PROJECT_HEADER_NAME = exports.storeKeyFor = exports.SessionService = exports.toSessionActor = exports.resolveSessionOrgRoles = exports.resolveInitialActiveOrgId = exports.RedisSessionStore = exports.ioredisScriptClient = exports.InMemorySessionStore = exports.OidcInvalidGrantError = exports.OidcClient = exports.randomUrlSafeToken = exports.createPkcePair = exports.OidcDiscovery = exports.OIDC_SESSION_REQUIRED_ENV_VARS = exports.OIDC_SESSION_OPTIONAL_ENV_VARS = exports.loadOidcSessionOptionsFromEnv = exports.REQUIRED_OIDC_SCOPE = exports.OidcSessionConfigError = exports.assertOidcSessionOptions = exports.SessionRequiredError = exports.SessionRefreshContendedError = exports.SessionExpiredError = exports.OidcTokenEndpointFailedError = exports.OidcLoginStateUnknownError = exports.OidcCallbackRejectedError = exports.OidcSessionErrorCode = exports.OidcSessionError = void 0;
+exports.OidcSessionGuard = exports.OidcSessionMiddleware = exports.OIDC_SESSION_SCOPE = exports.setCurrentProjectId = exports.runWithSessionScope = exports.currentSessionScope = exports.currentSession = exports.safeLoginHint = exports.MAX_LOGIN_HINT_LENGTH = exports.serializeCookie = exports.safeRelativePath = exports.readCookie = exports.resolveRedirectTargets = exports.resolveRequestAuthority = exports.parseTrustedProxies = exports.isTrustedPeer = exports.parseRedirectOriginPattern = exports.parseRedirectOriginAllowlist = exports.matchRedirectOrigin = exports.PROJECT_HEADER_NAME = exports.storeKeyFor = exports.SessionService = exports.toSessionActor = exports.resolveSessionOrgRoles = exports.resolveInitialActiveOrgId = exports.RedisSessionStore = exports.ioredisScriptClient = exports.InMemorySessionStore = exports.OidcInvalidGrantError = exports.OidcClient = exports.randomUrlSafeToken = exports.createPkcePair = exports.OidcDiscovery = exports.OIDC_SESSION_REQUIRED_ENV_VARS = exports.OIDC_SESSION_REDIRECT_ENV_VARS = exports.OIDC_SESSION_OPTIONAL_ENV_VARS = exports.loadOidcSessionOptionsFromEnv = exports.REQUIRED_OIDC_SCOPE = exports.OidcSessionConfigError = exports.assertOidcSessionOptions = exports.SessionRequiredError = exports.SessionRefreshContendedError = exports.SessionExpiredError = exports.OidcTokenEndpointFailedError = exports.OidcRedirectOriginNotAllowedError = exports.OidcLoginStateUnknownError = exports.OidcLoginOriginMismatchError = exports.OidcCallbackRejectedError = exports.OidcSessionErrorCode = exports.OidcSessionError = void 0;
+exports.OidcSessionModule = exports.OIDC_SESSION_STORE = exports.OIDC_SESSION_OPTIONS = exports.SessionActorDto = exports.LogoutResponseDto = exports.OIDC_NAVIGATION_ERROR_PARAM = exports.navigationErrorLocation = exports.OidcSessionAuthController = exports.sessionClientTransport = exports.SessionActor = void 0;
 var errors_1 = require("./errors");
 Object.defineProperty(exports, "OidcSessionError", { enumerable: true, get: function () { return errors_1.OidcSessionError; } });
 Object.defineProperty(exports, "OidcSessionErrorCode", { enumerable: true, get: function () { return errors_1.OidcSessionErrorCode; } });
 Object.defineProperty(exports, "OidcCallbackRejectedError", { enumerable: true, get: function () { return errors_1.OidcCallbackRejectedError; } });
+Object.defineProperty(exports, "OidcLoginOriginMismatchError", { enumerable: true, get: function () { return errors_1.OidcLoginOriginMismatchError; } });
 Object.defineProperty(exports, "OidcLoginStateUnknownError", { enumerable: true, get: function () { return errors_1.OidcLoginStateUnknownError; } });
+Object.defineProperty(exports, "OidcRedirectOriginNotAllowedError", { enumerable: true, get: function () { return errors_1.OidcRedirectOriginNotAllowedError; } });
 Object.defineProperty(exports, "OidcTokenEndpointFailedError", { enumerable: true, get: function () { return errors_1.OidcTokenEndpointFailedError; } });
 Object.defineProperty(exports, "SessionExpiredError", { enumerable: true, get: function () { return errors_1.SessionExpiredError; } });
 Object.defineProperty(exports, "SessionRefreshContendedError", { enumerable: true, get: function () { return errors_1.SessionRefreshContendedError; } });
@@ -17,6 +20,7 @@ Object.defineProperty(exports, "REQUIRED_OIDC_SCOPE", { enumerable: true, get: f
 var oidc_session_env_1 = require("./config/oidc-session-env");
 Object.defineProperty(exports, "loadOidcSessionOptionsFromEnv", { enumerable: true, get: function () { return oidc_session_env_1.loadOidcSessionOptionsFromEnv; } });
 Object.defineProperty(exports, "OIDC_SESSION_OPTIONAL_ENV_VARS", { enumerable: true, get: function () { return oidc_session_env_1.OIDC_SESSION_OPTIONAL_ENV_VARS; } });
+Object.defineProperty(exports, "OIDC_SESSION_REDIRECT_ENV_VARS", { enumerable: true, get: function () { return oidc_session_env_1.OIDC_SESSION_REDIRECT_ENV_VARS; } });
 Object.defineProperty(exports, "OIDC_SESSION_REQUIRED_ENV_VARS", { enumerable: true, get: function () { return oidc_session_env_1.OIDC_SESSION_REQUIRED_ENV_VARS; } });
 var discovery_1 = require("./oidc/discovery");
 Object.defineProperty(exports, "OidcDiscovery", { enumerable: true, get: function () { return discovery_1.OidcDiscovery; } });
@@ -40,6 +44,16 @@ Object.defineProperty(exports, "SessionService", { enumerable: true, get: functi
 Object.defineProperty(exports, "storeKeyFor", { enumerable: true, get: function () { return session_service_1.storeKeyFor; } });
 var headers_1 = require("./http/headers");
 Object.defineProperty(exports, "PROJECT_HEADER_NAME", { enumerable: true, get: function () { return headers_1.PROJECT_HEADER_NAME; } });
+var redirect_origin_1 = require("./config/redirect-origin");
+Object.defineProperty(exports, "matchRedirectOrigin", { enumerable: true, get: function () { return redirect_origin_1.matchRedirectOrigin; } });
+Object.defineProperty(exports, "parseRedirectOriginAllowlist", { enumerable: true, get: function () { return redirect_origin_1.parseRedirectOriginAllowlist; } });
+Object.defineProperty(exports, "parseRedirectOriginPattern", { enumerable: true, get: function () { return redirect_origin_1.parseRedirectOriginPattern; } });
+var request_authority_1 = require("./http/request-authority");
+Object.defineProperty(exports, "isTrustedPeer", { enumerable: true, get: function () { return request_authority_1.isTrustedPeer; } });
+Object.defineProperty(exports, "parseTrustedProxies", { enumerable: true, get: function () { return request_authority_1.parseTrustedProxies; } });
+Object.defineProperty(exports, "resolveRequestAuthority", { enumerable: true, get: function () { return request_authority_1.resolveRequestAuthority; } });
+var redirect_targets_1 = require("./nest/redirect-targets");
+Object.defineProperty(exports, "resolveRedirectTargets", { enumerable: true, get: function () { return redirect_targets_1.resolveRedirectTargets; } });
 var cookie_1 = require("./http/cookie");
 Object.defineProperty(exports, "readCookie", { enumerable: true, get: function () { return cookie_1.readCookie; } });
 Object.defineProperty(exports, "safeRelativePath", { enumerable: true, get: function () { return cookie_1.safeRelativePath; } });
@@ -63,6 +77,9 @@ var session_client_transport_1 = require("./nest/session-client-transport");
 Object.defineProperty(exports, "sessionClientTransport", { enumerable: true, get: function () { return session_client_transport_1.sessionClientTransport; } });
 var oidc_session_auth_controller_1 = require("./nest/oidc-session-auth.controller");
 Object.defineProperty(exports, "OidcSessionAuthController", { enumerable: true, get: function () { return oidc_session_auth_controller_1.OidcSessionAuthController; } });
+var navigation_refusal_1 = require("./nest/navigation-refusal");
+Object.defineProperty(exports, "navigationErrorLocation", { enumerable: true, get: function () { return navigation_refusal_1.navigationErrorLocation; } });
+Object.defineProperty(exports, "OIDC_NAVIGATION_ERROR_PARAM", { enumerable: true, get: function () { return navigation_refusal_1.OIDC_NAVIGATION_ERROR_PARAM; } });
 var logout_response_dto_1 = require("./nest/dto/logout-response.dto");
 Object.defineProperty(exports, "LogoutResponseDto", { enumerable: true, get: function () { return logout_response_dto_1.LogoutResponseDto; } });
 var session_actor_dto_1 = require("./nest/dto/session-actor.dto");

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAWA,mCAUkB;AAThB,0GAAA,gBAAgB,OAAA;AAChB,8GAAA,oBAAoB,OAAA;AACpB,mHAAA,yBAAyB,OAAA;AACzB,oHAAA,0BAA0B,OAAA;AAC1B,sHAAA,4BAA4B,OAAA;AAC5B,6GAAA,mBAAmB,OAAA;AACnB,sHAAA,4BAA4B,OAAA;AAC5B,8GAAA,oBAAoB,OAAA;AAItB,sEAQuC;AAPrC,gIAAA,wBAAwB,OAAA;AACxB,8HAAA,sBAAsB,OAAA;AACtB,2HAAA,mBAAmB,OAAA;AAOrB,8DAKmC;AAJjC,iIAAA,6BAA6B,OAAA;AAC7B,kIAAA,8BAA8B,OAAA;AAC9B,kIAAA,8BAA8B,OAAA;AAIhC,8CAI0B;AAHxB,0GAAA,aAAa,OAAA;AAKf,oCAAgF;AAAvE,sGAAA,cAAc,OAAA;AAAE,0GAAA,kBAAkB,OAAA;AAE3C,kDAM4B;AAL1B,yGAAA,UAAU,OAAA;AACV,oHAAA,qBAAqB,OAAA;AAavB,6EAG2C;AAFzC,+HAAA,oBAAoB,OAAA;AAItB,qEAMuC;AALrC,0HAAA,mBAAmB,OAAA;AACnB,wHAAA,iBAAiB,OAAA;AAMnB,yCAKyB;AAJvB,kHAAA,yBAAyB,OAAA;AACzB,+GAAA,sBAAsB,OAAA;AACtB,uGAAA,cAAc,OAAA;AAIhB,6DAOmC;AANjC,iHAAA,cAAc,OAAA;AACd,8GAAA,WAAW,OAAA;AAOb,0CAAqD;AAA5C,8GAAA,mBAAmB,OAAA;AAE5B,wCAKuB;AAJrB,oGAAA,UAAU,OAAA;AACV,0GAAA,gBAAgB,OAAA;AAChB,yGAAA,eAAe,OAAA;AAIjB,gDAAyE;AAAhE,mHAAA,qBAAqB,OAAA;AAAE,2GAAA,aAAa,OAAA;AAE7C,oEAMqC;AALnC,sHAAA,cAAc,OAAA;AACd,2HAAA,mBAAmB,OAAA;AACnB,2HAAA,mBAAmB,OAAA;AACnB,2HAAA,mBAAmB,OAAA;AAIrB,0EAQwC;AAPtC,6HAAA,kBAAkB,OAAA;AAClB,gIAAA,qBAAqB,OAAA;AAQvB,gEAA6D;AAApD,sHAAA,gBAAgB,OAAA;AAEzB,0EAA8D;AAArD,uHAAA,YAAY,OAAA;AAErB,4EAGyC;AAFvC,kIAAA,sBAAsB,OAAA;AAIxB,oFAK6C;AAJ3C,yIAAA,yBAAyB,OAAA;AAM3B,sEAAmE;AAA1D,wHAAA,iBAAiB,OAAA;AAC1B,kEAA+D;AAAtD,oHAAA,eAAe,OAAA;AAExB,wCAAyE;AAAhE,8GAAA,oBAAoB,OAAA;AAAE,4GAAA,kBAAkB,OAAA;AAEjD,kEAIoC;AAHlC,wHAAA,iBAAiB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;AAWA,mCAYkB;AAXhB,0GAAA,gBAAgB,OAAA;AAChB,8GAAA,oBAAoB,OAAA;AACpB,mHAAA,yBAAyB,OAAA;AACzB,sHAAA,4BAA4B,OAAA;AAC5B,oHAAA,0BAA0B,OAAA;AAC1B,2HAAA,iCAAiC,OAAA;AACjC,sHAAA,4BAA4B,OAAA;AAC5B,6GAAA,mBAAmB,OAAA;AACnB,sHAAA,4BAA4B,OAAA;AAC5B,8GAAA,oBAAoB,OAAA;AAItB,sEASuC;AARrC,gIAAA,wBAAwB,OAAA;AACxB,8HAAA,sBAAsB,OAAA;AACtB,2HAAA,mBAAmB,OAAA;AAQrB,8DAMmC;AALjC,iIAAA,6BAA6B,OAAA;AAC7B,kIAAA,8BAA8B,OAAA;AAC9B,kIAAA,8BAA8B,OAAA;AAC9B,kIAAA,8BAA8B,OAAA;AAIhC,8CAI0B;AAHxB,0GAAA,aAAa,OAAA;AAKf,oCAAgF;AAAvE,sGAAA,cAAc,OAAA;AAAE,0GAAA,kBAAkB,OAAA;AAE3C,kDAM4B;AAL1B,yGAAA,UAAU,OAAA;AACV,oHAAA,qBAAqB,OAAA;AAavB,6EAG2C;AAFzC,+HAAA,oBAAoB,OAAA;AAItB,qEAMuC;AALrC,0HAAA,mBAAmB,OAAA;AACnB,wHAAA,iBAAiB,OAAA;AAMnB,yCAKyB;AAJvB,kHAAA,yBAAyB,OAAA;AACzB,+GAAA,sBAAsB,OAAA;AACtB,uGAAA,cAAc,OAAA;AAIhB,6DAOmC;AANjC,iHAAA,cAAc,OAAA;AACd,8GAAA,WAAW,OAAA;AAOb,0CAAqD;AAA5C,8GAAA,mBAAmB,OAAA;AAE5B,4DAKkC;AAJhC,sHAAA,mBAAmB,OAAA;AACnB,+HAAA,4BAA4B,OAAA;AAC5B,6HAAA,0BAA0B,OAAA;AAI5B,8DAOkC;AANhC,kHAAA,aAAa,OAAA;AACb,wHAAA,mBAAmB,OAAA;AACnB,4HAAA,uBAAuB,OAAA;AAMzB,4DAGiC;AAF/B,0HAAA,sBAAsB,OAAA;AAIxB,wCAKuB;AAJrB,oGAAA,UAAU,OAAA;AACV,0GAAA,gBAAgB,OAAA;AAChB,yGAAA,eAAe,OAAA;AAIjB,gDAAyE;AAAhE,mHAAA,qBAAqB,OAAA;AAAE,2GAAA,aAAa,OAAA;AAE7C,oEAMqC;AALnC,sHAAA,cAAc,OAAA;AACd,2HAAA,mBAAmB,OAAA;AACnB,2HAAA,mBAAmB,OAAA;AACnB,2HAAA,mBAAmB,OAAA;AAIrB,0EAQwC;AAPtC,6HAAA,kBAAkB,OAAA;AAClB,gIAAA,qBAAqB,OAAA;AAQvB,gEAA6D;AAApD,sHAAA,gBAAgB,OAAA;AAEzB,0EAA8D;AAArD,uHAAA,YAAY,OAAA;AAErB,4EAGyC;AAFvC,kIAAA,sBAAsB,OAAA;AAIxB,oFAK6C;AAJ3C,yIAAA,yBAAyB,OAAA;AAM3B,gEAGmC;AAFjC,6HAAA,uBAAuB,OAAA;AACvB,iIAAA,2BAA2B,OAAA;AAG7B,sEAAmE;AAA1D,wHAAA,iBAAiB,OAAA;AAC1B,kEAA+D;AAAtD,oHAAA,eAAe,OAAA;AAExB,wCAAyE;AAAhE,8GAAA,oBAAoB,OAAA;AAAE,4GAAA,kBAAkB,OAAA;AAEjD,kEAIoC;AAHlC,wHAAA,iBAAiB,OAAA"}

package/dist/nest/navigation-refusal.d.ts

@@ -0,0 +1,4 @@
+import type { OidcSessionErrorCode } from '../errors';
+export declare const OIDC_NAVIGATION_ERROR_PARAM = "error";
+export declare function navigationErrorLocation(path: string, code: OidcSessionErrorCode): string;
+//# sourceMappingURL=navigation-refusal.d.ts.map

package/dist/nest/navigation-refusal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"navigation-refusal.d.ts","sourceRoot":"","sources":["../../src/nest/navigation-refusal.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAOtD,eAAO,MAAM,2BAA2B,UAAU,CAAC;AAOnD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,oBAAoB,GACzB,MAAM,CAGR"}

package/dist/nest/navigation-refusal.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OIDC_NAVIGATION_ERROR_PARAM = void 0;
+exports.navigationErrorLocation = navigationErrorLocation;
+exports.OIDC_NAVIGATION_ERROR_PARAM = 'error';
+function navigationErrorLocation(path, code) {
+    const query = new URLSearchParams({ [exports.OIDC_NAVIGATION_ERROR_PARAM]: code });
+    return `${path}?${query.toString()}`;
+}
+//# sourceMappingURL=navigation-refusal.js.map

package/dist/nest/navigation-refusal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"navigation-refusal.js","sourceRoot":"","sources":["../../src/nest/navigation-refusal.ts"],"names":[],"mappings":";;;AA6BA,0DAMC;AAbY,QAAA,2BAA2B,GAAG,OAAO,CAAC;AAOnD,SAAgB,uBAAuB,CACrC,IAAY,EACZ,IAA0B;IAE1B,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,CAAC,mCAA2B,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3E,OAAO,GAAG,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;AACvC,CAAC"}

package/dist/nest/oidc-session-auth.controller.d.ts

@@ -19,11 +19,15 @@ export declare class OidcSessionAuthController {
     private readonly sessions;
     private readonly client;
     private readonly options;
+    private readonly logger;
     constructor(sessions: SessionService, client: OidcClient, options: OidcSessionOptions);
     login(returnTo: string | undefined, loginHint: string | undefined, res: SessionResponseLike): Promise<void>;
     callback(code: string | undefined, state: string | undefined, error: string | undefined, errorDescription: string | undefined, res: SessionResponseLike): Promise<void>;
+    private completeCallback;
     logout(res: SessionResponseLike): Promise<void>;
     me(_req: SessionRequestShape, res: SessionResponseLike): void;
+    private exchangeCode;
+    private asNavigation;
     private sessionCookie;
     private clearedCookie;
 }

package/dist/nest/oidc-session-auth.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-session-auth.controller.d.ts","sourceRoot":"","sources":["../../src/nest/oidc-session-auth.controller.ts"],"names":[],"mappings":"AAiDA,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAK5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAIzE,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,CAAC;IAC1C,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAChD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/B,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IAC7B,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;IAC9B,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAC9B;AAGD,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;CACxD;AAGD,MAAM,WAAW,cAAc;IAQ7B,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC;AAgBD,qBAEa,yBAAyB;IAElC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAIvB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBALP,QAAQ,EAAE,cAAc,EACxB,MAAM,EAAE,UAAU,EAIlB,OAAO,EAAE,kBAAkB;IA2CxC,KAAK,CACU,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC3B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC1C,GAAG,EAAE,mBAAmB,GAC9B,OAAO,CAAC,IAAI,CAAC;IA+BV,QAAQ,CACG,IAAI,EAAE,MAAM,GAAG,SAAS,EACvB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,KAAK,EAAE,MAAM,GAAG,SAAS,EACb,gBAAgB,EAAE,MAAM,GAAG,SAAS,EACzD,GAAG,EAAE,mBAAmB,GAC9B,OAAO,CAAC,IAAI,CAAC;IAgEV,MAAM,CAAQ,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAuC5D,EAAE,CAAQ,IAAI,EAAE,mBAAmB,EAAS,GAAG,EAAE,mBAAmB,GAAG,IAAI;IAqB3E,OAAO,CAAC,aAAa;IAYrB,OAAO,CAAC,aAAa;CAWtB"}
+{"version":3,"file":"oidc-session-auth.controller.d.ts","sourceRoot":"","sources":["../../src/nest/oidc-session-auth.controller.ts"],"names":[],"mappings":"AAsDA,OAAO,EAAE,UAAU,EAAyB,MAAM,qBAAqB,CAAC;AAExE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAK5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAIzE,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,CAAC;IAC1C,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAChD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/B,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IAC7B,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;IAC9B,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAC9B;AAGD,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;CACxD;AAGD,MAAM,WAAW,cAAc;IAQ7B,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC;AAgBD,qBAEa,yBAAyB;IAIlC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAIvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAR1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8C;gBAGlD,QAAQ,EAAE,cAAc,EACxB,MAAM,EAAE,UAAU,EAIlB,OAAO,EAAE,kBAAkB;IA2CxC,KAAK,CACU,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC3B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC1C,GAAG,EAAE,mBAAmB,GAC9B,OAAO,CAAC,IAAI,CAAC;IAwCV,QAAQ,CACG,IAAI,EAAE,MAAM,GAAG,SAAS,EACvB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,KAAK,EAAE,MAAM,GAAG,SAAS,EACb,gBAAgB,EAAE,MAAM,GAAG,SAAS,EACzD,GAAG,EAAE,mBAAmB,GAC9B,OAAO,CAAC,IAAI,CAAC;YAMF,gBAAgB;IAqFxB,MAAM,CAAQ,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAgD5D,EAAE,CAAQ,IAAI,EAAE,mBAAmB,EAAS,GAAG,EAAE,mBAAmB,GAAG,IAAI;YA4B7D,YAAY;YAuBZ,YAAY;IAuB1B,OAAO,CAAC,aAAa;IAYrB,OAAO,CAAC,aAAa;CAWtB"}

package/dist/nest/oidc-session-auth.controller.js

@@ -11,14 +11,17 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
+var OidcSessionAuthController_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OidcSessionAuthController = void 0;
 const common_1 = require("@nestjs/common");
 const swagger_1 = require("@nestjs/swagger");
 const xema_decorators_1 = require("@xemahq/xema-decorators");
 const errors_1 = require("../errors");
+const navigation_refusal_1 = require("./navigation-refusal");
 const oidc_session_context_1 = require("./oidc-session-context");
 const oidc_session_guard_1 = require("./oidc-session.guard");
+const redirect_targets_1 = require("./redirect-targets");
 const tokens_1 = require("./tokens");
 const cookie_1 = require("../http/cookie");
 const login_hint_1 = require("../http/login-hint");
@@ -30,26 +33,34 @@ const session_actor_dto_1 = require("./dto/session-actor.dto");
 const HTTP_FOUND = 302;
 const HTTP_OK = 200;
 const HTTP_UNAUTHORIZED = 401;
-let OidcSessionAuthController = class OidcSessionAuthController {
+let OidcSessionAuthController = OidcSessionAuthController_1 = class OidcSessionAuthController {
     sessions;
     client;
     options;
+    logger = new common_1.Logger(OidcSessionAuthController_1.name);
     constructor(sessions, client, options) {
         this.sessions = sessions;
         this.client = client;
         this.options = options;
     }
     async login(returnTo, loginHint, res) {
-        const pkce = (0, pkce_1.createPkcePair)();
-        const { authorizationUrl } = await this.sessions.beginAuthorization({
-            pkceVerifier: pkce.verifier,
-            codeChallenge: pkce.challenge,
-            returnTo: (0, cookie_1.safeRelativePath)(returnTo),
-            loginHint: (0, login_hint_1.safeLoginHint)(loginHint),
+        await this.asNavigation('login', res, async () => {
+            const { redirectUri } = (0, redirect_targets_1.resolveRedirectTargets)(this.options.oidc, (0, oidc_session_context_1.currentSessionScope)());
+            const pkce = (0, pkce_1.createPkcePair)();
+            const { authorizationUrl } = await this.sessions.beginAuthorization({
+                pkceVerifier: pkce.verifier,
+                codeChallenge: pkce.challenge,
+                returnTo: (0, cookie_1.safeRelativePath)(returnTo),
+                loginHint: (0, login_hint_1.safeLoginHint)(loginHint),
+                redirectUri,
+            });
+            res.status(HTTP_FOUND).redirect(authorizationUrl);
         });
-        res.status(HTTP_FOUND).redirect(authorizationUrl);
     }
     async callback(code, state, error, errorDescription, res) {
+        await this.asNavigation('callback', res, () => this.completeCallback(code, state, error, errorDescription, res));
+    }
+    async completeCallback(code, state, error, errorDescription, res) {
         if (error !== undefined && error !== '') {
             throw new errors_1.OidcCallbackRejectedError(`The identity provider refused the sign-in (${error}` +
                 `${errorDescription === undefined ? '' : `: ${errorDescription}`}).`);
@@ -60,14 +71,19 @@ let OidcSessionAuthController = class OidcSessionAuthController {
         if (code === undefined || code === '') {
             throw new errors_1.OidcCallbackRejectedError('The callback carried no authorization code.');
         }
+        const { redirectUri } = (0, redirect_targets_1.resolveRedirectTargets)(this.options.oidc, (0, oidc_session_context_1.currentSessionScope)());
         const pending = await this.sessions.takePendingAuthorization(state);
         if (pending === null) {
             throw new errors_1.OidcLoginStateUnknownError();
         }
-        const tokenSet = await this.client.exchangeCode({
+        if (pending.redirectUri !== redirectUri) {
+            throw new errors_1.OidcLoginOriginMismatchError();
+        }
+        const tokenSet = await this.exchangeCode({
             code,
             codeVerifier: pending.codeVerifier,
             nonce: pending.nonce,
+            redirectUri: pending.redirectUri,
         });
         const scope = (0, oidc_session_context_1.currentSessionScope)();
         if (scope !== undefined && scope.session !== null) {
@@ -79,7 +95,8 @@ let OidcSessionAuthController = class OidcSessionAuthController {
     }
     async logout(res) {
         const scope = (0, oidc_session_context_1.currentSessionScope)();
-        const endSessionUrl = await this.sessions.endSession(scope?.session ?? null);
+        const { postLogoutRedirectUri } = (0, redirect_targets_1.resolveRedirectTargets)(this.options.oidc, scope);
+        const endSessionUrl = await this.sessions.endSession(scope?.session ?? null, postLogoutRedirectUri);
         res.setHeader('Set-Cookie', this.clearedCookie());
         const body = { endSessionUrl };
         res.status(HTTP_OK).json(body);
@@ -98,6 +115,31 @@ let OidcSessionAuthController = class OidcSessionAuthController {
         res.status(HTTP_OK).type('application/json');
         res.send('null');
     }
+    async exchangeCode(input) {
+        try {
+            return await this.client.exchangeCode(input);
+        }
+        catch (caught) {
+            if (caught instanceof oidc_client_1.OidcInvalidGrantError) {
+                throw new errors_1.OidcCallbackRejectedError(caught.message);
+            }
+            throw caught;
+        }
+    }
+    async asNavigation(route, res, work) {
+        try {
+            await work();
+        }
+        catch (caught) {
+            const path = this.options.navigationErrorPath;
+            if (path === undefined || !(caught instanceof errors_1.OidcSessionError)) {
+                throw caught;
+            }
+            this.logger.warn(`GET ${route} refused (${caught.code}, HTTP ${String(caught.getStatus())}): ` +
+                `${caught.message} — redirecting to the navigation-error path.`);
+            res.status(HTTP_FOUND).redirect((0, navigation_refusal_1.navigationErrorLocation)(path, caught.code));
+        }
+    }
     sessionCookie(value) {
         const { cookie, ttl } = this.options;
         return (0, cookie_1.serializeCookie)(cookie.name, value, {
@@ -216,7 +258,7 @@ __decorate([
     __metadata("design:paramtypes", [Object, Object]),
     __metadata("design:returntype", void 0)
 ], OidcSessionAuthController.prototype, "me", null);
-exports.OidcSessionAuthController = OidcSessionAuthController = __decorate([
+exports.OidcSessionAuthController = OidcSessionAuthController = OidcSessionAuthController_1 = __decorate([
     (0, swagger_1.ApiExtraModels)(session_actor_dto_1.SessionActorDto),
     (0, common_1.Controller)('auth'),
     __param(2, (0, common_1.Inject)(tokens_1.OIDC_SESSION_OPTIONS)),

package/dist/nest/oidc-session-auth.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-session-auth.controller.js","sourceRoot":"","sources":["../../src/nest/oidc-session-auth.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAiBA,2CASwB;AACxB,6CAMyB;AACzB,6DAA6E;AAE7E,sCAImB;AACnB,iEAA6D;AAC7D,6DAAwD;AACxD,qCAAgD;AAChD,2CAAmE;AACnE,mDAAmD;AAInD,qDAAiD;AACjD,uCAA8C;AAC9C,gEAA4D;AAC5D,mEAA8D;AAC9D,+DAA0D;AAiC1D,MAAM,UAAU,GAAG,GAAG,CAAC;AACvB,MAAM,OAAO,GAAG,GAAG,CAAC;AACpB,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAcvB,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IAEjB;IACA;IAIA;IANnB,YACmB,QAAwB,EACxB,MAAkB,EAIlB,OAA2B;QAL3B,aAAQ,GAAR,QAAQ,CAAgB;QACxB,WAAM,GAAN,MAAM,CAAY;QAIlB,YAAO,GAAP,OAAO,CAAoB;IAC3C,CAAC;IA0CE,AAAN,KAAK,CAAC,KAAK,CACU,QAA4B,EAC3B,SAA6B,EAC1C,GAAwB;QAE/B,MAAM,IAAI,GAAG,IAAA,qBAAc,GAAE,CAAC;QAC9B,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YAClE,YAAY,EAAE,IAAI,CAAC,QAAQ;YAC3B,aAAa,EAAE,IAAI,CAAC,SAAS;YAC7B,QAAQ,EAAE,IAAA,yBAAgB,EAAC,QAAQ,CAAC;YACpC,SAAS,EAAE,IAAA,0BAAa,EAAC,SAAS,CAAC;SACpC,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IACpD,CAAC;IAsBK,AAAN,KAAK,CAAC,QAAQ,CACG,IAAwB,EACvB,KAAyB,EACzB,KAAyB,EACb,gBAAoC,EACzD,GAAwB;QAE/B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,kCAAyB,CACjC,8CAA8C,KAAK,EAAE;gBACnD,GAAG,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,gBAAgB,EAAE,IAAI,CACvE,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,kCAAyB,CAAC,gCAAgC,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,kCAAyB,CACjC,6CAA6C,CAC9C,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;QACpE,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,mCAA0B,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YAC9C,IAAI;YACJ,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;QAKH,MAAM,KAAK,GAAG,IAAA,0CAAmB,GAAE,CAAC;QACpC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAClD,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CACtD,QAAQ,EACR,OAAO,CAAC,QAAQ,CACjB,CAAC;QACF,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;QACzE,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC;IAC/D,CAAC;IAuBK,AAAN,KAAK,CAAC,MAAM,CAAQ,GAAwB;QAC1C,MAAM,KAAK,GAAG,IAAA,0CAAmB,GAAE,CAAC;QACpC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC;QAC7E,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;QAClD,MAAM,IAAI,GAAmB,EAAE,aAAa,EAAE,CAAC;QAC/C,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAiCD,EAAE,CAAQ,IAAyB,EAAS,GAAwB;QAClE,MAAM,KAAK,GAAG,IAAA,0CAAmB,GAAE,CAAC;QACpC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAClD,MAAM,KAAK,GAAiB,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;QACD,IAAI,KAAK,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;YAC5B,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;YAIlD,MAAM,IAAI,4BAAmB,EAAE,CAAC;QAClC,CAAC;QAID,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC7C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnB,CAAC;IAEO,aAAa,CAAC,KAAa;QACjC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QACrC,OAAO,IAAA,wBAAe,EAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;YACzC,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;YACjE,aAAa,EAAE,GAAG,CAAC,kBAAkB;SACtC,CAAC,CAAC;IACL,CAAC;IAEO,aAAa;QACnB,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAChC,OAAO,IAAA,wBAAe,EAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE;YACtC,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;YACjE,aAAa,EAAE,CAAC;SACjB,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AA9OY,8DAAyB;AAkD9B;IA1BL,IAAA,iCAAe,EAAC;QACf,MAAM,EAAE,mCAAiB,CAAC,aAAa;QACvC,KAAK,EACH,0EAA0E;YAC1E,qDAAqD;KACxD,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,MAAM;QACZ,WAAW,EACT,+EAA+E;KAClF,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,MAAM;QACZ,WAAW,EACT,0EAA0E;YAC1E,6EAA6E;KAChF,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,UAAU;QAClB,WAAW,EAAE,0EAA0E;KACxF,CAAC;IACD,IAAA,YAAG,EAAC,OAAO,CAAC;IAEV,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;IACjB,WAAA,IAAA,cAAK,EAAC,WAAW,CAAC,CAAA;IAClB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;sDAUP;AAsBK;IAbL,IAAA,iCAAe,EAAC;QACf,MAAM,EAAE,mCAAiB,CAAC,aAAa;QACvC,KAAK,EACH,wEAAwE;YACxE,2EAA2E;KAC9E,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,UAAU;QAClB,WAAW,EACT,oEAAoE;YACpE,sCAAsC;KACzC,CAAC;IACD,IAAA,YAAG,EAAC,UAAU,CAAC;IAEb,WAAA,IAAA,cAAK,EAAC,MAAM,CAAC,CAAA;IACb,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,WAAA,IAAA,cAAK,EAAC,mBAAmB,CAAC,CAAA;IAC1B,WAAA,IAAA,YAAG,GAAE,CAAA;;;;yDA0CP;AAuBK;IAdL,IAAA,iCAAe,EAAC;QACf,MAAM,EAAE,mCAAiB,CAAC,wBAAwB;QAClD,KAAK,EACH,6DAA6D;YAC7D,wEAAwE;YACxE,2EAA2E;YAC3E,oBAAoB;KACvB,CAAC;IACD,IAAA,uBAAa,EAAC;QACb,IAAI,EAAE,uCAAiB;QACvB,WAAW,EAAE,sDAAsD;KACpE,CAAC;IACD,IAAA,kBAAS,EAAC,qCAAgB,CAAC;IAC3B,IAAA,aAAI,EAAC,QAAQ,CAAC;IACD,WAAA,IAAA,YAAG,GAAE,CAAA;;;;uDAMlB;AAiCD;IAtBC,IAAA,iCAAe,EAAC;QACf,MAAM,EAAE,mCAAiB,CAAC,wBAAwB;QAClD,KAAK,EACH,0EAA0E;YAC1E,0EAA0E;KAC7E,CAAC;IAID,IAAA,uBAAa,EAAC;QACb,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,IAAA,uBAAa,EAAC,mCAAe,CAAC,EAAE,CAAC,EAAE;QAC7E,WAAW,EACT,0EAA0E;YAC1E,iEAAiE;KACpE,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,iBAAiB;QACzB,WAAW,EACT,4EAA4E;YAC5E,yCAAyC;KAC5C,CAAC;IACD,IAAA,YAAG,EAAC,IAAI,CAAC;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;IAA6B,WAAA,IAAA,YAAG,GAAE,CAAA;;;;mDAmB1C;oCArNU,yBAAyB;IAFrC,IAAA,wBAAc,EAAC,mCAAe,CAAC;IAC/B,IAAA,mBAAU,EAAC,MAAM,CAAC;IAOd,WAAA,IAAA,eAAM,EAAC,6BAAoB,CAAC,CAAA;qCAJF,gCAAc;QAChB,wBAAU;GAH1B,yBAAyB,CA8OrC"}
+{"version":3,"file":"oidc-session-auth.controller.js","sourceRoot":"","sources":["../../src/nest/oidc-session-auth.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAiBA,2CAUwB;AACxB,6CAMyB;AACzB,6DAA6E;AAE7E,sCAMmB;AACnB,6DAA+D;AAC/D,iEAA6D;AAC7D,6DAAwD;AACxD,yDAA4D;AAC5D,qCAAgD;AAChD,2CAAmE;AACnE,mDAAmD;AAInD,qDAAwE;AACxE,uCAA8C;AAC9C,gEAA4D;AAC5D,mEAA8D;AAC9D,+DAA0D;AAiC1D,MAAM,UAAU,GAAG,GAAG,CAAC;AACvB,MAAM,OAAO,GAAG,GAAG,CAAC;AACpB,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAcvB,IAAM,yBAAyB,iCAA/B,MAAM,yBAAyB;IAIjB;IACA;IAIA;IARF,MAAM,GAAG,IAAI,eAAM,CAAC,2BAAyB,CAAC,IAAI,CAAC,CAAC;IAErE,YACmB,QAAwB,EACxB,MAAkB,EAIlB,OAA2B;QAL3B,aAAQ,GAAR,QAAQ,CAAgB;QACxB,WAAM,GAAN,MAAM,CAAY;QAIlB,YAAO,GAAP,OAAO,CAAoB;IAC3C,CAAC;IA0CE,AAAN,KAAK,CAAC,KAAK,CACU,QAA4B,EAC3B,SAA6B,EAC1C,GAAwB;QAE/B,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;YAG/C,MAAM,EAAE,WAAW,EAAE,GAAG,IAAA,yCAAsB,EAC5C,IAAI,CAAC,OAAO,CAAC,IAAI,EACjB,IAAA,0CAAmB,GAAE,CACtB,CAAC;YACF,MAAM,IAAI,GAAG,IAAA,qBAAc,GAAE,CAAC;YAC9B,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBAClE,YAAY,EAAE,IAAI,CAAC,QAAQ;gBAC3B,aAAa,EAAE,IAAI,CAAC,SAAS;gBAC7B,QAAQ,EAAE,IAAA,yBAAgB,EAAC,QAAQ,CAAC;gBACpC,SAAS,EAAE,IAAA,0BAAa,EAAC,SAAS,CAAC;gBACnC,WAAW;aACZ,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;IACL,CAAC;IAsBK,AAAN,KAAK,CAAC,QAAQ,CACG,IAAwB,EACvB,KAAyB,EACzB,KAAyB,EACb,gBAAoC,EACzD,GAAwB;QAE/B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,CAC5C,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAAG,CAAC,CACjE,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC5B,IAAwB,EACxB,KAAyB,EACzB,KAAyB,EACzB,gBAAoC,EACpC,GAAwB;QAExB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,kCAAyB,CACjC,8CAA8C,KAAK,EAAE;gBACnD,GAAG,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,gBAAgB,EAAE,IAAI,CACvE,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,kCAAyB,CAAC,gCAAgC,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,kCAAyB,CACjC,6CAA6C,CAC9C,CAAC;QACJ,CAAC;QAID,MAAM,EAAE,WAAW,EAAE,GAAG,IAAA,yCAAsB,EAC5C,IAAI,CAAC,OAAO,CAAC,IAAI,EACjB,IAAA,0CAAmB,GAAE,CACtB,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;QACpE,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,mCAA0B,EAAE,CAAC;QACzC,CAAC;QAID,IAAI,OAAO,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;YACxC,MAAM,IAAI,qCAA4B,EAAE,CAAC;QAC3C,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC;YACvC,IAAI;YACJ,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,KAAK,EAAE,OAAO,CAAC,KAAK;YAEpB,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,CAAC;QAKH,MAAM,KAAK,GAAG,IAAA,0CAAmB,GAAE,CAAC;QACpC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAClD,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CACtD,QAAQ,EACR,OAAO,CAAC,QAAQ,CACjB,CAAC;QACF,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;QACzE,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC;IAC/D,CAAC;IAuBK,AAAN,KAAK,CAAC,MAAM,CAAQ,GAAwB;QAC1C,MAAM,KAAK,GAAG,IAAA,0CAAmB,GAAE,CAAC;QAGpC,MAAM,EAAE,qBAAqB,EAAE,GAAG,IAAA,yCAAsB,EACtD,IAAI,CAAC,OAAO,CAAC,IAAI,EACjB,KAAK,CACN,CAAC;QACF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAClD,KAAK,EAAE,OAAO,IAAI,IAAI,EACtB,qBAAqB,CACtB,CAAC;QACF,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;QAClD,MAAM,IAAI,GAAmB,EAAE,aAAa,EAAE,CAAC;QAC/C,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAiCD,EAAE,CAAQ,IAAyB,EAAS,GAAwB;QAClE,MAAM,KAAK,GAAG,IAAA,0CAAmB,GAAE,CAAC;QACpC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAClD,MAAM,KAAK,GAAiB,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;QACD,IAAI,KAAK,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;YAC5B,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;YAIlD,MAAM,IAAI,4BAAmB,EAAE,CAAC;QAClC,CAAC;QAID,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC7C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnB,CAAC;IASO,KAAK,CAAC,YAAY,CACxB,KAAgD;QAEhD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,MAAM,EAAE,CAAC;YAChB,IAAI,MAAM,YAAY,mCAAqB,EAAE,CAAC;gBAC5C,MAAM,IAAI,kCAAyB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,MAAM,CAAC;QACf,CAAC;IACH,CAAC;IAYO,KAAK,CAAC,YAAY,CACxB,KAA2B,EAC3B,GAAwB,EACxB,IAAyB;QAEzB,IAAI,CAAC;YACH,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC;YAC9C,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,YAAY,yBAAgB,CAAC,EAAE,CAAC;gBAChE,MAAM,MAAM,CAAC;YACf,CAAC;YAID,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,OAAO,KAAK,aAAa,MAAM,CAAC,IAAI,UAAU,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,KAAK;gBAC3E,GAAG,MAAM,CAAC,OAAO,8CAA8C,CAClE,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,IAAA,4CAAuB,EAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAEO,aAAa,CAAC,KAAa;QACjC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QACrC,OAAO,IAAA,wBAAe,EAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;YACzC,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;YACjE,aAAa,EAAE,GAAG,CAAC,kBAAkB;SACtC,CAAC,CAAC;IACL,CAAC;IAEO,aAAa;QACnB,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAChC,OAAO,IAAA,wBAAe,EAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE;YACtC,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;YACjE,aAAa,EAAE,CAAC;SACjB,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAlVY,8DAAyB;AAoD9B;IA1BL,IAAA,iCAAe,EAAC;QACf,MAAM,EAAE,mCAAiB,CAAC,aAAa;QACvC,KAAK,EACH,0EAA0E;YAC1E,qDAAqD;KACxD,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,MAAM;QACZ,WAAW,EACT,+EAA+E;KAClF,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,MAAM;QACZ,WAAW,EACT,0EAA0E;YAC1E,6EAA6E;KAChF,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,UAAU;QAClB,WAAW,EAAE,0EAA0E;KACxF,CAAC;IACD,IAAA,YAAG,EAAC,OAAO,CAAC;IAEV,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;IACjB,WAAA,IAAA,cAAK,EAAC,WAAW,CAAC,CAAA;IAClB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;sDAmBP;AAsBK;IAbL,IAAA,iCAAe,EAAC;QACf,MAAM,EAAE,mCAAiB,CAAC,aAAa;QACvC,KAAK,EACH,wEAAwE;YACxE,2EAA2E;KAC9E,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,UAAU;QAClB,WAAW,EACT,oEAAoE;YACpE,sCAAsC;KACzC,CAAC;IACD,IAAA,YAAG,EAAC,UAAU,CAAC;IAEb,WAAA,IAAA,cAAK,EAAC,MAAM,CAAC,CAAA;IACb,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,WAAA,IAAA,cAAK,EAAC,mBAAmB,CAAC,CAAA;IAC1B,WAAA,IAAA,YAAG,GAAE,CAAA;;;;yDAKP;AAuFK;IAdL,IAAA,iCAAe,EAAC;QACf,MAAM,EAAE,mCAAiB,CAAC,wBAAwB;QAClD,KAAK,EACH,6DAA6D;YAC7D,wEAAwE;YACxE,2EAA2E;YAC3E,oBAAoB;KACvB,CAAC;IACD,IAAA,uBAAa,EAAC;QACb,IAAI,EAAE,uCAAiB;QACvB,WAAW,EAAE,sDAAsD;KACpE,CAAC;IACD,IAAA,kBAAS,EAAC,qCAAgB,CAAC;IAC3B,IAAA,aAAI,EAAC,QAAQ,CAAC;IACD,WAAA,IAAA,YAAG,GAAE,CAAA;;;;uDAelB;AAiCD;IAtBC,IAAA,iCAAe,EAAC;QACf,MAAM,EAAE,mCAAiB,CAAC,wBAAwB;QAClD,KAAK,EACH,0EAA0E;YAC1E,0EAA0E;KAC7E,CAAC;IAID,IAAA,uBAAa,EAAC;QACb,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,IAAA,uBAAa,EAAC,mCAAe,CAAC,EAAE,CAAC,EAAE;QAC7E,WAAW,EACT,0EAA0E;YAC1E,iEAAiE;KACpE,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,iBAAiB;QACzB,WAAW,EACT,4EAA4E;YAC5E,yCAAyC;KAC5C,CAAC;IACD,IAAA,YAAG,EAAC,IAAI,CAAC;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;IAA6B,WAAA,IAAA,YAAG,GAAE,CAAA;;;;mDAmB1C;oCApQU,yBAAyB;IAFrC,IAAA,wBAAc,EAAC,mCAAe,CAAC;IAC/B,IAAA,mBAAU,EAAC,MAAM,CAAC;IASd,WAAA,IAAA,eAAM,EAAC,6BAAoB,CAAC,CAAA;qCAJF,gCAAc;QAChB,wBAAU;GAL1B,yBAAyB,CAkVrC"}

package/dist/nest/oidc-session-context.d.ts

@@ -1,8 +1,10 @@
+import type { RequestAuthority } from '../http/request-authority';
 import type { LiveSession } from '../session/session-service';
 export interface OidcSessionScope {
     readonly session: LiveSession | null;
     readonly expired: boolean;
     projectId: string | null;
+    readonly requestAuthority?: RequestAuthority;
 }
 export declare function runWithSessionScope<T>(scope: OidcSessionScope, fn: () => T): T;
 export declare function currentSessionScope(): OidcSessionScope | undefined;

package/dist/nest/oidc-session-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-session-context.d.ts","sourceRoot":"","sources":["../../src/nest/oidc-session-context.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAG9D,MAAM,WAAW,gBAAgB;IAE/B,QAAQ,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAOrC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAS1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAuBD,wBAAgB,mBAAmB,CAAC,CAAC,EACnC,KAAK,EAAE,gBAAgB,EACvB,EAAE,EAAE,MAAM,CAAC,GACV,CAAC,CAEH;AAGD,wBAAgB,mBAAmB,IAAI,gBAAgB,GAAG,SAAS,CAElE;AAUD,wBAAgB,cAAc,IAAI,WAAW,GAAG,IAAI,CAEnD;AASD,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAUlE"}
+{"version":3,"file":"oidc-session-context.d.ts","sourceRoot":"","sources":["../../src/nest/oidc-session-context.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAG9D,MAAM,WAAW,gBAAgB;IAE/B,QAAQ,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAOrC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAS1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAOzB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CAC9C;AAuBD,wBAAgB,mBAAmB,CAAC,CAAC,EACnC,KAAK,EAAE,gBAAgB,EACvB,EAAE,EAAE,MAAM,CAAC,GACV,CAAC,CAEH;AAGD,wBAAgB,mBAAmB,IAAI,gBAAgB,GAAG,SAAS,CAElE;AAUD,wBAAgB,cAAc,IAAI,WAAW,GAAG,IAAI,CAEnD;AASD,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAUlE"}

package/dist/nest/oidc-session-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-session-context.js","sourceRoot":"","sources":["../../src/nest/oidc-session-context.ts"],"names":[],"mappings":";;AAkEA,kDAKC;AAGD,kDAEC;AAUD,wCAEC;AASD,kDAUC;AAxFD,uDAAqD;AA0BrD,MAAM,iBAAiB,GAAG,MAAM,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;AAMhF,SAAS,OAAO;IACd,MAAM,MAAM,GAAG,UAAoC,CAAC;IACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC3C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,oCAAiB,EAAoB,CAAC;IAC1D,MAAM,CAAC,iBAAiB,CAAC,GAAG,OAAO,CAAC;IACpC,OAAO,OAAO,CAAC;AACjB,CAAC;AAMD,SAAgB,mBAAmB,CACjC,KAAuB,EACvB,EAAW;IAEX,OAAO,OAAO,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC;AAGD,SAAgB,mBAAmB;IACjC,OAAO,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAUD,SAAgB,cAAc;IAC5B,OAAO,mBAAmB,EAAE,EAAE,OAAO,IAAI,IAAI,CAAC;AAChD,CAAC;AASD,SAAgB,mBAAmB,CAAC,SAAwB;IAC1D,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,uEAAuE;YACrE,sEAAsE;YACtE,6BAA6B,CAChC,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"oidc-session-context.js","sourceRoot":"","sources":["../../src/nest/oidc-session-context.ts"],"names":[],"mappings":";;AA0EA,kDAKC;AAGD,kDAEC;AAUD,wCAEC;AASD,kDAUC;AAhGD,uDAAqD;AAkCrD,MAAM,iBAAiB,GAAG,MAAM,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;AAMhF,SAAS,OAAO;IACd,MAAM,MAAM,GAAG,UAAoC,CAAC;IACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC3C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,oCAAiB,EAAoB,CAAC;IAC1D,MAAM,CAAC,iBAAiB,CAAC,GAAG,OAAO,CAAC;IACpC,OAAO,OAAO,CAAC;AACjB,CAAC;AAMD,SAAgB,mBAAmB,CACjC,KAAuB,EACvB,EAAW;IAEX,OAAO,OAAO,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC;AAGD,SAAgB,mBAAmB;IACjC,OAAO,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAUD,SAAgB,cAAc;IAC5B,OAAO,mBAAmB,EAAE,EAAE,OAAO,IAAI,IAAI,CAAC;AAChD,CAAC;AASD,SAAgB,mBAAmB,CAAC,SAAwB;IAC1D,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,uEAAuE;YACrE,sEAAsE;YACtE,6BAA6B,CAChC,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;AAC9B,CAAC"}

package/dist/nest/oidc-session.middleware.d.ts

@@ -1,8 +1,9 @@
 import { type NestMiddleware } from '@nestjs/common';
 import { type OidcSessionScope } from './oidc-session-context';
+import { type AuthorityRequestLike } from '../http/request-authority';
 import { SessionService } from '../session/session-service';
 import type { OidcSessionOptions } from '../config/oidc-session-options';
-export interface SessionRequestLike {
+export interface SessionRequestLike extends AuthorityRequestLike {
     headers: Record<string, string | string[] | undefined>;
 }
 export declare const OIDC_SESSION_SCOPE: unique symbol;
@@ -13,6 +14,7 @@ export declare class OidcSessionMiddleware implements NestMiddleware {
     private readonly sessions;
     private readonly options;
     constructor(sessions: SessionService, options: OidcSessionOptions);
+    private readonly trustedProxies;
     use(req: SessionRequestLike, _res: unknown, next: (error?: unknown) => void): Promise<void>;
     private resolveScope;
 }

package/dist/nest/oidc-session.middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-session.middleware.d.ts","sourceRoot":"","sources":["../../src/nest/oidc-session.middleware.ts"],"names":[],"mappings":"AAaA,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEzE,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AASzE,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;CACxD;AAUD,eAAO,MAAM,kBAAkB,EAAE,OAAO,MAEvC,CAAC;AAGF,MAAM,WAAW,mBAAmB;IAClC,CAAC,kBAAkB,CAAC,CAAC,EAAE,gBAAgB,CAAC;CACzC;AAED,qBACa,qBAAsB,YAAW,cAAc;IAExD,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAIzB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAJP,QAAQ,EAAE,cAAc,EAIxB,OAAO,EAAE,kBAAkB;IAGxC,GAAG,CACP,GAAG,EAAE,kBAAkB,EACvB,IAAI,EAAE,OAAO,EACb,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,GAC9B,OAAO,CAAC,IAAI,CAAC;YAYF,YAAY;CAgB3B"}
+{"version":3,"file":"oidc-session.middleware.d.ts","sourceRoot":"","sources":["../../src/nest/oidc-session.middleware.ts"],"names":[],"mappings":"AAaA,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEzE,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAGL,KAAK,oBAAoB,EAG1B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AASzE,MAAM,WAAW,kBAAmB,SAAQ,oBAAoB;IAC9D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;CACxD;AAUD,eAAO,MAAM,kBAAkB,EAAE,OAAO,MAEvC,CAAC;AAGF,MAAM,WAAW,mBAAmB;IAClC,CAAC,kBAAkB,CAAC,CAAC,EAAE,gBAAgB,CAAC;CACzC;AAED,qBACa,qBAAsB,YAAW,cAAc;IAExD,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAIzB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAJP,QAAQ,EAAE,cAAc,EAIxB,OAAO,EAAE,kBAAkB;IAU9C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA8B;IAEvD,GAAG,CACP,GAAG,EAAE,kBAAkB,EACvB,IAAI,EAAE,OAAO,EACb,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,GAC9B,OAAO,CAAC,IAAI,CAAC;YAYF,YAAY;CAwB3B"}

package/dist/nest/oidc-session.middleware.js

@@ -17,6 +17,7 @@ const common_1 = require("@nestjs/common");
 const oidc_session_context_1 = require("./oidc-session-context");
 const tokens_1 = require("./tokens");
 const cookie_1 = require("../http/cookie");
+const request_authority_1 = require("../http/request-authority");
 const session_service_1 = require("../session/session-service");
 exports.OIDC_SESSION_SCOPE = Symbol.for('@xemahq/oidc-session-nest:request-scope');
 let OidcSessionMiddleware = class OidcSessionMiddleware {
@@ -25,7 +26,13 @@ let OidcSessionMiddleware = class OidcSessionMiddleware {
     constructor(sessions, options) {
         this.sessions = sessions;
         this.options = options;
+        const perOrigin = options.oidc.redirectFromRequestOrigin;
+        this.trustedProxies =
+            perOrigin === undefined
+                ? undefined
+                : (0, request_authority_1.parseTrustedProxies)(perOrigin.trustedProxies ?? []);
     }
+    trustedProxies;
     async use(req, _res, next) {
         const scope = await this.resolveScope(req);
         req[exports.OIDC_SESSION_SCOPE] = scope;
@@ -34,17 +41,21 @@ let OidcSessionMiddleware = class OidcSessionMiddleware {
         });
     }
     async resolveScope(req) {
+        const authority = this.trustedProxies === undefined
+            ? {}
+            : { requestAuthority: (0, request_authority_1.resolveRequestAuthority)(req, this.trustedProxies) };
         const header = req.headers.cookie;
         const cookieHeader = Array.isArray(header) ? header.join('; ') : header;
         const cookieValue = (0, cookie_1.readCookie)(cookieHeader, this.options.cookie.name);
         if (cookieValue === null) {
-            return { session: null, expired: false, projectId: null };
+            return { session: null, expired: false, projectId: null, ...authority };
         }
         const resolved = await this.sessions.resolveSession(cookieValue);
         return {
             session: resolved.session,
             expired: resolved.expired,
             projectId: null,
+            ...authority,
         };
     }
 };

package/dist/nest/oidc-session.middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-session.middleware.js","sourceRoot":"","sources":["../../src/nest/oidc-session.middleware.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAaA,2CAAyE;AAEzE,iEAGgC;AAChC,qCAAgD;AAChD,2CAA4C;AAC5C,gEAA4D;AAuB/C,QAAA,kBAAkB,GAAkB,MAAM,CAAC,GAAG,CACzD,yCAAyC,CAC1C,CAAC;AAQK,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAEb;IAIA;IALnB,YACmB,QAAwB,EAIxB,OAA2B;QAJ3B,aAAQ,GAAR,QAAQ,CAAgB;QAIxB,YAAO,GAAP,OAAO,CAAoB;IAC3C,CAAC;IAEJ,KAAK,CAAC,GAAG,CACP,GAAuB,EACvB,IAAa,EACb,IAA+B;QAE/B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAK1C,GAAgD,CAAC,0BAAkB,CAAC,GAAG,KAAK,CAAC;QAC9E,IAAA,0CAAmB,EAAC,KAAK,EAAE,GAAG,EAAE;YAC9B,IAAI,EAAE,CAAC;QACT,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,GAAuB;QAEvB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QAClC,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACxE,MAAM,WAAW,GAAG,IAAA,mBAAU,EAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvE,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5D,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QACjE,OAAO;YACL,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;CACF,CAAA;AAzCY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,eAAM,EAAC,6BAAoB,CAAC,CAAA;qCAHF,gCAAc;GAFhC,qBAAqB,CAyCjC"}
+{"version":3,"file":"oidc-session.middleware.js","sourceRoot":"","sources":["../../src/nest/oidc-session.middleware.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAaA,2CAAyE;AAEzE,iEAGgC;AAChC,qCAAgD;AAChD,2CAA4C;AAC5C,iEAMmC;AACnC,gEAA4D;AAuB/C,QAAA,kBAAkB,GAAkB,MAAM,CAAC,GAAG,CACzD,yCAAyC,CAC1C,CAAC;AAQK,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAEb;IAIA;IALnB,YACmB,QAAwB,EAIxB,OAA2B;QAJ3B,aAAQ,GAAR,QAAQ,CAAgB;QAIxB,YAAO,GAAP,OAAO,CAAoB;QAE5C,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,yBAAyB,CAAC;QACzD,IAAI,CAAC,cAAc;YACjB,SAAS,KAAK,SAAS;gBACrB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAA,uCAAmB,EAAC,SAAS,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;IAGgB,cAAc,CAA8B;IAE7D,KAAK,CAAC,GAAG,CACP,GAAuB,EACvB,IAAa,EACb,IAA+B;QAE/B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAK1C,GAAgD,CAAC,0BAAkB,CAAC,GAAG,KAAK,CAAC;QAC9E,IAAA,0CAAmB,EAAC,KAAK,EAAE,GAAG,EAAE;YAC9B,IAAI,EAAE,CAAC;QACT,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,GAAuB;QAKvB,MAAM,SAAS,GACb,IAAI,CAAC,cAAc,KAAK,SAAS;YAC/B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAA,2CAAuB,EAAC,GAAG,EAAE,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QAC9E,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QAClC,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACxE,MAAM,WAAW,GAAG,IAAA,mBAAU,EAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvE,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,SAAS,EAAE,CAAC;QAC1E,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QACjE,OAAO;YACL,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,SAAS,EAAE,IAAI;YACf,GAAG,SAAS;SACb,CAAC;IACJ,CAAC;CACF,CAAA;AA1DY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,eAAM,EAAC,6BAAoB,CAAC,CAAA;qCAHF,gCAAc;GAFhC,qBAAqB,CA0DjC"}

package/dist/nest/redirect-targets.d.ts

@@ -0,0 +1,8 @@
+import type { OidcSessionScope } from './oidc-session-context';
+import type { OidcProviderOptions } from '../config/oidc-session-options';
+export interface RedirectTargets {
+    readonly redirectUri: string;
+    readonly postLogoutRedirectUri: string | null;
+}
+export declare function resolveRedirectTargets(oidc: OidcProviderOptions, scope: OidcSessionScope | undefined): RedirectTargets;
+//# sourceMappingURL=redirect-targets.d.ts.map