@authup/server-core 1.0.0-beta.3 → 1.0.0-beta.30

package/dist/core/oauth2/authorization/code/verifier/module.d.ts

@@ -0,0 +1,11 @@
+import type { OAuth2AuthorizationCode } from '@authup/core-kit';
+import type { IOAuth2AuthorizationCodeRepository } from '../repository/index.ts';
+import type { IOAuth2AuthorizationCodeVerifier, IOAuth2AuthorizationCodeVerifyOptions } from './types.ts';
+export declare class OAuth2AuthorizationCodeVerifier implements IOAuth2AuthorizationCodeVerifier {
+    protected repository: IOAuth2AuthorizationCodeRepository;
+    constructor(repository: IOAuth2AuthorizationCodeRepository);
+    verify(code: string, options: IOAuth2AuthorizationCodeVerifyOptions): Promise<OAuth2AuthorizationCode>;
+    remove(entity: OAuth2AuthorizationCode): Promise<void>;
+    removeById(code: string): Promise<void>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/oauth2/authorization/code/verifier/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code/verifier/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAIhE,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,wBAAwB,CAAC;AACjF,OAAO,KAAK,EAAE,gCAAgC,EAAE,qCAAqC,EAAE,MAAM,YAAY,CAAC;AAE1G,qBAAa,+BAAgC,YAAW,gCAAgC;IACpF,SAAS,CAAC,UAAU,EAAG,kCAAkC,CAAC;gBAE9C,UAAU,EAAE,kCAAkC;IAIpD,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qCAAqC,GAAI,OAAO,CAAC,uBAAuB,CAAC;IAgCvG,MAAM,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC;IAItD,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGhD"}

package/dist/core/oauth2/authorization/code/verifier/module.js

@@ -0,0 +1,49 @@
+/*
+ * Copyright (c) 2025.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */
+import { OAuth2AuthorizationCodeChallengeMethod, OAuth2Error } from '@authup/specs';
+import { buildOAuth2CodeChallenge } from "../../helpers.js";
+export class OAuth2AuthorizationCodeVerifier {
+    repository;
+    constructor(repository) {
+        this.repository = repository;
+    }
+    async verify(code, options) {
+        const entity = await this.repository.findOneById(code);
+        if (!entity) {
+            throw OAuth2Error.grantInvalid();
+        }
+        if (entity.redirect_uri) {
+            if (!options.redirectUri || entity.redirect_uri !== options.redirectUri) {
+                throw OAuth2Error.redirectUriMismatch();
+            }
+        }
+        if (entity.code_challenge) {
+            if (entity.code_challenge_method === OAuth2AuthorizationCodeChallengeMethod.PLAIN) {
+                if (options.codeVerifier !== entity.code_challenge) {
+                    throw OAuth2Error.grantInvalid('PKCE code_verifier mismatch.');
+                }
+            }
+            else {
+                if (!options.codeVerifier) {
+                    throw OAuth2Error.grantInvalid('Code verifier invalid.');
+                }
+                const codeVerifierHash = await buildOAuth2CodeChallenge(options.codeVerifier);
+                if (codeVerifierHash !== entity.code_challenge) {
+                    throw OAuth2Error.grantInvalid('PKCE code_verifier mismatch.');
+                }
+            }
+        }
+        return entity;
+    }
+    async remove(entity) {
+        return this.removeById(entity.id);
+    }
+    async removeById(code) {
+        await this.repository.removeById(code);
+    }
+}
+//# sourceMappingURL=module.js.map

package/dist/core/oauth2/authorization/code/verifier/module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.js","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code/verifier/module.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,sCAAsC,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACpF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAK5D,MAAM,OAAO,+BAA+B;IAC9B,UAAU,CAAsC;IAE1D,YAAY,UAA8C;QACtD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,OAA8C;QACrE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,WAAW,CAAC,YAAY,EAAE,CAAC;QACrC,CAAC;QAED,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACtB,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,MAAM,CAAC,YAAY,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;gBACtE,MAAM,WAAW,CAAC,mBAAmB,EAAE,CAAC;YAC5C,CAAC;QACL,CAAC;QAED,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YACxB,IAAI,MAAM,CAAC,qBAAqB,KAAK,sCAAsC,CAAC,KAAK,EAAE,CAAC;gBAChF,IAAI,OAAO,CAAC,YAAY,KAAK,MAAM,CAAC,cAAc,EAAE,CAAC;oBACjD,MAAM,WAAW,CAAC,YAAY,CAAC,8BAA8B,CAAC,CAAC;gBACnE,CAAC;YACL,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;oBACxB,MAAM,WAAW,CAAC,YAAY,CAAC,wBAAwB,CAAC,CAAC;gBAC7D,CAAC;gBAED,MAAM,gBAAgB,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;gBAC9E,IAAI,gBAAgB,KAAK,MAAM,CAAC,cAAc,EAAE,CAAC;oBAC7C,MAAM,WAAW,CAAC,YAAY,CAAC,8BAA8B,CAAC,CAAC;gBACnE,CAAC;YACL,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAA+B;QACxC,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAY;QACzB,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;CACJ"}

package/dist/core/oauth2/authorization/code/verifier/types.d.ts

@@ -0,0 +1,11 @@
+import type { OAuth2AuthorizationCode } from '@authup/core-kit';
+export type IOAuth2AuthorizationCodeVerifyOptions = {
+    redirectUri?: string;
+    codeVerifier?: string;
+};
+export interface IOAuth2AuthorizationCodeVerifier {
+    verify(code: string, options: IOAuth2AuthorizationCodeVerifyOptions): Promise<OAuth2AuthorizationCode>;
+    remove(entity: OAuth2AuthorizationCode): Promise<void>;
+    removeById(code: string): Promise<void>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/oauth2/authorization/code/verifier/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code/verifier/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAEhE,MAAM,MAAM,qCAAqC,GAAG;IAChD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAA;CACxB,CAAC;AAEF,MAAM,WAAW,gCAAgC;IAC7C,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qCAAqC,GAAI,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAExG,MAAM,CAAC,MAAM,EAAE,uBAAuB,GAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAExD,UAAU,CAAC,IAAI,EAAE,MAAM,GAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5C"}

package/dist/core/oauth2/authorization/code/verifier/types.js

@@ -0,0 +1,8 @@
+/*
+ * Copyright (c) 2025.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/core/oauth2/authorization/code/verifier/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code/verifier/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/core/oauth2/authorization/code-request/index.d.ts

@@ -0,0 +1,3 @@
+export * from './verifier/index.ts';
+export * from './validator.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/authorization/code-request/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/authorization/code-request/index.ts"],"names":[],"mappings":"AAOA,cAAc,qBAAqB,CAAC;AACpC,cAAc,gBAAgB,CAAC"}

package/dist/core/oauth2/authorization/code-request/index.js

@@ -0,0 +1,9 @@
+/*
+ * Copyright (c) 2025.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */
+export * from "./verifier/index.js";
+export * from "./validator.js";
+//# sourceMappingURL=index.js.map

package/dist/core/oauth2/authorization/code-request/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/core/oauth2/authorization/code-request/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,qBAAqB,CAAC;AACpC,cAAc,gBAAgB,CAAC"}

package/dist/core/oauth2/authorization/code-request/validator.d.ts

@@ -0,0 +1,6 @@
+import type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';
+import { Container } from 'validup';
+export declare class OAuth2AuthorizationCodeRequestValidator extends Container<OAuth2AuthorizationCodeRequest> {
+    protected initialize(): void;
+}
+//# sourceMappingURL=validator.d.ts.map

package/dist/core/oauth2/authorization/code-request/validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/authorization/code-request/validator.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAQvE,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAGpC,qBAAa,uCAAwC,SAAQ,SAAS,CAAC,8BAA8B,CAAC;IAClG,SAAS,CAAC,UAAU;CAoEvB"}

package/dist/core/oauth2/authorization/code-request/validator.js

@@ -0,0 +1,41 @@
+/*
+ * Copyright (c) 2022-2023.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */
+import { OAuth2AuthorizationCodeChallengeMethod, OAuth2AuthorizationResponseType, OAuth2Error, } from '@authup/specs';
+import { createValidator } from '@validup/adapter-zod';
+import { Container } from 'validup';
+import { z } from 'zod';
+export class OAuth2AuthorizationCodeRequestValidator extends Container {
+    initialize() {
+        super.initialize();
+        this.mount('response_type', createValidator(z
+            .string()
+            .nonempty()
+            .check((ctx) => {
+            const availableResponseTypes = Object.values(OAuth2AuthorizationResponseType);
+            const responseTypes = ctx.value.split(' ');
+            for (let i = 0; i < responseTypes.length; i++) {
+                if (availableResponseTypes.indexOf(responseTypes[i]) === -1) {
+                    const error = OAuth2Error.responseTypeUnsupported();
+                    ctx.issues.push({
+                        input: responseTypes[i],
+                        code: 'custom',
+                        message: error.message,
+                    });
+                }
+            }
+            return z.NEVER;
+        })));
+        this.mount('redirect_uri', createValidator(z.string().url()));
+        this.mount('scope', createValidator(z.string().min(3).max(512)));
+        this.mount('state', { optional: true }, createValidator(z.string().min(5).max(2048).nullable()));
+        this.mount('code_challenge', { optional: true }, createValidator(z.string().min(1).max(256).nullable()));
+        this.mount('code_challenge_method', { optional: true }, createValidator(z.enum(OAuth2AuthorizationCodeChallengeMethod).nullable()));
+        this.mount('realm_id', { optional: true }, createValidator(z.string().nonempty()));
+        this.mount('client_id', createValidator(z.string().nonempty()));
+    }
+}
+//# sourceMappingURL=validator.js.map

package/dist/core/oauth2/authorization/code-request/validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validator.js","sourceRoot":"","sources":["../../../../../src/core/oauth2/authorization/code-request/validator.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EACH,sCAAsC,EACtC,+BAA+B,EAC/B,WAAW,GACd,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,OAAO,uCAAwC,SAAQ,SAAyC;IACxF,UAAU;QAChB,KAAK,CAAC,UAAU,EAAE,CAAC;QAEnB,IAAI,CAAC,KAAK,CACN,eAAe,EACf,eAAe,CACX,CAAC;aACI,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACX,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC;YAC9E,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAsC,CAAC;YAEhF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC5C,IAAI,sBAAsB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;oBAC1D,MAAM,KAAK,GAAG,WAAW,CAAC,uBAAuB,EAAE,CAAC;oBACpD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;wBACZ,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC;wBACvB,IAAI,EAAE,QAAQ;wBACd,OAAO,EAAE,KAAK,CAAC,OAAO;qBACzB,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;YAED,OAAO,CAAC,CAAC,KAAK,CAAC;QACnB,CAAC,CAAC,CACT,CACJ,CAAC;QAEF,IAAI,CAAC,KAAK,CACN,cAAc,EACd,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,CACpC,CAAC;QAEF,IAAI,CAAC,KAAK,CACN,OAAO,EACP,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAC9C,CAAC;QAEF,IAAI,CAAC,KAAK,CACN,OAAO,EACP,EAAE,QAAQ,EAAE,IAAI,EAAE,EAClB,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAC1D,CAAC;QAEF,IAAI,CAAC,KAAK,CACN,gBAAgB,EAChB,EAAE,QAAQ,EAAE,IAAI,EAAE,EAClB,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,CACzD,CAAC;QAEF,IAAI,CAAC,KAAK,CACN,uBAAuB,EACvB,EAAE,QAAQ,EAAE,IAAI,EAAE,EAClB,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAC7E,CAAC;QAEF,IAAI,CAAC,KAAK,CACN,UAAU,EACV,EAAE,QAAQ,EAAE,IAAI,EAAE,EAClB,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,CACzC,CAAC;QAEF,IAAI,CAAC,KAAK,CACN,WAAW,EACX,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,CACzC,CAAC;IACN,CAAC;CACJ"}

package/dist/core/oauth2/authorization/code-request/verifier/index.d.ts

@@ -0,0 +1,3 @@
+export * from './types.ts';
+export * from './module.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/authorization/code-request/verifier/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code-request/verifier/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/core/oauth2/authorization/code-request/verifier/index.js

@@ -0,0 +1,9 @@
+/*
+ * Copyright (c) 2025.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */
+export * from "./types.js";
+export * from "./module.js";
+//# sourceMappingURL=index.js.map

package/dist/core/oauth2/authorization/code-request/verifier/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code-request/verifier/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/core/oauth2/authorization/code-request/verifier/module.d.ts

@@ -0,0 +1,15 @@
+import type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';
+import type { IOAuth2ClientRepository } from '../../../client/index.ts';
+import type { IOAuth2ScopeRepository } from '../../../scope/index.ts';
+import type { IOAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeRequestVerificationResult, OAuth2AuthorizationCodeRequestVerifierContext } from './types.ts';
+export declare class OAuth2AuthorizationCodeRequestVerifier implements IOAuth2AuthorizationCodeRequestVerifier {
+    protected clientRepository: IOAuth2ClientRepository;
+    protected scopeRepository: IOAuth2ScopeRepository;
+    constructor(ctx: OAuth2AuthorizationCodeRequestVerifierContext);
+    /**
+     * Verify validated authorization code request.
+     * @param data
+     */
+    verify(data: OAuth2AuthorizationCodeRequest): Promise<OAuth2AuthorizationCodeRequestVerificationResult>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/oauth2/authorization/code-request/verifier/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code-request/verifier/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAIvE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,KAAK,EACR,uCAAuC,EACvC,gDAAgD,EAChD,6CAA6C,EAChD,MAAM,YAAY,CAAC;AAEpB,qBAAa,sCAAuC,YAAW,uCAAuC;IAClG,SAAS,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;IAEpD,SAAS,CAAC,eAAe,EAAE,sBAAsB,CAAC;gBAEtC,GAAG,EAAE,6CAA6C;IAK9D;;;OAGG;IACG,MAAM,CACR,IAAI,EAAE,8BAA8B,GACpC,OAAO,CAAC,gDAAgD,CAAC;CAyChE"}

package/dist/core/oauth2/authorization/code-request/verifier/module.js

@@ -0,0 +1,56 @@
+/*
+ * Copyright (c) 2025.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */
+import { ScopeName } from '@authup/core-kit';
+import { isSimpleMatch } from '@authup/kit';
+import { OAuth2Error, hasOAuth2Scopes } from '@authup/specs';
+export class OAuth2AuthorizationCodeRequestVerifier {
+    clientRepository;
+    scopeRepository;
+    constructor(ctx) {
+        this.clientRepository = ctx.clientRepository;
+        this.scopeRepository = ctx.scopeRepository;
+    }
+    /**
+     * Verify validated authorization code request.
+     * @param data
+     */
+    async verify(data) {
+        const client = await this.clientRepository.findOneByIdOrName(data.client_id, data.realm_id);
+        if (!client) {
+            throw OAuth2Error.clientInvalid();
+        }
+        if (!client.active) {
+            throw OAuth2Error.clientInactive();
+        }
+        data.client_id = client.id;
+        data.realm_id = client.realm_id;
+        const scopes = await this.scopeRepository.findByClientId(client.id);
+        const scopeNames = scopes.map((scope) => scope.name);
+        if (data.scope) {
+            if (!hasOAuth2Scopes(scopeNames, data.scope) &&
+                !hasOAuth2Scopes(data.scope, ScopeName.GLOBAL)) {
+                throw OAuth2Error.scopeInsufficient();
+            }
+        }
+        else {
+            data.scope = scopeNames.join(' ');
+        }
+        if (client.redirect_uri) {
+            const redirectUris = client.redirect_uri.split(',');
+            // verifying scopes
+            if (!isSimpleMatch(data.redirect_uri, redirectUris)) {
+                throw OAuth2Error.redirectUriMismatch();
+            }
+        }
+        return {
+            data,
+            client,
+            scopes,
+        };
+    }
+}
+//# sourceMappingURL=module.js.map

package/dist/core/oauth2/authorization/code-request/verifier/module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.js","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code-request/verifier/module.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAS7D,MAAM,OAAO,sCAAsC;IACrC,gBAAgB,CAA0B;IAE1C,eAAe,CAAyB;IAElD,YAAY,GAAkD;QAC1D,IAAI,CAAC,gBAAgB,GAAG,GAAG,CAAC,gBAAgB,CAAC;QAC7C,IAAI,CAAC,eAAe,GAAG,GAAG,CAAC,eAAe,CAAC;IAC/C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CACR,IAAoC;QAEpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5F,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,WAAW,CAAC,aAAa,EAAE,CAAC;QACtC,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,WAAW,CAAC,cAAc,EAAE,CAAC;QACvC,CAAC;QAED,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAEhC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpE,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,IACI,CAAC,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC;gBACxC,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,EAChD,CAAC;gBACC,MAAM,WAAW,CAAC,iBAAiB,EAAE,CAAC;YAC1C,CAAC;QACL,CAAC;aAAM,CAAC;YACJ,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC;QAED,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAEpD,mBAAmB;YACnB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC;gBAClD,MAAM,WAAW,CAAC,mBAAmB,EAAE,CAAC;YAC5C,CAAC;QACL,CAAC;QAED,OAAO;YACH,IAAI;YACJ,MAAM;YACN,MAAM;SACT,CAAC;IACN,CAAC;CACJ"}

package/dist/core/oauth2/authorization/code-request/verifier/types.d.ts

@@ -0,0 +1,16 @@
+import type { Client, OAuth2AuthorizationCodeRequest, Scope } from '@authup/core-kit';
+import type { IOAuth2ClientRepository } from '../../../client/index.ts';
+import type { IOAuth2ScopeRepository } from '../../../scope/index.ts';
+export type OAuth2AuthorizationCodeRequestVerifierContext = {
+    clientRepository: IOAuth2ClientRepository;
+    scopeRepository: IOAuth2ScopeRepository;
+};
+export type OAuth2AuthorizationCodeRequestVerificationResult = {
+    data: OAuth2AuthorizationCodeRequest;
+    client: Client;
+    scopes: Scope[];
+};
+export interface IOAuth2AuthorizationCodeRequestVerifier {
+    verify(data: OAuth2AuthorizationCodeRequest): Promise<OAuth2AuthorizationCodeRequestVerificationResult>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/oauth2/authorization/code-request/verifier/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code-request/verifier/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,MAAM,EAAE,8BAA8B,EAAE,KAAK,EAChD,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEtE,MAAM,MAAM,6CAA6C,GAAG;IACxD,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,eAAe,EAAE,sBAAsB,CAAA;CAC1C,CAAC;AAEF,MAAM,MAAM,gDAAgD,GAAG;IAC3D,IAAI,EAAE,8BAA8B,CAAC;IAErC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,KAAK,EAAE,CAAA;CAClB,CAAC;AAEF,MAAM,WAAW,uCAAuC;IACpD,MAAM,CACF,IAAI,EAAE,8BAA8B,GACpC,OAAO,CAAC,gDAAgD,CAAC,CAAC;CACjE"}

package/dist/core/oauth2/authorization/code-request/verifier/types.js

@@ -0,0 +1,8 @@
+/*
+ * Copyright (c) 2025.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/core/oauth2/authorization/code-request/verifier/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code-request/verifier/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/core/oauth2/authorization/helpers.d.ts

@@ -0,0 +1,3 @@
+export declare function generateOAuth2CodeVerifier(): string;
+export declare function buildOAuth2CodeChallenge(codeVerifier: string): Promise<string>;
+//# sourceMappingURL=helpers.d.ts.map

package/dist/core/oauth2/authorization/helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/authorization/helpers.ts"],"names":[],"mappings":"AASA,wBAAgB,0BAA0B,WAazC;AAeD,wBAAsB,wBAAwB,CAAC,YAAY,EAAE,MAAM,mBAMlE"}

package/dist/core/oauth2/authorization/helpers.js

@@ -0,0 +1,36 @@
+/*
+ * Copyright (c) 2024.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */
+import { subtle } from 'uncrypto';
+export function generateOAuth2CodeVerifier() {
+    const length = 64;
+    const charset = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';
+    let codeVerifier = '';
+    const randomValues = new Uint8Array(length);
+    crypto.getRandomValues(randomValues);
+    for (let i = 0; i < length; i++) {
+        codeVerifier += charset[randomValues[i] % charset.length];
+    }
+    return codeVerifier;
+}
+function base64URLEncode(arrayBuffer) {
+    // Convert the ArrayBuffer to string using Uint8 array.
+    // btoa takes chars from 0-255 and base64 encodes.
+    // Then convert the base64 encoded to base64url encoded.
+    // (replace + with -, replace / with _, trim trailing =)
+    const charCode = Array.from(new Uint8Array(arrayBuffer));
+    return btoa(String.fromCharCode.apply(null, charCode))
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=+$/, '');
+}
+export async function buildOAuth2CodeChallenge(codeVerifier) {
+    const encoder = new TextEncoder();
+    const data = encoder.encode(codeVerifier);
+    const arrayBuffer = await subtle.digest('SHA-256', data);
+    return base64URLEncode(arrayBuffer);
+}
+//# sourceMappingURL=helpers.js.map

package/dist/core/oauth2/authorization/helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.js","sourceRoot":"","sources":["../../../../src/core/oauth2/authorization/helpers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAElC,MAAM,UAAU,0BAA0B;IACtC,MAAM,MAAM,GAAG,EAAE,CAAC;IAClB,MAAM,OAAO,GAAG,oEAAoE,CAAC;IAErF,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,MAAM,YAAY,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;IAErC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9B,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,YAAY,CAAC;AACxB,CAAC;AAED,SAAS,eAAe,CAAC,WAAwB;IAC7C,uDAAuD;IACvD,kDAAkD;IAClD,wDAAwD;IACxD,wDAAwD;IACxD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;IAEzD,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;SACjD,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,YAAoB;IAC/D,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAEzD,OAAO,eAAe,CAAC,WAAW,CAAC,CAAC;AACxC,CAAC"}

package/dist/core/oauth2/authorization/index.d.ts

@@ -0,0 +1,7 @@
+export * from './code/index.ts';
+export * from './code-request/index.ts';
+export * from './state/index.ts';
+export * from './module.ts';
+export * from './helpers.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/authorization/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/authorization/index.ts"],"names":[],"mappings":"AAOA,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,kBAAkB,CAAC;AAEjC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}

package/dist/core/oauth2/authorization/index.js

@@ -0,0 +1,13 @@
+/*
+ * Copyright (c) 2023.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */
+export * from "./code/index.js";
+export * from "./code-request/index.js";
+export * from "./state/index.js";
+export * from "./module.js";
+export * from "./helpers.js";
+export * from "./types.js";
+//# sourceMappingURL=index.js.map

package/dist/core/oauth2/authorization/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/core/oauth2/authorization/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,kBAAkB,CAAC;AAEjC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}

package/dist/core/oauth2/authorization/module.d.ts

@@ -0,0 +1,20 @@
+import type { Identity, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';
+import type { IOAuth2OpenIDTokenIssuer, IOAuth2TokenIssuer } from '../token/index.ts';
+import type { IOAuth2AuthorizationCodeIssuer } from './code/index.ts';
+import type { OAuth2AuthorizationManagerContext, OAuth2AuthorizationResult } from './types.ts';
+import type { IIdentityResolver } from '../../identity/index.ts';
+export declare class OAuth2Authorization {
+    protected accessTokenIssuer: IOAuth2TokenIssuer;
+    protected openIdTokenIssuer: IOAuth2OpenIDTokenIssuer;
+    protected codeIssuer: IOAuth2AuthorizationCodeIssuer;
+    protected identityResolver: IIdentityResolver;
+    constructor(ctx: OAuth2AuthorizationManagerContext);
+    /**
+     * Authorize with validated codeRequest.
+     *
+     * @param data
+     * @param identity
+     */
+    authorize(data: OAuth2AuthorizationCodeRequest, identity: Identity): Promise<OAuth2AuthorizationResult>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/oauth2/authorization/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/authorization/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAUjF,OAAO,KAAK,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACtF,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,KAAK,EACR,iCAAiC,EACjC,yBAAyB,EAC5B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,qBAAa,mBAAmB;IAC5B,SAAS,CAAC,iBAAiB,EAAG,kBAAkB,CAAC;IAEjD,SAAS,CAAC,iBAAiB,EAAG,wBAAwB,CAAC;IAEvD,SAAS,CAAC,UAAU,EAAG,8BAA8B,CAAC;IAEtD,SAAS,CAAC,gBAAgB,EAAG,iBAAiB,CAAC;gBAEnC,GAAG,EAAE,iCAAiC;IAOlD;;;;;OAKG;IACG,SAAS,CACX,IAAI,EAAE,8BAA8B,EACpC,QAAQ,EAAE,QAAQ,GAClB,OAAO,CAAC,yBAAyB,CAAC;CAkFzC"}

package/dist/core/oauth2/authorization/module.js

@@ -0,0 +1,83 @@
+/*
+ * Copyright (c) 2024.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */
+import { ScopeName, } from '@authup/core-kit';
+import { OAuth2AuthorizationResponseType, OAuth2Error, hasOAuth2Scopes, } from '@authup/specs';
+export class OAuth2Authorization {
+    accessTokenIssuer;
+    openIdTokenIssuer;
+    codeIssuer;
+    identityResolver;
+    constructor(ctx) {
+        this.accessTokenIssuer = ctx.accessTokenIssuer;
+        this.openIdTokenIssuer = ctx.openIdTokenIssuer;
+        this.codeIssuer = ctx.codeIssuer;
+        this.identityResolver = ctx.identityResolver;
+    }
+    /**
+     * Authorize with validated codeRequest.
+     *
+     * @param data
+     * @param identity
+     */
+    async authorize(data, identity) {
+        const availableResponseTypes = Object.values(OAuth2AuthorizationResponseType);
+        let responseTypes = [];
+        if (data.response_type) {
+            responseTypes = Array.isArray(data.response_type) ?
+                data.response_type :
+                data.response_type.split(' ');
+        }
+        const enabledResponseTypes = {};
+        for (let i = 0; i < responseTypes.length; i++) {
+            if (availableResponseTypes.indexOf(responseTypes[i]) === -1) {
+                throw OAuth2Error.responseTypeUnsupported();
+            }
+            else {
+                enabledResponseTypes[responseTypes[i]] = true;
+            }
+        }
+        const output = {
+            redirectUri: data.redirect_uri,
+            ...(data.state ? { state: data.state } : {}),
+        };
+        const payloadBaseNormalized = {
+            sub: identity.data.id,
+            sub_kind: identity.type,
+            realm_id: identity.data.realm.id,
+            realm_name: identity.data.realm.name,
+            client_id: data.client_id,
+            ...(data.scope ? { scope: data.scope } : {}),
+        };
+        if (!identity) {
+            throw OAuth2Error.identityInvalid();
+        }
+        let idToken;
+        if (enabledResponseTypes[OAuth2AuthorizationResponseType.ID_TOKEN] ||
+            (data.scope &&
+                hasOAuth2Scopes(data.scope, ScopeName.OPEN_ID))) {
+            const [token] = await this.openIdTokenIssuer.issueWithIdentity(payloadBaseNormalized, identity);
+            idToken = token;
+            if (enabledResponseTypes[OAuth2AuthorizationResponseType.ID_TOKEN]) {
+                output.idToken = token;
+            }
+        }
+        if (enabledResponseTypes[OAuth2AuthorizationResponseType.TOKEN]) {
+            const [token] = await this.accessTokenIssuer.issue(payloadBaseNormalized);
+            output.accessToken = token;
+        }
+        if (enabledResponseTypes[OAuth2AuthorizationResponseType.CODE]) {
+            if (identity) {
+                const entity = await this.codeIssuer.issue(data, identity, {
+                    idToken,
+                });
+                output.authorizationCode = entity.id;
+            }
+        }
+        return output;
+    }
+}
+//# sourceMappingURL=module.js.map

package/dist/core/oauth2/authorization/module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.js","sourceRoot":"","sources":["../../../../src/core/oauth2/authorization/module.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EACH,SAAS,GACZ,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACH,+BAA+B,EAC/B,WAAW,EACX,eAAe,GAClB,MAAM,eAAe,CAAC;AASvB,MAAM,OAAO,mBAAmB;IAClB,iBAAiB,CAAsB;IAEvC,iBAAiB,CAA4B;IAE7C,UAAU,CAAkC;IAE5C,gBAAgB,CAAqB;IAE/C,YAAY,GAAsC;QAC9C,IAAI,CAAC,iBAAiB,GAAG,GAAG,CAAC,iBAAiB,CAAC;QAC/C,IAAI,CAAC,iBAAiB,GAAG,GAAG,CAAC,iBAAiB,CAAC;QAC/C,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;QACjC,IAAI,CAAC,gBAAgB,GAAG,GAAG,CAAC,gBAAgB,CAAC;IACjD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CACX,IAAoC,EACpC,QAAkB;QAElB,MAAM,sBAAsB,GAAc,MAAM,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC;QAEzF,IAAI,aAAa,GAAc,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;gBAC/C,IAAI,CAAC,aAAa,CAAC,CAAC;gBACpB,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC;QAED,MAAM,oBAAoB,GAA6B,EAAE,CAAC;QAE1D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5C,IAAI,sBAAsB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC1D,MAAM,WAAW,CAAC,uBAAuB,EAAE,CAAC;YAChD,CAAC;iBAAM,CAAC;gBACJ,oBAAoB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;YAClD,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAA+B;YACvC,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C,CAAC;QAEF,MAAM,qBAAqB,GAAwB;YAE/C,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE;YACrB,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YAChC,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI;YAEpC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C,CAAC;QAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACZ,MAAM,WAAW,CAAC,eAAe,EAAE,CAAC;QACxC,CAAC;QAED,IAAI,OAA4B,CAAC;QACjC,IACI,oBAAoB,CAAC,+BAA+B,CAAC,QAAQ,CAAC;YAC9D,CACI,IAAI,CAAC,KAAK;gBACV,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC,CACjD,EACH,CAAC;YACC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAC1D,qBAAqB,EACrB,QAAQ,CACX,CAAC;YAEF,OAAO,GAAG,KAAK,CAAC;YAEhB,IAAI,oBAAoB,CAAC,+BAA+B,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjE,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;YAC3B,CAAC;QACL,CAAC;QAED,IAAI,oBAAoB,CAAC,+BAA+B,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9D,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;YAE1E,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC;QAC/B,CAAC;QAED,IAAI,oBAAoB,CAAC,+BAA+B,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,IAAI,QAAQ,EAAE,CAAC;gBACX,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACtC,IAAI,EACJ,QAAQ,EACR;oBACI,OAAO;iBACV,CACJ,CAAC;gBAEF,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC,EAAE,CAAC;YACzC,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;CACJ"}

package/dist/core/oauth2/authorization/state/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/authorization/state/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/authorization/state/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/oauth2/authorization/state/index.js

@@ -0,0 +1,9 @@
+/*
+ * Copyright (c) 2025.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */
+export * from "./module.js";
+export * from "./types.js";
+//# sourceMappingURL=index.js.map

package/dist/core/oauth2/authorization/state/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/core/oauth2/authorization/state/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/oauth2/authorization/state/module.d.ts

@@ -0,0 +1,8 @@
+import type { IOAuth2AuthorizationStateManager, IOAuth2AuthorizeStateRepository, OAuth2AuthorizationState } from './types.ts';
+export declare class OAuth2AuthorizationStateManager implements IOAuth2AuthorizationStateManager {
+    protected repository: IOAuth2AuthorizeStateRepository;
+    constructor(repository: IOAuth2AuthorizeStateRepository);
+    save(data: OAuth2AuthorizationState): Promise<string>;
+    verify(state: string, input: Partial<OAuth2AuthorizationState>): Promise<OAuth2AuthorizationState>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/oauth2/authorization/state/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/authorization/state/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACR,gCAAgC,EAChC,+BAA+B,EAC/B,wBAAwB,EAC3B,MAAM,YAAY,CAAC;AAEpB,qBAAa,+BAAgC,YAAW,gCAAgC;IACpF,SAAS,CAAC,UAAU,EAAE,+BAA+B,CAAC;gBAE1C,UAAU,EAAE,+BAA+B;IAIjD,IAAI,CAAC,IAAI,EAAE,wBAAwB,GAAI,OAAO,CAAC,MAAM,CAAC;IAItD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,wBAAwB,CAAC,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAyB3G"}

package/dist/core/oauth2/authorization/state/module.js

@@ -0,0 +1,34 @@
+/*
+ * Copyright (c) 2025.
+ *  Author Peter Placzek (tada5hi)
+ *  For the full copyright and license information,
+ *  view the LICENSE file that was distributed with this source code.
+ */
+import { OAuth2Error } from '@authup/specs';
+export class OAuth2AuthorizationStateManager {
+    repository;
+    constructor(repository) {
+        this.repository = repository;
+    }
+    async save(data) {
+        return this.repository.insert(data);
+    }
+    async verify(state, input) {
+        const payload = await this.repository.findOneById(state);
+        if (!payload) {
+            throw OAuth2Error.stateInvalid();
+        }
+        // avoid replay attacks
+        await this.repository.remove(state);
+        if (payload.ip &&
+            input.ip !== payload.ip) {
+            throw OAuth2Error.stateInvalid();
+        }
+        if (payload.userAgent &&
+            input.userAgent !== payload.userAgent) {
+            throw OAuth2Error.stateInvalid();
+        }
+        return payload;
+    }
+}
+//# sourceMappingURL=module.js.map

package/dist/core/oauth2/authorization/state/module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.js","sourceRoot":"","sources":["../../../../../src/core/oauth2/authorization/state/module.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAO5C,MAAM,OAAO,+BAA+B;IAC9B,UAAU,CAAkC;IAEtD,YAAY,UAA2C;QACnD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAA8B;QACrC,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,KAAwC;QAChE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,WAAW,CAAC,YAAY,EAAE,CAAC;QACrC,CAAC;QAED,uBAAuB;QACvB,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEpC,IACI,OAAO,CAAC,EAAE;YACV,KAAK,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,EACzB,CAAC;YACC,MAAM,WAAW,CAAC,YAAY,EAAE,CAAC;QACrC,CAAC;QAED,IACI,OAAO,CAAC,SAAS;YACjB,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,EACvC,CAAC;YACC,MAAM,WAAW,CAAC,YAAY,EAAE,CAAC;QACrC,CAAC;QAED,OAAO,OAAO,CAAC;IACnB,CAAC;CACJ"}

package/dist/core/oauth2/authorization/state/types.d.ts

@@ -0,0 +1,16 @@
+import type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';
+export type OAuth2AuthorizationState = {
+    codeRequest?: OAuth2AuthorizationCodeRequest;
+    ip: string;
+    userAgent?: string | null;
+};
+export interface IOAuth2AuthorizeStateRepository {
+    findOneById(id: string): Promise<OAuth2AuthorizationState | null>;
+    insert(data: OAuth2AuthorizationState): Promise<string>;
+    remove(id: string): Promise<void>;
+}
+export interface IOAuth2AuthorizationStateManager {
+    save(data: OAuth2AuthorizationState): Promise<string>;
+    verify(state: string, input: Partial<OAuth2AuthorizationState>): Promise<OAuth2AuthorizationState>;
+}
+//# sourceMappingURL=types.d.ts.map