antarctic 0.4.0 → 0.6.0

package/dist/auth.d.ts

@@ -1,8 +1,13 @@
+import type { OAuth2Tokens } from "./oauth2.js";
 export interface OAuthUser {
     id: string;
     name?: string | null;
     email?: string | null;
     image?: string | null;
+    raw?: Record<string, unknown>;
+    accessToken?: string;
+    refreshToken?: string | null;
+    scopes?: string[] | null;
 }
 export interface OAuthStateStore {
     get: (key: string) => Promise<any>;
@@ -51,6 +56,21 @@ export interface StoredOAuthState {
 }
 export declare function saveOAuthState(store: OAuthStateStore, state: string, payload: StoredOAuthState): Promise<void>;
 export declare function consumeOAuthState(store: OAuthStateStore, state: string): Promise<StoredOAuthState>;
+export interface AuthorizationRequest {
+    url: URL;
+    state: string;
+    payload: StoredOAuthState;
+}
+export interface SavedOAuthState {
+    state: string;
+    payload?: StoredOAuthState;
+}
+export declare function resolveOAuthState(store: OAuthStateStore, state: string, saved?: SavedOAuthState): Promise<StoredOAuthState>;
+export declare function extractOAuthTokens(tokens: OAuth2Tokens): {
+    accessToken: string;
+    refreshToken: string | null;
+    scopes: string[] | null;
+};
 export type OAuthCallbackQuery = string | URL | URLSearchParams | Record<string, string | string[] | undefined | null>;
 export declare function parseCallbackQuery(query: OAuthCallbackQuery): {
     code: string;

package/dist/auth.js

@@ -91,6 +91,26 @@ export async function consumeOAuthState(store, state) {
     await store.del(key);
     return payload;
 }
+// With `saved` the caller kept the state itself, so comparing it against the
+// value the provider echoed back is the CSRF check. Otherwise the store is.
+export async function resolveOAuthState(store, state, saved) {
+    if (saved !== undefined) {
+        if (saved.state !== state) {
+            throw new InvalidOAuthStateError();
+        }
+        return saved.payload ?? {};
+    }
+    return await consumeOAuthState(store, state);
+}
+// OAuth2Tokens throws on absent fields, and most providers omit the refresh
+// token and scopes unless they were asked for.
+export function extractOAuthTokens(tokens) {
+    return {
+        accessToken: tokens.accessToken(),
+        refreshToken: tokens.hasRefreshToken() ? tokens.refreshToken() : null,
+        scopes: tokens.hasScopes() ? tokens.scopes() : null
+    };
+}
 export function parseCallbackQuery(query) {
     let params;
     if (typeof query === "string") {

package/dist/index.d.ts

@@ -67,4 +67,4 @@ export { OAuth2Tokens, generateCodeVerifier, generateState } from "./oauth2.js";
 export { OAuth2RequestError, ArcticFetchError, UnexpectedErrorResponseBodyError, UnexpectedResponseError } from "./request.js";
 export { decodeIdToken } from "./oidc.js";
 export { InvalidOAuthCallbackError, InvalidOAuthStateError, OAuthConfigurationError, OAuthProviderError } from "./auth.js";
-export type { OAuthCallbackQuery, OAuthStateStore, OAuthUser, ProviderOptions } from "./auth.js";
+export type { AuthorizationRequest, OAuthCallbackQuery, OAuthStateStore, OAuthUser, ProviderOptions, SavedOAuthState, StoredOAuthState } from "./auth.js";

package/dist/providers/42.d.ts

@@ -1,5 +1,5 @@
 import type { OAuth2Tokens } from "../oauth2.js";
-import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+import type { AuthorizationRequest, OAuthCallbackQuery, OAuthUser, ProviderOptions, SavedOAuthState } from "../auth.js";
 export interface FortyTwoOptions extends ProviderOptions {
 }
 export declare class FortyTwo {
@@ -11,6 +11,6 @@ export declare class FortyTwo {
     constructor(clientId: string, clientSecret: string, redirectURI: string);
     createAuthorizationURL(state: string, scopes: string[]): URL;
     validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
-    getAuthorizationURL(scopes?: string[]): Promise<URL>;
-    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+    getAuthorizationURL(scopes?: string[]): Promise<AuthorizationRequest>;
+    getUser(query: OAuthCallbackQuery, saved?: SavedOAuthState): Promise<OAuthUser>;
 }

package/dist/providers/42.js

@@ -1,5 +1,5 @@
 import { createOAuth2Request, sendTokenRequest } from "../request.js";
-import { consumeOAuthState, fetchUserProfile, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+import { extractOAuthTokens, fetchUserProfile, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveOAuthState, resolveScopes, saveOAuthState } from "../auth.js";
 const authorizationEndpoint = "https://api.intra.42.fr/oauth/authorize";
 const tokenEndpoint = "https://api.intra.42.fr/oauth/token";
 const userEndpoint = "https://api.intra.42.fr/v2/me";
@@ -52,13 +52,14 @@ export class FortyTwo {
         const auth = requireAuthConfig(this.auth);
         const state = generateOAuthState();
         const url = this.createAuthorizationURL(state, resolveScopes(scopes, auth, defaultScopes));
-        await saveOAuthState(auth.store, state, {});
-        return url;
+        const payload = {};
+        await saveOAuthState(auth.store, state, payload);
+        return { url, state, payload };
     }
-    async getUser(query) {
+    async getUser(query, saved) {
         const auth = requireAuthConfig(this.auth);
         const { code, state } = parseCallbackQuery(query);
-        await consumeOAuthState(auth.store, state);
+        await resolveOAuthState(auth.store, state, saved);
         const tokens = await this.validateAuthorizationCode(code);
         const profile = await fetchUserProfile(userEndpoint, tokens.accessToken());
         let image = null;
@@ -69,7 +70,9 @@ export class FortyTwo {
             id: profileId(profile.id),
             name: profileString(profile.displayname) ?? profileString(profile.login),
             email: profileString(profile.email),
-            image
+            image,
+            raw: profile,
+            ...extractOAuthTokens(tokens)
         };
     }
 }

package/dist/providers/amazon-cognito.d.ts

@@ -1,5 +1,5 @@
 import type { OAuth2Tokens } from "../oauth2.js";
-import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+import type { AuthorizationRequest, OAuthCallbackQuery, OAuthUser, ProviderOptions, SavedOAuthState } from "../auth.js";
 export interface AmazonCognitoOptions extends ProviderOptions {
     domain?: string;
 }
@@ -16,6 +16,6 @@ export declare class AmazonCognito {
     validateAuthorizationCode(code: string, codeVerifier: string): Promise<OAuth2Tokens>;
     refreshAccessToken(refreshToken: string, scopes: string[]): Promise<OAuth2Tokens>;
     revokeToken(token: string): Promise<void>;
-    getAuthorizationURL(scopes?: string[]): Promise<URL>;
-    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+    getAuthorizationURL(scopes?: string[]): Promise<AuthorizationRequest>;
+    getUser(query: OAuthCallbackQuery, saved?: SavedOAuthState): Promise<OAuthUser>;
 }

package/dist/providers/amazon-cognito.js

@@ -1,6 +1,6 @@
 import { CodeChallengeMethod, OAuth2Client } from "../client.js";
 import { decodeIdToken } from "../oidc.js";
-import { consumeOAuthState, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, requireProviderOption, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+import { extractOAuthTokens, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, requireProviderOption, resolveAuthConfig, resolveOAuthState, resolveScopes, saveOAuthState } from "../auth.js";
 const envPrefix = "AMAZON_COGNITO";
 const defaultScopes = ["openid", "profile", "email"];
 export class AmazonCognito {
@@ -46,13 +46,14 @@ export class AmazonCognito {
         const state = generateOAuthState();
         const codeVerifier = generateOAuthCodeVerifier();
         const url = await this.createAuthorizationURL(state, codeVerifier, resolveScopes(scopes, auth, defaultScopes));
-        await saveOAuthState(auth.store, state, { codeVerifier });
-        return url;
+        const payload = { codeVerifier };
+        await saveOAuthState(auth.store, state, payload);
+        return { url, state, payload };
     }
-    async getUser(query) {
+    async getUser(query, saved) {
         const auth = requireAuthConfig(this.auth);
         const { code, state } = parseCallbackQuery(query);
-        const stored = await consumeOAuthState(auth.store, state);
+        const stored = await resolveOAuthState(auth.store, state, saved);
         if (typeof stored.codeVerifier !== "string") {
             throw new InvalidOAuthCallbackError("Missing PKCE code verifier for OAuth state");
         }
@@ -70,7 +71,9 @@ export class AmazonCognito {
                 profileString(claims["cognito:username"]) ??
                 profileString(claims.username),
             email: profileString(claims.email),
-            image: profileString(claims.picture)
+            image: profileString(claims.picture),
+            raw: claims,
+            ...extractOAuthTokens(tokens)
         };
     }
 }

package/dist/providers/anilist.d.ts

@@ -1,5 +1,5 @@
 import type { OAuth2Tokens } from "../oauth2.js";
-import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+import type { AuthorizationRequest, OAuthCallbackQuery, OAuthUser, ProviderOptions, SavedOAuthState } from "../auth.js";
 export interface AniListOptions extends ProviderOptions {
 }
 export declare class AniList {
@@ -9,6 +9,6 @@ export declare class AniList {
     constructor(clientId: string, clientSecret: string, redirectURI: string);
     createAuthorizationURL(state: string): URL;
     validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
-    getAuthorizationURL(): Promise<URL>;
-    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+    getAuthorizationURL(): Promise<AuthorizationRequest>;
+    getUser(query: OAuthCallbackQuery, saved?: SavedOAuthState): Promise<OAuthUser>;
 }

package/dist/providers/anilist.js

@@ -1,5 +1,5 @@
 import { OAuth2Client } from "../client.js";
-import { consumeOAuthState, generateOAuthState, OAuthProviderError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, saveOAuthState } from "../auth.js";
+import { extractOAuthTokens, generateOAuthState, OAuthProviderError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveOAuthState, saveOAuthState } from "../auth.js";
 const authorizationEndpoint = "https://anilist.co/api/v2/oauth/authorize";
 const tokenEndpoint = "https://anilist.co/api/v2/oauth/token";
 const graphqlEndpoint = "https://graphql.anilist.co";
@@ -31,13 +31,14 @@ export class AniList {
         const auth = requireAuthConfig(this.auth);
         const state = generateOAuthState();
         const url = this.createAuthorizationURL(state);
-        await saveOAuthState(auth.store, state, {});
-        return url;
+        const payload = {};
+        await saveOAuthState(auth.store, state, payload);
+        return { url, state, payload };
     }
-    async getUser(query) {
+    async getUser(query, saved) {
         const auth = requireAuthConfig(this.auth);
         const { code, state } = parseCallbackQuery(query);
-        await consumeOAuthState(auth.store, state);
+        await resolveOAuthState(auth.store, state, saved);
         const tokens = await this.validateAuthorizationCode(code);
         const viewer = await fetchViewer(tokens.accessToken());
         let image = null;
@@ -48,7 +49,9 @@ export class AniList {
             id: profileId(viewer.id),
             name: profileString(viewer.name),
             email: null,
-            image
+            image,
+            raw: viewer,
+            ...extractOAuthTokens(tokens)
         };
     }
 }

package/dist/providers/apple.d.ts

@@ -1,5 +1,5 @@
 import type { OAuth2Tokens } from "../oauth2.js";
-import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+import type { AuthorizationRequest, OAuthCallbackQuery, OAuthUser, ProviderOptions, SavedOAuthState } from "../auth.js";
 export interface AppleOptions extends ProviderOptions {
     teamId?: string;
     keyId?: string;
@@ -16,7 +16,7 @@ export declare class Apple {
     constructor(clientId: string, teamId: string, keyId: string, pkcs8PrivateKey: Uint8Array, redirectURI: string);
     createAuthorizationURL(state: string, scopes: string[]): URL;
     validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
-    getAuthorizationURL(scopes?: string[]): Promise<URL>;
-    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+    getAuthorizationURL(scopes?: string[]): Promise<AuthorizationRequest>;
+    getUser(query: OAuthCallbackQuery, saved?: SavedOAuthState): Promise<OAuthUser>;
     private createClientSecret;
 }

package/dist/providers/apple.js

@@ -1,7 +1,7 @@
 import { createJWTSignatureMessage, encodeJWT } from "../jwt.js";
 import { createOAuth2Request, sendTokenRequest } from "../request.js";
 import { decodeIdToken } from "../oidc.js";
-import { consumeOAuthState, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, requireProviderOption, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+import { extractOAuthTokens, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, requireProviderOption, resolveAuthConfig, resolveOAuthState, resolveScopes, saveOAuthState } from "../auth.js";
 const authorizationEndpoint = "https://appleid.apple.com/auth/authorize";
 const tokenEndpoint = "https://appleid.apple.com/auth/token";
 const envPrefix = "APPLE";
@@ -62,20 +62,23 @@ export class Apple {
         if (resolvedScopes.length > 0) {
             url.searchParams.set("response_mode", "form_post");
         }
-        await saveOAuthState(auth.store, state, {});
-        return url;
+        const payload = {};
+        await saveOAuthState(auth.store, state, payload);
+        return { url, state, payload };
     }
-    async getUser(query) {
+    async getUser(query, saved) {
         const auth = requireAuthConfig(this.auth);
         const { code, state } = parseCallbackQuery(query);
-        await consumeOAuthState(auth.store, state);
+        await resolveOAuthState(auth.store, state, saved);
         const tokens = await this.validateAuthorizationCode(code);
         const claims = decodeIdToken(tokens.idToken());
         return {
             id: profileId(claims.sub),
             name: null,
             email: profileString(claims.email),
-            image: null
+            image: null,
+            raw: claims,
+            ...extractOAuthTokens(tokens)
         };
     }
     async createClientSecret() {

package/dist/providers/atlassian.d.ts

@@ -1,5 +1,5 @@
 import type { OAuth2Tokens } from "../oauth2.js";
-import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+import type { AuthorizationRequest, OAuthCallbackQuery, OAuthUser, ProviderOptions, SavedOAuthState } from "../auth.js";
 export interface AtlassianOptions extends ProviderOptions {
 }
 export declare class Atlassian {
@@ -12,6 +12,6 @@ export declare class Atlassian {
     createAuthorizationURL(state: string, scopes: string[]): URL;
     validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
     refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
-    getAuthorizationURL(scopes?: string[]): Promise<URL>;
-    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+    getAuthorizationURL(scopes?: string[]): Promise<AuthorizationRequest>;
+    getUser(query: OAuthCallbackQuery, saved?: SavedOAuthState): Promise<OAuthUser>;
 }

package/dist/providers/atlassian.js

@@ -1,5 +1,5 @@
 import { createOAuth2Request, sendTokenRequest } from "../request.js";
-import { consumeOAuthState, fetchUserProfile, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+import { extractOAuthTokens, fetchUserProfile, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveOAuthState, resolveScopes, saveOAuthState } from "../auth.js";
 const authorizationEndpoint = "https://auth.atlassian.com/authorize";
 const tokenEndpoint = "https://auth.atlassian.com/oauth/token";
 const userEndpoint = "https://api.atlassian.com/me";
@@ -64,20 +64,23 @@ export class Atlassian {
         const auth = requireAuthConfig(this.auth);
         const state = generateOAuthState();
         const url = this.createAuthorizationURL(state, resolveScopes(scopes, auth, defaultScopes));
-        await saveOAuthState(auth.store, state, {});
-        return url;
+        const payload = {};
+        await saveOAuthState(auth.store, state, payload);
+        return { url, state, payload };
     }
-    async getUser(query) {
+    async getUser(query, saved) {
         const auth = requireAuthConfig(this.auth);
         const { code, state } = parseCallbackQuery(query);
-        await consumeOAuthState(auth.store, state);
+        await resolveOAuthState(auth.store, state, saved);
         const tokens = await this.validateAuthorizationCode(code);
         const profile = await fetchUserProfile(userEndpoint, tokens.accessToken());
         return {
             id: profileId(profile.account_id),
             name: profileString(profile.name) ?? profileString(profile.nickname),
             email: profileString(profile.email),
-            image: profileString(profile.picture)
+            image: profileString(profile.picture),
+            raw: profile,
+            ...extractOAuthTokens(tokens)
         };
     }
 }

package/dist/providers/auth0.d.ts

@@ -1,5 +1,5 @@
 import type { OAuth2Tokens } from "../oauth2.js";
-import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+import type { AuthorizationRequest, OAuthCallbackQuery, OAuthUser, ProviderOptions, SavedOAuthState } from "../auth.js";
 export interface Auth0Options extends ProviderOptions {
     domain?: string;
 }
@@ -16,6 +16,6 @@ export declare class Auth0 {
     validateAuthorizationCode(code: string, codeVerifier: string | null): Promise<OAuth2Tokens>;
     refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
     revokeToken(token: string): Promise<void>;
-    getAuthorizationURL(scopes?: string[]): Promise<URL>;
-    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+    getAuthorizationURL(scopes?: string[]): Promise<AuthorizationRequest>;
+    getUser(query: OAuthCallbackQuery, saved?: SavedOAuthState): Promise<OAuthUser>;
 }

package/dist/providers/auth0.js

@@ -1,6 +1,6 @@
 import { CodeChallengeMethod, OAuth2Client } from "../client.js";
 import { decodeIdToken } from "../oidc.js";
-import { consumeOAuthState, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, requireProviderOption, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+import { extractOAuthTokens, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, requireProviderOption, resolveAuthConfig, resolveOAuthState, resolveScopes, saveOAuthState } from "../auth.js";
 const envPrefix = "AUTH0";
 const defaultScopes = ["openid", "profile", "email"];
 export class Auth0 {
@@ -52,13 +52,14 @@ export class Auth0 {
         const state = generateOAuthState();
         const codeVerifier = generateOAuthCodeVerifier();
         const url = await this.createAuthorizationURL(state, codeVerifier, resolveScopes(scopes, auth, defaultScopes));
-        await saveOAuthState(auth.store, state, { codeVerifier });
-        return url;
+        const payload = { codeVerifier };
+        await saveOAuthState(auth.store, state, payload);
+        return { url, state, payload };
     }
-    async getUser(query) {
+    async getUser(query, saved) {
         const auth = requireAuthConfig(this.auth);
         const { code, state } = parseCallbackQuery(query);
-        const stored = await consumeOAuthState(auth.store, state);
+        const stored = await resolveOAuthState(auth.store, state, saved);
         if (typeof stored.codeVerifier !== "string") {
             throw new InvalidOAuthCallbackError("Missing PKCE code verifier for OAuth state");
         }
@@ -74,7 +75,9 @@ export class Auth0 {
             id: profileId(claims.sub),
             name: profileString(claims.name) ?? profileString(claims.nickname),
             email: profileString(claims.email),
-            image: profileString(claims.picture)
+            image: profileString(claims.picture),
+            raw: claims,
+            ...extractOAuthTokens(tokens)
         };
     }
 }

package/dist/providers/authentik.d.ts

@@ -1,5 +1,5 @@
 import type { OAuth2Tokens } from "../oauth2.js";
-import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+import type { AuthorizationRequest, OAuthCallbackQuery, OAuthUser, ProviderOptions, SavedOAuthState } from "../auth.js";
 export interface AuthentikOptions extends ProviderOptions {
     baseURL?: string;
 }
@@ -16,6 +16,6 @@ export declare class Authentik {
     validateAuthorizationCode(code: string, codeVerifier: string): Promise<OAuth2Tokens>;
     refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
     revokeToken(token: string): Promise<void>;
-    getAuthorizationURL(scopes?: string[]): Promise<URL>;
-    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+    getAuthorizationURL(scopes?: string[]): Promise<AuthorizationRequest>;
+    getUser(query: OAuthCallbackQuery, saved?: SavedOAuthState): Promise<OAuthUser>;
 }

package/dist/providers/authentik.js

@@ -1,7 +1,7 @@
 import { CodeChallengeMethod, OAuth2Client } from "../client.js";
 import { joinURIAndPath } from "../request.js";
 import { decodeIdToken } from "../oidc.js";
-import { consumeOAuthState, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, requireProviderOption, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+import { extractOAuthTokens, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, requireProviderOption, resolveAuthConfig, resolveOAuthState, resolveScopes, saveOAuthState } from "../auth.js";
 const envPrefix = "AUTHENTIK";
 const defaultScopes = ["openid", "profile", "email"];
 export class Authentik {
@@ -47,13 +47,14 @@ export class Authentik {
         const state = generateOAuthState();
         const codeVerifier = generateOAuthCodeVerifier();
         const url = await this.createAuthorizationURL(state, codeVerifier, resolveScopes(scopes, auth, defaultScopes));
-        await saveOAuthState(auth.store, state, { codeVerifier });
-        return url;
+        const payload = { codeVerifier };
+        await saveOAuthState(auth.store, state, payload);
+        return { url, state, payload };
     }
-    async getUser(query) {
+    async getUser(query, saved) {
         const auth = requireAuthConfig(this.auth);
         const { code, state } = parseCallbackQuery(query);
-        const stored = await consumeOAuthState(auth.store, state);
+        const stored = await resolveOAuthState(auth.store, state, saved);
         if (typeof stored.codeVerifier !== "string") {
             throw new InvalidOAuthCallbackError("Missing PKCE code verifier for OAuth state");
         }
@@ -69,7 +70,9 @@ export class Authentik {
             id: profileId(claims.sub),
             name: profileString(claims.name) ?? profileString(claims.preferred_username),
             email: profileString(claims.email),
-            image: profileString(claims.picture)
+            image: profileString(claims.picture),
+            raw: claims,
+            ...extractOAuthTokens(tokens)
         };
     }
 }

package/dist/providers/autodesk.d.ts

@@ -1,5 +1,5 @@
 import type { OAuth2Tokens } from "../oauth2.js";
-import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+import type { AuthorizationRequest, OAuthCallbackQuery, OAuthUser, ProviderOptions, SavedOAuthState } from "../auth.js";
 export interface AutodeskOptions extends ProviderOptions {
 }
 export declare class Autodesk {
@@ -11,6 +11,6 @@ export declare class Autodesk {
     validateAuthorizationCode(code: string, codeVerifier: string): Promise<OAuth2Tokens>;
     refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
     revokeToken(token: string): Promise<void>;
-    getAuthorizationURL(scopes?: string[]): Promise<URL>;
-    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+    getAuthorizationURL(scopes?: string[]): Promise<AuthorizationRequest>;
+    getUser(query: OAuthCallbackQuery, saved?: SavedOAuthState): Promise<OAuthUser>;
 }

package/dist/providers/autodesk.js

@@ -1,5 +1,5 @@
 import { CodeChallengeMethod, OAuth2Client } from "../client.js";
-import { consumeOAuthState, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+import { extractOAuthTokens, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveOAuthState, resolveScopes, saveOAuthState } from "../auth.js";
 const authorizationEndpoint = "https://developer.api.autodesk.com/authentication/v2/authorize";
 const tokenEndpoint = "https://developer.api.autodesk.com/authentication/v2/token";
 const tokenRevocationEndpoint = "https://developer.api.autodesk.com/authentication/v2/revoke";
@@ -38,13 +38,14 @@ export class Autodesk {
         const state = generateOAuthState();
         const codeVerifier = generateOAuthCodeVerifier();
         const url = await this.createAuthorizationURL(state, codeVerifier, resolveScopes(scopes, auth, defaultScopes));
-        await saveOAuthState(auth.store, state, { codeVerifier });
-        return url;
+        const payload = { codeVerifier };
+        await saveOAuthState(auth.store, state, payload);
+        return { url, state, payload };
     }
-    async getUser(query) {
+    async getUser(query, saved) {
         const auth = requireAuthConfig(this.auth);
         const { code, state } = parseCallbackQuery(query);
-        const stored = await consumeOAuthState(auth.store, state);
+        const stored = await resolveOAuthState(auth.store, state, saved);
         if (typeof stored.codeVerifier !== "string") {
             throw new InvalidOAuthCallbackError("Missing PKCE code verifier for OAuth state");
         }
@@ -54,7 +55,9 @@ export class Autodesk {
             id: profileId(claims.sub),
             name: profileString(claims.name) ?? profileString(claims.preferred_username),
             email: profileString(claims.email),
-            image: profileString(claims.picture)
+            image: profileString(claims.picture),
+            raw: claims,
+            ...extractOAuthTokens(tokens)
         };
     }
 }

package/dist/providers/battlenet.d.ts

@@ -1,5 +1,5 @@
 import type { OAuth2Tokens } from "../oauth2.js";
-import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+import type { AuthorizationRequest, OAuthCallbackQuery, OAuthUser, ProviderOptions, SavedOAuthState } from "../auth.js";
 export interface BattleNetOptions extends ProviderOptions {
 }
 export declare class BattleNet {
@@ -11,6 +11,6 @@ export declare class BattleNet {
     constructor(clientId: string, clientSecret: string, redirectURI: string);
     createAuthorizationURL(state: string, scopes: string[]): URL;
     validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
-    getAuthorizationURL(scopes?: string[]): Promise<URL>;
-    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+    getAuthorizationURL(scopes?: string[]): Promise<AuthorizationRequest>;
+    getUser(query: OAuthCallbackQuery, saved?: SavedOAuthState): Promise<OAuthUser>;
 }

package/dist/providers/battlenet.js

@@ -1,5 +1,5 @@
 import { createOAuth2Request, sendTokenRequest } from "../request.js";
-import { consumeOAuthState, fetchUserProfile, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+import { extractOAuthTokens, fetchUserProfile, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveOAuthState, resolveScopes, saveOAuthState } from "../auth.js";
 const authorizationEndpoint = "https://oauth.battle.net/authorize";
 const tokenEndpoint = "https://oauth.battle.net/token";
 const userinfoEndpoint = "https://oauth.battle.net/userinfo";
@@ -50,20 +50,23 @@ export class BattleNet {
         const auth = requireAuthConfig(this.auth);
         const state = generateOAuthState();
         const url = this.createAuthorizationURL(state, resolveScopes(scopes, auth, defaultScopes));
-        await saveOAuthState(auth.store, state, {});
-        return url;
+        const payload = {};
+        await saveOAuthState(auth.store, state, payload);
+        return { url, state, payload };
     }
-    async getUser(query) {
+    async getUser(query, saved) {
         const auth = requireAuthConfig(this.auth);
         const { code, state } = parseCallbackQuery(query);
-        await consumeOAuthState(auth.store, state);
+        await resolveOAuthState(auth.store, state, saved);
         const tokens = await this.validateAuthorizationCode(code);
         const profile = await fetchUserProfile(userinfoEndpoint, tokens.accessToken());
         return {
             id: profileId(profile.sub),
             name: profileString(profile.battletag),
             email: null,
-            image: null
+            image: null,
+            raw: profile,
+            ...extractOAuthTokens(tokens)
         };
     }
 }

package/dist/providers/bitbucket.d.ts

@@ -1,5 +1,5 @@
 import type { OAuth2Tokens } from "../oauth2.js";
-import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+import type { AuthorizationRequest, OAuthCallbackQuery, OAuthUser, ProviderOptions, SavedOAuthState } from "../auth.js";
 export interface BitbucketOptions extends ProviderOptions {
 }
 export declare class Bitbucket {
@@ -10,6 +10,6 @@ export declare class Bitbucket {
     createAuthorizationURL(state: string): URL;
     validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
     refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
-    getAuthorizationURL(): Promise<URL>;
-    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+    getAuthorizationURL(): Promise<AuthorizationRequest>;
+    getUser(query: OAuthCallbackQuery, saved?: SavedOAuthState): Promise<OAuthUser>;
 }

package/dist/providers/bitbucket.js

@@ -1,5 +1,5 @@
 import { OAuth2Client } from "../client.js";
-import { consumeOAuthState, fetchUserProfile, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, saveOAuthState } from "../auth.js";
+import { extractOAuthTokens, fetchUserProfile, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveOAuthState, saveOAuthState } from "../auth.js";
 const authorizationEndpoint = "https://bitbucket.org/site/oauth2/authorize";
 const tokenEndpoint = "https://bitbucket.org/site/oauth2/access_token";
 const userEndpoint = "https://api.bitbucket.org/2.0/user";
@@ -36,13 +36,14 @@ export class Bitbucket {
         const auth = requireAuthConfig(this.auth);
         const state = generateOAuthState();
         const url = this.createAuthorizationURL(state);
-        await saveOAuthState(auth.store, state, {});
-        return url;
+        const payload = {};
+        await saveOAuthState(auth.store, state, payload);
+        return { url, state, payload };
     }
-    async getUser(query) {
+    async getUser(query, saved) {
         const auth = requireAuthConfig(this.auth);
         const { code, state } = parseCallbackQuery(query);
-        await consumeOAuthState(auth.store, state);
+        await resolveOAuthState(auth.store, state, saved);
         const tokens = await this.validateAuthorizationCode(code);
         const accessToken = tokens.accessToken();
         const profile = await fetchUserProfile(userEndpoint, accessToken);
@@ -57,7 +58,9 @@ export class Bitbucket {
             id: profileId(profile.uuid ?? profile.account_id),
             name: profileString(profile.display_name) ?? profileString(profile.username),
             email: await fetchPrimaryEmail(accessToken),
-            image
+            image,
+            raw: profile,
+            ...extractOAuthTokens(tokens)
         };
     }
 }

package/dist/providers/box.d.ts

@@ -1,5 +1,5 @@
 import type { OAuth2Tokens } from "../oauth2.js";
-import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+import type { AuthorizationRequest, OAuthCallbackQuery, OAuthUser, ProviderOptions, SavedOAuthState } from "../auth.js";
 export interface BoxOptions extends ProviderOptions {
 }
 export declare class Box {
@@ -13,6 +13,6 @@ export declare class Box {
     validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
     refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
     revokeToken(token: string): Promise<void>;
-    getAuthorizationURL(scopes?: string[]): Promise<URL>;
-    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+    getAuthorizationURL(scopes?: string[]): Promise<AuthorizationRequest>;
+    getUser(query: OAuthCallbackQuery, saved?: SavedOAuthState): Promise<OAuthUser>;
 }