@authup/server-core 1.0.0-beta.36 → 1.0.0-beta.37

package/dist/core/oauth2/authorization/state/module.mjs

@@ -0,0 +1,23 @@
+import { OAuth2Error } from "@authup/specs";
+//#region src/core/oauth2/authorization/state/module.ts
+var OAuth2AuthorizationStateManager = class {
+	repository;
+	constructor(repository) {
+		this.repository = repository;
+	}
+	async save(data) {
+		return this.repository.insert(data);
+	}
+	async verify(state, input) {
+		const payload = await this.repository.findOneById(state);
+		if (!payload) throw OAuth2Error.stateInvalid();
+		await this.repository.remove(state);
+		if (payload.ip && input.ip !== payload.ip) throw OAuth2Error.stateInvalid();
+		if (payload.userAgent && input.userAgent !== payload.userAgent) throw OAuth2Error.stateInvalid();
+		return payload;
+	}
+};
+//#endregion
+export { OAuth2AuthorizationStateManager };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/authorization/state/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["OAuth2Error","OAuth2AuthorizationStateManager","repository","save","data","insert","verify","state","input","payload","findOneById","stateInvalid","remove","ip","userAgent"],"sources":["../../../../../src/core/oauth2/authorization/state/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { OAuth2Error } from '@authup/specs';\nimport type {\n    IOAuth2AuthorizationStateManager,\n    IOAuth2AuthorizeStateRepository,\n    OAuth2AuthorizationState,\n} from './types.ts';\n\nexport class OAuth2AuthorizationStateManager implements IOAuth2AuthorizationStateManager {\n    protected repository: IOAuth2AuthorizeStateRepository;\n\n    constructor(repository: IOAuth2AuthorizeStateRepository) {\n        this.repository = repository;\n    }\n\n    async save(data: OAuth2AuthorizationState) : Promise<string> {\n        return this.repository.insert(data);\n    }\n\n    async verify(state: string, input: Partial<OAuth2AuthorizationState>): Promise<OAuth2AuthorizationState> {\n        const payload = await this.repository.findOneById(state);\n        if (!payload) {\n            throw OAuth2Error.stateInvalid();\n        }\n\n        // avoid replay attacks\n        await this.repository.remove(state);\n\n        if (\n            payload.ip &&\n            input.ip !== payload.ip\n        ) {\n            throw OAuth2Error.stateInvalid();\n        }\n\n        if (\n            payload.userAgent &&\n            input.userAgent !== payload.userAgent\n        ) {\n            throw OAuth2Error.stateInvalid();\n        }\n\n        return payload;\n    }\n}\n"],"mappings":";;AAcA,IAAaC,kCAAb,MAAaA;CACCC;CAEV,YAAYA,YAA6C;AACrD,OAAKA,aAAaA;;CAGtB,MAAMC,KAAKC,MAAkD;AACzD,SAAO,KAAKF,WAAWG,OAAOD,KAAAA;;CAGlC,MAAME,OAAOC,OAAeC,OAA6E;EACrG,MAAMC,UAAU,MAAM,KAAKP,WAAWQ,YAAYH,MAAAA;AAClD,MAAI,CAACE,QACD,OAAMT,YAAYW,cAAY;AAIlC,QAAM,KAAKT,WAAWU,OAAOL,MAAAA;AAE7B,MACIE,QAAQI,MACRL,MAAMK,OAAOJ,QAAQI,GAErB,OAAMb,YAAYW,cAAY;AAGlC,MACIF,QAAQK,aACRN,MAAMM,cAAcL,QAAQK,UAE5B,OAAMd,YAAYW,cAAY;AAGlC,SAAOF"}

package/dist/core/oauth2/authorization/state/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/authorization/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/client/index.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/client/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/grant-types/authorize.mjs

@@ -0,0 +1,50 @@
+import { OAuth2BaseGrant } from "./base.mjs";
+import { buildOAuth2BearerTokenResponse } from "../response/bearer.mjs";
+import { ScopeName } from "@authup/core-kit";
+import { hasOAuth2Scopes } from "@authup/specs";
+//#region src/core/oauth2/grant-types/authorize.ts
+var OAuth2AuthorizeGrant = class extends OAuth2BaseGrant {
+	refreshTokenIssuer;
+	constructor(ctx) {
+		super({
+			accessTokenIssuer: ctx.accessTokenIssuer,
+			sessionManager: ctx.sessionManager
+		});
+		this.refreshTokenIssuer = ctx.refreshTokenIssuer;
+	}
+	async runWith(authorizationCode, options = {}) {
+		const session = await this.sessionManager.create({
+			user_agent: options.userAgent,
+			ip_address: options.ipAddress,
+			realm_id: authorizationCode.realm_id,
+			client_id: authorizationCode.client_id,
+			sub_kind: authorizationCode.sub_kind,
+			sub: authorizationCode.sub
+		});
+		const issuePayload = {
+			user_agent: options.userAgent,
+			remote_address: options.ipAddress,
+			session_id: session.id,
+			sub: authorizationCode.sub || void 0,
+			sub_kind: authorizationCode.sub_kind,
+			realm_id: authorizationCode.realm_id,
+			realm_name: authorizationCode.realm_name,
+			scope: authorizationCode.scope || void 0,
+			client_id: authorizationCode.client_id || void 0
+		};
+		const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);
+		const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);
+		const buildContext = {
+			accessToken,
+			accessTokenPayload,
+			refreshToken,
+			refreshTokenPayload
+		};
+		if (authorizationCode.scope && hasOAuth2Scopes(authorizationCode.scope, ScopeName.OPEN_ID)) buildContext.idToken = authorizationCode.id_token || void 0;
+		return buildOAuth2BearerTokenResponse(buildContext);
+	}
+};
+//#endregion
+export { OAuth2AuthorizeGrant };
+
+//# sourceMappingURL=authorize.mjs.map

package/dist/core/oauth2/grant-types/authorize.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.mjs","names":["hasOAuth2Scopes","ScopeName","OAuth2BaseGrant","buildOAuth2BearerTokenResponse","OAuth2AuthorizeGrant","refreshTokenIssuer","ctx","accessTokenIssuer","sessionManager","runWith","authorizationCode","options","session","create","user_agent","userAgent","ip_address","ipAddress","realm_id","client_id","sub_kind","sub","issuePayload","remote_address","session_id","id","undefined","realm_name","scope","accessToken","accessTokenPayload","issue","refreshToken","refreshTokenPayload","buildContext","OPEN_ID","idToken","id_token"],"sources":["../../../../src/core/oauth2/grant-types/authorize.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { hasOAuth2Scopes } from '@authup/specs';\nimport type { OAuth2AuthorizationCode } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport type { IOAuth2TokenIssuer } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport type { IOAuth2Grant, OAuth2AuthorizeGrantContext, OAuth2GrantRunWIthOptions } from './types.ts';\nimport type { OAuth2BearerResponseBuildContext } from '../response/index.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\n\nexport class OAuth2AuthorizeGrant extends OAuth2BaseGrant<OAuth2AuthorizationCode> implements IOAuth2Grant {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    constructor(ctx: OAuth2AuthorizeGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n    }\n\n    async runWith(\n        authorizationCode: OAuth2AuthorizationCode,\n        options: OAuth2GrantRunWIthOptions = {},\n    ) : Promise<OAuth2TokenGrantResponse> {\n        const session = await this.sessionManager.create({\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: authorizationCode.realm_id,\n            client_id: authorizationCode.client_id,\n            sub_kind: authorizationCode.sub_kind,\n            sub: authorizationCode.sub,\n        });\n\n        const issuePayload : Partial<OAuth2TokenPayload> = {\n            user_agent: options.userAgent,\n            remote_address: options.ipAddress,\n            session_id: session.id,\n            sub: authorizationCode.sub || undefined,\n            sub_kind: authorizationCode.sub_kind,\n            realm_id: authorizationCode.realm_id,\n            realm_name: authorizationCode.realm_name,\n            scope: authorizationCode.scope || undefined,\n            client_id: authorizationCode.client_id || undefined,\n        };\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);\n\n        const buildContext : OAuth2BearerResponseBuildContext = {\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        };\n\n        if (\n            authorizationCode.scope &&\n            hasOAuth2Scopes(authorizationCode.scope, ScopeName.OPEN_ID)\n        ) {\n            buildContext.idToken = authorizationCode.id_token || undefined;\n        }\n\n        return buildOAuth2BearerTokenResponse(buildContext);\n    }\n}\n"],"mappings":";;;;;AAiBA,IAAaI,uBAAb,cAA0CF,gBAAAA;CAC5BG;CAEV,YAAYC,KAAkC;AAC1C,QAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;GACxB,CAAA;AAEA,OAAKH,qBAAqBC,IAAID;;CAGlC,MAAMI,QACFC,mBACAC,UAAqC,EAAE,EACL;EAClC,MAAMC,UAAU,MAAM,KAAKJ,eAAeK,OAAO;GAC7CC,YAAYH,QAAQI;GACpBC,YAAYL,QAAQM;GACpBC,UAAUR,kBAAkBQ;GAC5BC,WAAWT,kBAAkBS;GAC7BC,UAAUV,kBAAkBU;GAC5BC,KAAKX,kBAAkBW;GAC3B,CAAA;EAEA,MAAMC,eAA6C;GAC/CR,YAAYH,QAAQI;GACpBQ,gBAAgBZ,QAAQM;GACxBO,YAAYZ,QAAQa;GACpBJ,KAAKX,kBAAkBW,OAAOK,KAAAA;GAC9BN,UAAUV,kBAAkBU;GAC5BF,UAAUR,kBAAkBQ;GAC5BS,YAAYjB,kBAAkBiB;GAC9BC,OAAOlB,kBAAkBkB,SAASF,KAAAA;GAClCP,WAAWT,kBAAkBS,aAAaO,KAAAA;GAC9C;EAEA,MAAM,CAACG,aAAaC,sBAAsB,MAAM,KAAKvB,kBAAkBwB,MAAMT,aAAAA;EAC7E,MAAM,CAACU,cAAcC,uBAAuB,MAAM,KAAK5B,mBAAmB0B,MAAMT,aAAAA;EAEhF,MAAMY,eAAkD;GACpDL;GACAC;GACAE;GACAC;GACJ;AAEA,MACIvB,kBAAkBkB,SAClB5B,gBAAgBU,kBAAkBkB,OAAO3B,UAAUkC,QAAO,CAE1DD,cAAaE,UAAU1B,kBAAkB2B,YAAYX,KAAAA;AAGzD,SAAOvB,+BAA+B+B,aAAAA"}

package/dist/core/oauth2/grant-types/base.mjs

@@ -0,0 +1,13 @@
+//#region src/core/oauth2/grant-types/base.ts
+var OAuth2BaseGrant = class {
+	accessTokenIssuer;
+	sessionManager;
+	constructor(ctx) {
+		this.accessTokenIssuer = ctx.accessTokenIssuer;
+		this.sessionManager = ctx.sessionManager;
+	}
+};
+//#endregion
+export { OAuth2BaseGrant };
+
+//# sourceMappingURL=base.mjs.map

package/dist/core/oauth2/grant-types/base.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.mjs","names":["OAuth2BaseGrant","accessTokenIssuer","sessionManager","ctx"],"sources":["../../../../src/core/oauth2/grant-types/base.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ObjectLiteral } from '@authup/kit';\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport type { ISessionManager } from '../../authentication/index.ts';\nimport type { IOAuth2TokenIssuer } from '../token/index.ts';\nimport type { BaseGrantContext, IOAuth2Grant, OAuth2GrantRunWIthOptions } from './types.ts';\n\nexport abstract class OAuth2BaseGrant<\n    T = ObjectLiteral,\n> implements IOAuth2Grant<T> {\n    protected accessTokenIssuer : IOAuth2TokenIssuer;\n\n    protected sessionManager : ISessionManager;\n\n    // -----------------------------------------------------\n\n    constructor(ctx: BaseGrantContext) {\n        this.accessTokenIssuer = ctx.accessTokenIssuer;\n        this.sessionManager = ctx.sessionManager;\n    }\n\n    // -----------------------------------------------------\n\n    abstract runWith(input: T, options?: OAuth2GrantRunWIthOptions): Promise<OAuth2TokenGrantResponse>;\n}\n"],"mappings":";AAaA,IAAsBA,kBAAtB,MAAsBA;CAGRC;CAEAC;CAIV,YAAYC,KAAuB;AAC/B,OAAKF,oBAAoBE,IAAIF;AAC7B,OAAKC,iBAAiBC,IAAID"}

package/dist/core/oauth2/grant-types/client-credentials.mjs

@@ -0,0 +1,35 @@
+import { OAuth2BaseGrant } from "./base.mjs";
+import { buildOAuth2BearerTokenResponse } from "../response/bearer.mjs";
+import { IdentityType, ScopeName } from "@authup/core-kit";
+import { OAuth2SubKind } from "@authup/specs";
+//#region src/core/oauth2/grant-types/client-credentials.ts
+var ClientCredentialsGrant = class extends OAuth2BaseGrant {
+	async runWith(input, options = {}) {
+		const session = await this.sessionManager.create({
+			user_agent: options.userAgent,
+			ip_address: options.ipAddress,
+			realm_id: input.realm_id,
+			sub: input.id,
+			sub_kind: IdentityType.CLIENT
+		});
+		const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({
+			user_agent: session.user_agent,
+			remote_address: session.ip_address,
+			session_id: session.id,
+			scope: ScopeName.GLOBAL,
+			sub: input.id,
+			sub_kind: OAuth2SubKind.CLIENT,
+			realm_id: input.realm.id,
+			realm_name: input.realm.id,
+			client_id: input.id
+		});
+		return buildOAuth2BearerTokenResponse({
+			accessToken,
+			accessTokenPayload
+		});
+	}
+};
+//#endregion
+export { ClientCredentialsGrant };
+
+//# sourceMappingURL=client-credentials.mjs.map

package/dist/core/oauth2/grant-types/client-credentials.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-credentials.mjs","names":["OAuth2SubKind","IdentityType","ScopeName","OAuth2BaseGrant","buildOAuth2BearerTokenResponse","ClientCredentialsGrant","runWith","input","options","session","sessionManager","create","user_agent","userAgent","ip_address","ipAddress","realm_id","sub","id","sub_kind","CLIENT","accessToken","accessTokenPayload","accessTokenIssuer","issue","remote_address","session_id","scope","GLOBAL","realm","realm_name","client_id"],"sources":["../../../../src/core/oauth2/grant-types/client-credentials.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2SubKind } from '@authup/specs';\nimport type { Client } from '@authup/core-kit';\nimport {\n    IdentityType,\n    ScopeName,\n} from '@authup/core-kit';\nimport { OAuth2BaseGrant } from './base.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { OAuth2GrantRunWIthOptions } from './types.ts';\n\nexport class ClientCredentialsGrant extends OAuth2BaseGrant<Client> {\n    async runWith(input: Client, options: OAuth2GrantRunWIthOptions = {}) : Promise<OAuth2TokenGrantResponse> {\n        const session = await this.sessionManager.create({\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: input.realm_id,\n            sub: input.id,\n            sub_kind: IdentityType.CLIENT,\n        });\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            session_id: session.id,\n            scope: ScopeName.GLOBAL,\n            sub: input.id,\n            sub_kind: OAuth2SubKind.CLIENT,\n            realm_id: input.realm.id,\n            realm_name: input.realm.id,\n            client_id: input.id,\n        });\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;AAkBA,IAAaK,yBAAb,cAA4CF,gBAAAA;CACxC,MAAMG,QAAQC,OAAeC,UAAqC,EAAE,EAAsC;EACtG,MAAMC,UAAU,MAAM,KAAKC,eAAeC,OAAO;GAC7CC,YAAYJ,QAAQK;GACpBC,YAAYN,QAAQO;GACpBC,UAAUT,MAAMS;GAChBC,KAAKV,MAAMW;GACXC,UAAUlB,aAAamB;GAC3B,CAAA;EAEA,MAAM,CAACC,aAAaC,sBAAsB,MAAM,KAAKC,kBAAkBC,MAAM;GACzEZ,YAAYH,QAAQG;GACpBa,gBAAgBhB,QAAQK;GACxBY,YAAYjB,QAAQS;GACpBS,OAAOzB,UAAU0B;GACjBX,KAAKV,MAAMW;GACXC,UAAUnB,cAAcoB;GACxBJ,UAAUT,MAAMsB,MAAMX;GACtBY,YAAYvB,MAAMsB,MAAMX;GACxBa,WAAWxB,MAAMW;GACrB,CAAA;AAEA,SAAOd,+BAA+B;GAClCiB;GACAC;GACJ,CAAA"}

package/dist/core/oauth2/grant-types/identity.mjs

@@ -0,0 +1,46 @@
+import { OAuth2BaseGrant } from "./base.mjs";
+import { buildOAuth2BearerTokenResponse } from "../response/bearer.mjs";
+import { ScopeName } from "@authup/core-kit";
+//#region src/core/oauth2/grant-types/identity.ts
+var IdentityGrantType = class extends OAuth2BaseGrant {
+	refreshTokenIssuer;
+	constructor(ctx) {
+		super({
+			accessTokenIssuer: ctx.accessTokenIssuer,
+			sessionManager: ctx.sessionManager
+		});
+		this.refreshTokenIssuer = ctx.refreshTokenIssuer;
+	}
+	async runWith(identity, options = {}) {
+		const session = {
+			user_agent: options.userAgent,
+			ip_address: options.ipAddress,
+			realm_id: identity.data.realm_id,
+			sub: identity.data.id,
+			sub_kind: identity.type
+		};
+		const { id: sessionId } = await this.sessionManager.create(session);
+		const issuePayload = {
+			session_id: sessionId,
+			user_agent: session.user_agent,
+			remote_address: session.ip_address,
+			scope: ScopeName.GLOBAL,
+			realm_id: identity.data.realm_id,
+			realm_name: identity.data.realm?.name,
+			sub: identity.data.id,
+			sub_kind: identity.type
+		};
+		const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);
+		const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);
+		return buildOAuth2BearerTokenResponse({
+			accessToken,
+			accessTokenPayload,
+			refreshToken,
+			refreshTokenPayload
+		});
+	}
+};
+//#endregion
+export { IdentityGrantType };
+
+//# sourceMappingURL=identity.mjs.map

package/dist/core/oauth2/grant-types/identity.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.mjs","names":["ScopeName","OAuth2BaseGrant","buildOAuth2BearerTokenResponse","IdentityGrantType","refreshTokenIssuer","ctx","accessTokenIssuer","sessionManager","runWith","identity","options","session","user_agent","userAgent","ip_address","ipAddress","realm_id","data","sub","id","sub_kind","type","sessionId","create","issuePayload","session_id","remote_address","scope","GLOBAL","realm_name","realm","name","accessToken","accessTokenPayload","issue","refreshToken","refreshTokenPayload"],"sources":["../../../../src/core/oauth2/grant-types/identity.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport type { Identity, Session } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport type { IOAuth2TokenIssuer } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { OAuth2GrantRunWIthOptions, OAuth2IdentityGrantContext } from './types.ts';\n\nexport class IdentityGrantType extends OAuth2BaseGrant<Identity> {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    constructor(ctx: OAuth2IdentityGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n    }\n\n    async runWith(\n        identity: Identity,\n        options: OAuth2GrantRunWIthOptions = {},\n    ): Promise<OAuth2TokenGrantResponse> {\n        const session : Partial<Session> = {\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: identity.data.realm_id,\n            sub: identity.data.id,\n            sub_kind: identity.type,\n        };\n\n        const { id: sessionId } = await this.sessionManager.create(session);\n\n        const issuePayload : Partial<OAuth2TokenPayload> = {\n            session_id: sessionId,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            scope: ScopeName.GLOBAL,\n            realm_id: identity.data.realm_id,\n            realm_name: identity.data.realm?.name,\n            sub: identity.data.id,\n            sub_kind: identity.type,\n        };\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;AAeA,IAAaG,oBAAb,cAAuCF,gBAAAA;CACzBG;CAEV,YAAYC,KAAiC;AACzC,QAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;GACxB,CAAA;AAEA,OAAKH,qBAAqBC,IAAID;;CAGlC,MAAMI,QACFC,UACAC,UAAqC,EAAE,EACN;EACjC,MAAMC,UAA6B;GAC/BC,YAAYF,QAAQG;GACpBC,YAAYJ,QAAQK;GACpBC,UAAUP,SAASQ,KAAKD;GACxBE,KAAKT,SAASQ,KAAKE;GACnBC,UAAUX,SAASY;GACvB;EAEA,MAAM,EAAEF,IAAIG,cAAc,MAAM,KAAKf,eAAegB,OAAOZ,QAAAA;EAE3D,MAAMa,eAA6C;GAC/CC,YAAYH;GACZV,YAAYD,QAAQC;GACpBc,gBAAgBf,QAAQG;GACxBa,OAAO3B,UAAU4B;GACjBZ,UAAUP,SAASQ,KAAKD;GACxBa,YAAYpB,SAASQ,KAAKa,OAAOC;GACjCb,KAAKT,SAASQ,KAAKE;GACnBC,UAAUX,SAASY;GACvB;EAEA,MAAM,CAACW,aAAaC,sBAAsB,MAAM,KAAK3B,kBAAkB4B,MAAMV,aAAAA;EAC7E,MAAM,CAACW,cAAcC,uBAAuB,MAAM,KAAKhC,mBAAmB8B,MAAMV,aAAAA;AAEhF,SAAOtB,+BAA+B;GAClC8B;GACAC;GACAE;GACAC;GACJ,CAAA"}

package/dist/core/oauth2/grant-types/index.mjs

@@ -0,0 +1,7 @@
+import { OAuth2AuthorizeGrant } from "./authorize.mjs";
+import { ClientCredentialsGrant } from "./client-credentials.mjs";
+import { IdentityGrantType } from "./identity.mjs";
+import { PasswordGrantType } from "./password.mjs";
+import { OAuth2RefreshTokenGrant } from "./refresh-token.mjs";
+import { RobotCredentialsGrant } from "./robot-credentials.mjs";
+export { ClientCredentialsGrant, IdentityGrantType, OAuth2AuthorizeGrant, OAuth2RefreshTokenGrant, PasswordGrantType, RobotCredentialsGrant };

package/dist/core/oauth2/grant-types/password.mjs

@@ -0,0 +1,48 @@
+import { OAuth2BaseGrant } from "./base.mjs";
+import { buildOAuth2BearerTokenResponse } from "../response/bearer.mjs";
+import { IdentityType, ScopeName } from "@authup/core-kit";
+import { OAuth2SubKind } from "@authup/specs";
+//#region src/core/oauth2/grant-types/password.ts
+var PasswordGrantType = class extends OAuth2BaseGrant {
+	refreshTokenIssuer;
+	constructor(ctx) {
+		super({
+			accessTokenIssuer: ctx.accessTokenIssuer,
+			sessionManager: ctx.sessionManager
+		});
+		this.refreshTokenIssuer = ctx.refreshTokenIssuer;
+	}
+	async runWith(input, options = {}) {
+		const session = await this.sessionManager.create({
+			user_agent: options.userAgent,
+			ip_address: options.ipAddress,
+			realm_id: input.realm_id,
+			client_id: input.client_id || void 0,
+			sub: input.id,
+			sub_kind: IdentityType.USER
+		});
+		const issuePayload = {
+			client_id: input.client_id || void 0,
+			session_id: session.id,
+			user_agent: session.user_agent,
+			remote_address: session.ip_address,
+			scope: ScopeName.GLOBAL,
+			sub: input.id,
+			sub_kind: OAuth2SubKind.USER,
+			realm_id: input.realm_id,
+			realm_name: input.realm?.name
+		};
+		const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);
+		const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);
+		return buildOAuth2BearerTokenResponse({
+			accessToken,
+			accessTokenPayload,
+			refreshToken,
+			refreshTokenPayload
+		});
+	}
+};
+//#endregion
+export { PasswordGrantType };
+
+//# sourceMappingURL=password.mjs.map

package/dist/core/oauth2/grant-types/password.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.mjs","names":["OAuth2SubKind","IdentityType","ScopeName","buildOAuth2BearerTokenResponse","OAuth2BaseGrant","PasswordGrantType","refreshTokenIssuer","ctx","accessTokenIssuer","sessionManager","runWith","input","options","session","create","user_agent","userAgent","ip_address","ipAddress","realm_id","client_id","undefined","sub","id","sub_kind","USER","issuePayload","session_id","remote_address","scope","GLOBAL","realm_name","realm","name","accessToken","accessTokenPayload","issue","refreshToken","refreshTokenPayload"],"sources":["../../../../src/core/oauth2/grant-types/password.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2SubKind } from '@authup/specs';\nimport type { User } from '@authup/core-kit';\nimport {\n    IdentityType,\n    ScopeName,\n} from '@authup/core-kit';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { IOAuth2TokenIssuer } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport type { OAuth2GrantRunWIthOptions, OAuth2PasswordGrantContext } from './types.ts';\n\nexport class PasswordGrantType extends OAuth2BaseGrant<User> {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    constructor(ctx: OAuth2PasswordGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n    }\n\n    async runWith(input: User, options: OAuth2GrantRunWIthOptions = {}) : Promise<OAuth2TokenGrantResponse> {\n        const session = await this.sessionManager.create({\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: input.realm_id,\n            client_id: input.client_id || undefined,\n            sub: input.id,\n            sub_kind: IdentityType.USER,\n        });\n\n        const issuePayload : Partial<OAuth2TokenPayload> = {\n            client_id: input.client_id || undefined,\n            session_id: session.id,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            scope: ScopeName.GLOBAL,\n            sub: input.id,\n            sub_kind: OAuth2SubKind.USER,\n            realm_id: input.realm_id,\n            realm_name: input.realm?.name,\n        };\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;AAmBA,IAAaK,oBAAb,cAAuCD,gBAAAA;CACzBE;CAEV,YAAYC,KAAiC;AACzC,QAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;GACxB,CAAA;AAEA,OAAKH,qBAAqBC,IAAID;;CAGlC,MAAMI,QAAQC,OAAaC,UAAqC,EAAE,EAAsC;EACpG,MAAMC,UAAU,MAAM,KAAKJ,eAAeK,OAAO;GAC7CC,YAAYH,QAAQI;GACpBC,YAAYL,QAAQM;GACpBC,UAAUR,MAAMQ;GAChBC,WAAWT,MAAMS,aAAaC,KAAAA;GAC9BC,KAAKX,MAAMY;GACXC,UAAUvB,aAAawB;GAC3B,CAAA;EAEA,MAAMC,eAA6C;GAC/CN,WAAWT,MAAMS,aAAaC,KAAAA;GAC9BM,YAAYd,QAAQU;GACpBR,YAAYF,QAAQE;GACpBa,gBAAgBf,QAAQI;GACxBY,OAAO3B,UAAU4B;GACjBR,KAAKX,MAAMY;GACXC,UAAUxB,cAAcyB;GACxBN,UAAUR,MAAMQ;GAChBY,YAAYpB,MAAMqB,OAAOC;GAC7B;EAEA,MAAM,CAACC,aAAaC,sBAAsB,MAAM,KAAK3B,kBAAkB4B,MAAMV,aAAAA;EAC7E,MAAM,CAACW,cAAcC,uBAAuB,MAAM,KAAKhC,mBAAmB8B,MAAMV,aAAAA;AAEhF,SAAOvB,+BAA+B;GAClC+B;GACAC;GACAE;GACAC;GACJ,CAAA"}

package/dist/core/oauth2/grant-types/refresh-token.mjs

@@ -0,0 +1,53 @@
+import { OAuth2BaseGrant } from "./base.mjs";
+import { buildOAuth2BearerTokenResponse } from "../response/bearer.mjs";
+import { JWTError } from "@authup/specs";
+//#region src/core/oauth2/grant-types/refresh-token.ts
+var OAuth2RefreshTokenGrant = class extends OAuth2BaseGrant {
+	refreshTokenIssuer;
+	tokenVerifier;
+	tokenRevoker;
+	constructor(ctx) {
+		super({
+			accessTokenIssuer: ctx.accessTokenIssuer,
+			sessionManager: ctx.sessionManager
+		});
+		this.refreshTokenIssuer = ctx.refreshTokenIssuer;
+		this.tokenVerifier = ctx.tokenVerifier;
+		this.tokenRevoker = ctx.tokenRevoker;
+	}
+	async runWith(input, options = {}) {
+		let payload;
+		if (typeof input === "string") payload = await this.tokenVerifier.verify(input);
+		else payload = input;
+		await this.tokenRevoker.revoke(payload);
+		if (!payload.session_id) throw JWTError.payloadPropertyInvalid("session_id");
+		const session = await this.sessionManager.findOneById(payload.session_id);
+		if (!session) throw JWTError.payloadPropertyInvalid("session_id");
+		await this.sessionManager.verify(session);
+		if (options.userAgent) session.user_agent = options.userAgent;
+		if (options.ipAddress) session.ip_address = options.ipAddress;
+		await this.sessionManager.refresh(session);
+		const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({
+			...payload,
+			user_agent: session.user_agent,
+			remote_address: session.ip_address,
+			exp: this.accessTokenIssuer.buildExp()
+		});
+		const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue({
+			...payload,
+			user_agent: session.user_agent,
+			remote_address: session.ip_address,
+			exp: this.refreshTokenIssuer.buildExp()
+		});
+		return buildOAuth2BearerTokenResponse({
+			accessToken,
+			accessTokenPayload,
+			refreshToken,
+			refreshTokenPayload
+		});
+	}
+};
+//#endregion
+export { OAuth2RefreshTokenGrant };
+
+//# sourceMappingURL=refresh-token.mjs.map

package/dist/core/oauth2/grant-types/refresh-token.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-token.mjs","names":["JWTError","buildOAuth2BearerTokenResponse","OAuth2BaseGrant","OAuth2RefreshTokenGrant","refreshTokenIssuer","tokenVerifier","tokenRevoker","ctx","accessTokenIssuer","sessionManager","runWith","input","options","payload","verify","revoke","session_id","payloadPropertyInvalid","session","findOneById","userAgent","user_agent","ipAddress","ip_address","refresh","accessToken","accessTokenPayload","issue","remote_address","exp","buildExp","refreshToken","refreshTokenPayload"],"sources":["../../../../src/core/oauth2/grant-types/refresh-token.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { JWTError } from '@authup/specs';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { IOAuth2TokenIssuer, IOAuth2TokenRevoker, IOAuth2TokenVerifier } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport type { IOAuth2Grant, OAuth2GrantRunWIthOptions, OAuth2RefreshTokenGrantContext } from './types.ts';\n\nexport class OAuth2RefreshTokenGrant extends OAuth2BaseGrant<string | OAuth2TokenPayload> implements IOAuth2Grant {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    protected tokenVerifier : IOAuth2TokenVerifier;\n\n    protected tokenRevoker : IOAuth2TokenRevoker;\n\n    constructor(ctx: OAuth2RefreshTokenGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n\n        this.tokenVerifier = ctx.tokenVerifier;\n        this.tokenRevoker = ctx.tokenRevoker;\n    }\n\n    async runWith(\n        input: string | OAuth2TokenPayload,\n        options: OAuth2GrantRunWIthOptions = {},\n    ) : Promise<OAuth2TokenGrantResponse> {\n        let payload : OAuth2TokenPayload;\n        if (typeof input === 'string') {\n            payload = await this.tokenVerifier.verify(input);\n        } else {\n            payload = input;\n        }\n\n        await this.tokenRevoker.revoke(payload);\n\n        if (!payload.session_id) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        const session = await this.sessionManager.findOneById(payload.session_id);\n        if (!session) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        await this.sessionManager.verify(session);\n\n        if (options.userAgent) {\n            session.user_agent = options.userAgent;\n        }\n        if (options.ipAddress) {\n            session.ip_address = options.ipAddress;\n        }\n        await this.sessionManager.refresh(session);\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({\n            ...payload,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            exp: this.accessTokenIssuer.buildExp(),\n        });\n\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue({\n            ...payload,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            exp: this.refreshTokenIssuer.buildExp(),\n        });\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;AAcA,IAAaG,0BAAb,cAA6CD,gBAAAA;CAC/BE;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;AAC7C,QAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;GACxB,CAAA;AAEA,OAAKL,qBAAqBG,IAAIH;AAE9B,OAAKC,gBAAgBE,IAAIF;AACzB,OAAKC,eAAeC,IAAID;;CAG5B,MAAMI,QACFC,OACAC,UAAqC,EAAE,EACL;EAClC,IAAIC;AACJ,MAAI,OAAOF,UAAU,SACjBE,WAAU,MAAM,KAAKR,cAAcS,OAAOH,MAAAA;MAE1CE,WAAUF;AAGd,QAAM,KAAKL,aAAaS,OAAOF,QAAAA;AAE/B,MAAI,CAACA,QAAQG,WACT,OAAMhB,SAASiB,uBAAuB,aAAA;EAG1C,MAAMC,UAAU,MAAM,KAAKT,eAAeU,YAAYN,QAAQG,WAAU;AACxE,MAAI,CAACE,QACD,OAAMlB,SAASiB,uBAAuB,aAAA;AAG1C,QAAM,KAAKR,eAAeK,OAAOI,QAAAA;AAEjC,MAAIN,QAAQQ,UACRF,SAAQG,aAAaT,QAAQQ;AAEjC,MAAIR,QAAQU,UACRJ,SAAQK,aAAaX,QAAQU;AAEjC,QAAM,KAAKb,eAAee,QAAQN,QAAAA;EAElC,MAAM,CAACO,aAAaC,sBAAsB,MAAM,KAAKlB,kBAAkBmB,MAAM;GACzE,GAAGd;GACHQ,YAAYH,QAAQG;GACpBO,gBAAgBV,QAAQK;GACxBM,KAAK,KAAKrB,kBAAkBsB,UAAQ;GACxC,CAAA;EAEA,MAAM,CAACC,cAAcC,uBAAuB,MAAM,KAAK5B,mBAAmBuB,MAAM;GAC5E,GAAGd;GACHQ,YAAYH,QAAQG;GACpBO,gBAAgBV,QAAQK;GACxBM,KAAK,KAAKzB,mBAAmB0B,UAAQ;GACzC,CAAA;AAEA,SAAO7B,+BAA+B;GAClCwB;GACAC;GACAK;GACAC;GACJ,CAAA"}

package/dist/core/oauth2/grant-types/robot-credentials.mjs

@@ -0,0 +1,35 @@
+import { OAuth2BaseGrant } from "./base.mjs";
+import { buildOAuth2BearerTokenResponse } from "../response/bearer.mjs";
+import { IdentityType, ScopeName } from "@authup/core-kit";
+import { OAuth2SubKind } from "@authup/specs";
+//#region src/core/oauth2/grant-types/robot-credentials.ts
+var RobotCredentialsGrant = class extends OAuth2BaseGrant {
+	async runWith(input, options = {}) {
+		const session = await this.sessionManager.create({
+			user_agent: options.userAgent,
+			ip_address: options.ipAddress,
+			realm_id: input.realm_id,
+			sub: input.id,
+			sub_kind: IdentityType.ROBOT
+		});
+		const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({
+			session_id: session.id,
+			user_agent: session.user_agent,
+			remote_address: session.ip_address,
+			scope: ScopeName.GLOBAL,
+			sub: input.id,
+			sub_kind: OAuth2SubKind.ROBOT,
+			realm_id: input.realm.id,
+			realm_name: input.realm?.id,
+			client_id: input.client_id || void 0
+		});
+		return buildOAuth2BearerTokenResponse({
+			accessToken,
+			accessTokenPayload
+		});
+	}
+};
+//#endregion
+export { RobotCredentialsGrant };
+
+//# sourceMappingURL=robot-credentials.mjs.map

package/dist/core/oauth2/grant-types/robot-credentials.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"robot-credentials.mjs","names":["OAuth2SubKind","IdentityType","ScopeName","OAuth2BaseGrant","buildOAuth2BearerTokenResponse","RobotCredentialsGrant","runWith","input","options","session","sessionManager","create","user_agent","userAgent","ip_address","ipAddress","realm_id","sub","id","sub_kind","ROBOT","accessToken","accessTokenPayload","accessTokenIssuer","issue","session_id","remote_address","scope","GLOBAL","realm","realm_name","client_id","undefined"],"sources":["../../../../src/core/oauth2/grant-types/robot-credentials.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2SubKind } from '@authup/specs';\nimport type { Robot } from '@authup/core-kit';\nimport {\n    IdentityType,\n    ScopeName,\n} from '@authup/core-kit';\nimport { OAuth2BaseGrant } from './base.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { OAuth2GrantRunWIthOptions } from './types.ts';\n\nexport class RobotCredentialsGrant extends OAuth2BaseGrant<Robot> {\n    async runWith(input: Robot, options: OAuth2GrantRunWIthOptions = {}) : Promise<OAuth2TokenGrantResponse> {\n        const session = await this.sessionManager.create({\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: input.realm_id,\n            sub: input.id,\n            sub_kind: IdentityType.ROBOT,\n        });\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({\n            session_id: session.id,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            scope: ScopeName.GLOBAL,\n            sub: input.id,\n            sub_kind: OAuth2SubKind.ROBOT,\n            realm_id: input.realm.id,\n            realm_name: input.realm?.id,\n            client_id: input.client_id || undefined,\n        });\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;AAkBA,IAAaK,wBAAb,cAA2CF,gBAAAA;CACvC,MAAMG,QAAQC,OAAcC,UAAqC,EAAE,EAAsC;EACrG,MAAMC,UAAU,MAAM,KAAKC,eAAeC,OAAO;GAC7CC,YAAYJ,QAAQK;GACpBC,YAAYN,QAAQO;GACpBC,UAAUT,MAAMS;GAChBC,KAAKV,MAAMW;GACXC,UAAUlB,aAAamB;GAC3B,CAAA;EAEA,MAAM,CAACC,aAAaC,sBAAsB,MAAM,KAAKC,kBAAkBC,MAAM;GACzEC,YAAYhB,QAAQS;GACpBN,YAAYH,QAAQG;GACpBc,gBAAgBjB,QAAQK;GACxBa,OAAOzB,UAAU0B;GACjBX,KAAKV,MAAMW;GACXC,UAAUnB,cAAcoB;GACxBJ,UAAUT,MAAMsB,MAAMX;GACtBY,YAAYvB,MAAMsB,OAAOX;GACzBa,WAAWxB,MAAMwB,aAAaC,KAAAA;GAClC,CAAA;AAEA,SAAO5B,+BAA+B;GAClCiB;GACAC;GACJ,CAAA"}

package/dist/core/oauth2/grant-types/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/helpers/erorr.mjs

@@ -0,0 +1,26 @@
+import { sanitizeError } from "../../../utils/error.mjs";
+import "../../../utils/index.mjs";
+import { isObject } from "@authup/kit";
+import { OAuth2Error, OAuth2ErrorCode } from "@authup/specs";
+import { AuthupError } from "@authup/errors";
+//#region src/core/oauth2/helpers/erorr.ts
+/**
+* Transforms an unknown error to an OAuth2Error.
+*
+* @param err
+*/ function toOAuth2Error(err) {
+	if (err instanceof OAuth2Error) return err;
+	let next;
+	if (err instanceof AuthupError) next = err;
+	else next = sanitizeError(err);
+	next.data = {
+		error: OAuth2ErrorCode.INVALID_REQUEST,
+		error_description: next.message,
+		...isObject(next.data) ? next.data : {}
+	};
+	return next;
+}
+//#endregion
+export { toOAuth2Error };
+
+//# sourceMappingURL=erorr.mjs.map

package/dist/core/oauth2/helpers/erorr.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"erorr.mjs","names":["OAuth2Error","OAuth2ErrorCode","AuthupError","isObject","sanitizeError","toOAuth2Error","err","next","data","error","INVALID_REQUEST","error_description","message"],"sources":["../../../../src/core/oauth2/helpers/erorr.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { OAuth2Error, OAuth2ErrorCode } from '@authup/specs';\nimport { AuthupError } from '@authup/errors';\nimport { isObject } from '@authup/kit';\nimport { sanitizeError } from '../../../utils/index.ts';\n\n/**\n * Transforms an unknown error to an OAuth2Error.\n *\n * @param err\n */\nexport function toOAuth2Error(err: unknown) : AuthupError | OAuth2Error {\n    if (err instanceof OAuth2Error) {\n        return err;\n    }\n\n    let next : AuthupError;\n    if (err instanceof AuthupError) {\n        next = err;\n    } else {\n        next = sanitizeError(err);\n    }\n\n    next.data = {\n        error: OAuth2ErrorCode.INVALID_REQUEST,\n        error_description: next.message,\n        ...(isObject(next.data) ? next.data : {}),\n    };\n\n    return next;\n}\n"],"mappings":";;;;;;;;;;GAiBA,SAAgBK,cAAcC,KAAY;AACtC,KAAIA,eAAeN,YACf,QAAOM;CAGX,IAAIC;AACJ,KAAID,eAAeJ,YACfK,QAAOD;KAEPC,QAAOH,cAAcE,IAAAA;AAGzBC,MAAKC,OAAO;EACRC,OAAOR,gBAAgBS;EACvBC,mBAAmBJ,KAAKK;EACxB,GAAIT,SAASI,KAAKC,KAAI,GAAID,KAAKC,OAAO,EAAE;EAC5C;AAEA,QAAOD"}

package/dist/core/oauth2/helpers/index.mjs

@@ -0,0 +1,2 @@
+import { toOAuth2Error } from "./erorr.mjs";
+export { toOAuth2Error };

package/dist/core/oauth2/index.mjs

@@ -0,0 +1,28 @@
+import { OAuth2AuthorizationCodeIssuer } from "./authorization/code/issuer/module.mjs";
+import { base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, generateOAuth2CodeVerifier } from "./authorization/helpers.mjs";
+import { OAuth2AuthorizationCodeVerifier } from "./authorization/code/verifier/module.mjs";
+import { OAuth2AuthorizationCodeRequestVerifier } from "./authorization/code-request/verifier/module.mjs";
+import { OAuth2AuthorizationCodeRequestValidator } from "./authorization/code-request/validator.mjs";
+import { OAuth2AuthorizationStateManager } from "./authorization/state/module.mjs";
+import { OAuth2Authorization } from "./authorization/module.mjs";
+import "./authorization/index.mjs";
+import { buildOAuth2BearerTokenResponse } from "./response/bearer.mjs";
+import { OAuth2AuthorizeGrant } from "./grant-types/authorize.mjs";
+import { ClientCredentialsGrant } from "./grant-types/client-credentials.mjs";
+import { IdentityGrantType } from "./grant-types/identity.mjs";
+import { PasswordGrantType } from "./grant-types/password.mjs";
+import { OAuth2RefreshTokenGrant } from "./grant-types/refresh-token.mjs";
+import { RobotCredentialsGrant } from "./grant-types/robot-credentials.mjs";
+import "./grant-types/index.mjs";
+import { OAuth2OpenIDClaimsBuilder } from "./openid/claims.mjs";
+import "./openid/index.mjs";
+import { OAuth2ScopeAttributesResolver } from "./scope/resolver.mjs";
+import "./scope/index.mjs";
+import { OAuth2AccessTokenIssuer } from "./token/issuer/access/module.mjs";
+import { OAuth2OpenIDTokenIssuer } from "./token/issuer/open-id/module.mjs";
+import { OAuth2RefreshTokenIssuer } from "./token/issuer/refresh/module.mjs";
+import { OAuth2TokenRevoker } from "./token/revoker/module.mjs";
+import { OAuth2TokenSigner } from "./token/signer/module.mjs";
+import { OAuth2TokenVerifier } from "./token/verifier/module.mjs";
+import "./token/index.mjs";
+export { ClientCredentialsGrant, IdentityGrantType, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PasswordGrantType, RobotCredentialsGrant, base64URLEncode, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, generateOAuth2CodeVerifier };

package/dist/core/oauth2/key/index.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/key/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/openid/claims.mjs

@@ -0,0 +1,75 @@
+import { hasOwnProperty } from "@authup/kit";
+import { OAuth2SubKind } from "@authup/specs";
+//#region src/core/oauth2/openid/claims.ts
+var OAuth2OpenIDClaimsBuilder = class {
+	clientMap = {
+		name: "name",
+		nickname: "name",
+		preferred_username: "name",
+		updated_at: ["updated_at", (value) => {
+			if (typeof value === "string") return Math.floor(new Date(value).getTime() / 1e3);
+			if (value instanceof Date) return Math.floor(value.getTime() / 1e3);
+			return value;
+		}]
+	};
+	robotMap = {
+		name: "name",
+		nickname: "name",
+		preferred_username: "name",
+		updated_at: ["updated_at", (value) => {
+			if (typeof value === "string") return Math.floor(new Date(value).getTime() / 1e3);
+			if (value instanceof Date) return Math.floor(value.getTime() / 1e3);
+			return value;
+		}]
+	};
+	userMap = {
+		name: "name",
+		family_name: "last_name",
+		given_name: "first_name",
+		nickname: "display_name",
+		preferred_username: "display_name",
+		updated_at: ["updated_at", (value) => {
+			if (typeof value === "string") return Math.floor(new Date(value).getTime() / 1e3);
+			if (value instanceof Date) return Math.floor(value.getTime() / 1e3);
+			return value;
+		}],
+		email: "email",
+		email_verified: "active"
+	};
+	/**
+	* Build OpenID Claims form Oauth2 Identity.
+	*
+	* @param identity
+	*/ fromIdentity(identity) {
+		if (identity.type === OAuth2SubKind.CLIENT) return this.fromClient(identity.data);
+		if (identity.type === OAuth2SubKind.ROBOT) return this.fromRobot(identity.data);
+		return this.fromUser(identity.data);
+	}
+	fromClient(input) {
+		return this.extract(this.clientMap, input);
+	}
+	fromRobot(input) {
+		return this.extract(this.robotMap, input);
+	}
+	fromUser(input) {
+		return this.extract(this.userMap, input);
+	}
+	extract(attributeMap, attributes) {
+		const result = {};
+		const keys = Object.keys(attributeMap);
+		for (const key_ of keys) {
+			const attribute = attributeMap[key_];
+			if (typeof attribute === "string") {
+				if (hasOwnProperty(attributes, attribute)) result[key_] = attributes[attribute];
+			} else {
+				const [key, transformer] = attribute;
+				if (hasOwnProperty(attributes, key)) result[key_] = transformer(attributes[key]);
+			}
+		}
+		return result;
+	}
+};
+//#endregion
+export { OAuth2OpenIDClaimsBuilder };
+
+//# sourceMappingURL=claims.mjs.map

package/dist/core/oauth2/openid/claims.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.mjs","names":["hasOwnProperty","OAuth2SubKind","OAuth2OpenIDClaimsBuilder","clientMap","name","nickname","preferred_username","updated_at","value","Math","floor","Date","getTime","robotMap","userMap","family_name","given_name","email","email_verified","fromIdentity","identity","type","CLIENT","fromClient","data","ROBOT","fromRobot","fromUser","input","extract","attributeMap","attributes","result","keys","Object","key_","attribute","key","transformer"],"sources":["../../../../src/core/oauth2/openid/claims.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Client, \n    Identity, \n    Robot, \n    User,\n} from '@authup/core-kit';\nimport { hasOwnProperty } from '@authup/kit';\nimport type { OpenIDTokenPayload } from '@authup/specs';\nimport { OAuth2SubKind } from '@authup/specs';\nimport type { ObjectLiteral } from 'validup';\n\ntype AttributeMapTuple<T> = {\n    [K in keyof T]: [K, (value: unknown) => any]\n}[keyof T];\n\ntype AttributeMap<T extends Record<string, any>> = Record<\n    keyof OpenIDTokenPayload,\nkeyof T | AttributeMapTuple<T>\n>;\n\nexport class OAuth2OpenIDClaimsBuilder {\n    protected clientMap : AttributeMap<Client> = {\n        name: 'name',\n        nickname: 'name',\n        preferred_username: 'name',\n        updated_at: [\n            'updated_at',\n            (value: unknown) => {\n                if (typeof value === 'string') {\n                    return Math.floor(new Date(value).getTime() / 1000);\n                }\n\n                if (value instanceof Date) {\n                    return Math.floor(value.getTime() / 1000);\n                }\n\n                return value;\n            },\n        ],\n    };\n\n    protected robotMap : AttributeMap<Robot> = {\n        name: 'name',\n        nickname: 'name',\n        preferred_username: 'name',\n        updated_at: [\n            'updated_at',\n            (value: unknown) => {\n                if (typeof value === 'string') {\n                    return Math.floor(new Date(value).getTime() / 1000);\n                }\n\n                if (value instanceof Date) {\n                    return Math.floor(value.getTime() / 1000);\n                }\n\n                return value;\n            },\n        ],\n    };\n\n    protected userMap : AttributeMap<User> = {\n        name: 'name',\n        family_name: 'last_name',\n        given_name: 'first_name',\n        nickname: 'display_name',\n        preferred_username: 'display_name',\n        updated_at: [\n            'updated_at',\n            (value: unknown) => {\n                if (typeof value === 'string') {\n                    return Math.floor(new Date(value).getTime() / 1000);\n                }\n\n                if (value instanceof Date) {\n                    return Math.floor(value.getTime() / 1000);\n                }\n\n                return value;\n            },\n        ],\n\n        email: 'email',\n        email_verified: 'active',\n    };\n\n    /**\n     * Build OpenID Claims form Oauth2 Identity.\n     *\n     * @param identity\n     */\n    fromIdentity(identity: Identity) : OpenIDTokenPayload {\n        if (identity.type === OAuth2SubKind.CLIENT) {\n            return this.fromClient(identity.data);\n        }\n\n        if (identity.type === OAuth2SubKind.ROBOT) {\n            return this.fromRobot(identity.data);\n        }\n\n        return this.fromUser(identity.data);\n    }\n\n    fromClient(input: Client) : OpenIDTokenPayload {\n        return this.extract(this.clientMap, input);\n    }\n\n    fromRobot(input: Robot): OpenIDTokenPayload {\n        return this.extract(this.robotMap, input);\n    }\n\n    fromUser(input: User) : OpenIDTokenPayload {\n        return this.extract(this.userMap, input);\n    }\n\n    protected extract<T extends ObjectLiteral = ObjectLiteral>(\n        attributeMap: AttributeMap<T>,\n        attributes: T,\n    ) : OpenIDTokenPayload {\n        const result = {} as OpenIDTokenPayload;\n\n        const keys = Object.keys(attributeMap);\n        for (const key_ of keys) {\n            const attribute = attributeMap[key_];\n            if (typeof attribute === 'string') {\n                if (hasOwnProperty(attributes, attribute)) {\n                    result[key_] = attributes[attribute];\n                }\n            } else {\n                const [key, transformer] = attribute as AttributeMapTuple<T>;\n\n                if (hasOwnProperty(attributes, key)) {\n                    result[key_] = transformer(attributes[key]);\n                }\n            }\n        }\n\n        return result;\n    }\n}\n"],"mappings":";;;AA2BA,IAAaE,4BAAb,MAAaA;CACCC,YAAmC;EACzCC,MAAM;EACNC,UAAU;EACVC,oBAAoB;EACpBC,YAAY,CACR,eACCC,UAAAA;AACG,OAAI,OAAOA,UAAU,SACjB,QAAOC,KAAKC,MAAM,IAAIC,KAAKH,MAAAA,CAAOI,SAAO,GAAK,IAAA;AAGlD,OAAIJ,iBAAiBG,KACjB,QAAOF,KAAKC,MAAMF,MAAMI,SAAO,GAAK,IAAA;AAGxC,UAAOJ;IAEd;EACL;CAEUK,WAAiC;EACvCT,MAAM;EACNC,UAAU;EACVC,oBAAoB;EACpBC,YAAY,CACR,eACCC,UAAAA;AACG,OAAI,OAAOA,UAAU,SACjB,QAAOC,KAAKC,MAAM,IAAIC,KAAKH,MAAAA,CAAOI,SAAO,GAAK,IAAA;AAGlD,OAAIJ,iBAAiBG,KACjB,QAAOF,KAAKC,MAAMF,MAAMI,SAAO,GAAK,IAAA;AAGxC,UAAOJ;IAEd;EACL;CAEUM,UAA+B;EACrCV,MAAM;EACNW,aAAa;EACbC,YAAY;EACZX,UAAU;EACVC,oBAAoB;EACpBC,YAAY,CACR,eACCC,UAAAA;AACG,OAAI,OAAOA,UAAU,SACjB,QAAOC,KAAKC,MAAM,IAAIC,KAAKH,MAAAA,CAAOI,SAAO,GAAK,IAAA;AAGlD,OAAIJ,iBAAiBG,KACjB,QAAOF,KAAKC,MAAMF,MAAMI,SAAO,GAAK,IAAA;AAGxC,UAAOJ;IAEd;EAEDS,OAAO;EACPC,gBAAgB;EACpB;;;;;IAOAC,aAAaC,UAAyC;AAClD,MAAIA,SAASC,SAASpB,cAAcqB,OAChC,QAAO,KAAKC,WAAWH,SAASI,KAAI;AAGxC,MAAIJ,SAASC,SAASpB,cAAcwB,MAChC,QAAO,KAAKC,UAAUN,SAASI,KAAI;AAGvC,SAAO,KAAKG,SAASP,SAASI,KAAI;;CAGtCD,WAAWK,OAAoC;AAC3C,SAAO,KAAKC,QAAQ,KAAK1B,WAAWyB,MAAAA;;CAGxCF,UAAUE,OAAkC;AACxC,SAAO,KAAKC,QAAQ,KAAKhB,UAAUe,MAAAA;;CAGvCD,SAASC,OAAkC;AACvC,SAAO,KAAKC,QAAQ,KAAKf,SAASc,MAAAA;;CAG5BC,QACNC,cACAC,YACmB;EACnB,MAAMC,SAAS,EAAC;EAEhB,MAAMC,OAAOC,OAAOD,KAAKH,aAAAA;AACzB,OAAK,MAAMK,QAAQF,MAAM;GACrB,MAAMG,YAAYN,aAAaK;AAC/B,OAAI,OAAOC,cAAc;QACjBpC,eAAe+B,YAAYK,UAAAA,CAC3BJ,QAAOG,QAAQJ,WAAWK;UAE3B;IACH,MAAM,CAACC,KAAKC,eAAeF;AAE3B,QAAIpC,eAAe+B,YAAYM,IAAAA,CAC3BL,QAAOG,QAAQG,YAAYP,WAAWM,KAAI;;;AAKtD,SAAOL"}

package/dist/core/oauth2/openid/index.mjs

@@ -0,0 +1,2 @@
+import { OAuth2OpenIDClaimsBuilder } from "./claims.mjs";
+export { OAuth2OpenIDClaimsBuilder };

package/dist/core/oauth2/response/bearer.mjs

@@ -0,0 +1,24 @@
+//#region src/core/oauth2/response/bearer.ts
+function resolveExpiresIn(payload, fallbackValue) {
+	if (payload && payload.exp) return payload.exp - Math.floor((/* @__PURE__ */ new Date()).getTime() / 1e3);
+	return fallbackValue || 3600;
+}
+function buildOAuth2BearerTokenResponse(context) {
+	const response = {
+		access_token: context.accessToken,
+		expires_in: resolveExpiresIn(context.accessTokenPayload),
+		token_type: "Bearer"
+	};
+	if (context.accessTokenPayload) response.scope = context.accessTokenPayload.scope;
+	else if (context.scope) response.scope = context.scope;
+	if (context.refreshToken) {
+		response.refresh_token = context.refreshToken;
+		response.refresh_token_expires_in = resolveExpiresIn(context.refreshTokenPayload);
+	}
+	if (context.idToken) response.id_token = context.idToken;
+	return response;
+}
+//#endregion
+export { buildOAuth2BearerTokenResponse };
+
+//# sourceMappingURL=bearer.mjs.map

package/dist/core/oauth2/response/bearer.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer.mjs","names":["resolveExpiresIn","payload","fallbackValue","exp","Math","floor","Date","getTime","buildOAuth2BearerTokenResponse","context","response","access_token","accessToken","expires_in","accessTokenPayload","token_type","scope","refreshToken","refresh_token","refresh_token_expires_in","refreshTokenPayload","idToken","id_token"],"sources":["../../../../src/core/oauth2/response/bearer.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport type { OAuth2BearerResponseBuildContext } from './type.ts';\n\nfunction resolveExpiresIn(payload?: OAuth2TokenPayload, fallbackValue?: number) : number {\n    if (payload && payload.exp) {\n        return payload.exp - Math.floor(new Date().getTime() / 1000);\n    }\n\n    return fallbackValue || 3_600;\n}\n\nexport function buildOAuth2BearerTokenResponse(\n    context: OAuth2BearerResponseBuildContext,\n) : OAuth2TokenGrantResponse {\n    const response : OAuth2TokenGrantResponse = {\n        access_token: context.accessToken,\n        expires_in: resolveExpiresIn(context.accessTokenPayload),\n        token_type: 'Bearer',\n    };\n\n    if (context.accessTokenPayload) {\n        response.scope = context.accessTokenPayload.scope;\n    } else if (context.scope) {\n        response.scope = context.scope;\n    }\n\n    if (context.refreshToken) {\n        response.refresh_token = context.refreshToken;\n        response.refresh_token_expires_in = resolveExpiresIn(context.refreshTokenPayload);\n    }\n\n    if (context.idToken) {\n        response.id_token = context.idToken;\n    }\n\n    return response;\n}\n"],"mappings":";AAUA,SAASA,iBAAiBC,SAA8BC,eAAsB;AAC1E,KAAID,WAAWA,QAAQE,IACnB,QAAOF,QAAQE,MAAMC,KAAKC,uBAAM,IAAIC,MAAAA,EAAOC,SAAO,GAAK,IAAA;AAG3D,QAAOL,iBAAiB;;AAG5B,SAAgBM,+BACZC,SAAyC;CAEzC,MAAMC,WAAsC;EACxCC,cAAcF,QAAQG;EACtBC,YAAYb,iBAAiBS,QAAQK,mBAAkB;EACvDC,YAAY;EAChB;AAEA,KAAIN,QAAQK,mBACRJ,UAASM,QAAQP,QAAQK,mBAAmBE;UACrCP,QAAQO,MACfN,UAASM,QAAQP,QAAQO;AAG7B,KAAIP,QAAQQ,cAAc;AACtBP,WAASQ,gBAAgBT,QAAQQ;AACjCP,WAASS,2BAA2BnB,iBAAiBS,QAAQW,oBAAmB;;AAGpF,KAAIX,QAAQY,QACRX,UAASY,WAAWb,QAAQY;AAGhC,QAAOX"}

package/dist/core/oauth2/response/index.mjs

@@ -0,0 +1,2 @@
+import { buildOAuth2BearerTokenResponse } from "./bearer.mjs";
+export { buildOAuth2BearerTokenResponse };

package/dist/core/oauth2/response/type.mjs

@@ -0,0 +1 @@
+export {};