alepha 0.20.5 → 0.20.7

package/dist/server/auth/index.d.ts

@@ -8,6 +8,7 @@ import * as _$alepha_logger0 from "alepha/logger";
 import * as _$alepha_server0 from "alepha/server";
 import { ServerRawRequest, ServerReply } from "alepha/server";
 import { ServerLinksProvider } from "alepha/server/links";
+import * as _$typebox from "typebox";
 
 //#region ../../src/server/auth/constants/routes.d.ts
 declare const alephaServerAuthRoutes: {
@@ -20,85 +21,85 @@ declare const alephaServerAuthRoutes: {
 };
 //#endregion
 //#region ../../src/server/auth/schemas/authenticationProviderSchema.d.ts
-declare const authenticationProviderSchema: _$alepha.TObject<{
-  name: _$alepha.TString;
-  type: _$alepha.TUnsafe<"OAUTH2" | "OIDC" | "CREDENTIALS">;
+declare const authenticationProviderSchema: _$typebox.TObject<{
+  name: _$typebox.TString;
+  type: _$typebox.TUnsafe<"OAUTH2" | "OIDC" | "CREDENTIALS">;
 }>;
 type AuthenticationProvider = Static<typeof authenticationProviderSchema>;
 //#endregion
 //#region ../../src/server/auth/schemas/tokenResponseSchema.d.ts
-declare const tokenResponseSchema: _$alepha.TObject<{
-  provider: _$alepha.TString;
-  access_token: _$alepha.TString;
-  issued_at: _$alepha.TNumber;
-  expires_in: _$alepha.TOptional<_$alepha.TNumber>;
-  refresh_token: _$alepha.TOptional<_$alepha.TString>;
-  refresh_token_expires_in: _$alepha.TOptional<_$alepha.TNumber>;
-  refresh_expires_in: _$alepha.TOptional<_$alepha.TNumber>;
-  id_token: _$alepha.TOptional<_$alepha.TString>;
-  scope: _$alepha.TOptional<_$alepha.TString>;
-  user: _$alepha.TObject<{
-    id: _$alepha.TString;
-    name: _$alepha.TOptional<_$alepha.TString>;
-    email: _$alepha.TOptional<_$alepha.TString>;
-    username: _$alepha.TOptional<_$alepha.TString>;
-    picture: _$alepha.TOptional<_$alepha.TString>;
-    sessionId: _$alepha.TOptional<_$alepha.TString>;
-    organization: _$alepha.TOptional<_$alepha.TString>;
-    roles: _$alepha.TOptional<_$alepha.TArray<_$alepha.TString>>;
-    realm: _$alepha.TOptional<_$alepha.TString>;
+declare const tokenResponseSchema: _$typebox.TObject<{
+  provider: _$typebox.TString;
+  access_token: _$typebox.TString;
+  issued_at: _$typebox.TNumber;
+  expires_in: _$typebox.TOptional<_$typebox.TNumber>;
+  refresh_token: _$typebox.TOptional<_$typebox.TString>;
+  refresh_token_expires_in: _$typebox.TOptional<_$typebox.TNumber>;
+  refresh_expires_in: _$typebox.TOptional<_$typebox.TNumber>;
+  id_token: _$typebox.TOptional<_$typebox.TString>;
+  scope: _$typebox.TOptional<_$typebox.TString>;
+  user: _$typebox.TObject<{
+    id: _$typebox.TString;
+    name: _$typebox.TOptional<_$typebox.TString>;
+    email: _$typebox.TOptional<_$typebox.TString>;
+    username: _$typebox.TOptional<_$typebox.TString>;
+    picture: _$typebox.TOptional<_$typebox.TString>;
+    sessionId: _$typebox.TOptional<_$typebox.TString>;
+    organization: _$typebox.TOptional<_$typebox.TString>;
+    roles: _$typebox.TOptional<_$typebox.TArray<_$typebox.TString>>;
+    realm: _$typebox.TOptional<_$typebox.TString>;
   }>;
-  api: _$alepha.TObject<{
-    prefix: _$alepha.TOptional<_$alepha.TString>;
-    actions: _$alepha.TRecord<"^.*$", _$alepha.TObject<{
-      path: _$alepha.TString;
-      method: _$alepha.TOptional<_$alepha.TString>;
-      contentType: _$alepha.TOptional<_$alepha.TString>;
-      kind: _$alepha.TOptional<_$alepha.TString>;
-      service: _$alepha.TOptional<_$alepha.TString>;
+  api: _$typebox.TObject<{
+    prefix: _$typebox.TOptional<_$typebox.TString>;
+    actions: _$typebox.TRecord<"^.*$", _$typebox.TObject<{
+      path: _$typebox.TString;
+      method: _$typebox.TOptional<_$typebox.TString>;
+      contentType: _$typebox.TOptional<_$typebox.TString>;
+      kind: _$typebox.TOptional<_$typebox.TString>;
+      service: _$typebox.TOptional<_$typebox.TString>;
     }>>;
-    permissions: _$alepha.TOptional<_$alepha.TArray<_$alepha.TString>>;
+    permissions: _$typebox.TOptional<_$typebox.TArray<_$typebox.TString>>;
   }>;
 }>;
 type TokenResponse = Static<typeof tokenResponseSchema>;
 //#endregion
 //#region ../../src/server/auth/schemas/tokensSchema.d.ts
-declare const tokensSchema: _$alepha.TObject<{
-  provider: _$alepha.TString;
-  access_token: _$alepha.TString;
-  issued_at: _$alepha.TNumber;
-  expires_in: _$alepha.TOptional<_$alepha.TNumber>;
-  refresh_token: _$alepha.TOptional<_$alepha.TString>;
-  refresh_token_expires_in: _$alepha.TOptional<_$alepha.TNumber>;
-  refresh_expires_in: _$alepha.TOptional<_$alepha.TNumber>;
-  id_token: _$alepha.TOptional<_$alepha.TString>;
-  scope: _$alepha.TOptional<_$alepha.TString>;
+declare const tokensSchema: _$typebox.TObject<{
+  provider: _$typebox.TString;
+  access_token: _$typebox.TString;
+  issued_at: _$typebox.TNumber;
+  expires_in: _$typebox.TOptional<_$typebox.TNumber>;
+  refresh_token: _$typebox.TOptional<_$typebox.TString>;
+  refresh_token_expires_in: _$typebox.TOptional<_$typebox.TNumber>;
+  refresh_expires_in: _$typebox.TOptional<_$typebox.TNumber>;
+  id_token: _$typebox.TOptional<_$typebox.TString>;
+  scope: _$typebox.TOptional<_$typebox.TString>;
 }>;
 type Tokens = Static<typeof tokensSchema>;
 //#endregion
 //#region ../../src/server/auth/schemas/userinfoResponseSchema.d.ts
-declare const userinfoResponseSchema: _$alepha.TObject<{
-  user: _$alepha.TOptional<_$alepha.TObject<{
-    id: _$alepha.TString;
-    name: _$alepha.TOptional<_$alepha.TString>;
-    email: _$alepha.TOptional<_$alepha.TString>;
-    username: _$alepha.TOptional<_$alepha.TString>;
-    picture: _$alepha.TOptional<_$alepha.TString>;
-    sessionId: _$alepha.TOptional<_$alepha.TString>;
-    organization: _$alepha.TOptional<_$alepha.TString>;
-    roles: _$alepha.TOptional<_$alepha.TArray<_$alepha.TString>>;
-    realm: _$alepha.TOptional<_$alepha.TString>;
+declare const userinfoResponseSchema: _$typebox.TObject<{
+  user: _$typebox.TOptional<_$typebox.TObject<{
+    id: _$typebox.TString;
+    name: _$typebox.TOptional<_$typebox.TString>;
+    email: _$typebox.TOptional<_$typebox.TString>;
+    username: _$typebox.TOptional<_$typebox.TString>;
+    picture: _$typebox.TOptional<_$typebox.TString>;
+    sessionId: _$typebox.TOptional<_$typebox.TString>;
+    organization: _$typebox.TOptional<_$typebox.TString>;
+    roles: _$typebox.TOptional<_$typebox.TArray<_$typebox.TString>>;
+    realm: _$typebox.TOptional<_$typebox.TString>;
   }>>;
-  api: _$alepha.TObject<{
-    prefix: _$alepha.TOptional<_$alepha.TString>;
-    actions: _$alepha.TRecord<"^.*$", _$alepha.TObject<{
-      path: _$alepha.TString;
-      method: _$alepha.TOptional<_$alepha.TString>;
-      contentType: _$alepha.TOptional<_$alepha.TString>;
-      kind: _$alepha.TOptional<_$alepha.TString>;
-      service: _$alepha.TOptional<_$alepha.TString>;
+  api: _$typebox.TObject<{
+    prefix: _$typebox.TOptional<_$typebox.TString>;
+    actions: _$typebox.TRecord<"^.*$", _$typebox.TObject<{
+      path: _$typebox.TString;
+      method: _$typebox.TOptional<_$typebox.TString>;
+      contentType: _$typebox.TOptional<_$typebox.TString>;
+      kind: _$typebox.TOptional<_$typebox.TString>;
+      service: _$typebox.TOptional<_$typebox.TString>;
     }>>;
-    permissions: _$alepha.TOptional<_$alepha.TArray<_$alepha.TString>>;
+    permissions: _$typebox.TOptional<_$typebox.TArray<_$typebox.TString>>;
   }>;
 }>;
 type UserinfoResponse = Static<typeof userinfoResponseSchema>;
@@ -1165,30 +1166,34 @@ declare class ServerAuthProvider {
   protected readonly dateTimeProvider: DateTimeProvider;
   protected readonly serverLinksProvider: ServerLinksProvider;
   /**
-   * Validates that a redirect URI is a safe relative path.
-   * Prevents open redirect attacks by rejecting absolute URLs and protocol-relative URLs.
+   * Validates that a redirect URI is a safe relative path, or — when
+   * COOKIE_PARENT_DOMAIN is configured — an https URL whose host is the
+   * parent domain or a subdomain of it. Used by SaaS deployments where the
+   * OAuth callback dispatches users back to their tenant subdomain.
+   *
+   * Prevents open redirect attacks by rejecting any other absolute URL.
    */
   protected validateRedirectUri(uri: string): string;
   get identities(): Array<AuthPrimitive>;
-  protected readonly authorizationCode: _$alepha_server_cookies0.AbstractCookiePrimitive<_$alepha.TObject<{
-    provider: _$alepha.TString;
-    realm: _$alepha.TOptional<_$alepha.TString>;
-    codeVerifier: _$alepha.TOptional<_$alepha.TString>;
-    redirectUri: _$alepha.TOptional<_$alepha.TString>;
-    loginUri: _$alepha.TOptional<_$alepha.TString>;
-    state: _$alepha.TOptional<_$alepha.TString>;
-    nonce: _$alepha.TOptional<_$alepha.TString>;
+  protected readonly authorizationCode: _$alepha_server_cookies0.AbstractCookiePrimitive<_$typebox.TObject<{
+    provider: _$typebox.TString;
+    realm: _$typebox.TOptional<_$typebox.TString>;
+    codeVerifier: _$typebox.TOptional<_$typebox.TString>;
+    redirectUri: _$typebox.TOptional<_$typebox.TString>;
+    loginUri: _$typebox.TOptional<_$typebox.TString>;
+    state: _$typebox.TOptional<_$typebox.TString>;
+    nonce: _$typebox.TOptional<_$typebox.TString>;
   }>>;
-  readonly tokens: _$alepha_server_cookies0.AbstractCookiePrimitive<_$alepha.TObject<{
-    provider: _$alepha.TString;
-    access_token: _$alepha.TString;
-    issued_at: _$alepha.TNumber;
-    expires_in: _$alepha.TOptional<_$alepha.TNumber>;
-    refresh_token: _$alepha.TOptional<_$alepha.TString>;
-    refresh_token_expires_in: _$alepha.TOptional<_$alepha.TNumber>;
-    refresh_expires_in: _$alepha.TOptional<_$alepha.TNumber>;
-    id_token: _$alepha.TOptional<_$alepha.TString>;
-    scope: _$alepha.TOptional<_$alepha.TString>;
+  readonly tokens: _$alepha_server_cookies0.AbstractCookiePrimitive<_$typebox.TObject<{
+    provider: _$typebox.TString;
+    access_token: _$typebox.TString;
+    issued_at: _$typebox.TNumber;
+    expires_in: _$typebox.TOptional<_$typebox.TNumber>;
+    refresh_token: _$typebox.TOptional<_$typebox.TString>;
+    refresh_token_expires_in: _$typebox.TOptional<_$typebox.TNumber>;
+    refresh_expires_in: _$typebox.TOptional<_$typebox.TNumber>;
+    id_token: _$typebox.TOptional<_$typebox.TString>;
+    scope: _$typebox.TOptional<_$typebox.TString>;
   }>>;
   protected readonly configure: _$alepha.HookPrimitive<"configure">;
   /**
@@ -1199,28 +1204,28 @@ declare class ServerAuthProvider {
    * Get user information.
    */
   readonly userinfo: _$alepha_server0.RoutePrimitive<{
-    response: _$alepha.TObject<{
-      user: _$alepha.TOptional<_$alepha.TObject<{
-        id: _$alepha.TString;
-        name: _$alepha.TOptional<_$alepha.TString>;
-        email: _$alepha.TOptional<_$alepha.TString>;
-        username: _$alepha.TOptional<_$alepha.TString>;
-        picture: _$alepha.TOptional<_$alepha.TString>;
-        sessionId: _$alepha.TOptional<_$alepha.TString>;
-        organization: _$alepha.TOptional<_$alepha.TString>;
-        roles: _$alepha.TOptional<_$alepha.TArray<_$alepha.TString>>;
-        realm: _$alepha.TOptional<_$alepha.TString>;
+    response: _$typebox.TObject<{
+      user: _$typebox.TOptional<_$typebox.TObject<{
+        id: _$typebox.TString;
+        name: _$typebox.TOptional<_$typebox.TString>;
+        email: _$typebox.TOptional<_$typebox.TString>;
+        username: _$typebox.TOptional<_$typebox.TString>;
+        picture: _$typebox.TOptional<_$typebox.TString>;
+        sessionId: _$typebox.TOptional<_$typebox.TString>;
+        organization: _$typebox.TOptional<_$typebox.TString>;
+        roles: _$typebox.TOptional<_$typebox.TArray<_$typebox.TString>>;
+        realm: _$typebox.TOptional<_$typebox.TString>;
       }>>;
-      api: _$alepha.TObject<{
-        prefix: _$alepha.TOptional<_$alepha.TString>;
-        actions: _$alepha.TRecord<"^.*$", _$alepha.TObject<{
-          path: _$alepha.TString;
-          method: _$alepha.TOptional<_$alepha.TString>;
-          contentType: _$alepha.TOptional<_$alepha.TString>;
-          kind: _$alepha.TOptional<_$alepha.TString>;
-          service: _$alepha.TOptional<_$alepha.TString>;
+      api: _$typebox.TObject<{
+        prefix: _$typebox.TOptional<_$typebox.TString>;
+        actions: _$typebox.TRecord<"^.*$", _$typebox.TObject<{
+          path: _$typebox.TString;
+          method: _$typebox.TOptional<_$typebox.TString>;
+          contentType: _$typebox.TOptional<_$typebox.TString>;
+          kind: _$typebox.TOptional<_$typebox.TString>;
+          service: _$typebox.TOptional<_$typebox.TString>;
         }>>;
-        permissions: _$alepha.TOptional<_$alepha.TArray<_$alepha.TString>>;
+        permissions: _$typebox.TOptional<_$typebox.TArray<_$typebox.TString>>;
       }>;
     }>;
   }>;
@@ -1228,68 +1233,68 @@ declare class ServerAuthProvider {
    * Refresh a token for internal providers.
    */
   readonly refresh: _$alepha_server0.RoutePrimitive<{
-    query: _$alepha.TObject<{
-      provider: _$alepha.TString;
+    query: _$typebox.TObject<{
+      provider: _$typebox.TString;
     }>;
-    body: _$alepha.TObject<{
-      refresh_token: _$alepha.TString;
-      access_token: _$alepha.TOptional<_$alepha.TString>;
+    body: _$typebox.TObject<{
+      refresh_token: _$typebox.TString;
+      access_token: _$typebox.TOptional<_$typebox.TString>;
     }>;
-    response: _$alepha.TObject<{
-      provider: _$alepha.TString;
-      access_token: _$alepha.TString;
-      issued_at: _$alepha.TNumber;
-      expires_in: _$alepha.TOptional<_$alepha.TNumber>;
-      refresh_token: _$alepha.TOptional<_$alepha.TString>;
-      refresh_token_expires_in: _$alepha.TOptional<_$alepha.TNumber>;
-      refresh_expires_in: _$alepha.TOptional<_$alepha.TNumber>;
-      id_token: _$alepha.TOptional<_$alepha.TString>;
-      scope: _$alepha.TOptional<_$alepha.TString>;
+    response: _$typebox.TObject<{
+      provider: _$typebox.TString;
+      access_token: _$typebox.TString;
+      issued_at: _$typebox.TNumber;
+      expires_in: _$typebox.TOptional<_$typebox.TNumber>;
+      refresh_token: _$typebox.TOptional<_$typebox.TString>;
+      refresh_token_expires_in: _$typebox.TOptional<_$typebox.TNumber>;
+      refresh_expires_in: _$typebox.TOptional<_$typebox.TNumber>;
+      id_token: _$typebox.TOptional<_$typebox.TString>;
+      scope: _$typebox.TOptional<_$typebox.TString>;
     }>;
   }>;
   /**
    * Login for local password-based authentication.
    */
   readonly token: _$alepha_server0.RoutePrimitive<{
-    query: _$alepha.TObject<{
-      provider: _$alepha.TString;
-      realm: _$alepha.TOptional<_$alepha.TString>;
+    query: _$typebox.TObject<{
+      provider: _$typebox.TString;
+      realm: _$typebox.TOptional<_$typebox.TString>;
     }>;
-    body: _$alepha.TObject<{
-      username: _$alepha.TString;
-      password: _$alepha.TString;
+    body: _$typebox.TObject<{
+      username: _$typebox.TString;
+      password: _$typebox.TString;
     }>;
-    response: _$alepha.TObject<{
-      provider: _$alepha.TString;
-      access_token: _$alepha.TString;
-      issued_at: _$alepha.TNumber;
-      expires_in: _$alepha.TOptional<_$alepha.TNumber>;
-      refresh_token: _$alepha.TOptional<_$alepha.TString>;
-      refresh_token_expires_in: _$alepha.TOptional<_$alepha.TNumber>;
-      refresh_expires_in: _$alepha.TOptional<_$alepha.TNumber>;
-      id_token: _$alepha.TOptional<_$alepha.TString>;
-      scope: _$alepha.TOptional<_$alepha.TString>;
-      user: _$alepha.TObject<{
-        id: _$alepha.TString;
-        name: _$alepha.TOptional<_$alepha.TString>;
-        email: _$alepha.TOptional<_$alepha.TString>;
-        username: _$alepha.TOptional<_$alepha.TString>;
-        picture: _$alepha.TOptional<_$alepha.TString>;
-        sessionId: _$alepha.TOptional<_$alepha.TString>;
-        organization: _$alepha.TOptional<_$alepha.TString>;
-        roles: _$alepha.TOptional<_$alepha.TArray<_$alepha.TString>>;
-        realm: _$alepha.TOptional<_$alepha.TString>;
+    response: _$typebox.TObject<{
+      provider: _$typebox.TString;
+      access_token: _$typebox.TString;
+      issued_at: _$typebox.TNumber;
+      expires_in: _$typebox.TOptional<_$typebox.TNumber>;
+      refresh_token: _$typebox.TOptional<_$typebox.TString>;
+      refresh_token_expires_in: _$typebox.TOptional<_$typebox.TNumber>;
+      refresh_expires_in: _$typebox.TOptional<_$typebox.TNumber>;
+      id_token: _$typebox.TOptional<_$typebox.TString>;
+      scope: _$typebox.TOptional<_$typebox.TString>;
+      user: _$typebox.TObject<{
+        id: _$typebox.TString;
+        name: _$typebox.TOptional<_$typebox.TString>;
+        email: _$typebox.TOptional<_$typebox.TString>;
+        username: _$typebox.TOptional<_$typebox.TString>;
+        picture: _$typebox.TOptional<_$typebox.TString>;
+        sessionId: _$typebox.TOptional<_$typebox.TString>;
+        organization: _$typebox.TOptional<_$typebox.TString>;
+        roles: _$typebox.TOptional<_$typebox.TArray<_$typebox.TString>>;
+        realm: _$typebox.TOptional<_$typebox.TString>;
       }>;
-      api: _$alepha.TObject<{
-        prefix: _$alepha.TOptional<_$alepha.TString>;
-        actions: _$alepha.TRecord<"^.*$", _$alepha.TObject<{
-          path: _$alepha.TString;
-          method: _$alepha.TOptional<_$alepha.TString>;
-          contentType: _$alepha.TOptional<_$alepha.TString>;
-          kind: _$alepha.TOptional<_$alepha.TString>;
-          service: _$alepha.TOptional<_$alepha.TString>;
+      api: _$typebox.TObject<{
+        prefix: _$typebox.TOptional<_$typebox.TString>;
+        actions: _$typebox.TRecord<"^.*$", _$typebox.TObject<{
+          path: _$typebox.TString;
+          method: _$typebox.TOptional<_$typebox.TString>;
+          contentType: _$typebox.TOptional<_$typebox.TString>;
+          kind: _$typebox.TOptional<_$typebox.TString>;
+          service: _$typebox.TOptional<_$typebox.TString>;
         }>>;
-        permissions: _$alepha.TOptional<_$alepha.TArray<_$alepha.TString>>;
+        permissions: _$typebox.TOptional<_$typebox.TArray<_$typebox.TString>>;
       }>;
     }>;
   }>;
@@ -1297,10 +1302,10 @@ declare class ServerAuthProvider {
    * Oauth2/OIDC login route.
    */
   readonly login: _$alepha_server0.RoutePrimitive<{
-    query: _$alepha.TObject<{
-      provider: _$alepha.TString;
-      realm: _$alepha.TOptional<_$alepha.TString>;
-      redirect_uri: _$alepha.TOptional<_$alepha.TString>;
+    query: _$typebox.TObject<{
+      provider: _$typebox.TString;
+      realm: _$typebox.TOptional<_$typebox.TString>;
+      redirect_uri: _$typebox.TOptional<_$typebox.TString>;
     }>;
   }>;
   /**
@@ -1330,8 +1335,8 @@ declare class ServerAuthProvider {
    * Logout route for OAuth2/OIDC providers.
    */
   readonly logout: _$alepha_server0.RoutePrimitive<{
-    query: _$alepha.TObject<{
-      post_logout_redirect_uri: _$alepha.TOptional<_$alepha.TString>;
+    query: _$typebox.TObject<{
+      post_logout_redirect_uri: _$typebox.TOptional<_$typebox.TString>;
     }>;
   }>;
   getAuthenticationProviders(filters?: {

package/dist/server/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":["CryptoKey","crypto","subtle","generateKey","ReturnType","Awaited","Extract","type","CryptoKeyPair","privateKey","publicKey","JsonObject","JsonValue","Key","JsonArray","JsonPrimitive","ModifyAssertionFunction","Record","header","payload","PrivateKey","key","kid","JWSAlgorithm","JWK","kty","alg","use","key_ops","e","n","crv","x","y","pub","parameter","allowInsecureRequests","clockSkew","clockTolerance","customFetch","modifyAssertion","jweDecrypt","jwksCache","AuthorizationServer","MTLSEndpointAliases","issuer","authorization_endpoint","token_endpoint","jwks_uri","registration_endpoint","scopes_supported","response_types_supported","response_modes_supported","grant_types_supported","token_endpoint_auth_methods_supported","token_endpoint_auth_signing_alg_values_supported","service_documentation","ui_locales_supported","op_policy_uri","op_tos_uri","revocation_endpoint","revocation_endpoint_auth_methods_supported","revocation_endpoint_auth_signing_alg_values_supported","introspection_endpoint","introspection_endpoint_auth_methods_supported","introspection_endpoint_auth_signing_alg_values_supported","code_challenge_methods_supported","signed_metadata","device_authorization_endpoint","tls_client_certificate_bound_access_tokens","mtls_endpoint_aliases","userinfo_endpoint","acr_values_supported","subject_types_supported","id_token_signing_alg_values_supported","id_token_encryption_alg_values_supported","id_token_encryption_enc_values_supported","userinfo_signing_alg_values_supported","userinfo_encryption_alg_values_supported","userinfo_encryption_enc_values_supported","request_object_signing_alg_values_supported","request_object_encryption_alg_values_supported","request_object_encryption_enc_values_supported","display_values_supported","claim_types_supported","claims_supported","claims_locales_supported","claims_parameter_supported","request_parameter_supported","request_uri_parameter_supported","require_request_uri_registration","require_signed_request_object","pushed_authorization_request_endpoint","require_pushed_authorization_requests","introspection_signing_alg_values_supported","introspection_encryption_alg_values_supported","introspection_encryption_enc_values_supported","authorization_response_iss_parameter_supported","authorization_signing_alg_values_supported","authorization_encryption_alg_values_supported","authorization_encryption_enc_values_supported","backchannel_authentication_endpoint","backchannel_authentication_request_signing_alg_values_supported","backchannel_token_delivery_modes_supported","backchannel_user_code_parameter_supported","check_session_iframe","dpop_signing_alg_values_supported","end_session_endpoint","frontchannel_logout_session_supported","frontchannel_logout_supported","backchannel_logout_session_supported","backchannel_logout_supported","protected_resources","metadata","Pick","Client","client_id","id_token_signed_response_alg","authorization_signed_response_alg","require_auth_time","userinfo_signed_response_alg","introspection_signed_response_alg","default_max_age","use_mtls_endpoint_aliases","UnsupportedOperationError","Error","code","constructor","message","cause","options","OperationProcessingError","JWKSCacheOptions","JWKSCacheInput","CustomFetchOptions","Method","BodyType","AbortSignal","body","headers","method","redirect","signal","HttpRequestOptions","Headers","Response","Promise","url","DiscoveryRequestOptions","algorithm","discoveryRequest","URL","issuerIdentifier","processDiscoveryResponse","expectedIssuerIdentifier","response","generateRandomCodeVerifier","generateRandomState","generateRandomNonce","calculatePKCECodeChallenge","codeVerifier","DPoPRequestOptions","DPoPHandle","DPoP","PushedAuthorizationRequestOptions","URLSearchParams","ClientAuth","as","client","ClientSecretPost","clientSecret","ClientSecretBasic","ModifyAssertionOptions","PrivateKeyJwt","clientPrivateKey","ClientSecretJwt","None","TlsClientAuth","issueRequestObject","parameters","checkProtocol","enforceHttps","pushedAuthorizationRequest","clientAuthentication","calculateThumbprint","isDPoPNonceError","err","keyPair","PushedAuthorizationResponse","request_uri","expires_in","OAuth2Error","error","error_description","error_uri","algs","scope","ResponseBodyError","RESPONSE_BODY_ERROR","status","AuthorizationResponseError","AUTHORIZATION_RESPONSE_ERROR","WWWAuthenticateChallengeError","WWWAuthenticateChallenge","WWW_AUTHENTICATE_CHALLENGE","WWWAuthenticateChallengeParameters","Lowercase","realm","resource_metadata","scheme","token68","processPushedAuthorizationResponse","ProtectedResourceRequestBody","ArrayBuffer","ReadableStream","Uint8Array","ProtectedResourceRequestOptions","Omit","protectedResourceRequest","accessToken","UserInfoRequestOptions","userInfoRequest","UserInfoAddress","formatted","street_address","locality","region","postal_code","country","claim","UserInfoResponse","sub","name","given_name","family_name","middle_name","nickname","preferred_username","profile","picture","website","email","email_verified","gender","birthdate","zoneinfo","locale","phone_number","updated_at","address","ExportedJWKSCache","JWKS","jwks","uat","skipSubjectCheck","JWEDecryptOptions","JweDecryptFunction","RecognizedTokenTypes","TokenEndpointResponse","res","ProcessTokenResponseOptions","recognizedTokenTypes","processUserInfoResponse","expectedSubject","TokenEndpointRequestOptions","additionalParameters","refreshTokenGrantRequest","refreshToken","getValidatedIdTokenClaims","IDToken","ref","ValidateSignatureOptions","validateApplicationLevelSignature","processRefreshTokenResponse","nopkce","authorizationCodeGrantRequest","callbackParameters","redirectUri","JWTPayload","ConfirmationClaims","iss","aud","jti","nbf","exp","iat","cnf","nonce","auth_time","azp","AuthorizationDetails","locations","actions","datatypes","privileges","identifier","access_token","id_token","refresh_token","authorization_details","token_type","expectNoNonce","skipAuthTimeCheck","ProcessAuthorizationCodeResponseOptions","expectedNonce","maxAge","requireIdToken","processAuthorizationCodeResponse","UNSUPPORTED_OPERATION","JWT_USERINFO_EXPECTED","PARSE_ERROR","INVALID_RESPONSE","INVALID_REQUEST","RESPONSE_IS_NOT_JSON","RESPONSE_IS_NOT_CONFORM","HTTP_REQUEST_FORBIDDEN","REQUEST_PROTOCOL_FORBIDDEN","JWT_TIMESTAMP_CHECK","JWT_CLAIM_COMPARISON","JSON_ATTRIBUTE_COMPARISON","KEY_SELECTION","MISSING_SERVER_METADATA","INVALID_SERVER_METADATA","ClientCredentialsGrantRequestOptions","clientCredentialsGrantRequest","genericTokenEndpointRequest","grantType","processGenericTokenEndpointResponse","processClientCredentialsResponse","RevocationRequestOptions","revocationRequest","token","processRevocationResponse","IntrospectionRequestOptions","requestJwtResponse","introspectionRequest","jkt","IntrospectionResponse","active","sid","username","processIntrospectionResponse","keys","jwe","validateJwtAuthResponse","expectNoState","skipStateCheck","expectedState","validateDetachedSignatureResponse","Request","validateCodeIdTokenResponse","validateAuthResponse","DeviceAuthorizationRequestOptions","deviceAuthorizationRequest","DeviceAuthorizationResponse","device_code","user_code","verification_uri","verification_uri_complete","interval","processDeviceAuthorizationResponse","deviceCodeGrantRequest","deviceCode","processDeviceCodeResponse","GenerateKeyPairOptions","extractable","modulusLength","generateKeyPair","JWTAccessTokenClaims","ValidateJWTAccessTokenOptions","requireDPoP","signingAlgorithms","validateJwtAccessToken","request","expectedAudience","BackchannelAuthenticationRequestOptions","backchannelAuthenticationRequest","BackchannelAuthenticationResponse","auth_req_id","processBackchannelAuthenticationResponse","backchannelAuthenticationGrantRequest","authReqId","processBackchannelAuthenticationGrantResponse","OmitSymbolProperties","T","K","DynamicClientRegistrationRequestOptions","initialAccessToken","dynamicClientRegistrationRequest","Partial","processDynamicClientRegistrationResponse","ResourceServer","resource","authorization_servers","bearer_methods_supported","resource_signing_alg_values_supported","resource_name","resource_documentation","resource_policy_uri","resource_tos_uri","authorization_details_types_supported","dpop_bound_access_tokens_required","resourceDiscoveryRequest","resourceIdentifier","processResourceDiscoveryResponse","expectedResourceIdentifier","oauth","CryptoKey","crypto","subtle","generateKey","ReturnType","Awaited","Extract","type","CryptoKeyPair","privateKey","publicKey","AuthorizationResponseError","ResponseBodyError","WWWAuthenticateChallengeError","AuthorizationDetails","BackchannelAuthenticationResponse","ConfirmationClaims","DeviceAuthorizationResponse","OmitSymbolProperties","ExportedJWKSCache","GenerateKeyPairOptions","IDToken","IntrospectionResponse","JsonArray","JsonObject","JsonPrimitive","JsonValue","JWK","JWKS","JWSAlgorithm","ModifyAssertionFunction","ModifyAssertionOptions","MTLSEndpointAliases","PrivateKey","TokenEndpointResponse","UserInfoAddress","UserInfoResponse","WWWAuthenticateChallenge","WWWAuthenticateChallengeParameters","ClientAuth","ServerMetadata","ClientMetadata","URLSearchParams","Headers","as","client","body","headers","ClientSecretPost","clientSecret","ClientSecretBasic","ClientSecretJwt","options","None","PrivateKeyJwt","clientPrivateKey","TlsClientAuth","skipStateCheck","skipSubjectCheck","customFetch","modifyAssertion","clockSkew","clockTolerance","FetchBody","ArrayBuffer","ReadableStream","Uint8Array","DPoPHandle","Client","client_secret","use_mtls_endpoint_aliases","AuthorizationServer","calculatePKCECodeChallenge","Promise","codeVerifier","randomPKCECodeVerifier","randomNonce","randomState","ClientError","Error","code","randomDPoPKeyPair","alg","DiscoveryRequestOptions","CustomFetch","Configuration","Array","algorithm","execute","config","timeout","DynamicClientRegistrationRequestOptions","DPoPOptions","initialAccessToken","dynamicClientRegistration","URL","Partial","server","metadata","clientAuthentication","discovery","clientId","DecryptionKey","key","kid","enableDecryptingResponses","contentEncryptionAlgorithms","keys","ServerMetadataHelpers","supportsPKCE","method","ConfigurationMethods","Readonly","serverMetadata","clientMetadata","CustomFetchOptions","Record","AbortSignal","redirect","signal","Response","url","ConfigurationProperties","constructor","value","TokenEndpointResponseHelpers","claims","expiresIn","getDPoPHandle","keyPair","DeviceAuthorizationGrantPollOptions","pollDeviceAuthorizationGrant","deviceAuthorizationResponse","parameters","initiateDeviceAuthorization","initiateBackchannelAuthentication","BackchannelAuthenticationGrantPollOptions","pollBackchannelAuthenticationGrant","backchannelAuthenticationResponse","AuthorizationCodeGrantOptions","allowInsecureRequests","setJwksCache","jwksCache","getJwksCache","enableNonRepudiationChecks","useJwtResponseMode","enableDetachedSignatureResponseChecks","ImplicitAuthenticationResponseChecks","AuthorizationCodeGrantChecks","Pick","implicitAuthentication","Request","currentUrl","expectedNonce","checks","useCodeIdTokenResponseType","useIdTokenResponseType","expectedState","idTokenExpected","maxAge","pkceCodeVerifier","authorizationCodeGrant","tokenEndpointParameters","refreshTokenGrant","refreshToken","clientCredentialsGrant","buildAuthorizationUrl","buildAuthorizationUrlWithJAR","signingKey","buildAuthorizationUrlWithPAR","buildEndSessionUrl","fetchUserInfo","accessToken","expectedSubject","tokenIntrospection","token","DPoP","genericGrantRequest","grantType","tokenRevocation","fetchProtectedResource","DeviceAutorizationGrantPollOptions"],"sources":["../../../src/server/auth/constants/routes.ts","../../../src/server/auth/schemas/authenticationProviderSchema.ts","../../../src/server/auth/schemas/tokenResponseSchema.ts","../../../src/server/auth/schemas/tokensSchema.ts","../../../src/server/auth/schemas/userinfoResponseSchema.ts","../../../../../node_modules/oauth4webapi/build/index.d.ts","../../../../../node_modules/openid-client/build/index.d.ts","../../../src/server/auth/providers/ServerAuthProvider.ts","../../../src/server/auth/primitives/$auth.ts","../../../src/server/auth/primitives/$authApple.ts","../../../src/server/auth/primitives/$authCredentials.ts","../../../src/server/auth/primitives/$authFacebook.ts","../../../src/server/auth/primitives/$authFranceConnect.ts","../../../src/server/auth/primitives/$authGithub.ts","../../../src/server/auth/primitives/$authGoogle.ts","../../../src/server/auth/primitives/$authMicrosoft.ts","../../../src/server/auth/index.ts"],"x_google_ignoreList":[5,6],"mappings":";;;;;;;;;;;;cAAa,sBAAA;;;;;;;;;;cCEA,4BAAA,WAA4B,OAAA;QAYxC,QAAA,CAAA,OAAA;;;KAEW,sBAAA,GAAyB,MAAA,QAC5B,4BAAA;;;cCZI,mBAAA,WAAmB,OAAA;YAG9B,QAAA,CAAA,OAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAEU,aAAA,GAAgB,MAAA,QAAc,mBAAA;;;cCP7B,YAAA,WAAY,OAAA;YAevB,QAAA,CAAA,OAAA;;;;;;;;;;KAEU,MAAA,GAAS,MAAA,QAAc,YAAA;;;cChBtB,sBAAA,WAAsB,OAAA;;QAGjC,QAAA,CAAA,OAAA;;;;;;;;;;;;;;;;;;;;;;KAEU,gBAAA,GAAmB,MAAA,QAAc,sBAAA;;;;;AJT7C;KKaYW,UAAAA,uBACUC,SAAAA;;;;KAKVE,SAAAA,GAAYF,SAAAA;;;;KAIZG,aAAAA;;;;KAIAH,SAAAA,GAAYG,aAAAA,GAAgBJ,UAAAA,GAAaG,SAAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAqFhCuB,SAAAA;;;;;;;;;;;;;;;;;cAiBAC,cAAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AHvHrB;;;;;;;;ACPA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiBA;;;;;;;;AChBA;;;;;cC8PqBC,aAAAA;;;;AAjIrB;;;;UA+QiBI,mBAAAA;EA9IIJ;;;EAAAA,SAkJRM,MAAAA;EAlJkC;AA8I/C;;EA9I+C,SAsJlCC,sBAAAA;EAqT6B;;;EAAA,SAjT7BC,cAAAA;EAIAC;;;EAAAA,SAAAA,QAAAA;EAkBAI;;;EAAAA,SAdAH,qBAAAA;EAiCAO;;;EAAAA,SA7BAN,gBAAAA;EAiDAU;;;;EAAAA,SA5CAT,wBAAAA;EAqEAc;;;;EAAAA,SAhEAb,wBAAAA;EAqFAkB;;;;EAAAA,SAhFAjB,qBAAAA;EAmGAqB;;;EAAAA,SA/FApB,qCAAAA;EAiHAwB;;;;EAAAA,SA5GAvB,gDAAAA;EAoIA4B;;;;EAAAA,SA/HA3B,qBAAAA;EAuJAgC;;;;EAAAA,SAlJA/B,oBAAAA;EAyKAoC;;;;;EAAAA,SAnKAnC,aAAAA;EAiMAyC;;;;EAAAA,SA5LAxC,UAAAA;EAkNA6C;;;EAAAA,SA9MA5C,mBAAAA;EAkOAgD;;;;EAAAA,SA7NA/C,0CAAAA;EA+OCoD;;;;EAAAA,SA1ODnD,qDAAAA;EA4OuB;;;EAAA,SAxOvBC,sBAAAA;EAwOqCpB;;;;EAAAA,SAnOrCqB,6CAAAA;EA2OU;;;;;EAAA,SArOVC,wDAAAA;EAgVoB;;;EAAA,SA5UpBC,gCAAAA;EAwPTqD;;;EAAAA,SApPSpD,eAAAA;EA+TTwD;;;EAAAA,SA3TSvD,6BAAAA;EAoUWxD;;;EAAAA,SAhUXyD,0CAAAA;EAo+DmB;;;;EAAA,SA/9DnBC,qBAAAA,GAAwB1B,mBAAAA;EAg+DeoV;;;EAAAA,SA59DvCzT,iBAAAA;EA29DoByT;;;;EAAAA,SAt9DpBxT,oBAAAA;EAu9DuCwT;;;;EAAAA,SAl9DvCvT,uBAAAA;;;ACxfb;;WD6faC,qCAAAA;EC7fiBqX;;;;EAAAA,SDkgBjBpX,wCAAAA;EClgBgG;;;;EAAA,SDugBhGC,wCAAAA;ECvgB+DqX;;;EAAAA,SD2gB/DpX,qCAAAA;EC3gBgG;;AAse7G;EAte6G,SD+gBhGC,wCAAAA;;;;WAIAC,wCAAAA;EC2CQ;;;;EAAA,SDtCRC,2CAAAA;ECsCmFiX;;;;EAAAA,SDjCnFhX,8CAAAA;ECiC0DwY;;;;EAAAA,SD5B1DvY,8CAAAA;EC4CkB;;;;EAAA,SDvClBC,wBAAAA;EC2CTyY;;;EAAAA,SDvCSxY,qBAAAA;ECoGI2W;;;;EAAAA,SD/FJ1W,gBAAAA;EC6WI8a;;;;EAAAA,SDxWJ7a,wBAAAA;ECoXIgb;;;;EAAAA,SD/WJ/a,0BAAAA;ECmXoC4a;;;;EAAAA,SD9WpC3a,2BAAAA;ECkXiB;;;;EAAA,SD7WjBC,+BAAAA;EC6WTgb;;;;EAAAA,SDxWS/a,gCAAAA;ECwW2D;;AAExE;;EAFwE,SDnW3DC,6BAAAA;ECyWH2X;;;EAAAA,SDrWG1X,qCAAAA;ECuXW;;;EAAA,SDnXXC,qCAAAA;ECqWA8a;;;;EAAAA,SDhWA7a,0CAAAA;EC8WW;;AAKxB;;EALwB,SDzWXC,6CAAAA;ECuXJ2a;;;;EAAAA,SDlXI1a,6CAAAA;EC8Wbgb;;;;EAAAA,SDzWa/a,8CAAAA;EC6WmC;;AAIhD;;EAJgD,SDxWnCC,0CAAAA;ECmXG;;;;EAAA,SD9WHC,6CAAAA;ECmXF;AA2CX;;;EA3CW,SD9WEC,6CAAAA;ECmagE4V;;;EAAAA,SD/ZhE3V,mCAAAA;ECmaSka;;;;EAAAA,SD9ZTja,+DAAAA;EC8aYqY;;;EAAAA,SD1aZpY,0CAAAA;EC4YiC+Z;;;EAAAA,SDxYjC9Z,yCAAAA;ECwYiC8Z;;;;EAAAA,SDnYjC7Z,oBAAAA;EC6Y2BmZ;;;EAAAA,SDzY3BlZ,iCAAAA;ECyYiHoV;;;;EAAAA,SDpYjHnV,oBAAAA;ECwYoCwZ;;;;;EAAAA,SDlYpCvZ,qCAAAA;EC0YLqY;;;EAAAA,SDtYKpY,6BAAAA;EC8YY8X;;;;EAAAA,SDzYZ7X,oCAAAA;EC6Y2B;;;EAAA,SDzY3BC,4BAAAA;EErqBA;;;EAAA,SFyqBAC,mBAAAA;EAAAA,UACCC,QAAAA,WAAmBrG,SAAAA;AAAAA;AAAAA,UAEhBgC,mBAAAA,SAA4BsE,IAAAA,CAAKvE,mBAAAA;EAAAA,UACpCsE,QAAAA;AAAAA;;;;;;UAOGE,MAAAA;;;;EAIbC,SAAAA;;;;;;;EAOAC,4BAAAA;;;;;;;EAOAC,iCAAAA;;;;;EAKAC,iBAAAA;;;;;;;EAOAC,4BAAAA;;;;;;;EAOAC,iCAAAA;;;;EAIAC,eAAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyDAC,yBAAAA;;;;GAICtF,SAAAA;;;;GAIAC,cAAAA;EAAAA,CACA2E,QAAAA,WAAmBrG,SAAAA;AAAAA;;;;KAoqDZmX,oBAAAA,oBACIC,CAAAA,IAAKC,CAAAA,0BAA2BA,CAAAA,GAAID,CAAAA,CAAEC,CAAAA;;;ALv+EtD;;;;;;;;;;;;;;;ACEA;;ADFA,KM6BY6D,UAAAA,IAAcK,EAAAA,EAAIJ,cAAAA,EAAgBK,MAAAA,EAAQJ,cAAAA,EAAgBK,IAAAA,EAAMJ,eAAAA,EAAiBK,OAAAA,EAASJ,OAAAA;;;;;;;AFpBtG;;;;;;;;ACIA;;;;;AAMA;;;;;AAIA;;;;;AAIA;;;;;;;;;;;;;AAqFA;;;;;AAiBA;;;;;AAiIA;;;;;AA8IA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+TA;;;;;;;;;AAQA;;;;;;;;;;;;;;;;;;;;;;AA+wDA;cCn+DqBgB,WAAAA,SAAoB5D,aAAAA;AAAAA,KAwF7BgE,SAAAA,GAAYC,WAAAA,UAAqBC,cAAAA,YAA0BC,UAAAA,eAAyBxB,eAAAA;;;;;;AAqXhG;;UArWiBD,cAAAA,SAAuB1C,MAAAA;EAyW9BgE;;;EArWNM,aAAAA;EAuXoB;;;;;;;;;;;AAKxB;;;;;;;;;;;;;;;AAaA;;;;;;;;;AAuDA;;;;;;;;;;;;;;;;EA5YIC,yBAAAA;AAAAA;;;;;;;;UASa9B,cAAAA,SAAuBzC,mBAAAA;AAAAA,UA8QvB6G,qBAAAA;EC/2BC;;;;;;EDs3BdC,YAAAA,CAAaC,MAAAA;AAAAA;;;;UAKAC,oBAAAA;;;;EAIbE,cAAAA,IAAkBD,QAAAA,CAASxE,cAAAA,IAAkBoE,qBAAAA;;;;EAI7CM,cAAAA,IAAkBF,QAAAA,CAASjH,oBAAAA,CAA2B0C,cAAAA;AAAAA;AAAAA,UAEzC0E,kBAAAA;;;;EAIbrE,IAAAA,EAAMiB,SAAAA;;;;EAINhB,OAAAA,EAASqE,MAAAA;ECx3BiB;;;;ED63B1BN,MAAAA;;;;EAIAQ,QAAAA;;;;;EAKAC,MAAAA,GAASF,WAAAA;AAAAA;;;;KAKDjC,WAAAA;;;;;AAKZqC,GAAAA;;;;AAIArE,OAAAA,EAAS+D,kBAAAA,KAAuB1C,OAAAA,CAAQ+C,QAAAA;;;;UAIvBE,uBAAAA;;;;;;;GAOZ/D,WAAAA,IAAeyB,WAAAA;;;;;EAKhBM,OAAAA;AAAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA2CiBL,aAAAA,YAAyB0B,oBAAAA,EAAsBW,uBAAAA;;;;;;;;;;EAUhEC,WAAAA,CAAY1B,MAAAA,EAAQzD,cAAAA,EAAgB6D,QAAAA,UAAkBH,QAAAA,GAAWF,OAAAA,CAAQvD,cAAAA,YAA0B0D,oBAAAA,GAAuB5D,UAAAA;;;;EAI1H0E,cAAAA,CAAAA,GAAkBD,QAAAA,CAASxE,cAAAA,IAAkBoE,qBAAAA;EC32B1B;;;ED+2BnBM,cAAAA,CAAAA,GAAkBF,QAAAA,CAASjH,oBAAAA,CAA2B0C,cAAAA;;;;MAIlDiD,OAAAA,CAAAA;;;;MAIAA,OAAAA,CAAQkC,KAAAA;;;;OAIPjE,WAAAA,KAAgByB,WAAAA;;;;OAIhBzB,WAAAA,EAAaiE,KAAAA,EAAOxC,WAAAA;AAAAA;;;cC9iChB,kBAAA;EAAA,mBACQ,GAAA,EADU,gBAAA,CACP,MAAA;EAAA,mBACH,MAAA,EAAM,MAAA;EAAA,mBACN,qBAAA,EAAqB,qBAAA;EAAA,mBACrB,gBAAA,EAAgB,gBAAA;EAAA,mBAChB,mBAAA,EAAmB,mBAAA;;;;;YAM5B,mBAAA,CAAoB,GAAA;EAAA,IAOnB,UAAA,CAAA,GAAc,KAAA,CAAM,aAAA;EAAA,mBAMZ,iBAAA,EAAiB,wBAAA,CAAA,uBAAA,UAAA,OAAA;cANN,QAAA,CAAA,OAAA;;;;;;;;WAsBd,MAAA,EAAM,wBAAA,CAAA,uBAAA,UAAA,OAAA;cAhBc,QAAA,CAAA,OAAA;;;;;;;;;;qBAyBjB,SAAA,EATG,QAAA,CASM,aAAA;;ANpE9B;;qBMgFqB,SAAA,EAZS,QAAA,CAYA,aAAA;ENhFO;;;EAAA,SMqHnB,QAAA,mBAAQ,cAAA;;;YArCI,QAAA,CAAA,OAAA;;;;;;;;;;;;;;;;;;;;;;;;;;WA2EZ,OAAA,mBAAO,cAAA;;gBAtCC,QAAA,CAAA,OAAA;IAAA;;;;;;;;;;;;;;;;;;;;WA6ER,KAAA,mBAAK,cAAA;;gBAvCE,QAAA,CAAA,OAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAoHP,KAAA,mBAAK,cAAA;;gBA7EA,QAAA,CAAA,OAAA;;;;;;;;;;;YA2ML,sBAAA,CACd,GAAA,EAAK,OAAA,GACJ,OAAA,CAAQ,MAAA;;;;;;YAsCK,cAAA,CACd,GAAA,EAAK,GAAA,EACL,KAAA,EAAO,WAAA,EACP,OAAA,EAAS,OAAA,EACT,GAAA,GAAM,gBAAA,GAAgB,OAAA;;;;;WA8FR,QAAA,EAAQ,gBAAA,CAAA,cAAA,CA9FA,gBAAA,CA8FA,mBAAA;;;;;WAWR,YAAA,EAAY,gBAAA,CAAA,cAAA,CAXJ,gBAAA,CAWI,mBAAA;;;;WAWZ,MAAA,mBAAM,cAAA;;mDAXM,QAAA,CAAA,OAAA;IAAA;EAAA;EAqFrB,0BAAA,CACL,OAAA;IAAW,SAAA;EAAA,IACV,sBAAA;;;AL/nBL;;;YKuqBY,QAAA,CACR,IAAA;IAAiB,QAAA;IAAkB,KAAA;EAAA,IAClC,aAAA;;AJhrBL;;;YI6sBkB,eAAA,CACd,OAAA,EAAS,OAAA,GACR,OAAA,CAAQ,MAAA;EAAA,UAgCD,SAAA,CAAU,OAAA,GAAU,OAAA,GAAU,MAAA;EAAA,UAI9B,SAAA,CAAU,MAAA,EAAQ,MAAA,EAAQ,OAAA,GAAU,OAAA;EAAA,UAgBpC,kBAAA,CAAmB,MAAA,EAAQ,MAAA;EAAA,UAcrB,aAAA,CAAc,MAAA,EAAQ,MAAA,GAAS,OAAA,CAAQ,MAAA;AAAA;AAAA,UAqDxC,aAAA;EACf,GAAA;EACA,KAAA;EACA,IAAA;EACA,UAAA;EACA,WAAA;EACA,WAAA;EACA,QAAA;EACA,kBAAA;EACA,OAAA;EACA,OAAA;EACA,OAAA;EACA,cAAA;EACA,MAAA;EACA,SAAA;EACA,QAAA;EACA,MAAA;EACA,YAAA;EACA,qBAAA;EACA,OAAA;IACE,SAAA;IACA,cAAA;IACA,QAAA;IACA,MAAA;IACA,WAAA;IACA,OAAA;EAAA;EAEF,UAAA;EAAA,CAEC,GAAA;AAAA;;;;;;;;;APt2BH;;;;;;;;;;;;;;;ACEA;;;;;;;;;;;;;cOyDa,KAAA;EAAA,UAAkB,oBAAA,GAAuB,aAAA;EAAA;;KAM1C,oBAAA;EPjDyB;;;;EOsDnC,IAAA;ENjEW;;;EMsEX,QAAA;AAAA,KACG,YAAA,GAAe,YAAA;;;;KAKR,YAAA;;;;EAIV,IAAA,EAAM,WAAA;;;;;;;;;;;;;;EAeN,QAAA,SAAiB,KAAA,CAAM,WAAA;AAAA;;;;;;;KASb,YAAA;EACV,MAAA,EAAQ,eAAA;AAAA;;;;;;;;EAUJ,WAAA,EAAa,kBAAA;AAAA;;;;;;;;EAUb,KAAA,EAAO,aAAA;AAAA;EN7HmB;;;;;;;;;EMyI1B,IAAA,EAAM,WAAA;AAAA;AAAA,KAIA,kBAAA;EACV,OAAA,EAAS,aAAA;AAAA;AAAA,KAGC,aAAA,IACV,WAAA,EAAa,WAAA,KACV,KAAA,CAAM,WAAA;AAAA,UAEM,WAAA;EACf,QAAA;EACA,QAAA;AAAA;AAAA,UAGe,WAAA;;;;EAIf,MAAA;;;;EAKA,QAAA;;;;;EAMA,YAAA;;;;;EAMA,WAAA;;;;;EAMA,UAAA;;;;EAKA,SAAA;;;;;EAMA,KAAA;EAEA,OAAA,GAAU,aAAA;;;;;;EAOV,YAAA;;;;;EAMA,uBAAA,GAA0B,MAAA;AAAA;AAAA,UAGX,kBAAA;EACf,YAAA;EACA,IAAA,EAAM,aAAA;EACN,QAAA;EACA,UAAA;EACA,KAAA;AAAA;AAAA,KAGU,aAAA,IAAiB,MAAA,EAAQ,kBAAA,KAAuB,KAAA,CAAM,WAAA;AAAA,UAEjD,aAAA;;;;EAIf,QAAA;;;;EAKA,YAAA;;;ANhOF;EMqOE,aAAA;;;;EAKA,KAAA;;;ALjPF;EKsPE,QAAA,GAAW,MAAA,EAAQ,MAAA,KAAW,KAAA,CAAM,aAAA;EAEpC,OAAA,GAAU,aAAA;ELzOV;;;EK8OA,WAAA;;;;EAKA,KAAA;AAAA;AAAA,cAKW,aAAA,SAAsB,SAAA,CAAU,oBAAA;EAAA,mBACxB,gBAAA,EAAgB,gBAAA;EAAA,mBAChB,gBAAA,EAAgB,gBAAA;EAAA,UAEzB,WAAA,GAAc,aAAA;EAAA,UACd,gBAAA,SAAyB,OAAA,CAAQ,aAAA;EAAA,IAEhC,KAAA,CAAA,GAAS,aAAA;;;;EAOP,QAAA,CAAA,GAAY,OAAA,CAAQ,aAAA;EAAA,IActB,IAAA,CAAA;EAAA,IAIA,MAAA,CAAA,GAAU,eAAA;EAAA,IAOV,QAAA,CAAA;EAAA,IAQA,KAAA,CAAA;EAAA,IAYA,YAAA,CAAA;;;;;EAgBE,OAAA,CACX,YAAA,UACA,WAAA,YACC,OAAA,CAAQ,mBAAA;;;;;;;;;;EA8CE,IAAA,CACX,MAAA,EAAQ,MAAA,EACR,eAAA,GAAkB,MAAA,oBACjB,OAAA,CAAQ,WAAA;EAAA,UAsDD,kBAAA,CAAmB,OAAA,WAAkB,aAAA;EAYlC,OAAA,CAAA,GAAO,OAAA;AAAA;AAAA,KAsDV,WAAA;EAAyB,KAAA,QAAa,KAAA;AAAA;AAAA,UAEjC,UAAA;EACf,IAAA,IAAQ,IAAA,cAAkB,IAAA,EAAM,kBAAA,KAAuB,KAAA,CAAM,WAAA;AAAA;AAAA,UAG9C,WAAA;EACf,KAAA,IACE,QAAA,cACI,KAAA,EAAO,WAAA,KAAgB,KAAA,CAAM,WAAA;AAAA;;;;;;;;;;;;;AR1gBrC;;;;;;;;;;;;;;;ACEA;;;;cQsCa,UAAA,GACX,KAAA,EAAO,eAAA,GAAkB,UAAA,EACzB,OAAA,GAAS,OAAA,CAAQ,WAAA,MAAD,aAAA;;;;;;;;cC5BL,gBAAA,GACX,KAAA,EAAO,eAAA,GAAkB,WAAA,EACzB,OAAA,GAAS,OAAA,CAAQ,kBAAA,MAAD,aAAA;;;;;;;;;;;;;cCIL,aAAA,GACX,KAAA,EAAO,eAAA,GAAkB,UAAA,EACzB,OAAA,GAAS,OAAA,CAAQ,WAAA,MAAD,aAAA;;;;;;;;;;;;;AXtBlB;;;;;;;;;;;;;;;ACEA;;cWkCa,kBAAA,GACX,KAAA,EAAO,eAAA,GAAkB,UAAA,EACzB,OAAA,GAAS,OAAA,CAAQ,WAAA,MAAD,aAAA;;;;;;;;;;;;;cClBL,WAAA,GACX,KAAA,EAAO,eAAA,GAAkB,UAAA,EACzB,OAAA,GAAS,OAAA,CAAQ,WAAA,MAAD,aAAA;;;;;;;;;;;;;cCHL,WAAA,GACX,KAAA,EAAO,eAAA,GAAkB,UAAA,EACzB,OAAA,GAAS,OAAA,CAAQ,WAAA,MAAD,aAAA;;;;;;;;;;;;;AdrBlB;;;;;;;;;;;;ce+Ba,cAAA,GACX,KAAA,EAAO,eAAA,GAAkB,UAAA,EACzB,OAAA,GAAS,OAAA,CAAQ,WAAA,MAAD,aAAA;;;;;AfjClB;;;;;;;;;;;;;;;cgBqCa,gBAAA,EAAgB,QAAA,CAAA,OAAA,CAI3B,QAAA,CAJ2B,MAAA"}
+{"version":3,"file":"index.d.ts","names":["CryptoKey","crypto","subtle","generateKey","ReturnType","Awaited","Extract","type","CryptoKeyPair","privateKey","publicKey","JsonObject","JsonValue","Key","JsonArray","JsonPrimitive","ModifyAssertionFunction","Record","header","payload","PrivateKey","key","kid","JWSAlgorithm","JWK","kty","alg","use","key_ops","e","n","crv","x","y","pub","parameter","allowInsecureRequests","clockSkew","clockTolerance","customFetch","modifyAssertion","jweDecrypt","jwksCache","AuthorizationServer","MTLSEndpointAliases","issuer","authorization_endpoint","token_endpoint","jwks_uri","registration_endpoint","scopes_supported","response_types_supported","response_modes_supported","grant_types_supported","token_endpoint_auth_methods_supported","token_endpoint_auth_signing_alg_values_supported","service_documentation","ui_locales_supported","op_policy_uri","op_tos_uri","revocation_endpoint","revocation_endpoint_auth_methods_supported","revocation_endpoint_auth_signing_alg_values_supported","introspection_endpoint","introspection_endpoint_auth_methods_supported","introspection_endpoint_auth_signing_alg_values_supported","code_challenge_methods_supported","signed_metadata","device_authorization_endpoint","tls_client_certificate_bound_access_tokens","mtls_endpoint_aliases","userinfo_endpoint","acr_values_supported","subject_types_supported","id_token_signing_alg_values_supported","id_token_encryption_alg_values_supported","id_token_encryption_enc_values_supported","userinfo_signing_alg_values_supported","userinfo_encryption_alg_values_supported","userinfo_encryption_enc_values_supported","request_object_signing_alg_values_supported","request_object_encryption_alg_values_supported","request_object_encryption_enc_values_supported","display_values_supported","claim_types_supported","claims_supported","claims_locales_supported","claims_parameter_supported","request_parameter_supported","request_uri_parameter_supported","require_request_uri_registration","require_signed_request_object","pushed_authorization_request_endpoint","require_pushed_authorization_requests","introspection_signing_alg_values_supported","introspection_encryption_alg_values_supported","introspection_encryption_enc_values_supported","authorization_response_iss_parameter_supported","authorization_signing_alg_values_supported","authorization_encryption_alg_values_supported","authorization_encryption_enc_values_supported","backchannel_authentication_endpoint","backchannel_authentication_request_signing_alg_values_supported","backchannel_token_delivery_modes_supported","backchannel_user_code_parameter_supported","check_session_iframe","dpop_signing_alg_values_supported","end_session_endpoint","frontchannel_logout_session_supported","frontchannel_logout_supported","backchannel_logout_session_supported","backchannel_logout_supported","protected_resources","metadata","Pick","Client","client_id","id_token_signed_response_alg","authorization_signed_response_alg","require_auth_time","userinfo_signed_response_alg","introspection_signed_response_alg","default_max_age","use_mtls_endpoint_aliases","UnsupportedOperationError","Error","code","constructor","message","cause","options","OperationProcessingError","JWKSCacheOptions","JWKSCacheInput","CustomFetchOptions","Method","BodyType","AbortSignal","body","headers","method","redirect","signal","HttpRequestOptions","Headers","Response","Promise","url","DiscoveryRequestOptions","algorithm","discoveryRequest","URL","issuerIdentifier","processDiscoveryResponse","expectedIssuerIdentifier","response","generateRandomCodeVerifier","generateRandomState","generateRandomNonce","calculatePKCECodeChallenge","codeVerifier","DPoPRequestOptions","DPoPHandle","DPoP","PushedAuthorizationRequestOptions","URLSearchParams","ClientAuth","as","client","ClientSecretPost","clientSecret","ClientSecretBasic","ModifyAssertionOptions","PrivateKeyJwt","clientPrivateKey","ClientSecretJwt","None","TlsClientAuth","issueRequestObject","parameters","checkProtocol","enforceHttps","pushedAuthorizationRequest","clientAuthentication","calculateThumbprint","isDPoPNonceError","err","keyPair","PushedAuthorizationResponse","request_uri","expires_in","OAuth2Error","error","error_description","error_uri","algs","scope","ResponseBodyError","RESPONSE_BODY_ERROR","status","AuthorizationResponseError","AUTHORIZATION_RESPONSE_ERROR","WWWAuthenticateChallengeError","WWWAuthenticateChallenge","WWW_AUTHENTICATE_CHALLENGE","WWWAuthenticateChallengeParameters","Lowercase","realm","resource_metadata","scheme","token68","processPushedAuthorizationResponse","ProtectedResourceRequestBody","ArrayBuffer","ReadableStream","Uint8Array","ProtectedResourceRequestOptions","Omit","protectedResourceRequest","accessToken","UserInfoRequestOptions","userInfoRequest","UserInfoAddress","formatted","street_address","locality","region","postal_code","country","claim","UserInfoResponse","sub","name","given_name","family_name","middle_name","nickname","preferred_username","profile","picture","website","email","email_verified","gender","birthdate","zoneinfo","locale","phone_number","updated_at","address","ExportedJWKSCache","JWKS","jwks","uat","skipSubjectCheck","JWEDecryptOptions","JweDecryptFunction","RecognizedTokenTypes","TokenEndpointResponse","res","ProcessTokenResponseOptions","recognizedTokenTypes","processUserInfoResponse","expectedSubject","TokenEndpointRequestOptions","additionalParameters","refreshTokenGrantRequest","refreshToken","getValidatedIdTokenClaims","IDToken","ref","ValidateSignatureOptions","validateApplicationLevelSignature","processRefreshTokenResponse","nopkce","authorizationCodeGrantRequest","callbackParameters","redirectUri","JWTPayload","ConfirmationClaims","iss","aud","jti","nbf","exp","iat","cnf","nonce","auth_time","azp","AuthorizationDetails","locations","actions","datatypes","privileges","identifier","access_token","id_token","refresh_token","authorization_details","token_type","expectNoNonce","skipAuthTimeCheck","ProcessAuthorizationCodeResponseOptions","expectedNonce","maxAge","requireIdToken","processAuthorizationCodeResponse","UNSUPPORTED_OPERATION","JWT_USERINFO_EXPECTED","PARSE_ERROR","INVALID_RESPONSE","INVALID_REQUEST","RESPONSE_IS_NOT_JSON","RESPONSE_IS_NOT_CONFORM","HTTP_REQUEST_FORBIDDEN","REQUEST_PROTOCOL_FORBIDDEN","JWT_TIMESTAMP_CHECK","JWT_CLAIM_COMPARISON","JSON_ATTRIBUTE_COMPARISON","KEY_SELECTION","MISSING_SERVER_METADATA","INVALID_SERVER_METADATA","ClientCredentialsGrantRequestOptions","clientCredentialsGrantRequest","genericTokenEndpointRequest","grantType","processGenericTokenEndpointResponse","processClientCredentialsResponse","RevocationRequestOptions","revocationRequest","token","processRevocationResponse","IntrospectionRequestOptions","requestJwtResponse","introspectionRequest","jkt","IntrospectionResponse","active","sid","username","processIntrospectionResponse","keys","jwe","validateJwtAuthResponse","expectNoState","skipStateCheck","expectedState","validateDetachedSignatureResponse","Request","validateCodeIdTokenResponse","validateAuthResponse","DeviceAuthorizationRequestOptions","deviceAuthorizationRequest","DeviceAuthorizationResponse","device_code","user_code","verification_uri","verification_uri_complete","interval","processDeviceAuthorizationResponse","deviceCodeGrantRequest","deviceCode","processDeviceCodeResponse","GenerateKeyPairOptions","extractable","modulusLength","generateKeyPair","JWTAccessTokenClaims","ValidateJWTAccessTokenOptions","requireDPoP","signingAlgorithms","validateJwtAccessToken","request","expectedAudience","BackchannelAuthenticationRequestOptions","backchannelAuthenticationRequest","BackchannelAuthenticationResponse","auth_req_id","processBackchannelAuthenticationResponse","backchannelAuthenticationGrantRequest","authReqId","processBackchannelAuthenticationGrantResponse","OmitSymbolProperties","T","K","DynamicClientRegistrationRequestOptions","initialAccessToken","dynamicClientRegistrationRequest","Partial","processDynamicClientRegistrationResponse","ResourceServer","resource","authorization_servers","bearer_methods_supported","resource_signing_alg_values_supported","resource_name","resource_documentation","resource_policy_uri","resource_tos_uri","authorization_details_types_supported","dpop_bound_access_tokens_required","resourceDiscoveryRequest","resourceIdentifier","processResourceDiscoveryResponse","expectedResourceIdentifier","oauth","CryptoKey","crypto","subtle","generateKey","ReturnType","Awaited","Extract","type","CryptoKeyPair","privateKey","publicKey","AuthorizationResponseError","ResponseBodyError","WWWAuthenticateChallengeError","AuthorizationDetails","BackchannelAuthenticationResponse","ConfirmationClaims","DeviceAuthorizationResponse","OmitSymbolProperties","ExportedJWKSCache","GenerateKeyPairOptions","IDToken","IntrospectionResponse","JsonArray","JsonObject","JsonPrimitive","JsonValue","JWK","JWKS","JWSAlgorithm","ModifyAssertionFunction","ModifyAssertionOptions","MTLSEndpointAliases","PrivateKey","TokenEndpointResponse","UserInfoAddress","UserInfoResponse","WWWAuthenticateChallenge","WWWAuthenticateChallengeParameters","ClientAuth","ServerMetadata","ClientMetadata","URLSearchParams","Headers","as","client","body","headers","ClientSecretPost","clientSecret","ClientSecretBasic","ClientSecretJwt","options","None","PrivateKeyJwt","clientPrivateKey","TlsClientAuth","skipStateCheck","skipSubjectCheck","customFetch","modifyAssertion","clockSkew","clockTolerance","FetchBody","ArrayBuffer","ReadableStream","Uint8Array","DPoPHandle","Client","client_secret","use_mtls_endpoint_aliases","AuthorizationServer","calculatePKCECodeChallenge","Promise","codeVerifier","randomPKCECodeVerifier","randomNonce","randomState","ClientError","Error","code","randomDPoPKeyPair","alg","DiscoveryRequestOptions","CustomFetch","Configuration","Array","algorithm","execute","config","timeout","DynamicClientRegistrationRequestOptions","DPoPOptions","initialAccessToken","dynamicClientRegistration","URL","Partial","server","metadata","clientAuthentication","discovery","clientId","DecryptionKey","key","kid","enableDecryptingResponses","contentEncryptionAlgorithms","keys","ServerMetadataHelpers","supportsPKCE","method","ConfigurationMethods","Readonly","serverMetadata","clientMetadata","CustomFetchOptions","Record","AbortSignal","redirect","signal","Response","url","ConfigurationProperties","constructor","value","TokenEndpointResponseHelpers","claims","expiresIn","getDPoPHandle","keyPair","DeviceAuthorizationGrantPollOptions","pollDeviceAuthorizationGrant","deviceAuthorizationResponse","parameters","initiateDeviceAuthorization","initiateBackchannelAuthentication","BackchannelAuthenticationGrantPollOptions","pollBackchannelAuthenticationGrant","backchannelAuthenticationResponse","AuthorizationCodeGrantOptions","allowInsecureRequests","setJwksCache","jwksCache","getJwksCache","enableNonRepudiationChecks","useJwtResponseMode","enableDetachedSignatureResponseChecks","ImplicitAuthenticationResponseChecks","AuthorizationCodeGrantChecks","Pick","implicitAuthentication","Request","currentUrl","expectedNonce","checks","useCodeIdTokenResponseType","useIdTokenResponseType","expectedState","idTokenExpected","maxAge","pkceCodeVerifier","authorizationCodeGrant","tokenEndpointParameters","refreshTokenGrant","refreshToken","clientCredentialsGrant","buildAuthorizationUrl","buildAuthorizationUrlWithJAR","signingKey","buildAuthorizationUrlWithPAR","buildEndSessionUrl","fetchUserInfo","accessToken","expectedSubject","tokenIntrospection","token","DPoP","genericGrantRequest","grantType","tokenRevocation","fetchProtectedResource","DeviceAutorizationGrantPollOptions"],"sources":["../../../src/server/auth/constants/routes.ts","../../../src/server/auth/schemas/authenticationProviderSchema.ts","../../../src/server/auth/schemas/tokenResponseSchema.ts","../../../src/server/auth/schemas/tokensSchema.ts","../../../src/server/auth/schemas/userinfoResponseSchema.ts","../../../../../node_modules/oauth4webapi/build/index.d.ts","../../../../../node_modules/openid-client/build/index.d.ts","../../../src/server/auth/providers/ServerAuthProvider.ts","../../../src/server/auth/primitives/$auth.ts","../../../src/server/auth/primitives/$authApple.ts","../../../src/server/auth/primitives/$authCredentials.ts","../../../src/server/auth/primitives/$authFacebook.ts","../../../src/server/auth/primitives/$authFranceConnect.ts","../../../src/server/auth/primitives/$authGithub.ts","../../../src/server/auth/primitives/$authGoogle.ts","../../../src/server/auth/primitives/$authMicrosoft.ts","../../../src/server/auth/index.ts"],"x_google_ignoreList":[5,6],"mappings":";;;;;;;;;;;;;cAAa,sBAAA;;;;;;;;;;cCEA,4BAAA,YAA4B,OAAA;QAYxC,SAAA,CAAA,OAAA;;;KAEW,sBAAA,GAAyB,MAAA,QAC5B,4BAAA;;;cCZI,mBAAA,YAAmB,OAAA;YAG9B,SAAA,CAAA,OAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAEU,aAAA,GAAgB,MAAA,QAAc,mBAAA;;;cCP7B,YAAA,YAAY,OAAA;YAevB,SAAA,CAAA,OAAA;;;;;;;;;;KAEU,MAAA,GAAS,MAAA,QAAc,YAAA;;;cChBtB,sBAAA,YAAsB,OAAA;;QAGjC,SAAA,CAAA,OAAA;;;;;;;;;;;;;;;;;;;;;;KAEU,gBAAA,GAAmB,MAAA,QAAc,sBAAA;;;;;;KCIjCW,UAAAA,uBACUC,SAAAA;;;;KAKVE,SAAAA,GAAYF,SAAAA;;;;KAIZG,aAAAA;;;;KAIAH,SAAAA,GAAYG,aAAAA,GAAgBJ,UAAAA,GAAaG,SAAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAqFhCuB,SAAAA;;;;;;;;;;;;;;;;;cAiBAC,cAAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AHvHrB;;;;;;;;ACPA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiBA;;;;;;;;AChBA;;;;cC8PqBC,aAAAA;;;;;AAjIrB;;;UA+QiBI,mBAAAA;EA/QiC;AAiIlD;;EAjIkD,SAmRrCE,MAAAA;EAlJkC;;AA8I/C;EA9I+C,SAsJlCC,sBAAAA;;;;WAIAC,cAAAA;EAAAA;;;EAAAA,SAIAC,QAAAA;EAaAG;;;EAAAA,SATAF,qBAAAA;EA4BAM;;;EAAAA,SAxBAL,gBAAAA;EA6CAS;;;;EAAAA,SAxCAR,wBAAAA;EA+DAa;;;;EAAAA,SA1DAZ,wBAAAA;EAgFAiB;;;;EAAAA,SA3EAhB,qBAAAA;EA8FAoB;;;EAAAA,SA1FAnB,qCAAAA;EA6GAuB;;;;EAAAA,SAxGAtB,gDAAAA;EA+HA2B;;;;EAAAA,SA1HA1B,qBAAAA;EAkJA+B;;;;EAAAA,SA7IA9B,oBAAAA;EAqKAmC;;;;;EAAAA,SA/JAlC,aAAAA;EA4LAwC;;;;EAAAA,SAvLAvC,UAAAA;EA8MA4C;;;EAAAA,SA1MA3C,mBAAAA;EA4NA+C;;;;EAAAA,SAvNA9C,0CAAAA;EA8OAmD;;;;EAAAA,SAzOAlD,qDAAAA;EA4OIlB;;;EAAAA,SAxOJmB,sBAAAA;EAwOgCmD;;;;EAAAA,SAnOhClD,6CAAAA;EA2OImD;;;;;EAAAA,SArOJlD,wDAAAA;EAgVoB;;;EAAA,SA5UpBC,gCAAAA;EAmPToD;;;EAAAA,SA/OSnD,eAAAA;EAsQTuD;;;EAAAA,SAlQStD,6BAAAA;EAoUR6C;;;EAAAA,SAhUQ5C,0CAAAA;EAo+DD0T;;;;EAAAA,SA/9DCzT,qBAAAA,GAAwB1B,mBAAAA;EAg+DWqV;;;EAAAA,SA59DnC1T,iBAAAA;EA49D0C;;;;EAAA,SAv9D1CC,oBAAAA;EAu9DmCyT;;;;EAAAA,SAl9DnCxT,uBAAAA;;;;ACxfb;WD6faC,qCAAAA;;;;;WAKAC,wCAAAA;EClgBgG;;;;EAAA,SDugBhGC,wCAAAA;ECvgBiCwX;;;EAAAA,SD2gBjCvX,qCAAAA;EC3gBgFyX;;;EAAAA,SD+gBhFxX,wCAAAA;ECzC6C;;;EAAA,SD6C7CC,wCAAAA;EC2CDuY;;;;EAAAA,SDtCCtY,2CAAAA;ECsC0DyY;;;;EAAAA,SDjC1DxY,8CAAAA;ECiCgCuY;;;;EAAAA,SD5BhCtY,8CAAAA;EC4CI8W;;;;EAAAA,SDvCJ7W,wBAAAA;ECuCiCwY;;;EAAAA,SDnCjCvY,qBAAAA;EC2FgB;AAS7B;;;EAT6B,SDtFhBC,gBAAAA;EC+FoD;AA8QjE;;;EA9QiE,SD1FpDC,wBAAAA;EC+WmB;AAKhC;;;EALgC,SD1WnBC,0BAAAA;ECmXSgb;;;;EAAAA,SD9WT/a,2BAAAA;ECkXiB;;;;EAAA,SD7WjBC,+BAAAA;ECyWoC0a;;;;EAAAA,SDpWpCza,gCAAAA;ECwW6CsW;;;AAE1D;EAF0DA,SDnW7CrW,6BAAAA;;;;WAIAC,qCAAAA;ECuXW;;;EAAA,SDnXXC,qCAAAA;ECqWTyW;;;;EAAAA,SDhWSxW,0CAAAA;EC8WA8a;;;AAKb;EALaA,SDzWA7a,6CAAAA;;;;;WAKAC,6CAAAA;ECkX0B;;;;EAAA,SD7W1BC,8CAAAA;EC6W2B8a;;;AAIxC;EAJwCA,SDxW3B7a,0CAAAA;;;;;WAKAC,6CAAAA;ECmXF;;AA2CX;;EA3CW,SD9WEC,6CAAAA;ECmaW2V;;;EAAAA,SD/ZX1V,mCAAAA;ECmakB0V;;;;EAAAA,SD9ZlBzV,+DAAAA;ECkaSia;;;EAAAA,SD9ZTha,0CAAAA;EC8aJ2W;;;EAAAA,SD1aI1W,yCAAAA;ECwY8E;;;;EAAA,SDnY9EC,oBAAAA;EC6YG+Y;;;EAAAA,SDzYH9Y,iCAAAA;ECyY6C+Y;;;;EAAAA,SDpY7C9Y,oBAAAA;ECwYkBoV;;;;;EAAAA,SDlYlBnV,qCAAAA;ECsY6CoV;;;EAAAA,SDlY7CnV,6BAAAA;EC8YJqW;;;;EAAAA,SDzYIpW,oCAAAA;EC6Y2B;;;EAAA,SDzY3BC,4BAAAA;;AErqBb;;WFyqBaC,mBAAAA;EAAAA,UACCC,QAAAA,WAAmBrG,SAAAA;AAAAA;AAAAA,UAEhBgC,mBAAAA,SAA4BsE,IAAAA,CAAKvE,mBAAAA;EAAAA,UACpCsE,QAAAA;AAAAA;;;;;;UAOGE,MAAAA;;;;EAIbC,SAAAA;;;;;;;EAOAC,4BAAAA;EEvpBkC;;;;;;EF8pBlCC,iCAAAA;;;;;EAKAC,iBAAAA;;;;;;;EAOAC,4BAAAA;EEroB0B;;;;;;EF4oB1BC,iCAAAA;;;;EAIAC,eAAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyDAC,yBAAAA;;;;GAICtF,SAAAA;;;;GAIAC,cAAAA;EAAAA,CACA2E,QAAAA,WAAmBrG,SAAAA;AAAAA;;;;KAoqDZmX,oBAAAA,oBACIC,CAAAA,IAAKC,CAAAA,0BAA2BA,CAAAA,GAAID,CAAAA,CAAEC,CAAAA;;;;ALv+EtD;;;;;;;;;;;;;;;ACEA;KK2BY6D,UAAAA,IAAcK,EAAAA,EAAIJ,cAAAA,EAAgBK,MAAAA,EAAQJ,cAAAA,EAAgBK,IAAAA,EAAMJ,eAAAA,EAAiBK,OAAAA,EAASJ,OAAAA;;;;;;;;AFpBtG;;;;;;;;ACIA;;;;;AAMA;;;;;AAIA;;;;;AAIA;;;;;;;;;;;;;AAqFA;;;;;AAiBA;;;;;AAiIA;;;;;AA8IA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+TA;;;;;;;;;AAQA;;;;;;;;;;;;;;;;;;;;;;cCpNqBgB,WAAAA,SAAoB5D,aAAAA;AAAAA,KAwF7BgE,SAAAA,GAAYC,WAAAA,UAAqBC,cAAAA,YAA0BC,UAAAA,eAAyBxB,eAAAA;;;;;;;AAqXhG;UArWiBD,cAAAA,SAAuB1C,MAAAA;;;;EAIpCsE,aAAAA;EAuXoB;;;;;;;;;;;;AAKxB;;;;;;;;;;;;;;;AAaA;;;;;;;;;AAuDA;;;;;;;;;;;;;;;EA5YIC,yBAAAA;AAAAA;;;;;;;;UASa9B,cAAAA,SAAuBzC,mBAAAA;AAAAA,UA8QvB6G,qBAAAA;;;;;;;EAObC,YAAAA,CAAaC,MAAAA;AAAAA;;;;UAKAC,oBAAAA;;;;EAIbE,cAAAA,IAAkBD,QAAAA,CAASxE,cAAAA,IAAkBoE,qBAAAA;;;;EAI7CM,cAAAA,IAAkBF,QAAAA,CAASjH,oBAAAA,CAA2B0C,cAAAA;AAAAA;AAAAA,UAEzC0E,kBAAAA;;;;EAIbrE,IAAAA,EAAMiB,SAAAA;;;;EAINhB,OAAAA,EAASqE,MAAAA;ECx2BQ;;;;ED62BjBN,MAAAA;;;;EAIAQ,QAAAA;;;;;EAKAC,MAAAA,GAASF,WAAAA;AAAAA;;;;KAKDjC,WAAAA;;;;;AAKZqC,GAAAA;;;;AAIArE,OAAAA,EAAS+D,kBAAAA,KAAuB1C,OAAAA,CAAQ+C,QAAAA;;;;UAIvBE,uBAAAA;;;;;;;GAOZ/D,WAAAA,IAAeyB,WAAAA;;;;;EAKhBM,OAAAA;AAAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA2CiBL,aAAAA,YAAyB0B,oBAAAA,EAAsBW,uBAAAA;;;;;;;;;;EAUhEC,WAAAA,CAAY1B,MAAAA,EAAQzD,cAAAA,EAAgB6D,QAAAA,UAAkBH,QAAAA,GAAWF,OAAAA,CAAQvD,cAAAA,YAA0B0D,oBAAAA,GAAuB5D,UAAAA;;;;EAI1H0E,cAAAA,CAAAA,GAAkBD,QAAAA,CAASxE,cAAAA,IAAkBoE,qBAAAA;EC31B/B;;;ED+1BdM,cAAAA,CAAAA,GAAkBF,QAAAA,CAASjH,oBAAAA,CAA2B0C,cAAAA;;;;MAIlDiD,OAAAA,CAAAA;;;;MAIAA,OAAAA,CAAQkC,KAAAA;;;;OAIPjE,WAAAA,KAAgByB,WAAAA;;;;OAIhBzB,WAAAA,EAAaiE,KAAAA,EAAOxC,WAAAA;AAAAA;;;cC9iChB,kBAAA;EAAA,mBACQ,GAAA,EADU,gBAAA,CACP,MAAA;EAAA,mBACH,MAAA,EAAM,MAAA;EAAA,mBACN,qBAAA,EAAqB,qBAAA;EAAA,mBACrB,gBAAA,EAAgB,gBAAA;EAAA,mBAChB,mBAAA,EAAmB,mBAAA;EPjCvC;;;;;;;;EAAA,UO2CW,mBAAA,CAAoB,GAAA;EAAA,IAmBnB,UAAA,CAAA,GAAc,KAAA,CAAM,aAAA;EAAA,mBAMZ,iBAAA,EAAiB,wBAAA,CAAA,uBAAA,WAAA,OAAA;cANN,SAAA,CAAA,OAAA;;;;;;;;WAsBd,MAAA,EAAM,wBAAA,CAAA,uBAAA,WAAA,OAAA;cAhBc,SAAA,CAAA,OAAA;;;;;;;;;;qBAyBjB,SAAA,EATG,QAAA,CASM,aAAA;;;;qBAYT,SAAA,EAZS,QAAA,CAYA,aAAA;;;AL3G9B;WKgJkB,QAAA,mBAAQ,cAAA;;;YArCI,SAAA,CAAA,OAAA;;;;;;;;;;;;;;;;;;;;;;;;;;WA2EZ,OAAA,mBAAO,cAAA;;gBAtCC,SAAA,CAAA,OAAA;IAAA;;;;;;;;;;;;;;;;;;;;WA6ER,KAAA,mBAAK,cAAA;;gBAvCE,SAAA,CAAA,OAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAoHP,KAAA,mBAAK,cAAA;;gBA7EA,SAAA,CAAA,OAAA;;;;;;;;;;;YA2ML,sBAAA,CACd,GAAA,EAAK,OAAA,GACJ,OAAA,CAAQ,MAAA;;;;;;YAsCK,cAAA,CACd,GAAA,EAAK,GAAA,EACL,KAAA,EAAO,WAAA,EACP,OAAA,EAAS,OAAA,EACT,GAAA,GAAM,gBAAA,GAAgB,OAAA;;;;;WA8FR,QAAA,EAAQ,gBAAA,CAAA,cAAA,CA9FA,gBAAA,CA8FA,mBAAA;;;;;WAWR,YAAA,EAAY,gBAAA,CAAA,cAAA,CAXJ,gBAAA,CAWI,mBAAA;;;;WAWZ,MAAA,mBAAM,cAAA;;oDAXM,SAAA,CAAA,OAAA;IAAA;EAAA;EAqFrB,0BAAA,CACL,OAAA;IAAW,SAAA;EAAA,IACV,sBAAA;EL/oBoB;;;;;EAAA,UKurBb,QAAA,CACR,IAAA;IAAiB,QAAA;IAAkB,KAAA;EAAA,IAClC,aAAA;;;;;YA6Ba,eAAA,CACd,OAAA,EAAS,OAAA,GACR,OAAA,CAAQ,MAAA;EAAA,UAgCD,SAAA,CAAU,OAAA,GAAU,OAAA,GAAU,MAAA;EAAA,UAI9B,SAAA,CAAU,MAAA,EAAQ,MAAA,EAAQ,OAAA,GAAU,OAAA;EAAA,UAgBpC,kBAAA,CAAmB,MAAA,EAAQ,MAAA;EAAA,UAcrB,aAAA,CAAc,MAAA,EAAQ,MAAA,GAAS,OAAA,CAAQ,MAAA;AAAA;AAAA,UAqDxC,aAAA;EACf,GAAA;EACA,KAAA;EACA,IAAA;EACA,UAAA;EACA,WAAA;EACA,WAAA;EACA,QAAA;EACA,kBAAA;EACA,OAAA;EACA,OAAA;EACA,OAAA;EACA,cAAA;EACA,MAAA;EACA,SAAA;EACA,QAAA;EACA,MAAA;EACA,YAAA;EACA,qBAAA;EACA,OAAA;IACE,SAAA;IACA,cAAA;IACA,QAAA;IACA,MAAA;IACA,WAAA;IACA,OAAA;EAAA;EAEF,UAAA;EAAA,CAEC,GAAA;AAAA;;;;;;;;;;APt3BH;;;;;;;;;;;;;;;ACEA;;;;;;;;;;;;cOyDa,KAAA;EAAA,UAAkB,oBAAA,GAAuB,aAAA;EAAA;;KAM1C,oBAAA;;;;;EAKV,IAAA;;ANjEF;;EMsEE,QAAA;AAAA,KACG,YAAA,GAAe,YAAA;;;;KAKR,YAAA;;;;EAIV,IAAA,EAAM,WAAA;;;;;;;;;;;;;;EAeN,QAAA,SAAiB,KAAA,CAAM,WAAA;AAAA;;;;;;;KASb,YAAA;EACV,MAAA,EAAQ,eAAA;AAAA;;;;;;;;EAUJ,WAAA,EAAa,kBAAA;AAAA;;;;;;;;EAUb,KAAA,EAAO,aAAA;AAAA;;;;;;;;;;EAYP,IAAA,EAAM,WAAA;AAAA;AAAA,KAIA,kBAAA;EACV,OAAA,EAAS,aAAA;AAAA;AAAA,KAGC,aAAA,IACV,WAAA,EAAa,WAAA,KACV,KAAA,CAAM,WAAA;AAAA,UAEM,WAAA;EACf,QAAA;EACA,QAAA;AAAA;AAAA,UAGe,WAAA;;;;EAIf,MAAA;;;;EAKA,QAAA;;;;;EAMA,YAAA;;;;;EAMA,WAAA;;;;;EAMA,UAAA;;;;EAKA,SAAA;;;;;EAMA,KAAA;EAEA,OAAA,GAAU,aAAA;;;;;;EAOV,YAAA;;;;;EAMA,uBAAA,GAA0B,MAAA;AAAA;AAAA,UAGX,kBAAA;EACf,YAAA;EACA,IAAA,EAAM,aAAA;EACN,QAAA;EACA,UAAA;EACA,KAAA;AAAA;AAAA,KAGU,aAAA,IAAiB,MAAA,EAAQ,kBAAA,KAAuB,KAAA,CAAM,WAAA;AAAA,UAEjD,aAAA;;;;EAIf,QAAA;;;;EAKA,YAAA;;;;EAKA,aAAA;ENrOuB;;;EM0OvB,KAAA;;;;EAKA,QAAA,GAAW,MAAA,EAAQ,MAAA,KAAW,KAAA,CAAM,aAAA;EAEpC,OAAA,GAAU,aAAA;;;;EAKV,WAAA;;;;EAKA,KAAA;AAAA;AAAA,cAKW,aAAA,SAAsB,SAAA,CAAU,oBAAA;EAAA,mBACxB,gBAAA,EAAgB,gBAAA;EAAA,mBAChB,gBAAA,EAAgB,gBAAA;EAAA,UAEzB,WAAA,GAAc,aAAA;EAAA,UACd,gBAAA,SAAyB,OAAA,CAAQ,aAAA;EAAA,IAEhC,KAAA,CAAA,GAAS,aAAA;;;;EAOP,QAAA,CAAA,GAAY,OAAA,CAAQ,aAAA;EAAA,IActB,IAAA,CAAA;EAAA,IAIA,MAAA,CAAA,GAAU,eAAA;EAAA,IAOV,QAAA,CAAA;EAAA,IAQA,KAAA,CAAA;EAAA,IAYA,YAAA,CAAA;;;;;EAgBE,OAAA,CACX,YAAA,UACA,WAAA,YACC,OAAA,CAAQ,mBAAA;;;;;;;;;;EA8CE,IAAA,CACX,MAAA,EAAQ,MAAA,EACR,eAAA,GAAkB,MAAA,oBACjB,OAAA,CAAQ,WAAA;EAAA,UAsDD,kBAAA,CAAmB,OAAA,WAAkB,aAAA;EAYlC,OAAA,CAAA,GAAO,OAAA;AAAA;AAAA,KAsDV,WAAA;EAAyB,KAAA,QAAa,KAAA;AAAA;AAAA,UAEjC,UAAA;EACf,IAAA,IAAQ,IAAA,cAAkB,IAAA,EAAM,kBAAA,KAAuB,KAAA,CAAM,WAAA;AAAA;AAAA,UAG9C,WAAA;EACf,KAAA,IACE,QAAA,cACI,KAAA,EAAO,WAAA,KAAgB,KAAA,CAAM,WAAA;AAAA;;;;;;;;;;;;;;AR1gBrC;;;;;;;;;;;;;;;ACEA;;;cQsCa,UAAA,GACX,KAAA,EAAO,eAAA,GAAkB,UAAA,EACzB,OAAA,GAAS,OAAA,CAAQ,WAAA,MAAD,aAAA;;;;;;;;cC5BL,gBAAA,GACX,KAAA,EAAO,eAAA,GAAkB,WAAA,EACzB,OAAA,GAAS,OAAA,CAAQ,kBAAA,MAAD,aAAA;;;;;;;;;;;;;cCIL,aAAA,GACX,KAAA,EAAO,eAAA,GAAkB,UAAA,EACzB,OAAA,GAAS,OAAA,CAAQ,WAAA,MAAD,aAAA;;;;;;;;;;;;;;AXtBlB;;;;;;;;;;;;;;;ACEA;cWkCa,kBAAA,GACX,KAAA,EAAO,eAAA,GAAkB,UAAA,EACzB,OAAA,GAAS,OAAA,CAAQ,WAAA,MAAD,aAAA;;;;;;;;;;;;;cClBL,WAAA,GACX,KAAA,EAAO,eAAA,GAAkB,UAAA,EACzB,OAAA,GAAS,OAAA,CAAQ,WAAA,MAAD,aAAA;;;;;;;;;;;;;cCHL,WAAA,GACX,KAAA,EAAO,eAAA,GAAkB,UAAA,EACzB,OAAA,GAAS,OAAA,CAAQ,WAAA,MAAD,aAAA;;;;;;;;;;;;;;AdrBlB;;;;;;;;;;;ce+Ba,cAAA,GACX,KAAA,EAAO,eAAA,GAAkB,UAAA,EACzB,OAAA,GAAS,OAAA,CAAQ,WAAA,MAAD,aAAA;;;;;;AfjClB;;;;;;;;;;;;;;cgBqCa,gBAAA,EAAgB,QAAA,CAAA,OAAA,CAI3B,QAAA,CAJ2B,MAAA"}

package/dist/server/auth/index.js

@@ -1438,12 +1438,24 @@ var ServerAuthProvider = class {
 	dateTimeProvider = $inject(DateTimeProvider);
 	serverLinksProvider = $inject(ServerLinksProvider);
 	/**
-	* Validates that a redirect URI is a safe relative path.
-	* Prevents open redirect attacks by rejecting absolute URLs and protocol-relative URLs.
+	* Validates that a redirect URI is a safe relative path, or — when
+	* COOKIE_PARENT_DOMAIN is configured — an https URL whose host is the
+	* parent domain or a subdomain of it. Used by SaaS deployments where the
+	* OAuth callback dispatches users back to their tenant subdomain.
+	*
+	* Prevents open redirect attacks by rejecting any other absolute URL.
 	*/
 	validateRedirectUri(uri) {
-		if (!uri.startsWith("/") || uri.startsWith("//")) return "/";
-		return uri;
+		if (uri.startsWith("/") && !uri.startsWith("//")) return uri;
+		const parent = this.alepha.env.COOKIE_PARENT_DOMAIN;
+		if (typeof parent === "string" && parent) try {
+			const parsed = new URL(uri);
+			const parentHost = parent.startsWith(".") ? parent.slice(1) : parent;
+			if (parsed.protocol !== "https:") return "/";
+			if (parsed.host === parentHost) return uri;
+			if (parsed.host.endsWith(`.${parentHost}`)) return uri;
+		} catch {}
+		return "/";
 	}
 	get identities() {
 		return this.alepha.primitives($auth).filter((auth) => !auth.options.disabled);