@authup/server-core 1.0.0-beta.35 → 1.0.0-beta.37

package/dist/core/oauth2/authorization/code-request/index.mjs

@@ -0,0 +1,4 @@
+import { OAuth2AuthorizationCodeRequestVerifier } from "./verifier/module.mjs";
+import "./verifier/index.mjs";
+import { OAuth2AuthorizationCodeRequestValidator } from "./validator.mjs";
+export { OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier };

package/dist/core/oauth2/authorization/code-request/validator.mjs

@@ -0,0 +1,35 @@
+import { OAuth2AuthorizationCodeChallengeMethod, OAuth2AuthorizationResponseType, OAuth2Error } from "@authup/specs";
+import { Container } from "validup";
+import { createValidator } from "@validup/adapter-zod";
+import { z } from "zod";
+//#region src/core/oauth2/authorization/code-request/validator.ts
+var OAuth2AuthorizationCodeRequestValidator = class extends Container {
+	initialize() {
+		super.initialize();
+		this.mount("response_type", createValidator(z.string().nonempty().check((ctx) => {
+			const availableResponseTypes = Object.values(OAuth2AuthorizationResponseType);
+			const responseTypes = ctx.value.split(" ");
+			for (const responseType of responseTypes) if (!availableResponseTypes.includes(responseType)) {
+				const error = OAuth2Error.responseTypeUnsupported();
+				ctx.issues.push({
+					input: responseType,
+					code: "custom",
+					message: error.message
+				});
+			}
+			return z.NEVER;
+		})));
+		this.mount("redirect_uri", createValidator(z.string().url()));
+		this.mount("scope", createValidator(z.string().min(3).max(512)));
+		this.mount("state", { optional: true }, createValidator(z.string().min(5).max(2048).nullable()));
+		this.mount("code_challenge", { optional: true }, createValidator(z.string().min(1).max(256).nullable()));
+		this.mount("code_challenge_method", { optional: true }, createValidator(z.enum(OAuth2AuthorizationCodeChallengeMethod).nullable()));
+		this.mount("nonce", { optional: true }, createValidator(z.string().min(1).max(512).nullable()));
+		this.mount("realm_id", { optional: true }, createValidator(z.string().nonempty()));
+		this.mount("client_id", createValidator(z.string().nonempty()));
+	}
+};
+//#endregion
+export { OAuth2AuthorizationCodeRequestValidator };
+
+//# sourceMappingURL=validator.mjs.map

package/dist/core/oauth2/authorization/code-request/validator.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"validator.mjs","names":["OAuth2AuthorizationCodeChallengeMethod","OAuth2AuthorizationResponseType","OAuth2Error","createValidator","Container","z","OAuth2AuthorizationCodeRequestValidator","initialize","mount","string","nonempty","check","ctx","availableResponseTypes","Object","values","responseTypes","value","split","responseType","includes","error","responseTypeUnsupported","issues","push","input","code","message","NEVER","url","min","max","optional","nullable","enum"],"sources":["../../../../../src/core/oauth2/authorization/code-request/validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport {\n    OAuth2AuthorizationCodeChallengeMethod,\n    OAuth2AuthorizationResponseType,\n    OAuth2Error,\n} from '@authup/specs';\n\nimport { createValidator } from '@validup/adapter-zod';\nimport { Container } from 'validup';\nimport { z } from 'zod';\n\nexport class OAuth2AuthorizationCodeRequestValidator extends Container<OAuth2AuthorizationCodeRequest> {\n    protected initialize() {\n        super.initialize();\n\n        this.mount(\n            'response_type',\n            createValidator(\n                z\n                    .string()\n                    .nonempty()\n                    .check((ctx) => {\n                        const availableResponseTypes = Object.values(OAuth2AuthorizationResponseType);\n                        const responseTypes = ctx.value.split(' ') as OAuth2AuthorizationResponseType[];\n\n                        for (const responseType of responseTypes) {\n                            if (!availableResponseTypes.includes(responseType)) {\n                                const error = OAuth2Error.responseTypeUnsupported();\n                                ctx.issues.push({\n                                    input: responseType,\n                                    code: 'custom',\n                                    message: error.message,\n                                });\n                            }\n                        }\n\n                        return z.NEVER;\n                    }),\n            ),\n        );\n\n        this.mount(\n            'redirect_uri',\n            createValidator(z.string().url()),\n        );\n\n        this.mount(\n            'scope',\n            createValidator(z.string().min(3).max(512)),\n        );\n\n        this.mount(\n            'state',\n            { optional: true },\n            createValidator(z.string().min(5).max(2048).nullable()),\n        );\n\n        this.mount(\n            'code_challenge',\n            { optional: true },\n            createValidator(z.string().min(1).max(256).nullable()),\n        );\n\n        this.mount(\n            'code_challenge_method',\n            { optional: true },\n            createValidator(z.enum(OAuth2AuthorizationCodeChallengeMethod).nullable()),\n        );\n\n        this.mount(\n            'nonce',\n            { optional: true },\n            createValidator(z.string().min(1).max(512).nullable()),\n        );\n\n        this.mount(\n            'realm_id',\n            { optional: true },\n            createValidator(z.string().nonempty()),\n        );\n\n        this.mount(\n            'client_id',\n            createValidator(z.string().nonempty()),\n        );\n    }\n}\n"],"mappings":";;;;;AAkBA,IAAaM,0CAAb,cAA6DF,UAAAA;CAC/CG,aAAa;AACnB,QAAMA,YAAAA;AAEN,OAAKC,MACD,iBACAL,gBACIE,EACKI,QAAM,CACNC,UAAQ,CACRC,OAAOC,QAAAA;GACJ,MAAMC,yBAAyBC,OAAOC,OAAOd,gCAAAA;GAC7C,MAAMe,gBAAgBJ,IAAIK,MAAMC,MAAM,IAAA;AAEtC,QAAK,MAAMC,gBAAgBH,cACvB,KAAI,CAACH,uBAAuBO,SAASD,aAAAA,EAAe;IAChD,MAAME,QAAQnB,YAAYoB,yBAAuB;AACjDV,QAAIW,OAAOC,KAAK;KACZC,OAAON;KACPO,MAAM;KACNC,SAASN,MAAMM;KACnB,CAAA;;AAIR,UAAOtB,EAAEuB;IACb,CAAA,CAAA;AAIZ,OAAKpB,MACD,gBACAL,gBAAgBE,EAAEI,QAAM,CAAGoB,KAAG,CAAA,CAAA;AAGlC,OAAKrB,MACD,SACAL,gBAAgBE,EAAEI,QAAM,CAAGqB,IAAI,EAAA,CAAGC,IAAI,IAAA,CAAA,CAAA;AAG1C,OAAKvB,MACD,SACA,EAAEwB,UAAU,MAAK,EACjB7B,gBAAgBE,EAAEI,QAAM,CAAGqB,IAAI,EAAA,CAAGC,IAAI,KAAA,CAAME,UAAQ,CAAA,CAAA;AAGxD,OAAKzB,MACD,kBACA,EAAEwB,UAAU,MAAK,EACjB7B,gBAAgBE,EAAEI,QAAM,CAAGqB,IAAI,EAAA,CAAGC,IAAI,IAAA,CAAKE,UAAQ,CAAA,CAAA;AAGvD,OAAKzB,MACD,yBACA,EAAEwB,UAAU,MAAK,EACjB7B,gBAAgBE,EAAE6B,KAAKlC,uCAAAA,CAAwCiC,UAAQ,CAAA,CAAA;AAG3E,OAAKzB,MACD,SACA,EAAEwB,UAAU,MAAK,EACjB7B,gBAAgBE,EAAEI,QAAM,CAAGqB,IAAI,EAAA,CAAGC,IAAI,IAAA,CAAKE,UAAQ,CAAA,CAAA;AAGvD,OAAKzB,MACD,YACA,EAAEwB,UAAU,MAAK,EACjB7B,gBAAgBE,EAAEI,QAAM,CAAGC,UAAQ,CAAA,CAAA;AAGvC,OAAKF,MACD,aACAL,gBAAgBE,EAAEI,QAAM,CAAGC,UAAQ,CAAA,CAAA"}

package/dist/core/oauth2/authorization/code-request/verifier/index.mjs

@@ -0,0 +1,2 @@
+import { OAuth2AuthorizationCodeRequestVerifier } from "./module.mjs";
+export { OAuth2AuthorizationCodeRequestVerifier };

package/dist/core/oauth2/authorization/code-request/verifier/module.mjs

@@ -0,0 +1,41 @@
+import { ScopeName } from "@authup/core-kit";
+import { isSimpleMatch } from "@authup/kit";
+import { OAuth2Error, hasOAuth2Scopes } from "@authup/specs";
+//#region src/core/oauth2/authorization/code-request/verifier/module.ts
+var OAuth2AuthorizationCodeRequestVerifier = class {
+	clientRepository;
+	scopeRepository;
+	constructor(ctx) {
+		this.clientRepository = ctx.clientRepository;
+		this.scopeRepository = ctx.scopeRepository;
+	}
+	/**
+	* Verify validated authorization code request.
+	* @param data
+	*/ async verify(data) {
+		if (!data.client_id) throw OAuth2Error.clientInvalid();
+		const client = await this.clientRepository.findOneByIdOrName(data.client_id, data.realm_id);
+		if (!client) throw OAuth2Error.clientInvalid();
+		if (!client.active) throw OAuth2Error.clientInactive();
+		data.client_id = client.id;
+		data.realm_id = client.realm_id;
+		const scopes = await this.scopeRepository.findByClientId(client.id);
+		const scopeNames = scopes.map((scope) => scope.name);
+		if (data.scope) {
+			if (!hasOAuth2Scopes(scopeNames, data.scope) && !hasOAuth2Scopes(data.scope, ScopeName.GLOBAL)) throw OAuth2Error.scopeInsufficient();
+		} else data.scope = scopeNames.join(" ");
+		if (client.redirect_uri && data.redirect_uri) {
+			const redirectUris = client.redirect_uri.split(",");
+			if (!isSimpleMatch(data.redirect_uri, redirectUris)) throw OAuth2Error.redirectUriMismatch();
+		}
+		return {
+			data,
+			client,
+			scopes
+		};
+	}
+};
+//#endregion
+export { OAuth2AuthorizationCodeRequestVerifier };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/authorization/code-request/verifier/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["ScopeName","isSimpleMatch","OAuth2Error","hasOAuth2Scopes","OAuth2AuthorizationCodeRequestVerifier","clientRepository","scopeRepository","ctx","verify","data","client_id","clientInvalid","client","findOneByIdOrName","realm_id","active","clientInactive","id","scopes","findByClientId","scopeNames","map","scope","name","GLOBAL","scopeInsufficient","join","redirect_uri","redirectUris","split","redirectUriMismatch"],"sources":["../../../../../../src/core/oauth2/authorization/code-request/verifier/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport { isSimpleMatch } from '@authup/kit';\nimport { OAuth2Error, hasOAuth2Scopes } from '@authup/specs';\nimport type { IOAuth2ClientRepository } from '../../../client/index.ts';\nimport type { IOAuth2ScopeRepository } from '../../../scope/index.ts';\nimport type {\n    IOAuth2AuthorizationCodeRequestVerifier,\n    OAuth2AuthorizationCodeRequestVerificationResult,\n    OAuth2AuthorizationCodeRequestVerifierContext,\n} from './types.ts';\n\nexport class OAuth2AuthorizationCodeRequestVerifier implements IOAuth2AuthorizationCodeRequestVerifier {\n    protected clientRepository: IOAuth2ClientRepository;\n\n    protected scopeRepository: IOAuth2ScopeRepository;\n\n    constructor(ctx: OAuth2AuthorizationCodeRequestVerifierContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.scopeRepository = ctx.scopeRepository;\n    }\n\n    /**\n     * Verify validated authorization code request.\n     * @param data\n     */\n    async verify(\n        data: OAuth2AuthorizationCodeRequest,\n    ) : Promise<OAuth2AuthorizationCodeRequestVerificationResult> {\n        if (!data.client_id) {\n            throw OAuth2Error.clientInvalid();\n        }\n\n        const client = await this.clientRepository.findOneByIdOrName(data.client_id, data.realm_id);\n        if (!client) {\n            throw OAuth2Error.clientInvalid();\n        }\n\n        if (!client.active) {\n            throw OAuth2Error.clientInactive();\n        }\n\n        data.client_id = client.id;\n        data.realm_id = client.realm_id;\n\n        const scopes = await this.scopeRepository.findByClientId(client.id);\n        const scopeNames = scopes.map((scope) => scope.name);\n        if (data.scope) {\n            if (\n                !hasOAuth2Scopes(scopeNames, data.scope) &&\n                !hasOAuth2Scopes(data.scope, ScopeName.GLOBAL)\n            ) {\n                throw OAuth2Error.scopeInsufficient();\n            }\n        } else {\n            data.scope = scopeNames.join(' ');\n        }\n\n        if (client.redirect_uri && data.redirect_uri) {\n            const redirectUris = client.redirect_uri.split(',');\n\n            if (!isSimpleMatch(data.redirect_uri, redirectUris)) {\n                throw OAuth2Error.redirectUriMismatch();\n            }\n        }\n\n        return {\n            data,\n            client,\n            scopes,\n        };\n    }\n}\n"],"mappings":";;;;AAmBA,IAAaI,yCAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAoD;AAC5D,OAAKF,mBAAmBE,IAAIF;AAC5B,OAAKC,kBAAkBC,IAAID;;;;;IAO/B,MAAME,OACFC,MAC0D;AAC1D,MAAI,CAACA,KAAKC,UACN,OAAMR,YAAYS,eAAa;EAGnC,MAAMC,SAAS,MAAM,KAAKP,iBAAiBQ,kBAAkBJ,KAAKC,WAAWD,KAAKK,SAAQ;AAC1F,MAAI,CAACF,OACD,OAAMV,YAAYS,eAAa;AAGnC,MAAI,CAACC,OAAOG,OACR,OAAMb,YAAYc,gBAAc;AAGpCP,OAAKC,YAAYE,OAAOK;AACxBR,OAAKK,WAAWF,OAAOE;EAEvB,MAAMI,SAAS,MAAM,KAAKZ,gBAAgBa,eAAeP,OAAOK,GAAE;EAClE,MAAMG,aAAaF,OAAOG,KAAKC,UAAUA,MAAMC,KAAI;AACnD,MAAId,KAAKa;OAED,CAACnB,gBAAgBiB,YAAYX,KAAKa,MAAK,IACvC,CAACnB,gBAAgBM,KAAKa,OAAOtB,UAAUwB,OAAM,CAE7C,OAAMtB,YAAYuB,mBAAiB;QAGvChB,MAAKa,QAAQF,WAAWM,KAAK,IAAA;AAGjC,MAAId,OAAOe,gBAAgBlB,KAAKkB,cAAc;GAC1C,MAAMC,eAAehB,OAAOe,aAAaE,MAAM,IAAA;AAE/C,OAAI,CAAC5B,cAAcQ,KAAKkB,cAAcC,aAAAA,CAClC,OAAM1B,YAAY4B,qBAAmB;;AAI7C,SAAO;GACHrB;GACAG;GACAM;GACJ"}

package/dist/core/oauth2/authorization/code-request/verifier/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/authorization/helpers.mjs

@@ -0,0 +1,27 @@
+import { subtle } from "uncrypto";
+//#region src/core/oauth2/authorization/helpers.ts
+function generateOAuth2CodeVerifier() {
+	const length = 64;
+	const charset = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
+	let codeVerifier = "";
+	const randomValues = new Uint8Array(length);
+	crypto.getRandomValues(randomValues);
+	for (let i = 0; i < length; i++) codeVerifier += charset[randomValues[i] % 66];
+	return codeVerifier;
+}
+function base64URLEncode(arrayBuffer) {
+	const charCode = Array.from(new Uint8Array(arrayBuffer));
+	return btoa(String.fromCharCode.apply(null, charCode)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function buildOAuth2TokenHash(value) {
+	const data = new TextEncoder().encode(value);
+	return base64URLEncode((await subtle.digest("SHA-256", data)).slice(0, 16));
+}
+async function buildOAuth2CodeChallenge(codeVerifier) {
+	const data = new TextEncoder().encode(codeVerifier);
+	return base64URLEncode(await subtle.digest("SHA-256", data));
+}
+//#endregion
+export { base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, generateOAuth2CodeVerifier };
+
+//# sourceMappingURL=helpers.mjs.map

package/dist/core/oauth2/authorization/helpers.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.mjs","names":["subtle","generateOAuth2CodeVerifier","length","charset","codeVerifier","randomValues","Uint8Array","crypto","getRandomValues","i","base64URLEncode","arrayBuffer","charCode","Array","from","btoa","String","fromCharCode","apply","replace","buildOAuth2TokenHash","value","encoder","TextEncoder","data","encode","hashBuffer","digest","halfHash","slice","buildOAuth2CodeChallenge"],"sources":["../../../../src/core/oauth2/authorization/helpers.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { subtle } from 'uncrypto';\n\nexport function generateOAuth2CodeVerifier() {\n    const length = 64;\n    const charset = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';\n\n    let codeVerifier = '';\n    const randomValues = new Uint8Array(length);\n    crypto.getRandomValues(randomValues);\n\n    for (let i = 0; i < length; i++) {\n        codeVerifier += charset[randomValues[i] % charset.length];\n    }\n\n    return codeVerifier;\n}\n\nexport function base64URLEncode(arrayBuffer: ArrayBuffer) {\n    // Convert the ArrayBuffer to string using Uint8 array.\n    // btoa takes chars from 0-255 and base64 encodes.\n    // Then convert the base64 encoded to base64url encoded.\n    // (replace + with -, replace / with _, trim trailing =)\n    const charCode = Array.from(new Uint8Array(arrayBuffer));\n\n    return btoa(String.fromCharCode.apply(null, charCode))\n        .replace(/\\+/g, '-')\n        .replace(/\\//g, '_')\n        .replace(/=+$/, '');\n}\n\nexport async function buildOAuth2TokenHash(value: string) : Promise<string> {\n    const encoder = new TextEncoder();\n    const data = encoder.encode(value);\n    const hashBuffer = await subtle.digest('SHA-256', data);\n    const halfHash = hashBuffer.slice(0, 16);\n\n    return base64URLEncode(halfHash);\n}\n\nexport async function buildOAuth2CodeChallenge(codeVerifier: string) {\n    const encoder = new TextEncoder();\n    const data = encoder.encode(codeVerifier);\n    const arrayBuffer = await subtle.digest('SHA-256', data);\n\n    return base64URLEncode(arrayBuffer);\n}\n"],"mappings":";;AASA,SAAgBC,6BAAAA;CACZ,MAAMC,SAAS;CACf,MAAMC,UAAU;CAEhB,IAAIC,eAAe;CACnB,MAAMC,eAAe,IAAIC,WAAWJ,OAAAA;AACpCK,QAAOC,gBAAgBH,aAAAA;AAEvB,MAAK,IAAII,IAAI,GAAGA,IAAIP,QAAQO,IACxBL,iBAAgBD,QAAQE,aAAaI,KAAKN;AAG9C,QAAOC;;AAGX,SAAgBM,gBAAgBC,aAAwB;CAKpD,MAAMC,WAAWC,MAAMC,KAAK,IAAIR,WAAWK,YAAAA,CAAAA;AAE3C,QAAOI,KAAKC,OAAOC,aAAaC,MAAM,MAAMN,SAAAA,CAAAA,CACvCO,QAAQ,OAAO,IAAA,CACfA,QAAQ,OAAO,IAAA,CACfA,QAAQ,OAAO,GAAA;;AAGxB,eAAsBC,qBAAqBC,OAAa;CAEpD,MAAMG,OAAOF,IADOC,aACPD,CAAQG,OAAOJ,MAAAA;AAI5B,QAAOX,iBAFUgB,MADQ1B,OAAO2B,OAAO,WAAWH,KAAAA,EACtBK,MAAM,GAAG,GAEdD,CAAAA;;AAG3B,eAAsBE,yBAAyB1B,cAAoB;CAE/D,MAAMoB,OAAOF,IADOC,aACPD,CAAQG,OAAOrB,aAAAA;AAG5B,QAAOM,gBAAgBC,MAFGX,OAAO2B,OAAO,WAAWH,KAAAA,CAE5Bb"}

package/dist/core/oauth2/authorization/index.mjs

@@ -0,0 +1,11 @@
+import { OAuth2AuthorizationCodeIssuer } from "./code/issuer/module.mjs";
+import { base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, generateOAuth2CodeVerifier } from "./helpers.mjs";
+import { OAuth2AuthorizationCodeVerifier } from "./code/verifier/module.mjs";
+import "./code/index.mjs";
+import { OAuth2AuthorizationCodeRequestVerifier } from "./code-request/verifier/module.mjs";
+import { OAuth2AuthorizationCodeRequestValidator } from "./code-request/validator.mjs";
+import "./code-request/index.mjs";
+import { OAuth2AuthorizationStateManager } from "./state/module.mjs";
+import "./state/index.mjs";
+import { OAuth2Authorization } from "./module.mjs";
+export { OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, generateOAuth2CodeVerifier };

package/dist/core/oauth2/authorization/module.mjs

@@ -0,0 +1,66 @@
+import { buildOAuth2TokenHash } from "./helpers.mjs";
+import { ScopeName } from "@authup/core-kit";
+import { OAuth2AuthorizationResponseType, OAuth2Error, hasOAuth2Scopes } from "@authup/specs";
+//#region src/core/oauth2/authorization/module.ts
+var OAuth2Authorization = class {
+	accessTokenIssuer;
+	openIdTokenIssuer;
+	codeIssuer;
+	identityResolver;
+	constructor(ctx) {
+		this.accessTokenIssuer = ctx.accessTokenIssuer;
+		this.openIdTokenIssuer = ctx.openIdTokenIssuer;
+		this.codeIssuer = ctx.codeIssuer;
+		this.identityResolver = ctx.identityResolver;
+	}
+	/**
+	* Authorize with validated codeRequest.
+	*
+	* @param data
+	* @param identity
+	*/ async authorize(data, identity) {
+		const availableResponseTypes = Object.values(OAuth2AuthorizationResponseType);
+		let responseTypes = [];
+		if (data.response_type) responseTypes = Array.isArray(data.response_type) ? data.response_type : data.response_type.split(" ");
+		const enabledResponseTypes = {};
+		for (const responseType of responseTypes) if (!availableResponseTypes.includes(responseType)) throw OAuth2Error.responseTypeUnsupported();
+		else enabledResponseTypes[responseType] = true;
+		if (!data.redirect_uri) throw OAuth2Error.redirectUriMismatch();
+		const output = {
+			redirectUri: data.redirect_uri,
+			...data.state ? { state: data.state } : {}
+		};
+		if (!identity) throw OAuth2Error.identityInvalid();
+		const payloadBaseNormalized = {
+			sub: identity.data.id,
+			sub_kind: identity.type,
+			realm_id: identity.data.realm.id,
+			realm_name: identity.data.realm.name,
+			client_id: data.client_id,
+			...data.scope ? { scope: data.scope } : {},
+			...data.nonce ? { nonce: data.nonce } : {}
+		};
+		let codeEntity;
+		if (enabledResponseTypes[OAuth2AuthorizationResponseType.TOKEN]) {
+			const [token] = await this.accessTokenIssuer.issue(payloadBaseNormalized);
+			output.accessToken = token;
+		}
+		if (enabledResponseTypes[OAuth2AuthorizationResponseType.CODE]) {
+			codeEntity = await this.codeIssuer.issue(data, identity);
+			output.authorizationCode = codeEntity.id;
+		}
+		if (enabledResponseTypes[OAuth2AuthorizationResponseType.ID_TOKEN] || data.scope && hasOAuth2Scopes(data.scope, ScopeName.OPEN_ID)) {
+			const idTokenPayload = { ...payloadBaseNormalized };
+			if (output.accessToken) idTokenPayload.at_hash = await buildOAuth2TokenHash(output.accessToken);
+			if (output.authorizationCode) idTokenPayload.c_hash = await buildOAuth2TokenHash(output.authorizationCode);
+			const [token] = await this.openIdTokenIssuer.issueWithIdentity(idTokenPayload, identity);
+			if (enabledResponseTypes[OAuth2AuthorizationResponseType.ID_TOKEN]) output.idToken = token;
+			if (codeEntity) await this.codeIssuer.updateIdToken(codeEntity, token);
+		}
+		return output;
+	}
+};
+//#endregion
+export { OAuth2Authorization };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/authorization/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["ScopeName","OAuth2AuthorizationResponseType","OAuth2Error","hasOAuth2Scopes","buildOAuth2TokenHash","OAuth2Authorization","accessTokenIssuer","openIdTokenIssuer","codeIssuer","identityResolver","ctx","authorize","data","identity","availableResponseTypes","Object","values","responseTypes","response_type","Array","isArray","split","enabledResponseTypes","responseType","includes","responseTypeUnsupported","redirect_uri","redirectUriMismatch","output","redirectUri","state","identityInvalid","payloadBaseNormalized","sub","id","sub_kind","type","realm_id","realm","realm_name","name","client_id","scope","nonce","codeEntity","TOKEN","token","issue","accessToken","CODE","authorizationCode","needsIdToken","ID_TOKEN","OPEN_ID","idTokenPayload","at_hash","c_hash","issueWithIdentity","idToken","updateIdToken"],"sources":["../../../../src/core/oauth2/authorization/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Identity, OAuth2AuthorizationCode, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport {\n    OAuth2AuthorizationResponseType,\n    OAuth2Error,\n    hasOAuth2Scopes,\n} from '@authup/specs';\nimport type { IOAuth2OpenIDTokenIssuer, IOAuth2TokenIssuer } from '../token/index.ts';\nimport type { IOAuth2AuthorizationCodeIssuer } from './code/index.ts';\nimport { buildOAuth2TokenHash } from './helpers.ts';\nimport type {\n    OAuth2AuthorizationManagerContext,\n    OAuth2AuthorizationResult,\n} from './types.ts';\nimport type { IIdentityResolver } from '../../identity/index.ts';\n\nexport class OAuth2Authorization {\n    protected accessTokenIssuer : IOAuth2TokenIssuer;\n\n    protected openIdTokenIssuer : IOAuth2OpenIDTokenIssuer;\n\n    protected codeIssuer : IOAuth2AuthorizationCodeIssuer;\n\n    protected identityResolver : IIdentityResolver;\n\n    constructor(ctx: OAuth2AuthorizationManagerContext) {\n        this.accessTokenIssuer = ctx.accessTokenIssuer;\n        this.openIdTokenIssuer = ctx.openIdTokenIssuer;\n        this.codeIssuer = ctx.codeIssuer;\n        this.identityResolver = ctx.identityResolver;\n    }\n\n    /**\n     * Authorize with validated codeRequest.\n     *\n     * @param data\n     * @param identity\n     */\n    async authorize(\n        data: OAuth2AuthorizationCodeRequest,\n        identity: Identity,\n    ) : Promise<OAuth2AuthorizationResult> {\n        const availableResponseTypes : string[] = Object.values(OAuth2AuthorizationResponseType);\n\n        let responseTypes : string[] = [];\n        if (data.response_type) {\n            responseTypes = Array.isArray(data.response_type) ?\n                data.response_type :\n                data.response_type.split(' ');\n        }\n\n        const enabledResponseTypes : Record<string, boolean> = {};\n\n        for (const responseType of responseTypes) {\n            if (!availableResponseTypes.includes(responseType)) {\n                throw OAuth2Error.responseTypeUnsupported();\n            } else {\n                enabledResponseTypes[responseType] = true;\n            }\n        }\n\n        if (!data.redirect_uri) {\n            throw OAuth2Error.redirectUriMismatch();\n        }\n\n        const output : OAuth2AuthorizationResult = {\n            redirectUri: data.redirect_uri,\n            ...(data.state ? { state: data.state } : {}),\n        };\n\n        if (!identity) {\n            throw OAuth2Error.identityInvalid();\n        }\n\n        const payloadBaseNormalized : OAuth2TokenPayload = {\n\n            sub: identity.data.id,\n            sub_kind: identity.type,\n            realm_id: identity.data.realm.id,\n            realm_name: identity.data.realm.name,\n\n            client_id: data.client_id,\n            ...(data.scope ? { scope: data.scope } : {}),\n            ...(data.nonce ? { nonce: data.nonce } : {}),\n        };\n\n        let codeEntity : OAuth2AuthorizationCode | undefined;\n\n        if (enabledResponseTypes[OAuth2AuthorizationResponseType.TOKEN]) {\n            const [token] = await this.accessTokenIssuer.issue(payloadBaseNormalized);\n\n            output.accessToken = token;\n        }\n\n        if (enabledResponseTypes[OAuth2AuthorizationResponseType.CODE]) {\n            codeEntity = await this.codeIssuer.issue(\n                data,\n                identity,\n            );\n\n            output.authorizationCode = codeEntity.id;\n        }\n\n        const needsIdToken = enabledResponseTypes[OAuth2AuthorizationResponseType.ID_TOKEN] ||\n            (data.scope && hasOAuth2Scopes(data.scope, ScopeName.OPEN_ID));\n\n        if (needsIdToken) {\n            const idTokenPayload = { ...payloadBaseNormalized };\n\n            if (output.accessToken) {\n                idTokenPayload.at_hash = await buildOAuth2TokenHash(output.accessToken);\n            }\n            if (output.authorizationCode) {\n                idTokenPayload.c_hash = await buildOAuth2TokenHash(output.authorizationCode);\n            }\n\n            const [token] = await this.openIdTokenIssuer.issueWithIdentity(\n                idTokenPayload,\n                identity,\n            );\n\n            if (enabledResponseTypes[OAuth2AuthorizationResponseType.ID_TOKEN]) {\n                output.idToken = token;\n            }\n\n            if (codeEntity) {\n                await this.codeIssuer.updateIdToken(codeEntity, token);\n            }\n        }\n\n        return output;\n    }\n}\n"],"mappings":";;;;AAwBA,IAAaK,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAwC;AAChD,OAAKJ,oBAAoBI,IAAIJ;AAC7B,OAAKC,oBAAoBG,IAAIH;AAC7B,OAAKC,aAAaE,IAAIF;AACtB,OAAKC,mBAAmBC,IAAID;;;;;;;IAShC,MAAME,UACFC,MACAC,UACmC;EACnC,MAAMC,yBAAoCC,OAAOC,OAAOf,gCAAAA;EAExD,IAAIgB,gBAA2B,EAAE;AACjC,MAAIL,KAAKM,cACLD,iBAAgBE,MAAMC,QAAQR,KAAKM,cAAa,GAC5CN,KAAKM,gBACLN,KAAKM,cAAcG,MAAM,IAAA;EAGjC,MAAMC,uBAAiD,EAAC;AAExD,OAAK,MAAMC,gBAAgBN,cACvB,KAAI,CAACH,uBAAuBU,SAASD,aAAAA,CACjC,OAAMrB,YAAYuB,yBAAuB;MAEzCH,sBAAqBC,gBAAgB;AAI7C,MAAI,CAACX,KAAKc,aACN,OAAMxB,YAAYyB,qBAAmB;EAGzC,MAAMC,SAAqC;GACvCC,aAAajB,KAAKc;GAClB,GAAId,KAAKkB,QAAQ,EAAEA,OAAOlB,KAAKkB,OAAM,GAAI,EAAE;GAC/C;AAEA,MAAI,CAACjB,SACD,OAAMX,YAAY6B,iBAAe;EAGrC,MAAMC,wBAA6C;GAE/CC,KAAKpB,SAASD,KAAKsB;GACnBC,UAAUtB,SAASuB;GACnBC,UAAUxB,SAASD,KAAK0B,MAAMJ;GAC9BK,YAAY1B,SAASD,KAAK0B,MAAME;GAEhCC,WAAW7B,KAAK6B;GAChB,GAAI7B,KAAK8B,QAAQ,EAAEA,OAAO9B,KAAK8B,OAAM,GAAI,EAAE;GAC3C,GAAI9B,KAAK+B,QAAQ,EAAEA,OAAO/B,KAAK+B,OAAM,GAAI,EAAE;GAC/C;EAEA,IAAIC;AAEJ,MAAItB,qBAAqBrB,gCAAgC4C,QAAQ;GAC7D,MAAM,CAACC,SAAS,MAAM,KAAKxC,kBAAkByC,MAAMf,sBAAAA;AAEnDJ,UAAOoB,cAAcF;;AAGzB,MAAIxB,qBAAqBrB,gCAAgCgD,OAAO;AAC5DL,gBAAa,MAAM,KAAKpC,WAAWuC,MAC/BnC,MACAC,SAAAA;AAGJe,UAAOsB,oBAAoBN,WAAWV;;AAM1C,MAHqBZ,qBAAqBrB,gCAAgCmD,aACrExC,KAAK8B,SAASvC,gBAAgBS,KAAK8B,OAAO1C,UAAUqD,QAAO,EAE9C;GACd,MAAMC,iBAAiB,EAAE,GAAGtB,uBAAsB;AAElD,OAAIJ,OAAOoB,YACPM,gBAAeC,UAAU,MAAMnD,qBAAqBwB,OAAOoB,YAAW;AAE1E,OAAIpB,OAAOsB,kBACPI,gBAAeE,SAAS,MAAMpD,qBAAqBwB,OAAOsB,kBAAiB;GAG/E,MAAM,CAACJ,SAAS,MAAM,KAAKvC,kBAAkBkD,kBACzCH,gBACAzC,SAAAA;AAGJ,OAAIS,qBAAqBrB,gCAAgCmD,UACrDxB,QAAO8B,UAAUZ;AAGrB,OAAIF,WACA,OAAM,KAAKpC,WAAWmD,cAAcf,YAAYE,MAAAA;;AAIxD,SAAOlB"}

package/dist/core/oauth2/authorization/state/index.mjs

@@ -0,0 +1,2 @@
+import { OAuth2AuthorizationStateManager } from "./module.mjs";
+export { OAuth2AuthorizationStateManager };

package/dist/core/oauth2/authorization/state/module.mjs

@@ -0,0 +1,23 @@
+import { OAuth2Error } from "@authup/specs";
+//#region src/core/oauth2/authorization/state/module.ts
+var OAuth2AuthorizationStateManager = class {
+	repository;
+	constructor(repository) {
+		this.repository = repository;
+	}
+	async save(data) {
+		return this.repository.insert(data);
+	}
+	async verify(state, input) {
+		const payload = await this.repository.findOneById(state);
+		if (!payload) throw OAuth2Error.stateInvalid();
+		await this.repository.remove(state);
+		if (payload.ip && input.ip !== payload.ip) throw OAuth2Error.stateInvalid();
+		if (payload.userAgent && input.userAgent !== payload.userAgent) throw OAuth2Error.stateInvalid();
+		return payload;
+	}
+};
+//#endregion
+export { OAuth2AuthorizationStateManager };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/authorization/state/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["OAuth2Error","OAuth2AuthorizationStateManager","repository","save","data","insert","verify","state","input","payload","findOneById","stateInvalid","remove","ip","userAgent"],"sources":["../../../../../src/core/oauth2/authorization/state/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { OAuth2Error } from '@authup/specs';\nimport type {\n    IOAuth2AuthorizationStateManager,\n    IOAuth2AuthorizeStateRepository,\n    OAuth2AuthorizationState,\n} from './types.ts';\n\nexport class OAuth2AuthorizationStateManager implements IOAuth2AuthorizationStateManager {\n    protected repository: IOAuth2AuthorizeStateRepository;\n\n    constructor(repository: IOAuth2AuthorizeStateRepository) {\n        this.repository = repository;\n    }\n\n    async save(data: OAuth2AuthorizationState) : Promise<string> {\n        return this.repository.insert(data);\n    }\n\n    async verify(state: string, input: Partial<OAuth2AuthorizationState>): Promise<OAuth2AuthorizationState> {\n        const payload = await this.repository.findOneById(state);\n        if (!payload) {\n            throw OAuth2Error.stateInvalid();\n        }\n\n        // avoid replay attacks\n        await this.repository.remove(state);\n\n        if (\n            payload.ip &&\n            input.ip !== payload.ip\n        ) {\n            throw OAuth2Error.stateInvalid();\n        }\n\n        if (\n            payload.userAgent &&\n            input.userAgent !== payload.userAgent\n        ) {\n            throw OAuth2Error.stateInvalid();\n        }\n\n        return payload;\n    }\n}\n"],"mappings":";;AAcA,IAAaC,kCAAb,MAAaA;CACCC;CAEV,YAAYA,YAA6C;AACrD,OAAKA,aAAaA;;CAGtB,MAAMC,KAAKC,MAAkD;AACzD,SAAO,KAAKF,WAAWG,OAAOD,KAAAA;;CAGlC,MAAME,OAAOC,OAAeC,OAA6E;EACrG,MAAMC,UAAU,MAAM,KAAKP,WAAWQ,YAAYH,MAAAA;AAClD,MAAI,CAACE,QACD,OAAMT,YAAYW,cAAY;AAIlC,QAAM,KAAKT,WAAWU,OAAOL,MAAAA;AAE7B,MACIE,QAAQI,MACRL,MAAMK,OAAOJ,QAAQI,GAErB,OAAMb,YAAYW,cAAY;AAGlC,MACIF,QAAQK,aACRN,MAAMM,cAAcL,QAAQK,UAE5B,OAAMd,YAAYW,cAAY;AAGlC,SAAOF"}

package/dist/core/oauth2/authorization/state/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/authorization/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/client/index.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/client/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/grant-types/authorize.mjs

@@ -0,0 +1,50 @@
+import { OAuth2BaseGrant } from "./base.mjs";
+import { buildOAuth2BearerTokenResponse } from "../response/bearer.mjs";
+import { ScopeName } from "@authup/core-kit";
+import { hasOAuth2Scopes } from "@authup/specs";
+//#region src/core/oauth2/grant-types/authorize.ts
+var OAuth2AuthorizeGrant = class extends OAuth2BaseGrant {
+	refreshTokenIssuer;
+	constructor(ctx) {
+		super({
+			accessTokenIssuer: ctx.accessTokenIssuer,
+			sessionManager: ctx.sessionManager
+		});
+		this.refreshTokenIssuer = ctx.refreshTokenIssuer;
+	}
+	async runWith(authorizationCode, options = {}) {
+		const session = await this.sessionManager.create({
+			user_agent: options.userAgent,
+			ip_address: options.ipAddress,
+			realm_id: authorizationCode.realm_id,
+			client_id: authorizationCode.client_id,
+			sub_kind: authorizationCode.sub_kind,
+			sub: authorizationCode.sub
+		});
+		const issuePayload = {
+			user_agent: options.userAgent,
+			remote_address: options.ipAddress,
+			session_id: session.id,
+			sub: authorizationCode.sub || void 0,
+			sub_kind: authorizationCode.sub_kind,
+			realm_id: authorizationCode.realm_id,
+			realm_name: authorizationCode.realm_name,
+			scope: authorizationCode.scope || void 0,
+			client_id: authorizationCode.client_id || void 0
+		};
+		const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);
+		const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);
+		const buildContext = {
+			accessToken,
+			accessTokenPayload,
+			refreshToken,
+			refreshTokenPayload
+		};
+		if (authorizationCode.scope && hasOAuth2Scopes(authorizationCode.scope, ScopeName.OPEN_ID)) buildContext.idToken = authorizationCode.id_token || void 0;
+		return buildOAuth2BearerTokenResponse(buildContext);
+	}
+};
+//#endregion
+export { OAuth2AuthorizeGrant };
+
+//# sourceMappingURL=authorize.mjs.map

package/dist/core/oauth2/grant-types/authorize.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.mjs","names":["hasOAuth2Scopes","ScopeName","OAuth2BaseGrant","buildOAuth2BearerTokenResponse","OAuth2AuthorizeGrant","refreshTokenIssuer","ctx","accessTokenIssuer","sessionManager","runWith","authorizationCode","options","session","create","user_agent","userAgent","ip_address","ipAddress","realm_id","client_id","sub_kind","sub","issuePayload","remote_address","session_id","id","undefined","realm_name","scope","accessToken","accessTokenPayload","issue","refreshToken","refreshTokenPayload","buildContext","OPEN_ID","idToken","id_token"],"sources":["../../../../src/core/oauth2/grant-types/authorize.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { hasOAuth2Scopes } from '@authup/specs';\nimport type { OAuth2AuthorizationCode } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport type { IOAuth2TokenIssuer } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport type { IOAuth2Grant, OAuth2AuthorizeGrantContext, OAuth2GrantRunWIthOptions } from './types.ts';\nimport type { OAuth2BearerResponseBuildContext } from '../response/index.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\n\nexport class OAuth2AuthorizeGrant extends OAuth2BaseGrant<OAuth2AuthorizationCode> implements IOAuth2Grant {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    constructor(ctx: OAuth2AuthorizeGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n    }\n\n    async runWith(\n        authorizationCode: OAuth2AuthorizationCode,\n        options: OAuth2GrantRunWIthOptions = {},\n    ) : Promise<OAuth2TokenGrantResponse> {\n        const session = await this.sessionManager.create({\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: authorizationCode.realm_id,\n            client_id: authorizationCode.client_id,\n            sub_kind: authorizationCode.sub_kind,\n            sub: authorizationCode.sub,\n        });\n\n        const issuePayload : Partial<OAuth2TokenPayload> = {\n            user_agent: options.userAgent,\n            remote_address: options.ipAddress,\n            session_id: session.id,\n            sub: authorizationCode.sub || undefined,\n            sub_kind: authorizationCode.sub_kind,\n            realm_id: authorizationCode.realm_id,\n            realm_name: authorizationCode.realm_name,\n            scope: authorizationCode.scope || undefined,\n            client_id: authorizationCode.client_id || undefined,\n        };\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);\n\n        const buildContext : OAuth2BearerResponseBuildContext = {\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        };\n\n        if (\n            authorizationCode.scope &&\n            hasOAuth2Scopes(authorizationCode.scope, ScopeName.OPEN_ID)\n        ) {\n            buildContext.idToken = authorizationCode.id_token || undefined;\n        }\n\n        return buildOAuth2BearerTokenResponse(buildContext);\n    }\n}\n"],"mappings":";;;;;AAiBA,IAAaI,uBAAb,cAA0CF,gBAAAA;CAC5BG;CAEV,YAAYC,KAAkC;AAC1C,QAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;GACxB,CAAA;AAEA,OAAKH,qBAAqBC,IAAID;;CAGlC,MAAMI,QACFC,mBACAC,UAAqC,EAAE,EACL;EAClC,MAAMC,UAAU,MAAM,KAAKJ,eAAeK,OAAO;GAC7CC,YAAYH,QAAQI;GACpBC,YAAYL,QAAQM;GACpBC,UAAUR,kBAAkBQ;GAC5BC,WAAWT,kBAAkBS;GAC7BC,UAAUV,kBAAkBU;GAC5BC,KAAKX,kBAAkBW;GAC3B,CAAA;EAEA,MAAMC,eAA6C;GAC/CR,YAAYH,QAAQI;GACpBQ,gBAAgBZ,QAAQM;GACxBO,YAAYZ,QAAQa;GACpBJ,KAAKX,kBAAkBW,OAAOK,KAAAA;GAC9BN,UAAUV,kBAAkBU;GAC5BF,UAAUR,kBAAkBQ;GAC5BS,YAAYjB,kBAAkBiB;GAC9BC,OAAOlB,kBAAkBkB,SAASF,KAAAA;GAClCP,WAAWT,kBAAkBS,aAAaO,KAAAA;GAC9C;EAEA,MAAM,CAACG,aAAaC,sBAAsB,MAAM,KAAKvB,kBAAkBwB,MAAMT,aAAAA;EAC7E,MAAM,CAACU,cAAcC,uBAAuB,MAAM,KAAK5B,mBAAmB0B,MAAMT,aAAAA;EAEhF,MAAMY,eAAkD;GACpDL;GACAC;GACAE;GACAC;GACJ;AAEA,MACIvB,kBAAkBkB,SAClB5B,gBAAgBU,kBAAkBkB,OAAO3B,UAAUkC,QAAO,CAE1DD,cAAaE,UAAU1B,kBAAkB2B,YAAYX,KAAAA;AAGzD,SAAOvB,+BAA+B+B,aAAAA"}

package/dist/core/oauth2/grant-types/base.mjs

@@ -0,0 +1,13 @@
+//#region src/core/oauth2/grant-types/base.ts
+var OAuth2BaseGrant = class {
+	accessTokenIssuer;
+	sessionManager;
+	constructor(ctx) {
+		this.accessTokenIssuer = ctx.accessTokenIssuer;
+		this.sessionManager = ctx.sessionManager;
+	}
+};
+//#endregion
+export { OAuth2BaseGrant };
+
+//# sourceMappingURL=base.mjs.map

package/dist/core/oauth2/grant-types/base.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.mjs","names":["OAuth2BaseGrant","accessTokenIssuer","sessionManager","ctx"],"sources":["../../../../src/core/oauth2/grant-types/base.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ObjectLiteral } from '@authup/kit';\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport type { ISessionManager } from '../../authentication/index.ts';\nimport type { IOAuth2TokenIssuer } from '../token/index.ts';\nimport type { BaseGrantContext, IOAuth2Grant, OAuth2GrantRunWIthOptions } from './types.ts';\n\nexport abstract class OAuth2BaseGrant<\n    T = ObjectLiteral,\n> implements IOAuth2Grant<T> {\n    protected accessTokenIssuer : IOAuth2TokenIssuer;\n\n    protected sessionManager : ISessionManager;\n\n    // -----------------------------------------------------\n\n    constructor(ctx: BaseGrantContext) {\n        this.accessTokenIssuer = ctx.accessTokenIssuer;\n        this.sessionManager = ctx.sessionManager;\n    }\n\n    // -----------------------------------------------------\n\n    abstract runWith(input: T, options?: OAuth2GrantRunWIthOptions): Promise<OAuth2TokenGrantResponse>;\n}\n"],"mappings":";AAaA,IAAsBA,kBAAtB,MAAsBA;CAGRC;CAEAC;CAIV,YAAYC,KAAuB;AAC/B,OAAKF,oBAAoBE,IAAIF;AAC7B,OAAKC,iBAAiBC,IAAID"}

package/dist/core/oauth2/grant-types/client-credentials.mjs

@@ -0,0 +1,35 @@
+import { OAuth2BaseGrant } from "./base.mjs";
+import { buildOAuth2BearerTokenResponse } from "../response/bearer.mjs";
+import { IdentityType, ScopeName } from "@authup/core-kit";
+import { OAuth2SubKind } from "@authup/specs";
+//#region src/core/oauth2/grant-types/client-credentials.ts
+var ClientCredentialsGrant = class extends OAuth2BaseGrant {
+	async runWith(input, options = {}) {
+		const session = await this.sessionManager.create({
+			user_agent: options.userAgent,
+			ip_address: options.ipAddress,
+			realm_id: input.realm_id,
+			sub: input.id,
+			sub_kind: IdentityType.CLIENT
+		});
+		const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({
+			user_agent: session.user_agent,
+			remote_address: session.ip_address,
+			session_id: session.id,
+			scope: ScopeName.GLOBAL,
+			sub: input.id,
+			sub_kind: OAuth2SubKind.CLIENT,
+			realm_id: input.realm.id,
+			realm_name: input.realm.id,
+			client_id: input.id
+		});
+		return buildOAuth2BearerTokenResponse({
+			accessToken,
+			accessTokenPayload
+		});
+	}
+};
+//#endregion
+export { ClientCredentialsGrant };
+
+//# sourceMappingURL=client-credentials.mjs.map

package/dist/core/oauth2/grant-types/client-credentials.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-credentials.mjs","names":["OAuth2SubKind","IdentityType","ScopeName","OAuth2BaseGrant","buildOAuth2BearerTokenResponse","ClientCredentialsGrant","runWith","input","options","session","sessionManager","create","user_agent","userAgent","ip_address","ipAddress","realm_id","sub","id","sub_kind","CLIENT","accessToken","accessTokenPayload","accessTokenIssuer","issue","remote_address","session_id","scope","GLOBAL","realm","realm_name","client_id"],"sources":["../../../../src/core/oauth2/grant-types/client-credentials.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2SubKind } from '@authup/specs';\nimport type { Client } from '@authup/core-kit';\nimport {\n    IdentityType,\n    ScopeName,\n} from '@authup/core-kit';\nimport { OAuth2BaseGrant } from './base.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { OAuth2GrantRunWIthOptions } from './types.ts';\n\nexport class ClientCredentialsGrant extends OAuth2BaseGrant<Client> {\n    async runWith(input: Client, options: OAuth2GrantRunWIthOptions = {}) : Promise<OAuth2TokenGrantResponse> {\n        const session = await this.sessionManager.create({\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: input.realm_id,\n            sub: input.id,\n            sub_kind: IdentityType.CLIENT,\n        });\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            session_id: session.id,\n            scope: ScopeName.GLOBAL,\n            sub: input.id,\n            sub_kind: OAuth2SubKind.CLIENT,\n            realm_id: input.realm.id,\n            realm_name: input.realm.id,\n            client_id: input.id,\n        });\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;AAkBA,IAAaK,yBAAb,cAA4CF,gBAAAA;CACxC,MAAMG,QAAQC,OAAeC,UAAqC,EAAE,EAAsC;EACtG,MAAMC,UAAU,MAAM,KAAKC,eAAeC,OAAO;GAC7CC,YAAYJ,QAAQK;GACpBC,YAAYN,QAAQO;GACpBC,UAAUT,MAAMS;GAChBC,KAAKV,MAAMW;GACXC,UAAUlB,aAAamB;GAC3B,CAAA;EAEA,MAAM,CAACC,aAAaC,sBAAsB,MAAM,KAAKC,kBAAkBC,MAAM;GACzEZ,YAAYH,QAAQG;GACpBa,gBAAgBhB,QAAQK;GACxBY,YAAYjB,QAAQS;GACpBS,OAAOzB,UAAU0B;GACjBX,KAAKV,MAAMW;GACXC,UAAUnB,cAAcoB;GACxBJ,UAAUT,MAAMsB,MAAMX;GACtBY,YAAYvB,MAAMsB,MAAMX;GACxBa,WAAWxB,MAAMW;GACrB,CAAA;AAEA,SAAOd,+BAA+B;GAClCiB;GACAC;GACJ,CAAA"}

package/dist/core/oauth2/grant-types/identity.mjs

@@ -0,0 +1,46 @@
+import { OAuth2BaseGrant } from "./base.mjs";
+import { buildOAuth2BearerTokenResponse } from "../response/bearer.mjs";
+import { ScopeName } from "@authup/core-kit";
+//#region src/core/oauth2/grant-types/identity.ts
+var IdentityGrantType = class extends OAuth2BaseGrant {
+	refreshTokenIssuer;
+	constructor(ctx) {
+		super({
+			accessTokenIssuer: ctx.accessTokenIssuer,
+			sessionManager: ctx.sessionManager
+		});
+		this.refreshTokenIssuer = ctx.refreshTokenIssuer;
+	}
+	async runWith(identity, options = {}) {
+		const session = {
+			user_agent: options.userAgent,
+			ip_address: options.ipAddress,
+			realm_id: identity.data.realm_id,
+			sub: identity.data.id,
+			sub_kind: identity.type
+		};
+		const { id: sessionId } = await this.sessionManager.create(session);
+		const issuePayload = {
+			session_id: sessionId,
+			user_agent: session.user_agent,
+			remote_address: session.ip_address,
+			scope: ScopeName.GLOBAL,
+			realm_id: identity.data.realm_id,
+			realm_name: identity.data.realm?.name,
+			sub: identity.data.id,
+			sub_kind: identity.type
+		};
+		const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);
+		const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);
+		return buildOAuth2BearerTokenResponse({
+			accessToken,
+			accessTokenPayload,
+			refreshToken,
+			refreshTokenPayload
+		});
+	}
+};
+//#endregion
+export { IdentityGrantType };
+
+//# sourceMappingURL=identity.mjs.map

package/dist/core/oauth2/grant-types/identity.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.mjs","names":["ScopeName","OAuth2BaseGrant","buildOAuth2BearerTokenResponse","IdentityGrantType","refreshTokenIssuer","ctx","accessTokenIssuer","sessionManager","runWith","identity","options","session","user_agent","userAgent","ip_address","ipAddress","realm_id","data","sub","id","sub_kind","type","sessionId","create","issuePayload","session_id","remote_address","scope","GLOBAL","realm_name","realm","name","accessToken","accessTokenPayload","issue","refreshToken","refreshTokenPayload"],"sources":["../../../../src/core/oauth2/grant-types/identity.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport type { Identity, Session } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport type { IOAuth2TokenIssuer } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { OAuth2GrantRunWIthOptions, OAuth2IdentityGrantContext } from './types.ts';\n\nexport class IdentityGrantType extends OAuth2BaseGrant<Identity> {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    constructor(ctx: OAuth2IdentityGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n    }\n\n    async runWith(\n        identity: Identity,\n        options: OAuth2GrantRunWIthOptions = {},\n    ): Promise<OAuth2TokenGrantResponse> {\n        const session : Partial<Session> = {\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: identity.data.realm_id,\n            sub: identity.data.id,\n            sub_kind: identity.type,\n        };\n\n        const { id: sessionId } = await this.sessionManager.create(session);\n\n        const issuePayload : Partial<OAuth2TokenPayload> = {\n            session_id: sessionId,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            scope: ScopeName.GLOBAL,\n            realm_id: identity.data.realm_id,\n            realm_name: identity.data.realm?.name,\n            sub: identity.data.id,\n            sub_kind: identity.type,\n        };\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;AAeA,IAAaG,oBAAb,cAAuCF,gBAAAA;CACzBG;CAEV,YAAYC,KAAiC;AACzC,QAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;GACxB,CAAA;AAEA,OAAKH,qBAAqBC,IAAID;;CAGlC,MAAMI,QACFC,UACAC,UAAqC,EAAE,EACN;EACjC,MAAMC,UAA6B;GAC/BC,YAAYF,QAAQG;GACpBC,YAAYJ,QAAQK;GACpBC,UAAUP,SAASQ,KAAKD;GACxBE,KAAKT,SAASQ,KAAKE;GACnBC,UAAUX,SAASY;GACvB;EAEA,MAAM,EAAEF,IAAIG,cAAc,MAAM,KAAKf,eAAegB,OAAOZ,QAAAA;EAE3D,MAAMa,eAA6C;GAC/CC,YAAYH;GACZV,YAAYD,QAAQC;GACpBc,gBAAgBf,QAAQG;GACxBa,OAAO3B,UAAU4B;GACjBZ,UAAUP,SAASQ,KAAKD;GACxBa,YAAYpB,SAASQ,KAAKa,OAAOC;GACjCb,KAAKT,SAASQ,KAAKE;GACnBC,UAAUX,SAASY;GACvB;EAEA,MAAM,CAACW,aAAaC,sBAAsB,MAAM,KAAK3B,kBAAkB4B,MAAMV,aAAAA;EAC7E,MAAM,CAACW,cAAcC,uBAAuB,MAAM,KAAKhC,mBAAmB8B,MAAMV,aAAAA;AAEhF,SAAOtB,+BAA+B;GAClC8B;GACAC;GACAE;GACAC;GACJ,CAAA"}

package/dist/core/oauth2/grant-types/index.mjs

@@ -0,0 +1,7 @@
+import { OAuth2AuthorizeGrant } from "./authorize.mjs";
+import { ClientCredentialsGrant } from "./client-credentials.mjs";
+import { IdentityGrantType } from "./identity.mjs";
+import { PasswordGrantType } from "./password.mjs";
+import { OAuth2RefreshTokenGrant } from "./refresh-token.mjs";
+import { RobotCredentialsGrant } from "./robot-credentials.mjs";
+export { ClientCredentialsGrant, IdentityGrantType, OAuth2AuthorizeGrant, OAuth2RefreshTokenGrant, PasswordGrantType, RobotCredentialsGrant };

package/dist/core/oauth2/grant-types/password.mjs

@@ -0,0 +1,48 @@
+import { OAuth2BaseGrant } from "./base.mjs";
+import { buildOAuth2BearerTokenResponse } from "../response/bearer.mjs";
+import { IdentityType, ScopeName } from "@authup/core-kit";
+import { OAuth2SubKind } from "@authup/specs";
+//#region src/core/oauth2/grant-types/password.ts
+var PasswordGrantType = class extends OAuth2BaseGrant {
+	refreshTokenIssuer;
+	constructor(ctx) {
+		super({
+			accessTokenIssuer: ctx.accessTokenIssuer,
+			sessionManager: ctx.sessionManager
+		});
+		this.refreshTokenIssuer = ctx.refreshTokenIssuer;
+	}
+	async runWith(input, options = {}) {
+		const session = await this.sessionManager.create({
+			user_agent: options.userAgent,
+			ip_address: options.ipAddress,
+			realm_id: input.realm_id,
+			client_id: input.client_id || void 0,
+			sub: input.id,
+			sub_kind: IdentityType.USER
+		});
+		const issuePayload = {
+			client_id: input.client_id || void 0,
+			session_id: session.id,
+			user_agent: session.user_agent,
+			remote_address: session.ip_address,
+			scope: ScopeName.GLOBAL,
+			sub: input.id,
+			sub_kind: OAuth2SubKind.USER,
+			realm_id: input.realm_id,
+			realm_name: input.realm?.name
+		};
+		const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);
+		const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);
+		return buildOAuth2BearerTokenResponse({
+			accessToken,
+			accessTokenPayload,
+			refreshToken,
+			refreshTokenPayload
+		});
+	}
+};
+//#endregion
+export { PasswordGrantType };
+
+//# sourceMappingURL=password.mjs.map

package/dist/core/oauth2/grant-types/password.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.mjs","names":["OAuth2SubKind","IdentityType","ScopeName","buildOAuth2BearerTokenResponse","OAuth2BaseGrant","PasswordGrantType","refreshTokenIssuer","ctx","accessTokenIssuer","sessionManager","runWith","input","options","session","create","user_agent","userAgent","ip_address","ipAddress","realm_id","client_id","undefined","sub","id","sub_kind","USER","issuePayload","session_id","remote_address","scope","GLOBAL","realm_name","realm","name","accessToken","accessTokenPayload","issue","refreshToken","refreshTokenPayload"],"sources":["../../../../src/core/oauth2/grant-types/password.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2SubKind } from '@authup/specs';\nimport type { User } from '@authup/core-kit';\nimport {\n    IdentityType,\n    ScopeName,\n} from '@authup/core-kit';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { IOAuth2TokenIssuer } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport type { OAuth2GrantRunWIthOptions, OAuth2PasswordGrantContext } from './types.ts';\n\nexport class PasswordGrantType extends OAuth2BaseGrant<User> {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    constructor(ctx: OAuth2PasswordGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n    }\n\n    async runWith(input: User, options: OAuth2GrantRunWIthOptions = {}) : Promise<OAuth2TokenGrantResponse> {\n        const session = await this.sessionManager.create({\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: input.realm_id,\n            client_id: input.client_id || undefined,\n            sub: input.id,\n            sub_kind: IdentityType.USER,\n        });\n\n        const issuePayload : Partial<OAuth2TokenPayload> = {\n            client_id: input.client_id || undefined,\n            session_id: session.id,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            scope: ScopeName.GLOBAL,\n            sub: input.id,\n            sub_kind: OAuth2SubKind.USER,\n            realm_id: input.realm_id,\n            realm_name: input.realm?.name,\n        };\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;AAmBA,IAAaK,oBAAb,cAAuCD,gBAAAA;CACzBE;CAEV,YAAYC,KAAiC;AACzC,QAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;GACxB,CAAA;AAEA,OAAKH,qBAAqBC,IAAID;;CAGlC,MAAMI,QAAQC,OAAaC,UAAqC,EAAE,EAAsC;EACpG,MAAMC,UAAU,MAAM,KAAKJ,eAAeK,OAAO;GAC7CC,YAAYH,QAAQI;GACpBC,YAAYL,QAAQM;GACpBC,UAAUR,MAAMQ;GAChBC,WAAWT,MAAMS,aAAaC,KAAAA;GAC9BC,KAAKX,MAAMY;GACXC,UAAUvB,aAAawB;GAC3B,CAAA;EAEA,MAAMC,eAA6C;GAC/CN,WAAWT,MAAMS,aAAaC,KAAAA;GAC9BM,YAAYd,QAAQU;GACpBR,YAAYF,QAAQE;GACpBa,gBAAgBf,QAAQI;GACxBY,OAAO3B,UAAU4B;GACjBR,KAAKX,MAAMY;GACXC,UAAUxB,cAAcyB;GACxBN,UAAUR,MAAMQ;GAChBY,YAAYpB,MAAMqB,OAAOC;GAC7B;EAEA,MAAM,CAACC,aAAaC,sBAAsB,MAAM,KAAK3B,kBAAkB4B,MAAMV,aAAAA;EAC7E,MAAM,CAACW,cAAcC,uBAAuB,MAAM,KAAKhC,mBAAmB8B,MAAMV,aAAAA;AAEhF,SAAOvB,+BAA+B;GAClC+B;GACAC;GACAE;GACAC;GACJ,CAAA"}

package/dist/core/oauth2/grant-types/refresh-token.mjs

@@ -0,0 +1,53 @@
+import { OAuth2BaseGrant } from "./base.mjs";
+import { buildOAuth2BearerTokenResponse } from "../response/bearer.mjs";
+import { JWTError } from "@authup/specs";
+//#region src/core/oauth2/grant-types/refresh-token.ts
+var OAuth2RefreshTokenGrant = class extends OAuth2BaseGrant {
+	refreshTokenIssuer;
+	tokenVerifier;
+	tokenRevoker;
+	constructor(ctx) {
+		super({
+			accessTokenIssuer: ctx.accessTokenIssuer,
+			sessionManager: ctx.sessionManager
+		});
+		this.refreshTokenIssuer = ctx.refreshTokenIssuer;
+		this.tokenVerifier = ctx.tokenVerifier;
+		this.tokenRevoker = ctx.tokenRevoker;
+	}
+	async runWith(input, options = {}) {
+		let payload;
+		if (typeof input === "string") payload = await this.tokenVerifier.verify(input);
+		else payload = input;
+		await this.tokenRevoker.revoke(payload);
+		if (!payload.session_id) throw JWTError.payloadPropertyInvalid("session_id");
+		const session = await this.sessionManager.findOneById(payload.session_id);
+		if (!session) throw JWTError.payloadPropertyInvalid("session_id");
+		await this.sessionManager.verify(session);
+		if (options.userAgent) session.user_agent = options.userAgent;
+		if (options.ipAddress) session.ip_address = options.ipAddress;
+		await this.sessionManager.refresh(session);
+		const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({
+			...payload,
+			user_agent: session.user_agent,
+			remote_address: session.ip_address,
+			exp: this.accessTokenIssuer.buildExp()
+		});
+		const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue({
+			...payload,
+			user_agent: session.user_agent,
+			remote_address: session.ip_address,
+			exp: this.refreshTokenIssuer.buildExp()
+		});
+		return buildOAuth2BearerTokenResponse({
+			accessToken,
+			accessTokenPayload,
+			refreshToken,
+			refreshTokenPayload
+		});
+	}
+};
+//#endregion
+export { OAuth2RefreshTokenGrant };
+
+//# sourceMappingURL=refresh-token.mjs.map