@authup/server-core 1.0.0-beta.36 → 1.0.0-beta.38

package/dist/core/oauth2/openid/claims.mjs

@@ -0,0 +1,75 @@
+import { hasOwnProperty } from "@authup/kit";
+import { OAuth2SubKind } from "@authup/specs";
+//#region src/core/oauth2/openid/claims.ts
+var OAuth2OpenIDClaimsBuilder = class {
+	clientMap = {
+		name: "name",
+		nickname: "name",
+		preferred_username: "name",
+		updated_at: ["updated_at", (value) => {
+			if (typeof value === "string") return Math.floor(new Date(value).getTime() / 1e3);
+			if (value instanceof Date) return Math.floor(value.getTime() / 1e3);
+			return value;
+		}]
+	};
+	robotMap = {
+		name: "name",
+		nickname: "name",
+		preferred_username: "name",
+		updated_at: ["updated_at", (value) => {
+			if (typeof value === "string") return Math.floor(new Date(value).getTime() / 1e3);
+			if (value instanceof Date) return Math.floor(value.getTime() / 1e3);
+			return value;
+		}]
+	};
+	userMap = {
+		name: "name",
+		family_name: "last_name",
+		given_name: "first_name",
+		nickname: "display_name",
+		preferred_username: "display_name",
+		updated_at: ["updated_at", (value) => {
+			if (typeof value === "string") return Math.floor(new Date(value).getTime() / 1e3);
+			if (value instanceof Date) return Math.floor(value.getTime() / 1e3);
+			return value;
+		}],
+		email: "email",
+		email_verified: "active"
+	};
+	/**
+	* Build OpenID Claims form Oauth2 Identity.
+	*
+	* @param identity
+	*/ fromIdentity(identity) {
+		if (identity.type === OAuth2SubKind.CLIENT) return this.fromClient(identity.data);
+		if (identity.type === OAuth2SubKind.ROBOT) return this.fromRobot(identity.data);
+		return this.fromUser(identity.data);
+	}
+	fromClient(input) {
+		return this.extract(this.clientMap, input);
+	}
+	fromRobot(input) {
+		return this.extract(this.robotMap, input);
+	}
+	fromUser(input) {
+		return this.extract(this.userMap, input);
+	}
+	extract(attributeMap, attributes) {
+		const result = {};
+		const keys = Object.keys(attributeMap);
+		for (const key_ of keys) {
+			const attribute = attributeMap[key_];
+			if (typeof attribute === "string") {
+				if (hasOwnProperty(attributes, attribute)) result[key_] = attributes[attribute];
+			} else {
+				const [key, transformer] = attribute;
+				if (hasOwnProperty(attributes, key)) result[key_] = transformer(attributes[key]);
+			}
+		}
+		return result;
+	}
+};
+//#endregion
+export { OAuth2OpenIDClaimsBuilder };
+
+//# sourceMappingURL=claims.mjs.map

package/dist/core/oauth2/openid/claims.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.mjs","names":["hasOwnProperty","OAuth2SubKind","OAuth2OpenIDClaimsBuilder","clientMap","name","nickname","preferred_username","updated_at","value","Math","floor","Date","getTime","robotMap","userMap","family_name","given_name","email","email_verified","fromIdentity","identity","type","CLIENT","fromClient","data","ROBOT","fromRobot","fromUser","input","extract","attributeMap","attributes","result","keys","Object","key_","attribute","key","transformer"],"sources":["../../../../src/core/oauth2/openid/claims.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Client, \n    Identity, \n    Robot, \n    User,\n} from '@authup/core-kit';\nimport { hasOwnProperty } from '@authup/kit';\nimport type { OpenIDTokenPayload } from '@authup/specs';\nimport { OAuth2SubKind } from '@authup/specs';\nimport type { ObjectLiteral } from 'validup';\n\ntype AttributeMapTuple<T> = {\n    [K in keyof T]: [K, (value: unknown) => any]\n}[keyof T];\n\ntype AttributeMap<T extends Record<string, any>> = Record<\n    keyof OpenIDTokenPayload,\nkeyof T | AttributeMapTuple<T>\n>;\n\nexport class OAuth2OpenIDClaimsBuilder {\n    protected clientMap : AttributeMap<Client> = {\n        name: 'name',\n        nickname: 'name',\n        preferred_username: 'name',\n        updated_at: [\n            'updated_at',\n            (value: unknown) => {\n                if (typeof value === 'string') {\n                    return Math.floor(new Date(value).getTime() / 1000);\n                }\n\n                if (value instanceof Date) {\n                    return Math.floor(value.getTime() / 1000);\n                }\n\n                return value;\n            },\n        ],\n    };\n\n    protected robotMap : AttributeMap<Robot> = {\n        name: 'name',\n        nickname: 'name',\n        preferred_username: 'name',\n        updated_at: [\n            'updated_at',\n            (value: unknown) => {\n                if (typeof value === 'string') {\n                    return Math.floor(new Date(value).getTime() / 1000);\n                }\n\n                if (value instanceof Date) {\n                    return Math.floor(value.getTime() / 1000);\n                }\n\n                return value;\n            },\n        ],\n    };\n\n    protected userMap : AttributeMap<User> = {\n        name: 'name',\n        family_name: 'last_name',\n        given_name: 'first_name',\n        nickname: 'display_name',\n        preferred_username: 'display_name',\n        updated_at: [\n            'updated_at',\n            (value: unknown) => {\n                if (typeof value === 'string') {\n                    return Math.floor(new Date(value).getTime() / 1000);\n                }\n\n                if (value instanceof Date) {\n                    return Math.floor(value.getTime() / 1000);\n                }\n\n                return value;\n            },\n        ],\n\n        email: 'email',\n        email_verified: 'active',\n    };\n\n    /**\n     * Build OpenID Claims form Oauth2 Identity.\n     *\n     * @param identity\n     */\n    fromIdentity(identity: Identity) : OpenIDTokenPayload {\n        if (identity.type === OAuth2SubKind.CLIENT) {\n            return this.fromClient(identity.data);\n        }\n\n        if (identity.type === OAuth2SubKind.ROBOT) {\n            return this.fromRobot(identity.data);\n        }\n\n        return this.fromUser(identity.data);\n    }\n\n    fromClient(input: Client) : OpenIDTokenPayload {\n        return this.extract(this.clientMap, input);\n    }\n\n    fromRobot(input: Robot): OpenIDTokenPayload {\n        return this.extract(this.robotMap, input);\n    }\n\n    fromUser(input: User) : OpenIDTokenPayload {\n        return this.extract(this.userMap, input);\n    }\n\n    protected extract<T extends ObjectLiteral = ObjectLiteral>(\n        attributeMap: AttributeMap<T>,\n        attributes: T,\n    ) : OpenIDTokenPayload {\n        const result = {} as OpenIDTokenPayload;\n\n        const keys = Object.keys(attributeMap);\n        for (const key_ of keys) {\n            const attribute = attributeMap[key_];\n            if (typeof attribute === 'string') {\n                if (hasOwnProperty(attributes, attribute)) {\n                    result[key_] = attributes[attribute];\n                }\n            } else {\n                const [key, transformer] = attribute as AttributeMapTuple<T>;\n\n                if (hasOwnProperty(attributes, key)) {\n                    result[key_] = transformer(attributes[key]);\n                }\n            }\n        }\n\n        return result;\n    }\n}\n"],"mappings":";;;AA2BA,IAAaE,4BAAb,MAAaA;CACCC,YAAmC;EACzCC,MAAM;EACNC,UAAU;EACVC,oBAAoB;EACpBC,YAAY,CACR,eACCC,UAAAA;AACG,OAAI,OAAOA,UAAU,SACjB,QAAOC,KAAKC,MAAM,IAAIC,KAAKH,MAAAA,CAAOI,SAAO,GAAK,IAAA;AAGlD,OAAIJ,iBAAiBG,KACjB,QAAOF,KAAKC,MAAMF,MAAMI,SAAO,GAAK,IAAA;AAGxC,UAAOJ;IAEd;EACL;CAEUK,WAAiC;EACvCT,MAAM;EACNC,UAAU;EACVC,oBAAoB;EACpBC,YAAY,CACR,eACCC,UAAAA;AACG,OAAI,OAAOA,UAAU,SACjB,QAAOC,KAAKC,MAAM,IAAIC,KAAKH,MAAAA,CAAOI,SAAO,GAAK,IAAA;AAGlD,OAAIJ,iBAAiBG,KACjB,QAAOF,KAAKC,MAAMF,MAAMI,SAAO,GAAK,IAAA;AAGxC,UAAOJ;IAEd;EACL;CAEUM,UAA+B;EACrCV,MAAM;EACNW,aAAa;EACbC,YAAY;EACZX,UAAU;EACVC,oBAAoB;EACpBC,YAAY,CACR,eACCC,UAAAA;AACG,OAAI,OAAOA,UAAU,SACjB,QAAOC,KAAKC,MAAM,IAAIC,KAAKH,MAAAA,CAAOI,SAAO,GAAK,IAAA;AAGlD,OAAIJ,iBAAiBG,KACjB,QAAOF,KAAKC,MAAMF,MAAMI,SAAO,GAAK,IAAA;AAGxC,UAAOJ;IAEd;EAEDS,OAAO;EACPC,gBAAgB;EACpB;;;;;IAOAC,aAAaC,UAAyC;AAClD,MAAIA,SAASC,SAASpB,cAAcqB,OAChC,QAAO,KAAKC,WAAWH,SAASI,KAAI;AAGxC,MAAIJ,SAASC,SAASpB,cAAcwB,MAChC,QAAO,KAAKC,UAAUN,SAASI,KAAI;AAGvC,SAAO,KAAKG,SAASP,SAASI,KAAI;;CAGtCD,WAAWK,OAAoC;AAC3C,SAAO,KAAKC,QAAQ,KAAK1B,WAAWyB,MAAAA;;CAGxCF,UAAUE,OAAkC;AACxC,SAAO,KAAKC,QAAQ,KAAKhB,UAAUe,MAAAA;;CAGvCD,SAASC,OAAkC;AACvC,SAAO,KAAKC,QAAQ,KAAKf,SAASc,MAAAA;;CAG5BC,QACNC,cACAC,YACmB;EACnB,MAAMC,SAAS,EAAC;EAEhB,MAAMC,OAAOC,OAAOD,KAAKH,aAAAA;AACzB,OAAK,MAAMK,QAAQF,MAAM;GACrB,MAAMG,YAAYN,aAAaK;AAC/B,OAAI,OAAOC,cAAc;QACjBpC,eAAe+B,YAAYK,UAAAA,CAC3BJ,QAAOG,QAAQJ,WAAWK;UAE3B;IACH,MAAM,CAACC,KAAKC,eAAeF;AAE3B,QAAIpC,eAAe+B,YAAYM,IAAAA,CAC3BL,QAAOG,QAAQG,YAAYP,WAAWM,KAAI;;;AAKtD,SAAOL"}

package/dist/core/oauth2/openid/index.mjs

@@ -0,0 +1,2 @@
+import { OAuth2OpenIDClaimsBuilder } from "./claims.mjs";
+export { OAuth2OpenIDClaimsBuilder };

package/dist/core/oauth2/response/bearer.mjs

@@ -0,0 +1,24 @@
+//#region src/core/oauth2/response/bearer.ts
+function resolveExpiresIn(payload, fallbackValue) {
+	if (payload && payload.exp) return payload.exp - Math.floor((/* @__PURE__ */ new Date()).getTime() / 1e3);
+	return fallbackValue || 3600;
+}
+function buildOAuth2BearerTokenResponse(context) {
+	const response = {
+		access_token: context.accessToken,
+		expires_in: resolveExpiresIn(context.accessTokenPayload),
+		token_type: "Bearer"
+	};
+	if (context.accessTokenPayload) response.scope = context.accessTokenPayload.scope;
+	else if (context.scope) response.scope = context.scope;
+	if (context.refreshToken) {
+		response.refresh_token = context.refreshToken;
+		response.refresh_token_expires_in = resolveExpiresIn(context.refreshTokenPayload);
+	}
+	if (context.idToken) response.id_token = context.idToken;
+	return response;
+}
+//#endregion
+export { buildOAuth2BearerTokenResponse };
+
+//# sourceMappingURL=bearer.mjs.map

package/dist/core/oauth2/response/bearer.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer.mjs","names":["resolveExpiresIn","payload","fallbackValue","exp","Math","floor","Date","getTime","buildOAuth2BearerTokenResponse","context","response","access_token","accessToken","expires_in","accessTokenPayload","token_type","scope","refreshToken","refresh_token","refresh_token_expires_in","refreshTokenPayload","idToken","id_token"],"sources":["../../../../src/core/oauth2/response/bearer.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport type { OAuth2BearerResponseBuildContext } from './type.ts';\n\nfunction resolveExpiresIn(payload?: OAuth2TokenPayload, fallbackValue?: number) : number {\n    if (payload && payload.exp) {\n        return payload.exp - Math.floor(new Date().getTime() / 1000);\n    }\n\n    return fallbackValue || 3_600;\n}\n\nexport function buildOAuth2BearerTokenResponse(\n    context: OAuth2BearerResponseBuildContext,\n) : OAuth2TokenGrantResponse {\n    const response : OAuth2TokenGrantResponse = {\n        access_token: context.accessToken,\n        expires_in: resolveExpiresIn(context.accessTokenPayload),\n        token_type: 'Bearer',\n    };\n\n    if (context.accessTokenPayload) {\n        response.scope = context.accessTokenPayload.scope;\n    } else if (context.scope) {\n        response.scope = context.scope;\n    }\n\n    if (context.refreshToken) {\n        response.refresh_token = context.refreshToken;\n        response.refresh_token_expires_in = resolveExpiresIn(context.refreshTokenPayload);\n    }\n\n    if (context.idToken) {\n        response.id_token = context.idToken;\n    }\n\n    return response;\n}\n"],"mappings":";AAUA,SAASA,iBAAiBC,SAA8BC,eAAsB;AAC1E,KAAID,WAAWA,QAAQE,IACnB,QAAOF,QAAQE,MAAMC,KAAKC,uBAAM,IAAIC,MAAAA,EAAOC,SAAO,GAAK,IAAA;AAG3D,QAAOL,iBAAiB;;AAG5B,SAAgBM,+BACZC,SAAyC;CAEzC,MAAMC,WAAsC;EACxCC,cAAcF,QAAQG;EACtBC,YAAYb,iBAAiBS,QAAQK,mBAAkB;EACvDC,YAAY;EAChB;AAEA,KAAIN,QAAQK,mBACRJ,UAASM,QAAQP,QAAQK,mBAAmBE;UACrCP,QAAQO,MACfN,UAASM,QAAQP,QAAQO;AAG7B,KAAIP,QAAQQ,cAAc;AACtBP,WAASQ,gBAAgBT,QAAQQ;AACjCP,WAASS,2BAA2BnB,iBAAiBS,QAAQW,oBAAmB;;AAGpF,KAAIX,QAAQY,QACRX,UAASY,WAAWb,QAAQY;AAGhC,QAAOX"}

package/dist/core/oauth2/response/index.mjs

@@ -0,0 +1,2 @@
+import { buildOAuth2BearerTokenResponse } from "./bearer.mjs";
+export { buildOAuth2BearerTokenResponse };

package/dist/core/oauth2/response/type.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/scope/index.mjs

@@ -0,0 +1,2 @@
+import { OAuth2ScopeAttributesResolver } from "./resolver.mjs";
+export { OAuth2ScopeAttributesResolver };

package/dist/core/oauth2/scope/resolver.mjs

@@ -0,0 +1,93 @@
+import { ScopeName } from "@authup/core-kit";
+import { hasOwnProperty } from "@authup/kit";
+import { OAuth2SubKind, unwrapOAuth2Scope } from "@authup/specs";
+import { distinctArray } from "smob";
+//#region src/core/oauth2/scope/resolver.ts
+var OAuth2ScopeAttributesResolver = class {
+	clientAttributes = {
+		[ScopeName.IDENTITY]: ["name"],
+		[ScopeName.OPEN_ID]: [
+			"name",
+			"display_name",
+			"updated_at",
+			"active"
+		]
+	};
+	robotAttributes = {
+		[ScopeName.IDENTITY]: ["name"],
+		[ScopeName.OPEN_ID]: [
+			"name",
+			"display_name",
+			"updated_at",
+			"active"
+		]
+	};
+	userAttributes = {
+		[ScopeName.IDENTITY]: [
+			"name",
+			"display_name",
+			"last_name",
+			"first_name"
+		],
+		[ScopeName.EMAIL]: ["email"],
+		[ScopeName.OPEN_ID]: [
+			"name",
+			"updated_at",
+			"first_name",
+			"last_name",
+			"display_name",
+			"active",
+			"email"
+		]
+	};
+	/**
+	* Resolve attributes for sub kind.
+	*
+	* @param type
+	* @param scope
+	*/ resolveFor(type, scope) {
+		if (type === OAuth2SubKind.CLIENT) return this.resolveForClient(scope);
+		if (type === OAuth2SubKind.ROBOT) return this.resolveForRobot(scope);
+		return this.resolveForUser(scope);
+	}
+	resolveForClient(scope) {
+		const attributes = [];
+		const scopes = unwrapOAuth2Scope(scope);
+		for (const scope of scopes) {
+			if (hasOwnProperty(this.clientAttributes, scope)) attributes.push(...this.clientAttributes[scope]);
+			if (scope === ScopeName.GLOBAL) {
+				attributes.push(...Object.values(this.clientAttributes).flat());
+				break;
+			}
+		}
+		return distinctArray(attributes);
+	}
+	resolveForRobot(scope) {
+		const attributes = [];
+		const scopes = unwrapOAuth2Scope(scope);
+		for (const scope of scopes) {
+			if (hasOwnProperty(this.robotAttributes, scope)) attributes.push(...this.robotAttributes[scope]);
+			if (scope === ScopeName.GLOBAL) {
+				attributes.push(...Object.values(this.robotAttributes).flat());
+				break;
+			}
+		}
+		return distinctArray(attributes);
+	}
+	resolveForUser(scope) {
+		const attributes = [];
+		const scopes = unwrapOAuth2Scope(scope);
+		for (const scope of scopes) {
+			if (hasOwnProperty(this.userAttributes, scope)) attributes.push(...this.userAttributes[scope]);
+			if (scope === ScopeName.GLOBAL) {
+				attributes.push(...Object.values(this.userAttributes).flat());
+				break;
+			}
+		}
+		return distinctArray(attributes);
+	}
+};
+//#endregion
+export { OAuth2ScopeAttributesResolver };
+
+//# sourceMappingURL=resolver.mjs.map

package/dist/core/oauth2/scope/resolver.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.mjs","names":["ScopeName","hasOwnProperty","OAuth2SubKind","unwrapOAuth2Scope","distinctArray","OAuth2ScopeAttributesResolver","clientAttributes","IDENTITY","OPEN_ID","robotAttributes","userAttributes","EMAIL","resolveFor","type","scope","CLIENT","resolveForClient","ROBOT","resolveForRobot","resolveForUser","attributes","scopes","push","GLOBAL","Object","values","flat"],"sources":["../../../../src/core/oauth2/scope/resolver.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Client, Robot, User } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport { hasOwnProperty } from '@authup/kit';\nimport { OAuth2SubKind, unwrapOAuth2Scope } from '@authup/specs';\nimport { distinctArray } from 'smob';\nimport type { ObjectLiteral } from 'validup';\n\ntype ScopeFields<T extends ObjectLiteral = ObjectLiteral> = {\n    [key: string]: (keyof T & string)[]\n};\n\nexport class OAuth2ScopeAttributesResolver {\n    protected clientAttributes : ScopeFields<Client> = {\n        [ScopeName.IDENTITY]: ['name'],\n        [ScopeName.OPEN_ID]: ['name', 'display_name', 'updated_at', 'active'],\n    };\n\n    protected robotAttributes : ScopeFields<Robot> = {\n        [ScopeName.IDENTITY]: ['name'],\n        [ScopeName.OPEN_ID]: ['name', 'display_name', 'updated_at', 'active'],\n    };\n\n    protected userAttributes : ScopeFields<User> = {\n        [ScopeName.IDENTITY]: ['name', 'display_name', 'last_name', 'first_name'],\n        [ScopeName.EMAIL]: ['email'],\n        [ScopeName.OPEN_ID]: ['name', 'updated_at', 'first_name', 'last_name', 'display_name', 'active', 'email'],\n    };\n\n    /**\n     * Resolve attributes for sub kind.\n     *\n     * @param type\n     * @param scope\n     */\n    resolveFor(type: OAuth2SubKind, scope: string | string[]) {\n        if (type === OAuth2SubKind.CLIENT) {\n            return this.resolveForClient(scope);\n        }\n\n        if (type === OAuth2SubKind.ROBOT) {\n            return this.resolveForRobot(scope);\n        }\n\n        return this.resolveForUser(scope);\n    }\n\n    resolveForClient(scope: string | string[]) : string[] {\n        const attributes : string[] = [];\n        const scopes = unwrapOAuth2Scope(scope);\n\n        for (const scope of scopes) {\n            if (hasOwnProperty(this.clientAttributes, scope)) {\n                attributes.push(...this.clientAttributes[scope]);\n            }\n\n            if (scope === ScopeName.GLOBAL) {\n                attributes.push(...Object.values(this.clientAttributes).flat());\n                break;\n            }\n        }\n\n        return distinctArray(attributes);\n    }\n\n    resolveForRobot(scope: string | string[]) : string[] {\n        const attributes : string[] = [];\n        const scopes = unwrapOAuth2Scope(scope);\n\n        for (const scope of scopes) {\n            if (hasOwnProperty(this.robotAttributes, scope)) {\n                attributes.push(...this.robotAttributes[scope]);\n            }\n\n            if (scope === ScopeName.GLOBAL) {\n                attributes.push(...Object.values(this.robotAttributes).flat());\n                break;\n            }\n        }\n\n        return distinctArray(attributes);\n    }\n\n    resolveForUser(scope: string | string[]) : string[] {\n        const attributes : string[] = [];\n        const scopes = unwrapOAuth2Scope(scope);\n\n        for (const scope of scopes) {\n            if (hasOwnProperty(this.userAttributes, scope)) {\n                attributes.push(...this.userAttributes[scope]);\n            }\n\n            if (scope === ScopeName.GLOBAL) {\n                attributes.push(...Object.values(this.userAttributes).flat());\n                break;\n            }\n        }\n\n        return distinctArray(attributes);\n    }\n}\n"],"mappings":";;;;;AAkBA,IAAaK,gCAAb,MAAaA;CACCC,mBAAyC;GAC9CN,UAAUO,WAAW,CAAC,OAAO;GAC7BP,UAAUQ,UAAU;GAAC;GAAQ;GAAgB;GAAc;GAAS;EACzE;CAEUC,kBAAuC;GAC5CT,UAAUO,WAAW,CAAC,OAAO;GAC7BP,UAAUQ,UAAU;GAAC;GAAQ;GAAgB;GAAc;GAAS;EACzE;CAEUE,iBAAqC;GAC1CV,UAAUO,WAAW;GAAC;GAAQ;GAAgB;GAAa;GAAa;GACxEP,UAAUW,QAAQ,CAAC,QAAQ;GAC3BX,UAAUQ,UAAU;GAAC;GAAQ;GAAc;GAAc;GAAa;GAAgB;GAAU;GAAQ;EAC7G;;;;;;IAQAI,WAAWC,MAAqBC,OAA0B;AACtD,MAAID,SAASX,cAAca,OACvB,QAAO,KAAKC,iBAAiBF,MAAAA;AAGjC,MAAID,SAASX,cAAce,MACvB,QAAO,KAAKC,gBAAgBJ,MAAAA;AAGhC,SAAO,KAAKK,eAAeL,MAAAA;;CAG/BE,iBAAiBF,OAAqC;EAClD,MAAMM,aAAwB,EAAE;EAChC,MAAMC,SAASlB,kBAAkBW,MAAAA;AAEjC,OAAK,MAAMA,SAASO,QAAQ;AACxB,OAAIpB,eAAe,KAAKK,kBAAkBQ,MAAAA,CACtCM,YAAWE,KAAI,GAAI,KAAKhB,iBAAiBQ,OAAM;AAGnD,OAAIA,UAAUd,UAAUuB,QAAQ;AAC5BH,eAAWE,KAAI,GAAIE,OAAOC,OAAO,KAAKnB,iBAAgB,CAAEoB,MAAI,CAAA;AAC5D;;;AAIR,SAAOtB,cAAcgB,WAAAA;;CAGzBF,gBAAgBJ,OAAqC;EACjD,MAAMM,aAAwB,EAAE;EAChC,MAAMC,SAASlB,kBAAkBW,MAAAA;AAEjC,OAAK,MAAMA,SAASO,QAAQ;AACxB,OAAIpB,eAAe,KAAKQ,iBAAiBK,MAAAA,CACrCM,YAAWE,KAAI,GAAI,KAAKb,gBAAgBK,OAAM;AAGlD,OAAIA,UAAUd,UAAUuB,QAAQ;AAC5BH,eAAWE,KAAI,GAAIE,OAAOC,OAAO,KAAKhB,gBAAe,CAAEiB,MAAI,CAAA;AAC3D;;;AAIR,SAAOtB,cAAcgB,WAAAA;;CAGzBD,eAAeL,OAAqC;EAChD,MAAMM,aAAwB,EAAE;EAChC,MAAMC,SAASlB,kBAAkBW,MAAAA;AAEjC,OAAK,MAAMA,SAASO,QAAQ;AACxB,OAAIpB,eAAe,KAAKS,gBAAgBI,MAAAA,CACpCM,YAAWE,KAAI,GAAI,KAAKZ,eAAeI,OAAM;AAGjD,OAAIA,UAAUd,UAAUuB,QAAQ;AAC5BH,eAAWE,KAAI,GAAIE,OAAOC,OAAO,KAAKf,eAAc,CAAEgB,MAAI,CAAA;AAC1D;;;AAIR,SAAOtB,cAAcgB,WAAAA"}

package/dist/core/oauth2/scope/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/token/index.mjs

@@ -0,0 +1,11 @@
+import { OAuth2AccessTokenIssuer } from "./issuer/access/module.mjs";
+import { OAuth2OpenIDTokenIssuer } from "./issuer/open-id/module.mjs";
+import { OAuth2RefreshTokenIssuer } from "./issuer/refresh/module.mjs";
+import "./issuer/index.mjs";
+import { OAuth2TokenRevoker } from "./revoker/module.mjs";
+import "./revoker/index.mjs";
+import { OAuth2TokenSigner } from "./signer/module.mjs";
+import "./signer/index.mjs";
+import { OAuth2TokenVerifier } from "./verifier/module.mjs";
+import "./verifier/index.mjs";
+export { OAuth2AccessTokenIssuer, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenIssuer, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier };

package/dist/core/oauth2/token/issuer/access/index.mjs

@@ -0,0 +1,2 @@
+import { OAuth2AccessTokenIssuer } from "./module.mjs";
+export { OAuth2AccessTokenIssuer };

package/dist/core/oauth2/token/issuer/access/module.d.ts

@@ -3,10 +3,13 @@ import type { IOAuth2TokenSigner } from '../../signer/index.ts';
 import type { IOAuth2TokenRepository } from '../../repository/index.ts';
 import { OAuth2BaseTokenIssuer } from '../base.ts';
 import type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';
+import type { IIdentityRoleProvider } from '../../../../identity/index.ts';
 export declare class OAuth2AccessTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {
     protected repository: IOAuth2TokenRepository;
     protected signer: IOAuth2TokenSigner;
-    constructor(repository: IOAuth2TokenRepository, signer: IOAuth2TokenSigner, options?: OAuth2TokenIssuerOptions);
+    protected identityRoleProvider?: IIdentityRoleProvider;
+    constructor(repository: IOAuth2TokenRepository, signer: IOAuth2TokenSigner, options?: OAuth2TokenIssuerOptions, identityRoleProvider?: IIdentityRoleProvider);
     issue(input?: OAuth2TokenPayload): Promise<OAuth2TokenIssuerResponse>;
+    protected buildAccessClaims(input: OAuth2TokenPayload): Promise<Pick<OAuth2TokenPayload, 'realm_access' | 'global_access'>>;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/core/oauth2/token/issuer/access/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/token/issuer/access/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAE3G,qBAAa,uBAAwB,SAAQ,qBAAsB,YAAW,kBAAkB;IAC5F,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,MAAM,EAAG,kBAAkB,CAAC;gBAGlC,UAAU,EAAE,sBAAsB,EAClC,MAAM,EAAE,kBAAkB,EAC1B,OAAO,GAAE,wBAA6B;IAQpC,KAAK,CAAC,KAAK,GAAE,kBAAuB,GAAI,OAAO,CAAC,yBAAyB,CAAC;CAgBnF"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/token/issuer/access/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAC3G,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAE3E,qBAAa,uBAAwB,SAAQ,qBAAsB,YAAW,kBAAkB;IAC5F,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,MAAM,EAAG,kBAAkB,CAAC;IAEtC,SAAS,CAAC,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;gBAGnD,UAAU,EAAE,sBAAsB,EAClC,MAAM,EAAE,kBAAkB,EAC1B,OAAO,GAAE,wBAA6B,EACtC,oBAAoB,CAAC,EAAE,qBAAqB;IAS1C,KAAK,CAAC,KAAK,GAAE,kBAAuB,GAAI,OAAO,CAAC,yBAAyB,CAAC;cAoBhE,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,GAAI,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,cAAc,GAAG,eAAe,CAAC,CAAC;CA6BrI"}

package/dist/core/oauth2/token/issuer/access/module.mjs

@@ -0,0 +1,50 @@
+import { OAuth2BaseTokenIssuer } from "../base.mjs";
+import { OAuth2TokenKind } from "@authup/specs";
+//#region src/core/oauth2/token/issuer/access/module.ts
+var OAuth2AccessTokenIssuer = class extends OAuth2BaseTokenIssuer {
+	repository;
+	signer;
+	identityRoleProvider;
+	constructor(repository, signer, options = {}, identityRoleProvider) {
+		super(options);
+		this.repository = repository;
+		this.signer = signer;
+		this.identityRoleProvider = identityRoleProvider;
+	}
+	async issue(input = {}) {
+		const iss = this.buildIss(input);
+		const accessClaims = await this.buildAccessClaims(input);
+		const data = await this.repository.insert({
+			...input,
+			kind: OAuth2TokenKind.ACCESS,
+			exp: this.buildExp(input),
+			...iss ? { iss } : {},
+			...accessClaims
+		});
+		const token = await this.signer.sign(data);
+		await this.repository.saveWithSignature(data, token);
+		return [token, data];
+	}
+	async buildAccessClaims(input) {
+		if (!this.identityRoleProvider || !input.sub || !input.sub_kind) return {};
+		const roles = await this.identityRoleProvider.getRolesFor({
+			type: input.sub_kind,
+			id: input.sub,
+			clientId: input.client_id,
+			realmId: input.realm_id,
+			realmName: input.realm_name
+		});
+		const realmRoles = [];
+		const globalRoles = [];
+		for (const role of roles) if (!role.realm_id) globalRoles.push(role.name);
+		else if (input.realm_id && role.realm_id === input.realm_id) realmRoles.push(role.name);
+		return {
+			realm_access: { roles: realmRoles },
+			global_access: { roles: globalRoles }
+		};
+	}
+};
+//#endregion
+export { OAuth2AccessTokenIssuer };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/token/issuer/access/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["OAuth2TokenKind","OAuth2BaseTokenIssuer","OAuth2AccessTokenIssuer","repository","signer","identityRoleProvider","options","issue","input","iss","buildIss","accessClaims","buildAccessClaims","data","insert","kind","ACCESS","exp","buildExp","token","sign","saveWithSignature","sub","sub_kind","roles","getRolesFor","type","id","clientId","client_id","realmId","realm_id","realmName","realm_name","realmRoles","globalRoles","role","push","name","realm_access","global_access"],"sources":["../../../../../../src/core/oauth2/token/issuer/access/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';\nimport type { IIdentityRoleProvider } from '../../../../identity/index.ts';\n\nexport class OAuth2AccessTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    protected identityRoleProvider?: IIdentityRoleProvider;\n\n    constructor(\n        repository: IOAuth2TokenRepository,\n        signer: IOAuth2TokenSigner,\n        options: OAuth2TokenIssuerOptions = {},\n        identityRoleProvider?: IIdentityRoleProvider,\n    ) {\n        super(options);\n\n        this.repository = repository;\n        this.signer = signer;\n        this.identityRoleProvider = identityRoleProvider;\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        const iss = this.buildIss(input);\n\n        const accessClaims = await this.buildAccessClaims(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            kind: OAuth2TokenKind.ACCESS,\n            exp: this.buildExp(input),\n            ...(iss ? { iss } : {}),\n            ...accessClaims,\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        return [token, data];\n    }\n\n    protected async buildAccessClaims(input: OAuth2TokenPayload) : Promise<Pick<OAuth2TokenPayload, 'realm_access' | 'global_access'>> {\n        if (!this.identityRoleProvider || !input.sub || !input.sub_kind) {\n            return {};\n        }\n\n        const roles = await this.identityRoleProvider.getRolesFor({\n            type: input.sub_kind,\n            id: input.sub,\n            clientId: input.client_id,\n            realmId: input.realm_id,\n            realmName: input.realm_name,\n        });\n\n        const realmRoles: string[] = [];\n        const globalRoles: string[] = [];\n\n        for (const role of roles) {\n            if (!role.realm_id) {\n                globalRoles.push(role.name);\n            } else if (input.realm_id && role.realm_id === input.realm_id) {\n                realmRoles.push(role.name);\n            }\n        }\n\n        return {\n            realm_access: { roles: realmRoles },\n            global_access: { roles: globalRoles },\n        };\n    }\n}\n"],"mappings":";;;AAeA,IAAaE,0BAAb,cAA6CD,sBAAAA;CAC/BE;CAEAC;CAEAC;CAEV,YACIF,YACAC,QACAE,UAAoC,EAAE,EACtCD,sBACF;AACE,QAAMC,QAAAA;AAEN,OAAKH,aAAaA;AAClB,OAAKC,SAASA;AACd,OAAKC,uBAAuBA;;CAGhC,MAAME,MAAMC,QAA4B,EAAE,EAAuC;EAC7E,MAAMC,MAAM,KAAKC,SAASF,MAAAA;EAE1B,MAAMG,eAAe,MAAM,KAAKC,kBAAkBJ,MAAAA;EAElD,MAAMK,OAAO,MAAM,KAAKV,WAAWW,OAAO;GACtC,GAAGN;GACHO,MAAMf,gBAAgBgB;GACtBC,KAAK,KAAKC,SAASV,MAAAA;GACnB,GAAIC,MAAM,EAAEA,KAAI,GAAI,EAAE;GACtB,GAAGE;GACP,CAAA;EAEA,MAAMQ,QAAQ,MAAM,KAAKf,OAAOgB,KAAKP,KAAAA;AAErC,QAAM,KAAKV,WAAWkB,kBAAkBR,MAAMM,MAAAA;AAE9C,SAAO,CAACA,OAAON,KAAK;;CAGxB,MAAgBD,kBAAkBJ,OAAiG;AAC/H,MAAI,CAAC,KAAKH,wBAAwB,CAACG,MAAMc,OAAO,CAACd,MAAMe,SACnD,QAAO,EAAC;EAGZ,MAAMC,QAAQ,MAAM,KAAKnB,qBAAqBoB,YAAY;GACtDC,MAAMlB,MAAMe;GACZI,IAAInB,MAAMc;GACVM,UAAUpB,MAAMqB;GAChBC,SAAStB,MAAMuB;GACfC,WAAWxB,MAAMyB;GACrB,CAAA;EAEA,MAAMC,aAAuB,EAAE;EAC/B,MAAMC,cAAwB,EAAE;AAEhC,OAAK,MAAMC,QAAQZ,MACf,KAAI,CAACY,KAAKL,SACNI,aAAYE,KAAKD,KAAKE,KAAI;WACnB9B,MAAMuB,YAAYK,KAAKL,aAAavB,MAAMuB,SACjDG,YAAWG,KAAKD,KAAKE,KAAI;AAIjC,SAAO;GACHC,cAAc,EAAEf,OAAOU,YAAW;GAClCM,eAAe,EAAEhB,OAAOW,aAAY;GACxC"}

package/dist/core/oauth2/token/issuer/base.mjs

@@ -0,0 +1,26 @@
+//#region src/core/oauth2/token/issuer/base.ts
+var OAuth2BaseTokenIssuer = class {
+	options;
+	constructor(options) {
+		this.options = options || {};
+	}
+	buildIss(input = {}) {
+		if (!this.options.issuer) return;
+		if (input.realm_name) return `${this.options.issuer}/realms/${input.realm_name}`;
+		return this.options.issuer;
+	}
+	/**
+	* Build utc expire time (in seconds).
+	*
+	* @param input
+	*/ buildExp(input = {}) {
+		if (input.exp) return input.exp;
+		const utc = Math.floor((/* @__PURE__ */ new Date()).getTime() / 1e3);
+		if (this.options.maxAge) return utc + this.options.maxAge;
+		return utc + 3600;
+	}
+};
+//#endregion
+export { OAuth2BaseTokenIssuer };
+
+//# sourceMappingURL=base.mjs.map

package/dist/core/oauth2/token/issuer/base.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.mjs","names":["OAuth2BaseTokenIssuer","options","buildIss","input","issuer","undefined","realm_name","buildExp","exp","utc","Math","floor","Date","getTime","maxAge"],"sources":["../../../../../src/core/oauth2/token/issuer/base.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from './types.ts';\n\nexport abstract class OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected options: OAuth2TokenIssuerOptions;\n\n    // ------------------------------------------------------------------\n\n    protected constructor(options?: OAuth2TokenIssuerOptions) {\n        this.options = options || {};\n    }\n\n    // ------------------------------------------------------------------\n\n    abstract issue(input: OAuth2TokenPayload, options?: OAuth2TokenIssuerOptions): Promise<OAuth2TokenIssuerResponse>;\n\n    // ------------------------------------------------------------------\n\n    buildIss(input: OAuth2TokenPayload = {}) : string | undefined {\n        if (!this.options.issuer) {\n            return undefined;\n        }\n\n        if (input.realm_name) {\n            return `${this.options.issuer}/realms/${input.realm_name}`;\n        }\n\n        return this.options.issuer;\n    }\n\n    /**\n     * Build utc expire time (in seconds).\n     *\n     * @param input\n     */\n    buildExp(input: OAuth2TokenPayload = {}) : number {\n        if (input.exp) {\n            return input.exp;\n        }\n\n        const utc = Math.floor(new Date().getTime() / 1000);\n        if (this.options.maxAge) {\n            return utc + this.options.maxAge;\n        }\n\n        return utc + 3_600;\n    }\n}\n"],"mappings":";AAUA,IAAsBA,wBAAtB,MAAsBA;CACRC;CAIV,YAAsBA,SAAoC;AACtD,OAAKA,UAAUA,WAAW,EAAC;;CAS/BC,SAASC,QAA4B,EAAE,EAAuB;AAC1D,MAAI,CAAC,KAAKF,QAAQG,OACd;AAGJ,MAAID,MAAMG,WACN,QAAO,GAAG,KAAKL,QAAQG,OAAO,UAAUD,MAAMG;AAGlD,SAAO,KAAKL,QAAQG;;;;;;IAQxBG,SAASJ,QAA4B,EAAE,EAAW;AAC9C,MAAIA,MAAMK,IACN,QAAOL,MAAMK;EAGjB,MAAMC,MAAMC,KAAKC,uBAAM,IAAIC,MAAAA,EAAOC,SAAO,GAAK,IAAA;AAC9C,MAAI,KAAKZ,QAAQa,OACb,QAAOL,MAAM,KAAKR,QAAQa;AAG9B,SAAOL,MAAM"}

package/dist/core/oauth2/token/issuer/index.mjs

@@ -0,0 +1,7 @@
+import { OAuth2AccessTokenIssuer } from "./access/module.mjs";
+import "./access/index.mjs";
+import { OAuth2OpenIDTokenIssuer } from "./open-id/module.mjs";
+import "./open-id/index.mjs";
+import { OAuth2RefreshTokenIssuer } from "./refresh/module.mjs";
+import "./refresh/index.mjs";
+export { OAuth2AccessTokenIssuer, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenIssuer };

package/dist/core/oauth2/token/issuer/open-id/index.mjs

@@ -0,0 +1,2 @@
+import { OAuth2OpenIDTokenIssuer } from "./module.mjs";
+export { OAuth2OpenIDTokenIssuer };

package/dist/core/oauth2/token/issuer/open-id/module.mjs

@@ -0,0 +1,47 @@
+import { OAuth2OpenIDClaimsBuilder } from "../../../openid/claims.mjs";
+import "../../../openid/index.mjs";
+import { OAuth2BaseTokenIssuer } from "../base.mjs";
+import { JWTError, OAuth2TokenKind } from "@authup/specs";
+//#region src/core/oauth2/token/issuer/open-id/module.ts
+var OAuth2OpenIDTokenIssuer = class extends OAuth2BaseTokenIssuer {
+	repository;
+	signer;
+	identityResolver;
+	claimsBuilder;
+	constructor(ctx) {
+		super(ctx.options);
+		this.repository = ctx.repository;
+		this.signer = ctx.signer;
+		this.identityResolver = ctx.identityResolver;
+		this.claimsBuilder = new OAuth2OpenIDClaimsBuilder();
+	}
+	async issue(input = {}) {
+		if (!input.sub_kind) throw JWTError.payloadPropertyInvalid("sub_kind");
+		if (!input.sub) throw JWTError.payloadPropertyInvalid("sub");
+		const identity = await this.identityResolver.resolve(input.sub_kind, input.sub);
+		if (!identity) throw JWTError.payloadInvalid();
+		return this.issueWithIdentity(input, identity);
+	}
+	async issueWithIdentity(input, identity) {
+		const claims = this.claimsBuilder.fromIdentity(identity);
+		const utc = Math.floor((/* @__PURE__ */ new Date()).getTime() / 1e3);
+		const iss = this.buildIss(input);
+		const data = await this.repository.insert({
+			...input,
+			...claims,
+			kind: OAuth2TokenKind.ID_TOKEN,
+			auth_time: utc,
+			exp: this.buildExp(input),
+			updated_at: utc,
+			...iss ? { iss } : {},
+			...input.client_id ? { aud: input.client_id } : {}
+		});
+		const token = await this.signer.sign(data);
+		await this.repository.saveWithSignature(data, token);
+		return [token, data];
+	}
+};
+//#endregion
+export { OAuth2OpenIDTokenIssuer };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/token/issuer/open-id/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["JWTError","OAuth2TokenKind","OAuth2OpenIDClaimsBuilder","OAuth2BaseTokenIssuer","OAuth2OpenIDTokenIssuer","repository","signer","identityResolver","claimsBuilder","ctx","options","issue","input","sub_kind","payloadPropertyInvalid","sub","identity","resolve","payloadInvalid","issueWithIdentity","claims","fromIdentity","utc","Math","floor","Date","getTime","iss","buildIss","data","insert","kind","ID_TOKEN","auth_time","exp","buildExp","updated_at","client_id","aud","token","sign","saveWithSignature"],"sources":["../../../../../../src/core/oauth2/token/issuer/open-id/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { JWTError, OAuth2TokenKind } from '@authup/specs';\nimport type { Identity } from '@authup/core-kit';\nimport { OAuth2OpenIDClaimsBuilder } from '../../../openid/index.ts';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { OAuth2TokenIssuerResponse } from '../types.ts';\nimport type { IOAuth2OpenIDTokenIssuer, OAuth2OpenIDTokenIssuerContext } from './types.ts';\nimport type { IIdentityResolver } from '../../../../identity/index.ts';\n\nexport class OAuth2OpenIDTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2OpenIDTokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    protected identityResolver : IIdentityResolver;\n\n    protected claimsBuilder: OAuth2OpenIDClaimsBuilder;\n\n    constructor(ctx: OAuth2OpenIDTokenIssuerContext) {\n        super(ctx.options);\n\n        this.repository = ctx.repository;\n        this.signer = ctx.signer;\n\n        this.identityResolver = ctx.identityResolver;\n        this.claimsBuilder = new OAuth2OpenIDClaimsBuilder();\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        if (!input.sub_kind) {\n            throw JWTError.payloadPropertyInvalid('sub_kind');\n        }\n\n        if (!input.sub) {\n            throw JWTError.payloadPropertyInvalid('sub');\n        }\n\n        const identity = await this.identityResolver.resolve(\n            input.sub_kind,\n            input.sub,\n        );\n\n        if (!identity) {\n            throw JWTError.payloadInvalid();\n        }\n\n        return this.issueWithIdentity(input, identity);\n    }\n\n    async issueWithIdentity(\n        input: OAuth2TokenPayload,\n        identity: Identity,\n    ): Promise<OAuth2TokenIssuerResponse> {\n        const claims = this.claimsBuilder.fromIdentity(identity);\n\n        const utc = Math.floor(new Date().getTime() / 1000);\n\n        const iss = this.buildIss(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            ...claims,\n            kind: OAuth2TokenKind.ID_TOKEN,\n            auth_time: utc,\n            exp: this.buildExp(input),\n            updated_at: utc,\n            ...(iss ? { iss } : {}),\n            ...(input.client_id ? { aud: input.client_id } : {}),\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        return [token, data];\n    }\n}\n"],"mappings":";;;;;AAkBA,IAAaI,0BAAb,cAA6CD,sBAAAA;CAC/BE;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;AAC7C,QAAMA,IAAIC,QAAO;AAEjB,OAAKL,aAAaI,IAAIJ;AACtB,OAAKC,SAASG,IAAIH;AAElB,OAAKC,mBAAmBE,IAAIF;AAC5B,OAAKC,gBAAgB,IAAIN,2BAAAA;;CAG7B,MAAMS,MAAMC,QAA4B,EAAE,EAAuC;AAC7E,MAAI,CAACA,MAAMC,SACP,OAAMb,SAASc,uBAAuB,WAAA;AAG1C,MAAI,CAACF,MAAMG,IACP,OAAMf,SAASc,uBAAuB,MAAA;EAG1C,MAAME,WAAW,MAAM,KAAKT,iBAAiBU,QACzCL,MAAMC,UACND,MAAMG,IAAG;AAGb,MAAI,CAACC,SACD,OAAMhB,SAASkB,gBAAc;AAGjC,SAAO,KAAKC,kBAAkBP,OAAOI,SAAAA;;CAGzC,MAAMG,kBACFP,OACAI,UACkC;EAClC,MAAMI,SAAS,KAAKZ,cAAca,aAAaL,SAAAA;EAE/C,MAAMM,MAAMC,KAAKC,uBAAM,IAAIC,MAAAA,EAAOC,SAAO,GAAK,IAAA;EAE9C,MAAMC,MAAM,KAAKC,SAAShB,MAAAA;EAE1B,MAAMiB,OAAO,MAAM,KAAKxB,WAAWyB,OAAO;GACtC,GAAGlB;GACH,GAAGQ;GACHW,MAAM9B,gBAAgB+B;GACtBC,WAAWX;GACXY,KAAK,KAAKC,SAASvB,MAAAA;GACnBwB,YAAYd;GACZ,GAAIK,MAAM,EAAEA,KAAI,GAAI,EAAE;GACtB,GAAIf,MAAMyB,YAAY,EAAEC,KAAK1B,MAAMyB,WAAU,GAAI,EAAE;GACvD,CAAA;EAEA,MAAME,QAAQ,MAAM,KAAKjC,OAAOkC,KAAKX,KAAAA;AAErC,QAAM,KAAKxB,WAAWoC,kBAAkBZ,MAAMU,MAAAA;AAE9C,SAAO,CAACA,OAAOV,KAAK"}

package/dist/core/oauth2/token/issuer/open-id/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/token/issuer/refresh/index.mjs

@@ -0,0 +1,2 @@
+import { OAuth2RefreshTokenIssuer } from "./module.mjs";
+export { OAuth2RefreshTokenIssuer };

package/dist/core/oauth2/token/issuer/refresh/module.mjs

@@ -0,0 +1,28 @@
+import { OAuth2BaseTokenIssuer } from "../base.mjs";
+import { OAuth2TokenKind } from "@authup/specs";
+//#region src/core/oauth2/token/issuer/refresh/module.ts
+var OAuth2RefreshTokenIssuer = class extends OAuth2BaseTokenIssuer {
+	repository;
+	signer;
+	constructor(repository, signer, options = {}) {
+		super(options);
+		this.repository = repository;
+		this.signer = signer;
+	}
+	async issue(input = {}) {
+		const iss = this.buildIss(input);
+		const data = await this.repository.insert({
+			...input,
+			kind: OAuth2TokenKind.REFRESH,
+			exp: this.buildExp(input),
+			...iss ? { iss } : {}
+		});
+		const token = await this.signer.sign(data);
+		await this.repository.saveWithSignature(data, token);
+		return [token, data];
+	}
+};
+//#endregion
+export { OAuth2RefreshTokenIssuer };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/token/issuer/refresh/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["OAuth2TokenKind","OAuth2BaseTokenIssuer","OAuth2RefreshTokenIssuer","repository","signer","options","issue","input","iss","buildIss","data","insert","kind","REFRESH","exp","buildExp","token","sign","saveWithSignature"],"sources":["../../../../../../src/core/oauth2/token/issuer/refresh/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';\n\nexport class OAuth2RefreshTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    constructor(\n        repository: IOAuth2TokenRepository,\n        signer: IOAuth2TokenSigner,\n        options: OAuth2TokenIssuerOptions = {},\n    ) {\n        super(options);\n\n        this.repository = repository;\n        this.signer = signer;\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        const iss = this.buildIss(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            kind: OAuth2TokenKind.REFRESH,\n            exp: this.buildExp(input),\n            ...(iss ? { iss } : {}),\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        return [token, data];\n    }\n}\n"],"mappings":";;;AAcA,IAAaE,2BAAb,cAA8CD,sBAAAA;CAChCE;CAEAC;CAEV,YACID,YACAC,QACAC,UAAoC,EAAE,EACxC;AACE,QAAMA,QAAAA;AAEN,OAAKF,aAAaA;AAClB,OAAKC,SAASA;;CAGlB,MAAME,MAAMC,QAA4B,EAAE,EAAuC;EAC7E,MAAMC,MAAM,KAAKC,SAASF,MAAAA;EAE1B,MAAMG,OAAO,MAAM,KAAKP,WAAWQ,OAAO;GACtC,GAAGJ;GACHK,MAAMZ,gBAAgBa;GACtBC,KAAK,KAAKC,SAASR,MAAAA;GACnB,GAAIC,MAAM,EAAEA,KAAI,GAAI,EAAE;GAC1B,CAAA;EAEA,MAAMQ,QAAQ,MAAM,KAAKZ,OAAOa,KAAKP,KAAAA;AAErC,QAAM,KAAKP,WAAWe,kBAAkBR,MAAMM,MAAAA;AAE9C,SAAO,CAACA,OAAON,KAAK"}

package/dist/core/oauth2/token/issuer/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/token/repository/index.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/token/repository/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/token/revoker/index.mjs

@@ -0,0 +1,2 @@
+import { OAuth2TokenRevoker } from "./module.mjs";
+export { OAuth2TokenRevoker };

package/dist/core/oauth2/token/revoker/module.mjs

@@ -0,0 +1,16 @@
+import { JWTError } from "@authup/specs";
+//#region src/core/oauth2/token/revoker/module.ts
+var OAuth2TokenRevoker = class {
+	repository;
+	constructor(repository) {
+		this.repository = repository;
+	}
+	async revoke(input) {
+		if (!input.jti) throw JWTError.payloadPropertyInvalid("jti");
+		await this.repository.removeById(input.jti);
+	}
+};
+//#endregion
+export { OAuth2TokenRevoker };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/token/revoker/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["JWTError","OAuth2TokenRevoker","repository","revoke","input","jti","payloadPropertyInvalid","removeById"],"sources":["../../../../../src/core/oauth2/token/revoker/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { JWTError } from '@authup/specs';\nimport type { IOAuth2TokenRepository } from '../repository/index.ts';\nimport type { IOAuth2TokenRevoker } from './types.ts';\n\nexport class OAuth2TokenRevoker implements IOAuth2TokenRevoker {\n    protected repository : IOAuth2TokenRepository;\n\n    constructor(repository : IOAuth2TokenRepository) {\n        this.repository = repository;\n    }\n\n    async revoke(input: OAuth2TokenPayload) : Promise<void> {\n        if (!input.jti) {\n            throw JWTError.payloadPropertyInvalid('jti');\n        }\n\n        await this.repository.removeById(input.jti);\n    }\n}\n"],"mappings":";;AAYA,IAAaC,qBAAb,MAAaA;CACCC;CAEV,YAAYA,YAAqC;AAC7C,OAAKA,aAAaA;;CAGtB,MAAMC,OAAOC,OAA2C;AACpD,MAAI,CAACA,MAAMC,IACP,OAAML,SAASM,uBAAuB,MAAA;AAG1C,QAAM,KAAKJ,WAAWK,WAAWH,MAAMC,IAAG"}

package/dist/core/oauth2/token/revoker/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/token/signer/index.mjs

@@ -0,0 +1,2 @@
+import { OAuth2TokenSigner } from "./module.mjs";
+export { OAuth2TokenSigner };

package/dist/core/oauth2/token/signer/module.mjs

@@ -0,0 +1,38 @@
+import { signToken } from "@authup/server-kit";
+import { JWKError, JWKType } from "@authup/specs";
+//#region src/core/oauth2/token/signer/module.ts
+var OAuth2TokenSigner = class {
+	keyRepository;
+	constructor(keyRepository) {
+		this.keyRepository = keyRepository;
+	}
+	async sign(payload) {
+		if (!payload.realm_id) throw JWKError.invalidRealm();
+		const key = await this.keyRepository.findByRealmId(payload.realm_id);
+		if (!key) throw JWKError.notFoundForRealm(payload.realm_id, payload.realm_name);
+		if (!key.decryption_key) throw JWKError.decryptionKeyMissing();
+		let token;
+		if (key.type === JWKType.OCT) token = await signToken(payload, {
+			type: JWKType.OCT,
+			key: key.decryption_key,
+			keyId: key.id
+		});
+		else if (key.type === JWKType.EC) token = await signToken(payload, {
+			type: key.type,
+			key: key.decryption_key,
+			algorithm: key.signature_algorithm,
+			keyId: key.id
+		});
+		else token = await signToken(payload, {
+			type: key.type,
+			key: key.decryption_key,
+			algorithm: key.signature_algorithm,
+			keyId: key.id
+		});
+		return token;
+	}
+};
+//#endregion
+export { OAuth2TokenSigner };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/token/signer/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["signToken","JWKError","JWKType","OAuth2TokenSigner","keyRepository","sign","payload","realm_id","invalidRealm","key","findByRealmId","notFoundForRealm","realm_name","decryption_key","decryptionKeyMissing","token","type","OCT","keyId","id","EC","algorithm","signature_algorithm"],"sources":["../../../../../src/core/oauth2/token/signer/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { type TokenECAlgorithm, type TokenRSAAlgorithm, signToken } from '@authup/server-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { JWKError, JWKType } from '@authup/specs';\nimport type { IOAuth2KeyRepository } from '../../key/index.ts';\nimport type { IOAuth2TokenSigner } from './types.ts';\n\nexport class OAuth2TokenSigner implements IOAuth2TokenSigner {\n    protected keyRepository : IOAuth2KeyRepository;\n\n    constructor(keyRepository : IOAuth2KeyRepository) {\n        this.keyRepository = keyRepository;\n    }\n\n    async sign<T extends OAuth2TokenPayload>(payload: T) : Promise<string> {\n        if (!payload.realm_id) {\n            throw JWKError.invalidRealm();\n        }\n\n        const key = await this.keyRepository.findByRealmId(payload.realm_id);\n        if (!key) {\n            throw JWKError.notFoundForRealm(payload.realm_id, payload.realm_name);\n        }\n\n        if (!key.decryption_key) {\n            throw JWKError.decryptionKeyMissing();\n        }\n\n        let token : string;\n        if (key.type === JWKType.OCT) {\n            token = await signToken(\n                payload,\n                {\n                    type: JWKType.OCT,\n                    key: key.decryption_key,\n                    keyId: key.id,\n                },\n            );\n        } else if (key.type === JWKType.EC) {\n            token = await signToken(\n                payload,\n                {\n                    type: key.type,\n                    key: key.decryption_key,\n                    algorithm: key.signature_algorithm as TokenECAlgorithm,\n                    keyId: key.id,\n                },\n            );\n        } else {\n            token = await signToken(\n                payload,\n                {\n                    type: key.type,\n                    key: key.decryption_key,\n                    algorithm: key.signature_algorithm as TokenRSAAlgorithm,\n                    keyId: key.id,\n                },\n            );\n        }\n\n        return token;\n    }\n}\n"],"mappings":";;;AAaA,IAAaG,oBAAb,MAAaA;CACCC;CAEV,YAAYA,eAAsC;AAC9C,OAAKA,gBAAgBA;;CAGzB,MAAMC,KAAmCC,SAA8B;AACnE,MAAI,CAACA,QAAQC,SACT,OAAMN,SAASO,cAAY;EAG/B,MAAMC,MAAM,MAAM,KAAKL,cAAcM,cAAcJ,QAAQC,SAAQ;AACnE,MAAI,CAACE,IACD,OAAMR,SAASU,iBAAiBL,QAAQC,UAAUD,QAAQM,WAAU;AAGxE,MAAI,CAACH,IAAII,eACL,OAAMZ,SAASa,sBAAoB;EAGvC,IAAIC;AACJ,MAAIN,IAAIO,SAASd,QAAQe,IACrBF,SAAQ,MAAMf,UACVM,SACA;GACIU,MAAMd,QAAQe;GACdR,KAAKA,IAAII;GACTK,OAAOT,IAAIU;GACf,CAAA;WAEGV,IAAIO,SAASd,QAAQkB,GAC5BL,SAAQ,MAAMf,UACVM,SACA;GACIU,MAAMP,IAAIO;GACVP,KAAKA,IAAII;GACTQ,WAAWZ,IAAIa;GACfJ,OAAOT,IAAIU;GACf,CAAA;MAGJJ,SAAQ,MAAMf,UACVM,SACA;GACIU,MAAMP,IAAIO;GACVP,KAAKA,IAAII;GACTQ,WAAWZ,IAAIa;GACfJ,OAAOT,IAAIU;GACf,CAAA;AAIR,SAAOJ"}

package/dist/core/oauth2/token/signer/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/token/verifier/index.mjs

@@ -0,0 +1,2 @@
+import { OAuth2TokenVerifier } from "./module.mjs";
+export { OAuth2TokenVerifier };