exisjs 0.5.10 → 0.5.11

package/dist/auth/oauth/providers/facebook.js

@@ -0,0 +1,124 @@
+"use strict";
+/**
+ * Facebook OAuth Provider.
+ *
+ * Endpoints:
+ *   Auth:     https://www.facebook.com/v19.0/dialog/oauth
+ *   Token:    https://graph.facebook.com/v19.0/oauth/access_token
+ *   UserInfo: https://graph.facebook.com/v19.0/me
+ *
+ * Default scopes: email, public_profile
+ *
+ * Note: Facebook uses Graph API versioning. This implementation uses v19.0.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FacebookProvider = void 0;
+const GRAPH_VERSION = 'v19.0';
+const AUTH_URL = `https://www.facebook.com/${GRAPH_VERSION}/dialog/oauth`;
+const TOKEN_URL = `https://graph.facebook.com/${GRAPH_VERSION}/oauth/access_token`;
+const USERINFO_URL = `https://graph.facebook.com/${GRAPH_VERSION}/me`;
+const DEFAULT_SCOPES = ['email', 'public_profile'];
+class FacebookProvider {
+    constructor(config) {
+        this.name = 'facebook';
+        this.config = config;
+    }
+    getAuthorizationUrl(state, _codeVerifier) {
+        const scopes = this.config.scopes || DEFAULT_SCOPES;
+        const params = new URLSearchParams({
+            client_id: this.config.clientId,
+            redirect_uri: this.config.redirectUri,
+            response_type: 'code',
+            scope: scopes.join(','),
+            state,
+        });
+        return `${AUTH_URL}?${params.toString()}`;
+    }
+    async exchangeCode(code, _codeVerifier) {
+        const params = new URLSearchParams({
+            client_id: this.config.clientId,
+            client_secret: this.config.clientSecret,
+            code,
+            redirect_uri: this.config.redirectUri,
+        });
+        const response = await fetch(`${TOKEN_URL}?${params.toString()}`, {
+            method: 'GET',
+        });
+        if (!response.ok) {
+            const error = await response.text();
+            throw new Error(`Facebook token exchange failed: ${error}`);
+        }
+        const data = (await response.json());
+        if (data.error) {
+            throw new Error(`Facebook token exchange failed: ${data.error.message || data.error}`);
+        }
+        return {
+            accessToken: data.access_token,
+            expiresIn: data.expires_in,
+            tokenType: data.token_type || 'Bearer',
+        };
+    }
+    async getUserProfile(tokens) {
+        const fields = 'id,name,email,first_name,last_name,picture.type(large)';
+        const response = await fetch(`${USERINFO_URL}?fields=${encodeURIComponent(fields)}&access_token=${encodeURIComponent(tokens.accessToken)}`);
+        if (!response.ok) {
+            throw new Error(`Facebook user info request failed: ${response.statusText}`);
+        }
+        const data = (await response.json());
+        if (data.error) {
+            throw new Error(`Facebook user info request failed: ${data.error.message || data.error}`);
+        }
+        // Extract profile picture URL
+        const avatar = data.picture?.data?.url || undefined;
+        return {
+            id: data.id,
+            email: data.email || '',
+            emailVerified: !!data.email, // Facebook only returns email if verified
+            name: data.name || '',
+            firstName: data.first_name,
+            lastName: data.last_name,
+            avatar,
+            provider: 'facebook',
+            raw: data,
+        };
+    }
+    async refreshToken(_refreshToken) {
+        // Facebook uses long-lived tokens instead of refresh tokens
+        // To extend a token, exchange a short-lived token for a long-lived one
+        throw new Error('Facebook does not support standard refresh tokens. ' +
+            'Use the long-lived token exchange endpoint instead: ' +
+            `${TOKEN_URL}?grant_type=fb_exchange_token&client_id=...&client_secret=...&fb_exchange_token=...`);
+    }
+    /**
+     * Exchange a short-lived token for a long-lived token (~60 days).
+     */
+    async exchangeForLongLived(shortLivedToken) {
+        const params = new URLSearchParams({
+            grant_type: 'fb_exchange_token',
+            client_id: this.config.clientId,
+            client_secret: this.config.clientSecret,
+            fb_exchange_token: shortLivedToken,
+        });
+        const response = await fetch(`${TOKEN_URL}?${params.toString()}`);
+        if (!response.ok) {
+            const error = await response.text();
+            throw new Error(`Facebook long-lived token exchange failed: ${error}`);
+        }
+        const data = (await response.json());
+        return {
+            accessToken: data.access_token,
+            expiresIn: data.expires_in,
+            tokenType: data.token_type || 'Bearer',
+        };
+    }
+    async revokeToken(token) {
+        // Facebook uses a DELETE request to revoke permissions
+        const response = await fetch(`https://graph.facebook.com/${GRAPH_VERSION}/me/permissions?access_token=${encodeURIComponent(token)}`, { method: 'DELETE' });
+        if (!response.ok) {
+            const error = await response.text();
+            throw new Error(`Facebook token revocation failed: ${error}`);
+        }
+    }
+}
+exports.FacebookProvider = FacebookProvider;
+//# sourceMappingURL=facebook.js.map

package/dist/auth/oauth/providers/facebook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"facebook.js","sourceRoot":"","sources":["../../../../src/auth/oauth/providers/facebook.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;AASH,MAAM,aAAa,GAAG,OAAO,CAAA;AAC7B,MAAM,QAAQ,GAAG,4BAA4B,aAAa,eAAe,CAAA;AACzE,MAAM,SAAS,GAAG,8BAA8B,aAAa,qBAAqB,CAAA;AAClF,MAAM,YAAY,GAAG,8BAA8B,aAAa,KAAK,CAAA;AAErE,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAA;AAElD,MAAa,gBAAgB;IAK3B,YAAY,MAA2B;QAJ9B,SAAI,GAAG,UAAmB,CAAA;QAKjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;IAED,mBAAmB,CAAC,KAAa,EAAE,aAAsB;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,cAAc,CAAA;QACnD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACrC,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YACvB,KAAK;SACN,CAAC,CAAA;QAEF,OAAO,GAAG,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAA;IAC3C,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,IAAY,EACZ,aAAsB;QAEtB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;YACvC,IAAI;YACJ,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;SACtC,CAAC,CAAA;QAEF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,SAAS,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,EAAE;YAChE,MAAM,EAAE,KAAK;SACd,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;YACnC,MAAM,IAAI,KAAK,CAAC,mCAAmC,KAAK,EAAE,CAAC,CAAA;QAC7D,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAQ,CAAA;QAE3C,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,mCAAmC,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,EAAE,CACtE,CAAA;QACH,CAAC;QAED,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,QAAQ;SACvC,CAAA;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAmB;QACtC,MAAM,MAAM,GAAG,wDAAwD,CAAA;QACvE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,YAAY,WAAW,kBAAkB,CAAC,MAAM,CAAC,iBAAiB,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAC9G,CAAA;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,sCAAsC,QAAQ,CAAC,UAAU,EAAE,CAC5D,CAAA;QACH,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAQ,CAAA;QAE3C,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,sCAAsC,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,EAAE,CACzE,CAAA;QACH,CAAC;QAED,8BAA8B;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,SAAS,CAAA;QAEnD,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;YACvB,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,0CAA0C;YACvE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;YACrB,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,MAAM;YACN,QAAQ,EAAE,UAAU;YACpB,GAAG,EAAE,IAAI;SACV,CAAA;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,aAAqB;QACtC,4DAA4D;QAC5D,uEAAuE;QACvE,MAAM,IAAI,KAAK,CACb,qDAAqD;YACnD,sDAAsD;YACtD,GAAG,SAAS,qFAAqF,CACpG,CAAA;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CAAC,eAAuB;QAChD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,UAAU,EAAE,mBAAmB;YAC/B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;YACvC,iBAAiB,EAAE,eAAe;SACnC,CAAC,CAAA;QAEF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,SAAS,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;QAEjE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;YACnC,MAAM,IAAI,KAAK,CAAC,8CAA8C,KAAK,EAAE,CAAC,CAAA;QACxE,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAQ,CAAA;QAE3C,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,QAAQ;SACvC,CAAA;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,uDAAuD;QACvD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,8BAA8B,aAAa,gCAAgC,kBAAkB,CAAC,KAAK,CAAC,EAAE,EACtG,EAAE,MAAM,EAAE,QAAQ,EAAE,CACrB,CAAA;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;YACnC,MAAM,IAAI,KAAK,CAAC,qCAAqC,KAAK,EAAE,CAAC,CAAA;QAC/D,CAAC;IACH,CAAC;CACF;AA9ID,4CA8IC"}

package/dist/auth/oauth/providers/github.d.ts

@@ -0,0 +1,25 @@
+/**
+ * GitHub OAuth Provider.
+ *
+ * Endpoints:
+ *   Auth:     https://github.com/login/oauth/authorize
+ *   Token:    https://github.com/login/oauth/access_token
+ *   UserInfo: https://api.github.com/user
+ *   Emails:   https://api.github.com/user/emails
+ *
+ * Default scopes: user:email, read:user
+ *
+ * Note: GitHub does not support PKCE or refresh tokens in the standard OAuth flow.
+ */
+import type { OAuthProviderAdapter, OAuthProviderConfig, OAuthTokens, OAuthUserProfile } from '../types';
+export declare class GithubProvider implements OAuthProviderAdapter {
+    readonly name: "github";
+    private config;
+    constructor(config: OAuthProviderConfig);
+    getAuthorizationUrl(state: string, _codeVerifier?: string): string;
+    exchangeCode(code: string, _codeVerifier?: string): Promise<OAuthTokens>;
+    getUserProfile(tokens: OAuthTokens): Promise<OAuthUserProfile>;
+    refreshToken(_refreshToken: string): Promise<OAuthTokens>;
+    revokeToken(token: string): Promise<void>;
+}
+//# sourceMappingURL=github.d.ts.map

package/dist/auth/oauth/providers/github.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../../../../src/auth/oauth/providers/github.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EACV,oBAAoB,EACpB,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EACjB,MAAM,UAAU,CAAA;AASjB,qBAAa,cAAe,YAAW,oBAAoB;IACzD,QAAQ,CAAC,IAAI,EAAG,QAAQ,CAAS;IAEjC,OAAO,CAAC,MAAM,CAAqB;gBAEvB,MAAM,EAAE,mBAAmB;IAIvC,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM;IAY5D,YAAY,CAChB,IAAI,EAAE,MAAM,EACZ,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,WAAW,CAAC;IAmCjB,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAoD9D,YAAY,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAOzD,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAuBhD"}

package/dist/auth/oauth/providers/github.js

@@ -0,0 +1,132 @@
+"use strict";
+/**
+ * GitHub OAuth Provider.
+ *
+ * Endpoints:
+ *   Auth:     https://github.com/login/oauth/authorize
+ *   Token:    https://github.com/login/oauth/access_token
+ *   UserInfo: https://api.github.com/user
+ *   Emails:   https://api.github.com/user/emails
+ *
+ * Default scopes: user:email, read:user
+ *
+ * Note: GitHub does not support PKCE or refresh tokens in the standard OAuth flow.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GithubProvider = void 0;
+const AUTH_URL = 'https://github.com/login/oauth/authorize';
+const TOKEN_URL = 'https://github.com/login/oauth/access_token';
+const USERINFO_URL = 'https://api.github.com/user';
+const EMAILS_URL = 'https://api.github.com/user/emails';
+const DEFAULT_SCOPES = ['user:email', 'read:user'];
+class GithubProvider {
+    constructor(config) {
+        this.name = 'github';
+        this.config = config;
+    }
+    getAuthorizationUrl(state, _codeVerifier) {
+        const scopes = this.config.scopes || DEFAULT_SCOPES;
+        const params = new URLSearchParams({
+            client_id: this.config.clientId,
+            redirect_uri: this.config.redirectUri,
+            scope: scopes.join(' '),
+            state,
+        });
+        return `${AUTH_URL}?${params.toString()}`;
+    }
+    async exchangeCode(code, _codeVerifier) {
+        const response = await fetch(TOKEN_URL, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Accept: 'application/json',
+            },
+            body: JSON.stringify({
+                client_id: this.config.clientId,
+                client_secret: this.config.clientSecret,
+                code,
+                redirect_uri: this.config.redirectUri,
+            }),
+        });
+        if (!response.ok) {
+            const error = await response.text();
+            throw new Error(`GitHub token exchange failed: ${error}`);
+        }
+        const data = (await response.json());
+        if (data.error) {
+            throw new Error(`GitHub token exchange failed: ${data.error_description || data.error}`);
+        }
+        return {
+            accessToken: data.access_token,
+            tokenType: data.token_type || 'Bearer',
+            scope: data.scope,
+        };
+    }
+    async getUserProfile(tokens) {
+        const headers = {
+            Authorization: `Bearer ${tokens.accessToken}`,
+            Accept: 'application/json',
+        };
+        // Fetch user info
+        const userResponse = await fetch(USERINFO_URL, { headers });
+        if (!userResponse.ok) {
+            throw new Error(`GitHub user info request failed: ${userResponse.statusText}`);
+        }
+        const userData = (await userResponse.json());
+        // Fetch emails (since the user endpoint might not include email)
+        let email = userData.email || '';
+        let emailVerified = false;
+        if (!email || tokens.scope?.includes('user:email')) {
+            try {
+                const emailsResponse = await fetch(EMAILS_URL, { headers });
+                if (emailsResponse.ok) {
+                    const emails = (await emailsResponse.json());
+                    const primaryEmail = emails.find((e) => e.primary) || emails[0];
+                    if (primaryEmail) {
+                        email = primaryEmail.email;
+                        emailVerified = primaryEmail.verified ?? false;
+                    }
+                }
+            }
+            catch {
+                // Non-critical: proceed with whatever email we have
+            }
+        }
+        // Parse name
+        const fullName = userData.name || userData.login || '';
+        const nameParts = fullName.split(' ');
+        return {
+            id: String(userData.id),
+            email,
+            emailVerified,
+            name: fullName,
+            firstName: nameParts[0] || undefined,
+            lastName: nameParts.length > 1 ? nameParts.slice(1).join(' ') : undefined,
+            avatar: userData.avatar_url,
+            provider: 'github',
+            raw: userData,
+        };
+    }
+    async refreshToken(_refreshToken) {
+        throw new Error('GitHub OAuth does not support refresh tokens in the standard flow. ' +
+            'The user must re-authenticate.');
+    }
+    async revokeToken(token) {
+        // GitHub uses the application API to revoke tokens
+        const response = await fetch(`https://api.github.com/applications/${this.config.clientId}/token`, {
+            method: 'DELETE',
+            headers: {
+                Authorization: 'Basic ' +
+                    Buffer.from(`${this.config.clientId}:${this.config.clientSecret}`).toString('base64'),
+                Accept: 'application/vnd.github+json',
+            },
+            body: JSON.stringify({ access_token: token }),
+        });
+        if (!response.ok && response.status !== 404) {
+            const error = await response.text();
+            throw new Error(`GitHub token revocation failed: ${error}`);
+        }
+    }
+}
+exports.GithubProvider = GithubProvider;
+//# sourceMappingURL=github.js.map

package/dist/auth/oauth/providers/github.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.js","sourceRoot":"","sources":["../../../../src/auth/oauth/providers/github.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AASH,MAAM,QAAQ,GAAG,0CAA0C,CAAA;AAC3D,MAAM,SAAS,GAAG,6CAA6C,CAAA;AAC/D,MAAM,YAAY,GAAG,6BAA6B,CAAA;AAClD,MAAM,UAAU,GAAG,oCAAoC,CAAA;AAEvD,MAAM,cAAc,GAAG,CAAC,YAAY,EAAE,WAAW,CAAC,CAAA;AAElD,MAAa,cAAc;IAKzB,YAAY,MAA2B;QAJ9B,SAAI,GAAG,QAAiB,CAAA;QAK/B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;IAED,mBAAmB,CAAC,KAAa,EAAE,aAAsB;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,cAAc,CAAA;QACnD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACrC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YACvB,KAAK;SACN,CAAC,CAAA;QAEF,OAAO,GAAG,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAA;IAC3C,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,IAAY,EACZ,aAAsB;QAEtB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE;YACtC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;gBACvC,IAAI;gBACJ,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;aACtC,CAAC;SACH,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;YACnC,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,EAAE,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAQ,CAAA;QAE3C,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,iCAAiC,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,KAAK,EAAE,CACxE,CAAA;QACH,CAAC;QAED,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,QAAQ;YACtC,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAA;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAmB;QACtC,MAAM,OAAO,GAAG;YACd,aAAa,EAAE,UAAU,MAAM,CAAC,WAAW,EAAE;YAC7C,MAAM,EAAE,kBAAkB;SAC3B,CAAA;QAED,kBAAkB;QAClB,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;QAC3D,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,oCAAoC,YAAY,CAAC,UAAU,EAAE,CAC9D,CAAA;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAQ,CAAA;QAEnD,iEAAiE;QACjE,IAAI,KAAK,GAAG,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAA;QAChC,IAAI,aAAa,GAAG,KAAK,CAAA;QAEzB,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACnD,IAAI,CAAC;gBACH,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;gBAC3D,IAAI,cAAc,CAAC,EAAE,EAAE,CAAC;oBACtB,MAAM,MAAM,GAAG,CAAC,MAAM,cAAc,CAAC,IAAI,EAAE,CAAU,CAAA;oBACrD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAA;oBACpE,IAAI,YAAY,EAAE,CAAC;wBACjB,KAAK,GAAG,YAAY,CAAC,KAAK,CAAA;wBAC1B,aAAa,GAAG,YAAY,CAAC,QAAQ,IAAI,KAAK,CAAA;oBAChD,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,oDAAoD;YACtD,CAAC;QACH,CAAC;QAED,aAAa;QACb,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAA;QACtD,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAErC,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvB,KAAK;YACL,aAAa;YACb,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS;YACpC,QAAQ,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;YACzE,MAAM,EAAE,QAAQ,CAAC,UAAU;YAC3B,QAAQ,EAAE,QAAQ;YAClB,GAAG,EAAE,QAAQ;SACd,CAAA;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,aAAqB;QACtC,MAAM,IAAI,KAAK,CACb,qEAAqE;YACnE,gCAAgC,CACnC,CAAA;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,mDAAmD;QACnD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,uCAAuC,IAAI,CAAC,MAAM,CAAC,QAAQ,QAAQ,EACnE;YACE,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE;gBACP,aAAa,EACX,QAAQ;oBACR,MAAM,CAAC,IAAI,CACT,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CACtD,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBACtB,MAAM,EAAE,6BAA6B;aACtC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;SAC9C,CACF,CAAA;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5C,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;YACnC,MAAM,IAAI,KAAK,CAAC,mCAAmC,KAAK,EAAE,CAAC,CAAA;QAC7D,CAAC;IACH,CAAC;CACF;AA7ID,wCA6IC"}

package/dist/auth/oauth/providers/google.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Google OAuth 2.0 + OpenID Connect Provider.
+ *
+ * Endpoints:
+ *   Auth:     https://accounts.google.com/o/oauth2/v2/auth
+ *   Token:    https://oauth2.googleapis.com/token
+ *   UserInfo: https://www.googleapis.com/oauth2/v3/userinfo
+ *   Revoke:   https://oauth2.googleapis.com/revoke
+ *
+ * Default scopes: openid, email, profile
+ */
+import type { OAuthProviderAdapter, OAuthProviderConfig, OAuthTokens, OAuthUserProfile } from '../types';
+export declare class GoogleProvider implements OAuthProviderAdapter {
+    readonly name: "google";
+    private config;
+    constructor(config: OAuthProviderConfig);
+    getAuthorizationUrl(state: string, codeVerifier?: string): string;
+    exchangeCode(code: string, codeVerifier?: string): Promise<OAuthTokens>;
+    getUserProfile(tokens: OAuthTokens): Promise<OAuthUserProfile>;
+    refreshToken(refreshToken: string): Promise<OAuthTokens>;
+    revokeToken(token: string): Promise<void>;
+}
+//# sourceMappingURL=google.d.ts.map

package/dist/auth/oauth/providers/google.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google.d.ts","sourceRoot":"","sources":["../../../../src/auth/oauth/providers/google.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EACV,oBAAoB,EACpB,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EACjB,MAAM,UAAU,CAAA;AASjB,qBAAa,cAAe,YAAW,oBAAoB;IACzD,QAAQ,CAAC,IAAI,EAAG,QAAQ,CAAS;IAEjC,OAAO,CAAC,MAAM,CAAqB;gBAEvB,MAAM,EAAE,mBAAmB;IAIvC,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM;IAuB3D,YAAY,CAChB,IAAI,EAAE,MAAM,EACZ,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,WAAW,CAAC;IAoCjB,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA0B9D,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IA6BxD,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAchD"}

package/dist/auth/oauth/providers/google.js

@@ -0,0 +1,134 @@
+"use strict";
+/**
+ * Google OAuth 2.0 + OpenID Connect Provider.
+ *
+ * Endpoints:
+ *   Auth:     https://accounts.google.com/o/oauth2/v2/auth
+ *   Token:    https://oauth2.googleapis.com/token
+ *   UserInfo: https://www.googleapis.com/oauth2/v3/userinfo
+ *   Revoke:   https://oauth2.googleapis.com/revoke
+ *
+ * Default scopes: openid, email, profile
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GoogleProvider = void 0;
+const node_crypto_1 = require("node:crypto");
+const AUTH_URL = 'https://accounts.google.com/o/oauth2/v2/auth';
+const TOKEN_URL = 'https://oauth2.googleapis.com/token';
+const USERINFO_URL = 'https://www.googleapis.com/oauth2/v3/userinfo';
+const REVOKE_URL = 'https://oauth2.googleapis.com/revoke';
+const DEFAULT_SCOPES = ['openid', 'email', 'profile'];
+class GoogleProvider {
+    constructor(config) {
+        this.name = 'google';
+        this.config = config;
+    }
+    getAuthorizationUrl(state, codeVerifier) {
+        const scopes = this.config.scopes || DEFAULT_SCOPES;
+        const params = new URLSearchParams({
+            client_id: this.config.clientId,
+            redirect_uri: this.config.redirectUri,
+            response_type: 'code',
+            scope: scopes.join(' '),
+            state,
+            access_type: 'offline', // Request refresh token
+            prompt: 'consent',
+        });
+        if (codeVerifier) {
+            const challenge = (0, node_crypto_1.createHash)('sha256')
+                .update(codeVerifier)
+                .digest('base64url');
+            params.set('code_challenge', challenge);
+            params.set('code_challenge_method', 'S256');
+        }
+        return `${AUTH_URL}?${params.toString()}`;
+    }
+    async exchangeCode(code, codeVerifier) {
+        const body = {
+            client_id: this.config.clientId,
+            client_secret: this.config.clientSecret,
+            code,
+            grant_type: 'authorization_code',
+            redirect_uri: this.config.redirectUri,
+        };
+        if (codeVerifier) {
+            body.code_verifier = codeVerifier;
+        }
+        const response = await fetch(TOKEN_URL, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams(body),
+        });
+        if (!response.ok) {
+            const error = await response.text();
+            throw new Error(`Google token exchange failed: ${error}`);
+        }
+        const data = (await response.json());
+        return {
+            accessToken: data.access_token,
+            refreshToken: data.refresh_token,
+            expiresIn: data.expires_in,
+            tokenType: data.token_type || 'Bearer',
+            idToken: data.id_token,
+            scope: data.scope,
+        };
+    }
+    async getUserProfile(tokens) {
+        const response = await fetch(USERINFO_URL, {
+            headers: { Authorization: `Bearer ${tokens.accessToken}` },
+        });
+        if (!response.ok) {
+            throw new Error(`Google user info request failed: ${response.statusText}`);
+        }
+        const data = (await response.json());
+        return {
+            id: data.sub,
+            email: data.email,
+            emailVerified: data.email_verified ?? false,
+            name: data.name ||
+                `${data.given_name || ''} ${data.family_name || ''}`.trim(),
+            firstName: data.given_name,
+            lastName: data.family_name,
+            avatar: data.picture,
+            provider: 'google',
+            raw: data,
+        };
+    }
+    async refreshToken(refreshToken) {
+        const response = await fetch(TOKEN_URL, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({
+                client_id: this.config.clientId,
+                client_secret: this.config.clientSecret,
+                refresh_token: refreshToken,
+                grant_type: 'refresh_token',
+            }),
+        });
+        if (!response.ok) {
+            const error = await response.text();
+            throw new Error(`Google token refresh failed: ${error}`);
+        }
+        const data = (await response.json());
+        return {
+            accessToken: data.access_token,
+            refreshToken: data.refresh_token || refreshToken,
+            expiresIn: data.expires_in,
+            tokenType: data.token_type || 'Bearer',
+            idToken: data.id_token,
+            scope: data.scope,
+        };
+    }
+    async revokeToken(token) {
+        const response = await fetch(`${REVOKE_URL}?token=${encodeURIComponent(token)}`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        });
+        if (!response.ok) {
+            const error = await response.text();
+            throw new Error(`Google token revocation failed: ${error}`);
+        }
+    }
+}
+exports.GoogleProvider = GoogleProvider;
+//# sourceMappingURL=google.js.map

package/dist/auth/oauth/providers/google.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google.js","sourceRoot":"","sources":["../../../../src/auth/oauth/providers/google.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAEH,6CAAwC;AAQxC,MAAM,QAAQ,GAAG,8CAA8C,CAAA;AAC/D,MAAM,SAAS,GAAG,qCAAqC,CAAA;AACvD,MAAM,YAAY,GAAG,+CAA+C,CAAA;AACpE,MAAM,UAAU,GAAG,sCAAsC,CAAA;AAEzD,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;AAErD,MAAa,cAAc;IAKzB,YAAY,MAA2B;QAJ9B,SAAI,GAAG,QAAiB,CAAA;QAK/B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;IAED,mBAAmB,CAAC,KAAa,EAAE,YAAqB;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,cAAc,CAAA;QACnD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACrC,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YACvB,KAAK;YACL,WAAW,EAAE,SAAS,EAAE,wBAAwB;YAChD,MAAM,EAAE,SAAS;SAClB,CAAC,CAAA;QAEF,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC;iBACnC,MAAM,CAAC,YAAY,CAAC;iBACpB,MAAM,CAAC,WAAW,CAAC,CAAA;YACtB,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAA;YACvC,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAA;QAC7C,CAAC;QAED,OAAO,GAAG,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAA;IAC3C,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,IAAY,EACZ,YAAqB;QAErB,MAAM,IAAI,GAA2B;YACnC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;YACvC,IAAI;YACJ,UAAU,EAAE,oBAAoB;YAChC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;SACtC,CAAA;QAED,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC,aAAa,GAAG,YAAY,CAAA;QACnC,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE;YACtC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC;SAChC,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;YACnC,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,EAAE,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAQ,CAAA;QAE3C,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,QAAQ;YACtC,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAA;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAmB;QACtC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE;YACzC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,WAAW,EAAE,EAAE;SAC3D,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,oCAAoC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAA;QAC5E,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAQ,CAAA;QAE3C,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,GAAG;YACZ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,aAAa,EAAE,IAAI,CAAC,cAAc,IAAI,KAAK;YAC3C,IAAI,EACF,IAAI,CAAC,IAAI;gBACT,GAAG,IAAI,CAAC,UAAU,IAAI,EAAE,IAAI,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE;YAC7D,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,QAAQ,EAAE,IAAI,CAAC,WAAW;YAC1B,MAAM,EAAE,IAAI,CAAC,OAAO;YACpB,QAAQ,EAAE,QAAQ;YAClB,GAAG,EAAE,IAAI;SACV,CAAA;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,YAAoB;QACrC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE;YACtC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;gBACvC,aAAa,EAAE,YAAY;gBAC3B,UAAU,EAAE,eAAe;aAC5B,CAAC;SACH,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;YACnC,MAAM,IAAI,KAAK,CAAC,gCAAgC,KAAK,EAAE,CAAC,CAAA;QAC1D,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAQ,CAAA;QAE3C,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa,IAAI,YAAY;YAChD,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,QAAQ;YACtC,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAA;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,UAAU,UAAU,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAClD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;SACjE,CACF,CAAA;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;YACnC,MAAM,IAAI,KAAK,CAAC,mCAAmC,KAAK,EAAE,CAAC,CAAA;QAC7D,CAAC;IACH,CAAC;CACF;AA5ID,wCA4IC"}

package/dist/auth/oauth/providers/microsoft.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Microsoft Entra ID (Azure AD) OAuth Provider.
+ *
+ * Endpoints:
+ *   Auth:     https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize
+ *   Token:    https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token
+ *   UserInfo: https://graph.microsoft.com/v1.0/me
+ *
+ * Supports multi-tenant ('common'), organizations-only ('organizations'),
+ * or a specific tenant ID.
+ *
+ * Default scopes: openid, email, profile, User.Read
+ */
+import type { OAuthProviderAdapter, OAuthProviderConfig, OAuthTokens, OAuthUserProfile } from '../types';
+export declare class MicrosoftProvider implements OAuthProviderAdapter {
+    readonly name: "microsoft";
+    private config;
+    private tenant;
+    constructor(config: OAuthProviderConfig);
+    private get authUrl();
+    private get tokenUrl();
+    getAuthorizationUrl(state: string, codeVerifier?: string): string;
+    exchangeCode(code: string, codeVerifier?: string): Promise<OAuthTokens>;
+    getUserProfile(tokens: OAuthTokens): Promise<OAuthUserProfile>;
+    refreshToken(refreshToken: string): Promise<OAuthTokens>;
+    revokeToken(_token: string): Promise<void>;
+}
+//# sourceMappingURL=microsoft.d.ts.map

package/dist/auth/oauth/providers/microsoft.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"microsoft.d.ts","sourceRoot":"","sources":["../../../../src/auth/oauth/providers/microsoft.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EACV,oBAAoB,EACpB,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EACjB,MAAM,UAAU,CAAA;AAKjB,qBAAa,iBAAkB,YAAW,oBAAoB;IAC5D,QAAQ,CAAC,IAAI,EAAG,WAAW,CAAS;IAEpC,OAAO,CAAC,MAAM,CAAqB;IACnC,OAAO,CAAC,MAAM,CAAQ;gBAEV,MAAM,EAAE,mBAAmB;IAKvC,OAAO,KAAK,OAAO,GAElB;IAED,OAAO,KAAK,QAAQ,GAEnB;IAED,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM;IAsB3D,YAAY,CAChB,IAAI,EAAE,MAAM,EACZ,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,WAAW,CAAC;IAoCjB,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA0B9D,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IA6BxD,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAUjD"}

package/dist/auth/oauth/providers/microsoft.js

@@ -0,0 +1,136 @@
+"use strict";
+/**
+ * Microsoft Entra ID (Azure AD) OAuth Provider.
+ *
+ * Endpoints:
+ *   Auth:     https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize
+ *   Token:    https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token
+ *   UserInfo: https://graph.microsoft.com/v1.0/me
+ *
+ * Supports multi-tenant ('common'), organizations-only ('organizations'),
+ * or a specific tenant ID.
+ *
+ * Default scopes: openid, email, profile, User.Read
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MicrosoftProvider = void 0;
+const node_crypto_1 = require("node:crypto");
+const USERINFO_URL = 'https://graph.microsoft.com/v1.0/me';
+const DEFAULT_SCOPES = ['openid', 'email', 'profile', 'User.Read'];
+class MicrosoftProvider {
+    constructor(config) {
+        this.name = 'microsoft';
+        this.config = config;
+        this.tenant = config.tenant || 'common';
+    }
+    get authUrl() {
+        return `https://login.microsoftonline.com/${this.tenant}/oauth2/v2.0/authorize`;
+    }
+    get tokenUrl() {
+        return `https://login.microsoftonline.com/${this.tenant}/oauth2/v2.0/token`;
+    }
+    getAuthorizationUrl(state, codeVerifier) {
+        const scopes = this.config.scopes || DEFAULT_SCOPES;
+        const params = new URLSearchParams({
+            client_id: this.config.clientId,
+            redirect_uri: this.config.redirectUri,
+            response_type: 'code',
+            scope: scopes.join(' '),
+            state,
+            response_mode: 'query',
+        });
+        if (codeVerifier) {
+            const challenge = (0, node_crypto_1.createHash)('sha256')
+                .update(codeVerifier)
+                .digest('base64url');
+            params.set('code_challenge', challenge);
+            params.set('code_challenge_method', 'S256');
+        }
+        return `${this.authUrl}?${params.toString()}`;
+    }
+    async exchangeCode(code, codeVerifier) {
+        const body = {
+            client_id: this.config.clientId,
+            client_secret: this.config.clientSecret,
+            code,
+            grant_type: 'authorization_code',
+            redirect_uri: this.config.redirectUri,
+        };
+        if (codeVerifier) {
+            body.code_verifier = codeVerifier;
+        }
+        const response = await fetch(this.tokenUrl, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams(body),
+        });
+        if (!response.ok) {
+            const error = await response.text();
+            throw new Error(`Microsoft token exchange failed: ${error}`);
+        }
+        const data = (await response.json());
+        return {
+            accessToken: data.access_token,
+            refreshToken: data.refresh_token,
+            expiresIn: data.expires_in,
+            tokenType: data.token_type || 'Bearer',
+            idToken: data.id_token,
+            scope: data.scope,
+        };
+    }
+    async getUserProfile(tokens) {
+        const response = await fetch(USERINFO_URL, {
+            headers: { Authorization: `Bearer ${tokens.accessToken}` },
+        });
+        if (!response.ok) {
+            throw new Error(`Microsoft user info request failed: ${response.statusText}`);
+        }
+        const data = (await response.json());
+        return {
+            id: data.id,
+            email: data.mail || data.userPrincipalName || '',
+            emailVerified: true, // Microsoft verifies emails by default
+            name: data.displayName || '',
+            firstName: data.givenName,
+            lastName: data.surname,
+            avatar: undefined, // Graph API requires a separate photo request
+            provider: 'microsoft',
+            raw: data,
+        };
+    }
+    async refreshToken(refreshToken) {
+        const response = await fetch(this.tokenUrl, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({
+                client_id: this.config.clientId,
+                client_secret: this.config.clientSecret,
+                refresh_token: refreshToken,
+                grant_type: 'refresh_token',
+            }),
+        });
+        if (!response.ok) {
+            const error = await response.text();
+            throw new Error(`Microsoft token refresh failed: ${error}`);
+        }
+        const data = (await response.json());
+        return {
+            accessToken: data.access_token,
+            refreshToken: data.refresh_token || refreshToken,
+            expiresIn: data.expires_in,
+            tokenType: data.token_type || 'Bearer',
+            idToken: data.id_token,
+            scope: data.scope,
+        };
+    }
+    async revokeToken(_token) {
+        // Microsoft's v2.0 endpoint does not have a standard revocation endpoint.
+        // Token revocation is handled via the admin portal or by signing the user out.
+        // The logout URL can be used instead:
+        //   https://login.microsoftonline.com/{tenant}/oauth2/v2.0/logout
+        throw new Error('Microsoft does not provide a standard token revocation endpoint. ' +
+            'Use the logout endpoint or revoke via the Azure admin portal.');
+    }
+}
+exports.MicrosoftProvider = MicrosoftProvider;
+//# sourceMappingURL=microsoft.js.map

package/dist/auth/oauth/providers/microsoft.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"microsoft.js","sourceRoot":"","sources":["../../../../src/auth/oauth/providers/microsoft.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AAEH,6CAAwC;AAQxC,MAAM,YAAY,GAAG,qCAAqC,CAAA;AAC1D,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CAAA;AAElE,MAAa,iBAAiB;IAM5B,YAAY,MAA2B;QAL9B,SAAI,GAAG,WAAoB,CAAA;QAMlC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAA;IACzC,CAAC;IAED,IAAY,OAAO;QACjB,OAAO,qCAAqC,IAAI,CAAC,MAAM,wBAAwB,CAAA;IACjF,CAAC;IAED,IAAY,QAAQ;QAClB,OAAO,qCAAqC,IAAI,CAAC,MAAM,oBAAoB,CAAA;IAC7E,CAAC;IAED,mBAAmB,CAAC,KAAa,EAAE,YAAqB;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,cAAc,CAAA;QACnD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACrC,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YACvB,KAAK;YACL,aAAa,EAAE,OAAO;SACvB,CAAC,CAAA;QAEF,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC;iBACnC,MAAM,CAAC,YAAY,CAAC;iBACpB,MAAM,CAAC,WAAW,CAAC,CAAA;YACtB,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAA;YACvC,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAA;QAC7C,CAAC;QAED,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAA;IAC/C,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,IAAY,EACZ,YAAqB;QAErB,MAAM,IAAI,GAA2B;YACnC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;YACvC,IAAI;YACJ,UAAU,EAAE,oBAAoB;YAChC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;SACtC,CAAA;QAED,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC,aAAa,GAAG,YAAY,CAAA;QACnC,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC;SAChC,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;YACnC,MAAM,IAAI,KAAK,CAAC,oCAAoC,KAAK,EAAE,CAAC,CAAA;QAC9D,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAQ,CAAA;QAE3C,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,QAAQ;YACtC,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAA;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAmB;QACtC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE;YACzC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,WAAW,EAAE,EAAE;SAC3D,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,uCAAuC,QAAQ,CAAC,UAAU,EAAE,CAC7D,CAAA;QACH,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAQ,CAAA;QAE3C,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,iBAAiB,IAAI,EAAE;YAChD,aAAa,EAAE,IAAI,EAAE,uCAAuC;YAC5D,IAAI,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE;YAC5B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,OAAO;YACtB,MAAM,EAAE,SAAS,EAAE,8CAA8C;YACjE,QAAQ,EAAE,WAAW;YACrB,GAAG,EAAE,IAAI;SACV,CAAA;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,YAAoB;QACrC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;gBACvC,aAAa,EAAE,YAAY;gBAC3B,UAAU,EAAE,eAAe;aAC5B,CAAC;SACH,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;YACnC,MAAM,IAAI,KAAK,CAAC,mCAAmC,KAAK,EAAE,CAAC,CAAA;QAC7D,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAQ,CAAA;QAE3C,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa,IAAI,YAAY;YAChD,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,QAAQ;YACtC,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAA;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,0EAA0E;QAC1E,+EAA+E;QAC/E,sCAAsC;QACtC,kEAAkE;QAClE,MAAM,IAAI,KAAK,CACb,mEAAmE;YACjE,+DAA+D,CAClE,CAAA;IACH,CAAC;CACF;AAjJD,8CAiJC"}