@authup/server-core 1.0.0-beta.36 → 1.0.0-beta.37

package/dist/core/oauth2/scope/index.mjs

@@ -0,0 +1,2 @@
+import { OAuth2ScopeAttributesResolver } from "./resolver.mjs";
+export { OAuth2ScopeAttributesResolver };

package/dist/core/oauth2/scope/resolver.mjs

@@ -0,0 +1,93 @@
+import { ScopeName } from "@authup/core-kit";
+import { hasOwnProperty } from "@authup/kit";
+import { OAuth2SubKind, unwrapOAuth2Scope } from "@authup/specs";
+import { distinctArray } from "smob";
+//#region src/core/oauth2/scope/resolver.ts
+var OAuth2ScopeAttributesResolver = class {
+	clientAttributes = {
+		[ScopeName.IDENTITY]: ["name"],
+		[ScopeName.OPEN_ID]: [
+			"name",
+			"display_name",
+			"updated_at",
+			"active"
+		]
+	};
+	robotAttributes = {
+		[ScopeName.IDENTITY]: ["name"],
+		[ScopeName.OPEN_ID]: [
+			"name",
+			"display_name",
+			"updated_at",
+			"active"
+		]
+	};
+	userAttributes = {
+		[ScopeName.IDENTITY]: [
+			"name",
+			"display_name",
+			"last_name",
+			"first_name"
+		],
+		[ScopeName.EMAIL]: ["email"],
+		[ScopeName.OPEN_ID]: [
+			"name",
+			"updated_at",
+			"first_name",
+			"last_name",
+			"display_name",
+			"active",
+			"email"
+		]
+	};
+	/**
+	* Resolve attributes for sub kind.
+	*
+	* @param type
+	* @param scope
+	*/ resolveFor(type, scope) {
+		if (type === OAuth2SubKind.CLIENT) return this.resolveForClient(scope);
+		if (type === OAuth2SubKind.ROBOT) return this.resolveForRobot(scope);
+		return this.resolveForUser(scope);
+	}
+	resolveForClient(scope) {
+		const attributes = [];
+		const scopes = unwrapOAuth2Scope(scope);
+		for (const scope of scopes) {
+			if (hasOwnProperty(this.clientAttributes, scope)) attributes.push(...this.clientAttributes[scope]);
+			if (scope === ScopeName.GLOBAL) {
+				attributes.push(...Object.values(this.clientAttributes).flat());
+				break;
+			}
+		}
+		return distinctArray(attributes);
+	}
+	resolveForRobot(scope) {
+		const attributes = [];
+		const scopes = unwrapOAuth2Scope(scope);
+		for (const scope of scopes) {
+			if (hasOwnProperty(this.robotAttributes, scope)) attributes.push(...this.robotAttributes[scope]);
+			if (scope === ScopeName.GLOBAL) {
+				attributes.push(...Object.values(this.robotAttributes).flat());
+				break;
+			}
+		}
+		return distinctArray(attributes);
+	}
+	resolveForUser(scope) {
+		const attributes = [];
+		const scopes = unwrapOAuth2Scope(scope);
+		for (const scope of scopes) {
+			if (hasOwnProperty(this.userAttributes, scope)) attributes.push(...this.userAttributes[scope]);
+			if (scope === ScopeName.GLOBAL) {
+				attributes.push(...Object.values(this.userAttributes).flat());
+				break;
+			}
+		}
+		return distinctArray(attributes);
+	}
+};
+//#endregion
+export { OAuth2ScopeAttributesResolver };
+
+//# sourceMappingURL=resolver.mjs.map

package/dist/core/oauth2/scope/resolver.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.mjs","names":["ScopeName","hasOwnProperty","OAuth2SubKind","unwrapOAuth2Scope","distinctArray","OAuth2ScopeAttributesResolver","clientAttributes","IDENTITY","OPEN_ID","robotAttributes","userAttributes","EMAIL","resolveFor","type","scope","CLIENT","resolveForClient","ROBOT","resolveForRobot","resolveForUser","attributes","scopes","push","GLOBAL","Object","values","flat"],"sources":["../../../../src/core/oauth2/scope/resolver.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Client, Robot, User } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport { hasOwnProperty } from '@authup/kit';\nimport { OAuth2SubKind, unwrapOAuth2Scope } from '@authup/specs';\nimport { distinctArray } from 'smob';\nimport type { ObjectLiteral } from 'validup';\n\ntype ScopeFields<T extends ObjectLiteral = ObjectLiteral> = {\n    [key: string]: (keyof T & string)[]\n};\n\nexport class OAuth2ScopeAttributesResolver {\n    protected clientAttributes : ScopeFields<Client> = {\n        [ScopeName.IDENTITY]: ['name'],\n        [ScopeName.OPEN_ID]: ['name', 'display_name', 'updated_at', 'active'],\n    };\n\n    protected robotAttributes : ScopeFields<Robot> = {\n        [ScopeName.IDENTITY]: ['name'],\n        [ScopeName.OPEN_ID]: ['name', 'display_name', 'updated_at', 'active'],\n    };\n\n    protected userAttributes : ScopeFields<User> = {\n        [ScopeName.IDENTITY]: ['name', 'display_name', 'last_name', 'first_name'],\n        [ScopeName.EMAIL]: ['email'],\n        [ScopeName.OPEN_ID]: ['name', 'updated_at', 'first_name', 'last_name', 'display_name', 'active', 'email'],\n    };\n\n    /**\n     * Resolve attributes for sub kind.\n     *\n     * @param type\n     * @param scope\n     */\n    resolveFor(type: OAuth2SubKind, scope: string | string[]) {\n        if (type === OAuth2SubKind.CLIENT) {\n            return this.resolveForClient(scope);\n        }\n\n        if (type === OAuth2SubKind.ROBOT) {\n            return this.resolveForRobot(scope);\n        }\n\n        return this.resolveForUser(scope);\n    }\n\n    resolveForClient(scope: string | string[]) : string[] {\n        const attributes : string[] = [];\n        const scopes = unwrapOAuth2Scope(scope);\n\n        for (const scope of scopes) {\n            if (hasOwnProperty(this.clientAttributes, scope)) {\n                attributes.push(...this.clientAttributes[scope]);\n            }\n\n            if (scope === ScopeName.GLOBAL) {\n                attributes.push(...Object.values(this.clientAttributes).flat());\n                break;\n            }\n        }\n\n        return distinctArray(attributes);\n    }\n\n    resolveForRobot(scope: string | string[]) : string[] {\n        const attributes : string[] = [];\n        const scopes = unwrapOAuth2Scope(scope);\n\n        for (const scope of scopes) {\n            if (hasOwnProperty(this.robotAttributes, scope)) {\n                attributes.push(...this.robotAttributes[scope]);\n            }\n\n            if (scope === ScopeName.GLOBAL) {\n                attributes.push(...Object.values(this.robotAttributes).flat());\n                break;\n            }\n        }\n\n        return distinctArray(attributes);\n    }\n\n    resolveForUser(scope: string | string[]) : string[] {\n        const attributes : string[] = [];\n        const scopes = unwrapOAuth2Scope(scope);\n\n        for (const scope of scopes) {\n            if (hasOwnProperty(this.userAttributes, scope)) {\n                attributes.push(...this.userAttributes[scope]);\n            }\n\n            if (scope === ScopeName.GLOBAL) {\n                attributes.push(...Object.values(this.userAttributes).flat());\n                break;\n            }\n        }\n\n        return distinctArray(attributes);\n    }\n}\n"],"mappings":";;;;;AAkBA,IAAaK,gCAAb,MAAaA;CACCC,mBAAyC;GAC9CN,UAAUO,WAAW,CAAC,OAAO;GAC7BP,UAAUQ,UAAU;GAAC;GAAQ;GAAgB;GAAc;GAAS;EACzE;CAEUC,kBAAuC;GAC5CT,UAAUO,WAAW,CAAC,OAAO;GAC7BP,UAAUQ,UAAU;GAAC;GAAQ;GAAgB;GAAc;GAAS;EACzE;CAEUE,iBAAqC;GAC1CV,UAAUO,WAAW;GAAC;GAAQ;GAAgB;GAAa;GAAa;GACxEP,UAAUW,QAAQ,CAAC,QAAQ;GAC3BX,UAAUQ,UAAU;GAAC;GAAQ;GAAc;GAAc;GAAa;GAAgB;GAAU;GAAQ;EAC7G;;;;;;IAQAI,WAAWC,MAAqBC,OAA0B;AACtD,MAAID,SAASX,cAAca,OACvB,QAAO,KAAKC,iBAAiBF,MAAAA;AAGjC,MAAID,SAASX,cAAce,MACvB,QAAO,KAAKC,gBAAgBJ,MAAAA;AAGhC,SAAO,KAAKK,eAAeL,MAAAA;;CAG/BE,iBAAiBF,OAAqC;EAClD,MAAMM,aAAwB,EAAE;EAChC,MAAMC,SAASlB,kBAAkBW,MAAAA;AAEjC,OAAK,MAAMA,SAASO,QAAQ;AACxB,OAAIpB,eAAe,KAAKK,kBAAkBQ,MAAAA,CACtCM,YAAWE,KAAI,GAAI,KAAKhB,iBAAiBQ,OAAM;AAGnD,OAAIA,UAAUd,UAAUuB,QAAQ;AAC5BH,eAAWE,KAAI,GAAIE,OAAOC,OAAO,KAAKnB,iBAAgB,CAAEoB,MAAI,CAAA;AAC5D;;;AAIR,SAAOtB,cAAcgB,WAAAA;;CAGzBF,gBAAgBJ,OAAqC;EACjD,MAAMM,aAAwB,EAAE;EAChC,MAAMC,SAASlB,kBAAkBW,MAAAA;AAEjC,OAAK,MAAMA,SAASO,QAAQ;AACxB,OAAIpB,eAAe,KAAKQ,iBAAiBK,MAAAA,CACrCM,YAAWE,KAAI,GAAI,KAAKb,gBAAgBK,OAAM;AAGlD,OAAIA,UAAUd,UAAUuB,QAAQ;AAC5BH,eAAWE,KAAI,GAAIE,OAAOC,OAAO,KAAKhB,gBAAe,CAAEiB,MAAI,CAAA;AAC3D;;;AAIR,SAAOtB,cAAcgB,WAAAA;;CAGzBD,eAAeL,OAAqC;EAChD,MAAMM,aAAwB,EAAE;EAChC,MAAMC,SAASlB,kBAAkBW,MAAAA;AAEjC,OAAK,MAAMA,SAASO,QAAQ;AACxB,OAAIpB,eAAe,KAAKS,gBAAgBI,MAAAA,CACpCM,YAAWE,KAAI,GAAI,KAAKZ,eAAeI,OAAM;AAGjD,OAAIA,UAAUd,UAAUuB,QAAQ;AAC5BH,eAAWE,KAAI,GAAIE,OAAOC,OAAO,KAAKf,eAAc,CAAEgB,MAAI,CAAA;AAC1D;;;AAIR,SAAOtB,cAAcgB,WAAAA"}

package/dist/core/oauth2/scope/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/token/index.mjs

@@ -0,0 +1,11 @@
+import { OAuth2AccessTokenIssuer } from "./issuer/access/module.mjs";
+import { OAuth2OpenIDTokenIssuer } from "./issuer/open-id/module.mjs";
+import { OAuth2RefreshTokenIssuer } from "./issuer/refresh/module.mjs";
+import "./issuer/index.mjs";
+import { OAuth2TokenRevoker } from "./revoker/module.mjs";
+import "./revoker/index.mjs";
+import { OAuth2TokenSigner } from "./signer/module.mjs";
+import "./signer/index.mjs";
+import { OAuth2TokenVerifier } from "./verifier/module.mjs";
+import "./verifier/index.mjs";
+export { OAuth2AccessTokenIssuer, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenIssuer, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier };

package/dist/core/oauth2/token/issuer/access/index.mjs

@@ -0,0 +1,2 @@
+import { OAuth2AccessTokenIssuer } from "./module.mjs";
+export { OAuth2AccessTokenIssuer };

package/dist/core/oauth2/token/issuer/access/module.mjs

@@ -0,0 +1,28 @@
+import { OAuth2BaseTokenIssuer } from "../base.mjs";
+import { OAuth2TokenKind } from "@authup/specs";
+//#region src/core/oauth2/token/issuer/access/module.ts
+var OAuth2AccessTokenIssuer = class extends OAuth2BaseTokenIssuer {
+	repository;
+	signer;
+	constructor(repository, signer, options = {}) {
+		super(options);
+		this.repository = repository;
+		this.signer = signer;
+	}
+	async issue(input = {}) {
+		const iss = this.buildIss(input);
+		const data = await this.repository.insert({
+			...input,
+			kind: OAuth2TokenKind.ACCESS,
+			exp: this.buildExp(input),
+			...iss ? { iss } : {}
+		});
+		const token = await this.signer.sign(data);
+		await this.repository.saveWithSignature(data, token);
+		return [token, data];
+	}
+};
+//#endregion
+export { OAuth2AccessTokenIssuer };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/token/issuer/access/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["OAuth2TokenKind","OAuth2BaseTokenIssuer","OAuth2AccessTokenIssuer","repository","signer","options","issue","input","iss","buildIss","data","insert","kind","ACCESS","exp","buildExp","token","sign","saveWithSignature"],"sources":["../../../../../../src/core/oauth2/token/issuer/access/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';\n\nexport class OAuth2AccessTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    constructor(\n        repository: IOAuth2TokenRepository,\n        signer: IOAuth2TokenSigner,\n        options: OAuth2TokenIssuerOptions = {},\n    ) {\n        super(options);\n\n        this.repository = repository;\n        this.signer = signer;\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        const iss = this.buildIss(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            kind: OAuth2TokenKind.ACCESS,\n            exp: this.buildExp(input),\n            ...(iss ? { iss } : {}),\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        return [token, data];\n    }\n}\n"],"mappings":";;;AAcA,IAAaE,0BAAb,cAA6CD,sBAAAA;CAC/BE;CAEAC;CAEV,YACID,YACAC,QACAC,UAAoC,EAAE,EACxC;AACE,QAAMA,QAAAA;AAEN,OAAKF,aAAaA;AAClB,OAAKC,SAASA;;CAGlB,MAAME,MAAMC,QAA4B,EAAE,EAAuC;EAC7E,MAAMC,MAAM,KAAKC,SAASF,MAAAA;EAE1B,MAAMG,OAAO,MAAM,KAAKP,WAAWQ,OAAO;GACtC,GAAGJ;GACHK,MAAMZ,gBAAgBa;GACtBC,KAAK,KAAKC,SAASR,MAAAA;GACnB,GAAIC,MAAM,EAAEA,KAAI,GAAI,EAAE;GAC1B,CAAA;EAEA,MAAMQ,QAAQ,MAAM,KAAKZ,OAAOa,KAAKP,KAAAA;AAErC,QAAM,KAAKP,WAAWe,kBAAkBR,MAAMM,MAAAA;AAE9C,SAAO,CAACA,OAAON,KAAK"}

package/dist/core/oauth2/token/issuer/base.mjs

@@ -0,0 +1,26 @@
+//#region src/core/oauth2/token/issuer/base.ts
+var OAuth2BaseTokenIssuer = class {
+	options;
+	constructor(options) {
+		this.options = options || {};
+	}
+	buildIss(input = {}) {
+		if (!this.options.issuer) return;
+		if (input.realm_name) return `${this.options.issuer}/realms/${input.realm_name}`;
+		return this.options.issuer;
+	}
+	/**
+	* Build utc expire time (in seconds).
+	*
+	* @param input
+	*/ buildExp(input = {}) {
+		if (input.exp) return input.exp;
+		const utc = Math.floor((/* @__PURE__ */ new Date()).getTime() / 1e3);
+		if (this.options.maxAge) return utc + this.options.maxAge;
+		return utc + 3600;
+	}
+};
+//#endregion
+export { OAuth2BaseTokenIssuer };
+
+//# sourceMappingURL=base.mjs.map

package/dist/core/oauth2/token/issuer/base.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.mjs","names":["OAuth2BaseTokenIssuer","options","buildIss","input","issuer","undefined","realm_name","buildExp","exp","utc","Math","floor","Date","getTime","maxAge"],"sources":["../../../../../src/core/oauth2/token/issuer/base.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from './types.ts';\n\nexport abstract class OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected options: OAuth2TokenIssuerOptions;\n\n    // ------------------------------------------------------------------\n\n    protected constructor(options?: OAuth2TokenIssuerOptions) {\n        this.options = options || {};\n    }\n\n    // ------------------------------------------------------------------\n\n    abstract issue(input: OAuth2TokenPayload, options?: OAuth2TokenIssuerOptions): Promise<OAuth2TokenIssuerResponse>;\n\n    // ------------------------------------------------------------------\n\n    buildIss(input: OAuth2TokenPayload = {}) : string | undefined {\n        if (!this.options.issuer) {\n            return undefined;\n        }\n\n        if (input.realm_name) {\n            return `${this.options.issuer}/realms/${input.realm_name}`;\n        }\n\n        return this.options.issuer;\n    }\n\n    /**\n     * Build utc expire time (in seconds).\n     *\n     * @param input\n     */\n    buildExp(input: OAuth2TokenPayload = {}) : number {\n        if (input.exp) {\n            return input.exp;\n        }\n\n        const utc = Math.floor(new Date().getTime() / 1000);\n        if (this.options.maxAge) {\n            return utc + this.options.maxAge;\n        }\n\n        return utc + 3_600;\n    }\n}\n"],"mappings":";AAUA,IAAsBA,wBAAtB,MAAsBA;CACRC;CAIV,YAAsBA,SAAoC;AACtD,OAAKA,UAAUA,WAAW,EAAC;;CAS/BC,SAASC,QAA4B,EAAE,EAAuB;AAC1D,MAAI,CAAC,KAAKF,QAAQG,OACd;AAGJ,MAAID,MAAMG,WACN,QAAO,GAAG,KAAKL,QAAQG,OAAO,UAAUD,MAAMG;AAGlD,SAAO,KAAKL,QAAQG;;;;;;IAQxBG,SAASJ,QAA4B,EAAE,EAAW;AAC9C,MAAIA,MAAMK,IACN,QAAOL,MAAMK;EAGjB,MAAMC,MAAMC,KAAKC,uBAAM,IAAIC,MAAAA,EAAOC,SAAO,GAAK,IAAA;AAC9C,MAAI,KAAKZ,QAAQa,OACb,QAAOL,MAAM,KAAKR,QAAQa;AAG9B,SAAOL,MAAM"}

package/dist/core/oauth2/token/issuer/index.mjs

@@ -0,0 +1,7 @@
+import { OAuth2AccessTokenIssuer } from "./access/module.mjs";
+import "./access/index.mjs";
+import { OAuth2OpenIDTokenIssuer } from "./open-id/module.mjs";
+import "./open-id/index.mjs";
+import { OAuth2RefreshTokenIssuer } from "./refresh/module.mjs";
+import "./refresh/index.mjs";
+export { OAuth2AccessTokenIssuer, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenIssuer };

package/dist/core/oauth2/token/issuer/open-id/index.mjs

@@ -0,0 +1,2 @@
+import { OAuth2OpenIDTokenIssuer } from "./module.mjs";
+export { OAuth2OpenIDTokenIssuer };

package/dist/core/oauth2/token/issuer/open-id/module.mjs

@@ -0,0 +1,47 @@
+import { OAuth2OpenIDClaimsBuilder } from "../../../openid/claims.mjs";
+import "../../../openid/index.mjs";
+import { OAuth2BaseTokenIssuer } from "../base.mjs";
+import { JWTError, OAuth2TokenKind } from "@authup/specs";
+//#region src/core/oauth2/token/issuer/open-id/module.ts
+var OAuth2OpenIDTokenIssuer = class extends OAuth2BaseTokenIssuer {
+	repository;
+	signer;
+	identityResolver;
+	claimsBuilder;
+	constructor(ctx) {
+		super(ctx.options);
+		this.repository = ctx.repository;
+		this.signer = ctx.signer;
+		this.identityResolver = ctx.identityResolver;
+		this.claimsBuilder = new OAuth2OpenIDClaimsBuilder();
+	}
+	async issue(input = {}) {
+		if (!input.sub_kind) throw JWTError.payloadPropertyInvalid("sub_kind");
+		if (!input.sub) throw JWTError.payloadPropertyInvalid("sub");
+		const identity = await this.identityResolver.resolve(input.sub_kind, input.sub);
+		if (!identity) throw JWTError.payloadInvalid();
+		return this.issueWithIdentity(input, identity);
+	}
+	async issueWithIdentity(input, identity) {
+		const claims = this.claimsBuilder.fromIdentity(identity);
+		const utc = Math.floor((/* @__PURE__ */ new Date()).getTime() / 1e3);
+		const iss = this.buildIss(input);
+		const data = await this.repository.insert({
+			...input,
+			...claims,
+			kind: OAuth2TokenKind.ID_TOKEN,
+			auth_time: utc,
+			exp: this.buildExp(input),
+			updated_at: utc,
+			...iss ? { iss } : {},
+			...input.client_id ? { aud: input.client_id } : {}
+		});
+		const token = await this.signer.sign(data);
+		await this.repository.saveWithSignature(data, token);
+		return [token, data];
+	}
+};
+//#endregion
+export { OAuth2OpenIDTokenIssuer };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/token/issuer/open-id/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["JWTError","OAuth2TokenKind","OAuth2OpenIDClaimsBuilder","OAuth2BaseTokenIssuer","OAuth2OpenIDTokenIssuer","repository","signer","identityResolver","claimsBuilder","ctx","options","issue","input","sub_kind","payloadPropertyInvalid","sub","identity","resolve","payloadInvalid","issueWithIdentity","claims","fromIdentity","utc","Math","floor","Date","getTime","iss","buildIss","data","insert","kind","ID_TOKEN","auth_time","exp","buildExp","updated_at","client_id","aud","token","sign","saveWithSignature"],"sources":["../../../../../../src/core/oauth2/token/issuer/open-id/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { JWTError, OAuth2TokenKind } from '@authup/specs';\nimport type { Identity } from '@authup/core-kit';\nimport { OAuth2OpenIDClaimsBuilder } from '../../../openid/index.ts';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { OAuth2TokenIssuerResponse } from '../types.ts';\nimport type { IOAuth2OpenIDTokenIssuer, OAuth2OpenIDTokenIssuerContext } from './types.ts';\nimport type { IIdentityResolver } from '../../../../identity/index.ts';\n\nexport class OAuth2OpenIDTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2OpenIDTokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    protected identityResolver : IIdentityResolver;\n\n    protected claimsBuilder: OAuth2OpenIDClaimsBuilder;\n\n    constructor(ctx: OAuth2OpenIDTokenIssuerContext) {\n        super(ctx.options);\n\n        this.repository = ctx.repository;\n        this.signer = ctx.signer;\n\n        this.identityResolver = ctx.identityResolver;\n        this.claimsBuilder = new OAuth2OpenIDClaimsBuilder();\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        if (!input.sub_kind) {\n            throw JWTError.payloadPropertyInvalid('sub_kind');\n        }\n\n        if (!input.sub) {\n            throw JWTError.payloadPropertyInvalid('sub');\n        }\n\n        const identity = await this.identityResolver.resolve(\n            input.sub_kind,\n            input.sub,\n        );\n\n        if (!identity) {\n            throw JWTError.payloadInvalid();\n        }\n\n        return this.issueWithIdentity(input, identity);\n    }\n\n    async issueWithIdentity(\n        input: OAuth2TokenPayload,\n        identity: Identity,\n    ): Promise<OAuth2TokenIssuerResponse> {\n        const claims = this.claimsBuilder.fromIdentity(identity);\n\n        const utc = Math.floor(new Date().getTime() / 1000);\n\n        const iss = this.buildIss(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            ...claims,\n            kind: OAuth2TokenKind.ID_TOKEN,\n            auth_time: utc,\n            exp: this.buildExp(input),\n            updated_at: utc,\n            ...(iss ? { iss } : {}),\n            ...(input.client_id ? { aud: input.client_id } : {}),\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        return [token, data];\n    }\n}\n"],"mappings":";;;;;AAkBA,IAAaI,0BAAb,cAA6CD,sBAAAA;CAC/BE;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;AAC7C,QAAMA,IAAIC,QAAO;AAEjB,OAAKL,aAAaI,IAAIJ;AACtB,OAAKC,SAASG,IAAIH;AAElB,OAAKC,mBAAmBE,IAAIF;AAC5B,OAAKC,gBAAgB,IAAIN,2BAAAA;;CAG7B,MAAMS,MAAMC,QAA4B,EAAE,EAAuC;AAC7E,MAAI,CAACA,MAAMC,SACP,OAAMb,SAASc,uBAAuB,WAAA;AAG1C,MAAI,CAACF,MAAMG,IACP,OAAMf,SAASc,uBAAuB,MAAA;EAG1C,MAAME,WAAW,MAAM,KAAKT,iBAAiBU,QACzCL,MAAMC,UACND,MAAMG,IAAG;AAGb,MAAI,CAACC,SACD,OAAMhB,SAASkB,gBAAc;AAGjC,SAAO,KAAKC,kBAAkBP,OAAOI,SAAAA;;CAGzC,MAAMG,kBACFP,OACAI,UACkC;EAClC,MAAMI,SAAS,KAAKZ,cAAca,aAAaL,SAAAA;EAE/C,MAAMM,MAAMC,KAAKC,uBAAM,IAAIC,MAAAA,EAAOC,SAAO,GAAK,IAAA;EAE9C,MAAMC,MAAM,KAAKC,SAAShB,MAAAA;EAE1B,MAAMiB,OAAO,MAAM,KAAKxB,WAAWyB,OAAO;GACtC,GAAGlB;GACH,GAAGQ;GACHW,MAAM9B,gBAAgB+B;GACtBC,WAAWX;GACXY,KAAK,KAAKC,SAASvB,MAAAA;GACnBwB,YAAYd;GACZ,GAAIK,MAAM,EAAEA,KAAI,GAAI,EAAE;GACtB,GAAIf,MAAMyB,YAAY,EAAEC,KAAK1B,MAAMyB,WAAU,GAAI,EAAE;GACvD,CAAA;EAEA,MAAME,QAAQ,MAAM,KAAKjC,OAAOkC,KAAKX,KAAAA;AAErC,QAAM,KAAKxB,WAAWoC,kBAAkBZ,MAAMU,MAAAA;AAE9C,SAAO,CAACA,OAAOV,KAAK"}

package/dist/core/oauth2/token/issuer/open-id/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/token/issuer/refresh/index.mjs

@@ -0,0 +1,2 @@
+import { OAuth2RefreshTokenIssuer } from "./module.mjs";
+export { OAuth2RefreshTokenIssuer };

package/dist/core/oauth2/token/issuer/refresh/module.mjs

@@ -0,0 +1,28 @@
+import { OAuth2BaseTokenIssuer } from "../base.mjs";
+import { OAuth2TokenKind } from "@authup/specs";
+//#region src/core/oauth2/token/issuer/refresh/module.ts
+var OAuth2RefreshTokenIssuer = class extends OAuth2BaseTokenIssuer {
+	repository;
+	signer;
+	constructor(repository, signer, options = {}) {
+		super(options);
+		this.repository = repository;
+		this.signer = signer;
+	}
+	async issue(input = {}) {
+		const iss = this.buildIss(input);
+		const data = await this.repository.insert({
+			...input,
+			kind: OAuth2TokenKind.REFRESH,
+			exp: this.buildExp(input),
+			...iss ? { iss } : {}
+		});
+		const token = await this.signer.sign(data);
+		await this.repository.saveWithSignature(data, token);
+		return [token, data];
+	}
+};
+//#endregion
+export { OAuth2RefreshTokenIssuer };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/token/issuer/refresh/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["OAuth2TokenKind","OAuth2BaseTokenIssuer","OAuth2RefreshTokenIssuer","repository","signer","options","issue","input","iss","buildIss","data","insert","kind","REFRESH","exp","buildExp","token","sign","saveWithSignature"],"sources":["../../../../../../src/core/oauth2/token/issuer/refresh/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';\n\nexport class OAuth2RefreshTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    constructor(\n        repository: IOAuth2TokenRepository,\n        signer: IOAuth2TokenSigner,\n        options: OAuth2TokenIssuerOptions = {},\n    ) {\n        super(options);\n\n        this.repository = repository;\n        this.signer = signer;\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        const iss = this.buildIss(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            kind: OAuth2TokenKind.REFRESH,\n            exp: this.buildExp(input),\n            ...(iss ? { iss } : {}),\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        return [token, data];\n    }\n}\n"],"mappings":";;;AAcA,IAAaE,2BAAb,cAA8CD,sBAAAA;CAChCE;CAEAC;CAEV,YACID,YACAC,QACAC,UAAoC,EAAE,EACxC;AACE,QAAMA,QAAAA;AAEN,OAAKF,aAAaA;AAClB,OAAKC,SAASA;;CAGlB,MAAME,MAAMC,QAA4B,EAAE,EAAuC;EAC7E,MAAMC,MAAM,KAAKC,SAASF,MAAAA;EAE1B,MAAMG,OAAO,MAAM,KAAKP,WAAWQ,OAAO;GACtC,GAAGJ;GACHK,MAAMZ,gBAAgBa;GACtBC,KAAK,KAAKC,SAASR,MAAAA;GACnB,GAAIC,MAAM,EAAEA,KAAI,GAAI,EAAE;GAC1B,CAAA;EAEA,MAAMQ,QAAQ,MAAM,KAAKZ,OAAOa,KAAKP,KAAAA;AAErC,QAAM,KAAKP,WAAWe,kBAAkBR,MAAMM,MAAAA;AAE9C,SAAO,CAACA,OAAON,KAAK"}

package/dist/core/oauth2/token/issuer/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/token/repository/index.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/token/repository/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/token/revoker/index.mjs

@@ -0,0 +1,2 @@
+import { OAuth2TokenRevoker } from "./module.mjs";
+export { OAuth2TokenRevoker };

package/dist/core/oauth2/token/revoker/module.mjs

@@ -0,0 +1,16 @@
+import { JWTError } from "@authup/specs";
+//#region src/core/oauth2/token/revoker/module.ts
+var OAuth2TokenRevoker = class {
+	repository;
+	constructor(repository) {
+		this.repository = repository;
+	}
+	async revoke(input) {
+		if (!input.jti) throw JWTError.payloadPropertyInvalid("jti");
+		await this.repository.removeById(input.jti);
+	}
+};
+//#endregion
+export { OAuth2TokenRevoker };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/token/revoker/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["JWTError","OAuth2TokenRevoker","repository","revoke","input","jti","payloadPropertyInvalid","removeById"],"sources":["../../../../../src/core/oauth2/token/revoker/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { JWTError } from '@authup/specs';\nimport type { IOAuth2TokenRepository } from '../repository/index.ts';\nimport type { IOAuth2TokenRevoker } from './types.ts';\n\nexport class OAuth2TokenRevoker implements IOAuth2TokenRevoker {\n    protected repository : IOAuth2TokenRepository;\n\n    constructor(repository : IOAuth2TokenRepository) {\n        this.repository = repository;\n    }\n\n    async revoke(input: OAuth2TokenPayload) : Promise<void> {\n        if (!input.jti) {\n            throw JWTError.payloadPropertyInvalid('jti');\n        }\n\n        await this.repository.removeById(input.jti);\n    }\n}\n"],"mappings":";;AAYA,IAAaC,qBAAb,MAAaA;CACCC;CAEV,YAAYA,YAAqC;AAC7C,OAAKA,aAAaA;;CAGtB,MAAMC,OAAOC,OAA2C;AACpD,MAAI,CAACA,MAAMC,IACP,OAAML,SAASM,uBAAuB,MAAA;AAG1C,QAAM,KAAKJ,WAAWK,WAAWH,MAAMC,IAAG"}

package/dist/core/oauth2/token/revoker/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/token/signer/index.mjs

@@ -0,0 +1,2 @@
+import { OAuth2TokenSigner } from "./module.mjs";
+export { OAuth2TokenSigner };

package/dist/core/oauth2/token/signer/module.mjs

@@ -0,0 +1,38 @@
+import { signToken } from "@authup/server-kit";
+import { JWKError, JWKType } from "@authup/specs";
+//#region src/core/oauth2/token/signer/module.ts
+var OAuth2TokenSigner = class {
+	keyRepository;
+	constructor(keyRepository) {
+		this.keyRepository = keyRepository;
+	}
+	async sign(payload) {
+		if (!payload.realm_id) throw JWKError.invalidRealm();
+		const key = await this.keyRepository.findByRealmId(payload.realm_id);
+		if (!key) throw JWKError.notFoundForRealm(payload.realm_id, payload.realm_name);
+		if (!key.decryption_key) throw JWKError.decryptionKeyMissing();
+		let token;
+		if (key.type === JWKType.OCT) token = await signToken(payload, {
+			type: JWKType.OCT,
+			key: key.decryption_key,
+			keyId: key.id
+		});
+		else if (key.type === JWKType.EC) token = await signToken(payload, {
+			type: key.type,
+			key: key.decryption_key,
+			algorithm: key.signature_algorithm,
+			keyId: key.id
+		});
+		else token = await signToken(payload, {
+			type: key.type,
+			key: key.decryption_key,
+			algorithm: key.signature_algorithm,
+			keyId: key.id
+		});
+		return token;
+	}
+};
+//#endregion
+export { OAuth2TokenSigner };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/token/signer/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["signToken","JWKError","JWKType","OAuth2TokenSigner","keyRepository","sign","payload","realm_id","invalidRealm","key","findByRealmId","notFoundForRealm","realm_name","decryption_key","decryptionKeyMissing","token","type","OCT","keyId","id","EC","algorithm","signature_algorithm"],"sources":["../../../../../src/core/oauth2/token/signer/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { type TokenECAlgorithm, type TokenRSAAlgorithm, signToken } from '@authup/server-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { JWKError, JWKType } from '@authup/specs';\nimport type { IOAuth2KeyRepository } from '../../key/index.ts';\nimport type { IOAuth2TokenSigner } from './types.ts';\n\nexport class OAuth2TokenSigner implements IOAuth2TokenSigner {\n    protected keyRepository : IOAuth2KeyRepository;\n\n    constructor(keyRepository : IOAuth2KeyRepository) {\n        this.keyRepository = keyRepository;\n    }\n\n    async sign<T extends OAuth2TokenPayload>(payload: T) : Promise<string> {\n        if (!payload.realm_id) {\n            throw JWKError.invalidRealm();\n        }\n\n        const key = await this.keyRepository.findByRealmId(payload.realm_id);\n        if (!key) {\n            throw JWKError.notFoundForRealm(payload.realm_id, payload.realm_name);\n        }\n\n        if (!key.decryption_key) {\n            throw JWKError.decryptionKeyMissing();\n        }\n\n        let token : string;\n        if (key.type === JWKType.OCT) {\n            token = await signToken(\n                payload,\n                {\n                    type: JWKType.OCT,\n                    key: key.decryption_key,\n                    keyId: key.id,\n                },\n            );\n        } else if (key.type === JWKType.EC) {\n            token = await signToken(\n                payload,\n                {\n                    type: key.type,\n                    key: key.decryption_key,\n                    algorithm: key.signature_algorithm as TokenECAlgorithm,\n                    keyId: key.id,\n                },\n            );\n        } else {\n            token = await signToken(\n                payload,\n                {\n                    type: key.type,\n                    key: key.decryption_key,\n                    algorithm: key.signature_algorithm as TokenRSAAlgorithm,\n                    keyId: key.id,\n                },\n            );\n        }\n\n        return token;\n    }\n}\n"],"mappings":";;;AAaA,IAAaG,oBAAb,MAAaA;CACCC;CAEV,YAAYA,eAAsC;AAC9C,OAAKA,gBAAgBA;;CAGzB,MAAMC,KAAmCC,SAA8B;AACnE,MAAI,CAACA,QAAQC,SACT,OAAMN,SAASO,cAAY;EAG/B,MAAMC,MAAM,MAAM,KAAKL,cAAcM,cAAcJ,QAAQC,SAAQ;AACnE,MAAI,CAACE,IACD,OAAMR,SAASU,iBAAiBL,QAAQC,UAAUD,QAAQM,WAAU;AAGxE,MAAI,CAACH,IAAII,eACL,OAAMZ,SAASa,sBAAoB;EAGvC,IAAIC;AACJ,MAAIN,IAAIO,SAASd,QAAQe,IACrBF,SAAQ,MAAMf,UACVM,SACA;GACIU,MAAMd,QAAQe;GACdR,KAAKA,IAAII;GACTK,OAAOT,IAAIU;GACf,CAAA;WAEGV,IAAIO,SAASd,QAAQkB,GAC5BL,SAAQ,MAAMf,UACVM,SACA;GACIU,MAAMP,IAAIO;GACVP,KAAKA,IAAII;GACTQ,WAAWZ,IAAIa;GACfJ,OAAOT,IAAIU;GACf,CAAA;MAGJJ,SAAQ,MAAMf,UACVM,SACA;GACIU,MAAMP,IAAIO;GACVP,KAAKA,IAAII;GACTQ,WAAWZ,IAAIa;GACfJ,OAAOT,IAAIU;GACf,CAAA;AAIR,SAAOJ"}

package/dist/core/oauth2/token/signer/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/token/verifier/index.mjs

@@ -0,0 +1,2 @@
+import { OAuth2TokenVerifier } from "./module.mjs";
+export { OAuth2TokenVerifier };

package/dist/core/oauth2/token/verifier/module.mjs

@@ -0,0 +1,62 @@
+import { extractTokenHeader, verifyToken } from "@authup/server-kit";
+import { JWKError, JWKType, JWTError } from "@authup/specs";
+//#region src/core/oauth2/token/verifier/module.ts
+var OAuth2TokenVerifier = class {
+	keyRepository;
+	tokenRepository;
+	constructor(keyRepository, tokenRepository) {
+		this.keyRepository = keyRepository;
+		this.tokenRepository = tokenRepository;
+	}
+	async isInactive(id) {
+		return this.tokenRepository.isInactive(id);
+	}
+	async verify(token, options = {}) {
+		let payload = await this.tokenRepository.findOneBySignature(token);
+		if (payload) {
+			if (!payload.jti) throw JWTError.payloadPropertyInvalid("jti");
+			if (!options.skipActiveCheck) {
+				if (await this.isInactive(payload.jti)) throw JWTError.notActive();
+			}
+			return payload;
+		}
+		const header = extractTokenHeader(token);
+		if (!header.kid) throw JWTError.headerPropertyInvalid("kid");
+		const key = await this.keyRepository.findById(header.kid);
+		if (!key) throw JWKError.notFound(header.kid);
+		switch (key.type) {
+			case JWKType.OCT:
+				if (!key.decryption_key) throw JWKError.decryptionKeyMissing();
+				payload = await verifyToken(token, {
+					type: JWKType.OCT,
+					key: key.decryption_key
+				});
+				break;
+			case JWKType.EC:
+				if (!key.encryption_key) throw JWKError.decryptionKeyMissing();
+				payload = await verifyToken(token, {
+					type: key.type,
+					key: key.encryption_key,
+					...key.signature_algorithm ? { algorithms: [key.signature_algorithm] } : []
+				});
+				break;
+			default:
+				if (!key.encryption_key) throw JWKError.decryptionKeyMissing();
+				payload = await verifyToken(token, {
+					type: key.type,
+					key: key.encryption_key,
+					...key.signature_algorithm ? { algorithms: [key.signature_algorithm] } : []
+				});
+		}
+		if (!payload.jti) throw JWTError.payloadPropertyInvalid("jti");
+		await this.tokenRepository.saveWithSignature(payload, token);
+		if (!options.skipActiveCheck) {
+			if (await this.isInactive(payload.jti)) throw JWTError.notActive();
+		}
+		return payload;
+	}
+};
+//#endregion
+export { OAuth2TokenVerifier };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/token/verifier/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["extractTokenHeader","verifyToken","JWKError","JWKType","JWTError","OAuth2TokenVerifier","keyRepository","tokenRepository","isInactive","id","verify","token","options","payload","findOneBySignature","jti","payloadPropertyInvalid","skipActiveCheck","notActive","header","kid","headerPropertyInvalid","key","findById","notFound","type","OCT","decryption_key","decryptionKeyMissing","EC","encryption_key","signature_algorithm","algorithms","saveWithSignature"],"sources":["../../../../../src/core/oauth2/token/verifier/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    type TokenECAlgorithm, \n    type TokenRSAAlgorithm, \n    extractTokenHeader, \n    verifyToken,\n} from '@authup/server-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { JWKError, JWKType, JWTError } from '@authup/specs';\nimport type { IOAuth2KeyRepository } from '../../key/index.ts';\nimport type { IOAuth2TokenRepository } from '../repository/types.ts';\nimport type { IOAuth2TokenVerifier, OAuth2TokenVerifyOptions } from './types.ts';\n\nexport class OAuth2TokenVerifier implements IOAuth2TokenVerifier {\n    protected keyRepository : IOAuth2KeyRepository;\n\n    protected tokenRepository : IOAuth2TokenRepository;\n\n    constructor(\n        keyRepository : IOAuth2KeyRepository,\n        tokenRepository : IOAuth2TokenRepository,\n    ) {\n        this.keyRepository = keyRepository;\n        this.tokenRepository = tokenRepository;\n    }\n\n    async isInactive(id: string): Promise<boolean> {\n        return this.tokenRepository.isInactive(id);\n    }\n\n    async verify(token: string, options: OAuth2TokenVerifyOptions = {}) : Promise<OAuth2TokenPayload> {\n        let payload = await this.tokenRepository.findOneBySignature(token);\n        if (payload) {\n            if (!payload.jti) {\n                throw JWTError.payloadPropertyInvalid('jti');\n            }\n\n            if (!options.skipActiveCheck) {\n                const isInactive = await this.isInactive(payload.jti);\n                if (isInactive) {\n                    throw JWTError.notActive();\n                }\n            }\n\n            return payload;\n        }\n\n        const header = extractTokenHeader(token);\n        if (!header.kid) {\n            throw JWTError.headerPropertyInvalid('kid');\n        }\n\n        const key = await this.keyRepository.findById(header.kid);\n        if (!key) {\n            throw JWKError.notFound(header.kid);\n        }\n\n        switch (key.type) {\n            case JWKType.OCT: {\n                if (!key.decryption_key) {\n                    throw JWKError.decryptionKeyMissing();\n                }\n\n                payload = await verifyToken(\n                    token,\n                    {\n                        type: JWKType.OCT,\n                        key: key.decryption_key,\n                    },\n                );\n                break;\n            }\n            case JWKType.EC: {\n                if (!key.encryption_key) {\n                    throw JWKError.decryptionKeyMissing();\n                }\n\n                payload = await verifyToken(\n                    token,\n                    {\n                        type: key.type,\n                        key: key.encryption_key,\n                        ...(\n                            key.signature_algorithm ?\n                                { algorithms: [key.signature_algorithm] } :\n                                []\n                        ) as TokenECAlgorithm[],\n                    },\n                );\n                break;\n            }\n            default: {\n                if (!key.encryption_key) {\n                    throw JWKError.decryptionKeyMissing();\n                }\n\n                payload = await verifyToken(\n                    token,\n                    {\n                        type: key.type,\n                        key: key.encryption_key,\n                        ...(\n                            key.signature_algorithm ?\n                                { algorithms: [key.signature_algorithm] } :\n                                []\n                        ) as TokenRSAAlgorithm[],\n                    },\n                );\n            }\n        }\n\n        if (!payload.jti) {\n            throw JWTError.payloadPropertyInvalid('jti');\n        }\n\n        await this.tokenRepository.saveWithSignature(payload, token);\n\n        if (!options.skipActiveCheck) {\n            const isInactive = await this.isInactive(payload.jti);\n            if (isInactive) {\n                throw JWTError.notActive();\n            }\n        }\n\n        return payload;\n    }\n}\n"],"mappings":";;;AAmBA,IAAaK,sBAAb,MAAaA;CACCC;CAEAC;CAEV,YACID,eACAC,iBACF;AACE,OAAKD,gBAAgBA;AACrB,OAAKC,kBAAkBA;;CAG3B,MAAMC,WAAWC,IAA8B;AAC3C,SAAO,KAAKF,gBAAgBC,WAAWC,GAAAA;;CAG3C,MAAMC,OAAOC,OAAeC,UAAoC,EAAE,EAAgC;EAC9F,IAAIC,UAAU,MAAM,KAAKN,gBAAgBO,mBAAmBH,MAAAA;AAC5D,MAAIE,SAAS;AACT,OAAI,CAACA,QAAQE,IACT,OAAMX,SAASY,uBAAuB,MAAA;AAG1C,OAAI,CAACJ,QAAQK;QAELT,MADqB,KAAKA,WAAWK,QAAQE,IAAG,CAEhD,OAAMX,SAASc,WAAS;;AAIhC,UAAOL;;EAGX,MAAMM,SAASnB,mBAAmBW,MAAAA;AAClC,MAAI,CAACQ,OAAOC,IACR,OAAMhB,SAASiB,sBAAsB,MAAA;EAGzC,MAAMC,MAAM,MAAM,KAAKhB,cAAciB,SAASJ,OAAOC,IAAG;AACxD,MAAI,CAACE,IACD,OAAMpB,SAASsB,SAASL,OAAOC,IAAG;AAGtC,UAAQE,IAAIG,MAAZ;GACI,KAAKtB,QAAQuB;AACT,QAAI,CAACJ,IAAIK,eACL,OAAMzB,SAAS0B,sBAAoB;AAGvCf,cAAU,MAAMZ,YACZU,OACA;KACIc,MAAMtB,QAAQuB;KACdJ,KAAKA,IAAIK;KACb,CAAA;AAEJ;GAEJ,KAAKxB,QAAQ0B;AACT,QAAI,CAACP,IAAIQ,eACL,OAAM5B,SAAS0B,sBAAoB;AAGvCf,cAAU,MAAMZ,YACZU,OACA;KACIc,MAAMH,IAAIG;KACVH,KAAKA,IAAIQ;KACT,GACIR,IAAIS,sBACA,EAAEC,YAAY,CAACV,IAAIS,oBAAoB,EAAC,GACxC,EAAE;KAEd,CAAA;AAEJ;GAEJ;AACI,QAAI,CAACT,IAAIQ,eACL,OAAM5B,SAAS0B,sBAAoB;AAGvCf,cAAU,MAAMZ,YACZU,OACA;KACIc,MAAMH,IAAIG;KACVH,KAAKA,IAAIQ;KACT,GACIR,IAAIS,sBACA,EAAEC,YAAY,CAACV,IAAIS,oBAAoB,EAAC,GACxC,EAAE;KAEd,CAAA;;AAKZ,MAAI,CAAClB,QAAQE,IACT,OAAMX,SAASY,uBAAuB,MAAA;AAG1C,QAAM,KAAKT,gBAAgB0B,kBAAkBpB,SAASF,MAAAA;AAEtD,MAAI,CAACC,QAAQK;OAELT,MADqB,KAAKA,WAAWK,QAAQE,IAAG,CAEhD,OAAMX,SAASc,WAAS;;AAIhC,SAAOL"}

package/dist/core/oauth2/token/verifier/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/provisioning/entities/client/index.mjs

@@ -0,0 +1,2 @@
+import { ClientProvisioningValidator } from "./validator.mjs";
+export { ClientProvisioningValidator };

package/dist/core/provisioning/entities/client/relations-validator.mjs

@@ -0,0 +1,25 @@
+import { PermissionProvisioningValidator } from "../permission/validator.mjs";
+import "../permission/index.mjs";
+import { RoleProvisioningValidator } from "../role/validator.mjs";
+import "../role/index.mjs";
+import { Container } from "validup";
+import { createValidator } from "@validup/adapter-zod";
+import { z } from "zod";
+//#region src/core/provisioning/entities/client/relations-validator.ts
+var ClientProvisioningRelationsValidator = class extends Container {
+	initialize() {
+		super.initialize();
+		const permissionValidator = new PermissionProvisioningValidator();
+		const roleValidator = new RoleProvisioningValidator();
+		this.mount("permissions.*", { optional: true }, permissionValidator);
+		this.mount("realmPermissions", { optional: true }, createValidator(z.array(z.string())));
+		this.mount("globalPermissions", { optional: true }, createValidator(z.array(z.string())));
+		this.mount("roles.*", { optional: true }, roleValidator);
+		this.mount("realmRoles", { optional: true }, createValidator(z.array(z.string())));
+		this.mount("globalRoles", { optional: true }, createValidator(z.array(z.string())));
+	}
+};
+//#endregion
+export { ClientProvisioningRelationsValidator };
+
+//# sourceMappingURL=relations-validator.mjs.map

package/dist/core/provisioning/entities/client/relations-validator.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"relations-validator.mjs","names":["createValidator","Container","z","PermissionProvisioningValidator","RoleProvisioningValidator","ClientProvisioningRelationsValidator","initialize","permissionValidator","roleValidator","mount","optional","array","string"],"sources":["../../../../../src/core/provisioning/entities/client/relations-validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createValidator } from '@validup/adapter-zod';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport { PermissionProvisioningValidator } from '../permission/index.ts';\nimport { RoleProvisioningValidator } from '../role/index.ts';\nimport type { ClientProvisioningRelations } from './types.ts';\n\nexport class ClientProvisioningRelationsValidator extends Container<ClientProvisioningRelations> {\n    protected initialize() {\n        super.initialize();\n\n        const permissionValidator = new PermissionProvisioningValidator();\n        const roleValidator = new RoleProvisioningValidator();\n\n        this.mount('permissions.*', { optional: true }, permissionValidator);\n\n        this.mount('realmPermissions', { optional: true }, createValidator(\n            z.array(z.string()),\n        ));\n\n        this.mount('globalPermissions', { optional: true }, createValidator(\n            z.array(z.string()),\n        ));\n\n        this.mount('roles.*', { optional: true }, roleValidator);\n\n        this.mount('realmRoles', { optional: true }, createValidator(\n            z.array(z.string()),\n        ));\n\n        this.mount('globalRoles', { optional: true }, createValidator(\n            z.array(z.string()),\n        ));\n    }\n}\n"],"mappings":";;;;;;;;AAcA,IAAaK,uCAAb,cAA0DJ,UAAAA;CAC5CK,aAAa;AACnB,QAAMA,YAAAA;EAEN,MAAMC,sBAAsB,IAAIJ,iCAAAA;EAChC,MAAMK,gBAAgB,IAAIJ,2BAAAA;AAE1B,OAAKK,MAAM,iBAAiB,EAAEC,UAAU,MAAK,EAAGH,oBAAAA;AAEhD,OAAKE,MAAM,oBAAoB,EAAEC,UAAU,MAAK,EAAGV,gBAC/CE,EAAES,MAAMT,EAAEU,QAAM,CAAA,CAAA,CAAA;AAGpB,OAAKH,MAAM,qBAAqB,EAAEC,UAAU,MAAK,EAAGV,gBAChDE,EAAES,MAAMT,EAAEU,QAAM,CAAA,CAAA,CAAA;AAGpB,OAAKH,MAAM,WAAW,EAAEC,UAAU,MAAK,EAAGF,cAAAA;AAE1C,OAAKC,MAAM,cAAc,EAAEC,UAAU,MAAK,EAAGV,gBACzCE,EAAES,MAAMT,EAAEU,QAAM,CAAA,CAAA,CAAA;AAGpB,OAAKH,MAAM,eAAe,EAAEC,UAAU,MAAK,EAAGV,gBAC1CE,EAAES,MAAMT,EAAEU,QAAM,CAAA,CAAA,CAAA"}

package/dist/core/provisioning/entities/client/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/provisioning/entities/client/validator.mjs

@@ -0,0 +1,21 @@
+import { ProvisioningStrategyValidator } from "../../strategy/validator.mjs";
+import "../../strategy/index.mjs";
+import { ClientProvisioningRelationsValidator } from "./relations-validator.mjs";
+import { ClientValidator } from "@authup/core-kit";
+import { Container } from "validup";
+//#region src/core/provisioning/entities/client/validator.ts
+var ClientProvisioningValidator = class extends Container {
+	initialize() {
+		super.initialize();
+		const strategyValidator = new ProvisioningStrategyValidator();
+		this.mount("strategy", { optional: true }, strategyValidator);
+		const attributesValidator = new ClientValidator();
+		this.mount("attributes", attributesValidator);
+		const relationsValidator = new ClientProvisioningRelationsValidator();
+		this.mount("relations", { optional: true }, relationsValidator);
+	}
+};
+//#endregion
+export { ClientProvisioningValidator };
+
+//# sourceMappingURL=validator.mjs.map

package/dist/core/provisioning/entities/client/validator.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"validator.mjs","names":["ClientValidator","Container","ProvisioningStrategyValidator","ClientProvisioningRelationsValidator","ClientProvisioningValidator","initialize","strategyValidator","mount","optional","attributesValidator","relationsValidator"],"sources":["../../../../../src/core/provisioning/entities/client/validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ClientValidator } from '@authup/core-kit';\nimport { Container } from 'validup';\nimport { ProvisioningStrategyValidator } from '../../strategy/index.ts';\nimport { ClientProvisioningRelationsValidator } from './relations-validator.ts';\nimport type { ClientProvisioningEntity } from './types.ts';\n\nexport class ClientProvisioningValidator extends Container<ClientProvisioningEntity> {\n    protected initialize() {\n        super.initialize();\n\n        const strategyValidator = new ProvisioningStrategyValidator();\n        this.mount('strategy', { optional: true }, strategyValidator);\n\n        const attributesValidator = new ClientValidator();\n        this.mount('attributes', attributesValidator);\n\n        const relationsValidator = new ClientProvisioningRelationsValidator();\n        this.mount('relations', { optional: true }, relationsValidator);\n    }\n}\n"],"mappings":";;;;;;AAaA,IAAaI,8BAAb,cAAiDH,UAAAA;CACnCI,aAAa;AACnB,QAAMA,YAAAA;EAEN,MAAMC,oBAAoB,IAAIJ,+BAAAA;AAC9B,OAAKK,MAAM,YAAY,EAAEC,UAAU,MAAK,EAAGF,kBAAAA;EAE3C,MAAMG,sBAAsB,IAAIT,iBAAAA;AAChC,OAAKO,MAAM,cAAcE,oBAAAA;EAEzB,MAAMC,qBAAqB,IAAIP,sCAAAA;AAC/B,OAAKI,MAAM,aAAa,EAAEC,UAAU,MAAK,EAAGE,mBAAAA"}

package/dist/core/provisioning/entities/index.mjs

@@ -0,0 +1,17 @@
+import { PermissionProvisioningValidator } from "./permission/validator.mjs";
+import "./permission/index.mjs";
+import { RoleProvisioningValidator } from "./role/validator.mjs";
+import "./role/index.mjs";
+import { ClientProvisioningValidator } from "./client/validator.mjs";
+import "./client/index.mjs";
+import { RobotProvisioningValidator } from "./robot/validator.mjs";
+import "./robot/index.mjs";
+import { ScopeProvisioningValidator } from "./scope/validator.mjs";
+import "./scope/index.mjs";
+import { UserProvisioningValidator } from "./user/validator.mjs";
+import "./user/index.mjs";
+import { RealmProvisioningValidator } from "./realm/validator.mjs";
+import "./realm/index.mjs";
+import { RootProvisioningValidator } from "./root/validator.mjs";
+import "./root/index.mjs";
+export { ClientProvisioningValidator, PermissionProvisioningValidator, RealmProvisioningValidator, RobotProvisioningValidator, RoleProvisioningValidator, RootProvisioningValidator, ScopeProvisioningValidator, UserProvisioningValidator };

package/dist/core/provisioning/entities/permission/index.mjs

@@ -0,0 +1,2 @@
+import { PermissionProvisioningValidator } from "./validator.mjs";
+export { PermissionProvisioningValidator };

package/dist/core/provisioning/entities/permission/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/provisioning/entities/permission/validator.mjs

@@ -0,0 +1,18 @@
+import { ProvisioningStrategyValidator } from "../../strategy/validator.mjs";
+import "../../strategy/index.mjs";
+import { PermissionValidator } from "@authup/core-kit";
+import { Container } from "validup";
+//#region src/core/provisioning/entities/permission/validator.ts
+var PermissionProvisioningValidator = class extends Container {
+	initialize() {
+		super.initialize();
+		const strategyValidator = new ProvisioningStrategyValidator();
+		this.mount("strategy", { optional: true }, strategyValidator);
+		const attributesValidator = new PermissionValidator();
+		this.mount("attributes", attributesValidator);
+	}
+};
+//#endregion
+export { PermissionProvisioningValidator };
+
+//# sourceMappingURL=validator.mjs.map