@authup/server-core 1.0.0-beta.36 → 1.0.0-beta.37

package/dist/core/identity/registration/service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.mjs","names":["UserValidator","createNanoID","BadRequestError","NotFoundError","randomBytes","Container","UserCredentialsService","RegistrationService","options","mailClient","repository","realmRepository","ctx","register","data","registrationEnabled","validator","mount","pathsToInclude","validated","run","group","validateJoinColumns","emailVerificationEnabled","active","activate_hash","toString","entity","create","credentialsService","password","protect","realm","resolve","realm_id","id","save","send","to","email","subject","html","remove","activate","findOneBy","token","merged","merge"],"sources":["../../../../src/core/identity/registration/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { UserValidator } from '@authup/core-kit';\nimport { createNanoID } from '@authup/kit';\nimport { BadRequestError, NotFoundError } from '@ebec/http';\nimport { randomBytes } from 'node:crypto';\nimport { Container } from 'validup';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type {\n    IRegistrationService,\n    RegistrationResult,\n    RegistrationServiceContext,\n    RegistrationServiceOptions,\n} from './types.ts';\nimport type { IMailClient } from '../../mail/types.ts';\nimport type { IRealmRepository, IUserRepository } from '../../entities/index.ts';\n\nexport class RegistrationService implements IRegistrationService {\n    protected options: RegistrationServiceOptions;\n\n    protected mailClient: IMailClient;\n\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    constructor(ctx: RegistrationServiceContext) {\n        this.options = ctx.options;\n        this.mailClient = ctx.mailClient;\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n    }\n\n    async register(data: Record<string, any>): Promise<RegistrationResult> {\n        if (!this.options.registrationEnabled) {\n            throw new BadRequestError('User registration is not enabled.');\n        }\n\n        const validator = new Container({});\n        validator.mount(new UserValidator({ pathsToInclude: ['email', 'name', 'password', 'realm_id'] }));\n        const validated = await validator.run(data, { group: 'create' });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (this.options.emailVerificationEnabled) {\n            validated.active = false;\n            validated.activate_hash = randomBytes(32).toString('hex');\n        } else {\n            validated.active = true;\n        }\n\n        const entity = this.repository.create(validated);\n\n        const credentialsService = new UserCredentialsService();\n        entity.password = entity.password || createNanoID(64);\n        entity.password = await credentialsService.protect(entity.password);\n\n        const realm = await this.realmRepository.resolve(entity.realm_id, true);\n        entity.realm_id = realm.id;\n\n        await this.repository.save(entity);\n\n        if (this.options.emailVerificationEnabled) {\n            try {\n                await this.mailClient.send({\n                    to: entity.email,\n                    subject: 'Registration - Activation code',\n                    html: `\n                    <p>Please use the code below to activate your account and start using the site.</p>\n                    <p>${entity.activate_hash}</p>\n                    `,\n                });\n            } catch {\n                await this.repository.remove(entity);\n                throw new BadRequestError('Registration failed. Could not send activation email.');\n            }\n        }\n\n        return { active: entity.active };\n    }\n\n    async activate(data: { token: string }): Promise<void> {\n        const entity = await this.repository.findOneBy({ activate_hash: data.token });\n\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        const merged = this.repository.merge(entity, {\n            active: true,\n            activate_hash: null,\n        });\n\n        await this.repository.save(merged);\n    }\n}\n"],"mappings":";;;;;;;AAsBA,IAAaO,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAiC;AACzC,OAAKJ,UAAUI,IAAIJ;AACnB,OAAKC,aAAaG,IAAIH;AACtB,OAAKC,aAAaE,IAAIF;AACtB,OAAKC,kBAAkBC,IAAID;;CAG/B,MAAME,SAASC,MAAwD;AACnE,MAAI,CAAC,KAAKN,QAAQO,oBACd,OAAM,IAAIb,gBAAgB,oCAAA;EAG9B,MAAMc,YAAY,IAAIX,UAAU,EAAC,CAAA;AACjCW,YAAUC,MAAM,IAAIjB,cAAc,EAAEkB,gBAAgB;GAAC;GAAS;GAAQ;GAAY;GAAW,EAAC,CAAA,CAAA;EAC9F,MAAMC,YAAY,MAAMH,UAAUI,IAAIN,MAAM,EAAEO,OAAO,UAAS,CAAA;AAE9D,QAAM,KAAKX,WAAWY,oBAAoBH,UAAAA;AAE1C,MAAI,KAAKX,QAAQe,0BAA0B;AACvCJ,aAAUK,SAAS;AACnBL,aAAUM,gBAAgBrB,YAAY,GAAA,CAAIsB,SAAS,MAAA;QAEnDP,WAAUK,SAAS;EAGvB,MAAMG,SAAS,KAAKjB,WAAWkB,OAAOT,UAAAA;EAEtC,MAAMU,qBAAqB,IAAIvB,wBAAAA;AAC/BqB,SAAOG,WAAWH,OAAOG,YAAY7B,aAAa,GAAA;AAClD0B,SAAOG,WAAW,MAAMD,mBAAmBE,QAAQJ,OAAOG,SAAQ;AAGlEH,SAAOO,YAAWF,MADE,KAAKrB,gBAAgBsB,QAAQN,OAAOO,UAAU,KAAA,EAC1CC;AAExB,QAAM,KAAKzB,WAAW0B,KAAKT,OAAAA;AAE3B,MAAI,KAAKnB,QAAQe,yBACb,KAAI;AACA,SAAM,KAAKd,WAAW4B,KAAK;IACvBC,IAAIX,OAAOY;IACXC,SAAS;IACTC,MAAM;;yBAEDd,OAAOF,cAAc;;IAE9B,CAAA;UACI;AACJ,SAAM,KAAKf,WAAWgC,OAAOf,OAAAA;AAC7B,SAAM,IAAIzB,gBAAgB,wDAAA;;AAIlC,SAAO,EAAEsB,QAAQG,OAAOH,QAAO;;CAGnC,MAAMmB,SAAS7B,MAAwC;EACnD,MAAMa,SAAS,MAAM,KAAKjB,WAAWkC,UAAU,EAAEnB,eAAeX,KAAK+B,OAAM,CAAA;AAE3E,MAAI,CAAClB,OACD,OAAM,IAAIxB,eAAAA;EAGd,MAAM2C,SAAS,KAAKpC,WAAWqC,MAAMpB,QAAQ;GACzCH,QAAQ;GACRC,eAAe;GACnB,CAAA;AAEA,QAAM,KAAKf,WAAW0B,KAAKU,OAAAA"}

package/dist/core/identity/registration/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/identity/resolver/entities/ldap/module.mjs

@@ -0,0 +1,8 @@
+//#region src/core/identity/resolver/entities/ldap/module.ts
+var LdapIdentityResolver = class {
+	repository;
+};
+//#endregion
+export { LdapIdentityResolver };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/identity/resolver/entities/ldap/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["LdapIdentityResolver","repository"],"sources":["../../../../../../src/core/identity/resolver/entities/ldap/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IIdentityProviderRepository } from '../../../../entities/index.ts';\n\nexport class LdapIdentityResolver {\n    protected repository : IIdentityProviderRepository;\n}\n"],"mappings":";AASA,IAAaA,uBAAb,MAAaA;CACCC"}

package/dist/core/identity/resolver/index.mjs

@@ -0,0 +1,2 @@
+import { IdentityResolver } from "./module.mjs";
+export { IdentityResolver };

package/dist/core/identity/resolver/module.mjs

@@ -0,0 +1,55 @@
+import { IdentityType } from "@authup/core-kit";
+import { isUUID } from "@authup/kit";
+//#region src/core/identity/resolver/module.ts
+var IdentityResolver = class {
+	clientRepository;
+	userRepository;
+	robotRepository;
+	constructor(ctx) {
+		this.clientRepository = ctx.clientRepository;
+		this.userRepository = ctx.userRepository;
+		this.robotRepository = ctx.robotRepository;
+	}
+	async resolve(type, key, realmKey) {
+		switch (type) {
+			case IdentityType.CLIENT: return this.resolveClient(key, realmKey);
+			case IdentityType.ROBOT: return this.resolveRobot(key, realmKey);
+			case IdentityType.USER: return this.resolveUser(key, realmKey);
+		}
+		return null;
+	}
+	async resolveClient(key, realmKey) {
+		let data;
+		if (isUUID(key)) data = await this.clientRepository.findOneById(key);
+		else data = await this.clientRepository.findOneByName(key, realmKey);
+		if (data) return {
+			type: IdentityType.CLIENT,
+			data
+		};
+		return null;
+	}
+	async resolveRobot(key, realmKey) {
+		let data;
+		if (isUUID(key)) data = await this.robotRepository.findOneById(key);
+		else data = await this.robotRepository.findOneByName(key, realmKey);
+		if (data) return {
+			type: IdentityType.ROBOT,
+			data
+		};
+		return null;
+	}
+	async resolveUser(key, realmKey) {
+		let data;
+		if (isUUID(key)) data = await this.userRepository.findOneById(key);
+		else data = await this.userRepository.findOneByName(key, realmKey);
+		if (data) return {
+			type: IdentityType.USER,
+			data
+		};
+		return null;
+	}
+};
+//#endregion
+export { IdentityResolver };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/identity/resolver/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["IdentityType","isUUID","IdentityResolver","clientRepository","userRepository","robotRepository","ctx","resolve","type","key","realmKey","CLIENT","resolveClient","ROBOT","resolveRobot","USER","resolveUser","data","findOneById","findOneByName"],"sources":["../../../../src/core/identity/resolver/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Client, \n    ClientIdentity, \n    Identity, \n    Robot, \n    RobotIdentity, \n    User, \n    UserIdentity,\n} from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { isUUID } from '@authup/kit';\nimport type { IIdentityResolver, IdentityResolverContext } from './types.ts';\nimport type { IClientIdentityRepository, IRobotIdentityRepository, IUserIdentityRepository } from '../entities/index.ts';\n\nexport class IdentityResolver implements IIdentityResolver {\n    protected clientRepository: IClientIdentityRepository;\n\n    protected userRepository: IUserIdentityRepository;\n\n    protected robotRepository: IRobotIdentityRepository;\n\n    constructor(ctx: IdentityResolverContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.userRepository = ctx.userRepository;\n        this.robotRepository = ctx.robotRepository;\n    }\n\n    async resolve(\n        type: `${IdentityType}`,\n        key: string,\n        realmKey?: string,\n    ): Promise<Identity | null> {\n        switch (type) {\n            case IdentityType.CLIENT: {\n                return this.resolveClient(key, realmKey);\n            }\n            case IdentityType.ROBOT: {\n                return this.resolveRobot(key, realmKey);\n            }\n            case IdentityType.USER: {\n                return this.resolveUser(key, realmKey);\n            }\n        }\n\n        return null;\n    }\n\n    private async resolveClient(\n        key: string,\n        realmKey?: string,\n    ) : Promise<ClientIdentity | null> {\n        let data : Client | null;\n\n        if (isUUID(key)) {\n            data = await this.clientRepository.findOneById(key);\n        } else {\n            data = await this.clientRepository.findOneByName(key, realmKey);\n        }\n\n        if (data) {\n            return {\n                type: IdentityType.CLIENT,\n                data, \n            };\n        }\n\n        return null;\n    }\n\n    private async resolveRobot(\n        key: string,\n        realmKey?: string,\n    ) : Promise<RobotIdentity | null> {\n        let data : Robot | null;\n\n        if (isUUID(key)) {\n            data = await this.robotRepository.findOneById(key);\n        } else {\n            data = await this.robotRepository.findOneByName(key, realmKey);\n        }\n\n        if (data) {\n            return {\n                type: IdentityType.ROBOT,\n                data, \n            };\n        }\n\n        return null;\n    }\n\n    private async resolveUser(\n        key: string,\n        realmKey?: string,\n    ) : Promise<UserIdentity | null> {\n        let data : User | null;\n\n        if (isUUID(key)) {\n            data = await this.userRepository.findOneById(key);\n        } else {\n            data = await this.userRepository.findOneByName(key, realmKey);\n        }\n\n        if (data) {\n            return {\n                type: IdentityType.USER,\n                data, \n            };\n        }\n\n        return null;\n    }\n}\n"],"mappings":";;;AAqBA,IAAaE,mBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA8B;AACtC,OAAKH,mBAAmBG,IAAIH;AAC5B,OAAKC,iBAAiBE,IAAIF;AAC1B,OAAKC,kBAAkBC,IAAID;;CAG/B,MAAME,QACFC,MACAC,KACAC,UACwB;AACxB,UAAQF,MAAR;GACI,KAAKR,aAAaW,OACd,QAAO,KAAKC,cAAcH,KAAKC,SAAAA;GAEnC,KAAKV,aAAaa,MACd,QAAO,KAAKC,aAAaL,KAAKC,SAAAA;GAElC,KAAKV,aAAae,KACd,QAAO,KAAKC,YAAYP,KAAKC,SAAAA;;AAIrC,SAAO;;CAGX,MAAcE,cACVH,KACAC,UAC+B;EAC/B,IAAIO;AAEJ,MAAIhB,OAAOQ,IAAAA,CACPQ,QAAO,MAAM,KAAKd,iBAAiBe,YAAYT,IAAAA;MAE/CQ,QAAO,MAAM,KAAKd,iBAAiBgB,cAAcV,KAAKC,SAAAA;AAG1D,MAAIO,KACA,QAAO;GACHT,MAAMR,aAAaW;GACnBM;GACJ;AAGJ,SAAO;;CAGX,MAAcH,aACVL,KACAC,UAC8B;EAC9B,IAAIO;AAEJ,MAAIhB,OAAOQ,IAAAA,CACPQ,QAAO,MAAM,KAAKZ,gBAAgBa,YAAYT,IAAAA;MAE9CQ,QAAO,MAAM,KAAKZ,gBAAgBc,cAAcV,KAAKC,SAAAA;AAGzD,MAAIO,KACA,QAAO;GACHT,MAAMR,aAAaa;GACnBI;GACJ;AAGJ,SAAO;;CAGX,MAAcD,YACVP,KACAC,UAC6B;EAC7B,IAAIO;AAEJ,MAAIhB,OAAOQ,IAAAA,CACPQ,QAAO,MAAM,KAAKb,eAAec,YAAYT,IAAAA;MAE7CQ,QAAO,MAAM,KAAKb,eAAee,cAAcV,KAAKC,SAAAA;AAGxD,MAAIO,KACA,QAAO;GACHT,MAAMR,aAAae;GACnBE;GACJ;AAGJ,SAAO"}

package/dist/core/identity/resolver/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/index.mjs

@@ -0,0 +1,104 @@
+import { ClientCredentialsService } from "./authentication/credential/entities/client/module.mjs";
+import { RobotCredentialsService } from "./authentication/credential/entities/robot/module.mjs";
+import { UserCredentialsService } from "./authentication/credential/entities/user/module.mjs";
+import { BaseCredentialsAuthenticator } from "./authentication/base.mjs";
+import { ClientAuthenticator } from "./authentication/entities/client/module.mjs";
+import { RobotAuthenticator } from "./authentication/entities/robot/module.mjs";
+import { UserAuthenticator } from "./authentication/entities/user/module.mjs";
+import { CredentialsAuthenticator } from "./authentication/module.mjs";
+import { SessionManager } from "./authentication/session/module.mjs";
+import "./authentication/index.mjs";
+import { AbstractEntityService } from "./entities/service.mjs";
+import { ClientService } from "./entities/client/service.mjs";
+import { ClientPermissionService } from "./entities/client-permission/service.mjs";
+import { ClientRoleService } from "./entities/client-role/service.mjs";
+import { ClientScopeService } from "./entities/client-scope/service.mjs";
+import { PermissionService } from "./entities/permission/service.mjs";
+import { PermissionPolicyService } from "./entities/permission-policy/service.mjs";
+import { PolicyService } from "./entities/policy/service.mjs";
+import { RealmService } from "./entities/realm/service.mjs";
+import { RobotService } from "./entities/robot/service.mjs";
+import { RobotPermissionService } from "./entities/robot-permission/service.mjs";
+import { RobotRoleService } from "./entities/robot-role/service.mjs";
+import { RoleService } from "./entities/role/service.mjs";
+import { RoleAttributeService } from "./entities/role-attribute/service.mjs";
+import { RolePermissionService } from "./entities/role-permission/service.mjs";
+import { ScopeService } from "./entities/scope/service.mjs";
+import { UserService } from "./entities/user/service.mjs";
+import { UserAttributeService } from "./entities/user-attribute/service.mjs";
+import { UserPermissionService } from "./entities/user-permission/service.mjs";
+import { UserRoleService } from "./entities/user-role/service.mjs";
+import { IdentityProviderRoleMappingService } from "./entities/identity-provider-role-mapping/service.mjs";
+import "./entities/index.mjs";
+import { OAuth2AuthorizationCodeIssuer } from "./oauth2/authorization/code/issuer/module.mjs";
+import { base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, generateOAuth2CodeVerifier } from "./oauth2/authorization/helpers.mjs";
+import { OAuth2AuthorizationCodeVerifier } from "./oauth2/authorization/code/verifier/module.mjs";
+import { OAuth2AuthorizationCodeRequestVerifier } from "./oauth2/authorization/code-request/verifier/module.mjs";
+import { OAuth2AuthorizationCodeRequestValidator } from "./oauth2/authorization/code-request/validator.mjs";
+import { OAuth2AuthorizationStateManager } from "./oauth2/authorization/state/module.mjs";
+import { OAuth2Authorization } from "./oauth2/authorization/module.mjs";
+import { buildOAuth2BearerTokenResponse } from "./oauth2/response/bearer.mjs";
+import { OAuth2AuthorizeGrant } from "./oauth2/grant-types/authorize.mjs";
+import { ClientCredentialsGrant } from "./oauth2/grant-types/client-credentials.mjs";
+import { IdentityGrantType } from "./oauth2/grant-types/identity.mjs";
+import { PasswordGrantType } from "./oauth2/grant-types/password.mjs";
+import { OAuth2RefreshTokenGrant } from "./oauth2/grant-types/refresh-token.mjs";
+import { RobotCredentialsGrant } from "./oauth2/grant-types/robot-credentials.mjs";
+import { OAuth2OpenIDClaimsBuilder } from "./oauth2/openid/claims.mjs";
+import { OAuth2ScopeAttributesResolver } from "./oauth2/scope/resolver.mjs";
+import { OAuth2AccessTokenIssuer } from "./oauth2/token/issuer/access/module.mjs";
+import { OAuth2OpenIDTokenIssuer } from "./oauth2/token/issuer/open-id/module.mjs";
+import { OAuth2RefreshTokenIssuer } from "./oauth2/token/issuer/refresh/module.mjs";
+import { OAuth2TokenRevoker } from "./oauth2/token/revoker/module.mjs";
+import { OAuth2TokenSigner } from "./oauth2/token/signer/module.mjs";
+import { OAuth2TokenVerifier } from "./oauth2/token/verifier/module.mjs";
+import "./oauth2/index.mjs";
+import { PasswordRecoveryService } from "./identity/password-recovery/service.mjs";
+import { IdentityPermissionProvider } from "./identity/permission/module.mjs";
+import { IdentityProviderMapperOperation } from "./identity/provider/mapper/constants.mjs";
+import { IdentityProviderAccountBaseMapper } from "./identity/provider/mapper/base.mjs";
+import { IdentityProviderAttributeMapper } from "./identity/provider/mapper/attributes/module.mjs";
+import { IdentityProviderRoleMapper } from "./identity/provider/mapper/role/module.mjs";
+import { IdentityProviderPermissionMapper } from "./identity/provider/mapper/permission/module.mjs";
+import { IdentityProviderAccountManager } from "./identity/provider/account/module.mjs";
+import { IdentityProviderLdapAuthenticator } from "./identity/provider/authentication/protocols/ldap/module.mjs";
+import { IdentityProviderLdapCollectionAuthenticator } from "./identity/provider/authentication/protocols/ldap/collection.mjs";
+import { IdentityProviderOAuth2Authenticator } from "./identity/provider/authentication/protocols/oauth2/module.mjs";
+import { IdentityProviderOpenIDAuthenticator } from "./identity/provider/authentication/protocols/open-id/module.mjs";
+import { IdentityProviderFacebookAuthenticator } from "./identity/provider/authentication/presets/facebook.mjs";
+import { IdentityProviderGithubAuthenticator } from "./identity/provider/authentication/presets/github.mjs";
+import { IdentityProviderGoogleAuthenticator } from "./identity/provider/authentication/presets/google.mjs";
+import { IdentityProviderInstagramAuthenticator } from "./identity/provider/authentication/presets/instagram.mjs";
+import { IdentityProviderPaypalAuthenticator } from "./identity/provider/authentication/presets/paypal.mjs";
+import { IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN } from "./identity/provider/authentication/constants.mjs";
+import { createIdentityProviderOAuth2Authenticator } from "./identity/provider/authentication/factory.mjs";
+import { RegistrationService } from "./identity/registration/service.mjs";
+import { IdentityResolver } from "./identity/resolver/module.mjs";
+import "./identity/index.mjs";
+import { ProvisioningEntityStrategyType } from "./provisioning/strategy/constants.mjs";
+import { normalizeEntityProvisioningStrategy } from "./provisioning/strategy/normalize.mjs";
+import { ProvisioningStrategyValidator } from "./provisioning/strategy/validator.mjs";
+import { PermissionProvisioningValidator } from "./provisioning/entities/permission/validator.mjs";
+import { RoleProvisioningValidator } from "./provisioning/entities/role/validator.mjs";
+import { ClientProvisioningValidator } from "./provisioning/entities/client/validator.mjs";
+import { RobotProvisioningValidator } from "./provisioning/entities/robot/validator.mjs";
+import { ScopeProvisioningValidator } from "./provisioning/entities/scope/validator.mjs";
+import { UserProvisioningValidator } from "./provisioning/entities/user/validator.mjs";
+import { RealmProvisioningValidator } from "./provisioning/entities/realm/validator.mjs";
+import { RootProvisioningValidator } from "./provisioning/entities/root/validator.mjs";
+import { ProvisioningEntityResolver } from "./provisioning/synchronizer/entity-resolver.mjs";
+import { ProvisioningJunctionSynchronizer } from "./provisioning/synchronizer/junction-synchronizer.mjs";
+import { ClientProvisioningSynchronizer } from "./provisioning/synchronizer/client/module.mjs";
+import { PermissionProvisioningSynchronizer } from "./provisioning/synchronizer/permission/module.mjs";
+import { PolicyProvisioningSynchronizer } from "./provisioning/synchronizer/policy/module.mjs";
+import { RealmProvisioningSynchronizer } from "./provisioning/synchronizer/realm/module.mjs";
+import { RoleProvisioningSynchronizer } from "./provisioning/synchronizer/role/module.mjs";
+import { GraphProvisioningSynchronizer } from "./provisioning/synchronizer/root/module.mjs";
+import { RobotProvisioningSynchronizer } from "./provisioning/synchronizer/robot/module.mjs";
+import { ScopeProvisioningSynchronizer } from "./provisioning/synchronizer/scope/module.mjs";
+import { UserProvisioningSynchronizer } from "./provisioning/synchronizer/user/module.mjs";
+import "./provisioning/index.mjs";
+import { PermissionBindingPolicyEvaluator } from "./security/policy/evaluator.mjs";
+import { PolicyEngine } from "./security/policy/engine.mjs";
+import "./security/index.mjs";
+export { AbstractEntityService, BaseCredentialsAuthenticator, ClientAuthenticator, ClientCredentialsGrant, ClientCredentialsService, ClientPermissionService, ClientProvisioningSynchronizer, ClientProvisioningValidator, ClientRoleService, ClientScopeService, ClientService, CredentialsAuthenticator, GraphProvisioningSynchronizer, IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityGrantType, IdentityPermissionProvider, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityProviderRoleMappingService, IdentityResolver, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PasswordGrantType, PasswordRecoveryService, PermissionBindingPolicyEvaluator, PermissionPolicyService, PermissionProvisioningSynchronizer, PermissionProvisioningValidator, PermissionService, PolicyEngine, PolicyProvisioningSynchronizer, PolicyService, ProvisioningEntityResolver, ProvisioningEntityStrategyType, ProvisioningJunctionSynchronizer, ProvisioningStrategyValidator, RealmProvisioningSynchronizer, RealmProvisioningValidator, RealmService, RegistrationService, RobotAuthenticator, RobotCredentialsGrant, RobotCredentialsService, RobotPermissionService, RobotProvisioningSynchronizer, RobotProvisioningValidator, RobotRoleService, RobotService, RoleAttributeService, RolePermissionService, RoleProvisioningSynchronizer, RoleProvisioningValidator, RoleService, RootProvisioningValidator, ScopeProvisioningSynchronizer, ScopeProvisioningValidator, ScopeService, SessionManager, UserAttributeService, UserAuthenticator, UserCredentialsService, UserPermissionService, UserProvisioningSynchronizer, UserProvisioningValidator, UserRoleService, UserService, base64URLEncode, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, createIdentityProviderOAuth2Authenticator, generateOAuth2CodeVerifier, normalizeEntityProvisioningStrategy };

package/dist/core/ldap/index.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/ldap/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/mail/index.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/mail/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/authorization/code/index.mjs

@@ -0,0 +1,4 @@
+import { OAuth2AuthorizationCodeIssuer } from "./issuer/module.mjs";
+import { OAuth2AuthorizationCodeVerifier } from "./verifier/module.mjs";
+import "./verifier/index.mjs";
+export { OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeVerifier };

package/dist/core/oauth2/authorization/code/issuer/index.mjs

@@ -0,0 +1,2 @@
+import { OAuth2AuthorizationCodeIssuer } from "./module.mjs";
+export { OAuth2AuthorizationCodeIssuer };

package/dist/core/oauth2/authorization/code/issuer/module.mjs

@@ -0,0 +1,33 @@
+//#region src/core/oauth2/authorization/code/issuer/module.ts
+var OAuth2AuthorizationCodeIssuer = class {
+	repository;
+	options;
+	constructor(repository, options = {}) {
+		this.repository = repository;
+		this.options = options;
+	}
+	async issue(input, identity, options = {}) {
+		const entity = {
+			redirect_uri: input.redirect_uri,
+			client_id: input.client_id,
+			scope: input.scope,
+			nonce: input.nonce,
+			code_challenge: input.code_challenge,
+			code_challenge_method: input.code_challenge_method,
+			realm_id: identity.data.realm.id,
+			realm_name: identity.data.realm.name,
+			sub: identity.data.id,
+			sub_kind: identity.type
+		};
+		if (options.idToken) entity.id_token = options.idToken;
+		return this.repository.save(entity, { maxAge: options.maxAge ?? this.options.maxAge });
+	}
+	async updateIdToken(entity, idToken) {
+		entity.id_token = idToken;
+		await this.repository.save(entity, { maxAge: this.options.maxAge });
+	}
+};
+//#endregion
+export { OAuth2AuthorizationCodeIssuer };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/authorization/code/issuer/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["OAuth2AuthorizationCodeIssuer","repository","options","issue","input","identity","entity","redirect_uri","client_id","scope","nonce","code_challenge","code_challenge_method","realm_id","data","realm","id","realm_name","name","sub","sub_kind","type","idToken","id_token","save","maxAge","updateIdToken"],"sources":["../../../../../../src/core/oauth2/authorization/code/issuer/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Identity, OAuth2AuthorizationCode, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport type { IOAuth2AuthorizationCodeRepository, OAuth2AuthorizationCodeInput } from '../repository/index.ts';\nimport type { IOAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeIssuerOptions } from './types.ts';\n\nexport class OAuth2AuthorizationCodeIssuer implements IOAuth2AuthorizationCodeIssuer {\n    protected repository: IOAuth2AuthorizationCodeRepository;\n\n    protected options: OAuth2AuthorizationCodeIssuerOptions;\n\n    constructor(\n        repository: IOAuth2AuthorizationCodeRepository,\n        options: OAuth2AuthorizationCodeIssuerOptions = {},\n    ) {\n        this.repository = repository;\n        this.options = options;\n    }\n\n    async issue(\n        input: OAuth2AuthorizationCodeRequest,\n        identity: Identity,\n        options: OAuth2AuthorizationCodeIssuerOptions = {},\n    ) : Promise<OAuth2AuthorizationCode> {\n        const entity: OAuth2AuthorizationCodeInput = {\n            redirect_uri: input.redirect_uri,\n            client_id: input.client_id,\n            scope: input.scope,\n            nonce: input.nonce,\n            code_challenge: input.code_challenge,\n            code_challenge_method: input.code_challenge_method,\n\n            realm_id: identity.data.realm.id,\n            realm_name: identity.data.realm.name,\n            sub: identity.data.id,\n            sub_kind: identity.type,\n        };\n\n        if (options.idToken) {\n            entity.id_token = options.idToken;\n        }\n\n        return this.repository.save(entity, { maxAge: options.maxAge ?? this.options.maxAge });\n    }\n\n    async updateIdToken(\n        entity: OAuth2AuthorizationCode,\n        idToken: string,\n    ) : Promise<void> {\n        entity.id_token = idToken;\n\n        await this.repository.save(entity, { maxAge: this.options.maxAge });\n    }\n}\n"],"mappings":";AAWA,IAAaA,gCAAb,MAAaA;CACCC;CAEAC;CAEV,YACID,YACAC,UAAgD,EAAE,EACpD;AACE,OAAKD,aAAaA;AAClB,OAAKC,UAAUA;;CAGnB,MAAMC,MACFC,OACAC,UACAH,UAAgD,EAAE,EACjB;EACjC,MAAMI,SAAuC;GACzCC,cAAcH,MAAMG;GACpBC,WAAWJ,MAAMI;GACjBC,OAAOL,MAAMK;GACbC,OAAON,MAAMM;GACbC,gBAAgBP,MAAMO;GACtBC,uBAAuBR,MAAMQ;GAE7BC,UAAUR,SAASS,KAAKC,MAAMC;GAC9BC,YAAYZ,SAASS,KAAKC,MAAMG;GAChCC,KAAKd,SAASS,KAAKE;GACnBI,UAAUf,SAASgB;GACvB;AAEA,MAAInB,QAAQoB,QACRhB,QAAOiB,WAAWrB,QAAQoB;AAG9B,SAAO,KAAKrB,WAAWuB,KAAKlB,QAAQ,EAAEmB,QAAQvB,QAAQuB,UAAU,KAAKvB,QAAQuB,QAAO,CAAA;;CAGxF,MAAMC,cACFpB,QACAgB,SACc;AACdhB,SAAOiB,WAAWD;AAElB,QAAM,KAAKrB,WAAWuB,KAAKlB,QAAQ,EAAEmB,QAAQ,KAAKvB,QAAQuB,QAAO,CAAA"}

package/dist/core/oauth2/authorization/code/issuer/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/authorization/code/repository/index.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/authorization/code/repository/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/authorization/code/verifier/index.mjs

@@ -0,0 +1,2 @@
+import { OAuth2AuthorizationCodeVerifier } from "./module.mjs";
+export { OAuth2AuthorizationCodeVerifier };

package/dist/core/oauth2/authorization/code/verifier/module.mjs

@@ -0,0 +1,27 @@
+import { buildOAuth2CodeChallenge } from "../../helpers.mjs";
+import { OAuth2AuthorizationCodeChallengeMethod, OAuth2Error } from "@authup/specs";
+//#region src/core/oauth2/authorization/code/verifier/module.ts
+var OAuth2AuthorizationCodeVerifier = class {
+	repository;
+	constructor(repository) {
+		this.repository = repository;
+	}
+	async verify(code, options) {
+		const entity = await this.repository.popOneById(code);
+		if (!entity) throw OAuth2Error.grantInvalid();
+		if (entity.redirect_uri) {
+			if (!options.redirectUri || entity.redirect_uri !== options.redirectUri) throw OAuth2Error.redirectUriMismatch();
+		}
+		if (entity.code_challenge) if (entity.code_challenge_method === OAuth2AuthorizationCodeChallengeMethod.PLAIN) {
+			if (options.codeVerifier !== entity.code_challenge) throw OAuth2Error.grantInvalid("PKCE code_verifier mismatch.");
+		} else {
+			if (!options.codeVerifier) throw OAuth2Error.grantInvalid("Code verifier invalid.");
+			if (await buildOAuth2CodeChallenge(options.codeVerifier) !== entity.code_challenge) throw OAuth2Error.grantInvalid("PKCE code_verifier mismatch.");
+		}
+		return entity;
+	}
+};
+//#endregion
+export { OAuth2AuthorizationCodeVerifier };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/authorization/code/verifier/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["OAuth2AuthorizationCodeChallengeMethod","OAuth2Error","buildOAuth2CodeChallenge","OAuth2AuthorizationCodeVerifier","repository","verify","code","options","entity","popOneById","grantInvalid","redirect_uri","redirectUri","redirectUriMismatch","code_challenge","code_challenge_method","PLAIN","codeVerifier","codeVerifierHash"],"sources":["../../../../../../src/core/oauth2/authorization/code/verifier/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2AuthorizationCode } from '@authup/core-kit';\nimport { OAuth2AuthorizationCodeChallengeMethod, OAuth2Error } from '@authup/specs';\nimport { buildOAuth2CodeChallenge } from '../../helpers.ts';\n\nimport type { IOAuth2AuthorizationCodeRepository } from '../repository/index.ts';\nimport type { IOAuth2AuthorizationCodeVerifier, IOAuth2AuthorizationCodeVerifyOptions } from './types.ts';\n\nexport class OAuth2AuthorizationCodeVerifier implements IOAuth2AuthorizationCodeVerifier {\n    protected repository : IOAuth2AuthorizationCodeRepository;\n\n    constructor(repository: IOAuth2AuthorizationCodeRepository) {\n        this.repository = repository;\n    }\n\n    async verify(code: string, options: IOAuth2AuthorizationCodeVerifyOptions) : Promise<OAuth2AuthorizationCode> {\n        const entity = await this.repository.popOneById(code);\n        if (!entity) {\n            throw OAuth2Error.grantInvalid();\n        }\n\n        if (entity.redirect_uri) {\n            if (!options.redirectUri || entity.redirect_uri !== options.redirectUri) {\n                throw OAuth2Error.redirectUriMismatch();\n            }\n        }\n\n        if (entity.code_challenge) {\n            if (entity.code_challenge_method === OAuth2AuthorizationCodeChallengeMethod.PLAIN) {\n                if (options.codeVerifier !== entity.code_challenge) {\n                    throw OAuth2Error.grantInvalid('PKCE code_verifier mismatch.');\n                }\n            } else {\n                if (!options.codeVerifier) {\n                    throw OAuth2Error.grantInvalid('Code verifier invalid.');\n                }\n\n                const codeVerifierHash = await buildOAuth2CodeChallenge(options.codeVerifier);\n                if (codeVerifierHash !== entity.code_challenge) {\n                    throw OAuth2Error.grantInvalid('PKCE code_verifier mismatch.');\n                }\n            }\n        }\n\n        return entity;\n    }\n}\n"],"mappings":";;;AAcA,IAAaG,kCAAb,MAAaA;CACCC;CAEV,YAAYA,YAAgD;AACxD,OAAKA,aAAaA;;CAGtB,MAAMC,OAAOC,MAAcC,SAAmF;EAC1G,MAAMC,SAAS,MAAM,KAAKJ,WAAWK,WAAWH,KAAAA;AAChD,MAAI,CAACE,OACD,OAAMP,YAAYS,cAAY;AAGlC,MAAIF,OAAOG;OACH,CAACJ,QAAQK,eAAeJ,OAAOG,iBAAiBJ,QAAQK,YACxD,OAAMX,YAAYY,qBAAmB;;AAI7C,MAAIL,OAAOM,eACP,KAAIN,OAAOO,0BAA0Bf,uCAAuCgB;OACpET,QAAQU,iBAAiBT,OAAOM,eAChC,OAAMb,YAAYS,aAAa,+BAAA;SAEhC;AACH,OAAI,CAACH,QAAQU,aACT,OAAMhB,YAAYS,aAAa,yBAAA;AAInC,OAAIQ,MAD2BhB,yBAAyBK,QAAQU,aAAY,KACnDT,OAAOM,eAC5B,OAAMb,YAAYS,aAAa,+BAAA;;AAK3C,SAAOF"}

package/dist/core/oauth2/authorization/code/verifier/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/authorization/code-request/index.mjs

@@ -0,0 +1,4 @@
+import { OAuth2AuthorizationCodeRequestVerifier } from "./verifier/module.mjs";
+import "./verifier/index.mjs";
+import { OAuth2AuthorizationCodeRequestValidator } from "./validator.mjs";
+export { OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier };

package/dist/core/oauth2/authorization/code-request/validator.mjs

@@ -0,0 +1,35 @@
+import { OAuth2AuthorizationCodeChallengeMethod, OAuth2AuthorizationResponseType, OAuth2Error } from "@authup/specs";
+import { Container } from "validup";
+import { createValidator } from "@validup/adapter-zod";
+import { z } from "zod";
+//#region src/core/oauth2/authorization/code-request/validator.ts
+var OAuth2AuthorizationCodeRequestValidator = class extends Container {
+	initialize() {
+		super.initialize();
+		this.mount("response_type", createValidator(z.string().nonempty().check((ctx) => {
+			const availableResponseTypes = Object.values(OAuth2AuthorizationResponseType);
+			const responseTypes = ctx.value.split(" ");
+			for (const responseType of responseTypes) if (!availableResponseTypes.includes(responseType)) {
+				const error = OAuth2Error.responseTypeUnsupported();
+				ctx.issues.push({
+					input: responseType,
+					code: "custom",
+					message: error.message
+				});
+			}
+			return z.NEVER;
+		})));
+		this.mount("redirect_uri", createValidator(z.string().url()));
+		this.mount("scope", createValidator(z.string().min(3).max(512)));
+		this.mount("state", { optional: true }, createValidator(z.string().min(5).max(2048).nullable()));
+		this.mount("code_challenge", { optional: true }, createValidator(z.string().min(1).max(256).nullable()));
+		this.mount("code_challenge_method", { optional: true }, createValidator(z.enum(OAuth2AuthorizationCodeChallengeMethod).nullable()));
+		this.mount("nonce", { optional: true }, createValidator(z.string().min(1).max(512).nullable()));
+		this.mount("realm_id", { optional: true }, createValidator(z.string().nonempty()));
+		this.mount("client_id", createValidator(z.string().nonempty()));
+	}
+};
+//#endregion
+export { OAuth2AuthorizationCodeRequestValidator };
+
+//# sourceMappingURL=validator.mjs.map

package/dist/core/oauth2/authorization/code-request/validator.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"validator.mjs","names":["OAuth2AuthorizationCodeChallengeMethod","OAuth2AuthorizationResponseType","OAuth2Error","createValidator","Container","z","OAuth2AuthorizationCodeRequestValidator","initialize","mount","string","nonempty","check","ctx","availableResponseTypes","Object","values","responseTypes","value","split","responseType","includes","error","responseTypeUnsupported","issues","push","input","code","message","NEVER","url","min","max","optional","nullable","enum"],"sources":["../../../../../src/core/oauth2/authorization/code-request/validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport {\n    OAuth2AuthorizationCodeChallengeMethod,\n    OAuth2AuthorizationResponseType,\n    OAuth2Error,\n} from '@authup/specs';\n\nimport { createValidator } from '@validup/adapter-zod';\nimport { Container } from 'validup';\nimport { z } from 'zod';\n\nexport class OAuth2AuthorizationCodeRequestValidator extends Container<OAuth2AuthorizationCodeRequest> {\n    protected initialize() {\n        super.initialize();\n\n        this.mount(\n            'response_type',\n            createValidator(\n                z\n                    .string()\n                    .nonempty()\n                    .check((ctx) => {\n                        const availableResponseTypes = Object.values(OAuth2AuthorizationResponseType);\n                        const responseTypes = ctx.value.split(' ') as OAuth2AuthorizationResponseType[];\n\n                        for (const responseType of responseTypes) {\n                            if (!availableResponseTypes.includes(responseType)) {\n                                const error = OAuth2Error.responseTypeUnsupported();\n                                ctx.issues.push({\n                                    input: responseType,\n                                    code: 'custom',\n                                    message: error.message,\n                                });\n                            }\n                        }\n\n                        return z.NEVER;\n                    }),\n            ),\n        );\n\n        this.mount(\n            'redirect_uri',\n            createValidator(z.string().url()),\n        );\n\n        this.mount(\n            'scope',\n            createValidator(z.string().min(3).max(512)),\n        );\n\n        this.mount(\n            'state',\n            { optional: true },\n            createValidator(z.string().min(5).max(2048).nullable()),\n        );\n\n        this.mount(\n            'code_challenge',\n            { optional: true },\n            createValidator(z.string().min(1).max(256).nullable()),\n        );\n\n        this.mount(\n            'code_challenge_method',\n            { optional: true },\n            createValidator(z.enum(OAuth2AuthorizationCodeChallengeMethod).nullable()),\n        );\n\n        this.mount(\n            'nonce',\n            { optional: true },\n            createValidator(z.string().min(1).max(512).nullable()),\n        );\n\n        this.mount(\n            'realm_id',\n            { optional: true },\n            createValidator(z.string().nonempty()),\n        );\n\n        this.mount(\n            'client_id',\n            createValidator(z.string().nonempty()),\n        );\n    }\n}\n"],"mappings":";;;;;AAkBA,IAAaM,0CAAb,cAA6DF,UAAAA;CAC/CG,aAAa;AACnB,QAAMA,YAAAA;AAEN,OAAKC,MACD,iBACAL,gBACIE,EACKI,QAAM,CACNC,UAAQ,CACRC,OAAOC,QAAAA;GACJ,MAAMC,yBAAyBC,OAAOC,OAAOd,gCAAAA;GAC7C,MAAMe,gBAAgBJ,IAAIK,MAAMC,MAAM,IAAA;AAEtC,QAAK,MAAMC,gBAAgBH,cACvB,KAAI,CAACH,uBAAuBO,SAASD,aAAAA,EAAe;IAChD,MAAME,QAAQnB,YAAYoB,yBAAuB;AACjDV,QAAIW,OAAOC,KAAK;KACZC,OAAON;KACPO,MAAM;KACNC,SAASN,MAAMM;KACnB,CAAA;;AAIR,UAAOtB,EAAEuB;IACb,CAAA,CAAA;AAIZ,OAAKpB,MACD,gBACAL,gBAAgBE,EAAEI,QAAM,CAAGoB,KAAG,CAAA,CAAA;AAGlC,OAAKrB,MACD,SACAL,gBAAgBE,EAAEI,QAAM,CAAGqB,IAAI,EAAA,CAAGC,IAAI,IAAA,CAAA,CAAA;AAG1C,OAAKvB,MACD,SACA,EAAEwB,UAAU,MAAK,EACjB7B,gBAAgBE,EAAEI,QAAM,CAAGqB,IAAI,EAAA,CAAGC,IAAI,KAAA,CAAME,UAAQ,CAAA,CAAA;AAGxD,OAAKzB,MACD,kBACA,EAAEwB,UAAU,MAAK,EACjB7B,gBAAgBE,EAAEI,QAAM,CAAGqB,IAAI,EAAA,CAAGC,IAAI,IAAA,CAAKE,UAAQ,CAAA,CAAA;AAGvD,OAAKzB,MACD,yBACA,EAAEwB,UAAU,MAAK,EACjB7B,gBAAgBE,EAAE6B,KAAKlC,uCAAAA,CAAwCiC,UAAQ,CAAA,CAAA;AAG3E,OAAKzB,MACD,SACA,EAAEwB,UAAU,MAAK,EACjB7B,gBAAgBE,EAAEI,QAAM,CAAGqB,IAAI,EAAA,CAAGC,IAAI,IAAA,CAAKE,UAAQ,CAAA,CAAA;AAGvD,OAAKzB,MACD,YACA,EAAEwB,UAAU,MAAK,EACjB7B,gBAAgBE,EAAEI,QAAM,CAAGC,UAAQ,CAAA,CAAA;AAGvC,OAAKF,MACD,aACAL,gBAAgBE,EAAEI,QAAM,CAAGC,UAAQ,CAAA,CAAA"}

package/dist/core/oauth2/authorization/code-request/verifier/index.mjs

@@ -0,0 +1,2 @@
+import { OAuth2AuthorizationCodeRequestVerifier } from "./module.mjs";
+export { OAuth2AuthorizationCodeRequestVerifier };

package/dist/core/oauth2/authorization/code-request/verifier/module.mjs

@@ -0,0 +1,41 @@
+import { ScopeName } from "@authup/core-kit";
+import { isSimpleMatch } from "@authup/kit";
+import { OAuth2Error, hasOAuth2Scopes } from "@authup/specs";
+//#region src/core/oauth2/authorization/code-request/verifier/module.ts
+var OAuth2AuthorizationCodeRequestVerifier = class {
+	clientRepository;
+	scopeRepository;
+	constructor(ctx) {
+		this.clientRepository = ctx.clientRepository;
+		this.scopeRepository = ctx.scopeRepository;
+	}
+	/**
+	* Verify validated authorization code request.
+	* @param data
+	*/ async verify(data) {
+		if (!data.client_id) throw OAuth2Error.clientInvalid();
+		const client = await this.clientRepository.findOneByIdOrName(data.client_id, data.realm_id);
+		if (!client) throw OAuth2Error.clientInvalid();
+		if (!client.active) throw OAuth2Error.clientInactive();
+		data.client_id = client.id;
+		data.realm_id = client.realm_id;
+		const scopes = await this.scopeRepository.findByClientId(client.id);
+		const scopeNames = scopes.map((scope) => scope.name);
+		if (data.scope) {
+			if (!hasOAuth2Scopes(scopeNames, data.scope) && !hasOAuth2Scopes(data.scope, ScopeName.GLOBAL)) throw OAuth2Error.scopeInsufficient();
+		} else data.scope = scopeNames.join(" ");
+		if (client.redirect_uri && data.redirect_uri) {
+			const redirectUris = client.redirect_uri.split(",");
+			if (!isSimpleMatch(data.redirect_uri, redirectUris)) throw OAuth2Error.redirectUriMismatch();
+		}
+		return {
+			data,
+			client,
+			scopes
+		};
+	}
+};
+//#endregion
+export { OAuth2AuthorizationCodeRequestVerifier };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/authorization/code-request/verifier/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["ScopeName","isSimpleMatch","OAuth2Error","hasOAuth2Scopes","OAuth2AuthorizationCodeRequestVerifier","clientRepository","scopeRepository","ctx","verify","data","client_id","clientInvalid","client","findOneByIdOrName","realm_id","active","clientInactive","id","scopes","findByClientId","scopeNames","map","scope","name","GLOBAL","scopeInsufficient","join","redirect_uri","redirectUris","split","redirectUriMismatch"],"sources":["../../../../../../src/core/oauth2/authorization/code-request/verifier/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport { isSimpleMatch } from '@authup/kit';\nimport { OAuth2Error, hasOAuth2Scopes } from '@authup/specs';\nimport type { IOAuth2ClientRepository } from '../../../client/index.ts';\nimport type { IOAuth2ScopeRepository } from '../../../scope/index.ts';\nimport type {\n    IOAuth2AuthorizationCodeRequestVerifier,\n    OAuth2AuthorizationCodeRequestVerificationResult,\n    OAuth2AuthorizationCodeRequestVerifierContext,\n} from './types.ts';\n\nexport class OAuth2AuthorizationCodeRequestVerifier implements IOAuth2AuthorizationCodeRequestVerifier {\n    protected clientRepository: IOAuth2ClientRepository;\n\n    protected scopeRepository: IOAuth2ScopeRepository;\n\n    constructor(ctx: OAuth2AuthorizationCodeRequestVerifierContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.scopeRepository = ctx.scopeRepository;\n    }\n\n    /**\n     * Verify validated authorization code request.\n     * @param data\n     */\n    async verify(\n        data: OAuth2AuthorizationCodeRequest,\n    ) : Promise<OAuth2AuthorizationCodeRequestVerificationResult> {\n        if (!data.client_id) {\n            throw OAuth2Error.clientInvalid();\n        }\n\n        const client = await this.clientRepository.findOneByIdOrName(data.client_id, data.realm_id);\n        if (!client) {\n            throw OAuth2Error.clientInvalid();\n        }\n\n        if (!client.active) {\n            throw OAuth2Error.clientInactive();\n        }\n\n        data.client_id = client.id;\n        data.realm_id = client.realm_id;\n\n        const scopes = await this.scopeRepository.findByClientId(client.id);\n        const scopeNames = scopes.map((scope) => scope.name);\n        if (data.scope) {\n            if (\n                !hasOAuth2Scopes(scopeNames, data.scope) &&\n                !hasOAuth2Scopes(data.scope, ScopeName.GLOBAL)\n            ) {\n                throw OAuth2Error.scopeInsufficient();\n            }\n        } else {\n            data.scope = scopeNames.join(' ');\n        }\n\n        if (client.redirect_uri && data.redirect_uri) {\n            const redirectUris = client.redirect_uri.split(',');\n\n            if (!isSimpleMatch(data.redirect_uri, redirectUris)) {\n                throw OAuth2Error.redirectUriMismatch();\n            }\n        }\n\n        return {\n            data,\n            client,\n            scopes,\n        };\n    }\n}\n"],"mappings":";;;;AAmBA,IAAaI,yCAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAoD;AAC5D,OAAKF,mBAAmBE,IAAIF;AAC5B,OAAKC,kBAAkBC,IAAID;;;;;IAO/B,MAAME,OACFC,MAC0D;AAC1D,MAAI,CAACA,KAAKC,UACN,OAAMR,YAAYS,eAAa;EAGnC,MAAMC,SAAS,MAAM,KAAKP,iBAAiBQ,kBAAkBJ,KAAKC,WAAWD,KAAKK,SAAQ;AAC1F,MAAI,CAACF,OACD,OAAMV,YAAYS,eAAa;AAGnC,MAAI,CAACC,OAAOG,OACR,OAAMb,YAAYc,gBAAc;AAGpCP,OAAKC,YAAYE,OAAOK;AACxBR,OAAKK,WAAWF,OAAOE;EAEvB,MAAMI,SAAS,MAAM,KAAKZ,gBAAgBa,eAAeP,OAAOK,GAAE;EAClE,MAAMG,aAAaF,OAAOG,KAAKC,UAAUA,MAAMC,KAAI;AACnD,MAAId,KAAKa;OAED,CAACnB,gBAAgBiB,YAAYX,KAAKa,MAAK,IACvC,CAACnB,gBAAgBM,KAAKa,OAAOtB,UAAUwB,OAAM,CAE7C,OAAMtB,YAAYuB,mBAAiB;QAGvChB,MAAKa,QAAQF,WAAWM,KAAK,IAAA;AAGjC,MAAId,OAAOe,gBAAgBlB,KAAKkB,cAAc;GAC1C,MAAMC,eAAehB,OAAOe,aAAaE,MAAM,IAAA;AAE/C,OAAI,CAAC5B,cAAcQ,KAAKkB,cAAcC,aAAAA,CAClC,OAAM1B,YAAY4B,qBAAmB;;AAI7C,SAAO;GACHrB;GACAG;GACAM;GACJ"}

package/dist/core/oauth2/authorization/code-request/verifier/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/authorization/helpers.mjs

@@ -0,0 +1,27 @@
+import { subtle } from "uncrypto";
+//#region src/core/oauth2/authorization/helpers.ts
+function generateOAuth2CodeVerifier() {
+	const length = 64;
+	const charset = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
+	let codeVerifier = "";
+	const randomValues = new Uint8Array(length);
+	crypto.getRandomValues(randomValues);
+	for (let i = 0; i < length; i++) codeVerifier += charset[randomValues[i] % 66];
+	return codeVerifier;
+}
+function base64URLEncode(arrayBuffer) {
+	const charCode = Array.from(new Uint8Array(arrayBuffer));
+	return btoa(String.fromCharCode.apply(null, charCode)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function buildOAuth2TokenHash(value) {
+	const data = new TextEncoder().encode(value);
+	return base64URLEncode((await subtle.digest("SHA-256", data)).slice(0, 16));
+}
+async function buildOAuth2CodeChallenge(codeVerifier) {
+	const data = new TextEncoder().encode(codeVerifier);
+	return base64URLEncode(await subtle.digest("SHA-256", data));
+}
+//#endregion
+export { base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, generateOAuth2CodeVerifier };
+
+//# sourceMappingURL=helpers.mjs.map

package/dist/core/oauth2/authorization/helpers.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.mjs","names":["subtle","generateOAuth2CodeVerifier","length","charset","codeVerifier","randomValues","Uint8Array","crypto","getRandomValues","i","base64URLEncode","arrayBuffer","charCode","Array","from","btoa","String","fromCharCode","apply","replace","buildOAuth2TokenHash","value","encoder","TextEncoder","data","encode","hashBuffer","digest","halfHash","slice","buildOAuth2CodeChallenge"],"sources":["../../../../src/core/oauth2/authorization/helpers.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { subtle } from 'uncrypto';\n\nexport function generateOAuth2CodeVerifier() {\n    const length = 64;\n    const charset = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';\n\n    let codeVerifier = '';\n    const randomValues = new Uint8Array(length);\n    crypto.getRandomValues(randomValues);\n\n    for (let i = 0; i < length; i++) {\n        codeVerifier += charset[randomValues[i] % charset.length];\n    }\n\n    return codeVerifier;\n}\n\nexport function base64URLEncode(arrayBuffer: ArrayBuffer) {\n    // Convert the ArrayBuffer to string using Uint8 array.\n    // btoa takes chars from 0-255 and base64 encodes.\n    // Then convert the base64 encoded to base64url encoded.\n    // (replace + with -, replace / with _, trim trailing =)\n    const charCode = Array.from(new Uint8Array(arrayBuffer));\n\n    return btoa(String.fromCharCode.apply(null, charCode))\n        .replace(/\\+/g, '-')\n        .replace(/\\//g, '_')\n        .replace(/=+$/, '');\n}\n\nexport async function buildOAuth2TokenHash(value: string) : Promise<string> {\n    const encoder = new TextEncoder();\n    const data = encoder.encode(value);\n    const hashBuffer = await subtle.digest('SHA-256', data);\n    const halfHash = hashBuffer.slice(0, 16);\n\n    return base64URLEncode(halfHash);\n}\n\nexport async function buildOAuth2CodeChallenge(codeVerifier: string) {\n    const encoder = new TextEncoder();\n    const data = encoder.encode(codeVerifier);\n    const arrayBuffer = await subtle.digest('SHA-256', data);\n\n    return base64URLEncode(arrayBuffer);\n}\n"],"mappings":";;AASA,SAAgBC,6BAAAA;CACZ,MAAMC,SAAS;CACf,MAAMC,UAAU;CAEhB,IAAIC,eAAe;CACnB,MAAMC,eAAe,IAAIC,WAAWJ,OAAAA;AACpCK,QAAOC,gBAAgBH,aAAAA;AAEvB,MAAK,IAAII,IAAI,GAAGA,IAAIP,QAAQO,IACxBL,iBAAgBD,QAAQE,aAAaI,KAAKN;AAG9C,QAAOC;;AAGX,SAAgBM,gBAAgBC,aAAwB;CAKpD,MAAMC,WAAWC,MAAMC,KAAK,IAAIR,WAAWK,YAAAA,CAAAA;AAE3C,QAAOI,KAAKC,OAAOC,aAAaC,MAAM,MAAMN,SAAAA,CAAAA,CACvCO,QAAQ,OAAO,IAAA,CACfA,QAAQ,OAAO,IAAA,CACfA,QAAQ,OAAO,GAAA;;AAGxB,eAAsBC,qBAAqBC,OAAa;CAEpD,MAAMG,OAAOF,IADOC,aACPD,CAAQG,OAAOJ,MAAAA;AAI5B,QAAOX,iBAFUgB,MADQ1B,OAAO2B,OAAO,WAAWH,KAAAA,EACtBK,MAAM,GAAG,GAEdD,CAAAA;;AAG3B,eAAsBE,yBAAyB1B,cAAoB;CAE/D,MAAMoB,OAAOF,IADOC,aACPD,CAAQG,OAAOrB,aAAAA;AAG5B,QAAOM,gBAAgBC,MAFGX,OAAO2B,OAAO,WAAWH,KAAAA,CAE5Bb"}

package/dist/core/oauth2/authorization/index.mjs

@@ -0,0 +1,11 @@
+import { OAuth2AuthorizationCodeIssuer } from "./code/issuer/module.mjs";
+import { base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, generateOAuth2CodeVerifier } from "./helpers.mjs";
+import { OAuth2AuthorizationCodeVerifier } from "./code/verifier/module.mjs";
+import "./code/index.mjs";
+import { OAuth2AuthorizationCodeRequestVerifier } from "./code-request/verifier/module.mjs";
+import { OAuth2AuthorizationCodeRequestValidator } from "./code-request/validator.mjs";
+import "./code-request/index.mjs";
+import { OAuth2AuthorizationStateManager } from "./state/module.mjs";
+import "./state/index.mjs";
+import { OAuth2Authorization } from "./module.mjs";
+export { OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, generateOAuth2CodeVerifier };

package/dist/core/oauth2/authorization/module.mjs

@@ -0,0 +1,66 @@
+import { buildOAuth2TokenHash } from "./helpers.mjs";
+import { ScopeName } from "@authup/core-kit";
+import { OAuth2AuthorizationResponseType, OAuth2Error, hasOAuth2Scopes } from "@authup/specs";
+//#region src/core/oauth2/authorization/module.ts
+var OAuth2Authorization = class {
+	accessTokenIssuer;
+	openIdTokenIssuer;
+	codeIssuer;
+	identityResolver;
+	constructor(ctx) {
+		this.accessTokenIssuer = ctx.accessTokenIssuer;
+		this.openIdTokenIssuer = ctx.openIdTokenIssuer;
+		this.codeIssuer = ctx.codeIssuer;
+		this.identityResolver = ctx.identityResolver;
+	}
+	/**
+	* Authorize with validated codeRequest.
+	*
+	* @param data
+	* @param identity
+	*/ async authorize(data, identity) {
+		const availableResponseTypes = Object.values(OAuth2AuthorizationResponseType);
+		let responseTypes = [];
+		if (data.response_type) responseTypes = Array.isArray(data.response_type) ? data.response_type : data.response_type.split(" ");
+		const enabledResponseTypes = {};
+		for (const responseType of responseTypes) if (!availableResponseTypes.includes(responseType)) throw OAuth2Error.responseTypeUnsupported();
+		else enabledResponseTypes[responseType] = true;
+		if (!data.redirect_uri) throw OAuth2Error.redirectUriMismatch();
+		const output = {
+			redirectUri: data.redirect_uri,
+			...data.state ? { state: data.state } : {}
+		};
+		if (!identity) throw OAuth2Error.identityInvalid();
+		const payloadBaseNormalized = {
+			sub: identity.data.id,
+			sub_kind: identity.type,
+			realm_id: identity.data.realm.id,
+			realm_name: identity.data.realm.name,
+			client_id: data.client_id,
+			...data.scope ? { scope: data.scope } : {},
+			...data.nonce ? { nonce: data.nonce } : {}
+		};
+		let codeEntity;
+		if (enabledResponseTypes[OAuth2AuthorizationResponseType.TOKEN]) {
+			const [token] = await this.accessTokenIssuer.issue(payloadBaseNormalized);
+			output.accessToken = token;
+		}
+		if (enabledResponseTypes[OAuth2AuthorizationResponseType.CODE]) {
+			codeEntity = await this.codeIssuer.issue(data, identity);
+			output.authorizationCode = codeEntity.id;
+		}
+		if (enabledResponseTypes[OAuth2AuthorizationResponseType.ID_TOKEN] || data.scope && hasOAuth2Scopes(data.scope, ScopeName.OPEN_ID)) {
+			const idTokenPayload = { ...payloadBaseNormalized };
+			if (output.accessToken) idTokenPayload.at_hash = await buildOAuth2TokenHash(output.accessToken);
+			if (output.authorizationCode) idTokenPayload.c_hash = await buildOAuth2TokenHash(output.authorizationCode);
+			const [token] = await this.openIdTokenIssuer.issueWithIdentity(idTokenPayload, identity);
+			if (enabledResponseTypes[OAuth2AuthorizationResponseType.ID_TOKEN]) output.idToken = token;
+			if (codeEntity) await this.codeIssuer.updateIdToken(codeEntity, token);
+		}
+		return output;
+	}
+};
+//#endregion
+export { OAuth2Authorization };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/authorization/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["ScopeName","OAuth2AuthorizationResponseType","OAuth2Error","hasOAuth2Scopes","buildOAuth2TokenHash","OAuth2Authorization","accessTokenIssuer","openIdTokenIssuer","codeIssuer","identityResolver","ctx","authorize","data","identity","availableResponseTypes","Object","values","responseTypes","response_type","Array","isArray","split","enabledResponseTypes","responseType","includes","responseTypeUnsupported","redirect_uri","redirectUriMismatch","output","redirectUri","state","identityInvalid","payloadBaseNormalized","sub","id","sub_kind","type","realm_id","realm","realm_name","name","client_id","scope","nonce","codeEntity","TOKEN","token","issue","accessToken","CODE","authorizationCode","needsIdToken","ID_TOKEN","OPEN_ID","idTokenPayload","at_hash","c_hash","issueWithIdentity","idToken","updateIdToken"],"sources":["../../../../src/core/oauth2/authorization/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Identity, OAuth2AuthorizationCode, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport {\n    OAuth2AuthorizationResponseType,\n    OAuth2Error,\n    hasOAuth2Scopes,\n} from '@authup/specs';\nimport type { IOAuth2OpenIDTokenIssuer, IOAuth2TokenIssuer } from '../token/index.ts';\nimport type { IOAuth2AuthorizationCodeIssuer } from './code/index.ts';\nimport { buildOAuth2TokenHash } from './helpers.ts';\nimport type {\n    OAuth2AuthorizationManagerContext,\n    OAuth2AuthorizationResult,\n} from './types.ts';\nimport type { IIdentityResolver } from '../../identity/index.ts';\n\nexport class OAuth2Authorization {\n    protected accessTokenIssuer : IOAuth2TokenIssuer;\n\n    protected openIdTokenIssuer : IOAuth2OpenIDTokenIssuer;\n\n    protected codeIssuer : IOAuth2AuthorizationCodeIssuer;\n\n    protected identityResolver : IIdentityResolver;\n\n    constructor(ctx: OAuth2AuthorizationManagerContext) {\n        this.accessTokenIssuer = ctx.accessTokenIssuer;\n        this.openIdTokenIssuer = ctx.openIdTokenIssuer;\n        this.codeIssuer = ctx.codeIssuer;\n        this.identityResolver = ctx.identityResolver;\n    }\n\n    /**\n     * Authorize with validated codeRequest.\n     *\n     * @param data\n     * @param identity\n     */\n    async authorize(\n        data: OAuth2AuthorizationCodeRequest,\n        identity: Identity,\n    ) : Promise<OAuth2AuthorizationResult> {\n        const availableResponseTypes : string[] = Object.values(OAuth2AuthorizationResponseType);\n\n        let responseTypes : string[] = [];\n        if (data.response_type) {\n            responseTypes = Array.isArray(data.response_type) ?\n                data.response_type :\n                data.response_type.split(' ');\n        }\n\n        const enabledResponseTypes : Record<string, boolean> = {};\n\n        for (const responseType of responseTypes) {\n            if (!availableResponseTypes.includes(responseType)) {\n                throw OAuth2Error.responseTypeUnsupported();\n            } else {\n                enabledResponseTypes[responseType] = true;\n            }\n        }\n\n        if (!data.redirect_uri) {\n            throw OAuth2Error.redirectUriMismatch();\n        }\n\n        const output : OAuth2AuthorizationResult = {\n            redirectUri: data.redirect_uri,\n            ...(data.state ? { state: data.state } : {}),\n        };\n\n        if (!identity) {\n            throw OAuth2Error.identityInvalid();\n        }\n\n        const payloadBaseNormalized : OAuth2TokenPayload = {\n\n            sub: identity.data.id,\n            sub_kind: identity.type,\n            realm_id: identity.data.realm.id,\n            realm_name: identity.data.realm.name,\n\n            client_id: data.client_id,\n            ...(data.scope ? { scope: data.scope } : {}),\n            ...(data.nonce ? { nonce: data.nonce } : {}),\n        };\n\n        let codeEntity : OAuth2AuthorizationCode | undefined;\n\n        if (enabledResponseTypes[OAuth2AuthorizationResponseType.TOKEN]) {\n            const [token] = await this.accessTokenIssuer.issue(payloadBaseNormalized);\n\n            output.accessToken = token;\n        }\n\n        if (enabledResponseTypes[OAuth2AuthorizationResponseType.CODE]) {\n            codeEntity = await this.codeIssuer.issue(\n                data,\n                identity,\n            );\n\n            output.authorizationCode = codeEntity.id;\n        }\n\n        const needsIdToken = enabledResponseTypes[OAuth2AuthorizationResponseType.ID_TOKEN] ||\n            (data.scope && hasOAuth2Scopes(data.scope, ScopeName.OPEN_ID));\n\n        if (needsIdToken) {\n            const idTokenPayload = { ...payloadBaseNormalized };\n\n            if (output.accessToken) {\n                idTokenPayload.at_hash = await buildOAuth2TokenHash(output.accessToken);\n            }\n            if (output.authorizationCode) {\n                idTokenPayload.c_hash = await buildOAuth2TokenHash(output.authorizationCode);\n            }\n\n            const [token] = await this.openIdTokenIssuer.issueWithIdentity(\n                idTokenPayload,\n                identity,\n            );\n\n            if (enabledResponseTypes[OAuth2AuthorizationResponseType.ID_TOKEN]) {\n                output.idToken = token;\n            }\n\n            if (codeEntity) {\n                await this.codeIssuer.updateIdToken(codeEntity, token);\n            }\n        }\n\n        return output;\n    }\n}\n"],"mappings":";;;;AAwBA,IAAaK,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAwC;AAChD,OAAKJ,oBAAoBI,IAAIJ;AAC7B,OAAKC,oBAAoBG,IAAIH;AAC7B,OAAKC,aAAaE,IAAIF;AACtB,OAAKC,mBAAmBC,IAAID;;;;;;;IAShC,MAAME,UACFC,MACAC,UACmC;EACnC,MAAMC,yBAAoCC,OAAOC,OAAOf,gCAAAA;EAExD,IAAIgB,gBAA2B,EAAE;AACjC,MAAIL,KAAKM,cACLD,iBAAgBE,MAAMC,QAAQR,KAAKM,cAAa,GAC5CN,KAAKM,gBACLN,KAAKM,cAAcG,MAAM,IAAA;EAGjC,MAAMC,uBAAiD,EAAC;AAExD,OAAK,MAAMC,gBAAgBN,cACvB,KAAI,CAACH,uBAAuBU,SAASD,aAAAA,CACjC,OAAMrB,YAAYuB,yBAAuB;MAEzCH,sBAAqBC,gBAAgB;AAI7C,MAAI,CAACX,KAAKc,aACN,OAAMxB,YAAYyB,qBAAmB;EAGzC,MAAMC,SAAqC;GACvCC,aAAajB,KAAKc;GAClB,GAAId,KAAKkB,QAAQ,EAAEA,OAAOlB,KAAKkB,OAAM,GAAI,EAAE;GAC/C;AAEA,MAAI,CAACjB,SACD,OAAMX,YAAY6B,iBAAe;EAGrC,MAAMC,wBAA6C;GAE/CC,KAAKpB,SAASD,KAAKsB;GACnBC,UAAUtB,SAASuB;GACnBC,UAAUxB,SAASD,KAAK0B,MAAMJ;GAC9BK,YAAY1B,SAASD,KAAK0B,MAAME;GAEhCC,WAAW7B,KAAK6B;GAChB,GAAI7B,KAAK8B,QAAQ,EAAEA,OAAO9B,KAAK8B,OAAM,GAAI,EAAE;GAC3C,GAAI9B,KAAK+B,QAAQ,EAAEA,OAAO/B,KAAK+B,OAAM,GAAI,EAAE;GAC/C;EAEA,IAAIC;AAEJ,MAAItB,qBAAqBrB,gCAAgC4C,QAAQ;GAC7D,MAAM,CAACC,SAAS,MAAM,KAAKxC,kBAAkByC,MAAMf,sBAAAA;AAEnDJ,UAAOoB,cAAcF;;AAGzB,MAAIxB,qBAAqBrB,gCAAgCgD,OAAO;AAC5DL,gBAAa,MAAM,KAAKpC,WAAWuC,MAC/BnC,MACAC,SAAAA;AAGJe,UAAOsB,oBAAoBN,WAAWV;;AAM1C,MAHqBZ,qBAAqBrB,gCAAgCmD,aACrExC,KAAK8B,SAASvC,gBAAgBS,KAAK8B,OAAO1C,UAAUqD,QAAO,EAE9C;GACd,MAAMC,iBAAiB,EAAE,GAAGtB,uBAAsB;AAElD,OAAIJ,OAAOoB,YACPM,gBAAeC,UAAU,MAAMnD,qBAAqBwB,OAAOoB,YAAW;AAE1E,OAAIpB,OAAOsB,kBACPI,gBAAeE,SAAS,MAAMpD,qBAAqBwB,OAAOsB,kBAAiB;GAG/E,MAAM,CAACJ,SAAS,MAAM,KAAKvC,kBAAkBkD,kBACzCH,gBACAzC,SAAAA;AAGJ,OAAIS,qBAAqBrB,gCAAgCmD,UACrDxB,QAAO8B,UAAUZ;AAGrB,OAAIF,WACA,OAAM,KAAKpC,WAAWmD,cAAcf,YAAYE,MAAAA;;AAIxD,SAAOlB"}

package/dist/core/oauth2/authorization/state/index.mjs

@@ -0,0 +1,2 @@
+import { OAuth2AuthorizationStateManager } from "./module.mjs";
+export { OAuth2AuthorizationStateManager };