@authup/server-core 1.0.0-beta.26 → 1.0.0-beta.27

package/dist/http/oauth2/authorize/state/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module';
+export * from './types';
+//# sourceMappingURL=index.d.ts.map

package/dist/http/oauth2/authorize/state/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/http/oauth2/authorize/state/index.ts"],"names":[],"mappings":"AAOA,cAAc,UAAU,CAAC;AACzB,cAAc,SAAS,CAAC"}

package/dist/http/oauth2/authorize/state/index.js

@@ -0,0 +1,25 @@
+"use strict";
+/*
+ * Copyright (c) 2025.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./module"), exports);
+__exportStar(require("./types"), exports);
+//# sourceMappingURL=index.js.map

package/dist/http/oauth2/authorize/state/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/http/oauth2/authorize/state/index.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;AAEH,2CAAyB;AACzB,0CAAwB"}

package/dist/http/oauth2/authorize/state/module.d.ts

@@ -0,0 +1,27 @@
+import type { Cache } from '@authup/server-kit';
+import type { Request } from 'routup';
+import type { OAuth2AuthorizeStateData } from './types';
+export declare class OAuth2AuthorizationStateManager {
+    protected cache: Cache;
+    constructor();
+    /**
+     * Create and store a state with meta information for an incoming request.
+     *
+     * The state is stored in the cache for 30 minutes.
+     *
+     * @param req
+     * @param data
+     */
+    create(req: Request, data: OAuth2AuthorizeStateData): Promise<string>;
+    /**
+     * Verify if the request state is valid and return the stored data.
+     *
+     * The state is removed from the cache after verification.
+     *
+     * @throws OAuth2Error.stateInvalid
+     *
+     * @param req
+     */
+    verify(req: Request): Promise<OAuth2AuthorizeStateData>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/http/oauth2/authorize/state/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/http/oauth2/authorize/state/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAIhD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAGtC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,SAAS,CAAC;AAExD,qBAAa,+BAA+B;IACxC,SAAS,CAAC,KAAK,EAAG,KAAK,CAAC;;IAMxB;;;;;;;OAOG;IACG,MAAM,CACR,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,wBAAwB,GAC9B,OAAO,CAAC,MAAM,CAAC;IAuBnB;;;;;;;;OAQG;IACG,MAAM,CAAC,GAAG,EAAE,OAAO,GAAI,OAAO,CAAC,wBAAwB,CAAC;CAiCjE"}

package/dist/http/oauth2/authorize/state/module.js

@@ -0,0 +1,78 @@
+"use strict";
+/*
+ * Copyright (c) 2025.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuth2AuthorizationStateManager = void 0;
+const kit_1 = require("@authup/kit");
+const server_kit_1 = require("@authup/server-kit");
+const specs_1 = require("@authup/specs");
+const query_1 = require("@routup/basic/query");
+const routup_1 = require("routup");
+const constants_1 = require("../../constants");
+class OAuth2AuthorizationStateManager {
+    constructor() {
+        this.cache = (0, server_kit_1.useCache)();
+    }
+    /**
+     * Create and store a state with meta information for an incoming request.
+     *
+     * The state is stored in the cache for 30 minutes.
+     *
+     * @param req
+     * @param data
+     */
+    async create(req, data) {
+        const state = (0, kit_1.createNanoID)();
+        const ip = (0, routup_1.getRequestIP)(req, {
+            trustProxy: true,
+        });
+        const userAgent = (0, routup_1.getRequestHeader)(req, 'user-agent');
+        await this.cache.set((0, server_kit_1.buildCacheKey)({ prefix: constants_1.OAuth2CachePrefix.AUTHORIZATION_CODE, key: state }), {
+            ip,
+            userAgent,
+            data,
+        }, {
+            ttl: 1000 * 60 * 30, // 30 min
+        });
+        return state;
+    }
+    /**
+     * Verify if the request state is valid and return the stored data.
+     *
+     * The state is removed from the cache after verification.
+     *
+     * @throws OAuth2Error.stateInvalid
+     *
+     * @param req
+     */
+    async verify(req) {
+        const query = (0, query_1.useRequestQuery)(req);
+        if (typeof query.state !== 'string') {
+            throw specs_1.OAuth2Error.stateInvalid();
+        }
+        const cacheKey = (0, server_kit_1.buildCacheKey)({ prefix: constants_1.OAuth2CachePrefix.AUTHORIZATION_CODE, key: query.state });
+        const cached = await this.cache.get(cacheKey);
+        if (!cached) {
+            throw specs_1.OAuth2Error.stateInvalid();
+        }
+        // avoid replay attack :)
+        await this.cache.drop(cacheKey);
+        const ip = (0, routup_1.getRequestIP)(req, {
+            trustProxy: true,
+        });
+        if (ip !== cached.ip) {
+            throw specs_1.OAuth2Error.stateInvalid();
+        }
+        const userAgent = (0, routup_1.getRequestHeader)(req, 'user-agent');
+        if (userAgent !== cached.userAgent) {
+            throw specs_1.OAuth2Error.stateInvalid();
+        }
+        return cached.data;
+    }
+}
+exports.OAuth2AuthorizationStateManager = OAuth2AuthorizationStateManager;
+//# sourceMappingURL=module.js.map

package/dist/http/oauth2/authorize/state/module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.js","sourceRoot":"","sources":["../../../../../src/http/oauth2/authorize/state/module.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAEH,qCAA2C;AAE3C,mDAA6D;AAC7D,yCAA4C;AAC5C,+CAAsD;AAEtD,mCAAwD;AACxD,+CAAoD;AAGpD,MAAa,+BAA+B;IAGxC;QACI,IAAI,CAAC,KAAK,GAAG,IAAA,qBAAQ,GAAE,CAAC;IAC5B,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CACR,GAAY,EACZ,IAA8B;QAE9B,MAAM,KAAK,GAAG,IAAA,kBAAY,GAAE,CAAC;QAE7B,MAAM,EAAE,GAAG,IAAA,qBAAY,EAAC,GAAG,EAAE;YACzB,UAAU,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,IAAA,yBAAgB,EAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAEtD,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAChB,IAAA,0BAAa,EAAC,EAAE,MAAM,EAAE,6BAAiB,CAAC,kBAAkB,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAC3E;YACI,EAAE;YACF,SAAS;YACT,IAAI;SACP,EACD;YACI,GAAG,EAAE,IAAI,GAAG,EAAE,GAAG,EAAE,EAAE,SAAS;SACjC,CACJ,CAAC;QAEF,OAAO,KAAK,CAAC;IACjB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,MAAM,CAAC,GAAY;QACrB,MAAM,KAAK,GAAG,IAAA,uBAAe,EAAC,GAAG,CAAC,CAAC;QACnC,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,mBAAW,CAAC,YAAY,EAAE,CAAC;QACrC,CAAC;QAED,MAAM,QAAQ,GAAG,IAAA,0BAAa,EAAC,EAAE,MAAM,EAAE,6BAAiB,CAAC,kBAAkB,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QACnG,MAAM,MAAM,GAIR,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,mBAAW,CAAC,YAAY,EAAE,CAAC;QACrC,CAAC;QAED,yBAAyB;QACzB,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEhC,MAAM,EAAE,GAAG,IAAA,qBAAY,EAAC,GAAG,EAAE;YACzB,UAAU,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,IAAI,EAAE,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;YACnB,MAAM,mBAAW,CAAC,YAAY,EAAE,CAAC;QACrC,CAAC;QAED,MAAM,SAAS,GAAG,IAAA,yBAAgB,EAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QACtD,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YACjC,MAAM,mBAAW,CAAC,YAAY,EAAE,CAAC;QACrC,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAAC;IACvB,CAAC;CACJ;AAnFD,0EAmFC"}

package/dist/http/oauth2/authorize/state/types.d.ts

@@ -0,0 +1,5 @@
+import type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';
+export type OAuth2AuthorizeStateData = {
+    codeRequest?: OAuth2AuthorizationCodeRequest;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/http/oauth2/authorize/state/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/http/oauth2/authorize/state/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAEvE,MAAM,MAAM,wBAAwB,GAAG;IACnC,WAAW,CAAC,EAAE,8BAA8B,CAAA;CAC/C,CAAC"}

package/dist/http/oauth2/authorize/state/types.js

@@ -0,0 +1,9 @@
+"use strict";
+/*
+ * Copyright (c) 2025.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/http/oauth2/authorize/state/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../../src/http/oauth2/authorize/state/types.ts"],"names":[],"mappings":";AAAA;;;;;GAKG"}

package/dist/http/oauth2/authorize/types.d.ts

@@ -1,9 +1,15 @@
-export type OAuth2AuthorizationServiceOptions = {
+import type { Client, ClientScope, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';
+export type OAuth2AuthorizationManagerOptions = {
     issuer: string;
     accessTokenMaxAge: number;
     authorizationCodeMaxAge: number;
     idTokenMaxAge: number;
 };
+export type OAuth2AuthorizationCodeRequestContainer = {
+    data: OAuth2AuthorizationCodeRequest;
+    client: Client;
+    clientScopes: ClientScope[];
+};
 export type OAuth2AuthorizationResult = {
     authorizationCode?: string;
     accessToken?: string;

package/dist/http/oauth2/authorize/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/http/oauth2/authorize/types.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,iCAAiC,GAAG;IAC5C,MAAM,EAAE,MAAM,CAAC;IAEf,iBAAiB,EAAE,MAAM,CAAC;IAE1B,uBAAuB,EAAE,MAAM,CAAC;IAEhC,aAAa,EAAE,MAAM,CAAA;CACxB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACpC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;CACjB,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/http/oauth2/authorize/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAE5F,MAAM,MAAM,iCAAiC,GAAG;IAC5C,MAAM,EAAE,MAAM,CAAC;IAEf,iBAAiB,EAAE,MAAM,CAAC;IAE1B,uBAAuB,EAAE,MAAM,CAAC;IAEhC,aAAa,EAAE,MAAM,CAAA;CACxB,CAAC;AAEF,MAAM,MAAM,uCAAuC,GAAG;IAClD,IAAI,EAAE,8BAA8B,CAAC;IAErC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,WAAW,EAAE,CAAA;CAC9B,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACpC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;CACjB,CAAC"}

package/dist/http/oauth2/authorize/validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../../src/http/oauth2/authorize/validation.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAQvE,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEpC,qBAAa,yBAA0B,SAAQ,SAAS,CAAC,8BAA8B,CAAC;IACpF,SAAS,CAAC,UAAU;CAsGvB"}
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../../src/http/oauth2/authorize/validation.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAQvE,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAGpC,qBAAa,yBAA0B,SAAQ,SAAS,CAAC,8BAA8B,CAAC;IACpF,SAAS,CAAC,UAAU;CAoEvB"}

package/dist/http/oauth2/authorize/validation.js

@@ -5,78 +5,43 @@
  * For the full copyright and license information,
  * view the LICENSE file that was distributed with this source code.
  */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthorizeRequestValidator = void 0;
 const specs_1 = require("@authup/specs");
-const adapter_validator_1 = require("@validup/adapter-validator");
+const adapter_zod_1 = require("@validup/adapter-zod");
 const validup_1 = require("validup");
+const zod_1 = __importDefault(require("zod"));
 class AuthorizeRequestValidator extends validup_1.Container {
     initialize() {
         super.initialize();
-        this.mount('response_type', (0, adapter_validator_1.createValidator)(() => {
-            const chain = (0, adapter_validator_1.createValidationChain)();
-            return chain
-                .exists()
-                .isString()
-                .notEmpty()
-                .custom((value) => {
-                const availableResponseTypes = Object.values(specs_1.OAuth2AuthorizationResponseType);
-                const responseTypes = value.split(' ');
-                for (let i = 0; i < responseTypes.length; i++) {
-                    if (availableResponseTypes.indexOf(responseTypes[i]) === -1) {
-                        throw specs_1.OAuth2Error.responseTypeUnsupported();
-                    }
+        this.mount('response_type', (0, adapter_zod_1.createValidator)(zod_1.default
+            .string()
+            .nonempty()
+            .check((ctx) => {
+            const availableResponseTypes = Object.values(specs_1.OAuth2AuthorizationResponseType);
+            const responseTypes = ctx.value.split(' ');
+            for (let i = 0; i < responseTypes.length; i++) {
+                if (availableResponseTypes.indexOf(responseTypes[i]) === -1) {
+                    const error = specs_1.OAuth2Error.responseTypeUnsupported();
+                    ctx.issues.push({
+                        input: responseTypes[i],
+                        code: 'custom',
+                        message: error.message,
+                    });
                 }
-                return true;
-            });
-        }));
-        this.mount('redirect_uri', (0, adapter_validator_1.createValidator)(() => {
-            const chain = (0, adapter_validator_1.createValidationChain)();
-            return chain
-                .exists()
-                .notEmpty()
-                .isURL()
-                .isLength({ min: 3, max: 2000 });
-        }));
-        this.mount('scope', (0, adapter_validator_1.createValidator)(() => {
-            const chain = (0, adapter_validator_1.createValidationChain)();
-            return chain
-                .exists()
-                .notEmpty()
-                .isString()
-                .isLength({ min: 3, max: 512 });
-        }));
-        this.mount('state', { optional: true }, (0, adapter_validator_1.createValidator)(() => {
-            const chain = (0, adapter_validator_1.createValidationChain)();
-            return chain
-                .exists()
-                .notEmpty()
-                .isString()
-                .isLength({ min: 5, max: 2048 })
-                .optional({ values: 'null' });
-        }));
-        this.mount('code_challenge', { optional: true }, (0, adapter_validator_1.createValidator)(() => {
-            const chain = (0, adapter_validator_1.createValidationChain)();
-            return chain
-                .isString()
-                .isLength({ max: 256 })
-                .optional({ values: 'null' });
-        }));
-        this.mount('code_challenge_method', { optional: true }, (0, adapter_validator_1.createValidator)(() => {
-            const chain = (0, adapter_validator_1.createValidationChain)();
-            return chain
-                .isString()
-                .isIn(Object.values(specs_1.OAuth2AuthorizationCodeChallengeMethod))
-                .optional({ values: 'null' });
-        }));
-        this.mount('client_id', (0, adapter_validator_1.createValidator)(() => {
-            const chain = (0, adapter_validator_1.createValidationChain)();
-            return chain
-                .exists()
-                .notEmpty()
-                .isString()
-                .isUUID();
-        }));
+            }
+            return zod_1.default.NEVER;
+        })));
+        this.mount('redirect_uri', (0, adapter_zod_1.createValidator)(zod_1.default.string().url()));
+        this.mount('scope', (0, adapter_zod_1.createValidator)(zod_1.default.string().min(3).max(512)));
+        this.mount('state', { optional: true }, (0, adapter_zod_1.createValidator)(zod_1.default.string().min(5).max(2048).nullable()));
+        this.mount('code_challenge', { optional: true }, (0, adapter_zod_1.createValidator)(zod_1.default.string().min(1).max(256).nullable()));
+        this.mount('code_challenge_method', { optional: true }, (0, adapter_zod_1.createValidator)(zod_1.default.nativeEnum(specs_1.OAuth2AuthorizationCodeChallengeMethod).nullable()));
+        this.mount('realm_id', { optional: true }, (0, adapter_zod_1.createValidator)(zod_1.default.string().nonempty()));
+        this.mount('client_id', (0, adapter_zod_1.createValidator)(zod_1.default.string().nonempty()));
     }
 }
 exports.AuthorizeRequestValidator = AuthorizeRequestValidator;

package/dist/http/oauth2/authorize/validation.js.map

@@ -1 +1 @@
-{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../../../src/http/oauth2/authorize/validation.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAGH,yCAIuB;AAEvB,kEAAoF;AACpF,qCAAoC;AAEpC,MAAa,yBAA0B,SAAQ,mBAAyC;IAC1E,UAAU;QAChB,KAAK,CAAC,UAAU,EAAE,CAAC;QAEnB,IAAI,CAAC,KAAK,CACN,eAAe,EACf,IAAA,mCAAe,EAAC,GAAG,EAAE;YACjB,MAAM,KAAK,GAAG,IAAA,yCAAqB,GAAE,CAAC;YACtC,OAAO,KAAK;iBACP,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,EAAE;iBACV,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;gBACd,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,CAAC,uCAA+B,CAAC,CAAC;gBAC9E,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAEvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBAC5C,IAAI,sBAAsB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;wBAC1D,MAAM,mBAAW,CAAC,uBAAuB,EAAE,CAAC;oBAChD,CAAC;gBACL,CAAC;gBAED,OAAO,IAAI,CAAC;YAChB,CAAC,CAAC,CAAC;QACX,CAAC,CAAC,CACL,CAAC;QAEF,IAAI,CAAC,KAAK,CACN,cAAc,EACd,IAAA,mCAAe,EAAC,GAAG,EAAE;YACjB,MAAM,KAAK,GAAG,IAAA,yCAAqB,GAAE,CAAC;YACtC,OAAO,KAAK;iBACP,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,KAAK,EAAE;iBACP,QAAQ,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC,CAAC,CACL,CAAC;QAEF,IAAI,CAAC,KAAK,CACN,OAAO,EACP,IAAA,mCAAe,EAAC,GAAG,EAAE;YACjB,MAAM,KAAK,GAAG,IAAA,yCAAqB,GAAE,CAAC;YACtC,OAAO,KAAK;iBACP,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,EAAE;iBACV,QAAQ,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QACxC,CAAC,CAAC,CACL,CAAC;QAEF,IAAI,CAAC,KAAK,CACN,OAAO,EACP,EAAE,QAAQ,EAAE,IAAI,EAAE,EAClB,IAAA,mCAAe,EAAC,GAAG,EAAE;YACjB,MAAM,KAAK,GAAG,IAAA,yCAAqB,GAAE,CAAC;YACtC,OAAO,KAAK;iBACP,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,EAAE;iBACV,QAAQ,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;iBAC/B,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACtC,CAAC,CAAC,CACL,CAAC;QAEF,IAAI,CAAC,KAAK,CACN,gBAAgB,EAChB,EAAE,QAAQ,EAAE,IAAI,EAAE,EAClB,IAAA,mCAAe,EAAC,GAAG,EAAE;YACjB,MAAM,KAAK,GAAG,IAAA,yCAAqB,GAAE,CAAC;YAEtC,OAAO,KAAK;iBACP,QAAQ,EAAE;iBACV,QAAQ,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;iBACtB,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACtC,CAAC,CAAC,CACL,CAAC;QAEF,IAAI,CAAC,KAAK,CACN,uBAAuB,EACvB,EAAE,QAAQ,EAAE,IAAI,EAAE,EAClB,IAAA,mCAAe,EAAC,GAAG,EAAE;YACjB,MAAM,KAAK,GAAG,IAAA,yCAAqB,GAAE,CAAC;YAEtC,OAAO,KAAK;iBACP,QAAQ,EAAE;iBACV,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,8CAAsC,CAAC,CAAC;iBAC3D,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACtC,CAAC,CAAC,CACL,CAAC;QAEF,IAAI,CAAC,KAAK,CACN,WAAW,EACX,IAAA,mCAAe,EAAC,GAAG,EAAE;YACjB,MAAM,KAAK,GAAG,IAAA,yCAAqB,GAAE,CAAC;YACtC,OAAO,KAAK;iBACP,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,EAAE;iBACV,MAAM,EAAE,CAAC;QAClB,CAAC,CAAC,CACL,CAAC;IACN,CAAC;CACJ;AAvGD,8DAuGC"}
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../../../src/http/oauth2/authorize/validation.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;AAGH,yCAIuB;AAEvB,sDAAuD;AACvD,qCAAoC;AACpC,8CAAsB;AAEtB,MAAa,yBAA0B,SAAQ,mBAAyC;IAC1E,UAAU;QAChB,KAAK,CAAC,UAAU,EAAE,CAAC;QAEnB,IAAI,CAAC,KAAK,CACN,eAAe,EACf,IAAA,6BAAe,EACX,aAAG;aACE,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACX,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,CAAC,uCAA+B,CAAC,CAAC;YAC9E,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAsC,CAAC;YAEhF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC5C,IAAI,sBAAsB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;oBAC1D,MAAM,KAAK,GAAG,mBAAW,CAAC,uBAAuB,EAAE,CAAC;oBACpD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;wBACZ,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC;wBACvB,IAAI,EAAE,QAAQ;wBACd,OAAO,EAAE,KAAK,CAAC,OAAO;qBACzB,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;YAED,OAAO,aAAG,CAAC,KAAK,CAAC;QACrB,CAAC,CAAC,CACT,CACJ,CAAC;QAEF,IAAI,CAAC,KAAK,CACN,cAAc,EACd,IAAA,6BAAe,EAAC,aAAG,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,CACtC,CAAC;QAEF,IAAI,CAAC,KAAK,CACN,OAAO,EACP,IAAA,6BAAe,EAAC,aAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAChD,CAAC;QAEF,IAAI,CAAC,KAAK,CACN,OAAO,EACP,EAAE,QAAQ,EAAE,IAAI,EAAE,EAClB,IAAA,6BAAe,EAAC,aAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAC5D,CAAC;QAEF,IAAI,CAAC,KAAK,CACN,gBAAgB,EAChB,EAAE,QAAQ,EAAE,IAAI,EAAE,EAClB,IAAA,6BAAe,EAAC,aAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,CAC3D,CAAC;QAEF,IAAI,CAAC,KAAK,CACN,uBAAuB,EACvB,EAAE,QAAQ,EAAE,IAAI,EAAE,EAClB,IAAA,6BAAe,EAAC,aAAG,CAAC,UAAU,CAAC,8CAAsC,CAAC,CAAC,QAAQ,EAAE,CAAC,CACrF,CAAC;QAEF,IAAI,CAAC,KAAK,CACN,UAAU,EACV,EAAE,QAAQ,EAAE,IAAI,EAAE,EAClB,IAAA,6BAAe,EAAC,aAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;QAEF,IAAI,CAAC,KAAK,CACN,WAAW,EACX,IAAA,6BAAe,EAAC,aAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;IACN,CAAC;CACJ;AArED,8DAqEC"}

package/dist/http/oauth2/constants.d.ts

@@ -1,4 +1,5 @@
 export declare enum OAuth2CachePrefix {
+    AUTHORIZATION_STATE = "oauth2_authorization_state",
     AUTHORIZATION_CODE = "oauth2_authorization_code",
     TOKEN_CLAIMS = "oauth2_token_claims",
     TOKEN_INACTIVE = "oauth2_token_blocked"

package/dist/http/oauth2/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/http/oauth2/constants.ts"],"names":[],"mappings":"AAOA,oBAAY,iBAAiB;IACzB,kBAAkB,8BAA8B;IAChD,YAAY,wBAAwB;IACpC,cAAc,yBAAyB;CAC1C"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/http/oauth2/constants.ts"],"names":[],"mappings":"AAOA,oBAAY,iBAAiB;IACzB,mBAAmB,+BAA+B;IAClD,kBAAkB,8BAA8B;IAChD,YAAY,wBAAwB;IACpC,cAAc,yBAAyB;CAC1C"}

package/dist/http/oauth2/constants.js

@@ -9,6 +9,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.OAuth2CachePrefix = void 0;
 var OAuth2CachePrefix;
 (function (OAuth2CachePrefix) {
+    OAuth2CachePrefix["AUTHORIZATION_STATE"] = "oauth2_authorization_state";
     OAuth2CachePrefix["AUTHORIZATION_CODE"] = "oauth2_authorization_code";
     OAuth2CachePrefix["TOKEN_CLAIMS"] = "oauth2_token_claims";
     OAuth2CachePrefix["TOKEN_INACTIVE"] = "oauth2_token_blocked";

package/dist/http/oauth2/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/http/oauth2/constants.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAEH,IAAY,iBAIX;AAJD,WAAY,iBAAiB;IACzB,qEAAgD,CAAA;IAChD,yDAAoC,CAAA;IACpC,4DAAuC,CAAA;AAC3C,CAAC,EAJW,iBAAiB,iCAAjB,iBAAiB,QAI5B"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/http/oauth2/constants.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAEH,IAAY,iBAKX;AALD,WAAY,iBAAiB;IACzB,uEAAkD,CAAA;IAClD,qEAAgD,CAAA;IAChD,yDAAoC,CAAA;IACpC,4DAAuC,CAAA;AAC3C,CAAC,EALW,iBAAiB,iCAAjB,iBAAiB,QAK5B"}

package/dist/http/oauth2/grant-types/authorize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../../src/http/oauth2/grant-types/authorize.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAM9D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAMhE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAGtC,OAAO,EAAE,iCAAiC,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAIpC,qBAAa,kBAAmB,SAAQ,aAAc,YAAW,KAAK;IAClE,SAAS,CAAC,cAAc,EAAG,iCAAiC,CAAC;;IAOvD,GAAG,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,wBAAwB,CAAC;IAmCzD,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,uBAAuB,CAAC;IAiCnE,SAAS,CAAC,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAI,MAAM;IAS5D,SAAS,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAI,MAAM;IASrD,SAAS,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAI,MAAM,GAAG,SAAS;CAezE"}
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../../src/http/oauth2/grant-types/authorize.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAO9D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAMhE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAGtC,OAAO,EAAE,iCAAiC,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAIpC,qBAAa,kBAAmB,SAAQ,aAAc,YAAW,KAAK;IAClE,SAAS,CAAC,cAAc,EAAG,iCAAiC,CAAC;;IAOvD,GAAG,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,wBAAwB,CAAC;IAsCzD,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,uBAAuB,CAAC;IAiCnE,SAAS,CAAC,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAI,MAAM;IAS5D,SAAS,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAI,MAAM;IASrD,SAAS,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAI,MAAM,GAAG,SAAS;CAezE"}

package/dist/http/oauth2/grant-types/authorize.js

@@ -39,7 +39,8 @@ class AuthorizeGrantType extends abstract_1.AbstractGrant {
             refreshToken,
             refreshTokenPayload,
         };
-        if ((0, core_kit_1.hasOAuth2OpenIDScope)(authorizationCode.scope)) {
+        if (authorizationCode.scope &&
+            (0, specs_1.hasOAuth2Scopes)(authorizationCode.scope, core_kit_1.ScopeName.OPEN_ID)) {
             buildContext.idToken = authorizationCode.id_token;
         }
         return (0, response_1.buildOAuth2BearerTokenResponse)(buildContext);

package/dist/http/oauth2/grant-types/authorize.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../../../src/http/oauth2/grant-types/authorize.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAGH,yCAIuB;AAEvB,+CAE0B;AAC1B,6CAAoD;AACpD,+CAAsD;AAEtD,mCAAsC;AACtC,4CAAwD;AACxD,wDAA4E;AAC5E,yCAA2C;AAG3C,0CAA6D;AAE7D,MAAa,kBAAmB,SAAQ,wBAAa;IAGjD;QACI,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,cAAc,GAAG,IAAI,8CAAiC,EAAE,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAgB;QACtB,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAEvD,MAAM,EACF,OAAO,EAAE,kBAAkB,EAC3B,KAAK,EAAE,WAAW,GACrB,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC;YAC5B,aAAa,EAAE,IAAA,qBAAY,EAAC,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;YAC1D,GAAG,EAAE,iBAAiB,CAAC,OAAO;YAC9B,OAAO,EAAE,qBAAa,CAAC,IAAI;YAC3B,OAAO,EAAE,iBAAiB,CAAC,QAAQ;YACnC,SAAS,EAAE,iBAAiB,CAAC,UAAU;YACvC,KAAK,EAAE,iBAAiB,CAAC,KAAK;YAC9B,QAAQ,EAAE,iBAAiB,CAAC,SAAS;SACxC,CAAC,CAAC;QAEH,MAAM,EACF,KAAK,EAAE,YAAY,EACnB,OAAO,EAAE,mBAAmB,GAC/B,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;QAErD,MAAM,YAAY,GAAsC;YACpD,WAAW;YACX,kBAAkB;YAClB,YAAY;YACZ,mBAAmB;SACtB,CAAC;QAEF,IAAI,IAAA,+BAAoB,EAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,YAAY,CAAC,OAAO,GAAG,iBAAiB,CAAC,QAAQ,CAAC;QACtD,CAAC;QAED,OAAO,IAAA,yCAA8B,EAAC,YAAY,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAgB;QAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAE5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,mBAAW,CAAC,YAAY,EAAE,CAAC;QACrC,CAAC;QAED,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,WAAW,GAAG,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC;YAE1D,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,YAAY,KAAK,WAAW,EAAE,CAAC;gBACtD,MAAM,mBAAW,CAAC,mBAAmB,EAAE,CAAC;YAC5C,CAAC;QACL,CAAC;QAED,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YACjE,IAAI,MAAM,CAAC,qBAAqB,KAAK,8CAAsC,CAAC,KAAK,EAAE,CAAC;gBAChF,IAAI,YAAY,KAAK,MAAM,CAAC,cAAc,EAAE,CAAC;oBACzC,MAAM,mBAAW,CAAC,YAAY,CAAC,8BAA8B,CAAC,CAAC;gBACnE,CAAC;YACL,CAAC;iBAAM,CAAC;gBACJ,MAAM,gBAAgB,GAAG,MAAM,IAAA,oCAAwB,EAAC,YAAY,CAAC,CAAC;gBACtE,IAAI,gBAAgB,KAAK,MAAM,CAAC,cAAc,EAAE,CAAC;oBAC7C,MAAM,mBAAW,CAAC,YAAY,CAAC,8BAA8B,CAAC,CAAC;gBACnE,CAAC;YACL,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;IAES,uBAAuB,CAAC,OAAgB;QAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAC/D,IAAI,CAAC,WAAW,EAAE,CAAC;YACf,MAAM,mBAAW,CAAC,mBAAmB,EAAE,CAAC;QAC5C,CAAC;QAED,OAAO,WAAW,CAAC;IACvB,CAAC;IAES,gBAAgB,CAAC,OAAgB;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,MAAM,mBAAW,CAAC,cAAc,EAAE,CAAC;QACvC,CAAC;QAED,OAAO,IAAI,CAAC;IAChB,CAAC;IAES,YAAY,CAAC,GAAY,EAAE,GAAW;QAC5C,IAAI,KAAK,GAAG,IAAA,qBAAc,EAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,KAAK,GAAG,IAAA,uBAAe,EAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC;QAED,IACI,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,CAAC,MAAM,GAAG,CAAC,EAClB,CAAC;YACC,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,OAAO,SAAS,CAAC;IACrB,CAAC;CACJ;AA7GD,gDA6GC"}
+{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../../../src/http/oauth2/grant-types/authorize.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAGH,yCAKuB;AAEvB,+CAE0B;AAC1B,6CAAoD;AACpD,+CAAsD;AAEtD,mCAAsC;AACtC,4CAAwD;AACxD,wDAA4E;AAC5E,yCAA2C;AAG3C,0CAA6D;AAE7D,MAAa,kBAAmB,SAAQ,wBAAa;IAGjD;QACI,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,cAAc,GAAG,IAAI,8CAAiC,EAAE,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAgB;QACtB,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAEvD,MAAM,EACF,OAAO,EAAE,kBAAkB,EAC3B,KAAK,EAAE,WAAW,GACrB,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC;YAC5B,aAAa,EAAE,IAAA,qBAAY,EAAC,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;YAC1D,GAAG,EAAE,iBAAiB,CAAC,OAAO;YAC9B,OAAO,EAAE,qBAAa,CAAC,IAAI;YAC3B,OAAO,EAAE,iBAAiB,CAAC,QAAQ;YACnC,SAAS,EAAE,iBAAiB,CAAC,UAAU;YACvC,KAAK,EAAE,iBAAiB,CAAC,KAAK;YAC9B,QAAQ,EAAE,iBAAiB,CAAC,SAAS;SACxC,CAAC,CAAC;QAEH,MAAM,EACF,KAAK,EAAE,YAAY,EACnB,OAAO,EAAE,mBAAmB,GAC/B,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;QAErD,MAAM,YAAY,GAAsC;YACpD,WAAW;YACX,kBAAkB;YAClB,YAAY;YACZ,mBAAmB;SACtB,CAAC;QAEF,IACI,iBAAiB,CAAC,KAAK;YACvB,IAAA,uBAAe,EAAC,iBAAiB,CAAC,KAAK,EAAE,oBAAS,CAAC,OAAO,CAAC,EAC7D,CAAC;YACC,YAAY,CAAC,OAAO,GAAG,iBAAiB,CAAC,QAAQ,CAAC;QACtD,CAAC;QAED,OAAO,IAAA,yCAA8B,EAAC,YAAY,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAgB;QAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAE5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,mBAAW,CAAC,YAAY,EAAE,CAAC;QACrC,CAAC;QAED,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,WAAW,GAAG,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC;YAE1D,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,YAAY,KAAK,WAAW,EAAE,CAAC;gBACtD,MAAM,mBAAW,CAAC,mBAAmB,EAAE,CAAC;YAC5C,CAAC;QACL,CAAC;QAED,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YACjE,IAAI,MAAM,CAAC,qBAAqB,KAAK,8CAAsC,CAAC,KAAK,EAAE,CAAC;gBAChF,IAAI,YAAY,KAAK,MAAM,CAAC,cAAc,EAAE,CAAC;oBACzC,MAAM,mBAAW,CAAC,YAAY,CAAC,8BAA8B,CAAC,CAAC;gBACnE,CAAC;YACL,CAAC;iBAAM,CAAC;gBACJ,MAAM,gBAAgB,GAAG,MAAM,IAAA,oCAAwB,EAAC,YAAY,CAAC,CAAC;gBACtE,IAAI,gBAAgB,KAAK,MAAM,CAAC,cAAc,EAAE,CAAC;oBAC7C,MAAM,mBAAW,CAAC,YAAY,CAAC,8BAA8B,CAAC,CAAC;gBACnE,CAAC;YACL,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;IAES,uBAAuB,CAAC,OAAgB;QAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAC/D,IAAI,CAAC,WAAW,EAAE,CAAC;YACf,MAAM,mBAAW,CAAC,mBAAmB,EAAE,CAAC;QAC5C,CAAC;QAED,OAAO,WAAW,CAAC;IACvB,CAAC;IAES,gBAAgB,CAAC,OAAgB;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,MAAM,mBAAW,CAAC,cAAc,EAAE,CAAC;QACvC,CAAC;QAED,OAAO,IAAI,CAAC;IAChB,CAAC;IAES,YAAY,CAAC,GAAY,EAAE,GAAW;QAC5C,IAAI,KAAK,GAAG,IAAA,qBAAc,EAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,KAAK,GAAG,IAAA,uBAAe,EAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC;QAED,IACI,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,CAAC,MAAM,GAAG,CAAC,EAClB,CAAC;YACC,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,OAAO,SAAS,CAAC;IACrB,CAAC;CACJ;AAhHD,gDAgHC"}

package/dist/http/oauth2/grant-types/client-credentials.d.ts

@@ -1,11 +1,11 @@
 import type { OAuth2TokenGrantResponse } from '@authup/specs';
 import type { Request } from 'routup';
-import { ClientEntity } from '../../../database/domains';
+import type { ClientEntity } from '../../../database/domains';
 import { AbstractGrant } from './abstract';
 import type { Grant } from './type';
 export declare class ClientCredentialsGrant extends AbstractGrant implements Grant {
     run(request: Request): Promise<OAuth2TokenGrantResponse>;
     validate(request: Request): Promise<ClientEntity>;
-    protected getClientCredentials(request: Request): [string, string];
+    protected getClientCredentials(request: Request): [string, string, string | undefined];
 }
 //# sourceMappingURL=client-credentials.d.ts.map

package/dist/http/oauth2/grant-types/client-credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-credentials.d.ts","sourceRoot":"","sources":["../../../../src/http/oauth2/grant-types/client-credentials.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAW9D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAGtC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAGpC,qBAAa,sBAAuB,SAAQ,aAAc,YAAW,KAAK;IAChE,GAAG,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,wBAAwB,CAAC;IA6BzD,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,YAAY,CAAC;IAqBxD,SAAS,CAAC,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAI,CAAC,MAAM,EAAE,MAAM,CAAC;CAmBtE"}
+{"version":3,"file":"client-credentials.d.ts","sourceRoot":"","sources":["../../../../src/http/oauth2/grant-types/client-credentials.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAU9D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAGtC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAE9D,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAGpC,qBAAa,sBAAuB,SAAQ,aAAc,YAAW,KAAK;IAChE,GAAG,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,wBAAwB,CAAC;IA6BzD,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,YAAY,CAAC;IAcxD,SAAS,CAAC,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;CAoB1F"}

package/dist/http/oauth2/grant-types/client-credentials.js

@@ -10,7 +10,6 @@ exports.ClientCredentialsGrant = void 0;
 const specs_1 = require("@authup/specs");
 const core_kit_1 = require("@authup/core-kit");
 const body_1 = require("@routup/basic/body");
-const query_1 = require("@routup/basic/query");
 const hapic_1 = require("hapic");
 const routup_1 = require("routup");
 const typeorm_extension_1 = require("typeorm-extension");
@@ -38,24 +37,19 @@ class ClientCredentialsGrant extends abstract_1.AbstractGrant {
         });
     }
     async validate(request) {
-        const [id, secret] = this.getClientCredentials(request);
+        const [id, secret, realmId] = this.getClientCredentials(request);
         const dataSource = await (0, typeorm_extension_1.useDataSource)();
-        const repository = dataSource.getRepository(domains_1.ClientEntity);
-        const entity = await repository.findOne({
-            where: {
-                id,
-                secret,
-            },
-            relations: ['realm'],
-        });
+        const repository = new domains_1.ClientRepository(dataSource);
+        const entity = await repository.verifyCredentials(id, secret, realmId);
         if (!entity) {
             throw core_kit_1.UserError.credentialsInvalid();
         }
         return entity;
     }
     getClientCredentials(request) {
-        let clientId = (0, body_1.useRequestBody)(request, 'client_id') || (0, query_1.useRequestQuery)(request, 'client_id');
-        let clientSecret = (0, body_1.useRequestBody)(request, 'client_secret') || (0, query_1.useRequestQuery)(request, 'client_secret');
+        let clientId = (0, body_1.useRequestBody)(request, 'client_id');
+        let clientSecret = (0, body_1.useRequestBody)(request, 'client_secret');
+        const realmId = (0, body_1.useRequestBody)(request, 'realm_id');
         if (!clientId && !clientSecret) {
             const { authorization: headerValue } = request.headers;
             const header = (0, hapic_1.parseAuthorizationHeader)(headerValue);
@@ -65,7 +59,7 @@ class ClientCredentialsGrant extends abstract_1.AbstractGrant {
             clientId = header.username;
             clientSecret = header.password;
         }
-        return [clientId, clientSecret];
+        return [clientId, clientSecret, realmId];
     }
 }
 exports.ClientCredentialsGrant = ClientCredentialsGrant;

package/dist/http/oauth2/grant-types/client-credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"client-credentials.js","sourceRoot":"","sources":["../../../../src/http/oauth2/grant-types/client-credentials.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAGH,yCAGuB;AACvB,+CAE0B;AAC1B,6CAAoD;AACpD,+CAAsD;AACtD,iCAA0E;AAE1E,mCAAsC;AACtC,yDAAkD;AAClD,uDAAyD;AACzD,yCAA2C;AAE3C,0CAA6D;AAE7D,MAAa,sBAAuB,SAAQ,wBAAa;IACrD,KAAK,CAAC,GAAG,CAAC,OAAgB;QACtB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAE5C,MAAM,EACF,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,kBAAkB,GAC9B,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC;YAC5B,aAAa,EAAE,IAAA,qBAAY,EAAC,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;YAC1D,KAAK,EAAE,oBAAS,CAAC,MAAM;YACvB,GAAG,EAAE,MAAM,CAAC,EAAE;YACd,OAAO,EAAE,qBAAa,CAAC,MAAM;YAC7B,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE;YACxB,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;YAC5B,QAAQ,EAAE,MAAM,CAAC,EAAE;SACtB,CAAC,CAAC;QAEH,MAAM,EACF,KAAK,EAAE,YAAY,EACnB,OAAO,EAAE,mBAAmB,GAC/B,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;QAErD,OAAO,IAAA,yCAA8B,EAAC;YAClC,WAAW;YACX,kBAAkB;YAClB,YAAY;YACZ,mBAAmB;SACtB,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAgB;QAC3B,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAExD,MAAM,UAAU,GAAG,MAAM,IAAA,iCAAa,GAAE,CAAC;QACzC,MAAM,UAAU,GAAG,UAAU,CAAC,aAAa,CAAC,sBAAY,CAAC,CAAC;QAE1D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;YACpC,KAAK,EAAE;gBACH,EAAE;gBACF,MAAM;aACT;YACD,SAAS,EAAE,CAAC,OAAO,CAAC;SACvB,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,oBAAS,CAAC,kBAAkB,EAAE,CAAC;QACzC,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;IAES,oBAAoB,CAAC,OAAgB;QAC3C,IAAI,QAAQ,GAAG,IAAA,qBAAc,EAAC,OAAO,EAAE,WAAW,CAAC,IAAI,IAAA,uBAAe,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC7F,IAAI,YAAY,GAAG,IAAA,qBAAc,EAAC,OAAO,EAAE,eAAe,CAAC,IAAI,IAAA,uBAAe,EAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAEzG,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YAC7B,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;YAEvD,MAAM,MAAM,GAAG,IAAA,gCAAwB,EAAC,WAAW,CAAC,CAAC;YAErD,IAAI,MAAM,CAAC,IAAI,KAAK,+BAAuB,CAAC,KAAK,EAAE,CAAC;gBAChD,MAAM,mBAAW,CAAC,cAAc,EAAE,CAAC;YACvC,CAAC;YAED,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC3B,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC;QACnC,CAAC;QAED,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACpC,CAAC;CACJ;AAtED,wDAsEC"}
+{"version":3,"file":"client-credentials.js","sourceRoot":"","sources":["../../../../src/http/oauth2/grant-types/client-credentials.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAGH,yCAGuB;AACvB,+CAE0B;AAC1B,6CAAoD;AACpD,iCAA0E;AAE1E,mCAAsC;AACtC,yDAAkD;AAElD,uDAA6D;AAC7D,yCAA2C;AAE3C,0CAA6D;AAE7D,MAAa,sBAAuB,SAAQ,wBAAa;IACrD,KAAK,CAAC,GAAG,CAAC,OAAgB;QACtB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAE5C,MAAM,EACF,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,kBAAkB,GAC9B,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC;YAC5B,aAAa,EAAE,IAAA,qBAAY,EAAC,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;YAC1D,KAAK,EAAE,oBAAS,CAAC,MAAM;YACvB,GAAG,EAAE,MAAM,CAAC,EAAE;YACd,OAAO,EAAE,qBAAa,CAAC,MAAM;YAC7B,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE;YACxB,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;YAC5B,QAAQ,EAAE,MAAM,CAAC,EAAE;SACtB,CAAC,CAAC;QAEH,MAAM,EACF,KAAK,EAAE,YAAY,EACnB,OAAO,EAAE,mBAAmB,GAC/B,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;QAErD,OAAO,IAAA,yCAA8B,EAAC;YAClC,WAAW;YACX,kBAAkB;YAClB,YAAY;YACZ,mBAAmB;SACtB,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAgB;QAC3B,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAEjE,MAAM,UAAU,GAAG,MAAM,IAAA,iCAAa,GAAE,CAAC;QACzC,MAAM,UAAU,GAAG,IAAI,0BAAgB,CAAC,UAAU,CAAC,CAAC;QAEpD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,oBAAS,CAAC,kBAAkB,EAAE,CAAC;QACzC,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;IAES,oBAAoB,CAAC,OAAgB;QAC3C,IAAI,QAAQ,GAAG,IAAA,qBAAc,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACpD,IAAI,YAAY,GAAG,IAAA,qBAAc,EAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,IAAA,qBAAc,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAEpD,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YAC7B,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;YAEvD,MAAM,MAAM,GAAG,IAAA,gCAAwB,EAAC,WAAW,CAAC,CAAC;YAErD,IAAI,MAAM,CAAC,IAAI,KAAK,+BAAuB,CAAC,KAAK,EAAE,CAAC;gBAChD,MAAM,mBAAW,CAAC,cAAc,EAAE,CAAC;YACvC,CAAC;YAED,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC3B,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC;QACnC,CAAC;QAED,OAAO,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;CACJ;AAhED,wDAgEC"}

package/dist/http/oauth2/grant-types/password.d.ts

@@ -6,6 +6,6 @@ import type { Grant } from './type';
 export declare class PasswordGrantType extends AbstractGrant implements Grant {
     run(request: Request): Promise<OAuth2TokenGrantResponse>;
     validate(request: Request): Promise<UserEntity>;
-    protected verifyCredentialsByLDAP(user: string, password: string, realmId?: string): Promise<UserEntity>;
+    protected verifyCredentialsWithLDAP(user: string, password: string, realmId?: string): Promise<UserEntity>;
 }
 //# sourceMappingURL=password.d.ts.map

package/dist/http/oauth2/grant-types/password.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../../../src/http/oauth2/grant-types/password.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAO9D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAWtC,OAAO,EAEH,UAAU,EAGb,MAAM,2BAA2B,CAAC;AAMnC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAEpC,qBAAa,iBAAkB,SAAQ,aAAc,YAAW,KAAK;IAC3D,GAAG,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,wBAAwB,CAAC;IA4BzD,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,UAAU,CAAC;cAmCtC,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAI,OAAO,CAAC,UAAU,CAAC;CAgElH"}
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../../../src/http/oauth2/grant-types/password.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAO9D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAWtC,OAAO,EAEH,UAAU,EAEb,MAAM,2BAA2B,CAAC;AAMnC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAEpC,qBAAa,iBAAkB,SAAQ,aAAc,YAAW,KAAK;IAC3D,GAAG,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,wBAAwB,CAAC;IA4BzD,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,UAAU,CAAC;cA+BtC,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAI,OAAO,CAAC,UAAU,CAAC;CAuEpH"}

package/dist/http/oauth2/grant-types/password.js

@@ -7,6 +7,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PasswordGrantType = void 0;
+const kit_1 = require("@authup/kit");
 const specs_1 = require("@authup/specs");
 const core_kit_1 = require("@authup/core-kit");
 const body_1 = require("@routup/basic/body");
@@ -37,17 +38,12 @@ class PasswordGrantType extends abstract_1.AbstractGrant {
         });
     }
     async validate(request) {
-        const { username, password, realm_id: requestRealmId } = (0, body_1.useRequestBody)(request);
-        const realm = await (0, domains_1.resolveRealm)((0, routup_1.useRequestParam)(request, 'realmId') || requestRealmId);
+        const { username, password, realm_id: realmId, } = (0, body_1.useRequestBody)(request);
         const dataSource = await (0, typeorm_extension_1.useDataSource)();
         const repository = new domains_1.UserRepository(dataSource);
-        let realmId;
-        if (realm && realm.id) {
-            realmId = realm.id;
-        }
         let entity = await repository.verifyCredentials(username, password, realmId);
         if (!entity) {
-            entity = await this.verifyCredentialsByLDAP(username, password, realmId);
+            entity = await this.verifyCredentialsWithLDAP(username, password, realmId);
         }
         if (!entity) {
             throw core_kit_1.UserError.credentialsInvalid();
@@ -57,17 +53,25 @@ class PasswordGrantType extends abstract_1.AbstractGrant {
         }
         return entity;
     }
-    async verifyCredentialsByLDAP(user, password, realmId) {
+    async verifyCredentialsWithLDAP(user, password, realmId) {
         const dataSource = await (0, typeorm_extension_1.useDataSource)();
         const repository = new domains_1.IdentityProviderRepository(dataSource);
         const where = {
             protocol: core_kit_1.IdentityProviderProtocol.LDAP,
         };
         if (realmId) {
-            where.realm_id = realmId;
+            if ((0, kit_1.isUUID)(realmId)) {
+                where.realm_id = realmId;
+            }
+            else {
+                where.realm = {
+                    name: realmId,
+                };
+            }
         }
         const entities = await repository.findManyWithEA({
             where,
+            relations: ['realm'],
         });
         let manager;
         let account;
@@ -80,12 +84,13 @@ class PasswordGrantType extends abstract_1.AbstractGrant {
             const flow = new domains_2.LdapIdentityProviderFlow(entity);
             try {
                 identity = await flow.getIdentityForCredentials(user, password);
-                await flow.unbind();
             }
             catch (e) {
-                await flow.unbind();
                 continue;
             }
+            finally {
+                await flow.unbind();
+            }
             manager = new services_1.IdentityProviderAccountService(dataSource, entity);
             account = await manager.save(identity);
             break;

package/dist/http/oauth2/grant-types/password.js.map

@@ -1 +1 @@
-{"version":3,"file":"password.js","sourceRoot":"","sources":["../../../../src/http/oauth2/grant-types/password.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAGH,yCAA8C;AAE9C,+CAE0B;AAC1B,6CAAoD;AAEpD,mCAAuD;AAEvD,yDAAkD;AAQlD,uDAKmC;AACnC,8CAE0B;AAC1B,gDAAmE;AACnE,0CAA6D;AAC7D,yCAA2C;AAG3C,MAAa,iBAAkB,SAAQ,wBAAa;IAChD,KAAK,CAAC,GAAG,CAAC,OAAgB;QACtB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAE1C,MAAM,EACF,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,kBAAkB,GAC9B,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC;YAC5B,aAAa,EAAE,IAAA,qBAAY,EAAC,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;YAC1D,KAAK,EAAE,oBAAS,CAAC,MAAM;YACvB,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,OAAO,EAAE,qBAAa,CAAC,IAAI;YAC3B,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YACtB,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;SAC7B,CAAC,CAAC;QAEH,MAAM,EACF,KAAK,EAAE,YAAY,EACnB,OAAO,EAAE,mBAAmB,GAC/B,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;QAErD,OAAO,IAAA,yCAA8B,EAAC;YAClC,WAAW;YACX,kBAAkB;YAClB,YAAY;YACZ,mBAAmB;SACtB,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAgB;QAC3B,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,IAAA,qBAAc,EAAC,OAAO,CAAC,CAAC;QAEjF,MAAM,KAAK,GAAG,MAAM,IAAA,sBAAY,EAC5B,IAAA,wBAAe,EAAC,OAAO,EAAE,SAAS,CAAC,IAAI,cAAc,CACxD,CAAC;QAEF,MAAM,UAAU,GAAG,MAAM,IAAA,iCAAa,GAAE,CAAC;QACzC,MAAM,UAAU,GAAG,IAAI,wBAAc,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,OAA4B,CAAC;QACjC,IAAI,KAAK,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;YACpB,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC;QACvB,CAAC;QAED,IAAI,MAAM,GAAG,MAAM,UAAU,CAAC,iBAAiB,CAC3C,QAAQ,EACR,QAAQ,EACR,OAAO,CACV,CAAC;QAEF,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC7E,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,oBAAS,CAAC,kBAAkB,EAAE,CAAC;QACzC,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,oBAAS,CAAC,QAAQ,EAAE,CAAC;QAC/B,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;IAES,KAAK,CAAC,uBAAuB,CAAC,IAAY,EAAE,QAAgB,EAAE,OAAgB;QACpF,MAAM,UAAU,GAAG,MAAM,IAAA,iCAAa,GAAE,CAAC;QACzC,MAAM,UAAU,GAAG,IAAI,oCAA0B,CAAC,UAAU,CAAC,CAAC;QAE9D,MAAM,KAAK,GAA6C;YACpD,QAAQ,EAAE,mCAAwB,CAAC,IAAI;SAC1C,CAAC;QAEF,IAAI,OAAO,EAAE,CAAC;YACV,KAAK,CAAC,QAAQ,GAAG,OAAO,CAAC;QAC7B,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,cAAc,CAC5C;YACI,KAAK;SACR,CACJ,CAAC;QAEF,IAAI,OAAoD,CAAC;QACzD,IAAI,OAA6C,CAAC;QAClD,IAAI,QAA8C,CAAC;QAEnD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YAE3B,IAAI,MAAM,CAAC,QAAQ,KAAK,mCAAwB,CAAC,IAAI,EAAE,CAAC;gBACpD,SAAS;YACb,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,kCAAwB,CAAC,MAAM,CAAC,CAAC;YAElD,IAAI,CAAC;gBACD,QAAQ,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;gBAChE,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YACxB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACT,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;gBACpB,SAAS;YACb,CAAC;YAED,OAAO,GAAG,IAAI,yCAA8B,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACjE,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvC,MAAM;QACV,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,IACI,OAAO,CAAC,IAAI;YACZ,OAAO,CAAC,IAAI,CAAC,KAAK,EACpB,CAAC;YACC,OAAO,OAAO,CAAC,IAAkB,CAAC;QACtC,CAAC;QAED,MAAM,cAAc,GAAG,UAAU,CAAC,aAAa,CAAC,oBAAU,CAAC,CAAC;QAE5D,OAAO,cAAc,CAAC,OAAO,CAAC;YAC1B,KAAK,EAAE;gBACH,EAAE,EAAE,OAAO,CAAC,OAAO;aACtB;YACD,SAAS,EAAE,CAAC,OAAO,CAAC;SACvB,CAAC,CAAC;IACP,CAAC;CACJ;AAhID,8CAgIC"}
+{"version":3,"file":"password.js","sourceRoot":"","sources":["../../../../src/http/oauth2/grant-types/password.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAEH,qCAAqC;AAErC,yCAA8C;AAE9C,+CAE0B;AAC1B,6CAAoD;AAEpD,mCAAsC;AAEtC,yDAAkD;AAQlD,uDAImC;AACnC,8CAE0B;AAC1B,gDAAmE;AACnE,0CAA6D;AAC7D,yCAA2C;AAG3C,MAAa,iBAAkB,SAAQ,wBAAa;IAChD,KAAK,CAAC,GAAG,CAAC,OAAgB;QACtB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAE1C,MAAM,EACF,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,kBAAkB,GAC9B,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC;YAC5B,aAAa,EAAE,IAAA,qBAAY,EAAC,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;YAC1D,KAAK,EAAE,oBAAS,CAAC,MAAM;YACvB,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,OAAO,EAAE,qBAAa,CAAC,IAAI;YAC3B,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YACtB,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;SAC7B,CAAC,CAAC;QAEH,MAAM,EACF,KAAK,EAAE,YAAY,EACnB,OAAO,EAAE,mBAAmB,GAC/B,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;QAErD,OAAO,IAAA,yCAA8B,EAAC;YAClC,WAAW;YACX,kBAAkB;YAClB,YAAY;YACZ,mBAAmB;SACtB,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAgB;QAC3B,MAAM,EACF,QAAQ,EACR,QAAQ,EACR,QAAQ,EAAE,OAAO,GACpB,GAAG,IAAA,qBAAc,EAAC,OAAO,CAAC,CAAC;QAE5B,MAAM,UAAU,GAAG,MAAM,IAAA,iCAAa,GAAE,CAAC;QACzC,MAAM,UAAU,GAAG,IAAI,wBAAc,CAAC,UAAU,CAAC,CAAC;QAElD,IAAI,MAAM,GAAG,MAAM,UAAU,CAAC,iBAAiB,CAC3C,QAAQ,EACR,QAAQ,EACR,OAAO,CACV,CAAC;QAEF,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/E,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,oBAAS,CAAC,kBAAkB,EAAE,CAAC;QACzC,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,oBAAS,CAAC,QAAQ,EAAE,CAAC;QAC/B,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;IAES,KAAK,CAAC,yBAAyB,CAAC,IAAY,EAAE,QAAgB,EAAE,OAAgB;QACtF,MAAM,UAAU,GAAG,MAAM,IAAA,iCAAa,GAAE,CAAC;QACzC,MAAM,UAAU,GAAG,IAAI,oCAA0B,CAAC,UAAU,CAAC,CAAC;QAE9D,MAAM,KAAK,GAA6C;YACpD,QAAQ,EAAE,mCAAwB,CAAC,IAAI;SAC1C,CAAC;QAEF,IAAI,OAAO,EAAE,CAAC;YACV,IAAI,IAAA,YAAM,EAAC,OAAO,CAAC,EAAE,CAAC;gBAClB,KAAK,CAAC,QAAQ,GAAG,OAAO,CAAC;YAC7B,CAAC;iBAAM,CAAC;gBACJ,KAAK,CAAC,KAAK,GAAG;oBACV,IAAI,EAAE,OAAO;iBAChB,CAAC;YACN,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,cAAc,CAC5C;YACI,KAAK;YACL,SAAS,EAAE,CAAC,OAAO,CAAC;SACvB,CACJ,CAAC;QAEF,IAAI,OAAoD,CAAC;QACzD,IAAI,OAA6C,CAAC;QAClD,IAAI,QAA8C,CAAC;QAEnD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YAE3B,IAAI,MAAM,CAAC,QAAQ,KAAK,mCAAwB,CAAC,IAAI,EAAE,CAAC;gBACpD,SAAS;YACb,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,kCAAwB,CAAC,MAAM,CAAC,CAAC;YAElD,IAAI,CAAC;gBACD,QAAQ,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACpE,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACT,SAAS;YACb,CAAC;oBAAS,CAAC;gBACP,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YACxB,CAAC;YAED,OAAO,GAAG,IAAI,yCAA8B,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACjE,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvC,MAAM;QACV,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,IACI,OAAO,CAAC,IAAI;YACZ,OAAO,CAAC,IAAI,CAAC,KAAK,EACpB,CAAC;YACC,OAAO,OAAO,CAAC,IAAkB,CAAC;QACtC,CAAC;QAED,MAAM,cAAc,GAAG,UAAU,CAAC,aAAa,CAAC,oBAAU,CAAC,CAAC;QAE5D,OAAO,cAAc,CAAC,OAAO,CAAC;YAC1B,KAAK,EAAE;gBACH,EAAE,EAAE,OAAO,CAAC,OAAO;aACtB;YACD,SAAS,EAAE,CAAC,OAAO,CAAC;SACvB,CAAC,CAAC;IACP,CAAC;CACJ;AAnID,8CAmIC"}

package/dist/http/oauth2/scope/resolve.d.ts

@@ -1,3 +1,3 @@
 import { OAuth2SubKind } from '@authup/specs';
-export declare function resolveOAuth2SubAttributesForScope(subKind: OAuth2SubKind | `${OAuth2SubKind}`, scope?: string | string[]): string[];
+export declare function resolveOAuth2SubAttributesForScopes(subKind: OAuth2SubKind | `${OAuth2SubKind}`, scope?: string | string[]): string[];
 //# sourceMappingURL=resolve.d.ts.map

package/dist/http/oauth2/scope/resolve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../../../src/http/oauth2/scope/resolve.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAe9C,wBAAgB,kCAAkC,CAC9C,OAAO,EAAE,aAAa,GAAG,GAAG,aAAa,EAAE,EAC3C,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GACzB,MAAM,EAAE,CAwCX"}
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../../../src/http/oauth2/scope/resolve.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,aAAa,EAAqB,MAAM,eAAe,CAAC;AAejE,wBAAgB,mCAAmC,CAC/C,OAAO,EAAE,aAAa,GAAG,GAAG,aAAa,EAAE,EAC3C,KAAK,GAAE,MAAM,GAAG,MAAM,EAAO,GAC7B,MAAM,EAAE,CA4CX"}