alepha 0.14.3 → 0.15.0

package/dist/server/auth/index.d.ts

@@ -3,7 +3,7 @@ import { Alepha, Async, KIND, Primitive, Static } from "alepha";
 import * as alepha_server_cookies0 from "alepha/server/cookies";
 import { Cookies, ServerCookiesProvider } from "alepha/server/cookies";
 import { DateTimeProvider } from "alepha/datetime";
-import { AccessTokenResponse, RealmPrimitive, SecurityProvider, UserAccount } from "alepha/security";
+import { AccessTokenResponse, IssuerPrimitive, SecurityProvider, UserAccount } from "alepha/security";
 import { Configuration } from "openid-client";
 import * as alepha_logger0 from "alepha/logger";
 import * as alepha_server0 from "alepha/server";
@@ -142,18 +142,18 @@ declare class ServerAuthProvider {
   protected readonly configure: alepha181.HookPrimitive<"configure">;
   protected getAccessTokens(tokens: Tokens): string | undefined;
   /**
-   * Fill request headers with access token from cookies or fallback to provider's fallback function.
-   */
+       * Fill request headers with access token from cookies or fallback to provider's fallback function.
+       */
   protected readonly onRequest: alepha181.HookPrimitive<"server:onRequest">;
   /**
-   * Convert cookies to tokens.
-   * If the tokens are expired, try to refresh them using the refresh token.
-   */
+       * Convert cookies to tokens.
+       * If the tokens are expired, try to refresh them using the refresh token.
+       */
   protected cookiesToTokens(cookies: Cookies): Promise<Tokens | undefined>;
   protected refreshTokens(tokens: Tokens): Promise<Tokens | undefined>;
   /**
-   * Get user information.
-   */
+       * Get user information.
+       */
   readonly userinfo: alepha_server0.RoutePrimitive<{
     response: alepha181.TObject<{
       user: alepha181.TOptional<alepha181.TObject<{
@@ -184,8 +184,8 @@ declare class ServerAuthProvider {
     }>;
   }>;
   /**
-   * Refresh a token for internal providers.
-   */
+       * Refresh a token for internal providers.
+       */
   readonly refresh: alepha_server0.RoutePrimitive<{
     query: alepha181.TObject<{
       provider: alepha181.TString;
@@ -207,8 +207,8 @@ declare class ServerAuthProvider {
     }>;
   }>;
   /**
-   * Login for local password-based authentication.
-   */
+       * Login for local password-based authentication.
+       */
   readonly token: alepha_server0.RoutePrimitive<{
     query: alepha181.TObject<{
       provider: alepha181.TString;
@@ -256,8 +256,8 @@ declare class ServerAuthProvider {
     }>;
   }>;
   /**
-   * Oauth2/OIDC login route.
-   */
+       * Oauth2/OIDC login route.
+       */
   readonly login: alepha_server0.RoutePrimitive<{
     query: alepha181.TObject<{
       provider: alepha181.TString;
@@ -266,23 +266,23 @@ declare class ServerAuthProvider {
     }>;
   }>;
   /**
-   * Callback for OAuth2/OIDC providers.
-   * It handles the authorization code flow and retrieves the access token.
-   */
+       * Callback for OAuth2/OIDC providers.
+       * It handles the authorization code flow and retrieves the access token.
+       */
   readonly callback: alepha_server0.RoutePrimitive<alepha_server0.RequestConfigSchema>;
   /**
-   * Logout route for OAuth2/OIDC providers.
-   */
+       * Logout route for OAuth2/OIDC providers.
+       */
   readonly logout: alepha_server0.RoutePrimitive<{
     query: alepha181.TObject<{
       post_logout_redirect_uri: alepha181.TOptional<alepha181.TString>;
     }>;
   }>;
   /**
-   * Find an auth provider by name and optionally by realm.
-   * When realm is specified, it filters providers by both name and realm.
-   * This enables multi-realm setups where multiple providers share the same name (e.g., "credentials").
-   */
+       * Find an auth provider by name and optionally by realm.
+       * When realm is specified, it filters providers by both name and realm.
+       * This enables multi-realm setups where multiple providers share the same name (e.g., "credentials").
+       */
   protected provider(opts: string | {
     provider: string;
     realm?: string;
@@ -362,13 +362,13 @@ declare const $auth: {
 };
 type AuthPrimitiveOptions = {
   /**
-   * Name of the identity provider.
-   * If not provided, it will be derived from the property key.
-   */
+       * Name of the identity provider.
+       * If not provided, it will be derived from the property key.
+       */
   name?: string;
   /**
-   * If true, auth provider will be skipped.
-   */
+       * If true, auth provider will be skipped.
+       */
   disabled?: boolean;
 } & (AuthExternal | AuthInternal);
 /**
@@ -376,60 +376,60 @@ type AuthPrimitiveOptions = {
  */
 type AuthExternal = {
   /**
-   * Only OIDC is supported for external authentication.
-   */
+       * Only OIDC is supported for external authentication.
+       */
   oidc: OidcOptions;
   /**
-   * For anonymous access, this will expect a service account access token.
-   *
-   * ```ts
-   * class App {
-   *   anonymous = $serviceAccount(...);
-   *   auth = $auth({
-   *     // ... config ...
-   *     fallback: this.anonymous,
-   *   })
-   * }
-   * ```
-   */
+       * For anonymous access, this will expect a service account access token.
+       *
+       * ```ts
+       * class App {
+       *   anonymous = $serviceAccount(...);
+       *   auth = $auth({
+       *     // ... config ...
+       *     fallback: this.anonymous,
+       *   })
+       * }
+       * ```
+       */
   fallback?: () => Async<AccessToken>;
 };
 /**
  * When using your own authentication system, e.g. using a database to store user accounts.
  * This is usually used with a custom login form.
  *
- * This relies on the `realm`, which is used to create/verify the access token.
+ * This relies on the `issuer`, which is used to create/verify the access token.
  */
 type AuthInternal = {
-  realm: RealmPrimitive;
+  issuer: IssuerPrimitive;
 } & ({
   /**
-   * The common username/password authentication.
-   *
-   * - It uses the OAuth2 Client Credentials flow to obtain an access token.
-   *
-   * This is usually used with a custom login form on your website or mobile app.
-   */
+       * The common username/password authentication.
+       *
+       * - It uses the OAuth2 Client Credentials flow to obtain an access token.
+       *
+       * This is usually used with a custom login form on your website or mobile app.
+       */
   credentials: CredentialsOptions;
 } | {
   /**
-   * OAuth2 authentication. Delegates authentication to an OAuth2 provider. (e.g. Google, GitHub, etc.)
-   *
-   * - It uses the OAuth2 Authorization Code flow to obtain an access token and user information.
-   *
-   * This is usually used with a login button that redirects to the OAuth2 provider.
-   */
+       * OAuth2 authentication. Delegates authentication to an OAuth2 provider. (e.g. Google, GitHub, etc.)
+       *
+       * - It uses the OAuth2 Authorization Code flow to obtain an access token and user information.
+       *
+       * This is usually used with a login button that redirects to the OAuth2 provider.
+       */
   oauth: OAuth2Options;
 } | {
   /**
-   * Like OAuth2, but uses OIDC (OpenID Connect) for authentication and user information retrieval.
-   * OIDC is an identity layer on top of OAuth2, providing user authentication and profile information.
-   *
-   * - It uses the OAuth2 Authorization Code flow to obtain an access token and user information.
-   * - PCKE (Proof Key for Code Exchange) is recommended for security.
-   *
-   * This is usually used with a login button that redirects to the OIDC provider.
-   */
+       * Like OAuth2, but uses OIDC (OpenID Connect) for authentication and user information retrieval.
+       * OIDC is an identity layer on top of OAuth2, providing user authentication and profile information.
+       *
+       * - It uses the OAuth2 Authorization Code flow to obtain an access token and user information.
+       * - PCKE (Proof Key for Code Exchange) is recommended for security.
+       *
+       * This is usually used with a login button that redirects to the OIDC provider.
+       */
   oidc: OidcOptions;
 });
 type CredentialsOptions = {
@@ -442,36 +442,36 @@ interface Credentials {
 }
 interface OidcOptions {
   /**
-   * URL of the OIDC issuer.
-   */
+       * URL of the OIDC issuer.
+       */
   issuer: string;
   /**
-   * Client ID for the OIDC client.
-   */
+       * Client ID for the OIDC client.
+       */
   clientId: string;
   /**
-   * Client secret for the OIDC client.
-   * Optional if PKCE (Proof Key for Code Exchange) is used.
-   */
+       * Client secret for the OIDC client.
+       * Optional if PKCE (Proof Key for Code Exchange) is used.
+       */
   clientSecret?: string;
   /**
-   * Redirect URI for the OIDC client.
-   * This is where the user will be redirected after authentication.
-   */
+       * Redirect URI for the OIDC client.
+       * This is where the user will be redirected after authentication.
+       */
   redirectUri?: string;
   /**
-   * For external auth providers only.
-   * Take the ID token instead of the access token for validation.
-   */
+       * For external auth providers only.
+       * Take the ID token instead of the access token for validation.
+       */
   useIdToken?: boolean;
   /**
-   * URI to redirect the user after logout.
-   */
+       * URI to redirect the user after logout.
+       */
   logoutUri?: string;
   /**
-   * Optional scope for the OIDC client.
-   * @default "openid profile email".
-   */
+       * Optional scope for the OIDC client.
+       * @default "openid profile email".
+       */
   scope?: string;
   account?: LinkAccountFn;
 }
@@ -485,33 +485,33 @@ interface LinkAccountOptions {
 type LinkAccountFn = (tokens: LinkAccountOptions) => Async<UserAccount>;
 interface OAuth2Options {
   /**
-   * URL of the OAuth2 authorization endpoint.
-   */
+       * URL of the OAuth2 authorization endpoint.
+       */
   clientId: string;
   /**
-   * Client secret for the OAuth2 client.
-   */
+       * Client secret for the OAuth2 client.
+       */
   clientSecret: string;
   /**
-   * URL of the OAuth2 authorization endpoint.
-   */
+       * URL of the OAuth2 authorization endpoint.
+       */
   authorization: string;
   /**
-   * URL of the OAuth2 token endpoint.
-   */
+       * URL of the OAuth2 token endpoint.
+       */
   token: string;
   /**
-   * Function to retrieve user profile information from the OAuth2 tokens.
-   */
+       * Function to retrieve user profile information from the OAuth2 tokens.
+       */
   userinfo: (tokens: Tokens) => Async<OAuth2Profile>;
   account?: LinkAccountFn;
   /**
-   * URL of the OAuth2 authorization endpoint.
-   */
+       * URL of the OAuth2 authorization endpoint.
+       */
   redirectUri?: string;
   /**
-   * URL of the OAuth2 authorization endpoint.
-   */
+       * URL of the OAuth2 authorization endpoint.
+       */
   scope?: string;
 }
 declare class AuthPrimitive extends Primitive<AuthPrimitiveOptions> {
@@ -519,19 +519,19 @@ declare class AuthPrimitive extends Primitive<AuthPrimitiveOptions> {
   protected readonly dateTimeProvider: DateTimeProvider;
   oauth?: Configuration;
   get name(): string;
-  get realm(): RealmPrimitive | undefined;
+  get issuer(): IssuerPrimitive | undefined;
   get jwks_uri(): string;
   get scope(): string | undefined;
   get redirect_uri(): string | undefined;
   /**
-   * Refreshes the access token using the refresh token.
-   * Can be used on oauth2, oidc or credentials auth providers.
-   */
+       * Refreshes the access token using the refresh token.
+       * Can be used on oauth2, oidc or credentials auth providers.
+       */
   refresh(refreshToken: string, accessToken?: string): Promise<AccessTokenResponse>;
   /**
-   * Extracts user information from the access token.
-   * This is used to create a user account from the access token.
-   */
+       * Extracts user information from the access token.
+       * This is used to create a user account from the access token.
+       */
   user(tokens: Tokens): Promise<UserAccount>;
   protected getUserFromIdToken(idToken: string): OAuth2Profile;
   prepare(): Promise<void>;
@@ -552,7 +552,7 @@ interface WithLoginFn {
  *
  * Uses username and password to authenticate users.
  */
-declare const $authCredentials: (realm: RealmPrimitive & WithLoginFn, options?: Partial<CredentialsOptions>) => AuthPrimitive;
+declare const $authCredentials: (realm: IssuerPrimitive & WithLoginFn, options?: Partial<CredentialsOptions>) => AuthPrimitive;
 //#endregion
 //#region ../../src/server/auth/primitives/$authGithub.d.ts
 /**
@@ -565,7 +565,7 @@ declare const $authCredentials: (realm: RealmPrimitive & WithLoginFn, options?:
  * - `GITHUB_CLIENT_ID`: The client ID obtained from the GitHub Developer Settings.
  * - `GITHUB_CLIENT_SECRET`: The client secret obtained from the GitHub Developer Settings.
  */
-declare const $authGithub: (realm: RealmPrimitive & WithLinkFn, options?: Partial<OidcOptions>) => AuthPrimitive;
+declare const $authGithub: (realm: IssuerPrimitive & WithLinkFn, options?: Partial<OidcOptions>) => AuthPrimitive;
 //#endregion
 //#region ../../src/server/auth/primitives/$authGoogle.d.ts
 /**
@@ -578,16 +578,16 @@ declare const $authGithub: (realm: RealmPrimitive & WithLinkFn, options?: Partia
  * - `GOOGLE_CLIENT_ID`: The client ID obtained from the Google Developer Console.
  * - `GOOGLE_CLIENT_SECRET`: The client secret obtained from the Google Developer Console.
  */
-declare const $authGoogle: (realm: RealmPrimitive & WithLinkFn, options?: Partial<OidcOptions>) => AuthPrimitive;
+declare const $authGoogle: (realm: IssuerPrimitive & WithLinkFn, options?: Partial<OidcOptions>) => AuthPrimitive;
 //#endregion
 //#region ../../src/server/auth/index.d.ts
 declare module "alepha" {
   interface State {
     /**
-     * The authenticated user account attached to the server request state.
-     *
-     * @internal
-     */
+             * The authenticated user account attached to the server request state.
+             *
+             * @internal
+             */
     "alepha.server.request.user"?: UserAccount;
   }
 }

package/dist/server/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../../../src/server/auth/constants/routes.ts","../../../src/server/auth/schemas/authenticationProviderSchema.ts","../../../src/server/auth/schemas/tokenResponseSchema.ts","../../../src/server/auth/schemas/tokensSchema.ts","../../../src/server/auth/schemas/userinfoResponseSchema.ts","../../../src/server/auth/providers/ServerAuthProvider.ts","../../../src/server/auth/primitives/$auth.ts","../../../src/server/auth/primitives/$authCredentials.ts","../../../src/server/auth/primitives/$authGithub.ts","../../../src/server/auth/primitives/$authGoogle.ts","../../../src/server/auth/index.ts"],"sourcesContent":[],"mappings":";;;;;;;;;;;;cAAa;;;;;;;;;;cCEA,wCAA4B;QAYxC,SAAA,CAAA;;;KAEW,sBAAA,GAAyB,cAC5B;;;cCZI,+BAAmB;YAG9B,SAAA,CAAA;;;;;;;;;;IFRW,EAAA,mBAOZ;;;;ICLY,OAAA,qBAYZ,mBAAA;IAAA,SAAA,qBAAA,mBAAA;;SAZwC,qBAAA,iBAAA,mBAAA,CAAA;EAAA,CAAA,CAAA;EAc7B,GAAA,mBAAsB,CAAA;;;;MCXrB,KAAA,qBAGX,mBAAA;MAAA,IAAA,mBAAA;;;;;;;;;;;KAEU,aAAA,GAAgB,cAAc;;;cCP7B,wBAAY;YAevB,SAAA,CAAA;;;;;;;;;;AHlBW,KGoBD,MAAA,GAAS,MHpBR,CAAA,OGoBsB,YHblC,CAAA;;;cIHY,kCAAsB;;QAGjC,SAAA,CAAA;;;;;;;;;EJPW,GAAA,mBAOZ,CAAA;;;;MCLY,KAAA,qBAYZ,mBAAA;MAAA,IAAA,mBAAA;;MAZwC,eAAA,qBAAA,mBAAA;MAAA,OAAA,qBAAA,mBAAA;MAc7B,SAAA,qBACH,kBAD4B,CAAA;;;;ICXxB,CAAA,CAAA,CAAA;EAGX,CAAA,CAAA;;KECU,gBAAA,GAAmB,cAAc;;;cCqBhC,kBAAA;0BAAkB,cAAA,CACP;6BACG;4CACe;uCACL;ELlCxB,mBAAA,mBAOZ,EK4BuC,mBL5BvC;wCK8BqC,sBAAA,CAAA,kCAAA;cAFE,SAAA,CAAA;;IJjC3B,YAAA,qBAYZ,mBAAA;IAAA,WAAA,qBAAA,mBAAA;;SAZwC,qBAAA,mBAAA;EAAA,CAAA,CAAA,CAAA;EAc7B,SAAA,MAAA,EImCY,sBAAA,CAAA,uBJnCa,WImCb,OJnCmB,CAAA;cIqBL,SAAA,CAAA;;;IHhCzB,UAAA,qBAGX,mBAAA;IAAA,aAAA,qBAAA,mBAAA;;;;;;oBGoDyB,MAAM;;;MAQ5B;gCAAsB,SAAA,CAiCG;oCASM;;;;gCAAM,SAAA,CAiBZ;;;;;qCAqCjB,UACR,QAAQ;kCA8B2B,SAAS,QAAQ;;;;oCAiD/B;;;YAjD8B,SAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;AHzLxD;mCG+QyB;;gBArCC,SAAA,CAAA;IFjPb,CAAA,CAAA;IAeX,IAAA,mBAAA,CAAA;;;;;;;;;;;;;;;;EAfuB;AAiBzB;;iCE4SuB;;MD5TV,QAAA,ECqRY,SAAA,CAAA,ODlRvB;MAAA,KAAA,qBAAA,mBAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAHiC,CAAA,CAAA;IAAA,CAAA,CAAA;EAKvB,CAAA,CAAA;;;;ECqBC,SAAA,KAAA,iBA+WU,cA/WQ,CAAA;IAAA,KAAA,mBACP,CAAA;MACG,QAAA,EAgSJ,SAAA,CAAA,OAhSI;MACe,KAAA,qBAAA,mBAAA;MACL,YAAA,qBAAA,mBAAA;IACG,CAAA,CAAA;EAAA,CAAA,CAAA;;;;;qBAicd,cAAA,CAAA,eAvFH,cAAA,CAuFG,mBAAA;;;;kCAmEF;;MAlgBc,wBAAA,qBAAA,CA+bZ,SAAA,CAAA,OAAA,CA/bY;IAAA,CAAA,CAAA;EAAA,CAAA,CAAA;;;;;;;;;MA+kBjC;gCAyB2B,UAAU;8BAIZ,kBAAkB;;UAiB/B,aAAA;;UA/mBO,MAAA;EAAA,IAAA,CAAA,EAAA,MAAA;EASS,UAAA,CAAA,EAAA,MAAA;EAAN,WAAA,CAAA,EAAA,MAAA;EAQtB,WAAA,CAAA,EAAA,MAAA;EAAsB,QAiCG,CAAA,EAAA,MAAA;EASM,kBAAA,CAAA,EAAA,MAAA;EAAM,OAiBZ,CAAA,EAAA,MAAA;EAqCjB,OAAA,CAAA,EAAA,MAAA;EACA,OAAA,CAAA,EAAA,MAAA;EAAR,cAAA,CAAA,EAAA,OAAA;EA8BmC,MAAA,CAAA,EAAA,MAAA;EAAiB,SAAA,CAAA,EAAA,MAAA;EAAR,QAAA,CAAA,EAAA,MAAA;EAAO,MAAA,CAAA,EAAA,MAAA;;;;;;;;;;;;;;;;;;;;;;ALnMxD;;;;ACEA;;;;;AAcA;;;;ACXA;;;;;;;;;;;;;;;cIsDa;YAAkB,uBAAuB;;;KAM1C,oBAAA;;;;;;;;;;KAWP,eAAe;;;;KAKR,YAAA;;;;QAIJ;;;;;;;;;;;;;;mBAeW,MAAM;;;;;;AJ1FzB;;KImGY,YAAA;SACH;AH3GT,CAAA,GAAa,CAAA;EAeX;;;;;;;eGsGiB;;;;;;;;;EHrHM,KAAA,EG+HZ,aH/HY;AAiBzB,CAAA,GAAY;;;;AChBZ;;;;;;QE0IY;;KAIA,kBAAA;WACD;;KAGC,aAAA,iBACG,gBACV,MAAM;UAEM,WAAA;;;;UAKA,WAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;EFtJL,SAAA,CAAA,EAAA,MAAA;;;;ACqBZ;EAA+B,KAAA,CAAA,EAAA,MACP;EACG,OAAA,CAAA,ECuKf,aDvKe;;AAEU,UCwKpB,kBAAA,CDxKoB;EACG,YAAA,EAAA,MAAA;EAAA,IAAA,ECyKhC,aDzKgC;;;;;KC+K5B,aAAA,YAAyB,uBAAuB,MAAM;UAEjD,aAAA;;;;;;;;;;;;;;;;;;;;qBAwBI,WAAW,MAAM;YAE1B;;;;EDlLe,WAAA,CAAA,EAAA,MAAA;EAQtB;;;EA0CqC,KAAA,CAAA,EAiBZ,MAAA;;AAsCjB,cCwFA,aAAA,SAAsB,SDxFtB,CCwFgC,oBDxFhC,CAAA,CAAA;EAAR,mBAAA,gBAAA,ECyFgC,gBDzFhC;EA8BmC,mBAAA,gBAAA,EC4DH,gBD5DG;EAAiB,KAAA,CAAA,EC8DxC,aD9DwC;EAAR,IAAA,IAAA,CAAA,CAAA,EAAA,MAAA;EAAO,IAAA,KAAA,CAAA,CAAA,ECoElC,cDpEkC,GAAA,SAAA;;;;;;;;uDCkHnD,QAAQ;;;;;eAsCe,SAAS,QAAQ;iDAyCI;aAY3B;;KA8CV,WAAA;eAAsC;;UAEjC,UAAA;kCACiB,uBAAuB,MAAM;;UAG9C,WAAA;wCAGF,gBAAgB,MAAM;;;;;;;;;cCzbxB,0BACJ,iBAAiB,uBACf,QAAQ,wBAAD;;;;;;;;;;;;;APhBL,cQoBA,WRbZ,EAAA,CAAA,KAAA,EQcQ,cRdR,GQcyB,URdzB,EAAA,OAAA,CAAA,EQeU,ORfV,CQekB,WRflB,CAAA,EAAA,GQeiB,aRfjB;;;;;;;;;;;;;AAPY,cSmBA,WTZZ,EAAA,CAAA,KAAA,ESaQ,cTbR,GSayB,UTbzB,EAAA,OAAA,CAAA,EScU,OTdV,CSckB,WTdlB,CAAA,EAAA,GSciB,aTdjB;;;;;;;;AAPD;;mCUwBmC;;ATtBnC;;;;;AAcA;;;;ACXA;;;;;cQsCa,kBAAgB,SAAA,CAAA,QAI3B,SAAA,CAJ2B,MAAA"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../../../src/server/auth/constants/routes.ts","../../../src/server/auth/schemas/authenticationProviderSchema.ts","../../../src/server/auth/schemas/tokenResponseSchema.ts","../../../src/server/auth/schemas/tokensSchema.ts","../../../src/server/auth/schemas/userinfoResponseSchema.ts","../../../src/server/auth/providers/ServerAuthProvider.ts","../../../src/server/auth/primitives/$auth.ts","../../../src/server/auth/primitives/$authCredentials.ts","../../../src/server/auth/primitives/$authGithub.ts","../../../src/server/auth/primitives/$authGoogle.ts","../../../src/server/auth/index.ts"],"mappings":";;;;;;;;;;;;cAAa,sBAAA;EAAA,KAAA;EAAA,QAAA;EAAA,MAAA;EAAA,KAAA;EAAA,OAAA;EAAA,QAAA;AAAA;;;cCEA,4BAAA,YAA4B,OAAA;EAAA,IAAA,EAYxC,SAAA,CAAA,OAAA;EAAA,IAAA;;KAEW,sBAAA,GAAyB,MAAA,QAC5B,4BAAA;;;cCZI,mBAAA,YAAmB,OAAA;EAAA,QAAA,EAG9B,SAAA,CAAA,OAAA;EAAA,YAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAEU,aAAA,GAAgB,MAAA,QAAc,mBAAA;;;cCP7B,YAAA,YAAY,OAAA;EAAA,QAAA,EAevB,SAAA,CAAA,OAAA;EAAA,YAAA;;;;;;;;;KAEU,MAAA,GAAS,MAAA,QAAc,YAAA;;;cChBtB,sBAAA,YAAsB,OAAA;EAAA,IAAA;QAGjC,SAAA,CAAA,OAAA;IAAA,IAAA;;;;;;;;;;;;;;;;;;;;;;;;KAEU,gBAAA,GAAmB,MAAA,QAAc,sBAAA;;;cCqBhC,kBAAA;EAAA,mBAAA,GAAA,EAAkB,cAAA,CACP,MAAA;EAAA,mBAAA,MAAA,EACG,MAAA;EAAA,mBAAA,qBAAA,EACe,qBAAA;EAAA,mBAAA,gBAAA,EACL,gBAAA;EAAA,mBAAA,mBAAA,EACG,mBAAA;EAAA,mBAAA,iBAAA,EAEF,sBAAA,CAAA,uBAAA,WAAA,OAAA;IAAA,QAAA,EAFE,SAAA,CAAA,OAAA;IAAA,KAAA;;;;;;mBAgBhB,sBAAA,CAAA,uBAAA,WAAA,OAAA;IAAA,QAAA,EAdc,SAAA,CAAA,OAAA;IAAA,YAAA;;;;;;;;;oBAuBX,KAAA,CAAM,aAAA;EAAA,2BAAA,OAAA;IAAA,SAAA;EAAA,IAQ5B,sBAAA;EAAA,mBAAA,SAAA,EAAsB,SAAA,CAiCG,aAAA;EAAA,UAAA,gBAAA,MAAA,EASM,MAAA;EAAA;;;EAAA,mBAAA,SAAA,EAAM,SAAA,CAiBZ,aAAA;EAAA;;;;EAAA,UAAA,gBAAA,OAAA,EAqCjB,OAAA,GACR,OAAA,CAAQ,MAAA;EAAA,UAAA,cAAA,MAAA,EA8B2B,MAAA,GAAS,OAAA,CAAQ,MAAA;EAAA;;;EAAA,SAAA,QAAA,iBAiD/B,cAAA;IAAA,QAAA;;YAjD8B,SAAA,CAAA,OAAA;QAAA,IAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;mCAsF/B,cAAA;IAAA,KAAA;gBArCC,SAAA,CAAA,OAAA;IAAA;IAAA,IAAA;;;;;;;;;;;;;;;;;;;iCA4EH,cAAA;IAAA,KAAA;gBAvCE,SAAA,CAAA,OAAA;MAAA,KAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAoHF,cAAA;IAAA,KAAA;gBA7EA,SAAA,CAAA,OAAA;MAAA,KAAA;;;;;;;;qBAoKG,cAAA,CAAA,cAAA,CAvFH,cAAA,CAuFG,mBAAA;EAAA;;;EAAA,SAAA,MAAA,iBAmEF,cAAA;IAAA,KAAA;oDAnEE,SAAA,CAAA,OAAA;IAAA;EAAA;EAAA;;;;;EAAA,UAAA,SAAA,IAAA;IAAA,QAAA;IAAA,KAAA;EAAA,IAgJrB,aAAA;EAAA,UAAA,UAAA,OAAA,GAyB2B,OAAA,GAAU,MAAA;EAAA,UAAA,UAAA,MAAA,EAIZ,MAAA,EAAA,OAAA,GAAkB,OAAA;AAAA;AAAA,UAiB/B,aAAA;EAAA,GAAA;EAAA,KAAA;EAAA,IAAA;EAAA,UAAA;EAAA,WAAA;EAAA,WAAA;EAAA,QAAA;EAAA,kBAAA;EAAA,OAAA;EAAA,OAAA;EAAA,OAAA;EAAA,cAAA;EAAA,MAAA;EAAA,SAAA;EAAA,QAAA;EAAA,MAAA;EAAA,YAAA;EAAA,qBAAA;EAAA,OAAA;IAAA,SAAA;IAAA,cAAA;IAAA,QAAA;IAAA,MAAA;IAAA,WAAA;IAAA,OAAA;EAAA;EAAA,UAAA;EAAA,CAAA,GAAA;AAAA;;;;ACvmBjB;;;;;;AAMA;AAgBA;;;;;AA4BA;;;;;;AAqCA;AAIA;;;;;AAIA;AAKA;AA2CA;AAQA;;;;;AAEA;cAzJa,KAAA;EAAA,CAAA,OAAA,EAAkB,oBAAA,GAAuB,aAAA;EAAA;;KAM1C,oBAAA;EAAA;AAgBZ;;;EAhBY,IAAA;EAAA;AAgBZ;;EAhBY,QAAA;AAAA,KAWP,YAAA,GAAe,YAAA;AAAA;AAKpB;;AALoB,KAKR,YAAA;EAAA;;;EAAA,IAAA,EAIJ,WAAA;EAAA;;;;AAwBR;;;;;;AAqCA;AAIA;;EAjEQ,QAAA,SAeW,KAAA,CAAM,WAAA;AAAA;AAAA;;;AASzB;;;AATyB,KASb,YAAA;EAAA,MAAA,EACF,eAAA;AAAA;EAAA;;;;;AAoCV;AAIA;EAxCU,WAAA,EAUS,kBAAA;AAAA;EAAA;;;;AA0BnB;AAIA;;EA9BmB,KAAA,EAUN,aAAA;AAAA;EAAA;;;AAgBb;AAIA;;;;;EApBa,IAAA,EAYD,WAAA;AAAA;AAAA,KAIA,kBAAA;EAAA,OAAA,EACD,aAAA;AAAA;AAAA,KAGC,aAAA,IAAA,WAAA,EACG,WAAA,KACV,KAAA,CAAM,WAAA;AAAA,UAEM,WAAA;EAAA,QAAA;EAAA,QAAA;AAAA;AAAA,UAKA,WAAA;EAAA;AA2CjB;AAQA;EAnDiB,MAAA;EAAA;AA2CjB;AAQA;EAnDiB,QAAA;EAAA;AA2CjB;AAQA;;EAnDiB,YAAA;EAAA;AA2CjB;AAQA;;EAnDiB,WAAA;EAAA;AA2CjB;AAQA;;EAnDiB,UAAA;EAAA;AA2CjB;AAQA;EAnDiB,SAAA;EAAA;AA2CjB;AAQA;;EAnDiB,KAAA;EAAA,OAAA,GAwCL,aAAA;AAAA;AAAA,UAGK,kBAAA;EAAA,YAAA;EAAA,IAAA,EAET,aAAA;EAAA,QAAA;EAAA,UAAA;EAAA,KAAA;AAAA;AAAA,KAMI,aAAA,IAAA,MAAA,EAAyB,kBAAA,KAAuB,KAAA,CAAM,WAAA;AAAA,UAEjD,aAAA;EAAA;;;EAAA,QAAA;EAAA;;;EAAA,YAAA;EAAA;;;EAAA,aAAA;EAAA;;;EAAA,KAAA;EAAA;;;EAAA,QAAA,GAAA,MAAA,EAwBI,MAAA,KAAW,KAAA,CAAM,aAAA;EAAA,OAAA,GAE1B,aAAA;EAAA;;AAeZ;EAfY,WAAA;EAAA;;AAeZ;EAfY,KAAA;AAAA;AAAA,cAeC,aAAA,SAAsB,SAAA,CAAU,oBAAA;EAAA,mBAAA,gBAAA,EACR,gBAAA;EAAA,mBAAA,gBAAA,EACA,gBAAA;EAAA,KAAA,GAEpB,aAAA;EAAA,IAAA,KAAA;EAAA,IAAA,OAAA,GAMM,eAAA;EAAA,IAAA,SAAA;EAAA,IAAA,MAAA;EAAA,IAAA,aAAA;EAAA;;;;EAAA,QAAA,YAAA,UAAA,WAAA,YA8ClB,OAAA,CAAQ,mBAAA;EAAA;;;;EAAA,KAAA,MAAA,EAsCe,MAAA,GAAS,OAAA,CAAQ,WAAA;EAAA,UAAA,mBAAA,OAAA,WAyCI,aAAA;EAAA,QAAA,GAY3B,OAAA;AAAA;AAAA,KA8CV,WAAA;EAAA,KAAA,QAAsC,KAAA;AAAA;AAAA,UAEjC,UAAA;EAAA,IAAA,IAAA,IAAA,cAAA,IAAA,EACiB,kBAAA,KAAuB,KAAA,CAAM,WAAA;AAAA;AAAA,UAG9C,WAAA;EAAA,KAAA,IAAA,QAAA,cAAA,KAAA,EAGF,WAAA,KAAgB,KAAA,CAAM,WAAA;AAAA;;;;ACzbrC;;;;cAAa,gBAAA,GAAA,KAAA,EACJ,eAAA,GAAkB,WAAA,EAAA,OAAA,GAChB,OAAA,CAAQ,kBAAA,MAAD,aAAA;;;;ACIlB;;;;;;;;;cAAa,WAAA,GAAA,KAAA,EACJ,eAAA,GAAkB,UAAA,EAAA,OAAA,GAChB,OAAA,CAAQ,WAAA,MAAD,aAAA;;;;ACHlB;;;;;;;;;cAAa,WAAA,GAAA,KAAA,EACJ,eAAA,GAAkB,UAAA,EAAA,OAAA,GAChB,OAAA,CAAQ,WAAA,MAAD,aAAA;;;;;;ACRgC;;;;mCAWf,WAAA;EAAA;AAAA;AAAA;;;AAmBnC;;;;;;;;;;AAnBmC,cAmBtB,gBAAA,EAAgB,SAAA,CAAA,OAAA,CAI3B,SAAA,CAJ2B,MAAA"}

package/dist/server/auth/index.js

@@ -52,8 +52,8 @@ var AuthPrimitive = class extends Primitive {
 	get name() {
 		return this.options.name ?? this.config.propertyKey;
 	}
-	get realm() {
-		if ("realm" in this.options) return this.options.realm;
+	get issuer() {
+		if ("issuer" in this.options) return this.options.issuer;
 	}
 	get jwks_uri() {
 		const jwks = this.oauth?.serverMetadata().jwks_uri;
@@ -75,8 +75,8 @@ var AuthPrimitive = class extends Primitive {
 	* Can be used on oauth2, oidc or credentials auth providers.
 	*/
 	async refresh(refreshToken, accessToken) {
-		if ("realm" in this.options) return this.options.realm.refreshToken(refreshToken, accessToken).then((it) => it.tokens).catch((error) => {
-			throw new SecurityError("Failed to refresh access token using the refresh token (realm)", { cause: error });
+		if ("issuer" in this.options) return this.options.issuer.refreshToken(refreshToken, accessToken).then((it) => it.tokens).catch((error) => {
+			throw new SecurityError("Failed to refresh access token using the refresh token (issuer)", { cause: error });
 		});
 		else if (this.oauth) try {
 			return {
@@ -86,7 +86,7 @@ var AuthPrimitive = class extends Primitive {
 		} catch (error) {
 			throw new SecurityError("Failed to refresh access token using the refresh token (oauth2)", { cause: error });
 		}
-		throw new AlephaError("No realm or OAuth2 configuration available for refreshing the access token");
+		throw new AlephaError("No issuer or OAuth2 configuration available for refreshing the access token");
 	}
 	/**
 	* Extracts user information from the access token.
@@ -218,8 +218,8 @@ var ServerAuthProvider = class {
 		const providers = [];
 		for (const identity of this.identities) {
 			if (filters.realmName) {
-				const realm = "realm" in identity.options && identity.options.realm;
-				if (!realm || realm.name !== filters.realmName) continue;
+				const issuer = identity.issuer;
+				if (!issuer || issuer.name !== filters.realmName) continue;
 			}
 			const type = "oidc" in identity.options ? "OIDC" : "oauth" in identity.options ? "OAUTH2" : "credentials" in identity.options ? "CREDENTIALS" : void 0;
 			if (!type) continue;
@@ -257,7 +257,7 @@ var ServerAuthProvider = class {
 				}
 			}
 			if (!request.headers.authorization) {
-				for (const provider of this.identities) if (!("realm" in provider.options) && !!provider.options.fallback) {
+				for (const provider of this.identities) if ("fallback" in provider.options && !!provider.options.fallback) {
 					const token = await provider.options.fallback();
 					if (token) {
 						request.headers.authorization = `Bearer ${token}`;
@@ -392,8 +392,8 @@ var ServerAuthProvider = class {
 				provider: query.provider,
 				realm: query.realm
 			});
-			const realm = "realm" in provider.options && provider.options.realm;
-			if (!realm) throw new SecurityError(`Auth provider '${query.provider}' does not support password grant`);
+			const issuer = provider.issuer;
+			if (!issuer) throw new SecurityError(`Auth provider '${query.provider}' does not support password grant`);
 			const credentials = "credentials" in provider.options && provider.options.credentials;
 			if (!credentials) throw new SecurityError(`Auth provider '${query.provider}' does not support password grant`);
 			let user;
@@ -407,7 +407,7 @@ var ServerAuthProvider = class {
 			if (!user) throw new InvalidCredentialsError();
 			const tokens = {
 				provider: query.provider,
-				...await realm.createToken(user)
+				...await issuer.createToken(user)
 			};
 			this.setTokens(tokens, cookies);
 			const api = await this.serverLinksProvider.getUserApiLinks({ user });
@@ -500,14 +500,14 @@ var ServerAuthProvider = class {
 				throw new SecurityError("Failed to get access token", { cause: e });
 			});
 			this.authorizationCode.del({ cookies });
-			const realm = "realm" in provider.options && provider.options.realm;
-			if (!realm) {
+			const issuer = provider.issuer;
+			if (!issuer) {
 				this.setTokens(externalTokens, cookies);
 				reply.redirect(redirectUri);
 				return;
 			}
 			const user = await provider.user(externalTokens);
-			const tokens = await realm.createToken(user);
+			const tokens = await issuer.createToken(user);
 			this.setTokens({
 				...tokens,
 				issued_at: this.dateTimeProvider.now().unix(),
@@ -532,8 +532,8 @@ var ServerAuthProvider = class {
 			}
 			const provider = this.provider(tokens.provider);
 			this.tokens.del({ cookies });
-			if ("realm" in provider.options && tokens.refresh_token) {
-				const onDeleteSession = provider.options.realm.options.settings?.onDeleteSession;
+			if (provider.issuer && tokens.refresh_token) {
+				const onDeleteSession = provider.issuer.options.settings?.onDeleteSession;
 				if (onDeleteSession) try {
 					await onDeleteSession(tokens.refresh_token);
 				} catch (e) {
@@ -571,7 +571,7 @@ var ServerAuthProvider = class {
 		const realmName = typeof opts === "string" ? void 0 : opts.realm;
 		const identity = this.identities.find((identity$1) => {
 			if (identity$1.name !== name) return false;
-			if (realmName && identity$1.realm?.name !== realmName) return false;
+			if (realmName && identity$1.issuer?.name !== realmName) return false;
 			return true;
 		});
 		if (!identity) throw new SecurityError(`Auth provider '${name}'${realmName ? ` for realm '${realmName}'` : ""} not found`);
@@ -613,7 +613,7 @@ const $authCredentials = (realm, options = {}) => {
 	const account = realm.login ? realm.login(name) : options.account;
 	if (!account) throw new AlephaError("Credentials authentication requires a login function in the realm primitive.");
 	return $auth({
-		realm,
+		issuer: realm,
 		name,
 		credentials: { account }
 	});
@@ -642,7 +642,7 @@ const $authGithub = (realm, options = {}) => {
 	const account = options.account ?? (realm.link ? realm.link(name) : void 0);
 	if (!account) throw new AlephaError("Authentication requires a link function in the realm primitive.");
 	return $auth({
-		realm,
+		issuer: realm,
 		name,
 		oauth: {
 			clientId: env.GITHUB_CLIENT_ID,
@@ -702,7 +702,7 @@ const $authGoogle = (realm, options = {}) => {
 	const account = options.account ?? (realm.link ? realm.link(name) : void 0);
 	if (!account) throw new AlephaError("Authentication requires a link function in the realm primitive.");
 	return $auth({
-		realm,
+		issuer: realm,
 		name,
 		oidc: {
 			issuer: "https://accounts.google.com",