@authup/server-core 1.0.0-beta.36 → 1.0.0-beta.38

package/dist/core/oauth2/authorization/index.mjs

@@ -0,0 +1,11 @@
+import { OAuth2AuthorizationCodeIssuer } from "./code/issuer/module.mjs";
+import { base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, generateOAuth2CodeVerifier } from "./helpers.mjs";
+import { OAuth2AuthorizationCodeVerifier } from "./code/verifier/module.mjs";
+import "./code/index.mjs";
+import { OAuth2AuthorizationCodeRequestVerifier } from "./code-request/verifier/module.mjs";
+import { OAuth2AuthorizationCodeRequestValidator } from "./code-request/validator.mjs";
+import "./code-request/index.mjs";
+import { OAuth2AuthorizationStateManager } from "./state/module.mjs";
+import "./state/index.mjs";
+import { OAuth2Authorization } from "./module.mjs";
+export { OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, generateOAuth2CodeVerifier };

package/dist/core/oauth2/authorization/module.mjs

@@ -0,0 +1,66 @@
+import { buildOAuth2TokenHash } from "./helpers.mjs";
+import { ScopeName } from "@authup/core-kit";
+import { OAuth2AuthorizationResponseType, OAuth2Error, hasOAuth2Scopes } from "@authup/specs";
+//#region src/core/oauth2/authorization/module.ts
+var OAuth2Authorization = class {
+	accessTokenIssuer;
+	openIdTokenIssuer;
+	codeIssuer;
+	identityResolver;
+	constructor(ctx) {
+		this.accessTokenIssuer = ctx.accessTokenIssuer;
+		this.openIdTokenIssuer = ctx.openIdTokenIssuer;
+		this.codeIssuer = ctx.codeIssuer;
+		this.identityResolver = ctx.identityResolver;
+	}
+	/**
+	* Authorize with validated codeRequest.
+	*
+	* @param data
+	* @param identity
+	*/ async authorize(data, identity) {
+		const availableResponseTypes = Object.values(OAuth2AuthorizationResponseType);
+		let responseTypes = [];
+		if (data.response_type) responseTypes = Array.isArray(data.response_type) ? data.response_type : data.response_type.split(" ");
+		const enabledResponseTypes = {};
+		for (const responseType of responseTypes) if (!availableResponseTypes.includes(responseType)) throw OAuth2Error.responseTypeUnsupported();
+		else enabledResponseTypes[responseType] = true;
+		if (!data.redirect_uri) throw OAuth2Error.redirectUriMismatch();
+		const output = {
+			redirectUri: data.redirect_uri,
+			...data.state ? { state: data.state } : {}
+		};
+		if (!identity) throw OAuth2Error.identityInvalid();
+		const payloadBaseNormalized = {
+			sub: identity.data.id,
+			sub_kind: identity.type,
+			realm_id: identity.data.realm.id,
+			realm_name: identity.data.realm.name,
+			client_id: data.client_id,
+			...data.scope ? { scope: data.scope } : {},
+			...data.nonce ? { nonce: data.nonce } : {}
+		};
+		let codeEntity;
+		if (enabledResponseTypes[OAuth2AuthorizationResponseType.TOKEN]) {
+			const [token] = await this.accessTokenIssuer.issue(payloadBaseNormalized);
+			output.accessToken = token;
+		}
+		if (enabledResponseTypes[OAuth2AuthorizationResponseType.CODE]) {
+			codeEntity = await this.codeIssuer.issue(data, identity);
+			output.authorizationCode = codeEntity.id;
+		}
+		if (enabledResponseTypes[OAuth2AuthorizationResponseType.ID_TOKEN] || data.scope && hasOAuth2Scopes(data.scope, ScopeName.OPEN_ID)) {
+			const idTokenPayload = { ...payloadBaseNormalized };
+			if (output.accessToken) idTokenPayload.at_hash = await buildOAuth2TokenHash(output.accessToken);
+			if (output.authorizationCode) idTokenPayload.c_hash = await buildOAuth2TokenHash(output.authorizationCode);
+			const [token] = await this.openIdTokenIssuer.issueWithIdentity(idTokenPayload, identity);
+			if (enabledResponseTypes[OAuth2AuthorizationResponseType.ID_TOKEN]) output.idToken = token;
+			if (codeEntity) await this.codeIssuer.updateIdToken(codeEntity, token);
+		}
+		return output;
+	}
+};
+//#endregion
+export { OAuth2Authorization };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/authorization/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["ScopeName","OAuth2AuthorizationResponseType","OAuth2Error","hasOAuth2Scopes","buildOAuth2TokenHash","OAuth2Authorization","accessTokenIssuer","openIdTokenIssuer","codeIssuer","identityResolver","ctx","authorize","data","identity","availableResponseTypes","Object","values","responseTypes","response_type","Array","isArray","split","enabledResponseTypes","responseType","includes","responseTypeUnsupported","redirect_uri","redirectUriMismatch","output","redirectUri","state","identityInvalid","payloadBaseNormalized","sub","id","sub_kind","type","realm_id","realm","realm_name","name","client_id","scope","nonce","codeEntity","TOKEN","token","issue","accessToken","CODE","authorizationCode","needsIdToken","ID_TOKEN","OPEN_ID","idTokenPayload","at_hash","c_hash","issueWithIdentity","idToken","updateIdToken"],"sources":["../../../../src/core/oauth2/authorization/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Identity, OAuth2AuthorizationCode, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport {\n    OAuth2AuthorizationResponseType,\n    OAuth2Error,\n    hasOAuth2Scopes,\n} from '@authup/specs';\nimport type { IOAuth2OpenIDTokenIssuer, IOAuth2TokenIssuer } from '../token/index.ts';\nimport type { IOAuth2AuthorizationCodeIssuer } from './code/index.ts';\nimport { buildOAuth2TokenHash } from './helpers.ts';\nimport type {\n    OAuth2AuthorizationManagerContext,\n    OAuth2AuthorizationResult,\n} from './types.ts';\nimport type { IIdentityResolver } from '../../identity/index.ts';\n\nexport class OAuth2Authorization {\n    protected accessTokenIssuer : IOAuth2TokenIssuer;\n\n    protected openIdTokenIssuer : IOAuth2OpenIDTokenIssuer;\n\n    protected codeIssuer : IOAuth2AuthorizationCodeIssuer;\n\n    protected identityResolver : IIdentityResolver;\n\n    constructor(ctx: OAuth2AuthorizationManagerContext) {\n        this.accessTokenIssuer = ctx.accessTokenIssuer;\n        this.openIdTokenIssuer = ctx.openIdTokenIssuer;\n        this.codeIssuer = ctx.codeIssuer;\n        this.identityResolver = ctx.identityResolver;\n    }\n\n    /**\n     * Authorize with validated codeRequest.\n     *\n     * @param data\n     * @param identity\n     */\n    async authorize(\n        data: OAuth2AuthorizationCodeRequest,\n        identity: Identity,\n    ) : Promise<OAuth2AuthorizationResult> {\n        const availableResponseTypes : string[] = Object.values(OAuth2AuthorizationResponseType);\n\n        let responseTypes : string[] = [];\n        if (data.response_type) {\n            responseTypes = Array.isArray(data.response_type) ?\n                data.response_type :\n                data.response_type.split(' ');\n        }\n\n        const enabledResponseTypes : Record<string, boolean> = {};\n\n        for (const responseType of responseTypes) {\n            if (!availableResponseTypes.includes(responseType)) {\n                throw OAuth2Error.responseTypeUnsupported();\n            } else {\n                enabledResponseTypes[responseType] = true;\n            }\n        }\n\n        if (!data.redirect_uri) {\n            throw OAuth2Error.redirectUriMismatch();\n        }\n\n        const output : OAuth2AuthorizationResult = {\n            redirectUri: data.redirect_uri,\n            ...(data.state ? { state: data.state } : {}),\n        };\n\n        if (!identity) {\n            throw OAuth2Error.identityInvalid();\n        }\n\n        const payloadBaseNormalized : OAuth2TokenPayload = {\n\n            sub: identity.data.id,\n            sub_kind: identity.type,\n            realm_id: identity.data.realm.id,\n            realm_name: identity.data.realm.name,\n\n            client_id: data.client_id,\n            ...(data.scope ? { scope: data.scope } : {}),\n            ...(data.nonce ? { nonce: data.nonce } : {}),\n        };\n\n        let codeEntity : OAuth2AuthorizationCode | undefined;\n\n        if (enabledResponseTypes[OAuth2AuthorizationResponseType.TOKEN]) {\n            const [token] = await this.accessTokenIssuer.issue(payloadBaseNormalized);\n\n            output.accessToken = token;\n        }\n\n        if (enabledResponseTypes[OAuth2AuthorizationResponseType.CODE]) {\n            codeEntity = await this.codeIssuer.issue(\n                data,\n                identity,\n            );\n\n            output.authorizationCode = codeEntity.id;\n        }\n\n        const needsIdToken = enabledResponseTypes[OAuth2AuthorizationResponseType.ID_TOKEN] ||\n            (data.scope && hasOAuth2Scopes(data.scope, ScopeName.OPEN_ID));\n\n        if (needsIdToken) {\n            const idTokenPayload = { ...payloadBaseNormalized };\n\n            if (output.accessToken) {\n                idTokenPayload.at_hash = await buildOAuth2TokenHash(output.accessToken);\n            }\n            if (output.authorizationCode) {\n                idTokenPayload.c_hash = await buildOAuth2TokenHash(output.authorizationCode);\n            }\n\n            const [token] = await this.openIdTokenIssuer.issueWithIdentity(\n                idTokenPayload,\n                identity,\n            );\n\n            if (enabledResponseTypes[OAuth2AuthorizationResponseType.ID_TOKEN]) {\n                output.idToken = token;\n            }\n\n            if (codeEntity) {\n                await this.codeIssuer.updateIdToken(codeEntity, token);\n            }\n        }\n\n        return output;\n    }\n}\n"],"mappings":";;;;AAwBA,IAAaK,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAwC;AAChD,OAAKJ,oBAAoBI,IAAIJ;AAC7B,OAAKC,oBAAoBG,IAAIH;AAC7B,OAAKC,aAAaE,IAAIF;AACtB,OAAKC,mBAAmBC,IAAID;;;;;;;IAShC,MAAME,UACFC,MACAC,UACmC;EACnC,MAAMC,yBAAoCC,OAAOC,OAAOf,gCAAAA;EAExD,IAAIgB,gBAA2B,EAAE;AACjC,MAAIL,KAAKM,cACLD,iBAAgBE,MAAMC,QAAQR,KAAKM,cAAa,GAC5CN,KAAKM,gBACLN,KAAKM,cAAcG,MAAM,IAAA;EAGjC,MAAMC,uBAAiD,EAAC;AAExD,OAAK,MAAMC,gBAAgBN,cACvB,KAAI,CAACH,uBAAuBU,SAASD,aAAAA,CACjC,OAAMrB,YAAYuB,yBAAuB;MAEzCH,sBAAqBC,gBAAgB;AAI7C,MAAI,CAACX,KAAKc,aACN,OAAMxB,YAAYyB,qBAAmB;EAGzC,MAAMC,SAAqC;GACvCC,aAAajB,KAAKc;GAClB,GAAId,KAAKkB,QAAQ,EAAEA,OAAOlB,KAAKkB,OAAM,GAAI,EAAE;GAC/C;AAEA,MAAI,CAACjB,SACD,OAAMX,YAAY6B,iBAAe;EAGrC,MAAMC,wBAA6C;GAE/CC,KAAKpB,SAASD,KAAKsB;GACnBC,UAAUtB,SAASuB;GACnBC,UAAUxB,SAASD,KAAK0B,MAAMJ;GAC9BK,YAAY1B,SAASD,KAAK0B,MAAME;GAEhCC,WAAW7B,KAAK6B;GAChB,GAAI7B,KAAK8B,QAAQ,EAAEA,OAAO9B,KAAK8B,OAAM,GAAI,EAAE;GAC3C,GAAI9B,KAAK+B,QAAQ,EAAEA,OAAO/B,KAAK+B,OAAM,GAAI,EAAE;GAC/C;EAEA,IAAIC;AAEJ,MAAItB,qBAAqBrB,gCAAgC4C,QAAQ;GAC7D,MAAM,CAACC,SAAS,MAAM,KAAKxC,kBAAkByC,MAAMf,sBAAAA;AAEnDJ,UAAOoB,cAAcF;;AAGzB,MAAIxB,qBAAqBrB,gCAAgCgD,OAAO;AAC5DL,gBAAa,MAAM,KAAKpC,WAAWuC,MAC/BnC,MACAC,SAAAA;AAGJe,UAAOsB,oBAAoBN,WAAWV;;AAM1C,MAHqBZ,qBAAqBrB,gCAAgCmD,aACrExC,KAAK8B,SAASvC,gBAAgBS,KAAK8B,OAAO1C,UAAUqD,QAAO,EAE9C;GACd,MAAMC,iBAAiB,EAAE,GAAGtB,uBAAsB;AAElD,OAAIJ,OAAOoB,YACPM,gBAAeC,UAAU,MAAMnD,qBAAqBwB,OAAOoB,YAAW;AAE1E,OAAIpB,OAAOsB,kBACPI,gBAAeE,SAAS,MAAMpD,qBAAqBwB,OAAOsB,kBAAiB;GAG/E,MAAM,CAACJ,SAAS,MAAM,KAAKvC,kBAAkBkD,kBACzCH,gBACAzC,SAAAA;AAGJ,OAAIS,qBAAqBrB,gCAAgCmD,UACrDxB,QAAO8B,UAAUZ;AAGrB,OAAIF,WACA,OAAM,KAAKpC,WAAWmD,cAAcf,YAAYE,MAAAA;;AAIxD,SAAOlB"}

package/dist/core/oauth2/authorization/state/index.mjs

@@ -0,0 +1,2 @@
+import { OAuth2AuthorizationStateManager } from "./module.mjs";
+export { OAuth2AuthorizationStateManager };

package/dist/core/oauth2/authorization/state/module.mjs

@@ -0,0 +1,23 @@
+import { OAuth2Error } from "@authup/specs";
+//#region src/core/oauth2/authorization/state/module.ts
+var OAuth2AuthorizationStateManager = class {
+	repository;
+	constructor(repository) {
+		this.repository = repository;
+	}
+	async save(data) {
+		return this.repository.insert(data);
+	}
+	async verify(state, input) {
+		const payload = await this.repository.findOneById(state);
+		if (!payload) throw OAuth2Error.stateInvalid();
+		await this.repository.remove(state);
+		if (payload.ip && input.ip !== payload.ip) throw OAuth2Error.stateInvalid();
+		if (payload.userAgent && input.userAgent !== payload.userAgent) throw OAuth2Error.stateInvalid();
+		return payload;
+	}
+};
+//#endregion
+export { OAuth2AuthorizationStateManager };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/authorization/state/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["OAuth2Error","OAuth2AuthorizationStateManager","repository","save","data","insert","verify","state","input","payload","findOneById","stateInvalid","remove","ip","userAgent"],"sources":["../../../../../src/core/oauth2/authorization/state/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { OAuth2Error } from '@authup/specs';\nimport type {\n    IOAuth2AuthorizationStateManager,\n    IOAuth2AuthorizeStateRepository,\n    OAuth2AuthorizationState,\n} from './types.ts';\n\nexport class OAuth2AuthorizationStateManager implements IOAuth2AuthorizationStateManager {\n    protected repository: IOAuth2AuthorizeStateRepository;\n\n    constructor(repository: IOAuth2AuthorizeStateRepository) {\n        this.repository = repository;\n    }\n\n    async save(data: OAuth2AuthorizationState) : Promise<string> {\n        return this.repository.insert(data);\n    }\n\n    async verify(state: string, input: Partial<OAuth2AuthorizationState>): Promise<OAuth2AuthorizationState> {\n        const payload = await this.repository.findOneById(state);\n        if (!payload) {\n            throw OAuth2Error.stateInvalid();\n        }\n\n        // avoid replay attacks\n        await this.repository.remove(state);\n\n        if (\n            payload.ip &&\n            input.ip !== payload.ip\n        ) {\n            throw OAuth2Error.stateInvalid();\n        }\n\n        if (\n            payload.userAgent &&\n            input.userAgent !== payload.userAgent\n        ) {\n            throw OAuth2Error.stateInvalid();\n        }\n\n        return payload;\n    }\n}\n"],"mappings":";;AAcA,IAAaC,kCAAb,MAAaA;CACCC;CAEV,YAAYA,YAA6C;AACrD,OAAKA,aAAaA;;CAGtB,MAAMC,KAAKC,MAAkD;AACzD,SAAO,KAAKF,WAAWG,OAAOD,KAAAA;;CAGlC,MAAME,OAAOC,OAAeC,OAA6E;EACrG,MAAMC,UAAU,MAAM,KAAKP,WAAWQ,YAAYH,MAAAA;AAClD,MAAI,CAACE,QACD,OAAMT,YAAYW,cAAY;AAIlC,QAAM,KAAKT,WAAWU,OAAOL,MAAAA;AAE7B,MACIE,QAAQI,MACRL,MAAMK,OAAOJ,QAAQI,GAErB,OAAMb,YAAYW,cAAY;AAGlC,MACIF,QAAQK,aACRN,MAAMM,cAAcL,QAAQK,UAE5B,OAAMd,YAAYW,cAAY;AAGlC,SAAOF"}

package/dist/core/oauth2/authorization/state/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/authorization/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/client/index.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/client/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/grant-types/authorize.mjs

@@ -0,0 +1,50 @@
+import { OAuth2BaseGrant } from "./base.mjs";
+import { buildOAuth2BearerTokenResponse } from "../response/bearer.mjs";
+import { ScopeName } from "@authup/core-kit";
+import { hasOAuth2Scopes } from "@authup/specs";
+//#region src/core/oauth2/grant-types/authorize.ts
+var OAuth2AuthorizeGrant = class extends OAuth2BaseGrant {
+	refreshTokenIssuer;
+	constructor(ctx) {
+		super({
+			accessTokenIssuer: ctx.accessTokenIssuer,
+			sessionManager: ctx.sessionManager
+		});
+		this.refreshTokenIssuer = ctx.refreshTokenIssuer;
+	}
+	async runWith(authorizationCode, options = {}) {
+		const session = await this.sessionManager.create({
+			user_agent: options.userAgent,
+			ip_address: options.ipAddress,
+			realm_id: authorizationCode.realm_id,
+			client_id: authorizationCode.client_id,
+			sub_kind: authorizationCode.sub_kind,
+			sub: authorizationCode.sub
+		});
+		const issuePayload = {
+			user_agent: options.userAgent,
+			remote_address: options.ipAddress,
+			session_id: session.id,
+			sub: authorizationCode.sub || void 0,
+			sub_kind: authorizationCode.sub_kind,
+			realm_id: authorizationCode.realm_id,
+			realm_name: authorizationCode.realm_name,
+			scope: authorizationCode.scope || void 0,
+			client_id: authorizationCode.client_id || void 0
+		};
+		const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);
+		const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);
+		const buildContext = {
+			accessToken,
+			accessTokenPayload,
+			refreshToken,
+			refreshTokenPayload
+		};
+		if (authorizationCode.scope && hasOAuth2Scopes(authorizationCode.scope, ScopeName.OPEN_ID)) buildContext.idToken = authorizationCode.id_token || void 0;
+		return buildOAuth2BearerTokenResponse(buildContext);
+	}
+};
+//#endregion
+export { OAuth2AuthorizeGrant };
+
+//# sourceMappingURL=authorize.mjs.map

package/dist/core/oauth2/grant-types/authorize.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.mjs","names":["hasOAuth2Scopes","ScopeName","OAuth2BaseGrant","buildOAuth2BearerTokenResponse","OAuth2AuthorizeGrant","refreshTokenIssuer","ctx","accessTokenIssuer","sessionManager","runWith","authorizationCode","options","session","create","user_agent","userAgent","ip_address","ipAddress","realm_id","client_id","sub_kind","sub","issuePayload","remote_address","session_id","id","undefined","realm_name","scope","accessToken","accessTokenPayload","issue","refreshToken","refreshTokenPayload","buildContext","OPEN_ID","idToken","id_token"],"sources":["../../../../src/core/oauth2/grant-types/authorize.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { hasOAuth2Scopes } from '@authup/specs';\nimport type { OAuth2AuthorizationCode } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport type { IOAuth2TokenIssuer } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport type { IOAuth2Grant, OAuth2AuthorizeGrantContext, OAuth2GrantRunWIthOptions } from './types.ts';\nimport type { OAuth2BearerResponseBuildContext } from '../response/index.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\n\nexport class OAuth2AuthorizeGrant extends OAuth2BaseGrant<OAuth2AuthorizationCode> implements IOAuth2Grant {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    constructor(ctx: OAuth2AuthorizeGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n    }\n\n    async runWith(\n        authorizationCode: OAuth2AuthorizationCode,\n        options: OAuth2GrantRunWIthOptions = {},\n    ) : Promise<OAuth2TokenGrantResponse> {\n        const session = await this.sessionManager.create({\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: authorizationCode.realm_id,\n            client_id: authorizationCode.client_id,\n            sub_kind: authorizationCode.sub_kind,\n            sub: authorizationCode.sub,\n        });\n\n        const issuePayload : Partial<OAuth2TokenPayload> = {\n            user_agent: options.userAgent,\n            remote_address: options.ipAddress,\n            session_id: session.id,\n            sub: authorizationCode.sub || undefined,\n            sub_kind: authorizationCode.sub_kind,\n            realm_id: authorizationCode.realm_id,\n            realm_name: authorizationCode.realm_name,\n            scope: authorizationCode.scope || undefined,\n            client_id: authorizationCode.client_id || undefined,\n        };\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);\n\n        const buildContext : OAuth2BearerResponseBuildContext = {\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        };\n\n        if (\n            authorizationCode.scope &&\n            hasOAuth2Scopes(authorizationCode.scope, ScopeName.OPEN_ID)\n        ) {\n            buildContext.idToken = authorizationCode.id_token || undefined;\n        }\n\n        return buildOAuth2BearerTokenResponse(buildContext);\n    }\n}\n"],"mappings":";;;;;AAiBA,IAAaI,uBAAb,cAA0CF,gBAAAA;CAC5BG;CAEV,YAAYC,KAAkC;AAC1C,QAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;GACxB,CAAA;AAEA,OAAKH,qBAAqBC,IAAID;;CAGlC,MAAMI,QACFC,mBACAC,UAAqC,EAAE,EACL;EAClC,MAAMC,UAAU,MAAM,KAAKJ,eAAeK,OAAO;GAC7CC,YAAYH,QAAQI;GACpBC,YAAYL,QAAQM;GACpBC,UAAUR,kBAAkBQ;GAC5BC,WAAWT,kBAAkBS;GAC7BC,UAAUV,kBAAkBU;GAC5BC,KAAKX,kBAAkBW;GAC3B,CAAA;EAEA,MAAMC,eAA6C;GAC/CR,YAAYH,QAAQI;GACpBQ,gBAAgBZ,QAAQM;GACxBO,YAAYZ,QAAQa;GACpBJ,KAAKX,kBAAkBW,OAAOK,KAAAA;GAC9BN,UAAUV,kBAAkBU;GAC5BF,UAAUR,kBAAkBQ;GAC5BS,YAAYjB,kBAAkBiB;GAC9BC,OAAOlB,kBAAkBkB,SAASF,KAAAA;GAClCP,WAAWT,kBAAkBS,aAAaO,KAAAA;GAC9C;EAEA,MAAM,CAACG,aAAaC,sBAAsB,MAAM,KAAKvB,kBAAkBwB,MAAMT,aAAAA;EAC7E,MAAM,CAACU,cAAcC,uBAAuB,MAAM,KAAK5B,mBAAmB0B,MAAMT,aAAAA;EAEhF,MAAMY,eAAkD;GACpDL;GACAC;GACAE;GACAC;GACJ;AAEA,MACIvB,kBAAkBkB,SAClB5B,gBAAgBU,kBAAkBkB,OAAO3B,UAAUkC,QAAO,CAE1DD,cAAaE,UAAU1B,kBAAkB2B,YAAYX,KAAAA;AAGzD,SAAOvB,+BAA+B+B,aAAAA"}

package/dist/core/oauth2/grant-types/base.mjs

@@ -0,0 +1,13 @@
+//#region src/core/oauth2/grant-types/base.ts
+var OAuth2BaseGrant = class {
+	accessTokenIssuer;
+	sessionManager;
+	constructor(ctx) {
+		this.accessTokenIssuer = ctx.accessTokenIssuer;
+		this.sessionManager = ctx.sessionManager;
+	}
+};
+//#endregion
+export { OAuth2BaseGrant };
+
+//# sourceMappingURL=base.mjs.map

package/dist/core/oauth2/grant-types/base.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.mjs","names":["OAuth2BaseGrant","accessTokenIssuer","sessionManager","ctx"],"sources":["../../../../src/core/oauth2/grant-types/base.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ObjectLiteral } from '@authup/kit';\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport type { ISessionManager } from '../../authentication/index.ts';\nimport type { IOAuth2TokenIssuer } from '../token/index.ts';\nimport type { BaseGrantContext, IOAuth2Grant, OAuth2GrantRunWIthOptions } from './types.ts';\n\nexport abstract class OAuth2BaseGrant<\n    T = ObjectLiteral,\n> implements IOAuth2Grant<T> {\n    protected accessTokenIssuer : IOAuth2TokenIssuer;\n\n    protected sessionManager : ISessionManager;\n\n    // -----------------------------------------------------\n\n    constructor(ctx: BaseGrantContext) {\n        this.accessTokenIssuer = ctx.accessTokenIssuer;\n        this.sessionManager = ctx.sessionManager;\n    }\n\n    // -----------------------------------------------------\n\n    abstract runWith(input: T, options?: OAuth2GrantRunWIthOptions): Promise<OAuth2TokenGrantResponse>;\n}\n"],"mappings":";AAaA,IAAsBA,kBAAtB,MAAsBA;CAGRC;CAEAC;CAIV,YAAYC,KAAuB;AAC/B,OAAKF,oBAAoBE,IAAIF;AAC7B,OAAKC,iBAAiBC,IAAID"}

package/dist/core/oauth2/grant-types/client-credentials.mjs

@@ -0,0 +1,35 @@
+import { OAuth2BaseGrant } from "./base.mjs";
+import { buildOAuth2BearerTokenResponse } from "../response/bearer.mjs";
+import { IdentityType, ScopeName } from "@authup/core-kit";
+import { OAuth2SubKind } from "@authup/specs";
+//#region src/core/oauth2/grant-types/client-credentials.ts
+var ClientCredentialsGrant = class extends OAuth2BaseGrant {
+	async runWith(input, options = {}) {
+		const session = await this.sessionManager.create({
+			user_agent: options.userAgent,
+			ip_address: options.ipAddress,
+			realm_id: input.realm_id,
+			sub: input.id,
+			sub_kind: IdentityType.CLIENT
+		});
+		const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({
+			user_agent: session.user_agent,
+			remote_address: session.ip_address,
+			session_id: session.id,
+			scope: ScopeName.GLOBAL,
+			sub: input.id,
+			sub_kind: OAuth2SubKind.CLIENT,
+			realm_id: input.realm.id,
+			realm_name: input.realm.id,
+			client_id: input.id
+		});
+		return buildOAuth2BearerTokenResponse({
+			accessToken,
+			accessTokenPayload
+		});
+	}
+};
+//#endregion
+export { ClientCredentialsGrant };
+
+//# sourceMappingURL=client-credentials.mjs.map

package/dist/core/oauth2/grant-types/client-credentials.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-credentials.mjs","names":["OAuth2SubKind","IdentityType","ScopeName","OAuth2BaseGrant","buildOAuth2BearerTokenResponse","ClientCredentialsGrant","runWith","input","options","session","sessionManager","create","user_agent","userAgent","ip_address","ipAddress","realm_id","sub","id","sub_kind","CLIENT","accessToken","accessTokenPayload","accessTokenIssuer","issue","remote_address","session_id","scope","GLOBAL","realm","realm_name","client_id"],"sources":["../../../../src/core/oauth2/grant-types/client-credentials.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2SubKind } from '@authup/specs';\nimport type { Client } from '@authup/core-kit';\nimport {\n    IdentityType,\n    ScopeName,\n} from '@authup/core-kit';\nimport { OAuth2BaseGrant } from './base.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { OAuth2GrantRunWIthOptions } from './types.ts';\n\nexport class ClientCredentialsGrant extends OAuth2BaseGrant<Client> {\n    async runWith(input: Client, options: OAuth2GrantRunWIthOptions = {}) : Promise<OAuth2TokenGrantResponse> {\n        const session = await this.sessionManager.create({\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: input.realm_id,\n            sub: input.id,\n            sub_kind: IdentityType.CLIENT,\n        });\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            session_id: session.id,\n            scope: ScopeName.GLOBAL,\n            sub: input.id,\n            sub_kind: OAuth2SubKind.CLIENT,\n            realm_id: input.realm.id,\n            realm_name: input.realm.id,\n            client_id: input.id,\n        });\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;AAkBA,IAAaK,yBAAb,cAA4CF,gBAAAA;CACxC,MAAMG,QAAQC,OAAeC,UAAqC,EAAE,EAAsC;EACtG,MAAMC,UAAU,MAAM,KAAKC,eAAeC,OAAO;GAC7CC,YAAYJ,QAAQK;GACpBC,YAAYN,QAAQO;GACpBC,UAAUT,MAAMS;GAChBC,KAAKV,MAAMW;GACXC,UAAUlB,aAAamB;GAC3B,CAAA;EAEA,MAAM,CAACC,aAAaC,sBAAsB,MAAM,KAAKC,kBAAkBC,MAAM;GACzEZ,YAAYH,QAAQG;GACpBa,gBAAgBhB,QAAQK;GACxBY,YAAYjB,QAAQS;GACpBS,OAAOzB,UAAU0B;GACjBX,KAAKV,MAAMW;GACXC,UAAUnB,cAAcoB;GACxBJ,UAAUT,MAAMsB,MAAMX;GACtBY,YAAYvB,MAAMsB,MAAMX;GACxBa,WAAWxB,MAAMW;GACrB,CAAA;AAEA,SAAOd,+BAA+B;GAClCiB;GACAC;GACJ,CAAA"}

package/dist/core/oauth2/grant-types/identity.mjs

@@ -0,0 +1,46 @@
+import { OAuth2BaseGrant } from "./base.mjs";
+import { buildOAuth2BearerTokenResponse } from "../response/bearer.mjs";
+import { ScopeName } from "@authup/core-kit";
+//#region src/core/oauth2/grant-types/identity.ts
+var IdentityGrantType = class extends OAuth2BaseGrant {
+	refreshTokenIssuer;
+	constructor(ctx) {
+		super({
+			accessTokenIssuer: ctx.accessTokenIssuer,
+			sessionManager: ctx.sessionManager
+		});
+		this.refreshTokenIssuer = ctx.refreshTokenIssuer;
+	}
+	async runWith(identity, options = {}) {
+		const session = {
+			user_agent: options.userAgent,
+			ip_address: options.ipAddress,
+			realm_id: identity.data.realm_id,
+			sub: identity.data.id,
+			sub_kind: identity.type
+		};
+		const { id: sessionId } = await this.sessionManager.create(session);
+		const issuePayload = {
+			session_id: sessionId,
+			user_agent: session.user_agent,
+			remote_address: session.ip_address,
+			scope: ScopeName.GLOBAL,
+			realm_id: identity.data.realm_id,
+			realm_name: identity.data.realm?.name,
+			sub: identity.data.id,
+			sub_kind: identity.type
+		};
+		const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);
+		const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);
+		return buildOAuth2BearerTokenResponse({
+			accessToken,
+			accessTokenPayload,
+			refreshToken,
+			refreshTokenPayload
+		});
+	}
+};
+//#endregion
+export { IdentityGrantType };
+
+//# sourceMappingURL=identity.mjs.map

package/dist/core/oauth2/grant-types/identity.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.mjs","names":["ScopeName","OAuth2BaseGrant","buildOAuth2BearerTokenResponse","IdentityGrantType","refreshTokenIssuer","ctx","accessTokenIssuer","sessionManager","runWith","identity","options","session","user_agent","userAgent","ip_address","ipAddress","realm_id","data","sub","id","sub_kind","type","sessionId","create","issuePayload","session_id","remote_address","scope","GLOBAL","realm_name","realm","name","accessToken","accessTokenPayload","issue","refreshToken","refreshTokenPayload"],"sources":["../../../../src/core/oauth2/grant-types/identity.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport type { Identity, Session } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport type { IOAuth2TokenIssuer } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { OAuth2GrantRunWIthOptions, OAuth2IdentityGrantContext } from './types.ts';\n\nexport class IdentityGrantType extends OAuth2BaseGrant<Identity> {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    constructor(ctx: OAuth2IdentityGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n    }\n\n    async runWith(\n        identity: Identity,\n        options: OAuth2GrantRunWIthOptions = {},\n    ): Promise<OAuth2TokenGrantResponse> {\n        const session : Partial<Session> = {\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: identity.data.realm_id,\n            sub: identity.data.id,\n            sub_kind: identity.type,\n        };\n\n        const { id: sessionId } = await this.sessionManager.create(session);\n\n        const issuePayload : Partial<OAuth2TokenPayload> = {\n            session_id: sessionId,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            scope: ScopeName.GLOBAL,\n            realm_id: identity.data.realm_id,\n            realm_name: identity.data.realm?.name,\n            sub: identity.data.id,\n            sub_kind: identity.type,\n        };\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;AAeA,IAAaG,oBAAb,cAAuCF,gBAAAA;CACzBG;CAEV,YAAYC,KAAiC;AACzC,QAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;GACxB,CAAA;AAEA,OAAKH,qBAAqBC,IAAID;;CAGlC,MAAMI,QACFC,UACAC,UAAqC,EAAE,EACN;EACjC,MAAMC,UAA6B;GAC/BC,YAAYF,QAAQG;GACpBC,YAAYJ,QAAQK;GACpBC,UAAUP,SAASQ,KAAKD;GACxBE,KAAKT,SAASQ,KAAKE;GACnBC,UAAUX,SAASY;GACvB;EAEA,MAAM,EAAEF,IAAIG,cAAc,MAAM,KAAKf,eAAegB,OAAOZ,QAAAA;EAE3D,MAAMa,eAA6C;GAC/CC,YAAYH;GACZV,YAAYD,QAAQC;GACpBc,gBAAgBf,QAAQG;GACxBa,OAAO3B,UAAU4B;GACjBZ,UAAUP,SAASQ,KAAKD;GACxBa,YAAYpB,SAASQ,KAAKa,OAAOC;GACjCb,KAAKT,SAASQ,KAAKE;GACnBC,UAAUX,SAASY;GACvB;EAEA,MAAM,CAACW,aAAaC,sBAAsB,MAAM,KAAK3B,kBAAkB4B,MAAMV,aAAAA;EAC7E,MAAM,CAACW,cAAcC,uBAAuB,MAAM,KAAKhC,mBAAmB8B,MAAMV,aAAAA;AAEhF,SAAOtB,+BAA+B;GAClC8B;GACAC;GACAE;GACAC;GACJ,CAAA"}

package/dist/core/oauth2/grant-types/index.mjs

@@ -0,0 +1,7 @@
+import { OAuth2AuthorizeGrant } from "./authorize.mjs";
+import { ClientCredentialsGrant } from "./client-credentials.mjs";
+import { IdentityGrantType } from "./identity.mjs";
+import { PasswordGrantType } from "./password.mjs";
+import { OAuth2RefreshTokenGrant } from "./refresh-token.mjs";
+import { RobotCredentialsGrant } from "./robot-credentials.mjs";
+export { ClientCredentialsGrant, IdentityGrantType, OAuth2AuthorizeGrant, OAuth2RefreshTokenGrant, PasswordGrantType, RobotCredentialsGrant };

package/dist/core/oauth2/grant-types/password.mjs

@@ -0,0 +1,48 @@
+import { OAuth2BaseGrant } from "./base.mjs";
+import { buildOAuth2BearerTokenResponse } from "../response/bearer.mjs";
+import { IdentityType, ScopeName } from "@authup/core-kit";
+import { OAuth2SubKind } from "@authup/specs";
+//#region src/core/oauth2/grant-types/password.ts
+var PasswordGrantType = class extends OAuth2BaseGrant {
+	refreshTokenIssuer;
+	constructor(ctx) {
+		super({
+			accessTokenIssuer: ctx.accessTokenIssuer,
+			sessionManager: ctx.sessionManager
+		});
+		this.refreshTokenIssuer = ctx.refreshTokenIssuer;
+	}
+	async runWith(input, options = {}) {
+		const session = await this.sessionManager.create({
+			user_agent: options.userAgent,
+			ip_address: options.ipAddress,
+			realm_id: input.realm_id,
+			client_id: input.client_id || void 0,
+			sub: input.id,
+			sub_kind: IdentityType.USER
+		});
+		const issuePayload = {
+			client_id: input.client_id || void 0,
+			session_id: session.id,
+			user_agent: session.user_agent,
+			remote_address: session.ip_address,
+			scope: ScopeName.GLOBAL,
+			sub: input.id,
+			sub_kind: OAuth2SubKind.USER,
+			realm_id: input.realm_id,
+			realm_name: input.realm?.name
+		};
+		const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);
+		const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);
+		return buildOAuth2BearerTokenResponse({
+			accessToken,
+			accessTokenPayload,
+			refreshToken,
+			refreshTokenPayload
+		});
+	}
+};
+//#endregion
+export { PasswordGrantType };
+
+//# sourceMappingURL=password.mjs.map

package/dist/core/oauth2/grant-types/password.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.mjs","names":["OAuth2SubKind","IdentityType","ScopeName","buildOAuth2BearerTokenResponse","OAuth2BaseGrant","PasswordGrantType","refreshTokenIssuer","ctx","accessTokenIssuer","sessionManager","runWith","input","options","session","create","user_agent","userAgent","ip_address","ipAddress","realm_id","client_id","undefined","sub","id","sub_kind","USER","issuePayload","session_id","remote_address","scope","GLOBAL","realm_name","realm","name","accessToken","accessTokenPayload","issue","refreshToken","refreshTokenPayload"],"sources":["../../../../src/core/oauth2/grant-types/password.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2SubKind } from '@authup/specs';\nimport type { User } from '@authup/core-kit';\nimport {\n    IdentityType,\n    ScopeName,\n} from '@authup/core-kit';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { IOAuth2TokenIssuer } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport type { OAuth2GrantRunWIthOptions, OAuth2PasswordGrantContext } from './types.ts';\n\nexport class PasswordGrantType extends OAuth2BaseGrant<User> {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    constructor(ctx: OAuth2PasswordGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n    }\n\n    async runWith(input: User, options: OAuth2GrantRunWIthOptions = {}) : Promise<OAuth2TokenGrantResponse> {\n        const session = await this.sessionManager.create({\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: input.realm_id,\n            client_id: input.client_id || undefined,\n            sub: input.id,\n            sub_kind: IdentityType.USER,\n        });\n\n        const issuePayload : Partial<OAuth2TokenPayload> = {\n            client_id: input.client_id || undefined,\n            session_id: session.id,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            scope: ScopeName.GLOBAL,\n            sub: input.id,\n            sub_kind: OAuth2SubKind.USER,\n            realm_id: input.realm_id,\n            realm_name: input.realm?.name,\n        };\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;AAmBA,IAAaK,oBAAb,cAAuCD,gBAAAA;CACzBE;CAEV,YAAYC,KAAiC;AACzC,QAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;GACxB,CAAA;AAEA,OAAKH,qBAAqBC,IAAID;;CAGlC,MAAMI,QAAQC,OAAaC,UAAqC,EAAE,EAAsC;EACpG,MAAMC,UAAU,MAAM,KAAKJ,eAAeK,OAAO;GAC7CC,YAAYH,QAAQI;GACpBC,YAAYL,QAAQM;GACpBC,UAAUR,MAAMQ;GAChBC,WAAWT,MAAMS,aAAaC,KAAAA;GAC9BC,KAAKX,MAAMY;GACXC,UAAUvB,aAAawB;GAC3B,CAAA;EAEA,MAAMC,eAA6C;GAC/CN,WAAWT,MAAMS,aAAaC,KAAAA;GAC9BM,YAAYd,QAAQU;GACpBR,YAAYF,QAAQE;GACpBa,gBAAgBf,QAAQI;GACxBY,OAAO3B,UAAU4B;GACjBR,KAAKX,MAAMY;GACXC,UAAUxB,cAAcyB;GACxBN,UAAUR,MAAMQ;GAChBY,YAAYpB,MAAMqB,OAAOC;GAC7B;EAEA,MAAM,CAACC,aAAaC,sBAAsB,MAAM,KAAK3B,kBAAkB4B,MAAMV,aAAAA;EAC7E,MAAM,CAACW,cAAcC,uBAAuB,MAAM,KAAKhC,mBAAmB8B,MAAMV,aAAAA;AAEhF,SAAOvB,+BAA+B;GAClC+B;GACAC;GACAE;GACAC;GACJ,CAAA"}

package/dist/core/oauth2/grant-types/refresh-token.mjs

@@ -0,0 +1,53 @@
+import { OAuth2BaseGrant } from "./base.mjs";
+import { buildOAuth2BearerTokenResponse } from "../response/bearer.mjs";
+import { JWTError } from "@authup/specs";
+//#region src/core/oauth2/grant-types/refresh-token.ts
+var OAuth2RefreshTokenGrant = class extends OAuth2BaseGrant {
+	refreshTokenIssuer;
+	tokenVerifier;
+	tokenRevoker;
+	constructor(ctx) {
+		super({
+			accessTokenIssuer: ctx.accessTokenIssuer,
+			sessionManager: ctx.sessionManager
+		});
+		this.refreshTokenIssuer = ctx.refreshTokenIssuer;
+		this.tokenVerifier = ctx.tokenVerifier;
+		this.tokenRevoker = ctx.tokenRevoker;
+	}
+	async runWith(input, options = {}) {
+		let payload;
+		if (typeof input === "string") payload = await this.tokenVerifier.verify(input);
+		else payload = input;
+		await this.tokenRevoker.revoke(payload);
+		if (!payload.session_id) throw JWTError.payloadPropertyInvalid("session_id");
+		const session = await this.sessionManager.findOneById(payload.session_id);
+		if (!session) throw JWTError.payloadPropertyInvalid("session_id");
+		await this.sessionManager.verify(session);
+		if (options.userAgent) session.user_agent = options.userAgent;
+		if (options.ipAddress) session.ip_address = options.ipAddress;
+		await this.sessionManager.refresh(session);
+		const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({
+			...payload,
+			user_agent: session.user_agent,
+			remote_address: session.ip_address,
+			exp: this.accessTokenIssuer.buildExp()
+		});
+		const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue({
+			...payload,
+			user_agent: session.user_agent,
+			remote_address: session.ip_address,
+			exp: this.refreshTokenIssuer.buildExp()
+		});
+		return buildOAuth2BearerTokenResponse({
+			accessToken,
+			accessTokenPayload,
+			refreshToken,
+			refreshTokenPayload
+		});
+	}
+};
+//#endregion
+export { OAuth2RefreshTokenGrant };
+
+//# sourceMappingURL=refresh-token.mjs.map

package/dist/core/oauth2/grant-types/refresh-token.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-token.mjs","names":["JWTError","buildOAuth2BearerTokenResponse","OAuth2BaseGrant","OAuth2RefreshTokenGrant","refreshTokenIssuer","tokenVerifier","tokenRevoker","ctx","accessTokenIssuer","sessionManager","runWith","input","options","payload","verify","revoke","session_id","payloadPropertyInvalid","session","findOneById","userAgent","user_agent","ipAddress","ip_address","refresh","accessToken","accessTokenPayload","issue","remote_address","exp","buildExp","refreshToken","refreshTokenPayload"],"sources":["../../../../src/core/oauth2/grant-types/refresh-token.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { JWTError } from '@authup/specs';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { IOAuth2TokenIssuer, IOAuth2TokenRevoker, IOAuth2TokenVerifier } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport type { IOAuth2Grant, OAuth2GrantRunWIthOptions, OAuth2RefreshTokenGrantContext } from './types.ts';\n\nexport class OAuth2RefreshTokenGrant extends OAuth2BaseGrant<string | OAuth2TokenPayload> implements IOAuth2Grant {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    protected tokenVerifier : IOAuth2TokenVerifier;\n\n    protected tokenRevoker : IOAuth2TokenRevoker;\n\n    constructor(ctx: OAuth2RefreshTokenGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n\n        this.tokenVerifier = ctx.tokenVerifier;\n        this.tokenRevoker = ctx.tokenRevoker;\n    }\n\n    async runWith(\n        input: string | OAuth2TokenPayload,\n        options: OAuth2GrantRunWIthOptions = {},\n    ) : Promise<OAuth2TokenGrantResponse> {\n        let payload : OAuth2TokenPayload;\n        if (typeof input === 'string') {\n            payload = await this.tokenVerifier.verify(input);\n        } else {\n            payload = input;\n        }\n\n        await this.tokenRevoker.revoke(payload);\n\n        if (!payload.session_id) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        const session = await this.sessionManager.findOneById(payload.session_id);\n        if (!session) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        await this.sessionManager.verify(session);\n\n        if (options.userAgent) {\n            session.user_agent = options.userAgent;\n        }\n        if (options.ipAddress) {\n            session.ip_address = options.ipAddress;\n        }\n        await this.sessionManager.refresh(session);\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({\n            ...payload,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            exp: this.accessTokenIssuer.buildExp(),\n        });\n\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue({\n            ...payload,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            exp: this.refreshTokenIssuer.buildExp(),\n        });\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;AAcA,IAAaG,0BAAb,cAA6CD,gBAAAA;CAC/BE;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;AAC7C,QAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;GACxB,CAAA;AAEA,OAAKL,qBAAqBG,IAAIH;AAE9B,OAAKC,gBAAgBE,IAAIF;AACzB,OAAKC,eAAeC,IAAID;;CAG5B,MAAMI,QACFC,OACAC,UAAqC,EAAE,EACL;EAClC,IAAIC;AACJ,MAAI,OAAOF,UAAU,SACjBE,WAAU,MAAM,KAAKR,cAAcS,OAAOH,MAAAA;MAE1CE,WAAUF;AAGd,QAAM,KAAKL,aAAaS,OAAOF,QAAAA;AAE/B,MAAI,CAACA,QAAQG,WACT,OAAMhB,SAASiB,uBAAuB,aAAA;EAG1C,MAAMC,UAAU,MAAM,KAAKT,eAAeU,YAAYN,QAAQG,WAAU;AACxE,MAAI,CAACE,QACD,OAAMlB,SAASiB,uBAAuB,aAAA;AAG1C,QAAM,KAAKR,eAAeK,OAAOI,QAAAA;AAEjC,MAAIN,QAAQQ,UACRF,SAAQG,aAAaT,QAAQQ;AAEjC,MAAIR,QAAQU,UACRJ,SAAQK,aAAaX,QAAQU;AAEjC,QAAM,KAAKb,eAAee,QAAQN,QAAAA;EAElC,MAAM,CAACO,aAAaC,sBAAsB,MAAM,KAAKlB,kBAAkBmB,MAAM;GACzE,GAAGd;GACHQ,YAAYH,QAAQG;GACpBO,gBAAgBV,QAAQK;GACxBM,KAAK,KAAKrB,kBAAkBsB,UAAQ;GACxC,CAAA;EAEA,MAAM,CAACC,cAAcC,uBAAuB,MAAM,KAAK5B,mBAAmBuB,MAAM;GAC5E,GAAGd;GACHQ,YAAYH,QAAQG;GACpBO,gBAAgBV,QAAQK;GACxBM,KAAK,KAAKzB,mBAAmB0B,UAAQ;GACzC,CAAA;AAEA,SAAO7B,+BAA+B;GAClCwB;GACAC;GACAK;GACAC;GACJ,CAAA"}

package/dist/core/oauth2/grant-types/robot-credentials.mjs

@@ -0,0 +1,35 @@
+import { OAuth2BaseGrant } from "./base.mjs";
+import { buildOAuth2BearerTokenResponse } from "../response/bearer.mjs";
+import { IdentityType, ScopeName } from "@authup/core-kit";
+import { OAuth2SubKind } from "@authup/specs";
+//#region src/core/oauth2/grant-types/robot-credentials.ts
+var RobotCredentialsGrant = class extends OAuth2BaseGrant {
+	async runWith(input, options = {}) {
+		const session = await this.sessionManager.create({
+			user_agent: options.userAgent,
+			ip_address: options.ipAddress,
+			realm_id: input.realm_id,
+			sub: input.id,
+			sub_kind: IdentityType.ROBOT
+		});
+		const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({
+			session_id: session.id,
+			user_agent: session.user_agent,
+			remote_address: session.ip_address,
+			scope: ScopeName.GLOBAL,
+			sub: input.id,
+			sub_kind: OAuth2SubKind.ROBOT,
+			realm_id: input.realm.id,
+			realm_name: input.realm?.id,
+			client_id: input.client_id || void 0
+		});
+		return buildOAuth2BearerTokenResponse({
+			accessToken,
+			accessTokenPayload
+		});
+	}
+};
+//#endregion
+export { RobotCredentialsGrant };
+
+//# sourceMappingURL=robot-credentials.mjs.map

package/dist/core/oauth2/grant-types/robot-credentials.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"robot-credentials.mjs","names":["OAuth2SubKind","IdentityType","ScopeName","OAuth2BaseGrant","buildOAuth2BearerTokenResponse","RobotCredentialsGrant","runWith","input","options","session","sessionManager","create","user_agent","userAgent","ip_address","ipAddress","realm_id","sub","id","sub_kind","ROBOT","accessToken","accessTokenPayload","accessTokenIssuer","issue","session_id","remote_address","scope","GLOBAL","realm","realm_name","client_id","undefined"],"sources":["../../../../src/core/oauth2/grant-types/robot-credentials.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2SubKind } from '@authup/specs';\nimport type { Robot } from '@authup/core-kit';\nimport {\n    IdentityType,\n    ScopeName,\n} from '@authup/core-kit';\nimport { OAuth2BaseGrant } from './base.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { OAuth2GrantRunWIthOptions } from './types.ts';\n\nexport class RobotCredentialsGrant extends OAuth2BaseGrant<Robot> {\n    async runWith(input: Robot, options: OAuth2GrantRunWIthOptions = {}) : Promise<OAuth2TokenGrantResponse> {\n        const session = await this.sessionManager.create({\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: input.realm_id,\n            sub: input.id,\n            sub_kind: IdentityType.ROBOT,\n        });\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({\n            session_id: session.id,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            scope: ScopeName.GLOBAL,\n            sub: input.id,\n            sub_kind: OAuth2SubKind.ROBOT,\n            realm_id: input.realm.id,\n            realm_name: input.realm?.id,\n            client_id: input.client_id || undefined,\n        });\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;AAkBA,IAAaK,wBAAb,cAA2CF,gBAAAA;CACvC,MAAMG,QAAQC,OAAcC,UAAqC,EAAE,EAAsC;EACrG,MAAMC,UAAU,MAAM,KAAKC,eAAeC,OAAO;GAC7CC,YAAYJ,QAAQK;GACpBC,YAAYN,QAAQO;GACpBC,UAAUT,MAAMS;GAChBC,KAAKV,MAAMW;GACXC,UAAUlB,aAAamB;GAC3B,CAAA;EAEA,MAAM,CAACC,aAAaC,sBAAsB,MAAM,KAAKC,kBAAkBC,MAAM;GACzEC,YAAYhB,QAAQS;GACpBN,YAAYH,QAAQG;GACpBc,gBAAgBjB,QAAQK;GACxBa,OAAOzB,UAAU0B;GACjBX,KAAKV,MAAMW;GACXC,UAAUnB,cAAcoB;GACxBJ,UAAUT,MAAMsB,MAAMX;GACtBY,YAAYvB,MAAMsB,OAAOX;GACzBa,WAAWxB,MAAMwB,aAAaC,KAAAA;GAClC,CAAA;AAEA,SAAO5B,+BAA+B;GAClCiB;GACAC;GACJ,CAAA"}

package/dist/core/oauth2/grant-types/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/helpers/erorr.mjs

@@ -0,0 +1,26 @@
+import { sanitizeError } from "../../../utils/error.mjs";
+import "../../../utils/index.mjs";
+import { isObject } from "@authup/kit";
+import { OAuth2Error, OAuth2ErrorCode } from "@authup/specs";
+import { AuthupError } from "@authup/errors";
+//#region src/core/oauth2/helpers/erorr.ts
+/**
+* Transforms an unknown error to an OAuth2Error.
+*
+* @param err
+*/ function toOAuth2Error(err) {
+	if (err instanceof OAuth2Error) return err;
+	let next;
+	if (err instanceof AuthupError) next = err;
+	else next = sanitizeError(err);
+	next.data = {
+		error: OAuth2ErrorCode.INVALID_REQUEST,
+		error_description: next.message,
+		...isObject(next.data) ? next.data : {}
+	};
+	return next;
+}
+//#endregion
+export { toOAuth2Error };
+
+//# sourceMappingURL=erorr.mjs.map

package/dist/core/oauth2/helpers/erorr.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"erorr.mjs","names":["OAuth2Error","OAuth2ErrorCode","AuthupError","isObject","sanitizeError","toOAuth2Error","err","next","data","error","INVALID_REQUEST","error_description","message"],"sources":["../../../../src/core/oauth2/helpers/erorr.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { OAuth2Error, OAuth2ErrorCode } from '@authup/specs';\nimport { AuthupError } from '@authup/errors';\nimport { isObject } from '@authup/kit';\nimport { sanitizeError } from '../../../utils/index.ts';\n\n/**\n * Transforms an unknown error to an OAuth2Error.\n *\n * @param err\n */\nexport function toOAuth2Error(err: unknown) : AuthupError | OAuth2Error {\n    if (err instanceof OAuth2Error) {\n        return err;\n    }\n\n    let next : AuthupError;\n    if (err instanceof AuthupError) {\n        next = err;\n    } else {\n        next = sanitizeError(err);\n    }\n\n    next.data = {\n        error: OAuth2ErrorCode.INVALID_REQUEST,\n        error_description: next.message,\n        ...(isObject(next.data) ? next.data : {}),\n    };\n\n    return next;\n}\n"],"mappings":";;;;;;;;;;GAiBA,SAAgBK,cAAcC,KAAY;AACtC,KAAIA,eAAeN,YACf,QAAOM;CAGX,IAAIC;AACJ,KAAID,eAAeJ,YACfK,QAAOD;KAEPC,QAAOH,cAAcE,IAAAA;AAGzBC,MAAKC,OAAO;EACRC,OAAOR,gBAAgBS;EACvBC,mBAAmBJ,KAAKK;EACxB,GAAIT,SAASI,KAAKC,KAAI,GAAID,KAAKC,OAAO,EAAE;EAC5C;AAEA,QAAOD"}

package/dist/core/oauth2/helpers/index.mjs

@@ -0,0 +1,2 @@
+import { toOAuth2Error } from "./erorr.mjs";
+export { toOAuth2Error };

package/dist/core/oauth2/index.mjs

@@ -0,0 +1,28 @@
+import { OAuth2AuthorizationCodeIssuer } from "./authorization/code/issuer/module.mjs";
+import { base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, generateOAuth2CodeVerifier } from "./authorization/helpers.mjs";
+import { OAuth2AuthorizationCodeVerifier } from "./authorization/code/verifier/module.mjs";
+import { OAuth2AuthorizationCodeRequestVerifier } from "./authorization/code-request/verifier/module.mjs";
+import { OAuth2AuthorizationCodeRequestValidator } from "./authorization/code-request/validator.mjs";
+import { OAuth2AuthorizationStateManager } from "./authorization/state/module.mjs";
+import { OAuth2Authorization } from "./authorization/module.mjs";
+import "./authorization/index.mjs";
+import { buildOAuth2BearerTokenResponse } from "./response/bearer.mjs";
+import { OAuth2AuthorizeGrant } from "./grant-types/authorize.mjs";
+import { ClientCredentialsGrant } from "./grant-types/client-credentials.mjs";
+import { IdentityGrantType } from "./grant-types/identity.mjs";
+import { PasswordGrantType } from "./grant-types/password.mjs";
+import { OAuth2RefreshTokenGrant } from "./grant-types/refresh-token.mjs";
+import { RobotCredentialsGrant } from "./grant-types/robot-credentials.mjs";
+import "./grant-types/index.mjs";
+import { OAuth2OpenIDClaimsBuilder } from "./openid/claims.mjs";
+import "./openid/index.mjs";
+import { OAuth2ScopeAttributesResolver } from "./scope/resolver.mjs";
+import "./scope/index.mjs";
+import { OAuth2AccessTokenIssuer } from "./token/issuer/access/module.mjs";
+import { OAuth2OpenIDTokenIssuer } from "./token/issuer/open-id/module.mjs";
+import { OAuth2RefreshTokenIssuer } from "./token/issuer/refresh/module.mjs";
+import { OAuth2TokenRevoker } from "./token/revoker/module.mjs";
+import { OAuth2TokenSigner } from "./token/signer/module.mjs";
+import { OAuth2TokenVerifier } from "./token/verifier/module.mjs";
+import "./token/index.mjs";
+export { ClientCredentialsGrant, IdentityGrantType, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PasswordGrantType, RobotCredentialsGrant, base64URLEncode, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, generateOAuth2CodeVerifier };

package/dist/core/oauth2/key/index.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/key/types.mjs

@@ -0,0 +1 @@
+export {};