@authup/server-core 1.0.0-beta.50 → 1.0.0-beta.52

package/dist/core/oauth2/authorization/code-request/validator.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"validator.mjs","names":["OAuth2AuthorizationCodeChallengeMethod","OAuth2AuthorizationResponseType","OAuth2ResponseTypeError","createValidator","Container","z","OAuth2AuthorizationCodeRequestValidator","initialize","mount","string","nonempty","check","ctx","availableResponseTypes","Object","values","responseTypes","value","split","responseType","includes","error","unsupported","issues","push","input","code","message","NEVER","url","min","max","optional","nullable","enum"],"sources":["../../../../../src/core/oauth2/authorization/code-request/validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport {\n    OAuth2AuthorizationCodeChallengeMethod,\n    OAuth2AuthorizationResponseType,\n    OAuth2ResponseTypeError,\n} from '@authup/specs';\n\nimport { createValidator } from '@validup/zod';\nimport { Container } from 'validup';\nimport { z } from 'zod';\n\nexport class OAuth2AuthorizationCodeRequestValidator extends Container<OAuth2AuthorizationCodeRequest> {\n    protected initialize() {\n        super.initialize();\n\n        this.mount(\n            'response_type',\n            createValidator(\n                z\n                    .string()\n                    .nonempty()\n                    .check((ctx) => {\n                        const availableResponseTypes = Object.values(OAuth2AuthorizationResponseType);\n                        const responseTypes = ctx.value.split(' ') as OAuth2AuthorizationResponseType[];\n\n                        for (const responseType of responseTypes) {\n                            if (!availableResponseTypes.includes(responseType)) {\n                                const error = OAuth2ResponseTypeError.unsupported();\n                                ctx.issues.push({\n                                    input: responseType,\n                                    code: 'custom',\n                                    message: error.message,\n                                });\n                            }\n                        }\n\n                        return z.NEVER;\n                    }),\n            ),\n        );\n\n        this.mount(\n            'redirect_uri',\n            createValidator(z.string().url()),\n        );\n\n        this.mount(\n            'scope',\n            createValidator(z.string().min(3).max(512)),\n        );\n\n        this.mount(\n            'state',\n            { optional: true },\n            createValidator(z.string().min(5).max(2048).nullable()),\n        );\n\n        this.mount(\n            'code_challenge',\n            { optional: true },\n            createValidator(z.string().min(1).max(256).nullable()),\n        );\n\n        this.mount(\n            'code_challenge_method',\n            { optional: true },\n            createValidator(z.enum(OAuth2AuthorizationCodeChallengeMethod).nullable()),\n        );\n\n        this.mount(\n            'nonce',\n            { optional: true },\n            createValidator(z.string().min(1).max(512).nullable()),\n        );\n\n        this.mount(\n            'realm_id',\n            { optional: true },\n            createValidator(z.string().nonempty()),\n        );\n\n        this.mount(\n            'client_id',\n            createValidator(z.string().nonempty()),\n        );\n    }\n}\n"],"mappings":";;;;;;;;AAkBA,IAAaM,0CAAb,cAA6DF,UAAAA;CAC/CG,aAAa;EACnB,MAAMA,WAAAA;EAEN,KAAKC,MACD,iBACAL,gBACIE,EACKI,OAAM,CAAA,CACNC,SAAQ,CAAA,CACRC,OAAOC,QAAAA;GACJ,MAAMC,yBAAyBC,OAAOC,OAAOd,+BAAAA;GAC7C,MAAMe,gBAAgBJ,IAAIK,MAAMC,MAAM,GAAA;GAEtC,KAAK,MAAMC,gBAAgBH,eACvB,IAAI,CAACH,uBAAuBO,SAASD,YAAAA,GAAe;IAChD,MAAME,QAAQnB,wBAAwBoB,YAAW;IACjDV,IAAIW,OAAOC,KAAK;KACZC,OAAON;KACPO,MAAM;KACNC,SAASN,MAAMM;IACnB,CAAA;GACJ;GAGJ,OAAOtB,EAAEuB;EACb,CAAA,CAAA,CAAA;EAIZ,KAAKpB,MACD,gBACAL,gBAAgBE,EAAEI,OAAM,CAAA,CAAGoB,IAAG,CAAA,CAAA;EAGlC,KAAKrB,MACD,SACAL,gBAAgBE,EAAEI,OAAM,CAAA,CAAGqB,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA,CAAA;EAG1C,KAAKvB,MACD,SACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAEI,OAAM,CAAA,CAAGqB,IAAI,CAAA,CAAA,CAAGC,IAAI,IAAA,CAAA,CAAME,SAAQ,CAAA,CAAA;EAGxD,KAAKzB,MACD,kBACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAEI,OAAM,CAAA,CAAGqB,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA,CAAKE,SAAQ,CAAA,CAAA;EAGvD,KAAKzB,MACD,yBACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAE6B,KAAKlC,sCAAAA,CAAAA,CAAwCiC,SAAQ,CAAA,CAAA;EAG3E,KAAKzB,MACD,SACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAEI,OAAM,CAAA,CAAGqB,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA,CAAKE,SAAQ,CAAA,CAAA;EAGvD,KAAKzB,MACD,YACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAEI,OAAM,CAAA,CAAGC,SAAQ,CAAA,CAAA;EAGvC,KAAKF,MACD,aACAL,gBAAgBE,EAAEI,OAAM,CAAA,CAAGC,SAAQ,CAAA,CAAA;CAE3C;AACJ"}
+{"version":3,"file":"validator.mjs","names":["OAuth2AuthorizationCodeChallengeMethod","OAuth2AuthorizationPrompt","OAuth2AuthorizationResponseType","OAuth2RequestError","OAuth2ResponseTypeError","createValidator","Container","z","OAuth2AuthorizationCodeRequestValidator","initialize","mount","string","nonempty","check","ctx","responseTypes","value","split","filter","Boolean","invalid","length","CODE","error","unsupported","issues","push","input","code","message","NEVER","url","min","max","optional","nullable","enum","values","includes","NONE","malformed","preprocess","trim","undefined","coerce","number","int","toLowerCase"],"sources":["../../../../../src/core/oauth2/authorization/code-request/validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport {\n    OAuth2AuthorizationCodeChallengeMethod,\n    OAuth2AuthorizationPrompt,\n    OAuth2AuthorizationResponseType,\n    OAuth2RequestError,\n    OAuth2ResponseTypeError,\n} from '@authup/specs';\n\nimport { createValidator } from '@validup/zod';\nimport { Container } from 'validup';\nimport { z } from 'zod';\n\nexport class OAuth2AuthorizationCodeRequestValidator extends Container<OAuth2AuthorizationCodeRequest> {\n    protected initialize() {\n        super.initialize();\n\n        this.mount(\n            'response_type',\n            createValidator(\n                z\n                    .string()\n                    .nonempty()\n                    .check((ctx) => {\n                        // OAuth 2.1 posture: the authorization endpoint issues\n                        // codes only — the implicit/hybrid response types\n                        // (token, id_token, none) are not supported.\n                        const responseTypes = ctx.value.split(' ').filter(Boolean);\n\n                        const invalid = responseTypes.length !== 1 ||\n                            responseTypes[0] !== OAuth2AuthorizationResponseType.CODE;\n\n                        if (invalid) {\n                            const error = OAuth2ResponseTypeError.unsupported();\n                            ctx.issues.push({\n                                input: ctx.value,\n                                code: 'custom',\n                                message: error.message,\n                            });\n                        }\n\n                        return z.NEVER;\n                    }),\n            ),\n        );\n\n        this.mount(\n            'redirect_uri',\n            createValidator(z.string().url()),\n        );\n\n        this.mount(\n            'scope',\n            createValidator(z.string().min(3).max(512)),\n        );\n\n        this.mount(\n            'state',\n            { optional: true },\n            createValidator(z.string().min(5).max(2048).nullable()),\n        );\n\n        this.mount(\n            'code_challenge',\n            { optional: true },\n            createValidator(z.string().min(1).max(256).nullable()),\n        );\n\n        this.mount(\n            'code_challenge_method',\n            { optional: true },\n            createValidator(z.enum(OAuth2AuthorizationCodeChallengeMethod).nullable()),\n        );\n\n        this.mount(\n            'nonce',\n            { optional: true },\n            createValidator(z.string().min(1).max(512).nullable()),\n        );\n\n        this.mount(\n            'prompt',\n            { optional: true },\n            createValidator(\n                z\n                    .string()\n                    .min(1)\n                    .max(128)\n                    .nullable()\n                    .check((ctx) => {\n                        if (!ctx.value) {\n                            return z.NEVER;\n                        }\n\n                        // Unknown tokens are ignored (forward-compat). Only the\n                        // OIDC §3.1.2.1 rule \"none must not be combined\" is enforced.\n                        const values = ctx.value.split(' ').filter(Boolean);\n                        if (\n                            values.includes(OAuth2AuthorizationPrompt.NONE) &&\n                            values.length > 1\n                        ) {\n                            const error = OAuth2RequestError.malformed(\n                                'prompt=none must not be combined with other prompt values.',\n                            );\n                            ctx.issues.push({\n                                input: ctx.value,\n                                code: 'custom',\n                                message: error.message,\n                            });\n                        }\n\n                        return z.NEVER;\n                    }),\n            ),\n        );\n\n        this.mount(\n            'max_age',\n            { optional: true },\n            createValidator(\n                z.preprocess(\n                    // An empty / blank max_age (e.g. a stray `?max_age=` from an\n                    // RP template) is absent, not `max_age=0` — without this\n                    // z.coerce.number('') === 0 would silently force\n                    // re-authentication on every request for that RP.\n                    (value) => (typeof value === 'string' && value.trim() === '' ? undefined : value),\n                    z.coerce.number().int().min(0).nullable().optional(),\n                ),\n            ),\n        );\n\n        this.mount(\n            'login_hint',\n            { optional: true },\n            createValidator(z.string().trim().toLowerCase().min(1).max(256).nullable()),\n        );\n\n        this.mount(\n            'realm_id',\n            { optional: true },\n            createValidator(z.string().nonempty()),\n        );\n\n        this.mount(\n            'client_id',\n            createValidator(z.string().nonempty()),\n        );\n    }\n}\n"],"mappings":";;;;;;;;AAoBA,IAAaQ,0CAAb,cAA6DF,UAAAA;CAC/CG,aAAa;EACnB,MAAMA,WAAAA;EAEN,KAAKC,MACD,iBACAL,gBACIE,EACKI,OAAM,CAAA,CACNC,SAAQ,CAAA,CACRC,OAAOC,QAAAA;GAIJ,MAAMC,gBAAgBD,IAAIE,MAAMC,MAAM,GAAA,CAAA,CAAKC,OAAOC,OAAAA;GAKlD,IAHgBJ,cAAcM,WAAW,KACrCN,cAAc,OAAOb,gCAAgCoB,MAE5C;IACT,MAAMC,QAAQnB,wBAAwBoB,YAAW;IACjDV,IAAIW,OAAOC,KAAK;KACZC,OAAOb,IAAIE;KACXY,MAAM;KACNC,SAASN,MAAMM;IACnB,CAAA;GACJ;GAEA,OAAOtB,EAAEuB;EACb,CAAA,CAAA,CAAA;EAIZ,KAAKpB,MACD,gBACAL,gBAAgBE,EAAEI,OAAM,CAAA,CAAGoB,IAAG,CAAA,CAAA;EAGlC,KAAKrB,MACD,SACAL,gBAAgBE,EAAEI,OAAM,CAAA,CAAGqB,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA,CAAA;EAG1C,KAAKvB,MACD,SACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAEI,OAAM,CAAA,CAAGqB,IAAI,CAAA,CAAA,CAAGC,IAAI,IAAA,CAAA,CAAME,SAAQ,CAAA,CAAA;EAGxD,KAAKzB,MACD,kBACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAEI,OAAM,CAAA,CAAGqB,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA,CAAKE,SAAQ,CAAA,CAAA;EAGvD,KAAKzB,MACD,yBACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAE6B,KAAKpC,sCAAAA,CAAAA,CAAwCmC,SAAQ,CAAA,CAAA;EAG3E,KAAKzB,MACD,SACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAEI,OAAM,CAAA,CAAGqB,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA,CAAKE,SAAQ,CAAA,CAAA;EAGvD,KAAKzB,MACD,UACA,EAAEwB,UAAU,KAAK,GACjB7B,gBACIE,EACKI,OAAM,CAAA,CACNqB,IAAI,CAAA,CAAA,CACJC,IAAI,GAAA,CAAA,CACJE,SAAQ,CAAA,CACRtB,OAAOC,QAAAA;GACJ,IAAI,CAACA,IAAIE,OACL,OAAOT,EAAEuB;GAKb,MAAMO,SAASvB,IAAIE,MAAMC,MAAM,GAAA,CAAA,CAAKC,OAAOC,OAAAA;GAC3C,IACIkB,OAAOC,SAASrC,0BAA0BsC,IAAI,KAC9CF,OAAOhB,SAAS,GAClB;IACE,MAAME,QAAQpB,mBAAmBqC,UAC7B,4DAAA;IAEJ1B,IAAIW,OAAOC,KAAK;KACZC,OAAOb,IAAIE;KACXY,MAAM;KACNC,SAASN,MAAMM;IACnB,CAAA;GACJ;GAEA,OAAOtB,EAAEuB;EACb,CAAA,CAAA,CAAA;EAIZ,KAAKpB,MACD,WACA,EAAEwB,UAAU,KAAK,GACjB7B,gBACIE,EAAEkC,YAKGzB,UAAW,OAAOA,UAAU,YAAYA,MAAM0B,KAAI,MAAO,KAAKC,KAAAA,IAAY3B,OAC3ET,EAAEqC,OAAOC,OAAM,CAAA,CAAGC,IAAG,CAAA,CAAGd,IAAI,CAAA,CAAA,CAAGG,SAAQ,CAAA,CAAGD,SAAQ,CAAA,CAAA,CAAA;EAK9D,KAAKxB,MACD,cACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAEI,OAAM,CAAA,CAAG+B,KAAI,CAAA,CAAGK,YAAW,CAAA,CAAGf,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA,CAAKE,SAAQ,CAAA,CAAA;EAG5E,KAAKzB,MACD,YACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAEI,OAAM,CAAA,CAAGC,SAAQ,CAAA,CAAA;EAGvC,KAAKF,MACD,aACAL,gBAAgBE,EAAEI,OAAM,CAAA,CAAGC,SAAQ,CAAA,CAAA;CAE3C;AACJ"}

package/dist/core/oauth2/authorization/code-request/verifier/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code-request/verifier/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAWvE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,KAAK,EACR,uCAAuC,EACvC,gDAAgD,EAChD,6CAA6C,EAChD,MAAM,YAAY,CAAC;AASpB,qBAAa,sCAAuC,YAAW,uCAAuC;IAClG,SAAS,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;IAEpD,SAAS,CAAC,eAAe,EAAE,sBAAsB,CAAC;gBAEtC,GAAG,EAAE,6CAA6C;IAK9D;;;OAGG;IACG,MAAM,CACR,IAAI,EAAE,8BAA8B,GACpC,OAAO,CAAC,gDAAgD,CAAC;CA6DhE"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code-request/verifier/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAWvE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAExE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,KAAK,EACR,uCAAuC,EACvC,gDAAgD,EAChD,6CAA6C,EAChD,MAAM,YAAY,CAAC;AAEpB,qBAAa,sCAAuC,YAAW,uCAAuC;IAClG,SAAS,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;IAEpD,SAAS,CAAC,eAAe,EAAE,sBAAsB,CAAC;gBAEtC,GAAG,EAAE,6CAA6C;IAK9D;;;OAGG;IACG,MAAM,CACR,IAAI,EAAE,8BAA8B,GACpC,OAAO,CAAC,gDAAgD,CAAC;CAsFhE"}

package/dist/core/oauth2/authorization/code-request/verifier/module.mjs

@@ -1,14 +1,12 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { isSimpleMatch } from "@authup/kit";
+import { assertClientGrantAllowed } from "../../../client/grant-type.mjs";
+import "../../../client/index.mjs";
+import { isSimpleMatch, isUUID } from "@authup/kit";
 import { ScopeName } from "@authup/core-kit";
-import { OAuth2AuthorizationResponseType, OAuth2ClientError, OAuth2GrantError, OAuth2RequestError, OAuth2ScopeError, hasOAuth2Scopes } from "@authup/specs";
+import { OAuth2ClientError, OAuth2GrantError, OAuth2RequestError, OAuth2ScopeError, OAuth2TokenGrant, hasOAuth2Scopes } from "@authup/specs";
 //#region src/core/oauth2/authorization/code-request/verifier/module.ts
-function willIssueCode(responseType) {
-	if (!responseType) return false;
-	return responseType.split(" ").includes(OAuth2AuthorizationResponseType.CODE);
-}
 var OAuth2AuthorizationCodeRequestVerifier = class {
 	clientRepository;
 	scopeRepository;
@@ -21,11 +19,14 @@ var OAuth2AuthorizationCodeRequestVerifier = class {
 	* @param data
 	*/ async verify(data) {
 		if (!data.client_id) throw OAuth2ClientError.invalid();
+		if (!isUUID(data.client_id) && !data.realm_id) throw OAuth2RequestError.malformed("A realm is required to resolve a client by name.");
 		const client = await this.clientRepository.findOneByIdOrName(data.client_id, data.realm_id);
 		if (!client) throw OAuth2ClientError.invalid();
 		if (!client.active) throw OAuth2ClientError.inactive();
-		if (!client.is_confidential && !data.code_challenge && willIssueCode(data.response_type)) throw OAuth2RequestError.malformed("PKCE code_challenge is required for public clients.");
-		if (!client.is_confidential && !data.state && willIssueCode(data.response_type)) throw OAuth2RequestError.malformed("state is required for public clients in the code flow.");
+		assertClientGrantAllowed(client, OAuth2TokenGrant.AUTHORIZATION_CODE);
+		if (!client.redirect_uri) throw OAuth2GrantError.redirectUriMismatch();
+		if (!client.is_confidential && !data.code_challenge) throw OAuth2RequestError.malformed("PKCE code_challenge is required for public clients.");
+		if (!client.is_confidential && !data.state) throw OAuth2RequestError.malformed("state is required for public clients in the code flow.");
 		data.client_id = client.id;
 		data.realm_id = client.realm_id;
 		const scopes = await this.scopeRepository.findByClientId(client.id);
@@ -33,14 +34,16 @@ var OAuth2AuthorizationCodeRequestVerifier = class {
 		if (data.scope) {
 			if (!hasOAuth2Scopes(scopeNames, data.scope) && !hasOAuth2Scopes(data.scope, ScopeName.GLOBAL)) throw OAuth2ScopeError.insufficient();
 		} else data.scope = scopeNames.join(" ");
-		if (client.redirect_uri && data.redirect_uri) {
+		const redirectUriVerified = !!data.redirect_uri;
+		if (data.redirect_uri) {
 			const redirectUris = client.redirect_uri.split(",");
 			if (!isSimpleMatch(data.redirect_uri, redirectUris)) throw OAuth2GrantError.redirectUriMismatch();
 		}
 		return {
 			data,
 			client,
-			scopes
+			scopes,
+			redirectUriVerified
 		};
 	}
 };

package/dist/core/oauth2/authorization/code-request/verifier/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["ScopeName","isSimpleMatch","OAuth2AuthorizationResponseType","OAuth2ClientError","OAuth2GrantError","OAuth2RequestError","OAuth2ScopeError","hasOAuth2Scopes","willIssueCode","responseType","split","includes","CODE","OAuth2AuthorizationCodeRequestVerifier","clientRepository","scopeRepository","ctx","verify","data","client_id","invalid","client","findOneByIdOrName","realm_id","active","inactive","is_confidential","code_challenge","response_type","malformed","state","id","scopes","findByClientId","scopeNames","map","scope","name","GLOBAL","insufficient","join","redirect_uri","redirectUris","redirectUriMismatch"],"sources":["../../../../../../src/core/oauth2/authorization/code-request/verifier/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport { isSimpleMatch } from '@authup/kit';\nimport {\n    OAuth2AuthorizationResponseType,\n    OAuth2ClientError,\n    OAuth2GrantError,\n    OAuth2RequestError,\n    OAuth2ScopeError,\n    hasOAuth2Scopes,\n} from '@authup/specs';\nimport type { IOAuth2ClientRepository } from '../../../client/index.ts';\nimport type { IOAuth2ScopeRepository } from '../../../scope/index.ts';\nimport type {\n    IOAuth2AuthorizationCodeRequestVerifier,\n    OAuth2AuthorizationCodeRequestVerificationResult,\n    OAuth2AuthorizationCodeRequestVerifierContext,\n} from './types.ts';\n\nfunction willIssueCode(responseType: string | undefined): boolean {\n    if (!responseType) {\n        return false;\n    }\n    return responseType.split(' ').includes(OAuth2AuthorizationResponseType.CODE);\n}\n\nexport class OAuth2AuthorizationCodeRequestVerifier implements IOAuth2AuthorizationCodeRequestVerifier {\n    protected clientRepository: IOAuth2ClientRepository;\n\n    protected scopeRepository: IOAuth2ScopeRepository;\n\n    constructor(ctx: OAuth2AuthorizationCodeRequestVerifierContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.scopeRepository = ctx.scopeRepository;\n    }\n\n    /**\n     * Verify validated authorization code request.\n     * @param data\n     */\n    async verify(\n        data: OAuth2AuthorizationCodeRequest,\n    ) : Promise<OAuth2AuthorizationCodeRequestVerificationResult> {\n        if (!data.client_id) {\n            throw OAuth2ClientError.invalid();\n        }\n\n        const client = await this.clientRepository.findOneByIdOrName(data.client_id, data.realm_id);\n        if (!client) {\n            throw OAuth2ClientError.invalid();\n        }\n\n        if (!client.active) {\n            throw OAuth2ClientError.inactive();\n        }\n\n        // Public clients MUST use PKCE for the code flow (RFC 7636 §4.4.1,\n        // OAuth 2.1). Without PKCE a public client's code flow has no second\n        // factor — anyone who intercepts the redirect can redeem the code at\n        // /token. Only enforce when an authorization code will actually be\n        // issued; implicit/id_token-only flows don't involve a code.\n        if (!client.is_confidential && !data.code_challenge && willIssueCode(data.response_type)) {\n            throw OAuth2RequestError.malformed('PKCE code_challenge is required for public clients.');\n        }\n\n        // Public clients SHOULD include state to bind the redirect to the\n        // initiating session and prevent CSRF (RFC 6749 §10.12). Confidential\n        // clients are exempt because the /token exchange already authenticates\n        // them via client_secret.\n        if (!client.is_confidential && !data.state && willIssueCode(data.response_type)) {\n            throw OAuth2RequestError.malformed('state is required for public clients in the code flow.');\n        }\n\n        data.client_id = client.id;\n        data.realm_id = client.realm_id;\n\n        const scopes = await this.scopeRepository.findByClientId(client.id);\n        const scopeNames = scopes.map((scope) => scope.name);\n        if (data.scope) {\n            if (\n                !hasOAuth2Scopes(scopeNames, data.scope) &&\n                !hasOAuth2Scopes(data.scope, ScopeName.GLOBAL)\n            ) {\n                throw OAuth2ScopeError.insufficient();\n            }\n        } else {\n            data.scope = scopeNames.join(' ');\n        }\n\n        if (client.redirect_uri && data.redirect_uri) {\n            const redirectUris = client.redirect_uri.split(',');\n\n            if (!isSimpleMatch(data.redirect_uri, redirectUris)) {\n                throw OAuth2GrantError.redirectUriMismatch();\n            }\n        }\n\n        return {\n            data,\n            client,\n            scopes,\n        };\n    }\n}\n"],"mappings":";;;;;;;AA0BA,SAASQ,cAAcC,cAAgC;CACnD,IAAI,CAACA,cACD,OAAO;CAEX,OAAOA,aAAaC,MAAM,GAAA,CAAA,CAAKC,SAAST,gCAAgCU,IAAI;AAChF;AAEA,IAAaC,yCAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAoD;EAC5D,KAAKF,mBAAmBE,IAAIF;EAC5B,KAAKC,kBAAkBC,IAAID;CAC/B;;;;IAMA,MAAME,OACFC,MAC0D;EAC1D,IAAI,CAACA,KAAKC,WACN,MAAMhB,kBAAkBiB,QAAO;EAGnC,MAAMC,SAAS,MAAM,KAAKP,iBAAiBQ,kBAAkBJ,KAAKC,WAAWD,KAAKK,QAAQ;EAC1F,IAAI,CAACF,QACD,MAAMlB,kBAAkBiB,QAAO;EAGnC,IAAI,CAACC,OAAOG,QACR,MAAMrB,kBAAkBsB,SAAQ;EAQpC,IAAI,CAACJ,OAAOK,mBAAmB,CAACR,KAAKS,kBAAkBnB,cAAcU,KAAKU,aAAa,GACnF,MAAMvB,mBAAmBwB,UAAU,qDAAA;EAOvC,IAAI,CAACR,OAAOK,mBAAmB,CAACR,KAAKY,SAAStB,cAAcU,KAAKU,aAAa,GAC1E,MAAMvB,mBAAmBwB,UAAU,wDAAA;EAGvCX,KAAKC,YAAYE,OAAOU;EACxBb,KAAKK,WAAWF,OAAOE;EAEvB,MAAMS,SAAS,MAAM,KAAKjB,gBAAgBkB,eAAeZ,OAAOU,EAAE;EAClE,MAAMG,aAAaF,OAAOG,KAAKC,UAAUA,MAAMC,IAAI;EACnD,IAAInB,KAAKkB;OAED,CAAC7B,gBAAgB2B,YAAYhB,KAAKkB,KAAK,KACvC,CAAC7B,gBAAgBW,KAAKkB,OAAOpC,UAAUsC,MAAM,GAE7C,MAAMhC,iBAAiBiC,aAAY;EAAA,OAGvCrB,KAAKkB,QAAQF,WAAWM,KAAK,GAAA;EAGjC,IAAInB,OAAOoB,gBAAgBvB,KAAKuB,cAAc;GAC1C,MAAMC,eAAerB,OAAOoB,aAAa/B,MAAM,GAAA;GAE/C,IAAI,CAACT,cAAciB,KAAKuB,cAAcC,YAAAA,GAClC,MAAMtC,iBAAiBuC,oBAAmB;EAElD;EAEA,OAAO;GACHzB;GACAG;GACAW;EACJ;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["ScopeName","isSimpleMatch","isUUID","OAuth2ClientError","OAuth2GrantError","OAuth2RequestError","OAuth2ScopeError","OAuth2TokenGrant","hasOAuth2Scopes","assertClientGrantAllowed","OAuth2AuthorizationCodeRequestVerifier","clientRepository","scopeRepository","ctx","verify","data","client_id","invalid","realm_id","malformed","client","findOneByIdOrName","active","inactive","AUTHORIZATION_CODE","redirect_uri","redirectUriMismatch","is_confidential","code_challenge","state","id","scopes","findByClientId","scopeNames","map","scope","name","GLOBAL","insufficient","join","redirectUriVerified","redirectUris","split"],"sources":["../../../../../../src/core/oauth2/authorization/code-request/verifier/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport { isSimpleMatch, isUUID } from '@authup/kit';\nimport {\n    OAuth2ClientError,\n    OAuth2GrantError,\n    OAuth2RequestError,\n    OAuth2ScopeError,\n    OAuth2TokenGrant,\n    hasOAuth2Scopes,\n} from '@authup/specs';\nimport type { IOAuth2ClientRepository } from '../../../client/index.ts';\nimport { assertClientGrantAllowed } from '../../../client/index.ts';\nimport type { IOAuth2ScopeRepository } from '../../../scope/index.ts';\nimport type {\n    IOAuth2AuthorizationCodeRequestVerifier,\n    OAuth2AuthorizationCodeRequestVerificationResult,\n    OAuth2AuthorizationCodeRequestVerifierContext,\n} from './types.ts';\n\nexport class OAuth2AuthorizationCodeRequestVerifier implements IOAuth2AuthorizationCodeRequestVerifier {\n    protected clientRepository: IOAuth2ClientRepository;\n\n    protected scopeRepository: IOAuth2ScopeRepository;\n\n    constructor(ctx: OAuth2AuthorizationCodeRequestVerifierContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.scopeRepository = ctx.scopeRepository;\n    }\n\n    /**\n     * Verify validated authorization code request.\n     * @param data\n     */\n    async verify(\n        data: OAuth2AuthorizationCodeRequest,\n    ) : Promise<OAuth2AuthorizationCodeRequestVerificationResult> {\n        if (!data.client_id) {\n            throw OAuth2ClientError.invalid();\n        }\n\n        // A name-identified client needs a realm hint to resolve deterministically\n        // — every realm has a built-in `web` client, so `client_id=web` without a\n        // realm would bind to an arbitrary realm's client (and, post realm-gate,\n        // produce a confusing mismatch against a random realm). Require the hint.\n        if (!isUUID(data.client_id) && !data.realm_id) {\n            throw OAuth2RequestError.malformed('A realm is required to resolve a client by name.');\n        }\n\n        const client = await this.clientRepository.findOneByIdOrName(data.client_id, data.realm_id);\n        if (!client) {\n            throw OAuth2ClientError.invalid();\n        }\n\n        if (!client.active) {\n            throw OAuth2ClientError.inactive();\n        }\n\n        // A non-null grant_types allowlist must cover the code flow — an RP\n        // misconfiguration fails at the front door, not at code redemption.\n        assertClientGrantAllowed(client, OAuth2TokenGrant.AUTHORIZATION_CODE);\n\n        // OAuth 2.1 posture: a client with no registered redirect_uri pattern\n        // can never be matched — reject outright instead of trusting whatever\n        // redirect_uri the request carries (the server would otherwise issue a\n        // code to an attacker-supplied URI).\n        if (!client.redirect_uri) {\n            throw OAuth2GrantError.redirectUriMismatch();\n        }\n\n        // Public clients MUST use PKCE (RFC 7636 §4.4.1, OAuth 2.1). Without\n        // PKCE a public client's code flow has no second factor — anyone who\n        // intercepts the redirect can redeem the code at /token. The code flow\n        // is the only supported response type, so this holds unconditionally.\n        if (!client.is_confidential && !data.code_challenge) {\n            throw OAuth2RequestError.malformed('PKCE code_challenge is required for public clients.');\n        }\n\n        // Public clients SHOULD include state to bind the redirect to the\n        // initiating session and prevent CSRF (RFC 6749 §10.12). Confidential\n        // clients are exempt because the /token exchange already authenticates\n        // them via client_secret.\n        if (!client.is_confidential && !data.state) {\n            throw OAuth2RequestError.malformed('state is required for public clients in the code flow.');\n        }\n\n        data.client_id = client.id;\n        data.realm_id = client.realm_id;\n\n        const scopes = await this.scopeRepository.findByClientId(client.id);\n        const scopeNames = scopes.map((scope) => scope.name);\n        if (data.scope) {\n            if (\n                !hasOAuth2Scopes(scopeNames, data.scope) &&\n                !hasOAuth2Scopes(data.scope, ScopeName.GLOBAL)\n            ) {\n                throw OAuth2ScopeError.insufficient();\n            }\n        } else {\n            data.scope = scopeNames.join(' ');\n        }\n\n        // Verified only when the request's redirect_uri matched a registered\n        // pattern (pattern-less clients were rejected above). A request without\n        // a redirect_uri (e.g. the GET page render) stays unverified so\n        // consumers never auto-redirect without a match.\n        const redirectUriVerified = !!data.redirect_uri;\n        if (data.redirect_uri) {\n            const redirectUris = client.redirect_uri.split(',');\n\n            if (!isSimpleMatch(data.redirect_uri, redirectUris)) {\n                throw OAuth2GrantError.redirectUriMismatch();\n            }\n        }\n\n        return {\n            data,\n            client,\n            scopes,\n            redirectUriVerified,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;AA2BA,IAAaU,yCAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAoD;EAC5D,KAAKF,mBAAmBE,IAAIF;EAC5B,KAAKC,kBAAkBC,IAAID;CAC/B;;;;IAMA,MAAME,OACFC,MAC0D;EAC1D,IAAI,CAACA,KAAKC,WACN,MAAMb,kBAAkBc,QAAO;EAOnC,IAAI,CAACf,OAAOa,KAAKC,SAAS,KAAK,CAACD,KAAKG,UACjC,MAAMb,mBAAmBc,UAAU,kDAAA;EAGvC,MAAMC,SAAS,MAAM,KAAKT,iBAAiBU,kBAAkBN,KAAKC,WAAWD,KAAKG,QAAQ;EAC1F,IAAI,CAACE,QACD,MAAMjB,kBAAkBc,QAAO;EAGnC,IAAI,CAACG,OAAOE,QACR,MAAMnB,kBAAkBoB,SAAQ;EAKpCd,yBAAyBW,QAAQb,iBAAiBiB,kBAAkB;EAMpE,IAAI,CAACJ,OAAOK,cACR,MAAMrB,iBAAiBsB,oBAAmB;EAO9C,IAAI,CAACN,OAAOO,mBAAmB,CAACZ,KAAKa,gBACjC,MAAMvB,mBAAmBc,UAAU,qDAAA;EAOvC,IAAI,CAACC,OAAOO,mBAAmB,CAACZ,KAAKc,OACjC,MAAMxB,mBAAmBc,UAAU,wDAAA;EAGvCJ,KAAKC,YAAYI,OAAOU;EACxBf,KAAKG,WAAWE,OAAOF;EAEvB,MAAMa,SAAS,MAAM,KAAKnB,gBAAgBoB,eAAeZ,OAAOU,EAAE;EAClE,MAAMG,aAAaF,OAAOG,KAAKC,UAAUA,MAAMC,IAAI;EACnD,IAAIrB,KAAKoB;OAED,CAAC3B,gBAAgByB,YAAYlB,KAAKoB,KAAK,KACvC,CAAC3B,gBAAgBO,KAAKoB,OAAOnC,UAAUqC,MAAM,GAE7C,MAAM/B,iBAAiBgC,aAAY;EAAA,OAGvCvB,KAAKoB,QAAQF,WAAWM,KAAK,GAAA;EAOjC,MAAMC,sBAAsB,CAAC,CAACzB,KAAKU;EACnC,IAAIV,KAAKU,cAAc;GACnB,MAAMgB,eAAerB,OAAOK,aAAaiB,MAAM,GAAA;GAE/C,IAAI,CAACzC,cAAcc,KAAKU,cAAcgB,YAAAA,GAClC,MAAMrC,iBAAiBsB,oBAAmB;EAElD;EAEA,OAAO;GACHX;GACAK;GACAW;GACAS;EACJ;CACJ;AACJ"}

package/dist/core/oauth2/authorization/code-request/verifier/types.d.ts

@@ -9,6 +9,13 @@ export type OAuth2AuthorizationCodeRequestVerificationResult = {
     data: OAuth2AuthorizationCodeRequest;
     client: Client;
     scopes: Scope[];
+    /**
+     * True when the request `redirect_uri` was matched against a registered,
+     * non-null client pattern. A pattern-less (null `redirect_uri`) client lets
+     * any supplied `redirect_uri` through unverified — consumers must NOT
+     * automatically redirect to it (open-redirect guard).
+     */
+    redirectUriVerified: boolean;
 };
 export interface IOAuth2AuthorizationCodeRequestVerifier {
     verify(data: OAuth2AuthorizationCodeRequest): Promise<OAuth2AuthorizationCodeRequestVerificationResult>;

package/dist/core/oauth2/authorization/code-request/verifier/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code-request/verifier/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACtF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEtE,MAAM,MAAM,6CAA6C,GAAG;IACxD,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,eAAe,EAAE,sBAAsB,CAAA;CAC1C,CAAC;AAEF,MAAM,MAAM,gDAAgD,GAAG;IAC3D,IAAI,EAAE,8BAA8B,CAAC;IAErC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,KAAK,EAAE,CAAA;CAClB,CAAC;AAEF,MAAM,WAAW,uCAAuC;IACpD,MAAM,CACF,IAAI,EAAE,8BAA8B,GACpC,OAAO,CAAC,gDAAgD,CAAC,CAAC;CACjE"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code-request/verifier/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACtF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEtE,MAAM,MAAM,6CAA6C,GAAG;IACxD,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,eAAe,EAAE,sBAAsB,CAAA;CAC1C,CAAC;AAEF,MAAM,MAAM,gDAAgD,GAAG;IAC3D,IAAI,EAAE,8BAA8B,CAAC;IAErC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,KAAK,EAAE,CAAC;IAEhB;;;;;OAKG;IACH,mBAAmB,EAAE,OAAO,CAAA;CAC/B,CAAC;AAEF,MAAM,WAAW,uCAAuC;IACpD,MAAM,CACF,IAAI,EAAE,8BAA8B,GACpC,OAAO,CAAC,gDAAgD,CAAC,CAAC;CACjE"}

package/dist/core/oauth2/authorization/helpers.d.ts

@@ -1,5 +1,6 @@
+import type { JWTAlgorithm } from '@authup/specs';
 export declare function generateOAuth2CodeVerifier(): string;
 export declare function base64URLEncode(arrayBuffer: ArrayBuffer): string;
-export declare function buildOAuth2TokenHash(value: string): Promise<string>;
+export declare function buildOAuth2TokenHash(value: string, alg?: `${JWTAlgorithm}` | null): Promise<string>;
 export declare function buildOAuth2CodeChallenge(codeVerifier: string): Promise<string>;
 //# sourceMappingURL=helpers.d.ts.map

package/dist/core/oauth2/authorization/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/authorization/helpers.ts"],"names":[],"mappings":"AASA,wBAAgB,0BAA0B,WAazC;AAED,wBAAgB,eAAe,CAAC,WAAW,EAAE,WAAW,UAWvD;AAED,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAI,OAAO,CAAC,MAAM,CAAC,CAO1E;AAED,wBAAsB,wBAAwB,CAAC,YAAY,EAAE,MAAM,mBAMlE"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/authorization/helpers.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAIlD,wBAAgB,0BAA0B,WAazC;AAED,wBAAgB,eAAe,CAAC,WAAW,EAAE,WAAW,UAWvD;AAWD,wBAAsB,oBAAoB,CACtC,KAAK,EAAE,MAAM,EACb,GAAG,CAAC,EAAE,GAAG,YAAY,EAAE,GAAG,IAAI,GAC9B,OAAO,CAAC,MAAM,CAAC,CAkBlB;AAED,wBAAsB,wBAAwB,CAAC,YAAY,EAAE,MAAM,mBAMlE"}

package/dist/core/oauth2/authorization/helpers.mjs

@@ -1,6 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { JWTError } from "@authup/specs";
 import { subtle } from "uncrypto";
 //#region src/core/oauth2/authorization/helpers.ts
 function generateOAuth2CodeVerifier() {
@@ -16,9 +17,25 @@ function base64URLEncode(arrayBuffer) {
 	const charCode = Array.from(new Uint8Array(arrayBuffer));
 	return btoa(String.fromCharCode.apply(null, charCode)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
-async function buildOAuth2TokenHash(value) {
+const TOKEN_HASH_DIGESTS = {
+	256: {
+		name: "SHA-256",
+		halfLength: 16
+	},
+	384: {
+		name: "SHA-384",
+		halfLength: 24
+	},
+	512: {
+		name: "SHA-512",
+		halfLength: 32
+	}
+};
+async function buildOAuth2TokenHash(value, alg) {
+	const digest = alg ? TOKEN_HASH_DIGESTS[alg.slice(-3)] : TOKEN_HASH_DIGESTS["256"];
+	if (!digest) throw JWTError.headerPropertyInvalid("alg");
 	const data = new TextEncoder().encode(value);
-	return base64URLEncode((await subtle.digest("SHA-256", data)).slice(0, 16));
+	return base64URLEncode((await subtle.digest(digest.name, data)).slice(0, digest.halfLength));
 }
 async function buildOAuth2CodeChallenge(codeVerifier) {
 	const data = new TextEncoder().encode(codeVerifier);

package/dist/core/oauth2/authorization/helpers.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.mjs","names":["subtle","generateOAuth2CodeVerifier","length","charset","codeVerifier","randomValues","Uint8Array","crypto","getRandomValues","i","base64URLEncode","arrayBuffer","charCode","Array","from","btoa","String","fromCharCode","apply","replace","buildOAuth2TokenHash","value","encoder","TextEncoder","data","encode","hashBuffer","digest","halfHash","slice","buildOAuth2CodeChallenge"],"sources":["../../../../src/core/oauth2/authorization/helpers.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { subtle } from 'uncrypto';\n\nexport function generateOAuth2CodeVerifier() {\n    const length = 64;\n    const charset = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';\n\n    let codeVerifier = '';\n    const randomValues = new Uint8Array(length);\n    crypto.getRandomValues(randomValues);\n\n    for (let i = 0; i < length; i++) {\n        codeVerifier += charset[randomValues[i] % charset.length];\n    }\n\n    return codeVerifier;\n}\n\nexport function base64URLEncode(arrayBuffer: ArrayBuffer) {\n    // Convert the ArrayBuffer to string using Uint8 array.\n    // btoa takes chars from 0-255 and base64 encodes.\n    // Then convert the base64 encoded to base64url encoded.\n    // (replace + with -, replace / with _, trim trailing =)\n    const charCode = Array.from(new Uint8Array(arrayBuffer));\n\n    return btoa(String.fromCharCode.apply(null, charCode))\n        .replace(/\\+/g, '-')\n        .replace(/\\//g, '_')\n        .replace(/=+$/, '');\n}\n\nexport async function buildOAuth2TokenHash(value: string) : Promise<string> {\n    const encoder = new TextEncoder();\n    const data = encoder.encode(value);\n    const hashBuffer = await subtle.digest('SHA-256', data);\n    const halfHash = hashBuffer.slice(0, 16);\n\n    return base64URLEncode(halfHash);\n}\n\nexport async function buildOAuth2CodeChallenge(codeVerifier: string) {\n    const encoder = new TextEncoder();\n    const data = encoder.encode(codeVerifier);\n    const arrayBuffer = await subtle.digest('SHA-256', data);\n\n    return base64URLEncode(arrayBuffer);\n}\n"],"mappings":";;;;;AASA,SAAgBC,6BAAAA;CACZ,MAAMC,SAAS;CACf,MAAMC,UAAU;CAEhB,IAAIC,eAAe;CACnB,MAAMC,eAAe,IAAIC,WAAWJ,MAAAA;CACpCK,OAAOC,gBAAgBH,YAAAA;CAEvB,KAAK,IAAII,IAAI,GAAGA,IAAIP,QAAQO,KACxBL,gBAAgBD,QAAQE,aAAaI,KAAKN;CAG9C,OAAOC;AACX;AAEA,SAAgBM,gBAAgBC,aAAwB;CAKpD,MAAMC,WAAWC,MAAMC,KAAK,IAAIR,WAAWK,WAAAA,CAAAA;CAE3C,OAAOI,KAAKC,OAAOC,aAAaC,MAAM,MAAMN,QAAAA,CAAAA,CAAAA,CACvCO,QAAQ,OAAO,GAAA,CAAA,CACfA,QAAQ,OAAO,GAAA,CAAA,CACfA,QAAQ,OAAO,EAAA;AACxB;AAEA,eAAsBC,qBAAqBC,OAAa;CAEpD,MAAMG,OAAOF,IADOC,YACPD,CAAAA,CAAQG,OAAOJ,KAAAA;CAI5B,OAAOX,iBAFUgB,MADQ1B,OAAO2B,OAAO,WAAWH,IAAAA,EAAAA,CACtBK,MAAM,GAAG,EAEdD,CAAAA;AAC3B;AAEA,eAAsBE,yBAAyB1B,cAAoB;CAE/D,MAAMoB,OAAOF,IADOC,YACPD,CAAAA,CAAQG,OAAOrB,YAAAA;CAG5B,OAAOM,gBAAgBC,MAFGX,OAAO2B,OAAO,WAAWH,IAAAA,CAE5Bb;AAC3B"}
+{"version":3,"file":"helpers.mjs","names":["JWTError","subtle","generateOAuth2CodeVerifier","length","charset","codeVerifier","randomValues","Uint8Array","crypto","getRandomValues","i","base64URLEncode","arrayBuffer","charCode","Array","from","btoa","String","fromCharCode","apply","replace","TOKEN_HASH_DIGESTS","name","halfLength","buildOAuth2TokenHash","value","alg","digest","slice","headerPropertyInvalid","encoder","TextEncoder","data","encode","hashBuffer","halfHash","buildOAuth2CodeChallenge"],"sources":["../../../../src/core/oauth2/authorization/helpers.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { JWTAlgorithm } from '@authup/specs';\nimport { JWTError } from '@authup/specs';\nimport { subtle } from 'uncrypto';\n\nexport function generateOAuth2CodeVerifier() {\n    const length = 64;\n    const charset = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';\n\n    let codeVerifier = '';\n    const randomValues = new Uint8Array(length);\n    crypto.getRandomValues(randomValues);\n\n    for (let i = 0; i < length; i++) {\n        codeVerifier += charset[randomValues[i] % charset.length];\n    }\n\n    return codeVerifier;\n}\n\nexport function base64URLEncode(arrayBuffer: ArrayBuffer) {\n    // Convert the ArrayBuffer to string using Uint8 array.\n    // btoa takes chars from 0-255 and base64 encodes.\n    // Then convert the base64 encoded to base64url encoded.\n    // (replace + with -, replace / with _, trim trailing =)\n    const charCode = Array.from(new Uint8Array(arrayBuffer));\n\n    return btoa(String.fromCharCode.apply(null, charCode))\n        .replace(/\\+/g, '-')\n        .replace(/\\//g, '_')\n        .replace(/=+$/, '');\n}\n\n// OIDC Core §3.1.3.6: at_hash / c_hash use the hash algorithm of the id_token's\n// JWS alg (…S256 → SHA-256, …S384 → SHA-384, …S512 → SHA-512) and keep the LEFT\n// HALF of the digest — so the half-length follows the digest (16/24/32 bytes).\nconst TOKEN_HASH_DIGESTS : Record<string, { name: string, halfLength: number }> = {\n    256: { name: 'SHA-256', halfLength: 16 },\n    384: { name: 'SHA-384', halfLength: 24 },\n    512: { name: 'SHA-512', halfLength: 32 },\n};\n\nexport async function buildOAuth2TokenHash(\n    value: string,\n    alg?: `${JWTAlgorithm}` | null,\n) : Promise<string> {\n    // A key row without a persisted alg (nullable legacy column) signs with\n    // the signer's *256 default (RS256/ES256/HS256) — derive the matching\n    // SHA-256 digest. An unrecognized alg still fails loud — silently\n    // defaulting there would mint a hash no conforming verifier accepts.\n    const digest = alg ?\n        TOKEN_HASH_DIGESTS[alg.slice(-3)] :\n        TOKEN_HASH_DIGESTS['256'];\n    if (!digest) {\n        throw JWTError.headerPropertyInvalid('alg');\n    }\n\n    const encoder = new TextEncoder();\n    const data = encoder.encode(value);\n    const hashBuffer = await subtle.digest(digest.name, data);\n    const halfHash = hashBuffer.slice(0, digest.halfLength);\n\n    return base64URLEncode(halfHash);\n}\n\nexport async function buildOAuth2CodeChallenge(codeVerifier: string) {\n    const encoder = new TextEncoder();\n    const data = encoder.encode(codeVerifier);\n    const arrayBuffer = await subtle.digest('SHA-256', data);\n\n    return base64URLEncode(arrayBuffer);\n}\n"],"mappings":";;;;;;AAWA,SAAgBE,6BAAAA;CACZ,MAAMC,SAAS;CACf,MAAMC,UAAU;CAEhB,IAAIC,eAAe;CACnB,MAAMC,eAAe,IAAIC,WAAWJ,MAAAA;CACpCK,OAAOC,gBAAgBH,YAAAA;CAEvB,KAAK,IAAII,IAAI,GAAGA,IAAIP,QAAQO,KACxBL,gBAAgBD,QAAQE,aAAaI,KAAKN;CAG9C,OAAOC;AACX;AAEA,SAAgBM,gBAAgBC,aAAwB;CAKpD,MAAMC,WAAWC,MAAMC,KAAK,IAAIR,WAAWK,WAAAA,CAAAA;CAE3C,OAAOI,KAAKC,OAAOC,aAAaC,MAAM,MAAMN,QAAAA,CAAAA,CAAAA,CACvCO,QAAQ,OAAO,GAAA,CAAA,CACfA,QAAQ,OAAO,GAAA,CAAA,CACfA,QAAQ,OAAO,EAAA;AACxB;AAKA,MAAMC,qBAA4E;CAC9E,KAAK;EAAEC,MAAM;EAAWC,YAAY;CAAG;CACvC,KAAK;EAAED,MAAM;EAAWC,YAAY;CAAG;CACvC,KAAK;EAAED,MAAM;EAAWC,YAAY;CAAG;AAC3C;AAEA,eAAsBC,qBAClBC,OACAC,KAA8B;CAM9B,MAAMC,SAASD,MACXL,mBAAmBK,IAAIE,MAAM,EAAC,KAC9BP,mBAAmB;CACvB,IAAI,CAACM,QACD,MAAM3B,SAAS6B,sBAAsB,KAAA;CAIzC,MAAMG,OAAOF,IADOC,YACPD,CAAAA,CAAQG,OAAOR,KAAAA;CAI5B,OAAOd,iBAFUuB,MADQjC,OAAO0B,OAAOA,OAAOL,MAAMU,IAAAA,EAAAA,CACxBJ,MAAM,GAAGD,OAAOJ,UAErBY,CAAAA;AAC3B;AAEA,eAAsBC,yBAAyB/B,cAAoB;CAE/D,MAAM2B,OAAOF,IADOC,YACPD,CAAAA,CAAQG,OAAO5B,YAAAA;CAG5B,OAAOM,gBAAgBC,MAFGX,OAAO0B,OAAO,WAAWK,IAAAA,CAE5BpB;AAC3B"}

package/dist/core/oauth2/authorization/module.d.ts

@@ -1,20 +1,19 @@
 import type { Identity, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';
-import type { IOAuth2OpenIDTokenIssuer, IOAuth2TokenIssuer } from '../token/index.ts';
 import type { IOAuth2AuthorizationCodeIssuer } from './code/index.ts';
-import type { OAuth2AuthorizationManagerContext, OAuth2AuthorizationResult } from './types.ts';
-import type { IIdentityResolver } from '../../identity/index.ts';
+import type { OAuth2AuthorizationManagerContext, OAuth2AuthorizationOptions, OAuth2AuthorizationResult } from './types.ts';
+import type { ISessionManager } from '../../authentication/index.ts';
 export declare class OAuth2Authorization {
-    protected accessTokenIssuer: IOAuth2TokenIssuer;
-    protected openIdTokenIssuer: IOAuth2OpenIDTokenIssuer;
     protected codeIssuer: IOAuth2AuthorizationCodeIssuer;
-    protected identityResolver: IIdentityResolver;
+    protected sessionManager: ISessionManager;
+    protected promptLoginMaxAge: number;
     constructor(ctx: OAuth2AuthorizationManagerContext);
     /**
      * Authorize with validated codeRequest.
      *
      * @param data
      * @param identity
+     * @param options
      */
-    authorize(data: OAuth2AuthorizationCodeRequest, identity: Identity): Promise<OAuth2AuthorizationResult>;
+    authorize(data: OAuth2AuthorizationCodeRequest, identity: Identity, options?: OAuth2AuthorizationOptions): Promise<OAuth2AuthorizationResult>;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/core/oauth2/authorization/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/authorization/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAA2B,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAU1G,OAAO,KAAK,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACtF,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AAEtE,OAAO,KAAK,EACR,iCAAiC,EACjC,yBAAyB,EAC5B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,qBAAa,mBAAmB;IAC5B,SAAS,CAAC,iBAAiB,EAAG,kBAAkB,CAAC;IAEjD,SAAS,CAAC,iBAAiB,EAAG,wBAAwB,CAAC;IAEvD,SAAS,CAAC,UAAU,EAAG,8BAA8B,CAAC;IAEtD,SAAS,CAAC,gBAAgB,EAAG,iBAAiB,CAAC;gBAEnC,GAAG,EAAE,iCAAiC;IAOlD;;;;;OAKG;IACG,SAAS,CACX,IAAI,EAAE,8BAA8B,EACpC,QAAQ,EAAE,QAAQ,GAClB,OAAO,CAAC,yBAAyB,CAAC;CA2FzC"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/authorization/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAA2B,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAS1G,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,KAAK,EACR,iCAAiC,EACjC,0BAA0B,EAC1B,yBAAyB,EAC5B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAIrE,qBAAa,mBAAmB;IAC5B,SAAS,CAAC,UAAU,EAAG,8BAA8B,CAAC;IAEtD,SAAS,CAAC,cAAc,EAAG,eAAe,CAAC;IAE3C,SAAS,CAAC,iBAAiB,EAAG,MAAM,CAAC;gBAEzB,GAAG,EAAE,iCAAiC;IAMlD;;;;;;OAMG;IACG,SAAS,CACX,IAAI,EAAE,8BAA8B,EACpC,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,0BAA+B,GACxC,OAAO,CAAC,yBAAyB,CAAC;CAoGzC"}

package/dist/core/oauth2/authorization/module.mjs

@@ -1,65 +1,51 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { buildOAuth2TokenHash } from "./helpers.mjs";
-import { ScopeName } from "@authup/core-kit";
-import { OAuth2AuthorizationResponseType, OAuth2GrantError, OAuth2RequestError, OAuth2ResponseTypeError, hasOAuth2Scopes } from "@authup/specs";
+import { OAuth2AuthorizationPrompt, OAuth2AuthorizationResponseType, OAuth2GrantError, OAuth2LoginRequiredError, OAuth2RequestError, OAuth2ResponseTypeError } from "@authup/specs";
 //#region src/core/oauth2/authorization/module.ts
+const DEFAULT_PROMPT_LOGIN_MAX_AGE = 60;
 var OAuth2Authorization = class {
-	accessTokenIssuer;
-	openIdTokenIssuer;
 	codeIssuer;
-	identityResolver;
+	sessionManager;
+	promptLoginMaxAge;
 	constructor(ctx) {
-		this.accessTokenIssuer = ctx.accessTokenIssuer;
-		this.openIdTokenIssuer = ctx.openIdTokenIssuer;
 		this.codeIssuer = ctx.codeIssuer;
-		this.identityResolver = ctx.identityResolver;
+		this.sessionManager = ctx.sessionManager;
+		this.promptLoginMaxAge = ctx.promptLoginMaxAge ?? DEFAULT_PROMPT_LOGIN_MAX_AGE;
 	}
 	/**
 	* Authorize with validated codeRequest.
 	*
 	* @param data
 	* @param identity
-	*/ async authorize(data, identity) {
-		const availableResponseTypes = Object.values(OAuth2AuthorizationResponseType);
+	* @param options
+	*/ async authorize(data, identity, options = {}) {
 		let responseTypes = [];
 		if (data.response_type) responseTypes = Array.isArray(data.response_type) ? data.response_type : data.response_type.split(" ");
-		const enabledResponseTypes = {};
-		for (const responseType of responseTypes) if (!availableResponseTypes.includes(responseType)) throw OAuth2ResponseTypeError.unsupported();
-		else enabledResponseTypes[responseType] = true;
+		for (const responseType of responseTypes) if (responseType !== OAuth2AuthorizationResponseType.CODE) throw OAuth2ResponseTypeError.unsupported();
+		if (!responseTypes.includes(OAuth2AuthorizationResponseType.CODE)) throw OAuth2ResponseTypeError.unsupported();
 		if (!data.redirect_uri) throw OAuth2GrantError.redirectUriMismatch();
 		const output = {
 			redirectUri: data.redirect_uri,
 			...data.state ? { state: data.state } : {}
 		};
 		if (!identity) throw OAuth2RequestError.identityInvalid();
-		const payloadBaseNormalized = {
-			sub: identity.data.id,
-			sub_kind: identity.type,
-			realm_id: identity.data.realm.id,
-			realm_name: identity.data.realm.name,
-			client_id: data.client_id,
-			...data.scope ? { scope: data.scope } : {},
-			...data.nonce ? { nonce: data.nonce } : {}
-		};
-		let codeEntity;
-		if (enabledResponseTypes[OAuth2AuthorizationResponseType.TOKEN]) {
-			const [token] = await this.accessTokenIssuer.issue(payloadBaseNormalized);
-			output.accessToken = token;
-		}
-		if (enabledResponseTypes[OAuth2AuthorizationResponseType.CODE]) {
-			codeEntity = await this.codeIssuer.issue(data, identity);
-			output.authorizationCode = codeEntity.id;
+		if (data.realm_id && identity.data.realm_id !== data.realm_id) throw OAuth2LoginRequiredError.realmMismatch();
+		const nowSeconds = Math.floor(Date.now() / 1e3);
+		let authTime = nowSeconds;
+		if (options.sessionId) {
+			const session = await this.sessionManager.findOneById(options.sessionId);
+			if (session && session.created_at) authTime = Math.floor(new Date(session.created_at).getTime() / 1e3);
 		}
-		if (enabledResponseTypes[OAuth2AuthorizationResponseType.ID_TOKEN] || data.scope && hasOAuth2Scopes(data.scope, ScopeName.OPEN_ID)) {
-			const idTokenPayload = { ...payloadBaseNormalized };
-			if (output.accessToken) idTokenPayload.at_hash = await buildOAuth2TokenHash(output.accessToken);
-			if (output.authorizationCode) idTokenPayload.c_hash = await buildOAuth2TokenHash(output.authorizationCode);
-			const [token] = await this.openIdTokenIssuer.issueWithIdentity(idTokenPayload, identity);
-			if (enabledResponseTypes[OAuth2AuthorizationResponseType.ID_TOKEN]) output.idToken = token;
-			if (codeEntity) await this.codeIssuer.updateIdToken(codeEntity, token);
+		if ((data.prompt ? data.prompt.split(" ") : []).includes(OAuth2AuthorizationPrompt.LOGIN) && nowSeconds - authTime > this.promptLoginMaxAge) throw OAuth2LoginRequiredError.reauthenticationRequired();
+		if (typeof data.max_age !== "undefined" && data.max_age !== null) {
+			const maxAge = Number(data.max_age);
+			if (Number.isFinite(maxAge) && nowSeconds - authTime > maxAge) throw OAuth2LoginRequiredError.reauthenticationRequired();
 		}
+		output.authorizationCode = (await this.codeIssuer.issue(data, identity, {
+			sessionId: options.sessionId,
+			authTime
+		})).id;
 		return output;
 	}
 };

package/dist/core/oauth2/authorization/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["ScopeName","OAuth2AuthorizationResponseType","OAuth2GrantError","OAuth2RequestError","OAuth2ResponseTypeError","hasOAuth2Scopes","buildOAuth2TokenHash","OAuth2Authorization","accessTokenIssuer","openIdTokenIssuer","codeIssuer","identityResolver","ctx","authorize","data","identity","availableResponseTypes","Object","values","responseTypes","response_type","Array","isArray","split","enabledResponseTypes","responseType","includes","unsupported","redirect_uri","redirectUriMismatch","output","redirectUri","state","identityInvalid","payloadBaseNormalized","sub","id","sub_kind","type","realm_id","realm","realm_name","name","client_id","scope","nonce","codeEntity","TOKEN","token","issue","accessToken","CODE","authorizationCode","needsIdToken","ID_TOKEN","OPEN_ID","idTokenPayload","at_hash","c_hash","issueWithIdentity","idToken","updateIdToken"],"sources":["../../../../src/core/oauth2/authorization/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Identity, OAuth2AuthorizationCode, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport {\n    OAuth2AuthorizationResponseType,\n    OAuth2GrantError,\n    OAuth2RequestError,\n    OAuth2ResponseTypeError,\n    hasOAuth2Scopes,\n} from '@authup/specs';\nimport type { IOAuth2OpenIDTokenIssuer, IOAuth2TokenIssuer } from '../token/index.ts';\nimport type { IOAuth2AuthorizationCodeIssuer } from './code/index.ts';\nimport { buildOAuth2TokenHash } from './helpers.ts';\nimport type {\n    OAuth2AuthorizationManagerContext,\n    OAuth2AuthorizationResult,\n} from './types.ts';\nimport type { IIdentityResolver } from '../../identity/index.ts';\n\nexport class OAuth2Authorization {\n    protected accessTokenIssuer : IOAuth2TokenIssuer;\n\n    protected openIdTokenIssuer : IOAuth2OpenIDTokenIssuer;\n\n    protected codeIssuer : IOAuth2AuthorizationCodeIssuer;\n\n    protected identityResolver : IIdentityResolver;\n\n    constructor(ctx: OAuth2AuthorizationManagerContext) {\n        this.accessTokenIssuer = ctx.accessTokenIssuer;\n        this.openIdTokenIssuer = ctx.openIdTokenIssuer;\n        this.codeIssuer = ctx.codeIssuer;\n        this.identityResolver = ctx.identityResolver;\n    }\n\n    /**\n     * Authorize with validated codeRequest.\n     *\n     * @param data\n     * @param identity\n     */\n    async authorize(\n        data: OAuth2AuthorizationCodeRequest,\n        identity: Identity,\n    ) : Promise<OAuth2AuthorizationResult> {\n        const availableResponseTypes : string[] = Object.values(OAuth2AuthorizationResponseType);\n\n        let responseTypes : string[] = [];\n        if (data.response_type) {\n            responseTypes = Array.isArray(data.response_type) ?\n                data.response_type :\n                data.response_type.split(' ');\n        }\n\n        const enabledResponseTypes : Record<string, boolean> = {};\n\n        for (const responseType of responseTypes) {\n            if (!availableResponseTypes.includes(responseType)) {\n                throw OAuth2ResponseTypeError.unsupported();\n            } else {\n                enabledResponseTypes[responseType] = true;\n            }\n        }\n\n        if (!data.redirect_uri) {\n            throw OAuth2GrantError.redirectUriMismatch();\n        }\n\n        const output : OAuth2AuthorizationResult = {\n            redirectUri: data.redirect_uri,\n            ...(data.state ? { state: data.state } : {}),\n        };\n\n        if (!identity) {\n            throw OAuth2RequestError.identityInvalid();\n        }\n\n        const payloadBaseNormalized : OAuth2TokenPayload = {\n\n            sub: identity.data.id,\n            sub_kind: identity.type,\n            realm_id: identity.data.realm.id,\n            realm_name: identity.data.realm.name,\n\n            client_id: data.client_id,\n            ...(data.scope ? { scope: data.scope } : {}),\n            ...(data.nonce ? { nonce: data.nonce } : {}),\n        };\n\n        let codeEntity : OAuth2AuthorizationCode | undefined;\n\n        if (enabledResponseTypes[OAuth2AuthorizationResponseType.TOKEN]) {\n            const [token] = await this.accessTokenIssuer.issue(payloadBaseNormalized);\n\n            output.accessToken = token;\n        }\n\n        if (enabledResponseTypes[OAuth2AuthorizationResponseType.CODE]) {\n            codeEntity = await this.codeIssuer.issue(\n                data,\n                identity,\n            );\n\n            output.authorizationCode = codeEntity.id;\n        }\n\n        const needsIdToken = enabledResponseTypes[OAuth2AuthorizationResponseType.ID_TOKEN] ||\n            (data.scope && hasOAuth2Scopes(data.scope, ScopeName.OPEN_ID));\n\n        if (needsIdToken) {\n            const idTokenPayload = { ...payloadBaseNormalized };\n\n            if (output.accessToken) {\n                idTokenPayload.at_hash = await buildOAuth2TokenHash(output.accessToken);\n            }\n            if (output.authorizationCode) {\n                idTokenPayload.c_hash = await buildOAuth2TokenHash(output.authorizationCode);\n            }\n\n            const [token] = await this.openIdTokenIssuer.issueWithIdentity(\n                idTokenPayload,\n                identity,\n            );\n\n            if (enabledResponseTypes[OAuth2AuthorizationResponseType.ID_TOKEN]) {\n                output.idToken = token;\n            }\n\n            if (codeEntity) {\n                await this.codeIssuer.updateIdToken(codeEntity, token);\n            }\n        }\n\n        return output;\n    }\n}\n"],"mappings":";;;;;;;AA0BA,IAAaO,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAwC;EAChD,KAAKJ,oBAAoBI,IAAIJ;EAC7B,KAAKC,oBAAoBG,IAAIH;EAC7B,KAAKC,aAAaE,IAAIF;EACtB,KAAKC,mBAAmBC,IAAID;CAChC;;;;;;IAQA,MAAME,UACFC,MACAC,UACmC;EACnC,MAAMC,yBAAoCC,OAAOC,OAAOjB,+BAAAA;EAExD,IAAIkB,gBAA2B,CAAA;EAC/B,IAAIL,KAAKM,eACLD,gBAAgBE,MAAMC,QAAQR,KAAKM,aAAa,IAC5CN,KAAKM,gBACLN,KAAKM,cAAcG,MAAM,GAAA;EAGjC,MAAMC,uBAAiD,CAAC;EAExD,KAAK,MAAMC,gBAAgBN,eACvB,IAAI,CAACH,uBAAuBU,SAASD,YAAAA,GACjC,MAAMrB,wBAAwBuB,YAAW;OAEzCH,qBAAqBC,gBAAgB;EAI7C,IAAI,CAACX,KAAKc,cACN,MAAM1B,iBAAiB2B,oBAAmB;EAG9C,MAAMC,SAAqC;GACvCC,aAAajB,KAAKc;GAClB,GAAId,KAAKkB,QAAQ,EAAEA,OAAOlB,KAAKkB,MAAM,IAAI,CAAC;EAC9C;EAEA,IAAI,CAACjB,UACD,MAAMZ,mBAAmB8B,gBAAe;EAG5C,MAAMC,wBAA6C;GAE/CC,KAAKpB,SAASD,KAAKsB;GACnBC,UAAUtB,SAASuB;GACnBC,UAAUxB,SAASD,KAAK0B,MAAMJ;GAC9BK,YAAY1B,SAASD,KAAK0B,MAAME;GAEhCC,WAAW7B,KAAK6B;GAChB,GAAI7B,KAAK8B,QAAQ,EAAEA,OAAO9B,KAAK8B,MAAM,IAAI,CAAC;GAC1C,GAAI9B,KAAK+B,QAAQ,EAAEA,OAAO/B,KAAK+B,MAAM,IAAI,CAAC;EAC9C;EAEA,IAAIC;EAEJ,IAAItB,qBAAqBvB,gCAAgC8C,QAAQ;GAC7D,MAAM,CAACC,SAAS,MAAM,KAAKxC,kBAAkByC,MAAMf,qBAAAA;GAEnDJ,OAAOoB,cAAcF;EACzB;EAEA,IAAIxB,qBAAqBvB,gCAAgCkD,OAAO;GAC5DL,aAAa,MAAM,KAAKpC,WAAWuC,MAC/BnC,MACAC,QAAAA;GAGJe,OAAOsB,oBAAoBN,WAAWV;EAC1C;EAKA,IAHqBZ,qBAAqBvB,gCAAgCqD,aACrExC,KAAK8B,SAASvC,gBAAgBS,KAAK8B,OAAO5C,UAAUuD,OAAO,GAE9C;GACd,MAAMC,iBAAiB,EAAE,GAAGtB,sBAAsB;GAElD,IAAIJ,OAAOoB,aACPM,eAAeC,UAAU,MAAMnD,qBAAqBwB,OAAOoB,WAAW;GAE1E,IAAIpB,OAAOsB,mBACPI,eAAeE,SAAS,MAAMpD,qBAAqBwB,OAAOsB,iBAAiB;GAG/E,MAAM,CAACJ,SAAS,MAAM,KAAKvC,kBAAkBkD,kBACzCH,gBACAzC,QAAAA;GAGJ,IAAIS,qBAAqBvB,gCAAgCqD,WACrDxB,OAAO8B,UAAUZ;GAGrB,IAAIF,YACA,MAAM,KAAKpC,WAAWmD,cAAcf,YAAYE,KAAAA;EAExD;EAEA,OAAOlB;CACX;AACJ"}
+{"version":3,"file":"module.mjs","names":["OAuth2AuthorizationPrompt","OAuth2AuthorizationResponseType","OAuth2GrantError","OAuth2LoginRequiredError","OAuth2RequestError","OAuth2ResponseTypeError","DEFAULT_PROMPT_LOGIN_MAX_AGE","OAuth2Authorization","codeIssuer","sessionManager","promptLoginMaxAge","ctx","authorize","data","identity","options","responseTypes","response_type","Array","isArray","split","responseType","CODE","unsupported","includes","redirect_uri","redirectUriMismatch","output","redirectUri","state","identityInvalid","realm_id","realmMismatch","nowSeconds","Math","floor","Date","now","authTime","sessionId","session","findOneById","created_at","getTime","prompts","prompt","LOGIN","reauthenticationRequired","max_age","maxAge","Number","isFinite","codeEntity","issue","authorizationCode","id"],"sources":["../../../../src/core/oauth2/authorization/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Identity, OAuth2AuthorizationCode, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport {\n    OAuth2AuthorizationPrompt,\n    OAuth2AuthorizationResponseType,\n    OAuth2GrantError,\n    OAuth2LoginRequiredError,\n    OAuth2RequestError,\n    OAuth2ResponseTypeError,\n} from '@authup/specs';\nimport type { IOAuth2AuthorizationCodeIssuer } from './code/index.ts';\nimport type {\n    OAuth2AuthorizationManagerContext,\n    OAuth2AuthorizationOptions,\n    OAuth2AuthorizationResult,\n} from './types.ts';\nimport type { ISessionManager } from '../../authentication/index.ts';\n\nconst DEFAULT_PROMPT_LOGIN_MAX_AGE = 60;\n\nexport class OAuth2Authorization {\n    protected codeIssuer : IOAuth2AuthorizationCodeIssuer;\n\n    protected sessionManager : ISessionManager;\n\n    protected promptLoginMaxAge : number;\n\n    constructor(ctx: OAuth2AuthorizationManagerContext) {\n        this.codeIssuer = ctx.codeIssuer;\n        this.sessionManager = ctx.sessionManager;\n        this.promptLoginMaxAge = ctx.promptLoginMaxAge ?? DEFAULT_PROMPT_LOGIN_MAX_AGE;\n    }\n\n    /**\n     * Authorize with validated codeRequest.\n     *\n     * @param data\n     * @param identity\n     * @param options\n     */\n    async authorize(\n        data: OAuth2AuthorizationCodeRequest,\n        identity: Identity,\n        options: OAuth2AuthorizationOptions = {},\n    ) : Promise<OAuth2AuthorizationResult> {\n        // OAuth 2.1 posture: only the authorization-code response type is\n        // supported — implicit/hybrid (token, id_token, none) were dropped\n        // (plan 042 item 3). Defense in depth behind the request validator.\n        let responseTypes : string[] = [];\n        if (data.response_type) {\n            responseTypes = Array.isArray(data.response_type) ?\n                data.response_type :\n                data.response_type.split(' ');\n        }\n\n        for (const responseType of responseTypes) {\n            if (responseType !== OAuth2AuthorizationResponseType.CODE) {\n                throw OAuth2ResponseTypeError.unsupported();\n            }\n        }\n\n        if (!responseTypes.includes(OAuth2AuthorizationResponseType.CODE)) {\n            throw OAuth2ResponseTypeError.unsupported();\n        }\n\n        if (!data.redirect_uri) {\n            throw OAuth2GrantError.redirectUriMismatch();\n        }\n\n        const output : OAuth2AuthorizationResult = {\n            redirectUri: data.redirect_uri,\n            ...(data.state ? { state: data.state } : {}),\n        };\n\n        if (!identity) {\n            throw OAuth2RequestError.identityInvalid();\n        }\n\n        // Realm binding: the code-request verifier stamped data.realm_id with the\n        // resolved client's realm. The authenticated identity must belong to that\n        // same realm — otherwise a lingering session for realm A could silently\n        // mint a code/token for realm B's client (confused deputy). The error body\n        // deliberately carries no identity data (no realm-enumeration oracle).\n        // The comparison reads the scalar realm_id column, NOT the realm\n        // relation — the relation may simply not be loaded on the resolved\n        // identity. An identity without a realm_id fails closed the same way —\n        // clean login_required, never a TypeError.\n        if (\n            data.realm_id &&\n            identity.data.realm_id !== data.realm_id\n        ) {\n            throw OAuth2LoginRequiredError.realmMismatch();\n        }\n\n        // Authentication time = the backing session's creation instant (NOT\n        // refreshed_at — a token refresh must not reset it). Session-less flows\n        // (e.g. HTTP Basic authorize) present live credentials on this request,\n        // so the authentication time is \"now\".\n        const nowSeconds = Math.floor(Date.now() / 1000);\n        let authTime = nowSeconds;\n        if (options.sessionId) {\n            const session = await this.sessionManager.findOneById(options.sessionId);\n            if (session && session.created_at) {\n                authTime = Math.floor(new Date(session.created_at).getTime() / 1000);\n            }\n        }\n\n        // OIDC §3.1.2.1 prompt=login / max_age freshness (enforced only when\n        // requested — a plain authorize never throws here). The hosted page\n        // renders the login form for prompt=login; this is the server backstop.\n        const prompts = data.prompt ? data.prompt.split(' ') : [];\n        if (\n            prompts.includes(OAuth2AuthorizationPrompt.LOGIN) &&\n            nowSeconds - authTime > this.promptLoginMaxAge\n        ) {\n            throw OAuth2LoginRequiredError.reauthenticationRequired();\n        }\n\n        if (\n            typeof data.max_age !== 'undefined' &&\n            data.max_age !== null\n        ) {\n            const maxAge = Number(data.max_age);\n            if (\n                Number.isFinite(maxAge) &&\n                nowSeconds - authTime > maxAge\n            ) {\n                throw OAuth2LoginRequiredError.reauthenticationRequired();\n            }\n        }\n\n        // The id_token is NOT minted here — the /token exchange mints it after\n        // resolving the real backing session, so its `sid` is authoritative\n        // (plan 042 item 6). The code carries the authentication instant.\n        const codeEntity : OAuth2AuthorizationCode = await this.codeIssuer.issue(\n            data,\n            identity,\n            { sessionId: options.sessionId, authTime },\n        );\n\n        output.authorizationCode = codeEntity.id;\n\n        return output;\n    }\n}\n"],"mappings":";;;;;AAwBA,MAAMM,+BAA+B;AAErC,IAAaC,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAAwC;EAChD,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,oBAAoBC,IAAID,qBAAqBJ;CACtD;;;;;;;IASA,MAAMM,UACFC,MACAC,UACAC,UAAsC,CAAC,GACJ;EAInC,IAAIC,gBAA2B,CAAA;EAC/B,IAAIH,KAAKI,eACLD,gBAAgBE,MAAMC,QAAQN,KAAKI,aAAa,IAC5CJ,KAAKI,gBACLJ,KAAKI,cAAcG,MAAM,GAAA;EAGjC,KAAK,MAAMC,gBAAgBL,eACvB,IAAIK,iBAAiBpB,gCAAgCqB,MACjD,MAAMjB,wBAAwBkB,YAAW;EAIjD,IAAI,CAACP,cAAcQ,SAASvB,gCAAgCqB,IAAI,GAC5D,MAAMjB,wBAAwBkB,YAAW;EAG7C,IAAI,CAACV,KAAKY,cACN,MAAMvB,iBAAiBwB,oBAAmB;EAG9C,MAAMC,SAAqC;GACvCC,aAAaf,KAAKY;GAClB,GAAIZ,KAAKgB,QAAQ,EAAEA,OAAOhB,KAAKgB,MAAM,IAAI,CAAC;EAC9C;EAEA,IAAI,CAACf,UACD,MAAMV,mBAAmB0B,gBAAe;EAY5C,IACIjB,KAAKkB,YACLjB,SAASD,KAAKkB,aAAalB,KAAKkB,UAEhC,MAAM5B,yBAAyB6B,cAAa;EAOhD,MAAMC,aAAaC,KAAKC,MAAMC,KAAKC,IAAG,IAAK,GAAA;EAC3C,IAAIC,WAAWL;EACf,IAAIlB,QAAQwB,WAAW;GACnB,MAAMC,UAAU,MAAM,KAAK/B,eAAegC,YAAY1B,QAAQwB,SAAS;GACvE,IAAIC,WAAWA,QAAQE,YACnBJ,WAAWJ,KAAKC,MAAM,IAAIC,KAAKI,QAAQE,UAAU,CAAA,CAAEC,QAAO,IAAK,GAAA;EAEvE;EAMA,KADgB9B,KAAKgC,SAAShC,KAAKgC,OAAOzB,MAAM,GAAA,IAAO,CAAA,EAAA,CAE3CI,SAASxB,0BAA0B8C,KAAK,KAChDb,aAAaK,WAAW,KAAK5B,mBAE7B,MAAMP,yBAAyB4C,yBAAwB;EAG3D,IACI,OAAOlC,KAAKmC,YAAY,eACxBnC,KAAKmC,YAAY,MACnB;GACE,MAAMC,SAASC,OAAOrC,KAAKmC,OAAO;GAClC,IACIE,OAAOC,SAASF,MAAAA,KAChBhB,aAAaK,WAAWW,QAExB,MAAM9C,yBAAyB4C,yBAAwB;EAE/D;EAWApB,OAAO2B,qBAAoBF,MANwB,KAAK5C,WAAW6C,MAC/DxC,MACAC,UACA;GAAEyB,WAAWxB,QAAQwB;GAAWD;EAAS,CAAA,EAAA,CAGPiB;EAEtC,OAAO5B;CACX;AACJ"}

package/dist/core/oauth2/authorization/types.d.ts

@@ -1,17 +1,25 @@
-import type { IOAuth2OpenIDTokenIssuer, IOAuth2TokenIssuer } from '../token/index.ts';
 import type { IOAuth2AuthorizationCodeIssuer } from './code/index.ts';
-import type { IIdentityResolver } from '../../identity/index.ts';
+import type { ISessionManager } from '../../authentication/index.ts';
 export type OAuth2AuthorizationManagerContext = {
-    accessTokenIssuer: IOAuth2TokenIssuer;
-    openIdTokenIssuer: IOAuth2OpenIDTokenIssuer;
     codeIssuer: IOAuth2AuthorizationCodeIssuer;
-    identityResolver: IIdentityResolver;
+    sessionManager: ISessionManager;
+    /**
+     * Max age (seconds) of the authentication a `prompt=login` request accepts
+     * before forcing re-auth (config `promptLoginMaxAge`). Default 60.
+     */
+    promptLoginMaxAge?: number;
 };
 export type OAuth2AuthorizationResult = {
     authorizationCode?: string;
-    accessToken?: string;
-    idToken?: string;
     redirectUri: string;
     state?: string;
 };
+export type OAuth2AuthorizationOptions = {
+    /**
+     * The id of the session the authorizing bearer belongs to. Persisted on the
+     * issued authorization code so the token exchange can reuse that session
+     * instead of creating a second one.
+     */
+    sessionId?: string | null;
+};
 //# sourceMappingURL=types.d.ts.map

package/dist/core/oauth2/authorization/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/authorization/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACtF,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,MAAM,MAAM,iCAAiC,GAAG;IAC5C,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,iBAAiB,EAAE,wBAAwB,CAAC;IAC5C,UAAU,EAAE,8BAA8B,CAAC;IAC3C,gBAAgB,EAAE,iBAAiB,CAAA;CACtC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACpC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;CACjB,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/authorization/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAErE,MAAM,MAAM,iCAAiC,GAAG;IAC5C,UAAU,EAAE,8BAA8B,CAAC;IAC3C,cAAc,EAAE,eAAe,CAAC;IAChC;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC7B,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACpC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;CACjB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACrC;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,CAAC"}

package/dist/core/oauth2/client/grant-type.d.ts

@@ -0,0 +1,9 @@
+import type { Client } from '@authup/core-kit';
+/**
+ * Enforce the client's grant_types allowlist (RFC 6749 §5.2
+ * unauthorized_client). A null/empty column means allow-all, so
+ * enforcement is opt-in per client; unknown values in the list are
+ * inert — they can only narrow, never widen.
+ */
+export declare function assertClientGrantAllowed(client: Pick<Client, 'grant_types'>, grantType: string): void;
+//# sourceMappingURL=grant-type.d.ts.map

package/dist/core/oauth2/client/grant-type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-type.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/client/grant-type.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAG/C;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CASrG"}

package/dist/core/oauth2/client/grant-type.mjs

@@ -0,0 +1,18 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { OAuth2ClientUnauthorizedError } from "@authup/specs";
+//#region src/core/oauth2/client/grant-type.ts
+/**
+* Enforce the client's grant_types allowlist (RFC 6749 §5.2
+* unauthorized_client). A null/empty column means allow-all, so
+* enforcement is opt-in per client; unknown values in the list are
+* inert — they can only narrow, never widen.
+*/ function assertClientGrantAllowed(client, grantType) {
+	if (!client.grant_types) return;
+	if (!client.grant_types.split(/[\s,]+/).includes(grantType)) throw OAuth2ClientUnauthorizedError.grantType(grantType);
+}
+//#endregion
+export { assertClientGrantAllowed };
+
+//# sourceMappingURL=grant-type.mjs.map

package/dist/core/oauth2/client/grant-type.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-type.mjs","names":["OAuth2ClientUnauthorizedError","assertClientGrantAllowed","client","grantType","grant_types","allowed","split","includes"],"sources":["../../../../src/core/oauth2/client/grant-type.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Client } from '@authup/core-kit';\nimport { OAuth2ClientUnauthorizedError } from '@authup/specs';\n\n/**\n * Enforce the client's grant_types allowlist (RFC 6749 §5.2\n * unauthorized_client). A null/empty column means allow-all, so\n * enforcement is opt-in per client; unknown values in the list are\n * inert — they can only narrow, never widen.\n */\nexport function assertClientGrantAllowed(client: Pick<Client, 'grant_types'>, grantType: string): void {\n    if (!client.grant_types) {\n        return;\n    }\n\n    const allowed = client.grant_types.split(/[\\s,]+/);\n    if (!allowed.includes(grantType)) {\n        throw OAuth2ClientUnauthorizedError.grantType(grantType);\n    }\n}\n"],"mappings":";;;;;;;;;;GAgBA,SAAgBC,yBAAyBC,QAAqCC,WAAiB;CAC3F,IAAI,CAACD,OAAOE,aACR;CAIJ,IAAI,CADYF,OAAOE,YAAYE,MAAM,QACpCD,CAAAA,CAAQE,SAASJ,SAAAA,GAClB,MAAMH,8BAA8BG,UAAUA,SAAAA;AAEtD"}

package/dist/core/oauth2/client/index.d.ts

@@ -1,3 +1,4 @@
 export * from './authenticator.ts';
+export * from './grant-type.ts';
 export * from './types.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/client/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/client/index.ts"],"names":[],"mappings":"AAOA,cAAc,oBAAoB,CAAC;AACnC,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/client/index.ts"],"names":[],"mappings":"AAOA,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,YAAY,CAAC"}

package/dist/core/oauth2/client/index.mjs

@@ -2,4 +2,5 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { OAuth2ClientAuthenticator } from "./authenticator.mjs";
-export { OAuth2ClientAuthenticator };
+import { assertClientGrantAllowed } from "./grant-type.mjs";
+export { OAuth2ClientAuthenticator, assertClientGrantAllowed };

package/dist/core/oauth2/end-session/index.d.ts

@@ -0,0 +1,4 @@
+export * from './service.ts';
+export * from './types.ts';
+export * from './validator.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/end-session/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/end-session/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC"}

package/dist/core/oauth2/end-session/index.mjs

@@ -0,0 +1,6 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { OAuth2EndSessionService } from "./service.mjs";
+import { OAuth2EndSessionRequestValidator } from "./validator.mjs";
+export { OAuth2EndSessionRequestValidator, OAuth2EndSessionService };

package/dist/core/oauth2/end-session/service.d.ts

@@ -0,0 +1,30 @@
+import type { OAuth2TokenPayload } from '@authup/specs';
+import type { IRealmRepository } from '../../entities/index.ts';
+import type { ISessionManager } from '../../authentication/index.ts';
+import type { IOAuth2ClientRepository } from '../client/index.ts';
+import type { IOAuth2TokenVerifier } from '../token/index.ts';
+import type { IOAuth2EndSessionService, OAuth2EndSessionRequest, OAuth2EndSessionResult, OAuth2EndSessionServiceContext } from './types.ts';
+export declare class OAuth2EndSessionService implements IOAuth2EndSessionService {
+    protected tokenVerifier: IOAuth2TokenVerifier;
+    protected sessionManager: ISessionManager;
+    protected clientRepository: IOAuth2ClientRepository;
+    protected realmRepository: IRealmRepository;
+    protected hintGracePeriod: number;
+    constructor(ctx: OAuth2EndSessionServiceContext);
+    verify(data: OAuth2EndSessionRequest): Promise<OAuth2EndSessionResult>;
+    revoke(sessionId: string, sub: string, subKind: string): Promise<boolean>;
+    /**
+     * With a positive `hintGracePeriod`, an expired hint is honored only within
+     * the window past `exp` — beyond it a leaked id_token stops being a
+     * replayable remote logout (the hint counts as unverified; the click-gated
+     * confirm page still works). 0 keeps spec/Keycloak parity: any expired hint.
+     */
+    protected isWithinHintGraceWindow(payload: OAuth2TokenPayload): boolean;
+    /**
+     * A post-logout redirect is honored only when it is an absolute http(s) URL
+     * that matches a registered client redirect pattern (defense against open
+     * redirects to attacker-controlled URLs).
+     */
+    protected isValidPostLogoutRedirect(registered: string | null | undefined, candidate: string): boolean;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/core/oauth2/end-session/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/end-session/service.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,KAAK,EACR,wBAAwB,EACxB,uBAAuB,EACvB,sBAAsB,EACtB,8BAA8B,EACjC,MAAM,YAAY,CAAC;AAEpB,qBAAa,uBAAwB,YAAW,wBAAwB;IACpE,SAAS,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAE9C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;IAEpD,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,eAAe,EAAE,MAAM,CAAC;gBAEtB,GAAG,EAAE,8BAA8B;IAQzC,MAAM,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IA+GtE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAe/E;;;;;OAKG;IACH,SAAS,CAAC,uBAAuB,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO;IAcvE;;;;OAIG;IACH,SAAS,CAAC,yBAAyB,CAC/B,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACrC,SAAS,EAAE,MAAM,GAClB,OAAO;CAkBb"}