exisjs 0.5.9 → 0.5.11

package/dist/auth/oauth/middleware.js

@@ -0,0 +1,164 @@
+"use strict";
+/**
+ * OAuth Middleware Helpers.
+ *
+ * Express-style middleware functions for handling OAuth redirects, callbacks,
+ * and authentication guards in ExisJS route handlers.
+ *
+ * @example
+ * ```ts
+ * import { oauthRedirect, oauthCallback, requireAuth } from 'exisjs/auth/oauth'
+ *
+ * app.get('/auth/google', oauthRedirect('google'))
+ * app.get('/auth/google/callback', oauthCallback('google', {
+ *   onSuccess: async (req, res, profile, tokens) => {
+ *     // Create or update user in your database
+ *     req.session.userId = profile.id
+ *     res.redirect('/dashboard')
+ *   },
+ * }))
+ *
+ * // Protect routes
+ * app.get('/dashboard', requireAuth(), (req, res) => {
+ *   res.json({ user: req.user })
+ * })
+ * ```
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.oauthRedirect = oauthRedirect;
+exports.oauthCallback = oauthCallback;
+exports.requireAuth = requireAuth;
+const errors_1 = require("../../utils/errors");
+const core_1 = require("./core");
+const DEFAULT_STATE_KEY = '_exis_oauth_state';
+const STATE_MAX_AGE_MS = 10 * 60 * 1000; // 10 minutes
+/**
+ * Middleware that redirects the user to an OAuth provider's login page.
+ * Stores the state and code verifier in the user's session for validation on callback.
+ *
+ * @param provider The OAuth provider name (e.g. 'google', 'github')
+ * @param options Optional settings like additional params or disabling PKCE
+ */
+function oauthRedirect(provider, options) {
+    return (req, res, _next) => {
+        const stateKey = options?.stateKey || DEFAULT_STATE_KEY;
+        const { url, flowState } = core_1.OAuth.getAuthUrl(provider, {
+            usePKCE: options?.usePKCE,
+            additionalParams: options?.additionalParams,
+        });
+        // Store the flow state in session
+        if (req.session) {
+            req.session[stateKey] = flowState;
+        }
+        else {
+            // If no session middleware, store in a signed cookie
+            res.cookie(stateKey, JSON.stringify(flowState), {
+                httpOnly: true,
+                secure: process.env.NODE_ENV === 'production',
+                sameSite: 'Lax',
+                maxAge: STATE_MAX_AGE_MS / 1000,
+                path: '/',
+            });
+        }
+        res.redirect(url);
+    };
+}
+/**
+ * Middleware that handles the OAuth callback from a provider.
+ * Validates the state, exchanges the authorization code for tokens,
+ * fetches the user profile, and calls the onSuccess callback.
+ *
+ * @param provider The OAuth provider name
+ * @param options Callback options including onSuccess and onError handlers
+ */
+function oauthCallback(provider, options) {
+    const stateKey = options.stateKey || DEFAULT_STATE_KEY;
+    return async (req, res, next) => {
+        try {
+            // 1. Extract code and state from the callback query params
+            const code = req.query?.code;
+            const returnedState = req.query?.state;
+            const error = req.query?.error;
+            // Handle provider-side errors
+            if (error) {
+                const errorDesc = req.query?.error_description || error;
+                throw new Error(`OAuth error from ${provider}: ${errorDesc}`);
+            }
+            if (!code) {
+                throw errors_1.HttpError.badRequest('Missing authorization code in OAuth callback');
+            }
+            // 2. Retrieve and validate the stored state
+            let flowState;
+            if (req.session && req.session[stateKey]) {
+                flowState = req.session[stateKey];
+                // Clean up
+                delete req.session[stateKey];
+            }
+            else if (req.cookies?.[stateKey]) {
+                try {
+                    flowState = JSON.parse(req.cookies[stateKey]);
+                }
+                catch {
+                    // Invalid cookie
+                }
+                // Clear the cookie
+                res.cookie(stateKey, '', { maxAge: 0, path: '/' });
+            }
+            if (!flowState) {
+                throw errors_1.HttpError.badRequest('OAuth state not found. The session may have expired. Please try again.');
+            }
+            // Validate state matches
+            if (flowState.state !== returnedState) {
+                throw errors_1.HttpError.badRequest('OAuth state mismatch. This may be a CSRF attack. Please try again.');
+            }
+            // Validate state age
+            if (Date.now() - flowState.createdAt > STATE_MAX_AGE_MS) {
+                throw errors_1.HttpError.badRequest('OAuth state has expired. Please try again.');
+            }
+            // Validate provider
+            if (flowState.provider !== provider) {
+                throw errors_1.HttpError.badRequest(`OAuth provider mismatch. Expected '${flowState.provider}', got '${provider}'.`);
+            }
+            // 3. Exchange code for tokens and get the user profile
+            const { profile, tokens } = await core_1.OAuth.handleCallback(provider, code, flowState.codeVerifier);
+            // 4. Call the success handler
+            await options.onSuccess(req, res, profile, tokens);
+        }
+        catch (err) {
+            if (options.onError) {
+                await options.onError(req, res, err instanceof Error ? err : new Error(String(err)));
+            }
+            else {
+                next(err);
+            }
+        }
+    };
+}
+/**
+ * Guard middleware that ensures the user is authenticated.
+ * Checks for `req.user` or `req.session.userId` to determine authentication status.
+ *
+ * @param options Configuration options
+ */
+function requireAuth(options) {
+    return (req, res, next) => {
+        let authenticated;
+        if (options?.isAuthenticated) {
+            authenticated = options.isAuthenticated(req);
+        }
+        else {
+            // Default check: req.user exists or session has a userId
+            authenticated = !!(req.user ||
+                (req.session && req.session.userId));
+        }
+        if (authenticated) {
+            return next();
+        }
+        // Not authenticated
+        if (options?.redirectTo && req.headers.accept?.includes('text/html')) {
+            return res.redirect(options.redirectTo);
+        }
+        return next(errors_1.HttpError.unauthorized(options?.message || 'Authentication required'));
+    };
+}
+//# sourceMappingURL=middleware.js.map

package/dist/auth/oauth/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../../src/auth/oauth/middleware.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;;AAiBH,sCA+BC;AAUD,sCAqFC;AAQD,kCAkCC;AAtLD,+CAA8C;AAC9C,iCAA8B;AAG9B,MAAM,iBAAiB,GAAG,mBAAmB,CAAA;AAC7C,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA,CAAC,aAAa;AAErD;;;;;;GAMG;AACH,SAAgB,aAAa,CAC3B,QAAgB,EAChB,OAIC;IAED,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,KAAmB,EAAE,EAAE;QAC1D,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,iBAAiB,CAAA;QACvD,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,YAAK,CAAC,UAAU,CAAC,QAAQ,EAAE;YACpD,OAAO,EAAE,OAAO,EAAE,OAAO;YACzB,gBAAgB,EAAE,OAAO,EAAE,gBAAgB;SAC5C,CAAC,CAAA;QAEF,kCAAkC;QAClC,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAChB,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAA;QACnC,CAAC;aAAM,CAAC;YACN,qDAAqD;YACrD,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE;gBAC9C,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;gBAC7C,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,gBAAgB,GAAG,IAAI;gBAC/B,IAAI,EAAE,GAAG;aACV,CAAC,CAAA;QACJ,CAAC;QAED,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IACnB,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,aAAa,CAAC,QAAgB,EAAE,OAA6B;IAC3E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,iBAAiB,CAAA;IAEtD,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC/D,IAAI,CAAC;YACH,2DAA2D;YAC3D,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,EAAE,IAAc,CAAA;YACtC,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,EAAE,KAAe,CAAA;YAChD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,EAAE,KAAe,CAAA;YAExC,8BAA8B;YAC9B,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,SAAS,GAAI,GAAG,CAAC,KAAK,EAAE,iBAA4B,IAAI,KAAK,CAAA;gBACnE,MAAM,IAAI,KAAK,CAAC,oBAAoB,QAAQ,KAAK,SAAS,EAAE,CAAC,CAAA;YAC/D,CAAC;YAED,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,kBAAS,CAAC,UAAU,CACxB,8CAA8C,CAC/C,CAAA;YACH,CAAC;YAED,4CAA4C;YAC5C,IAAI,SAAqC,CAAA;YAEzC,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzC,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAmB,CAAA;gBACnD,WAAW;gBACX,OAAO,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;YAC9B,CAAC;iBAAM,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACnC,IAAI,CAAC;oBACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAmB,CAAA;gBACjE,CAAC;gBAAC,MAAM,CAAC;oBACP,iBAAiB;gBACnB,CAAC;gBACD,mBAAmB;gBACnB,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAA;YACpD,CAAC;YAED,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,kBAAS,CAAC,UAAU,CACxB,wEAAwE,CACzE,CAAA;YACH,CAAC;YAED,yBAAyB;YACzB,IAAI,SAAS,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;gBACtC,MAAM,kBAAS,CAAC,UAAU,CACxB,oEAAoE,CACrE,CAAA;YACH,CAAC;YAED,qBAAqB;YACrB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,SAAS,GAAG,gBAAgB,EAAE,CAAC;gBACxD,MAAM,kBAAS,CAAC,UAAU,CAAC,4CAA4C,CAAC,CAAA;YAC1E,CAAC;YAED,oBAAoB;YACpB,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACpC,MAAM,kBAAS,CAAC,UAAU,CACxB,sCAAsC,SAAS,CAAC,QAAQ,WAAW,QAAQ,IAAI,CAChF,CAAA;YACH,CAAC;YAED,uDAAuD;YACvD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,YAAK,CAAC,cAAc,CACpD,QAAQ,EACR,IAAI,EACJ,SAAS,CAAC,YAAY,CACvB,CAAA;YAED,8BAA8B;YAC9B,MAAM,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;QACpD,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,OAAO,CAAC,OAAO,CACnB,GAAG,EACH,GAAG,EACH,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CACpD,CAAA;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,GAAG,CAAC,CAAA;YACX,CAAC;QACH,CAAC;IACH,CAAC,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAgB,WAAW,CAAC,OAO3B;IACC,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,IAAI,aAAsB,CAAA;QAE1B,IAAI,OAAO,EAAE,eAAe,EAAE,CAAC;YAC7B,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;QAC9C,CAAC;aAAM,CAAC;YACN,yDAAyD;YACzD,aAAa,GAAG,CAAC,CAAC,CAChB,GAAG,CAAC,IAAI;gBACR,CAAC,GAAG,CAAC,OAAO,IAAK,GAAG,CAAC,OAAe,CAAC,MAAM,CAAC,CAC7C,CAAA;QACH,CAAC;QAED,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,IAAI,EAAE,CAAA;QACf,CAAC;QAED,oBAAoB;QACpB,IAAI,OAAO,EAAE,UAAU,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACrE,OAAO,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;QACzC,CAAC;QAED,OAAO,IAAI,CACT,kBAAS,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,IAAI,yBAAyB,CAAC,CACtE,CAAA;IACH,CAAC,CAAA;AACH,CAAC"}

package/dist/auth/oauth/providers/custom.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Custom OAuth Provider.
+ *
+ * A generic adapter for any OAuth 2.0 compliant provider that isn't
+ * built in. Configure with your own auth/token/userinfo URLs and
+ * an optional profile mapping function.
+ *
+ * @example
+ * ```ts
+ * import { OAuth } from 'exisjs/auth'
+ *
+ * OAuth.custom({
+ *   name: 'keycloak',
+ *   authUrl: 'https://keycloak.example.com/realms/main/protocol/openid-connect/auth',
+ *   tokenUrl: 'https://keycloak.example.com/realms/main/protocol/openid-connect/token',
+ *   userInfoUrl: 'https://keycloak.example.com/realms/main/protocol/openid-connect/userinfo',
+ *   clientId: process.env.KC_CLIENT_ID!,
+ *   clientSecret: process.env.KC_CLIENT_SECRET!,
+ *   redirectUri: 'http://localhost:3000/auth/keycloak/callback',
+ *   scopes: ['openid', 'profile', 'email'],
+ *   mapProfile: (raw) => ({
+ *     id: raw.sub as string,
+ *     email: raw.email as string,
+ *     emailVerified: raw.email_verified as boolean,
+ *     name: raw.preferred_username as string,
+ *   }),
+ * })
+ * ```
+ */
+import type { OAuthProviderAdapter, OAuthTokens, OAuthUserProfile, CustomOAuthProviderConfig } from '../types';
+export declare class CustomProvider implements OAuthProviderAdapter {
+    readonly name: string;
+    private config;
+    constructor(config: CustomOAuthProviderConfig);
+    getAuthorizationUrl(state: string, codeVerifier?: string): string;
+    exchangeCode(code: string, codeVerifier?: string): Promise<OAuthTokens>;
+    getUserProfile(tokens: OAuthTokens): Promise<OAuthUserProfile>;
+    refreshToken(refreshToken: string): Promise<OAuthTokens>;
+    revokeToken(token: string): Promise<void>;
+}
+//# sourceMappingURL=custom.d.ts.map

package/dist/auth/oauth/providers/custom.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom.d.ts","sourceRoot":"","sources":["../../../../src/auth/oauth/providers/custom.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAGH,OAAO,KAAK,EACV,oBAAoB,EACpB,WAAW,EACX,gBAAgB,EAChB,yBAAyB,EAC1B,MAAM,UAAU,CAAA;AAEjB,qBAAa,cAAe,YAAW,oBAAoB;IACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IAErB,OAAO,CAAC,MAAM,CAA2B;gBAE7B,MAAM,EAAE,yBAAyB;IAK7C,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM;IAwB3D,YAAY,CAChB,IAAI,EAAE,MAAM,EACZ,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,WAAW,CAAC;IAoDjB,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA6C9D,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IA6CxD,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAoChD"}

package/dist/auth/oauth/providers/custom.js

@@ -0,0 +1,204 @@
+"use strict";
+/**
+ * Custom OAuth Provider.
+ *
+ * A generic adapter for any OAuth 2.0 compliant provider that isn't
+ * built in. Configure with your own auth/token/userinfo URLs and
+ * an optional profile mapping function.
+ *
+ * @example
+ * ```ts
+ * import { OAuth } from 'exisjs/auth'
+ *
+ * OAuth.custom({
+ *   name: 'keycloak',
+ *   authUrl: 'https://keycloak.example.com/realms/main/protocol/openid-connect/auth',
+ *   tokenUrl: 'https://keycloak.example.com/realms/main/protocol/openid-connect/token',
+ *   userInfoUrl: 'https://keycloak.example.com/realms/main/protocol/openid-connect/userinfo',
+ *   clientId: process.env.KC_CLIENT_ID!,
+ *   clientSecret: process.env.KC_CLIENT_SECRET!,
+ *   redirectUri: 'http://localhost:3000/auth/keycloak/callback',
+ *   scopes: ['openid', 'profile', 'email'],
+ *   mapProfile: (raw) => ({
+ *     id: raw.sub as string,
+ *     email: raw.email as string,
+ *     emailVerified: raw.email_verified as boolean,
+ *     name: raw.preferred_username as string,
+ *   }),
+ * })
+ * ```
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CustomProvider = void 0;
+const node_crypto_1 = require("node:crypto");
+class CustomProvider {
+    constructor(config) {
+        this.name = config.name;
+        this.config = config;
+    }
+    getAuthorizationUrl(state, codeVerifier) {
+        const scopes = this.config.scopes || [];
+        const params = new URLSearchParams({
+            client_id: this.config.clientId,
+            redirect_uri: this.config.redirectUri,
+            response_type: 'code',
+            state,
+        });
+        if (scopes.length > 0) {
+            params.set('scope', scopes.join(' '));
+        }
+        if (codeVerifier) {
+            const challenge = (0, node_crypto_1.createHash)('sha256')
+                .update(codeVerifier)
+                .digest('base64url');
+            params.set('code_challenge', challenge);
+            params.set('code_challenge_method', 'S256');
+        }
+        return `${this.config.authUrl}?${params.toString()}`;
+    }
+    async exchangeCode(code, codeVerifier) {
+        const body = {
+            code,
+            grant_type: 'authorization_code',
+            redirect_uri: this.config.redirectUri,
+        };
+        if (codeVerifier) {
+            body.code_verifier = codeVerifier;
+        }
+        const headers = {
+            'Content-Type': 'application/x-www-form-urlencoded',
+            Accept: 'application/json',
+        };
+        if (this.config.authMethod === 'header') {
+            // Send client credentials as Basic auth header
+            headers.Authorization =
+                'Basic ' +
+                    Buffer.from(`${this.config.clientId}:${this.config.clientSecret}`).toString('base64');
+        }
+        else {
+            // Send client credentials in the request body (default)
+            body.client_id = this.config.clientId;
+            body.client_secret = this.config.clientSecret;
+        }
+        const response = await fetch(this.config.tokenUrl, {
+            method: 'POST',
+            headers,
+            body: new URLSearchParams(body),
+        });
+        if (!response.ok) {
+            const error = await response.text();
+            throw new Error(`${this.name} token exchange failed: ${error}`);
+        }
+        const data = (await response.json());
+        return {
+            accessToken: data.access_token,
+            refreshToken: data.refresh_token,
+            expiresIn: data.expires_in,
+            tokenType: data.token_type || 'Bearer',
+            idToken: data.id_token,
+            scope: data.scope,
+        };
+    }
+    async getUserProfile(tokens) {
+        const response = await fetch(this.config.userInfoUrl, {
+            headers: { Authorization: `Bearer ${tokens.accessToken}` },
+        });
+        if (!response.ok) {
+            throw new Error(`${this.name} user info request failed: ${response.statusText}`);
+        }
+        const raw = (await response.json());
+        // Use custom profile mapper if provided
+        if (this.config.mapProfile) {
+            const mapped = this.config.mapProfile(raw);
+            return {
+                ...mapped,
+                emailVerified: mapped.emailVerified ?? false,
+                provider: this.name,
+                raw,
+            };
+        }
+        // Best-effort field mapping for common OpenID Connect fields
+        return {
+            id: String(raw.sub || raw.id || raw.user_id || ''),
+            email: String(raw.email || ''),
+            emailVerified: raw.email_verified ?? false,
+            name: String(raw.name ||
+                raw.preferred_username ||
+                raw.username ||
+                raw.display_name ||
+                ''),
+            firstName: raw.given_name,
+            lastName: raw.family_name,
+            avatar: (raw.picture || raw.avatar || raw.avatar_url),
+            provider: this.name,
+            raw,
+        };
+    }
+    async refreshToken(refreshToken) {
+        const body = {
+            refresh_token: refreshToken,
+            grant_type: 'refresh_token',
+        };
+        const headers = {
+            'Content-Type': 'application/x-www-form-urlencoded',
+            Accept: 'application/json',
+        };
+        if (this.config.authMethod === 'header') {
+            headers.Authorization =
+                'Basic ' +
+                    Buffer.from(`${this.config.clientId}:${this.config.clientSecret}`).toString('base64');
+        }
+        else {
+            body.client_id = this.config.clientId;
+            body.client_secret = this.config.clientSecret;
+        }
+        const response = await fetch(this.config.tokenUrl, {
+            method: 'POST',
+            headers,
+            body: new URLSearchParams(body),
+        });
+        if (!response.ok) {
+            const error = await response.text();
+            throw new Error(`${this.name} token refresh failed: ${error}`);
+        }
+        const data = (await response.json());
+        return {
+            accessToken: data.access_token,
+            refreshToken: data.refresh_token || refreshToken,
+            expiresIn: data.expires_in,
+            tokenType: data.token_type || 'Bearer',
+            idToken: data.id_token,
+            scope: data.scope,
+        };
+    }
+    async revokeToken(token) {
+        if (!this.config.revokeUrl) {
+            throw new Error(`${this.name} does not have a revocation endpoint configured. ` +
+                'Set revokeUrl in the provider config.');
+        }
+        const body = { token };
+        const headers = {
+            'Content-Type': 'application/x-www-form-urlencoded',
+        };
+        if (this.config.authMethod === 'header') {
+            headers.Authorization =
+                'Basic ' +
+                    Buffer.from(`${this.config.clientId}:${this.config.clientSecret}`).toString('base64');
+        }
+        else {
+            body.client_id = this.config.clientId;
+            body.client_secret = this.config.clientSecret;
+        }
+        const response = await fetch(this.config.revokeUrl, {
+            method: 'POST',
+            headers,
+            body: new URLSearchParams(body),
+        });
+        if (!response.ok) {
+            const error = await response.text();
+            throw new Error(`${this.name} token revocation failed: ${error}`);
+        }
+    }
+}
+exports.CustomProvider = CustomProvider;
+//# sourceMappingURL=custom.js.map

package/dist/auth/oauth/providers/custom.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom.js","sourceRoot":"","sources":["../../../../src/auth/oauth/providers/custom.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;;;AAEH,6CAAwC;AAQxC,MAAa,cAAc;IAKzB,YAAY,MAAiC;QAC3C,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAA;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;IAED,mBAAmB,CAAC,KAAa,EAAE,YAAqB;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAA;QACvC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACrC,aAAa,EAAE,MAAM;YACrB,KAAK;SACN,CAAC,CAAA;QAEF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;QACvC,CAAC;QAED,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC;iBACnC,MAAM,CAAC,YAAY,CAAC;iBACpB,MAAM,CAAC,WAAW,CAAC,CAAA;YACtB,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAA;YACvC,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAA;QAC7C,CAAC;QAED,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAA;IACtD,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,IAAY,EACZ,YAAqB;QAErB,MAAM,IAAI,GAA2B;YACnC,IAAI;YACJ,UAAU,EAAE,oBAAoB;YAChC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;SACtC,CAAA;QAED,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC,aAAa,GAAG,YAAY,CAAA;QACnC,CAAC;QAED,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;SAC3B,CAAA;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACxC,+CAA+C;YAC/C,OAAO,CAAC,aAAa;gBACnB,QAAQ;oBACR,MAAM,CAAC,IAAI,CACT,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CACtD,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;QACxB,CAAC;aAAM,CAAC;YACN,wDAAwD;YACxD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAA;YACrC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAA;QAC/C,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC;SAChC,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;YACnC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,2BAA2B,KAAK,EAAE,CAAC,CAAA;QACjE,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAQ,CAAA;QAE3C,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,QAAQ;YACtC,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAA;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAmB;QACtC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE;YACpD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,WAAW,EAAE,EAAE;SAC3D,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,IAAI,8BAA8B,QAAQ,CAAC,UAAU,EAAE,CAChE,CAAA;QACH,CAAC;QAED,MAAM,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAA;QAE9D,wCAAwC;QACxC,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YAC1C,OAAO;gBACL,GAAG,MAAM;gBACT,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,KAAK;gBAC5C,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,GAAG;aACJ,CAAA;QACH,CAAC;QAED,6DAA6D;QAC7D,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;YAClD,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9B,aAAa,EAAG,GAAG,CAAC,cAA0B,IAAI,KAAK;YACvD,IAAI,EAAE,MAAM,CACV,GAAG,CAAC,IAAI;gBACN,GAAG,CAAC,kBAAkB;gBACtB,GAAG,CAAC,QAAQ;gBACZ,GAAG,CAAC,YAAY;gBAChB,EAAE,CACL;YACD,SAAS,EAAE,GAAG,CAAC,UAAgC;YAC/C,QAAQ,EAAE,GAAG,CAAC,WAAiC;YAC/C,MAAM,EAAE,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,CAChC;YACpB,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,GAAG;SACJ,CAAA;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,YAAoB;QACrC,MAAM,IAAI,GAA2B;YACnC,aAAa,EAAE,YAAY;YAC3B,UAAU,EAAE,eAAe;SAC5B,CAAA;QAED,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;SAC3B,CAAA;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACxC,OAAO,CAAC,aAAa;gBACnB,QAAQ;oBACR,MAAM,CAAC,IAAI,CACT,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CACtD,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;QACxB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAA;YACrC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAA;QAC/C,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC;SAChC,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;YACnC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,0BAA0B,KAAK,EAAE,CAAC,CAAA;QAChE,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAQ,CAAA;QAE3C,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa,IAAI,YAAY;YAChD,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,QAAQ;YACtC,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAA;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,IAAI,mDAAmD;gBAC7D,uCAAuC,CAC1C,CAAA;QACH,CAAC;QAED,MAAM,IAAI,GAA2B,EAAE,KAAK,EAAE,CAAA;QAE9C,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,mCAAmC;SACpD,CAAA;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACxC,OAAO,CAAC,aAAa;gBACnB,QAAQ;oBACR,MAAM,CAAC,IAAI,CACT,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CACtD,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;QACxB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAA;YACrC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAA;QAC/C,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;YAClD,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC;SAChC,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;YACnC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,6BAA6B,KAAK,EAAE,CAAC,CAAA;QACnE,CAAC;IACH,CAAC;CACF;AAvND,wCAuNC"}

package/dist/auth/oauth/providers/discord.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Discord OAuth Provider.
+ *
+ * Endpoints:
+ *   Auth:     https://discord.com/api/oauth2/authorize
+ *   Token:    https://discord.com/api/oauth2/token
+ *   UserInfo: https://discord.com/api/v10/users/@me
+ *   Revoke:   https://discord.com/api/oauth2/token/revoke
+ *
+ * Default scopes: identify, email
+ */
+import type { OAuthProviderAdapter, OAuthProviderConfig, OAuthTokens, OAuthUserProfile } from '../types';
+export declare class DiscordProvider implements OAuthProviderAdapter {
+    readonly name: "discord";
+    private config;
+    constructor(config: OAuthProviderConfig);
+    getAuthorizationUrl(state: string, _codeVerifier?: string): string;
+    exchangeCode(code: string, _codeVerifier?: string): Promise<OAuthTokens>;
+    getUserProfile(tokens: OAuthTokens): Promise<OAuthUserProfile>;
+    refreshToken(refreshToken: string): Promise<OAuthTokens>;
+    revokeToken(token: string): Promise<void>;
+}
+//# sourceMappingURL=discord.d.ts.map

package/dist/auth/oauth/providers/discord.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discord.d.ts","sourceRoot":"","sources":["../../../../src/auth/oauth/providers/discord.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EACV,oBAAoB,EACpB,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EACjB,MAAM,UAAU,CAAA;AASjB,qBAAa,eAAgB,YAAW,oBAAoB;IAC1D,QAAQ,CAAC,IAAI,EAAG,SAAS,CAAS;IAElC,OAAO,CAAC,MAAM,CAAqB;gBAEvB,MAAM,EAAE,mBAAmB;IAIvC,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM;IAa5D,YAAY,CAChB,IAAI,EAAE,MAAM,EACZ,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,WAAW,CAAC;IA6BjB,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAoC9D,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IA4BxD,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAgBhD"}

package/dist/auth/oauth/providers/discord.js

@@ -0,0 +1,130 @@
+"use strict";
+/**
+ * Discord OAuth Provider.
+ *
+ * Endpoints:
+ *   Auth:     https://discord.com/api/oauth2/authorize
+ *   Token:    https://discord.com/api/oauth2/token
+ *   UserInfo: https://discord.com/api/v10/users/@me
+ *   Revoke:   https://discord.com/api/oauth2/token/revoke
+ *
+ * Default scopes: identify, email
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DiscordProvider = void 0;
+const AUTH_URL = 'https://discord.com/api/oauth2/authorize';
+const TOKEN_URL = 'https://discord.com/api/oauth2/token';
+const USERINFO_URL = 'https://discord.com/api/v10/users/@me';
+const REVOKE_URL = 'https://discord.com/api/oauth2/token/revoke';
+const DEFAULT_SCOPES = ['identify', 'email'];
+class DiscordProvider {
+    constructor(config) {
+        this.name = 'discord';
+        this.config = config;
+    }
+    getAuthorizationUrl(state, _codeVerifier) {
+        const scopes = this.config.scopes || DEFAULT_SCOPES;
+        const params = new URLSearchParams({
+            client_id: this.config.clientId,
+            redirect_uri: this.config.redirectUri,
+            response_type: 'code',
+            scope: scopes.join(' '),
+            state,
+        });
+        return `${AUTH_URL}?${params.toString()}`;
+    }
+    async exchangeCode(code, _codeVerifier) {
+        const response = await fetch(TOKEN_URL, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({
+                client_id: this.config.clientId,
+                client_secret: this.config.clientSecret,
+                code,
+                grant_type: 'authorization_code',
+                redirect_uri: this.config.redirectUri,
+            }),
+        });
+        if (!response.ok) {
+            const error = await response.text();
+            throw new Error(`Discord token exchange failed: ${error}`);
+        }
+        const data = (await response.json());
+        return {
+            accessToken: data.access_token,
+            refreshToken: data.refresh_token,
+            expiresIn: data.expires_in,
+            tokenType: data.token_type || 'Bearer',
+            scope: data.scope,
+        };
+    }
+    async getUserProfile(tokens) {
+        const response = await fetch(USERINFO_URL, {
+            headers: { Authorization: `Bearer ${tokens.accessToken}` },
+        });
+        if (!response.ok) {
+            throw new Error(`Discord user info request failed: ${response.statusText}`);
+        }
+        const data = (await response.json());
+        // Build avatar URL
+        let avatar;
+        if (data.avatar) {
+            const ext = data.avatar.startsWith('a_') ? 'gif' : 'png';
+            avatar = `https://cdn.discordapp.com/avatars/${data.id}/${data.avatar}.${ext}`;
+        }
+        // Discord username: pre-2023 has discriminator, post-2023 uses display name
+        const displayName = data.global_name || data.username || '';
+        return {
+            id: data.id,
+            email: data.email || '',
+            emailVerified: data.verified ?? false,
+            name: displayName,
+            firstName: undefined,
+            lastName: undefined,
+            avatar,
+            provider: 'discord',
+            raw: data,
+        };
+    }
+    async refreshToken(refreshToken) {
+        const response = await fetch(TOKEN_URL, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({
+                client_id: this.config.clientId,
+                client_secret: this.config.clientSecret,
+                refresh_token: refreshToken,
+                grant_type: 'refresh_token',
+            }),
+        });
+        if (!response.ok) {
+            const error = await response.text();
+            throw new Error(`Discord token refresh failed: ${error}`);
+        }
+        const data = (await response.json());
+        return {
+            accessToken: data.access_token,
+            refreshToken: data.refresh_token || refreshToken,
+            expiresIn: data.expires_in,
+            tokenType: data.token_type || 'Bearer',
+            scope: data.scope,
+        };
+    }
+    async revokeToken(token) {
+        const response = await fetch(REVOKE_URL, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({
+                client_id: this.config.clientId,
+                client_secret: this.config.clientSecret,
+                token,
+            }),
+        });
+        if (!response.ok) {
+            const error = await response.text();
+            throw new Error(`Discord token revocation failed: ${error}`);
+        }
+    }
+}
+exports.DiscordProvider = DiscordProvider;
+//# sourceMappingURL=discord.js.map

package/dist/auth/oauth/providers/discord.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discord.js","sourceRoot":"","sources":["../../../../src/auth/oauth/providers/discord.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AASH,MAAM,QAAQ,GAAG,0CAA0C,CAAA;AAC3D,MAAM,SAAS,GAAG,sCAAsC,CAAA;AACxD,MAAM,YAAY,GAAG,uCAAuC,CAAA;AAC5D,MAAM,UAAU,GAAG,6CAA6C,CAAA;AAEhE,MAAM,cAAc,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;AAE5C,MAAa,eAAe;IAK1B,YAAY,MAA2B;QAJ9B,SAAI,GAAG,SAAkB,CAAA;QAKhC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;IAED,mBAAmB,CAAC,KAAa,EAAE,aAAsB;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,cAAc,CAAA;QACnD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACrC,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YACvB,KAAK;SACN,CAAC,CAAA;QAEF,OAAO,GAAG,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAA;IAC3C,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,IAAY,EACZ,aAAsB;QAEtB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE;YACtC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;gBACvC,IAAI;gBACJ,UAAU,EAAE,oBAAoB;gBAChC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;aACtC,CAAC;SACH,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;YACnC,MAAM,IAAI,KAAK,CAAC,kCAAkC,KAAK,EAAE,CAAC,CAAA;QAC5D,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAQ,CAAA;QAE3C,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,QAAQ;YACtC,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAA;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAmB;QACtC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE;YACzC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,WAAW,EAAE,EAAE;SAC3D,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,qCAAqC,QAAQ,CAAC,UAAU,EAAE,CAC3D,CAAA;QACH,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAQ,CAAA;QAE3C,mBAAmB;QACnB,IAAI,MAA0B,CAAA;QAC9B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAA;YACxD,MAAM,GAAG,sCAAsC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,EAAE,CAAA;QAChF,CAAC;QAED,4EAA4E;QAC5E,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAA;QAE3D,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;YACvB,aAAa,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK;YACrC,IAAI,EAAE,WAAW;YACjB,SAAS,EAAE,SAAS;YACpB,QAAQ,EAAE,SAAS;YACnB,MAAM;YACN,QAAQ,EAAE,SAAS;YACnB,GAAG,EAAE,IAAI;SACV,CAAA;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,YAAoB;QACrC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE;YACtC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;gBACvC,aAAa,EAAE,YAAY;gBAC3B,UAAU,EAAE,eAAe;aAC5B,CAAC;SACH,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;YACnC,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,EAAE,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAQ,CAAA;QAE3C,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa,IAAI,YAAY;YAChD,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,QAAQ;YACtC,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAA;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE;YACvC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;gBACvC,KAAK;aACN,CAAC;SACH,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;YACnC,MAAM,IAAI,KAAK,CAAC,oCAAoC,KAAK,EAAE,CAAC,CAAA;QAC9D,CAAC;IACH,CAAC;CACF;AAtID,0CAsIC"}

package/dist/auth/oauth/providers/facebook.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Facebook OAuth Provider.
+ *
+ * Endpoints:
+ *   Auth:     https://www.facebook.com/v19.0/dialog/oauth
+ *   Token:    https://graph.facebook.com/v19.0/oauth/access_token
+ *   UserInfo: https://graph.facebook.com/v19.0/me
+ *
+ * Default scopes: email, public_profile
+ *
+ * Note: Facebook uses Graph API versioning. This implementation uses v19.0.
+ */
+import type { OAuthProviderAdapter, OAuthProviderConfig, OAuthTokens, OAuthUserProfile } from '../types';
+export declare class FacebookProvider implements OAuthProviderAdapter {
+    readonly name: "facebook";
+    private config;
+    constructor(config: OAuthProviderConfig);
+    getAuthorizationUrl(state: string, _codeVerifier?: string): string;
+    exchangeCode(code: string, _codeVerifier?: string): Promise<OAuthTokens>;
+    getUserProfile(tokens: OAuthTokens): Promise<OAuthUserProfile>;
+    refreshToken(_refreshToken: string): Promise<OAuthTokens>;
+    /**
+     * Exchange a short-lived token for a long-lived token (~60 days).
+     */
+    exchangeForLongLived(shortLivedToken: string): Promise<OAuthTokens>;
+    revokeToken(token: string): Promise<void>;
+}
+//# sourceMappingURL=facebook.d.ts.map

package/dist/auth/oauth/providers/facebook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"facebook.d.ts","sourceRoot":"","sources":["../../../../src/auth/oauth/providers/facebook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EACV,oBAAoB,EACpB,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EACjB,MAAM,UAAU,CAAA;AASjB,qBAAa,gBAAiB,YAAW,oBAAoB;IAC3D,QAAQ,CAAC,IAAI,EAAG,UAAU,CAAS;IAEnC,OAAO,CAAC,MAAM,CAAqB;gBAEvB,MAAM,EAAE,mBAAmB;IAIvC,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM;IAa5D,YAAY,CAChB,IAAI,EAAE,MAAM,EACZ,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,WAAW,CAAC;IAgCjB,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAoC9D,YAAY,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAU/D;;OAEG;IACG,oBAAoB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAwBnE,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAYhD"}