@authup/server-core 1.0.0-beta.50 → 1.0.0-beta.52

package/dist/core/oauth2/end-session/service.mjs

@@ -0,0 +1,117 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { isSimpleMatch, isUUID } from "@authup/kit";
+import { OAuth2TokenKind } from "@authup/specs";
+//#region src/core/oauth2/end-session/service.ts
+var OAuth2EndSessionService = class {
+	tokenVerifier;
+	sessionManager;
+	clientRepository;
+	realmRepository;
+	hintGracePeriod;
+	constructor(ctx) {
+		this.tokenVerifier = ctx.tokenVerifier;
+		this.sessionManager = ctx.sessionManager;
+		this.clientRepository = ctx.clientRepository;
+		this.realmRepository = ctx.realmRepository;
+		this.hintGracePeriod = ctx.hintGracePeriod ?? 0;
+	}
+	async verify(data) {
+		let hintVerified = false;
+		let sub;
+		let subKind;
+		let sessionId;
+		let hintRealmId;
+		let audiences = [];
+		if (data.id_token_hint) try {
+			const payload = await this.tokenVerifier.verify(data.id_token_hint, {
+				ignoreExpiry: true,
+				skipActiveCheck: true
+			});
+			if (payload.kind === OAuth2TokenKind.ID_TOKEN && this.isWithinHintGraceWindow(payload)) {
+				hintVerified = true;
+				sub = payload.sub;
+				subKind = payload.sub_kind;
+				sessionId = payload.sid ?? payload.session_id ?? void 0;
+				hintRealmId = payload.realm_id ?? void 0;
+				const { aud } = payload;
+				if (Array.isArray(aud)) audiences = aud.filter((entry) => typeof entry === "string");
+				else if (typeof aud === "string") audiences = [aud];
+			}
+		} catch {}
+		const clientId = data.client_id ?? (audiences.length === 1 ? audiences[0] : void 0);
+		let client = null;
+		if (clientId) {
+			const realmKey = data.realm_id ?? data.realm_name ?? (hintVerified ? hintRealmId : void 0);
+			const realm = await this.realmRepository.resolve(realmKey, false);
+			if (realm) client = await this.clientRepository.findOneByIdOrName(clientId, realm.id);
+			else if (!realmKey && isUUID(clientId)) client = await this.clientRepository.findOneByIdOrName(clientId);
+		}
+		if (hintVerified && data.client_id) {
+			const expected = isUUID(data.client_id) ? data.client_id : client?.id;
+			if (audiences.length === 0 || !expected || !audiences.includes(expected)) {
+				hintVerified = false;
+				sub = void 0;
+				subKind = void 0;
+				sessionId = void 0;
+			}
+		}
+		let clientName;
+		let redirectUri;
+		if (client) {
+			clientName = client.name;
+			if (data.post_logout_redirect_uri && this.isValidPostLogoutRedirect(client.post_logout_redirect_uri, data.post_logout_redirect_uri)) redirectUri = data.post_logout_redirect_uri;
+		}
+		return {
+			hintVerified,
+			...hintVerified ? {
+				sub,
+				subKind,
+				sessionId
+			} : {},
+			...clientId ? { clientId } : {},
+			...clientName ? { clientName } : {},
+			...redirectUri ? {
+				redirectUri,
+				...data.state ? { state: data.state } : {}
+			} : {}
+		};
+	}
+	async revoke(sessionId, sub, subKind) {
+		const session = await this.sessionManager.findOneById(sessionId);
+		if (!session) return false;
+		if (session.sub !== sub || session.sub_kind !== subKind) return false;
+		await this.sessionManager.revoke(sessionId);
+		return true;
+	}
+	/**
+	* With a positive `hintGracePeriod`, an expired hint is honored only within
+	* the window past `exp` — beyond it a leaked id_token stops being a
+	* replayable remote logout (the hint counts as unverified; the click-gated
+	* confirm page still works). 0 keeps spec/Keycloak parity: any expired hint.
+	*/ isWithinHintGraceWindow(payload) {
+		if (this.hintGracePeriod <= 0) return true;
+		if (typeof payload.exp !== "number") return false;
+		return Math.floor(Date.now() / 1e3) - payload.exp <= this.hintGracePeriod;
+	}
+	/**
+	* A post-logout redirect is honored only when it is an absolute http(s) URL
+	* that matches a registered client redirect pattern (defense against open
+	* redirects to attacker-controlled URLs).
+	*/ isValidPostLogoutRedirect(registered, candidate) {
+		let parsed;
+		try {
+			parsed = new URL(candidate);
+		} catch {
+			return false;
+		}
+		if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return false;
+		if (!registered) return false;
+		return isSimpleMatch(candidate, registered.split(","));
+	}
+};
+//#endregion
+export { OAuth2EndSessionService };
+
+//# sourceMappingURL=service.mjs.map

package/dist/core/oauth2/end-session/service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.mjs","names":["isSimpleMatch","isUUID","OAuth2TokenKind","OAuth2EndSessionService","tokenVerifier","sessionManager","clientRepository","realmRepository","hintGracePeriod","ctx","verify","data","hintVerified","sub","subKind","sessionId","hintRealmId","audiences","id_token_hint","payload","ignoreExpiry","skipActiveCheck","kind","ID_TOKEN","isWithinHintGraceWindow","sub_kind","sid","session_id","undefined","realm_id","aud","Array","isArray","filter","entry","clientId","client_id","length","client","realmKey","realm_name","realm","resolve","findOneByIdOrName","id","expected","includes","clientName","redirectUri","name","post_logout_redirect_uri","isValidPostLogoutRedirect","state","revoke","session","findOneById","exp","nowSeconds","Math","floor","Date","now","registered","candidate","parsed","URL","protocol","split"],"sources":["../../../../src/core/oauth2/end-session/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isSimpleMatch, isUUID } from '@authup/kit';\nimport type { Client } from '@authup/core-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IRealmRepository } from '../../entities/index.ts';\nimport type { ISessionManager } from '../../authentication/index.ts';\nimport type { IOAuth2ClientRepository } from '../client/index.ts';\nimport type { IOAuth2TokenVerifier } from '../token/index.ts';\nimport type {\n    IOAuth2EndSessionService,\n    OAuth2EndSessionRequest,\n    OAuth2EndSessionResult,\n    OAuth2EndSessionServiceContext,\n} from './types.ts';\n\nexport class OAuth2EndSessionService implements IOAuth2EndSessionService {\n    protected tokenVerifier: IOAuth2TokenVerifier;\n\n    protected sessionManager: ISessionManager;\n\n    protected clientRepository: IOAuth2ClientRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected hintGracePeriod: number;\n\n    constructor(ctx: OAuth2EndSessionServiceContext) {\n        this.tokenVerifier = ctx.tokenVerifier;\n        this.sessionManager = ctx.sessionManager;\n        this.clientRepository = ctx.clientRepository;\n        this.realmRepository = ctx.realmRepository;\n        this.hintGracePeriod = ctx.hintGracePeriod ?? 0;\n    }\n\n    async verify(data: OAuth2EndSessionRequest): Promise<OAuth2EndSessionResult> {\n        let hintVerified = false;\n        let sub: string | undefined;\n        let subKind: string | undefined;\n        let sessionId: string | undefined;\n        let hintRealmId: string | undefined;\n        let audiences: string[] = [];\n\n        if (data.id_token_hint) {\n            try {\n                // Signature + kind are the anchors; exp is skipped (a logout hint\n                // is routinely expired) and the cache blocklist is irrelevant.\n                const payload = await this.tokenVerifier.verify(data.id_token_hint, {\n                    ignoreExpiry: true,\n                    skipActiveCheck: true,\n                });\n\n                // MUST be an id_token — access/refresh tokens also carry\n                // session_id, so accepting them would let a leaked access token\n                // act as a logout weapon.\n                if (payload.kind === OAuth2TokenKind.ID_TOKEN && this.isWithinHintGraceWindow(payload)) {\n                    hintVerified = true;\n                    sub = payload.sub;\n                    subKind = payload.sub_kind;\n                    sessionId = payload.sid ?? payload.session_id ?? undefined;\n                    hintRealmId = payload.realm_id ?? undefined;\n                    // aud may be a single string or an array (JWT spec).\n                    const { aud } = payload;\n                    if (Array.isArray(aud)) {\n                        audiences = aud.filter((entry): entry is string => typeof entry === 'string');\n                    } else if (typeof aud === 'string') {\n                        audiences = [aud];\n                    }\n                }\n            } catch {\n                // forged / unverifiable hint → stays unverified (no revoke)\n            }\n        }\n\n        // Resolve a single client for the aud cross-check and redirect\n        // validation: the request's client_id, else the hint's sole audience\n        // (ambiguous for a multi-aud hint).\n        const clientId = data.client_id ?? (audiences.length === 1 ? audiences[0] : undefined);\n\n        let client: Client | null = null;\n        if (clientId) {\n            // Scope a name-identified client to the request's realm hint; a\n            // VERIFIED hint's own realm claim serves as fallback (claims from an\n            // unverified hint are never trusted). No master fallback here\n            // (unlike /token): a bogus hint must NOT silently resolve a\n            // same-named client in master → null realm.\n            const realmKey = data.realm_id ?? data.realm_name ?? (hintVerified ? hintRealmId : undefined);\n            const realm = await this.realmRepository.resolve(realmKey, false);\n\n            // Fail closed instead of dropping the realm predicate: a supplied\n            // realm key that does not resolve never degrades to an unscoped\n            // lookup, and a NAME-form client_id without any realm key is\n            // ambiguous (every realm has a built-in `web` client — same rule as\n            // the /authorize verifier). A UUID is globally unique and needs no\n            // scope; the sole-aud-derived clientId is always a UUID.\n            if (realm) {\n                client = await this.clientRepository.findOneByIdOrName(clientId, realm.id);\n            } else if (!realmKey && isUUID(clientId)) {\n                client = await this.clientRepository.findOneByIdOrName(clientId);\n            }\n        }\n\n        // aud/client_id cross-check: when the request supplies a client_id on a\n        // verified hint, it MUST denote one of the hint's audiences. The aud is\n        // the client UUID, so a name-form client_id is compared via its resolved\n        // client's id. Fail closed: an aud-less hint, or a name that did not\n        // resolve, counts as unverified.\n        if (hintVerified && data.client_id) {\n            const expected = isUUID(data.client_id) ? data.client_id : client?.id;\n            if (audiences.length === 0 || !expected || !audiences.includes(expected)) {\n                hintVerified = false;\n                sub = undefined;\n                subKind = undefined;\n                sessionId = undefined;\n            }\n        }\n\n        let clientName: string | undefined;\n        let redirectUri: string | undefined;\n\n        // Redirect validation is independent of hint verification — the\n        // click-gated confirm page (unverified hint / hint-less request) still\n        // honors a registered post-logout redirect.\n        if (client) {\n            clientName = client.name;\n            if (\n                data.post_logout_redirect_uri &&\n                this.isValidPostLogoutRedirect(client.post_logout_redirect_uri, data.post_logout_redirect_uri)\n            ) {\n                redirectUri = data.post_logout_redirect_uri;\n            }\n        }\n\n        return {\n            hintVerified,\n            ...(hintVerified ? {\n                sub,\n                subKind,\n                sessionId,\n            } : {}),\n            ...(clientId ? { clientId } : {}),\n            ...(clientName ? { clientName } : {}),\n            ...(redirectUri ? { redirectUri, ...(data.state ? { state: data.state } : {}) } : {}),\n        };\n    }\n\n    async revoke(sessionId: string, sub: string, subKind: string): Promise<boolean> {\n        const session = await this.sessionManager.findOneById(sessionId);\n        if (!session) {\n            return false;\n        }\n\n        // Never revoke a session that does not belong to the hint's subject.\n        if (session.sub !== sub || session.sub_kind !== subKind) {\n            return false;\n        }\n\n        await this.sessionManager.revoke(sessionId);\n        return true;\n    }\n\n    /**\n     * With a positive `hintGracePeriod`, an expired hint is honored only within\n     * the window past `exp` — beyond it a leaked id_token stops being a\n     * replayable remote logout (the hint counts as unverified; the click-gated\n     * confirm page still works). 0 keeps spec/Keycloak parity: any expired hint.\n     */\n    protected isWithinHintGraceWindow(payload: OAuth2TokenPayload): boolean {\n        if (this.hintGracePeriod <= 0) {\n            return true;\n        }\n\n        // a bounded window without an exp claim to judge against fails closed\n        if (typeof payload.exp !== 'number') {\n            return false;\n        }\n\n        const nowSeconds = Math.floor(Date.now() / 1000);\n        return nowSeconds - payload.exp <= this.hintGracePeriod;\n    }\n\n    /**\n     * A post-logout redirect is honored only when it is an absolute http(s) URL\n     * that matches a registered client redirect pattern (defense against open\n     * redirects to attacker-controlled URLs).\n     */\n    protected isValidPostLogoutRedirect(\n        registered: string | null | undefined,\n        candidate: string,\n    ): boolean {\n        let parsed: URL;\n        try {\n            parsed = new URL(candidate);\n        } catch {\n            return false;\n        }\n\n        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {\n            return false;\n        }\n\n        if (!registered) {\n            return false;\n        }\n\n        return isSimpleMatch(candidate, registered.split(','));\n    }\n}\n"],"mappings":";;;;;;AAsBA,IAAaG,0BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,KAAKL,gBAAgBK,IAAIL;EACzB,KAAKC,iBAAiBI,IAAIJ;EAC1B,KAAKC,mBAAmBG,IAAIH;EAC5B,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,kBAAkBC,IAAID,mBAAmB;CAClD;CAEA,MAAME,OAAOC,MAAgE;EACzE,IAAIC,eAAe;EACnB,IAAIC;EACJ,IAAIC;EACJ,IAAIC;EACJ,IAAIC;EACJ,IAAIC,YAAsB,CAAA;EAE1B,IAAIN,KAAKO,eACL,IAAI;GAGA,MAAMC,UAAU,MAAM,KAAKf,cAAcM,OAAOC,KAAKO,eAAe;IAChEE,cAAc;IACdC,iBAAiB;GACrB,CAAA;GAKA,IAAIF,QAAQG,SAASpB,gBAAgBqB,YAAY,KAAKC,wBAAwBL,OAAAA,GAAU;IACpFP,eAAe;IACfC,MAAMM,QAAQN;IACdC,UAAUK,QAAQM;IAClBV,YAAYI,QAAQO,OAAOP,QAAQQ,cAAcC,KAAAA;IACjDZ,cAAcG,QAAQU,YAAYD,KAAAA;IAElC,MAAM,EAAEE,QAAQX;IAChB,IAAIY,MAAMC,QAAQF,GAAAA,GACdb,YAAYa,IAAIG,QAAQC,UAA2B,OAAOA,UAAU,QAAA;SACjE,IAAI,OAAOJ,QAAQ,UACtBb,YAAY,CAACa,GAAAA;GAErB;EACJ,QAAQ,CAER;EAMJ,MAAMK,WAAWxB,KAAKyB,cAAcnB,UAAUoB,WAAW,IAAIpB,UAAU,KAAKW,KAAAA;EAE5E,IAAIU,SAAwB;EAC5B,IAAIH,UAAU;GAMV,MAAMI,WAAW5B,KAAKkB,YAAYlB,KAAK6B,eAAe5B,eAAeI,cAAcY,KAAAA;GACnF,MAAMa,QAAQ,MAAM,KAAKlC,gBAAgBmC,QAAQH,UAAU,KAAA;GAQ3D,IAAIE,OACAH,SAAS,MAAM,KAAKhC,iBAAiBqC,kBAAkBR,UAAUM,MAAMG,EAAE;QACtE,IAAI,CAACL,YAAYtC,OAAOkC,QAAAA,GAC3BG,SAAS,MAAM,KAAKhC,iBAAiBqC,kBAAkBR,QAAAA;EAE/D;EAOA,IAAIvB,gBAAgBD,KAAKyB,WAAW;GAChC,MAAMS,WAAW5C,OAAOU,KAAKyB,SAAS,IAAIzB,KAAKyB,YAAYE,QAAQM;GACnE,IAAI3B,UAAUoB,WAAW,KAAK,CAACQ,YAAY,CAAC5B,UAAU6B,SAASD,QAAAA,GAAW;IACtEjC,eAAe;IACfC,MAAMe,KAAAA;IACNd,UAAUc,KAAAA;IACVb,YAAYa,KAAAA;GAChB;EACJ;EAEA,IAAImB;EACJ,IAAIC;EAKJ,IAAIV,QAAQ;GACRS,aAAaT,OAAOW;GACpB,IACItC,KAAKuC,4BACL,KAAKC,0BAA0Bb,OAAOY,0BAA0BvC,KAAKuC,wBAAwB,GAE7FF,cAAcrC,KAAKuC;EAE3B;EAEA,OAAO;GACHtC;GACA,GAAIA,eAAe;IACfC;IACAC;IACAC;GACJ,IAAI,CAAC;GACL,GAAIoB,WAAW,EAAEA,SAAS,IAAI,CAAC;GAC/B,GAAIY,aAAa,EAAEA,WAAW,IAAI,CAAC;GACnC,GAAIC,cAAc;IAAEA;IAAa,GAAIrC,KAAKyC,QAAQ,EAAEA,OAAOzC,KAAKyC,MAAM,IAAI,CAAC;GAAG,IAAI,CAAC;EACvF;CACJ;CAEA,MAAMC,OAAOtC,WAAmBF,KAAaC,SAAmC;EAC5E,MAAMwC,UAAU,MAAM,KAAKjD,eAAekD,YAAYxC,SAAAA;EACtD,IAAI,CAACuC,SACD,OAAO;EAIX,IAAIA,QAAQzC,QAAQA,OAAOyC,QAAQ7B,aAAaX,SAC5C,OAAO;EAGX,MAAM,KAAKT,eAAegD,OAAOtC,SAAAA;EACjC,OAAO;CACX;;;;;;IAQA,wBAAkCI,SAAsC;EACpE,IAAI,KAAKX,mBAAmB,GACxB,OAAO;EAIX,IAAI,OAAOW,QAAQqC,QAAQ,UACvB,OAAO;EAIX,OADmBE,KAAKC,MAAMC,KAAKC,IAAG,IAAK,GACpCJ,IAAatC,QAAQqC,OAAO,KAAKhD;CAC5C;;;;;IAOA,0BACIsD,YACAC,WACO;EACP,IAAIC;EACJ,IAAI;GACAA,SAAS,IAAIC,IAAIF,SAAAA;EACrB,QAAQ;GACJ,OAAO;EACX;EAEA,IAAIC,OAAOE,aAAa,WAAWF,OAAOE,aAAa,UACnD,OAAO;EAGX,IAAI,CAACJ,YACD,OAAO;EAGX,OAAO9D,cAAc+D,WAAWD,WAAWK,MAAM,GAAA,CAAA;CACrD;AACJ"}

package/dist/core/oauth2/end-session/types.d.ts

@@ -0,0 +1,55 @@
+import type { IRealmRepository } from '../../entities/index.ts';
+import type { ISessionManager } from '../../authentication/index.ts';
+import type { IOAuth2ClientRepository } from '../client/index.ts';
+import type { IOAuth2TokenVerifier } from '../token/index.ts';
+export type OAuth2EndSessionRequest = {
+    id_token_hint?: string;
+    client_id?: string;
+    post_logout_redirect_uri?: string;
+    state?: string;
+    realm_id?: string;
+    realm_name?: string;
+};
+export type OAuth2EndSessionResult = {
+    /**
+     * True when a signature-verified id_token_hint proved possession. Only then
+     * are `sub` / `sessionId` populated and a server-side revoke authorized.
+     */
+    hintVerified: boolean;
+    sub?: string;
+    subKind?: string;
+    sessionId?: string;
+    clientId?: string;
+    clientName?: string;
+    /**
+     * The post-logout redirect — present ONLY when it matched a registered
+     * client pattern (open-redirect guard). `state` rides only alongside it.
+     */
+    redirectUri?: string;
+    state?: string;
+};
+export type OAuth2EndSessionServiceContext = {
+    tokenVerifier: IOAuth2TokenVerifier;
+    sessionManager: ISessionManager;
+    clientRepository: IOAuth2ClientRepository;
+    realmRepository: IRealmRepository;
+    /**
+     * Seconds past its `exp` an (expired) id_token_hint is still accepted for
+     * a server-side revoke (config `endSessionHintGracePeriod`).
+     * 0 (default) = unbounded — spec/Keycloak parity.
+     */
+    hintGracePeriod?: number;
+};
+export interface IOAuth2EndSessionService {
+    /**
+     * Verify the request (id_token_hint signature + kind + aud, redirect
+     * validation). Pure — performs no mutation.
+     */
+    verify(data: OAuth2EndSessionRequest): Promise<OAuth2EndSessionResult>;
+    /**
+     * Revoke the session ONLY when it belongs to the hint's subject.
+     * @returns whether a session was revoked.
+     */
+    revoke(sessionId: string, sub: string, subKind: string): Promise<boolean>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/oauth2/end-session/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/end-session/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAE9D,MAAM,MAAM,uBAAuB,GAAG;IAClC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACjC;;;OAGG;IACH,YAAY,EAAE,OAAO,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IACzC,aAAa,EAAE,oBAAoB,CAAC;IACpC,cAAc,EAAE,eAAe,CAAC;IAChC,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,eAAe,EAAE,gBAAgB,CAAC;IAClC;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,MAAM,WAAW,wBAAwB;IACrC;;;OAGG;IACH,MAAM,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAEvE;;;OAGG;IACH,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7E"}

package/dist/core/oauth2/end-session/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/oauth2/end-session/validator.d.ts

@@ -0,0 +1,6 @@
+import { Container } from 'validup';
+import type { OAuth2EndSessionRequest } from './types.ts';
+export declare class OAuth2EndSessionRequestValidator extends Container<OAuth2EndSessionRequest> {
+    protected initialize(): void;
+}
+//# sourceMappingURL=validator.d.ts.map

package/dist/core/oauth2/end-session/validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/end-session/validator.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEpC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAS1D,qBAAa,gCAAiC,SAAQ,SAAS,CAAC,uBAAuB,CAAC;IACpF,SAAS,CAAC,UAAU;CA0CvB"}

package/dist/core/oauth2/end-session/validator.mjs

@@ -0,0 +1,23 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { Container } from "validup";
+import { createValidator } from "@validup/zod";
+import { z } from "zod";
+//#region src/core/oauth2/end-session/validator.ts
+const blankAsAbsent = (schema) => z.preprocess((value) => typeof value === "string" && value.trim() === "" ? void 0 : value, schema);
+var OAuth2EndSessionRequestValidator = class extends Container {
+	initialize() {
+		super.initialize();
+		this.mount("id_token_hint", { optional: true }, createValidator(blankAsAbsent(z.string().max(4096).nullable().optional())));
+		this.mount("client_id", { optional: true }, createValidator(blankAsAbsent(z.string().max(256).nullable().optional())));
+		this.mount("post_logout_redirect_uri", { optional: true }, createValidator(blankAsAbsent(z.string().url().max(2e3).nullable().optional())));
+		this.mount("state", { optional: true }, createValidator(blankAsAbsent(z.string().max(2048).nullable().optional())));
+		this.mount("realm_id", { optional: true }, createValidator(blankAsAbsent(z.string().trim().toLowerCase().max(256).nullable().optional())));
+		this.mount("realm_name", { optional: true }, createValidator(blankAsAbsent(z.string().trim().toLowerCase().max(256).nullable().optional())));
+	}
+};
+//#endregion
+export { OAuth2EndSessionRequestValidator };
+
+//# sourceMappingURL=validator.mjs.map

package/dist/core/oauth2/end-session/validator.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"validator.mjs","names":["createValidator","Container","z","blankAsAbsent","schema","preprocess","value","trim","undefined","OAuth2EndSessionRequestValidator","initialize","mount","optional","string","max","nullable","url","toLowerCase"],"sources":["../../../../src/core/oauth2/end-session/validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createValidator } from '@validup/zod';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport type { OAuth2EndSessionRequest } from './types.ts';\n\n// A blank param (e.g. a stray `?state=` from an RP template) is absent,\n// not a validation failure — it must not discard the rest of the request.\nconst blankAsAbsent = (schema: z.ZodType) => z.preprocess(\n    (value) => (typeof value === 'string' && value.trim() === '' ? undefined : value),\n    schema,\n);\n\nexport class OAuth2EndSessionRequestValidator extends Container<OAuth2EndSessionRequest> {\n    protected initialize() {\n        super.initialize();\n\n        this.mount(\n            'id_token_hint',\n            { optional: true },\n            createValidator(blankAsAbsent(z.string().max(4096).nullable().optional())),\n        );\n\n        this.mount(\n            'client_id',\n            { optional: true },\n            createValidator(blankAsAbsent(z.string().max(256).nullable().optional())),\n        );\n\n        this.mount(\n            'post_logout_redirect_uri',\n            { optional: true },\n            createValidator(blankAsAbsent(z.string().url().max(2000).nullable().optional())),\n        );\n\n        this.mount(\n            'state',\n            { optional: true },\n            createValidator(blankAsAbsent(z.string().max(2048).nullable().optional())),\n        );\n\n        // Canonical identifier form (layer 3): no other validator runs on the\n        // end-session request, so the realm hint is canonicalized at this\n        // ingress — same contract as the token endpoint's readRealmHint.\n        this.mount(\n            'realm_id',\n            { optional: true },\n            createValidator(blankAsAbsent(z.string().trim().toLowerCase().max(256).nullable().optional())),\n        );\n\n        this.mount(\n            'realm_name',\n            { optional: true },\n            createValidator(blankAsAbsent(z.string().trim().toLowerCase().max(256).nullable().optional())),\n        );\n    }\n}\n"],"mappings":";;;;;;;AAcA,MAAMG,iBAAiBC,WAAsBF,EAAEG,YAC1CC,UAAW,OAAOA,UAAU,YAAYA,MAAMC,KAAI,MAAO,KAAKC,KAAAA,IAAYF,OAC3EF,MAAAA;AAGJ,IAAaK,mCAAb,cAAsDR,UAAAA;CACxCS,aAAa;EACnB,MAAMA,WAAAA;EAEN,KAAKC,MACD,iBACA,EAAEC,UAAU,KAAK,GACjBZ,gBAAgBG,cAAcD,EAAEW,OAAM,CAAA,CAAGC,IAAI,IAAA,CAAA,CAAMC,SAAQ,CAAA,CAAGH,SAAQ,CAAA,CAAA,CAAA;EAG1E,KAAKD,MACD,aACA,EAAEC,UAAU,KAAK,GACjBZ,gBAAgBG,cAAcD,EAAEW,OAAM,CAAA,CAAGC,IAAI,GAAA,CAAA,CAAKC,SAAQ,CAAA,CAAGH,SAAQ,CAAA,CAAA,CAAA;EAGzE,KAAKD,MACD,4BACA,EAAEC,UAAU,KAAK,GACjBZ,gBAAgBG,cAAcD,EAAEW,OAAM,CAAA,CAAGG,IAAG,CAAA,CAAGF,IAAI,GAAA,CAAA,CAAMC,SAAQ,CAAA,CAAGH,SAAQ,CAAA,CAAA,CAAA;EAGhF,KAAKD,MACD,SACA,EAAEC,UAAU,KAAK,GACjBZ,gBAAgBG,cAAcD,EAAEW,OAAM,CAAA,CAAGC,IAAI,IAAA,CAAA,CAAMC,SAAQ,CAAA,CAAGH,SAAQ,CAAA,CAAA,CAAA;EAM1E,KAAKD,MACD,YACA,EAAEC,UAAU,KAAK,GACjBZ,gBAAgBG,cAAcD,EAAEW,OAAM,CAAA,CAAGN,KAAI,CAAA,CAAGU,YAAW,CAAA,CAAGH,IAAI,GAAA,CAAA,CAAKC,SAAQ,CAAA,CAAGH,SAAQ,CAAA,CAAA,CAAA;EAG9F,KAAKD,MACD,cACA,EAAEC,UAAU,KAAK,GACjBZ,gBAAgBG,cAAcD,EAAEW,OAAM,CAAA,CAAGN,KAAI,CAAA,CAAGU,YAAW,CAAA,CAAGH,IAAI,GAAA,CAAA,CAAKC,SAAQ,CAAA,CAAGH,SAAQ,CAAA,CAAA,CAAA;CAElG;AACJ"}

package/dist/core/oauth2/grant-types/authorize.d.ts

@@ -1,11 +1,28 @@
 import type { OAuth2TokenGrantResponse } from '@authup/specs';
-import type { OAuth2AuthorizationCode } from '@authup/core-kit';
-import type { IOAuth2TokenIssuer } from '../token/index.ts';
+import type { OAuth2AuthorizationCode, Session } from '@authup/core-kit';
+import type { IOAuth2KeyRepository } from '../key/index.ts';
+import type { IOAuth2OpenIDTokenIssuer, IOAuth2TokenIssuer } from '../token/index.ts';
 import { OAuth2BaseGrant } from './base.ts';
 import type { IOAuth2Grant, OAuth2AuthorizeGrantContext, OAuth2GrantRunWIthOptions } from './types.ts';
 export declare class OAuth2AuthorizeGrant extends OAuth2BaseGrant<OAuth2AuthorizationCode> implements IOAuth2Grant {
     protected refreshTokenIssuer: IOAuth2TokenIssuer;
+    protected openIdTokenIssuer: IOAuth2OpenIDTokenIssuer;
+    protected keyRepository: IOAuth2KeyRepository;
     constructor(ctx: OAuth2AuthorizeGrantContext);
     runWith(authorizationCode: OAuth2AuthorizationCode, options?: OAuth2GrantRunWIthOptions): Promise<OAuth2TokenGrantResponse>;
+    /**
+     * Reuse the bearer's session when the authorization code was issued from an
+     * (interactive) `/authorize` request that carried one — otherwise the
+     * interactive login would create a second session (the abandoned bearer
+     * session that authenticated `POST /authorize`, plus this one).
+     *
+     * The reuse is gated on the session still existing and belonging to the
+     * same subject/realm as the code (defense in depth — the id is
+     * server-derived from the authenticated bearer, never client input). Any
+     * mismatch, or a session-less authorize flow (external IdP, non-interactive
+     * clients), falls back to creating a fresh session — preserving prior
+     * behavior.
+     */
+    protected resolveSession(authorizationCode: OAuth2AuthorizationCode, options: OAuth2GrantRunWIthOptions): Promise<Session>;
 }
 //# sourceMappingURL=authorize.d.ts.map

package/dist/core/oauth2/grant-types/authorize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/grant-types/authorize.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAsB,MAAM,eAAe,CAAC;AAElF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAEhE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,YAAY,EAAE,2BAA2B,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAIvG,qBAAa,oBAAqB,SAAQ,eAAe,CAAC,uBAAuB,CAAE,YAAW,YAAY;IACtG,SAAS,CAAC,kBAAkB,EAAG,kBAAkB,CAAC;gBAEtC,GAAG,EAAE,2BAA2B;IAStC,OAAO,CACT,iBAAiB,EAAE,uBAAuB,EAC1C,OAAO,GAAE,yBAA8B,GACvC,OAAO,CAAC,wBAAwB,CAAC;CAyCxC"}
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/grant-types/authorize.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAsB,MAAM,eAAe,CAAC;AAElF,OAAO,KAAK,EAAE,uBAAuB,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAGzE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACtF,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,YAAY,EAAE,2BAA2B,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAIvG,qBAAa,oBAAqB,SAAQ,eAAe,CAAC,uBAAuB,CAAE,YAAW,YAAY;IACtG,SAAS,CAAC,kBAAkB,EAAG,kBAAkB,CAAC;IAElD,SAAS,CAAC,iBAAiB,EAAG,wBAAwB,CAAC;IAEvD,SAAS,CAAC,aAAa,EAAG,oBAAoB,CAAC;gBAEnC,GAAG,EAAE,2BAA2B;IAWtC,OAAO,CACT,iBAAiB,EAAE,uBAAuB,EAC1C,OAAO,GAAE,yBAA8B,GACvC,OAAO,CAAC,wBAAwB,CAAC;IA6DrC;;;;;;;;;;;;OAYG;cACa,cAAc,CAC1B,iBAAiB,EAAE,uBAAuB,EAC1C,OAAO,EAAE,yBAAyB,GAClC,OAAO,CAAC,OAAO,CAAC;CAwBvB"}

package/dist/core/oauth2/grant-types/authorize.mjs

@@ -1,29 +1,27 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { buildOAuth2TokenHash } from "../authorization/helpers.mjs";
 import { OAuth2BaseGrant } from "./base.mjs";
 import { buildOAuth2BearerTokenResponse } from "../response/bearer.mjs";
 import { ScopeName } from "@authup/core-kit";
-import { hasOAuth2Scopes } from "@authup/specs";
+import { JWKError, hasOAuth2Scopes } from "@authup/specs";
 //#region src/core/oauth2/grant-types/authorize.ts
 var OAuth2AuthorizeGrant = class extends OAuth2BaseGrant {
 	refreshTokenIssuer;
+	openIdTokenIssuer;
+	keyRepository;
 	constructor(ctx) {
 		super({
 			accessTokenIssuer: ctx.accessTokenIssuer,
 			sessionManager: ctx.sessionManager
 		});
 		this.refreshTokenIssuer = ctx.refreshTokenIssuer;
+		this.openIdTokenIssuer = ctx.openIdTokenIssuer;
+		this.keyRepository = ctx.keyRepository;
 	}
 	async runWith(authorizationCode, options = {}) {
-		const session = await this.sessionManager.create({
-			user_agent: options.userAgent,
-			ip_address: options.ipAddress,
-			realm_id: authorizationCode.realm_id,
-			client_id: authorizationCode.client_id,
-			sub_kind: authorizationCode.sub_kind,
-			sub: authorizationCode.sub
-		});
+		const session = await this.resolveSession(authorizationCode, options);
 		const issuePayload = {
 			user_agent: options.userAgent,
 			remote_address: options.ipAddress,
@@ -43,9 +41,54 @@ var OAuth2AuthorizeGrant = class extends OAuth2BaseGrant {
 			refreshToken,
 			refreshTokenPayload
 		};
-		if (authorizationCode.scope && hasOAuth2Scopes(authorizationCode.scope, ScopeName.OPEN_ID)) buildContext.idToken = authorizationCode.id_token || void 0;
+		if (authorizationCode.scope && hasOAuth2Scopes(authorizationCode.scope, ScopeName.OPEN_ID)) {
+			const key = await this.keyRepository.findByRealmId(authorizationCode.realm_id);
+			if (!key) throw JWKError.notFoundForRealm(authorizationCode.realm_id, authorizationCode.realm_name);
+			const [idToken] = await this.openIdTokenIssuer.issue({
+				sub: authorizationCode.sub || void 0,
+				sub_kind: authorizationCode.sub_kind,
+				realm_id: authorizationCode.realm_id,
+				realm_name: authorizationCode.realm_name,
+				scope: authorizationCode.scope || void 0,
+				client_id: authorizationCode.client_id || void 0,
+				...authorizationCode.nonce ? { nonce: authorizationCode.nonce } : {},
+				...typeof authorizationCode.auth_time === "number" ? { auth_time: authorizationCode.auth_time } : {},
+				sid: session.id,
+				at_hash: await buildOAuth2TokenHash(accessToken, key.signature_algorithm)
+			});
+			buildContext.idToken = idToken;
+		}
 		return buildOAuth2BearerTokenResponse(buildContext);
 	}
+	/**
+	* Reuse the bearer's session when the authorization code was issued from an
+	* (interactive) `/authorize` request that carried one — otherwise the
+	* interactive login would create a second session (the abandoned bearer
+	* session that authenticated `POST /authorize`, plus this one).
+	*
+	* The reuse is gated on the session still existing and belonging to the
+	* same subject/realm as the code (defense in depth — the id is
+	* server-derived from the authenticated bearer, never client input). Any
+	* mismatch, or a session-less authorize flow (external IdP, non-interactive
+	* clients), falls back to creating a fresh session — preserving prior
+	* behavior.
+	*/ async resolveSession(authorizationCode, options) {
+		if (authorizationCode.session_id) {
+			const existing = await this.sessionManager.findOneById(authorizationCode.session_id);
+			if (existing && existing.sub === authorizationCode.sub && existing.sub_kind === authorizationCode.sub_kind && existing.realm_id === authorizationCode.realm_id) {
+				existing.client_id = authorizationCode.client_id || null;
+				return this.sessionManager.refresh(existing);
+			}
+		}
+		return this.sessionManager.create({
+			user_agent: options.userAgent,
+			ip_address: options.ipAddress,
+			realm_id: authorizationCode.realm_id,
+			client_id: authorizationCode.client_id,
+			sub_kind: authorizationCode.sub_kind,
+			sub: authorizationCode.sub
+		});
+	}
 };
 //#endregion
 export { OAuth2AuthorizeGrant };

package/dist/core/oauth2/grant-types/authorize.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.mjs","names":["hasOAuth2Scopes","ScopeName","OAuth2BaseGrant","buildOAuth2BearerTokenResponse","OAuth2AuthorizeGrant","refreshTokenIssuer","ctx","accessTokenIssuer","sessionManager","runWith","authorizationCode","options","session","create","user_agent","userAgent","ip_address","ipAddress","realm_id","client_id","sub_kind","sub","issuePayload","remote_address","session_id","id","undefined","realm_name","scope","accessToken","accessTokenPayload","issue","refreshToken","refreshTokenPayload","buildContext","OPEN_ID","idToken","id_token"],"sources":["../../../../src/core/oauth2/grant-types/authorize.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { hasOAuth2Scopes } from '@authup/specs';\nimport type { OAuth2AuthorizationCode } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport type { IOAuth2TokenIssuer } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport type { IOAuth2Grant, OAuth2AuthorizeGrantContext, OAuth2GrantRunWIthOptions } from './types.ts';\nimport type { OAuth2BearerResponseBuildContext } from '../response/index.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\n\nexport class OAuth2AuthorizeGrant extends OAuth2BaseGrant<OAuth2AuthorizationCode> implements IOAuth2Grant {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    constructor(ctx: OAuth2AuthorizeGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n    }\n\n    async runWith(\n        authorizationCode: OAuth2AuthorizationCode,\n        options: OAuth2GrantRunWIthOptions = {},\n    ) : Promise<OAuth2TokenGrantResponse> {\n        const session = await this.sessionManager.create({\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: authorizationCode.realm_id,\n            client_id: authorizationCode.client_id,\n            sub_kind: authorizationCode.sub_kind,\n            sub: authorizationCode.sub,\n        });\n\n        const issuePayload : Partial<OAuth2TokenPayload> = {\n            user_agent: options.userAgent,\n            remote_address: options.ipAddress,\n            session_id: session.id,\n            sub: authorizationCode.sub || undefined,\n            sub_kind: authorizationCode.sub_kind,\n            realm_id: authorizationCode.realm_id,\n            realm_name: authorizationCode.realm_name,\n            scope: authorizationCode.scope || undefined,\n            client_id: authorizationCode.client_id || undefined,\n        };\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);\n\n        const buildContext : OAuth2BearerResponseBuildContext = {\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        };\n\n        if (\n            authorizationCode.scope &&\n            hasOAuth2Scopes(authorizationCode.scope, ScopeName.OPEN_ID)\n        ) {\n            buildContext.idToken = authorizationCode.id_token || undefined;\n        }\n\n        return buildOAuth2BearerTokenResponse(buildContext);\n    }\n}\n"],"mappings":";;;;;;;;AAiBA,IAAaI,uBAAb,cAA0CF,gBAAAA;CAC5BG;CAEV,YAAYC,KAAkC;EAC1C,MAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;EACxB,CAAA;EAEA,KAAKH,qBAAqBC,IAAID;CAClC;CAEA,MAAMI,QACFC,mBACAC,UAAqC,CAAC,GACJ;EAClC,MAAMC,UAAU,MAAM,KAAKJ,eAAeK,OAAO;GAC7CC,YAAYH,QAAQI;GACpBC,YAAYL,QAAQM;GACpBC,UAAUR,kBAAkBQ;GAC5BC,WAAWT,kBAAkBS;GAC7BC,UAAUV,kBAAkBU;GAC5BC,KAAKX,kBAAkBW;EAC3B,CAAA;EAEA,MAAMC,eAA6C;GAC/CR,YAAYH,QAAQI;GACpBQ,gBAAgBZ,QAAQM;GACxBO,YAAYZ,QAAQa;GACpBJ,KAAKX,kBAAkBW,OAAOK,KAAAA;GAC9BN,UAAUV,kBAAkBU;GAC5BF,UAAUR,kBAAkBQ;GAC5BS,YAAYjB,kBAAkBiB;GAC9BC,OAAOlB,kBAAkBkB,SAASF,KAAAA;GAClCP,WAAWT,kBAAkBS,aAAaO,KAAAA;EAC9C;EAEA,MAAM,CAACG,aAAaC,sBAAsB,MAAM,KAAKvB,kBAAkBwB,MAAMT,YAAAA;EAC7E,MAAM,CAACU,cAAcC,uBAAuB,MAAM,KAAK5B,mBAAmB0B,MAAMT,YAAAA;EAEhF,MAAMY,eAAkD;GACpDL;GACAC;GACAE;GACAC;EACJ;EAEA,IACIvB,kBAAkBkB,SAClB5B,gBAAgBU,kBAAkBkB,OAAO3B,UAAUkC,OAAO,GAE1DD,aAAaE,UAAU1B,kBAAkB2B,YAAYX,KAAAA;EAGzD,OAAOvB,+BAA+B+B,YAAAA;CAC1C;AACJ"}
+{"version":3,"file":"authorize.mjs","names":["JWKError","hasOAuth2Scopes","ScopeName","buildOAuth2TokenHash","OAuth2BaseGrant","buildOAuth2BearerTokenResponse","OAuth2AuthorizeGrant","refreshTokenIssuer","openIdTokenIssuer","keyRepository","ctx","accessTokenIssuer","sessionManager","runWith","authorizationCode","options","session","resolveSession","issuePayload","user_agent","userAgent","remote_address","ipAddress","session_id","id","sub","undefined","sub_kind","realm_id","realm_name","scope","client_id","accessToken","accessTokenPayload","issue","refreshToken","refreshTokenPayload","buildContext","OPEN_ID","key","findByRealmId","notFoundForRealm","idToken","nonce","auth_time","sid","at_hash","signature_algorithm","existing","findOneById","refresh","create","ip_address"],"sources":["../../../../src/core/oauth2/grant-types/authorize.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { JWKError, hasOAuth2Scopes } from '@authup/specs';\nimport type { OAuth2AuthorizationCode, Session } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport { buildOAuth2TokenHash } from '../authorization/helpers.ts';\nimport type { IOAuth2KeyRepository } from '../key/index.ts';\nimport type { IOAuth2OpenIDTokenIssuer, IOAuth2TokenIssuer } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport type { IOAuth2Grant, OAuth2AuthorizeGrantContext, OAuth2GrantRunWIthOptions } from './types.ts';\nimport type { OAuth2BearerResponseBuildContext } from '../response/index.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\n\nexport class OAuth2AuthorizeGrant extends OAuth2BaseGrant<OAuth2AuthorizationCode> implements IOAuth2Grant {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    protected openIdTokenIssuer : IOAuth2OpenIDTokenIssuer;\n\n    protected keyRepository : IOAuth2KeyRepository;\n\n    constructor(ctx: OAuth2AuthorizeGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n        this.openIdTokenIssuer = ctx.openIdTokenIssuer;\n        this.keyRepository = ctx.keyRepository;\n    }\n\n    async runWith(\n        authorizationCode: OAuth2AuthorizationCode,\n        options: OAuth2GrantRunWIthOptions = {},\n    ) : Promise<OAuth2TokenGrantResponse> {\n        const session = await this.resolveSession(authorizationCode, options);\n\n        const issuePayload : Partial<OAuth2TokenPayload> = {\n            user_agent: options.userAgent,\n            remote_address: options.ipAddress,\n            session_id: session.id,\n            sub: authorizationCode.sub || undefined,\n            sub_kind: authorizationCode.sub_kind,\n            realm_id: authorizationCode.realm_id,\n            realm_name: authorizationCode.realm_name,\n            scope: authorizationCode.scope || undefined,\n            client_id: authorizationCode.client_id || undefined,\n        };\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);\n\n        const buildContext : OAuth2BearerResponseBuildContext = {\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        };\n\n        // The id_token is minted HERE — after resolveSession — so its `sid`\n        // references the real backing session for the reuse branch, the\n        // fallback branch, and session-less (federated IdP) codes alike.\n        // `auth_time` is the authentication instant captured on the code.\n        if (\n            authorizationCode.scope &&\n            hasOAuth2Scopes(authorizationCode.scope, ScopeName.OPEN_ID)\n        ) {\n            // The at_hash digest follows the id_token's JWS alg (OIDC Core\n            // §3.1.3.6) — the alg of the realm key the openid issuer signs\n            // with. The access token above was signed with the same key, so a\n            // missing key would already have thrown; this guard fails closed.\n            const key = await this.keyRepository.findByRealmId(authorizationCode.realm_id);\n            if (!key) {\n                throw JWKError.notFoundForRealm(authorizationCode.realm_id, authorizationCode.realm_name);\n            }\n\n            const [idToken] = await this.openIdTokenIssuer.issue({\n                sub: authorizationCode.sub || undefined,\n                sub_kind: authorizationCode.sub_kind,\n                realm_id: authorizationCode.realm_id,\n                realm_name: authorizationCode.realm_name,\n                scope: authorizationCode.scope || undefined,\n                client_id: authorizationCode.client_id || undefined,\n                ...(authorizationCode.nonce ? { nonce: authorizationCode.nonce } : {}),\n                ...(typeof authorizationCode.auth_time === 'number' ? { auth_time: authorizationCode.auth_time } : {}),\n                sid: session.id,\n                at_hash: await buildOAuth2TokenHash(accessToken, key.signature_algorithm),\n            });\n\n            buildContext.idToken = idToken;\n        }\n\n        return buildOAuth2BearerTokenResponse(buildContext);\n    }\n\n    /**\n     * Reuse the bearer's session when the authorization code was issued from an\n     * (interactive) `/authorize` request that carried one — otherwise the\n     * interactive login would create a second session (the abandoned bearer\n     * session that authenticated `POST /authorize`, plus this one).\n     *\n     * The reuse is gated on the session still existing and belonging to the\n     * same subject/realm as the code (defense in depth — the id is\n     * server-derived from the authenticated bearer, never client input). Any\n     * mismatch, or a session-less authorize flow (external IdP, non-interactive\n     * clients), falls back to creating a fresh session — preserving prior\n     * behavior.\n     */\n    protected async resolveSession(\n        authorizationCode: OAuth2AuthorizationCode,\n        options: OAuth2GrantRunWIthOptions,\n    ) : Promise<Session> {\n        if (authorizationCode.session_id) {\n            const existing = await this.sessionManager.findOneById(authorizationCode.session_id);\n            if (\n                existing &&\n                existing.sub === authorizationCode.sub &&\n                existing.sub_kind === authorizationCode.sub_kind &&\n                existing.realm_id === authorizationCode.realm_id\n            ) {\n                existing.client_id = authorizationCode.client_id || null;\n\n                return this.sessionManager.refresh(existing);\n            }\n        }\n\n        return this.sessionManager.create({\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: authorizationCode.realm_id,\n            client_id: authorizationCode.client_id,\n            sub_kind: authorizationCode.sub_kind,\n            sub: authorizationCode.sub,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;AAmBA,IAAaM,uBAAb,cAA0CF,gBAAAA;CAC5BG;CAEAC;CAEAC;CAEV,YAAYC,KAAkC;EAC1C,MAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;EACxB,CAAA;EAEA,KAAKL,qBAAqBG,IAAIH;EAC9B,KAAKC,oBAAoBE,IAAIF;EAC7B,KAAKC,gBAAgBC,IAAID;CAC7B;CAEA,MAAMI,QACFC,mBACAC,UAAqC,CAAC,GACJ;EAClC,MAAMC,UAAU,MAAM,KAAKC,eAAeH,mBAAmBC,OAAAA;EAE7D,MAAMG,eAA6C;GAC/CC,YAAYJ,QAAQK;GACpBC,gBAAgBN,QAAQO;GACxBC,YAAYP,QAAQQ;GACpBC,KAAKX,kBAAkBW,OAAOC,KAAAA;GAC9BC,UAAUb,kBAAkBa;GAC5BC,UAAUd,kBAAkBc;GAC5BC,YAAYf,kBAAkBe;GAC9BC,OAAOhB,kBAAkBgB,SAASJ,KAAAA;GAClCK,WAAWjB,kBAAkBiB,aAAaL,KAAAA;EAC9C;EAEA,MAAM,CAACM,aAAaC,sBAAsB,MAAM,KAAKtB,kBAAkBuB,MAAMhB,YAAAA;EAC7E,MAAM,CAACiB,cAAcC,uBAAuB,MAAM,KAAK7B,mBAAmB2B,MAAMhB,YAAAA;EAEhF,MAAMmB,eAAkD;GACpDL;GACAC;GACAE;GACAC;EACJ;EAMA,IACItB,kBAAkBgB,SAClB7B,gBAAgBa,kBAAkBgB,OAAO5B,UAAUoC,OAAO,GAC5D;GAKE,MAAMC,MAAM,MAAM,KAAK9B,cAAc+B,cAAc1B,kBAAkBc,QAAQ;GAC7E,IAAI,CAACW,KACD,MAAMvC,SAASyC,iBAAiB3B,kBAAkBc,UAAUd,kBAAkBe,UAAU;GAG5F,MAAM,CAACa,WAAW,MAAM,KAAKlC,kBAAkB0B,MAAM;IACjDT,KAAKX,kBAAkBW,OAAOC,KAAAA;IAC9BC,UAAUb,kBAAkBa;IAC5BC,UAAUd,kBAAkBc;IAC5BC,YAAYf,kBAAkBe;IAC9BC,OAAOhB,kBAAkBgB,SAASJ,KAAAA;IAClCK,WAAWjB,kBAAkBiB,aAAaL,KAAAA;IAC1C,GAAIZ,kBAAkB6B,QAAQ,EAAEA,OAAO7B,kBAAkB6B,MAAM,IAAI,CAAC;IACpE,GAAI,OAAO7B,kBAAkB8B,cAAc,WAAW,EAAEA,WAAW9B,kBAAkB8B,UAAU,IAAI,CAAC;IACpGC,KAAK7B,QAAQQ;IACbsB,SAAS,MAAM3C,qBAAqB6B,aAAaO,IAAIQ,mBAAmB;GAC5E,CAAA;GAEAV,aAAaK,UAAUA;EAC3B;EAEA,OAAOrC,+BAA+BgC,YAAAA;CAC1C;;;;;;;;;;;;;IAeA,MAAgBpB,eACZH,mBACAC,SACiB;EACjB,IAAID,kBAAkBS,YAAY;GAC9B,MAAMyB,WAAW,MAAM,KAAKpC,eAAeqC,YAAYnC,kBAAkBS,UAAU;GACnF,IACIyB,YACAA,SAASvB,QAAQX,kBAAkBW,OACnCuB,SAASrB,aAAab,kBAAkBa,YACxCqB,SAASpB,aAAad,kBAAkBc,UAC1C;IACEoB,SAASjB,YAAYjB,kBAAkBiB,aAAa;IAEpD,OAAO,KAAKnB,eAAesC,QAAQF,QAAAA;GACvC;EACJ;EAEA,OAAO,KAAKpC,eAAeuC,OAAO;GAC9BhC,YAAYJ,QAAQK;GACpBgC,YAAYrC,QAAQO;GACpBM,UAAUd,kBAAkBc;GAC5BG,WAAWjB,kBAAkBiB;GAC7BJ,UAAUb,kBAAkBa;GAC5BF,KAAKX,kBAAkBW;EAC3B,CAAA;CACJ;AACJ"}

package/dist/core/oauth2/grant-types/refresh-token.d.ts

@@ -1,12 +1,31 @@
 import type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';
-import type { IOAuth2TokenIssuer, IOAuth2TokenRevoker, IOAuth2TokenVerifier } from '../token/index.ts';
+import type { Logger } from '@authup/server-kit';
+import type { ISessionTokenRepository } from '../session-token/index.ts';
+import type { IOAuth2TokenIssuer, IOAuth2TokenRepository, IOAuth2TokenVerifier } from '../token/index.ts';
 import { OAuth2BaseGrant } from './base.ts';
 import type { IOAuth2Grant, OAuth2GrantRunWIthOptions, OAuth2RefreshTokenGrantContext } from './types.ts';
 export declare class OAuth2RefreshTokenGrant extends OAuth2BaseGrant<string | OAuth2TokenPayload> implements IOAuth2Grant {
     protected refreshTokenIssuer: IOAuth2TokenIssuer;
     protected tokenVerifier: IOAuth2TokenVerifier;
-    protected tokenRevoker: IOAuth2TokenRevoker;
+    protected tokenRepository: IOAuth2TokenRepository;
+    protected sessionTokenRepository: ISessionTokenRepository;
+    protected logger?: Logger;
+    protected gracePeriod: number;
     constructor(ctx: OAuth2RefreshTokenGrantContext);
     runWith(input: string | OAuth2TokenPayload, options?: OAuth2GrantRunWIthOptions): Promise<OAuth2TokenGrantResponse>;
+    /**
+     * The grace window (opt-in via `tokenRefreshGracePeriod`) absorbs benign
+     * concurrent / multi-tab refreshes of the SAME still-current token. It is
+     * scoped to the chain tip: a token whose descendant has already been
+     * consumed is a stale ancestor (a real replay), never a grace re-use.
+     */
+    protected isWithinGraceWindow(jti: string, now: Date): Promise<boolean>;
+    /**
+     * RFC 6819 §5.2.2.3 reaction strategy — revoke the whole token family
+     * (the auth_sessions row) on replay: soft-revoke every session-token row,
+     * blocklist their jtis in the cache, and delete the session so its access
+     * tokens stop verifying on authup's own API.
+     */
+    protected revokeFamily(sessionId: string, jti: string, at: string): Promise<void>;
 }
 //# sourceMappingURL=refresh-token.d.ts.map

package/dist/core/oauth2/grant-types/refresh-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refresh-token.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/grant-types/refresh-token.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAGlF,OAAO,KAAK,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACvG,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,YAAY,EAAE,yBAAyB,EAAE,8BAA8B,EAAE,MAAM,YAAY,CAAC;AAE1G,qBAAa,uBAAwB,SAAQ,eAAe,CAAC,MAAM,GAAG,kBAAkB,CAAE,YAAW,YAAY;IAC7G,SAAS,CAAC,kBAAkB,EAAG,kBAAkB,CAAC;IAElD,SAAS,CAAC,aAAa,EAAG,oBAAoB,CAAC;IAE/C,SAAS,CAAC,YAAY,EAAG,mBAAmB,CAAC;gBAEjC,GAAG,EAAE,8BAA8B;IAYzC,OAAO,CACT,KAAK,EAAE,MAAM,GAAG,kBAAkB,EAClC,OAAO,GAAE,yBAA8B,GACvC,OAAO,CAAC,wBAAwB,CAAC;CAkDxC"}
+{"version":3,"file":"refresh-token.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/grant-types/refresh-token.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAElF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC1G,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,YAAY,EAAE,yBAAyB,EAAE,8BAA8B,EAAE,MAAM,YAAY,CAAC;AAE1G,qBAAa,uBAAwB,SAAQ,eAAe,CAAC,MAAM,GAAG,kBAAkB,CAAE,YAAW,YAAY;IAC7G,SAAS,CAAC,kBAAkB,EAAG,kBAAkB,CAAC;IAElD,SAAS,CAAC,aAAa,EAAG,oBAAoB,CAAC;IAE/C,SAAS,CAAC,eAAe,EAAG,sBAAsB,CAAC;IAEnD,SAAS,CAAC,sBAAsB,EAAG,uBAAuB,CAAC;IAE3D,SAAS,CAAC,MAAM,CAAC,EAAG,MAAM,CAAC;IAE3B,SAAS,CAAC,WAAW,EAAG,MAAM,CAAC;gBAEnB,GAAG,EAAE,8BAA8B;IAczC,OAAO,CACT,KAAK,EAAE,MAAM,GAAG,kBAAkB,EAClC,OAAO,GAAE,yBAA8B,GACvC,OAAO,CAAC,wBAAwB,CAAC;IA4FrC;;;;;OAKG;cACa,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAI,OAAO,CAAC,OAAO,CAAC;IAqB9E;;;;;OAKG;cACa,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAI,OAAO,CAAC,IAAI,CAAC;CAmB3F"}

package/dist/core/oauth2/grant-types/refresh-token.mjs

@@ -3,12 +3,15 @@ import "node:url";
 import.meta.url;
 import { OAuth2BaseGrant } from "./base.mjs";
 import { buildOAuth2BearerTokenResponse } from "../response/bearer.mjs";
-import { JWTError } from "@authup/specs";
+import { JWTError, OAuth2GrantError } from "@authup/specs";
 //#region src/core/oauth2/grant-types/refresh-token.ts
 var OAuth2RefreshTokenGrant = class extends OAuth2BaseGrant {
 	refreshTokenIssuer;
 	tokenVerifier;
-	tokenRevoker;
+	tokenRepository;
+	sessionTokenRepository;
+	logger;
+	gracePeriod;
 	constructor(ctx) {
 		super({
 			accessTokenIssuer: ctx.accessTokenIssuer,
@@ -16,31 +19,49 @@ var OAuth2RefreshTokenGrant = class extends OAuth2BaseGrant {
 		});
 		this.refreshTokenIssuer = ctx.refreshTokenIssuer;
 		this.tokenVerifier = ctx.tokenVerifier;
-		this.tokenRevoker = ctx.tokenRevoker;
+		this.tokenRepository = ctx.tokenRepository;
+		this.sessionTokenRepository = ctx.sessionTokenRepository;
+		this.logger = ctx.logger;
+		this.gracePeriod = ctx.options?.gracePeriod ?? 0;
 	}
 	async runWith(input, options = {}) {
 		let payload;
-		if (typeof input === "string") payload = await this.tokenVerifier.verify(input);
+		if (typeof input === "string") payload = await this.tokenVerifier.verify(input, { skipActiveCheck: true });
 		else payload = input;
-		await this.tokenRevoker.revoke(payload);
+		if (!payload.jti) throw JWTError.payloadPropertyInvalid("jti");
 		if (!payload.session_id) throw JWTError.payloadPropertyInvalid("session_id");
+		const row = await this.sessionTokenRepository.findOneById(payload.jti);
+		if (!row || row.kind !== "refresh") throw OAuth2GrantError.invalid("refresh token is unknown");
+		if (row.revoked_at) throw OAuth2GrantError.invalid("refresh token has been revoked");
+		if (row.session_id !== payload.session_id) throw OAuth2GrantError.invalid("refresh token session mismatch");
+		const now = /* @__PURE__ */ new Date();
+		const nowISO = now.toISOString();
+		if (!await this.sessionTokenRepository.markRefreshConsumed(payload.jti, nowISO)) {
+			if (!await this.isWithinGraceWindow(payload.jti, now)) {
+				await this.revokeFamily(row.session_id, payload.jti, nowISO);
+				throw OAuth2GrantError.invalid("refresh token replay detected; session revoked");
+			}
+		}
+		await this.tokenRepository.setInactive(payload.jti, payload.exp);
 		const session = await this.sessionManager.findOneById(payload.session_id);
 		if (!session) throw JWTError.payloadPropertyInvalid("session_id");
 		await this.sessionManager.verify(session);
 		if (options.userAgent) session.user_agent = options.userAgent;
 		if (options.ipAddress) session.ip_address = options.ipAddress;
 		await this.sessionManager.refresh(session);
-		const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({
+		const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue({
 			...payload,
 			user_agent: session.user_agent,
 			remote_address: session.ip_address,
-			exp: this.accessTokenIssuer.buildExp()
+			exp: this.refreshTokenIssuer.buildExp(),
+			parent_id: payload.jti
 		});
-		const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue({
+		const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({
 			...payload,
 			user_agent: session.user_agent,
 			remote_address: session.ip_address,
-			exp: this.refreshTokenIssuer.buildExp()
+			exp: this.accessTokenIssuer.buildExp(),
+			refresh_token_id: refreshTokenPayload.jti
 		});
 		return buildOAuth2BearerTokenResponse({
 			accessToken,
@@ -49,6 +70,31 @@ var OAuth2RefreshTokenGrant = class extends OAuth2BaseGrant {
 			refreshTokenPayload
 		});
 	}
+	/**
+	* The grace window (opt-in via `tokenRefreshGracePeriod`) absorbs benign
+	* concurrent / multi-tab refreshes of the SAME still-current token. It is
+	* scoped to the chain tip: a token whose descendant has already been
+	* consumed is a stale ancestor (a real replay), never a grace re-use.
+	*/ async isWithinGraceWindow(jti, now) {
+		if (this.gracePeriod <= 0) return false;
+		const current = await this.sessionTokenRepository.findOneById(jti);
+		if (!current || current.revoked_at !== null || current.consumed_at === null || now.getTime() - new Date(current.consumed_at).getTime() > this.gracePeriod * 1e3) return false;
+		return !await this.sessionTokenRepository.hasConsumedChild(jti);
+	}
+	/**
+	* RFC 6819 §5.2.2.3 reaction strategy — revoke the whole token family
+	* (the auth_sessions row) on replay: soft-revoke every session-token row,
+	* blocklist their jtis in the cache, and delete the session so its access
+	* tokens stop verifying on authup's own API.
+	*/ async revokeFamily(sessionId, jti, at) {
+		this.logger?.warn("OAuth2 refresh token replay detected; revoking session", {
+			session_id: sessionId,
+			jti
+		});
+		const rows = await this.sessionTokenRepository.revokeBySessionId(sessionId, at);
+		await Promise.allSettled(rows.map((row) => this.tokenRepository.setInactive(row.id, Math.floor(new Date(row.expires_at).getTime() / 1e3))));
+		await this.sessionManager.revoke(sessionId);
+	}
 };
 //#endregion
 export { OAuth2RefreshTokenGrant };

package/dist/core/oauth2/grant-types/refresh-token.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"refresh-token.mjs","names":["JWTError","buildOAuth2BearerTokenResponse","OAuth2BaseGrant","OAuth2RefreshTokenGrant","refreshTokenIssuer","tokenVerifier","tokenRevoker","ctx","accessTokenIssuer","sessionManager","runWith","input","options","payload","verify","revoke","session_id","payloadPropertyInvalid","session","findOneById","userAgent","user_agent","ipAddress","ip_address","refresh","accessToken","accessTokenPayload","issue","remote_address","exp","buildExp","refreshToken","refreshTokenPayload"],"sources":["../../../../src/core/oauth2/grant-types/refresh-token.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { JWTError } from '@authup/specs';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { IOAuth2TokenIssuer, IOAuth2TokenRevoker, IOAuth2TokenVerifier } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport type { IOAuth2Grant, OAuth2GrantRunWIthOptions, OAuth2RefreshTokenGrantContext } from './types.ts';\n\nexport class OAuth2RefreshTokenGrant extends OAuth2BaseGrant<string | OAuth2TokenPayload> implements IOAuth2Grant {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    protected tokenVerifier : IOAuth2TokenVerifier;\n\n    protected tokenRevoker : IOAuth2TokenRevoker;\n\n    constructor(ctx: OAuth2RefreshTokenGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n\n        this.tokenVerifier = ctx.tokenVerifier;\n        this.tokenRevoker = ctx.tokenRevoker;\n    }\n\n    async runWith(\n        input: string | OAuth2TokenPayload,\n        options: OAuth2GrantRunWIthOptions = {},\n    ) : Promise<OAuth2TokenGrantResponse> {\n        let payload : OAuth2TokenPayload;\n        if (typeof input === 'string') {\n            payload = await this.tokenVerifier.verify(input);\n        } else {\n            payload = input;\n        }\n\n        await this.tokenRevoker.revoke(payload);\n\n        if (!payload.session_id) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        const session = await this.sessionManager.findOneById(payload.session_id);\n        if (!session) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        await this.sessionManager.verify(session);\n\n        if (options.userAgent) {\n            session.user_agent = options.userAgent;\n        }\n        if (options.ipAddress) {\n            session.ip_address = options.ipAddress;\n        }\n        await this.sessionManager.refresh(session);\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({\n            ...payload,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            exp: this.accessTokenIssuer.buildExp(),\n        });\n\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue({\n            ...payload,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            exp: this.refreshTokenIssuer.buildExp(),\n        });\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;;;AAcA,IAAaG,0BAAb,cAA6CD,gBAAAA;CAC/BE;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;EACxB,CAAA;EAEA,KAAKL,qBAAqBG,IAAIH;EAE9B,KAAKC,gBAAgBE,IAAIF;EACzB,KAAKC,eAAeC,IAAID;CAC5B;CAEA,MAAMI,QACFC,OACAC,UAAqC,CAAC,GACJ;EAClC,IAAIC;EACJ,IAAI,OAAOF,UAAU,UACjBE,UAAU,MAAM,KAAKR,cAAcS,OAAOH,KAAAA;OAE1CE,UAAUF;EAGd,MAAM,KAAKL,aAAaS,OAAOF,OAAAA;EAE/B,IAAI,CAACA,QAAQG,YACT,MAAMhB,SAASiB,uBAAuB,YAAA;EAG1C,MAAMC,UAAU,MAAM,KAAKT,eAAeU,YAAYN,QAAQG,UAAU;EACxE,IAAI,CAACE,SACD,MAAMlB,SAASiB,uBAAuB,YAAA;EAG1C,MAAM,KAAKR,eAAeK,OAAOI,OAAAA;EAEjC,IAAIN,QAAQQ,WACRF,QAAQG,aAAaT,QAAQQ;EAEjC,IAAIR,QAAQU,WACRJ,QAAQK,aAAaX,QAAQU;EAEjC,MAAM,KAAKb,eAAee,QAAQN,OAAAA;EAElC,MAAM,CAACO,aAAaC,sBAAsB,MAAM,KAAKlB,kBAAkBmB,MAAM;GACzE,GAAGd;GACHQ,YAAYH,QAAQG;GACpBO,gBAAgBV,QAAQK;GACxBM,KAAK,KAAKrB,kBAAkBsB,SAAQ;EACxC,CAAA;EAEA,MAAM,CAACC,cAAcC,uBAAuB,MAAM,KAAK5B,mBAAmBuB,MAAM;GAC5E,GAAGd;GACHQ,YAAYH,QAAQG;GACpBO,gBAAgBV,QAAQK;GACxBM,KAAK,KAAKzB,mBAAmB0B,SAAQ;EACzC,CAAA;EAEA,OAAO7B,+BAA+B;GAClCwB;GACAC;GACAK;GACAC;EACJ,CAAA;CACJ;AACJ"}
+{"version":3,"file":"refresh-token.mjs","names":["JWTError","OAuth2GrantError","buildOAuth2BearerTokenResponse","OAuth2BaseGrant","OAuth2RefreshTokenGrant","refreshTokenIssuer","tokenVerifier","tokenRepository","sessionTokenRepository","logger","gracePeriod","ctx","accessTokenIssuer","sessionManager","options","runWith","input","payload","verify","skipActiveCheck","jti","payloadPropertyInvalid","session_id","row","findOneById","kind","invalid","revoked_at","now","Date","nowISO","toISOString","consumed","markRefreshConsumed","withinGrace","isWithinGraceWindow","revokeFamily","setInactive","exp","session","userAgent","user_agent","ipAddress","ip_address","refresh","refreshToken","refreshTokenPayload","issue","remote_address","buildExp","parent_id","accessToken","accessTokenPayload","refresh_token_id","current","consumed_at","getTime","chainAdvanced","hasConsumedChild","sessionId","at","warn","rows","revokeBySessionId","Promise","allSettled","map","id","Math","floor","expires_at","revoke"],"sources":["../../../../src/core/oauth2/grant-types/refresh-token.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { JWTError, OAuth2GrantError } from '@authup/specs';\nimport type { Logger } from '@authup/server-kit';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { ISessionTokenRepository } from '../session-token/index.ts';\nimport type { IOAuth2TokenIssuer, IOAuth2TokenRepository, IOAuth2TokenVerifier } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport type { IOAuth2Grant, OAuth2GrantRunWIthOptions, OAuth2RefreshTokenGrantContext } from './types.ts';\n\nexport class OAuth2RefreshTokenGrant extends OAuth2BaseGrant<string | OAuth2TokenPayload> implements IOAuth2Grant {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    protected tokenVerifier : IOAuth2TokenVerifier;\n\n    protected tokenRepository : IOAuth2TokenRepository;\n\n    protected sessionTokenRepository : ISessionTokenRepository;\n\n    protected logger? : Logger;\n\n    protected gracePeriod : number;\n\n    constructor(ctx: OAuth2RefreshTokenGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n        this.tokenVerifier = ctx.tokenVerifier;\n        this.tokenRepository = ctx.tokenRepository;\n        this.sessionTokenRepository = ctx.sessionTokenRepository;\n        this.logger = ctx.logger;\n        this.gracePeriod = ctx.options?.gracePeriod ?? 0;\n    }\n\n    async runWith(\n        input: string | OAuth2TokenPayload,\n        options: OAuth2GrantRunWIthOptions = {},\n    ) : Promise<OAuth2TokenGrantResponse> {\n        let payload : OAuth2TokenPayload;\n        if (typeof input === 'string') {\n            // The auth_session_tokens row — not the cache blocklist — is the\n            // authority for refresh-token validity, so skip the active check.\n            payload = await this.tokenVerifier.verify(input, { skipActiveCheck: true });\n        } else {\n            payload = input;\n        }\n\n        if (!payload.jti) {\n            throw JWTError.payloadPropertyInvalid('jti');\n        }\n        if (!payload.session_id) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        const row = await this.sessionTokenRepository.findOneById(payload.jti);\n        if (!row || row.kind !== 'refresh') {\n            // Row missing = expired-and-swept or a pre-rotation legacy token\n            // (hard cutover). Either way the client must re-authenticate.\n            throw OAuth2GrantError.invalid('refresh token is unknown');\n        }\n        if (row.revoked_at) {\n            throw OAuth2GrantError.invalid('refresh token has been revoked');\n        }\n        if (row.session_id !== payload.session_id) {\n            // The row is written with the token's own session_id and jti is\n            // globally unique, so a mismatch means corruption / jti reuse — fail\n            // closed rather than refresh or revoke against the wrong session.\n            throw OAuth2GrantError.invalid('refresh token session mismatch');\n        }\n\n        const now = new Date();\n        const nowISO = now.toISOString();\n\n        const consumed = await this.sessionTokenRepository.markRefreshConsumed(payload.jti, nowISO);\n        if (!consumed) {\n            // Lost the atomic consume — either a replay of an already-rotated\n            // token, or a benign concurrent-refresh race the grace window\n            // absorbs.\n            const withinGrace = await this.isWithinGraceWindow(payload.jti, now);\n            if (!withinGrace) {\n                await this.revokeFamily(row.session_id, payload.jti, nowISO);\n                throw OAuth2GrantError.invalid('refresh token replay detected; session revoked');\n            }\n        }\n\n        // Blocklist the presented refresh token in the cache so introspection\n        // reports it inactive. Deliberately NOT a DB revoke — that would set\n        // revoked_at and break the grace window.\n        await this.tokenRepository.setInactive(payload.jti, payload.exp);\n\n        const session = await this.sessionManager.findOneById(payload.session_id);\n        if (!session) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        await this.sessionManager.verify(session);\n\n        if (options.userAgent) {\n            session.user_agent = options.userAgent;\n        }\n        if (options.ipAddress) {\n            session.ip_address = options.ipAddress;\n        }\n        await this.sessionManager.refresh(session);\n\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue({\n            ...payload,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            exp: this.refreshTokenIssuer.buildExp(),\n            parent_id: payload.jti,\n        });\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({\n            ...payload,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            exp: this.accessTokenIssuer.buildExp(),\n            refresh_token_id: refreshTokenPayload.jti,\n        });\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        });\n    }\n\n    /**\n     * The grace window (opt-in via `tokenRefreshGracePeriod`) absorbs benign\n     * concurrent / multi-tab refreshes of the SAME still-current token. It is\n     * scoped to the chain tip: a token whose descendant has already been\n     * consumed is a stale ancestor (a real replay), never a grace re-use.\n     */\n    protected async isWithinGraceWindow(jti: string, now: Date) : Promise<boolean> {\n        if (this.gracePeriod <= 0) {\n            return false;\n        }\n\n        const current = await this.sessionTokenRepository.findOneById(jti);\n        if (\n            !current ||\n            current.revoked_at !== null ||\n            current.consumed_at === null ||\n            (now.getTime() - new Date(current.consumed_at).getTime()) > this.gracePeriod * 1_000\n        ) {\n            return false;\n        }\n\n        // Grace applies ONLY to the most-recent consumed token: a consumed\n        // descendant proves the rotation advanced past this one (stale replay).\n        const chainAdvanced = await this.sessionTokenRepository.hasConsumedChild(jti);\n        return !chainAdvanced;\n    }\n\n    /**\n     * RFC 6819 §5.2.2.3 reaction strategy — revoke the whole token family\n     * (the auth_sessions row) on replay: soft-revoke every session-token row,\n     * blocklist their jtis in the cache, and delete the session so its access\n     * tokens stop verifying on authup's own API.\n     */\n    protected async revokeFamily(sessionId: string, jti: string, at: string) : Promise<void> {\n        this.logger?.warn('OAuth2 refresh token replay detected; revoking session', {\n            session_id: sessionId,\n            jti,\n        });\n\n        // Blocklisting is best-effort (cache) — settle all of them so one cache\n        // failure cannot skip the rest or, worse, abort the session delete\n        // below (the load-bearing part of the revocation). Pin each TTL to the\n        // token's real expiry (unix seconds) so a long-lived refresh token\n        // cannot resurface as active via introspection after the fallback 1h.\n        const rows = await this.sessionTokenRepository.revokeBySessionId(sessionId, at);\n        await Promise.allSettled(rows.map((row) => this.tokenRepository.setInactive(\n            row.id,\n            Math.floor(new Date(row.expires_at).getTime() / 1_000),\n        )));\n\n        await this.sessionManager.revoke(sessionId);\n    }\n}\n"],"mappings":";;;;;;;AAgBA,IAAaI,0BAAb,cAA6CD,gBAAAA;CAC/BE;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;EACxB,CAAA;EAEA,KAAKR,qBAAqBM,IAAIN;EAC9B,KAAKC,gBAAgBK,IAAIL;EACzB,KAAKC,kBAAkBI,IAAIJ;EAC3B,KAAKC,yBAAyBG,IAAIH;EAClC,KAAKC,SAASE,IAAIF;EAClB,KAAKC,cAAcC,IAAIG,SAASJ,eAAe;CACnD;CAEA,MAAMK,QACFC,OACAF,UAAqC,CAAC,GACJ;EAClC,IAAIG;EACJ,IAAI,OAAOD,UAAU,UAGjBC,UAAU,MAAM,KAAKX,cAAcY,OAAOF,OAAO,EAAEG,iBAAiB,KAAK,CAAA;OAEzEF,UAAUD;EAGd,IAAI,CAACC,QAAQG,KACT,MAAMpB,SAASqB,uBAAuB,KAAA;EAE1C,IAAI,CAACJ,QAAQK,YACT,MAAMtB,SAASqB,uBAAuB,YAAA;EAG1C,MAAME,MAAM,MAAM,KAAKf,uBAAuBgB,YAAYP,QAAQG,GAAG;EACrE,IAAI,CAACG,OAAOA,IAAIE,SAAS,WAGrB,MAAMxB,iBAAiByB,QAAQ,0BAAA;EAEnC,IAAIH,IAAII,YACJ,MAAM1B,iBAAiByB,QAAQ,gCAAA;EAEnC,IAAIH,IAAID,eAAeL,QAAQK,YAI3B,MAAMrB,iBAAiByB,QAAQ,gCAAA;EAGnC,MAAME,sBAAM,IAAIC,KAAAA;EAChB,MAAMC,SAASF,IAAIG,YAAW;EAG9B,IAAI,CAACC,MADkB,KAAKxB,uBAAuByB,oBAAoBhB,QAAQG,KAAKU,MAAAA;OAM5E,CAACI,MADqB,KAAKC,oBAAoBlB,QAAQG,KAAKQ,GAAAA,GAC9C;IACd,MAAM,KAAKQ,aAAab,IAAID,YAAYL,QAAQG,KAAKU,MAAAA;IACrD,MAAM7B,iBAAiByB,QAAQ,gDAAA;GACnC;;EAMJ,MAAM,KAAKnB,gBAAgB8B,YAAYpB,QAAQG,KAAKH,QAAQqB,GAAG;EAE/D,MAAMC,UAAU,MAAM,KAAK1B,eAAeW,YAAYP,QAAQK,UAAU;EACxE,IAAI,CAACiB,SACD,MAAMvC,SAASqB,uBAAuB,YAAA;EAG1C,MAAM,KAAKR,eAAeK,OAAOqB,OAAAA;EAEjC,IAAIzB,QAAQ0B,WACRD,QAAQE,aAAa3B,QAAQ0B;EAEjC,IAAI1B,QAAQ4B,WACRH,QAAQI,aAAa7B,QAAQ4B;EAEjC,MAAM,KAAK7B,eAAe+B,QAAQL,OAAAA;EAElC,MAAM,CAACM,cAAcC,uBAAuB,MAAM,KAAKzC,mBAAmB0C,MAAM;GAC5E,GAAG9B;GACHwB,YAAYF,QAAQE;GACpBO,gBAAgBT,QAAQI;GACxBL,KAAK,KAAKjC,mBAAmB4C,SAAQ;GACrCC,WAAWjC,QAAQG;EACvB,CAAA;EAEA,MAAM,CAAC+B,aAAaC,sBAAsB,MAAM,KAAKxC,kBAAkBmC,MAAM;GACzE,GAAG9B;GACHwB,YAAYF,QAAQE;GACpBO,gBAAgBT,QAAQI;GACxBL,KAAK,KAAK1B,kBAAkBqC,SAAQ;GACpCI,kBAAkBP,oBAAoB1B;EAC1C,CAAA;EAEA,OAAOlB,+BAA+B;GAClCiD;GACAC;GACAP;GACAC;EACJ,CAAA;CACJ;;;;;;IAQA,MAAgBX,oBAAoBf,KAAaQ,KAA8B;EAC3E,IAAI,KAAKlB,eAAe,GACpB,OAAO;EAGX,MAAM4C,UAAU,MAAM,KAAK9C,uBAAuBgB,YAAYJ,GAAAA;EAC9D,IACI,CAACkC,WACDA,QAAQ3B,eAAe,QACvB2B,QAAQC,gBAAgB,QACxB,IAAKC,QAAO,IAAK,IAAI3B,KAAKyB,QAAQC,WAAW,CAAA,CAAEC,QAAO,IAAM,KAAK9C,cAAc,KAE/E,OAAO;EAMX,OAAO,CAAC+C,MADoB,KAAKjD,uBAAuBkD,iBAAiBtC,GAAAA;CAE7E;;;;;;IAQA,MAAgBgB,aAAauB,WAAmBvC,KAAawC,IAA4B;EACrF,KAAKnD,QAAQoD,KAAK,0DAA0D;GACxEvC,YAAYqC;GACZvC;EACJ,CAAA;EAOA,MAAM0C,OAAO,MAAM,KAAKtD,uBAAuBuD,kBAAkBJ,WAAWC,EAAAA;EAC5E,MAAMI,QAAQC,WAAWH,KAAKI,KAAK3C,QAAQ,KAAKhB,gBAAgB8B,YAC5Dd,IAAI4C,IACJC,KAAKC,MAAM,IAAIxC,KAAKN,IAAI+C,UAAU,CAAA,CAAEd,QAAO,IAAK,GAAA,CAAA,CAAA,CAAA;EAGpD,MAAM,KAAK3C,eAAe0D,OAAOZ,SAAAA;CACrC;AACJ"}