@authup/server-core 1.0.0-beta.40 → 1.0.0-beta.42

package/dist/core/oauth2/authorization/code-request/verifier/module.mjs

@@ -1,6 +1,6 @@
 import { ScopeName } from "@authup/core-kit";
 import { isSimpleMatch } from "@authup/kit";
-import { OAuth2AuthorizationResponseType, OAuth2Error, hasOAuth2Scopes } from "@authup/specs";
+import { OAuth2AuthorizationResponseType, OAuth2ClientError, OAuth2GrantError, OAuth2RequestError, OAuth2ScopeError, hasOAuth2Scopes } from "@authup/specs";
 //#region src/core/oauth2/authorization/code-request/verifier/module.ts
 function willIssueCode(responseType) {
 	if (!responseType) return false;
@@ -17,22 +17,22 @@ var OAuth2AuthorizationCodeRequestVerifier = class {
 	* Verify validated authorization code request.
 	* @param data
 	*/ async verify(data) {
-		if (!data.client_id) throw OAuth2Error.clientInvalid();
+		if (!data.client_id) throw OAuth2ClientError.invalid();
 		const client = await this.clientRepository.findOneByIdOrName(data.client_id, data.realm_id);
-		if (!client) throw OAuth2Error.clientInvalid();
-		if (!client.active) throw OAuth2Error.clientInactive();
-		if (!client.is_confidential && !data.code_challenge && willIssueCode(data.response_type)) throw OAuth2Error.requestInvalid("PKCE code_challenge is required for public clients.");
-		if (!client.is_confidential && !data.state && willIssueCode(data.response_type)) throw OAuth2Error.requestInvalid("state is required for public clients in the code flow.");
+		if (!client) throw OAuth2ClientError.invalid();
+		if (!client.active) throw OAuth2ClientError.inactive();
+		if (!client.is_confidential && !data.code_challenge && willIssueCode(data.response_type)) throw OAuth2RequestError.malformed("PKCE code_challenge is required for public clients.");
+		if (!client.is_confidential && !data.state && willIssueCode(data.response_type)) throw OAuth2RequestError.malformed("state is required for public clients in the code flow.");
 		data.client_id = client.id;
 		data.realm_id = client.realm_id;
 		const scopes = await this.scopeRepository.findByClientId(client.id);
 		const scopeNames = scopes.map((scope) => scope.name);
 		if (data.scope) {
-			if (!hasOAuth2Scopes(scopeNames, data.scope) && !hasOAuth2Scopes(data.scope, ScopeName.GLOBAL)) throw OAuth2Error.scopeInsufficient();
+			if (!hasOAuth2Scopes(scopeNames, data.scope) && !hasOAuth2Scopes(data.scope, ScopeName.GLOBAL)) throw OAuth2ScopeError.insufficient();
 		} else data.scope = scopeNames.join(" ");
 		if (client.redirect_uri && data.redirect_uri) {
 			const redirectUris = client.redirect_uri.split(",");
-			if (!isSimpleMatch(data.redirect_uri, redirectUris)) throw OAuth2Error.redirectUriMismatch();
+			if (!isSimpleMatch(data.redirect_uri, redirectUris)) throw OAuth2GrantError.redirectUriMismatch();
 		}
 		return {
 			data,

package/dist/core/oauth2/authorization/code-request/verifier/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["ScopeName","isSimpleMatch","OAuth2AuthorizationResponseType","OAuth2Error","hasOAuth2Scopes","willIssueCode","responseType","split","includes","CODE","OAuth2AuthorizationCodeRequestVerifier","clientRepository","scopeRepository","ctx","verify","data","client_id","clientInvalid","client","findOneByIdOrName","realm_id","active","clientInactive","is_confidential","code_challenge","response_type","requestInvalid","state","id","scopes","findByClientId","scopeNames","map","scope","name","GLOBAL","scopeInsufficient","join","redirect_uri","redirectUris","redirectUriMismatch"],"sources":["../../../../../../src/core/oauth2/authorization/code-request/verifier/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport { isSimpleMatch } from '@authup/kit';\nimport {\n    OAuth2AuthorizationResponseType,\n    OAuth2Error,\n    hasOAuth2Scopes,\n} from '@authup/specs';\nimport type { IOAuth2ClientRepository } from '../../../client/index.ts';\nimport type { IOAuth2ScopeRepository } from '../../../scope/index.ts';\nimport type {\n    IOAuth2AuthorizationCodeRequestVerifier,\n    OAuth2AuthorizationCodeRequestVerificationResult,\n    OAuth2AuthorizationCodeRequestVerifierContext,\n} from './types.ts';\n\nfunction willIssueCode(responseType: string | undefined): boolean {\n    if (!responseType) {\n        return false;\n    }\n    return responseType.split(' ').includes(OAuth2AuthorizationResponseType.CODE);\n}\n\nexport class OAuth2AuthorizationCodeRequestVerifier implements IOAuth2AuthorizationCodeRequestVerifier {\n    protected clientRepository: IOAuth2ClientRepository;\n\n    protected scopeRepository: IOAuth2ScopeRepository;\n\n    constructor(ctx: OAuth2AuthorizationCodeRequestVerifierContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.scopeRepository = ctx.scopeRepository;\n    }\n\n    /**\n     * Verify validated authorization code request.\n     * @param data\n     */\n    async verify(\n        data: OAuth2AuthorizationCodeRequest,\n    ) : Promise<OAuth2AuthorizationCodeRequestVerificationResult> {\n        if (!data.client_id) {\n            throw OAuth2Error.clientInvalid();\n        }\n\n        const client = await this.clientRepository.findOneByIdOrName(data.client_id, data.realm_id);\n        if (!client) {\n            throw OAuth2Error.clientInvalid();\n        }\n\n        if (!client.active) {\n            throw OAuth2Error.clientInactive();\n        }\n\n        // Public clients MUST use PKCE for the code flow (RFC 7636 §4.4.1,\n        // OAuth 2.1). Without PKCE a public client's code flow has no second\n        // factor — anyone who intercepts the redirect can redeem the code at\n        // /token. Only enforce when an authorization code will actually be\n        // issued; implicit/id_token-only flows don't involve a code.\n        if (!client.is_confidential && !data.code_challenge && willIssueCode(data.response_type)) {\n            throw OAuth2Error.requestInvalid('PKCE code_challenge is required for public clients.');\n        }\n\n        // Public clients SHOULD include state to bind the redirect to the\n        // initiating session and prevent CSRF (RFC 6749 §10.12). Confidential\n        // clients are exempt because the /token exchange already authenticates\n        // them via client_secret.\n        if (!client.is_confidential && !data.state && willIssueCode(data.response_type)) {\n            throw OAuth2Error.requestInvalid('state is required for public clients in the code flow.');\n        }\n\n        data.client_id = client.id;\n        data.realm_id = client.realm_id;\n\n        const scopes = await this.scopeRepository.findByClientId(client.id);\n        const scopeNames = scopes.map((scope) => scope.name);\n        if (data.scope) {\n            if (\n                !hasOAuth2Scopes(scopeNames, data.scope) &&\n                !hasOAuth2Scopes(data.scope, ScopeName.GLOBAL)\n            ) {\n                throw OAuth2Error.scopeInsufficient();\n            }\n        } else {\n            data.scope = scopeNames.join(' ');\n        }\n\n        if (client.redirect_uri && data.redirect_uri) {\n            const redirectUris = client.redirect_uri.split(',');\n\n            if (!isSimpleMatch(data.redirect_uri, redirectUris)) {\n                throw OAuth2Error.redirectUriMismatch();\n            }\n        }\n\n        return {\n            data,\n            client,\n            scopes,\n        };\n    }\n}\n"],"mappings":";;;;AAuBA,SAASK,cAAcC,cAAgC;AACnD,KAAI,CAACA,aACD,QAAO;AAEX,QAAOA,aAAaC,MAAM,IAAA,CAAKC,SAASN,gCAAgCO,KAAI;;AAGhF,IAAaC,yCAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAoD;AAC5D,OAAKF,mBAAmBE,IAAIF;AAC5B,OAAKC,kBAAkBC,IAAID;;;;;IAO/B,MAAME,OACFC,MAC0D;AAC1D,MAAI,CAACA,KAAKC,UACN,OAAMb,YAAYc,eAAa;EAGnC,MAAMC,SAAS,MAAM,KAAKP,iBAAiBQ,kBAAkBJ,KAAKC,WAAWD,KAAKK,SAAQ;AAC1F,MAAI,CAACF,OACD,OAAMf,YAAYc,eAAa;AAGnC,MAAI,CAACC,OAAOG,OACR,OAAMlB,YAAYmB,gBAAc;AAQpC,MAAI,CAACJ,OAAOK,mBAAmB,CAACR,KAAKS,kBAAkBnB,cAAcU,KAAKU,cAAa,CACnF,OAAMtB,YAAYuB,eAAe,sDAAA;AAOrC,MAAI,CAACR,OAAOK,mBAAmB,CAACR,KAAKY,SAAStB,cAAcU,KAAKU,cAAa,CAC1E,OAAMtB,YAAYuB,eAAe,yDAAA;AAGrCX,OAAKC,YAAYE,OAAOU;AACxBb,OAAKK,WAAWF,OAAOE;EAEvB,MAAMS,SAAS,MAAM,KAAKjB,gBAAgBkB,eAAeZ,OAAOU,GAAE;EAClE,MAAMG,aAAaF,OAAOG,KAAKC,UAAUA,MAAMC,KAAI;AACnD,MAAInB,KAAKkB;OAED,CAAC7B,gBAAgB2B,YAAYhB,KAAKkB,MAAK,IACvC,CAAC7B,gBAAgBW,KAAKkB,OAAOjC,UAAUmC,OAAM,CAE7C,OAAMhC,YAAYiC,mBAAiB;QAGvCrB,MAAKkB,QAAQF,WAAWM,KAAK,IAAA;AAGjC,MAAInB,OAAOoB,gBAAgBvB,KAAKuB,cAAc;GAC1C,MAAMC,eAAerB,OAAOoB,aAAa/B,MAAM,IAAA;AAE/C,OAAI,CAACN,cAAcc,KAAKuB,cAAcC,aAAAA,CAClC,OAAMpC,YAAYqC,qBAAmB;;AAI7C,SAAO;GACHzB;GACAG;GACAW;GACJ"}
+{"version":3,"file":"module.mjs","names":["ScopeName","isSimpleMatch","OAuth2AuthorizationResponseType","OAuth2ClientError","OAuth2GrantError","OAuth2RequestError","OAuth2ScopeError","hasOAuth2Scopes","willIssueCode","responseType","split","includes","CODE","OAuth2AuthorizationCodeRequestVerifier","clientRepository","scopeRepository","ctx","verify","data","client_id","invalid","client","findOneByIdOrName","realm_id","active","inactive","is_confidential","code_challenge","response_type","malformed","state","id","scopes","findByClientId","scopeNames","map","scope","name","GLOBAL","insufficient","join","redirect_uri","redirectUris","redirectUriMismatch"],"sources":["../../../../../../src/core/oauth2/authorization/code-request/verifier/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport { isSimpleMatch } from '@authup/kit';\nimport {\n    OAuth2AuthorizationResponseType,\n    OAuth2ClientError,\n    OAuth2GrantError,\n    OAuth2RequestError,\n    OAuth2ScopeError,\n    hasOAuth2Scopes,\n} from '@authup/specs';\nimport type { IOAuth2ClientRepository } from '../../../client/index.ts';\nimport type { IOAuth2ScopeRepository } from '../../../scope/index.ts';\nimport type {\n    IOAuth2AuthorizationCodeRequestVerifier,\n    OAuth2AuthorizationCodeRequestVerificationResult,\n    OAuth2AuthorizationCodeRequestVerifierContext,\n} from './types.ts';\n\nfunction willIssueCode(responseType: string | undefined): boolean {\n    if (!responseType) {\n        return false;\n    }\n    return responseType.split(' ').includes(OAuth2AuthorizationResponseType.CODE);\n}\n\nexport class OAuth2AuthorizationCodeRequestVerifier implements IOAuth2AuthorizationCodeRequestVerifier {\n    protected clientRepository: IOAuth2ClientRepository;\n\n    protected scopeRepository: IOAuth2ScopeRepository;\n\n    constructor(ctx: OAuth2AuthorizationCodeRequestVerifierContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.scopeRepository = ctx.scopeRepository;\n    }\n\n    /**\n     * Verify validated authorization code request.\n     * @param data\n     */\n    async verify(\n        data: OAuth2AuthorizationCodeRequest,\n    ) : Promise<OAuth2AuthorizationCodeRequestVerificationResult> {\n        if (!data.client_id) {\n            throw OAuth2ClientError.invalid();\n        }\n\n        const client = await this.clientRepository.findOneByIdOrName(data.client_id, data.realm_id);\n        if (!client) {\n            throw OAuth2ClientError.invalid();\n        }\n\n        if (!client.active) {\n            throw OAuth2ClientError.inactive();\n        }\n\n        // Public clients MUST use PKCE for the code flow (RFC 7636 §4.4.1,\n        // OAuth 2.1). Without PKCE a public client's code flow has no second\n        // factor — anyone who intercepts the redirect can redeem the code at\n        // /token. Only enforce when an authorization code will actually be\n        // issued; implicit/id_token-only flows don't involve a code.\n        if (!client.is_confidential && !data.code_challenge && willIssueCode(data.response_type)) {\n            throw OAuth2RequestError.malformed('PKCE code_challenge is required for public clients.');\n        }\n\n        // Public clients SHOULD include state to bind the redirect to the\n        // initiating session and prevent CSRF (RFC 6749 §10.12). Confidential\n        // clients are exempt because the /token exchange already authenticates\n        // them via client_secret.\n        if (!client.is_confidential && !data.state && willIssueCode(data.response_type)) {\n            throw OAuth2RequestError.malformed('state is required for public clients in the code flow.');\n        }\n\n        data.client_id = client.id;\n        data.realm_id = client.realm_id;\n\n        const scopes = await this.scopeRepository.findByClientId(client.id);\n        const scopeNames = scopes.map((scope) => scope.name);\n        if (data.scope) {\n            if (\n                !hasOAuth2Scopes(scopeNames, data.scope) &&\n                !hasOAuth2Scopes(data.scope, ScopeName.GLOBAL)\n            ) {\n                throw OAuth2ScopeError.insufficient();\n            }\n        } else {\n            data.scope = scopeNames.join(' ');\n        }\n\n        if (client.redirect_uri && data.redirect_uri) {\n            const redirectUris = client.redirect_uri.split(',');\n\n            if (!isSimpleMatch(data.redirect_uri, redirectUris)) {\n                throw OAuth2GrantError.redirectUriMismatch();\n            }\n        }\n\n        return {\n            data,\n            client,\n            scopes,\n        };\n    }\n}\n"],"mappings":";;;;AA0BA,SAASQ,cAAcC,cAAgC;CACnD,IAAI,CAACA,cACD,OAAO;CAEX,OAAOA,aAAaC,MAAM,GAAA,EAAKC,SAAST,gCAAgCU,IAAI;AAChF;AAEA,IAAaC,yCAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAoD;EAC5D,KAAKF,mBAAmBE,IAAIF;EAC5B,KAAKC,kBAAkBC,IAAID;CAC/B;;;;IAMA,MAAME,OACFC,MAC0D;EAC1D,IAAI,CAACA,KAAKC,WACN,MAAMhB,kBAAkBiB,QAAO;EAGnC,MAAMC,SAAS,MAAM,KAAKP,iBAAiBQ,kBAAkBJ,KAAKC,WAAWD,KAAKK,QAAQ;EAC1F,IAAI,CAACF,QACD,MAAMlB,kBAAkBiB,QAAO;EAGnC,IAAI,CAACC,OAAOG,QACR,MAAMrB,kBAAkBsB,SAAQ;EAQpC,IAAI,CAACJ,OAAOK,mBAAmB,CAACR,KAAKS,kBAAkBnB,cAAcU,KAAKU,aAAa,GACnF,MAAMvB,mBAAmBwB,UAAU,qDAAA;EAOvC,IAAI,CAACR,OAAOK,mBAAmB,CAACR,KAAKY,SAAStB,cAAcU,KAAKU,aAAa,GAC1E,MAAMvB,mBAAmBwB,UAAU,wDAAA;EAGvCX,KAAKC,YAAYE,OAAOU;EACxBb,KAAKK,WAAWF,OAAOE;EAEvB,MAAMS,SAAS,MAAM,KAAKjB,gBAAgBkB,eAAeZ,OAAOU,EAAE;EAClE,MAAMG,aAAaF,OAAOG,KAAKC,UAAUA,MAAMC,IAAI;EACnD,IAAInB,KAAKkB;OAED,CAAC7B,gBAAgB2B,YAAYhB,KAAKkB,KAAK,KACvC,CAAC7B,gBAAgBW,KAAKkB,OAAOpC,UAAUsC,MAAM,GAE7C,MAAMhC,iBAAiBiC,aAAY;EAAA,OAGvCrB,KAAKkB,QAAQF,WAAWM,KAAK,GAAA;EAGjC,IAAInB,OAAOoB,gBAAgBvB,KAAKuB,cAAc;GAC1C,MAAMC,eAAerB,OAAOoB,aAAa/B,MAAM,GAAA;GAE/C,IAAI,CAACT,cAAciB,KAAKuB,cAAcC,YAAAA,GAClC,MAAMtC,iBAAiBuC,oBAAmB;EAElD;EAEA,OAAO;GACHzB;GACAG;GACAW;EACJ;CACJ;AACJ"}

package/dist/core/oauth2/authorization/helpers.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.mjs","names":["subtle","generateOAuth2CodeVerifier","length","charset","codeVerifier","randomValues","Uint8Array","crypto","getRandomValues","i","base64URLEncode","arrayBuffer","charCode","Array","from","btoa","String","fromCharCode","apply","replace","buildOAuth2TokenHash","value","encoder","TextEncoder","data","encode","hashBuffer","digest","halfHash","slice","buildOAuth2CodeChallenge"],"sources":["../../../../src/core/oauth2/authorization/helpers.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { subtle } from 'uncrypto';\n\nexport function generateOAuth2CodeVerifier() {\n    const length = 64;\n    const charset = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';\n\n    let codeVerifier = '';\n    const randomValues = new Uint8Array(length);\n    crypto.getRandomValues(randomValues);\n\n    for (let i = 0; i < length; i++) {\n        codeVerifier += charset[randomValues[i] % charset.length];\n    }\n\n    return codeVerifier;\n}\n\nexport function base64URLEncode(arrayBuffer: ArrayBuffer) {\n    // Convert the ArrayBuffer to string using Uint8 array.\n    // btoa takes chars from 0-255 and base64 encodes.\n    // Then convert the base64 encoded to base64url encoded.\n    // (replace + with -, replace / with _, trim trailing =)\n    const charCode = Array.from(new Uint8Array(arrayBuffer));\n\n    return btoa(String.fromCharCode.apply(null, charCode))\n        .replace(/\\+/g, '-')\n        .replace(/\\//g, '_')\n        .replace(/=+$/, '');\n}\n\nexport async function buildOAuth2TokenHash(value: string) : Promise<string> {\n    const encoder = new TextEncoder();\n    const data = encoder.encode(value);\n    const hashBuffer = await subtle.digest('SHA-256', data);\n    const halfHash = hashBuffer.slice(0, 16);\n\n    return base64URLEncode(halfHash);\n}\n\nexport async function buildOAuth2CodeChallenge(codeVerifier: string) {\n    const encoder = new TextEncoder();\n    const data = encoder.encode(codeVerifier);\n    const arrayBuffer = await subtle.digest('SHA-256', data);\n\n    return base64URLEncode(arrayBuffer);\n}\n"],"mappings":";;AASA,SAAgBC,6BAAAA;CACZ,MAAMC,SAAS;CACf,MAAMC,UAAU;CAEhB,IAAIC,eAAe;CACnB,MAAMC,eAAe,IAAIC,WAAWJ,OAAAA;AACpCK,QAAOC,gBAAgBH,aAAAA;AAEvB,MAAK,IAAII,IAAI,GAAGA,IAAIP,QAAQO,IACxBL,iBAAgBD,QAAQE,aAAaI,KAAKN;AAG9C,QAAOC;;AAGX,SAAgBM,gBAAgBC,aAAwB;CAKpD,MAAMC,WAAWC,MAAMC,KAAK,IAAIR,WAAWK,YAAAA,CAAAA;AAE3C,QAAOI,KAAKC,OAAOC,aAAaC,MAAM,MAAMN,SAAAA,CAAAA,CACvCO,QAAQ,OAAO,IAAA,CACfA,QAAQ,OAAO,IAAA,CACfA,QAAQ,OAAO,GAAA;;AAGxB,eAAsBC,qBAAqBC,OAAa;CAEpD,MAAMG,OAAOF,IADOC,aACPD,CAAQG,OAAOJ,MAAAA;AAI5B,QAAOX,iBAFUgB,MADQ1B,OAAO2B,OAAO,WAAWH,KAAAA,EACtBK,MAAM,GAAG,GAEdD,CAAAA;;AAG3B,eAAsBE,yBAAyB1B,cAAoB;CAE/D,MAAMoB,OAAOF,IADOC,aACPD,CAAQG,OAAOrB,aAAAA;AAG5B,QAAOM,gBAAgBC,MAFGX,OAAO2B,OAAO,WAAWH,KAAAA,CAE5Bb"}
+{"version":3,"file":"helpers.mjs","names":["subtle","generateOAuth2CodeVerifier","length","charset","codeVerifier","randomValues","Uint8Array","crypto","getRandomValues","i","base64URLEncode","arrayBuffer","charCode","Array","from","btoa","String","fromCharCode","apply","replace","buildOAuth2TokenHash","value","encoder","TextEncoder","data","encode","hashBuffer","digest","halfHash","slice","buildOAuth2CodeChallenge"],"sources":["../../../../src/core/oauth2/authorization/helpers.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { subtle } from 'uncrypto';\n\nexport function generateOAuth2CodeVerifier() {\n    const length = 64;\n    const charset = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';\n\n    let codeVerifier = '';\n    const randomValues = new Uint8Array(length);\n    crypto.getRandomValues(randomValues);\n\n    for (let i = 0; i < length; i++) {\n        codeVerifier += charset[randomValues[i] % charset.length];\n    }\n\n    return codeVerifier;\n}\n\nexport function base64URLEncode(arrayBuffer: ArrayBuffer) {\n    // Convert the ArrayBuffer to string using Uint8 array.\n    // btoa takes chars from 0-255 and base64 encodes.\n    // Then convert the base64 encoded to base64url encoded.\n    // (replace + with -, replace / with _, trim trailing =)\n    const charCode = Array.from(new Uint8Array(arrayBuffer));\n\n    return btoa(String.fromCharCode.apply(null, charCode))\n        .replace(/\\+/g, '-')\n        .replace(/\\//g, '_')\n        .replace(/=+$/, '');\n}\n\nexport async function buildOAuth2TokenHash(value: string) : Promise<string> {\n    const encoder = new TextEncoder();\n    const data = encoder.encode(value);\n    const hashBuffer = await subtle.digest('SHA-256', data);\n    const halfHash = hashBuffer.slice(0, 16);\n\n    return base64URLEncode(halfHash);\n}\n\nexport async function buildOAuth2CodeChallenge(codeVerifier: string) {\n    const encoder = new TextEncoder();\n    const data = encoder.encode(codeVerifier);\n    const arrayBuffer = await subtle.digest('SHA-256', data);\n\n    return base64URLEncode(arrayBuffer);\n}\n"],"mappings":";;AASA,SAAgBC,6BAAAA;CACZ,MAAMC,SAAS;CACf,MAAMC,UAAU;CAEhB,IAAIC,eAAe;CACnB,MAAMC,eAAe,IAAIC,WAAWJ,MAAAA;CACpCK,OAAOC,gBAAgBH,YAAAA;CAEvB,KAAK,IAAII,IAAI,GAAGA,IAAIP,QAAQO,KACxBL,gBAAgBD,QAAQE,aAAaI,KAAKN;CAG9C,OAAOC;AACX;AAEA,SAAgBM,gBAAgBC,aAAwB;CAKpD,MAAMC,WAAWC,MAAMC,KAAK,IAAIR,WAAWK,WAAAA,CAAAA;CAE3C,OAAOI,KAAKC,OAAOC,aAAaC,MAAM,MAAMN,QAAAA,CAAAA,EACvCO,QAAQ,OAAO,GAAA,EACfA,QAAQ,OAAO,GAAA,EACfA,QAAQ,OAAO,EAAA;AACxB;AAEA,eAAsBC,qBAAqBC,OAAa;CAEpD,MAAMG,OAAOF,IADOC,YACPD,EAAQG,OAAOJ,KAAAA;CAI5B,OAAOX,iBAFUgB,MADQ1B,OAAO2B,OAAO,WAAWH,IAAAA,GACtBK,MAAM,GAAG,EAEdD,CAAAA;AAC3B;AAEA,eAAsBE,yBAAyB1B,cAAoB;CAE/D,MAAMoB,OAAOF,IADOC,YACPD,EAAQG,OAAOrB,YAAAA;CAG5B,OAAOM,gBAAgBC,MAFGX,OAAO2B,OAAO,WAAWH,IAAAA,CAE5Bb;AAC3B"}

package/dist/core/oauth2/authorization/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/authorization/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAA2B,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAQ1G,OAAO,KAAK,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACtF,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AAEtE,OAAO,KAAK,EACR,iCAAiC,EACjC,yBAAyB,EAC5B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,qBAAa,mBAAmB;IAC5B,SAAS,CAAC,iBAAiB,EAAG,kBAAkB,CAAC;IAEjD,SAAS,CAAC,iBAAiB,EAAG,wBAAwB,CAAC;IAEvD,SAAS,CAAC,UAAU,EAAG,8BAA8B,CAAC;IAEtD,SAAS,CAAC,gBAAgB,EAAG,iBAAiB,CAAC;gBAEnC,GAAG,EAAE,iCAAiC;IAOlD;;;;;OAKG;IACG,SAAS,CACX,IAAI,EAAE,8BAA8B,EACpC,QAAQ,EAAE,QAAQ,GAClB,OAAO,CAAC,yBAAyB,CAAC;CA2FzC"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/authorization/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAA2B,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAU1G,OAAO,KAAK,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACtF,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AAEtE,OAAO,KAAK,EACR,iCAAiC,EACjC,yBAAyB,EAC5B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,qBAAa,mBAAmB;IAC5B,SAAS,CAAC,iBAAiB,EAAG,kBAAkB,CAAC;IAEjD,SAAS,CAAC,iBAAiB,EAAG,wBAAwB,CAAC;IAEvD,SAAS,CAAC,UAAU,EAAG,8BAA8B,CAAC;IAEtD,SAAS,CAAC,gBAAgB,EAAG,iBAAiB,CAAC;gBAEnC,GAAG,EAAE,iCAAiC;IAOlD;;;;;OAKG;IACG,SAAS,CACX,IAAI,EAAE,8BAA8B,EACpC,QAAQ,EAAE,QAAQ,GAClB,OAAO,CAAC,yBAAyB,CAAC;CA2FzC"}

package/dist/core/oauth2/authorization/module.mjs

@@ -1,6 +1,6 @@
 import { buildOAuth2TokenHash } from "./helpers.mjs";
 import { ScopeName } from "@authup/core-kit";
-import { OAuth2AuthorizationResponseType, OAuth2Error, hasOAuth2Scopes } from "@authup/specs";
+import { OAuth2AuthorizationResponseType, OAuth2GrantError, OAuth2RequestError, OAuth2ResponseTypeError, hasOAuth2Scopes } from "@authup/specs";
 //#region src/core/oauth2/authorization/module.ts
 var OAuth2Authorization = class {
 	accessTokenIssuer;
@@ -23,14 +23,14 @@ var OAuth2Authorization = class {
 		let responseTypes = [];
 		if (data.response_type) responseTypes = Array.isArray(data.response_type) ? data.response_type : data.response_type.split(" ");
 		const enabledResponseTypes = {};
-		for (const responseType of responseTypes) if (!availableResponseTypes.includes(responseType)) throw OAuth2Error.responseTypeUnsupported();
+		for (const responseType of responseTypes) if (!availableResponseTypes.includes(responseType)) throw OAuth2ResponseTypeError.unsupported();
 		else enabledResponseTypes[responseType] = true;
-		if (!data.redirect_uri) throw OAuth2Error.redirectUriMismatch();
+		if (!data.redirect_uri) throw OAuth2GrantError.redirectUriMismatch();
 		const output = {
 			redirectUri: data.redirect_uri,
 			...data.state ? { state: data.state } : {}
 		};
-		if (!identity) throw OAuth2Error.identityInvalid();
+		if (!identity) throw OAuth2RequestError.identityInvalid();
 		const payloadBaseNormalized = {
 			sub: identity.data.id,
 			sub_kind: identity.type,

package/dist/core/oauth2/authorization/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["ScopeName","OAuth2AuthorizationResponseType","OAuth2Error","hasOAuth2Scopes","buildOAuth2TokenHash","OAuth2Authorization","accessTokenIssuer","openIdTokenIssuer","codeIssuer","identityResolver","ctx","authorize","data","identity","availableResponseTypes","Object","values","responseTypes","response_type","Array","isArray","split","enabledResponseTypes","responseType","includes","responseTypeUnsupported","redirect_uri","redirectUriMismatch","output","redirectUri","state","identityInvalid","payloadBaseNormalized","sub","id","sub_kind","type","realm_id","realm","realm_name","name","client_id","scope","nonce","codeEntity","TOKEN","token","issue","accessToken","CODE","authorizationCode","needsIdToken","ID_TOKEN","OPEN_ID","idTokenPayload","at_hash","c_hash","issueWithIdentity","idToken","updateIdToken"],"sources":["../../../../src/core/oauth2/authorization/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Identity, OAuth2AuthorizationCode, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport {\n    OAuth2AuthorizationResponseType,\n    OAuth2Error,\n    hasOAuth2Scopes,\n} from '@authup/specs';\nimport type { IOAuth2OpenIDTokenIssuer, IOAuth2TokenIssuer } from '../token/index.ts';\nimport type { IOAuth2AuthorizationCodeIssuer } from './code/index.ts';\nimport { buildOAuth2TokenHash } from './helpers.ts';\nimport type {\n    OAuth2AuthorizationManagerContext,\n    OAuth2AuthorizationResult,\n} from './types.ts';\nimport type { IIdentityResolver } from '../../identity/index.ts';\n\nexport class OAuth2Authorization {\n    protected accessTokenIssuer : IOAuth2TokenIssuer;\n\n    protected openIdTokenIssuer : IOAuth2OpenIDTokenIssuer;\n\n    protected codeIssuer : IOAuth2AuthorizationCodeIssuer;\n\n    protected identityResolver : IIdentityResolver;\n\n    constructor(ctx: OAuth2AuthorizationManagerContext) {\n        this.accessTokenIssuer = ctx.accessTokenIssuer;\n        this.openIdTokenIssuer = ctx.openIdTokenIssuer;\n        this.codeIssuer = ctx.codeIssuer;\n        this.identityResolver = ctx.identityResolver;\n    }\n\n    /**\n     * Authorize with validated codeRequest.\n     *\n     * @param data\n     * @param identity\n     */\n    async authorize(\n        data: OAuth2AuthorizationCodeRequest,\n        identity: Identity,\n    ) : Promise<OAuth2AuthorizationResult> {\n        const availableResponseTypes : string[] = Object.values(OAuth2AuthorizationResponseType);\n\n        let responseTypes : string[] = [];\n        if (data.response_type) {\n            responseTypes = Array.isArray(data.response_type) ?\n                data.response_type :\n                data.response_type.split(' ');\n        }\n\n        const enabledResponseTypes : Record<string, boolean> = {};\n\n        for (const responseType of responseTypes) {\n            if (!availableResponseTypes.includes(responseType)) {\n                throw OAuth2Error.responseTypeUnsupported();\n            } else {\n                enabledResponseTypes[responseType] = true;\n            }\n        }\n\n        if (!data.redirect_uri) {\n            throw OAuth2Error.redirectUriMismatch();\n        }\n\n        const output : OAuth2AuthorizationResult = {\n            redirectUri: data.redirect_uri,\n            ...(data.state ? { state: data.state } : {}),\n        };\n\n        if (!identity) {\n            throw OAuth2Error.identityInvalid();\n        }\n\n        const payloadBaseNormalized : OAuth2TokenPayload = {\n\n            sub: identity.data.id,\n            sub_kind: identity.type,\n            realm_id: identity.data.realm.id,\n            realm_name: identity.data.realm.name,\n\n            client_id: data.client_id,\n            ...(data.scope ? { scope: data.scope } : {}),\n            ...(data.nonce ? { nonce: data.nonce } : {}),\n        };\n\n        let codeEntity : OAuth2AuthorizationCode | undefined;\n\n        if (enabledResponseTypes[OAuth2AuthorizationResponseType.TOKEN]) {\n            const [token] = await this.accessTokenIssuer.issue(payloadBaseNormalized);\n\n            output.accessToken = token;\n        }\n\n        if (enabledResponseTypes[OAuth2AuthorizationResponseType.CODE]) {\n            codeEntity = await this.codeIssuer.issue(\n                data,\n                identity,\n            );\n\n            output.authorizationCode = codeEntity.id;\n        }\n\n        const needsIdToken = enabledResponseTypes[OAuth2AuthorizationResponseType.ID_TOKEN] ||\n            (data.scope && hasOAuth2Scopes(data.scope, ScopeName.OPEN_ID));\n\n        if (needsIdToken) {\n            const idTokenPayload = { ...payloadBaseNormalized };\n\n            if (output.accessToken) {\n                idTokenPayload.at_hash = await buildOAuth2TokenHash(output.accessToken);\n            }\n            if (output.authorizationCode) {\n                idTokenPayload.c_hash = await buildOAuth2TokenHash(output.authorizationCode);\n            }\n\n            const [token] = await this.openIdTokenIssuer.issueWithIdentity(\n                idTokenPayload,\n                identity,\n            );\n\n            if (enabledResponseTypes[OAuth2AuthorizationResponseType.ID_TOKEN]) {\n                output.idToken = token;\n            }\n\n            if (codeEntity) {\n                await this.codeIssuer.updateIdToken(codeEntity, token);\n            }\n        }\n\n        return output;\n    }\n}\n"],"mappings":";;;;AAwBA,IAAaK,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAwC;AAChD,OAAKJ,oBAAoBI,IAAIJ;AAC7B,OAAKC,oBAAoBG,IAAIH;AAC7B,OAAKC,aAAaE,IAAIF;AACtB,OAAKC,mBAAmBC,IAAID;;;;;;;IAShC,MAAME,UACFC,MACAC,UACmC;EACnC,MAAMC,yBAAoCC,OAAOC,OAAOf,gCAAAA;EAExD,IAAIgB,gBAA2B,EAAE;AACjC,MAAIL,KAAKM,cACLD,iBAAgBE,MAAMC,QAAQR,KAAKM,cAAa,GAC5CN,KAAKM,gBACLN,KAAKM,cAAcG,MAAM,IAAA;EAGjC,MAAMC,uBAAiD,EAAC;AAExD,OAAK,MAAMC,gBAAgBN,cACvB,KAAI,CAACH,uBAAuBU,SAASD,aAAAA,CACjC,OAAMrB,YAAYuB,yBAAuB;MAEzCH,sBAAqBC,gBAAgB;AAI7C,MAAI,CAACX,KAAKc,aACN,OAAMxB,YAAYyB,qBAAmB;EAGzC,MAAMC,SAAqC;GACvCC,aAAajB,KAAKc;GAClB,GAAId,KAAKkB,QAAQ,EAAEA,OAAOlB,KAAKkB,OAAM,GAAI,EAAE;GAC/C;AAEA,MAAI,CAACjB,SACD,OAAMX,YAAY6B,iBAAe;EAGrC,MAAMC,wBAA6C;GAE/CC,KAAKpB,SAASD,KAAKsB;GACnBC,UAAUtB,SAASuB;GACnBC,UAAUxB,SAASD,KAAK0B,MAAMJ;GAC9BK,YAAY1B,SAASD,KAAK0B,MAAME;GAEhCC,WAAW7B,KAAK6B;GAChB,GAAI7B,KAAK8B,QAAQ,EAAEA,OAAO9B,KAAK8B,OAAM,GAAI,EAAE;GAC3C,GAAI9B,KAAK+B,QAAQ,EAAEA,OAAO/B,KAAK+B,OAAM,GAAI,EAAE;GAC/C;EAEA,IAAIC;AAEJ,MAAItB,qBAAqBrB,gCAAgC4C,QAAQ;GAC7D,MAAM,CAACC,SAAS,MAAM,KAAKxC,kBAAkByC,MAAMf,sBAAAA;AAEnDJ,UAAOoB,cAAcF;;AAGzB,MAAIxB,qBAAqBrB,gCAAgCgD,OAAO;AAC5DL,gBAAa,MAAM,KAAKpC,WAAWuC,MAC/BnC,MACAC,SAAAA;AAGJe,UAAOsB,oBAAoBN,WAAWV;;AAM1C,MAHqBZ,qBAAqBrB,gCAAgCmD,aACrExC,KAAK8B,SAASvC,gBAAgBS,KAAK8B,OAAO1C,UAAUqD,QAAO,EAE9C;GACd,MAAMC,iBAAiB,EAAE,GAAGtB,uBAAsB;AAElD,OAAIJ,OAAOoB,YACPM,gBAAeC,UAAU,MAAMnD,qBAAqBwB,OAAOoB,YAAW;AAE1E,OAAIpB,OAAOsB,kBACPI,gBAAeE,SAAS,MAAMpD,qBAAqBwB,OAAOsB,kBAAiB;GAG/E,MAAM,CAACJ,SAAS,MAAM,KAAKvC,kBAAkBkD,kBACzCH,gBACAzC,SAAAA;AAGJ,OAAIS,qBAAqBrB,gCAAgCmD,UACrDxB,QAAO8B,UAAUZ;AAGrB,OAAIF,WACA,OAAM,KAAKpC,WAAWmD,cAAcf,YAAYE,MAAAA;;AAIxD,SAAOlB"}
+{"version":3,"file":"module.mjs","names":["ScopeName","OAuth2AuthorizationResponseType","OAuth2GrantError","OAuth2RequestError","OAuth2ResponseTypeError","hasOAuth2Scopes","buildOAuth2TokenHash","OAuth2Authorization","accessTokenIssuer","openIdTokenIssuer","codeIssuer","identityResolver","ctx","authorize","data","identity","availableResponseTypes","Object","values","responseTypes","response_type","Array","isArray","split","enabledResponseTypes","responseType","includes","unsupported","redirect_uri","redirectUriMismatch","output","redirectUri","state","identityInvalid","payloadBaseNormalized","sub","id","sub_kind","type","realm_id","realm","realm_name","name","client_id","scope","nonce","codeEntity","TOKEN","token","issue","accessToken","CODE","authorizationCode","needsIdToken","ID_TOKEN","OPEN_ID","idTokenPayload","at_hash","c_hash","issueWithIdentity","idToken","updateIdToken"],"sources":["../../../../src/core/oauth2/authorization/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Identity, OAuth2AuthorizationCode, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport {\n    OAuth2AuthorizationResponseType,\n    OAuth2GrantError,\n    OAuth2RequestError,\n    OAuth2ResponseTypeError,\n    hasOAuth2Scopes,\n} from '@authup/specs';\nimport type { IOAuth2OpenIDTokenIssuer, IOAuth2TokenIssuer } from '../token/index.ts';\nimport type { IOAuth2AuthorizationCodeIssuer } from './code/index.ts';\nimport { buildOAuth2TokenHash } from './helpers.ts';\nimport type {\n    OAuth2AuthorizationManagerContext,\n    OAuth2AuthorizationResult,\n} from './types.ts';\nimport type { IIdentityResolver } from '../../identity/index.ts';\n\nexport class OAuth2Authorization {\n    protected accessTokenIssuer : IOAuth2TokenIssuer;\n\n    protected openIdTokenIssuer : IOAuth2OpenIDTokenIssuer;\n\n    protected codeIssuer : IOAuth2AuthorizationCodeIssuer;\n\n    protected identityResolver : IIdentityResolver;\n\n    constructor(ctx: OAuth2AuthorizationManagerContext) {\n        this.accessTokenIssuer = ctx.accessTokenIssuer;\n        this.openIdTokenIssuer = ctx.openIdTokenIssuer;\n        this.codeIssuer = ctx.codeIssuer;\n        this.identityResolver = ctx.identityResolver;\n    }\n\n    /**\n     * Authorize with validated codeRequest.\n     *\n     * @param data\n     * @param identity\n     */\n    async authorize(\n        data: OAuth2AuthorizationCodeRequest,\n        identity: Identity,\n    ) : Promise<OAuth2AuthorizationResult> {\n        const availableResponseTypes : string[] = Object.values(OAuth2AuthorizationResponseType);\n\n        let responseTypes : string[] = [];\n        if (data.response_type) {\n            responseTypes = Array.isArray(data.response_type) ?\n                data.response_type :\n                data.response_type.split(' ');\n        }\n\n        const enabledResponseTypes : Record<string, boolean> = {};\n\n        for (const responseType of responseTypes) {\n            if (!availableResponseTypes.includes(responseType)) {\n                throw OAuth2ResponseTypeError.unsupported();\n            } else {\n                enabledResponseTypes[responseType] = true;\n            }\n        }\n\n        if (!data.redirect_uri) {\n            throw OAuth2GrantError.redirectUriMismatch();\n        }\n\n        const output : OAuth2AuthorizationResult = {\n            redirectUri: data.redirect_uri,\n            ...(data.state ? { state: data.state } : {}),\n        };\n\n        if (!identity) {\n            throw OAuth2RequestError.identityInvalid();\n        }\n\n        const payloadBaseNormalized : OAuth2TokenPayload = {\n\n            sub: identity.data.id,\n            sub_kind: identity.type,\n            realm_id: identity.data.realm.id,\n            realm_name: identity.data.realm.name,\n\n            client_id: data.client_id,\n            ...(data.scope ? { scope: data.scope } : {}),\n            ...(data.nonce ? { nonce: data.nonce } : {}),\n        };\n\n        let codeEntity : OAuth2AuthorizationCode | undefined;\n\n        if (enabledResponseTypes[OAuth2AuthorizationResponseType.TOKEN]) {\n            const [token] = await this.accessTokenIssuer.issue(payloadBaseNormalized);\n\n            output.accessToken = token;\n        }\n\n        if (enabledResponseTypes[OAuth2AuthorizationResponseType.CODE]) {\n            codeEntity = await this.codeIssuer.issue(\n                data,\n                identity,\n            );\n\n            output.authorizationCode = codeEntity.id;\n        }\n\n        const needsIdToken = enabledResponseTypes[OAuth2AuthorizationResponseType.ID_TOKEN] ||\n            (data.scope && hasOAuth2Scopes(data.scope, ScopeName.OPEN_ID));\n\n        if (needsIdToken) {\n            const idTokenPayload = { ...payloadBaseNormalized };\n\n            if (output.accessToken) {\n                idTokenPayload.at_hash = await buildOAuth2TokenHash(output.accessToken);\n            }\n            if (output.authorizationCode) {\n                idTokenPayload.c_hash = await buildOAuth2TokenHash(output.authorizationCode);\n            }\n\n            const [token] = await this.openIdTokenIssuer.issueWithIdentity(\n                idTokenPayload,\n                identity,\n            );\n\n            if (enabledResponseTypes[OAuth2AuthorizationResponseType.ID_TOKEN]) {\n                output.idToken = token;\n            }\n\n            if (codeEntity) {\n                await this.codeIssuer.updateIdToken(codeEntity, token);\n            }\n        }\n\n        return output;\n    }\n}\n"],"mappings":";;;;AA0BA,IAAaO,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAwC;EAChD,KAAKJ,oBAAoBI,IAAIJ;EAC7B,KAAKC,oBAAoBG,IAAIH;EAC7B,KAAKC,aAAaE,IAAIF;EACtB,KAAKC,mBAAmBC,IAAID;CAChC;;;;;;IAQA,MAAME,UACFC,MACAC,UACmC;EACnC,MAAMC,yBAAoCC,OAAOC,OAAOjB,+BAAAA;EAExD,IAAIkB,gBAA2B,CAAA;EAC/B,IAAIL,KAAKM,eACLD,gBAAgBE,MAAMC,QAAQR,KAAKM,aAAa,IAC5CN,KAAKM,gBACLN,KAAKM,cAAcG,MAAM,GAAA;EAGjC,MAAMC,uBAAiD,CAAC;EAExD,KAAK,MAAMC,gBAAgBN,eACvB,IAAI,CAACH,uBAAuBU,SAASD,YAAAA,GACjC,MAAMrB,wBAAwBuB,YAAW;OAEzCH,qBAAqBC,gBAAgB;EAI7C,IAAI,CAACX,KAAKc,cACN,MAAM1B,iBAAiB2B,oBAAmB;EAG9C,MAAMC,SAAqC;GACvCC,aAAajB,KAAKc;GAClB,GAAId,KAAKkB,QAAQ,EAAEA,OAAOlB,KAAKkB,MAAM,IAAI,CAAC;EAC9C;EAEA,IAAI,CAACjB,UACD,MAAMZ,mBAAmB8B,gBAAe;EAG5C,MAAMC,wBAA6C;GAE/CC,KAAKpB,SAASD,KAAKsB;GACnBC,UAAUtB,SAASuB;GACnBC,UAAUxB,SAASD,KAAK0B,MAAMJ;GAC9BK,YAAY1B,SAASD,KAAK0B,MAAME;GAEhCC,WAAW7B,KAAK6B;GAChB,GAAI7B,KAAK8B,QAAQ,EAAEA,OAAO9B,KAAK8B,MAAM,IAAI,CAAC;GAC1C,GAAI9B,KAAK+B,QAAQ,EAAEA,OAAO/B,KAAK+B,MAAM,IAAI,CAAC;EAC9C;EAEA,IAAIC;EAEJ,IAAItB,qBAAqBvB,gCAAgC8C,QAAQ;GAC7D,MAAM,CAACC,SAAS,MAAM,KAAKxC,kBAAkByC,MAAMf,qBAAAA;GAEnDJ,OAAOoB,cAAcF;EACzB;EAEA,IAAIxB,qBAAqBvB,gCAAgCkD,OAAO;GAC5DL,aAAa,MAAM,KAAKpC,WAAWuC,MAC/BnC,MACAC,QAAAA;GAGJe,OAAOsB,oBAAoBN,WAAWV;EAC1C;EAKA,IAHqBZ,qBAAqBvB,gCAAgCqD,aACrExC,KAAK8B,SAASvC,gBAAgBS,KAAK8B,OAAO5C,UAAUuD,OAAO,GAE9C;GACd,MAAMC,iBAAiB,EAAE,GAAGtB,sBAAsB;GAElD,IAAIJ,OAAOoB,aACPM,eAAeC,UAAU,MAAMnD,qBAAqBwB,OAAOoB,WAAW;GAE1E,IAAIpB,OAAOsB,mBACPI,eAAeE,SAAS,MAAMpD,qBAAqBwB,OAAOsB,iBAAiB;GAG/E,MAAM,CAACJ,SAAS,MAAM,KAAKvC,kBAAkBkD,kBACzCH,gBACAzC,QAAAA;GAGJ,IAAIS,qBAAqBvB,gCAAgCqD,WACrDxB,OAAO8B,UAAUZ;GAGrB,IAAIF,YACA,MAAM,KAAKpC,WAAWmD,cAAcf,YAAYE,KAAAA;EAExD;EAEA,OAAOlB;CACX;AACJ"}

package/dist/core/oauth2/authorization/state/module.mjs

@@ -1,4 +1,4 @@
-import { OAuth2Error } from "@authup/specs";
+import { OAuth2RequestError } from "@authup/specs";
 //#region src/core/oauth2/authorization/state/module.ts
 var OAuth2AuthorizationStateManager = class {
 	repository;
@@ -10,10 +10,10 @@ var OAuth2AuthorizationStateManager = class {
 	}
 	async verify(state, input) {
 		const payload = await this.repository.findOneById(state);
-		if (!payload) throw OAuth2Error.stateInvalid();
+		if (!payload) throw OAuth2RequestError.stateInvalid();
 		await this.repository.remove(state);
-		if (payload.ip && input.ip !== payload.ip) throw OAuth2Error.stateInvalid();
-		if (payload.userAgent && input.userAgent !== payload.userAgent) throw OAuth2Error.stateInvalid();
+		if (payload.ip && input.ip !== payload.ip) throw OAuth2RequestError.stateInvalid();
+		if (payload.userAgent && input.userAgent !== payload.userAgent) throw OAuth2RequestError.stateInvalid();
 		return payload;
 	}
 };

package/dist/core/oauth2/authorization/state/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2Error","OAuth2AuthorizationStateManager","repository","save","data","insert","verify","state","input","payload","findOneById","stateInvalid","remove","ip","userAgent"],"sources":["../../../../../src/core/oauth2/authorization/state/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { OAuth2Error } from '@authup/specs';\nimport type {\n    IOAuth2AuthorizationStateManager,\n    IOAuth2AuthorizeStateRepository,\n    OAuth2AuthorizationState,\n} from './types.ts';\n\nexport class OAuth2AuthorizationStateManager implements IOAuth2AuthorizationStateManager {\n    protected repository: IOAuth2AuthorizeStateRepository;\n\n    constructor(repository: IOAuth2AuthorizeStateRepository) {\n        this.repository = repository;\n    }\n\n    async save(data: OAuth2AuthorizationState) : Promise<string> {\n        return this.repository.insert(data);\n    }\n\n    async verify(state: string, input: Partial<OAuth2AuthorizationState>): Promise<OAuth2AuthorizationState> {\n        const payload = await this.repository.findOneById(state);\n        if (!payload) {\n            throw OAuth2Error.stateInvalid();\n        }\n\n        // avoid replay attacks\n        await this.repository.remove(state);\n\n        if (\n            payload.ip &&\n            input.ip !== payload.ip\n        ) {\n            throw OAuth2Error.stateInvalid();\n        }\n\n        if (\n            payload.userAgent &&\n            input.userAgent !== payload.userAgent\n        ) {\n            throw OAuth2Error.stateInvalid();\n        }\n\n        return payload;\n    }\n}\n"],"mappings":";;AAcA,IAAaC,kCAAb,MAAaA;CACCC;CAEV,YAAYA,YAA6C;AACrD,OAAKA,aAAaA;;CAGtB,MAAMC,KAAKC,MAAkD;AACzD,SAAO,KAAKF,WAAWG,OAAOD,KAAAA;;CAGlC,MAAME,OAAOC,OAAeC,OAA6E;EACrG,MAAMC,UAAU,MAAM,KAAKP,WAAWQ,YAAYH,MAAAA;AAClD,MAAI,CAACE,QACD,OAAMT,YAAYW,cAAY;AAIlC,QAAM,KAAKT,WAAWU,OAAOL,MAAAA;AAE7B,MACIE,QAAQI,MACRL,MAAMK,OAAOJ,QAAQI,GAErB,OAAMb,YAAYW,cAAY;AAGlC,MACIF,QAAQK,aACRN,MAAMM,cAAcL,QAAQK,UAE5B,OAAMd,YAAYW,cAAY;AAGlC,SAAOF"}
+{"version":3,"file":"module.mjs","names":["OAuth2RequestError","OAuth2AuthorizationStateManager","repository","save","data","insert","verify","state","input","payload","findOneById","stateInvalid","remove","ip","userAgent"],"sources":["../../../../../src/core/oauth2/authorization/state/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { OAuth2RequestError } from '@authup/specs';\nimport type {\n    IOAuth2AuthorizationStateManager,\n    IOAuth2AuthorizeStateRepository,\n    OAuth2AuthorizationState,\n} from './types.ts';\n\nexport class OAuth2AuthorizationStateManager implements IOAuth2AuthorizationStateManager {\n    protected repository: IOAuth2AuthorizeStateRepository;\n\n    constructor(repository: IOAuth2AuthorizeStateRepository) {\n        this.repository = repository;\n    }\n\n    async save(data: OAuth2AuthorizationState) : Promise<string> {\n        return this.repository.insert(data);\n    }\n\n    async verify(state: string, input: Partial<OAuth2AuthorizationState>): Promise<OAuth2AuthorizationState> {\n        const payload = await this.repository.findOneById(state);\n        if (!payload) {\n            throw OAuth2RequestError.stateInvalid();\n        }\n\n        // avoid replay attacks\n        await this.repository.remove(state);\n\n        if (\n            payload.ip &&\n            input.ip !== payload.ip\n        ) {\n            throw OAuth2RequestError.stateInvalid();\n        }\n\n        if (\n            payload.userAgent &&\n            input.userAgent !== payload.userAgent\n        ) {\n            throw OAuth2RequestError.stateInvalid();\n        }\n\n        return payload;\n    }\n}\n"],"mappings":";;AAcA,IAAaC,kCAAb,MAAaA;CACCC;CAEV,YAAYA,YAA6C;EACrD,KAAKA,aAAaA;CACtB;CAEA,MAAMC,KAAKC,MAAkD;EACzD,OAAO,KAAKF,WAAWG,OAAOD,IAAAA;CAClC;CAEA,MAAME,OAAOC,OAAeC,OAA6E;EACrG,MAAMC,UAAU,MAAM,KAAKP,WAAWQ,YAAYH,KAAAA;EAClD,IAAI,CAACE,SACD,MAAMT,mBAAmBW,aAAY;EAIzC,MAAM,KAAKT,WAAWU,OAAOL,KAAAA;EAE7B,IACIE,QAAQI,MACRL,MAAMK,OAAOJ,QAAQI,IAErB,MAAMb,mBAAmBW,aAAY;EAGzC,IACIF,QAAQK,aACRN,MAAMM,cAAcL,QAAQK,WAE5B,MAAMd,mBAAmBW,aAAY;EAGzC,OAAOF;CACX;AACJ"}

package/dist/core/oauth2/client/authenticator.mjs

@@ -1,7 +1,7 @@
 import { ClientCredentialsService } from "../../authentication/credential/entities/client/module.mjs";
 import "../../authentication/credential/index.mjs";
 import { IdentityType } from "@authup/core-kit";
-import { OAuth2Error } from "@authup/specs";
+import { OAuth2ClientError } from "@authup/specs";
 //#region src/core/oauth2/client/authenticator.ts
 /**
 * Authenticates a client at the OAuth2 token endpoint. Confidential clients
@@ -17,13 +17,13 @@ import { OAuth2Error } from "@authup/specs";
 		this.credentialsService = new ClientCredentialsService();
 	}
 	async authenticate(clientId, clientSecret, realmId) {
-		if (!clientId) throw OAuth2Error.clientInvalid();
+		if (!clientId) throw OAuth2ClientError.invalid();
 		const identity = await this.identityResolver.resolve(IdentityType.CLIENT, clientId, realmId);
-		if (!identity || identity.type !== IdentityType.CLIENT) throw OAuth2Error.clientInvalid();
-		if (!identity.data.active) throw OAuth2Error.clientInactive();
+		if (!identity || identity.type !== IdentityType.CLIENT) throw OAuth2ClientError.invalid();
+		if (!identity.data.active) throw OAuth2ClientError.inactive();
 		if (identity.data.is_confidential) {
-			if (!clientSecret) throw OAuth2Error.clientInvalid();
-			if (!await this.credentialsService.verify(clientSecret, identity.data)) throw OAuth2Error.clientInvalid();
+			if (!clientSecret) throw OAuth2ClientError.invalid();
+			if (!await this.credentialsService.verify(clientSecret, identity.data)) throw OAuth2ClientError.invalid();
 		}
 		return identity.data;
 	}

package/dist/core/oauth2/client/authenticator.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"authenticator.mjs","names":["IdentityType","OAuth2Error","ClientCredentialsService","OAuth2ClientAuthenticator","identityResolver","credentialsService","authenticate","clientId","clientSecret","realmId","clientInvalid","identity","resolve","CLIENT","type","data","active","clientInactive","is_confidential","verified","verify"],"sources":["../../../../src/core/oauth2/client/authenticator.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Client } from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { OAuth2Error } from '@authup/specs';\nimport { ClientCredentialsService } from '../../authentication/credential/index.ts';\nimport type { IIdentityResolver } from '../../identity/index.ts';\n\n/**\n * Authenticates a client at the OAuth2 token endpoint. Confidential clients\n * MUST present a valid client_secret (RFC 6749 §3.2.1, §4.1.3, §4.3.2, §6);\n * public clients identify via client_id only.\n *\n * Used by authorization_code, refresh_token, and password grants.\n */\nexport class OAuth2ClientAuthenticator {\n    protected identityResolver: IIdentityResolver;\n\n    protected credentialsService: ClientCredentialsService;\n\n    constructor(identityResolver: IIdentityResolver) {\n        this.identityResolver = identityResolver;\n        this.credentialsService = new ClientCredentialsService();\n    }\n\n    async authenticate(\n        clientId: string | undefined,\n        clientSecret?: string,\n        realmId?: string,\n    ): Promise<Client> {\n        if (!clientId) {\n            throw OAuth2Error.clientInvalid();\n        }\n\n        const identity = await this.identityResolver.resolve(IdentityType.CLIENT, clientId, realmId);\n        if (!identity || identity.type !== IdentityType.CLIENT) {\n            throw OAuth2Error.clientInvalid();\n        }\n\n        if (!identity.data.active) {\n            throw OAuth2Error.clientInactive();\n        }\n\n        if (identity.data.is_confidential) {\n            if (!clientSecret) {\n                throw OAuth2Error.clientInvalid();\n            }\n\n            const verified = await this.credentialsService.verify(clientSecret, identity.data);\n            if (!verified) {\n                throw OAuth2Error.clientInvalid();\n            }\n        }\n\n        return identity.data;\n    }\n}\n"],"mappings":";;;;;;;;;;;GAoBA,IAAaG,4BAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,kBAAqC;AAC7C,OAAKA,mBAAmBA;AACxB,OAAKC,qBAAqB,IAAIH,0BAAAA;;CAGlC,MAAMI,aACFC,UACAC,cACAC,SACe;AACf,MAAI,CAACF,SACD,OAAMN,YAAYS,eAAa;EAGnC,MAAMC,WAAW,MAAM,KAAKP,iBAAiBQ,QAAQZ,aAAaa,QAAQN,UAAUE,QAAAA;AACpF,MAAI,CAACE,YAAYA,SAASG,SAASd,aAAaa,OAC5C,OAAMZ,YAAYS,eAAa;AAGnC,MAAI,CAACC,SAASI,KAAKC,OACf,OAAMf,YAAYgB,gBAAc;AAGpC,MAAIN,SAASI,KAAKG,iBAAiB;AAC/B,OAAI,CAACV,aACD,OAAMP,YAAYS,eAAa;AAInC,OAAI,CAACS,MADkB,KAAKd,mBAAmBe,OAAOZ,cAAcG,SAASI,KAAI,CAE7E,OAAMd,YAAYS,eAAa;;AAIvC,SAAOC,SAASI"}
+{"version":3,"file":"authenticator.mjs","names":["IdentityType","OAuth2ClientError","ClientCredentialsService","OAuth2ClientAuthenticator","identityResolver","credentialsService","authenticate","clientId","clientSecret","realmId","invalid","identity","resolve","CLIENT","type","data","active","inactive","is_confidential","verified","verify"],"sources":["../../../../src/core/oauth2/client/authenticator.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Client } from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { OAuth2ClientError } from '@authup/specs';\nimport { ClientCredentialsService } from '../../authentication/credential/index.ts';\nimport type { IIdentityResolver } from '../../identity/index.ts';\n\n/**\n * Authenticates a client at the OAuth2 token endpoint. Confidential clients\n * MUST present a valid client_secret (RFC 6749 §3.2.1, §4.1.3, §4.3.2, §6);\n * public clients identify via client_id only.\n *\n * Used by authorization_code, refresh_token, and password grants.\n */\nexport class OAuth2ClientAuthenticator {\n    protected identityResolver: IIdentityResolver;\n\n    protected credentialsService: ClientCredentialsService;\n\n    constructor(identityResolver: IIdentityResolver) {\n        this.identityResolver = identityResolver;\n        this.credentialsService = new ClientCredentialsService();\n    }\n\n    async authenticate(\n        clientId: string | undefined,\n        clientSecret?: string,\n        realmId?: string,\n    ): Promise<Client> {\n        if (!clientId) {\n            throw OAuth2ClientError.invalid();\n        }\n\n        const identity = await this.identityResolver.resolve(IdentityType.CLIENT, clientId, realmId);\n        if (!identity || identity.type !== IdentityType.CLIENT) {\n            throw OAuth2ClientError.invalid();\n        }\n\n        if (!identity.data.active) {\n            throw OAuth2ClientError.inactive();\n        }\n\n        if (identity.data.is_confidential) {\n            if (!clientSecret) {\n                throw OAuth2ClientError.invalid();\n            }\n\n            const verified = await this.credentialsService.verify(clientSecret, identity.data);\n            if (!verified) {\n                throw OAuth2ClientError.invalid();\n            }\n        }\n\n        return identity.data;\n    }\n}\n"],"mappings":";;;;;;;;;;;GAoBA,IAAaG,4BAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,kBAAqC;EAC7C,KAAKA,mBAAmBA;EACxB,KAAKC,qBAAqB,IAAIH,yBAAAA;CAClC;CAEA,MAAMI,aACFC,UACAC,cACAC,SACe;EACf,IAAI,CAACF,UACD,MAAMN,kBAAkBS,QAAO;EAGnC,MAAMC,WAAW,MAAM,KAAKP,iBAAiBQ,QAAQZ,aAAaa,QAAQN,UAAUE,OAAAA;EACpF,IAAI,CAACE,YAAYA,SAASG,SAASd,aAAaa,QAC5C,MAAMZ,kBAAkBS,QAAO;EAGnC,IAAI,CAACC,SAASI,KAAKC,QACf,MAAMf,kBAAkBgB,SAAQ;EAGpC,IAAIN,SAASI,KAAKG,iBAAiB;GAC/B,IAAI,CAACV,cACD,MAAMP,kBAAkBS,QAAO;GAInC,IAAI,CAACS,MADkB,KAAKd,mBAAmBe,OAAOZ,cAAcG,SAASI,IAAI,GAE7E,MAAMd,kBAAkBS,QAAO;EAEvC;EAEA,OAAOC,SAASI;CACpB;AACJ"}

package/dist/core/oauth2/grant-types/authorize.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.mjs","names":["hasOAuth2Scopes","ScopeName","OAuth2BaseGrant","buildOAuth2BearerTokenResponse","OAuth2AuthorizeGrant","refreshTokenIssuer","ctx","accessTokenIssuer","sessionManager","runWith","authorizationCode","options","session","create","user_agent","userAgent","ip_address","ipAddress","realm_id","client_id","sub_kind","sub","issuePayload","remote_address","session_id","id","undefined","realm_name","scope","accessToken","accessTokenPayload","issue","refreshToken","refreshTokenPayload","buildContext","OPEN_ID","idToken","id_token"],"sources":["../../../../src/core/oauth2/grant-types/authorize.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { hasOAuth2Scopes } from '@authup/specs';\nimport type { OAuth2AuthorizationCode } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport type { IOAuth2TokenIssuer } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport type { IOAuth2Grant, OAuth2AuthorizeGrantContext, OAuth2GrantRunWIthOptions } from './types.ts';\nimport type { OAuth2BearerResponseBuildContext } from '../response/index.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\n\nexport class OAuth2AuthorizeGrant extends OAuth2BaseGrant<OAuth2AuthorizationCode> implements IOAuth2Grant {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    constructor(ctx: OAuth2AuthorizeGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n    }\n\n    async runWith(\n        authorizationCode: OAuth2AuthorizationCode,\n        options: OAuth2GrantRunWIthOptions = {},\n    ) : Promise<OAuth2TokenGrantResponse> {\n        const session = await this.sessionManager.create({\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: authorizationCode.realm_id,\n            client_id: authorizationCode.client_id,\n            sub_kind: authorizationCode.sub_kind,\n            sub: authorizationCode.sub,\n        });\n\n        const issuePayload : Partial<OAuth2TokenPayload> = {\n            user_agent: options.userAgent,\n            remote_address: options.ipAddress,\n            session_id: session.id,\n            sub: authorizationCode.sub || undefined,\n            sub_kind: authorizationCode.sub_kind,\n            realm_id: authorizationCode.realm_id,\n            realm_name: authorizationCode.realm_name,\n            scope: authorizationCode.scope || undefined,\n            client_id: authorizationCode.client_id || undefined,\n        };\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);\n\n        const buildContext : OAuth2BearerResponseBuildContext = {\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        };\n\n        if (\n            authorizationCode.scope &&\n            hasOAuth2Scopes(authorizationCode.scope, ScopeName.OPEN_ID)\n        ) {\n            buildContext.idToken = authorizationCode.id_token || undefined;\n        }\n\n        return buildOAuth2BearerTokenResponse(buildContext);\n    }\n}\n"],"mappings":";;;;;AAiBA,IAAaI,uBAAb,cAA0CF,gBAAAA;CAC5BG;CAEV,YAAYC,KAAkC;AAC1C,QAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;GACxB,CAAA;AAEA,OAAKH,qBAAqBC,IAAID;;CAGlC,MAAMI,QACFC,mBACAC,UAAqC,EAAE,EACL;EAClC,MAAMC,UAAU,MAAM,KAAKJ,eAAeK,OAAO;GAC7CC,YAAYH,QAAQI;GACpBC,YAAYL,QAAQM;GACpBC,UAAUR,kBAAkBQ;GAC5BC,WAAWT,kBAAkBS;GAC7BC,UAAUV,kBAAkBU;GAC5BC,KAAKX,kBAAkBW;GAC3B,CAAA;EAEA,MAAMC,eAA6C;GAC/CR,YAAYH,QAAQI;GACpBQ,gBAAgBZ,QAAQM;GACxBO,YAAYZ,QAAQa;GACpBJ,KAAKX,kBAAkBW,OAAOK,KAAAA;GAC9BN,UAAUV,kBAAkBU;GAC5BF,UAAUR,kBAAkBQ;GAC5BS,YAAYjB,kBAAkBiB;GAC9BC,OAAOlB,kBAAkBkB,SAASF,KAAAA;GAClCP,WAAWT,kBAAkBS,aAAaO,KAAAA;GAC9C;EAEA,MAAM,CAACG,aAAaC,sBAAsB,MAAM,KAAKvB,kBAAkBwB,MAAMT,aAAAA;EAC7E,MAAM,CAACU,cAAcC,uBAAuB,MAAM,KAAK5B,mBAAmB0B,MAAMT,aAAAA;EAEhF,MAAMY,eAAkD;GACpDL;GACAC;GACAE;GACAC;GACJ;AAEA,MACIvB,kBAAkBkB,SAClB5B,gBAAgBU,kBAAkBkB,OAAO3B,UAAUkC,QAAO,CAE1DD,cAAaE,UAAU1B,kBAAkB2B,YAAYX,KAAAA;AAGzD,SAAOvB,+BAA+B+B,aAAAA"}
+{"version":3,"file":"authorize.mjs","names":["hasOAuth2Scopes","ScopeName","OAuth2BaseGrant","buildOAuth2BearerTokenResponse","OAuth2AuthorizeGrant","refreshTokenIssuer","ctx","accessTokenIssuer","sessionManager","runWith","authorizationCode","options","session","create","user_agent","userAgent","ip_address","ipAddress","realm_id","client_id","sub_kind","sub","issuePayload","remote_address","session_id","id","undefined","realm_name","scope","accessToken","accessTokenPayload","issue","refreshToken","refreshTokenPayload","buildContext","OPEN_ID","idToken","id_token"],"sources":["../../../../src/core/oauth2/grant-types/authorize.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { hasOAuth2Scopes } from '@authup/specs';\nimport type { OAuth2AuthorizationCode } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport type { IOAuth2TokenIssuer } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport type { IOAuth2Grant, OAuth2AuthorizeGrantContext, OAuth2GrantRunWIthOptions } from './types.ts';\nimport type { OAuth2BearerResponseBuildContext } from '../response/index.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\n\nexport class OAuth2AuthorizeGrant extends OAuth2BaseGrant<OAuth2AuthorizationCode> implements IOAuth2Grant {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    constructor(ctx: OAuth2AuthorizeGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n    }\n\n    async runWith(\n        authorizationCode: OAuth2AuthorizationCode,\n        options: OAuth2GrantRunWIthOptions = {},\n    ) : Promise<OAuth2TokenGrantResponse> {\n        const session = await this.sessionManager.create({\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: authorizationCode.realm_id,\n            client_id: authorizationCode.client_id,\n            sub_kind: authorizationCode.sub_kind,\n            sub: authorizationCode.sub,\n        });\n\n        const issuePayload : Partial<OAuth2TokenPayload> = {\n            user_agent: options.userAgent,\n            remote_address: options.ipAddress,\n            session_id: session.id,\n            sub: authorizationCode.sub || undefined,\n            sub_kind: authorizationCode.sub_kind,\n            realm_id: authorizationCode.realm_id,\n            realm_name: authorizationCode.realm_name,\n            scope: authorizationCode.scope || undefined,\n            client_id: authorizationCode.client_id || undefined,\n        };\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);\n\n        const buildContext : OAuth2BearerResponseBuildContext = {\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        };\n\n        if (\n            authorizationCode.scope &&\n            hasOAuth2Scopes(authorizationCode.scope, ScopeName.OPEN_ID)\n        ) {\n            buildContext.idToken = authorizationCode.id_token || undefined;\n        }\n\n        return buildOAuth2BearerTokenResponse(buildContext);\n    }\n}\n"],"mappings":";;;;;AAiBA,IAAaI,uBAAb,cAA0CF,gBAAAA;CAC5BG;CAEV,YAAYC,KAAkC;EAC1C,MAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;EACxB,CAAA;EAEA,KAAKH,qBAAqBC,IAAID;CAClC;CAEA,MAAMI,QACFC,mBACAC,UAAqC,CAAC,GACJ;EAClC,MAAMC,UAAU,MAAM,KAAKJ,eAAeK,OAAO;GAC7CC,YAAYH,QAAQI;GACpBC,YAAYL,QAAQM;GACpBC,UAAUR,kBAAkBQ;GAC5BC,WAAWT,kBAAkBS;GAC7BC,UAAUV,kBAAkBU;GAC5BC,KAAKX,kBAAkBW;EAC3B,CAAA;EAEA,MAAMC,eAA6C;GAC/CR,YAAYH,QAAQI;GACpBQ,gBAAgBZ,QAAQM;GACxBO,YAAYZ,QAAQa;GACpBJ,KAAKX,kBAAkBW,OAAOK,KAAAA;GAC9BN,UAAUV,kBAAkBU;GAC5BF,UAAUR,kBAAkBQ;GAC5BS,YAAYjB,kBAAkBiB;GAC9BC,OAAOlB,kBAAkBkB,SAASF,KAAAA;GAClCP,WAAWT,kBAAkBS,aAAaO,KAAAA;EAC9C;EAEA,MAAM,CAACG,aAAaC,sBAAsB,MAAM,KAAKvB,kBAAkBwB,MAAMT,YAAAA;EAC7E,MAAM,CAACU,cAAcC,uBAAuB,MAAM,KAAK5B,mBAAmB0B,MAAMT,YAAAA;EAEhF,MAAMY,eAAkD;GACpDL;GACAC;GACAE;GACAC;EACJ;EAEA,IACIvB,kBAAkBkB,SAClB5B,gBAAgBU,kBAAkBkB,OAAO3B,UAAUkC,OAAO,GAE1DD,aAAaE,UAAU1B,kBAAkB2B,YAAYX,KAAAA;EAGzD,OAAOvB,+BAA+B+B,YAAAA;CAC1C;AACJ"}

package/dist/core/oauth2/grant-types/base.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"base.mjs","names":["OAuth2BaseGrant","accessTokenIssuer","sessionManager","ctx"],"sources":["../../../../src/core/oauth2/grant-types/base.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ObjectLiteral } from '@authup/kit';\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport type { ISessionManager } from '../../authentication/index.ts';\nimport type { IOAuth2TokenIssuer } from '../token/index.ts';\nimport type { BaseGrantContext, IOAuth2Grant, OAuth2GrantRunWIthOptions } from './types.ts';\n\nexport abstract class OAuth2BaseGrant<\n    T = ObjectLiteral,\n> implements IOAuth2Grant<T> {\n    protected accessTokenIssuer : IOAuth2TokenIssuer;\n\n    protected sessionManager : ISessionManager;\n\n    // -----------------------------------------------------\n\n    constructor(ctx: BaseGrantContext) {\n        this.accessTokenIssuer = ctx.accessTokenIssuer;\n        this.sessionManager = ctx.sessionManager;\n    }\n\n    // -----------------------------------------------------\n\n    abstract runWith(input: T, options?: OAuth2GrantRunWIthOptions): Promise<OAuth2TokenGrantResponse>;\n}\n"],"mappings":";AAaA,IAAsBA,kBAAtB,MAAsBA;CAGRC;CAEAC;CAIV,YAAYC,KAAuB;AAC/B,OAAKF,oBAAoBE,IAAIF;AAC7B,OAAKC,iBAAiBC,IAAID"}
+{"version":3,"file":"base.mjs","names":["OAuth2BaseGrant","accessTokenIssuer","sessionManager","ctx"],"sources":["../../../../src/core/oauth2/grant-types/base.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ObjectLiteral } from '@authup/kit';\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport type { ISessionManager } from '../../authentication/index.ts';\nimport type { IOAuth2TokenIssuer } from '../token/index.ts';\nimport type { BaseGrantContext, IOAuth2Grant, OAuth2GrantRunWIthOptions } from './types.ts';\n\nexport abstract class OAuth2BaseGrant<\n    T = ObjectLiteral,\n> implements IOAuth2Grant<T> {\n    protected accessTokenIssuer : IOAuth2TokenIssuer;\n\n    protected sessionManager : ISessionManager;\n\n    // -----------------------------------------------------\n\n    constructor(ctx: BaseGrantContext) {\n        this.accessTokenIssuer = ctx.accessTokenIssuer;\n        this.sessionManager = ctx.sessionManager;\n    }\n\n    // -----------------------------------------------------\n\n    abstract runWith(input: T, options?: OAuth2GrantRunWIthOptions): Promise<OAuth2TokenGrantResponse>;\n}\n"],"mappings":";AAaA,IAAsBA,kBAAtB,MAAsBA;CAGRC;CAEAC;CAIV,YAAYC,KAAuB;EAC/B,KAAKF,oBAAoBE,IAAIF;EAC7B,KAAKC,iBAAiBC,IAAID;CAC9B;AAKJ"}

package/dist/core/oauth2/grant-types/client-credentials.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"client-credentials.mjs","names":["OAuth2SubKind","IdentityType","ScopeName","OAuth2BaseGrant","buildOAuth2BearerTokenResponse","ClientCredentialsGrant","runWith","input","options","session","sessionManager","create","user_agent","userAgent","ip_address","ipAddress","realm_id","sub","id","sub_kind","CLIENT","accessToken","accessTokenPayload","accessTokenIssuer","issue","remote_address","session_id","scope","GLOBAL","realm","realm_name","name","client_id"],"sources":["../../../../src/core/oauth2/grant-types/client-credentials.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2SubKind } from '@authup/specs';\nimport type { Client } from '@authup/core-kit';\nimport {\n    IdentityType,\n    ScopeName,\n} from '@authup/core-kit';\nimport { OAuth2BaseGrant } from './base.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { OAuth2GrantRunWIthOptions } from './types.ts';\n\nexport class ClientCredentialsGrant extends OAuth2BaseGrant<Client> {\n    async runWith(input: Client, options: OAuth2GrantRunWIthOptions = {}) : Promise<OAuth2TokenGrantResponse> {\n        const session = await this.sessionManager.create({\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: input.realm_id,\n            sub: input.id,\n            sub_kind: IdentityType.CLIENT,\n        });\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            session_id: session.id,\n            scope: ScopeName.GLOBAL,\n            sub: input.id,\n            sub_kind: OAuth2SubKind.CLIENT,\n            realm_id: input.realm.id,\n            realm_name: input.realm.name,\n            client_id: input.id,\n        });\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;AAkBA,IAAaK,yBAAb,cAA4CF,gBAAAA;CACxC,MAAMG,QAAQC,OAAeC,UAAqC,EAAE,EAAsC;EACtG,MAAMC,UAAU,MAAM,KAAKC,eAAeC,OAAO;GAC7CC,YAAYJ,QAAQK;GACpBC,YAAYN,QAAQO;GACpBC,UAAUT,MAAMS;GAChBC,KAAKV,MAAMW;GACXC,UAAUlB,aAAamB;GAC3B,CAAA;EAEA,MAAM,CAACC,aAAaC,sBAAsB,MAAM,KAAKC,kBAAkBC,MAAM;GACzEZ,YAAYH,QAAQG;GACpBa,gBAAgBhB,QAAQK;GACxBY,YAAYjB,QAAQS;GACpBS,OAAOzB,UAAU0B;GACjBX,KAAKV,MAAMW;GACXC,UAAUnB,cAAcoB;GACxBJ,UAAUT,MAAMsB,MAAMX;GACtBY,YAAYvB,MAAMsB,MAAME;GACxBC,WAAWzB,MAAMW;GACrB,CAAA;AAEA,SAAOd,+BAA+B;GAClCiB;GACAC;GACJ,CAAA"}
+{"version":3,"file":"client-credentials.mjs","names":["OAuth2SubKind","IdentityType","ScopeName","OAuth2BaseGrant","buildOAuth2BearerTokenResponse","ClientCredentialsGrant","runWith","input","options","session","sessionManager","create","user_agent","userAgent","ip_address","ipAddress","realm_id","sub","id","sub_kind","CLIENT","accessToken","accessTokenPayload","accessTokenIssuer","issue","remote_address","session_id","scope","GLOBAL","realm","realm_name","name","client_id"],"sources":["../../../../src/core/oauth2/grant-types/client-credentials.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2SubKind } from '@authup/specs';\nimport type { Client } from '@authup/core-kit';\nimport {\n    IdentityType,\n    ScopeName,\n} from '@authup/core-kit';\nimport { OAuth2BaseGrant } from './base.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { OAuth2GrantRunWIthOptions } from './types.ts';\n\nexport class ClientCredentialsGrant extends OAuth2BaseGrant<Client> {\n    async runWith(input: Client, options: OAuth2GrantRunWIthOptions = {}) : Promise<OAuth2TokenGrantResponse> {\n        const session = await this.sessionManager.create({\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: input.realm_id,\n            sub: input.id,\n            sub_kind: IdentityType.CLIENT,\n        });\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            session_id: session.id,\n            scope: ScopeName.GLOBAL,\n            sub: input.id,\n            sub_kind: OAuth2SubKind.CLIENT,\n            realm_id: input.realm.id,\n            realm_name: input.realm.name,\n            client_id: input.id,\n        });\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;AAkBA,IAAaK,yBAAb,cAA4CF,gBAAAA;CACxC,MAAMG,QAAQC,OAAeC,UAAqC,CAAC,GAAuC;EACtG,MAAMC,UAAU,MAAM,KAAKC,eAAeC,OAAO;GAC7CC,YAAYJ,QAAQK;GACpBC,YAAYN,QAAQO;GACpBC,UAAUT,MAAMS;GAChBC,KAAKV,MAAMW;GACXC,UAAUlB,aAAamB;EAC3B,CAAA;EAEA,MAAM,CAACC,aAAaC,sBAAsB,MAAM,KAAKC,kBAAkBC,MAAM;GACzEZ,YAAYH,QAAQG;GACpBa,gBAAgBhB,QAAQK;GACxBY,YAAYjB,QAAQS;GACpBS,OAAOzB,UAAU0B;GACjBX,KAAKV,MAAMW;GACXC,UAAUnB,cAAcoB;GACxBJ,UAAUT,MAAMsB,MAAMX;GACtBY,YAAYvB,MAAMsB,MAAME;GACxBC,WAAWzB,MAAMW;EACrB,CAAA;EAEA,OAAOd,+BAA+B;GAClCiB;GACAC;EACJ,CAAA;CACJ;AACJ"}

package/dist/core/oauth2/grant-types/identity.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"identity.mjs","names":["ScopeName","OAuth2BaseGrant","buildOAuth2BearerTokenResponse","IdentityGrantType","refreshTokenIssuer","ctx","accessTokenIssuer","sessionManager","runWith","identity","options","session","user_agent","userAgent","ip_address","ipAddress","realm_id","data","sub","id","sub_kind","type","sessionId","create","issuePayload","session_id","remote_address","scope","GLOBAL","realm_name","realm","name","accessToken","accessTokenPayload","issue","refreshToken","refreshTokenPayload"],"sources":["../../../../src/core/oauth2/grant-types/identity.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport type { Identity, Session } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport type { IOAuth2TokenIssuer } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { OAuth2GrantRunWIthOptions, OAuth2IdentityGrantContext } from './types.ts';\n\nexport class IdentityGrantType extends OAuth2BaseGrant<Identity> {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    constructor(ctx: OAuth2IdentityGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n    }\n\n    async runWith(\n        identity: Identity,\n        options: OAuth2GrantRunWIthOptions = {},\n    ): Promise<OAuth2TokenGrantResponse> {\n        const session : Partial<Session> = {\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: identity.data.realm_id,\n            sub: identity.data.id,\n            sub_kind: identity.type,\n        };\n\n        const { id: sessionId } = await this.sessionManager.create(session);\n\n        const issuePayload : Partial<OAuth2TokenPayload> = {\n            session_id: sessionId,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            scope: ScopeName.GLOBAL,\n            realm_id: identity.data.realm_id,\n            realm_name: identity.data.realm?.name,\n            sub: identity.data.id,\n            sub_kind: identity.type,\n        };\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;AAeA,IAAaG,oBAAb,cAAuCF,gBAAAA;CACzBG;CAEV,YAAYC,KAAiC;AACzC,QAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;GACxB,CAAA;AAEA,OAAKH,qBAAqBC,IAAID;;CAGlC,MAAMI,QACFC,UACAC,UAAqC,EAAE,EACN;EACjC,MAAMC,UAA6B;GAC/BC,YAAYF,QAAQG;GACpBC,YAAYJ,QAAQK;GACpBC,UAAUP,SAASQ,KAAKD;GACxBE,KAAKT,SAASQ,KAAKE;GACnBC,UAAUX,SAASY;GACvB;EAEA,MAAM,EAAEF,IAAIG,cAAc,MAAM,KAAKf,eAAegB,OAAOZ,QAAAA;EAE3D,MAAMa,eAA6C;GAC/CC,YAAYH;GACZV,YAAYD,QAAQC;GACpBc,gBAAgBf,QAAQG;GACxBa,OAAO3B,UAAU4B;GACjBZ,UAAUP,SAASQ,KAAKD;GACxBa,YAAYpB,SAASQ,KAAKa,OAAOC;GACjCb,KAAKT,SAASQ,KAAKE;GACnBC,UAAUX,SAASY;GACvB;EAEA,MAAM,CAACW,aAAaC,sBAAsB,MAAM,KAAK3B,kBAAkB4B,MAAMV,aAAAA;EAC7E,MAAM,CAACW,cAAcC,uBAAuB,MAAM,KAAKhC,mBAAmB8B,MAAMV,aAAAA;AAEhF,SAAOtB,+BAA+B;GAClC8B;GACAC;GACAE;GACAC;GACJ,CAAA"}
+{"version":3,"file":"identity.mjs","names":["ScopeName","OAuth2BaseGrant","buildOAuth2BearerTokenResponse","IdentityGrantType","refreshTokenIssuer","ctx","accessTokenIssuer","sessionManager","runWith","identity","options","session","user_agent","userAgent","ip_address","ipAddress","realm_id","data","sub","id","sub_kind","type","sessionId","create","issuePayload","session_id","remote_address","scope","GLOBAL","realm_name","realm","name","accessToken","accessTokenPayload","issue","refreshToken","refreshTokenPayload"],"sources":["../../../../src/core/oauth2/grant-types/identity.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport type { Identity, Session } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport type { IOAuth2TokenIssuer } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { OAuth2GrantRunWIthOptions, OAuth2IdentityGrantContext } from './types.ts';\n\nexport class IdentityGrantType extends OAuth2BaseGrant<Identity> {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    constructor(ctx: OAuth2IdentityGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n    }\n\n    async runWith(\n        identity: Identity,\n        options: OAuth2GrantRunWIthOptions = {},\n    ): Promise<OAuth2TokenGrantResponse> {\n        const session : Partial<Session> = {\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: identity.data.realm_id,\n            sub: identity.data.id,\n            sub_kind: identity.type,\n        };\n\n        const { id: sessionId } = await this.sessionManager.create(session);\n\n        const issuePayload : Partial<OAuth2TokenPayload> = {\n            session_id: sessionId,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            scope: ScopeName.GLOBAL,\n            realm_id: identity.data.realm_id,\n            realm_name: identity.data.realm?.name,\n            sub: identity.data.id,\n            sub_kind: identity.type,\n        };\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;AAeA,IAAaG,oBAAb,cAAuCF,gBAAAA;CACzBG;CAEV,YAAYC,KAAiC;EACzC,MAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;EACxB,CAAA;EAEA,KAAKH,qBAAqBC,IAAID;CAClC;CAEA,MAAMI,QACFC,UACAC,UAAqC,CAAC,GACL;EACjC,MAAMC,UAA6B;GAC/BC,YAAYF,QAAQG;GACpBC,YAAYJ,QAAQK;GACpBC,UAAUP,SAASQ,KAAKD;GACxBE,KAAKT,SAASQ,KAAKE;GACnBC,UAAUX,SAASY;EACvB;EAEA,MAAM,EAAEF,IAAIG,cAAc,MAAM,KAAKf,eAAegB,OAAOZ,OAAAA;EAE3D,MAAMa,eAA6C;GAC/CC,YAAYH;GACZV,YAAYD,QAAQC;GACpBc,gBAAgBf,QAAQG;GACxBa,OAAO3B,UAAU4B;GACjBZ,UAAUP,SAASQ,KAAKD;GACxBa,YAAYpB,SAASQ,KAAKa,OAAOC;GACjCb,KAAKT,SAASQ,KAAKE;GACnBC,UAAUX,SAASY;EACvB;EAEA,MAAM,CAACW,aAAaC,sBAAsB,MAAM,KAAK3B,kBAAkB4B,MAAMV,YAAAA;EAC7E,MAAM,CAACW,cAAcC,uBAAuB,MAAM,KAAKhC,mBAAmB8B,MAAMV,YAAAA;EAEhF,OAAOtB,+BAA+B;GAClC8B;GACAC;GACAE;GACAC;EACJ,CAAA;CACJ;AACJ"}

package/dist/core/oauth2/grant-types/password.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"password.mjs","names":["OAuth2SubKind","IdentityType","ScopeName","buildOAuth2BearerTokenResponse","OAuth2BaseGrant","PasswordGrantType","refreshTokenIssuer","ctx","accessTokenIssuer","sessionManager","runWith","input","options","user","client","clientId","id","session","create","user_agent","userAgent","ip_address","ipAddress","realm_id","client_id","sub","sub_kind","USER","issuePayload","session_id","remote_address","scope","GLOBAL","realm_name","realm","name","accessToken","accessTokenPayload","issue","refreshToken","refreshTokenPayload"],"sources":["../../../../src/core/oauth2/grant-types/password.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2SubKind } from '@authup/specs';\nimport type { Client, User } from '@authup/core-kit';\nimport {\n    IdentityType,\n    ScopeName,\n} from '@authup/core-kit';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { IOAuth2TokenIssuer } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport type { OAuth2GrantRunWIthOptions, OAuth2PasswordGrantContext } from './types.ts';\n\nexport type OAuth2PasswordGrantInput = {\n    user: User,\n    client?: Client,\n};\n\nexport class PasswordGrantType extends OAuth2BaseGrant<OAuth2PasswordGrantInput> {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    constructor(ctx: OAuth2PasswordGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n    }\n\n    async runWith(input: OAuth2PasswordGrantInput, options: OAuth2GrantRunWIthOptions = {}) : Promise<OAuth2TokenGrantResponse> {\n        const { user, client } = input;\n        const clientId = client?.id;\n\n        const session = await this.sessionManager.create({\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: user.realm_id,\n            client_id: clientId,\n            sub: user.id,\n            sub_kind: IdentityType.USER,\n        });\n\n        const issuePayload : Partial<OAuth2TokenPayload> = {\n            client_id: clientId,\n            session_id: session.id,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            scope: ScopeName.GLOBAL,\n            sub: user.id,\n            sub_kind: OAuth2SubKind.USER,\n            realm_id: user.realm_id,\n            realm_name: user.realm?.name,\n        };\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;AAwBA,IAAaK,oBAAb,cAAuCD,gBAAAA;CACzBE;CAEV,YAAYC,KAAiC;AACzC,QAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;GACxB,CAAA;AAEA,OAAKH,qBAAqBC,IAAID;;CAGlC,MAAMI,QAAQC,OAAiCC,UAAqC,EAAE,EAAsC;EACxH,MAAM,EAAEC,MAAMC,WAAWH;EACzB,MAAMI,WAAWD,QAAQE;EAEzB,MAAMC,UAAU,MAAM,KAAKR,eAAeS,OAAO;GAC7CC,YAAYP,QAAQQ;GACpBC,YAAYT,QAAQU;GACpBC,UAAUV,KAAKU;GACfC,WAAWT;GACXU,KAAKZ,KAAKG;GACVU,UAAUzB,aAAa0B;GAC3B,CAAA;EAEA,MAAMC,eAA6C;GAC/CJ,WAAWT;GACXc,YAAYZ,QAAQD;GACpBG,YAAYF,QAAQE;GACpBW,gBAAgBb,QAAQI;GACxBU,OAAO7B,UAAU8B;GACjBP,KAAKZ,KAAKG;GACVU,UAAU1B,cAAc2B;GACxBJ,UAAUV,KAAKU;GACfU,YAAYpB,KAAKqB,OAAOC;GAC5B;EAEA,MAAM,CAACC,aAAaC,sBAAsB,MAAM,KAAK7B,kBAAkB8B,MAAMV,aAAAA;EAC7E,MAAM,CAACW,cAAcC,uBAAuB,MAAM,KAAKlC,mBAAmBgC,MAAMV,aAAAA;AAEhF,SAAOzB,+BAA+B;GAClCiC;GACAC;GACAE;GACAC;GACJ,CAAA"}
+{"version":3,"file":"password.mjs","names":["OAuth2SubKind","IdentityType","ScopeName","buildOAuth2BearerTokenResponse","OAuth2BaseGrant","PasswordGrantType","refreshTokenIssuer","ctx","accessTokenIssuer","sessionManager","runWith","input","options","user","client","clientId","id","session","create","user_agent","userAgent","ip_address","ipAddress","realm_id","client_id","sub","sub_kind","USER","issuePayload","session_id","remote_address","scope","GLOBAL","realm_name","realm","name","accessToken","accessTokenPayload","issue","refreshToken","refreshTokenPayload"],"sources":["../../../../src/core/oauth2/grant-types/password.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2SubKind } from '@authup/specs';\nimport type { Client, User } from '@authup/core-kit';\nimport {\n    IdentityType,\n    ScopeName,\n} from '@authup/core-kit';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { IOAuth2TokenIssuer } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport type { OAuth2GrantRunWIthOptions, OAuth2PasswordGrantContext } from './types.ts';\n\nexport type OAuth2PasswordGrantInput = {\n    user: User,\n    client?: Client,\n};\n\nexport class PasswordGrantType extends OAuth2BaseGrant<OAuth2PasswordGrantInput> {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    constructor(ctx: OAuth2PasswordGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n    }\n\n    async runWith(input: OAuth2PasswordGrantInput, options: OAuth2GrantRunWIthOptions = {}) : Promise<OAuth2TokenGrantResponse> {\n        const { user, client } = input;\n        const clientId = client?.id;\n\n        const session = await this.sessionManager.create({\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: user.realm_id,\n            client_id: clientId,\n            sub: user.id,\n            sub_kind: IdentityType.USER,\n        });\n\n        const issuePayload : Partial<OAuth2TokenPayload> = {\n            client_id: clientId,\n            session_id: session.id,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            scope: ScopeName.GLOBAL,\n            sub: user.id,\n            sub_kind: OAuth2SubKind.USER,\n            realm_id: user.realm_id,\n            realm_name: user.realm?.name,\n        };\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;AAwBA,IAAaK,oBAAb,cAAuCD,gBAAAA;CACzBE;CAEV,YAAYC,KAAiC;EACzC,MAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;EACxB,CAAA;EAEA,KAAKH,qBAAqBC,IAAID;CAClC;CAEA,MAAMI,QAAQC,OAAiCC,UAAqC,CAAC,GAAuC;EACxH,MAAM,EAAEC,MAAMC,WAAWH;EACzB,MAAMI,WAAWD,QAAQE;EAEzB,MAAMC,UAAU,MAAM,KAAKR,eAAeS,OAAO;GAC7CC,YAAYP,QAAQQ;GACpBC,YAAYT,QAAQU;GACpBC,UAAUV,KAAKU;GACfC,WAAWT;GACXU,KAAKZ,KAAKG;GACVU,UAAUzB,aAAa0B;EAC3B,CAAA;EAEA,MAAMC,eAA6C;GAC/CJ,WAAWT;GACXc,YAAYZ,QAAQD;GACpBG,YAAYF,QAAQE;GACpBW,gBAAgBb,QAAQI;GACxBU,OAAO7B,UAAU8B;GACjBP,KAAKZ,KAAKG;GACVU,UAAU1B,cAAc2B;GACxBJ,UAAUV,KAAKU;GACfU,YAAYpB,KAAKqB,OAAOC;EAC5B;EAEA,MAAM,CAACC,aAAaC,sBAAsB,MAAM,KAAK7B,kBAAkB8B,MAAMV,YAAAA;EAC7E,MAAM,CAACW,cAAcC,uBAAuB,MAAM,KAAKlC,mBAAmBgC,MAAMV,YAAAA;EAEhF,OAAOzB,+BAA+B;GAClCiC;GACAC;GACAE;GACAC;EACJ,CAAA;CACJ;AACJ"}

package/dist/core/oauth2/grant-types/refresh-token.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"refresh-token.mjs","names":["JWTError","buildOAuth2BearerTokenResponse","OAuth2BaseGrant","OAuth2RefreshTokenGrant","refreshTokenIssuer","tokenVerifier","tokenRevoker","ctx","accessTokenIssuer","sessionManager","runWith","input","options","payload","verify","revoke","session_id","payloadPropertyInvalid","session","findOneById","userAgent","user_agent","ipAddress","ip_address","refresh","accessToken","accessTokenPayload","issue","remote_address","exp","buildExp","refreshToken","refreshTokenPayload"],"sources":["../../../../src/core/oauth2/grant-types/refresh-token.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { JWTError } from '@authup/specs';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { IOAuth2TokenIssuer, IOAuth2TokenRevoker, IOAuth2TokenVerifier } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport type { IOAuth2Grant, OAuth2GrantRunWIthOptions, OAuth2RefreshTokenGrantContext } from './types.ts';\n\nexport class OAuth2RefreshTokenGrant extends OAuth2BaseGrant<string | OAuth2TokenPayload> implements IOAuth2Grant {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    protected tokenVerifier : IOAuth2TokenVerifier;\n\n    protected tokenRevoker : IOAuth2TokenRevoker;\n\n    constructor(ctx: OAuth2RefreshTokenGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n\n        this.tokenVerifier = ctx.tokenVerifier;\n        this.tokenRevoker = ctx.tokenRevoker;\n    }\n\n    async runWith(\n        input: string | OAuth2TokenPayload,\n        options: OAuth2GrantRunWIthOptions = {},\n    ) : Promise<OAuth2TokenGrantResponse> {\n        let payload : OAuth2TokenPayload;\n        if (typeof input === 'string') {\n            payload = await this.tokenVerifier.verify(input);\n        } else {\n            payload = input;\n        }\n\n        await this.tokenRevoker.revoke(payload);\n\n        if (!payload.session_id) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        const session = await this.sessionManager.findOneById(payload.session_id);\n        if (!session) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        await this.sessionManager.verify(session);\n\n        if (options.userAgent) {\n            session.user_agent = options.userAgent;\n        }\n        if (options.ipAddress) {\n            session.ip_address = options.ipAddress;\n        }\n        await this.sessionManager.refresh(session);\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({\n            ...payload,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            exp: this.accessTokenIssuer.buildExp(),\n        });\n\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue({\n            ...payload,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            exp: this.refreshTokenIssuer.buildExp(),\n        });\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;AAcA,IAAaG,0BAAb,cAA6CD,gBAAAA;CAC/BE;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;AAC7C,QAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;GACxB,CAAA;AAEA,OAAKL,qBAAqBG,IAAIH;AAE9B,OAAKC,gBAAgBE,IAAIF;AACzB,OAAKC,eAAeC,IAAID;;CAG5B,MAAMI,QACFC,OACAC,UAAqC,EAAE,EACL;EAClC,IAAIC;AACJ,MAAI,OAAOF,UAAU,SACjBE,WAAU,MAAM,KAAKR,cAAcS,OAAOH,MAAAA;MAE1CE,WAAUF;AAGd,QAAM,KAAKL,aAAaS,OAAOF,QAAAA;AAE/B,MAAI,CAACA,QAAQG,WACT,OAAMhB,SAASiB,uBAAuB,aAAA;EAG1C,MAAMC,UAAU,MAAM,KAAKT,eAAeU,YAAYN,QAAQG,WAAU;AACxE,MAAI,CAACE,QACD,OAAMlB,SAASiB,uBAAuB,aAAA;AAG1C,QAAM,KAAKR,eAAeK,OAAOI,QAAAA;AAEjC,MAAIN,QAAQQ,UACRF,SAAQG,aAAaT,QAAQQ;AAEjC,MAAIR,QAAQU,UACRJ,SAAQK,aAAaX,QAAQU;AAEjC,QAAM,KAAKb,eAAee,QAAQN,QAAAA;EAElC,MAAM,CAACO,aAAaC,sBAAsB,MAAM,KAAKlB,kBAAkBmB,MAAM;GACzE,GAAGd;GACHQ,YAAYH,QAAQG;GACpBO,gBAAgBV,QAAQK;GACxBM,KAAK,KAAKrB,kBAAkBsB,UAAQ;GACxC,CAAA;EAEA,MAAM,CAACC,cAAcC,uBAAuB,MAAM,KAAK5B,mBAAmBuB,MAAM;GAC5E,GAAGd;GACHQ,YAAYH,QAAQG;GACpBO,gBAAgBV,QAAQK;GACxBM,KAAK,KAAKzB,mBAAmB0B,UAAQ;GACzC,CAAA;AAEA,SAAO7B,+BAA+B;GAClCwB;GACAC;GACAK;GACAC;GACJ,CAAA"}
+{"version":3,"file":"refresh-token.mjs","names":["JWTError","buildOAuth2BearerTokenResponse","OAuth2BaseGrant","OAuth2RefreshTokenGrant","refreshTokenIssuer","tokenVerifier","tokenRevoker","ctx","accessTokenIssuer","sessionManager","runWith","input","options","payload","verify","revoke","session_id","payloadPropertyInvalid","session","findOneById","userAgent","user_agent","ipAddress","ip_address","refresh","accessToken","accessTokenPayload","issue","remote_address","exp","buildExp","refreshToken","refreshTokenPayload"],"sources":["../../../../src/core/oauth2/grant-types/refresh-token.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { JWTError } from '@authup/specs';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { IOAuth2TokenIssuer, IOAuth2TokenRevoker, IOAuth2TokenVerifier } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport type { IOAuth2Grant, OAuth2GrantRunWIthOptions, OAuth2RefreshTokenGrantContext } from './types.ts';\n\nexport class OAuth2RefreshTokenGrant extends OAuth2BaseGrant<string | OAuth2TokenPayload> implements IOAuth2Grant {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    protected tokenVerifier : IOAuth2TokenVerifier;\n\n    protected tokenRevoker : IOAuth2TokenRevoker;\n\n    constructor(ctx: OAuth2RefreshTokenGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n\n        this.tokenVerifier = ctx.tokenVerifier;\n        this.tokenRevoker = ctx.tokenRevoker;\n    }\n\n    async runWith(\n        input: string | OAuth2TokenPayload,\n        options: OAuth2GrantRunWIthOptions = {},\n    ) : Promise<OAuth2TokenGrantResponse> {\n        let payload : OAuth2TokenPayload;\n        if (typeof input === 'string') {\n            payload = await this.tokenVerifier.verify(input);\n        } else {\n            payload = input;\n        }\n\n        await this.tokenRevoker.revoke(payload);\n\n        if (!payload.session_id) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        const session = await this.sessionManager.findOneById(payload.session_id);\n        if (!session) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        await this.sessionManager.verify(session);\n\n        if (options.userAgent) {\n            session.user_agent = options.userAgent;\n        }\n        if (options.ipAddress) {\n            session.ip_address = options.ipAddress;\n        }\n        await this.sessionManager.refresh(session);\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({\n            ...payload,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            exp: this.accessTokenIssuer.buildExp(),\n        });\n\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue({\n            ...payload,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            exp: this.refreshTokenIssuer.buildExp(),\n        });\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;AAcA,IAAaG,0BAAb,cAA6CD,gBAAAA;CAC/BE;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;EACxB,CAAA;EAEA,KAAKL,qBAAqBG,IAAIH;EAE9B,KAAKC,gBAAgBE,IAAIF;EACzB,KAAKC,eAAeC,IAAID;CAC5B;CAEA,MAAMI,QACFC,OACAC,UAAqC,CAAC,GACJ;EAClC,IAAIC;EACJ,IAAI,OAAOF,UAAU,UACjBE,UAAU,MAAM,KAAKR,cAAcS,OAAOH,KAAAA;OAE1CE,UAAUF;EAGd,MAAM,KAAKL,aAAaS,OAAOF,OAAAA;EAE/B,IAAI,CAACA,QAAQG,YACT,MAAMhB,SAASiB,uBAAuB,YAAA;EAG1C,MAAMC,UAAU,MAAM,KAAKT,eAAeU,YAAYN,QAAQG,UAAU;EACxE,IAAI,CAACE,SACD,MAAMlB,SAASiB,uBAAuB,YAAA;EAG1C,MAAM,KAAKR,eAAeK,OAAOI,OAAAA;EAEjC,IAAIN,QAAQQ,WACRF,QAAQG,aAAaT,QAAQQ;EAEjC,IAAIR,QAAQU,WACRJ,QAAQK,aAAaX,QAAQU;EAEjC,MAAM,KAAKb,eAAee,QAAQN,OAAAA;EAElC,MAAM,CAACO,aAAaC,sBAAsB,MAAM,KAAKlB,kBAAkBmB,MAAM;GACzE,GAAGd;GACHQ,YAAYH,QAAQG;GACpBO,gBAAgBV,QAAQK;GACxBM,KAAK,KAAKrB,kBAAkBsB,SAAQ;EACxC,CAAA;EAEA,MAAM,CAACC,cAAcC,uBAAuB,MAAM,KAAK5B,mBAAmBuB,MAAM;GAC5E,GAAGd;GACHQ,YAAYH,QAAQG;GACpBO,gBAAgBV,QAAQK;GACxBM,KAAK,KAAKzB,mBAAmB0B,SAAQ;EACzC,CAAA;EAEA,OAAO7B,+BAA+B;GAClCwB;GACAC;GACAK;GACAC;EACJ,CAAA;CACJ;AACJ"}

package/dist/core/oauth2/grant-types/robot-credentials.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"robot-credentials.mjs","names":["OAuth2SubKind","IdentityType","ScopeName","OAuth2BaseGrant","buildOAuth2BearerTokenResponse","RobotCredentialsGrant","runWith","input","options","session","sessionManager","create","user_agent","userAgent","ip_address","ipAddress","realm_id","sub","id","sub_kind","ROBOT","accessToken","accessTokenPayload","accessTokenIssuer","issue","session_id","remote_address","scope","GLOBAL","realm","realm_name","name","client_id","undefined"],"sources":["../../../../src/core/oauth2/grant-types/robot-credentials.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2SubKind } from '@authup/specs';\nimport type { Robot } from '@authup/core-kit';\nimport {\n    IdentityType,\n    ScopeName,\n} from '@authup/core-kit';\nimport { OAuth2BaseGrant } from './base.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { OAuth2GrantRunWIthOptions } from './types.ts';\n\nexport class RobotCredentialsGrant extends OAuth2BaseGrant<Robot> {\n    async runWith(input: Robot, options: OAuth2GrantRunWIthOptions = {}) : Promise<OAuth2TokenGrantResponse> {\n        const session = await this.sessionManager.create({\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: input.realm_id,\n            sub: input.id,\n            sub_kind: IdentityType.ROBOT,\n        });\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({\n            session_id: session.id,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            scope: ScopeName.GLOBAL,\n            sub: input.id,\n            sub_kind: OAuth2SubKind.ROBOT,\n            realm_id: input.realm.id,\n            realm_name: input.realm.name,\n            client_id: input.client_id || undefined,\n        });\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;AAkBA,IAAaK,wBAAb,cAA2CF,gBAAAA;CACvC,MAAMG,QAAQC,OAAcC,UAAqC,EAAE,EAAsC;EACrG,MAAMC,UAAU,MAAM,KAAKC,eAAeC,OAAO;GAC7CC,YAAYJ,QAAQK;GACpBC,YAAYN,QAAQO;GACpBC,UAAUT,MAAMS;GAChBC,KAAKV,MAAMW;GACXC,UAAUlB,aAAamB;GAC3B,CAAA;EAEA,MAAM,CAACC,aAAaC,sBAAsB,MAAM,KAAKC,kBAAkBC,MAAM;GACzEC,YAAYhB,QAAQS;GACpBN,YAAYH,QAAQG;GACpBc,gBAAgBjB,QAAQK;GACxBa,OAAOzB,UAAU0B;GACjBX,KAAKV,MAAMW;GACXC,UAAUnB,cAAcoB;GACxBJ,UAAUT,MAAMsB,MAAMX;GACtBY,YAAYvB,MAAMsB,MAAME;GACxBC,WAAWzB,MAAMyB,aAAaC,KAAAA;GAClC,CAAA;AAEA,SAAO7B,+BAA+B;GAClCiB;GACAC;GACJ,CAAA"}
+{"version":3,"file":"robot-credentials.mjs","names":["OAuth2SubKind","IdentityType","ScopeName","OAuth2BaseGrant","buildOAuth2BearerTokenResponse","RobotCredentialsGrant","runWith","input","options","session","sessionManager","create","user_agent","userAgent","ip_address","ipAddress","realm_id","sub","id","sub_kind","ROBOT","accessToken","accessTokenPayload","accessTokenIssuer","issue","session_id","remote_address","scope","GLOBAL","realm","realm_name","name","client_id","undefined"],"sources":["../../../../src/core/oauth2/grant-types/robot-credentials.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2SubKind } from '@authup/specs';\nimport type { Robot } from '@authup/core-kit';\nimport {\n    IdentityType,\n    ScopeName,\n} from '@authup/core-kit';\nimport { OAuth2BaseGrant } from './base.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { OAuth2GrantRunWIthOptions } from './types.ts';\n\nexport class RobotCredentialsGrant extends OAuth2BaseGrant<Robot> {\n    async runWith(input: Robot, options: OAuth2GrantRunWIthOptions = {}) : Promise<OAuth2TokenGrantResponse> {\n        const session = await this.sessionManager.create({\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: input.realm_id,\n            sub: input.id,\n            sub_kind: IdentityType.ROBOT,\n        });\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({\n            session_id: session.id,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            scope: ScopeName.GLOBAL,\n            sub: input.id,\n            sub_kind: OAuth2SubKind.ROBOT,\n            realm_id: input.realm.id,\n            realm_name: input.realm.name,\n            client_id: input.client_id || undefined,\n        });\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;AAkBA,IAAaK,wBAAb,cAA2CF,gBAAAA;CACvC,MAAMG,QAAQC,OAAcC,UAAqC,CAAC,GAAuC;EACrG,MAAMC,UAAU,MAAM,KAAKC,eAAeC,OAAO;GAC7CC,YAAYJ,QAAQK;GACpBC,YAAYN,QAAQO;GACpBC,UAAUT,MAAMS;GAChBC,KAAKV,MAAMW;GACXC,UAAUlB,aAAamB;EAC3B,CAAA;EAEA,MAAM,CAACC,aAAaC,sBAAsB,MAAM,KAAKC,kBAAkBC,MAAM;GACzEC,YAAYhB,QAAQS;GACpBN,YAAYH,QAAQG;GACpBc,gBAAgBjB,QAAQK;GACxBa,OAAOzB,UAAU0B;GACjBX,KAAKV,MAAMW;GACXC,UAAUnB,cAAcoB;GACxBJ,UAAUT,MAAMsB,MAAMX;GACtBY,YAAYvB,MAAMsB,MAAME;GACxBC,WAAWzB,MAAMyB,aAAaC,KAAAA;EAClC,CAAA;EAEA,OAAO7B,+BAA+B;GAClCiB;GACAC;EACJ,CAAA;CACJ;AACJ"}

package/dist/core/oauth2/helpers/error.d.ts

@@ -0,0 +1,8 @@
+import { OAuth2Error } from '@authup/specs';
+/**
+ * Transforms an unknown error to an OAuth2Error.
+ *
+ * @param err
+ */
+export declare function toOAuth2Error(err: unknown): OAuth2Error;
+//# sourceMappingURL=error.d.ts.map

package/dist/core/oauth2/helpers/error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/helpers/error.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,WAAW,EAAkC,MAAM,eAAe,CAAC;AAK5E;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,WAAW,CAgBvD"}

package/dist/core/oauth2/helpers/error.mjs

@@ -0,0 +1,26 @@
+import { sanitizeError } from "../../../utils/error.mjs";
+import "../../../utils/index.mjs";
+import { isAuthupError } from "@authup/errors";
+import { OAuth2Error, OAuth2ErrorCode, isOAuth2Error } from "@authup/specs";
+//#region src/core/oauth2/helpers/error.ts
+/**
+* Transforms an unknown error to an OAuth2Error.
+*
+* @param err
+*/ function toOAuth2Error(err) {
+	if (isOAuth2Error(err)) return err;
+	const source = isAuthupError(err) ? err : sanitizeError(err);
+	return new OAuth2Error({
+		message: source.message,
+		code: source.code,
+		data: {
+			error: OAuth2ErrorCode.INVALID_REQUEST,
+			error_description: source.message,
+			...source.data ?? {}
+		}
+	});
+}
+//#endregion
+export { toOAuth2Error };
+
+//# sourceMappingURL=error.mjs.map

package/dist/core/oauth2/helpers/error.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.mjs","names":["OAuth2Error","OAuth2ErrorCode","isOAuth2Error","isAuthupError","sanitizeError","toOAuth2Error","err","source","message","code","data","error","INVALID_REQUEST","error_description"],"sources":["../../../../src/core/oauth2/helpers/error.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { OAuth2Error, OAuth2ErrorCode, isOAuth2Error } from '@authup/specs';\nimport type { AuthupError } from '@authup/errors';\nimport { isAuthupError } from '@authup/errors';\nimport { sanitizeError } from '../../../utils/index.ts';\n\n/**\n * Transforms an unknown error to an OAuth2Error.\n *\n * @param err\n */\nexport function toOAuth2Error(err: unknown): OAuth2Error {\n    if (isOAuth2Error(err)) {\n        return err;\n    }\n\n    const source: AuthupError = isAuthupError(err) ? err : sanitizeError(err);\n\n    return new OAuth2Error({\n        message: source.message,\n        code: source.code,\n        data: {\n            error: OAuth2ErrorCode.INVALID_REQUEST,\n            error_description: source.message,\n            ...(source.data ?? {}),\n        },\n    });\n}\n"],"mappings":";;;;;;;;;GAiBA,SAAgBK,cAAcC,KAAY;CACtC,IAAIJ,cAAcI,GAAAA,GACd,OAAOA;CAGX,MAAMC,SAAsBJ,cAAcG,GAAAA,IAAOA,MAAMF,cAAcE,GAAAA;CAErE,OAAO,IAAIN,YAAY;EACnBQ,SAASD,OAAOC;EAChBC,MAAMF,OAAOE;EACbC,MAAM;GACFC,OAAOV,gBAAgBW;GACvBC,mBAAmBN,OAAOC;GAC1B,GAAID,OAAOG,QAAQ,CAAC;EACxB;CACJ,CAAA;AACJ"}

package/dist/core/oauth2/helpers/index.d.ts

@@ -1,2 +1,2 @@
-export * from './erorr.ts';
+export * from './error.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/helpers/index.mjs

@@ -1,2 +1,2 @@
-import { toOAuth2Error } from "./erorr.mjs";
+import { toOAuth2Error } from "./error.mjs";
 export { toOAuth2Error };

package/dist/core/oauth2/openid/claims.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"claims.mjs","names":["hasOwnProperty","OAuth2SubKind","OAuth2OpenIDClaimsBuilder","clientMap","name","nickname","preferred_username","updated_at","value","Math","floor","Date","getTime","robotMap","userMap","family_name","given_name","email","email_verified","fromIdentity","identity","type","CLIENT","fromClient","data","ROBOT","fromRobot","fromUser","input","extract","attributeMap","attributes","result","keys","Object","key_","attribute","key","transformer"],"sources":["../../../../src/core/oauth2/openid/claims.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Client, \n    Identity, \n    Robot, \n    User,\n} from '@authup/core-kit';\nimport { hasOwnProperty } from '@authup/kit';\nimport type { OpenIDTokenPayload } from '@authup/specs';\nimport { OAuth2SubKind } from '@authup/specs';\nimport type { ObjectLiteral } from 'validup';\n\ntype AttributeMapTuple<T> = {\n    [K in keyof T]: [K, (value: unknown) => any]\n}[keyof T];\n\ntype AttributeMap<T extends Record<string, any>> = Record<\n    keyof OpenIDTokenPayload,\nkeyof T | AttributeMapTuple<T>\n>;\n\nexport class OAuth2OpenIDClaimsBuilder {\n    protected clientMap : AttributeMap<Client> = {\n        name: 'name',\n        nickname: 'name',\n        preferred_username: 'name',\n        updated_at: [\n            'updated_at',\n            (value: unknown) => {\n                if (typeof value === 'string') {\n                    return Math.floor(new Date(value).getTime() / 1000);\n                }\n\n                if (value instanceof Date) {\n                    return Math.floor(value.getTime() / 1000);\n                }\n\n                return value;\n            },\n        ],\n    };\n\n    protected robotMap : AttributeMap<Robot> = {\n        name: 'name',\n        nickname: 'name',\n        preferred_username: 'name',\n        updated_at: [\n            'updated_at',\n            (value: unknown) => {\n                if (typeof value === 'string') {\n                    return Math.floor(new Date(value).getTime() / 1000);\n                }\n\n                if (value instanceof Date) {\n                    return Math.floor(value.getTime() / 1000);\n                }\n\n                return value;\n            },\n        ],\n    };\n\n    protected userMap : AttributeMap<User> = {\n        name: 'name',\n        family_name: 'last_name',\n        given_name: 'first_name',\n        nickname: 'display_name',\n        preferred_username: 'display_name',\n        updated_at: [\n            'updated_at',\n            (value: unknown) => {\n                if (typeof value === 'string') {\n                    return Math.floor(new Date(value).getTime() / 1000);\n                }\n\n                if (value instanceof Date) {\n                    return Math.floor(value.getTime() / 1000);\n                }\n\n                return value;\n            },\n        ],\n\n        email: 'email',\n        email_verified: 'active',\n    };\n\n    /**\n     * Build OpenID Claims form Oauth2 Identity.\n     *\n     * @param identity\n     */\n    fromIdentity(identity: Identity) : OpenIDTokenPayload {\n        if (identity.type === OAuth2SubKind.CLIENT) {\n            return this.fromClient(identity.data);\n        }\n\n        if (identity.type === OAuth2SubKind.ROBOT) {\n            return this.fromRobot(identity.data);\n        }\n\n        return this.fromUser(identity.data);\n    }\n\n    fromClient(input: Client) : OpenIDTokenPayload {\n        return this.extract(this.clientMap, input);\n    }\n\n    fromRobot(input: Robot): OpenIDTokenPayload {\n        return this.extract(this.robotMap, input);\n    }\n\n    fromUser(input: User) : OpenIDTokenPayload {\n        return this.extract(this.userMap, input);\n    }\n\n    protected extract<T extends ObjectLiteral = ObjectLiteral>(\n        attributeMap: AttributeMap<T>,\n        attributes: T,\n    ) : OpenIDTokenPayload {\n        const result = {} as OpenIDTokenPayload;\n\n        const keys = Object.keys(attributeMap);\n        for (const key_ of keys) {\n            const attribute = attributeMap[key_];\n            if (typeof attribute === 'string') {\n                if (hasOwnProperty(attributes, attribute)) {\n                    result[key_] = attributes[attribute];\n                }\n            } else {\n                const [key, transformer] = attribute as AttributeMapTuple<T>;\n\n                if (hasOwnProperty(attributes, key)) {\n                    result[key_] = transformer(attributes[key]);\n                }\n            }\n        }\n\n        return result;\n    }\n}\n"],"mappings":";;;AA2BA,IAAaE,4BAAb,MAAaA;CACCC,YAAmC;EACzCC,MAAM;EACNC,UAAU;EACVC,oBAAoB;EACpBC,YAAY,CACR,eACCC,UAAAA;AACG,OAAI,OAAOA,UAAU,SACjB,QAAOC,KAAKC,MAAM,IAAIC,KAAKH,MAAAA,CAAOI,SAAO,GAAK,IAAA;AAGlD,OAAIJ,iBAAiBG,KACjB,QAAOF,KAAKC,MAAMF,MAAMI,SAAO,GAAK,IAAA;AAGxC,UAAOJ;IAEd;EACL;CAEUK,WAAiC;EACvCT,MAAM;EACNC,UAAU;EACVC,oBAAoB;EACpBC,YAAY,CACR,eACCC,UAAAA;AACG,OAAI,OAAOA,UAAU,SACjB,QAAOC,KAAKC,MAAM,IAAIC,KAAKH,MAAAA,CAAOI,SAAO,GAAK,IAAA;AAGlD,OAAIJ,iBAAiBG,KACjB,QAAOF,KAAKC,MAAMF,MAAMI,SAAO,GAAK,IAAA;AAGxC,UAAOJ;IAEd;EACL;CAEUM,UAA+B;EACrCV,MAAM;EACNW,aAAa;EACbC,YAAY;EACZX,UAAU;EACVC,oBAAoB;EACpBC,YAAY,CACR,eACCC,UAAAA;AACG,OAAI,OAAOA,UAAU,SACjB,QAAOC,KAAKC,MAAM,IAAIC,KAAKH,MAAAA,CAAOI,SAAO,GAAK,IAAA;AAGlD,OAAIJ,iBAAiBG,KACjB,QAAOF,KAAKC,MAAMF,MAAMI,SAAO,GAAK,IAAA;AAGxC,UAAOJ;IAEd;EAEDS,OAAO;EACPC,gBAAgB;EACpB;;;;;IAOAC,aAAaC,UAAyC;AAClD,MAAIA,SAASC,SAASpB,cAAcqB,OAChC,QAAO,KAAKC,WAAWH,SAASI,KAAI;AAGxC,MAAIJ,SAASC,SAASpB,cAAcwB,MAChC,QAAO,KAAKC,UAAUN,SAASI,KAAI;AAGvC,SAAO,KAAKG,SAASP,SAASI,KAAI;;CAGtCD,WAAWK,OAAoC;AAC3C,SAAO,KAAKC,QAAQ,KAAK1B,WAAWyB,MAAAA;;CAGxCF,UAAUE,OAAkC;AACxC,SAAO,KAAKC,QAAQ,KAAKhB,UAAUe,MAAAA;;CAGvCD,SAASC,OAAkC;AACvC,SAAO,KAAKC,QAAQ,KAAKf,SAASc,MAAAA;;CAG5BC,QACNC,cACAC,YACmB;EACnB,MAAMC,SAAS,EAAC;EAEhB,MAAMC,OAAOC,OAAOD,KAAKH,aAAAA;AACzB,OAAK,MAAMK,QAAQF,MAAM;GACrB,MAAMG,YAAYN,aAAaK;AAC/B,OAAI,OAAOC,cAAc;QACjBpC,eAAe+B,YAAYK,UAAAA,CAC3BJ,QAAOG,QAAQJ,WAAWK;UAE3B;IACH,MAAM,CAACC,KAAKC,eAAeF;AAE3B,QAAIpC,eAAe+B,YAAYM,IAAAA,CAC3BL,QAAOG,QAAQG,YAAYP,WAAWM,KAAI;;;AAKtD,SAAOL"}
+{"version":3,"file":"claims.mjs","names":["hasOwnProperty","OAuth2SubKind","OAuth2OpenIDClaimsBuilder","clientMap","name","nickname","preferred_username","updated_at","value","Math","floor","Date","getTime","robotMap","userMap","family_name","given_name","email","email_verified","fromIdentity","identity","type","CLIENT","fromClient","data","ROBOT","fromRobot","fromUser","input","extract","attributeMap","attributes","result","keys","Object","key_","attribute","key","transformer"],"sources":["../../../../src/core/oauth2/openid/claims.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Client, \n    Identity, \n    Robot, \n    User,\n} from '@authup/core-kit';\nimport { hasOwnProperty } from '@authup/kit';\nimport type { OpenIDTokenPayload } from '@authup/specs';\nimport { OAuth2SubKind } from '@authup/specs';\nimport type { ObjectLiteral } from 'validup';\n\ntype AttributeMapTuple<T> = {\n    [K in keyof T]: [K, (value: unknown) => any]\n}[keyof T];\n\ntype AttributeMap<T extends Record<string, any>> = Record<\n    keyof OpenIDTokenPayload,\nkeyof T | AttributeMapTuple<T>\n>;\n\nexport class OAuth2OpenIDClaimsBuilder {\n    protected clientMap : AttributeMap<Client> = {\n        name: 'name',\n        nickname: 'name',\n        preferred_username: 'name',\n        updated_at: [\n            'updated_at',\n            (value: unknown) => {\n                if (typeof value === 'string') {\n                    return Math.floor(new Date(value).getTime() / 1000);\n                }\n\n                if (value instanceof Date) {\n                    return Math.floor(value.getTime() / 1000);\n                }\n\n                return value;\n            },\n        ],\n    };\n\n    protected robotMap : AttributeMap<Robot> = {\n        name: 'name',\n        nickname: 'name',\n        preferred_username: 'name',\n        updated_at: [\n            'updated_at',\n            (value: unknown) => {\n                if (typeof value === 'string') {\n                    return Math.floor(new Date(value).getTime() / 1000);\n                }\n\n                if (value instanceof Date) {\n                    return Math.floor(value.getTime() / 1000);\n                }\n\n                return value;\n            },\n        ],\n    };\n\n    protected userMap : AttributeMap<User> = {\n        name: 'name',\n        family_name: 'last_name',\n        given_name: 'first_name',\n        nickname: 'display_name',\n        preferred_username: 'display_name',\n        updated_at: [\n            'updated_at',\n            (value: unknown) => {\n                if (typeof value === 'string') {\n                    return Math.floor(new Date(value).getTime() / 1000);\n                }\n\n                if (value instanceof Date) {\n                    return Math.floor(value.getTime() / 1000);\n                }\n\n                return value;\n            },\n        ],\n\n        email: 'email',\n        email_verified: 'active',\n    };\n\n    /**\n     * Build OpenID Claims form Oauth2 Identity.\n     *\n     * @param identity\n     */\n    fromIdentity(identity: Identity) : OpenIDTokenPayload {\n        if (identity.type === OAuth2SubKind.CLIENT) {\n            return this.fromClient(identity.data);\n        }\n\n        if (identity.type === OAuth2SubKind.ROBOT) {\n            return this.fromRobot(identity.data);\n        }\n\n        return this.fromUser(identity.data);\n    }\n\n    fromClient(input: Client) : OpenIDTokenPayload {\n        return this.extract(this.clientMap, input);\n    }\n\n    fromRobot(input: Robot): OpenIDTokenPayload {\n        return this.extract(this.robotMap, input);\n    }\n\n    fromUser(input: User) : OpenIDTokenPayload {\n        return this.extract(this.userMap, input);\n    }\n\n    protected extract<T extends ObjectLiteral = ObjectLiteral>(\n        attributeMap: AttributeMap<T>,\n        attributes: T,\n    ) : OpenIDTokenPayload {\n        const result = {} as OpenIDTokenPayload;\n\n        const keys = Object.keys(attributeMap);\n        for (const key_ of keys) {\n            const attribute = attributeMap[key_];\n            if (typeof attribute === 'string') {\n                if (hasOwnProperty(attributes, attribute)) {\n                    result[key_] = attributes[attribute];\n                }\n            } else {\n                const [key, transformer] = attribute as AttributeMapTuple<T>;\n\n                if (hasOwnProperty(attributes, key)) {\n                    result[key_] = transformer(attributes[key]);\n                }\n            }\n        }\n\n        return result;\n    }\n}\n"],"mappings":";;;AA2BA,IAAaE,4BAAb,MAAaA;CACCC,YAAmC;EACzCC,MAAM;EACNC,UAAU;EACVC,oBAAoB;EACpBC,YAAY,CACR,eACCC,UAAAA;GACG,IAAI,OAAOA,UAAU,UACjB,OAAOC,KAAKC,MAAM,IAAIC,KAAKH,KAAAA,EAAOI,QAAO,IAAK,GAAA;GAGlD,IAAIJ,iBAAiBG,MACjB,OAAOF,KAAKC,MAAMF,MAAMI,QAAO,IAAK,GAAA;GAGxC,OAAOJ;EACX,CAAA;CAER;CAEUK,WAAiC;EACvCT,MAAM;EACNC,UAAU;EACVC,oBAAoB;EACpBC,YAAY,CACR,eACCC,UAAAA;GACG,IAAI,OAAOA,UAAU,UACjB,OAAOC,KAAKC,MAAM,IAAIC,KAAKH,KAAAA,EAAOI,QAAO,IAAK,GAAA;GAGlD,IAAIJ,iBAAiBG,MACjB,OAAOF,KAAKC,MAAMF,MAAMI,QAAO,IAAK,GAAA;GAGxC,OAAOJ;EACX,CAAA;CAER;CAEUM,UAA+B;EACrCV,MAAM;EACNW,aAAa;EACbC,YAAY;EACZX,UAAU;EACVC,oBAAoB;EACpBC,YAAY,CACR,eACCC,UAAAA;GACG,IAAI,OAAOA,UAAU,UACjB,OAAOC,KAAKC,MAAM,IAAIC,KAAKH,KAAAA,EAAOI,QAAO,IAAK,GAAA;GAGlD,IAAIJ,iBAAiBG,MACjB,OAAOF,KAAKC,MAAMF,MAAMI,QAAO,IAAK,GAAA;GAGxC,OAAOJ;EACX,CAAA;EAGJS,OAAO;EACPC,gBAAgB;CACpB;;;;;IAOAC,aAAaC,UAAyC;EAClD,IAAIA,SAASC,SAASpB,cAAcqB,QAChC,OAAO,KAAKC,WAAWH,SAASI,IAAI;EAGxC,IAAIJ,SAASC,SAASpB,cAAcwB,OAChC,OAAO,KAAKC,UAAUN,SAASI,IAAI;EAGvC,OAAO,KAAKG,SAASP,SAASI,IAAI;CACtC;CAEAD,WAAWK,OAAoC;EAC3C,OAAO,KAAKC,QAAQ,KAAK1B,WAAWyB,KAAAA;CACxC;CAEAF,UAAUE,OAAkC;EACxC,OAAO,KAAKC,QAAQ,KAAKhB,UAAUe,KAAAA;CACvC;CAEAD,SAASC,OAAkC;EACvC,OAAO,KAAKC,QAAQ,KAAKf,SAASc,KAAAA;CACtC;CAEUC,QACNC,cACAC,YACmB;EACnB,MAAMC,SAAS,CAAC;EAEhB,MAAMC,OAAOC,OAAOD,KAAKH,YAAAA;EACzB,KAAK,MAAMK,QAAQF,MAAM;GACrB,MAAMG,YAAYN,aAAaK;GAC/B,IAAI,OAAOC,cAAc;QACjBpC,eAAe+B,YAAYK,SAAAA,GAC3BJ,OAAOG,QAAQJ,WAAWK;GAAAA,OAE3B;IACH,MAAM,CAACC,KAAKC,eAAeF;IAE3B,IAAIpC,eAAe+B,YAAYM,GAAAA,GAC3BL,OAAOG,QAAQG,YAAYP,WAAWM,IAAI;GAElD;EACJ;EAEA,OAAOL;CACX;AACJ"}

package/dist/core/oauth2/response/bearer.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"bearer.mjs","names":["resolveExpiresIn","payload","fallbackValue","exp","Math","floor","Date","getTime","buildOAuth2BearerTokenResponse","context","response","access_token","accessToken","expires_in","accessTokenPayload","token_type","scope","refreshToken","refresh_token","refresh_token_expires_in","refreshTokenPayload","idToken","id_token"],"sources":["../../../../src/core/oauth2/response/bearer.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport type { OAuth2BearerResponseBuildContext } from './type.ts';\n\nfunction resolveExpiresIn(payload?: OAuth2TokenPayload, fallbackValue?: number) : number {\n    if (payload && payload.exp) {\n        return payload.exp - Math.floor(new Date().getTime() / 1000);\n    }\n\n    return fallbackValue || 3_600;\n}\n\nexport function buildOAuth2BearerTokenResponse(\n    context: OAuth2BearerResponseBuildContext,\n) : OAuth2TokenGrantResponse {\n    const response : OAuth2TokenGrantResponse = {\n        access_token: context.accessToken,\n        expires_in: resolveExpiresIn(context.accessTokenPayload),\n        token_type: 'Bearer',\n    };\n\n    if (context.accessTokenPayload) {\n        response.scope = context.accessTokenPayload.scope;\n    } else if (context.scope) {\n        response.scope = context.scope;\n    }\n\n    if (context.refreshToken) {\n        response.refresh_token = context.refreshToken;\n        response.refresh_token_expires_in = resolveExpiresIn(context.refreshTokenPayload);\n    }\n\n    if (context.idToken) {\n        response.id_token = context.idToken;\n    }\n\n    return response;\n}\n"],"mappings":";AAUA,SAASA,iBAAiBC,SAA8BC,eAAsB;AAC1E,KAAID,WAAWA,QAAQE,IACnB,QAAOF,QAAQE,MAAMC,KAAKC,uBAAM,IAAIC,MAAAA,EAAOC,SAAO,GAAK,IAAA;AAG3D,QAAOL,iBAAiB;;AAG5B,SAAgBM,+BACZC,SAAyC;CAEzC,MAAMC,WAAsC;EACxCC,cAAcF,QAAQG;EACtBC,YAAYb,iBAAiBS,QAAQK,mBAAkB;EACvDC,YAAY;EAChB;AAEA,KAAIN,QAAQK,mBACRJ,UAASM,QAAQP,QAAQK,mBAAmBE;UACrCP,QAAQO,MACfN,UAASM,QAAQP,QAAQO;AAG7B,KAAIP,QAAQQ,cAAc;AACtBP,WAASQ,gBAAgBT,QAAQQ;AACjCP,WAASS,2BAA2BnB,iBAAiBS,QAAQW,oBAAmB;;AAGpF,KAAIX,QAAQY,QACRX,UAASY,WAAWb,QAAQY;AAGhC,QAAOX"}
+{"version":3,"file":"bearer.mjs","names":["resolveExpiresIn","payload","fallbackValue","exp","Math","floor","Date","getTime","buildOAuth2BearerTokenResponse","context","response","access_token","accessToken","expires_in","accessTokenPayload","token_type","scope","refreshToken","refresh_token","refresh_token_expires_in","refreshTokenPayload","idToken","id_token"],"sources":["../../../../src/core/oauth2/response/bearer.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport type { OAuth2BearerResponseBuildContext } from './type.ts';\n\nfunction resolveExpiresIn(payload?: OAuth2TokenPayload, fallbackValue?: number) : number {\n    if (payload && payload.exp) {\n        return payload.exp - Math.floor(new Date().getTime() / 1000);\n    }\n\n    return fallbackValue || 3_600;\n}\n\nexport function buildOAuth2BearerTokenResponse(\n    context: OAuth2BearerResponseBuildContext,\n) : OAuth2TokenGrantResponse {\n    const response : OAuth2TokenGrantResponse = {\n        access_token: context.accessToken,\n        expires_in: resolveExpiresIn(context.accessTokenPayload),\n        token_type: 'Bearer',\n    };\n\n    if (context.accessTokenPayload) {\n        response.scope = context.accessTokenPayload.scope;\n    } else if (context.scope) {\n        response.scope = context.scope;\n    }\n\n    if (context.refreshToken) {\n        response.refresh_token = context.refreshToken;\n        response.refresh_token_expires_in = resolveExpiresIn(context.refreshTokenPayload);\n    }\n\n    if (context.idToken) {\n        response.id_token = context.idToken;\n    }\n\n    return response;\n}\n"],"mappings":";AAUA,SAASA,iBAAiBC,SAA8BC,eAAsB;CAC1E,IAAID,WAAWA,QAAQE,KACnB,OAAOF,QAAQE,MAAMC,KAAKC,uBAAM,IAAIC,KAAAA,GAAOC,QAAO,IAAK,GAAA;CAG3D,OAAOL,iBAAiB;AAC5B;AAEA,SAAgBM,+BACZC,SAAyC;CAEzC,MAAMC,WAAsC;EACxCC,cAAcF,QAAQG;EACtBC,YAAYb,iBAAiBS,QAAQK,kBAAkB;EACvDC,YAAY;CAChB;CAEA,IAAIN,QAAQK,oBACRJ,SAASM,QAAQP,QAAQK,mBAAmBE;MACzC,IAAIP,QAAQO,OACfN,SAASM,QAAQP,QAAQO;CAG7B,IAAIP,QAAQQ,cAAc;EACtBP,SAASQ,gBAAgBT,QAAQQ;EACjCP,SAASS,2BAA2BnB,iBAAiBS,QAAQW,mBAAmB;CACpF;CAEA,IAAIX,QAAQY,SACRX,SAASY,WAAWb,QAAQY;CAGhC,OAAOX;AACX"}

package/dist/core/oauth2/scope/resolver.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"resolver.mjs","names":["ScopeName","hasOwnProperty","OAuth2SubKind","unwrapOAuth2Scope","distinctArray","OAuth2ScopeAttributesResolver","clientAttributes","IDENTITY","OPEN_ID","robotAttributes","userAttributes","EMAIL","resolveFor","type","scope","CLIENT","resolveForClient","ROBOT","resolveForRobot","resolveForUser","attributes","scopes","push","GLOBAL","Object","values","flat"],"sources":["../../../../src/core/oauth2/scope/resolver.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Client, Robot, User } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport { hasOwnProperty } from '@authup/kit';\nimport { OAuth2SubKind, unwrapOAuth2Scope } from '@authup/specs';\nimport { distinctArray } from 'smob';\nimport type { ObjectLiteral } from 'validup';\n\ntype ScopeFields<T extends ObjectLiteral = ObjectLiteral> = {\n    [key: string]: (keyof T & string)[]\n};\n\nexport class OAuth2ScopeAttributesResolver {\n    protected clientAttributes : ScopeFields<Client> = {\n        [ScopeName.IDENTITY]: ['name'],\n        [ScopeName.OPEN_ID]: ['name', 'display_name', 'updated_at', 'active'],\n    };\n\n    protected robotAttributes : ScopeFields<Robot> = {\n        [ScopeName.IDENTITY]: ['name'],\n        [ScopeName.OPEN_ID]: ['name', 'display_name', 'updated_at', 'active'],\n    };\n\n    protected userAttributes : ScopeFields<User> = {\n        [ScopeName.IDENTITY]: ['name', 'display_name', 'last_name', 'first_name'],\n        [ScopeName.EMAIL]: ['email'],\n        [ScopeName.OPEN_ID]: ['name', 'updated_at', 'first_name', 'last_name', 'display_name', 'active', 'email'],\n    };\n\n    /**\n     * Resolve attributes for sub kind.\n     *\n     * @param type\n     * @param scope\n     */\n    resolveFor(type: OAuth2SubKind, scope: string | string[]) {\n        if (type === OAuth2SubKind.CLIENT) {\n            return this.resolveForClient(scope);\n        }\n\n        if (type === OAuth2SubKind.ROBOT) {\n            return this.resolveForRobot(scope);\n        }\n\n        return this.resolveForUser(scope);\n    }\n\n    resolveForClient(scope: string | string[]) : string[] {\n        const attributes : string[] = [];\n        const scopes = unwrapOAuth2Scope(scope);\n\n        for (const scope of scopes) {\n            if (hasOwnProperty(this.clientAttributes, scope)) {\n                attributes.push(...this.clientAttributes[scope]);\n            }\n\n            if (scope === ScopeName.GLOBAL) {\n                attributes.push(...Object.values(this.clientAttributes).flat());\n                break;\n            }\n        }\n\n        return distinctArray(attributes);\n    }\n\n    resolveForRobot(scope: string | string[]) : string[] {\n        const attributes : string[] = [];\n        const scopes = unwrapOAuth2Scope(scope);\n\n        for (const scope of scopes) {\n            if (hasOwnProperty(this.robotAttributes, scope)) {\n                attributes.push(...this.robotAttributes[scope]);\n            }\n\n            if (scope === ScopeName.GLOBAL) {\n                attributes.push(...Object.values(this.robotAttributes).flat());\n                break;\n            }\n        }\n\n        return distinctArray(attributes);\n    }\n\n    resolveForUser(scope: string | string[]) : string[] {\n        const attributes : string[] = [];\n        const scopes = unwrapOAuth2Scope(scope);\n\n        for (const scope of scopes) {\n            if (hasOwnProperty(this.userAttributes, scope)) {\n                attributes.push(...this.userAttributes[scope]);\n            }\n\n            if (scope === ScopeName.GLOBAL) {\n                attributes.push(...Object.values(this.userAttributes).flat());\n                break;\n            }\n        }\n\n        return distinctArray(attributes);\n    }\n}\n"],"mappings":";;;;;AAkBA,IAAaK,gCAAb,MAAaA;CACCC,mBAAyC;GAC9CN,UAAUO,WAAW,CAAC,OAAO;GAC7BP,UAAUQ,UAAU;GAAC;GAAQ;GAAgB;GAAc;GAAS;EACzE;CAEUC,kBAAuC;GAC5CT,UAAUO,WAAW,CAAC,OAAO;GAC7BP,UAAUQ,UAAU;GAAC;GAAQ;GAAgB;GAAc;GAAS;EACzE;CAEUE,iBAAqC;GAC1CV,UAAUO,WAAW;GAAC;GAAQ;GAAgB;GAAa;GAAa;GACxEP,UAAUW,QAAQ,CAAC,QAAQ;GAC3BX,UAAUQ,UAAU;GAAC;GAAQ;GAAc;GAAc;GAAa;GAAgB;GAAU;GAAQ;EAC7G;;;;;;IAQAI,WAAWC,MAAqBC,OAA0B;AACtD,MAAID,SAASX,cAAca,OACvB,QAAO,KAAKC,iBAAiBF,MAAAA;AAGjC,MAAID,SAASX,cAAce,MACvB,QAAO,KAAKC,gBAAgBJ,MAAAA;AAGhC,SAAO,KAAKK,eAAeL,MAAAA;;CAG/BE,iBAAiBF,OAAqC;EAClD,MAAMM,aAAwB,EAAE;EAChC,MAAMC,SAASlB,kBAAkBW,MAAAA;AAEjC,OAAK,MAAMA,SAASO,QAAQ;AACxB,OAAIpB,eAAe,KAAKK,kBAAkBQ,MAAAA,CACtCM,YAAWE,KAAI,GAAI,KAAKhB,iBAAiBQ,OAAM;AAGnD,OAAIA,UAAUd,UAAUuB,QAAQ;AAC5BH,eAAWE,KAAI,GAAIE,OAAOC,OAAO,KAAKnB,iBAAgB,CAAEoB,MAAI,CAAA;AAC5D;;;AAIR,SAAOtB,cAAcgB,WAAAA;;CAGzBF,gBAAgBJ,OAAqC;EACjD,MAAMM,aAAwB,EAAE;EAChC,MAAMC,SAASlB,kBAAkBW,MAAAA;AAEjC,OAAK,MAAMA,SAASO,QAAQ;AACxB,OAAIpB,eAAe,KAAKQ,iBAAiBK,MAAAA,CACrCM,YAAWE,KAAI,GAAI,KAAKb,gBAAgBK,OAAM;AAGlD,OAAIA,UAAUd,UAAUuB,QAAQ;AAC5BH,eAAWE,KAAI,GAAIE,OAAOC,OAAO,KAAKhB,gBAAe,CAAEiB,MAAI,CAAA;AAC3D;;;AAIR,SAAOtB,cAAcgB,WAAAA;;CAGzBD,eAAeL,OAAqC;EAChD,MAAMM,aAAwB,EAAE;EAChC,MAAMC,SAASlB,kBAAkBW,MAAAA;AAEjC,OAAK,MAAMA,SAASO,QAAQ;AACxB,OAAIpB,eAAe,KAAKS,gBAAgBI,MAAAA,CACpCM,YAAWE,KAAI,GAAI,KAAKZ,eAAeI,OAAM;AAGjD,OAAIA,UAAUd,UAAUuB,QAAQ;AAC5BH,eAAWE,KAAI,GAAIE,OAAOC,OAAO,KAAKf,eAAc,CAAEgB,MAAI,CAAA;AAC1D;;;AAIR,SAAOtB,cAAcgB,WAAAA"}
+{"version":3,"file":"resolver.mjs","names":["ScopeName","hasOwnProperty","OAuth2SubKind","unwrapOAuth2Scope","distinctArray","OAuth2ScopeAttributesResolver","clientAttributes","IDENTITY","OPEN_ID","robotAttributes","userAttributes","EMAIL","resolveFor","type","scope","CLIENT","resolveForClient","ROBOT","resolveForRobot","resolveForUser","attributes","scopes","push","GLOBAL","Object","values","flat"],"sources":["../../../../src/core/oauth2/scope/resolver.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Client, Robot, User } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport { hasOwnProperty } from '@authup/kit';\nimport { OAuth2SubKind, unwrapOAuth2Scope } from '@authup/specs';\nimport { distinctArray } from 'smob';\nimport type { ObjectLiteral } from 'validup';\n\ntype ScopeFields<T extends ObjectLiteral = ObjectLiteral> = {\n    [key: string]: (keyof T & string)[]\n};\n\nexport class OAuth2ScopeAttributesResolver {\n    protected clientAttributes : ScopeFields<Client> = {\n        [ScopeName.IDENTITY]: ['name'],\n        [ScopeName.OPEN_ID]: ['name', 'display_name', 'updated_at', 'active'],\n    };\n\n    protected robotAttributes : ScopeFields<Robot> = {\n        [ScopeName.IDENTITY]: ['name'],\n        [ScopeName.OPEN_ID]: ['name', 'display_name', 'updated_at', 'active'],\n    };\n\n    protected userAttributes : ScopeFields<User> = {\n        [ScopeName.IDENTITY]: ['name', 'display_name', 'last_name', 'first_name'],\n        [ScopeName.EMAIL]: ['email'],\n        [ScopeName.OPEN_ID]: ['name', 'updated_at', 'first_name', 'last_name', 'display_name', 'active', 'email'],\n    };\n\n    /**\n     * Resolve attributes for sub kind.\n     *\n     * @param type\n     * @param scope\n     */\n    resolveFor(type: OAuth2SubKind, scope: string | string[]) {\n        if (type === OAuth2SubKind.CLIENT) {\n            return this.resolveForClient(scope);\n        }\n\n        if (type === OAuth2SubKind.ROBOT) {\n            return this.resolveForRobot(scope);\n        }\n\n        return this.resolveForUser(scope);\n    }\n\n    resolveForClient(scope: string | string[]) : string[] {\n        const attributes : string[] = [];\n        const scopes = unwrapOAuth2Scope(scope);\n\n        for (const scope of scopes) {\n            if (hasOwnProperty(this.clientAttributes, scope)) {\n                attributes.push(...this.clientAttributes[scope]);\n            }\n\n            if (scope === ScopeName.GLOBAL) {\n                attributes.push(...Object.values(this.clientAttributes).flat());\n                break;\n            }\n        }\n\n        return distinctArray(attributes);\n    }\n\n    resolveForRobot(scope: string | string[]) : string[] {\n        const attributes : string[] = [];\n        const scopes = unwrapOAuth2Scope(scope);\n\n        for (const scope of scopes) {\n            if (hasOwnProperty(this.robotAttributes, scope)) {\n                attributes.push(...this.robotAttributes[scope]);\n            }\n\n            if (scope === ScopeName.GLOBAL) {\n                attributes.push(...Object.values(this.robotAttributes).flat());\n                break;\n            }\n        }\n\n        return distinctArray(attributes);\n    }\n\n    resolveForUser(scope: string | string[]) : string[] {\n        const attributes : string[] = [];\n        const scopes = unwrapOAuth2Scope(scope);\n\n        for (const scope of scopes) {\n            if (hasOwnProperty(this.userAttributes, scope)) {\n                attributes.push(...this.userAttributes[scope]);\n            }\n\n            if (scope === ScopeName.GLOBAL) {\n                attributes.push(...Object.values(this.userAttributes).flat());\n                break;\n            }\n        }\n\n        return distinctArray(attributes);\n    }\n}\n"],"mappings":";;;;;AAkBA,IAAaK,gCAAb,MAAaA;CACCC,mBAAyC;GAC9CN,UAAUO,WAAW,CAAC,MAAA;GACtBP,UAAUQ,UAAU;GAAC;GAAQ;GAAgB;GAAc;;CAChE;CAEUC,kBAAuC;GAC5CT,UAAUO,WAAW,CAAC,MAAA;GACtBP,UAAUQ,UAAU;GAAC;GAAQ;GAAgB;GAAc;;CAChE;CAEUE,iBAAqC;GAC1CV,UAAUO,WAAW;GAAC;GAAQ;GAAgB;GAAa;;GAC3DP,UAAUW,QAAQ,CAAC,OAAA;GACnBX,UAAUQ,UAAU;GAAC;GAAQ;GAAc;GAAc;GAAa;GAAgB;GAAU;;CACrG;;;;;;IAQAI,WAAWC,MAAqBC,OAA0B;EACtD,IAAID,SAASX,cAAca,QACvB,OAAO,KAAKC,iBAAiBF,KAAAA;EAGjC,IAAID,SAASX,cAAce,OACvB,OAAO,KAAKC,gBAAgBJ,KAAAA;EAGhC,OAAO,KAAKK,eAAeL,KAAAA;CAC/B;CAEAE,iBAAiBF,OAAqC;EAClD,MAAMM,aAAwB,CAAA;EAC9B,MAAMC,SAASlB,kBAAkBW,KAAAA;EAEjC,KAAK,MAAMA,SAASO,QAAQ;GACxB,IAAIpB,eAAe,KAAKK,kBAAkBQ,KAAAA,GACtCM,WAAWE,KAAI,GAAI,KAAKhB,iBAAiBQ,MAAM;GAGnD,IAAIA,UAAUd,UAAUuB,QAAQ;IAC5BH,WAAWE,KAAI,GAAIE,OAAOC,OAAO,KAAKnB,gBAAgB,EAAEoB,KAAI,CAAA;IAC5D;GACJ;EACJ;EAEA,OAAOtB,cAAcgB,UAAAA;CACzB;CAEAF,gBAAgBJ,OAAqC;EACjD,MAAMM,aAAwB,CAAA;EAC9B,MAAMC,SAASlB,kBAAkBW,KAAAA;EAEjC,KAAK,MAAMA,SAASO,QAAQ;GACxB,IAAIpB,eAAe,KAAKQ,iBAAiBK,KAAAA,GACrCM,WAAWE,KAAI,GAAI,KAAKb,gBAAgBK,MAAM;GAGlD,IAAIA,UAAUd,UAAUuB,QAAQ;IAC5BH,WAAWE,KAAI,GAAIE,OAAOC,OAAO,KAAKhB,eAAe,EAAEiB,KAAI,CAAA;IAC3D;GACJ;EACJ;EAEA,OAAOtB,cAAcgB,UAAAA;CACzB;CAEAD,eAAeL,OAAqC;EAChD,MAAMM,aAAwB,CAAA;EAC9B,MAAMC,SAASlB,kBAAkBW,KAAAA;EAEjC,KAAK,MAAMA,SAASO,QAAQ;GACxB,IAAIpB,eAAe,KAAKS,gBAAgBI,KAAAA,GACpCM,WAAWE,KAAI,GAAI,KAAKZ,eAAeI,MAAM;GAGjD,IAAIA,UAAUd,UAAUuB,QAAQ;IAC5BH,WAAWE,KAAI,GAAIE,OAAOC,OAAO,KAAKf,cAAc,EAAEgB,KAAI,CAAA;IAC1D;GACJ;EACJ;EAEA,OAAOtB,cAAcgB,UAAAA;CACzB;AACJ"}