@authup/server-core 1.0.0-beta.41 → 1.0.0-beta.44

package/dist/core/identity/registration/service.mjs

@@ -1,7 +1,11 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 import { UserCredentialsService } from "../../authentication/credential/entities/user/module.mjs";
+import { RegistrationDisabledError } from "./error.mjs";
 import { UserValidator } from "@authup/core-kit";
 import { createNanoID } from "@authup/kit";
-import { BadRequestError, NotFoundError } from "@ebec/http";
+import { BadRequestError, EntityNotFoundError } from "@authup/errors";
 import { Container } from "validup";
 import { randomBytes } from "node:crypto";
 //#region src/core/identity/registration/service.ts
@@ -17,7 +21,7 @@ var RegistrationService = class {
 		this.realmRepository = ctx.realmRepository;
 	}
 	async register(data) {
-		if (!this.options.registrationEnabled) throw new BadRequestError("User registration is not enabled.");
+		if (!this.options.registrationEnabled) throw new RegistrationDisabledError();
 		const validator = new Container({});
 		validator.mount(new UserValidator({ pathsToInclude: [
 			"email",
@@ -54,7 +58,7 @@ var RegistrationService = class {
 	}
 	async activate(data) {
 		const entity = await this.repository.findOneBy({ activate_hash: data.token });
-		if (!entity) throw new NotFoundError();
+		if (!entity) throw new EntityNotFoundError();
 		const merged = this.repository.merge(entity, {
 			active: true,
 			activate_hash: null

package/dist/core/identity/registration/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["UserValidator","createNanoID","BadRequestError","NotFoundError","randomBytes","Container","UserCredentialsService","RegistrationService","options","mailClient","repository","realmRepository","ctx","register","data","registrationEnabled","validator","mount","pathsToInclude","validated","run","group","validateJoinColumns","emailVerificationEnabled","active","activate_hash","toString","entity","create","credentialsService","password","protect","realm","resolve","realm_id","id","save","send","to","email","subject","html","remove","activate","findOneBy","token","merged","merge"],"sources":["../../../../src/core/identity/registration/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { UserValidator } from '@authup/core-kit';\nimport { createNanoID } from '@authup/kit';\nimport { BadRequestError, NotFoundError } from '@ebec/http';\nimport { randomBytes } from 'node:crypto';\nimport { Container } from 'validup';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type {\n    IRegistrationService,\n    RegistrationResult,\n    RegistrationServiceContext,\n    RegistrationServiceOptions,\n} from './types.ts';\nimport type { IMailClient } from '../../mail/types.ts';\nimport type { IRealmRepository, IUserRepository } from '../../entities/index.ts';\n\nexport class RegistrationService implements IRegistrationService {\n    protected options: RegistrationServiceOptions;\n\n    protected mailClient: IMailClient;\n\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    constructor(ctx: RegistrationServiceContext) {\n        this.options = ctx.options;\n        this.mailClient = ctx.mailClient;\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n    }\n\n    async register(data: Record<string, any>): Promise<RegistrationResult> {\n        if (!this.options.registrationEnabled) {\n            throw new BadRequestError('User registration is not enabled.');\n        }\n\n        const validator = new Container({});\n        validator.mount(new UserValidator({ pathsToInclude: ['email', 'name', 'password', 'realm_id'] }));\n        const validated = await validator.run(data, { group: 'create' });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (this.options.emailVerificationEnabled) {\n            validated.active = false;\n            validated.activate_hash = randomBytes(32).toString('hex');\n        } else {\n            validated.active = true;\n        }\n\n        const entity = this.repository.create(validated);\n\n        const credentialsService = new UserCredentialsService();\n        entity.password = entity.password || createNanoID(64);\n        entity.password = await credentialsService.protect(entity.password);\n\n        const realm = await this.realmRepository.resolve(entity.realm_id, true);\n        entity.realm_id = realm.id;\n\n        await this.repository.save(entity);\n\n        if (this.options.emailVerificationEnabled) {\n            try {\n                await this.mailClient.send({\n                    to: entity.email,\n                    subject: 'Registration - Activation code',\n                    html: `\n                    <p>Please use the code below to activate your account and start using the site.</p>\n                    <p>${entity.activate_hash}</p>\n                    `,\n                });\n            } catch {\n                await this.repository.remove(entity);\n                throw new BadRequestError('Registration failed. Could not send activation email.');\n            }\n        }\n\n        return { active: entity.active };\n    }\n\n    async activate(data: { token: string }): Promise<void> {\n        const entity = await this.repository.findOneBy({ activate_hash: data.token });\n\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        const merged = this.repository.merge(entity, {\n            active: true,\n            activate_hash: null,\n        });\n\n        await this.repository.save(merged);\n    }\n}\n"],"mappings":";;;;;;;AAsBA,IAAaO,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAiC;AACzC,OAAKJ,UAAUI,IAAIJ;AACnB,OAAKC,aAAaG,IAAIH;AACtB,OAAKC,aAAaE,IAAIF;AACtB,OAAKC,kBAAkBC,IAAID;;CAG/B,MAAME,SAASC,MAAwD;AACnE,MAAI,CAAC,KAAKN,QAAQO,oBACd,OAAM,IAAIb,gBAAgB,oCAAA;EAG9B,MAAMc,YAAY,IAAIX,UAAU,EAAC,CAAA;AACjCW,YAAUC,MAAM,IAAIjB,cAAc,EAAEkB,gBAAgB;GAAC;GAAS;GAAQ;GAAY;GAAW,EAAC,CAAA,CAAA;EAC9F,MAAMC,YAAY,MAAMH,UAAUI,IAAIN,MAAM,EAAEO,OAAO,UAAS,CAAA;AAE9D,QAAM,KAAKX,WAAWY,oBAAoBH,UAAAA;AAE1C,MAAI,KAAKX,QAAQe,0BAA0B;AACvCJ,aAAUK,SAAS;AACnBL,aAAUM,gBAAgBrB,YAAY,GAAA,CAAIsB,SAAS,MAAA;QAEnDP,WAAUK,SAAS;EAGvB,MAAMG,SAAS,KAAKjB,WAAWkB,OAAOT,UAAAA;EAEtC,MAAMU,qBAAqB,IAAIvB,wBAAAA;AAC/BqB,SAAOG,WAAWH,OAAOG,YAAY7B,aAAa,GAAA;AAClD0B,SAAOG,WAAW,MAAMD,mBAAmBE,QAAQJ,OAAOG,SAAQ;AAGlEH,SAAOO,YAAWF,MADE,KAAKrB,gBAAgBsB,QAAQN,OAAOO,UAAU,KAAA,EAC1CC;AAExB,QAAM,KAAKzB,WAAW0B,KAAKT,OAAAA;AAE3B,MAAI,KAAKnB,QAAQe,yBACb,KAAI;AACA,SAAM,KAAKd,WAAW4B,KAAK;IACvBC,IAAIX,OAAOY;IACXC,SAAS;IACTC,MAAM;;yBAEDd,OAAOF,cAAc;;IAE9B,CAAA;UACI;AACJ,SAAM,KAAKf,WAAWgC,OAAOf,OAAAA;AAC7B,SAAM,IAAIzB,gBAAgB,wDAAA;;AAIlC,SAAO,EAAEsB,QAAQG,OAAOH,QAAO;;CAGnC,MAAMmB,SAAS7B,MAAwC;EACnD,MAAMa,SAAS,MAAM,KAAKjB,WAAWkC,UAAU,EAAEnB,eAAeX,KAAK+B,OAAM,CAAA;AAE3E,MAAI,CAAClB,OACD,OAAM,IAAIxB,eAAAA;EAGd,MAAM2C,SAAS,KAAKpC,WAAWqC,MAAMpB,QAAQ;GACzCH,QAAQ;GACRC,eAAe;GACnB,CAAA;AAEA,QAAM,KAAKf,WAAW0B,KAAKU,OAAAA"}
+{"version":3,"file":"service.mjs","names":["UserValidator","createNanoID","BadRequestError","EntityNotFoundError","RegistrationDisabledError","randomBytes","Container","UserCredentialsService","RegistrationService","options","mailClient","repository","realmRepository","ctx","register","data","registrationEnabled","validator","mount","pathsToInclude","validated","run","group","validateJoinColumns","emailVerificationEnabled","active","activate_hash","toString","entity","create","credentialsService","password","protect","realm","resolve","realm_id","id","save","send","to","email","subject","html","remove","activate","findOneBy","token","merged","merge"],"sources":["../../../../src/core/identity/registration/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { UserValidator } from '@authup/core-kit';\nimport { createNanoID } from '@authup/kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport { RegistrationDisabledError } from './error.ts';\nimport { randomBytes } from 'node:crypto';\nimport { Container } from 'validup';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type {\n    IRegistrationService,\n    RegistrationResult,\n    RegistrationServiceContext,\n    RegistrationServiceOptions,\n} from './types.ts';\nimport type { IMailClient } from '../../mail/types.ts';\nimport type { IRealmRepository, IUserRepository } from '../../entities/index.ts';\n\nexport class RegistrationService implements IRegistrationService {\n    protected options: RegistrationServiceOptions;\n\n    protected mailClient: IMailClient;\n\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    constructor(ctx: RegistrationServiceContext) {\n        this.options = ctx.options;\n        this.mailClient = ctx.mailClient;\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n    }\n\n    async register(data: Record<string, any>): Promise<RegistrationResult> {\n        if (!this.options.registrationEnabled) {\n            throw new RegistrationDisabledError();\n        }\n\n        const validator = new Container({});\n        validator.mount(new UserValidator({ pathsToInclude: ['email', 'name', 'password', 'realm_id'] }));\n        const validated = await validator.run(data, { group: 'create' });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (this.options.emailVerificationEnabled) {\n            validated.active = false;\n            validated.activate_hash = randomBytes(32).toString('hex');\n        } else {\n            validated.active = true;\n        }\n\n        const entity = this.repository.create(validated);\n\n        const credentialsService = new UserCredentialsService();\n        entity.password = entity.password || createNanoID(64);\n        entity.password = await credentialsService.protect(entity.password);\n\n        const realm = await this.realmRepository.resolve(entity.realm_id, true);\n        entity.realm_id = realm.id;\n\n        await this.repository.save(entity);\n\n        if (this.options.emailVerificationEnabled) {\n            try {\n                await this.mailClient.send({\n                    to: entity.email,\n                    subject: 'Registration - Activation code',\n                    html: `\n                    <p>Please use the code below to activate your account and start using the site.</p>\n                    <p>${entity.activate_hash}</p>\n                    `,\n                });\n            } catch {\n                await this.repository.remove(entity);\n                throw new BadRequestError('Registration failed. Could not send activation email.');\n            }\n        }\n\n        return { active: entity.active };\n    }\n\n    async activate(data: { token: string }): Promise<void> {\n        const entity = await this.repository.findOneBy({ activate_hash: data.token });\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const merged = this.repository.merge(entity, {\n            active: true,\n            activate_hash: null,\n        });\n\n        await this.repository.save(merged);\n    }\n}\n"],"mappings":";;;;;;;;;;;AAuBA,IAAaQ,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAiC;EACzC,KAAKJ,UAAUI,IAAIJ;EACnB,KAAKC,aAAaG,IAAIH;EACtB,KAAKC,aAAaE,IAAIF;EACtB,KAAKC,kBAAkBC,IAAID;CAC/B;CAEA,MAAME,SAASC,MAAwD;EACnE,IAAI,CAAC,KAAKN,QAAQO,qBACd,MAAM,IAAIZ,0BAAAA;EAGd,MAAMa,YAAY,IAAIX,UAAU,CAAC,CAAA;EACjCW,UAAUC,MAAM,IAAIlB,cAAc,EAAEmB,gBAAgB;GAAC;GAAS;GAAQ;GAAY;IAAY,CAAA,CAAA;EAC9F,MAAMC,YAAY,MAAMH,UAAUI,IAAIN,MAAM,EAAEO,OAAO,SAAS,CAAA;EAE9D,MAAM,KAAKX,WAAWY,oBAAoBH,SAAAA;EAE1C,IAAI,KAAKX,QAAQe,0BAA0B;GACvCJ,UAAUK,SAAS;GACnBL,UAAUM,gBAAgBrB,YAAY,EAAA,CAAA,CAAIsB,SAAS,KAAA;EACvD,OACIP,UAAUK,SAAS;EAGvB,MAAMG,SAAS,KAAKjB,WAAWkB,OAAOT,SAAAA;EAEtC,MAAMU,qBAAqB,IAAIvB,uBAAAA;EAC/BqB,OAAOG,WAAWH,OAAOG,YAAY9B,aAAa,EAAA;EAClD2B,OAAOG,WAAW,MAAMD,mBAAmBE,QAAQJ,OAAOG,QAAQ;EAGlEH,OAAOO,YAAWF,MADE,KAAKrB,gBAAgBsB,QAAQN,OAAOO,UAAU,IAAA,EAAA,CAC1CC;EAExB,MAAM,KAAKzB,WAAW0B,KAAKT,MAAAA;EAE3B,IAAI,KAAKnB,QAAQe,0BACb,IAAI;GACA,MAAM,KAAKd,WAAW4B,KAAK;IACvBC,IAAIX,OAAOY;IACXC,SAAS;IACTC,MAAM;;yBAEDd,OAAOF,cAAc;;GAE9B,CAAA;EACJ,QAAQ;GACJ,MAAM,KAAKf,WAAWgC,OAAOf,MAAAA;GAC7B,MAAM,IAAI1B,gBAAgB,uDAAA;EAC9B;EAGJ,OAAO,EAAEuB,QAAQG,OAAOH,OAAO;CACnC;CAEA,MAAMmB,SAAS7B,MAAwC;EACnD,MAAMa,SAAS,MAAM,KAAKjB,WAAWkC,UAAU,EAAEnB,eAAeX,KAAK+B,MAAM,CAAA;EAE3E,IAAI,CAAClB,QACD,MAAM,IAAIzB,oBAAAA;EAGd,MAAM4C,SAAS,KAAKpC,WAAWqC,MAAMpB,QAAQ;GACzCH,QAAQ;GACRC,eAAe;EACnB,CAAA;EAEA,MAAM,KAAKf,WAAW0B,KAAKU,MAAAA;CAC/B;AACJ"}

package/dist/core/identity/registration/types.mjs

@@ -1 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 export {};

package/dist/core/identity/resolver/entities/ldap/module.mjs

@@ -1,3 +1,6 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 //#region src/core/identity/resolver/entities/ldap/module.ts
 var LdapIdentityResolver = class {
 	repository;

package/dist/core/identity/resolver/entities/ldap/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["LdapIdentityResolver","repository"],"sources":["../../../../../../src/core/identity/resolver/entities/ldap/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IIdentityProviderRepository } from '../../../../entities/index.ts';\n\nexport class LdapIdentityResolver {\n    protected repository : IIdentityProviderRepository;\n}\n"],"mappings":";AASA,IAAaA,uBAAb,MAAaA;CACCC"}
+{"version":3,"file":"module.mjs","names":["LdapIdentityResolver","repository"],"sources":["../../../../../../src/core/identity/resolver/entities/ldap/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IIdentityProviderRepository } from '../../../../entities/index.ts';\n\nexport class LdapIdentityResolver {\n    protected repository : IIdentityProviderRepository;\n}\n"],"mappings":";;;;AASA,IAAaA,uBAAb,MAAaA;CACCC;AACd"}

package/dist/core/identity/resolver/index.mjs

@@ -1,2 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 import { IdentityResolver } from "./module.mjs";
 export { IdentityResolver };

package/dist/core/identity/resolver/module.mjs

@@ -1,3 +1,6 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 import { IdentityType } from "@authup/core-kit";
 import { isUUID } from "@authup/kit";
 //#region src/core/identity/resolver/module.ts

package/dist/core/identity/resolver/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["IdentityType","isUUID","IdentityResolver","clientRepository","userRepository","robotRepository","ctx","resolve","type","key","realmKey","CLIENT","resolveClient","ROBOT","resolveRobot","USER","resolveUser","data","findOneById","findOneByName"],"sources":["../../../../src/core/identity/resolver/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Client, \n    ClientIdentity, \n    Identity, \n    Robot, \n    RobotIdentity, \n    User, \n    UserIdentity,\n} from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { isUUID } from '@authup/kit';\nimport type { IIdentityResolver, IdentityResolverContext } from './types.ts';\nimport type { IClientIdentityRepository, IRobotIdentityRepository, IUserIdentityRepository } from '../entities/index.ts';\n\nexport class IdentityResolver implements IIdentityResolver {\n    protected clientRepository: IClientIdentityRepository;\n\n    protected userRepository: IUserIdentityRepository;\n\n    protected robotRepository: IRobotIdentityRepository;\n\n    constructor(ctx: IdentityResolverContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.userRepository = ctx.userRepository;\n        this.robotRepository = ctx.robotRepository;\n    }\n\n    async resolve(\n        type: `${IdentityType}`,\n        key: string,\n        realmKey?: string,\n    ): Promise<Identity | null> {\n        switch (type) {\n            case IdentityType.CLIENT: {\n                return this.resolveClient(key, realmKey);\n            }\n            case IdentityType.ROBOT: {\n                return this.resolveRobot(key, realmKey);\n            }\n            case IdentityType.USER: {\n                return this.resolveUser(key, realmKey);\n            }\n        }\n\n        return null;\n    }\n\n    private async resolveClient(\n        key: string,\n        realmKey?: string,\n    ) : Promise<ClientIdentity | null> {\n        let data : Client | null;\n\n        if (isUUID(key)) {\n            data = await this.clientRepository.findOneById(key);\n        } else {\n            data = await this.clientRepository.findOneByName(key, realmKey);\n        }\n\n        if (data) {\n            return {\n                type: IdentityType.CLIENT,\n                data, \n            };\n        }\n\n        return null;\n    }\n\n    private async resolveRobot(\n        key: string,\n        realmKey?: string,\n    ) : Promise<RobotIdentity | null> {\n        let data : Robot | null;\n\n        if (isUUID(key)) {\n            data = await this.robotRepository.findOneById(key);\n        } else {\n            data = await this.robotRepository.findOneByName(key, realmKey);\n        }\n\n        if (data) {\n            return {\n                type: IdentityType.ROBOT,\n                data, \n            };\n        }\n\n        return null;\n    }\n\n    private async resolveUser(\n        key: string,\n        realmKey?: string,\n    ) : Promise<UserIdentity | null> {\n        let data : User | null;\n\n        if (isUUID(key)) {\n            data = await this.userRepository.findOneById(key);\n        } else {\n            data = await this.userRepository.findOneByName(key, realmKey);\n        }\n\n        if (data) {\n            return {\n                type: IdentityType.USER,\n                data, \n            };\n        }\n\n        return null;\n    }\n}\n"],"mappings":";;;AAqBA,IAAaE,mBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA8B;AACtC,OAAKH,mBAAmBG,IAAIH;AAC5B,OAAKC,iBAAiBE,IAAIF;AAC1B,OAAKC,kBAAkBC,IAAID;;CAG/B,MAAME,QACFC,MACAC,KACAC,UACwB;AACxB,UAAQF,MAAR;GACI,KAAKR,aAAaW,OACd,QAAO,KAAKC,cAAcH,KAAKC,SAAAA;GAEnC,KAAKV,aAAaa,MACd,QAAO,KAAKC,aAAaL,KAAKC,SAAAA;GAElC,KAAKV,aAAae,KACd,QAAO,KAAKC,YAAYP,KAAKC,SAAAA;;AAIrC,SAAO;;CAGX,MAAcE,cACVH,KACAC,UAC+B;EAC/B,IAAIO;AAEJ,MAAIhB,OAAOQ,IAAAA,CACPQ,QAAO,MAAM,KAAKd,iBAAiBe,YAAYT,IAAAA;MAE/CQ,QAAO,MAAM,KAAKd,iBAAiBgB,cAAcV,KAAKC,SAAAA;AAG1D,MAAIO,KACA,QAAO;GACHT,MAAMR,aAAaW;GACnBM;GACJ;AAGJ,SAAO;;CAGX,MAAcH,aACVL,KACAC,UAC8B;EAC9B,IAAIO;AAEJ,MAAIhB,OAAOQ,IAAAA,CACPQ,QAAO,MAAM,KAAKZ,gBAAgBa,YAAYT,IAAAA;MAE9CQ,QAAO,MAAM,KAAKZ,gBAAgBc,cAAcV,KAAKC,SAAAA;AAGzD,MAAIO,KACA,QAAO;GACHT,MAAMR,aAAaa;GACnBI;GACJ;AAGJ,SAAO;;CAGX,MAAcD,YACVP,KACAC,UAC6B;EAC7B,IAAIO;AAEJ,MAAIhB,OAAOQ,IAAAA,CACPQ,QAAO,MAAM,KAAKb,eAAec,YAAYT,IAAAA;MAE7CQ,QAAO,MAAM,KAAKb,eAAee,cAAcV,KAAKC,SAAAA;AAGxD,MAAIO,KACA,QAAO;GACHT,MAAMR,aAAae;GACnBE;GACJ;AAGJ,SAAO"}
+{"version":3,"file":"module.mjs","names":["IdentityType","isUUID","IdentityResolver","clientRepository","userRepository","robotRepository","ctx","resolve","type","key","realmKey","CLIENT","resolveClient","ROBOT","resolveRobot","USER","resolveUser","data","findOneById","findOneByName"],"sources":["../../../../src/core/identity/resolver/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Client, \n    ClientIdentity, \n    Identity, \n    Robot, \n    RobotIdentity, \n    User, \n    UserIdentity,\n} from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { isUUID } from '@authup/kit';\nimport type { IIdentityResolver, IdentityResolverContext } from './types.ts';\nimport type { IClientIdentityRepository, IRobotIdentityRepository, IUserIdentityRepository } from '../entities/index.ts';\n\nexport class IdentityResolver implements IIdentityResolver {\n    protected clientRepository: IClientIdentityRepository;\n\n    protected userRepository: IUserIdentityRepository;\n\n    protected robotRepository: IRobotIdentityRepository;\n\n    constructor(ctx: IdentityResolverContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.userRepository = ctx.userRepository;\n        this.robotRepository = ctx.robotRepository;\n    }\n\n    async resolve(\n        type: `${IdentityType}`,\n        key: string,\n        realmKey?: string,\n    ): Promise<Identity | null> {\n        switch (type) {\n            case IdentityType.CLIENT: {\n                return this.resolveClient(key, realmKey);\n            }\n            case IdentityType.ROBOT: {\n                return this.resolveRobot(key, realmKey);\n            }\n            case IdentityType.USER: {\n                return this.resolveUser(key, realmKey);\n            }\n        }\n\n        return null;\n    }\n\n    private async resolveClient(\n        key: string,\n        realmKey?: string,\n    ) : Promise<ClientIdentity | null> {\n        let data : Client | null;\n\n        if (isUUID(key)) {\n            data = await this.clientRepository.findOneById(key);\n        } else {\n            data = await this.clientRepository.findOneByName(key, realmKey);\n        }\n\n        if (data) {\n            return {\n                type: IdentityType.CLIENT,\n                data, \n            };\n        }\n\n        return null;\n    }\n\n    private async resolveRobot(\n        key: string,\n        realmKey?: string,\n    ) : Promise<RobotIdentity | null> {\n        let data : Robot | null;\n\n        if (isUUID(key)) {\n            data = await this.robotRepository.findOneById(key);\n        } else {\n            data = await this.robotRepository.findOneByName(key, realmKey);\n        }\n\n        if (data) {\n            return {\n                type: IdentityType.ROBOT,\n                data, \n            };\n        }\n\n        return null;\n    }\n\n    private async resolveUser(\n        key: string,\n        realmKey?: string,\n    ) : Promise<UserIdentity | null> {\n        let data : User | null;\n\n        if (isUUID(key)) {\n            data = await this.userRepository.findOneById(key);\n        } else {\n            data = await this.userRepository.findOneByName(key, realmKey);\n        }\n\n        if (data) {\n            return {\n                type: IdentityType.USER,\n                data, \n            };\n        }\n\n        return null;\n    }\n}\n"],"mappings":";;;;;;AAqBA,IAAaE,mBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA8B;EACtC,KAAKH,mBAAmBG,IAAIH;EAC5B,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,kBAAkBC,IAAID;CAC/B;CAEA,MAAME,QACFC,MACAC,KACAC,UACwB;EACxB,QAAQF,MAAR;GACI,KAAKR,aAAaW,QACd,OAAO,KAAKC,cAAcH,KAAKC,QAAAA;GAEnC,KAAKV,aAAaa,OACd,OAAO,KAAKC,aAAaL,KAAKC,QAAAA;GAElC,KAAKV,aAAae,MACd,OAAO,KAAKC,YAAYP,KAAKC,QAAAA;EAErC;EAEA,OAAO;CACX;CAEA,MAAcE,cACVH,KACAC,UAC+B;EAC/B,IAAIO;EAEJ,IAAIhB,OAAOQ,GAAAA,GACPQ,OAAO,MAAM,KAAKd,iBAAiBe,YAAYT,GAAAA;OAE/CQ,OAAO,MAAM,KAAKd,iBAAiBgB,cAAcV,KAAKC,QAAAA;EAG1D,IAAIO,MACA,OAAO;GACHT,MAAMR,aAAaW;GACnBM;EACJ;EAGJ,OAAO;CACX;CAEA,MAAcH,aACVL,KACAC,UAC8B;EAC9B,IAAIO;EAEJ,IAAIhB,OAAOQ,GAAAA,GACPQ,OAAO,MAAM,KAAKZ,gBAAgBa,YAAYT,GAAAA;OAE9CQ,OAAO,MAAM,KAAKZ,gBAAgBc,cAAcV,KAAKC,QAAAA;EAGzD,IAAIO,MACA,OAAO;GACHT,MAAMR,aAAaa;GACnBI;EACJ;EAGJ,OAAO;CACX;CAEA,MAAcD,YACVP,KACAC,UAC6B;EAC7B,IAAIO;EAEJ,IAAIhB,OAAOQ,GAAAA,GACPQ,OAAO,MAAM,KAAKb,eAAec,YAAYT,GAAAA;OAE7CQ,OAAO,MAAM,KAAKb,eAAee,cAAcV,KAAKC,QAAAA;EAGxD,IAAIO,MACA,OAAO;GACHT,MAAMR,aAAae;GACnBE;EACJ;EAGJ,OAAO;CACX;AACJ"}

package/dist/core/identity/resolver/types.mjs

@@ -1 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 export {};

package/dist/core/identity/role/index.mjs

@@ -1,2 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 import { IdentityRoleProvider } from "./module.mjs";
 export { IdentityRoleProvider };

package/dist/core/identity/role/module.mjs

@@ -1,3 +1,6 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 //#region src/core/identity/role/module.ts
 var IdentityRoleProvider = class {
 	clientRepository;

package/dist/core/identity/role/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["IdentityRoleProvider","clientRepository","userRepository","robotRepository","ctx","getRolesFor","identity","type","getBoundRoles","id","then","data","reduceByIdentityClient","entities","clientId","filter","entity","client_id"],"sources":["../../../../src/core/identity/role/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Role } from '@authup/core-kit';\nimport type { IdentityPolicyData } from '@authup/access';\nimport type { IClientRepository } from '../../entities/client/types.ts';\nimport type { IRobotRepository } from '../../entities/robot/types.ts';\nimport type { IUserRepository } from '../../entities/user/types.ts';\nimport type { IIdentityRoleProvider, IdentityRoleProviderContext } from './types.ts';\n\nexport class IdentityRoleProvider implements IIdentityRoleProvider {\n    protected clientRepository: IClientRepository;\n\n    protected userRepository: IUserRepository;\n\n    protected robotRepository: IRobotRepository;\n\n    constructor(ctx: IdentityRoleProviderContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.userRepository = ctx.userRepository;\n        this.robotRepository = ctx.robotRepository;\n    }\n\n    async getRolesFor(identity: IdentityPolicyData) : Promise<Role[]> {\n        switch (identity.type) {\n            case 'client': {\n                return this.clientRepository.getBoundRoles(identity.id);\n            }\n            case 'user': {\n                return this.userRepository.getBoundRoles(identity.id)\n                    .then((data) => this.reduceByIdentityClient(data, identity));\n            }\n            case 'robot': {\n                return this.robotRepository.getBoundRoles(identity.id)\n                    .then((data) => this.reduceByIdentityClient(data, identity));\n            }\n        }\n\n        return [];\n    }\n\n    private reduceByIdentityClient<T extends { client_id?: string | null }>(\n        entities: T[],\n        identity: IdentityPolicyData,\n    ): T[] {\n        if (!identity.clientId) {\n            return entities;\n        }\n\n        return entities.filter((entity) => entity.client_id === identity.clientId);\n    }\n}\n"],"mappings":";AAcA,IAAaA,uBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAAkC;AAC1C,OAAKH,mBAAmBG,IAAIH;AAC5B,OAAKC,iBAAiBE,IAAIF;AAC1B,OAAKC,kBAAkBC,IAAID;;CAG/B,MAAME,YAAYC,UAAgD;AAC9D,UAAQA,SAASC,MAAjB;GACI,KAAK,SACD,QAAO,KAAKN,iBAAiBO,cAAcF,SAASG,GAAE;GAE1D,KAAK,OACD,QAAO,KAAKP,eAAeM,cAAcF,SAASG,GAAE,CAC/CC,MAAMC,SAAS,KAAKC,uBAAuBD,MAAML,SAAAA,CAAAA;GAE1D,KAAK,QACD,QAAO,KAAKH,gBAAgBK,cAAcF,SAASG,GAAE,CAChDC,MAAMC,SAAS,KAAKC,uBAAuBD,MAAML,SAAAA,CAAAA;;AAI9D,SAAO,EAAE;;CAGLM,uBACJC,UACAP,UACG;AACH,MAAI,CAACA,SAASQ,SACV,QAAOD;AAGX,SAAOA,SAASE,QAAQC,WAAWA,OAAOC,cAAcX,SAASQ,SAAQ"}
+{"version":3,"file":"module.mjs","names":["IdentityRoleProvider","clientRepository","userRepository","robotRepository","ctx","getRolesFor","identity","type","getBoundRoles","id","then","data","reduceByIdentityClient","entities","clientId","filter","entity","client_id"],"sources":["../../../../src/core/identity/role/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Role } from '@authup/core-kit';\nimport type { IdentityPolicyData } from '@authup/access';\nimport type { IClientRepository } from '../../entities/client/types.ts';\nimport type { IRobotRepository } from '../../entities/robot/types.ts';\nimport type { IUserRepository } from '../../entities/user/types.ts';\nimport type { IIdentityRoleProvider, IdentityRoleProviderContext } from './types.ts';\n\nexport class IdentityRoleProvider implements IIdentityRoleProvider {\n    protected clientRepository: IClientRepository;\n\n    protected userRepository: IUserRepository;\n\n    protected robotRepository: IRobotRepository;\n\n    constructor(ctx: IdentityRoleProviderContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.userRepository = ctx.userRepository;\n        this.robotRepository = ctx.robotRepository;\n    }\n\n    async getRolesFor(identity: IdentityPolicyData) : Promise<Role[]> {\n        switch (identity.type) {\n            case 'client': {\n                return this.clientRepository.getBoundRoles(identity.id);\n            }\n            case 'user': {\n                return this.userRepository.getBoundRoles(identity.id)\n                    .then((data) => this.reduceByIdentityClient(data, identity));\n            }\n            case 'robot': {\n                return this.robotRepository.getBoundRoles(identity.id)\n                    .then((data) => this.reduceByIdentityClient(data, identity));\n            }\n        }\n\n        return [];\n    }\n\n    private reduceByIdentityClient<T extends { client_id?: string | null }>(\n        entities: T[],\n        identity: IdentityPolicyData,\n    ): T[] {\n        if (!identity.clientId) {\n            return entities;\n        }\n\n        return entities.filter((entity) => entity.client_id === identity.clientId);\n    }\n}\n"],"mappings":";;;;AAcA,IAAaA,uBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAAkC;EAC1C,KAAKH,mBAAmBG,IAAIH;EAC5B,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,kBAAkBC,IAAID;CAC/B;CAEA,MAAME,YAAYC,UAAgD;EAC9D,QAAQA,SAASC,MAAjB;GACI,KAAK,UACD,OAAO,KAAKN,iBAAiBO,cAAcF,SAASG,EAAE;GAE1D,KAAK,QACD,OAAO,KAAKP,eAAeM,cAAcF,SAASG,EAAE,CAAA,CAC/CC,MAAMC,SAAS,KAAKC,uBAAuBD,MAAML,QAAAA,CAAAA;GAE1D,KAAK,SACD,OAAO,KAAKH,gBAAgBK,cAAcF,SAASG,EAAE,CAAA,CAChDC,MAAMC,SAAS,KAAKC,uBAAuBD,MAAML,QAAAA,CAAAA;EAE9D;EAEA,OAAO,CAAA;CACX;CAEQM,uBACJC,UACAP,UACG;EACH,IAAI,CAACA,SAASQ,UACV,OAAOD;EAGX,OAAOA,SAASE,QAAQC,WAAWA,OAAOC,cAAcX,SAASQ,QAAQ;CAC7E;AACJ"}

package/dist/core/identity/role/types.mjs

@@ -1 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 export {};

package/dist/core/index.mjs

@@ -1,3 +1,6 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 import { ClientCredentialsService } from "./authentication/credential/entities/client/module.mjs";
 import { RobotCredentialsService } from "./authentication/credential/entities/robot/module.mjs";
 import { UserCredentialsService } from "./authentication/credential/entities/user/module.mjs";
@@ -8,7 +11,6 @@ import { UserAuthenticator } from "./authentication/entities/user/module.mjs";
 import { CredentialsAuthenticator } from "./authentication/module.mjs";
 import { SessionManager } from "./authentication/session/module.mjs";
 import "./authentication/index.mjs";
-import { AbstractEntityService } from "./entities/service.mjs";
 import { ClientService } from "./entities/client/service.mjs";
 import { ClientPermissionService } from "./entities/client-permission/service.mjs";
 import { ClientRoleService } from "./entities/client-role/service.mjs";
@@ -55,7 +57,11 @@ import { OAuth2TokenSigner } from "./oauth2/token/signer/module.mjs";
 import { OAuth2TokenVerifier } from "./oauth2/token/verifier/module.mjs";
 import "./oauth2/index.mjs";
 import { PasswordRecoveryService } from "./identity/password-recovery/service.mjs";
+import { PermissionBindingPolicyEvaluator } from "./security/policy/evaluator.mjs";
+import { PolicyEngine } from "./security/policy/engine.mjs";
+import { PermissionCheckerService } from "./identity/permission/checker/service.mjs";
 import { IdentityPermissionProvider } from "./identity/permission/module.mjs";
+import { PolicyCheckerService } from "./identity/policy/checker/service.mjs";
 import { IdentityProviderMapperOperation } from "./identity/provider/mapper/constants.mjs";
 import { IdentityProviderAccountBaseMapper } from "./identity/provider/mapper/base.mjs";
 import { IdentityProviderAttributeMapper } from "./identity/provider/mapper/attributes/module.mjs";
@@ -100,7 +106,5 @@ import { RobotProvisioningSynchronizer } from "./provisioning/synchronizer/robot
 import { ScopeProvisioningSynchronizer } from "./provisioning/synchronizer/scope/module.mjs";
 import { UserProvisioningSynchronizer } from "./provisioning/synchronizer/user/module.mjs";
 import "./provisioning/index.mjs";
-import { PermissionBindingPolicyEvaluator } from "./security/policy/evaluator.mjs";
-import { PolicyEngine } from "./security/policy/engine.mjs";
 import "./security/index.mjs";
-export { AbstractEntityService, BaseCredentialsAuthenticator, ClientAuthenticator, ClientCredentialsGrant, ClientCredentialsService, ClientPermissionService, ClientProvisioningSynchronizer, ClientProvisioningValidator, ClientRoleService, ClientScopeService, ClientService, CredentialsAuthenticator, GraphProvisioningSynchronizer, IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityGrantType, IdentityPermissionProvider, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityProviderRoleMappingService, IdentityResolver, IdentityRoleProvider, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2ClientAuthenticator, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PasswordGrantType, PasswordRecoveryService, PermissionBindingPolicyEvaluator, PermissionPolicyService, PermissionProvisioningSynchronizer, PermissionProvisioningValidator, PermissionService, PolicyEngine, PolicyProvisioningSynchronizer, PolicyService, ProvisioningEntityResolver, ProvisioningEntityStrategyType, ProvisioningJunctionSynchronizer, ProvisioningStrategyValidator, RealmProvisioningSynchronizer, RealmProvisioningValidator, RealmService, RegistrationService, RobotAuthenticator, RobotCredentialsGrant, RobotCredentialsService, RobotPermissionService, RobotProvisioningSynchronizer, RobotProvisioningValidator, RobotRoleService, RobotService, RoleAttributeService, RolePermissionService, RoleProvisioningSynchronizer, RoleProvisioningValidator, RoleService, RootProvisioningValidator, ScopeProvisioningSynchronizer, ScopeProvisioningValidator, ScopeService, SessionManager, UserAttributeService, UserAuthenticator, UserCredentialsService, UserPermissionService, UserProvisioningSynchronizer, UserProvisioningValidator, UserRoleService, UserService, base64URLEncode, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, createIdentityProviderOAuth2Authenticator, generateOAuth2CodeVerifier, normalizeEntityProvisioningStrategy };
+export { BaseCredentialsAuthenticator, ClientAuthenticator, ClientCredentialsGrant, ClientCredentialsService, ClientPermissionService, ClientProvisioningSynchronizer, ClientProvisioningValidator, ClientRoleService, ClientScopeService, ClientService, CredentialsAuthenticator, GraphProvisioningSynchronizer, IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityGrantType, IdentityPermissionProvider, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityProviderRoleMappingService, IdentityResolver, IdentityRoleProvider, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2ClientAuthenticator, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PasswordGrantType, PasswordRecoveryService, PermissionBindingPolicyEvaluator, PermissionCheckerService, PermissionPolicyService, PermissionProvisioningSynchronizer, PermissionProvisioningValidator, PermissionService, PolicyCheckerService, PolicyEngine, PolicyProvisioningSynchronizer, PolicyService, ProvisioningEntityResolver, ProvisioningEntityStrategyType, ProvisioningJunctionSynchronizer, ProvisioningStrategyValidator, RealmProvisioningSynchronizer, RealmProvisioningValidator, RealmService, RegistrationService, RobotAuthenticator, RobotCredentialsGrant, RobotCredentialsService, RobotPermissionService, RobotProvisioningSynchronizer, RobotProvisioningValidator, RobotRoleService, RobotService, RoleAttributeService, RolePermissionService, RoleProvisioningSynchronizer, RoleProvisioningValidator, RoleService, RootProvisioningValidator, ScopeProvisioningSynchronizer, ScopeProvisioningValidator, ScopeService, SessionManager, UserAttributeService, UserAuthenticator, UserCredentialsService, UserPermissionService, UserProvisioningSynchronizer, UserProvisioningValidator, UserRoleService, UserService, base64URLEncode, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, createIdentityProviderOAuth2Authenticator, generateOAuth2CodeVerifier, normalizeEntityProvisioningStrategy };

package/dist/core/ldap/index.mjs

@@ -1 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 export {};

package/dist/core/ldap/types.mjs

@@ -1 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 export {};

package/dist/core/mail/index.mjs

@@ -1 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 export {};

package/dist/core/mail/types.mjs

@@ -1 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 export {};

package/dist/core/oauth2/authorization/code/index.mjs

@@ -1,3 +1,6 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 import { OAuth2AuthorizationCodeIssuer } from "./issuer/module.mjs";
 import { OAuth2AuthorizationCodeVerifier } from "./verifier/module.mjs";
 import "./verifier/index.mjs";

package/dist/core/oauth2/authorization/code/issuer/index.mjs

@@ -1,2 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 import { OAuth2AuthorizationCodeIssuer } from "./module.mjs";
 export { OAuth2AuthorizationCodeIssuer };

package/dist/core/oauth2/authorization/code/issuer/module.mjs

@@ -1,3 +1,6 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 //#region src/core/oauth2/authorization/code/issuer/module.ts
 var OAuth2AuthorizationCodeIssuer = class {
 	repository;

package/dist/core/oauth2/authorization/code/issuer/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2AuthorizationCodeIssuer","repository","options","issue","input","identity","entity","redirect_uri","client_id","scope","nonce","code_challenge","code_challenge_method","realm_id","data","realm","id","realm_name","name","sub","sub_kind","type","idToken","id_token","save","maxAge","updateIdToken"],"sources":["../../../../../../src/core/oauth2/authorization/code/issuer/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Identity, OAuth2AuthorizationCode, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport type { IOAuth2AuthorizationCodeRepository, OAuth2AuthorizationCodeInput } from '../repository/index.ts';\nimport type { IOAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeIssuerOptions } from './types.ts';\n\nexport class OAuth2AuthorizationCodeIssuer implements IOAuth2AuthorizationCodeIssuer {\n    protected repository: IOAuth2AuthorizationCodeRepository;\n\n    protected options: OAuth2AuthorizationCodeIssuerOptions;\n\n    constructor(\n        repository: IOAuth2AuthorizationCodeRepository,\n        options: OAuth2AuthorizationCodeIssuerOptions = {},\n    ) {\n        this.repository = repository;\n        this.options = options;\n    }\n\n    async issue(\n        input: OAuth2AuthorizationCodeRequest,\n        identity: Identity,\n        options: OAuth2AuthorizationCodeIssuerOptions = {},\n    ) : Promise<OAuth2AuthorizationCode> {\n        const entity: OAuth2AuthorizationCodeInput = {\n            redirect_uri: input.redirect_uri,\n            client_id: input.client_id,\n            scope: input.scope,\n            nonce: input.nonce,\n            code_challenge: input.code_challenge,\n            code_challenge_method: input.code_challenge_method,\n\n            realm_id: identity.data.realm.id,\n            realm_name: identity.data.realm.name,\n            sub: identity.data.id,\n            sub_kind: identity.type,\n        };\n\n        if (options.idToken) {\n            entity.id_token = options.idToken;\n        }\n\n        return this.repository.save(entity, { maxAge: options.maxAge ?? this.options.maxAge });\n    }\n\n    async updateIdToken(\n        entity: OAuth2AuthorizationCode,\n        idToken: string,\n    ) : Promise<void> {\n        entity.id_token = idToken;\n\n        await this.repository.save(entity, { maxAge: this.options.maxAge });\n    }\n}\n"],"mappings":";AAWA,IAAaA,gCAAb,MAAaA;CACCC;CAEAC;CAEV,YACID,YACAC,UAAgD,EAAE,EACpD;AACE,OAAKD,aAAaA;AAClB,OAAKC,UAAUA;;CAGnB,MAAMC,MACFC,OACAC,UACAH,UAAgD,EAAE,EACjB;EACjC,MAAMI,SAAuC;GACzCC,cAAcH,MAAMG;GACpBC,WAAWJ,MAAMI;GACjBC,OAAOL,MAAMK;GACbC,OAAON,MAAMM;GACbC,gBAAgBP,MAAMO;GACtBC,uBAAuBR,MAAMQ;GAE7BC,UAAUR,SAASS,KAAKC,MAAMC;GAC9BC,YAAYZ,SAASS,KAAKC,MAAMG;GAChCC,KAAKd,SAASS,KAAKE;GACnBI,UAAUf,SAASgB;GACvB;AAEA,MAAInB,QAAQoB,QACRhB,QAAOiB,WAAWrB,QAAQoB;AAG9B,SAAO,KAAKrB,WAAWuB,KAAKlB,QAAQ,EAAEmB,QAAQvB,QAAQuB,UAAU,KAAKvB,QAAQuB,QAAO,CAAA;;CAGxF,MAAMC,cACFpB,QACAgB,SACc;AACdhB,SAAOiB,WAAWD;AAElB,QAAM,KAAKrB,WAAWuB,KAAKlB,QAAQ,EAAEmB,QAAQ,KAAKvB,QAAQuB,QAAO,CAAA"}
+{"version":3,"file":"module.mjs","names":["OAuth2AuthorizationCodeIssuer","repository","options","issue","input","identity","entity","redirect_uri","client_id","scope","nonce","code_challenge","code_challenge_method","realm_id","data","realm","id","realm_name","name","sub","sub_kind","type","idToken","id_token","save","maxAge","updateIdToken"],"sources":["../../../../../../src/core/oauth2/authorization/code/issuer/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Identity, OAuth2AuthorizationCode, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport type { IOAuth2AuthorizationCodeRepository, OAuth2AuthorizationCodeInput } from '../repository/index.ts';\nimport type { IOAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeIssuerOptions } from './types.ts';\n\nexport class OAuth2AuthorizationCodeIssuer implements IOAuth2AuthorizationCodeIssuer {\n    protected repository: IOAuth2AuthorizationCodeRepository;\n\n    protected options: OAuth2AuthorizationCodeIssuerOptions;\n\n    constructor(\n        repository: IOAuth2AuthorizationCodeRepository,\n        options: OAuth2AuthorizationCodeIssuerOptions = {},\n    ) {\n        this.repository = repository;\n        this.options = options;\n    }\n\n    async issue(\n        input: OAuth2AuthorizationCodeRequest,\n        identity: Identity,\n        options: OAuth2AuthorizationCodeIssuerOptions = {},\n    ) : Promise<OAuth2AuthorizationCode> {\n        const entity: OAuth2AuthorizationCodeInput = {\n            redirect_uri: input.redirect_uri,\n            client_id: input.client_id,\n            scope: input.scope,\n            nonce: input.nonce,\n            code_challenge: input.code_challenge,\n            code_challenge_method: input.code_challenge_method,\n\n            realm_id: identity.data.realm.id,\n            realm_name: identity.data.realm.name,\n            sub: identity.data.id,\n            sub_kind: identity.type,\n        };\n\n        if (options.idToken) {\n            entity.id_token = options.idToken;\n        }\n\n        return this.repository.save(entity, { maxAge: options.maxAge ?? this.options.maxAge });\n    }\n\n    async updateIdToken(\n        entity: OAuth2AuthorizationCode,\n        idToken: string,\n    ) : Promise<void> {\n        entity.id_token = idToken;\n\n        await this.repository.save(entity, { maxAge: this.options.maxAge });\n    }\n}\n"],"mappings":";;;;AAWA,IAAaA,gCAAb,MAAaA;CACCC;CAEAC;CAEV,YACID,YACAC,UAAgD,CAAC,GACnD;EACE,KAAKD,aAAaA;EAClB,KAAKC,UAAUA;CACnB;CAEA,MAAMC,MACFC,OACAC,UACAH,UAAgD,CAAC,GAChB;EACjC,MAAMI,SAAuC;GACzCC,cAAcH,MAAMG;GACpBC,WAAWJ,MAAMI;GACjBC,OAAOL,MAAMK;GACbC,OAAON,MAAMM;GACbC,gBAAgBP,MAAMO;GACtBC,uBAAuBR,MAAMQ;GAE7BC,UAAUR,SAASS,KAAKC,MAAMC;GAC9BC,YAAYZ,SAASS,KAAKC,MAAMG;GAChCC,KAAKd,SAASS,KAAKE;GACnBI,UAAUf,SAASgB;EACvB;EAEA,IAAInB,QAAQoB,SACRhB,OAAOiB,WAAWrB,QAAQoB;EAG9B,OAAO,KAAKrB,WAAWuB,KAAKlB,QAAQ,EAAEmB,QAAQvB,QAAQuB,UAAU,KAAKvB,QAAQuB,OAAO,CAAA;CACxF;CAEA,MAAMC,cACFpB,QACAgB,SACc;EACdhB,OAAOiB,WAAWD;EAElB,MAAM,KAAKrB,WAAWuB,KAAKlB,QAAQ,EAAEmB,QAAQ,KAAKvB,QAAQuB,OAAO,CAAA;CACrE;AACJ"}

package/dist/core/oauth2/authorization/code/issuer/types.mjs

@@ -1 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 export {};

package/dist/core/oauth2/authorization/code/repository/index.mjs

@@ -1 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 export {};

package/dist/core/oauth2/authorization/code/repository/types.mjs

@@ -1 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 export {};

package/dist/core/oauth2/authorization/code/verifier/index.mjs

@@ -1,2 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 import { OAuth2AuthorizationCodeVerifier } from "./module.mjs";
 export { OAuth2AuthorizationCodeVerifier };

package/dist/core/oauth2/authorization/code/verifier/module.mjs

@@ -1,5 +1,8 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 import { buildOAuth2CodeChallenge } from "../../helpers.mjs";
-import { OAuth2AuthorizationCodeChallengeMethod, OAuth2Error } from "@authup/specs";
+import { OAuth2AuthorizationCodeChallengeMethod, OAuth2GrantError } from "@authup/specs";
 //#region src/core/oauth2/authorization/code/verifier/module.ts
 var OAuth2AuthorizationCodeVerifier = class {
 	repository;
@@ -8,19 +11,19 @@ var OAuth2AuthorizationCodeVerifier = class {
 	}
 	async verify(code, options) {
 		const entity = await this.repository.popOneById(code);
-		if (!entity) throw OAuth2Error.grantInvalid();
+		if (!entity) throw OAuth2GrantError.invalid();
 		if (entity.client_id) {
-			if (!options.clientId || options.clientId !== entity.client_id) throw OAuth2Error.grantInvalid();
+			if (!options.clientId || options.clientId !== entity.client_id) throw OAuth2GrantError.invalid();
 		}
 		if (entity.redirect_uri) {
-			if (!options.redirectUri || entity.redirect_uri !== options.redirectUri) throw OAuth2Error.redirectUriMismatch();
+			if (!options.redirectUri || entity.redirect_uri !== options.redirectUri) throw OAuth2GrantError.redirectUriMismatch();
 		}
-		if (options.clientIsPublic && !entity.code_challenge) throw OAuth2Error.grantInvalid("PKCE is required for public clients.");
+		if (options.clientIsPublic && !entity.code_challenge) throw OAuth2GrantError.invalid("PKCE is required for public clients.");
 		if (entity.code_challenge) {
-			if (!options.codeVerifier) throw OAuth2Error.grantInvalid("Code verifier invalid.");
+			if (!options.codeVerifier) throw OAuth2GrantError.invalid("Code verifier invalid.");
 			if (entity.code_challenge_method === OAuth2AuthorizationCodeChallengeMethod.SHA_256) {
-				if (await buildOAuth2CodeChallenge(options.codeVerifier) !== entity.code_challenge) throw OAuth2Error.grantInvalid("PKCE code_verifier mismatch.");
-			} else if (options.codeVerifier !== entity.code_challenge) throw OAuth2Error.grantInvalid("PKCE code_verifier mismatch.");
+				if (await buildOAuth2CodeChallenge(options.codeVerifier) !== entity.code_challenge) throw OAuth2GrantError.invalid("PKCE code_verifier mismatch.");
+			} else if (options.codeVerifier !== entity.code_challenge) throw OAuth2GrantError.invalid("PKCE code_verifier mismatch.");
 		}
 		return entity;
 	}

package/dist/core/oauth2/authorization/code/verifier/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2AuthorizationCodeChallengeMethod","OAuth2Error","buildOAuth2CodeChallenge","OAuth2AuthorizationCodeVerifier","repository","verify","code","options","entity","popOneById","grantInvalid","client_id","clientId","redirect_uri","redirectUri","redirectUriMismatch","clientIsPublic","code_challenge","codeVerifier","code_challenge_method","SHA_256","codeVerifierHash"],"sources":["../../../../../../src/core/oauth2/authorization/code/verifier/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2AuthorizationCode } from '@authup/core-kit';\nimport { OAuth2AuthorizationCodeChallengeMethod, OAuth2Error } from '@authup/specs';\nimport { buildOAuth2CodeChallenge } from '../../helpers.ts';\n\nimport type { IOAuth2AuthorizationCodeRepository } from '../repository/index.ts';\nimport type { IOAuth2AuthorizationCodeVerifier, IOAuth2AuthorizationCodeVerifyOptions } from './types.ts';\n\nexport class OAuth2AuthorizationCodeVerifier implements IOAuth2AuthorizationCodeVerifier {\n    protected repository : IOAuth2AuthorizationCodeRepository;\n\n    constructor(repository: IOAuth2AuthorizationCodeRepository) {\n        this.repository = repository;\n    }\n\n    async verify(code: string, options: IOAuth2AuthorizationCodeVerifyOptions) : Promise<OAuth2AuthorizationCode> {\n        const entity = await this.repository.popOneById(code);\n        if (!entity) {\n            throw OAuth2Error.grantInvalid();\n        }\n\n        // RFC 6749 §4.1.3: if the client was issued a client_id, verify the\n        // authorization code was issued to the authenticated client. Always\n        // require a clientId to be supplied so a malformed token request can't\n        // bypass the binding by omitting it.\n        if (entity.client_id) {\n            if (!options.clientId || options.clientId !== entity.client_id) {\n                throw OAuth2Error.grantInvalid();\n            }\n        }\n\n        if (entity.redirect_uri) {\n            if (!options.redirectUri || entity.redirect_uri !== options.redirectUri) {\n                throw OAuth2Error.redirectUriMismatch();\n            }\n        }\n\n        // Public clients MUST use PKCE (RFC 7636). Defense in depth in case\n        // the authorize-side check was bypassed or the client's\n        // is_confidential flag changed between authorize and token.\n        if (options.clientIsPublic && !entity.code_challenge) {\n            throw OAuth2Error.grantInvalid('PKCE is required for public clients.');\n        }\n\n        if (entity.code_challenge) {\n            if (!options.codeVerifier) {\n                throw OAuth2Error.grantInvalid('Code verifier invalid.');\n            }\n\n            // RFC 7636 §4.3: code_challenge_method defaults to \"plain\" when\n            // absent. Only treat the challenge as S256 when the client\n            // explicitly sent code_challenge_method=S256.\n            if (entity.code_challenge_method === OAuth2AuthorizationCodeChallengeMethod.SHA_256) {\n                const codeVerifierHash = await buildOAuth2CodeChallenge(options.codeVerifier);\n                if (codeVerifierHash !== entity.code_challenge) {\n                    throw OAuth2Error.grantInvalid('PKCE code_verifier mismatch.');\n                }\n            } else if (options.codeVerifier !== entity.code_challenge) {\n                throw OAuth2Error.grantInvalid('PKCE code_verifier mismatch.');\n            }\n        }\n\n        return entity;\n    }\n}\n"],"mappings":";;;AAcA,IAAaG,kCAAb,MAAaA;CACCC;CAEV,YAAYA,YAAgD;AACxD,OAAKA,aAAaA;;CAGtB,MAAMC,OAAOC,MAAcC,SAAmF;EAC1G,MAAMC,SAAS,MAAM,KAAKJ,WAAWK,WAAWH,KAAAA;AAChD,MAAI,CAACE,OACD,OAAMP,YAAYS,cAAY;AAOlC,MAAIF,OAAOG;OACH,CAACJ,QAAQK,YAAYL,QAAQK,aAAaJ,OAAOG,UACjD,OAAMV,YAAYS,cAAY;;AAItC,MAAIF,OAAOK;OACH,CAACN,QAAQO,eAAeN,OAAOK,iBAAiBN,QAAQO,YACxD,OAAMb,YAAYc,qBAAmB;;AAO7C,MAAIR,QAAQS,kBAAkB,CAACR,OAAOS,eAClC,OAAMhB,YAAYS,aAAa,uCAAA;AAGnC,MAAIF,OAAOS,gBAAgB;AACvB,OAAI,CAACV,QAAQW,aACT,OAAMjB,YAAYS,aAAa,yBAAA;AAMnC,OAAIF,OAAOW,0BAA0BnB,uCAAuCoB;QAEpEC,MAD2BnB,yBAAyBK,QAAQW,aAAY,KACnDV,OAAOS,eAC5B,OAAMhB,YAAYS,aAAa,+BAAA;cAE5BH,QAAQW,iBAAiBV,OAAOS,eACvC,OAAMhB,YAAYS,aAAa,+BAAA;;AAIvC,SAAOF"}
+{"version":3,"file":"module.mjs","names":["OAuth2AuthorizationCodeChallengeMethod","OAuth2GrantError","buildOAuth2CodeChallenge","OAuth2AuthorizationCodeVerifier","repository","verify","code","options","entity","popOneById","invalid","client_id","clientId","redirect_uri","redirectUri","redirectUriMismatch","clientIsPublic","code_challenge","codeVerifier","code_challenge_method","SHA_256","codeVerifierHash"],"sources":["../../../../../../src/core/oauth2/authorization/code/verifier/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2AuthorizationCode } from '@authup/core-kit';\nimport { OAuth2AuthorizationCodeChallengeMethod, OAuth2GrantError } from '@authup/specs';\nimport { buildOAuth2CodeChallenge } from '../../helpers.ts';\n\nimport type { IOAuth2AuthorizationCodeRepository } from '../repository/index.ts';\nimport type { IOAuth2AuthorizationCodeVerifier, IOAuth2AuthorizationCodeVerifyOptions } from './types.ts';\n\nexport class OAuth2AuthorizationCodeVerifier implements IOAuth2AuthorizationCodeVerifier {\n    protected repository : IOAuth2AuthorizationCodeRepository;\n\n    constructor(repository: IOAuth2AuthorizationCodeRepository) {\n        this.repository = repository;\n    }\n\n    async verify(code: string, options: IOAuth2AuthorizationCodeVerifyOptions) : Promise<OAuth2AuthorizationCode> {\n        const entity = await this.repository.popOneById(code);\n        if (!entity) {\n            throw OAuth2GrantError.invalid();\n        }\n\n        // RFC 6749 §4.1.3: if the client was issued a client_id, verify the\n        // authorization code was issued to the authenticated client. Always\n        // require a clientId to be supplied so a malformed token request can't\n        // bypass the binding by omitting it.\n        if (entity.client_id) {\n            if (!options.clientId || options.clientId !== entity.client_id) {\n                throw OAuth2GrantError.invalid();\n            }\n        }\n\n        if (entity.redirect_uri) {\n            if (!options.redirectUri || entity.redirect_uri !== options.redirectUri) {\n                throw OAuth2GrantError.redirectUriMismatch();\n            }\n        }\n\n        // Public clients MUST use PKCE (RFC 7636). Defense in depth in case\n        // the authorize-side check was bypassed or the client's\n        // is_confidential flag changed between authorize and token.\n        if (options.clientIsPublic && !entity.code_challenge) {\n            throw OAuth2GrantError.invalid('PKCE is required for public clients.');\n        }\n\n        if (entity.code_challenge) {\n            if (!options.codeVerifier) {\n                throw OAuth2GrantError.invalid('Code verifier invalid.');\n            }\n\n            // RFC 7636 §4.3: code_challenge_method defaults to \"plain\" when\n            // absent. Only treat the challenge as S256 when the client\n            // explicitly sent code_challenge_method=S256.\n            if (entity.code_challenge_method === OAuth2AuthorizationCodeChallengeMethod.SHA_256) {\n                const codeVerifierHash = await buildOAuth2CodeChallenge(options.codeVerifier);\n                if (codeVerifierHash !== entity.code_challenge) {\n                    throw OAuth2GrantError.invalid('PKCE code_verifier mismatch.');\n                }\n            } else if (options.codeVerifier !== entity.code_challenge) {\n                throw OAuth2GrantError.invalid('PKCE code_verifier mismatch.');\n            }\n        }\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;AAcA,IAAaG,kCAAb,MAAaA;CACCC;CAEV,YAAYA,YAAgD;EACxD,KAAKA,aAAaA;CACtB;CAEA,MAAMC,OAAOC,MAAcC,SAAmF;EAC1G,MAAMC,SAAS,MAAM,KAAKJ,WAAWK,WAAWH,IAAAA;EAChD,IAAI,CAACE,QACD,MAAMP,iBAAiBS,QAAO;EAOlC,IAAIF,OAAOG;OACH,CAACJ,QAAQK,YAAYL,QAAQK,aAAaJ,OAAOG,WACjD,MAAMV,iBAAiBS,QAAO;EAAA;EAItC,IAAIF,OAAOK;OACH,CAACN,QAAQO,eAAeN,OAAOK,iBAAiBN,QAAQO,aACxD,MAAMb,iBAAiBc,oBAAmB;EAAA;EAOlD,IAAIR,QAAQS,kBAAkB,CAACR,OAAOS,gBAClC,MAAMhB,iBAAiBS,QAAQ,sCAAA;EAGnC,IAAIF,OAAOS,gBAAgB;GACvB,IAAI,CAACV,QAAQW,cACT,MAAMjB,iBAAiBS,QAAQ,wBAAA;GAMnC,IAAIF,OAAOW,0BAA0BnB,uCAAuCoB;QAEpEC,MAD2BnB,yBAAyBK,QAAQW,YAAY,MACnDV,OAAOS,gBAC5B,MAAMhB,iBAAiBS,QAAQ,8BAAA;GAAA,OAEhC,IAAIH,QAAQW,iBAAiBV,OAAOS,gBACvC,MAAMhB,iBAAiBS,QAAQ,8BAAA;EAEvC;EAEA,OAAOF;CACX;AACJ"}

package/dist/core/oauth2/authorization/code/verifier/types.mjs

@@ -1 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 export {};

package/dist/core/oauth2/authorization/code-request/index.mjs

@@ -1,3 +1,6 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 import { OAuth2AuthorizationCodeRequestVerifier } from "./verifier/module.mjs";
 import "./verifier/index.mjs";
 import { OAuth2AuthorizationCodeRequestValidator } from "./validator.mjs";

package/dist/core/oauth2/authorization/code-request/validator.mjs

@@ -1,6 +1,9 @@
-import { OAuth2AuthorizationCodeChallengeMethod, OAuth2AuthorizationResponseType, OAuth2Error } from "@authup/specs";
+import "node:path";
+import "node:url";
+import.meta.url;
+import { OAuth2AuthorizationCodeChallengeMethod, OAuth2AuthorizationResponseType, OAuth2ResponseTypeError } from "@authup/specs";
 import { Container } from "validup";
-import { createValidator } from "@validup/adapter-zod";
+import { createValidator } from "@validup/zod";
 import { z } from "zod";
 //#region src/core/oauth2/authorization/code-request/validator.ts
 var OAuth2AuthorizationCodeRequestValidator = class extends Container {
@@ -10,7 +13,7 @@ var OAuth2AuthorizationCodeRequestValidator = class extends Container {
 			const availableResponseTypes = Object.values(OAuth2AuthorizationResponseType);
 			const responseTypes = ctx.value.split(" ");
 			for (const responseType of responseTypes) if (!availableResponseTypes.includes(responseType)) {
-				const error = OAuth2Error.responseTypeUnsupported();
+				const error = OAuth2ResponseTypeError.unsupported();
 				ctx.issues.push({
 					input: responseType,
 					code: "custom",

package/dist/core/oauth2/authorization/code-request/validator.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"validator.mjs","names":["OAuth2AuthorizationCodeChallengeMethod","OAuth2AuthorizationResponseType","OAuth2Error","createValidator","Container","z","OAuth2AuthorizationCodeRequestValidator","initialize","mount","string","nonempty","check","ctx","availableResponseTypes","Object","values","responseTypes","value","split","responseType","includes","error","responseTypeUnsupported","issues","push","input","code","message","NEVER","url","min","max","optional","nullable","enum"],"sources":["../../../../../src/core/oauth2/authorization/code-request/validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport {\n    OAuth2AuthorizationCodeChallengeMethod,\n    OAuth2AuthorizationResponseType,\n    OAuth2Error,\n} from '@authup/specs';\n\nimport { createValidator } from '@validup/adapter-zod';\nimport { Container } from 'validup';\nimport { z } from 'zod';\n\nexport class OAuth2AuthorizationCodeRequestValidator extends Container<OAuth2AuthorizationCodeRequest> {\n    protected initialize() {\n        super.initialize();\n\n        this.mount(\n            'response_type',\n            createValidator(\n                z\n                    .string()\n                    .nonempty()\n                    .check((ctx) => {\n                        const availableResponseTypes = Object.values(OAuth2AuthorizationResponseType);\n                        const responseTypes = ctx.value.split(' ') as OAuth2AuthorizationResponseType[];\n\n                        for (const responseType of responseTypes) {\n                            if (!availableResponseTypes.includes(responseType)) {\n                                const error = OAuth2Error.responseTypeUnsupported();\n                                ctx.issues.push({\n                                    input: responseType,\n                                    code: 'custom',\n                                    message: error.message,\n                                });\n                            }\n                        }\n\n                        return z.NEVER;\n                    }),\n            ),\n        );\n\n        this.mount(\n            'redirect_uri',\n            createValidator(z.string().url()),\n        );\n\n        this.mount(\n            'scope',\n            createValidator(z.string().min(3).max(512)),\n        );\n\n        this.mount(\n            'state',\n            { optional: true },\n            createValidator(z.string().min(5).max(2048).nullable()),\n        );\n\n        this.mount(\n            'code_challenge',\n            { optional: true },\n            createValidator(z.string().min(1).max(256).nullable()),\n        );\n\n        this.mount(\n            'code_challenge_method',\n            { optional: true },\n            createValidator(z.enum(OAuth2AuthorizationCodeChallengeMethod).nullable()),\n        );\n\n        this.mount(\n            'nonce',\n            { optional: true },\n            createValidator(z.string().min(1).max(512).nullable()),\n        );\n\n        this.mount(\n            'realm_id',\n            { optional: true },\n            createValidator(z.string().nonempty()),\n        );\n\n        this.mount(\n            'client_id',\n            createValidator(z.string().nonempty()),\n        );\n    }\n}\n"],"mappings":";;;;;AAkBA,IAAaM,0CAAb,cAA6DF,UAAAA;CAC/CG,aAAa;AACnB,QAAMA,YAAAA;AAEN,OAAKC,MACD,iBACAL,gBACIE,EACKI,QAAM,CACNC,UAAQ,CACRC,OAAOC,QAAAA;GACJ,MAAMC,yBAAyBC,OAAOC,OAAOd,gCAAAA;GAC7C,MAAMe,gBAAgBJ,IAAIK,MAAMC,MAAM,IAAA;AAEtC,QAAK,MAAMC,gBAAgBH,cACvB,KAAI,CAACH,uBAAuBO,SAASD,aAAAA,EAAe;IAChD,MAAME,QAAQnB,YAAYoB,yBAAuB;AACjDV,QAAIW,OAAOC,KAAK;KACZC,OAAON;KACPO,MAAM;KACNC,SAASN,MAAMM;KACnB,CAAA;;AAIR,UAAOtB,EAAEuB;IACb,CAAA,CAAA;AAIZ,OAAKpB,MACD,gBACAL,gBAAgBE,EAAEI,QAAM,CAAGoB,KAAG,CAAA,CAAA;AAGlC,OAAKrB,MACD,SACAL,gBAAgBE,EAAEI,QAAM,CAAGqB,IAAI,EAAA,CAAGC,IAAI,IAAA,CAAA,CAAA;AAG1C,OAAKvB,MACD,SACA,EAAEwB,UAAU,MAAK,EACjB7B,gBAAgBE,EAAEI,QAAM,CAAGqB,IAAI,EAAA,CAAGC,IAAI,KAAA,CAAME,UAAQ,CAAA,CAAA;AAGxD,OAAKzB,MACD,kBACA,EAAEwB,UAAU,MAAK,EACjB7B,gBAAgBE,EAAEI,QAAM,CAAGqB,IAAI,EAAA,CAAGC,IAAI,IAAA,CAAKE,UAAQ,CAAA,CAAA;AAGvD,OAAKzB,MACD,yBACA,EAAEwB,UAAU,MAAK,EACjB7B,gBAAgBE,EAAE6B,KAAKlC,uCAAAA,CAAwCiC,UAAQ,CAAA,CAAA;AAG3E,OAAKzB,MACD,SACA,EAAEwB,UAAU,MAAK,EACjB7B,gBAAgBE,EAAEI,QAAM,CAAGqB,IAAI,EAAA,CAAGC,IAAI,IAAA,CAAKE,UAAQ,CAAA,CAAA;AAGvD,OAAKzB,MACD,YACA,EAAEwB,UAAU,MAAK,EACjB7B,gBAAgBE,EAAEI,QAAM,CAAGC,UAAQ,CAAA,CAAA;AAGvC,OAAKF,MACD,aACAL,gBAAgBE,EAAEI,QAAM,CAAGC,UAAQ,CAAA,CAAA"}
+{"version":3,"file":"validator.mjs","names":["OAuth2AuthorizationCodeChallengeMethod","OAuth2AuthorizationResponseType","OAuth2ResponseTypeError","createValidator","Container","z","OAuth2AuthorizationCodeRequestValidator","initialize","mount","string","nonempty","check","ctx","availableResponseTypes","Object","values","responseTypes","value","split","responseType","includes","error","unsupported","issues","push","input","code","message","NEVER","url","min","max","optional","nullable","enum"],"sources":["../../../../../src/core/oauth2/authorization/code-request/validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport {\n    OAuth2AuthorizationCodeChallengeMethod,\n    OAuth2AuthorizationResponseType,\n    OAuth2ResponseTypeError,\n} from '@authup/specs';\n\nimport { createValidator } from '@validup/zod';\nimport { Container } from 'validup';\nimport { z } from 'zod';\n\nexport class OAuth2AuthorizationCodeRequestValidator extends Container<OAuth2AuthorizationCodeRequest> {\n    protected initialize() {\n        super.initialize();\n\n        this.mount(\n            'response_type',\n            createValidator(\n                z\n                    .string()\n                    .nonempty()\n                    .check((ctx) => {\n                        const availableResponseTypes = Object.values(OAuth2AuthorizationResponseType);\n                        const responseTypes = ctx.value.split(' ') as OAuth2AuthorizationResponseType[];\n\n                        for (const responseType of responseTypes) {\n                            if (!availableResponseTypes.includes(responseType)) {\n                                const error = OAuth2ResponseTypeError.unsupported();\n                                ctx.issues.push({\n                                    input: responseType,\n                                    code: 'custom',\n                                    message: error.message,\n                                });\n                            }\n                        }\n\n                        return z.NEVER;\n                    }),\n            ),\n        );\n\n        this.mount(\n            'redirect_uri',\n            createValidator(z.string().url()),\n        );\n\n        this.mount(\n            'scope',\n            createValidator(z.string().min(3).max(512)),\n        );\n\n        this.mount(\n            'state',\n            { optional: true },\n            createValidator(z.string().min(5).max(2048).nullable()),\n        );\n\n        this.mount(\n            'code_challenge',\n            { optional: true },\n            createValidator(z.string().min(1).max(256).nullable()),\n        );\n\n        this.mount(\n            'code_challenge_method',\n            { optional: true },\n            createValidator(z.enum(OAuth2AuthorizationCodeChallengeMethod).nullable()),\n        );\n\n        this.mount(\n            'nonce',\n            { optional: true },\n            createValidator(z.string().min(1).max(512).nullable()),\n        );\n\n        this.mount(\n            'realm_id',\n            { optional: true },\n            createValidator(z.string().nonempty()),\n        );\n\n        this.mount(\n            'client_id',\n            createValidator(z.string().nonempty()),\n        );\n    }\n}\n"],"mappings":";;;;;;;;AAkBA,IAAaM,0CAAb,cAA6DF,UAAAA;CAC/CG,aAAa;EACnB,MAAMA,WAAAA;EAEN,KAAKC,MACD,iBACAL,gBACIE,EACKI,OAAM,CAAA,CACNC,SAAQ,CAAA,CACRC,OAAOC,QAAAA;GACJ,MAAMC,yBAAyBC,OAAOC,OAAOd,+BAAAA;GAC7C,MAAMe,gBAAgBJ,IAAIK,MAAMC,MAAM,GAAA;GAEtC,KAAK,MAAMC,gBAAgBH,eACvB,IAAI,CAACH,uBAAuBO,SAASD,YAAAA,GAAe;IAChD,MAAME,QAAQnB,wBAAwBoB,YAAW;IACjDV,IAAIW,OAAOC,KAAK;KACZC,OAAON;KACPO,MAAM;KACNC,SAASN,MAAMM;IACnB,CAAA;GACJ;GAGJ,OAAOtB,EAAEuB;EACb,CAAA,CAAA,CAAA;EAIZ,KAAKpB,MACD,gBACAL,gBAAgBE,EAAEI,OAAM,CAAA,CAAGoB,IAAG,CAAA,CAAA;EAGlC,KAAKrB,MACD,SACAL,gBAAgBE,EAAEI,OAAM,CAAA,CAAGqB,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA,CAAA;EAG1C,KAAKvB,MACD,SACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAEI,OAAM,CAAA,CAAGqB,IAAI,CAAA,CAAA,CAAGC,IAAI,IAAA,CAAA,CAAME,SAAQ,CAAA,CAAA;EAGxD,KAAKzB,MACD,kBACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAEI,OAAM,CAAA,CAAGqB,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA,CAAKE,SAAQ,CAAA,CAAA;EAGvD,KAAKzB,MACD,yBACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAE6B,KAAKlC,sCAAAA,CAAAA,CAAwCiC,SAAQ,CAAA,CAAA;EAG3E,KAAKzB,MACD,SACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAEI,OAAM,CAAA,CAAGqB,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA,CAAKE,SAAQ,CAAA,CAAA;EAGvD,KAAKzB,MACD,YACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAEI,OAAM,CAAA,CAAGC,SAAQ,CAAA,CAAA;EAGvC,KAAKF,MACD,aACAL,gBAAgBE,EAAEI,OAAM,CAAA,CAAGC,SAAQ,CAAA,CAAA;CAE3C;AACJ"}

package/dist/core/oauth2/authorization/code-request/verifier/index.mjs

@@ -1,2 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 import { OAuth2AuthorizationCodeRequestVerifier } from "./module.mjs";
 export { OAuth2AuthorizationCodeRequestVerifier };

package/dist/core/oauth2/authorization/code-request/verifier/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code-request/verifier/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAQvE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,KAAK,EACR,uCAAuC,EACvC,gDAAgD,EAChD,6CAA6C,EAChD,MAAM,YAAY,CAAC;AASpB,qBAAa,sCAAuC,YAAW,uCAAuC;IAClG,SAAS,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;IAEpD,SAAS,CAAC,eAAe,EAAE,sBAAsB,CAAC;gBAEtC,GAAG,EAAE,6CAA6C;IAK9D;;;OAGG;IACG,MAAM,CACR,IAAI,EAAE,8BAA8B,GACpC,OAAO,CAAC,gDAAgD,CAAC;CA6DhE"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code-request/verifier/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAWvE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,KAAK,EACR,uCAAuC,EACvC,gDAAgD,EAChD,6CAA6C,EAChD,MAAM,YAAY,CAAC;AASpB,qBAAa,sCAAuC,YAAW,uCAAuC;IAClG,SAAS,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;IAEpD,SAAS,CAAC,eAAe,EAAE,sBAAsB,CAAC;gBAEtC,GAAG,EAAE,6CAA6C;IAK9D;;;OAGG;IACG,MAAM,CACR,IAAI,EAAE,8BAA8B,GACpC,OAAO,CAAC,gDAAgD,CAAC;CA6DhE"}

package/dist/core/oauth2/authorization/code-request/verifier/module.mjs

@@ -1,6 +1,9 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 import { ScopeName } from "@authup/core-kit";
 import { isSimpleMatch } from "@authup/kit";
-import { OAuth2AuthorizationResponseType, OAuth2Error, hasOAuth2Scopes } from "@authup/specs";
+import { OAuth2AuthorizationResponseType, OAuth2ClientError, OAuth2GrantError, OAuth2RequestError, OAuth2ScopeError, hasOAuth2Scopes } from "@authup/specs";
 //#region src/core/oauth2/authorization/code-request/verifier/module.ts
 function willIssueCode(responseType) {
 	if (!responseType) return false;
@@ -17,22 +20,22 @@ var OAuth2AuthorizationCodeRequestVerifier = class {
 	* Verify validated authorization code request.
 	* @param data
 	*/ async verify(data) {
-		if (!data.client_id) throw OAuth2Error.clientInvalid();
+		if (!data.client_id) throw OAuth2ClientError.invalid();
 		const client = await this.clientRepository.findOneByIdOrName(data.client_id, data.realm_id);
-		if (!client) throw OAuth2Error.clientInvalid();
-		if (!client.active) throw OAuth2Error.clientInactive();
-		if (!client.is_confidential && !data.code_challenge && willIssueCode(data.response_type)) throw OAuth2Error.requestInvalid("PKCE code_challenge is required for public clients.");
-		if (!client.is_confidential && !data.state && willIssueCode(data.response_type)) throw OAuth2Error.requestInvalid("state is required for public clients in the code flow.");
+		if (!client) throw OAuth2ClientError.invalid();
+		if (!client.active) throw OAuth2ClientError.inactive();
+		if (!client.is_confidential && !data.code_challenge && willIssueCode(data.response_type)) throw OAuth2RequestError.malformed("PKCE code_challenge is required for public clients.");
+		if (!client.is_confidential && !data.state && willIssueCode(data.response_type)) throw OAuth2RequestError.malformed("state is required for public clients in the code flow.");
 		data.client_id = client.id;
 		data.realm_id = client.realm_id;
 		const scopes = await this.scopeRepository.findByClientId(client.id);
 		const scopeNames = scopes.map((scope) => scope.name);
 		if (data.scope) {
-			if (!hasOAuth2Scopes(scopeNames, data.scope) && !hasOAuth2Scopes(data.scope, ScopeName.GLOBAL)) throw OAuth2Error.scopeInsufficient();
+			if (!hasOAuth2Scopes(scopeNames, data.scope) && !hasOAuth2Scopes(data.scope, ScopeName.GLOBAL)) throw OAuth2ScopeError.insufficient();
 		} else data.scope = scopeNames.join(" ");
 		if (client.redirect_uri && data.redirect_uri) {
 			const redirectUris = client.redirect_uri.split(",");
-			if (!isSimpleMatch(data.redirect_uri, redirectUris)) throw OAuth2Error.redirectUriMismatch();
+			if (!isSimpleMatch(data.redirect_uri, redirectUris)) throw OAuth2GrantError.redirectUriMismatch();
 		}
 		return {
 			data,

package/dist/core/oauth2/authorization/code-request/verifier/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["ScopeName","isSimpleMatch","OAuth2AuthorizationResponseType","OAuth2Error","hasOAuth2Scopes","willIssueCode","responseType","split","includes","CODE","OAuth2AuthorizationCodeRequestVerifier","clientRepository","scopeRepository","ctx","verify","data","client_id","clientInvalid","client","findOneByIdOrName","realm_id","active","clientInactive","is_confidential","code_challenge","response_type","requestInvalid","state","id","scopes","findByClientId","scopeNames","map","scope","name","GLOBAL","scopeInsufficient","join","redirect_uri","redirectUris","redirectUriMismatch"],"sources":["../../../../../../src/core/oauth2/authorization/code-request/verifier/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport { isSimpleMatch } from '@authup/kit';\nimport {\n    OAuth2AuthorizationResponseType,\n    OAuth2Error,\n    hasOAuth2Scopes,\n} from '@authup/specs';\nimport type { IOAuth2ClientRepository } from '../../../client/index.ts';\nimport type { IOAuth2ScopeRepository } from '../../../scope/index.ts';\nimport type {\n    IOAuth2AuthorizationCodeRequestVerifier,\n    OAuth2AuthorizationCodeRequestVerificationResult,\n    OAuth2AuthorizationCodeRequestVerifierContext,\n} from './types.ts';\n\nfunction willIssueCode(responseType: string | undefined): boolean {\n    if (!responseType) {\n        return false;\n    }\n    return responseType.split(' ').includes(OAuth2AuthorizationResponseType.CODE);\n}\n\nexport class OAuth2AuthorizationCodeRequestVerifier implements IOAuth2AuthorizationCodeRequestVerifier {\n    protected clientRepository: IOAuth2ClientRepository;\n\n    protected scopeRepository: IOAuth2ScopeRepository;\n\n    constructor(ctx: OAuth2AuthorizationCodeRequestVerifierContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.scopeRepository = ctx.scopeRepository;\n    }\n\n    /**\n     * Verify validated authorization code request.\n     * @param data\n     */\n    async verify(\n        data: OAuth2AuthorizationCodeRequest,\n    ) : Promise<OAuth2AuthorizationCodeRequestVerificationResult> {\n        if (!data.client_id) {\n            throw OAuth2Error.clientInvalid();\n        }\n\n        const client = await this.clientRepository.findOneByIdOrName(data.client_id, data.realm_id);\n        if (!client) {\n            throw OAuth2Error.clientInvalid();\n        }\n\n        if (!client.active) {\n            throw OAuth2Error.clientInactive();\n        }\n\n        // Public clients MUST use PKCE for the code flow (RFC 7636 §4.4.1,\n        // OAuth 2.1). Without PKCE a public client's code flow has no second\n        // factor — anyone who intercepts the redirect can redeem the code at\n        // /token. Only enforce when an authorization code will actually be\n        // issued; implicit/id_token-only flows don't involve a code.\n        if (!client.is_confidential && !data.code_challenge && willIssueCode(data.response_type)) {\n            throw OAuth2Error.requestInvalid('PKCE code_challenge is required for public clients.');\n        }\n\n        // Public clients SHOULD include state to bind the redirect to the\n        // initiating session and prevent CSRF (RFC 6749 §10.12). Confidential\n        // clients are exempt because the /token exchange already authenticates\n        // them via client_secret.\n        if (!client.is_confidential && !data.state && willIssueCode(data.response_type)) {\n            throw OAuth2Error.requestInvalid('state is required for public clients in the code flow.');\n        }\n\n        data.client_id = client.id;\n        data.realm_id = client.realm_id;\n\n        const scopes = await this.scopeRepository.findByClientId(client.id);\n        const scopeNames = scopes.map((scope) => scope.name);\n        if (data.scope) {\n            if (\n                !hasOAuth2Scopes(scopeNames, data.scope) &&\n                !hasOAuth2Scopes(data.scope, ScopeName.GLOBAL)\n            ) {\n                throw OAuth2Error.scopeInsufficient();\n            }\n        } else {\n            data.scope = scopeNames.join(' ');\n        }\n\n        if (client.redirect_uri && data.redirect_uri) {\n            const redirectUris = client.redirect_uri.split(',');\n\n            if (!isSimpleMatch(data.redirect_uri, redirectUris)) {\n                throw OAuth2Error.redirectUriMismatch();\n            }\n        }\n\n        return {\n            data,\n            client,\n            scopes,\n        };\n    }\n}\n"],"mappings":";;;;AAuBA,SAASK,cAAcC,cAAgC;AACnD,KAAI,CAACA,aACD,QAAO;AAEX,QAAOA,aAAaC,MAAM,IAAA,CAAKC,SAASN,gCAAgCO,KAAI;;AAGhF,IAAaC,yCAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAoD;AAC5D,OAAKF,mBAAmBE,IAAIF;AAC5B,OAAKC,kBAAkBC,IAAID;;;;;IAO/B,MAAME,OACFC,MAC0D;AAC1D,MAAI,CAACA,KAAKC,UACN,OAAMb,YAAYc,eAAa;EAGnC,MAAMC,SAAS,MAAM,KAAKP,iBAAiBQ,kBAAkBJ,KAAKC,WAAWD,KAAKK,SAAQ;AAC1F,MAAI,CAACF,OACD,OAAMf,YAAYc,eAAa;AAGnC,MAAI,CAACC,OAAOG,OACR,OAAMlB,YAAYmB,gBAAc;AAQpC,MAAI,CAACJ,OAAOK,mBAAmB,CAACR,KAAKS,kBAAkBnB,cAAcU,KAAKU,cAAa,CACnF,OAAMtB,YAAYuB,eAAe,sDAAA;AAOrC,MAAI,CAACR,OAAOK,mBAAmB,CAACR,KAAKY,SAAStB,cAAcU,KAAKU,cAAa,CAC1E,OAAMtB,YAAYuB,eAAe,yDAAA;AAGrCX,OAAKC,YAAYE,OAAOU;AACxBb,OAAKK,WAAWF,OAAOE;EAEvB,MAAMS,SAAS,MAAM,KAAKjB,gBAAgBkB,eAAeZ,OAAOU,GAAE;EAClE,MAAMG,aAAaF,OAAOG,KAAKC,UAAUA,MAAMC,KAAI;AACnD,MAAInB,KAAKkB;OAED,CAAC7B,gBAAgB2B,YAAYhB,KAAKkB,MAAK,IACvC,CAAC7B,gBAAgBW,KAAKkB,OAAOjC,UAAUmC,OAAM,CAE7C,OAAMhC,YAAYiC,mBAAiB;QAGvCrB,MAAKkB,QAAQF,WAAWM,KAAK,IAAA;AAGjC,MAAInB,OAAOoB,gBAAgBvB,KAAKuB,cAAc;GAC1C,MAAMC,eAAerB,OAAOoB,aAAa/B,MAAM,IAAA;AAE/C,OAAI,CAACN,cAAcc,KAAKuB,cAAcC,aAAAA,CAClC,OAAMpC,YAAYqC,qBAAmB;;AAI7C,SAAO;GACHzB;GACAG;GACAW;GACJ"}
+{"version":3,"file":"module.mjs","names":["ScopeName","isSimpleMatch","OAuth2AuthorizationResponseType","OAuth2ClientError","OAuth2GrantError","OAuth2RequestError","OAuth2ScopeError","hasOAuth2Scopes","willIssueCode","responseType","split","includes","CODE","OAuth2AuthorizationCodeRequestVerifier","clientRepository","scopeRepository","ctx","verify","data","client_id","invalid","client","findOneByIdOrName","realm_id","active","inactive","is_confidential","code_challenge","response_type","malformed","state","id","scopes","findByClientId","scopeNames","map","scope","name","GLOBAL","insufficient","join","redirect_uri","redirectUris","redirectUriMismatch"],"sources":["../../../../../../src/core/oauth2/authorization/code-request/verifier/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport { isSimpleMatch } from '@authup/kit';\nimport {\n    OAuth2AuthorizationResponseType,\n    OAuth2ClientError,\n    OAuth2GrantError,\n    OAuth2RequestError,\n    OAuth2ScopeError,\n    hasOAuth2Scopes,\n} from '@authup/specs';\nimport type { IOAuth2ClientRepository } from '../../../client/index.ts';\nimport type { IOAuth2ScopeRepository } from '../../../scope/index.ts';\nimport type {\n    IOAuth2AuthorizationCodeRequestVerifier,\n    OAuth2AuthorizationCodeRequestVerificationResult,\n    OAuth2AuthorizationCodeRequestVerifierContext,\n} from './types.ts';\n\nfunction willIssueCode(responseType: string | undefined): boolean {\n    if (!responseType) {\n        return false;\n    }\n    return responseType.split(' ').includes(OAuth2AuthorizationResponseType.CODE);\n}\n\nexport class OAuth2AuthorizationCodeRequestVerifier implements IOAuth2AuthorizationCodeRequestVerifier {\n    protected clientRepository: IOAuth2ClientRepository;\n\n    protected scopeRepository: IOAuth2ScopeRepository;\n\n    constructor(ctx: OAuth2AuthorizationCodeRequestVerifierContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.scopeRepository = ctx.scopeRepository;\n    }\n\n    /**\n     * Verify validated authorization code request.\n     * @param data\n     */\n    async verify(\n        data: OAuth2AuthorizationCodeRequest,\n    ) : Promise<OAuth2AuthorizationCodeRequestVerificationResult> {\n        if (!data.client_id) {\n            throw OAuth2ClientError.invalid();\n        }\n\n        const client = await this.clientRepository.findOneByIdOrName(data.client_id, data.realm_id);\n        if (!client) {\n            throw OAuth2ClientError.invalid();\n        }\n\n        if (!client.active) {\n            throw OAuth2ClientError.inactive();\n        }\n\n        // Public clients MUST use PKCE for the code flow (RFC 7636 §4.4.1,\n        // OAuth 2.1). Without PKCE a public client's code flow has no second\n        // factor — anyone who intercepts the redirect can redeem the code at\n        // /token. Only enforce when an authorization code will actually be\n        // issued; implicit/id_token-only flows don't involve a code.\n        if (!client.is_confidential && !data.code_challenge && willIssueCode(data.response_type)) {\n            throw OAuth2RequestError.malformed('PKCE code_challenge is required for public clients.');\n        }\n\n        // Public clients SHOULD include state to bind the redirect to the\n        // initiating session and prevent CSRF (RFC 6749 §10.12). Confidential\n        // clients are exempt because the /token exchange already authenticates\n        // them via client_secret.\n        if (!client.is_confidential && !data.state && willIssueCode(data.response_type)) {\n            throw OAuth2RequestError.malformed('state is required for public clients in the code flow.');\n        }\n\n        data.client_id = client.id;\n        data.realm_id = client.realm_id;\n\n        const scopes = await this.scopeRepository.findByClientId(client.id);\n        const scopeNames = scopes.map((scope) => scope.name);\n        if (data.scope) {\n            if (\n                !hasOAuth2Scopes(scopeNames, data.scope) &&\n                !hasOAuth2Scopes(data.scope, ScopeName.GLOBAL)\n            ) {\n                throw OAuth2ScopeError.insufficient();\n            }\n        } else {\n            data.scope = scopeNames.join(' ');\n        }\n\n        if (client.redirect_uri && data.redirect_uri) {\n            const redirectUris = client.redirect_uri.split(',');\n\n            if (!isSimpleMatch(data.redirect_uri, redirectUris)) {\n                throw OAuth2GrantError.redirectUriMismatch();\n            }\n        }\n\n        return {\n            data,\n            client,\n            scopes,\n        };\n    }\n}\n"],"mappings":";;;;;;;AA0BA,SAASQ,cAAcC,cAAgC;CACnD,IAAI,CAACA,cACD,OAAO;CAEX,OAAOA,aAAaC,MAAM,GAAA,CAAA,CAAKC,SAAST,gCAAgCU,IAAI;AAChF;AAEA,IAAaC,yCAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAoD;EAC5D,KAAKF,mBAAmBE,IAAIF;EAC5B,KAAKC,kBAAkBC,IAAID;CAC/B;;;;IAMA,MAAME,OACFC,MAC0D;EAC1D,IAAI,CAACA,KAAKC,WACN,MAAMhB,kBAAkBiB,QAAO;EAGnC,MAAMC,SAAS,MAAM,KAAKP,iBAAiBQ,kBAAkBJ,KAAKC,WAAWD,KAAKK,QAAQ;EAC1F,IAAI,CAACF,QACD,MAAMlB,kBAAkBiB,QAAO;EAGnC,IAAI,CAACC,OAAOG,QACR,MAAMrB,kBAAkBsB,SAAQ;EAQpC,IAAI,CAACJ,OAAOK,mBAAmB,CAACR,KAAKS,kBAAkBnB,cAAcU,KAAKU,aAAa,GACnF,MAAMvB,mBAAmBwB,UAAU,qDAAA;EAOvC,IAAI,CAACR,OAAOK,mBAAmB,CAACR,KAAKY,SAAStB,cAAcU,KAAKU,aAAa,GAC1E,MAAMvB,mBAAmBwB,UAAU,wDAAA;EAGvCX,KAAKC,YAAYE,OAAOU;EACxBb,KAAKK,WAAWF,OAAOE;EAEvB,MAAMS,SAAS,MAAM,KAAKjB,gBAAgBkB,eAAeZ,OAAOU,EAAE;EAClE,MAAMG,aAAaF,OAAOG,KAAKC,UAAUA,MAAMC,IAAI;EACnD,IAAInB,KAAKkB;OAED,CAAC7B,gBAAgB2B,YAAYhB,KAAKkB,KAAK,KACvC,CAAC7B,gBAAgBW,KAAKkB,OAAOpC,UAAUsC,MAAM,GAE7C,MAAMhC,iBAAiBiC,aAAY;EAAA,OAGvCrB,KAAKkB,QAAQF,WAAWM,KAAK,GAAA;EAGjC,IAAInB,OAAOoB,gBAAgBvB,KAAKuB,cAAc;GAC1C,MAAMC,eAAerB,OAAOoB,aAAa/B,MAAM,GAAA;GAE/C,IAAI,CAACT,cAAciB,KAAKuB,cAAcC,YAAAA,GAClC,MAAMtC,iBAAiBuC,oBAAmB;EAElD;EAEA,OAAO;GACHzB;GACAG;GACAW;EACJ;CACJ;AACJ"}

package/dist/core/oauth2/authorization/code-request/verifier/types.mjs

@@ -1 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 export {};

package/dist/core/oauth2/authorization/helpers.mjs

@@ -1,3 +1,6 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 import { subtle } from "uncrypto";
 //#region src/core/oauth2/authorization/helpers.ts
 function generateOAuth2CodeVerifier() {

package/dist/core/oauth2/authorization/helpers.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.mjs","names":["subtle","generateOAuth2CodeVerifier","length","charset","codeVerifier","randomValues","Uint8Array","crypto","getRandomValues","i","base64URLEncode","arrayBuffer","charCode","Array","from","btoa","String","fromCharCode","apply","replace","buildOAuth2TokenHash","value","encoder","TextEncoder","data","encode","hashBuffer","digest","halfHash","slice","buildOAuth2CodeChallenge"],"sources":["../../../../src/core/oauth2/authorization/helpers.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { subtle } from 'uncrypto';\n\nexport function generateOAuth2CodeVerifier() {\n    const length = 64;\n    const charset = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';\n\n    let codeVerifier = '';\n    const randomValues = new Uint8Array(length);\n    crypto.getRandomValues(randomValues);\n\n    for (let i = 0; i < length; i++) {\n        codeVerifier += charset[randomValues[i] % charset.length];\n    }\n\n    return codeVerifier;\n}\n\nexport function base64URLEncode(arrayBuffer: ArrayBuffer) {\n    // Convert the ArrayBuffer to string using Uint8 array.\n    // btoa takes chars from 0-255 and base64 encodes.\n    // Then convert the base64 encoded to base64url encoded.\n    // (replace + with -, replace / with _, trim trailing =)\n    const charCode = Array.from(new Uint8Array(arrayBuffer));\n\n    return btoa(String.fromCharCode.apply(null, charCode))\n        .replace(/\\+/g, '-')\n        .replace(/\\//g, '_')\n        .replace(/=+$/, '');\n}\n\nexport async function buildOAuth2TokenHash(value: string) : Promise<string> {\n    const encoder = new TextEncoder();\n    const data = encoder.encode(value);\n    const hashBuffer = await subtle.digest('SHA-256', data);\n    const halfHash = hashBuffer.slice(0, 16);\n\n    return base64URLEncode(halfHash);\n}\n\nexport async function buildOAuth2CodeChallenge(codeVerifier: string) {\n    const encoder = new TextEncoder();\n    const data = encoder.encode(codeVerifier);\n    const arrayBuffer = await subtle.digest('SHA-256', data);\n\n    return base64URLEncode(arrayBuffer);\n}\n"],"mappings":";;AASA,SAAgBC,6BAAAA;CACZ,MAAMC,SAAS;CACf,MAAMC,UAAU;CAEhB,IAAIC,eAAe;CACnB,MAAMC,eAAe,IAAIC,WAAWJ,OAAAA;AACpCK,QAAOC,gBAAgBH,aAAAA;AAEvB,MAAK,IAAII,IAAI,GAAGA,IAAIP,QAAQO,IACxBL,iBAAgBD,QAAQE,aAAaI,KAAKN;AAG9C,QAAOC;;AAGX,SAAgBM,gBAAgBC,aAAwB;CAKpD,MAAMC,WAAWC,MAAMC,KAAK,IAAIR,WAAWK,YAAAA,CAAAA;AAE3C,QAAOI,KAAKC,OAAOC,aAAaC,MAAM,MAAMN,SAAAA,CAAAA,CACvCO,QAAQ,OAAO,IAAA,CACfA,QAAQ,OAAO,IAAA,CACfA,QAAQ,OAAO,GAAA;;AAGxB,eAAsBC,qBAAqBC,OAAa;CAEpD,MAAMG,OAAOF,IADOC,aACPD,CAAQG,OAAOJ,MAAAA;AAI5B,QAAOX,iBAFUgB,MADQ1B,OAAO2B,OAAO,WAAWH,KAAAA,EACtBK,MAAM,GAAG,GAEdD,CAAAA;;AAG3B,eAAsBE,yBAAyB1B,cAAoB;CAE/D,MAAMoB,OAAOF,IADOC,aACPD,CAAQG,OAAOrB,aAAAA;AAG5B,QAAOM,gBAAgBC,MAFGX,OAAO2B,OAAO,WAAWH,KAAAA,CAE5Bb"}
+{"version":3,"file":"helpers.mjs","names":["subtle","generateOAuth2CodeVerifier","length","charset","codeVerifier","randomValues","Uint8Array","crypto","getRandomValues","i","base64URLEncode","arrayBuffer","charCode","Array","from","btoa","String","fromCharCode","apply","replace","buildOAuth2TokenHash","value","encoder","TextEncoder","data","encode","hashBuffer","digest","halfHash","slice","buildOAuth2CodeChallenge"],"sources":["../../../../src/core/oauth2/authorization/helpers.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { subtle } from 'uncrypto';\n\nexport function generateOAuth2CodeVerifier() {\n    const length = 64;\n    const charset = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';\n\n    let codeVerifier = '';\n    const randomValues = new Uint8Array(length);\n    crypto.getRandomValues(randomValues);\n\n    for (let i = 0; i < length; i++) {\n        codeVerifier += charset[randomValues[i] % charset.length];\n    }\n\n    return codeVerifier;\n}\n\nexport function base64URLEncode(arrayBuffer: ArrayBuffer) {\n    // Convert the ArrayBuffer to string using Uint8 array.\n    // btoa takes chars from 0-255 and base64 encodes.\n    // Then convert the base64 encoded to base64url encoded.\n    // (replace + with -, replace / with _, trim trailing =)\n    const charCode = Array.from(new Uint8Array(arrayBuffer));\n\n    return btoa(String.fromCharCode.apply(null, charCode))\n        .replace(/\\+/g, '-')\n        .replace(/\\//g, '_')\n        .replace(/=+$/, '');\n}\n\nexport async function buildOAuth2TokenHash(value: string) : Promise<string> {\n    const encoder = new TextEncoder();\n    const data = encoder.encode(value);\n    const hashBuffer = await subtle.digest('SHA-256', data);\n    const halfHash = hashBuffer.slice(0, 16);\n\n    return base64URLEncode(halfHash);\n}\n\nexport async function buildOAuth2CodeChallenge(codeVerifier: string) {\n    const encoder = new TextEncoder();\n    const data = encoder.encode(codeVerifier);\n    const arrayBuffer = await subtle.digest('SHA-256', data);\n\n    return base64URLEncode(arrayBuffer);\n}\n"],"mappings":";;;;;AASA,SAAgBC,6BAAAA;CACZ,MAAMC,SAAS;CACf,MAAMC,UAAU;CAEhB,IAAIC,eAAe;CACnB,MAAMC,eAAe,IAAIC,WAAWJ,MAAAA;CACpCK,OAAOC,gBAAgBH,YAAAA;CAEvB,KAAK,IAAII,IAAI,GAAGA,IAAIP,QAAQO,KACxBL,gBAAgBD,QAAQE,aAAaI,KAAKN;CAG9C,OAAOC;AACX;AAEA,SAAgBM,gBAAgBC,aAAwB;CAKpD,MAAMC,WAAWC,MAAMC,KAAK,IAAIR,WAAWK,WAAAA,CAAAA;CAE3C,OAAOI,KAAKC,OAAOC,aAAaC,MAAM,MAAMN,QAAAA,CAAAA,CAAAA,CACvCO,QAAQ,OAAO,GAAA,CAAA,CACfA,QAAQ,OAAO,GAAA,CAAA,CACfA,QAAQ,OAAO,EAAA;AACxB;AAEA,eAAsBC,qBAAqBC,OAAa;CAEpD,MAAMG,OAAOF,IADOC,YACPD,CAAAA,CAAQG,OAAOJ,KAAAA;CAI5B,OAAOX,iBAFUgB,MADQ1B,OAAO2B,OAAO,WAAWH,IAAAA,EAAAA,CACtBK,MAAM,GAAG,EAEdD,CAAAA;AAC3B;AAEA,eAAsBE,yBAAyB1B,cAAoB;CAE/D,MAAMoB,OAAOF,IADOC,YACPD,CAAAA,CAAQG,OAAOrB,YAAAA;CAG5B,OAAOM,gBAAgBC,MAFGX,OAAO2B,OAAO,WAAWH,IAAAA,CAE5Bb;AAC3B"}