covara 0.0.1 → 0.6.0

package/dist/oidc/types.d.ts

@@ -0,0 +1,442 @@
+import type { Context, Hono } from "hono";
+import { SessionStore } from "../auth/types.js";
+import { KVAdapter } from "../kv/types.js";
+export type GrantType = "authorization_code" | "refresh_token" | "client_credentials";
+export type ResponseType = "code" | "token" | "id_token" | "code id_token" | "code token" | "id_token token" | "code id_token token";
+export type TokenAuthMethod = "client_secret_basic" | "client_secret_post" | "none";
+export type PKCEMethod = "S256" | "plain";
+export interface OIDCClient {
+    id: string;
+    secret?: string;
+    name: string;
+    redirectUris: string[];
+    postLogoutRedirectUris?: string[];
+    grantTypes: GrantType[];
+    responseTypes: ResponseType[];
+    tokenEndpointAuthMethod: TokenAuthMethod;
+    scopes: string[];
+    audiences?: string[];
+    metadata?: Record<string, unknown>;
+}
+export interface OIDCUser {
+    id: string;
+    email?: string;
+    emailVerified?: boolean;
+    name?: string;
+    givenName?: string;
+    familyName?: string;
+    picture?: string;
+    locale?: string;
+    metadata?: Record<string, unknown>;
+}
+export interface IDTokenClaims {
+    iss: string;
+    sub: string;
+    aud: string | string[];
+    exp: number;
+    iat: number;
+    auth_time?: number;
+    nonce?: string;
+    acr?: string;
+    amr?: string[];
+    azp?: string;
+    at_hash?: string;
+    email?: string;
+    email_verified?: boolean;
+    name?: string;
+    given_name?: string;
+    family_name?: string;
+    picture?: string;
+    locale?: string;
+    [key: string]: unknown;
+}
+export interface AccessTokenClaims {
+    iss: string;
+    sub: string;
+    aud: string | string[];
+    exp: number;
+    iat: number;
+    jti: string;
+    scope: string;
+    client_id: string;
+    [key: string]: unknown;
+}
+export interface AuthorizationRequest {
+    responseType: ResponseType;
+    clientId: string;
+    redirectUri: string;
+    scope: string;
+    state: string;
+    nonce?: string;
+    codeChallenge?: string;
+    codeChallengeMethod?: PKCEMethod;
+    prompt?: "none" | "login" | "consent" | "select_account";
+    maxAge?: number;
+    loginHint?: string;
+    acrValues?: string;
+    returnTo?: string;
+}
+export interface AuthorizationCode {
+    code: string;
+    clientId: string;
+    userId: string;
+    redirectUri: string;
+    scope: string;
+    nonce?: string;
+    codeChallenge?: string;
+    codeChallengeMethod?: PKCEMethod;
+    authTime: number;
+    expiresAt: number;
+}
+export interface RefreshTokenData {
+    token: string;
+    userId: string;
+    clientId: string;
+    scope: string;
+    expiresAt: number;
+    createdAt: number;
+}
+export interface TokenRequest {
+    grantType: GrantType;
+    code?: string;
+    redirectUri?: string;
+    clientId?: string;
+    clientSecret?: string;
+    refreshToken?: string;
+    codeVerifier?: string;
+    scope?: string;
+}
+export interface TokenResponse {
+    access_token: string;
+    token_type: "Bearer";
+    expires_in: number;
+    refresh_token?: string;
+    id_token?: string;
+    scope?: string;
+}
+export interface UserConsent {
+    userId: string;
+    clientId: string;
+    scopes: string[];
+    grantedAt: number;
+    expiresAt?: number;
+}
+export interface InteractionData {
+    authRequest: AuthorizationRequest;
+    userId?: string;
+    expiresAt: number;
+}
+export interface OIDCDiscoveryDocument {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    userinfo_endpoint: string;
+    jwks_uri: string;
+    end_session_endpoint: string;
+    introspection_endpoint?: string;
+    revocation_endpoint?: string;
+    registration_endpoint?: string;
+    response_types_supported: string[];
+    grant_types_supported: string[];
+    subject_types_supported: string[];
+    id_token_signing_alg_values_supported: string[];
+    token_endpoint_auth_methods_supported: string[];
+    scopes_supported: string[];
+    claims_supported: string[];
+    code_challenge_methods_supported: string[];
+    claims_parameter_supported: boolean;
+    request_parameter_supported: boolean;
+    request_uri_parameter_supported: boolean;
+}
+export interface JWK {
+    kty: "RSA" | "EC";
+    use: "sig";
+    alg: string;
+    kid: string;
+    n?: string;
+    e?: string;
+    x?: string;
+    y?: string;
+    crv?: string;
+}
+export interface JWKPrivate extends JWK {
+    d?: string;
+    p?: string;
+    q?: string;
+    dp?: string;
+    dq?: string;
+    qi?: string;
+}
+export interface KeyPair {
+    privateKey: string;
+    publicKey: string;
+    kid: string;
+    alg: string;
+}
+export type Algorithm = "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "PS256" | "PS384" | "PS512";
+export interface KeyConfig {
+    algorithm?: Algorithm;
+    privateKey?: string | Buffer;
+    publicKey?: string | Buffer;
+    keyId?: string;
+    rotationIntervalMs?: number;
+}
+export interface TokenConfig {
+    accessToken?: {
+        ttlSeconds?: number;
+        format?: "jwt" | "opaque";
+    };
+    idToken?: {
+        ttlSeconds?: number;
+    };
+    refreshToken?: {
+        enabled?: boolean;
+        ttlSeconds?: number;
+        rotateOnUse?: boolean;
+    };
+    authorizationCode?: {
+        ttlSeconds?: number;
+    };
+}
+export interface EmailPasswordBackendConfig {
+    enabled: boolean;
+    validateUser: (email: string, password: string) => Promise<OIDCUser | null>;
+    findUserById: (id: string) => Promise<OIDCUser | null>;
+    createUser?: (data: {
+        email: string;
+        password: string;
+        name?: string;
+    }) => Promise<OIDCUser>;
+    hashPassword?: (password: string) => Promise<string>;
+    verifyPassword?: (password: string, hash: string) => Promise<boolean>;
+}
+export interface PassportBackendConfig {
+    strategies: string[];
+    passportInstance?: unknown;
+    getUserFromPassportUser?: (passportUser: unknown) => OIDCUser;
+}
+export interface AuthJsBackendConfig {
+    db: unknown;
+    tables: {
+        users: unknown;
+        sessions: unknown;
+        accounts?: unknown;
+    };
+}
+export interface FederatedProvider {
+    name: string;
+    clientId: string;
+    clientSecret: string;
+    issuer: string;
+    scopes?: string[];
+    mapUser?: (claims: Record<string, unknown>) => Promise<OIDCUser>;
+}
+export interface AuthBackendsConfig {
+    emailPassword?: EmailPasswordBackendConfig;
+    passport?: PassportBackendConfig;
+    authjs?: AuthJsBackendConfig;
+    federated?: FederatedProvider[];
+}
+export interface StoreConfig {
+    type: "memory" | "redis" | "drizzle";
+    kv?: KVAdapter;
+    sessionStore?: SessionStore;
+    prefix?: string;
+    db?: unknown;
+    tables?: Record<string, unknown>;
+}
+export interface UIConfig {
+    loginPath?: string;
+    consentPath?: string;
+    templates?: {
+        login?: string;
+        consent?: string;
+        loggedOut?: string;
+        error?: string;
+    };
+    customLoginHandler?: (c: Context, interaction: InteractionData) => Promise<Response>;
+    customConsentHandler?: (c: Context, interaction: InteractionData, client: OIDCClient, user: OIDCUser) => Promise<Response>;
+}
+export interface SecurityConfig {
+    pkce?: {
+        required?: boolean;
+        methods?: PKCEMethod[];
+    };
+    nonce?: {
+        required?: boolean;
+    };
+    consent?: {
+        ttlSeconds?: number;
+    };
+    allowedOrigins?: string[];
+    trustedProxies?: string[];
+    rateLimiting?: {
+        login?: {
+            windowMs: number;
+            max: number;
+        };
+        token?: {
+            windowMs: number;
+            max: number;
+        };
+        jwks?: {
+            windowMs: number;
+            max: number;
+        };
+        introspect?: {
+            windowMs: number;
+            max: number;
+        };
+    };
+}
+export interface RegistrationConfig {
+    enabled?: boolean;
+    defaultScopes?: string[];
+    initialAccessToken?: string;
+}
+export interface ProviderHooks {
+    onUserAuthenticated?: (user: OIDCUser, method: string) => Promise<void>;
+    onTokenIssued?: (userId: string, clientId: string, scopes: string[]) => Promise<void>;
+    onConsentGranted?: (userId: string, clientId: string, scopes: string[]) => Promise<void>;
+    onLogout?: (userId: string, sessionId?: string) => Promise<void>;
+    getUserInfoClaims?: (user: OIDCUser, scopes: string[]) => Promise<Record<string, unknown>>;
+    getAccessTokenClaims?: (user: OIDCUser, client: OIDCClient, scopes: string[]) => Promise<Record<string, unknown>>;
+}
+export interface OIDCProviderConfig {
+    issuer: string;
+    baseUrl?: string;
+    keys: KeyConfig;
+    tokens?: TokenConfig;
+    clients: OIDCClient[] | ClientStore;
+    backends: AuthBackendsConfig;
+    stores?: StoreConfig;
+    scopes?: ScopeDefinition[];
+    claims?: ClaimDefinition[];
+    ui?: UIConfig;
+    security?: SecurityConfig;
+    registration?: RegistrationConfig;
+    hooks?: ProviderHooks;
+}
+export declare const DEFAULT_CONSENT_TTL_SECONDS: number;
+export interface ScopeDefinition {
+    name: string;
+    description: string;
+    claims?: string[];
+}
+export interface ClaimDefinition {
+    name: string;
+    scope: string;
+    getValue: (user: OIDCUser) => unknown;
+}
+export interface ClientStore {
+    get(clientId: string): Promise<OIDCClient | null>;
+    getAll(): Promise<OIDCClient[]>;
+    set(client: OIDCClient): Promise<void>;
+    delete(clientId: string): Promise<void>;
+}
+export interface AuthorizationCodeStore {
+    set(code: AuthorizationCode): Promise<void>;
+    get(code: string): Promise<AuthorizationCode | null>;
+    delete(code: string): Promise<void>;
+}
+export interface RefreshTokenStore {
+    set(data: RefreshTokenData): Promise<void>;
+    get(token: string): Promise<RefreshTokenData | null>;
+    delete(token: string): Promise<void>;
+    deleteByUserId(userId: string): Promise<void>;
+}
+export interface ConsentStore {
+    get(userId: string, clientId: string): Promise<UserConsent | null>;
+    set(consent: UserConsent): Promise<void>;
+    delete(userId: string, clientId: string): Promise<void>;
+    deleteByUserId(userId: string): Promise<void>;
+}
+export interface InteractionStore {
+    set(id: string, data: InteractionData): Promise<void>;
+    get(id: string): Promise<InteractionData | null>;
+    delete(id: string): Promise<void>;
+}
+export interface StateStore {
+    set(state: string, data: {
+        provider: string;
+        nonce: string;
+        codeVerifier: string;
+        returnTo?: string;
+    }): Promise<void>;
+    get(state: string): Promise<{
+        provider: string;
+        nonce: string;
+        codeVerifier: string;
+        returnTo?: string;
+    } | null>;
+    delete(state: string): Promise<void>;
+}
+export interface AuthBackend {
+    name: string;
+    authenticate(c: Context): Promise<AuthBackendResult>;
+    getLoginForm?(): {
+        fields: Array<{
+            name: string;
+            type: string;
+            label: string;
+            required?: boolean;
+        }>;
+    };
+    getExternalProviders?(): Array<{
+        name: string;
+        authUrl: string;
+        icon?: string;
+    }>;
+    initiateExternalAuth?(providerName: string, c: Context): Promise<Response>;
+    handleExternalCallback?(c: Context): Promise<AuthBackendResult>;
+    supportsSignup?: boolean;
+    createUser?(data: {
+        email: string;
+        password: string;
+        name?: string;
+    }): Promise<OIDCUser>;
+    getRoutes?(): Hono;
+}
+export interface AuthBackendResult {
+    success: boolean;
+    user?: OIDCUser;
+    error?: string;
+    authTime?: number;
+    amr?: string[];
+    provider?: string;
+}
+export interface KeyManager {
+    getCurrentKey(): Promise<KeyPair>;
+    getPublicKeys(): Promise<JWK[]>;
+    signToken(payload: Record<string, unknown>): Promise<string>;
+    verifyToken(token: string): Promise<Record<string, unknown>>;
+    rotateKeys(): Promise<void>;
+    getKeyId(): string;
+    getAlgorithm(): Algorithm;
+}
+export interface TokenService {
+    generateTokenSet(params: {
+        user: OIDCUser;
+        client: OIDCClient;
+        scope: string;
+        nonce?: string;
+        authTime?: number;
+        includeIdToken?: boolean;
+        includeRefreshToken?: boolean;
+    }): Promise<TokenResponse>;
+    validateAccessToken(token: string): Promise<{
+        valid: boolean;
+        claims?: AccessTokenClaims;
+    }>;
+    decodeIdToken(token: string): Promise<IDTokenClaims>;
+    revokeRefreshToken(token: string): Promise<void>;
+}
+export interface OIDCProviderStores {
+    clients: ClientStore;
+    authorizationCodes: AuthorizationCodeStore;
+    refreshTokens: RefreshTokenStore;
+    consent: ConsentStore;
+    interactions: InteractionStore;
+    state: StateStore;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/oidc/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/oidc/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,MAAM,MAAM,SAAS,GACjB,oBAAoB,GACpB,eAAe,GACf,oBAAoB,CAAC;AAEzB,MAAM,MAAM,YAAY,GACpB,MAAM,GACN,OAAO,GACP,UAAU,GACV,eAAe,GACf,YAAY,GACZ,gBAAgB,GAChB,qBAAqB,CAAC;AAE1B,MAAM,MAAM,eAAe,GACvB,qBAAqB,GACrB,oBAAoB,GACpB,MAAM,CAAC;AAEX,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC;AAE1C,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB,aAAa,EAAE,YAAY,EAAE,CAAC;IAC9B,uBAAuB,EAAE,eAAe,CAAC;IACzC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,YAAY,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,UAAU,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,gBAAgB,CAAC;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,UAAU,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,SAAS,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,oBAAoB,CAAC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,uBAAuB,EAAE,MAAM,EAAE,CAAC;IAClC,qCAAqC,EAAE,MAAM,EAAE,CAAC;IAChD,qCAAqC,EAAE,MAAM,EAAE,CAAC;IAChD,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,gCAAgC,EAAE,MAAM,EAAE,CAAC;IAC3C,0BAA0B,EAAE,OAAO,CAAC;IACpC,2BAA2B,EAAE,OAAO,CAAC;IACrC,+BAA+B,EAAE,OAAO,CAAC;CAC1C;AAED,MAAM,WAAW,GAAG;IAClB,GAAG,EAAE,KAAK,GAAG,IAAI,CAAC;IAClB,GAAG,EAAE,KAAK,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,UAAW,SAAQ,GAAG;IACrC,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,OAAO;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;AAEhH,MAAM,WAAW,SAAS;IACxB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,CAAC,EAAE;QACZ,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC;KAC3B,CAAC;IACF,OAAO,CAAC,EAAE;QACR,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,YAAY,CAAC,EAAE;QACb,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,CAAC;IACF,iBAAiB,CAAC,EAAE;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAC5E,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IACvD,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxB,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACvE;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,uBAAuB,CAAC,EAAE,CAAC,YAAY,EAAE,OAAO,KAAK,QAAQ,CAAC;CAC/D;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE;QACN,KAAK,EAAE,OAAO,CAAC;QACf,QAAQ,EAAE,OAAO,CAAC;QAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC;CACH;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CAClE;AAED,MAAM,WAAW,kBAAkB;IACjC,aAAa,CAAC,EAAE,0BAA0B,CAAC;IAC3C,QAAQ,CAAC,EAAE,qBAAqB,CAAC;IACjC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,SAAS,CAAC,EAAE,iBAAiB,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;IACrC,EAAE,CAAC,EAAE,SAAS,CAAC;IACf,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,QAAQ;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE;QACV,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,kBAAkB,CAAC,EAAE,CACnB,CAAC,EAAE,OAAO,EACV,WAAW,EAAE,eAAe,KACzB,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvB,oBAAoB,CAAC,EAAE,CACrB,CAAC,EAAE,OAAO,EACV,WAAW,EAAE,eAAe,EAC5B,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,QAAQ,KACX,OAAO,CAAC,QAAQ,CAAC,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE;QACL,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC;KACxB,CAAC;IACF,KAAK,CAAC,EAAE;QACN,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC;IACF,OAAO,CAAC,EAAE;QACR,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,CAAC,EAAE;QACb,KAAK,CAAC,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAC;QAC1C,KAAK,CAAC,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAC;QAC1C,IAAI,CAAC,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAC;QACzC,UAAU,CAAC,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAC;KAChD,CAAC;CACH;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,aAAa,CAAC,EAAE,CACd,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EAAE,KACb,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,gBAAgB,CAAC,EAAE,CACjB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EAAE,KACb,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,iBAAiB,CAAC,EAAE,CAClB,IAAI,EAAE,QAAQ,EACd,MAAM,EAAE,MAAM,EAAE,KACb,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACtC,oBAAoB,CAAC,EAAE,CACrB,IAAI,EAAE,QAAQ,EACd,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,EAAE,KACb,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,OAAO,EAAE,UAAU,EAAE,GAAG,WAAW,CAAC;IACpC,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,MAAM,CAAC,EAAE,eAAe,EAAE,CAAC;IAC3B,MAAM,CAAC,EAAE,eAAe,EAAE,CAAC;IAC3B,EAAE,CAAC,EAAE,QAAQ,CAAC;IACd,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,KAAK,CAAC,EAAE,aAAa,CAAC;CACvB;AAED,eAAO,MAAM,2BAA2B,QAAqB,CAAC;AAE9D,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC;CACvC;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAClD,MAAM,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAChC,GAAG,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,sBAAsB;IACrC,GAAG,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IACrD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACrD,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACnE,GAAG,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IACjD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,CACD,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;QACJ,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GACA,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAC1B,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,IAAI,CAAC,CAAC;IACV,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACrD,YAAY,CAAC,IAAI;QACf,MAAM,EAAE,KAAK,CAAC;YACZ,IAAI,EAAE,MAAM,CAAC;YACb,IAAI,EAAE,MAAM,CAAC;YACb,KAAK,EAAE,MAAM,CAAC;YACd,QAAQ,CAAC,EAAE,OAAO,CAAC;SACpB,CAAC,CAAC;KACJ,CAAC;IACF,oBAAoB,CAAC,IAAI,KAAK,CAAC;QAC7B,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC,CAAC;IACH,oBAAoB,CAAC,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3E,sBAAsB,CAAC,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAChE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,UAAU,CAAC,CAAC,IAAI,EAAE;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtB,SAAS,CAAC,IAAI,IAAI,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,aAAa,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAChC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7D,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,QAAQ,IAAI,MAAM,CAAC;IACnB,YAAY,IAAI,SAAS,CAAC;CAC3B;AAED,MAAM,WAAW,YAAY;IAC3B,gBAAgB,CAAC,MAAM,EAAE;QACvB,IAAI,EAAE,QAAQ,CAAC;QACf,MAAM,EAAE,UAAU,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,mBAAmB,CAAC,EAAE,OAAO,CAAC;KAC/B,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3B,mBAAmB,CACjB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,iBAAiB,CAAA;KAAE,CAAC,CAAC;IAC3D,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACrD,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,WAAW,CAAC;IACrB,kBAAkB,EAAE,sBAAsB,CAAC;IAC3C,aAAa,EAAE,iBAAiB,CAAC;IACjC,OAAO,EAAE,YAAY,CAAC;IACtB,YAAY,EAAE,gBAAgB,CAAC;IAC/B,KAAK,EAAE,UAAU,CAAC;CACnB"}

package/dist/oidc/types.js

@@ -0,0 +1,2 @@
+export const DEFAULT_CONSENT_TTL_SECONDS = 365 * 24 * 60 * 60;
+//# sourceMappingURL=types.js.map

package/dist/oidc/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/oidc/types.ts"],"names":[],"mappings":"AAyXA,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC"}

package/dist/oidc/ui/consent.d.ts

@@ -0,0 +1,12 @@
+import { Hono } from "hono";
+import { OIDCProviderConfig, OIDCProviderStores, OIDCUser } from "../types.js";
+import { SessionStore } from "../../auth/types.js";
+interface ConsentHandlerConfig {
+    config: OIDCProviderConfig;
+    stores: OIDCProviderStores;
+    findUserById: (id: string) => Promise<OIDCUser | null>;
+    sessionStore?: SessionStore;
+}
+export declare const createConsentHandler: ({ config, stores, findUserById, sessionStore, }: ConsentHandlerConfig) => Hono;
+export {};
+//# sourceMappingURL=consent.d.ts.map

package/dist/oidc/ui/consent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent.d.ts","sourceRoot":"","sources":["../../../src/oidc/ui/consent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAG1C,OAAO,EAIL,kBAAkB,EAClB,kBAAkB,EAClB,QAAQ,EACT,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAgF5C,UAAU,oBAAoB;IAC5B,MAAM,EAAE,kBAAkB,CAAC;IAC3B,MAAM,EAAE,kBAAkB,CAAC;IAC3B,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IACvD,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED,eAAO,MAAM,oBAAoB,GAAI,iDAKlC,oBAAoB,KAAG,IAkIzB,CAAC"}

package/dist/oidc/ui/consent.js

@@ -0,0 +1,180 @@
+import { Hono } from "hono";
+import { getCookie } from "hono/cookie";
+import * as crypto from "node:crypto";
+import { DEFAULT_CONSENT_TTL_SECONDS, } from "../types.js";
+import { readFormBody } from "../body.js";
+const defaultConsentTemplate = (client, user, scopes) => {
+    const scopeDescriptions = {
+        openid: "Access your user ID",
+        profile: "Access your profile information (name, picture)",
+        email: "Access your email address",
+        offline_access: "Stay signed in (refresh tokens)",
+    };
+    return `
+<!DOCTYPE html>
+<html>
+<head>
+  <title>Authorize Application</title>
+  <style>
+    * { box-sizing: border-box; }
+    body { font-family: system-ui, sans-serif; display: flex; justify-content: center; align-items: center; min-height: 100vh; margin: 0; background: #f5f5f5; }
+    .container { width: 100%; max-width: 450px; padding: 2rem; background: white; border-radius: 8px; box-shadow: 0 2px 8px rgba(0,0,0,0.1); }
+    h1 { margin: 0 0 0.5rem; color: #333; }
+    .subtitle { color: #666; margin-bottom: 1.5rem; }
+    .client { font-weight: 600; color: #007bff; }
+    .scopes { margin: 1.5rem 0; }
+    .scope { display: flex; align-items: start; padding: 0.75rem; background: #f8f9fa; border-radius: 4px; margin-bottom: 0.5rem; }
+    .scope-check { margin-right: 0.75rem; color: #28a745; font-size: 1.2rem; }
+    .scope-text { flex: 1; }
+    .scope-name { font-weight: 500; color: #333; }
+    .scope-desc { font-size: 0.875rem; color: #666; }
+    .buttons { display: flex; gap: 1rem; margin-top: 1.5rem; }
+    button { flex: 1; padding: 0.75rem; border: none; border-radius: 4px; font-size: 1rem; cursor: pointer; }
+    .allow { background: #007bff; color: white; }
+    .allow:hover { background: #0056b3; }
+    .deny { background: #f5f5f5; color: #333; border: 1px solid #ddd; }
+    .deny:hover { background: #e9ecef; }
+    .user-info { padding: 0.75rem; background: #f8f9fa; border-radius: 4px; margin-bottom: 1rem; }
+    .user-email { font-weight: 500; }
+  </style>
+</head>
+<body>
+  <div class="container">
+    <h1>Authorize Application</h1>
+    <p class="subtitle"><span class="client">${client.name}</span> wants to access your account</p>
+
+    <div class="user-info">
+      Signed in as <span class="user-email">${user.email ?? user.name ?? user.id}</span>
+    </div>
+
+    <div class="scopes">
+      <p><strong>This application will be able to:</strong></p>
+      ${scopes
+        .map((scope) => `
+        <div class="scope">
+          <span class="scope-check">✓</span>
+          <div class="scope-text">
+            <div class="scope-name">${scope}</div>
+            <div class="scope-desc">${scopeDescriptions[scope] ?? `Access ${scope} data`}</div>
+          </div>
+        </div>
+      `)
+        .join("")}
+    </div>
+
+    <form method="POST">
+      <div class="buttons">
+        <button type="submit" name="action" value="deny" class="deny">Deny</button>
+        <button type="submit" name="action" value="allow" class="allow">Allow</button>
+      </div>
+    </form>
+  </div>
+</body>
+</html>
+`;
+};
+export const createConsentHandler = ({ config, stores, findUserById, sessionStore, }) => {
+    const router = new Hono();
+    const resolveUserId = async (c) => {
+        const sessionId = getCookie(c, "oidc_session");
+        if (!sessionId || !sessionStore)
+            return null;
+        const session = await sessionStore.get(sessionId);
+        return session?.userId ?? null;
+    };
+    const revokeHandler = async (c) => {
+        const userId = await resolveUserId(c);
+        if (!userId) {
+            return c.json({ error: "unauthorized", error_description: "No active session" }, 401);
+        }
+        const body = await readFormBody(c);
+        const clientId = body.client_id ?? body.clientId;
+        if (clientId) {
+            await stores.consent.delete(userId, clientId);
+        }
+        else {
+            await stores.consent.deleteByUserId(userId);
+        }
+        return c.json({ success: true });
+    };
+    router.post("/revoke", (c) => revokeHandler(c));
+    router.delete("/revoke", (c) => revokeHandler(c));
+    router.get("/", async (c) => {
+        const interactionId = c.req.query("interaction");
+        if (!interactionId) {
+            return c.html("Missing interaction parameter", 400);
+        }
+        const interaction = await stores.interactions.get(interactionId);
+        if (!interaction || !interaction.userId) {
+            return c.html("Invalid or expired interaction", 400);
+        }
+        const client = await stores.clients.get(interaction.authRequest.clientId);
+        if (!client) {
+            return c.html("Unknown client", 400);
+        }
+        const user = await findUserById(interaction.userId);
+        if (!user) {
+            return c.html("User not found", 400);
+        }
+        if (config.ui?.customConsentHandler) {
+            return config.ui.customConsentHandler(c, interaction, client, user);
+        }
+        const scopes = interaction.authRequest.scope.split(" ");
+        const template = config.ui?.templates?.consent ?? defaultConsentTemplate(client, user, scopes);
+        return c.html(template);
+    });
+    router.post("/", async (c) => {
+        const interactionId = c.req.query("interaction");
+        if (!interactionId) {
+            return c.html("Missing interaction parameter", 400);
+        }
+        const interaction = await stores.interactions.get(interactionId);
+        if (!interaction || !interaction.userId) {
+            return c.html("Invalid or expired interaction", 400);
+        }
+        await stores.interactions.delete(interactionId);
+        const body = await readFormBody(c);
+        const action = body.action;
+        const authRequest = interaction.authRequest;
+        if (action === "deny") {
+            const redirectUrl = new URL(authRequest.redirectUri);
+            redirectUrl.searchParams.set("error", "access_denied");
+            redirectUrl.searchParams.set("error_description", "User denied the request");
+            redirectUrl.searchParams.set("state", authRequest.state);
+            return c.redirect(redirectUrl.toString(), 302);
+        }
+        const scopes = authRequest.scope.split(" ");
+        const ttlSeconds = config.security?.consent?.ttlSeconds ?? DEFAULT_CONSENT_TTL_SECONDS;
+        const grantedAt = Date.now();
+        await stores.consent.set({
+            userId: interaction.userId,
+            clientId: authRequest.clientId,
+            scopes,
+            grantedAt,
+            expiresAt: grantedAt + ttlSeconds * 1000,
+        });
+        if (config.hooks?.onConsentGranted) {
+            await config.hooks.onConsentGranted(interaction.userId, authRequest.clientId, scopes);
+        }
+        const code = crypto.randomBytes(32).toString("hex");
+        const authCode = {
+            code,
+            clientId: authRequest.clientId,
+            userId: interaction.userId,
+            redirectUri: authRequest.redirectUri,
+            scope: authRequest.scope,
+            nonce: authRequest.nonce,
+            codeChallenge: authRequest.codeChallenge,
+            codeChallengeMethod: authRequest.codeChallengeMethod,
+            authTime: Math.floor(Date.now() / 1000),
+            expiresAt: Date.now() + (config.tokens?.authorizationCode?.ttlSeconds ?? 600) * 1000,
+        };
+        await stores.authorizationCodes.set(authCode);
+        const redirectUrl = new URL(authRequest.redirectUri);
+        redirectUrl.searchParams.set("code", code);
+        redirectUrl.searchParams.set("state", authRequest.state);
+        return c.redirect(redirectUrl.toString(), 302);
+    });
+    return router;
+};
+//# sourceMappingURL=consent.js.map

package/dist/oidc/ui/consent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent.js","sourceRoot":"","sources":["../../../src/oidc/ui/consent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAEL,2BAA2B,GAK5B,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAGvC,MAAM,sBAAsB,GAAG,CAC7B,MAAkB,EAClB,IAAc,EACd,MAAgB,EACR,EAAE;IACV,MAAM,iBAAiB,GAA2B;QAChD,MAAM,EAAE,qBAAqB;QAC7B,OAAO,EAAE,iDAAiD;QAC1D,KAAK,EAAE,2BAA2B;QAClC,cAAc,EAAE,iCAAiC;KAClD,CAAC;IAEF,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;+CA+BsC,MAAM,CAAC,IAAI;;;8CAGZ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE;;;;;QAKxE,MAAM;SACL,GAAG,CACF,CAAC,KAAK,EAAE,EAAE,CAAC;;;;sCAIiB,KAAK;sCACL,iBAAiB,CAAC,KAAK,CAAC,IAAI,UAAU,KAAK,OAAO;;;OAGjF,CACE;SACA,IAAI,CAAC,EAAE,CAAC;;;;;;;;;;;;CAYhB,CAAC;AACF,CAAC,CAAC;AASF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,EACnC,MAAM,EACN,MAAM,EACN,YAAY,EACZ,YAAY,GACS,EAAQ,EAAE;IAC/B,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;IAE1B,MAAM,aAAa,GAAG,KAAK,EAAE,CAAU,EAA0B,EAAE;QACjE,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAC/C,IAAI,CAAC,SAAS,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC;QAC7C,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAClD,OAAO,OAAO,EAAE,MAAM,IAAI,IAAI,CAAC;IACjC,CAAC,CAAC;IAEF,MAAM,aAAa,GAAG,KAAK,EAAE,CAAU,EAAE,EAAE;QACzC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,CAAC,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;QACxF,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC;QAEjD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC9C,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC;IAEF,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IAElD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1B,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAEjD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,CAAC,CAAC,IAAI,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACjE,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;YACxC,OAAO,CAAC,CAAC,IAAI,CAAC,gCAAgC,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC1E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,CAAC,IAAI,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;QACvC,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,CAAC,IAAI,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,MAAM,CAAC,EAAE,EAAE,oBAAoB,EAAE,CAAC;YACpC,OAAO,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxD,MAAM,QAAQ,GACZ,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,IAAI,sBAAsB,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAEhF,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3B,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAEjD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,CAAC,CAAC,IAAI,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACjE,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;YACxC,OAAO,CAAC,CAAC,IAAI,CAAC,gCAAgC,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAEhD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC;QAE5C,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;YACrD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YACvD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,yBAAyB,CAAC,CAAC;YAC7E,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;YACzD,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,UAAU,GACd,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,IAAI,2BAA2B,CAAC;QACtE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;YACvB,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,MAAM;YACN,SAAS;YACT,SAAS,EAAE,SAAS,GAAG,UAAU,GAAG,IAAI;SACzC,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,KAAK,EAAE,gBAAgB,EAAE,CAAC;YACnC,MAAM,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACxF,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAsB;YAClC,IAAI;YACJ,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,WAAW,EAAE,WAAW,CAAC,WAAW;YACpC,KAAK,EAAE,WAAW,CAAC,KAAK;YACxB,KAAK,EAAE,WAAW,CAAC,KAAK;YACxB,aAAa,EAAE,WAAW,CAAC,aAAa;YACxC,mBAAmB,EAAE,WAAW,CAAC,mBAAmB;YACpD,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YACvC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,EAAE,UAAU,IAAI,GAAG,CAAC,GAAG,IAAI;SACrF,CAAC;QAEF,MAAM,MAAM,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAE9C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QACrD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC3C,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;QAEzD,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC"}