@authup/server-core 1.0.0-beta.4 → 1.0.0-beta.41

package/dist/core/oauth2/authorization/code/verifier/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/authorization/code/verifier/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code/verifier/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/oauth2/authorization/code/verifier/index.mjs

@@ -0,0 +1,2 @@
+import { OAuth2AuthorizationCodeVerifier } from "./module.mjs";
+export { OAuth2AuthorizationCodeVerifier };

package/dist/core/oauth2/authorization/code/verifier/module.d.ts

@@ -0,0 +1,9 @@
+import type { OAuth2AuthorizationCode } from '@authup/core-kit';
+import type { IOAuth2AuthorizationCodeRepository } from '../repository/index.ts';
+import type { IOAuth2AuthorizationCodeVerifier, IOAuth2AuthorizationCodeVerifyOptions } from './types.ts';
+export declare class OAuth2AuthorizationCodeVerifier implements IOAuth2AuthorizationCodeVerifier {
+    protected repository: IOAuth2AuthorizationCodeRepository;
+    constructor(repository: IOAuth2AuthorizationCodeRepository);
+    verify(code: string, options: IOAuth2AuthorizationCodeVerifyOptions): Promise<OAuth2AuthorizationCode>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/oauth2/authorization/code/verifier/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code/verifier/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAIhE,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,wBAAwB,CAAC;AACjF,OAAO,KAAK,EAAE,gCAAgC,EAAE,qCAAqC,EAAE,MAAM,YAAY,CAAC;AAE1G,qBAAa,+BAAgC,YAAW,gCAAgC;IACpF,SAAS,CAAC,UAAU,EAAG,kCAAkC,CAAC;gBAE9C,UAAU,EAAE,kCAAkC;IAIpD,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qCAAqC,GAAI,OAAO,CAAC,uBAAuB,CAAC;CAiDhH"}

package/dist/core/oauth2/authorization/code/verifier/module.mjs

@@ -0,0 +1,31 @@
+import { buildOAuth2CodeChallenge } from "../../helpers.mjs";
+import { OAuth2AuthorizationCodeChallengeMethod, OAuth2Error } from "@authup/specs";
+//#region src/core/oauth2/authorization/code/verifier/module.ts
+var OAuth2AuthorizationCodeVerifier = class {
+	repository;
+	constructor(repository) {
+		this.repository = repository;
+	}
+	async verify(code, options) {
+		const entity = await this.repository.popOneById(code);
+		if (!entity) throw OAuth2Error.grantInvalid();
+		if (entity.client_id) {
+			if (!options.clientId || options.clientId !== entity.client_id) throw OAuth2Error.grantInvalid();
+		}
+		if (entity.redirect_uri) {
+			if (!options.redirectUri || entity.redirect_uri !== options.redirectUri) throw OAuth2Error.redirectUriMismatch();
+		}
+		if (options.clientIsPublic && !entity.code_challenge) throw OAuth2Error.grantInvalid("PKCE is required for public clients.");
+		if (entity.code_challenge) {
+			if (!options.codeVerifier) throw OAuth2Error.grantInvalid("Code verifier invalid.");
+			if (entity.code_challenge_method === OAuth2AuthorizationCodeChallengeMethod.SHA_256) {
+				if (await buildOAuth2CodeChallenge(options.codeVerifier) !== entity.code_challenge) throw OAuth2Error.grantInvalid("PKCE code_verifier mismatch.");
+			} else if (options.codeVerifier !== entity.code_challenge) throw OAuth2Error.grantInvalid("PKCE code_verifier mismatch.");
+		}
+		return entity;
+	}
+};
+//#endregion
+export { OAuth2AuthorizationCodeVerifier };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/authorization/code/verifier/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["OAuth2AuthorizationCodeChallengeMethod","OAuth2Error","buildOAuth2CodeChallenge","OAuth2AuthorizationCodeVerifier","repository","verify","code","options","entity","popOneById","grantInvalid","client_id","clientId","redirect_uri","redirectUri","redirectUriMismatch","clientIsPublic","code_challenge","codeVerifier","code_challenge_method","SHA_256","codeVerifierHash"],"sources":["../../../../../../src/core/oauth2/authorization/code/verifier/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2AuthorizationCode } from '@authup/core-kit';\nimport { OAuth2AuthorizationCodeChallengeMethod, OAuth2Error } from '@authup/specs';\nimport { buildOAuth2CodeChallenge } from '../../helpers.ts';\n\nimport type { IOAuth2AuthorizationCodeRepository } from '../repository/index.ts';\nimport type { IOAuth2AuthorizationCodeVerifier, IOAuth2AuthorizationCodeVerifyOptions } from './types.ts';\n\nexport class OAuth2AuthorizationCodeVerifier implements IOAuth2AuthorizationCodeVerifier {\n    protected repository : IOAuth2AuthorizationCodeRepository;\n\n    constructor(repository: IOAuth2AuthorizationCodeRepository) {\n        this.repository = repository;\n    }\n\n    async verify(code: string, options: IOAuth2AuthorizationCodeVerifyOptions) : Promise<OAuth2AuthorizationCode> {\n        const entity = await this.repository.popOneById(code);\n        if (!entity) {\n            throw OAuth2Error.grantInvalid();\n        }\n\n        // RFC 6749 §4.1.3: if the client was issued a client_id, verify the\n        // authorization code was issued to the authenticated client. Always\n        // require a clientId to be supplied so a malformed token request can't\n        // bypass the binding by omitting it.\n        if (entity.client_id) {\n            if (!options.clientId || options.clientId !== entity.client_id) {\n                throw OAuth2Error.grantInvalid();\n            }\n        }\n\n        if (entity.redirect_uri) {\n            if (!options.redirectUri || entity.redirect_uri !== options.redirectUri) {\n                throw OAuth2Error.redirectUriMismatch();\n            }\n        }\n\n        // Public clients MUST use PKCE (RFC 7636). Defense in depth in case\n        // the authorize-side check was bypassed or the client's\n        // is_confidential flag changed between authorize and token.\n        if (options.clientIsPublic && !entity.code_challenge) {\n            throw OAuth2Error.grantInvalid('PKCE is required for public clients.');\n        }\n\n        if (entity.code_challenge) {\n            if (!options.codeVerifier) {\n                throw OAuth2Error.grantInvalid('Code verifier invalid.');\n            }\n\n            // RFC 7636 §4.3: code_challenge_method defaults to \"plain\" when\n            // absent. Only treat the challenge as S256 when the client\n            // explicitly sent code_challenge_method=S256.\n            if (entity.code_challenge_method === OAuth2AuthorizationCodeChallengeMethod.SHA_256) {\n                const codeVerifierHash = await buildOAuth2CodeChallenge(options.codeVerifier);\n                if (codeVerifierHash !== entity.code_challenge) {\n                    throw OAuth2Error.grantInvalid('PKCE code_verifier mismatch.');\n                }\n            } else if (options.codeVerifier !== entity.code_challenge) {\n                throw OAuth2Error.grantInvalid('PKCE code_verifier mismatch.');\n            }\n        }\n\n        return entity;\n    }\n}\n"],"mappings":";;;AAcA,IAAaG,kCAAb,MAAaA;CACCC;CAEV,YAAYA,YAAgD;AACxD,OAAKA,aAAaA;;CAGtB,MAAMC,OAAOC,MAAcC,SAAmF;EAC1G,MAAMC,SAAS,MAAM,KAAKJ,WAAWK,WAAWH,KAAAA;AAChD,MAAI,CAACE,OACD,OAAMP,YAAYS,cAAY;AAOlC,MAAIF,OAAOG;OACH,CAACJ,QAAQK,YAAYL,QAAQK,aAAaJ,OAAOG,UACjD,OAAMV,YAAYS,cAAY;;AAItC,MAAIF,OAAOK;OACH,CAACN,QAAQO,eAAeN,OAAOK,iBAAiBN,QAAQO,YACxD,OAAMb,YAAYc,qBAAmB;;AAO7C,MAAIR,QAAQS,kBAAkB,CAACR,OAAOS,eAClC,OAAMhB,YAAYS,aAAa,uCAAA;AAGnC,MAAIF,OAAOS,gBAAgB;AACvB,OAAI,CAACV,QAAQW,aACT,OAAMjB,YAAYS,aAAa,yBAAA;AAMnC,OAAIF,OAAOW,0BAA0BnB,uCAAuCoB;QAEpEC,MAD2BnB,yBAAyBK,QAAQW,aAAY,KACnDV,OAAOS,eAC5B,OAAMhB,YAAYS,aAAa,+BAAA;cAE5BH,QAAQW,iBAAiBV,OAAOS,eACvC,OAAMhB,YAAYS,aAAa,+BAAA;;AAIvC,SAAOF"}

package/dist/core/oauth2/authorization/code/verifier/types.d.ts

@@ -0,0 +1,11 @@
+import type { OAuth2AuthorizationCode } from '@authup/core-kit';
+export type IOAuth2AuthorizationCodeVerifyOptions = {
+    redirectUri?: string;
+    codeVerifier?: string;
+    clientId?: string;
+    clientIsPublic?: boolean;
+};
+export interface IOAuth2AuthorizationCodeVerifier {
+    verify(code: string, options: IOAuth2AuthorizationCodeVerifyOptions): Promise<OAuth2AuthorizationCode>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/oauth2/authorization/code/verifier/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code/verifier/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAEhE,MAAM,MAAM,qCAAqC,GAAG;IAChD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC5B,CAAC;AAEF,MAAM,WAAW,gCAAgC;IAC7C,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qCAAqC,GAAI,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC3G"}

package/dist/core/oauth2/authorization/code/verifier/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/authorization/code-request/index.d.ts

@@ -0,0 +1,3 @@
+export * from './verifier/index.ts';
+export * from './validator.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/authorization/code-request/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/authorization/code-request/index.ts"],"names":[],"mappings":"AAOA,cAAc,qBAAqB,CAAC;AACpC,cAAc,gBAAgB,CAAC"}

package/dist/core/oauth2/authorization/code-request/index.mjs

@@ -0,0 +1,4 @@
+import { OAuth2AuthorizationCodeRequestVerifier } from "./verifier/module.mjs";
+import "./verifier/index.mjs";
+import { OAuth2AuthorizationCodeRequestValidator } from "./validator.mjs";
+export { OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier };

package/dist/core/oauth2/authorization/code-request/validator.d.ts

@@ -0,0 +1,6 @@
+import type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';
+import { Container } from 'validup';
+export declare class OAuth2AuthorizationCodeRequestValidator extends Container<OAuth2AuthorizationCodeRequest> {
+    protected initialize(): void;
+}
+//# sourceMappingURL=validator.d.ts.map

package/dist/core/oauth2/authorization/code-request/validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/authorization/code-request/validator.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAQvE,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAGpC,qBAAa,uCAAwC,SAAQ,SAAS,CAAC,8BAA8B,CAAC;IAClG,SAAS,CAAC,UAAU;CA0EvB"}

package/dist/core/oauth2/authorization/code-request/validator.mjs

@@ -0,0 +1,35 @@
+import { OAuth2AuthorizationCodeChallengeMethod, OAuth2AuthorizationResponseType, OAuth2Error } from "@authup/specs";
+import { Container } from "validup";
+import { createValidator } from "@validup/adapter-zod";
+import { z } from "zod";
+//#region src/core/oauth2/authorization/code-request/validator.ts
+var OAuth2AuthorizationCodeRequestValidator = class extends Container {
+	initialize() {
+		super.initialize();
+		this.mount("response_type", createValidator(z.string().nonempty().check((ctx) => {
+			const availableResponseTypes = Object.values(OAuth2AuthorizationResponseType);
+			const responseTypes = ctx.value.split(" ");
+			for (const responseType of responseTypes) if (!availableResponseTypes.includes(responseType)) {
+				const error = OAuth2Error.responseTypeUnsupported();
+				ctx.issues.push({
+					input: responseType,
+					code: "custom",
+					message: error.message
+				});
+			}
+			return z.NEVER;
+		})));
+		this.mount("redirect_uri", createValidator(z.string().url()));
+		this.mount("scope", createValidator(z.string().min(3).max(512)));
+		this.mount("state", { optional: true }, createValidator(z.string().min(5).max(2048).nullable()));
+		this.mount("code_challenge", { optional: true }, createValidator(z.string().min(1).max(256).nullable()));
+		this.mount("code_challenge_method", { optional: true }, createValidator(z.enum(OAuth2AuthorizationCodeChallengeMethod).nullable()));
+		this.mount("nonce", { optional: true }, createValidator(z.string().min(1).max(512).nullable()));
+		this.mount("realm_id", { optional: true }, createValidator(z.string().nonempty()));
+		this.mount("client_id", createValidator(z.string().nonempty()));
+	}
+};
+//#endregion
+export { OAuth2AuthorizationCodeRequestValidator };
+
+//# sourceMappingURL=validator.mjs.map

package/dist/core/oauth2/authorization/code-request/validator.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"validator.mjs","names":["OAuth2AuthorizationCodeChallengeMethod","OAuth2AuthorizationResponseType","OAuth2Error","createValidator","Container","z","OAuth2AuthorizationCodeRequestValidator","initialize","mount","string","nonempty","check","ctx","availableResponseTypes","Object","values","responseTypes","value","split","responseType","includes","error","responseTypeUnsupported","issues","push","input","code","message","NEVER","url","min","max","optional","nullable","enum"],"sources":["../../../../../src/core/oauth2/authorization/code-request/validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport {\n    OAuth2AuthorizationCodeChallengeMethod,\n    OAuth2AuthorizationResponseType,\n    OAuth2Error,\n} from '@authup/specs';\n\nimport { createValidator } from '@validup/adapter-zod';\nimport { Container } from 'validup';\nimport { z } from 'zod';\n\nexport class OAuth2AuthorizationCodeRequestValidator extends Container<OAuth2AuthorizationCodeRequest> {\n    protected initialize() {\n        super.initialize();\n\n        this.mount(\n            'response_type',\n            createValidator(\n                z\n                    .string()\n                    .nonempty()\n                    .check((ctx) => {\n                        const availableResponseTypes = Object.values(OAuth2AuthorizationResponseType);\n                        const responseTypes = ctx.value.split(' ') as OAuth2AuthorizationResponseType[];\n\n                        for (const responseType of responseTypes) {\n                            if (!availableResponseTypes.includes(responseType)) {\n                                const error = OAuth2Error.responseTypeUnsupported();\n                                ctx.issues.push({\n                                    input: responseType,\n                                    code: 'custom',\n                                    message: error.message,\n                                });\n                            }\n                        }\n\n                        return z.NEVER;\n                    }),\n            ),\n        );\n\n        this.mount(\n            'redirect_uri',\n            createValidator(z.string().url()),\n        );\n\n        this.mount(\n            'scope',\n            createValidator(z.string().min(3).max(512)),\n        );\n\n        this.mount(\n            'state',\n            { optional: true },\n            createValidator(z.string().min(5).max(2048).nullable()),\n        );\n\n        this.mount(\n            'code_challenge',\n            { optional: true },\n            createValidator(z.string().min(1).max(256).nullable()),\n        );\n\n        this.mount(\n            'code_challenge_method',\n            { optional: true },\n            createValidator(z.enum(OAuth2AuthorizationCodeChallengeMethod).nullable()),\n        );\n\n        this.mount(\n            'nonce',\n            { optional: true },\n            createValidator(z.string().min(1).max(512).nullable()),\n        );\n\n        this.mount(\n            'realm_id',\n            { optional: true },\n            createValidator(z.string().nonempty()),\n        );\n\n        this.mount(\n            'client_id',\n            createValidator(z.string().nonempty()),\n        );\n    }\n}\n"],"mappings":";;;;;AAkBA,IAAaM,0CAAb,cAA6DF,UAAAA;CAC/CG,aAAa;AACnB,QAAMA,YAAAA;AAEN,OAAKC,MACD,iBACAL,gBACIE,EACKI,QAAM,CACNC,UAAQ,CACRC,OAAOC,QAAAA;GACJ,MAAMC,yBAAyBC,OAAOC,OAAOd,gCAAAA;GAC7C,MAAMe,gBAAgBJ,IAAIK,MAAMC,MAAM,IAAA;AAEtC,QAAK,MAAMC,gBAAgBH,cACvB,KAAI,CAACH,uBAAuBO,SAASD,aAAAA,EAAe;IAChD,MAAME,QAAQnB,YAAYoB,yBAAuB;AACjDV,QAAIW,OAAOC,KAAK;KACZC,OAAON;KACPO,MAAM;KACNC,SAASN,MAAMM;KACnB,CAAA;;AAIR,UAAOtB,EAAEuB;IACb,CAAA,CAAA;AAIZ,OAAKpB,MACD,gBACAL,gBAAgBE,EAAEI,QAAM,CAAGoB,KAAG,CAAA,CAAA;AAGlC,OAAKrB,MACD,SACAL,gBAAgBE,EAAEI,QAAM,CAAGqB,IAAI,EAAA,CAAGC,IAAI,IAAA,CAAA,CAAA;AAG1C,OAAKvB,MACD,SACA,EAAEwB,UAAU,MAAK,EACjB7B,gBAAgBE,EAAEI,QAAM,CAAGqB,IAAI,EAAA,CAAGC,IAAI,KAAA,CAAME,UAAQ,CAAA,CAAA;AAGxD,OAAKzB,MACD,kBACA,EAAEwB,UAAU,MAAK,EACjB7B,gBAAgBE,EAAEI,QAAM,CAAGqB,IAAI,EAAA,CAAGC,IAAI,IAAA,CAAKE,UAAQ,CAAA,CAAA;AAGvD,OAAKzB,MACD,yBACA,EAAEwB,UAAU,MAAK,EACjB7B,gBAAgBE,EAAE6B,KAAKlC,uCAAAA,CAAwCiC,UAAQ,CAAA,CAAA;AAG3E,OAAKzB,MACD,SACA,EAAEwB,UAAU,MAAK,EACjB7B,gBAAgBE,EAAEI,QAAM,CAAGqB,IAAI,EAAA,CAAGC,IAAI,IAAA,CAAKE,UAAQ,CAAA,CAAA;AAGvD,OAAKzB,MACD,YACA,EAAEwB,UAAU,MAAK,EACjB7B,gBAAgBE,EAAEI,QAAM,CAAGC,UAAQ,CAAA,CAAA;AAGvC,OAAKF,MACD,aACAL,gBAAgBE,EAAEI,QAAM,CAAGC,UAAQ,CAAA,CAAA"}

package/dist/core/oauth2/authorization/code-request/verifier/index.d.ts

@@ -0,0 +1,3 @@
+export * from './types.ts';
+export * from './module.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/authorization/code-request/verifier/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code-request/verifier/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/core/oauth2/authorization/code-request/verifier/index.mjs

@@ -0,0 +1,2 @@
+import { OAuth2AuthorizationCodeRequestVerifier } from "./module.mjs";
+export { OAuth2AuthorizationCodeRequestVerifier };

package/dist/core/oauth2/authorization/code-request/verifier/module.d.ts

@@ -0,0 +1,15 @@
+import type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';
+import type { IOAuth2ClientRepository } from '../../../client/index.ts';
+import type { IOAuth2ScopeRepository } from '../../../scope/index.ts';
+import type { IOAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeRequestVerificationResult, OAuth2AuthorizationCodeRequestVerifierContext } from './types.ts';
+export declare class OAuth2AuthorizationCodeRequestVerifier implements IOAuth2AuthorizationCodeRequestVerifier {
+    protected clientRepository: IOAuth2ClientRepository;
+    protected scopeRepository: IOAuth2ScopeRepository;
+    constructor(ctx: OAuth2AuthorizationCodeRequestVerifierContext);
+    /**
+     * Verify validated authorization code request.
+     * @param data
+     */
+    verify(data: OAuth2AuthorizationCodeRequest): Promise<OAuth2AuthorizationCodeRequestVerificationResult>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/oauth2/authorization/code-request/verifier/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code-request/verifier/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAQvE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,KAAK,EACR,uCAAuC,EACvC,gDAAgD,EAChD,6CAA6C,EAChD,MAAM,YAAY,CAAC;AASpB,qBAAa,sCAAuC,YAAW,uCAAuC;IAClG,SAAS,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;IAEpD,SAAS,CAAC,eAAe,EAAE,sBAAsB,CAAC;gBAEtC,GAAG,EAAE,6CAA6C;IAK9D;;;OAGG;IACG,MAAM,CACR,IAAI,EAAE,8BAA8B,GACpC,OAAO,CAAC,gDAAgD,CAAC;CA6DhE"}

package/dist/core/oauth2/authorization/code-request/verifier/module.mjs

@@ -0,0 +1,47 @@
+import { ScopeName } from "@authup/core-kit";
+import { isSimpleMatch } from "@authup/kit";
+import { OAuth2AuthorizationResponseType, OAuth2Error, hasOAuth2Scopes } from "@authup/specs";
+//#region src/core/oauth2/authorization/code-request/verifier/module.ts
+function willIssueCode(responseType) {
+	if (!responseType) return false;
+	return responseType.split(" ").includes(OAuth2AuthorizationResponseType.CODE);
+}
+var OAuth2AuthorizationCodeRequestVerifier = class {
+	clientRepository;
+	scopeRepository;
+	constructor(ctx) {
+		this.clientRepository = ctx.clientRepository;
+		this.scopeRepository = ctx.scopeRepository;
+	}
+	/**
+	* Verify validated authorization code request.
+	* @param data
+	*/ async verify(data) {
+		if (!data.client_id) throw OAuth2Error.clientInvalid();
+		const client = await this.clientRepository.findOneByIdOrName(data.client_id, data.realm_id);
+		if (!client) throw OAuth2Error.clientInvalid();
+		if (!client.active) throw OAuth2Error.clientInactive();
+		if (!client.is_confidential && !data.code_challenge && willIssueCode(data.response_type)) throw OAuth2Error.requestInvalid("PKCE code_challenge is required for public clients.");
+		if (!client.is_confidential && !data.state && willIssueCode(data.response_type)) throw OAuth2Error.requestInvalid("state is required for public clients in the code flow.");
+		data.client_id = client.id;
+		data.realm_id = client.realm_id;
+		const scopes = await this.scopeRepository.findByClientId(client.id);
+		const scopeNames = scopes.map((scope) => scope.name);
+		if (data.scope) {
+			if (!hasOAuth2Scopes(scopeNames, data.scope) && !hasOAuth2Scopes(data.scope, ScopeName.GLOBAL)) throw OAuth2Error.scopeInsufficient();
+		} else data.scope = scopeNames.join(" ");
+		if (client.redirect_uri && data.redirect_uri) {
+			const redirectUris = client.redirect_uri.split(",");
+			if (!isSimpleMatch(data.redirect_uri, redirectUris)) throw OAuth2Error.redirectUriMismatch();
+		}
+		return {
+			data,
+			client,
+			scopes
+		};
+	}
+};
+//#endregion
+export { OAuth2AuthorizationCodeRequestVerifier };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/authorization/code-request/verifier/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["ScopeName","isSimpleMatch","OAuth2AuthorizationResponseType","OAuth2Error","hasOAuth2Scopes","willIssueCode","responseType","split","includes","CODE","OAuth2AuthorizationCodeRequestVerifier","clientRepository","scopeRepository","ctx","verify","data","client_id","clientInvalid","client","findOneByIdOrName","realm_id","active","clientInactive","is_confidential","code_challenge","response_type","requestInvalid","state","id","scopes","findByClientId","scopeNames","map","scope","name","GLOBAL","scopeInsufficient","join","redirect_uri","redirectUris","redirectUriMismatch"],"sources":["../../../../../../src/core/oauth2/authorization/code-request/verifier/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport { isSimpleMatch } from '@authup/kit';\nimport {\n    OAuth2AuthorizationResponseType,\n    OAuth2Error,\n    hasOAuth2Scopes,\n} from '@authup/specs';\nimport type { IOAuth2ClientRepository } from '../../../client/index.ts';\nimport type { IOAuth2ScopeRepository } from '../../../scope/index.ts';\nimport type {\n    IOAuth2AuthorizationCodeRequestVerifier,\n    OAuth2AuthorizationCodeRequestVerificationResult,\n    OAuth2AuthorizationCodeRequestVerifierContext,\n} from './types.ts';\n\nfunction willIssueCode(responseType: string | undefined): boolean {\n    if (!responseType) {\n        return false;\n    }\n    return responseType.split(' ').includes(OAuth2AuthorizationResponseType.CODE);\n}\n\nexport class OAuth2AuthorizationCodeRequestVerifier implements IOAuth2AuthorizationCodeRequestVerifier {\n    protected clientRepository: IOAuth2ClientRepository;\n\n    protected scopeRepository: IOAuth2ScopeRepository;\n\n    constructor(ctx: OAuth2AuthorizationCodeRequestVerifierContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.scopeRepository = ctx.scopeRepository;\n    }\n\n    /**\n     * Verify validated authorization code request.\n     * @param data\n     */\n    async verify(\n        data: OAuth2AuthorizationCodeRequest,\n    ) : Promise<OAuth2AuthorizationCodeRequestVerificationResult> {\n        if (!data.client_id) {\n            throw OAuth2Error.clientInvalid();\n        }\n\n        const client = await this.clientRepository.findOneByIdOrName(data.client_id, data.realm_id);\n        if (!client) {\n            throw OAuth2Error.clientInvalid();\n        }\n\n        if (!client.active) {\n            throw OAuth2Error.clientInactive();\n        }\n\n        // Public clients MUST use PKCE for the code flow (RFC 7636 §4.4.1,\n        // OAuth 2.1). Without PKCE a public client's code flow has no second\n        // factor — anyone who intercepts the redirect can redeem the code at\n        // /token. Only enforce when an authorization code will actually be\n        // issued; implicit/id_token-only flows don't involve a code.\n        if (!client.is_confidential && !data.code_challenge && willIssueCode(data.response_type)) {\n            throw OAuth2Error.requestInvalid('PKCE code_challenge is required for public clients.');\n        }\n\n        // Public clients SHOULD include state to bind the redirect to the\n        // initiating session and prevent CSRF (RFC 6749 §10.12). Confidential\n        // clients are exempt because the /token exchange already authenticates\n        // them via client_secret.\n        if (!client.is_confidential && !data.state && willIssueCode(data.response_type)) {\n            throw OAuth2Error.requestInvalid('state is required for public clients in the code flow.');\n        }\n\n        data.client_id = client.id;\n        data.realm_id = client.realm_id;\n\n        const scopes = await this.scopeRepository.findByClientId(client.id);\n        const scopeNames = scopes.map((scope) => scope.name);\n        if (data.scope) {\n            if (\n                !hasOAuth2Scopes(scopeNames, data.scope) &&\n                !hasOAuth2Scopes(data.scope, ScopeName.GLOBAL)\n            ) {\n                throw OAuth2Error.scopeInsufficient();\n            }\n        } else {\n            data.scope = scopeNames.join(' ');\n        }\n\n        if (client.redirect_uri && data.redirect_uri) {\n            const redirectUris = client.redirect_uri.split(',');\n\n            if (!isSimpleMatch(data.redirect_uri, redirectUris)) {\n                throw OAuth2Error.redirectUriMismatch();\n            }\n        }\n\n        return {\n            data,\n            client,\n            scopes,\n        };\n    }\n}\n"],"mappings":";;;;AAuBA,SAASK,cAAcC,cAAgC;AACnD,KAAI,CAACA,aACD,QAAO;AAEX,QAAOA,aAAaC,MAAM,IAAA,CAAKC,SAASN,gCAAgCO,KAAI;;AAGhF,IAAaC,yCAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAoD;AAC5D,OAAKF,mBAAmBE,IAAIF;AAC5B,OAAKC,kBAAkBC,IAAID;;;;;IAO/B,MAAME,OACFC,MAC0D;AAC1D,MAAI,CAACA,KAAKC,UACN,OAAMb,YAAYc,eAAa;EAGnC,MAAMC,SAAS,MAAM,KAAKP,iBAAiBQ,kBAAkBJ,KAAKC,WAAWD,KAAKK,SAAQ;AAC1F,MAAI,CAACF,OACD,OAAMf,YAAYc,eAAa;AAGnC,MAAI,CAACC,OAAOG,OACR,OAAMlB,YAAYmB,gBAAc;AAQpC,MAAI,CAACJ,OAAOK,mBAAmB,CAACR,KAAKS,kBAAkBnB,cAAcU,KAAKU,cAAa,CACnF,OAAMtB,YAAYuB,eAAe,sDAAA;AAOrC,MAAI,CAACR,OAAOK,mBAAmB,CAACR,KAAKY,SAAStB,cAAcU,KAAKU,cAAa,CAC1E,OAAMtB,YAAYuB,eAAe,yDAAA;AAGrCX,OAAKC,YAAYE,OAAOU;AACxBb,OAAKK,WAAWF,OAAOE;EAEvB,MAAMS,SAAS,MAAM,KAAKjB,gBAAgBkB,eAAeZ,OAAOU,GAAE;EAClE,MAAMG,aAAaF,OAAOG,KAAKC,UAAUA,MAAMC,KAAI;AACnD,MAAInB,KAAKkB;OAED,CAAC7B,gBAAgB2B,YAAYhB,KAAKkB,MAAK,IACvC,CAAC7B,gBAAgBW,KAAKkB,OAAOjC,UAAUmC,OAAM,CAE7C,OAAMhC,YAAYiC,mBAAiB;QAGvCrB,MAAKkB,QAAQF,WAAWM,KAAK,IAAA;AAGjC,MAAInB,OAAOoB,gBAAgBvB,KAAKuB,cAAc;GAC1C,MAAMC,eAAerB,OAAOoB,aAAa/B,MAAM,IAAA;AAE/C,OAAI,CAACN,cAAcc,KAAKuB,cAAcC,aAAAA,CAClC,OAAMpC,YAAYqC,qBAAmB;;AAI7C,SAAO;GACHzB;GACAG;GACAW;GACJ"}

package/dist/core/oauth2/authorization/code-request/verifier/types.d.ts

@@ -0,0 +1,16 @@
+import type { Client, OAuth2AuthorizationCodeRequest, Scope } from '@authup/core-kit';
+import type { IOAuth2ClientRepository } from '../../../client/index.ts';
+import type { IOAuth2ScopeRepository } from '../../../scope/index.ts';
+export type OAuth2AuthorizationCodeRequestVerifierContext = {
+    clientRepository: IOAuth2ClientRepository;
+    scopeRepository: IOAuth2ScopeRepository;
+};
+export type OAuth2AuthorizationCodeRequestVerificationResult = {
+    data: OAuth2AuthorizationCodeRequest;
+    client: Client;
+    scopes: Scope[];
+};
+export interface IOAuth2AuthorizationCodeRequestVerifier {
+    verify(data: OAuth2AuthorizationCodeRequest): Promise<OAuth2AuthorizationCodeRequestVerificationResult>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/oauth2/authorization/code-request/verifier/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code-request/verifier/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACtF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEtE,MAAM,MAAM,6CAA6C,GAAG;IACxD,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,eAAe,EAAE,sBAAsB,CAAA;CAC1C,CAAC;AAEF,MAAM,MAAM,gDAAgD,GAAG;IAC3D,IAAI,EAAE,8BAA8B,CAAC;IAErC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,KAAK,EAAE,CAAA;CAClB,CAAC;AAEF,MAAM,WAAW,uCAAuC;IACpD,MAAM,CACF,IAAI,EAAE,8BAA8B,GACpC,OAAO,CAAC,gDAAgD,CAAC,CAAC;CACjE"}

package/dist/core/oauth2/authorization/code-request/verifier/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/authorization/helpers.d.ts

@@ -0,0 +1,5 @@
+export declare function generateOAuth2CodeVerifier(): string;
+export declare function base64URLEncode(arrayBuffer: ArrayBuffer): string;
+export declare function buildOAuth2TokenHash(value: string): Promise<string>;
+export declare function buildOAuth2CodeChallenge(codeVerifier: string): Promise<string>;
+//# sourceMappingURL=helpers.d.ts.map

package/dist/core/oauth2/authorization/helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/authorization/helpers.ts"],"names":[],"mappings":"AASA,wBAAgB,0BAA0B,WAazC;AAED,wBAAgB,eAAe,CAAC,WAAW,EAAE,WAAW,UAWvD;AAED,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAI,OAAO,CAAC,MAAM,CAAC,CAO1E;AAED,wBAAsB,wBAAwB,CAAC,YAAY,EAAE,MAAM,mBAMlE"}

package/dist/core/oauth2/authorization/helpers.mjs

@@ -0,0 +1,27 @@
+import { subtle } from "uncrypto";
+//#region src/core/oauth2/authorization/helpers.ts
+function generateOAuth2CodeVerifier() {
+	const length = 64;
+	const charset = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
+	let codeVerifier = "";
+	const randomValues = new Uint8Array(length);
+	crypto.getRandomValues(randomValues);
+	for (let i = 0; i < length; i++) codeVerifier += charset[randomValues[i] % 66];
+	return codeVerifier;
+}
+function base64URLEncode(arrayBuffer) {
+	const charCode = Array.from(new Uint8Array(arrayBuffer));
+	return btoa(String.fromCharCode.apply(null, charCode)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function buildOAuth2TokenHash(value) {
+	const data = new TextEncoder().encode(value);
+	return base64URLEncode((await subtle.digest("SHA-256", data)).slice(0, 16));
+}
+async function buildOAuth2CodeChallenge(codeVerifier) {
+	const data = new TextEncoder().encode(codeVerifier);
+	return base64URLEncode(await subtle.digest("SHA-256", data));
+}
+//#endregion
+export { base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, generateOAuth2CodeVerifier };
+
+//# sourceMappingURL=helpers.mjs.map

package/dist/core/oauth2/authorization/helpers.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.mjs","names":["subtle","generateOAuth2CodeVerifier","length","charset","codeVerifier","randomValues","Uint8Array","crypto","getRandomValues","i","base64URLEncode","arrayBuffer","charCode","Array","from","btoa","String","fromCharCode","apply","replace","buildOAuth2TokenHash","value","encoder","TextEncoder","data","encode","hashBuffer","digest","halfHash","slice","buildOAuth2CodeChallenge"],"sources":["../../../../src/core/oauth2/authorization/helpers.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { subtle } from 'uncrypto';\n\nexport function generateOAuth2CodeVerifier() {\n    const length = 64;\n    const charset = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';\n\n    let codeVerifier = '';\n    const randomValues = new Uint8Array(length);\n    crypto.getRandomValues(randomValues);\n\n    for (let i = 0; i < length; i++) {\n        codeVerifier += charset[randomValues[i] % charset.length];\n    }\n\n    return codeVerifier;\n}\n\nexport function base64URLEncode(arrayBuffer: ArrayBuffer) {\n    // Convert the ArrayBuffer to string using Uint8 array.\n    // btoa takes chars from 0-255 and base64 encodes.\n    // Then convert the base64 encoded to base64url encoded.\n    // (replace + with -, replace / with _, trim trailing =)\n    const charCode = Array.from(new Uint8Array(arrayBuffer));\n\n    return btoa(String.fromCharCode.apply(null, charCode))\n        .replace(/\\+/g, '-')\n        .replace(/\\//g, '_')\n        .replace(/=+$/, '');\n}\n\nexport async function buildOAuth2TokenHash(value: string) : Promise<string> {\n    const encoder = new TextEncoder();\n    const data = encoder.encode(value);\n    const hashBuffer = await subtle.digest('SHA-256', data);\n    const halfHash = hashBuffer.slice(0, 16);\n\n    return base64URLEncode(halfHash);\n}\n\nexport async function buildOAuth2CodeChallenge(codeVerifier: string) {\n    const encoder = new TextEncoder();\n    const data = encoder.encode(codeVerifier);\n    const arrayBuffer = await subtle.digest('SHA-256', data);\n\n    return base64URLEncode(arrayBuffer);\n}\n"],"mappings":";;AASA,SAAgBC,6BAAAA;CACZ,MAAMC,SAAS;CACf,MAAMC,UAAU;CAEhB,IAAIC,eAAe;CACnB,MAAMC,eAAe,IAAIC,WAAWJ,OAAAA;AACpCK,QAAOC,gBAAgBH,aAAAA;AAEvB,MAAK,IAAII,IAAI,GAAGA,IAAIP,QAAQO,IACxBL,iBAAgBD,QAAQE,aAAaI,KAAKN;AAG9C,QAAOC;;AAGX,SAAgBM,gBAAgBC,aAAwB;CAKpD,MAAMC,WAAWC,MAAMC,KAAK,IAAIR,WAAWK,YAAAA,CAAAA;AAE3C,QAAOI,KAAKC,OAAOC,aAAaC,MAAM,MAAMN,SAAAA,CAAAA,CACvCO,QAAQ,OAAO,IAAA,CACfA,QAAQ,OAAO,IAAA,CACfA,QAAQ,OAAO,GAAA;;AAGxB,eAAsBC,qBAAqBC,OAAa;CAEpD,MAAMG,OAAOF,IADOC,aACPD,CAAQG,OAAOJ,MAAAA;AAI5B,QAAOX,iBAFUgB,MADQ1B,OAAO2B,OAAO,WAAWH,KAAAA,EACtBK,MAAM,GAAG,GAEdD,CAAAA;;AAG3B,eAAsBE,yBAAyB1B,cAAoB;CAE/D,MAAMoB,OAAOF,IADOC,aACPD,CAAQG,OAAOrB,aAAAA;AAG5B,QAAOM,gBAAgBC,MAFGX,OAAO2B,OAAO,WAAWH,KAAAA,CAE5Bb"}

package/dist/core/oauth2/authorization/index.d.ts

@@ -0,0 +1,7 @@
+export * from './code/index.ts';
+export * from './code-request/index.ts';
+export * from './state/index.ts';
+export * from './module.ts';
+export * from './helpers.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/authorization/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/authorization/index.ts"],"names":[],"mappings":"AAOA,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,kBAAkB,CAAC;AAEjC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}

package/dist/core/oauth2/authorization/index.mjs

@@ -0,0 +1,11 @@
+import { OAuth2AuthorizationCodeIssuer } from "./code/issuer/module.mjs";
+import { base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, generateOAuth2CodeVerifier } from "./helpers.mjs";
+import { OAuth2AuthorizationCodeVerifier } from "./code/verifier/module.mjs";
+import "./code/index.mjs";
+import { OAuth2AuthorizationCodeRequestVerifier } from "./code-request/verifier/module.mjs";
+import { OAuth2AuthorizationCodeRequestValidator } from "./code-request/validator.mjs";
+import "./code-request/index.mjs";
+import { OAuth2AuthorizationStateManager } from "./state/module.mjs";
+import "./state/index.mjs";
+import { OAuth2Authorization } from "./module.mjs";
+export { OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, generateOAuth2CodeVerifier };

package/dist/core/oauth2/authorization/module.d.ts

@@ -0,0 +1,20 @@
+import type { Identity, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';
+import type { IOAuth2OpenIDTokenIssuer, IOAuth2TokenIssuer } from '../token/index.ts';
+import type { IOAuth2AuthorizationCodeIssuer } from './code/index.ts';
+import type { OAuth2AuthorizationManagerContext, OAuth2AuthorizationResult } from './types.ts';
+import type { IIdentityResolver } from '../../identity/index.ts';
+export declare class OAuth2Authorization {
+    protected accessTokenIssuer: IOAuth2TokenIssuer;
+    protected openIdTokenIssuer: IOAuth2OpenIDTokenIssuer;
+    protected codeIssuer: IOAuth2AuthorizationCodeIssuer;
+    protected identityResolver: IIdentityResolver;
+    constructor(ctx: OAuth2AuthorizationManagerContext);
+    /**
+     * Authorize with validated codeRequest.
+     *
+     * @param data
+     * @param identity
+     */
+    authorize(data: OAuth2AuthorizationCodeRequest, identity: Identity): Promise<OAuth2AuthorizationResult>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/oauth2/authorization/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/authorization/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAA2B,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAQ1G,OAAO,KAAK,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACtF,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AAEtE,OAAO,KAAK,EACR,iCAAiC,EACjC,yBAAyB,EAC5B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,qBAAa,mBAAmB;IAC5B,SAAS,CAAC,iBAAiB,EAAG,kBAAkB,CAAC;IAEjD,SAAS,CAAC,iBAAiB,EAAG,wBAAwB,CAAC;IAEvD,SAAS,CAAC,UAAU,EAAG,8BAA8B,CAAC;IAEtD,SAAS,CAAC,gBAAgB,EAAG,iBAAiB,CAAC;gBAEnC,GAAG,EAAE,iCAAiC;IAOlD;;;;;OAKG;IACG,SAAS,CACX,IAAI,EAAE,8BAA8B,EACpC,QAAQ,EAAE,QAAQ,GAClB,OAAO,CAAC,yBAAyB,CAAC;CA2FzC"}

package/dist/core/oauth2/authorization/module.mjs

@@ -0,0 +1,66 @@
+import { buildOAuth2TokenHash } from "./helpers.mjs";
+import { ScopeName } from "@authup/core-kit";
+import { OAuth2AuthorizationResponseType, OAuth2Error, hasOAuth2Scopes } from "@authup/specs";
+//#region src/core/oauth2/authorization/module.ts
+var OAuth2Authorization = class {
+	accessTokenIssuer;
+	openIdTokenIssuer;
+	codeIssuer;
+	identityResolver;
+	constructor(ctx) {
+		this.accessTokenIssuer = ctx.accessTokenIssuer;
+		this.openIdTokenIssuer = ctx.openIdTokenIssuer;
+		this.codeIssuer = ctx.codeIssuer;
+		this.identityResolver = ctx.identityResolver;
+	}
+	/**
+	* Authorize with validated codeRequest.
+	*
+	* @param data
+	* @param identity
+	*/ async authorize(data, identity) {
+		const availableResponseTypes = Object.values(OAuth2AuthorizationResponseType);
+		let responseTypes = [];
+		if (data.response_type) responseTypes = Array.isArray(data.response_type) ? data.response_type : data.response_type.split(" ");
+		const enabledResponseTypes = {};
+		for (const responseType of responseTypes) if (!availableResponseTypes.includes(responseType)) throw OAuth2Error.responseTypeUnsupported();
+		else enabledResponseTypes[responseType] = true;
+		if (!data.redirect_uri) throw OAuth2Error.redirectUriMismatch();
+		const output = {
+			redirectUri: data.redirect_uri,
+			...data.state ? { state: data.state } : {}
+		};
+		if (!identity) throw OAuth2Error.identityInvalid();
+		const payloadBaseNormalized = {
+			sub: identity.data.id,
+			sub_kind: identity.type,
+			realm_id: identity.data.realm.id,
+			realm_name: identity.data.realm.name,
+			client_id: data.client_id,
+			...data.scope ? { scope: data.scope } : {},
+			...data.nonce ? { nonce: data.nonce } : {}
+		};
+		let codeEntity;
+		if (enabledResponseTypes[OAuth2AuthorizationResponseType.TOKEN]) {
+			const [token] = await this.accessTokenIssuer.issue(payloadBaseNormalized);
+			output.accessToken = token;
+		}
+		if (enabledResponseTypes[OAuth2AuthorizationResponseType.CODE]) {
+			codeEntity = await this.codeIssuer.issue(data, identity);
+			output.authorizationCode = codeEntity.id;
+		}
+		if (enabledResponseTypes[OAuth2AuthorizationResponseType.ID_TOKEN] || data.scope && hasOAuth2Scopes(data.scope, ScopeName.OPEN_ID)) {
+			const idTokenPayload = { ...payloadBaseNormalized };
+			if (output.accessToken) idTokenPayload.at_hash = await buildOAuth2TokenHash(output.accessToken);
+			if (output.authorizationCode) idTokenPayload.c_hash = await buildOAuth2TokenHash(output.authorizationCode);
+			const [token] = await this.openIdTokenIssuer.issueWithIdentity(idTokenPayload, identity);
+			if (enabledResponseTypes[OAuth2AuthorizationResponseType.ID_TOKEN]) output.idToken = token;
+			if (codeEntity) await this.codeIssuer.updateIdToken(codeEntity, token);
+		}
+		return output;
+	}
+};
+//#endregion
+export { OAuth2Authorization };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/authorization/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["ScopeName","OAuth2AuthorizationResponseType","OAuth2Error","hasOAuth2Scopes","buildOAuth2TokenHash","OAuth2Authorization","accessTokenIssuer","openIdTokenIssuer","codeIssuer","identityResolver","ctx","authorize","data","identity","availableResponseTypes","Object","values","responseTypes","response_type","Array","isArray","split","enabledResponseTypes","responseType","includes","responseTypeUnsupported","redirect_uri","redirectUriMismatch","output","redirectUri","state","identityInvalid","payloadBaseNormalized","sub","id","sub_kind","type","realm_id","realm","realm_name","name","client_id","scope","nonce","codeEntity","TOKEN","token","issue","accessToken","CODE","authorizationCode","needsIdToken","ID_TOKEN","OPEN_ID","idTokenPayload","at_hash","c_hash","issueWithIdentity","idToken","updateIdToken"],"sources":["../../../../src/core/oauth2/authorization/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Identity, OAuth2AuthorizationCode, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport {\n    OAuth2AuthorizationResponseType,\n    OAuth2Error,\n    hasOAuth2Scopes,\n} from '@authup/specs';\nimport type { IOAuth2OpenIDTokenIssuer, IOAuth2TokenIssuer } from '../token/index.ts';\nimport type { IOAuth2AuthorizationCodeIssuer } from './code/index.ts';\nimport { buildOAuth2TokenHash } from './helpers.ts';\nimport type {\n    OAuth2AuthorizationManagerContext,\n    OAuth2AuthorizationResult,\n} from './types.ts';\nimport type { IIdentityResolver } from '../../identity/index.ts';\n\nexport class OAuth2Authorization {\n    protected accessTokenIssuer : IOAuth2TokenIssuer;\n\n    protected openIdTokenIssuer : IOAuth2OpenIDTokenIssuer;\n\n    protected codeIssuer : IOAuth2AuthorizationCodeIssuer;\n\n    protected identityResolver : IIdentityResolver;\n\n    constructor(ctx: OAuth2AuthorizationManagerContext) {\n        this.accessTokenIssuer = ctx.accessTokenIssuer;\n        this.openIdTokenIssuer = ctx.openIdTokenIssuer;\n        this.codeIssuer = ctx.codeIssuer;\n        this.identityResolver = ctx.identityResolver;\n    }\n\n    /**\n     * Authorize with validated codeRequest.\n     *\n     * @param data\n     * @param identity\n     */\n    async authorize(\n        data: OAuth2AuthorizationCodeRequest,\n        identity: Identity,\n    ) : Promise<OAuth2AuthorizationResult> {\n        const availableResponseTypes : string[] = Object.values(OAuth2AuthorizationResponseType);\n\n        let responseTypes : string[] = [];\n        if (data.response_type) {\n            responseTypes = Array.isArray(data.response_type) ?\n                data.response_type :\n                data.response_type.split(' ');\n        }\n\n        const enabledResponseTypes : Record<string, boolean> = {};\n\n        for (const responseType of responseTypes) {\n            if (!availableResponseTypes.includes(responseType)) {\n                throw OAuth2Error.responseTypeUnsupported();\n            } else {\n                enabledResponseTypes[responseType] = true;\n            }\n        }\n\n        if (!data.redirect_uri) {\n            throw OAuth2Error.redirectUriMismatch();\n        }\n\n        const output : OAuth2AuthorizationResult = {\n            redirectUri: data.redirect_uri,\n            ...(data.state ? { state: data.state } : {}),\n        };\n\n        if (!identity) {\n            throw OAuth2Error.identityInvalid();\n        }\n\n        const payloadBaseNormalized : OAuth2TokenPayload = {\n\n            sub: identity.data.id,\n            sub_kind: identity.type,\n            realm_id: identity.data.realm.id,\n            realm_name: identity.data.realm.name,\n\n            client_id: data.client_id,\n            ...(data.scope ? { scope: data.scope } : {}),\n            ...(data.nonce ? { nonce: data.nonce } : {}),\n        };\n\n        let codeEntity : OAuth2AuthorizationCode | undefined;\n\n        if (enabledResponseTypes[OAuth2AuthorizationResponseType.TOKEN]) {\n            const [token] = await this.accessTokenIssuer.issue(payloadBaseNormalized);\n\n            output.accessToken = token;\n        }\n\n        if (enabledResponseTypes[OAuth2AuthorizationResponseType.CODE]) {\n            codeEntity = await this.codeIssuer.issue(\n                data,\n                identity,\n            );\n\n            output.authorizationCode = codeEntity.id;\n        }\n\n        const needsIdToken = enabledResponseTypes[OAuth2AuthorizationResponseType.ID_TOKEN] ||\n            (data.scope && hasOAuth2Scopes(data.scope, ScopeName.OPEN_ID));\n\n        if (needsIdToken) {\n            const idTokenPayload = { ...payloadBaseNormalized };\n\n            if (output.accessToken) {\n                idTokenPayload.at_hash = await buildOAuth2TokenHash(output.accessToken);\n            }\n            if (output.authorizationCode) {\n                idTokenPayload.c_hash = await buildOAuth2TokenHash(output.authorizationCode);\n            }\n\n            const [token] = await this.openIdTokenIssuer.issueWithIdentity(\n                idTokenPayload,\n                identity,\n            );\n\n            if (enabledResponseTypes[OAuth2AuthorizationResponseType.ID_TOKEN]) {\n                output.idToken = token;\n            }\n\n            if (codeEntity) {\n                await this.codeIssuer.updateIdToken(codeEntity, token);\n            }\n        }\n\n        return output;\n    }\n}\n"],"mappings":";;;;AAwBA,IAAaK,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAwC;AAChD,OAAKJ,oBAAoBI,IAAIJ;AAC7B,OAAKC,oBAAoBG,IAAIH;AAC7B,OAAKC,aAAaE,IAAIF;AACtB,OAAKC,mBAAmBC,IAAID;;;;;;;IAShC,MAAME,UACFC,MACAC,UACmC;EACnC,MAAMC,yBAAoCC,OAAOC,OAAOf,gCAAAA;EAExD,IAAIgB,gBAA2B,EAAE;AACjC,MAAIL,KAAKM,cACLD,iBAAgBE,MAAMC,QAAQR,KAAKM,cAAa,GAC5CN,KAAKM,gBACLN,KAAKM,cAAcG,MAAM,IAAA;EAGjC,MAAMC,uBAAiD,EAAC;AAExD,OAAK,MAAMC,gBAAgBN,cACvB,KAAI,CAACH,uBAAuBU,SAASD,aAAAA,CACjC,OAAMrB,YAAYuB,yBAAuB;MAEzCH,sBAAqBC,gBAAgB;AAI7C,MAAI,CAACX,KAAKc,aACN,OAAMxB,YAAYyB,qBAAmB;EAGzC,MAAMC,SAAqC;GACvCC,aAAajB,KAAKc;GAClB,GAAId,KAAKkB,QAAQ,EAAEA,OAAOlB,KAAKkB,OAAM,GAAI,EAAE;GAC/C;AAEA,MAAI,CAACjB,SACD,OAAMX,YAAY6B,iBAAe;EAGrC,MAAMC,wBAA6C;GAE/CC,KAAKpB,SAASD,KAAKsB;GACnBC,UAAUtB,SAASuB;GACnBC,UAAUxB,SAASD,KAAK0B,MAAMJ;GAC9BK,YAAY1B,SAASD,KAAK0B,MAAME;GAEhCC,WAAW7B,KAAK6B;GAChB,GAAI7B,KAAK8B,QAAQ,EAAEA,OAAO9B,KAAK8B,OAAM,GAAI,EAAE;GAC3C,GAAI9B,KAAK+B,QAAQ,EAAEA,OAAO/B,KAAK+B,OAAM,GAAI,EAAE;GAC/C;EAEA,IAAIC;AAEJ,MAAItB,qBAAqBrB,gCAAgC4C,QAAQ;GAC7D,MAAM,CAACC,SAAS,MAAM,KAAKxC,kBAAkByC,MAAMf,sBAAAA;AAEnDJ,UAAOoB,cAAcF;;AAGzB,MAAIxB,qBAAqBrB,gCAAgCgD,OAAO;AAC5DL,gBAAa,MAAM,KAAKpC,WAAWuC,MAC/BnC,MACAC,SAAAA;AAGJe,UAAOsB,oBAAoBN,WAAWV;;AAM1C,MAHqBZ,qBAAqBrB,gCAAgCmD,aACrExC,KAAK8B,SAASvC,gBAAgBS,KAAK8B,OAAO1C,UAAUqD,QAAO,EAE9C;GACd,MAAMC,iBAAiB,EAAE,GAAGtB,uBAAsB;AAElD,OAAIJ,OAAOoB,YACPM,gBAAeC,UAAU,MAAMnD,qBAAqBwB,OAAOoB,YAAW;AAE1E,OAAIpB,OAAOsB,kBACPI,gBAAeE,SAAS,MAAMpD,qBAAqBwB,OAAOsB,kBAAiB;GAG/E,MAAM,CAACJ,SAAS,MAAM,KAAKvC,kBAAkBkD,kBACzCH,gBACAzC,SAAAA;AAGJ,OAAIS,qBAAqBrB,gCAAgCmD,UACrDxB,QAAO8B,UAAUZ;AAGrB,OAAIF,WACA,OAAM,KAAKpC,WAAWmD,cAAcf,YAAYE,MAAAA;;AAIxD,SAAOlB"}

package/dist/core/oauth2/authorization/state/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/authorization/state/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/authorization/state/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/oauth2/authorization/state/index.mjs

@@ -0,0 +1,2 @@
+import { OAuth2AuthorizationStateManager } from "./module.mjs";
+export { OAuth2AuthorizationStateManager };

package/dist/core/oauth2/authorization/state/module.d.ts

@@ -0,0 +1,8 @@
+import type { IOAuth2AuthorizationStateManager, IOAuth2AuthorizeStateRepository, OAuth2AuthorizationState } from './types.ts';
+export declare class OAuth2AuthorizationStateManager implements IOAuth2AuthorizationStateManager {
+    protected repository: IOAuth2AuthorizeStateRepository;
+    constructor(repository: IOAuth2AuthorizeStateRepository);
+    save(data: OAuth2AuthorizationState): Promise<string>;
+    verify(state: string, input: Partial<OAuth2AuthorizationState>): Promise<OAuth2AuthorizationState>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/oauth2/authorization/state/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/authorization/state/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACR,gCAAgC,EAChC,+BAA+B,EAC/B,wBAAwB,EAC3B,MAAM,YAAY,CAAC;AAEpB,qBAAa,+BAAgC,YAAW,gCAAgC;IACpF,SAAS,CAAC,UAAU,EAAE,+BAA+B,CAAC;gBAE1C,UAAU,EAAE,+BAA+B;IAIjD,IAAI,CAAC,IAAI,EAAE,wBAAwB,GAAI,OAAO,CAAC,MAAM,CAAC;IAItD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,wBAAwB,CAAC,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAyB3G"}

package/dist/core/oauth2/authorization/state/module.mjs

@@ -0,0 +1,23 @@
+import { OAuth2Error } from "@authup/specs";
+//#region src/core/oauth2/authorization/state/module.ts
+var OAuth2AuthorizationStateManager = class {
+	repository;
+	constructor(repository) {
+		this.repository = repository;
+	}
+	async save(data) {
+		return this.repository.insert(data);
+	}
+	async verify(state, input) {
+		const payload = await this.repository.findOneById(state);
+		if (!payload) throw OAuth2Error.stateInvalid();
+		await this.repository.remove(state);
+		if (payload.ip && input.ip !== payload.ip) throw OAuth2Error.stateInvalid();
+		if (payload.userAgent && input.userAgent !== payload.userAgent) throw OAuth2Error.stateInvalid();
+		return payload;
+	}
+};
+//#endregion
+export { OAuth2AuthorizationStateManager };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/authorization/state/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["OAuth2Error","OAuth2AuthorizationStateManager","repository","save","data","insert","verify","state","input","payload","findOneById","stateInvalid","remove","ip","userAgent"],"sources":["../../../../../src/core/oauth2/authorization/state/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { OAuth2Error } from '@authup/specs';\nimport type {\n    IOAuth2AuthorizationStateManager,\n    IOAuth2AuthorizeStateRepository,\n    OAuth2AuthorizationState,\n} from './types.ts';\n\nexport class OAuth2AuthorizationStateManager implements IOAuth2AuthorizationStateManager {\n    protected repository: IOAuth2AuthorizeStateRepository;\n\n    constructor(repository: IOAuth2AuthorizeStateRepository) {\n        this.repository = repository;\n    }\n\n    async save(data: OAuth2AuthorizationState) : Promise<string> {\n        return this.repository.insert(data);\n    }\n\n    async verify(state: string, input: Partial<OAuth2AuthorizationState>): Promise<OAuth2AuthorizationState> {\n        const payload = await this.repository.findOneById(state);\n        if (!payload) {\n            throw OAuth2Error.stateInvalid();\n        }\n\n        // avoid replay attacks\n        await this.repository.remove(state);\n\n        if (\n            payload.ip &&\n            input.ip !== payload.ip\n        ) {\n            throw OAuth2Error.stateInvalid();\n        }\n\n        if (\n            payload.userAgent &&\n            input.userAgent !== payload.userAgent\n        ) {\n            throw OAuth2Error.stateInvalid();\n        }\n\n        return payload;\n    }\n}\n"],"mappings":";;AAcA,IAAaC,kCAAb,MAAaA;CACCC;CAEV,YAAYA,YAA6C;AACrD,OAAKA,aAAaA;;CAGtB,MAAMC,KAAKC,MAAkD;AACzD,SAAO,KAAKF,WAAWG,OAAOD,KAAAA;;CAGlC,MAAME,OAAOC,OAAeC,OAA6E;EACrG,MAAMC,UAAU,MAAM,KAAKP,WAAWQ,YAAYH,MAAAA;AAClD,MAAI,CAACE,QACD,OAAMT,YAAYW,cAAY;AAIlC,QAAM,KAAKT,WAAWU,OAAOL,MAAAA;AAE7B,MACIE,QAAQI,MACRL,MAAMK,OAAOJ,QAAQI,GAErB,OAAMb,YAAYW,cAAY;AAGlC,MACIF,QAAQK,aACRN,MAAMM,cAAcL,QAAQK,UAE5B,OAAMd,YAAYW,cAAY;AAGlC,SAAOF"}

package/dist/core/oauth2/authorization/state/types.d.ts

@@ -0,0 +1,16 @@
+import type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';
+export type OAuth2AuthorizationState = {
+    codeRequest?: OAuth2AuthorizationCodeRequest;
+    ip: string;
+    userAgent?: string | null;
+};
+export interface IOAuth2AuthorizeStateRepository {
+    findOneById(id: string): Promise<OAuth2AuthorizationState | null>;
+    insert(data: OAuth2AuthorizationState): Promise<string>;
+    remove(id: string): Promise<void>;
+}
+export interface IOAuth2AuthorizationStateManager {
+    save(data: OAuth2AuthorizationState): Promise<string>;
+    verify(state: string, input: Partial<OAuth2AuthorizationState>): Promise<OAuth2AuthorizationState>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/oauth2/authorization/state/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/authorization/state/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAEvE,MAAM,MAAM,wBAAwB,GAAG;IACnC,WAAW,CAAC,EAAE,8BAA8B,CAAC;IAC7C,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC5B,CAAC;AAEF,MAAM,WAAW,+BAA+B;IAC5C,WAAW,CAAC,EAAE,EAAE,MAAM,GAAI,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAAC;IAEnE,MAAM,CAAC,IAAI,EAAE,wBAAwB,GAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAEzD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,gCAAgC;IAC7C,IAAI,CAAC,IAAI,EAAE,wBAAwB,GAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAEvD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,wBAAwB,CAAC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;CACtG"}

package/dist/core/oauth2/authorization/state/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/authorization/types.d.ts

@@ -0,0 +1,17 @@
+import type { IOAuth2OpenIDTokenIssuer, IOAuth2TokenIssuer } from '../token/index.ts';
+import type { IOAuth2AuthorizationCodeIssuer } from './code/index.ts';
+import type { IIdentityResolver } from '../../identity/index.ts';
+export type OAuth2AuthorizationManagerContext = {
+    accessTokenIssuer: IOAuth2TokenIssuer;
+    openIdTokenIssuer: IOAuth2OpenIDTokenIssuer;
+    codeIssuer: IOAuth2AuthorizationCodeIssuer;
+    identityResolver: IIdentityResolver;
+};
+export type OAuth2AuthorizationResult = {
+    authorizationCode?: string;
+    accessToken?: string;
+    idToken?: string;
+    redirectUri: string;
+    state?: string;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/core/oauth2/authorization/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/authorization/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACtF,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,MAAM,MAAM,iCAAiC,GAAG;IAC5C,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,iBAAiB,EAAE,wBAAwB,CAAC;IAC5C,UAAU,EAAE,8BAA8B,CAAC;IAC3C,gBAAgB,EAAE,iBAAiB,CAAA;CACtC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACpC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;CACjB,CAAC"}

package/dist/core/oauth2/authorization/types.mjs

@@ -0,0 +1 @@
+export {};