@authup/server-core 1.0.0-beta.5 → 1.0.0-beta.51

package/dist/core/mail/template/types.d.ts

@@ -0,0 +1,39 @@
+import type { TranslatorTranslationMailKey } from '@authup/i18n';
+import type { MailBlock } from '../format/types.ts';
+export declare enum MailTemplateName {
+    REGISTRATION_ACTIVATION = "registration-activation",
+    PASSWORD_RESET = "password-reset"
+}
+export type MailTemplateParamsMap = {
+    [MailTemplateName.REGISTRATION_ACTIVATION]: {
+        code: string;
+        url?: string;
+    };
+    [MailTemplateName.PASSWORD_RESET]: {
+        code: string;
+        url?: string;
+        expiresInMinutes?: number;
+    };
+};
+/**
+ * Locale-bound translator handed to a template's `build`. Resolves a key
+ * of the `authupMail` namespace (`@authup/i18n`) through ilingo — `data`
+ * feeds `{{var}}` interpolation. Async so file- or remote-backed override
+ * stores can slot in behind the same contract.
+ */
+export type MailTemplateTranslator = (key: `${TranslatorTranslationMailKey}`, data?: Record<string, any>) => Promise<string>;
+export type MailTemplateBuildOutput = {
+    subject: string;
+    preview?: string;
+    blocks: MailBlock[];
+};
+/**
+ * A mail template composes its body from blocks; subject, html and text
+ * all derive from the same build output. Copy is not embedded — it is
+ * resolved per locale through the supplied translator.
+ */
+export type MailTemplate<N extends MailTemplateName = MailTemplateName> = {
+    name: N;
+    build(params: MailTemplateParamsMap[N], t: MailTemplateTranslator): Promise<MailTemplateBuildOutput>;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/core/mail/template/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/mail/template/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEpD,oBAAY,gBAAgB;IACxB,uBAAuB,4BAA4B;IACnD,cAAc,mBAAmB;CACpC;AAED,MAAM,MAAM,qBAAqB,GAAG;IAChC,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,EAAE;QACxC,IAAI,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE;QAC/B,IAAI,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;CACL,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG,CACjC,GAAG,EAAE,GAAG,4BAA4B,EAAE,EACtC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KACzB,OAAO,CAAC,MAAM,CAAC,CAAC;AAErB,MAAM,MAAM,uBAAuB,GAAG;IAClC,OAAO,EAAE,MAAM,CAAC;IAEhB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,SAAS,EAAE,CAAC;CACvB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,gBAAgB,GAAG,gBAAgB,IAAI;IACtE,IAAI,EAAE,CAAC,CAAC;IACR,KAAK,CACD,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAC,EAChC,CAAC,EAAE,sBAAsB,GAC1B,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACvC,CAAC"}

package/dist/core/mail/template/types.mjs

@@ -0,0 +1,13 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/mail/template/types.ts
+var MailTemplateName = /*#__PURE__*/ function(MailTemplateName) {
+	MailTemplateName["REGISTRATION_ACTIVATION"] = "registration-activation";
+	MailTemplateName["PASSWORD_RESET"] = "password-reset";
+	return MailTemplateName;
+}({});
+//#endregion
+export { MailTemplateName };
+
+//# sourceMappingURL=types.mjs.map

package/dist/core/mail/template/types.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.mjs","names":["MailTemplateName"],"sources":["../../../../src/core/mail/template/types.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { TranslatorTranslationMailKey } from '@authup/i18n';\nimport type { MailBlock } from '../format/types.ts';\n\nexport enum MailTemplateName {\n    REGISTRATION_ACTIVATION = 'registration-activation',\n    PASSWORD_RESET = 'password-reset',\n}\n\nexport type MailTemplateParamsMap = {\n    [MailTemplateName.REGISTRATION_ACTIVATION]: {\n        code: string,\n        url?: string,\n    },\n    [MailTemplateName.PASSWORD_RESET]: {\n        code: string,\n        url?: string,\n        expiresInMinutes?: number,\n    },\n};\n\n/**\n * Locale-bound translator handed to a template's `build`. Resolves a key\n * of the `authupMail` namespace (`@authup/i18n`) through ilingo — `data`\n * feeds `{{var}}` interpolation. Async so file- or remote-backed override\n * stores can slot in behind the same contract.\n */\nexport type MailTemplateTranslator = (\n    key: `${TranslatorTranslationMailKey}`,\n    data?: Record<string, any>,\n) => Promise<string>;\n\nexport type MailTemplateBuildOutput = {\n    subject: string,\n    // Hidden preheader shown by mail clients as the preview line.\n    preview?: string,\n    blocks: MailBlock[],\n};\n\n/**\n * A mail template composes its body from blocks; subject, html and text\n * all derive from the same build output. Copy is not embedded — it is\n * resolved per locale through the supplied translator.\n */\nexport type MailTemplate<N extends MailTemplateName = MailTemplateName> = {\n    name: N,\n    build(\n        params: MailTemplateParamsMap[N],\n        t: MailTemplateTranslator,\n    ): Promise<MailTemplateBuildOutput>,\n};\n"],"mappings":";;;;AAUA,IAAO,mBAAKA,uBAAAA,kBAAAA;;;QAAAA"}

package/dist/core/mail/types.d.ts

@@ -0,0 +1,36 @@
+import type { MailTemplateName, MailTemplateParamsMap } from './template/types.ts';
+export type MailAddress = {
+    name: string;
+    address: string;
+};
+export type MailSendOptions = {
+    to?: string | MailAddress;
+    from?: string | MailAddress;
+    subject?: string;
+    text?: string;
+    html?: string;
+};
+export interface IMailClient {
+    send(options: MailSendOptions): Promise<void>;
+}
+export type MailRenderInput<N extends MailTemplateName = MailTemplateName> = {
+    template: N;
+    params: MailTemplateParamsMap[N];
+    locale?: string;
+};
+export type MailContent = {
+    subject: string;
+    html: string;
+    text: string;
+};
+/**
+ * Renders a localized, branded mail (subject + html + text) from a template
+ * name and typed params. Decouples mail copy/markup from the workflow
+ * services, which pass `{ template, params, locale }` instead of building
+ * HTML. Async because copy resolution runs through ilingo's store contract
+ * (memory today; file- or remote-backed overrides tomorrow).
+ */
+export interface IMailTemplateRenderer {
+    render<N extends MailTemplateName>(input: MailRenderInput<N>): Promise<MailContent>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/mail/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/mail/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAEnF,MAAM,MAAM,WAAW,GAAG;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAClB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC1B,EAAE,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,WAAW,WAAW;IACxB,IAAI,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAMD,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,gBAAgB,GAAG,gBAAgB,IAAI;IACzE,QAAQ,EAAE,CAAC,CAAC;IACZ,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAGjC,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IAClC,MAAM,CAAC,CAAC,SAAS,gBAAgB,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CACvF"}

package/dist/core/mail/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/oauth2/authorization/code/index.d.ts

@@ -0,0 +1,4 @@
+export * from './issuer/index.ts';
+export * from './repository/index.ts';
+export * from './verifier/index.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/authorization/code/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/authorization/code/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC"}

package/dist/core/oauth2/authorization/code/index.mjs

@@ -0,0 +1,7 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { OAuth2AuthorizationCodeIssuer } from "./issuer/module.mjs";
+import { OAuth2AuthorizationCodeVerifier } from "./verifier/module.mjs";
+import "./verifier/index.mjs";
+export { OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeVerifier };

package/dist/core/oauth2/authorization/code/issuer/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/authorization/code/issuer/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code/issuer/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/oauth2/authorization/code/issuer/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { OAuth2AuthorizationCodeIssuer } from "./module.mjs";
+export { OAuth2AuthorizationCodeIssuer };

package/dist/core/oauth2/authorization/code/issuer/module.d.ts

@@ -0,0 +1,11 @@
+import type { Identity, OAuth2AuthorizationCode, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';
+import type { IOAuth2AuthorizationCodeRepository } from '../repository/index.ts';
+import type { IOAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeIssuerOptions } from './types.ts';
+export declare class OAuth2AuthorizationCodeIssuer implements IOAuth2AuthorizationCodeIssuer {
+    protected repository: IOAuth2AuthorizationCodeRepository;
+    protected options: OAuth2AuthorizationCodeIssuerOptions;
+    constructor(repository: IOAuth2AuthorizationCodeRepository, options?: OAuth2AuthorizationCodeIssuerOptions);
+    issue(input: OAuth2AuthorizationCodeRequest, identity: Identity, options?: OAuth2AuthorizationCodeIssuerOptions): Promise<OAuth2AuthorizationCode>;
+    updateIdToken(entity: OAuth2AuthorizationCode, idToken: string): Promise<void>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/oauth2/authorization/code/issuer/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code/issuer/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,uBAAuB,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAC1G,OAAO,KAAK,EAAE,kCAAkC,EAAgC,MAAM,wBAAwB,CAAC;AAC/G,OAAO,KAAK,EAAE,8BAA8B,EAAE,oCAAoC,EAAE,MAAM,YAAY,CAAC;AAEvG,qBAAa,6BAA8B,YAAW,8BAA8B;IAChF,SAAS,CAAC,UAAU,EAAE,kCAAkC,CAAC;IAEzD,SAAS,CAAC,OAAO,EAAE,oCAAoC,CAAC;gBAGpD,UAAU,EAAE,kCAAkC,EAC9C,OAAO,GAAE,oCAAyC;IAMhD,KAAK,CACP,KAAK,EAAE,8BAA8B,EACrC,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,oCAAyC,GAClD,OAAO,CAAC,uBAAuB,CAAC;IAsB9B,aAAa,CACf,MAAM,EAAE,uBAAuB,EAC/B,OAAO,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;CAKpB"}

package/dist/core/oauth2/authorization/code/issuer/module.mjs

@@ -0,0 +1,36 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/oauth2/authorization/code/issuer/module.ts
+var OAuth2AuthorizationCodeIssuer = class {
+	repository;
+	options;
+	constructor(repository, options = {}) {
+		this.repository = repository;
+		this.options = options;
+	}
+	async issue(input, identity, options = {}) {
+		const entity = {
+			redirect_uri: input.redirect_uri,
+			client_id: input.client_id,
+			scope: input.scope,
+			nonce: input.nonce,
+			code_challenge: input.code_challenge,
+			code_challenge_method: input.code_challenge_method,
+			realm_id: identity.data.realm.id,
+			realm_name: identity.data.realm.name,
+			sub: identity.data.id,
+			sub_kind: identity.type
+		};
+		if (options.idToken) entity.id_token = options.idToken;
+		return this.repository.save(entity, { maxAge: options.maxAge ?? this.options.maxAge });
+	}
+	async updateIdToken(entity, idToken) {
+		entity.id_token = idToken;
+		await this.repository.save(entity, { maxAge: this.options.maxAge });
+	}
+};
+//#endregion
+export { OAuth2AuthorizationCodeIssuer };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/authorization/code/issuer/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["OAuth2AuthorizationCodeIssuer","repository","options","issue","input","identity","entity","redirect_uri","client_id","scope","nonce","code_challenge","code_challenge_method","realm_id","data","realm","id","realm_name","name","sub","sub_kind","type","idToken","id_token","save","maxAge","updateIdToken"],"sources":["../../../../../../src/core/oauth2/authorization/code/issuer/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Identity, OAuth2AuthorizationCode, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport type { IOAuth2AuthorizationCodeRepository, OAuth2AuthorizationCodeInput } from '../repository/index.ts';\nimport type { IOAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeIssuerOptions } from './types.ts';\n\nexport class OAuth2AuthorizationCodeIssuer implements IOAuth2AuthorizationCodeIssuer {\n    protected repository: IOAuth2AuthorizationCodeRepository;\n\n    protected options: OAuth2AuthorizationCodeIssuerOptions;\n\n    constructor(\n        repository: IOAuth2AuthorizationCodeRepository,\n        options: OAuth2AuthorizationCodeIssuerOptions = {},\n    ) {\n        this.repository = repository;\n        this.options = options;\n    }\n\n    async issue(\n        input: OAuth2AuthorizationCodeRequest,\n        identity: Identity,\n        options: OAuth2AuthorizationCodeIssuerOptions = {},\n    ) : Promise<OAuth2AuthorizationCode> {\n        const entity: OAuth2AuthorizationCodeInput = {\n            redirect_uri: input.redirect_uri,\n            client_id: input.client_id,\n            scope: input.scope,\n            nonce: input.nonce,\n            code_challenge: input.code_challenge,\n            code_challenge_method: input.code_challenge_method,\n\n            realm_id: identity.data.realm.id,\n            realm_name: identity.data.realm.name,\n            sub: identity.data.id,\n            sub_kind: identity.type,\n        };\n\n        if (options.idToken) {\n            entity.id_token = options.idToken;\n        }\n\n        return this.repository.save(entity, { maxAge: options.maxAge ?? this.options.maxAge });\n    }\n\n    async updateIdToken(\n        entity: OAuth2AuthorizationCode,\n        idToken: string,\n    ) : Promise<void> {\n        entity.id_token = idToken;\n\n        await this.repository.save(entity, { maxAge: this.options.maxAge });\n    }\n}\n"],"mappings":";;;;AAWA,IAAaA,gCAAb,MAAaA;CACCC;CAEAC;CAEV,YACID,YACAC,UAAgD,CAAC,GACnD;EACE,KAAKD,aAAaA;EAClB,KAAKC,UAAUA;CACnB;CAEA,MAAMC,MACFC,OACAC,UACAH,UAAgD,CAAC,GAChB;EACjC,MAAMI,SAAuC;GACzCC,cAAcH,MAAMG;GACpBC,WAAWJ,MAAMI;GACjBC,OAAOL,MAAMK;GACbC,OAAON,MAAMM;GACbC,gBAAgBP,MAAMO;GACtBC,uBAAuBR,MAAMQ;GAE7BC,UAAUR,SAASS,KAAKC,MAAMC;GAC9BC,YAAYZ,SAASS,KAAKC,MAAMG;GAChCC,KAAKd,SAASS,KAAKE;GACnBI,UAAUf,SAASgB;EACvB;EAEA,IAAInB,QAAQoB,SACRhB,OAAOiB,WAAWrB,QAAQoB;EAG9B,OAAO,KAAKrB,WAAWuB,KAAKlB,QAAQ,EAAEmB,QAAQvB,QAAQuB,UAAU,KAAKvB,QAAQuB,OAAO,CAAA;CACxF;CAEA,MAAMC,cACFpB,QACAgB,SACc;EACdhB,OAAOiB,WAAWD;EAElB,MAAM,KAAKrB,WAAWuB,KAAKlB,QAAQ,EAAEmB,QAAQ,KAAKvB,QAAQuB,OAAO,CAAA;CACrE;AACJ"}

package/dist/core/oauth2/authorization/code/issuer/types.d.ts

@@ -0,0 +1,13 @@
+import type { Identity, OAuth2AuthorizationCode, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';
+export type OAuth2AuthorizationCodeIssuerOptions = {
+    /**
+     * Max duration in seconds
+     */
+    maxAge?: number;
+    idToken?: string;
+};
+export interface IOAuth2AuthorizationCodeIssuer {
+    issue(input: OAuth2AuthorizationCodeRequest, identity: Identity, options?: OAuth2AuthorizationCodeIssuerOptions): Promise<OAuth2AuthorizationCode>;
+    updateIdToken(entity: OAuth2AuthorizationCode, idToken: string): Promise<void>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/oauth2/authorization/code/issuer/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code/issuer/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,uBAAuB,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAE1G,MAAM,MAAM,oCAAoC,GAAG;IAC/C;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,WAAW,8BAA8B;IAC3C,KAAK,CACD,KAAK,EAAE,8BAA8B,EACrC,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE,oCAAoC,GAC9C,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAErC,aAAa,CACT,MAAM,EAAE,uBAAuB,EAC/B,OAAO,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAAC;CACrB"}

package/dist/core/oauth2/authorization/code/issuer/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/oauth2/authorization/code/repository/index.d.ts

@@ -0,0 +1,2 @@
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/authorization/code/repository/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code/repository/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC"}

package/dist/core/oauth2/authorization/code/repository/index.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/oauth2/authorization/code/repository/types.d.ts

@@ -0,0 +1,14 @@
+import type { OAuth2AuthorizationCode } from '@authup/core-kit';
+import type { ObjectOptional } from '@authup/kit';
+export type OAuth2AuthorizationCodeRepositorySaveOptions = {
+    maxAge?: number;
+};
+export type OAuth2AuthorizationCodeInput = ObjectOptional<OAuth2AuthorizationCode, 'id'>;
+export interface IOAuth2AuthorizationCodeRepository {
+    removeById(id: string): Promise<void>;
+    remove(entity: OAuth2AuthorizationCode): Promise<void>;
+    findOneById(id: string): Promise<OAuth2AuthorizationCode | null>;
+    popOneById(id: string): Promise<OAuth2AuthorizationCode | null>;
+    save(input: OAuth2AuthorizationCodeInput, options?: OAuth2AuthorizationCodeRepositorySaveOptions): Promise<OAuth2AuthorizationCode>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/oauth2/authorization/code/repository/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code/repository/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,MAAM,4CAA4C,GAAG;IACvD,MAAM,CAAC,EAAE,MAAM,CAAA;CAClB,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG,cAAc,CAAC,uBAAuB,EAAE,IAAI,CAAC,CAAC;AAEzF,MAAM,WAAW,kCAAkC;IAC/C,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtC,MAAM,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvD,WAAW,CAAC,EAAE,EAAE,MAAM,GAAI,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IAElE,UAAU,CAAC,EAAE,EAAE,MAAM,GAAI,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IAEjE,IAAI,CACA,KAAK,EAAE,4BAA4B,EACnC,OAAO,CAAC,EAAE,4CAA4C,GACtD,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACxC"}

package/dist/core/oauth2/authorization/code/repository/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/oauth2/authorization/code/verifier/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/authorization/code/verifier/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code/verifier/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/oauth2/authorization/code/verifier/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { OAuth2AuthorizationCodeVerifier } from "./module.mjs";
+export { OAuth2AuthorizationCodeVerifier };

package/dist/core/oauth2/authorization/code/verifier/module.d.ts

@@ -0,0 +1,9 @@
+import type { OAuth2AuthorizationCode } from '@authup/core-kit';
+import type { IOAuth2AuthorizationCodeRepository } from '../repository/index.ts';
+import type { IOAuth2AuthorizationCodeVerifier, IOAuth2AuthorizationCodeVerifyOptions } from './types.ts';
+export declare class OAuth2AuthorizationCodeVerifier implements IOAuth2AuthorizationCodeVerifier {
+    protected repository: IOAuth2AuthorizationCodeRepository;
+    constructor(repository: IOAuth2AuthorizationCodeRepository);
+    verify(code: string, options: IOAuth2AuthorizationCodeVerifyOptions): Promise<OAuth2AuthorizationCode>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/oauth2/authorization/code/verifier/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code/verifier/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAIhE,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,wBAAwB,CAAC;AACjF,OAAO,KAAK,EAAE,gCAAgC,EAAE,qCAAqC,EAAE,MAAM,YAAY,CAAC;AAE1G,qBAAa,+BAAgC,YAAW,gCAAgC;IACpF,SAAS,CAAC,UAAU,EAAG,kCAAkC,CAAC;gBAE9C,UAAU,EAAE,kCAAkC;IAIpD,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qCAAqC,GAAI,OAAO,CAAC,uBAAuB,CAAC;CAiDhH"}

package/dist/core/oauth2/authorization/code/verifier/module.mjs

@@ -0,0 +1,34 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { buildOAuth2CodeChallenge } from "../../helpers.mjs";
+import { OAuth2AuthorizationCodeChallengeMethod, OAuth2GrantError } from "@authup/specs";
+//#region src/core/oauth2/authorization/code/verifier/module.ts
+var OAuth2AuthorizationCodeVerifier = class {
+	repository;
+	constructor(repository) {
+		this.repository = repository;
+	}
+	async verify(code, options) {
+		const entity = await this.repository.popOneById(code);
+		if (!entity) throw OAuth2GrantError.invalid();
+		if (entity.client_id) {
+			if (!options.clientId || options.clientId !== entity.client_id) throw OAuth2GrantError.invalid();
+		}
+		if (entity.redirect_uri) {
+			if (!options.redirectUri || entity.redirect_uri !== options.redirectUri) throw OAuth2GrantError.redirectUriMismatch();
+		}
+		if (options.clientIsPublic && !entity.code_challenge) throw OAuth2GrantError.invalid("PKCE is required for public clients.");
+		if (entity.code_challenge) {
+			if (!options.codeVerifier) throw OAuth2GrantError.invalid("Code verifier invalid.");
+			if (entity.code_challenge_method === OAuth2AuthorizationCodeChallengeMethod.SHA_256) {
+				if (await buildOAuth2CodeChallenge(options.codeVerifier) !== entity.code_challenge) throw OAuth2GrantError.invalid("PKCE code_verifier mismatch.");
+			} else if (options.codeVerifier !== entity.code_challenge) throw OAuth2GrantError.invalid("PKCE code_verifier mismatch.");
+		}
+		return entity;
+	}
+};
+//#endregion
+export { OAuth2AuthorizationCodeVerifier };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/authorization/code/verifier/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["OAuth2AuthorizationCodeChallengeMethod","OAuth2GrantError","buildOAuth2CodeChallenge","OAuth2AuthorizationCodeVerifier","repository","verify","code","options","entity","popOneById","invalid","client_id","clientId","redirect_uri","redirectUri","redirectUriMismatch","clientIsPublic","code_challenge","codeVerifier","code_challenge_method","SHA_256","codeVerifierHash"],"sources":["../../../../../../src/core/oauth2/authorization/code/verifier/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2AuthorizationCode } from '@authup/core-kit';\nimport { OAuth2AuthorizationCodeChallengeMethod, OAuth2GrantError } from '@authup/specs';\nimport { buildOAuth2CodeChallenge } from '../../helpers.ts';\n\nimport type { IOAuth2AuthorizationCodeRepository } from '../repository/index.ts';\nimport type { IOAuth2AuthorizationCodeVerifier, IOAuth2AuthorizationCodeVerifyOptions } from './types.ts';\n\nexport class OAuth2AuthorizationCodeVerifier implements IOAuth2AuthorizationCodeVerifier {\n    protected repository : IOAuth2AuthorizationCodeRepository;\n\n    constructor(repository: IOAuth2AuthorizationCodeRepository) {\n        this.repository = repository;\n    }\n\n    async verify(code: string, options: IOAuth2AuthorizationCodeVerifyOptions) : Promise<OAuth2AuthorizationCode> {\n        const entity = await this.repository.popOneById(code);\n        if (!entity) {\n            throw OAuth2GrantError.invalid();\n        }\n\n        // RFC 6749 §4.1.3: if the client was issued a client_id, verify the\n        // authorization code was issued to the authenticated client. Always\n        // require a clientId to be supplied so a malformed token request can't\n        // bypass the binding by omitting it.\n        if (entity.client_id) {\n            if (!options.clientId || options.clientId !== entity.client_id) {\n                throw OAuth2GrantError.invalid();\n            }\n        }\n\n        if (entity.redirect_uri) {\n            if (!options.redirectUri || entity.redirect_uri !== options.redirectUri) {\n                throw OAuth2GrantError.redirectUriMismatch();\n            }\n        }\n\n        // Public clients MUST use PKCE (RFC 7636). Defense in depth in case\n        // the authorize-side check was bypassed or the client's\n        // is_confidential flag changed between authorize and token.\n        if (options.clientIsPublic && !entity.code_challenge) {\n            throw OAuth2GrantError.invalid('PKCE is required for public clients.');\n        }\n\n        if (entity.code_challenge) {\n            if (!options.codeVerifier) {\n                throw OAuth2GrantError.invalid('Code verifier invalid.');\n            }\n\n            // RFC 7636 §4.3: code_challenge_method defaults to \"plain\" when\n            // absent. Only treat the challenge as S256 when the client\n            // explicitly sent code_challenge_method=S256.\n            if (entity.code_challenge_method === OAuth2AuthorizationCodeChallengeMethod.SHA_256) {\n                const codeVerifierHash = await buildOAuth2CodeChallenge(options.codeVerifier);\n                if (codeVerifierHash !== entity.code_challenge) {\n                    throw OAuth2GrantError.invalid('PKCE code_verifier mismatch.');\n                }\n            } else if (options.codeVerifier !== entity.code_challenge) {\n                throw OAuth2GrantError.invalid('PKCE code_verifier mismatch.');\n            }\n        }\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;AAcA,IAAaG,kCAAb,MAAaA;CACCC;CAEV,YAAYA,YAAgD;EACxD,KAAKA,aAAaA;CACtB;CAEA,MAAMC,OAAOC,MAAcC,SAAmF;EAC1G,MAAMC,SAAS,MAAM,KAAKJ,WAAWK,WAAWH,IAAAA;EAChD,IAAI,CAACE,QACD,MAAMP,iBAAiBS,QAAO;EAOlC,IAAIF,OAAOG;OACH,CAACJ,QAAQK,YAAYL,QAAQK,aAAaJ,OAAOG,WACjD,MAAMV,iBAAiBS,QAAO;EAAA;EAItC,IAAIF,OAAOK;OACH,CAACN,QAAQO,eAAeN,OAAOK,iBAAiBN,QAAQO,aACxD,MAAMb,iBAAiBc,oBAAmB;EAAA;EAOlD,IAAIR,QAAQS,kBAAkB,CAACR,OAAOS,gBAClC,MAAMhB,iBAAiBS,QAAQ,sCAAA;EAGnC,IAAIF,OAAOS,gBAAgB;GACvB,IAAI,CAACV,QAAQW,cACT,MAAMjB,iBAAiBS,QAAQ,wBAAA;GAMnC,IAAIF,OAAOW,0BAA0BnB,uCAAuCoB;QAEpEC,MAD2BnB,yBAAyBK,QAAQW,YAAY,MACnDV,OAAOS,gBAC5B,MAAMhB,iBAAiBS,QAAQ,8BAAA;GAAA,OAEhC,IAAIH,QAAQW,iBAAiBV,OAAOS,gBACvC,MAAMhB,iBAAiBS,QAAQ,8BAAA;EAEvC;EAEA,OAAOF;CACX;AACJ"}

package/dist/core/oauth2/authorization/code/verifier/types.d.ts

@@ -0,0 +1,11 @@
+import type { OAuth2AuthorizationCode } from '@authup/core-kit';
+export type IOAuth2AuthorizationCodeVerifyOptions = {
+    redirectUri?: string;
+    codeVerifier?: string;
+    clientId?: string;
+    clientIsPublic?: boolean;
+};
+export interface IOAuth2AuthorizationCodeVerifier {
+    verify(code: string, options: IOAuth2AuthorizationCodeVerifyOptions): Promise<OAuth2AuthorizationCode>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/oauth2/authorization/code/verifier/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code/verifier/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAEhE,MAAM,MAAM,qCAAqC,GAAG;IAChD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC5B,CAAC;AAEF,MAAM,WAAW,gCAAgC;IAC7C,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qCAAqC,GAAI,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC3G"}

package/dist/core/oauth2/authorization/code/verifier/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/oauth2/authorization/code-request/index.d.ts

@@ -0,0 +1,3 @@
+export * from './verifier/index.ts';
+export * from './validator.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/authorization/code-request/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/authorization/code-request/index.ts"],"names":[],"mappings":"AAOA,cAAc,qBAAqB,CAAC;AACpC,cAAc,gBAAgB,CAAC"}

package/dist/core/oauth2/authorization/code-request/index.mjs

@@ -0,0 +1,7 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { OAuth2AuthorizationCodeRequestVerifier } from "./verifier/module.mjs";
+import "./verifier/index.mjs";
+import { OAuth2AuthorizationCodeRequestValidator } from "./validator.mjs";
+export { OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier };

package/dist/core/oauth2/authorization/code-request/validator.d.ts

@@ -0,0 +1,6 @@
+import type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';
+import { Container } from 'validup';
+export declare class OAuth2AuthorizationCodeRequestValidator extends Container<OAuth2AuthorizationCodeRequest> {
+    protected initialize(): void;
+}
+//# sourceMappingURL=validator.d.ts.map

package/dist/core/oauth2/authorization/code-request/validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/authorization/code-request/validator.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAQvE,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAGpC,qBAAa,uCAAwC,SAAQ,SAAS,CAAC,8BAA8B,CAAC;IAClG,SAAS,CAAC,UAAU;CA0EvB"}

package/dist/core/oauth2/authorization/code-request/validator.mjs

@@ -0,0 +1,38 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { OAuth2AuthorizationCodeChallengeMethod, OAuth2AuthorizationResponseType, OAuth2ResponseTypeError } from "@authup/specs";
+import { Container } from "validup";
+import { createValidator } from "@validup/zod";
+import { z } from "zod";
+//#region src/core/oauth2/authorization/code-request/validator.ts
+var OAuth2AuthorizationCodeRequestValidator = class extends Container {
+	initialize() {
+		super.initialize();
+		this.mount("response_type", createValidator(z.string().nonempty().check((ctx) => {
+			const availableResponseTypes = Object.values(OAuth2AuthorizationResponseType);
+			const responseTypes = ctx.value.split(" ");
+			for (const responseType of responseTypes) if (!availableResponseTypes.includes(responseType)) {
+				const error = OAuth2ResponseTypeError.unsupported();
+				ctx.issues.push({
+					input: responseType,
+					code: "custom",
+					message: error.message
+				});
+			}
+			return z.NEVER;
+		})));
+		this.mount("redirect_uri", createValidator(z.string().url()));
+		this.mount("scope", createValidator(z.string().min(3).max(512)));
+		this.mount("state", { optional: true }, createValidator(z.string().min(5).max(2048).nullable()));
+		this.mount("code_challenge", { optional: true }, createValidator(z.string().min(1).max(256).nullable()));
+		this.mount("code_challenge_method", { optional: true }, createValidator(z.enum(OAuth2AuthorizationCodeChallengeMethod).nullable()));
+		this.mount("nonce", { optional: true }, createValidator(z.string().min(1).max(512).nullable()));
+		this.mount("realm_id", { optional: true }, createValidator(z.string().nonempty()));
+		this.mount("client_id", createValidator(z.string().nonempty()));
+	}
+};
+//#endregion
+export { OAuth2AuthorizationCodeRequestValidator };
+
+//# sourceMappingURL=validator.mjs.map

package/dist/core/oauth2/authorization/code-request/validator.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"validator.mjs","names":["OAuth2AuthorizationCodeChallengeMethod","OAuth2AuthorizationResponseType","OAuth2ResponseTypeError","createValidator","Container","z","OAuth2AuthorizationCodeRequestValidator","initialize","mount","string","nonempty","check","ctx","availableResponseTypes","Object","values","responseTypes","value","split","responseType","includes","error","unsupported","issues","push","input","code","message","NEVER","url","min","max","optional","nullable","enum"],"sources":["../../../../../src/core/oauth2/authorization/code-request/validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport {\n    OAuth2AuthorizationCodeChallengeMethod,\n    OAuth2AuthorizationResponseType,\n    OAuth2ResponseTypeError,\n} from '@authup/specs';\n\nimport { createValidator } from '@validup/zod';\nimport { Container } from 'validup';\nimport { z } from 'zod';\n\nexport class OAuth2AuthorizationCodeRequestValidator extends Container<OAuth2AuthorizationCodeRequest> {\n    protected initialize() {\n        super.initialize();\n\n        this.mount(\n            'response_type',\n            createValidator(\n                z\n                    .string()\n                    .nonempty()\n                    .check((ctx) => {\n                        const availableResponseTypes = Object.values(OAuth2AuthorizationResponseType);\n                        const responseTypes = ctx.value.split(' ') as OAuth2AuthorizationResponseType[];\n\n                        for (const responseType of responseTypes) {\n                            if (!availableResponseTypes.includes(responseType)) {\n                                const error = OAuth2ResponseTypeError.unsupported();\n                                ctx.issues.push({\n                                    input: responseType,\n                                    code: 'custom',\n                                    message: error.message,\n                                });\n                            }\n                        }\n\n                        return z.NEVER;\n                    }),\n            ),\n        );\n\n        this.mount(\n            'redirect_uri',\n            createValidator(z.string().url()),\n        );\n\n        this.mount(\n            'scope',\n            createValidator(z.string().min(3).max(512)),\n        );\n\n        this.mount(\n            'state',\n            { optional: true },\n            createValidator(z.string().min(5).max(2048).nullable()),\n        );\n\n        this.mount(\n            'code_challenge',\n            { optional: true },\n            createValidator(z.string().min(1).max(256).nullable()),\n        );\n\n        this.mount(\n            'code_challenge_method',\n            { optional: true },\n            createValidator(z.enum(OAuth2AuthorizationCodeChallengeMethod).nullable()),\n        );\n\n        this.mount(\n            'nonce',\n            { optional: true },\n            createValidator(z.string().min(1).max(512).nullable()),\n        );\n\n        this.mount(\n            'realm_id',\n            { optional: true },\n            createValidator(z.string().nonempty()),\n        );\n\n        this.mount(\n            'client_id',\n            createValidator(z.string().nonempty()),\n        );\n    }\n}\n"],"mappings":";;;;;;;;AAkBA,IAAaM,0CAAb,cAA6DF,UAAAA;CAC/CG,aAAa;EACnB,MAAMA,WAAAA;EAEN,KAAKC,MACD,iBACAL,gBACIE,EACKI,OAAM,CAAA,CACNC,SAAQ,CAAA,CACRC,OAAOC,QAAAA;GACJ,MAAMC,yBAAyBC,OAAOC,OAAOd,+BAAAA;GAC7C,MAAMe,gBAAgBJ,IAAIK,MAAMC,MAAM,GAAA;GAEtC,KAAK,MAAMC,gBAAgBH,eACvB,IAAI,CAACH,uBAAuBO,SAASD,YAAAA,GAAe;IAChD,MAAME,QAAQnB,wBAAwBoB,YAAW;IACjDV,IAAIW,OAAOC,KAAK;KACZC,OAAON;KACPO,MAAM;KACNC,SAASN,MAAMM;IACnB,CAAA;GACJ;GAGJ,OAAOtB,EAAEuB;EACb,CAAA,CAAA,CAAA;EAIZ,KAAKpB,MACD,gBACAL,gBAAgBE,EAAEI,OAAM,CAAA,CAAGoB,IAAG,CAAA,CAAA;EAGlC,KAAKrB,MACD,SACAL,gBAAgBE,EAAEI,OAAM,CAAA,CAAGqB,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA,CAAA;EAG1C,KAAKvB,MACD,SACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAEI,OAAM,CAAA,CAAGqB,IAAI,CAAA,CAAA,CAAGC,IAAI,IAAA,CAAA,CAAME,SAAQ,CAAA,CAAA;EAGxD,KAAKzB,MACD,kBACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAEI,OAAM,CAAA,CAAGqB,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA,CAAKE,SAAQ,CAAA,CAAA;EAGvD,KAAKzB,MACD,yBACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAE6B,KAAKlC,sCAAAA,CAAAA,CAAwCiC,SAAQ,CAAA,CAAA;EAG3E,KAAKzB,MACD,SACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAEI,OAAM,CAAA,CAAGqB,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA,CAAKE,SAAQ,CAAA,CAAA;EAGvD,KAAKzB,MACD,YACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAEI,OAAM,CAAA,CAAGC,SAAQ,CAAA,CAAA;EAGvC,KAAKF,MACD,aACAL,gBAAgBE,EAAEI,OAAM,CAAA,CAAGC,SAAQ,CAAA,CAAA;CAE3C;AACJ"}

package/dist/core/oauth2/authorization/code-request/verifier/index.d.ts

@@ -0,0 +1,3 @@
+export * from './types.ts';
+export * from './module.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/authorization/code-request/verifier/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code-request/verifier/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/core/oauth2/authorization/code-request/verifier/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { OAuth2AuthorizationCodeRequestVerifier } from "./module.mjs";
+export { OAuth2AuthorizationCodeRequestVerifier };

package/dist/core/oauth2/authorization/code-request/verifier/module.d.ts

@@ -0,0 +1,15 @@
+import type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';
+import type { IOAuth2ClientRepository } from '../../../client/index.ts';
+import type { IOAuth2ScopeRepository } from '../../../scope/index.ts';
+import type { IOAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeRequestVerificationResult, OAuth2AuthorizationCodeRequestVerifierContext } from './types.ts';
+export declare class OAuth2AuthorizationCodeRequestVerifier implements IOAuth2AuthorizationCodeRequestVerifier {
+    protected clientRepository: IOAuth2ClientRepository;
+    protected scopeRepository: IOAuth2ScopeRepository;
+    constructor(ctx: OAuth2AuthorizationCodeRequestVerifierContext);
+    /**
+     * Verify validated authorization code request.
+     * @param data
+     */
+    verify(data: OAuth2AuthorizationCodeRequest): Promise<OAuth2AuthorizationCodeRequestVerificationResult>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/oauth2/authorization/code-request/verifier/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code-request/verifier/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAWvE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,KAAK,EACR,uCAAuC,EACvC,gDAAgD,EAChD,6CAA6C,EAChD,MAAM,YAAY,CAAC;AASpB,qBAAa,sCAAuC,YAAW,uCAAuC;IAClG,SAAS,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;IAEpD,SAAS,CAAC,eAAe,EAAE,sBAAsB,CAAC;gBAEtC,GAAG,EAAE,6CAA6C;IAK9D;;;OAGG;IACG,MAAM,CACR,IAAI,EAAE,8BAA8B,GACpC,OAAO,CAAC,gDAAgD,CAAC;CA6DhE"}

package/dist/core/oauth2/authorization/code-request/verifier/module.mjs

@@ -0,0 +1,50 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { isSimpleMatch } from "@authup/kit";
+import { ScopeName } from "@authup/core-kit";
+import { OAuth2AuthorizationResponseType, OAuth2ClientError, OAuth2GrantError, OAuth2RequestError, OAuth2ScopeError, hasOAuth2Scopes } from "@authup/specs";
+//#region src/core/oauth2/authorization/code-request/verifier/module.ts
+function willIssueCode(responseType) {
+	if (!responseType) return false;
+	return responseType.split(" ").includes(OAuth2AuthorizationResponseType.CODE);
+}
+var OAuth2AuthorizationCodeRequestVerifier = class {
+	clientRepository;
+	scopeRepository;
+	constructor(ctx) {
+		this.clientRepository = ctx.clientRepository;
+		this.scopeRepository = ctx.scopeRepository;
+	}
+	/**
+	* Verify validated authorization code request.
+	* @param data
+	*/ async verify(data) {
+		if (!data.client_id) throw OAuth2ClientError.invalid();
+		const client = await this.clientRepository.findOneByIdOrName(data.client_id, data.realm_id);
+		if (!client) throw OAuth2ClientError.invalid();
+		if (!client.active) throw OAuth2ClientError.inactive();
+		if (!client.is_confidential && !data.code_challenge && willIssueCode(data.response_type)) throw OAuth2RequestError.malformed("PKCE code_challenge is required for public clients.");
+		if (!client.is_confidential && !data.state && willIssueCode(data.response_type)) throw OAuth2RequestError.malformed("state is required for public clients in the code flow.");
+		data.client_id = client.id;
+		data.realm_id = client.realm_id;
+		const scopes = await this.scopeRepository.findByClientId(client.id);
+		const scopeNames = scopes.map((scope) => scope.name);
+		if (data.scope) {
+			if (!hasOAuth2Scopes(scopeNames, data.scope) && !hasOAuth2Scopes(data.scope, ScopeName.GLOBAL)) throw OAuth2ScopeError.insufficient();
+		} else data.scope = scopeNames.join(" ");
+		if (client.redirect_uri && data.redirect_uri) {
+			const redirectUris = client.redirect_uri.split(",");
+			if (!isSimpleMatch(data.redirect_uri, redirectUris)) throw OAuth2GrantError.redirectUriMismatch();
+		}
+		return {
+			data,
+			client,
+			scopes
+		};
+	}
+};
+//#endregion
+export { OAuth2AuthorizationCodeRequestVerifier };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/authorization/code-request/verifier/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["ScopeName","isSimpleMatch","OAuth2AuthorizationResponseType","OAuth2ClientError","OAuth2GrantError","OAuth2RequestError","OAuth2ScopeError","hasOAuth2Scopes","willIssueCode","responseType","split","includes","CODE","OAuth2AuthorizationCodeRequestVerifier","clientRepository","scopeRepository","ctx","verify","data","client_id","invalid","client","findOneByIdOrName","realm_id","active","inactive","is_confidential","code_challenge","response_type","malformed","state","id","scopes","findByClientId","scopeNames","map","scope","name","GLOBAL","insufficient","join","redirect_uri","redirectUris","redirectUriMismatch"],"sources":["../../../../../../src/core/oauth2/authorization/code-request/verifier/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport { isSimpleMatch } from '@authup/kit';\nimport {\n    OAuth2AuthorizationResponseType,\n    OAuth2ClientError,\n    OAuth2GrantError,\n    OAuth2RequestError,\n    OAuth2ScopeError,\n    hasOAuth2Scopes,\n} from '@authup/specs';\nimport type { IOAuth2ClientRepository } from '../../../client/index.ts';\nimport type { IOAuth2ScopeRepository } from '../../../scope/index.ts';\nimport type {\n    IOAuth2AuthorizationCodeRequestVerifier,\n    OAuth2AuthorizationCodeRequestVerificationResult,\n    OAuth2AuthorizationCodeRequestVerifierContext,\n} from './types.ts';\n\nfunction willIssueCode(responseType: string | undefined): boolean {\n    if (!responseType) {\n        return false;\n    }\n    return responseType.split(' ').includes(OAuth2AuthorizationResponseType.CODE);\n}\n\nexport class OAuth2AuthorizationCodeRequestVerifier implements IOAuth2AuthorizationCodeRequestVerifier {\n    protected clientRepository: IOAuth2ClientRepository;\n\n    protected scopeRepository: IOAuth2ScopeRepository;\n\n    constructor(ctx: OAuth2AuthorizationCodeRequestVerifierContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.scopeRepository = ctx.scopeRepository;\n    }\n\n    /**\n     * Verify validated authorization code request.\n     * @param data\n     */\n    async verify(\n        data: OAuth2AuthorizationCodeRequest,\n    ) : Promise<OAuth2AuthorizationCodeRequestVerificationResult> {\n        if (!data.client_id) {\n            throw OAuth2ClientError.invalid();\n        }\n\n        const client = await this.clientRepository.findOneByIdOrName(data.client_id, data.realm_id);\n        if (!client) {\n            throw OAuth2ClientError.invalid();\n        }\n\n        if (!client.active) {\n            throw OAuth2ClientError.inactive();\n        }\n\n        // Public clients MUST use PKCE for the code flow (RFC 7636 §4.4.1,\n        // OAuth 2.1). Without PKCE a public client's code flow has no second\n        // factor — anyone who intercepts the redirect can redeem the code at\n        // /token. Only enforce when an authorization code will actually be\n        // issued; implicit/id_token-only flows don't involve a code.\n        if (!client.is_confidential && !data.code_challenge && willIssueCode(data.response_type)) {\n            throw OAuth2RequestError.malformed('PKCE code_challenge is required for public clients.');\n        }\n\n        // Public clients SHOULD include state to bind the redirect to the\n        // initiating session and prevent CSRF (RFC 6749 §10.12). Confidential\n        // clients are exempt because the /token exchange already authenticates\n        // them via client_secret.\n        if (!client.is_confidential && !data.state && willIssueCode(data.response_type)) {\n            throw OAuth2RequestError.malformed('state is required for public clients in the code flow.');\n        }\n\n        data.client_id = client.id;\n        data.realm_id = client.realm_id;\n\n        const scopes = await this.scopeRepository.findByClientId(client.id);\n        const scopeNames = scopes.map((scope) => scope.name);\n        if (data.scope) {\n            if (\n                !hasOAuth2Scopes(scopeNames, data.scope) &&\n                !hasOAuth2Scopes(data.scope, ScopeName.GLOBAL)\n            ) {\n                throw OAuth2ScopeError.insufficient();\n            }\n        } else {\n            data.scope = scopeNames.join(' ');\n        }\n\n        if (client.redirect_uri && data.redirect_uri) {\n            const redirectUris = client.redirect_uri.split(',');\n\n            if (!isSimpleMatch(data.redirect_uri, redirectUris)) {\n                throw OAuth2GrantError.redirectUriMismatch();\n            }\n        }\n\n        return {\n            data,\n            client,\n            scopes,\n        };\n    }\n}\n"],"mappings":";;;;;;;AA0BA,SAASQ,cAAcC,cAAgC;CACnD,IAAI,CAACA,cACD,OAAO;CAEX,OAAOA,aAAaC,MAAM,GAAA,CAAA,CAAKC,SAAST,gCAAgCU,IAAI;AAChF;AAEA,IAAaC,yCAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAoD;EAC5D,KAAKF,mBAAmBE,IAAIF;EAC5B,KAAKC,kBAAkBC,IAAID;CAC/B;;;;IAMA,MAAME,OACFC,MAC0D;EAC1D,IAAI,CAACA,KAAKC,WACN,MAAMhB,kBAAkBiB,QAAO;EAGnC,MAAMC,SAAS,MAAM,KAAKP,iBAAiBQ,kBAAkBJ,KAAKC,WAAWD,KAAKK,QAAQ;EAC1F,IAAI,CAACF,QACD,MAAMlB,kBAAkBiB,QAAO;EAGnC,IAAI,CAACC,OAAOG,QACR,MAAMrB,kBAAkBsB,SAAQ;EAQpC,IAAI,CAACJ,OAAOK,mBAAmB,CAACR,KAAKS,kBAAkBnB,cAAcU,KAAKU,aAAa,GACnF,MAAMvB,mBAAmBwB,UAAU,qDAAA;EAOvC,IAAI,CAACR,OAAOK,mBAAmB,CAACR,KAAKY,SAAStB,cAAcU,KAAKU,aAAa,GAC1E,MAAMvB,mBAAmBwB,UAAU,wDAAA;EAGvCX,KAAKC,YAAYE,OAAOU;EACxBb,KAAKK,WAAWF,OAAOE;EAEvB,MAAMS,SAAS,MAAM,KAAKjB,gBAAgBkB,eAAeZ,OAAOU,EAAE;EAClE,MAAMG,aAAaF,OAAOG,KAAKC,UAAUA,MAAMC,IAAI;EACnD,IAAInB,KAAKkB;OAED,CAAC7B,gBAAgB2B,YAAYhB,KAAKkB,KAAK,KACvC,CAAC7B,gBAAgBW,KAAKkB,OAAOpC,UAAUsC,MAAM,GAE7C,MAAMhC,iBAAiBiC,aAAY;EAAA,OAGvCrB,KAAKkB,QAAQF,WAAWM,KAAK,GAAA;EAGjC,IAAInB,OAAOoB,gBAAgBvB,KAAKuB,cAAc;GAC1C,MAAMC,eAAerB,OAAOoB,aAAa/B,MAAM,GAAA;GAE/C,IAAI,CAACT,cAAciB,KAAKuB,cAAcC,YAAAA,GAClC,MAAMtC,iBAAiBuC,oBAAmB;EAElD;EAEA,OAAO;GACHzB;GACAG;GACAW;EACJ;CACJ;AACJ"}

package/dist/core/oauth2/authorization/code-request/verifier/types.d.ts

@@ -0,0 +1,16 @@
+import type { Client, OAuth2AuthorizationCodeRequest, Scope } from '@authup/core-kit';
+import type { IOAuth2ClientRepository } from '../../../client/index.ts';
+import type { IOAuth2ScopeRepository } from '../../../scope/index.ts';
+export type OAuth2AuthorizationCodeRequestVerifierContext = {
+    clientRepository: IOAuth2ClientRepository;
+    scopeRepository: IOAuth2ScopeRepository;
+};
+export type OAuth2AuthorizationCodeRequestVerificationResult = {
+    data: OAuth2AuthorizationCodeRequest;
+    client: Client;
+    scopes: Scope[];
+};
+export interface IOAuth2AuthorizationCodeRequestVerifier {
+    verify(data: OAuth2AuthorizationCodeRequest): Promise<OAuth2AuthorizationCodeRequestVerificationResult>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/oauth2/authorization/code-request/verifier/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code-request/verifier/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACtF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEtE,MAAM,MAAM,6CAA6C,GAAG;IACxD,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,eAAe,EAAE,sBAAsB,CAAA;CAC1C,CAAC;AAEF,MAAM,MAAM,gDAAgD,GAAG;IAC3D,IAAI,EAAE,8BAA8B,CAAC;IAErC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,KAAK,EAAE,CAAA;CAClB,CAAC;AAEF,MAAM,WAAW,uCAAuC;IACpD,MAAM,CACF,IAAI,EAAE,8BAA8B,GACpC,OAAO,CAAC,gDAAgD,CAAC,CAAC;CACjE"}

package/dist/core/oauth2/authorization/code-request/verifier/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/oauth2/authorization/helpers.d.ts

@@ -0,0 +1,5 @@
+export declare function generateOAuth2CodeVerifier(): string;
+export declare function base64URLEncode(arrayBuffer: ArrayBuffer): string;
+export declare function buildOAuth2TokenHash(value: string): Promise<string>;
+export declare function buildOAuth2CodeChallenge(codeVerifier: string): Promise<string>;
+//# sourceMappingURL=helpers.d.ts.map

package/dist/core/oauth2/authorization/helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/authorization/helpers.ts"],"names":[],"mappings":"AASA,wBAAgB,0BAA0B,WAazC;AAED,wBAAgB,eAAe,CAAC,WAAW,EAAE,WAAW,UAWvD;AAED,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAI,OAAO,CAAC,MAAM,CAAC,CAO1E;AAED,wBAAsB,wBAAwB,CAAC,YAAY,EAAE,MAAM,mBAMlE"}