@authup/server-core 1.0.0-beta.38 → 1.0.0-beta.39

package/dist/adapters/http/adapters/index.mjs

@@ -1,4 +1,5 @@
 import { HTTPOAuth2Authorizer } from "./oauth2/authorization/module.mjs";
+import { extractClientCredentialsFromRequest } from "./oauth2/grant-types/utils/credentials.mjs";
 import { guessOauth2GrantTypeByRequest } from "./oauth2/grant-types/utils/guess.mjs";
 import { HTTPOAuth2AuthorizeGrant } from "./oauth2/grant-types/authorize.mjs";
 import { HTTPClientCredentialsGrant } from "./oauth2/grant-types/client-credentials.mjs";
@@ -7,4 +8,4 @@ import { HTTPPasswordGrant } from "./oauth2/grant-types/password.mjs";
 import { HTTPOAuth2RefreshTokenGrant } from "./oauth2/grant-types/refresh_token.mjs";
 import { HTTPRobotCredentialsGrant } from "./oauth2/grant-types/robot-credentials.mjs";
 import "./oauth2/index.mjs";
-export { HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, guessOauth2GrantTypeByRequest };
+export { HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, extractClientCredentialsFromRequest, guessOauth2GrantTypeByRequest };

package/dist/adapters/http/adapters/oauth2/grant-types/authorize.d.ts

@@ -1,10 +1,11 @@
 import type { OAuth2TokenGrantResponse } from '@authup/specs';
 import type { Request } from 'routup';
 import { OAuth2AuthorizeGrant } from '../../../../../core/index.ts';
-import type { IOAuth2AuthorizationCodeVerifier } from '../../../../../core/index.ts';
+import type { IOAuth2AuthorizationCodeVerifier, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';
 import type { HTTPOAuth2AuthorizeGrantContext, IHTTPOAuth2Grant } from './types.ts';
 export declare class HTTPOAuth2AuthorizeGrant extends OAuth2AuthorizeGrant implements IHTTPOAuth2Grant {
     protected codeVerifier: IOAuth2AuthorizationCodeVerifier;
+    protected clientAuthenticator: OAuth2ClientAuthenticator;
     constructor(ctx: HTTPOAuth2AuthorizeGrantContext);
     runWithRequest(req: Request): Promise<OAuth2TokenGrantResponse>;
     protected extractParam(req: Request, key: string): string | undefined;

package/dist/adapters/http/adapters/oauth2/grant-types/authorize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/authorize.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAI9D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAEtC,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,8BAA8B,CAAC;AACrF,OAAO,KAAK,EAAE,+BAA+B,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEpF,qBAAa,wBAAyB,SAAQ,oBAAqB,YAAW,gBAAgB;IAC1F,SAAS,CAAC,YAAY,EAAG,gCAAgC,CAAC;gBAE9C,GAAG,EAAE,+BAA+B;IAM1C,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAmBrE,SAAS,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAI,MAAM,GAAG,SAAS;CAUzE"}
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/authorize.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAI9D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAEtC,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EACR,gCAAgC,EAChC,yBAAyB,EAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,+BAA+B,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAGpF,qBAAa,wBAAyB,SAAQ,oBAAqB,YAAW,gBAAgB;IAC1F,SAAS,CAAC,YAAY,EAAG,gCAAgC,CAAC;IAE1D,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;gBAE9C,GAAG,EAAE,+BAA+B;IAO1C,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,wBAAwB,CAAC;IA0BrE,SAAS,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAI,MAAM,GAAG,SAAS;CAUzE"}

package/dist/adapters/http/adapters/oauth2/grant-types/authorize.mjs

@@ -1,5 +1,7 @@
 import { OAuth2AuthorizeGrant } from "../../../../../core/oauth2/grant-types/authorize.mjs";
 import "../../../../../core/index.mjs";
+import { extractClientCredentialsFromRequest } from "./utils/credentials.mjs";
+import "./utils/index.mjs";
 import { OAuth2Error } from "@authup/specs";
 import { getRequestHeader, getRequestIP } from "routup";
 import { useRequestBody } from "@routup/basic/body";
@@ -7,18 +9,25 @@ import { useRequestQuery } from "@routup/basic/query";
 //#region src/adapters/http/adapters/oauth2/grant-types/authorize.ts
 var HTTPOAuth2AuthorizeGrant = class extends OAuth2AuthorizeGrant {
 	codeVerifier;
+	clientAuthenticator;
 	constructor(ctx) {
 		super(ctx);
 		this.codeVerifier = ctx.codeVerifier;
+		this.clientAuthenticator = ctx.clientAuthenticator;
 	}
 	async runWithRequest(req) {
 		const code = this.extractParam(req, "code");
 		const redirectUri = this.extractParam(req, "redirect_uri");
 		const codeVerifier = this.extractParam(req, "code_verifier");
 		if (!code) throw OAuth2Error.requestInvalid();
+		const { clientId, clientSecret } = extractClientCredentialsFromRequest(req);
+		const realmId = this.extractParam(req, "realm_id");
+		const client = await this.clientAuthenticator.authenticate(clientId, clientSecret, realmId);
 		const entity = await this.codeVerifier.verify(code, {
 			redirectUri,
-			codeVerifier
+			codeVerifier,
+			clientId: client.id,
+			clientIsPublic: !client.is_confidential
 		});
 		return this.runWith(entity, {
 			ipAddress: getRequestIP(req, { trustProxy: true }),

package/dist/adapters/http/adapters/oauth2/grant-types/authorize.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.mjs","names":["OAuth2Error","useRequestBody","useRequestQuery","getRequestHeader","getRequestIP","OAuth2AuthorizeGrant","HTTPOAuth2AuthorizeGrant","codeVerifier","ctx","runWithRequest","req","code","extractParam","redirectUri","requestInvalid","entity","verify","runWith","ipAddress","trustProxy","userAgent","key","value","length","undefined"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/authorize.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2Error } from '@authup/specs';\nimport { useRequestBody } from '@routup/basic/body';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { Request } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport { OAuth2AuthorizeGrant } from '../../../../../core/index.ts';\nimport type { IOAuth2AuthorizationCodeVerifier } from '../../../../../core/index.ts';\nimport type { HTTPOAuth2AuthorizeGrantContext, IHTTPOAuth2Grant } from './types.ts';\n\nexport class HTTPOAuth2AuthorizeGrant extends OAuth2AuthorizeGrant implements IHTTPOAuth2Grant {\n    protected codeVerifier : IOAuth2AuthorizationCodeVerifier;\n\n    constructor(ctx: HTTPOAuth2AuthorizeGrantContext) {\n        super(ctx);\n\n        this.codeVerifier = ctx.codeVerifier;\n    }\n\n    async runWithRequest(req: Request): Promise<OAuth2TokenGrantResponse> {\n        const code = this.extractParam(req, 'code');\n        const redirectUri = this.extractParam(req, 'redirect_uri');\n        const codeVerifier = this.extractParam(req, 'code_verifier');\n        if (!code) {\n            throw OAuth2Error.requestInvalid();\n        }\n\n        const entity = await this.codeVerifier.verify(code, {\n            redirectUri,\n            codeVerifier,\n        });\n\n        return this.runWith(entity, {\n            ipAddress: getRequestIP(req, { trustProxy: true }),\n            userAgent: getRequestHeader(req, 'user-agent'),\n        });\n    }\n\n    protected extractParam(req: Request, key: string) : string | undefined {\n        let value : unknown = useRequestBody(req, key);\n        if (!value) {\n            value = useRequestQuery(req, key);\n        }\n\n        return typeof value === 'string' && value.length > 0 ?\n            value :\n            undefined;\n    }\n}\n"],"mappings":";;;;;;;AAiBA,IAAaM,2BAAb,cAA8CD,qBAAAA;CAChCE;CAEV,YAAYC,KAAsC;AAC9C,QAAMA,IAAAA;AAEN,OAAKD,eAAeC,IAAID;;CAG5B,MAAME,eAAeC,KAAiD;EAClE,MAAMC,OAAO,KAAKC,aAAaF,KAAK,OAAA;EACpC,MAAMG,cAAc,KAAKD,aAAaF,KAAK,eAAA;EAC3C,MAAMH,eAAe,KAAKK,aAAaF,KAAK,gBAAA;AAC5C,MAAI,CAACC,KACD,OAAMX,YAAYc,gBAAc;EAGpC,MAAMC,SAAS,MAAM,KAAKR,aAAaS,OAAOL,MAAM;GAChDE;GACAN;GACJ,CAAA;AAEA,SAAO,KAAKU,QAAQF,QAAQ;GACxBG,WAAWd,aAAaM,KAAK,EAAES,YAAY,MAAK,CAAA;GAChDC,WAAWjB,iBAAiBO,KAAK,aAAA;GACrC,CAAA;;CAGME,aAAaF,KAAcW,KAAkC;EACnE,IAAIC,QAAkBrB,eAAeS,KAAKW,IAAAA;AAC1C,MAAI,CAACC,MACDA,SAAQpB,gBAAgBQ,KAAKW,IAAAA;AAGjC,SAAO,OAAOC,UAAU,YAAYA,MAAMC,SAAS,IAC/CD,QACAE,KAAAA"}
+{"version":3,"file":"authorize.mjs","names":["OAuth2Error","useRequestBody","useRequestQuery","getRequestHeader","getRequestIP","OAuth2AuthorizeGrant","extractClientCredentialsFromRequest","HTTPOAuth2AuthorizeGrant","codeVerifier","clientAuthenticator","ctx","runWithRequest","req","code","extractParam","redirectUri","requestInvalid","clientId","clientSecret","realmId","client","authenticate","entity","verify","id","clientIsPublic","is_confidential","runWith","ipAddress","trustProxy","userAgent","key","value","length","undefined"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/authorize.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2Error } from '@authup/specs';\nimport { useRequestBody } from '@routup/basic/body';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { Request } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport { OAuth2AuthorizeGrant } from '../../../../../core/index.ts';\nimport type {\n    IOAuth2AuthorizationCodeVerifier,\n    OAuth2ClientAuthenticator,\n} from '../../../../../core/index.ts';\nimport type { HTTPOAuth2AuthorizeGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport { extractClientCredentialsFromRequest } from './utils/index.ts';\n\nexport class HTTPOAuth2AuthorizeGrant extends OAuth2AuthorizeGrant implements IHTTPOAuth2Grant {\n    protected codeVerifier : IOAuth2AuthorizationCodeVerifier;\n\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    constructor(ctx: HTTPOAuth2AuthorizeGrantContext) {\n        super(ctx);\n\n        this.codeVerifier = ctx.codeVerifier;\n        this.clientAuthenticator = ctx.clientAuthenticator;\n    }\n\n    async runWithRequest(req: Request): Promise<OAuth2TokenGrantResponse> {\n        const code = this.extractParam(req, 'code');\n        const redirectUri = this.extractParam(req, 'redirect_uri');\n        const codeVerifier = this.extractParam(req, 'code_verifier');\n        if (!code) {\n            throw OAuth2Error.requestInvalid();\n        }\n\n        const { clientId, clientSecret } = extractClientCredentialsFromRequest(req);\n        const realmId = this.extractParam(req, 'realm_id');\n\n        const client = await this.clientAuthenticator.authenticate(clientId, clientSecret, realmId);\n\n        const entity = await this.codeVerifier.verify(code, {\n            redirectUri,\n            codeVerifier,\n            clientId: client.id,\n            clientIsPublic: !client.is_confidential,\n        });\n\n        return this.runWith(entity, {\n            ipAddress: getRequestIP(req, { trustProxy: true }),\n            userAgent: getRequestHeader(req, 'user-agent'),\n        });\n    }\n\n    protected extractParam(req: Request, key: string) : string | undefined {\n        let value : unknown = useRequestBody(req, key);\n        if (!value) {\n            value = useRequestQuery(req, key);\n        }\n\n        return typeof value === 'string' && value.length > 0 ?\n            value :\n            undefined;\n    }\n}\n"],"mappings":";;;;;;;;;AAqBA,IAAaO,2BAAb,cAA8CF,qBAAAA;CAChCG;CAEAC;CAEV,YAAYC,KAAsC;AAC9C,QAAMA,IAAAA;AAEN,OAAKF,eAAeE,IAAIF;AACxB,OAAKC,sBAAsBC,IAAID;;CAGnC,MAAME,eAAeC,KAAiD;EAClE,MAAMC,OAAO,KAAKC,aAAaF,KAAK,OAAA;EACpC,MAAMG,cAAc,KAAKD,aAAaF,KAAK,eAAA;EAC3C,MAAMJ,eAAe,KAAKM,aAAaF,KAAK,gBAAA;AAC5C,MAAI,CAACC,KACD,OAAMb,YAAYgB,gBAAc;EAGpC,MAAM,EAAEC,UAAUC,iBAAiBZ,oCAAoCM,IAAAA;EACvE,MAAMO,UAAU,KAAKL,aAAaF,KAAK,WAAA;EAEvC,MAAMQ,SAAS,MAAM,KAAKX,oBAAoBY,aAAaJ,UAAUC,cAAcC,QAAAA;EAEnF,MAAMG,SAAS,MAAM,KAAKd,aAAae,OAAOV,MAAM;GAChDE;GACAP;GACAS,UAAUG,OAAOI;GACjBC,gBAAgB,CAACL,OAAOM;GAC5B,CAAA;AAEA,SAAO,KAAKC,QAAQL,QAAQ;GACxBM,WAAWxB,aAAaQ,KAAK,EAAEiB,YAAY,MAAK,CAAA;GAChDC,WAAW3B,iBAAiBS,KAAK,aAAA;GACrC,CAAA;;CAGME,aAAaF,KAAcmB,KAAkC;EACnE,IAAIC,QAAkB/B,eAAeW,KAAKmB,IAAAA;AAC1C,MAAI,CAACC,MACDA,SAAQ9B,gBAAgBU,KAAKmB,IAAAA;AAGjC,SAAO,OAAOC,UAAU,YAAYA,MAAMC,SAAS,IAC/CD,QACAE,KAAAA"}

package/dist/adapters/http/adapters/oauth2/grant-types/client-credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-credentials.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/client-credentials.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAG9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAG/C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAEtC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,KAAK,EAAE,uCAAuC,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE5F,qBAAa,0BAA2B,SAAQ,sBAAuB,YAAW,gBAAgB;IAC9F,SAAS,CAAC,aAAa,EAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;gBAEhD,GAAG,EAAE,uCAAuC;IAMlD,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,wBAAwB,CAAC;CA6BxE"}
+{"version":3,"file":"client-credentials.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/client-credentials.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAE9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAEtC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,KAAK,EAAE,uCAAuC,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAG5F,qBAAa,0BAA2B,SAAQ,sBAAuB,YAAW,gBAAgB;IAC9F,SAAS,CAAC,aAAa,EAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;gBAEhD,GAAG,EAAE,uCAAuC;IAMlD,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAexE"}

package/dist/adapters/http/adapters/oauth2/grant-types/client-credentials.mjs

@@ -1,10 +1,10 @@
 import { ClientCredentialsGrant } from "../../../../../core/oauth2/grant-types/client-credentials.mjs";
 import "../../../../../core/index.mjs";
+import { extractClientCredentialsFromRequest } from "./utils/credentials.mjs";
+import "./utils/index.mjs";
 import { ClientError } from "@authup/core-kit";
-import { OAuth2Error } from "@authup/specs";
 import { getRequestHeader, getRequestIP } from "routup";
 import { useRequestBody } from "@routup/basic/body";
-import { AuthorizationHeaderType, parseAuthorizationHeader } from "hapic";
 //#region src/adapters/http/adapters/oauth2/grant-types/client-credentials.ts
 var HTTPClientCredentialsGrant = class extends ClientCredentialsGrant {
 	authenticator;
@@ -13,18 +13,10 @@ var HTTPClientCredentialsGrant = class extends ClientCredentialsGrant {
 		this.authenticator = ctx.authenticator;
 	}
 	async runWithRequest(req) {
-		let clientId = useRequestBody(req, "client_id");
-		let clientSecret = useRequestBody(req, "client_secret");
+		const { clientId, clientSecret } = extractClientCredentialsFromRequest(req);
 		const realmId = useRequestBody(req, "realm_id");
-		if (!clientId && !clientSecret) {
-			const { authorization: headerValue } = req.headers;
-			if (typeof headerValue !== "string") throw ClientError.credentialsInvalid();
-			const header = parseAuthorizationHeader(headerValue);
-			if (header.type !== AuthorizationHeaderType.BASIC) throw OAuth2Error.requestInvalid();
-			clientId = header.username;
-			clientSecret = header.password;
-		}
-		const client = await this.authenticator.authenticate(clientId, clientSecret, realmId);
+		if (!clientId) throw ClientError.credentialsInvalid();
+		const client = await this.authenticator.authenticate(clientId, clientSecret ?? "", realmId);
 		return this.runWith(client, {
 			ipAddress: getRequestIP(req, { trustProxy: true }),
 			userAgent: getRequestHeader(req, "user-agent")

package/dist/adapters/http/adapters/oauth2/grant-types/client-credentials.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"client-credentials.mjs","names":["OAuth2Error","useRequestBody","ClientError","AuthorizationHeaderType","parseAuthorizationHeader","getRequestHeader","getRequestIP","ClientCredentialsGrant","HTTPClientCredentialsGrant","authenticator","ctx","runWithRequest","req","clientId","clientSecret","realmId","authorization","headerValue","headers","credentialsInvalid","header","type","BASIC","requestInvalid","username","password","client","authenticate","runWith","ipAddress","trustProxy","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/client-credentials.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2Error } from '@authup/specs';\nimport { useRequestBody } from '@routup/basic/body';\nimport type { Client } from '@authup/core-kit';\nimport { ClientError } from '@authup/core-kit';\nimport { AuthorizationHeaderType, parseAuthorizationHeader } from 'hapic';\nimport type { Request } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type { ICredentialsAuthenticator } from '../../../../../core/index.ts';\nimport { ClientCredentialsGrant } from '../../../../../core/index.ts';\nimport type { HTTPOAuth2ClientCredentialsGrantContext, IHTTPOAuth2Grant } from './types.ts';\n\nexport class HTTPClientCredentialsGrant extends ClientCredentialsGrant implements IHTTPOAuth2Grant {\n    protected authenticator : ICredentialsAuthenticator<Client>;\n\n    constructor(ctx: HTTPOAuth2ClientCredentialsGrantContext) {\n        super(ctx);\n\n        this.authenticator = ctx.authenticator;\n    }\n\n    async runWithRequest(req: Request): Promise<OAuth2TokenGrantResponse> {\n        let clientId = useRequestBody(req, 'client_id');\n        let clientSecret = useRequestBody(req, 'client_secret');\n        const realmId = useRequestBody(req, 'realm_id');\n\n        if (!clientId && !clientSecret) {\n            const { authorization: headerValue } = req.headers;\n\n            if (typeof headerValue !== 'string') {\n                throw ClientError.credentialsInvalid();\n            }\n\n            const header = parseAuthorizationHeader(headerValue);\n\n            if (header.type !== AuthorizationHeaderType.BASIC) {\n                throw OAuth2Error.requestInvalid();\n            }\n\n            clientId = header.username;\n            clientSecret = header.password;\n        }\n\n        const client = await this.authenticator.authenticate(clientId, clientSecret, realmId);\n\n        return this.runWith(client, {\n            ipAddress: getRequestIP(req, { trustProxy: true }),\n            userAgent: getRequestHeader(req, 'user-agent'),\n        });\n    }\n}\n"],"mappings":";;;;;;;;AAmBA,IAAaQ,6BAAb,cAAgDD,uBAAAA;CAClCE;CAEV,YAAYC,KAA8C;AACtD,QAAMA,IAAAA;AAEN,OAAKD,gBAAgBC,IAAID;;CAG7B,MAAME,eAAeC,KAAiD;EAClE,IAAIC,WAAWZ,eAAeW,KAAK,YAAA;EACnC,IAAIE,eAAeb,eAAeW,KAAK,gBAAA;EACvC,MAAMG,UAAUd,eAAeW,KAAK,WAAA;AAEpC,MAAI,CAACC,YAAY,CAACC,cAAc;GAC5B,MAAM,EAAEE,eAAeC,gBAAgBL,IAAIM;AAE3C,OAAI,OAAOD,gBAAgB,SACvB,OAAMf,YAAYiB,oBAAkB;GAGxC,MAAMC,SAAShB,yBAAyBa,YAAAA;AAExC,OAAIG,OAAOC,SAASlB,wBAAwBmB,MACxC,OAAMtB,YAAYuB,gBAAc;AAGpCV,cAAWO,OAAOI;AAClBV,kBAAeM,OAAOK;;EAG1B,MAAMC,SAAS,MAAM,KAAKjB,cAAckB,aAAad,UAAUC,cAAcC,QAAAA;AAE7E,SAAO,KAAKa,QAAQF,QAAQ;GACxBG,WAAWvB,aAAaM,KAAK,EAAEkB,YAAY,MAAK,CAAA;GAChDC,WAAW1B,iBAAiBO,KAAK,aAAA;GACrC,CAAA"}
+{"version":3,"file":"client-credentials.mjs","names":["useRequestBody","ClientError","getRequestHeader","getRequestIP","ClientCredentialsGrant","extractClientCredentialsFromRequest","HTTPClientCredentialsGrant","authenticator","ctx","runWithRequest","req","clientId","clientSecret","realmId","credentialsInvalid","client","authenticate","runWith","ipAddress","trustProxy","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/client-credentials.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { useRequestBody } from '@routup/basic/body';\nimport type { Client } from '@authup/core-kit';\nimport { ClientError } from '@authup/core-kit';\nimport type { Request } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type { ICredentialsAuthenticator } from '../../../../../core/index.ts';\nimport { ClientCredentialsGrant } from '../../../../../core/index.ts';\nimport type { HTTPOAuth2ClientCredentialsGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport { extractClientCredentialsFromRequest } from './utils/index.ts';\n\nexport class HTTPClientCredentialsGrant extends ClientCredentialsGrant implements IHTTPOAuth2Grant {\n    protected authenticator : ICredentialsAuthenticator<Client>;\n\n    constructor(ctx: HTTPOAuth2ClientCredentialsGrantContext) {\n        super(ctx);\n\n        this.authenticator = ctx.authenticator;\n    }\n\n    async runWithRequest(req: Request): Promise<OAuth2TokenGrantResponse> {\n        const { clientId, clientSecret } = extractClientCredentialsFromRequest(req);\n        const realmId = useRequestBody(req, 'realm_id');\n\n        if (!clientId) {\n            throw ClientError.credentialsInvalid();\n        }\n\n        const client = await this.authenticator.authenticate(clientId, clientSecret ?? '', realmId);\n\n        return this.runWith(client, {\n            ipAddress: getRequestIP(req, { trustProxy: true }),\n            userAgent: getRequestHeader(req, 'user-agent'),\n        });\n    }\n}\n"],"mappings":";;;;;;;;AAkBA,IAAaM,6BAAb,cAAgDF,uBAAAA;CAClCG;CAEV,YAAYC,KAA8C;AACtD,QAAMA,IAAAA;AAEN,OAAKD,gBAAgBC,IAAID;;CAG7B,MAAME,eAAeC,KAAiD;EAClE,MAAM,EAAEC,UAAUC,iBAAiBP,oCAAoCK,IAAAA;EACvE,MAAMG,UAAUb,eAAeU,KAAK,WAAA;AAEpC,MAAI,CAACC,SACD,OAAMV,YAAYa,oBAAkB;EAGxC,MAAMC,SAAS,MAAM,KAAKR,cAAcS,aAAaL,UAAUC,gBAAgB,IAAIC,QAAAA;AAEnF,SAAO,KAAKI,QAAQF,QAAQ;GACxBG,WAAWf,aAAaO,KAAK,EAAES,YAAY,MAAK,CAAA;GAChDC,WAAWlB,iBAAiBQ,KAAK,aAAA;GACrC,CAAA"}

package/dist/adapters/http/adapters/oauth2/grant-types/index.mjs

@@ -1,3 +1,4 @@
+import { extractClientCredentialsFromRequest } from "./utils/credentials.mjs";
 import { guessOauth2GrantTypeByRequest } from "./utils/guess.mjs";
 import "./utils/index.mjs";
 import { HTTPOAuth2AuthorizeGrant } from "./authorize.mjs";
@@ -6,4 +7,4 @@ import { HTTPOAuth2IdentityGrantType } from "./identity.mjs";
 import { HTTPPasswordGrant } from "./password.mjs";
 import { HTTPOAuth2RefreshTokenGrant } from "./refresh_token.mjs";
 import { HTTPRobotCredentialsGrant } from "./robot-credentials.mjs";
-export { HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, guessOauth2GrantTypeByRequest };
+export { HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, extractClientCredentialsFromRequest, guessOauth2GrantTypeByRequest };

package/dist/adapters/http/adapters/oauth2/grant-types/password.d.ts

@@ -1,11 +1,12 @@
 import type { User } from '@authup/core-kit';
 import type { OAuth2TokenGrantResponse } from '@authup/specs';
 import type { Request } from 'routup';
-import type { ICredentialsAuthenticator } from '../../../../../core/index.ts';
+import type { ICredentialsAuthenticator, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';
 import { PasswordGrantType } from '../../../../../core/index.ts';
 import type { HTTPOAuth2PasswordGrantContext, IHTTPOAuth2Grant } from './types.ts';
 export declare class HTTPPasswordGrant extends PasswordGrantType implements IHTTPOAuth2Grant {
     protected authenticator: ICredentialsAuthenticator<User>;
+    protected clientAuthenticator: OAuth2ClientAuthenticator;
     constructor(ctx: HTTPOAuth2PasswordGrantContext);
     runWithRequest(req: Request): Promise<OAuth2TokenGrantResponse>;
 }

package/dist/adapters/http/adapters/oauth2/grant-types/password.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/password.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAE9D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAEtC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAE,8BAA8B,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnF,qBAAa,iBAAkB,SAAQ,iBAAkB,YAAW,gBAAgB;IAChF,SAAS,CAAC,aAAa,EAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;gBAE9C,GAAG,EAAE,8BAA8B;IAMzC,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAiBxE"}
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/password.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAE9D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAEtC,OAAO,KAAK,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACzG,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAE,8BAA8B,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAGnF,qBAAa,iBAAkB,SAAQ,iBAAkB,YAAW,gBAAgB;IAChF,SAAS,CAAC,aAAa,EAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAE1D,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;gBAE9C,GAAG,EAAE,8BAA8B;IAOzC,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,wBAAwB,CAAC;CA2BxE"}

package/dist/adapters/http/adapters/oauth2/grant-types/password.mjs

@@ -1,18 +1,27 @@
 import { PasswordGrantType } from "../../../../../core/oauth2/grant-types/password.mjs";
 import "../../../../../core/index.mjs";
+import { extractClientCredentialsFromRequest } from "./utils/credentials.mjs";
+import "./utils/index.mjs";
 import { getRequestHeader, getRequestIP } from "routup";
 import { useRequestBody } from "@routup/basic/body";
 //#region src/adapters/http/adapters/oauth2/grant-types/password.ts
 var HTTPPasswordGrant = class extends PasswordGrantType {
 	authenticator;
+	clientAuthenticator;
 	constructor(ctx) {
 		super(ctx);
 		this.authenticator = ctx.authenticator;
+		this.clientAuthenticator = ctx.clientAuthenticator;
 	}
 	async runWithRequest(req) {
 		const { username, password, realm_id: realmId } = useRequestBody(req);
-		const data = await this.authenticator.authenticate(username, password, realmId);
-		return this.runWith(data, {
+		const { clientId, clientSecret } = extractClientCredentialsFromRequest(req);
+		const client = clientId ? await this.clientAuthenticator.authenticate(clientId, clientSecret, typeof realmId === "string" ? realmId : void 0) : void 0;
+		const user = await this.authenticator.authenticate(username, password, realmId);
+		return this.runWith({
+			user,
+			client
+		}, {
 			ipAddress: getRequestIP(req, { trustProxy: true }),
 			userAgent: getRequestHeader(req, "user-agent")
 		});

package/dist/adapters/http/adapters/oauth2/grant-types/password.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"password.mjs","names":["useRequestBody","getRequestHeader","getRequestIP","PasswordGrantType","HTTPPasswordGrant","authenticator","ctx","runWithRequest","req","username","password","realm_id","realmId","data","authenticate","runWith","ipAddress","trustProxy","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/password.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { User } from '@authup/core-kit';\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { useRequestBody } from '@routup/basic/body';\nimport type { Request } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type { ICredentialsAuthenticator } from '../../../../../core/index.ts';\nimport { PasswordGrantType } from '../../../../../core/index.ts';\nimport type { HTTPOAuth2PasswordGrantContext, IHTTPOAuth2Grant } from './types.ts';\n\nexport class HTTPPasswordGrant extends PasswordGrantType implements IHTTPOAuth2Grant {\n    protected authenticator : ICredentialsAuthenticator<User>;\n\n    constructor(ctx: HTTPOAuth2PasswordGrantContext) {\n        super(ctx);\n\n        this.authenticator = ctx.authenticator;\n    }\n\n    async runWithRequest(req: Request): Promise<OAuth2TokenGrantResponse> {\n        const {\n            username,\n            password,\n            realm_id: realmId,\n        } = useRequestBody(req);\n\n        const data = await this.authenticator.authenticate(username, password, realmId);\n\n        return this.runWith(\n            data,\n            {\n                ipAddress: getRequestIP(req, { trustProxy: true }),\n                userAgent: getRequestHeader(req, 'user-agent'),\n            },\n        );\n    }\n}\n"],"mappings":";;;;;AAgBA,IAAaI,oBAAb,cAAuCD,kBAAAA;CACzBE;CAEV,YAAYC,KAAqC;AAC7C,QAAMA,IAAAA;AAEN,OAAKD,gBAAgBC,IAAID;;CAG7B,MAAME,eAAeC,KAAiD;EAClE,MAAM,EACFC,UACAC,UACAC,UAAUC,YACVZ,eAAeQ,IAAAA;EAEnB,MAAMK,OAAO,MAAM,KAAKR,cAAcS,aAAaL,UAAUC,UAAUE,QAAAA;AAEvE,SAAO,KAAKG,QACRF,MACA;GACIG,WAAWd,aAAaM,KAAK,EAAES,YAAY,MAAK,CAAA;GAChDC,WAAWjB,iBAAiBO,KAAK,aAAA;GACrC,CAAA"}
+{"version":3,"file":"password.mjs","names":["useRequestBody","getRequestHeader","getRequestIP","PasswordGrantType","extractClientCredentialsFromRequest","HTTPPasswordGrant","authenticator","clientAuthenticator","ctx","runWithRequest","req","username","password","realm_id","realmId","clientId","clientSecret","client","authenticate","undefined","user","runWith","ipAddress","trustProxy","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/password.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { User } from '@authup/core-kit';\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { useRequestBody } from '@routup/basic/body';\nimport type { Request } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type { ICredentialsAuthenticator, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';\nimport { PasswordGrantType } from '../../../../../core/index.ts';\nimport type { HTTPOAuth2PasswordGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport { extractClientCredentialsFromRequest } from './utils/index.ts';\n\nexport class HTTPPasswordGrant extends PasswordGrantType implements IHTTPOAuth2Grant {\n    protected authenticator : ICredentialsAuthenticator<User>;\n\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    constructor(ctx: HTTPOAuth2PasswordGrantContext) {\n        super(ctx);\n\n        this.authenticator = ctx.authenticator;\n        this.clientAuthenticator = ctx.clientAuthenticator;\n    }\n\n    async runWithRequest(req: Request): Promise<OAuth2TokenGrantResponse> {\n        const {\n            username,\n            password,\n            realm_id: realmId,\n        } = useRequestBody(req);\n\n        const { clientId, clientSecret } = extractClientCredentialsFromRequest(req);\n\n        const client = clientId ?\n            await this.clientAuthenticator.authenticate(\n                clientId,\n                clientSecret,\n                typeof realmId === 'string' ? realmId : undefined,\n            ) :\n            undefined;\n\n        const user = await this.authenticator.authenticate(username, password, realmId);\n\n        return this.runWith(\n            { user, client },\n            {\n                ipAddress: getRequestIP(req, { trustProxy: true }),\n                userAgent: getRequestHeader(req, 'user-agent'),\n            },\n        );\n    }\n}\n"],"mappings":";;;;;;;AAiBA,IAAaK,oBAAb,cAAuCF,kBAAAA;CACzBG;CAEAC;CAEV,YAAYC,KAAqC;AAC7C,QAAMA,IAAAA;AAEN,OAAKF,gBAAgBE,IAAIF;AACzB,OAAKC,sBAAsBC,IAAID;;CAGnC,MAAME,eAAeC,KAAiD;EAClE,MAAM,EACFC,UACAC,UACAC,UAAUC,YACVd,eAAeU,IAAAA;EAEnB,MAAM,EAAEK,UAAUC,iBAAiBZ,oCAAoCM,IAAAA;EAEvE,MAAMO,SAASF,WACX,MAAM,KAAKR,oBAAoBW,aAC3BH,UACAC,cACA,OAAOF,YAAY,WAAWA,UAAUK,KAAAA,EAAAA,GAE5CA,KAAAA;EAEJ,MAAMC,OAAO,MAAM,KAAKd,cAAcY,aAAaP,UAAUC,UAAUE,QAAAA;AAEvE,SAAO,KAAKO,QACR;GAAED;GAAMH;GAAO,EACf;GACIK,WAAWpB,aAAaQ,KAAK,EAAEa,YAAY,MAAK,CAAA;GAChDC,WAAWvB,iBAAiBS,KAAK,aAAA;GACrC,CAAA"}

package/dist/adapters/http/adapters/oauth2/grant-types/refresh_token.d.ts

@@ -1,8 +1,12 @@
 import type { OAuth2TokenGrantResponse } from '@authup/specs';
 import type { Request } from 'routup';
 import { OAuth2RefreshTokenGrant } from '../../../../../core/index.ts';
-import type { IHTTPOAuth2Grant } from './types.ts';
+import type { IOAuth2TokenVerifier, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';
+import type { HTTPOAuth2RefreshTokenGrantContext, IHTTPOAuth2Grant } from './types.ts';
 export declare class HTTPOAuth2RefreshTokenGrant extends OAuth2RefreshTokenGrant implements IHTTPOAuth2Grant {
+    protected clientAuthenticator: OAuth2ClientAuthenticator;
+    protected refreshTokenVerifier: IOAuth2TokenVerifier;
+    constructor(ctx: HTTPOAuth2RefreshTokenGrantContext);
     runWithRequest(req: Request): Promise<OAuth2TokenGrantResponse>;
 }
 //# sourceMappingURL=refresh_token.d.ts.map

package/dist/adapters/http/adapters/oauth2/grant-types/refresh_token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refresh_token.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/refresh_token.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAE9D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAEtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,qBAAa,2BAA4B,SAAQ,uBAAwB,YAAW,gBAAgB;IAC1F,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAQxE"}
+{"version":3,"file":"refresh_token.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/refresh_token.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAG9D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAEtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,KAAK,EACR,oBAAoB,EACpB,yBAAyB,EAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,kCAAkC,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAGvF,qBAAa,2BAA4B,SAAQ,uBAAwB,YAAW,gBAAgB;IAChG,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;IAE1D,SAAS,CAAC,oBAAoB,EAAG,oBAAoB,CAAC;gBAE1C,GAAG,EAAE,kCAAkC;IAO7C,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAoCxE"}

package/dist/adapters/http/adapters/oauth2/grant-types/refresh_token.mjs

@@ -1,12 +1,30 @@
 import { OAuth2RefreshTokenGrant } from "../../../../../core/oauth2/grant-types/refresh-token.mjs";
 import "../../../../../core/index.mjs";
+import { extractClientCredentialsFromRequest } from "./utils/credentials.mjs";
+import "./utils/index.mjs";
+import { OAuth2Error } from "@authup/specs";
 import { getRequestHeader, getRequestIP } from "routup";
 import { useRequestBody } from "@routup/basic/body";
 //#region src/adapters/http/adapters/oauth2/grant-types/refresh_token.ts
 var HTTPOAuth2RefreshTokenGrant = class extends OAuth2RefreshTokenGrant {
+	clientAuthenticator;
+	refreshTokenVerifier;
+	constructor(ctx) {
+		super(ctx);
+		this.clientAuthenticator = ctx.clientAuthenticator;
+		this.refreshTokenVerifier = ctx.tokenVerifier;
+	}
 	async runWithRequest(req) {
 		const refreshToken = useRequestBody(req, "refresh_token");
-		return this.runWith(refreshToken, {
+		if (typeof refreshToken !== "string" || refreshToken.length === 0) throw OAuth2Error.requestInvalid();
+		const { clientId, clientSecret } = extractClientCredentialsFromRequest(req);
+		const realmId = useRequestBody(req, "realm_id");
+		const payload = await this.refreshTokenVerifier.verify(refreshToken);
+		if (clientId) {
+			const client = await this.clientAuthenticator.authenticate(clientId, clientSecret, typeof realmId === "string" ? realmId : void 0);
+			if (payload.client_id && payload.client_id !== client.id) throw OAuth2Error.grantInvalid();
+		} else if (payload.client_id) throw OAuth2Error.clientInvalid();
+		return this.runWith(payload, {
 			ipAddress: getRequestIP(req, { trustProxy: true }),
 			userAgent: getRequestHeader(req, "user-agent")
 		});

package/dist/adapters/http/adapters/oauth2/grant-types/refresh_token.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"refresh_token.mjs","names":["useRequestBody","getRequestHeader","getRequestIP","OAuth2RefreshTokenGrant","HTTPOAuth2RefreshTokenGrant","runWithRequest","req","refreshToken","runWith","ipAddress","trustProxy","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/refresh_token.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { useRequestBody } from '@routup/basic/body';\nimport type { Request } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport { OAuth2RefreshTokenGrant } from '../../../../../core/index.ts';\nimport type { IHTTPOAuth2Grant } from './types.ts';\n\nexport class HTTPOAuth2RefreshTokenGrant extends OAuth2RefreshTokenGrant implements IHTTPOAuth2Grant {\n    async runWithRequest(req: Request): Promise<OAuth2TokenGrantResponse> {\n        const refreshToken = useRequestBody(req, 'refresh_token');\n\n        return this.runWith(refreshToken, {\n            ipAddress: getRequestIP(req, { trustProxy: true }),\n            userAgent: getRequestHeader(req, 'user-agent'),\n        });\n    }\n}\n"],"mappings":";;;;;AAcA,IAAaI,8BAAb,cAAiDD,wBAAAA;CAC7C,MAAME,eAAeC,KAAiD;EAClE,MAAMC,eAAeP,eAAeM,KAAK,gBAAA;AAEzC,SAAO,KAAKE,QAAQD,cAAc;GAC9BE,WAAWP,aAAaI,KAAK,EAAEI,YAAY,MAAK,CAAA;GAChDC,WAAWV,iBAAiBK,KAAK,aAAA;GACrC,CAAA"}
+{"version":3,"file":"refresh_token.mjs","names":["OAuth2Error","useRequestBody","getRequestHeader","getRequestIP","OAuth2RefreshTokenGrant","extractClientCredentialsFromRequest","HTTPOAuth2RefreshTokenGrant","clientAuthenticator","refreshTokenVerifier","ctx","tokenVerifier","runWithRequest","req","refreshToken","length","requestInvalid","clientId","clientSecret","realmId","payload","verify","client","authenticate","undefined","client_id","id","grantInvalid","clientInvalid","runWith","ipAddress","trustProxy","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/refresh_token.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2Error } from '@authup/specs';\nimport { useRequestBody } from '@routup/basic/body';\nimport type { Request } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport { OAuth2RefreshTokenGrant } from '../../../../../core/index.ts';\nimport type {\n    IOAuth2TokenVerifier,\n    OAuth2ClientAuthenticator,\n} from '../../../../../core/index.ts';\nimport type { HTTPOAuth2RefreshTokenGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport { extractClientCredentialsFromRequest } from './utils/index.ts';\n\nexport class HTTPOAuth2RefreshTokenGrant extends OAuth2RefreshTokenGrant implements IHTTPOAuth2Grant {\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    protected refreshTokenVerifier : IOAuth2TokenVerifier;\n\n    constructor(ctx: HTTPOAuth2RefreshTokenGrantContext) {\n        super(ctx);\n\n        this.clientAuthenticator = ctx.clientAuthenticator;\n        this.refreshTokenVerifier = ctx.tokenVerifier;\n    }\n\n    async runWithRequest(req: Request): Promise<OAuth2TokenGrantResponse> {\n        const refreshToken = useRequestBody(req, 'refresh_token');\n        if (typeof refreshToken !== 'string' || refreshToken.length === 0) {\n            throw OAuth2Error.requestInvalid();\n        }\n\n        const { clientId, clientSecret } = extractClientCredentialsFromRequest(req);\n        const realmId = useRequestBody(req, 'realm_id');\n\n        // RFC 6749 §6: verify the refresh token first to learn its bound\n        // client (if any), then enforce binding. Authenticate the requesting\n        // client when credentials are present, or when the token requires\n        // a client binding.\n        const payload = await this.refreshTokenVerifier.verify(refreshToken);\n\n        if (clientId) {\n            const client = await this.clientAuthenticator.authenticate(\n                clientId,\n                clientSecret,\n                typeof realmId === 'string' ? realmId : undefined,\n            );\n\n            if (payload.client_id && payload.client_id !== client.id) {\n                throw OAuth2Error.grantInvalid();\n            }\n        } else if (payload.client_id) {\n            // Token was issued to a specific client — that client MUST\n            // re-authenticate (RFC 6749 §6 binding requirement).\n            throw OAuth2Error.clientInvalid();\n        }\n\n        return this.runWith(payload, {\n            ipAddress: getRequestIP(req, { trustProxy: true }),\n            userAgent: getRequestHeader(req, 'user-agent'),\n        });\n    }\n}\n"],"mappings":";;;;;;;;AAoBA,IAAaM,8BAAb,cAAiDF,wBAAAA;CACnCG;CAEAC;CAEV,YAAYC,KAAyC;AACjD,QAAMA,IAAAA;AAEN,OAAKF,sBAAsBE,IAAIF;AAC/B,OAAKC,uBAAuBC,IAAIC;;CAGpC,MAAMC,eAAeC,KAAiD;EAClE,MAAMC,eAAeZ,eAAeW,KAAK,gBAAA;AACzC,MAAI,OAAOC,iBAAiB,YAAYA,aAAaC,WAAW,EAC5D,OAAMd,YAAYe,gBAAc;EAGpC,MAAM,EAAEC,UAAUC,iBAAiBZ,oCAAoCO,IAAAA;EACvE,MAAMM,UAAUjB,eAAeW,KAAK,WAAA;EAMpC,MAAMO,UAAU,MAAM,KAAKX,qBAAqBY,OAAOP,aAAAA;AAEvD,MAAIG,UAAU;GACV,MAAMK,SAAS,MAAM,KAAKd,oBAAoBe,aAC1CN,UACAC,cACA,OAAOC,YAAY,WAAWA,UAAUK,KAAAA,EAAAA;AAG5C,OAAIJ,QAAQK,aAAaL,QAAQK,cAAcH,OAAOI,GAClD,OAAMzB,YAAY0B,cAAY;aAE3BP,QAAQK,UAGf,OAAMxB,YAAY2B,eAAa;AAGnC,SAAO,KAAKC,QAAQT,SAAS;GACzBU,WAAW1B,aAAaS,KAAK,EAAEkB,YAAY,MAAK,CAAA;GAChDC,WAAW7B,iBAAiBU,KAAK,aAAA;GACrC,CAAA"}

package/dist/adapters/http/adapters/oauth2/grant-types/types.d.ts

@@ -1,15 +1,20 @@
 import type { Client, Robot, User } from '@authup/core-kit';
 import type { OAuth2TokenGrantResponse } from '@authup/specs';
 import type { Request } from 'routup';
-import type { BaseGrantContext, ICredentialsAuthenticator, IOAuth2AuthorizationCodeVerifier, OAuth2AuthorizeGrantContext, OAuth2PasswordGrantContext } from '../../../../../core/index.ts';
+import type { BaseGrantContext, ICredentialsAuthenticator, IOAuth2AuthorizationCodeVerifier, OAuth2AuthorizeGrantContext, OAuth2ClientAuthenticator, OAuth2PasswordGrantContext, OAuth2RefreshTokenGrantContext } from '../../../../../core/index.ts';
 export type HTTPOAuth2AuthorizeGrantContext = OAuth2AuthorizeGrantContext & {
     codeVerifier: IOAuth2AuthorizationCodeVerifier;
+    clientAuthenticator: OAuth2ClientAuthenticator;
 };
 export interface IHTTPOAuth2Grant {
     runWithRequest(req: Request): Promise<OAuth2TokenGrantResponse>;
 }
 export type HTTPOAuth2PasswordGrantContext = OAuth2PasswordGrantContext & {
     authenticator: ICredentialsAuthenticator<User>;
+    clientAuthenticator: OAuth2ClientAuthenticator;
+};
+export type HTTPOAuth2RefreshTokenGrantContext = OAuth2RefreshTokenGrantContext & {
+    clientAuthenticator: OAuth2ClientAuthenticator;
 };
 export type HTTPOAuth2ClientCredentialsGrantContext = BaseGrantContext & {
     authenticator: ICredentialsAuthenticator<Client>;

package/dist/adapters/http/adapters/oauth2/grant-types/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,KAAK,EACR,gBAAgB,EAChB,yBAAyB,EACzB,gCAAgC,EAChC,2BAA2B,EAC3B,0BAA0B,EAC7B,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,+BAA+B,GAAG,2BAA2B,GAAG;IACxE,YAAY,EAAE,gCAAgC,CAAA;CACjD,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC7B,cAAc,CAAC,GAAG,EAAE,OAAO,GAAI,OAAO,CAAC,wBAAwB,CAAC,CAAA;CACnE;AAED,MAAM,MAAM,8BAA8B,GAAG,0BAA0B,GAAG;IACtE,aAAa,EAAG,yBAAyB,CAAC,IAAI,CAAC,CAAA;CAClD,CAAC;AAEF,MAAM,MAAM,uCAAuC,GAAG,gBAAgB,GAAG;IACrE,aAAa,EAAG,yBAAyB,CAAC,MAAM,CAAC,CAAA;CACpD,CAAC;AAEF,MAAM,MAAM,sCAAsC,GAAG,gBAAgB,GAAG;IACpE,aAAa,EAAG,yBAAyB,CAAC,KAAK,CAAC,CAAA;CACnD,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,KAAK,EACR,gBAAgB,EAChB,yBAAyB,EACzB,gCAAgC,EAChC,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,8BAA8B,EACjC,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,+BAA+B,GAAG,2BAA2B,GAAG;IACxE,YAAY,EAAE,gCAAgC,CAAC;IAC/C,mBAAmB,EAAE,yBAAyB,CAAC;CAClD,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC7B,cAAc,CAAC,GAAG,EAAE,OAAO,GAAI,OAAO,CAAC,wBAAwB,CAAC,CAAA;CACnE;AAED,MAAM,MAAM,8BAA8B,GAAG,0BAA0B,GAAG;IACtE,aAAa,EAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAChD,mBAAmB,EAAE,yBAAyB,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,kCAAkC,GAAG,8BAA8B,GAAG;IAC9E,mBAAmB,EAAE,yBAAyB,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,uCAAuC,GAAG,gBAAgB,GAAG;IACrE,aAAa,EAAG,yBAAyB,CAAC,MAAM,CAAC,CAAA;CACpD,CAAC;AAEF,MAAM,MAAM,sCAAsC,GAAG,gBAAgB,GAAG;IACpE,aAAa,EAAG,yBAAyB,CAAC,KAAK,CAAC,CAAA;CACnD,CAAC"}

package/dist/adapters/http/adapters/oauth2/grant-types/utils/credentials.d.ts

@@ -0,0 +1,15 @@
+import type { Request } from 'routup';
+export type ExtractedClientCredentials = {
+    clientId?: string;
+    clientSecret?: string;
+};
+/**
+ * Extract client credentials from an OAuth2 token endpoint request.
+ *
+ * Per RFC 6749 §2.3.1, the server MUST NOT support multiple client
+ * authentication methods in a single request. This helper rejects requests
+ * that present credentials in BOTH the Basic Authorization header and the
+ * request body.
+ */
+export declare function extractClientCredentialsFromRequest(req: Request): ExtractedClientCredentials;
+//# sourceMappingURL=credentials.d.ts.map

package/dist/adapters/http/adapters/oauth2/grant-types/utils/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/credentials.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAEtC,MAAM,MAAM,0BAA0B,GAAG;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,mCAAmC,CAAC,GAAG,EAAE,OAAO,GAAG,0BAA0B,CA4B5F"}

package/dist/adapters/http/adapters/oauth2/grant-types/utils/credentials.mjs

@@ -0,0 +1,57 @@
+import { OAuth2Error } from "@authup/specs";
+import { useRequestBody } from "@routup/basic/body";
+import { AuthorizationHeaderType, parseAuthorizationHeader } from "hapic";
+//#region src/adapters/http/adapters/oauth2/grant-types/utils/credentials.ts
+/**
+* Extract client credentials from an OAuth2 token endpoint request.
+*
+* Per RFC 6749 §2.3.1, the server MUST NOT support multiple client
+* authentication methods in a single request. This helper rejects requests
+* that present credentials in BOTH the Basic Authorization header and the
+* request body.
+*/ function extractClientCredentialsFromRequest(req) {
+	const bodyClientId = readStringBody(req, "client_id");
+	const bodyClientSecret = readStringBody(req, "client_secret");
+	const hasBodyCredentials = !!bodyClientId || !!bodyClientSecret;
+	const basicCredentials = parseBasicCredentials(req);
+	if (hasBodyCredentials && basicCredentials) throw OAuth2Error.requestInvalid("Client credentials must be provided either via Basic Authorization header or request body, not both.");
+	if (hasBodyCredentials) {
+		if (!bodyClientId) throw OAuth2Error.requestInvalid("client_secret was provided without client_id.");
+		return {
+			clientId: bodyClientId,
+			clientSecret: bodyClientSecret
+		};
+	}
+	if (basicCredentials) return basicCredentials;
+	return {};
+}
+function readStringBody(req, key) {
+	const value = useRequestBody(req, key);
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function parseBasicCredentials(req) {
+	const headerValue = req.headers.authorization;
+	if (typeof headerValue !== "string") return;
+	let header;
+	try {
+		header = parseAuthorizationHeader(headerValue);
+	} catch {
+		throw OAuth2Error.requestInvalid("Malformed Authorization header.");
+	}
+	if (header.type !== AuthorizationHeaderType.BASIC) return;
+	return {
+		clientId: formDecode(header.username),
+		clientSecret: formDecode(header.password)
+	};
+}
+function formDecode(value) {
+	try {
+		return decodeURIComponent(value.replace(/\+/g, " "));
+	} catch {
+		return value;
+	}
+}
+//#endregion
+export { extractClientCredentialsFromRequest };
+
+//# sourceMappingURL=credentials.mjs.map

package/dist/adapters/http/adapters/oauth2/grant-types/utils/credentials.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.mjs","names":["OAuth2Error","useRequestBody","AuthorizationHeaderType","parseAuthorizationHeader","extractClientCredentialsFromRequest","req","bodyClientId","readStringBody","bodyClientSecret","hasBodyCredentials","basicCredentials","parseBasicCredentials","requestInvalid","clientId","clientSecret","key","value","length","undefined","headerValue","headers","authorization","header","type","BASIC","formDecode","username","password","decodeURIComponent","replace"],"sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/credentials.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { OAuth2Error } from '@authup/specs';\nimport { useRequestBody } from '@routup/basic/body';\nimport { AuthorizationHeaderType, parseAuthorizationHeader } from 'hapic';\nimport type { Request } from 'routup';\n\nexport type ExtractedClientCredentials = {\n    clientId?: string,\n    clientSecret?: string,\n};\n\n/**\n * Extract client credentials from an OAuth2 token endpoint request.\n *\n * Per RFC 6749 §2.3.1, the server MUST NOT support multiple client\n * authentication methods in a single request. This helper rejects requests\n * that present credentials in BOTH the Basic Authorization header and the\n * request body.\n */\nexport function extractClientCredentialsFromRequest(req: Request): ExtractedClientCredentials {\n    const bodyClientId = readStringBody(req, 'client_id');\n    const bodyClientSecret = readStringBody(req, 'client_secret');\n    const hasBodyCredentials = !!bodyClientId || !!bodyClientSecret;\n\n    const basicCredentials = parseBasicCredentials(req);\n\n    if (hasBodyCredentials && basicCredentials) {\n        throw OAuth2Error.requestInvalid(\n            'Client credentials must be provided either via Basic Authorization header or request body, not both.',\n        );\n    }\n\n    if (hasBodyCredentials) {\n        // Reject stray client_secret without client_id — otherwise grants\n        // that gate auth on `if (clientId)` would silently skip\n        // authentication and leak through with the secret discarded.\n        if (!bodyClientId) {\n            throw OAuth2Error.requestInvalid('client_secret was provided without client_id.');\n        }\n        return { clientId: bodyClientId, clientSecret: bodyClientSecret };\n    }\n\n    if (basicCredentials) {\n        return basicCredentials;\n    }\n\n    return {};\n}\n\nfunction readStringBody(req: Request, key: string): string | undefined {\n    const value = useRequestBody(req, key);\n    return typeof value === 'string' && value.length > 0 ? value : undefined;\n}\n\nfunction parseBasicCredentials(req: Request): ExtractedClientCredentials | undefined {\n    const headerValue = req.headers.authorization;\n    if (typeof headerValue !== 'string') {\n        return undefined;\n    }\n\n    let header;\n    try {\n        header = parseAuthorizationHeader(headerValue);\n    } catch {\n        // Malformed Authorization header — surface as 400 invalid_request\n        // rather than letting hapic's error propagate as 500.\n        throw OAuth2Error.requestInvalid('Malformed Authorization header.');\n    }\n\n    if (header.type !== AuthorizationHeaderType.BASIC) {\n        return undefined;\n    }\n\n    // RFC 6749 §2.3.1 + Appendix B: client_id and client_secret are\n    // application/x-www-form-urlencoded BEFORE base64 encoding in the\n    // Authorization header. hapic only base64-decodes; we form-decode here\n    // so credentials containing reserved characters (`:`, `+`, `%`, `&`,\n    // `=`, etc.) round-trip correctly.\n    return {\n        clientId: formDecode(header.username),\n        clientSecret: formDecode(header.password),\n    };\n}\n\nfunction formDecode(value: string): string {\n    try {\n        // application/x-www-form-urlencoded: '+' represents space; %XX is\n        // percent-encoded UTF-8.\n        return decodeURIComponent(value.replace(/\\+/g, ' '));\n    } catch {\n        // Malformed percent-encoding — return raw value rather than\n        // throwing; the caller will still validate via authentication.\n        return value;\n    }\n}\n"],"mappings":";;;;;;;;;;;GAyBA,SAAgBI,oCAAoCC,KAAY;CAC5D,MAAMC,eAAeC,eAAeF,KAAK,YAAA;CACzC,MAAMG,mBAAmBD,eAAeF,KAAK,gBAAA;CAC7C,MAAMI,qBAAqB,CAAC,CAACH,gBAAgB,CAAC,CAACE;CAE/C,MAAME,mBAAmBC,sBAAsBN,IAAAA;AAE/C,KAAII,sBAAsBC,iBACtB,OAAMV,YAAYY,eACd,uGAAA;AAIR,KAAIH,oBAAoB;AAIpB,MAAI,CAACH,aACD,OAAMN,YAAYY,eAAe,gDAAA;AAErC,SAAO;GAAEC,UAAUP;GAAcQ,cAAcN;GAAiB;;AAGpE,KAAIE,iBACA,QAAOA;AAGX,QAAO,EAAC;;AAGZ,SAASH,eAAeF,KAAcU,KAAW;CAC7C,MAAMC,QAAQf,eAAeI,KAAKU,IAAAA;AAClC,QAAO,OAAOC,UAAU,YAAYA,MAAMC,SAAS,IAAID,QAAQE,KAAAA;;AAGnE,SAASP,sBAAsBN,KAAY;CACvC,MAAMc,cAAcd,IAAIe,QAAQC;AAChC,KAAI,OAAOF,gBAAgB,SACvB;CAGJ,IAAIG;AACJ,KAAI;AACAA,WAASnB,yBAAyBgB,YAAAA;SAC9B;AAGJ,QAAMnB,YAAYY,eAAe,kCAAA;;AAGrC,KAAIU,OAAOC,SAASrB,wBAAwBsB,MACxC;AAQJ,QAAO;EACHX,UAAUY,WAAWH,OAAOI,SAAQ;EACpCZ,cAAcW,WAAWH,OAAOK,SAAQ;EAC5C;;AAGJ,SAASF,WAAWT,OAAa;AAC7B,KAAI;AAGA,SAAOY,mBAAmBZ,MAAMa,QAAQ,OAAO,IAAA,CAAA;SAC3C;AAGJ,SAAOb"}

package/dist/adapters/http/adapters/oauth2/grant-types/utils/guess.mjs

@@ -1,7 +1,7 @@
 import { OAuth2TokenGrant } from "@authup/specs";
 import { useRequestBody } from "@routup/basic/body";
-import { useRequestQuery } from "@routup/basic/query";
 import { AuthorizationHeaderType, parseAuthorizationHeader } from "hapic";
+import { useRequestQuery } from "@routup/basic/query";
 //#region src/adapters/http/adapters/oauth2/grant-types/utils/guess.ts
 function guessOauth2GrantTypeByRequest(request) {
 	const grantType = useRequestBody(request, "grant_type") || useRequestQuery(request, "grant_type");

package/dist/adapters/http/adapters/oauth2/grant-types/utils/index.d.ts

@@ -1,2 +1,3 @@
+export * from './credentials.ts';
 export * from './guess.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/adapters/oauth2/grant-types/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/index.ts"],"names":[],"mappings":"AAOA,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC"}

package/dist/adapters/http/adapters/oauth2/grant-types/utils/index.mjs

@@ -1,2 +1,3 @@
+import { extractClientCredentialsFromRequest } from "./credentials.mjs";
 import { guessOauth2GrantTypeByRequest } from "./guess.mjs";
-export { guessOauth2GrantTypeByRequest };
+export { extractClientCredentialsFromRequest, guessOauth2GrantTypeByRequest };

package/dist/adapters/http/adapters/oauth2/index.mjs

@@ -1,5 +1,6 @@
 import { HTTPOAuth2Authorizer } from "./authorization/module.mjs";
 import "./authorization/index.mjs";
+import { extractClientCredentialsFromRequest } from "./grant-types/utils/credentials.mjs";
 import { guessOauth2GrantTypeByRequest } from "./grant-types/utils/guess.mjs";
 import { HTTPOAuth2AuthorizeGrant } from "./grant-types/authorize.mjs";
 import { HTTPClientCredentialsGrant } from "./grant-types/client-credentials.mjs";
@@ -8,4 +9,4 @@ import { HTTPPasswordGrant } from "./grant-types/password.mjs";
 import { HTTPOAuth2RefreshTokenGrant } from "./grant-types/refresh_token.mjs";
 import { HTTPRobotCredentialsGrant } from "./grant-types/robot-credentials.mjs";
 import "./grant-types/index.mjs";
-export { HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, guessOauth2GrantTypeByRequest };
+export { HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, extractClientCredentialsFromRequest, guessOauth2GrantTypeByRequest };

package/dist/adapters/http/controllers/entities/client/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/client/module.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAUtF,MAAM,MAAM,uBAAuB,GAAG;IAClC,OAAO,EAAE,cAAc,CAAC;IACxB,UAAU,EAAE,iBAAiB,CAAC;CACjC,CAAC;AAEF,qBAEa,gBAAgB;IACzB,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC;IAElC,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC;gBAE5B,GAAG,EAAE,uBAAuB;IAMlC,OAAO,CACG,GAAG,EAAE,GAAG,EACP,GAAG,EAAE,GAAG,GACtB,OAAO,CAAC,GAAG,CAAC;IAcT,GAAG,CACQ,EAAE,EAAE,MAAM,EACX,GAAG,EAAE,GAAG,EACP,GAAG,EAAE,GAAG,GACtB,OAAO,CAAC,GAAG,CAAC;IA4CT,GAAG,CACI,IAAI,EAAE,GAAG,EACN,GAAG,EAAE,GAAG,EACP,GAAG,EAAE,GAAG,GACtB,OAAO,CAAC,GAAG,CAAC;IAQT,IAAI,CACO,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,GAAG,EACN,GAAG,EAAE,GAAG,EACP,GAAG,EAAE,GAAG,GACtB,OAAO,CAAC,GAAG,CAAC;IAQT,GAAG,CACQ,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,GAAG,EACN,GAAG,EAAE,GAAG,EACP,GAAG,EAAE,GAAG,GACtB,OAAO,CAAC,GAAG,CAAC;IAmBT,IAAI,CACO,EAAE,EAAE,MAAM,EACX,GAAG,EAAE,GAAG,EACP,GAAG,EAAE,GAAG,GACtB,OAAO,CAAC,GAAG,CAAC;CAMlB"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/client/module.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAUtF,MAAM,MAAM,uBAAuB,GAAG;IAClC,OAAO,EAAE,cAAc,CAAC;IACxB,UAAU,EAAE,iBAAiB,CAAC;CACjC,CAAC;AAEF,qBAEa,gBAAgB;IACzB,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC;IAElC,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC;gBAE5B,GAAG,EAAE,uBAAuB;IAMlC,OAAO,CACG,GAAG,EAAE,GAAG,EACP,GAAG,EAAE,GAAG,GACtB,OAAO,CAAC,GAAG,CAAC;IAcT,GAAG,CACQ,EAAE,EAAE,MAAM,EACX,GAAG,EAAE,GAAG,EACP,GAAG,EAAE,GAAG,GACtB,OAAO,CAAC,GAAG,CAAC;IAiDT,GAAG,CACI,IAAI,EAAE,GAAG,EACN,GAAG,EAAE,GAAG,EACP,GAAG,EAAE,GAAG,GACtB,OAAO,CAAC,GAAG,CAAC;IAQT,IAAI,CACO,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,GAAG,EACN,GAAG,EAAE,GAAG,EACP,GAAG,EAAE,GAAG,GACtB,OAAO,CAAC,GAAG,CAAC;IAQT,GAAG,CACQ,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,GAAG,EACN,GAAG,EAAE,GAAG,EACP,GAAG,EAAE,GAAG,GACtB,OAAO,CAAC,GAAG,CAAC;IAmBT,IAAI,CACO,EAAE,EAAE,MAAM,EACX,GAAG,EAAE,GAAG,EACP,GAAG,EAAE,GAAG,GACtB,OAAO,CAAC,GAAG,CAAC;CAMlB"}

package/dist/adapters/http/controllers/entities/client/module.mjs

@@ -58,7 +58,7 @@ var ClientController = class {
 			return send(res, entity);
 		}
 		const actor = buildActorContext(req);
-		return send(res, await this.service.getOne(id, actor, useRequestParam(req, "realmId")));
+		return send(res, await this.service.getOne(id, actor, useRequestQuery(req), useRequestParam(req, "realmId")));
 	}
 	async add(data, req, res) {
 		const actor = buildActorContext(req);

package/dist/adapters/http/controllers/entities/client/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2SubKind","DBody","DController","DDelete","DGet","DPath","DPost","DPut","DRequest","DResponse","DTags","NotFoundError","send","sendAccepted","sendCreated","useRequestParam","useRequestQuery","OAuth2ScopeAttributesResolver","ForceLoggedInMiddleware","isSelfToken","buildActorContext","useRequestIdentity","useRequestScopes","ClientController","service","repository","ctx","getMany","req","res","actor","data","meta","get","id","identity","isMe","type","attributesResolver","attributes","resolveFor","CLIENT","entity","findOneByIdOrName","attribute","attr","withSecret","findOneWithSecret","secret","getOne","add","create","edit","update","put","created","save","undefined","drop","delete"],"sources":["../../../../../../src/adapters/http/controllers/entities/client/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { OAuth2SubKind } from '@authup/specs';\nimport {\n    DBody, \n    DController, \n    DDelete, \n    DGet, \n    DPath, \n    DPost, \n    DPut, \n    DRequest, \n    DResponse, \n    DTags,\n} from '@routup/decorators';\nimport { NotFoundError } from '@ebec/http';\nimport type { Client } from '@authup/core-kit';\nimport {\n    send, \n    sendAccepted, \n    sendCreated, \n    useRequestParam,\n} from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { IClientRepository, IClientService } from '../../../../../core/index.ts';\nimport { OAuth2ScopeAttributesResolver } from '../../../../../core/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { isSelfToken } from '../../../../../utils/index.ts';\nimport {\n    buildActorContext,\n    useRequestIdentity,\n    useRequestScopes,\n} from '../../../request/index.ts';\n\nexport type ClientControllerContext = {\n    service: IClientService,\n    repository: IClientRepository,\n};\n\n@DTags('oauth2')\n@DController('/clients')\nexport class ClientController {\n    protected service: IClientService;\n\n    protected repository: IClientRepository;\n\n    constructor(ctx: ClientControllerContext) {\n        this.service = ctx.service;\n        this.repository = ctx.repository;\n    }\n\n    @DGet('', [])\n    async getMany(\n        @DRequest() req: any,\n        @DResponse() res: any,\n    ): Promise<any> {\n        const actor = buildActorContext(req);\n        const {\n            data, \n            meta, \n        } = await this.service.getMany(useRequestQuery(req), actor);\n\n        return send(res, {\n            data,\n            meta, \n        });\n    }\n\n    @DGet('/:id', [])\n    async get(\n        @DPath('id') id: string,\n        @DRequest() req: any,\n        @DResponse() res: any,\n    ): Promise<any> {\n        const identity = useRequestIdentity(req);\n\n        let isMe = false;\n        if (\n            identity &&\n            identity.type === 'client'\n        ) {\n            isMe = isSelfToken(id) || identity.id === id;\n        }\n\n        if (isMe) {\n            const attributesResolver = new OAuth2ScopeAttributesResolver();\n            const attributes = attributesResolver.resolveFor(OAuth2SubKind.CLIENT, useRequestScopes(req));\n\n            const entity = await this.repository.findOneByIdOrName(\n                identity!.id,\n                useRequestParam(req, 'realmId'),\n            );\n\n            if (!entity) {\n                throw new NotFoundError();\n            }\n\n            for (const attribute of attributes) {\n                const attr = attribute as keyof Client;\n                if (attr === 'secret') {\n                    const withSecret = await this.repository.findOneWithSecret({ id: entity.id });\n                    if (withSecret) {\n                        entity.secret = withSecret.secret;\n                    }\n                }\n            }\n\n            return send(res, entity);\n        }\n\n        const actor = buildActorContext(req);\n        const entity = await this.service.getOne(id, actor, useRequestParam(req, 'realmId'));\n\n        return send(res, entity);\n    }\n\n    @DPost('', [ForceLoggedInMiddleware])\n    async add(\n        @DBody() data: any,\n        @DRequest() req: any,\n        @DResponse() res: any,\n    ): Promise<any> {\n        const actor = buildActorContext(req);\n        const entity = await this.service.create(data, actor);\n\n        return sendCreated(res, entity);\n    }\n\n    @DPost('/:id', [ForceLoggedInMiddleware])\n    async edit(\n        @DPath('id') id: string,\n        @DBody() data: any,\n        @DRequest() req: any,\n        @DResponse() res: any,\n    ): Promise<any> {\n        const actor = buildActorContext(req);\n        const entity = await this.service.update(id, data, actor);\n\n        return sendAccepted(res, entity);\n    }\n\n    @DPut('/:id', [ForceLoggedInMiddleware])\n    async put(\n        @DPath('id') id: string,\n        @DBody() data: any,\n        @DRequest() req: any,\n        @DResponse() res: any,\n    ): Promise<any> {\n        const actor = buildActorContext(req);\n        const {\n            entity, \n            created, \n        } = await this.service.save(\n            id || undefined,\n            data,\n            actor,\n        );\n\n        if (created) {\n            return sendCreated(res, entity);\n        }\n\n        return sendAccepted(res, entity);\n    }\n\n    @DDelete('/:id', [ForceLoggedInMiddleware])\n    async drop(\n        @DPath('id') id: string,\n        @DRequest() req: any,\n        @DResponse() res: any,\n    ): Promise<any> {\n        const actor = buildActorContext(req);\n        const entity = await this.service.delete(id, actor);\n\n        return sendAccepted(res, entity);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8CA,IAAauB,mBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAA8B;AACtC,OAAKF,UAAUE,IAAIF;AACnB,OAAKC,aAAaC,IAAID;;CAG1B,MACME,QACF,KACA,KACY;EACZ,MAAMG,QAAQV,kBAAkBQ,IAAAA;EAChC,MAAM,EACFG,MACAC,SACA,MAAM,KAAKR,QAAQG,QAAQX,gBAAgBY,IAAAA,EAAME,MAAAA;AAErD,SAAOlB,KAAKiB,KAAK;GACbE;GACAC;GACJ,CAAA;;CAGJ,MACMC,IACF,IACA,KACA,KACY;EACZ,MAAME,WAAWd,mBAAmBO,IAAAA;EAEpC,IAAIQ,OAAO;AACX,MACID,YACAA,SAASE,SAAS,SAElBD,QAAOjB,YAAYe,GAAAA,IAAOC,SAASD,OAAOA;AAG9C,MAAIE,MAAM;GAEN,MAAMG,aAAaD,IADYrB,+BACZqB,CAAmBE,WAAWxC,cAAcyC,QAAQnB,iBAAiBM,IAAAA,CAAAA;GAExF,MAAMc,SAAS,MAAM,KAAKjB,WAAWkB,kBACjCR,SAAUD,IACVnB,gBAAgBa,KAAK,UAAA,CAAA;AAGzB,OAAI,CAACc,OACD,OAAM,IAAI/B,eAAAA;AAGd,QAAK,MAAMiC,aAAaL,WAEpB,KAAIM,cAAS,UAAU;IACnB,MAAMC,aAAa,MAAM,KAAKrB,WAAWsB,kBAAkB,EAAEb,IAAIQ,OAAOR,IAAG,CAAA;AAC3E,QAAIY,WACAJ,QAAOM,SAASF,WAAWE;;AAKvC,UAAOpC,KAAKiB,KAAKa,OAAAA;;EAGrB,MAAMZ,QAAQV,kBAAkBQ,IAAAA;AAGhC,SAAOhB,KAAKiB,KAAKa,MAFI,KAAKlB,QAAQyB,OAAOf,IAAIJ,OAAOf,gBAAgBa,KAAK,UAAA,CAAA,CAExDc;;CAGrB,MACMQ,IACF,MACA,KACA,KACY;EACZ,MAAMpB,QAAQV,kBAAkBQ,IAAAA;AAGhC,SAAOd,YAAYe,KAAKa,MAFH,KAAKlB,QAAQ2B,OAAOpB,MAAMD,MAAAA,CAEvBY;;CAG5B,MACMU,KACF,IACA,MACA,KACA,KACY;EACZ,MAAMtB,QAAQV,kBAAkBQ,IAAAA;AAGhC,SAAOf,aAAagB,KAAKa,MAFJ,KAAKlB,QAAQ6B,OAAOnB,IAAIH,MAAMD,MAAAA,CAE1BY;;CAG7B,MACMY,IACF,IACA,MACA,KACA,KACY;EACZ,MAAMxB,QAAQV,kBAAkBQ,IAAAA;EAChC,MAAM,EACFc,QACAa,YACA,MAAM,KAAK/B,QAAQgC,KACnBtB,MAAMuB,KAAAA,GACN1B,MACAD,MAAAA;AAGJ,MAAIyB,QACA,QAAOzC,YAAYe,KAAKa,OAAAA;AAG5B,SAAO7B,aAAagB,KAAKa,OAAAA;;CAG7B,MACMgB,KACF,IACA,KACA,KACY;EACZ,MAAM5B,QAAQV,kBAAkBQ,IAAAA;AAGhC,SAAOf,aAAagB,KAAKa,MAFJ,KAAKlB,QAAQmC,OAAOzB,IAAIJ,MAAAA,CAEpBY;;;;;;;;;;;;;;;;;;;;;;;;;YA1DjBxB,wBAAAA,CAAAA;;;;;;;;;;;;;gBAYIA,wBAAAA,CAAAA;;;;;;;;;;;;;;;eAaDA,wBAAAA,CAAAA;;;;;;;;;;;;;;;kBAwBGA,wBAAAA,CAAAA"}
+{"version":3,"file":"module.mjs","names":["OAuth2SubKind","DBody","DController","DDelete","DGet","DPath","DPost","DPut","DRequest","DResponse","DTags","NotFoundError","send","sendAccepted","sendCreated","useRequestParam","useRequestQuery","OAuth2ScopeAttributesResolver","ForceLoggedInMiddleware","isSelfToken","buildActorContext","useRequestIdentity","useRequestScopes","ClientController","service","repository","ctx","getMany","req","res","actor","data","meta","get","id","identity","isMe","type","attributesResolver","attributes","resolveFor","CLIENT","entity","findOneByIdOrName","attribute","attr","withSecret","findOneWithSecret","secret","getOne","add","create","edit","update","put","created","save","undefined","drop","delete"],"sources":["../../../../../../src/adapters/http/controllers/entities/client/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { OAuth2SubKind } from '@authup/specs';\nimport {\n    DBody, \n    DController, \n    DDelete, \n    DGet, \n    DPath, \n    DPost, \n    DPut, \n    DRequest, \n    DResponse, \n    DTags,\n} from '@routup/decorators';\nimport { NotFoundError } from '@ebec/http';\nimport type { Client } from '@authup/core-kit';\nimport {\n    send, \n    sendAccepted, \n    sendCreated, \n    useRequestParam,\n} from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { IClientRepository, IClientService } from '../../../../../core/index.ts';\nimport { OAuth2ScopeAttributesResolver } from '../../../../../core/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { isSelfToken } from '../../../../../utils/index.ts';\nimport {\n    buildActorContext,\n    useRequestIdentity,\n    useRequestScopes,\n} from '../../../request/index.ts';\n\nexport type ClientControllerContext = {\n    service: IClientService,\n    repository: IClientRepository,\n};\n\n@DTags('oauth2')\n@DController('/clients')\nexport class ClientController {\n    protected service: IClientService;\n\n    protected repository: IClientRepository;\n\n    constructor(ctx: ClientControllerContext) {\n        this.service = ctx.service;\n        this.repository = ctx.repository;\n    }\n\n    @DGet('', [])\n    async getMany(\n        @DRequest() req: any,\n        @DResponse() res: any,\n    ): Promise<any> {\n        const actor = buildActorContext(req);\n        const {\n            data, \n            meta, \n        } = await this.service.getMany(useRequestQuery(req), actor);\n\n        return send(res, {\n            data,\n            meta, \n        });\n    }\n\n    @DGet('/:id', [])\n    async get(\n        @DPath('id') id: string,\n        @DRequest() req: any,\n        @DResponse() res: any,\n    ): Promise<any> {\n        const identity = useRequestIdentity(req);\n\n        let isMe = false;\n        if (\n            identity &&\n            identity.type === 'client'\n        ) {\n            isMe = isSelfToken(id) || identity.id === id;\n        }\n\n        if (isMe) {\n            const attributesResolver = new OAuth2ScopeAttributesResolver();\n            const attributes = attributesResolver.resolveFor(OAuth2SubKind.CLIENT, useRequestScopes(req));\n\n            const entity = await this.repository.findOneByIdOrName(\n                identity!.id,\n                useRequestParam(req, 'realmId'),\n            );\n\n            if (!entity) {\n                throw new NotFoundError();\n            }\n\n            for (const attribute of attributes) {\n                const attr = attribute as keyof Client;\n                if (attr === 'secret') {\n                    const withSecret = await this.repository.findOneWithSecret({ id: entity.id });\n                    if (withSecret) {\n                        entity.secret = withSecret.secret;\n                    }\n                }\n            }\n\n            return send(res, entity);\n        }\n\n        const actor = buildActorContext(req);\n        const entity = await this.service.getOne(\n            id,\n            actor,\n            useRequestQuery(req),\n            useRequestParam(req, 'realmId'),\n        );\n\n        return send(res, entity);\n    }\n\n    @DPost('', [ForceLoggedInMiddleware])\n    async add(\n        @DBody() data: any,\n        @DRequest() req: any,\n        @DResponse() res: any,\n    ): Promise<any> {\n        const actor = buildActorContext(req);\n        const entity = await this.service.create(data, actor);\n\n        return sendCreated(res, entity);\n    }\n\n    @DPost('/:id', [ForceLoggedInMiddleware])\n    async edit(\n        @DPath('id') id: string,\n        @DBody() data: any,\n        @DRequest() req: any,\n        @DResponse() res: any,\n    ): Promise<any> {\n        const actor = buildActorContext(req);\n        const entity = await this.service.update(id, data, actor);\n\n        return sendAccepted(res, entity);\n    }\n\n    @DPut('/:id', [ForceLoggedInMiddleware])\n    async put(\n        @DPath('id') id: string,\n        @DBody() data: any,\n        @DRequest() req: any,\n        @DResponse() res: any,\n    ): Promise<any> {\n        const actor = buildActorContext(req);\n        const {\n            entity, \n            created, \n        } = await this.service.save(\n            id || undefined,\n            data,\n            actor,\n        );\n\n        if (created) {\n            return sendCreated(res, entity);\n        }\n\n        return sendAccepted(res, entity);\n    }\n\n    @DDelete('/:id', [ForceLoggedInMiddleware])\n    async drop(\n        @DPath('id') id: string,\n        @DRequest() req: any,\n        @DResponse() res: any,\n    ): Promise<any> {\n        const actor = buildActorContext(req);\n        const entity = await this.service.delete(id, actor);\n\n        return sendAccepted(res, entity);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8CA,IAAauB,mBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAA8B;AACtC,OAAKF,UAAUE,IAAIF;AACnB,OAAKC,aAAaC,IAAID;;CAG1B,MACME,QACF,KACA,KACY;EACZ,MAAMG,QAAQV,kBAAkBQ,IAAAA;EAChC,MAAM,EACFG,MACAC,SACA,MAAM,KAAKR,QAAQG,QAAQX,gBAAgBY,IAAAA,EAAME,MAAAA;AAErD,SAAOlB,KAAKiB,KAAK;GACbE;GACAC;GACJ,CAAA;;CAGJ,MACMC,IACF,IACA,KACA,KACY;EACZ,MAAME,WAAWd,mBAAmBO,IAAAA;EAEpC,IAAIQ,OAAO;AACX,MACID,YACAA,SAASE,SAAS,SAElBD,QAAOjB,YAAYe,GAAAA,IAAOC,SAASD,OAAOA;AAG9C,MAAIE,MAAM;GAEN,MAAMG,aAAaD,IADYrB,+BACZqB,CAAmBE,WAAWxC,cAAcyC,QAAQnB,iBAAiBM,IAAAA,CAAAA;GAExF,MAAMc,SAAS,MAAM,KAAKjB,WAAWkB,kBACjCR,SAAUD,IACVnB,gBAAgBa,KAAK,UAAA,CAAA;AAGzB,OAAI,CAACc,OACD,OAAM,IAAI/B,eAAAA;AAGd,QAAK,MAAMiC,aAAaL,WAEpB,KAAIM,cAAS,UAAU;IACnB,MAAMC,aAAa,MAAM,KAAKrB,WAAWsB,kBAAkB,EAAEb,IAAIQ,OAAOR,IAAG,CAAA;AAC3E,QAAIY,WACAJ,QAAOM,SAASF,WAAWE;;AAKvC,UAAOpC,KAAKiB,KAAKa,OAAAA;;EAGrB,MAAMZ,QAAQV,kBAAkBQ,IAAAA;AAQhC,SAAOhB,KAAKiB,KAAKa,MAPI,KAAKlB,QAAQyB,OAC9Bf,IACAJ,OACAd,gBAAgBY,IAAAA,EAChBb,gBAAgBa,KAAK,UAAA,CAAA,CAGRc;;CAGrB,MACMQ,IACF,MACA,KACA,KACY;EACZ,MAAMpB,QAAQV,kBAAkBQ,IAAAA;AAGhC,SAAOd,YAAYe,KAAKa,MAFH,KAAKlB,QAAQ2B,OAAOpB,MAAMD,MAAAA,CAEvBY;;CAG5B,MACMU,KACF,IACA,MACA,KACA,KACY;EACZ,MAAMtB,QAAQV,kBAAkBQ,IAAAA;AAGhC,SAAOf,aAAagB,KAAKa,MAFJ,KAAKlB,QAAQ6B,OAAOnB,IAAIH,MAAMD,MAAAA,CAE1BY;;CAG7B,MACMY,IACF,IACA,MACA,KACA,KACY;EACZ,MAAMxB,QAAQV,kBAAkBQ,IAAAA;EAChC,MAAM,EACFc,QACAa,YACA,MAAM,KAAK/B,QAAQgC,KACnBtB,MAAMuB,KAAAA,GACN1B,MACAD,MAAAA;AAGJ,MAAIyB,QACA,QAAOzC,YAAYe,KAAKa,OAAAA;AAG5B,SAAO7B,aAAagB,KAAKa,OAAAA;;CAG7B,MACMgB,KACF,IACA,KACA,KACY;EACZ,MAAM5B,QAAQV,kBAAkBQ,IAAAA;AAGhC,SAAOf,aAAagB,KAAKa,MAFJ,KAAKlB,QAAQmC,OAAOzB,IAAIJ,MAAAA,CAEpBY;;;;;;;;;;;;;;;;;;;;;;;;;YA1DjBxB,wBAAAA,CAAAA;;;;;;;;;;;;;gBAYIA,wBAAAA,CAAAA;;;;;;;;;;;;;;;eAaDA,wBAAAA,CAAAA;;;;;;;;;;;;;;;kBAwBGA,wBAAAA,CAAAA"}

package/dist/adapters/http/controllers/entities/policy/utils/validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../../../../../src/adapters/http/controllers/entities/policy/utils/validation.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEpC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0CAA0C,CAAC;AAI7E,qBAAa,eAAgB,SAAQ,SAAS,CAAC,YAAY,GAAG;IAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;IACxF,SAAS,CAAC,UAAU;CAkHvB"}
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../../../../../src/adapters/http/controllers/entities/policy/utils/validation.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEpC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0CAA0C,CAAC;AAI7E,qBAAa,eAAgB,SAAQ,SAAS,CAAC,YAAY,GAAG;IAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;IACxF,SAAS,CAAC,UAAU;CAoHvB"}

package/dist/adapters/http/controllers/entities/policy/utils/validation.mjs

@@ -11,7 +11,7 @@ var PolicyValidator = class extends Container {
 	initialize() {
 		super.initialize();
 		const nameValidator = createValidator(() => {
-			return createValidationChain().exists().notEmpty().isString().isLength({
+			return createValidationChain().exists().notEmpty().isString().trim().toLowerCase().isLength({
 				min: 3,
 				max: 128
 			}).custom((value) => isPolicyNameValid(value, { throwOnFailure: true }));