covara 0.0.1 → 0.6.0

package/dist/oidc/keys/jwk.js

@@ -0,0 +1,171 @@
+import * as crypto from "node:crypto";
+import jwt from "jsonwebtoken";
+const generateKeyId = () => {
+    return crypto.randomBytes(16).toString("hex");
+};
+const generateRSAKeyPair = async (algorithm) => {
+    return new Promise((resolve, reject) => {
+        const modulusLength = algorithm.includes("384") ? 3072 : 2048;
+        crypto.generateKeyPair("rsa", {
+            modulusLength,
+            publicKeyEncoding: { type: "spki", format: "pem" },
+            privateKeyEncoding: { type: "pkcs8", format: "pem" },
+        }, (err, publicKey, privateKey) => {
+            if (err)
+                reject(err);
+            else
+                resolve({ publicKey, privateKey });
+        });
+    });
+};
+const generateECKeyPair = async (algorithm) => {
+    const namedCurve = algorithm === "ES256"
+        ? "prime256v1"
+        : algorithm === "ES384"
+            ? "secp384r1"
+            : "secp521r1";
+    return new Promise((resolve, reject) => {
+        crypto.generateKeyPair("ec", {
+            namedCurve,
+            publicKeyEncoding: { type: "spki", format: "pem" },
+            privateKeyEncoding: { type: "pkcs8", format: "pem" },
+        }, (err, publicKey, privateKey) => {
+            if (err)
+                reject(err);
+            else
+                resolve({ publicKey, privateKey });
+        });
+    });
+};
+const rsaPublicKeyToJWK = (publicKey, kid, alg) => {
+    const keyObject = crypto.createPublicKey(publicKey);
+    const exported = keyObject.export({ format: "jwk" });
+    return {
+        kty: "RSA",
+        use: "sig",
+        alg,
+        kid,
+        n: exported.n,
+        e: exported.e,
+    };
+};
+const ecPublicKeyToJWK = (publicKey, kid, alg) => {
+    const keyObject = crypto.createPublicKey(publicKey);
+    const exported = keyObject.export({ format: "jwk" });
+    return {
+        kty: "EC",
+        use: "sig",
+        alg,
+        kid,
+        x: exported.x,
+        y: exported.y,
+        crv: exported.crv,
+    };
+};
+export const createKeyManager = (config) => {
+    const algorithm = config.algorithm ?? "RS256";
+    const isEC = algorithm.startsWith("ES");
+    const keys = new Map();
+    let currentKeyId;
+    let initialized = false;
+    let initPromise = null;
+    const initialize = async () => {
+        if (initialized)
+            return;
+        if (initPromise)
+            return initPromise;
+        initPromise = (async () => {
+            if (config.privateKey) {
+                const privateKey = typeof config.privateKey === "string"
+                    ? config.privateKey
+                    : config.privateKey.toString("utf-8");
+                const publicKey = config.publicKey
+                    ? typeof config.publicKey === "string"
+                        ? config.publicKey
+                        : config.publicKey.toString("utf-8")
+                    : crypto.createPublicKey(privateKey).export({
+                        type: "spki",
+                        format: "pem",
+                    });
+                const kid = config.keyId ?? generateKeyId();
+                keys.set(kid, { privateKey, publicKey, kid, alg: algorithm });
+                currentKeyId = kid;
+            }
+            else {
+                await rotateKeys();
+            }
+            initialized = true;
+        })();
+        return initPromise;
+    };
+    const rotateKeys = async () => {
+        const { privateKey, publicKey } = isEC
+            ? await generateECKeyPair(algorithm)
+            : await generateRSAKeyPair(algorithm);
+        const kid = generateKeyId();
+        keys.set(kid, { privateKey, publicKey, kid, alg: algorithm });
+        const oldKeyId = currentKeyId;
+        currentKeyId = kid;
+        if (keys.size > 2 && oldKeyId) {
+            const keysArray = Array.from(keys.keys());
+            const oldestKey = keysArray.find((k) => k !== currentKeyId && k !== oldKeyId);
+            if (oldestKey) {
+                keys.delete(oldestKey);
+            }
+        }
+    };
+    const getCurrentKey = async () => {
+        await initialize();
+        return keys.get(currentKeyId);
+    };
+    const getPublicKeys = async () => {
+        await initialize();
+        return Array.from(keys.values()).map((kp) => isEC
+            ? ecPublicKeyToJWK(kp.publicKey, kp.kid, kp.alg)
+            : rsaPublicKeyToJWK(kp.publicKey, kp.kid, kp.alg));
+    };
+    const signToken = async (payload) => {
+        await initialize();
+        const key = keys.get(currentKeyId);
+        return jwt.sign(payload, key.privateKey, {
+            algorithm: algorithm,
+            keyid: key.kid,
+        });
+    };
+    const verifyToken = async (token) => {
+        await initialize();
+        const decoded = jwt.decode(token, { complete: true });
+        if (!decoded?.header) {
+            throw new Error("Invalid token format");
+        }
+        const kid = decoded.header.kid;
+        let keyPair;
+        if (kid) {
+            keyPair = keys.get(kid);
+        }
+        if (!keyPair) {
+            keyPair = keys.get(currentKeyId);
+        }
+        if (!keyPair) {
+            throw new Error("No valid key found for token verification");
+        }
+        return jwt.verify(token, keyPair.publicKey, {
+            algorithms: [algorithm],
+        });
+    };
+    const getKeyId = () => currentKeyId;
+    const getAlgorithm = () => algorithm;
+    if (config.rotationIntervalMs) {
+        setInterval(() => rotateKeys(), config.rotationIntervalMs);
+    }
+    return {
+        getCurrentKey,
+        getPublicKeys,
+        signToken,
+        verifyToken,
+        rotateKeys,
+        getKeyId,
+        getAlgorithm,
+    };
+};
+//# sourceMappingURL=jwk.js.map

package/dist/oidc/keys/jwk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwk.js","sourceRoot":"","sources":["../../../src/oidc/keys/jwk.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,GAAG,MAAM,cAAc,CAAC;AAG/B,MAAM,aAAa,GAAG,GAAW,EAAE;IACjC,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,KAAK,EAC9B,SAAoB,EACgC,EAAE;IACtD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9D,MAAM,CAAC,eAAe,CACpB,KAAK,EACL;YACE,aAAa;YACb,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;YAClD,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;SACrD,EACD,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE;YAC7B,IAAI,GAAG;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;gBAChB,OAAO,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;QAC1C,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,KAAK,EAC7B,SAAoB,EACgC,EAAE;IACtD,MAAM,UAAU,GACd,SAAS,KAAK,OAAO;QACnB,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,SAAS,KAAK,OAAO;YACrB,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,WAAW,CAAC;IAEpB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,eAAe,CACpB,IAAI,EACJ;YACE,UAAU;YACV,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;YAClD,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;SACrD,EACD,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE;YAC7B,IAAI,GAAG;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;gBAChB,OAAO,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;QAC1C,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,SAAiB,EAAE,GAAW,EAAE,GAAW,EAAO,EAAE;IAC7E,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAErD,OAAO;QACL,GAAG,EAAE,KAAK;QACV,GAAG,EAAE,KAAK;QACV,GAAG;QACH,GAAG;QACH,CAAC,EAAE,QAAQ,CAAC,CAAW;QACvB,CAAC,EAAE,QAAQ,CAAC,CAAW;KACxB,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,SAAiB,EAAE,GAAW,EAAE,GAAW,EAAO,EAAE;IAC5E,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAErD,OAAO;QACL,GAAG,EAAE,IAAI;QACT,GAAG,EAAE,KAAK;QACV,GAAG;QACH,GAAG;QACH,CAAC,EAAE,QAAQ,CAAC,CAAW;QACvB,CAAC,EAAE,QAAQ,CAAC,CAAW;QACvB,GAAG,EAAE,QAAQ,CAAC,GAAa;KAC5B,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAiB,EAAc,EAAE;IAChE,MAAM,SAAS,GAAc,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC;IACzD,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAmB,CAAC;IACxC,IAAI,YAAoB,CAAC;IACzB,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,WAAW,GAAyB,IAAI,CAAC;IAE7C,MAAM,UAAU,GAAG,KAAK,IAAmB,EAAE;QAC3C,IAAI,WAAW;YAAE,OAAO;QACxB,IAAI,WAAW;YAAE,OAAO,WAAW,CAAC;QAEpC,WAAW,GAAG,CAAC,KAAK,IAAI,EAAE;YACxB,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBACtB,MAAM,UAAU,GACd,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;oBACnC,CAAC,CAAC,MAAM,CAAC,UAAU;oBACnB,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAC1C,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS;oBAChC,CAAC,CAAC,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;wBACpC,CAAC,CAAC,MAAM,CAAC,SAAS;wBAClB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;oBACtC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;wBACxC,IAAI,EAAE,MAAM;wBACZ,MAAM,EAAE,KAAK;qBACd,CAAW,CAAC;gBAEjB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,IAAI,aAAa,EAAE,CAAC;gBAC5C,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC9D,YAAY,GAAG,GAAG,CAAC;YACrB,CAAC;iBAAM,CAAC;gBACN,MAAM,UAAU,EAAE,CAAC;YACrB,CAAC;YACD,WAAW,GAAG,IAAI,CAAC;QACrB,CAAC,CAAC,EAAE,CAAC;QAEL,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,KAAK,IAAmB,EAAE;QAC3C,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,IAAI;YACpC,CAAC,CAAC,MAAM,iBAAiB,CAAC,SAAS,CAAC;YACpC,CAAC,CAAC,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAExC,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;QAE9D,MAAM,QAAQ,GAAG,YAAY,CAAC;QAC9B,YAAY,GAAG,GAAG,CAAC;QAEnB,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC;YAC9B,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1C,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,YAAY,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC;YAC9E,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,aAAa,GAAG,KAAK,IAAsB,EAAE;QACjD,MAAM,UAAU,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,CAAE,CAAC;IACjC,CAAC,CAAC;IAEF,MAAM,aAAa,GAAG,KAAK,IAAoB,EAAE;QAC/C,MAAM,UAAU,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAC1C,IAAI;YACF,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC;YAChD,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,CACpD,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,KAAK,EAAE,OAAgC,EAAmB,EAAE;QAC5E,MAAM,UAAU,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAE,CAAC;QACpC,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,UAAU,EAAE;YACvC,SAAS,EAAE,SAA0B;YACrC,KAAK,EAAE,GAAG,CAAC,GAAG;SACf,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,KAAK,EAAE,KAAa,EAAoC,EAAE;QAC5E,MAAM,UAAU,EAAE,CAAC;QAEnB,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAE5C,CAAC;QACT,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;QAC/B,IAAI,OAA4B,CAAC;QAEjC,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QAED,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE;YAC1C,UAAU,EAAE,CAAC,SAA0B,CAAC;SACzC,CAA4B,CAAC;IAChC,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,GAAW,EAAE,CAAC,YAAY,CAAC;IAC5C,MAAM,YAAY,GAAG,GAAc,EAAE,CAAC,SAAS,CAAC;IAEhD,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAC9B,WAAW,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO;QACL,aAAa;QACb,aAAa;QACb,SAAS;QACT,WAAW;QACX,UAAU;QACV,QAAQ;QACR,YAAY;KACb,CAAC;AACJ,CAAC,CAAC"}

package/dist/oidc/provider.d.ts

@@ -0,0 +1,10 @@
+import { Hono, type MiddlewareHandler } from "hono";
+import { OIDCProviderConfig, OIDCProviderStores, TokenService } from "./types.js";
+export interface OIDCProviderResult {
+    router: Hono;
+    middleware: MiddlewareHandler;
+    stores: OIDCProviderStores;
+    tokenService: TokenService;
+}
+export declare const createOIDCProvider: (config: OIDCProviderConfig) => OIDCProviderResult;
+//# sourceMappingURL=provider.d.ts.map

package/dist/oidc/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../src/oidc/provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,KAAK,iBAAiB,EAAE,MAAM,MAAM,CAAC;AACpD,OAAO,EAGL,kBAAkB,EAClB,kBAAkB,EAElB,YAAY,EACb,MAAM,SAAS,CAAC;AAoBjB,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,IAAI,CAAC;IACb,UAAU,EAAE,iBAAiB,CAAC;IAC9B,MAAM,EAAE,kBAAkB,CAAC;IAC3B,YAAY,EAAE,YAAY,CAAC;CAC5B;AAED,eAAO,MAAM,kBAAkB,GAAI,QAAQ,kBAAkB,KAAG,kBA6M/D,CAAC"}

package/dist/oidc/provider.js

@@ -0,0 +1,152 @@
+import { Hono } from "hono";
+import { createKeyManager } from "./keys/index.js";
+import { createTokenService } from "./tokens/index.js";
+import { generateDiscoveryDocument } from "./discovery.js";
+import { createStores } from "./stores/index.js";
+import { createAuthorizeEndpoint, createTokenEndpoint, createUserInfoEndpoint, createJWKSEndpoint, createLogoutEndpoint, createRevocationEndpoint, createIntrospectionEndpoint, } from "./endpoints/index.js";
+import { createRegisterEndpoint } from "./endpoints/register.js";
+import { createOIDCRateLimiter } from "./rate-limit.js";
+import { createLoginHandler, createConsentHandler } from "./ui/index.js";
+import { createEmailPasswordBackend, createFederatedBackend } from "./backends/index.js";
+import { InMemorySessionStore } from "../auth/types.js";
+export const createOIDCProvider = (config) => {
+    const keyManager = createKeyManager(config.keys);
+    const clients = Array.isArray(config.clients)
+        ? config.clients
+        : [];
+    const stores = createStores(config.stores, clients);
+    if (Array.isArray(config.clients)) {
+        for (const client of config.clients) {
+            stores.clients.set(client);
+        }
+    }
+    const tokenService = createTokenService(config, keyManager, stores.refreshTokens);
+    const sessionStore = config.stores?.sessionStore ?? new InMemorySessionStore();
+    const backends = [];
+    const findUserById = async (id) => {
+        if (config.backends.emailPassword?.findUserById) {
+            return config.backends.emailPassword.findUserById(id);
+        }
+        return null;
+    };
+    if (config.backends.emailPassword?.enabled) {
+        backends.push(createEmailPasswordBackend(config.backends.emailPassword));
+    }
+    if (config.backends.federated && config.backends.federated.length > 0) {
+        backends.push(createFederatedBackend({
+            providers: config.backends.federated,
+            baseUrl: config.baseUrl ?? config.issuer,
+            stateStore: stores.state,
+            findUserByAccount: async (_provider, _providerAccountId) => null,
+            createUser: async (userInfo, _provider) => ({
+                id: userInfo.sub,
+                email: userInfo.email,
+                emailVerified: userInfo.email_verified,
+                name: userInfo.name,
+                givenName: userInfo.given_name,
+                familyName: userInfo.family_name,
+                picture: userInfo.picture,
+            }),
+        }));
+    }
+    const router = new Hono();
+    router.get("/.well-known/openid-configuration", (c) => {
+        return c.json(generateDiscoveryDocument(config));
+    });
+    const rl = config.security?.rateLimiting;
+    if (rl?.jwks) {
+        router.use("/jwks", createOIDCRateLimiter({ ...rl.jwks, prefix: "jwks" }));
+    }
+    if (rl?.token) {
+        router.use("/token", createOIDCRateLimiter({ ...rl.token, prefix: "token" }));
+    }
+    if (rl?.introspect) {
+        router.use("/introspect", createOIDCRateLimiter({ ...rl.introspect, prefix: "introspect" }));
+    }
+    router.route("/jwks", createJWKSEndpoint(keyManager));
+    router.route("/authorize", createAuthorizeEndpoint({
+        config,
+        stores,
+        sessionStore,
+        findUserById,
+    }));
+    router.route("/token", createTokenEndpoint({
+        config,
+        stores,
+        tokenService,
+        findUserById,
+    }));
+    router.route("/userinfo", createUserInfoEndpoint({
+        config,
+        tokenService,
+        findUserById,
+    }));
+    router.route("/logout", createLogoutEndpoint({
+        config,
+        stores,
+        tokenService,
+        sessionStore,
+    }));
+    router.route("/revoke", createRevocationEndpoint({
+        stores,
+        tokenService,
+    }));
+    router.route("/introspect", createIntrospectionEndpoint({
+        stores,
+        tokenService,
+    }));
+    router.route(config.ui?.loginPath ?? "/login", createLoginHandler({
+        config,
+        stores,
+        backends,
+        sessionStore,
+    }));
+    router.route(config.ui?.consentPath ?? "/consent", createConsentHandler({
+        config,
+        stores,
+        findUserById,
+        sessionStore,
+    }));
+    router.route("/register", createRegisterEndpoint({
+        stores,
+        registration: config.registration,
+    }));
+    for (const backend of backends) {
+        if (backend.getRoutes) {
+            router.route(`/auth/${backend.name}`, backend.getRoutes());
+        }
+    }
+    const middleware = async (c, next) => {
+        const authHeader = c.req.header("authorization");
+        if (!authHeader?.startsWith("Bearer ")) {
+            return next();
+        }
+        const token = authHeader.slice(7);
+        const validation = await tokenService.validateAccessToken(token);
+        if (!validation.valid || !validation.claims) {
+            return c.json({
+                error: "invalid_token",
+                error_description: "Invalid or expired access token",
+            }, 401);
+        }
+        const user = await findUserById(validation.claims.sub);
+        c.set("user", {
+            id: validation.claims.sub,
+            email: user?.email ?? null,
+            name: user?.name ?? null,
+            image: user?.picture ?? null,
+            emailVerified: user?.emailVerified ? new Date() : null,
+            sessionId: validation.claims.jti,
+            sessionExpiresAt: new Date(validation.claims.exp * 1000),
+            metadata: user?.metadata,
+        });
+        return next();
+    };
+    return {
+        router,
+        middleware,
+        stores,
+        tokenService,
+    };
+};
+//# sourceMappingURL=provider.js.map

package/dist/oidc/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../src/oidc/provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAA0B,MAAM,MAAM,CAAC;AASpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,EAClB,oBAAoB,EACpB,wBAAwB,EACxB,2BAA2B,GAC5B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,MAAM,CAAC;AAChE,OAAO,EAAE,0BAA0B,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAgB,MAAM,cAAc,CAAC;AASlE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAA0B,EAAsB,EAAE;IACnF,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAEjD,MAAM,OAAO,GAAiB,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QACzD,CAAC,CAAC,MAAM,CAAC,OAAO;QAChB,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEpD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAElF,MAAM,YAAY,GACf,MAAM,CAAC,MAAM,EAAE,YAA6B,IAAI,IAAI,oBAAoB,EAAE,CAAC;IAE9E,MAAM,QAAQ,GAAkB,EAAE,CAAC;IAEnC,MAAM,YAAY,GAAG,KAAK,EAAE,EAAU,EAA4B,EAAE;QAClE,IAAI,MAAM,CAAC,QAAQ,CAAC,aAAa,EAAE,YAAY,EAAE,CAAC;YAChD,OAAO,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,IAAI,MAAM,CAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,EAAE,CAAC;QAC3C,QAAQ,CAAC,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtE,QAAQ,CAAC,IAAI,CACX,sBAAsB,CAAC;YACrB,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS;YACpC,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM;YACxC,UAAU,EAAE,MAAM,CAAC,KAAK;YACxB,iBAAiB,EAAE,KAAK,EAAE,SAAiB,EAAE,kBAA0B,EAAE,EAAE,CAAC,IAAI;YAChF,UAAU,EAAE,KAAK,EAAE,QAAiC,EAAE,SAAiB,EAAE,EAAE,CAAC,CAAC;gBAC3E,EAAE,EAAE,QAAQ,CAAC,GAAa;gBAC1B,KAAK,EAAE,QAAQ,CAAC,KAA2B;gBAC3C,aAAa,EAAE,QAAQ,CAAC,cAAqC;gBAC7D,IAAI,EAAE,QAAQ,CAAC,IAA0B;gBACzC,SAAS,EAAE,QAAQ,CAAC,UAAgC;gBACpD,UAAU,EAAE,QAAQ,CAAC,WAAiC;gBACtD,OAAO,EAAE,QAAQ,CAAC,OAA6B;aAChD,CAAC;SACH,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;IAE1B,MAAM,CAAC,GAAG,CAAC,mCAAmC,EAAE,CAAC,CAAC,EAAE,EAAE;QACpD,OAAO,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC;IACzC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,qBAAqB,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,qBAAqB,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,EAAE,EAAE,UAAU,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,CACR,aAAa,EACb,qBAAqB,CAAC,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAClE,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC;IAEtD,MAAM,CAAC,KAAK,CACV,YAAY,EACZ,uBAAuB,CAAC;QACtB,MAAM;QACN,MAAM;QACN,YAAY;QACZ,YAAY;KACb,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,KAAK,CACV,QAAQ,EACR,mBAAmB,CAAC;QAClB,MAAM;QACN,MAAM;QACN,YAAY;QACZ,YAAY;KACb,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,KAAK,CACV,WAAW,EACX,sBAAsB,CAAC;QACrB,MAAM;QACN,YAAY;QACZ,YAAY;KACb,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,KAAK,CACV,SAAS,EACT,oBAAoB,CAAC;QACnB,MAAM;QACN,MAAM;QACN,YAAY;QACZ,YAAY;KACb,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,KAAK,CACV,SAAS,EACT,wBAAwB,CAAC;QACvB,MAAM;QACN,YAAY;KACb,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,KAAK,CACV,aAAa,EACb,2BAA2B,CAAC;QAC1B,MAAM;QACN,YAAY;KACb,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,KAAK,CACV,MAAM,CAAC,EAAE,EAAE,SAAS,IAAI,QAAQ,EAChC,kBAAkB,CAAC;QACjB,MAAM;QACN,MAAM;QACN,QAAQ;QACR,YAAY;KACb,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,KAAK,CACV,MAAM,CAAC,EAAE,EAAE,WAAW,IAAI,UAAU,EACpC,oBAAoB,CAAC;QACnB,MAAM;QACN,MAAM;QACN,YAAY;QACZ,YAAY;KACb,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,KAAK,CACV,WAAW,EACX,sBAAsB,CAAC;QACrB,MAAM;QACN,YAAY,EAAE,MAAM,CAAC,YAAY;KAClC,CAAC,CACH,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,CAAC,KAAK,CAAC,SAAS,OAAO,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAsB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACtD,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACjD,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAEjE,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YAC5C,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,eAAe;gBACtB,iBAAiB,EAAE,iCAAiC;aACrD,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAEvD,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE;YACZ,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,GAAG;YACzB,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,IAAI;YAC1B,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI;YACxB,KAAK,EAAE,IAAI,EAAE,OAAO,IAAI,IAAI;YAC5B,aAAa,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI;YACtD,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,GAAG;YAChC,gBAAgB,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC;YACxD,QAAQ,EAAE,IAAI,EAAE,QAAQ;SACzB,CAAC,CAAC;QAEH,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;IAEF,OAAO;QACL,MAAM;QACN,UAAU;QACV,MAAM;QACN,YAAY;KACb,CAAC;AACJ,CAAC,CAAC"}

package/dist/oidc/rate-limit.d.ts

@@ -0,0 +1,9 @@
+import type { MiddlewareHandler } from "hono";
+export interface OIDCRateLimitOptions {
+    windowMs: number;
+    max: number;
+    prefix: string;
+}
+export declare const createOIDCRateLimiter: (options: OIDCRateLimitOptions) => MiddlewareHandler;
+export declare const resetOIDCRateLimits: () => void;
+//# sourceMappingURL=rate-limit.d.ts.map

package/dist/oidc/rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/oidc/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAIvD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;CAChB;AAiDD,eAAO,MAAM,qBAAqB,GAChC,SAAS,oBAAoB,KAC5B,iBAyBF,CAAC;AAEF,eAAO,MAAM,mBAAmB,QAAO,IAEtC,CAAC"}

package/dist/oidc/rate-limit.js

@@ -0,0 +1,61 @@
+import { getClientIP } from "../server/request.js";
+import { getGlobalKV, hasGlobalKV } from "../kv/index.js";
+const memoryBuckets = new Map();
+const incrementMemory = (key, windowMs) => {
+    const now = Date.now();
+    const entry = memoryBuckets.get(key);
+    if (!entry || entry.resetAt <= now) {
+        const fresh = { count: 1, resetAt: now + windowMs };
+        memoryBuckets.set(key, fresh);
+        return fresh;
+    }
+    entry.count++;
+    return entry;
+};
+const incrementKv = async (key, windowMs) => {
+    const kv = getGlobalKV();
+    const now = Date.now();
+    const data = await kv.hgetall(key);
+    let count;
+    let resetAt;
+    if (!data.resetAt || parseInt(data.resetAt, 10) <= now) {
+        count = 1;
+        resetAt = now + windowMs;
+    }
+    else {
+        count = (parseInt(data.count, 10) || 0) + 1;
+        resetAt = parseInt(data.resetAt, 10);
+    }
+    await kv.hmset(key, { count: String(count), resetAt: String(resetAt) });
+    await kv.expire(key, Math.ceil((resetAt - now) / 1000) + 1);
+    return { count, resetAt };
+};
+const keyFor = (c, prefix) => {
+    const clientId = c.req.query("client_id") ?? c.req.header("x-client-id") ?? undefined;
+    const ip = getClientIP(c);
+    return `oidc:rl:${prefix}:${clientId ?? ip}`;
+};
+export const createOIDCRateLimiter = (options) => {
+    return async (c, next) => {
+        const key = keyFor(c, options.prefix);
+        const info = hasGlobalKV()
+            ? await incrementKv(key, options.windowMs)
+            : incrementMemory(key, options.windowMs);
+        c.header("X-RateLimit-Limit", String(options.max));
+        c.header("X-RateLimit-Remaining", String(Math.max(0, options.max - info.count)));
+        c.header("X-RateLimit-Reset", String(Math.ceil(info.resetAt / 1000)));
+        if (info.count > options.max) {
+            const retryAfter = Math.ceil((info.resetAt - Date.now()) / 1000);
+            c.header("Retry-After", String(retryAfter));
+            return c.json({
+                error: "rate_limited",
+                error_description: "Too many requests, please try again later",
+            }, 429);
+        }
+        return next();
+    };
+};
+export const resetOIDCRateLimits = () => {
+    memoryBuckets.clear();
+};
+//# sourceMappingURL=rate-limit.js.map

package/dist/oidc/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../src/oidc/rate-limit.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC;AAQhD,MAAM,aAAa,GAAG,IAAI,GAAG,EAA8C,CAAC;AAE5E,MAAM,eAAe,GAAG,CACtB,GAAW,EACX,QAAgB,EACoB,EAAE;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,QAAQ,EAAE,CAAC;QACpD,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,KAAK,EACvB,GAAW,EACX,QAAgB,EAC6B,EAAE;IAC/C,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;IACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEnC,IAAI,KAAa,CAAC;IAClB,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,GAAG,EAAE,CAAC;QACvD,KAAK,GAAG,CAAC,CAAC;QACV,OAAO,GAAG,GAAG,GAAG,QAAQ,CAAC;IAC3B,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC5C,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACxE,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC,CAAC;AAEF,MAAM,MAAM,GAAG,CAAC,CAAU,EAAE,MAAc,EAAU,EAAE;IACpD,MAAM,QAAQ,GACZ,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC;IACvE,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC1B,OAAO,WAAW,MAAM,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;AAC/C,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,OAA6B,EACV,EAAE;IACrB,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,WAAW,EAAE;YACxB,CAAC,CAAC,MAAM,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC;YAC1C,CAAC,CAAC,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAE3C,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACnD,CAAC,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjF,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAEtE,IAAI,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;YACjE,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;YAC5C,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,cAAc;gBACrB,iBAAiB,EAAE,2CAA2C;aAC/D,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAS,EAAE;IAC5C,aAAa,CAAC,KAAK,EAAE,CAAC;AACxB,CAAC,CAAC"}

package/dist/oidc/stores/index.d.ts

@@ -0,0 +1,124 @@
+import { AuthorizationCode, AuthorizationCodeStore, ClientStore, ConsentStore, InteractionData, InteractionStore, OIDCClient, OIDCProviderStores, RefreshTokenData, RefreshTokenStore, StateStore, StoreConfig, UserConsent } from "../types.js";
+import { KVAdapter } from "../../kv/types.js";
+export declare class InMemoryClientStore implements ClientStore {
+    private clients;
+    constructor(clients?: OIDCClient[]);
+    get(clientId: string): Promise<OIDCClient | null>;
+    getAll(): Promise<OIDCClient[]>;
+    set(client: OIDCClient): Promise<void>;
+    delete(clientId: string): Promise<void>;
+}
+export declare class InMemoryAuthorizationCodeStore implements AuthorizationCodeStore {
+    private codes;
+    set(code: AuthorizationCode): Promise<void>;
+    get(code: string): Promise<AuthorizationCode | null>;
+    delete(code: string): Promise<void>;
+}
+export declare class InMemoryRefreshTokenStore implements RefreshTokenStore {
+    private tokens;
+    private userIndex;
+    set(data: RefreshTokenData): Promise<void>;
+    get(token: string): Promise<RefreshTokenData | null>;
+    delete(token: string): Promise<void>;
+    deleteByUserId(userId: string): Promise<void>;
+}
+export declare class InMemoryConsentStore implements ConsentStore {
+    private consents;
+    private key;
+    get(userId: string, clientId: string): Promise<UserConsent | null>;
+    set(consent: UserConsent): Promise<void>;
+    delete(userId: string, clientId: string): Promise<void>;
+    deleteByUserId(userId: string): Promise<void>;
+}
+export declare class InMemoryInteractionStore implements InteractionStore {
+    private interactions;
+    set(id: string, data: InteractionData): Promise<void>;
+    get(id: string): Promise<InteractionData | null>;
+    delete(id: string): Promise<void>;
+}
+export declare class InMemoryStateStore implements StateStore {
+    private states;
+    set(state: string, data: {
+        provider: string;
+        nonce: string;
+        codeVerifier: string;
+        returnTo?: string;
+    }): Promise<void>;
+    get(state: string): Promise<{
+        provider: string;
+        nonce: string;
+        codeVerifier: string;
+        returnTo?: string;
+    } | null>;
+    delete(state: string): Promise<void>;
+}
+export declare class KVClientStore implements ClientStore {
+    private kv;
+    private prefix;
+    constructor(kv: KVAdapter, prefix?: string);
+    private key;
+    get(clientId: string): Promise<OIDCClient | null>;
+    getAll(): Promise<OIDCClient[]>;
+    set(client: OIDCClient): Promise<void>;
+    delete(clientId: string): Promise<void>;
+}
+export declare class KVAuthorizationCodeStore implements AuthorizationCodeStore {
+    private kv;
+    private prefix;
+    constructor(kv: KVAdapter, prefix?: string);
+    private key;
+    set(code: AuthorizationCode): Promise<void>;
+    get(code: string): Promise<AuthorizationCode | null>;
+    delete(code: string): Promise<void>;
+}
+export declare class KVRefreshTokenStore implements RefreshTokenStore {
+    private kv;
+    private prefix;
+    constructor(kv: KVAdapter, prefix?: string);
+    private key;
+    private userKey;
+    set(data: RefreshTokenData): Promise<void>;
+    get(token: string): Promise<RefreshTokenData | null>;
+    delete(token: string): Promise<void>;
+    deleteByUserId(userId: string): Promise<void>;
+}
+export declare class KVConsentStore implements ConsentStore {
+    private kv;
+    private prefix;
+    constructor(kv: KVAdapter, prefix?: string);
+    private key;
+    get(userId: string, clientId: string): Promise<UserConsent | null>;
+    set(consent: UserConsent): Promise<void>;
+    delete(userId: string, clientId: string): Promise<void>;
+    deleteByUserId(userId: string): Promise<void>;
+}
+export declare class KVInteractionStore implements InteractionStore {
+    private kv;
+    private prefix;
+    constructor(kv: KVAdapter, prefix?: string);
+    private key;
+    set(id: string, data: InteractionData): Promise<void>;
+    get(id: string): Promise<InteractionData | null>;
+    delete(id: string): Promise<void>;
+}
+export declare class KVStateStore implements StateStore {
+    private kv;
+    private prefix;
+    constructor(kv: KVAdapter, prefix?: string);
+    private key;
+    set(state: string, data: {
+        provider: string;
+        nonce: string;
+        codeVerifier: string;
+        returnTo?: string;
+    }): Promise<void>;
+    get(state: string): Promise<{
+        provider: string;
+        nonce: string;
+        codeVerifier: string;
+        returnTo?: string;
+    } | null>;
+    delete(state: string): Promise<void>;
+}
+export declare const createStores: (config: StoreConfig | undefined, clients: OIDCClient[]) => OIDCProviderStores;
+//# sourceMappingURL=index.d.ts.map

package/dist/oidc/stores/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/oidc/stores/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,WAAW,EACX,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,WAAW,EACX,WAAW,EACZ,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAKvC,qBAAa,mBAAoB,YAAW,WAAW;IACrD,OAAO,CAAC,OAAO,CAAiC;gBAEpC,OAAO,GAAE,UAAU,EAAO;IAMhC,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAIjD,MAAM,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAI/B,GAAG,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAItC,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAG9C;AAED,qBAAa,8BAA+B,YAAW,sBAAsB;IAC3E,OAAO,CAAC,KAAK,CAAwC;IAE/C,GAAG,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAK3C,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAUpD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAG1C;AAED,qBAAa,yBAA0B,YAAW,iBAAiB;IACjE,OAAO,CAAC,MAAM,CAAuC;IACrD,OAAO,CAAC,SAAS,CAAkC;IAE7C,GAAG,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ1C,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAUpD,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASpC,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CASpD;AAED,qBAAa,oBAAqB,YAAW,YAAY;IACvD,OAAO,CAAC,QAAQ,CAAkC;IAElD,OAAO,CAAC,GAAG;IAIL,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAUlE,GAAG,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvD,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAOpD;AAED,qBAAa,wBAAyB,YAAW,gBAAgB;IAC/D,OAAO,CAAC,YAAY,CAAsC;IAEpD,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAQrD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAUhD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGxC;AAED,qBAAa,kBAAmB,YAAW,UAAU;IACnD,OAAO,CAAC,MAAM,CAGV;IAEE,GAAG,CACP,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GACjF,OAAO,CAAC,IAAI,CAAC;IAKV,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAChC,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,IAAI,CAAC;IAIH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAG3C;AAED,qBAAa,aAAc,YAAW,WAAW;IAE7C,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,MAAM;gBADN,EAAE,EAAE,SAAS,EACb,MAAM,GAAE,MAAe;IAGjC,OAAO,CAAC,GAAG;IAIL,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAKjD,MAAM,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAU/B,GAAG,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAItC,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAG9C;AAED,qBAAa,wBAAyB,YAAW,sBAAsB;IAEnE,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,MAAM;gBADN,EAAE,EAAE,SAAS,EACb,MAAM,GAAE,MAAe;IAGjC,OAAO,CAAC,GAAG;IAIL,GAAG,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAK3C,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAKpD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAG1C;AAED,qBAAa,mBAAoB,YAAW,iBAAiB;IAEzD,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,MAAM;gBADN,EAAE,EAAE,SAAS,EACb,MAAM,GAAE,MAAe;IAGjC,OAAO,CAAC,GAAG;IAIX,OAAO,CAAC,OAAO;IAIT,GAAG,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAM1C,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAKpD,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQpC,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAOpD;AAED,qBAAa,cAAe,YAAW,YAAY;IAE/C,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,MAAM;gBADN,EAAE,EAAE,SAAS,EACb,MAAM,GAAE,MAAe;IAGjC,OAAO,CAAC,GAAG;IAIL,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAKlE,GAAG,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAYxC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvD,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAMpD;AAED,qBAAa,kBAAmB,YAAW,gBAAgB;IAEvD,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,MAAM;gBADN,EAAE,EAAE,SAAS,EACb,MAAM,GAAE,MAAe;IAGjC,OAAO,CAAC,GAAG;IAIL,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAKrD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAKhD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGxC;AAED,qBAAa,YAAa,YAAW,UAAU;IAE3C,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,MAAM;gBADN,EAAE,EAAE,SAAS,EACb,MAAM,GAAE,MAAe;IAGjC,OAAO,CAAC,GAAG;IAIL,GAAG,CACP,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GACjF,OAAO,CAAC,IAAI,CAAC;IAIV,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAChC,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,IAAI,CAAC;IAKH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAG3C;AAqBD,eAAO,MAAM,YAAY,GACvB,QAAQ,WAAW,GAAG,SAAS,EAC/B,SAAS,UAAU,EAAE,KACpB,kBAsBF,CAAC"}