@authup/server-core 1.0.0-beta.50 → 1.0.0-beta.51

package/dist/adapters/http/adapters/oauth2/grant-types/password.mjs

@@ -3,24 +3,32 @@ import "node:url";
 import.meta.url;
 import { PasswordGrantType } from "../../../../../core/oauth2/grant-types/password.mjs";
 import "../../../../../core/index.mjs";
-import { extractClientCredentialsFromRequest } from "./utils/credentials.mjs";
+import { extractClientCredentialsFromRequest, readStringField } from "./utils/credentials.mjs";
 import "./utils/index.mjs";
+import { OAuth2RequestError } from "@authup/specs";
 import { getRequestHeader, getRequestIP } from "routup";
 import { readRequestBody } from "@routup/basic/body";
 //#region src/adapters/http/adapters/oauth2/grant-types/password.ts
 var HTTPPasswordGrant = class extends PasswordGrantType {
 	authenticator;
 	clientAuthenticator;
+	realmRepository;
 	constructor(ctx) {
 		super(ctx);
 		this.authenticator = ctx.authenticator;
 		this.clientAuthenticator = ctx.clientAuthenticator;
+		this.realmRepository = ctx.realmRepository;
 	}
 	async runWithRequest(event) {
-		const { username, password, realm_id: realmId } = await readRequestBody(event) || {};
+		const body = await readRequestBody(event);
+		const username = readStringField(body, "username");
+		const password = readStringField(body, "password");
+		if (!username || !password) throw OAuth2RequestError.malformed("username and password must be provided.");
 		const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);
-		const client = clientId ? await this.clientAuthenticator.authenticate(clientId, clientSecret, typeof realmId === "string" ? realmId : void 0) : void 0;
-		const user = await this.authenticator.authenticate(username, password, realmId);
+		const realmHint = [readStringField(body, "realm_id"), readStringField(body, "realm_name")].map((value) => value?.trim().toLowerCase()).find((value) => !!value);
+		const realm = await this.realmRepository.resolve(realmHint, true);
+		const client = clientId ? await this.clientAuthenticator.authenticate(clientId, clientSecret, realm.id) : void 0;
+		const user = await this.authenticator.authenticate(username, password, realm.id);
 		return this.runWith({
 			user,
 			client

package/dist/adapters/http/adapters/oauth2/grant-types/password.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"password.mjs","names":["readRequestBody","getRequestHeader","getRequestIP","PasswordGrantType","extractClientCredentialsFromRequest","HTTPPasswordGrant","authenticator","clientAuthenticator","ctx","runWithRequest","event","body","username","password","realm_id","realmId","clientId","clientSecret","client","authenticate","undefined","user","runWith","ipAddress","trustProxy","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/password.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { User } from '@authup/core-kit';\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type { ICredentialsAuthenticator, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';\nimport { PasswordGrantType } from '../../../../../core/index.ts';\nimport type { HTTPOAuth2PasswordGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport { extractClientCredentialsFromRequest } from './utils/index.ts';\n\nexport class HTTPPasswordGrant extends PasswordGrantType implements IHTTPOAuth2Grant {\n    protected authenticator : ICredentialsAuthenticator<User>;\n\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    constructor(ctx: HTTPOAuth2PasswordGrantContext) {\n        super(ctx);\n\n        this.authenticator = ctx.authenticator;\n        this.clientAuthenticator = ctx.clientAuthenticator;\n    }\n\n    async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const body = await readRequestBody(event);\n        const {\n            username,\n            password,\n            realm_id: realmId,\n        } = body || {};\n\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n\n        const client = clientId ?\n            await this.clientAuthenticator.authenticate(\n                clientId,\n                clientSecret,\n                typeof realmId === 'string' ? realmId : undefined,\n            ) :\n            undefined;\n\n        const user = await this.authenticator.authenticate(username, password, realmId);\n\n        return this.runWith(\n            { user, client },\n            {\n                ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n                userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n            },\n        );\n    }\n}\n"],"mappings":";;;;;;;;;;AAiBA,IAAaK,oBAAb,cAAuCF,kBAAAA;CACzBG;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAMA,GAAAA;EAEN,KAAKF,gBAAgBE,IAAIF;EACzB,KAAKC,sBAAsBC,IAAID;CACnC;CAEA,MAAME,eAAeC,OAAqD;EAEtE,MAAM,EACFE,UACAC,UACAC,UAAUC,YACVJ,MALeX,gBAAgBU,KAAAA,KAKvB,CAAC;EAEb,MAAM,EAAEM,UAAUC,iBAAiB,MAAMb,oCAAoCM,KAAAA;EAE7E,MAAMQ,SAASF,WACX,MAAM,KAAKT,oBAAoBY,aAC3BH,UACAC,cACA,OAAOF,YAAY,WAAWA,UAAUK,KAAAA,CAAAA,IAE5CA,KAAAA;EAEJ,MAAMC,OAAO,MAAM,KAAKf,cAAca,aAAaP,UAAUC,UAAUE,OAAAA;EAEvE,OAAO,KAAKO,QACR;GAAED;GAAMH;EAAO,GACf;GACIK,WAAWrB,aAAaQ,OAAO,EAAEc,YAAY,KAAK,CAAA,KAAMJ,KAAAA;GACxDK,WAAWxB,iBAAiBS,OAAO,YAAA,KAAiBU,KAAAA;EACxD,CAAA;CAER;AACJ"}
+{"version":3,"file":"password.mjs","names":["OAuth2RequestError","readRequestBody","getRequestHeader","getRequestIP","PasswordGrantType","extractClientCredentialsFromRequest","readStringField","HTTPPasswordGrant","authenticator","clientAuthenticator","realmRepository","ctx","runWithRequest","event","body","username","password","malformed","clientId","clientSecret","realmHint","map","value","trim","toLowerCase","find","realm","resolve","client","authenticate","id","undefined","user","runWith","ipAddress","trustProxy","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/password.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { User } from '@authup/core-kit';\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2RequestError } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type { ICredentialsAuthenticator, IRealmRepository, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';\nimport { PasswordGrantType } from '../../../../../core/index.ts';\nimport type { HTTPOAuth2PasswordGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport { extractClientCredentialsFromRequest, readStringField } from './utils/index.ts';\n\nexport class HTTPPasswordGrant extends PasswordGrantType implements IHTTPOAuth2Grant {\n    protected authenticator : ICredentialsAuthenticator<User>;\n\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    protected realmRepository : IRealmRepository;\n\n    constructor(ctx: HTTPOAuth2PasswordGrantContext) {\n        super(ctx);\n\n        this.authenticator = ctx.authenticator;\n        this.clientAuthenticator = ctx.clientAuthenticator;\n        this.realmRepository = ctx.realmRepository;\n    }\n\n    async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const body = await readRequestBody(event);\n\n        const username = readStringField(body, 'username');\n        const password = readStringField(body, 'password');\n        if (!username || !password) {\n            throw OAuth2RequestError.malformed('username and password must be provided.');\n        }\n\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n\n        // canonical identifier form: realm names are stored LOWER(TRIM(...))\n        const realmHint = [\n            readStringField(body, 'realm_id'),\n            readStringField(body, 'realm_name'),\n        ]\n            .map((value) => value?.trim().toLowerCase())\n            .find((value) => !!value);\n\n        const realm = await this.realmRepository.resolve(realmHint, true);\n\n        const client = clientId ?\n            await this.clientAuthenticator.authenticate(\n                clientId,\n                clientSecret,\n                realm.id,\n            ) :\n            undefined;\n\n        const user = await this.authenticator.authenticate(username, password, realm.id);\n\n        return this.runWith(\n            { user, client },\n            {\n                ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n                userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n            },\n        );\n    }\n}\n"],"mappings":";;;;;;;;;;;AAkBA,IAAaO,oBAAb,cAAuCH,kBAAAA;CACzBI;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAMA,GAAAA;EAEN,KAAKH,gBAAgBG,IAAIH;EACzB,KAAKC,sBAAsBE,IAAIF;EAC/B,KAAKC,kBAAkBC,IAAID;CAC/B;CAEA,MAAME,eAAeC,OAAqD;EACtE,MAAMC,OAAO,MAAMb,gBAAgBY,KAAAA;EAEnC,MAAME,WAAWT,gBAAgBQ,MAAM,UAAA;EACvC,MAAME,WAAWV,gBAAgBQ,MAAM,UAAA;EACvC,IAAI,CAACC,YAAY,CAACC,UACd,MAAMhB,mBAAmBiB,UAAU,yCAAA;EAGvC,MAAM,EAAEC,UAAUC,iBAAiB,MAAMd,oCAAoCQ,KAAAA;EAG7E,MAAMO,YAAY,CACdd,gBAAgBQ,MAAM,UAAA,GACtBR,gBAAgBQ,MAAM,YAAA,CAAA,CACzB,CACIO,KAAKC,UAAUA,OAAOC,KAAAA,CAAAA,CAAOC,YAAAA,CAAAA,CAAAA,CAC7BC,MAAMH,UAAU,CAAC,CAACA,KAAAA;EAEvB,MAAMI,QAAQ,MAAM,KAAKhB,gBAAgBiB,QAAQP,WAAW,IAAA;EAE5D,MAAMQ,SAASV,WACX,MAAM,KAAKT,oBAAoBoB,aAC3BX,UACAC,cACAO,MAAMI,EAAE,IAEZC,KAAAA;EAEJ,MAAMC,OAAO,MAAM,KAAKxB,cAAcqB,aAAad,UAAUC,UAAUU,MAAMI,EAAE;EAE/E,OAAO,KAAKG,QACR;GAAED;GAAMJ;EAAO,GACf;GACIM,WAAW/B,aAAaU,OAAO,EAAEsB,YAAY,KAAK,CAAA,KAAMJ,KAAAA;GACxDK,WAAWlC,iBAAiBW,OAAO,YAAA,KAAiBkB,KAAAA;EACxD,CAAA;CAER;AACJ"}

package/dist/adapters/http/adapters/oauth2/grant-types/types.d.ts

@@ -1,7 +1,7 @@
 import type { Client, Robot, User } from '@authup/core-kit';
 import type { OAuth2TokenGrantResponse } from '@authup/specs';
 import type { IAppEvent } from 'routup';
-import type { BaseGrantContext, ICredentialsAuthenticator, IOAuth2AuthorizationCodeVerifier, OAuth2AuthorizeGrantContext, OAuth2ClientAuthenticator, OAuth2PasswordGrantContext, OAuth2RefreshTokenGrantContext } from '../../../../../core/index.ts';
+import type { BaseGrantContext, ICredentialsAuthenticator, IOAuth2AuthorizationCodeVerifier, IRealmRepository, OAuth2AuthorizeGrantContext, OAuth2ClientAuthenticator, OAuth2PasswordGrantContext, OAuth2RefreshTokenGrantContext } from '../../../../../core/index.ts';
 export type HTTPOAuth2AuthorizeGrantContext = OAuth2AuthorizeGrantContext & {
     codeVerifier: IOAuth2AuthorizationCodeVerifier;
     clientAuthenticator: OAuth2ClientAuthenticator;
@@ -12,6 +12,7 @@ export interface IHTTPOAuth2Grant {
 export type HTTPOAuth2PasswordGrantContext = OAuth2PasswordGrantContext & {
     authenticator: ICredentialsAuthenticator<User>;
     clientAuthenticator: OAuth2ClientAuthenticator;
+    realmRepository: IRealmRepository;
 };
 export type HTTPOAuth2RefreshTokenGrantContext = OAuth2RefreshTokenGrantContext & {
     clientAuthenticator: OAuth2ClientAuthenticator;

package/dist/adapters/http/adapters/oauth2/grant-types/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EACR,gBAAgB,EAChB,yBAAyB,EACzB,gCAAgC,EAChC,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,8BAA8B,EACjC,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,+BAA+B,GAAG,2BAA2B,GAAG;IACxE,YAAY,EAAE,gCAAgC,CAAC;IAC/C,mBAAmB,EAAE,yBAAyB,CAAC;CAClD,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC7B,cAAc,CAAC,KAAK,EAAE,SAAS,GAAI,OAAO,CAAC,wBAAwB,CAAC,CAAA;CACvE;AAED,MAAM,MAAM,8BAA8B,GAAG,0BAA0B,GAAG;IACtE,aAAa,EAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAChD,mBAAmB,EAAE,yBAAyB,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,kCAAkC,GAAG,8BAA8B,GAAG;IAC9E,mBAAmB,EAAE,yBAAyB,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,uCAAuC,GAAG,gBAAgB,GAAG;IACrE,aAAa,EAAG,yBAAyB,CAAC,MAAM,CAAC,CAAA;CACpD,CAAC;AAEF,MAAM,MAAM,sCAAsC,GAAG,gBAAgB,GAAG;IACpE,aAAa,EAAG,yBAAyB,CAAC,KAAK,CAAC,CAAA;CACnD,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EACR,gBAAgB,EAChB,yBAAyB,EACzB,gCAAgC,EAChC,gBAAgB,EAChB,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,8BAA8B,EACjC,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,+BAA+B,GAAG,2BAA2B,GAAG;IACxE,YAAY,EAAE,gCAAgC,CAAC;IAC/C,mBAAmB,EAAE,yBAAyB,CAAC;CAClD,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC7B,cAAc,CAAC,KAAK,EAAE,SAAS,GAAI,OAAO,CAAC,wBAAwB,CAAC,CAAA;CACvE;AAED,MAAM,MAAM,8BAA8B,GAAG,0BAA0B,GAAG;IACtE,aAAa,EAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAChD,mBAAmB,EAAE,yBAAyB,CAAC;IAC/C,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,kCAAkC,GAAG,8BAA8B,GAAG;IAC9E,mBAAmB,EAAE,yBAAyB,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,uCAAuC,GAAG,gBAAgB,GAAG;IACrE,aAAa,EAAG,yBAAyB,CAAC,MAAM,CAAC,CAAA;CACpD,CAAC;AAEF,MAAM,MAAM,sCAAsC,GAAG,gBAAgB,GAAG;IACpE,aAAa,EAAG,yBAAyB,CAAC,KAAK,CAAC,CAAA;CACnD,CAAC"}

package/dist/adapters/http/adapters/oauth2/grant-types/utils/credentials.d.ts

@@ -12,4 +12,5 @@ export type ExtractedClientCredentials = {
  * request body.
  */
 export declare function extractClientCredentialsFromRequest(event: IAppEvent): Promise<ExtractedClientCredentials>;
+export declare function readStringField(body: Record<string, any> | undefined, key: string): string | undefined;
 //# sourceMappingURL=credentials.d.ts.map

package/dist/adapters/http/adapters/oauth2/grant-types/utils/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/credentials.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,MAAM,MAAM,0BAA0B,GAAG;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAsB,mCAAmC,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,0BAA0B,CAAC,CA6B/G"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/credentials.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,MAAM,MAAM,0BAA0B,GAAG;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAsB,mCAAmC,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,0BAA0B,CAAC,CA6B/G;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGtG"}

package/dist/adapters/http/adapters/oauth2/grant-types/utils/credentials.mjs

@@ -56,6 +56,6 @@ function formDecode(value) {
 	}
 }
 //#endregion
-export { extractClientCredentialsFromRequest };
+export { extractClientCredentialsFromRequest, readStringField };
 
 //# sourceMappingURL=credentials.mjs.map

package/dist/adapters/http/adapters/oauth2/grant-types/utils/credentials.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.mjs","names":["OAuth2RequestError","readRequestBody","AuthorizationHeaderType","parseAuthorizationHeader","extractClientCredentialsFromRequest","event","body","bodyClientId","readStringField","bodyClientSecret","hasBodyCredentials","basicCredentials","parseBasicCredentials","malformed","clientId","clientSecret","key","value","length","undefined","headerValue","headers","get","header","type","BASIC","formDecode","username","password","decodeURIComponent","replace"],"sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/credentials.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { OAuth2RequestError } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport { AuthorizationHeaderType, parseAuthorizationHeader } from 'hapic';\nimport type { IAppEvent } from 'routup';\n\nexport type ExtractedClientCredentials = {\n    clientId?: string,\n    clientSecret?: string,\n};\n\n/**\n * Extract client credentials from an OAuth2 token endpoint request.\n *\n * Per RFC 6749 §2.3.1, the server MUST NOT support multiple client\n * authentication methods in a single request. This helper rejects requests\n * that present credentials in BOTH the Basic Authorization header and the\n * request body.\n */\nexport async function extractClientCredentialsFromRequest(event: IAppEvent): Promise<ExtractedClientCredentials> {\n    const body = await readRequestBody(event);\n    const bodyClientId = readStringField(body, 'client_id');\n    const bodyClientSecret = readStringField(body, 'client_secret');\n    const hasBodyCredentials = !!bodyClientId || !!bodyClientSecret;\n\n    const basicCredentials = parseBasicCredentials(event);\n\n    if (hasBodyCredentials && basicCredentials) {\n        throw OAuth2RequestError.malformed(\n            'Client credentials must be provided either via Basic Authorization header or request body, not both.',\n        );\n    }\n\n    if (hasBodyCredentials) {\n        // Reject stray client_secret without client_id — otherwise grants\n        // that gate auth on `if (clientId)` would silently skip\n        // authentication and leak through with the secret discarded.\n        if (!bodyClientId) {\n            throw OAuth2RequestError.malformed('client_secret was provided without client_id.');\n        }\n        return { clientId: bodyClientId, clientSecret: bodyClientSecret };\n    }\n\n    if (basicCredentials) {\n        return basicCredentials;\n    }\n\n    return {};\n}\n\nfunction readStringField(body: Record<string, any> | undefined, key: string): string | undefined {\n    const value = body?.[key];\n    return typeof value === 'string' && value.length > 0 ? value : undefined;\n}\n\nfunction parseBasicCredentials(event: IAppEvent): ExtractedClientCredentials | undefined {\n    const headerValue = event.headers.get('authorization');\n    if (!headerValue) {\n        return undefined;\n    }\n\n    let header;\n    try {\n        header = parseAuthorizationHeader(headerValue);\n    } catch {\n        // Malformed Authorization header — surface as 400 invalid_request\n        // rather than letting hapic's error propagate as 500.\n        throw OAuth2RequestError.malformed('Malformed Authorization header.');\n    }\n\n    if (header.type !== AuthorizationHeaderType.BASIC) {\n        return undefined;\n    }\n\n    // RFC 6749 §2.3.1 + Appendix B: client_id and client_secret are\n    // application/x-www-form-urlencoded BEFORE base64 encoding in the\n    // Authorization header. hapic only base64-decodes; we form-decode here\n    // so credentials containing reserved characters (`:`, `+`, `%`, `&`,\n    // `=`, etc.) round-trip correctly.\n    return {\n        clientId: formDecode(header.username),\n        clientSecret: formDecode(header.password),\n    };\n}\n\nfunction formDecode(value: string): string {\n    try {\n        // application/x-www-form-urlencoded: '+' represents space; %XX is\n        // percent-encoded UTF-8.\n        return decodeURIComponent(value.replace(/\\+/g, ' '));\n    } catch {\n        // Malformed percent-encoding — return raw value rather than\n        // throwing; the caller will still validate via authentication.\n        return value;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;GAyBA,eAAsBI,oCAAoCC,OAAgB;CACtE,MAAMC,OAAO,MAAML,gBAAgBI,KAAAA;CACnC,MAAME,eAAeC,gBAAgBF,MAAM,WAAA;CAC3C,MAAMG,mBAAmBD,gBAAgBF,MAAM,eAAA;CAC/C,MAAMI,qBAAqB,CAAC,CAACH,gBAAgB,CAAC,CAACE;CAE/C,MAAME,mBAAmBC,sBAAsBP,KAAAA;CAE/C,IAAIK,sBAAsBC,kBACtB,MAAMX,mBAAmBa,UACrB,sGAAA;CAIR,IAAIH,oBAAoB;EAIpB,IAAI,CAACH,cACD,MAAMP,mBAAmBa,UAAU,+CAAA;EAEvC,OAAO;GAAEC,UAAUP;GAAcQ,cAAcN;EAAiB;CACpE;CAEA,IAAIE,kBACA,OAAOA;CAGX,OAAO,CAAC;AACZ;AAEA,SAASH,gBAAgBF,MAAuCU,KAAW;CACvE,MAAMC,QAAQX,OAAOU;CACrB,OAAO,OAAOC,UAAU,YAAYA,MAAMC,SAAS,IAAID,QAAQE,KAAAA;AACnE;AAEA,SAASP,sBAAsBP,OAAgB;CAC3C,MAAMe,cAAcf,MAAMgB,QAAQC,IAAI,eAAA;CACtC,IAAI,CAACF,aACD;CAGJ,IAAIG;CACJ,IAAI;EACAA,SAASpB,yBAAyBiB,WAAAA;CACtC,QAAQ;EAGJ,MAAMpB,mBAAmBa,UAAU,iCAAA;CACvC;CAEA,IAAIU,OAAOC,SAAStB,wBAAwBuB,OACxC;CAQJ,OAAO;EACHX,UAAUY,WAAWH,OAAOI,QAAQ;EACpCZ,cAAcW,WAAWH,OAAOK,QAAQ;CAC5C;AACJ;AAEA,SAASF,WAAWT,OAAa;CAC7B,IAAI;EAGA,OAAOY,mBAAmBZ,MAAMa,QAAQ,OAAO,GAAA,CAAA;CACnD,QAAQ;EAGJ,OAAOb;CACX;AACJ"}
+{"version":3,"file":"credentials.mjs","names":["OAuth2RequestError","readRequestBody","AuthorizationHeaderType","parseAuthorizationHeader","extractClientCredentialsFromRequest","event","body","bodyClientId","readStringField","bodyClientSecret","hasBodyCredentials","basicCredentials","parseBasicCredentials","malformed","clientId","clientSecret","key","value","length","undefined","headerValue","headers","get","header","type","BASIC","formDecode","username","password","decodeURIComponent","replace"],"sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/credentials.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { OAuth2RequestError } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport { AuthorizationHeaderType, parseAuthorizationHeader } from 'hapic';\nimport type { IAppEvent } from 'routup';\n\nexport type ExtractedClientCredentials = {\n    clientId?: string,\n    clientSecret?: string,\n};\n\n/**\n * Extract client credentials from an OAuth2 token endpoint request.\n *\n * Per RFC 6749 §2.3.1, the server MUST NOT support multiple client\n * authentication methods in a single request. This helper rejects requests\n * that present credentials in BOTH the Basic Authorization header and the\n * request body.\n */\nexport async function extractClientCredentialsFromRequest(event: IAppEvent): Promise<ExtractedClientCredentials> {\n    const body = await readRequestBody(event);\n    const bodyClientId = readStringField(body, 'client_id');\n    const bodyClientSecret = readStringField(body, 'client_secret');\n    const hasBodyCredentials = !!bodyClientId || !!bodyClientSecret;\n\n    const basicCredentials = parseBasicCredentials(event);\n\n    if (hasBodyCredentials && basicCredentials) {\n        throw OAuth2RequestError.malformed(\n            'Client credentials must be provided either via Basic Authorization header or request body, not both.',\n        );\n    }\n\n    if (hasBodyCredentials) {\n        // Reject stray client_secret without client_id — otherwise grants\n        // that gate auth on `if (clientId)` would silently skip\n        // authentication and leak through with the secret discarded.\n        if (!bodyClientId) {\n            throw OAuth2RequestError.malformed('client_secret was provided without client_id.');\n        }\n        return { clientId: bodyClientId, clientSecret: bodyClientSecret };\n    }\n\n    if (basicCredentials) {\n        return basicCredentials;\n    }\n\n    return {};\n}\n\nexport function readStringField(body: Record<string, any> | undefined, key: string): string | undefined {\n    const value = body?.[key];\n    return typeof value === 'string' && value.length > 0 ? value : undefined;\n}\n\nfunction parseBasicCredentials(event: IAppEvent): ExtractedClientCredentials | undefined {\n    const headerValue = event.headers.get('authorization');\n    if (!headerValue) {\n        return undefined;\n    }\n\n    let header;\n    try {\n        header = parseAuthorizationHeader(headerValue);\n    } catch {\n        // Malformed Authorization header — surface as 400 invalid_request\n        // rather than letting hapic's error propagate as 500.\n        throw OAuth2RequestError.malformed('Malformed Authorization header.');\n    }\n\n    if (header.type !== AuthorizationHeaderType.BASIC) {\n        return undefined;\n    }\n\n    // RFC 6749 §2.3.1 + Appendix B: client_id and client_secret are\n    // application/x-www-form-urlencoded BEFORE base64 encoding in the\n    // Authorization header. hapic only base64-decodes; we form-decode here\n    // so credentials containing reserved characters (`:`, `+`, `%`, `&`,\n    // `=`, etc.) round-trip correctly.\n    return {\n        clientId: formDecode(header.username),\n        clientSecret: formDecode(header.password),\n    };\n}\n\nfunction formDecode(value: string): string {\n    try {\n        // application/x-www-form-urlencoded: '+' represents space; %XX is\n        // percent-encoded UTF-8.\n        return decodeURIComponent(value.replace(/\\+/g, ' '));\n    } catch {\n        // Malformed percent-encoding — return raw value rather than\n        // throwing; the caller will still validate via authentication.\n        return value;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;GAyBA,eAAsBI,oCAAoCC,OAAgB;CACtE,MAAMC,OAAO,MAAML,gBAAgBI,KAAAA;CACnC,MAAME,eAAeC,gBAAgBF,MAAM,WAAA;CAC3C,MAAMG,mBAAmBD,gBAAgBF,MAAM,eAAA;CAC/C,MAAMI,qBAAqB,CAAC,CAACH,gBAAgB,CAAC,CAACE;CAE/C,MAAME,mBAAmBC,sBAAsBP,KAAAA;CAE/C,IAAIK,sBAAsBC,kBACtB,MAAMX,mBAAmBa,UACrB,sGAAA;CAIR,IAAIH,oBAAoB;EAIpB,IAAI,CAACH,cACD,MAAMP,mBAAmBa,UAAU,+CAAA;EAEvC,OAAO;GAAEC,UAAUP;GAAcQ,cAAcN;EAAiB;CACpE;CAEA,IAAIE,kBACA,OAAOA;CAGX,OAAO,CAAC;AACZ;AAEA,SAAgBH,gBAAgBF,MAAuCU,KAAW;CAC9E,MAAMC,QAAQX,OAAOU;CACrB,OAAO,OAAOC,UAAU,YAAYA,MAAMC,SAAS,IAAID,QAAQE,KAAAA;AACnE;AAEA,SAASP,sBAAsBP,OAAgB;CAC3C,MAAMe,cAAcf,MAAMgB,QAAQC,IAAI,eAAA;CACtC,IAAI,CAACF,aACD;CAGJ,IAAIG;CACJ,IAAI;EACAA,SAASpB,yBAAyBiB,WAAAA;CACtC,QAAQ;EAGJ,MAAMpB,mBAAmBa,UAAU,iCAAA;CACvC;CAEA,IAAIU,OAAOC,SAAStB,wBAAwBuB,OACxC;CAQJ,OAAO;EACHX,UAAUY,WAAWH,OAAOI,QAAQ;EACpCZ,cAAcW,WAAWH,OAAOK,QAAQ;CAC5C;AACJ;AAEA,SAASF,WAAWT,OAAa;CAC7B,IAAI;EAGA,OAAOY,mBAAmBZ,MAAMa,QAAQ,OAAO,GAAA,CAAA;CACnD,QAAQ;EAGJ,OAAOb;CACX;AACJ"}

package/dist/adapters/http/adapters/oauth2/grant-types/utils/index.mjs

@@ -1,6 +1,6 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { extractClientCredentialsFromRequest } from "./credentials.mjs";
+import { extractClientCredentialsFromRequest, readStringField } from "./credentials.mjs";
 import { guessOauth2GrantTypeByRequest } from "./guess.mjs";
-export { extractClientCredentialsFromRequest, guessOauth2GrantTypeByRequest };
+export { extractClientCredentialsFromRequest, guessOauth2GrantTypeByRequest, readStringField };

package/dist/adapters/http/adapters/oauth2/index.mjs

@@ -3,7 +3,7 @@ import "node:url";
 import.meta.url;
 import { HTTPOAuth2Authorizer } from "./authorization/module.mjs";
 import "./authorization/index.mjs";
-import { extractClientCredentialsFromRequest } from "./grant-types/utils/credentials.mjs";
+import { extractClientCredentialsFromRequest, readStringField } from "./grant-types/utils/credentials.mjs";
 import { guessOauth2GrantTypeByRequest } from "./grant-types/utils/guess.mjs";
 import { HTTPOAuth2AuthorizeGrant } from "./grant-types/authorize.mjs";
 import { HTTPClientCredentialsGrant } from "./grant-types/client-credentials.mjs";
@@ -12,4 +12,4 @@ import { HTTPPasswordGrant } from "./grant-types/password.mjs";
 import { HTTPOAuth2RefreshTokenGrant } from "./grant-types/refresh_token.mjs";
 import { HTTPRobotCredentialsGrant } from "./grant-types/robot-credentials.mjs";
 import "./grant-types/index.mjs";
-export { HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, extractClientCredentialsFromRequest, guessOauth2GrantTypeByRequest };
+export { HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, extractClientCredentialsFromRequest, guessOauth2GrantTypeByRequest, readStringField };

package/dist/adapters/http/controllers/entities/identity-provider/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/module.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAMxC,OAAO,KAAK,EAAE,gBAAgB,EAAkC,MAAM,kBAAkB,CAAC;AAgBzF,OAAO,KAAK,EACR,wBAAwB,EACxB,6BAA6B,EAC7B,2BAA2B,EAC3B,6BAA6B,EAChC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EACR,+BAA+B,EAC/B,2BAA2B,EAC3B,8BAA8B,EAC9B,uCAAuC,EACvC,gCAAgC,EAChC,gBAAgB,EAEnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACH,uCAAuC,EAE1C,MAAM,8BAA8B,CAAC;AAWtC,OAAO,KAAK,EAAE,iCAAiC,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAEvG,qBAEa,0BAA0B;IACnC,SAAS,CAAC,OAAO,EAAE,iCAAiC,CAAC;IAErD,SAAS,CAAC,UAAU,EAAE,2BAA2B,CAAC;IAElD,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,cAAc,EAAE,+BAA+B,CAAC;IAE1D,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,oBAAoB,EAAG,uCAAuC,CAAC;IAEzE,SAAS,CAAC,YAAY,EAAG,gCAAgC,CAAC;IAE1D,SAAS,CAAC,UAAU,EAAG,8BAA8B,CAAC;gBAI1C,GAAG,EAAE,iCAAiC;IAc5C,YAAY,CACF,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;IA+BhD,WAAW,CACA,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,gBAAgB,CAAC;IA0BtB,YAAY,CACD,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,6BAA6B,EAChC,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,gBAAgB,CAAC;IAKvB,GAAG,CACQ,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,2BAA2B,EAC9B,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,gBAAgB,CAAC;IAKvB,YAAY,CACD,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,gBAAgB,CAAC;IA6BvB,WAAW,CACJ,IAAI,EAAE,6BAA6B,EAChC,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,gBAAgB,CAAC;IAOvB,YAAY,CACD,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS;IAgD1B,WAAW,CACA,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS;YA2ElB,KAAK;YA4FL,OAAO;YAYP,sBAAsB;YAWtB,wBAAwB;CAWzC"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/module.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAMxC,OAAO,KAAK,EAAE,gBAAgB,EAAkC,MAAM,kBAAkB,CAAC;AAgBzF,OAAO,KAAK,EACR,wBAAwB,EACxB,6BAA6B,EAC7B,2BAA2B,EAC3B,6BAA6B,EAChC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EACR,+BAA+B,EAC/B,2BAA2B,EAC3B,8BAA8B,EAC9B,uCAAuC,EACvC,gCAAgC,EAChC,gBAAgB,EAEnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACH,uCAAuC,EAE1C,MAAM,8BAA8B,CAAC;AAWtC,OAAO,KAAK,EAAE,iCAAiC,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAEvG,qBAEa,0BAA0B;IACnC,SAAS,CAAC,OAAO,EAAE,iCAAiC,CAAC;IAErD,SAAS,CAAC,UAAU,EAAE,2BAA2B,CAAC;IAElD,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,cAAc,EAAE,+BAA+B,CAAC;IAE1D,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,oBAAoB,EAAG,uCAAuC,CAAC;IAEzE,SAAS,CAAC,YAAY,EAAG,gCAAgC,CAAC;IAE1D,SAAS,CAAC,UAAU,EAAG,8BAA8B,CAAC;gBAI1C,GAAG,EAAE,iCAAiC;IAc5C,YAAY,CACF,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;IA+BhD,WAAW,CACA,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,gBAAgB,CAAC;IA0BtB,YAAY,CACD,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,6BAA6B,EAChC,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,gBAAgB,CAAC;IAKvB,GAAG,CACQ,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,2BAA2B,EAC9B,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,gBAAgB,CAAC;IAKvB,YAAY,CACD,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,gBAAgB,CAAC;IA6BvB,WAAW,CACJ,IAAI,EAAE,6BAA6B,EAChC,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,gBAAgB,CAAC;IAOvB,YAAY,CACD,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS;IAgD1B,WAAW,CACA,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS;YA2ElB,KAAK;YA6FL,OAAO;YAYP,sBAAsB;YAWtB,wBAAwB;CAWzC"}

package/dist/adapters/http/controllers/entities/identity-provider/module.mjs

@@ -16,7 +16,7 @@ import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/m
 import "../../../middleware/index.mjs";
 import { ValidatorGroup, base64URLDecode, isUUID } from "@authup/kit";
 import { IdentityProviderAttributesValidator, IdentityProviderValidator, IdentityType, PermissionName, isOAuth2IdentityProvider, isOpenIDIdentityProvider } from "@authup/core-kit";
-import { BuiltInPolicyType, PolicyData } from "@authup/access";
+import { BuiltInPolicyType, definePolicyData } from "@authup/access";
 import { BadRequestError, EntityNotFoundError } from "@authup/errors";
 import { OAuth2RequestError } from "@authup/specs";
 import { URL } from "node:url";
@@ -66,7 +66,10 @@ var IdentityProviderController = class {
 			for (const datum of data) try {
 				await permissionEvaluator.evaluate({
 					name: PermissionName.IDENTITY_PROVIDER_READ,
-					input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: datum })
+					data: definePolicyData({
+						[BuiltInPolicyType.ATTRIBUTES]: datum,
+						[BuiltInPolicyType.REALM_MATCH]: datum.realm_id ?? null
+					})
 				});
 			} catch {}
 		} catch {}
@@ -82,7 +85,10 @@ var IdentityProviderController = class {
 		try {
 			await useRequestPermissionEvaluator(event).evaluate({
 				name: PermissionName.IDENTITY_PROVIDER_READ,
-				input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+				data: definePolicyData({
+					[BuiltInPolicyType.ATTRIBUTES]: entity,
+					[BuiltInPolicyType.REALM_MATCH]: entity.realm_id ?? null
+				})
 			});
 		} catch {}
 		return entity;
@@ -101,7 +107,10 @@ var IdentityProviderController = class {
 		if (!entity) throw new EntityNotFoundError();
 		await permissionEvaluator.evaluate({
 			name: PermissionName.IDENTITY_PROVIDER_DELETE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: entity,
+				[BuiltInPolicyType.REALM_MATCH]: entity.realm_id ?? null
+			})
 		});
 		const { id: entityId } = entity;
 		await this.repository.remove(entity);
@@ -209,16 +218,22 @@ var IdentityProviderController = class {
 		await this.repository.validateJoinColumns(data);
 		if (entity) await permissionEvaluator.evaluate({
 			name: PermissionName.IDENTITY_PROVIDER_UPDATE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: {
-				...entity,
-				...data
-			} })
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: {
+					...entity,
+					...data
+				},
+				[BuiltInPolicyType.REALM_MATCH]: data.realm_id ?? entity.realm_id ?? null
+			})
 		});
 		else {
 			if (!data.realm_id) data.realm_id = useRequestIdentityOrFail(event).realmId;
 			await permissionEvaluator.evaluate({
 				name: PermissionName.IDENTITY_PROVIDER_CREATE,
-				input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: data })
+				data: definePolicyData({
+					[BuiltInPolicyType.ATTRIBUTES]: data,
+					[BuiltInPolicyType.REALM_MATCH]: data.realm_id ?? null
+				})
 			});
 		}
 		await this.repository.checkUniqueness(data, entity || void 0);

package/dist/adapters/http/controllers/entities/identity-provider/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["BuiltInPolicyType","PolicyData","ValidatorGroup","base64URLDecode","isUUID","DBody","DContext","DController","DDelete","DGet","DPath","DPost","DPut","DTags","getRequestHeader","getRequestIP","sendRedirect","IdentityProviderAttributesValidator","IdentityProviderValidator","IdentityType","PermissionName","isOAuth2IdentityProvider","isOpenIDIdentityProvider","BadRequestError","EntityNotFoundError","resolveURL","useRequestQuery","readRequestBody","OAuth2RequestError","URL","OAuth2AuthorizationCodeRequestValidator","createIdentityProviderOAuth2Authenticator","applyRouteRealmIDToBody","getBodyRealmID","getRequestParamID","getRequestRealmID","useRequestIdentityOrFail","useRequestParamID","useRequestPermissionEvaluator","ForceLoggedInMiddleware","IdentityProviderController","options","repository","realmRepository","accountManager","codeRequestVerifier","codeRequestValidator","stateManager","codeIssuer","ctx","getProviders","event","data","meta","findMany","permissionEvaluator","preEvaluate","name","IDENTITY_PROVIDER_READ","datum","evaluate","input","ATTRIBUTES","getProvider","id","paramId","entity","findOneByIdOrName","editProvider","user","write","updateOnly","put","dropProvider","IDENTITY_PROVIDER_DELETE","findOneBy","entityId","remove","response","status","addProvider","authorizeOut","_id","resolve","authenticator","provider","baseURL","parameters","codeRequest","query","codeRequestDecoded","JSON","parse","malformed","codeRequestValidated","run","verify","client","realm_id","state","saveAuthorizationState","buildRedirectURL","authorizeIn","Error","protocol","verifyAuthorizationState","code","clientId","client_id","authenticate","realm","authorizationCode","issue","response_type","redirect_uri","scope","type","USER","codeRequestKeys","Object","keys","url","codeRequestKey_","codeRequestKey","searchParams","set","href","group","body","realmId","where","IDENTITY_PROVIDER_UPDATE","UPDATE","IDENTITY_PROVIDER_CREATE","CREATE","validator","attributesValidator","attributes","validateJoinColumns","identity","checkUniqueness","undefined","merge","saveWithEA","create","findOneById","save","ip","trustProxy","userAgent","stateInvalid"],"sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport { ValidatorGroup, base64URLDecode, isUUID } from '@authup/kit';\nimport {\n    DBody,\n    DContext,\n    DController,\n    DDelete,\n    DGet,\n    DPath,\n    DPost,\n    DPut,\n    DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport {\n    getRequestHeader,\n    getRequestIP,\n    sendRedirect,\n} from 'routup';\nimport type { IdentityProvider, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport {\n\n    IdentityProviderAttributesValidator,\n    IdentityProviderValidator,\n    IdentityType,\n    PermissionName,\n    isOAuth2IdentityProvider,\n    isOpenIDIdentityProvider,\n} from '@authup/core-kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport { resolveURL } from '../../../../../utils/index.ts';\nimport type { AuthorizeParameters } from '@hapic/oauth2';\nimport { useRequestQuery } from '@routup/basic/query';\nimport { readRequestBody } from '@routup/basic/body';\nimport { OAuth2RequestError } from '@authup/specs';\nimport type {\n    EntityCollectionResponse,\n    IdentityProviderCreatePayload,\n    IdentityProviderSavePayload,\n    IdentityProviderUpdatePayload,\n} from '@authup/core-http-kit';\nimport { URL } from 'node:url';\nimport type {\n    IIdentityProviderAccountManager,\n    IIdentityProviderRepository,\n    IOAuth2AuthorizationCodeIssuer,\n    IOAuth2AuthorizationCodeRequestVerifier,\n    IOAuth2AuthorizationStateManager,\n    IRealmRepository,\n    OAuth2AuthorizationState,\n} from '../../../../../core/index.ts';\nimport {\n    OAuth2AuthorizationCodeRequestValidator,\n    createIdentityProviderOAuth2Authenticator,\n} from '../../../../../core/index.ts';\nimport {\n    applyRouteRealmIDToBody,\n    getBodyRealmID,\n    getRequestParamID,\n    getRequestRealmID,\n    useRequestIdentityOrFail,\n    useRequestParamID,\n    useRequestPermissionEvaluator,\n} from '../../../request/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport type { IdentityProviderControllerContext, IdentityProviderControllerOptions } from './types.ts';\n\n@DTags('identity')\n@DController(['/identity-providers', '/realms/:realmId/identity-providers'])\nexport class IdentityProviderController {\n    protected options: IdentityProviderControllerOptions;\n\n    protected repository: IIdentityProviderRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected accountManager: IIdentityProviderAccountManager;\n\n    protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n    protected codeRequestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n    protected stateManager : IOAuth2AuthorizationStateManager;\n\n    protected codeIssuer : IOAuth2AuthorizationCodeIssuer;\n\n    // ---------------------------------------------------------\n\n    constructor(ctx: IdentityProviderControllerContext) {\n        this.options = ctx.options;\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.accountManager = ctx.accountManager;\n        this.codeIssuer = ctx.codeIssuer;\n        this.codeRequestVerifier = ctx.codeRequestVerifier;\n        this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();\n        this.stateManager = ctx.stateManager;\n    }\n\n    // ---------------------------------------------------------\n\n    @DGet('', [])\n    async getProviders(\n        @DContext() event: IAppEvent,\n    ): Promise<EntityCollectionResponse<IdentityProvider>> {\n        const {\n            data, \n            meta, \n        } = await this.repository.findMany(useRequestQuery(event));\n\n        try {\n            const permissionEvaluator = useRequestPermissionEvaluator(event);\n            await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_READ });\n\n            for (const datum of data) {\n                try {\n                    await permissionEvaluator.evaluate({\n                        name: PermissionName.IDENTITY_PROVIDER_READ,\n                        input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: datum }),\n                    });\n                } catch {\n                    // do nothing\n                }\n            }\n        } catch {\n            // do nothing\n        }\n\n        return {\n            data,\n            meta,\n        };\n    }\n\n    @DGet('/:id', [])\n    async getProvider(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ): Promise<IdentityProvider> {\n        const paramId = useRequestParamID(event, { isUUID: false });\n\n        const entity = await this.repository.findOneByIdOrName(\n            paramId,\n            getRequestRealmID(event),\n        );\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        try {\n            const permissionEvaluator = useRequestPermissionEvaluator(event);\n            await permissionEvaluator.evaluate({\n                name: PermissionName.IDENTITY_PROVIDER_READ,\n                input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n            });\n        } catch {\n            // do nothing\n        }\n\n        return entity;\n    }\n\n    @DPost('/:id', [ForceLoggedInMiddleware])\n    async editProvider(\n        @DPath('id') id: string,\n        @DBody() user: IdentityProviderUpdatePayload,\n        @DContext() event: IAppEvent,\n    ) : Promise<IdentityProvider> {\n        return this.write(event, { updateOnly: true });\n    }\n\n    @DPut('/:id', [ForceLoggedInMiddleware])\n    async put(\n        @DPath('id') id: string,\n        @DBody() user: IdentityProviderSavePayload,\n        @DContext() event: IAppEvent,\n    ) : Promise<IdentityProvider> {\n        return this.write(event);\n    }\n\n    @DDelete('/:id', [ForceLoggedInMiddleware])\n    async dropProvider(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ) : Promise<IdentityProvider> {\n        const paramId = useRequestParamID(event);\n\n        const permissionEvaluator = useRequestPermissionEvaluator(event);\n        await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_DELETE });\n\n        const entity = await this.repository.findOneBy({ id: paramId });\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await permissionEvaluator.evaluate({\n            name: PermissionName.IDENTITY_PROVIDER_DELETE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n\n        await this.repository.remove(entity);\n\n        entity.id = entityId;\n\n        event.response.status = 202;\n\n        return entity;\n    }\n\n    @DPost('', [ForceLoggedInMiddleware])\n    async addProvider(\n        @DBody() user: IdentityProviderCreatePayload,\n        @DContext() event: IAppEvent,\n    ) : Promise<IdentityProvider> {\n        return this.write(event);\n    }\n\n    // ---------------------------------------------------------\n\n    @DGet('/:id/authorize-out', [])\n    async authorizeOut(\n        @DPath('id') _id: string,\n        @DContext() event: IAppEvent,\n    ) {\n        const id = useRequestParamID(event);\n        const entity = await this.resolve(id);\n\n        if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) {\n            throw new BadRequestError('Only an identity-provider based on the oauth protocol supports authorize redirect.');\n        }\n\n        const authenticator = createIdentityProviderOAuth2Authenticator({\n            accountManager: this.accountManager,\n            provider: entity,\n            options: { baseURL: this.options.baseURL },\n        });\n\n        const parameters : AuthorizeParameters = {};\n\n        let codeRequest: OAuth2AuthorizationCodeRequest | undefined;\n        const query = useRequestQuery(event);\n        if (typeof query.codeRequest === 'string') {\n            let codeRequestDecoded: OAuth2AuthorizationCodeRequest;\n\n            try {\n                codeRequestDecoded = JSON.parse(base64URLDecode(query.codeRequest));\n            } catch {\n                throw OAuth2RequestError.malformed('The code request is malformed and can not be parsed.');\n            }\n\n            const codeRequestValidated = await this.codeRequestValidator.run(codeRequestDecoded);\n            const data = await this.codeRequestVerifier.verify(codeRequestValidated);\n\n            if (\n                data.client.realm_id &&\n                entity.realm_id &&\n                entity.realm_id !== data.client.realm_id\n            ) {\n                throw OAuth2RequestError.malformed('The provider and client realm do not match.');\n            }\n\n            codeRequest = data.data;\n        }\n\n        parameters.state = await this.saveAuthorizationState(event, codeRequest);\n\n        return sendRedirect(event, authenticator.buildRedirectURL(parameters));\n    }\n\n    @DGet('/:id/authorize-in', [])\n    async authorizeIn(\n        @DPath('id') _id: string,\n        @DContext() event: IAppEvent,\n    ) {\n        const id = useRequestParamID(event);\n\n        const entity = await this.resolve(id);\n\n        if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) {\n            throw new Error(`The provider protocol ${entity.protocol} is not valid.`);\n        }\n\n        const data = await this.verifyAuthorizationState(event);\n        if (\n            entity.realm_id &&\n            data.codeRequest &&\n            data.codeRequest.realm_id &&\n            data.codeRequest.realm_id !== entity.realm_id\n        ) {\n            throw OAuth2RequestError.malformed('The provider and client realm do not match.');\n        }\n\n        const { code } = useRequestQuery(event);\n\n        const authenticator = createIdentityProviderOAuth2Authenticator({\n            accountManager: this.accountManager,\n            provider: entity,\n            options: {\n                baseURL: this.options.baseURL,\n                clientId: data.codeRequest?.client_id,\n            },\n        });\n\n        const user = await authenticator.authenticate(code);\n\n        const realm = await this.realmRepository.resolve(entity.realm_id, true);\n\n        const authorizationCode = await this.codeIssuer.issue(\n            {\n                response_type: 'code',\n                client_id: data.codeRequest?.client_id,\n                redirect_uri: data.codeRequest?.redirect_uri,\n                scope: data.codeRequest?.scope,\n            },\n            {\n                type: IdentityType.USER,\n                data: {\n                    ...user,\n                    realm,\n                },\n            },\n        );\n\n        if (data.codeRequest) {\n            const codeRequestKeys = Object.keys(data.codeRequest);\n\n            const url = new URL(resolveURL(this.options.baseURL, 'authorize'));\n            for (const codeRequestKey_ of codeRequestKeys) {\n                const codeRequestKey = codeRequestKey_ as keyof OAuth2AuthorizationCodeRequest;\n                if (data.codeRequest[codeRequestKey]) {\n                    url.searchParams.set(codeRequestKey, data.codeRequest[codeRequestKey]);\n                }\n            }\n\n            url.searchParams.set('code', authorizationCode.id);\n\n            return sendRedirect(event, url.href);\n        }\n\n        const url = new URL(this.options.baseURL);\n        url.searchParams.set('code', authorizationCode.id);\n\n        return sendRedirect(event, url.href);\n    }\n\n    // ---------------------------------------------------------\n\n    private async write(event: IAppEvent, options: {\n        updateOnly?: boolean\n    } = {}): Promise<IdentityProvider> {\n        let group: string;\n        const id = getRequestParamID(event, { isUUID: false });\n        const body = await readRequestBody(event);\n        applyRouteRealmIDToBody(event, body);\n        const realmId = getRequestRealmID(event) ?? getBodyRealmID(body);\n\n        let entity: IdentityProvider | null | undefined;\n        if (id) {\n            const where: Record<string, any> = {};\n            if (isUUID(id)) {\n                where.id = id;\n            } else {\n                where.name = id;\n            }\n\n            if (realmId) {\n                where.realm_id = realmId;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        const permissionEvaluator = useRequestPermissionEvaluator(event);\n        if (entity) {\n            await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_UPDATE });\n\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_CREATE });\n\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validator = new IdentityProviderValidator();\n        const data = await validator.run(body, { group });\n\n        const attributesValidator = new IdentityProviderAttributesValidator();\n        const attributes = await attributesValidator.run(body);\n\n        await this.repository.validateJoinColumns(data);\n\n        if (entity) {\n            await permissionEvaluator.evaluate({\n                name: PermissionName.IDENTITY_PROVIDER_UPDATE,\n                input: new PolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...data,\n                    },\n                }),\n            });\n        } else {\n            if (!data.realm_id) {\n                const identity = useRequestIdentityOrFail(event);\n                data.realm_id = identity.realmId;\n            }\n\n            await permissionEvaluator.evaluate({\n                name: PermissionName.IDENTITY_PROVIDER_CREATE,\n                input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: data }),\n            });\n        }\n\n        await this.repository.checkUniqueness(data, entity || undefined);\n\n        if (entity) {\n            entity = this.repository.merge(entity, data);\n            await this.repository.saveWithEA(entity, attributes);\n\n            event.response.status = 202;\n\n            return entity;\n        }\n\n        entity = this.repository.create(data);\n        await this.repository.saveWithEA(entity, attributes);\n\n        event.response.status = 201;\n\n        return entity;\n    }\n\n    // ---------------------------------------------------------\n\n    private async resolve(id: string) {\n        const entity = await this.repository.findOneById(id);\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    // ---------------------------------------------------------\n\n    private async saveAuthorizationState(\n        event: IAppEvent,\n        codeRequest?: OAuth2AuthorizationCodeRequest,\n    ) : Promise<string> {\n        return this.stateManager.save({\n            codeRequest,\n            ip: getRequestIP(event, { trustProxy: true }) ?? '',\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n\n    private async verifyAuthorizationState(event: IAppEvent): Promise<OAuth2AuthorizationState> {\n        const query = useRequestQuery(event);\n        if (typeof query.state !== 'string') {\n            throw OAuth2RequestError.stateInvalid();\n        }\n\n        return this.stateManager.verify(query.state, {\n            ip: getRequestIP(event, { trustProxy: true }) ?? '',\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4EA,IAAawC,6BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAwC;EAChD,KAAKR,UAAUQ,IAAIR;EACnB,KAAKC,aAAaO,IAAIP;EACtB,KAAKC,kBAAkBM,IAAIN;EAC3B,KAAKC,iBAAiBK,IAAIL;EAC1B,KAAKI,aAAaC,IAAID;EACtB,KAAKH,sBAAsBI,IAAIJ;EAC/B,KAAKC,uBAAuB,IAAIhB,wCAAAA;EAChC,KAAKiB,eAAeE,IAAIF;CAC5B;CAIA,MACMG,aACF,OACmD;EACnD,MAAM,EACFE,MACAC,SACA,MAAM,KAAKX,WAAWY,SAAS5B,gBAAgByB,KAAAA,CAAAA;EAEnD,IAAI;GACA,MAAMI,sBAAsBjB,8BAA8Ba,KAAAA;GAC1D,MAAMI,oBAAoBC,YAAY,EAAEC,MAAMrC,eAAesC,uBAAuB,CAAA;GAEpF,KAAK,MAAMC,SAASP,MAChB,IAAI;IACA,MAAMG,oBAAoBK,SAAS;KAC/BH,MAAMrC,eAAesC;KACrBG,OAAO,IAAI5D,WAAW,GAAGD,kBAAkB8D,aAAaH,MAAM,CAAA;IAClE,CAAA;GACJ,QAAQ,CAER;EAER,QAAQ,CAER;EAEA,OAAO;GACHP;GACAC;EACJ;CACJ;CAEA,MACMU,YACF,IACA,OACyB;EACzB,MAAME,UAAU5B,kBAAkBc,OAAO,EAAE/C,QAAQ,MAAM,CAAA;EAEzD,MAAM8D,SAAS,MAAM,KAAKxB,WAAWyB,kBACjCF,SACA9B,kBAAkBgB,KAAAA,CAAAA;EAGtB,IAAI,CAACe,QACD,MAAM,IAAI1C,oBAAAA;EAGd,IAAI;GAEA,MAD4Bc,8BAA8Ba,KACpDI,CAAAA,CAAoBK,SAAS;IAC/BH,MAAMrC,eAAesC;IACrBG,OAAO,IAAI5D,WAAW,GAAGD,kBAAkB8D,aAAaI,OAAO,CAAA;GACnE,CAAA;EACJ,QAAQ,CAER;EAEA,OAAOA;CACX;CAEA,MACME,aACF,IACA,MACA,OAC0B;EAC1B,OAAO,KAAKE,MAAMnB,OAAO,EAAEoB,YAAY,KAAK,CAAA;CAChD;CAEA,MACMC,IACF,IACA,MACA,OAC0B;EAC1B,OAAO,KAAKF,MAAMnB,KAAAA;CACtB;CAEA,MACMsB,aACF,IACA,OAC0B;EAC1B,MAAMR,UAAU5B,kBAAkBc,KAAAA;EAElC,MAAMI,sBAAsBjB,8BAA8Ba,KAAAA;EAC1D,MAAMI,oBAAoBC,YAAY,EAAEC,MAAMrC,eAAesD,yBAAyB,CAAA;EAEtF,MAAMR,SAAS,MAAM,KAAKxB,WAAWiC,UAAU,EAAEX,IAAIC,QAAQ,CAAA;EAE7D,IAAI,CAACC,QACD,MAAM,IAAI1C,oBAAAA;EAGd,MAAM+B,oBAAoBK,SAAS;GAC/BH,MAAMrC,eAAesD;GACrBb,OAAO,IAAI5D,WAAW,GAAGD,kBAAkB8D,aAAaI,OAAO,CAAA;EACnE,CAAA;EAEA,MAAM,EAAEF,IAAIY,aAAaV;EAEzB,MAAM,KAAKxB,WAAWmC,OAAOX,MAAAA;EAE7BA,OAAOF,KAAKY;EAEZzB,MAAM2B,SAASC,SAAS;EAExB,OAAOb;CACX;CAEA,MACMc,YACF,MACA,OAC0B;EAC1B,OAAO,KAAKV,MAAMnB,KAAAA;CACtB;CAIA,MACM8B,aACF,KACA,OACF;EACE,MAAMjB,KAAK3B,kBAAkBc,KAAAA;EAC7B,MAAMe,SAAS,MAAM,KAAKiB,QAAQnB,EAAAA;EAElC,IAAI,CAAC3C,yBAAyB6C,MAAAA,KAAW,CAAC5C,yBAAyB4C,MAAAA,GAC/D,MAAM,IAAI3C,gBAAgB,oFAAA;EAG9B,MAAM6D,gBAAgBrD,0CAA0C;GAC5Da,gBAAgB,KAAKA;GACrByC,UAAUnB;GACVzB,SAAS,EAAE6C,SAAS,KAAK7C,QAAQ6C,QAAQ;EAC7C,CAAA;EAEA,MAAMC,aAAmC,CAAC;EAE1C,IAAIC;EACJ,MAAMC,QAAQ/D,gBAAgByB,KAAAA;EAC9B,IAAI,OAAOsC,MAAMD,gBAAgB,UAAU;GACvC,IAAIE;GAEJ,IAAI;IACAA,qBAAqBC,KAAKC,MAAMzF,gBAAgBsF,MAAMD,WAAW,CAAA;GACrE,QAAQ;IACJ,MAAM5D,mBAAmBiE,UAAU,sDAAA;GACvC;GAEA,MAAMC,uBAAuB,MAAM,KAAKhD,qBAAqBiD,IAAIL,kBAAAA;GACjE,MAAMtC,OAAO,MAAM,KAAKP,oBAAoBmD,OAAOF,oBAAAA;GAEnD,IACI1C,KAAK6C,OAAOC,YACZhC,OAAOgC,YACPhC,OAAOgC,aAAa9C,KAAK6C,OAAOC,UAEhC,MAAMtE,mBAAmBiE,UAAU,6CAAA;GAGvCL,cAAcpC,KAAKA;EACvB;EAEAmC,WAAWY,QAAQ,MAAM,KAAKC,uBAAuBjD,OAAOqC,WAAAA;EAE5D,OAAOxE,aAAamC,OAAOiC,cAAciB,iBAAiBd,UAAAA,CAAAA;CAC9D;CAEA,MACMe,YACF,KACA,OACF;EACE,MAAMtC,KAAK3B,kBAAkBc,KAAAA;EAE7B,MAAMe,SAAS,MAAM,KAAKiB,QAAQnB,EAAAA;EAElC,IAAI,CAAC3C,yBAAyB6C,MAAAA,KAAW,CAAC5C,yBAAyB4C,MAAAA,GAC/D,MAAM,IAAIqC,MAAM,yBAAyBrC,OAAOsC,SAAS,eAAe;EAG5E,MAAMpD,OAAO,MAAM,KAAKqD,yBAAyBtD,KAAAA;EACjD,IACIe,OAAOgC,YACP9C,KAAKoC,eACLpC,KAAKoC,YAAYU,YACjB9C,KAAKoC,YAAYU,aAAahC,OAAOgC,UAErC,MAAMtE,mBAAmBiE,UAAU,6CAAA;EAGvC,MAAM,EAAEa,SAAShF,gBAAgByB,KAAAA;EAWjC,MAAMkB,OAAO,MATStC,0CAA0C;GAC5Da,gBAAgB,KAAKA;GACrByC,UAAUnB;GACVzB,SAAS;IACL6C,SAAS,KAAK7C,QAAQ6C;IACtBqB,UAAUvD,KAAKoC,aAAaoB;GAChC;EACJ,CAEmBxB,CAAAA,CAAcyB,aAAaH,IAAAA;EAE9C,MAAMI,QAAQ,MAAM,KAAKnE,gBAAgBwC,QAAQjB,OAAOgC,UAAU,IAAA;EAElE,MAAMa,oBAAoB,MAAM,KAAK/D,WAAWgE,MAC5C;GACIC,eAAe;GACfL,WAAWxD,KAAKoC,aAAaoB;GAC7BM,cAAc9D,KAAKoC,aAAa0B;GAChCC,OAAO/D,KAAKoC,aAAa2B;EAC7B,GACA;GACIC,MAAMjG,aAAakG;GACnBjE,MAAM;IACF,GAAGiB;IACHyC;GACJ;EACJ,CAAA;EAGJ,IAAI1D,KAAKoC,aAAa;GAClB,MAAM8B,kBAAkBC,OAAOC,KAAKpE,KAAKoC,WAAW;GAEpD,MAAMiC,MAAM,IAAI5F,IAAIJ,WAAW,KAAKgB,QAAQ6C,SAAS,WAAA,CAAA;GACrD,KAAK,MAAMoC,mBAAmBJ,iBAAiB;IAC3C,MAAMK,iBAAiBD;IACvB,IAAItE,KAAKoC,YAAYmC,iBACjBF,IAAIG,aAAaC,IAAIF,gBAAgBvE,KAAKoC,YAAYmC,eAAe;GAE7E;GAEAF,IAAIG,aAAaC,IAAI,QAAQd,kBAAkB/C,EAAE;GAEjD,OAAOhD,aAAamC,OAAOsE,IAAIK,IAAI;EACvC;EAEA,MAAML,MAAM,IAAI5F,IAAI,KAAKY,QAAQ6C,OAAO;EACxCmC,IAAIG,aAAaC,IAAI,QAAQd,kBAAkB/C,EAAE;EAEjD,OAAOhD,aAAamC,OAAOsE,IAAIK,IAAI;CACvC;CAIA,MAAcxD,MAAMnB,OAAkBV,UAElC,CAAC,GAA8B;EAC/B,IAAIsF;EACJ,MAAM/D,KAAK9B,kBAAkBiB,OAAO,EAAE/C,QAAQ,MAAM,CAAA;EACpD,MAAM4H,OAAO,MAAMrG,gBAAgBwB,KAAAA;EACnCnB,wBAAwBmB,OAAO6E,IAAAA;EAC/B,MAAMC,UAAU9F,kBAAkBgB,KAAAA,KAAUlB,eAAe+F,IAAAA;EAE3D,IAAI9D;EACJ,IAAIF,IAAI;GACJ,MAAMkE,QAA6B,CAAC;GACpC,IAAI9H,OAAO4D,EAAAA,GACPkE,MAAMlE,KAAKA;QAEXkE,MAAMzE,OAAOO;GAGjB,IAAIiE,SACAC,MAAMhC,WAAW+B;GAGrB/D,SAAS,MAAM,KAAKxB,WAAWiC,UAAUuD,KAAAA;GACzC,IAAI,CAAChE,UAAUzB,QAAQ8B,YACnB,MAAM,IAAI/C,oBAAAA;EAElB,OAAO,IAAIiB,QAAQ8B,YACf,MAAM,IAAI/C,oBAAAA;EAGd,MAAM+B,sBAAsBjB,8BAA8Ba,KAAAA;EAC1D,IAAIe,QAAQ;GACR,MAAMX,oBAAoBC,YAAY,EAAEC,MAAMrC,eAAe+G,yBAAyB,CAAA;GAEtFJ,QAAQ7H,eAAekI;EAC3B,OAAO;GACH,MAAM7E,oBAAoBC,YAAY,EAAEC,MAAMrC,eAAeiH,yBAAyB,CAAA;GAEtFN,QAAQ7H,eAAeoI;EAC3B;EAGA,MAAMlF,OAAO,MAAMmF,IADGrH,0BACHqH,CAAAA,CAAUxC,IAAIiC,MAAM,EAAED,MAAM,CAAA;EAG/C,MAAMU,aAAa,MAAMD,IADOvH,oCACPuH,CAAAA,CAAoBzC,IAAIiC,IAAAA;EAEjD,MAAM,KAAKtF,WAAWgG,oBAAoBtF,IAAAA;EAE1C,IAAIc,QACA,MAAMX,oBAAoBK,SAAS;GAC/BH,MAAMrC,eAAe+G;GACrBtE,OAAO,IAAI5D,WAAW,GACjBD,kBAAkB8D,aAAa;IAC5B,GAAGI;IACH,GAAGd;GACP,EACJ,CAAA;EACJ,CAAA;OACG;GACH,IAAI,CAACA,KAAK8C,UAEN9C,KAAK8C,WADY9D,yBAAyBe,KAC1BwF,CAAAA,CAASV;GAG7B,MAAM1E,oBAAoBK,SAAS;IAC/BH,MAAMrC,eAAeiH;IACrBxE,OAAO,IAAI5D,WAAW,GAAGD,kBAAkB8D,aAAaV,KAAK,CAAA;GACjE,CAAA;EACJ;EAEA,MAAM,KAAKV,WAAWkG,gBAAgBxF,MAAMc,UAAU2E,KAAAA,CAAAA;EAEtD,IAAI3E,QAAQ;GACRA,SAAS,KAAKxB,WAAWoG,MAAM5E,QAAQd,IAAAA;GACvC,MAAM,KAAKV,WAAWqG,WAAW7E,QAAQuE,UAAAA;GAEzCtF,MAAM2B,SAASC,SAAS;GAExB,OAAOb;EACX;EAEAA,SAAS,KAAKxB,WAAWsG,OAAO5F,IAAAA;EAChC,MAAM,KAAKV,WAAWqG,WAAW7E,QAAQuE,UAAAA;EAEzCtF,MAAM2B,SAASC,SAAS;EAExB,OAAOb;CACX;CAIA,MAAciB,QAAQnB,IAAY;EAC9B,MAAME,SAAS,MAAM,KAAKxB,WAAWuG,YAAYjF,EAAAA;EAEjD,IAAI,CAACE,QACD,MAAM,IAAI1C,oBAAAA;EAGd,OAAO0C;CACX;CAIA,MAAckC,uBACVjD,OACAqC,aACgB;EAChB,OAAO,KAAKzC,aAAamG,KAAK;GAC1B1D;GACA2D,IAAIpI,aAAaoC,OAAO,EAAEiG,YAAY,KAAK,CAAA,KAAM;GACjDC,WAAWvI,iBAAiBqC,OAAO,YAAA,KAAiB0F,KAAAA;EACxD,CAAA;CACJ;CAEA,MAAcpC,yBAAyBtD,OAAqD;EACxF,MAAMsC,QAAQ/D,gBAAgByB,KAAAA;EAC9B,IAAI,OAAOsC,MAAMU,UAAU,UACvB,MAAMvE,mBAAmB0H,aAAY;EAGzC,OAAO,KAAKvG,aAAaiD,OAAOP,MAAMU,OAAO;GACzCgD,IAAIpI,aAAaoC,OAAO,EAAEiG,YAAY,KAAK,CAAA,KAAM;GACjDC,WAAWvI,iBAAiBqC,OAAO,YAAA,KAAiB0F,KAAAA;EACxD,CAAA;CACJ;AACJ;;;;;;;;;;;;;;;;;gBA1ToBtG,uBAAAA,CAAAA;;;;;;;;;;;;;eASDA,uBAAAA,CAAAA;;;;;;;;;;;;;kBASGA,uBAAAA,CAAAA;;;;;;;;YAgCNA,uBAAAA,CAAAA;;;;;;;;;;;;;;;;;;;;;;;;;cAjJF,uBAAuB,qCAAA,CAAA"}
+{"version":3,"file":"module.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","base64URLDecode","isUUID","DBody","DContext","DController","DDelete","DGet","DPath","DPost","DPut","DTags","getRequestHeader","getRequestIP","sendRedirect","IdentityProviderAttributesValidator","IdentityProviderValidator","IdentityType","PermissionName","isOAuth2IdentityProvider","isOpenIDIdentityProvider","BadRequestError","EntityNotFoundError","resolveURL","useRequestQuery","readRequestBody","OAuth2RequestError","URL","OAuth2AuthorizationCodeRequestValidator","createIdentityProviderOAuth2Authenticator","applyRouteRealmIDToBody","getBodyRealmID","getRequestParamID","getRequestRealmID","useRequestIdentityOrFail","useRequestParamID","useRequestPermissionEvaluator","ForceLoggedInMiddleware","IdentityProviderController","options","repository","realmRepository","accountManager","codeRequestVerifier","codeRequestValidator","stateManager","codeIssuer","ctx","getProviders","event","data","meta","findMany","permissionEvaluator","preEvaluate","name","IDENTITY_PROVIDER_READ","datum","evaluate","ATTRIBUTES","REALM_MATCH","realm_id","getProvider","id","paramId","entity","findOneByIdOrName","editProvider","user","write","updateOnly","put","dropProvider","IDENTITY_PROVIDER_DELETE","findOneBy","entityId","remove","response","status","addProvider","authorizeOut","_id","resolve","authenticator","provider","baseURL","parameters","codeRequest","query","codeRequestDecoded","JSON","parse","malformed","codeRequestValidated","run","verify","client","state","saveAuthorizationState","buildRedirectURL","authorizeIn","Error","protocol","verifyAuthorizationState","code","clientId","client_id","authenticate","realm","authorizationCode","issue","response_type","redirect_uri","scope","type","USER","codeRequestKeys","Object","keys","url","codeRequestKey_","codeRequestKey","searchParams","set","href","group","body","realmId","where","IDENTITY_PROVIDER_UPDATE","UPDATE","IDENTITY_PROVIDER_CREATE","CREATE","validator","attributesValidator","attributes","validateJoinColumns","identity","checkUniqueness","undefined","merge","saveWithEA","create","findOneById","save","ip","trustProxy","userAgent","stateInvalid"],"sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, base64URLDecode, isUUID } from '@authup/kit';\nimport {\n    DBody,\n    DContext,\n    DController,\n    DDelete,\n    DGet,\n    DPath,\n    DPost,\n    DPut,\n    DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport {\n    getRequestHeader,\n    getRequestIP,\n    sendRedirect,\n} from 'routup';\nimport type { IdentityProvider, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport {\n\n    IdentityProviderAttributesValidator,\n    IdentityProviderValidator,\n    IdentityType,\n    PermissionName,\n    isOAuth2IdentityProvider,\n    isOpenIDIdentityProvider,\n} from '@authup/core-kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport { resolveURL } from '../../../../../utils/index.ts';\nimport type { AuthorizeParameters } from '@hapic/oauth2';\nimport { useRequestQuery } from '@routup/basic/query';\nimport { readRequestBody } from '@routup/basic/body';\nimport { OAuth2RequestError } from '@authup/specs';\nimport type {\n    EntityCollectionResponse,\n    IdentityProviderCreatePayload,\n    IdentityProviderSavePayload,\n    IdentityProviderUpdatePayload,\n} from '@authup/core-http-kit';\nimport { URL } from 'node:url';\nimport type {\n    IIdentityProviderAccountManager,\n    IIdentityProviderRepository,\n    IOAuth2AuthorizationCodeIssuer,\n    IOAuth2AuthorizationCodeRequestVerifier,\n    IOAuth2AuthorizationStateManager,\n    IRealmRepository,\n    OAuth2AuthorizationState,\n} from '../../../../../core/index.ts';\nimport {\n    OAuth2AuthorizationCodeRequestValidator,\n    createIdentityProviderOAuth2Authenticator,\n} from '../../../../../core/index.ts';\nimport {\n    applyRouteRealmIDToBody,\n    getBodyRealmID,\n    getRequestParamID,\n    getRequestRealmID,\n    useRequestIdentityOrFail,\n    useRequestParamID,\n    useRequestPermissionEvaluator,\n} from '../../../request/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport type { IdentityProviderControllerContext, IdentityProviderControllerOptions } from './types.ts';\n\n@DTags('identity')\n@DController(['/identity-providers', '/realms/:realmId/identity-providers'])\nexport class IdentityProviderController {\n    protected options: IdentityProviderControllerOptions;\n\n    protected repository: IIdentityProviderRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected accountManager: IIdentityProviderAccountManager;\n\n    protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n    protected codeRequestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n    protected stateManager : IOAuth2AuthorizationStateManager;\n\n    protected codeIssuer : IOAuth2AuthorizationCodeIssuer;\n\n    // ---------------------------------------------------------\n\n    constructor(ctx: IdentityProviderControllerContext) {\n        this.options = ctx.options;\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.accountManager = ctx.accountManager;\n        this.codeIssuer = ctx.codeIssuer;\n        this.codeRequestVerifier = ctx.codeRequestVerifier;\n        this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();\n        this.stateManager = ctx.stateManager;\n    }\n\n    // ---------------------------------------------------------\n\n    @DGet('', [])\n    async getProviders(\n        @DContext() event: IAppEvent,\n    ): Promise<EntityCollectionResponse<IdentityProvider>> {\n        const {\n            data, \n            meta, \n        } = await this.repository.findMany(useRequestQuery(event));\n\n        try {\n            const permissionEvaluator = useRequestPermissionEvaluator(event);\n            await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_READ });\n\n            for (const datum of data) {\n                try {\n                    await permissionEvaluator.evaluate({\n                        name: PermissionName.IDENTITY_PROVIDER_READ,\n                        data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: datum, [BuiltInPolicyType.REALM_MATCH]: datum.realm_id ?? null }),\n                    });\n                } catch {\n                    // do nothing\n                }\n            }\n        } catch {\n            // do nothing\n        }\n\n        return {\n            data,\n            meta,\n        };\n    }\n\n    @DGet('/:id', [])\n    async getProvider(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ): Promise<IdentityProvider> {\n        const paramId = useRequestParamID(event, { isUUID: false });\n\n        const entity = await this.repository.findOneByIdOrName(\n            paramId,\n            getRequestRealmID(event),\n        );\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        try {\n            const permissionEvaluator = useRequestPermissionEvaluator(event);\n            await permissionEvaluator.evaluate({\n                name: PermissionName.IDENTITY_PROVIDER_READ,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, [BuiltInPolicyType.REALM_MATCH]: entity.realm_id ?? null }),\n            });\n        } catch {\n            // do nothing\n        }\n\n        return entity;\n    }\n\n    @DPost('/:id', [ForceLoggedInMiddleware])\n    async editProvider(\n        @DPath('id') id: string,\n        @DBody() user: IdentityProviderUpdatePayload,\n        @DContext() event: IAppEvent,\n    ) : Promise<IdentityProvider> {\n        return this.write(event, { updateOnly: true });\n    }\n\n    @DPut('/:id', [ForceLoggedInMiddleware])\n    async put(\n        @DPath('id') id: string,\n        @DBody() user: IdentityProviderSavePayload,\n        @DContext() event: IAppEvent,\n    ) : Promise<IdentityProvider> {\n        return this.write(event);\n    }\n\n    @DDelete('/:id', [ForceLoggedInMiddleware])\n    async dropProvider(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ) : Promise<IdentityProvider> {\n        const paramId = useRequestParamID(event);\n\n        const permissionEvaluator = useRequestPermissionEvaluator(event);\n        await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_DELETE });\n\n        const entity = await this.repository.findOneBy({ id: paramId });\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await permissionEvaluator.evaluate({\n            name: PermissionName.IDENTITY_PROVIDER_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, [BuiltInPolicyType.REALM_MATCH]: entity.realm_id ?? null }),\n        });\n\n        const { id: entityId } = entity;\n\n        await this.repository.remove(entity);\n\n        entity.id = entityId;\n\n        event.response.status = 202;\n\n        return entity;\n    }\n\n    @DPost('', [ForceLoggedInMiddleware])\n    async addProvider(\n        @DBody() user: IdentityProviderCreatePayload,\n        @DContext() event: IAppEvent,\n    ) : Promise<IdentityProvider> {\n        return this.write(event);\n    }\n\n    // ---------------------------------------------------------\n\n    @DGet('/:id/authorize-out', [])\n    async authorizeOut(\n        @DPath('id') _id: string,\n        @DContext() event: IAppEvent,\n    ) {\n        const id = useRequestParamID(event);\n        const entity = await this.resolve(id);\n\n        if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) {\n            throw new BadRequestError('Only an identity-provider based on the oauth protocol supports authorize redirect.');\n        }\n\n        const authenticator = createIdentityProviderOAuth2Authenticator({\n            accountManager: this.accountManager,\n            provider: entity,\n            options: { baseURL: this.options.baseURL },\n        });\n\n        const parameters : AuthorizeParameters = {};\n\n        let codeRequest: OAuth2AuthorizationCodeRequest | undefined;\n        const query = useRequestQuery(event);\n        if (typeof query.codeRequest === 'string') {\n            let codeRequestDecoded: OAuth2AuthorizationCodeRequest;\n\n            try {\n                codeRequestDecoded = JSON.parse(base64URLDecode(query.codeRequest));\n            } catch {\n                throw OAuth2RequestError.malformed('The code request is malformed and can not be parsed.');\n            }\n\n            const codeRequestValidated = await this.codeRequestValidator.run(codeRequestDecoded);\n            const data = await this.codeRequestVerifier.verify(codeRequestValidated);\n\n            if (\n                data.client.realm_id &&\n                entity.realm_id &&\n                entity.realm_id !== data.client.realm_id\n            ) {\n                throw OAuth2RequestError.malformed('The provider and client realm do not match.');\n            }\n\n            codeRequest = data.data;\n        }\n\n        parameters.state = await this.saveAuthorizationState(event, codeRequest);\n\n        return sendRedirect(event, authenticator.buildRedirectURL(parameters));\n    }\n\n    @DGet('/:id/authorize-in', [])\n    async authorizeIn(\n        @DPath('id') _id: string,\n        @DContext() event: IAppEvent,\n    ) {\n        const id = useRequestParamID(event);\n\n        const entity = await this.resolve(id);\n\n        if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) {\n            throw new Error(`The provider protocol ${entity.protocol} is not valid.`);\n        }\n\n        const data = await this.verifyAuthorizationState(event);\n        if (\n            entity.realm_id &&\n            data.codeRequest &&\n            data.codeRequest.realm_id &&\n            data.codeRequest.realm_id !== entity.realm_id\n        ) {\n            throw OAuth2RequestError.malformed('The provider and client realm do not match.');\n        }\n\n        const { code } = useRequestQuery(event);\n\n        const authenticator = createIdentityProviderOAuth2Authenticator({\n            accountManager: this.accountManager,\n            provider: entity,\n            options: {\n                baseURL: this.options.baseURL,\n                clientId: data.codeRequest?.client_id,\n            },\n        });\n\n        const user = await authenticator.authenticate(code);\n\n        const realm = await this.realmRepository.resolve(entity.realm_id, true);\n\n        const authorizationCode = await this.codeIssuer.issue(\n            {\n                response_type: 'code',\n                client_id: data.codeRequest?.client_id,\n                redirect_uri: data.codeRequest?.redirect_uri,\n                scope: data.codeRequest?.scope,\n            },\n            {\n                type: IdentityType.USER,\n                data: {\n                    ...user,\n                    realm,\n                },\n            },\n        );\n\n        if (data.codeRequest) {\n            const codeRequestKeys = Object.keys(data.codeRequest);\n\n            const url = new URL(resolveURL(this.options.baseURL, 'authorize'));\n            for (const codeRequestKey_ of codeRequestKeys) {\n                const codeRequestKey = codeRequestKey_ as keyof OAuth2AuthorizationCodeRequest;\n                if (data.codeRequest[codeRequestKey]) {\n                    url.searchParams.set(codeRequestKey, data.codeRequest[codeRequestKey]);\n                }\n            }\n\n            url.searchParams.set('code', authorizationCode.id);\n\n            return sendRedirect(event, url.href);\n        }\n\n        const url = new URL(this.options.baseURL);\n        url.searchParams.set('code', authorizationCode.id);\n\n        return sendRedirect(event, url.href);\n    }\n\n    // ---------------------------------------------------------\n\n    private async write(event: IAppEvent, options: {\n        updateOnly?: boolean\n    } = {}): Promise<IdentityProvider> {\n        let group: string;\n        const id = getRequestParamID(event, { isUUID: false });\n        const body = await readRequestBody(event);\n        applyRouteRealmIDToBody(event, body);\n        const realmId = getRequestRealmID(event) ?? getBodyRealmID(body);\n\n        let entity: IdentityProvider | null | undefined;\n        if (id) {\n            const where: Record<string, any> = {};\n            if (isUUID(id)) {\n                where.id = id;\n            } else {\n                where.name = id;\n            }\n\n            if (realmId) {\n                where.realm_id = realmId;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        const permissionEvaluator = useRequestPermissionEvaluator(event);\n        if (entity) {\n            await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_UPDATE });\n\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_CREATE });\n\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validator = new IdentityProviderValidator();\n        const data = await validator.run(body, { group });\n\n        const attributesValidator = new IdentityProviderAttributesValidator();\n        const attributes = await attributesValidator.run(body);\n\n        await this.repository.validateJoinColumns(data);\n\n        if (entity) {\n            await permissionEvaluator.evaluate({\n                name: PermissionName.IDENTITY_PROVIDER_UPDATE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...data,\n                    },\n                    [BuiltInPolicyType.REALM_MATCH]: data.realm_id ?? entity.realm_id ?? null,\n                }),\n            });\n        } else {\n            if (!data.realm_id) {\n                const identity = useRequestIdentityOrFail(event);\n                data.realm_id = identity.realmId;\n            }\n\n            await permissionEvaluator.evaluate({\n                name: PermissionName.IDENTITY_PROVIDER_CREATE,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: data, [BuiltInPolicyType.REALM_MATCH]: data.realm_id ?? null }),\n            });\n        }\n\n        await this.repository.checkUniqueness(data, entity || undefined);\n\n        if (entity) {\n            entity = this.repository.merge(entity, data);\n            await this.repository.saveWithEA(entity, attributes);\n\n            event.response.status = 202;\n\n            return entity;\n        }\n\n        entity = this.repository.create(data);\n        await this.repository.saveWithEA(entity, attributes);\n\n        event.response.status = 201;\n\n        return entity;\n    }\n\n    // ---------------------------------------------------------\n\n    private async resolve(id: string) {\n        const entity = await this.repository.findOneById(id);\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    // ---------------------------------------------------------\n\n    private async saveAuthorizationState(\n        event: IAppEvent,\n        codeRequest?: OAuth2AuthorizationCodeRequest,\n    ) : Promise<string> {\n        return this.stateManager.save({\n            codeRequest,\n            ip: getRequestIP(event, { trustProxy: true }) ?? '',\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n\n    private async verifyAuthorizationState(event: IAppEvent): Promise<OAuth2AuthorizationState> {\n        const query = useRequestQuery(event);\n        if (typeof query.state !== 'string') {\n            throw OAuth2RequestError.stateInvalid();\n        }\n\n        return this.stateManager.verify(query.state, {\n            ip: getRequestIP(event, { trustProxy: true }) ?? '',\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4EA,IAAawC,6BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAwC;EAChD,KAAKR,UAAUQ,IAAIR;EACnB,KAAKC,aAAaO,IAAIP;EACtB,KAAKC,kBAAkBM,IAAIN;EAC3B,KAAKC,iBAAiBK,IAAIL;EAC1B,KAAKI,aAAaC,IAAID;EACtB,KAAKH,sBAAsBI,IAAIJ;EAC/B,KAAKC,uBAAuB,IAAIhB,wCAAAA;EAChC,KAAKiB,eAAeE,IAAIF;CAC5B;CAIA,MACMG,aACF,OACmD;EACnD,MAAM,EACFE,MACAC,SACA,MAAM,KAAKX,WAAWY,SAAS5B,gBAAgByB,KAAAA,CAAAA;EAEnD,IAAI;GACA,MAAMI,sBAAsBjB,8BAA8Ba,KAAAA;GAC1D,MAAMI,oBAAoBC,YAAY,EAAEC,MAAMrC,eAAesC,uBAAuB,CAAA;GAEpF,KAAK,MAAMC,SAASP,MAChB,IAAI;IACA,MAAMG,oBAAoBK,SAAS;KAC/BH,MAAMrC,eAAesC;KACrBN,MAAMnD,iBAAiB;OAAGD,kBAAkB6D,aAAaF;OAAQ3D,kBAAkB8D,cAAcH,MAAMI,YAAY;KAAK,CAAA;IAC5H,CAAA;GACJ,QAAQ,CAER;EAER,QAAQ,CAER;EAEA,OAAO;GACHX;GACAC;EACJ;CACJ;CAEA,MACMW,YACF,IACA,OACyB;EACzB,MAAME,UAAU7B,kBAAkBc,OAAO,EAAE/C,QAAQ,MAAM,CAAA;EAEzD,MAAM+D,SAAS,MAAM,KAAKzB,WAAW0B,kBACjCF,SACA/B,kBAAkBgB,KAAAA,CAAAA;EAGtB,IAAI,CAACgB,QACD,MAAM,IAAI3C,oBAAAA;EAGd,IAAI;GAEA,MAD4Bc,8BAA8Ba,KACpDI,CAAAA,CAAoBK,SAAS;IAC/BH,MAAMrC,eAAesC;IACrBN,MAAMnD,iBAAiB;MAAGD,kBAAkB6D,aAAaM;MAASnE,kBAAkB8D,cAAcK,OAAOJ,YAAY;IAAK,CAAA;GAC9H,CAAA;EACJ,QAAQ,CAER;EAEA,OAAOI;CACX;CAEA,MACME,aACF,IACA,MACA,OAC0B;EAC1B,OAAO,KAAKE,MAAMpB,OAAO,EAAEqB,YAAY,KAAK,CAAA;CAChD;CAEA,MACMC,IACF,IACA,MACA,OAC0B;EAC1B,OAAO,KAAKF,MAAMpB,KAAAA;CACtB;CAEA,MACMuB,aACF,IACA,OAC0B;EAC1B,MAAMR,UAAU7B,kBAAkBc,KAAAA;EAElC,MAAMI,sBAAsBjB,8BAA8Ba,KAAAA;EAC1D,MAAMI,oBAAoBC,YAAY,EAAEC,MAAMrC,eAAeuD,yBAAyB,CAAA;EAEtF,MAAMR,SAAS,MAAM,KAAKzB,WAAWkC,UAAU,EAAEX,IAAIC,QAAQ,CAAA;EAE7D,IAAI,CAACC,QACD,MAAM,IAAI3C,oBAAAA;EAGd,MAAM+B,oBAAoBK,SAAS;GAC/BH,MAAMrC,eAAeuD;GACrBvB,MAAMnD,iBAAiB;KAAGD,kBAAkB6D,aAAaM;KAASnE,kBAAkB8D,cAAcK,OAAOJ,YAAY;GAAK,CAAA;EAC9H,CAAA;EAEA,MAAM,EAAEE,IAAIY,aAAaV;EAEzB,MAAM,KAAKzB,WAAWoC,OAAOX,MAAAA;EAE7BA,OAAOF,KAAKY;EAEZ1B,MAAM4B,SAASC,SAAS;EAExB,OAAOb;CACX;CAEA,MACMc,YACF,MACA,OAC0B;EAC1B,OAAO,KAAKV,MAAMpB,KAAAA;CACtB;CAIA,MACM+B,aACF,KACA,OACF;EACE,MAAMjB,KAAK5B,kBAAkBc,KAAAA;EAC7B,MAAMgB,SAAS,MAAM,KAAKiB,QAAQnB,EAAAA;EAElC,IAAI,CAAC5C,yBAAyB8C,MAAAA,KAAW,CAAC7C,yBAAyB6C,MAAAA,GAC/D,MAAM,IAAI5C,gBAAgB,oFAAA;EAG9B,MAAM8D,gBAAgBtD,0CAA0C;GAC5Da,gBAAgB,KAAKA;GACrB0C,UAAUnB;GACV1B,SAAS,EAAE8C,SAAS,KAAK9C,QAAQ8C,QAAQ;EAC7C,CAAA;EAEA,MAAMC,aAAmC,CAAC;EAE1C,IAAIC;EACJ,MAAMC,QAAQhE,gBAAgByB,KAAAA;EAC9B,IAAI,OAAOuC,MAAMD,gBAAgB,UAAU;GACvC,IAAIE;GAEJ,IAAI;IACAA,qBAAqBC,KAAKC,MAAM1F,gBAAgBuF,MAAMD,WAAW,CAAA;GACrE,QAAQ;IACJ,MAAM7D,mBAAmBkE,UAAU,sDAAA;GACvC;GAEA,MAAMC,uBAAuB,MAAM,KAAKjD,qBAAqBkD,IAAIL,kBAAAA;GACjE,MAAMvC,OAAO,MAAM,KAAKP,oBAAoBoD,OAAOF,oBAAAA;GAEnD,IACI3C,KAAK8C,OAAOnC,YACZI,OAAOJ,YACPI,OAAOJ,aAAaX,KAAK8C,OAAOnC,UAEhC,MAAMnC,mBAAmBkE,UAAU,6CAAA;GAGvCL,cAAcrC,KAAKA;EACvB;EAEAoC,WAAWW,QAAQ,MAAM,KAAKC,uBAAuBjD,OAAOsC,WAAAA;EAE5D,OAAOzE,aAAamC,OAAOkC,cAAcgB,iBAAiBb,UAAAA,CAAAA;CAC9D;CAEA,MACMc,YACF,KACA,OACF;EACE,MAAMrC,KAAK5B,kBAAkBc,KAAAA;EAE7B,MAAMgB,SAAS,MAAM,KAAKiB,QAAQnB,EAAAA;EAElC,IAAI,CAAC5C,yBAAyB8C,MAAAA,KAAW,CAAC7C,yBAAyB6C,MAAAA,GAC/D,MAAM,IAAIoC,MAAM,yBAAyBpC,OAAOqC,SAAS,eAAe;EAG5E,MAAMpD,OAAO,MAAM,KAAKqD,yBAAyBtD,KAAAA;EACjD,IACIgB,OAAOJ,YACPX,KAAKqC,eACLrC,KAAKqC,YAAY1B,YACjBX,KAAKqC,YAAY1B,aAAaI,OAAOJ,UAErC,MAAMnC,mBAAmBkE,UAAU,6CAAA;EAGvC,MAAM,EAAEY,SAAShF,gBAAgByB,KAAAA;EAWjC,MAAMmB,OAAO,MATSvC,0CAA0C;GAC5Da,gBAAgB,KAAKA;GACrB0C,UAAUnB;GACV1B,SAAS;IACL8C,SAAS,KAAK9C,QAAQ8C;IACtBoB,UAAUvD,KAAKqC,aAAamB;GAChC;EACJ,CAEmBvB,CAAAA,CAAcwB,aAAaH,IAAAA;EAE9C,MAAMI,QAAQ,MAAM,KAAKnE,gBAAgByC,QAAQjB,OAAOJ,UAAU,IAAA;EAElE,MAAMgD,oBAAoB,MAAM,KAAK/D,WAAWgE,MAC5C;GACIC,eAAe;GACfL,WAAWxD,KAAKqC,aAAamB;GAC7BM,cAAc9D,KAAKqC,aAAayB;GAChCC,OAAO/D,KAAKqC,aAAa0B;EAC7B,GACA;GACIC,MAAMjG,aAAakG;GACnBjE,MAAM;IACF,GAAGkB;IACHwC;GACJ;EACJ,CAAA;EAGJ,IAAI1D,KAAKqC,aAAa;GAClB,MAAM6B,kBAAkBC,OAAOC,KAAKpE,KAAKqC,WAAW;GAEpD,MAAMgC,MAAM,IAAI5F,IAAIJ,WAAW,KAAKgB,QAAQ8C,SAAS,WAAA,CAAA;GACrD,KAAK,MAAMmC,mBAAmBJ,iBAAiB;IAC3C,MAAMK,iBAAiBD;IACvB,IAAItE,KAAKqC,YAAYkC,iBACjBF,IAAIG,aAAaC,IAAIF,gBAAgBvE,KAAKqC,YAAYkC,eAAe;GAE7E;GAEAF,IAAIG,aAAaC,IAAI,QAAQd,kBAAkB9C,EAAE;GAEjD,OAAOjD,aAAamC,OAAOsE,IAAIK,IAAI;EACvC;EAEA,MAAML,MAAM,IAAI5F,IAAI,KAAKY,QAAQ8C,OAAO;EACxCkC,IAAIG,aAAaC,IAAI,QAAQd,kBAAkB9C,EAAE;EAEjD,OAAOjD,aAAamC,OAAOsE,IAAIK,IAAI;CACvC;CAIA,MAAcvD,MAAMpB,OAAkBV,UAElC,CAAC,GAA8B;EAC/B,IAAIsF;EACJ,MAAM9D,KAAK/B,kBAAkBiB,OAAO,EAAE/C,QAAQ,MAAM,CAAA;EACpD,MAAM4H,OAAO,MAAMrG,gBAAgBwB,KAAAA;EACnCnB,wBAAwBmB,OAAO6E,IAAAA;EAC/B,MAAMC,UAAU9F,kBAAkBgB,KAAAA,KAAUlB,eAAe+F,IAAAA;EAE3D,IAAI7D;EACJ,IAAIF,IAAI;GACJ,MAAMiE,QAA6B,CAAC;GACpC,IAAI9H,OAAO6D,EAAAA,GACPiE,MAAMjE,KAAKA;QAEXiE,MAAMzE,OAAOQ;GAGjB,IAAIgE,SACAC,MAAMnE,WAAWkE;GAGrB9D,SAAS,MAAM,KAAKzB,WAAWkC,UAAUsD,KAAAA;GACzC,IAAI,CAAC/D,UAAU1B,QAAQ+B,YACnB,MAAM,IAAIhD,oBAAAA;EAElB,OAAO,IAAIiB,QAAQ+B,YACf,MAAM,IAAIhD,oBAAAA;EAGd,MAAM+B,sBAAsBjB,8BAA8Ba,KAAAA;EAC1D,IAAIgB,QAAQ;GACR,MAAMZ,oBAAoBC,YAAY,EAAEC,MAAMrC,eAAe+G,yBAAyB,CAAA;GAEtFJ,QAAQ7H,eAAekI;EAC3B,OAAO;GACH,MAAM7E,oBAAoBC,YAAY,EAAEC,MAAMrC,eAAeiH,yBAAyB,CAAA;GAEtFN,QAAQ7H,eAAeoI;EAC3B;EAGA,MAAMlF,OAAO,MAAMmF,IADGrH,0BACHqH,CAAAA,CAAUvC,IAAIgC,MAAM,EAAED,MAAM,CAAA;EAG/C,MAAMU,aAAa,MAAMD,IADOvH,oCACPuH,CAAAA,CAAoBxC,IAAIgC,IAAAA;EAEjD,MAAM,KAAKtF,WAAWgG,oBAAoBtF,IAAAA;EAE1C,IAAIe,QACA,MAAMZ,oBAAoBK,SAAS;GAC/BH,MAAMrC,eAAe+G;GACrB/E,MAAMnD,iBAAiB;KAClBD,kBAAkB6D,aAAa;KAC5B,GAAGM;KACH,GAAGf;IACP;KACCpD,kBAAkB8D,cAAcV,KAAKW,YAAYI,OAAOJ,YAAY;GACzE,CAAA;EACJ,CAAA;OACG;GACH,IAAI,CAACX,KAAKW,UAENX,KAAKW,WADY3B,yBAAyBe,KAC1BwF,CAAAA,CAASV;GAG7B,MAAM1E,oBAAoBK,SAAS;IAC/BH,MAAMrC,eAAeiH;IACrBjF,MAAMnD,iBAAiB;MAAGD,kBAAkB6D,aAAaT;MAAOpD,kBAAkB8D,cAAcV,KAAKW,YAAY;IAAK,CAAA;GAC1H,CAAA;EACJ;EAEA,MAAM,KAAKrB,WAAWkG,gBAAgBxF,MAAMe,UAAU0E,KAAAA,CAAAA;EAEtD,IAAI1E,QAAQ;GACRA,SAAS,KAAKzB,WAAWoG,MAAM3E,QAAQf,IAAAA;GACvC,MAAM,KAAKV,WAAWqG,WAAW5E,QAAQsE,UAAAA;GAEzCtF,MAAM4B,SAASC,SAAS;GAExB,OAAOb;EACX;EAEAA,SAAS,KAAKzB,WAAWsG,OAAO5F,IAAAA;EAChC,MAAM,KAAKV,WAAWqG,WAAW5E,QAAQsE,UAAAA;EAEzCtF,MAAM4B,SAASC,SAAS;EAExB,OAAOb;CACX;CAIA,MAAciB,QAAQnB,IAAY;EAC9B,MAAME,SAAS,MAAM,KAAKzB,WAAWuG,YAAYhF,EAAAA;EAEjD,IAAI,CAACE,QACD,MAAM,IAAI3C,oBAAAA;EAGd,OAAO2C;CACX;CAIA,MAAciC,uBACVjD,OACAsC,aACgB;EAChB,OAAO,KAAK1C,aAAamG,KAAK;GAC1BzD;GACA0D,IAAIpI,aAAaoC,OAAO,EAAEiG,YAAY,KAAK,CAAA,KAAM;GACjDC,WAAWvI,iBAAiBqC,OAAO,YAAA,KAAiB0F,KAAAA;EACxD,CAAA;CACJ;CAEA,MAAcpC,yBAAyBtD,OAAqD;EACxF,MAAMuC,QAAQhE,gBAAgByB,KAAAA;EAC9B,IAAI,OAAOuC,MAAMS,UAAU,UACvB,MAAMvE,mBAAmB0H,aAAY;EAGzC,OAAO,KAAKvG,aAAakD,OAAOP,MAAMS,OAAO;GACzCgD,IAAIpI,aAAaoC,OAAO,EAAEiG,YAAY,KAAK,CAAA,KAAM;GACjDC,WAAWvI,iBAAiBqC,OAAO,YAAA,KAAiB0F,KAAAA;EACxD,CAAA;CACJ;AACJ;;;;;;;;;;;;;;;;;gBA3ToBtG,uBAAAA,CAAAA;;;;;;;;;;;;;eASDA,uBAAAA,CAAAA;;;;;;;;;;;;;kBASGA,uBAAAA,CAAAA;;;;;;;;YAgCNA,uBAAAA,CAAAA;;;;;;;;;;;;;;;;;;;;;;;;;cAjJF,uBAAuB,qCAAA,CAAA"}

package/dist/adapters/http/controllers/workflows/token/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/token/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,gCAAgC,EAAyB,MAAM,eAAe,CAAC;AACvH,OAAO,EAA4C,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAQ3F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGxC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,KAAK,EACR,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACvB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAWnE,qBAEa,eAAe;IACxB,SAAS,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;IAEjD,SAAS,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;IAEhD,SAAS,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAE9C,SAAS,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAE5C,SAAS,CAAC,gBAAgB,EAAG,iBAAiB,CAAC;IAE/C,SAAS,CAAC,0BAA0B,EAAG,2BAA2B,CAAC;IAEnE,SAAS,CAAC,WAAW,EAAG,MAAM,CAAC,GAAG,gBAAgB,EAAE,EAAE,gBAAgB,CAAC,CAAC;gBAI5D,GAAG,EAAE,sBAAsB;IA+CjC,aAAa,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,gCAAgC,CAAC;IAKtF,cAAc,CACJ,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,gCAAgC,CAAC;IA4DtC,WAAW,CACD,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,IAAI,CAAC;IAkBV,WAAW,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAarF"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/token/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,gCAAgC,EAAyB,MAAM,eAAe,CAAC;AACvH,OAAO,EAA4C,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAQ3F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGxC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,KAAK,EACR,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACvB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAWnE,qBAEa,eAAe;IACxB,SAAS,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;IAEjD,SAAS,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;IAEhD,SAAS,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAE9C,SAAS,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAE5C,SAAS,CAAC,gBAAgB,EAAG,iBAAiB,CAAC;IAE/C,SAAS,CAAC,0BAA0B,EAAG,2BAA2B,CAAC;IAEnE,SAAS,CAAC,WAAW,EAAG,MAAM,CAAC,GAAG,gBAAgB,EAAE,EAAE,gBAAgB,CAAC,CAAC;gBAI5D,GAAG,EAAE,sBAAsB;IAgDjC,aAAa,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,gCAAgC,CAAC;IAKtF,cAAc,CACJ,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,gCAAgC,CAAC;IA4DtC,WAAW,CACD,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,IAAI,CAAC;IAkBV,WAAW,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAarF"}

package/dist/adapters/http/controllers/workflows/token/module.mjs

@@ -70,7 +70,8 @@ var TokenController = class {
 				refreshTokenIssuer: ctx.refreshTokenIssuer,
 				authenticator: ctx.userAuthenticator,
 				clientAuthenticator: ctx.oauth2ClientAuthenticator,
-				sessionManager: ctx.sessionManager
+				sessionManager: ctx.sessionManager,
+				realmRepository: ctx.realmRepository
 			}),
 			[OAuth2TokenGrant.REFRESH_TOKEN]: new HTTPOAuth2RefreshTokenGrant({
 				accessTokenIssuer: ctx.accessTokenIssuer,

package/dist/adapters/http/controllers/workflows/token/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2GrantTypeError","OAuth2RequestError","OAuth2TokenGrant","DContext","DController","DGet","DPost","DTags","buildPermissionKey","toOAuth2Error","OAuth2OpenIDClaimsBuilder","HTTPClientCredentialsGrant","HTTPOAuth2AuthorizeGrant","HTTPOAuth2RefreshTokenGrant","HTTPPasswordGrant","HTTPRobotCredentialsGrant","guessOauth2GrantTypeByRequest","extractTokenFromRequest","TokenController","refreshTokenIssuer","accessTokenIssuer","tokenVerifier","tokenRevoker","identityResolver","identityPermissionProvider","tokenGrants","ctx","AUTHORIZATION_CODE","codeVerifier","clientAuthenticator","oauth2ClientAuthenticator","sessionManager","CLIENT_CREDENTIALS","authenticator","ROBOT_CREDENTIALS","robotAuthenticator","PASSWORD","userAuthenticator","REFRESH_TOKEN","getIntrospect","event","postIntrospect","token","payload","verify","skipActiveCheck","sub","sub_kind","identityInvalid","permissions","getFor","id","type","clientId","client_id","realmId","realm_id","identity","resolve","claimsBuilder","claims","fromIdentity","active","jti","isInactive","Object","values","reduce","acc","binding","key","permission","name","e","revokeToken","revoke","response","status","createToken","grantType","unsupported","grant","runWithRequest"],"sources":["../../../../../../src/adapters/http/controllers/workflows/token/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenIntrospectionResponse, OAuth2TokenPermission } from '@authup/specs';\nimport { OAuth2GrantTypeError, OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPost,\n    DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport { buildPermissionKey } from '@authup/access';\nimport { toOAuth2Error } from '../../../../../core/oauth2/helpers/index.ts';\nimport type { TokenControllerContext } from './types.ts';\nimport type {\n    IIdentityPermissionProvider,\n    IIdentityResolver,\n    IOAuth2TokenIssuer,\n    IOAuth2TokenRevoker,\n    IOAuth2TokenVerifier,\n} from '../../../../../core/index.ts';\nimport { OAuth2OpenIDClaimsBuilder } from '../../../../../core/index.ts';\nimport type { IHTTPOAuth2Grant } from '../../../adapters/index.ts';\nimport {\n    HTTPClientCredentialsGrant,\n    HTTPOAuth2AuthorizeGrant,\n    HTTPOAuth2RefreshTokenGrant,\n    HTTPPasswordGrant,\n    HTTPRobotCredentialsGrant,\n    guessOauth2GrantTypeByRequest,\n} from '../../../adapters/index.ts';\nimport { extractTokenFromRequest } from './utils/index.ts';\n\n@DTags('auth')\n@DController('/token')\nexport class TokenController {\n    protected refreshTokenIssuer: IOAuth2TokenIssuer;\n\n    protected accessTokenIssuer: IOAuth2TokenIssuer;\n\n    protected tokenVerifier: IOAuth2TokenVerifier;\n\n    protected tokenRevoker: IOAuth2TokenRevoker;\n\n    protected identityResolver : IIdentityResolver;\n\n    protected identityPermissionProvider : IIdentityPermissionProvider;\n\n    protected tokenGrants : Record<`${OAuth2TokenGrant}`, IHTTPOAuth2Grant>;\n\n    // -------------------------------------------\n\n    constructor(ctx: TokenControllerContext) {\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n        this.accessTokenIssuer = ctx.accessTokenIssuer;\n        this.tokenVerifier = ctx.tokenVerifier;\n        this.tokenRevoker = ctx.tokenRevoker;\n        this.identityResolver = ctx.identityResolver;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n\n        this.tokenGrants = {\n            [OAuth2TokenGrant.AUTHORIZATION_CODE]: new HTTPOAuth2AuthorizeGrant({\n                codeVerifier: ctx.codeVerifier,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                sessionManager: ctx.sessionManager,\n            }),\n            [OAuth2TokenGrant.CLIENT_CREDENTIALS]: new HTTPClientCredentialsGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                authenticator: ctx.clientAuthenticator,\n                sessionManager: ctx.sessionManager,\n            }),\n            [OAuth2TokenGrant.ROBOT_CREDENTIALS]: new HTTPRobotCredentialsGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                authenticator: ctx.robotAuthenticator,\n                sessionManager: ctx.sessionManager,\n            }),\n            [OAuth2TokenGrant.PASSWORD]: new HTTPPasswordGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                authenticator: ctx.userAuthenticator,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                sessionManager: ctx.sessionManager,\n            }),\n            [OAuth2TokenGrant.REFRESH_TOKEN]: new HTTPOAuth2RefreshTokenGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                tokenVerifier: ctx.tokenVerifier,\n                tokenRevoker: ctx.tokenRevoker,\n                sessionManager: ctx.sessionManager,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n            }),\n        };\n    }\n\n    // -------------------------------------------\n\n    @DGet('/introspect', [])\n    async getIntrospect(@DContext() event: IAppEvent): Promise<OAuth2TokenIntrospectionResponse> {\n        return this.postIntrospect(event);\n    }\n\n    @DPost('/introspect', [])\n    async postIntrospect(\n        @DContext() event: IAppEvent,\n    ): Promise<OAuth2TokenIntrospectionResponse> {\n        try {\n            const token = await extractTokenFromRequest(event);\n            const payload = await this.tokenVerifier.verify(token, { skipActiveCheck: true });\n            if (!payload.sub || !payload.sub_kind) {\n                throw OAuth2RequestError.identityInvalid();\n            }\n\n            // todo: only receive client specific permissions\n            const permissions = await this.identityPermissionProvider.getFor({\n                id: payload.sub,\n                type: payload.sub_kind,\n                clientId: payload.client_id,\n                realmId: payload.realm_id,\n            });\n\n            const identity = await this.identityResolver.resolve(payload.sub_kind, payload.sub);\n            if (!identity) {\n                // todo: differentiate between client, robot & user\n                throw OAuth2RequestError.identityInvalid();\n            }\n\n            const claimsBuilder = new OAuth2OpenIDClaimsBuilder();\n            const claims = claimsBuilder.fromIdentity(identity);\n\n            let active : boolean;\n            if (payload.jti) {\n                const isInactive = await this.tokenVerifier.isInactive(payload.jti);\n                active = !isInactive;\n            } else {\n                active = false;\n            }\n\n            return {\n                active,\n                // todo: permissions property should be removed.\n                permissions: Object.values(\n                    permissions.reduce((acc, binding) => {\n                        const key = buildPermissionKey(binding.permission);\n                        if (!acc[key]) {\n                            acc[key] = {\n                                name: binding.permission.name,\n                                client_id: binding.permission.client_id,\n                                realm_id: binding.permission.realm_id,\n                            } as OAuth2TokenPermission;\n                        }\n                        return acc;\n                    }, {} as Record<string, OAuth2TokenPermission>),\n                ),\n                ...payload,\n                ...claims,\n            };\n        } catch (e) {\n            throw toOAuth2Error(e);\n        }\n    }\n\n    // ----------------------------------------------------------\n\n    @DPost('/revoke', [])\n    async revokeToken(\n        @DContext() event: IAppEvent,\n    ): Promise<null> {\n        try {\n            const token = await extractTokenFromRequest(event);\n\n            const payload = await this.tokenVerifier.verify(token);\n\n            await this.tokenRevoker.revoke(payload);\n\n            event.response.status = 202;\n            return null;\n        } catch (e) {\n            throw toOAuth2Error(e);\n        }\n    }\n\n    // ----------------------------------------------------------\n\n    @DPost('', [])\n    async createToken(@DContext() event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const grantType = await guessOauth2GrantTypeByRequest(event);\n        if (!grantType) {\n            throw OAuth2GrantTypeError.unsupported();\n        }\n\n        const grant = this.tokenGrants[grantType];\n        if (!grant) {\n            throw OAuth2GrantTypeError.unsupported();\n        }\n\n        return grant.runWithRequest(event);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAKC,SAAA,aAAA,YAAA,QAAA,KAAA,MAAA;;;;;;;;;;;;;;AAoCD,IAAakB,kBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAA6B;EACrC,KAAKP,qBAAqBO,IAAIP;EAC9B,KAAKC,oBAAoBM,IAAIN;EAC7B,KAAKC,gBAAgBK,IAAIL;EACzB,KAAKC,eAAeI,IAAIJ;EACxB,KAAKC,mBAAmBG,IAAIH;EAC5B,KAAKC,6BAA6BE,IAAIF;EAEtC,KAAKC,cAAc;IACdvB,iBAAiByB,qBAAqB,IAAIf,yBAAyB;IAChEgB,cAAcF,IAAIE;IAClBC,qBAAqBH,IAAII;IACzBV,mBAAmBM,IAAIN;IACvBD,oBAAoBO,IAAIP;IACxBY,gBAAgBL,IAAIK;GACxB,CAAA;IACC7B,iBAAiB8B,qBAAqB,IAAIrB,2BAA2B;IAClES,mBAAmBM,IAAIN;IACvBa,eAAeP,IAAIG;IACnBE,gBAAgBL,IAAIK;GACxB,CAAA;IACC7B,iBAAiBgC,oBAAoB,IAAInB,0BAA0B;IAChEK,mBAAmBM,IAAIN;IACvBa,eAAeP,IAAIS;IACnBJ,gBAAgBL,IAAIK;GACxB,CAAA;IACC7B,iBAAiBkC,WAAW,IAAItB,kBAAkB;IAC/CM,mBAAmBM,IAAIN;IACvBD,oBAAoBO,IAAIP;IACxBc,eAAeP,IAAIW;IACnBR,qBAAqBH,IAAII;IACzBC,gBAAgBL,IAAIK;GACxB,CAAA;IACC7B,iBAAiBoC,gBAAgB,IAAIzB,4BAA4B;IAC9DO,mBAAmBM,IAAIN;IACvBD,oBAAoBO,IAAIP;IACxBE,eAAeK,IAAIL;IACnBC,cAAcI,IAAIJ;IAClBS,gBAAgBL,IAAIK;IACpBF,qBAAqBH,IAAII;GAC7B,CAAA;EACJ;CACJ;CAIA,MACMS,cAAc,OAAyE;EACzF,OAAO,KAAKE,eAAeD,KAAAA;CAC/B;CAEA,MACMC,eACF,OACyC;EACzC,IAAI;GACA,MAAMC,QAAQ,MAAMzB,wBAAwBuB,KAAAA;GAC5C,MAAMG,UAAU,MAAM,KAAKtB,cAAcuB,OAAOF,OAAO,EAAEG,iBAAiB,KAAK,CAAA;GAC/E,IAAI,CAACF,QAAQG,OAAO,CAACH,QAAQI,UACzB,MAAM9C,mBAAmB+C,gBAAe;GAI5C,MAAMC,cAAc,MAAM,KAAKzB,2BAA2B0B,OAAO;IAC7DC,IAAIR,QAAQG;IACZM,MAAMT,QAAQI;IACdM,UAAUV,QAAQW;IAClBC,SAASZ,QAAQa;GACrB,CAAA;GAEA,MAAMC,WAAW,MAAM,KAAKlC,iBAAiBmC,QAAQf,QAAQI,UAAUJ,QAAQG,GAAG;GAClF,IAAI,CAACW,UAED,MAAMxD,mBAAmB+C,gBAAe;GAI5C,MAAMY,SAASD,IADWjD,0BACXiD,CAAAA,CAAcE,aAAaJ,QAAAA;GAE1C,IAAIK;GACJ,IAAInB,QAAQoB,KAERD,SAAS,CAACE,MADe,KAAK3C,cAAc2C,WAAWrB,QAAQoB,GAAG;QAGlED,SAAS;GAGb,OAAO;IACHA;IAEAb,aAAagB,OAAOC,OAChBjB,YAAYkB,QAAQC,KAAKC,YAAAA;KACrB,MAAMC,MAAM9D,mBAAmB6D,QAAQE,UAAU;KACjD,IAAI,CAACH,IAAIE,MACLF,IAAIE,OAAO;MACPE,MAAMH,QAAQE,WAAWC;MACzBlB,WAAWe,QAAQE,WAAWjB;MAC9BE,UAAUa,QAAQE,WAAWf;KACjC;KAEJ,OAAOY;IACX,GAAG,CAAC,CAAA,CAAA;IAER,GAAGzB;IACH,GAAGiB;GACP;EACJ,SAASa,GAAG;GACR,MAAMhE,cAAcgE,CAAAA;EACxB;CACJ;CAIA,MACMC,YACF,OACa;EACb,IAAI;GACA,MAAMhC,QAAQ,MAAMzB,wBAAwBuB,KAAAA;GAE5C,MAAMG,UAAU,MAAM,KAAKtB,cAAcuB,OAAOF,KAAAA;GAEhD,MAAM,KAAKpB,aAAaqD,OAAOhC,OAAAA;GAE/BH,MAAMoC,SAASC,SAAS;GACxB,OAAO;EACX,SAASJ,GAAG;GACR,MAAMhE,cAAcgE,CAAAA;EACxB;CACJ;CAIA,MACMK,YAAY,OAAiE;EAC/E,MAAMC,YAAY,MAAM/D,8BAA8BwB,KAAAA;EACtD,IAAI,CAACuC,WACD,MAAM/E,qBAAqBgF,YAAW;EAG1C,MAAMC,QAAQ,KAAKxD,YAAYsD;EAC/B,IAAI,CAACE,OACD,MAAMjF,qBAAqBgF,YAAW;EAG1C,OAAOC,MAAMC,eAAe1C,KAAAA;CAChC;AACJ"}
+{"version":3,"file":"module.mjs","names":["OAuth2GrantTypeError","OAuth2RequestError","OAuth2TokenGrant","DContext","DController","DGet","DPost","DTags","buildPermissionKey","toOAuth2Error","OAuth2OpenIDClaimsBuilder","HTTPClientCredentialsGrant","HTTPOAuth2AuthorizeGrant","HTTPOAuth2RefreshTokenGrant","HTTPPasswordGrant","HTTPRobotCredentialsGrant","guessOauth2GrantTypeByRequest","extractTokenFromRequest","TokenController","refreshTokenIssuer","accessTokenIssuer","tokenVerifier","tokenRevoker","identityResolver","identityPermissionProvider","tokenGrants","ctx","AUTHORIZATION_CODE","codeVerifier","clientAuthenticator","oauth2ClientAuthenticator","sessionManager","CLIENT_CREDENTIALS","authenticator","ROBOT_CREDENTIALS","robotAuthenticator","PASSWORD","userAuthenticator","realmRepository","REFRESH_TOKEN","getIntrospect","event","postIntrospect","token","payload","verify","skipActiveCheck","sub","sub_kind","identityInvalid","permissions","getFor","id","type","clientId","client_id","realmId","realm_id","identity","resolve","claimsBuilder","claims","fromIdentity","active","jti","isInactive","Object","values","reduce","acc","binding","key","permission","name","e","revokeToken","revoke","response","status","createToken","grantType","unsupported","grant","runWithRequest"],"sources":["../../../../../../src/adapters/http/controllers/workflows/token/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenIntrospectionResponse, OAuth2TokenPermission } from '@authup/specs';\nimport { OAuth2GrantTypeError, OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPost,\n    DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport { buildPermissionKey } from '@authup/access';\nimport { toOAuth2Error } from '../../../../../core/oauth2/helpers/index.ts';\nimport type { TokenControllerContext } from './types.ts';\nimport type {\n    IIdentityPermissionProvider,\n    IIdentityResolver,\n    IOAuth2TokenIssuer,\n    IOAuth2TokenRevoker,\n    IOAuth2TokenVerifier,\n} from '../../../../../core/index.ts';\nimport { OAuth2OpenIDClaimsBuilder } from '../../../../../core/index.ts';\nimport type { IHTTPOAuth2Grant } from '../../../adapters/index.ts';\nimport {\n    HTTPClientCredentialsGrant,\n    HTTPOAuth2AuthorizeGrant,\n    HTTPOAuth2RefreshTokenGrant,\n    HTTPPasswordGrant,\n    HTTPRobotCredentialsGrant,\n    guessOauth2GrantTypeByRequest,\n} from '../../../adapters/index.ts';\nimport { extractTokenFromRequest } from './utils/index.ts';\n\n@DTags('auth')\n@DController('/token')\nexport class TokenController {\n    protected refreshTokenIssuer: IOAuth2TokenIssuer;\n\n    protected accessTokenIssuer: IOAuth2TokenIssuer;\n\n    protected tokenVerifier: IOAuth2TokenVerifier;\n\n    protected tokenRevoker: IOAuth2TokenRevoker;\n\n    protected identityResolver : IIdentityResolver;\n\n    protected identityPermissionProvider : IIdentityPermissionProvider;\n\n    protected tokenGrants : Record<`${OAuth2TokenGrant}`, IHTTPOAuth2Grant>;\n\n    // -------------------------------------------\n\n    constructor(ctx: TokenControllerContext) {\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n        this.accessTokenIssuer = ctx.accessTokenIssuer;\n        this.tokenVerifier = ctx.tokenVerifier;\n        this.tokenRevoker = ctx.tokenRevoker;\n        this.identityResolver = ctx.identityResolver;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n\n        this.tokenGrants = {\n            [OAuth2TokenGrant.AUTHORIZATION_CODE]: new HTTPOAuth2AuthorizeGrant({\n                codeVerifier: ctx.codeVerifier,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                sessionManager: ctx.sessionManager,\n            }),\n            [OAuth2TokenGrant.CLIENT_CREDENTIALS]: new HTTPClientCredentialsGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                authenticator: ctx.clientAuthenticator,\n                sessionManager: ctx.sessionManager,\n            }),\n            [OAuth2TokenGrant.ROBOT_CREDENTIALS]: new HTTPRobotCredentialsGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                authenticator: ctx.robotAuthenticator,\n                sessionManager: ctx.sessionManager,\n            }),\n            [OAuth2TokenGrant.PASSWORD]: new HTTPPasswordGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                authenticator: ctx.userAuthenticator,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                sessionManager: ctx.sessionManager,\n                realmRepository: ctx.realmRepository,\n            }),\n            [OAuth2TokenGrant.REFRESH_TOKEN]: new HTTPOAuth2RefreshTokenGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                tokenVerifier: ctx.tokenVerifier,\n                tokenRevoker: ctx.tokenRevoker,\n                sessionManager: ctx.sessionManager,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n            }),\n        };\n    }\n\n    // -------------------------------------------\n\n    @DGet('/introspect', [])\n    async getIntrospect(@DContext() event: IAppEvent): Promise<OAuth2TokenIntrospectionResponse> {\n        return this.postIntrospect(event);\n    }\n\n    @DPost('/introspect', [])\n    async postIntrospect(\n        @DContext() event: IAppEvent,\n    ): Promise<OAuth2TokenIntrospectionResponse> {\n        try {\n            const token = await extractTokenFromRequest(event);\n            const payload = await this.tokenVerifier.verify(token, { skipActiveCheck: true });\n            if (!payload.sub || !payload.sub_kind) {\n                throw OAuth2RequestError.identityInvalid();\n            }\n\n            // todo: only receive client specific permissions\n            const permissions = await this.identityPermissionProvider.getFor({\n                id: payload.sub,\n                type: payload.sub_kind,\n                clientId: payload.client_id,\n                realmId: payload.realm_id,\n            });\n\n            const identity = await this.identityResolver.resolve(payload.sub_kind, payload.sub);\n            if (!identity) {\n                // todo: differentiate between client, robot & user\n                throw OAuth2RequestError.identityInvalid();\n            }\n\n            const claimsBuilder = new OAuth2OpenIDClaimsBuilder();\n            const claims = claimsBuilder.fromIdentity(identity);\n\n            let active : boolean;\n            if (payload.jti) {\n                const isInactive = await this.tokenVerifier.isInactive(payload.jti);\n                active = !isInactive;\n            } else {\n                active = false;\n            }\n\n            return {\n                active,\n                // todo: permissions property should be removed.\n                permissions: Object.values(\n                    permissions.reduce((acc, binding) => {\n                        const key = buildPermissionKey(binding.permission);\n                        if (!acc[key]) {\n                            acc[key] = {\n                                name: binding.permission.name,\n                                client_id: binding.permission.client_id,\n                                realm_id: binding.permission.realm_id,\n                            } as OAuth2TokenPermission;\n                        }\n                        return acc;\n                    }, {} as Record<string, OAuth2TokenPermission>),\n                ),\n                ...payload,\n                ...claims,\n            };\n        } catch (e) {\n            throw toOAuth2Error(e);\n        }\n    }\n\n    // ----------------------------------------------------------\n\n    @DPost('/revoke', [])\n    async revokeToken(\n        @DContext() event: IAppEvent,\n    ): Promise<null> {\n        try {\n            const token = await extractTokenFromRequest(event);\n\n            const payload = await this.tokenVerifier.verify(token);\n\n            await this.tokenRevoker.revoke(payload);\n\n            event.response.status = 202;\n            return null;\n        } catch (e) {\n            throw toOAuth2Error(e);\n        }\n    }\n\n    // ----------------------------------------------------------\n\n    @DPost('', [])\n    async createToken(@DContext() event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const grantType = await guessOauth2GrantTypeByRequest(event);\n        if (!grantType) {\n            throw OAuth2GrantTypeError.unsupported();\n        }\n\n        const grant = this.tokenGrants[grantType];\n        if (!grant) {\n            throw OAuth2GrantTypeError.unsupported();\n        }\n\n        return grant.runWithRequest(event);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAKC,SAAA,aAAA,YAAA,QAAA,KAAA,MAAA;;;;;;;;;;;;;;AAoCD,IAAakB,kBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAA6B;EACrC,KAAKP,qBAAqBO,IAAIP;EAC9B,KAAKC,oBAAoBM,IAAIN;EAC7B,KAAKC,gBAAgBK,IAAIL;EACzB,KAAKC,eAAeI,IAAIJ;EACxB,KAAKC,mBAAmBG,IAAIH;EAC5B,KAAKC,6BAA6BE,IAAIF;EAEtC,KAAKC,cAAc;IACdvB,iBAAiByB,qBAAqB,IAAIf,yBAAyB;IAChEgB,cAAcF,IAAIE;IAClBC,qBAAqBH,IAAII;IACzBV,mBAAmBM,IAAIN;IACvBD,oBAAoBO,IAAIP;IACxBY,gBAAgBL,IAAIK;GACxB,CAAA;IACC7B,iBAAiB8B,qBAAqB,IAAIrB,2BAA2B;IAClES,mBAAmBM,IAAIN;IACvBa,eAAeP,IAAIG;IACnBE,gBAAgBL,IAAIK;GACxB,CAAA;IACC7B,iBAAiBgC,oBAAoB,IAAInB,0BAA0B;IAChEK,mBAAmBM,IAAIN;IACvBa,eAAeP,IAAIS;IACnBJ,gBAAgBL,IAAIK;GACxB,CAAA;IACC7B,iBAAiBkC,WAAW,IAAItB,kBAAkB;IAC/CM,mBAAmBM,IAAIN;IACvBD,oBAAoBO,IAAIP;IACxBc,eAAeP,IAAIW;IACnBR,qBAAqBH,IAAII;IACzBC,gBAAgBL,IAAIK;IACpBO,iBAAiBZ,IAAIY;GACzB,CAAA;IACCpC,iBAAiBqC,gBAAgB,IAAI1B,4BAA4B;IAC9DO,mBAAmBM,IAAIN;IACvBD,oBAAoBO,IAAIP;IACxBE,eAAeK,IAAIL;IACnBC,cAAcI,IAAIJ;IAClBS,gBAAgBL,IAAIK;IACpBF,qBAAqBH,IAAII;GAC7B,CAAA;EACJ;CACJ;CAIA,MACMU,cAAc,OAAyE;EACzF,OAAO,KAAKE,eAAeD,KAAAA;CAC/B;CAEA,MACMC,eACF,OACyC;EACzC,IAAI;GACA,MAAMC,QAAQ,MAAM1B,wBAAwBwB,KAAAA;GAC5C,MAAMG,UAAU,MAAM,KAAKvB,cAAcwB,OAAOF,OAAO,EAAEG,iBAAiB,KAAK,CAAA;GAC/E,IAAI,CAACF,QAAQG,OAAO,CAACH,QAAQI,UACzB,MAAM/C,mBAAmBgD,gBAAe;GAI5C,MAAMC,cAAc,MAAM,KAAK1B,2BAA2B2B,OAAO;IAC7DC,IAAIR,QAAQG;IACZM,MAAMT,QAAQI;IACdM,UAAUV,QAAQW;IAClBC,SAASZ,QAAQa;GACrB,CAAA;GAEA,MAAMC,WAAW,MAAM,KAAKnC,iBAAiBoC,QAAQf,QAAQI,UAAUJ,QAAQG,GAAG;GAClF,IAAI,CAACW,UAED,MAAMzD,mBAAmBgD,gBAAe;GAI5C,MAAMY,SAASD,IADWlD,0BACXkD,CAAAA,CAAcE,aAAaJ,QAAAA;GAE1C,IAAIK;GACJ,IAAInB,QAAQoB,KAERD,SAAS,CAACE,MADe,KAAK5C,cAAc4C,WAAWrB,QAAQoB,GAAG;QAGlED,SAAS;GAGb,OAAO;IACHA;IAEAb,aAAagB,OAAOC,OAChBjB,YAAYkB,QAAQC,KAAKC,YAAAA;KACrB,MAAMC,MAAM/D,mBAAmB8D,QAAQE,UAAU;KACjD,IAAI,CAACH,IAAIE,MACLF,IAAIE,OAAO;MACPE,MAAMH,QAAQE,WAAWC;MACzBlB,WAAWe,QAAQE,WAAWjB;MAC9BE,UAAUa,QAAQE,WAAWf;KACjC;KAEJ,OAAOY;IACX,GAAG,CAAC,CAAA,CAAA;IAER,GAAGzB;IACH,GAAGiB;GACP;EACJ,SAASa,GAAG;GACR,MAAMjE,cAAciE,CAAAA;EACxB;CACJ;CAIA,MACMC,YACF,OACa;EACb,IAAI;GACA,MAAMhC,QAAQ,MAAM1B,wBAAwBwB,KAAAA;GAE5C,MAAMG,UAAU,MAAM,KAAKvB,cAAcwB,OAAOF,KAAAA;GAEhD,MAAM,KAAKrB,aAAasD,OAAOhC,OAAAA;GAE/BH,MAAMoC,SAASC,SAAS;GACxB,OAAO;EACX,SAASJ,GAAG;GACR,MAAMjE,cAAciE,CAAAA;EACxB;CACJ;CAIA,MACMK,YAAY,OAAiE;EAC/E,MAAMC,YAAY,MAAMhE,8BAA8ByB,KAAAA;EACtD,IAAI,CAACuC,WACD,MAAMhF,qBAAqBiF,YAAW;EAG1C,MAAMC,QAAQ,KAAKzD,YAAYuD;EAC/B,IAAI,CAACE,OACD,MAAMlF,qBAAqBiF,YAAW;EAG1C,OAAOC,MAAMC,eAAe1C,KAAAA;CAChC;AACJ"}

package/dist/adapters/http/controllers/workflows/token/types.d.ts

@@ -1,5 +1,5 @@
 import type { Client, Robot, User } from '@authup/core-kit';
-import type { ICredentialsAuthenticator, IIdentityPermissionProvider, IIdentityResolver, IOAuth2AuthorizationCodeVerifier, IOAuth2TokenIssuer, IOAuth2TokenRevoker, IOAuth2TokenVerifier, ISessionManager, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';
+import type { ICredentialsAuthenticator, IIdentityPermissionProvider, IIdentityResolver, IOAuth2AuthorizationCodeVerifier, IOAuth2TokenIssuer, IOAuth2TokenRevoker, IOAuth2TokenVerifier, IRealmRepository, ISessionManager, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';
 export type TokenControllerContext = {
     codeVerifier: IOAuth2AuthorizationCodeVerifier;
     accessTokenIssuer: IOAuth2TokenIssuer;
@@ -13,5 +13,6 @@ export type TokenControllerContext = {
     robotAuthenticator: ICredentialsAuthenticator<Robot>;
     userAuthenticator: ICredentialsAuthenticator<User>;
     oauth2ClientAuthenticator: OAuth2ClientAuthenticator;
+    realmRepository: IRealmRepository;
 };
 //# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/controllers/workflows/token/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/token/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,EACR,yBAAyB,EACzB,2BAA2B,EAC3B,iBAAiB,EACjB,gCAAgC,EAChC,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,yBAAyB,EAC5B,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,sBAAsB,GAAG;IACjC,YAAY,EAAE,gCAAgC,CAAC;IAE/C,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,aAAa,EAAE,oBAAoB,CAAC;IACpC,YAAY,EAAE,mBAAmB,CAAC;IAElC,cAAc,EAAE,eAAe,CAAC;IAEhC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,0BAA0B,EAAE,2BAA2B,CAAC;IAExD,mBAAmB,EAAE,yBAAyB,CAAC,MAAM,CAAC,CAAA;IACtD,kBAAkB,EAAE,yBAAyB,CAAC,KAAK,CAAC,CAAA;IACpD,iBAAiB,EAAE,yBAAyB,CAAC,IAAI,CAAC,CAAA;IAElD,yBAAyB,EAAE,yBAAyB,CAAA;CACvD,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/token/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,EACR,yBAAyB,EACzB,2BAA2B,EAC3B,iBAAiB,EACjB,gCAAgC,EAChC,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,yBAAyB,EAC5B,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,sBAAsB,GAAG;IACjC,YAAY,EAAE,gCAAgC,CAAC;IAE/C,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,aAAa,EAAE,oBAAoB,CAAC;IACpC,YAAY,EAAE,mBAAmB,CAAC;IAElC,cAAc,EAAE,eAAe,CAAC;IAEhC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,0BAA0B,EAAE,2BAA2B,CAAC;IAExD,mBAAmB,EAAE,yBAAyB,CAAC,MAAM,CAAC,CAAA;IACtD,kBAAkB,EAAE,yBAAyB,CAAC,KAAK,CAAC,CAAA;IACpD,iBAAiB,EAAE,yBAAyB,CAAC,IAAI,CAAC,CAAA;IAElD,yBAAyB,EAAE,yBAAyB,CAAA;IAEpD,eAAe,EAAE,gBAAgB,CAAA;CACpC,CAAC"}

package/dist/adapters/http/index.mjs

@@ -3,7 +3,7 @@ import "node:url";
 import.meta.url;
 import { RequestHandlerOperation } from "./request/constants.mjs";
 import { setRequestPermissionEvaluator, useRequestPermissionEvaluator } from "./request/permission/helper.mjs";
-import { RequestIdentity, isRequestIdentityMasterRealmMember, setRequestIdentity, useRequestIdentity, useRequestIdentityOrFail } from "./request/helpers/identity.mjs";
+import { RequestIdentity, setRequestIdentity, useRequestIdentity, useRequestIdentityOrFail } from "./request/helpers/identity.mjs";
 import { buildActorContext } from "./request/helpers/actor.mjs";
 import { getBodyRealmID } from "./request/helpers/body-realm-id.mjs";
 import { LOCALE_COOKIE, useRequestLocale } from "./request/helpers/locale.mjs";
@@ -16,7 +16,7 @@ import { setRequestToken, useRequestToken } from "./request/helpers/token.mjs";
 import { RequestPermissionEvaluator } from "./request/permission/module.mjs";
 import "./request/index.mjs";
 import { HTTPOAuth2Authorizer } from "./adapters/oauth2/authorization/module.mjs";
-import { extractClientCredentialsFromRequest } from "./adapters/oauth2/grant-types/utils/credentials.mjs";
+import { extractClientCredentialsFromRequest, readStringField } from "./adapters/oauth2/grant-types/utils/credentials.mjs";
 import { guessOauth2GrantTypeByRequest } from "./adapters/oauth2/grant-types/utils/guess.mjs";
 import { HTTPOAuth2AuthorizeGrant } from "./adapters/oauth2/grant-types/authorize.mjs";
 import { HTTPClientCredentialsGrant } from "./adapters/oauth2/grant-types/client-credentials.mjs";
@@ -85,4 +85,4 @@ import { UserPermissionRequestValidator } from "./controllers/entities/user-perm
 import { UserRoleController } from "./controllers/entities/user-role/module.mjs";
 import { UserRoleRequestValidator } from "./controllers/entities/user-role/utils/validation.mjs";
 import "./controllers/index.mjs";
-export { ActivateController, AuthorizationMiddleware, AuthorizeController, ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, IdentityProviderController, IdentityProviderRoleMappingController, JwkController, LOCALE_COOKIE, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RealmResolverMiddleware, RegisterController, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, RobotController, RobotPermissionController, RobotPermissionRequestValidator, RobotRoleController, RobotRoleRequestValidator, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, StatusController, TokenController, UI_HTTP_CLIENT_FACTORY_STORE_KEY, UserAttributeController, UserAttributeRequestValidator, UserController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator, VITE_SERVER_STORE_KEY, applyRouteRealmIDToBody, buildActorContext, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createSwaggerMiddleware, extractClientCredentialsFromRequest, getBodyRealmID, getJwkRouteHandler, getJwksRouteHandler, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, guessOauth2GrantTypeByRequest, isRequestIdentityMasterRealmMember, readFromLocations, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerUIHttpClientMiddleware, sanitizeRelativeRedirect, setRequestIdentity, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestToken, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestToken };
+export { ActivateController, AuthorizationMiddleware, AuthorizeController, ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, IdentityProviderController, IdentityProviderRoleMappingController, JwkController, LOCALE_COOKIE, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RealmResolverMiddleware, RegisterController, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, RobotController, RobotPermissionController, RobotPermissionRequestValidator, RobotRoleController, RobotRoleRequestValidator, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, StatusController, TokenController, UI_HTTP_CLIENT_FACTORY_STORE_KEY, UserAttributeController, UserAttributeRequestValidator, UserController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator, VITE_SERVER_STORE_KEY, applyRouteRealmIDToBody, buildActorContext, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createSwaggerMiddleware, extractClientCredentialsFromRequest, getBodyRealmID, getJwkRouteHandler, getJwksRouteHandler, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, guessOauth2GrantTypeByRequest, readFromLocations, readStringField, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerUIHttpClientMiddleware, sanitizeRelativeRedirect, setRequestIdentity, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestToken, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestToken };

package/dist/adapters/http/request/helpers/identity.d.ts

@@ -13,5 +13,4 @@ export declare class RequestIdentity {
 export declare function useRequestIdentity(event: IAppEvent): RequestIdentity | undefined;
 export declare function setRequestIdentity(event: IAppEvent, input: Identity | RequestIdentity): void;
 export declare function useRequestIdentityOrFail(event: IAppEvent): RequestIdentity;
-export declare function isRequestIdentityMasterRealmMember(input: RequestIdentity): boolean;
 //# sourceMappingURL=identity.d.ts.map

package/dist/adapters/http/request/helpers/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/helpers/identity.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAGjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAIxC,qBAAa,eAAe;IACxB,SAAgB,GAAG,EAAG,QAAQ,CAAC;gBAEnB,QAAQ,EAAE,QAAQ;IAI9B,IAAI,QAAQ,QAOX;IAED,IAAI,IAAI,2GAEP;IAED,IAAI,IAAI,gCAEP;IAED,IAAI,EAAE,WAEL;IAED,IAAI,OAAO,WAEV;IAED,IAAI,SAAS,WAEZ;CACJ;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,GAAI,eAAe,GAAG,SAAS,CAEjF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,GAAG,eAAe,GAAI,IAAI,CAU7F;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,SAAS,GAAI,eAAe,CAO3E;AAED,wBAAgB,kCAAkC,CAAC,KAAK,EAAE,eAAe,GAAI,OAAO,CAEnF"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/helpers/identity.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAGjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAIxC,qBAAa,eAAe;IACxB,SAAgB,GAAG,EAAG,QAAQ,CAAC;gBAEnB,QAAQ,EAAE,QAAQ;IAI9B,IAAI,QAAQ,QAOX;IAED,IAAI,IAAI,2GAEP;IAED,IAAI,IAAI,gCAEP;IAED,IAAI,EAAE,WAEL;IAED,IAAI,OAAO,WAEV;IAED,IAAI,SAAS,WAEZ;CACJ;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,GAAI,eAAe,GAAG,SAAS,CAEjF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,GAAG,eAAe,GAAI,IAAI,CAU7F;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,SAAS,GAAI,eAAe,CAO3E"}

package/dist/adapters/http/request/helpers/identity.mjs

@@ -1,7 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { IdentityType, REALM_MASTER_NAME } from "@authup/core-kit";
+import { IdentityType } from "@authup/core-kit";
 import { UnauthorizedError } from "@authup/errors";
 //#region src/adapters/http/request/helpers/identity.ts
 const sym = Symbol("RIdentity");
@@ -45,10 +45,7 @@ function useRequestIdentityOrFail(event) {
 	if (!identity) throw new UnauthorizedError();
 	return identity;
 }
-function isRequestIdentityMasterRealmMember(input) {
-	return input.realmName === REALM_MASTER_NAME;
-}
 //#endregion
-export { RequestIdentity, isRequestIdentityMasterRealmMember, setRequestIdentity, useRequestIdentity, useRequestIdentityOrFail };
+export { RequestIdentity, setRequestIdentity, useRequestIdentity, useRequestIdentityOrFail };
 
 //# sourceMappingURL=identity.mjs.map

package/dist/adapters/http/request/helpers/identity.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"identity.mjs","names":["IdentityType","REALM_MASTER_NAME","UnauthorizedError","sym","Symbol","RequestIdentity","raw","identity","clientId","type","CLIENT","data","id","client_id","realmId","realm_id","realm","realmName","name","useRequestIdentity","event","store","setRequestIdentity","input","useRequestIdentityOrFail","isRequestIdentityMasterRealmMember"],"sources":["../../../../../src/adapters/http/request/helpers/identity.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Identity } from '@authup/core-kit';\nimport { IdentityType, REALM_MASTER_NAME } from '@authup/core-kit';\nimport { UnauthorizedError } from '@authup/errors';\nimport type { IAppEvent } from 'routup';\n\nconst sym = Symbol('RIdentity');\n\nexport class RequestIdentity {\n    public readonly raw : Identity;\n\n    constructor(identity: Identity) {\n        this.raw = identity;\n    }\n\n    get clientId() {\n        const { raw } = this;\n        if (raw.type === IdentityType.CLIENT) {\n            return raw.data.id;\n        }\n\n        return raw.data.client_id || null;\n    }\n\n    get data() {\n        return this.raw.data;\n    }\n\n    get type() {\n        return this.raw.type;\n    }\n\n    get id() {\n        return this.raw.data.id;\n    }\n\n    get realmId() {\n        return this.raw.data.realm_id || this.raw.data.realm?.id;\n    }\n\n    get realmName() {\n        return this.raw.data.realm?.name;\n    }\n}\n\nexport function useRequestIdentity(event: IAppEvent) : RequestIdentity | undefined {\n    return event.store[sym] as RequestIdentity | undefined;\n}\n\nexport function setRequestIdentity(event: IAppEvent, input: Identity | RequestIdentity) : void {\n    let data : RequestIdentity;\n\n    if (input instanceof RequestIdentity) {\n        data = input;\n    } else {\n        data = new RequestIdentity(input);\n    }\n\n    event.store[sym] = data;\n}\n\nexport function useRequestIdentityOrFail(event: IAppEvent) : RequestIdentity {\n    const identity = useRequestIdentity(event);\n    if (!identity) {\n        throw new UnauthorizedError();\n    }\n\n    return identity;\n}\n\nexport function isRequestIdentityMasterRealmMember(input: RequestIdentity) : boolean {\n    return input.realmName === REALM_MASTER_NAME;\n}\n"],"mappings":";;;;;;AAYA,MAAMG,MAAMC,OAAO,WAAA;AAEnB,IAAaC,kBAAb,MAAaA;CACOC;CAEhB,YAAYC,UAAoB;EAC5B,KAAKD,MAAMC;CACf;CAEA,IAAIC,WAAW;EACX,MAAM,EAAEF,QAAQ;EAChB,IAAIA,IAAIG,SAAST,aAAaU,QAC1B,OAAOJ,IAAIK,KAAKC;EAGpB,OAAON,IAAIK,KAAKE,aAAa;CACjC;CAEA,IAAIF,OAAO;EACP,OAAO,KAAKL,IAAIK;CACpB;CAEA,IAAIF,OAAO;EACP,OAAO,KAAKH,IAAIG;CACpB;CAEA,IAAIG,KAAK;EACL,OAAO,KAAKN,IAAIK,KAAKC;CACzB;CAEA,IAAIE,UAAU;EACV,OAAO,KAAKR,IAAIK,KAAKI,YAAY,KAAKT,IAAIK,KAAKK,OAAOJ;CAC1D;CAEA,IAAIK,YAAY;EACZ,OAAO,KAAKX,IAAIK,KAAKK,OAAOE;CAChC;AACJ;AAEA,SAAgBC,mBAAmBC,OAAgB;CAC/C,OAAOA,MAAMC,MAAMlB;AACvB;AAEA,SAAgBmB,mBAAmBF,OAAkBG,OAAiC;CAClF,IAAIZ;CAEJ,IAAIY,iBAAiBlB,iBACjBM,OAAOY;MAEPZ,OAAO,IAAIN,gBAAgBkB,KAAAA;CAG/BH,MAAMC,MAAMlB,OAAOQ;AACvB;AAEA,SAAgBa,yBAAyBJ,OAAgB;CACrD,MAAMb,WAAWY,mBAAmBC,KAAAA;CACpC,IAAI,CAACb,UACD,MAAM,IAAIL,kBAAAA;CAGd,OAAOK;AACX;AAEA,SAAgBkB,mCAAmCF,OAAsB;CACrE,OAAOA,MAAMN,cAAchB;AAC/B"}
+{"version":3,"file":"identity.mjs","names":["IdentityType","UnauthorizedError","sym","Symbol","RequestIdentity","raw","identity","clientId","type","CLIENT","data","id","client_id","realmId","realm_id","realm","realmName","name","useRequestIdentity","event","store","setRequestIdentity","input","useRequestIdentityOrFail"],"sources":["../../../../../src/adapters/http/request/helpers/identity.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Identity } from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { UnauthorizedError } from '@authup/errors';\nimport type { IAppEvent } from 'routup';\n\nconst sym = Symbol('RIdentity');\n\nexport class RequestIdentity {\n    public readonly raw : Identity;\n\n    constructor(identity: Identity) {\n        this.raw = identity;\n    }\n\n    get clientId() {\n        const { raw } = this;\n        if (raw.type === IdentityType.CLIENT) {\n            return raw.data.id;\n        }\n\n        return raw.data.client_id || null;\n    }\n\n    get data() {\n        return this.raw.data;\n    }\n\n    get type() {\n        return this.raw.type;\n    }\n\n    get id() {\n        return this.raw.data.id;\n    }\n\n    get realmId() {\n        return this.raw.data.realm_id || this.raw.data.realm?.id;\n    }\n\n    get realmName() {\n        return this.raw.data.realm?.name;\n    }\n}\n\nexport function useRequestIdentity(event: IAppEvent) : RequestIdentity | undefined {\n    return event.store[sym] as RequestIdentity | undefined;\n}\n\nexport function setRequestIdentity(event: IAppEvent, input: Identity | RequestIdentity) : void {\n    let data : RequestIdentity;\n\n    if (input instanceof RequestIdentity) {\n        data = input;\n    } else {\n        data = new RequestIdentity(input);\n    }\n\n    event.store[sym] = data;\n}\n\nexport function useRequestIdentityOrFail(event: IAppEvent) : RequestIdentity {\n    const identity = useRequestIdentity(event);\n    if (!identity) {\n        throw new UnauthorizedError();\n    }\n\n    return identity;\n}\n"],"mappings":";;;;;;AAYA,MAAME,MAAMC,OAAO,WAAA;AAEnB,IAAaC,kBAAb,MAAaA;CACOC;CAEhB,YAAYC,UAAoB;EAC5B,KAAKD,MAAMC;CACf;CAEA,IAAIC,WAAW;EACX,MAAM,EAAEF,QAAQ;EAChB,IAAIA,IAAIG,SAASR,aAAaS,QAC1B,OAAOJ,IAAIK,KAAKC;EAGpB,OAAON,IAAIK,KAAKE,aAAa;CACjC;CAEA,IAAIF,OAAO;EACP,OAAO,KAAKL,IAAIK;CACpB;CAEA,IAAIF,OAAO;EACP,OAAO,KAAKH,IAAIG;CACpB;CAEA,IAAIG,KAAK;EACL,OAAO,KAAKN,IAAIK,KAAKC;CACzB;CAEA,IAAIE,UAAU;EACV,OAAO,KAAKR,IAAIK,KAAKI,YAAY,KAAKT,IAAIK,KAAKK,OAAOJ;CAC1D;CAEA,IAAIK,YAAY;EACZ,OAAO,KAAKX,IAAIK,KAAKK,OAAOE;CAChC;AACJ;AAEA,SAAgBC,mBAAmBC,OAAgB;CAC/C,OAAOA,MAAMC,MAAMlB;AACvB;AAEA,SAAgBmB,mBAAmBF,OAAkBG,OAAiC;CAClF,IAAIZ;CAEJ,IAAIY,iBAAiBlB,iBACjBM,OAAOY;MAEPZ,OAAO,IAAIN,gBAAgBkB,KAAAA;CAG/BH,MAAMC,MAAMlB,OAAOQ;AACvB;AAEA,SAAgBa,yBAAyBJ,OAAgB;CACrD,MAAMb,WAAWY,mBAAmBC,KAAAA;CACpC,IAAI,CAACb,UACD,MAAM,IAAIL,kBAAAA;CAGd,OAAOK;AACX"}