Skip to main content

Abstract Class: BaseOAuthUserInfoRoute<P>

Defined in: auth/src/routes/BaseOAuthUserInfoRoute.ts:40

Handles the OIDC /userinfo endpoint (OIDC Core §5.3). Authenticates via the OAuth access token itself (Authorization: Bearer <token>, through OAuthBearerStrategy — registered here under the fixed name "oauth_bearer"), not this library's own relying-party @Auth(["jwt"])/ACL model: a third-party OAuth client presenting a resource owner's access token isn't an ACL-scoped "user" of this app, it's a delegated caller entitled only to whatever claims the resource owner consented to share (the token's own scope).

sub is always present once openid scope is confirmed (enforced by @RequiresScope(["openid"])) — every other claim is additive per OIDC Core §5.4's profile/email/phone claim groups. Deliberately does not fetch the underlying User record: sub/scope already came from the verified token itself, so only Profile (the source of every optional claim) is ever read, via the same RepoUtils<Profile> fetch pattern used everywhere else in this library.

Extended by​

Type Parameters​

P​

P extends Profile

Constructors​

Constructor​

new BaseOAuthUserInfoRoute<P>(): BaseOAuthUserInfoRoute<P>

Returns​

BaseOAuthUserInfoRoute<P>

Properties​

authMiddleware?​

protected optional authMiddleware?: AuthMiddleware

Defined in: auth/src/routes/BaseOAuthUserInfoRoute.ts:45

oauthTokenUtils?​

protected optional oauthTokenUtils?: OAuthTokenUtils

Defined in: auth/src/routes/BaseOAuthUserInfoRoute.ts:47

profileClass​

abstract protected profileClass: any

Defined in: auth/src/routes/BaseOAuthUserInfoRoute.ts:49

profileRepo?​

protected optional profileRepo?: RepoUtils<P>

Defined in: auth/src/routes/BaseOAuthUserInfoRoute.ts:51

signingKeyClass​

abstract protected signingKeyClass: any

Defined in: auth/src/routes/BaseOAuthUserInfoRoute.ts:53

Methods​

userinfo()​

userinfo(user): Promise<any>

Defined in: auth/src/routes/BaseOAuthUserInfoRoute.ts:150

Returns claims about the authenticated resource owner, gated by the scope granted to the presented access token. sub is always present; profile/email/phone scopes each add their own claim group (OIDC Core §5.4), read from the owner's Profile — absent entirely if no such scope was granted, or if the Profile carries nothing for that group.

Parameters​

user​

JWTUser

Returns​

Promise<any>