@authup/server-core 1.0.0-beta.50 → 1.0.0-beta.52

package/dist/adapters/database/subscriber/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["EntityDefaultEventName","buildEntityChannelName","buildEntityNamespaceName","buildEntityDestinations","type","realmIds","data","destinations","channel","id","items","seen","Set","realmId","has","add","push","namespace","EntitySubscriber","ctx","publisher","setPublisher","listenTo","target","afterInsert","event","entity","cache","onInsert","dropCacheKeys","connection","publish","CREATED","afterUpdate","UPDATED","afterRemove","DELETED","queryResultCache","remove","keys","safePublish","content"],"sources":["../../../../src/adapters/database/subscriber/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { EntityType } from '@authup/core-kit';\nimport {\n    EntityDefaultEventName,\n    buildEntityChannelName,\n    buildEntityNamespaceName,\n} from '@authup/core-kit';\nimport type { DomainEventDestinations, IDomainEventPublisher } from '@authup/server-kit';\nimport type {\n    DataSource,\n    EntitySubscriberInterface,\n    InsertEvent,\n    ObjectLiteral,\n    RemoveEvent,\n    UpdateEvent,\n} from 'typeorm';\nimport type { EntitySubscriberContext } from './types.ts';\n\nexport function buildEntityDestinations<T extends ObjectLiteral>(\n    type: `${EntityType}`,\n    realmIds?: (data: T) => (string | null | undefined)[],\n) : (data: T) => DomainEventDestinations {\n    return (data) => {\n        const destinations : DomainEventDestinations = [\n            { channel: (id) => buildEntityChannelName(type, id) },\n        ];\n\n        if (realmIds) {\n            const items = realmIds(data);\n            const seen = new Set<string>();\n            for (const realmId of items) {\n                if (realmId && !seen.has(realmId)) {\n                    seen.add(realmId);\n                    destinations.push({\n                        channel: (id) => buildEntityChannelName(type, id),\n                        namespace: buildEntityNamespaceName(realmId),\n                    });\n                }\n            }\n        }\n\n        return destinations;\n    };\n}\n\nexport class EntitySubscriber<T extends ObjectLiteral> implements EntitySubscriberInterface<T> {\n    protected ctx : EntitySubscriberContext<T>;\n\n    protected publisher? : IDomainEventPublisher;\n\n    constructor(ctx: EntitySubscriberContext<T>) {\n        this.ctx = ctx;\n        this.publisher = ctx.publisher;\n    }\n\n    setPublisher(publisher: IDomainEventPublisher) : void {\n        this.publisher = publisher;\n    }\n\n    // eslint-disable-next-line @typescript-eslint/no-unsafe-function-type\n    listenTo() : Function | string {\n        return this.ctx.target;\n    }\n\n    async afterInsert(event: InsertEvent<T>): Promise<any> {\n        if (!event.entity) {\n            return;\n        }\n\n        if (this.ctx.cache && this.ctx.cache.onInsert) {\n            await this.dropCacheKeys(event.connection, event.entity);\n        }\n\n        await this.publish(EntityDefaultEventName.CREATED, event.entity);\n    }\n\n    async afterUpdate(event: UpdateEvent<T>): Promise<any> {\n        if (!event.entity) {\n            return;\n        }\n\n        await this.dropCacheKeys(event.connection, event.entity as T);\n\n        await this.publish(EntityDefaultEventName.UPDATED, event.entity as T);\n    }\n\n    async afterRemove(event: RemoveEvent<T>): Promise<any> {\n        if (!event.entity) {\n            return;\n        }\n\n        await this.dropCacheKeys(event.connection, event.entity);\n\n        await this.publish(EntityDefaultEventName.DELETED, event.entity);\n    }\n\n    protected async dropCacheKeys(connection: DataSource, data: T) : Promise<void> {\n        if (!this.ctx.cache || !connection.queryResultCache) {\n            return;\n        }\n\n        await connection.queryResultCache.remove(this.ctx.cache.keys(data));\n    }\n\n    protected async publish(event: `${EntityDefaultEventName}`, data: T) : Promise<void> {\n        if (!this.publisher) {\n            return;\n        }\n\n        await this.publisher.safePublish({\n            content: {\n                type: this.ctx.type,\n                event,\n                data,\n            },\n            destinations: this.ctx.destinations(data),\n        });\n    }\n}\n"],"mappings":";;;;;AAwBA,SAAgBG,wBACZC,MACAC,UAAqD;CAErD,QAAQC,SAAAA;EACJ,MAAMC,eAAyC,CAC3C,EAAEC,UAAUC,OAAOR,uBAAuBG,MAAMK,EAAAA,EAAI,CAAA;EAGxD,IAAIJ,UAAU;GACV,MAAMK,QAAQL,SAASC,IAAAA;GACvB,MAAMK,uBAAO,IAAIC,IAAAA;GACjB,KAAK,MAAMC,WAAWH,OAClB,IAAIG,WAAW,CAACF,KAAKG,IAAID,OAAAA,GAAU;IAC/BF,KAAKI,IAAIF,OAAAA;IACTN,aAAaS,KAAK;KACdR,UAAUC,OAAOR,uBAAuBG,MAAMK,EAAAA;KAC9CQ,WAAWf,yBAAyBW,OAAAA;IACxC,CAAA;GACJ;EAER;EAEA,OAAON;CACX;AACJ;AAEA,IAAaW,mBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,KAAiC;EACzC,KAAKA,MAAMA;EACX,KAAKC,YAAYD,IAAIC;CACzB;CAEAC,aAAaD,WAAyC;EAClD,KAAKA,YAAYA;CACrB;CAGAE,WAA+B;EAC3B,OAAO,KAAKH,IAAII;CACpB;CAEA,MAAMC,YAAYC,OAAqC;EACnD,IAAI,CAACA,MAAMC,QACP;EAGJ,IAAI,KAAKP,IAAIQ,SAAS,KAAKR,IAAIQ,MAAMC,UACjC,MAAM,KAAKC,cAAcJ,MAAMK,YAAYL,MAAMC,MAAM;EAG3D,MAAM,KAAKK,QAAQ/B,uBAAuBgC,SAASP,MAAMC,MAAM;CACnE;CAEA,MAAMO,YAAYR,OAAqC;EACnD,IAAI,CAACA,MAAMC,QACP;EAGJ,MAAM,KAAKG,cAAcJ,MAAMK,YAAYL,MAAMC,MAAM;EAEvD,MAAM,KAAKK,QAAQ/B,uBAAuBkC,SAAST,MAAMC,MAAM;CACnE;CAEA,MAAMS,YAAYV,OAAqC;EACnD,IAAI,CAACA,MAAMC,QACP;EAGJ,MAAM,KAAKG,cAAcJ,MAAMK,YAAYL,MAAMC,MAAM;EAEvD,MAAM,KAAKK,QAAQ/B,uBAAuBoC,SAASX,MAAMC,MAAM;CACnE;CAEA,MAAgBG,cAAcC,YAAwBxB,MAAyB;EAC3E,IAAI,CAAC,KAAKa,IAAIQ,SAAS,CAACG,WAAWO,kBAC/B;EAGJ,MAAMP,WAAWO,iBAAiBC,OAAO,KAAKnB,IAAIQ,MAAMY,KAAKjC,IAAAA,CAAAA;CACjE;CAEA,MAAgByB,QAAQN,OAAoCnB,MAAyB;EACjF,IAAI,CAAC,KAAKc,WACN;EAGJ,MAAM,KAAKA,UAAUoB,YAAY;GAC7BC,SAAS;IACLrC,MAAM,KAAKe,IAAIf;IACfqB;IACAnB;GACJ;GACAC,cAAc,KAAKY,IAAIZ,aAAaD,IAAAA;EACxC,CAAA;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["EntityDefaultEventName","buildEntityChannelName","buildEntityNamespaceName","buildEntityDestinations","type","realmIds","data","destinations","channel","id","items","seen","Set","realmId","has","add","push","namespace","EntitySubscriber","ctx","publisher","setPublisher","listenTo","target","afterInsert","event","entity","cache","onInsert","dropCacheKeys","connection","publish","CREATED","afterUpdate","UPDATED","afterRemove","databaseEntity","DELETED","queryResultCache","remove","keys","safePublish","content"],"sources":["../../../../src/adapters/database/subscriber/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { EntityType } from '@authup/core-kit';\nimport {\n    EntityDefaultEventName,\n    buildEntityChannelName,\n    buildEntityNamespaceName,\n} from '@authup/core-kit';\nimport type { DomainEventDestinations, IDomainEventPublisher } from '@authup/server-kit';\nimport type {\n    DataSource,\n    EntitySubscriberInterface,\n    InsertEvent,\n    ObjectLiteral,\n    RemoveEvent,\n    UpdateEvent,\n} from 'typeorm';\nimport type { EntitySubscriberContext } from './types.ts';\n\nexport function buildEntityDestinations<T extends ObjectLiteral>(\n    type: `${EntityType}`,\n    realmIds?: (data: T) => (string | null | undefined)[],\n) : (data: T) => DomainEventDestinations {\n    return (data) => {\n        const destinations : DomainEventDestinations = [\n            { channel: (id) => buildEntityChannelName(type, id) },\n        ];\n\n        if (realmIds) {\n            const items = realmIds(data);\n            const seen = new Set<string>();\n            for (const realmId of items) {\n                if (realmId && !seen.has(realmId)) {\n                    seen.add(realmId);\n                    destinations.push({\n                        channel: (id) => buildEntityChannelName(type, id),\n                        namespace: buildEntityNamespaceName(realmId),\n                    });\n                }\n            }\n        }\n\n        return destinations;\n    };\n}\n\nexport class EntitySubscriber<T extends ObjectLiteral> implements EntitySubscriberInterface<T> {\n    protected ctx : EntitySubscriberContext<T>;\n\n    protected publisher? : IDomainEventPublisher;\n\n    constructor(ctx: EntitySubscriberContext<T>) {\n        this.ctx = ctx;\n        this.publisher = ctx.publisher;\n    }\n\n    setPublisher(publisher: IDomainEventPublisher) : void {\n        this.publisher = publisher;\n    }\n\n    // eslint-disable-next-line @typescript-eslint/no-unsafe-function-type\n    listenTo() : Function | string {\n        return this.ctx.target;\n    }\n\n    async afterInsert(event: InsertEvent<T>): Promise<any> {\n        if (!event.entity) {\n            return;\n        }\n\n        if (this.ctx.cache && this.ctx.cache.onInsert) {\n            await this.dropCacheKeys(event.connection, event.entity);\n        }\n\n        await this.publish(EntityDefaultEventName.CREATED, event.entity);\n    }\n\n    async afterUpdate(event: UpdateEvent<T>): Promise<any> {\n        if (!event.entity) {\n            return;\n        }\n\n        await this.dropCacheKeys(event.connection, event.entity as T);\n\n        await this.publish(EntityDefaultEventName.UPDATED, event.entity as T);\n    }\n\n    async afterRemove(event: RemoveEvent<T>): Promise<any> {\n        // remove() strips the primary key from event.entity before the\n        // subscriber runs — databaseEntity is the pre-removal row and keeps\n        // the id-keyed cache invalidation (and the DELETED payload) intact.\n        const entity = event.databaseEntity ?? event.entity;\n        if (!entity) {\n            return;\n        }\n\n        await this.dropCacheKeys(event.connection, entity);\n\n        await this.publish(EntityDefaultEventName.DELETED, entity);\n    }\n\n    protected async dropCacheKeys(connection: DataSource, data: T) : Promise<void> {\n        if (!this.ctx.cache || !connection.queryResultCache) {\n            return;\n        }\n\n        await connection.queryResultCache.remove(this.ctx.cache.keys(data));\n    }\n\n    protected async publish(event: `${EntityDefaultEventName}`, data: T) : Promise<void> {\n        if (!this.publisher) {\n            return;\n        }\n\n        await this.publisher.safePublish({\n            content: {\n                type: this.ctx.type,\n                event,\n                data,\n            },\n            destinations: this.ctx.destinations(data),\n        });\n    }\n}\n"],"mappings":";;;;;AAwBA,SAAgBG,wBACZC,MACAC,UAAqD;CAErD,QAAQC,SAAAA;EACJ,MAAMC,eAAyC,CAC3C,EAAEC,UAAUC,OAAOR,uBAAuBG,MAAMK,EAAAA,EAAI,CAAA;EAGxD,IAAIJ,UAAU;GACV,MAAMK,QAAQL,SAASC,IAAAA;GACvB,MAAMK,uBAAO,IAAIC,IAAAA;GACjB,KAAK,MAAMC,WAAWH,OAClB,IAAIG,WAAW,CAACF,KAAKG,IAAID,OAAAA,GAAU;IAC/BF,KAAKI,IAAIF,OAAAA;IACTN,aAAaS,KAAK;KACdR,UAAUC,OAAOR,uBAAuBG,MAAMK,EAAAA;KAC9CQ,WAAWf,yBAAyBW,OAAAA;IACxC,CAAA;GACJ;EAER;EAEA,OAAON;CACX;AACJ;AAEA,IAAaW,mBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,KAAiC;EACzC,KAAKA,MAAMA;EACX,KAAKC,YAAYD,IAAIC;CACzB;CAEAC,aAAaD,WAAyC;EAClD,KAAKA,YAAYA;CACrB;CAGAE,WAA+B;EAC3B,OAAO,KAAKH,IAAII;CACpB;CAEA,MAAMC,YAAYC,OAAqC;EACnD,IAAI,CAACA,MAAMC,QACP;EAGJ,IAAI,KAAKP,IAAIQ,SAAS,KAAKR,IAAIQ,MAAMC,UACjC,MAAM,KAAKC,cAAcJ,MAAMK,YAAYL,MAAMC,MAAM;EAG3D,MAAM,KAAKK,QAAQ/B,uBAAuBgC,SAASP,MAAMC,MAAM;CACnE;CAEA,MAAMO,YAAYR,OAAqC;EACnD,IAAI,CAACA,MAAMC,QACP;EAGJ,MAAM,KAAKG,cAAcJ,MAAMK,YAAYL,MAAMC,MAAM;EAEvD,MAAM,KAAKK,QAAQ/B,uBAAuBkC,SAAST,MAAMC,MAAM;CACnE;CAEA,MAAMS,YAAYV,OAAqC;EAInD,MAAMC,SAASD,MAAMW,kBAAkBX,MAAMC;EAC7C,IAAI,CAACA,QACD;EAGJ,MAAM,KAAKG,cAAcJ,MAAMK,YAAYJ,MAAAA;EAE3C,MAAM,KAAKK,QAAQ/B,uBAAuBqC,SAASX,MAAAA;CACvD;CAEA,MAAgBG,cAAcC,YAAwBxB,MAAyB;EAC3E,IAAI,CAAC,KAAKa,IAAIQ,SAAS,CAACG,WAAWQ,kBAC/B;EAGJ,MAAMR,WAAWQ,iBAAiBC,OAAO,KAAKpB,IAAIQ,MAAMa,KAAKlC,IAAAA,CAAAA;CACjE;CAEA,MAAgByB,QAAQN,OAAoCnB,MAAyB;EACjF,IAAI,CAAC,KAAKc,WACN;EAGJ,MAAM,KAAKA,UAAUqB,YAAY;GAC7BC,SAAS;IACLtC,MAAM,KAAKe,IAAIf;IACfqB;IACAnB;GACJ;GACAC,cAAc,KAAKY,IAAIZ,aAAaD,IAAAA;EACxC,CAAA;CACJ;AACJ"}

package/dist/adapters/http/adapters/index.mjs

@@ -2,8 +2,9 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { HTTPOAuth2Authorizer } from "./oauth2/authorization/module.mjs";
-import { extractClientCredentialsFromRequest } from "./oauth2/grant-types/utils/credentials.mjs";
+import { extractClientCredentialsFromRequest, readStringField } from "./oauth2/grant-types/utils/credentials.mjs";
 import { guessOauth2GrantTypeByRequest } from "./oauth2/grant-types/utils/guess.mjs";
+import { readRealmHint } from "./oauth2/grant-types/utils/realm.mjs";
 import { HTTPOAuth2AuthorizeGrant } from "./oauth2/grant-types/authorize.mjs";
 import { HTTPClientCredentialsGrant } from "./oauth2/grant-types/client-credentials.mjs";
 import { HTTPOAuth2IdentityGrantType } from "./oauth2/grant-types/identity.mjs";
@@ -11,4 +12,4 @@ import { HTTPPasswordGrant } from "./oauth2/grant-types/password.mjs";
 import { HTTPOAuth2RefreshTokenGrant } from "./oauth2/grant-types/refresh_token.mjs";
 import { HTTPRobotCredentialsGrant } from "./oauth2/grant-types/robot-credentials.mjs";
 import "./oauth2/index.mjs";
-export { HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, extractClientCredentialsFromRequest, guessOauth2GrantTypeByRequest };
+export { HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, extractClientCredentialsFromRequest, guessOauth2GrantTypeByRequest, readRealmHint, readStringField };

package/dist/adapters/http/adapters/oauth2/authorization/module.mjs

@@ -6,6 +6,7 @@ import { OAuth2Authorization } from "../../../../../core/oauth2/authorization/mo
 import "../../../../../core/index.mjs";
 import { useRequestIdentityOrFail } from "../../../request/helpers/identity.mjs";
 import { readFromLocations } from "../../../request/helpers/locations.mjs";
+import { useRequestSessionId } from "../../../request/helpers/session-id.mjs";
 import "../../../request/index.mjs";
 //#region src/adapters/http/adapters/oauth2/authorization/module.ts
 var HTTPOAuth2Authorizer = class extends OAuth2Authorization {
@@ -20,7 +21,7 @@ var HTTPOAuth2Authorizer = class extends OAuth2Authorization {
 		const codeRequestValidated = await this.validateWithRequest(event);
 		const { data } = await this.codeRequestVerifier.verify(codeRequestValidated);
 		const identity = useRequestIdentityOrFail(event);
-		return this.authorize(data, identity.raw);
+		return this.authorize(data, identity.raw, { sessionId: useRequestSessionId(event) });
 	}
 	/**
 	* Validate authorization request.

package/dist/adapters/http/adapters/oauth2/authorization/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2Authorization","OAuth2AuthorizationCodeRequestValidator","readFromLocations","useRequestIdentityOrFail","HTTPOAuth2Authorizer","codeRequestVerifier","requestValidator","ctx","authorizeWithRequest","event","codeRequestValidated","validateWithRequest","data","verify","identity","authorize","raw","run"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/authorization/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IAppEvent } from 'routup';\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport type { IOAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationResult } from '../../../../../core/index.ts';\nimport { OAuth2Authorization, OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';\nimport { readFromLocations, useRequestIdentityOrFail } from '../../../request/index.ts';\nimport type { HTTPOAuth2AuthorizationManagerContext } from './types.ts';\n\nexport class HTTPOAuth2Authorizer extends OAuth2Authorization {\n    protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n    protected requestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n    constructor(ctx: HTTPOAuth2AuthorizationManagerContext) {\n        super(ctx);\n\n        this.codeRequestVerifier = ctx.codeRequestVerifier;\n\n        this.requestValidator = new OAuth2AuthorizationCodeRequestValidator();\n    }\n\n    async authorizeWithRequest(event: IAppEvent) : Promise<OAuth2AuthorizationResult> {\n        const codeRequestValidated = await this.validateWithRequest(event);\n\n        const { data } = await this.codeRequestVerifier.verify(codeRequestValidated);\n\n        const identity = useRequestIdentityOrFail(event);\n\n        return this.authorize(data, identity.raw);\n    }\n\n    /**\n     * Validate authorization request.\n     *\n     * @throws OAuth2Error\n     */\n    async validateWithRequest(\n        event: IAppEvent,\n    ) : Promise<OAuth2AuthorizationCodeRequest> {\n        const data = await readFromLocations(event, ['body', 'query']);\n        return this.requestValidator.run(data);\n    }\n}\n"],"mappings":";;;;;;;;;;AAcA,IAAaI,uBAAb,cAA0CJ,oBAAAA;CAC5BK;CAEAC;CAEV,YAAYC,KAA4C;EACpD,MAAMA,GAAAA;EAEN,KAAKF,sBAAsBE,IAAIF;EAE/B,KAAKC,mBAAmB,IAAIL,wCAAAA;CAChC;CAEA,MAAMO,qBAAqBC,OAAuD;EAC9E,MAAMC,uBAAuB,MAAM,KAAKC,oBAAoBF,KAAAA;EAE5D,MAAM,EAAEG,SAAS,MAAM,KAAKP,oBAAoBQ,OAAOH,oBAAAA;EAEvD,MAAMI,WAAWX,yBAAyBM,KAAAA;EAE1C,OAAO,KAAKM,UAAUH,MAAME,SAASE,GAAG;CAC5C;;;;;IAOA,MAAML,oBACFF,OACwC;EACxC,MAAMG,OAAO,MAAMV,kBAAkBO,OAAO,CAAC,QAAQ,OAAA,CAAQ;EAC7D,OAAO,KAAKH,iBAAiBW,IAAIL,IAAAA;CACrC;AACJ"}
+{"version":3,"file":"module.mjs","names":["OAuth2Authorization","OAuth2AuthorizationCodeRequestValidator","readFromLocations","useRequestIdentityOrFail","useRequestSessionId","HTTPOAuth2Authorizer","codeRequestVerifier","requestValidator","ctx","authorizeWithRequest","event","codeRequestValidated","validateWithRequest","data","verify","identity","authorize","raw","sessionId","run"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/authorization/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IAppEvent } from 'routup';\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport type { IOAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationResult } from '../../../../../core/index.ts';\nimport { OAuth2Authorization, OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';\nimport { readFromLocations, useRequestIdentityOrFail, useRequestSessionId } from '../../../request/index.ts';\nimport type { HTTPOAuth2AuthorizationManagerContext } from './types.ts';\n\nexport class HTTPOAuth2Authorizer extends OAuth2Authorization {\n    protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n    protected requestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n    constructor(ctx: HTTPOAuth2AuthorizationManagerContext) {\n        super(ctx);\n\n        this.codeRequestVerifier = ctx.codeRequestVerifier;\n\n        this.requestValidator = new OAuth2AuthorizationCodeRequestValidator();\n    }\n\n    async authorizeWithRequest(event: IAppEvent) : Promise<OAuth2AuthorizationResult> {\n        const codeRequestValidated = await this.validateWithRequest(event);\n\n        const { data } = await this.codeRequestVerifier.verify(codeRequestValidated);\n\n        const identity = useRequestIdentityOrFail(event);\n\n        return this.authorize(data, identity.raw, { sessionId: useRequestSessionId(event) });\n    }\n\n    /**\n     * Validate authorization request.\n     *\n     * @throws OAuth2Error\n     */\n    async validateWithRequest(\n        event: IAppEvent,\n    ) : Promise<OAuth2AuthorizationCodeRequest> {\n        const data = await readFromLocations(event, ['body', 'query']);\n        return this.requestValidator.run(data);\n    }\n}\n"],"mappings":";;;;;;;;;;;AAcA,IAAaK,uBAAb,cAA0CL,oBAAAA;CAC5BM;CAEAC;CAEV,YAAYC,KAA4C;EACpD,MAAMA,GAAAA;EAEN,KAAKF,sBAAsBE,IAAIF;EAE/B,KAAKC,mBAAmB,IAAIN,wCAAAA;CAChC;CAEA,MAAMQ,qBAAqBC,OAAuD;EAC9E,MAAMC,uBAAuB,MAAM,KAAKC,oBAAoBF,KAAAA;EAE5D,MAAM,EAAEG,SAAS,MAAM,KAAKP,oBAAoBQ,OAAOH,oBAAAA;EAEvD,MAAMI,WAAWZ,yBAAyBO,KAAAA;EAE1C,OAAO,KAAKM,UAAUH,MAAME,SAASE,KAAK,EAAEC,WAAWd,oBAAoBM,KAAAA,EAAO,CAAA;CACtF;;;;;IAOA,MAAME,oBACFF,OACwC;EACxC,MAAMG,OAAO,MAAMX,kBAAkBQ,OAAO,CAAC,QAAQ,OAAA,CAAQ;EAC7D,OAAO,KAAKH,iBAAiBY,IAAIN,IAAAA;CACrC;AACJ"}

package/dist/adapters/http/adapters/oauth2/grant-types/authorize.d.ts

@@ -1,11 +1,12 @@
 import type { OAuth2TokenGrantResponse } from '@authup/specs';
 import type { IAppEvent } from 'routup';
 import { OAuth2AuthorizeGrant } from '../../../../../core/index.ts';
-import type { IOAuth2AuthorizationCodeVerifier, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';
+import type { IOAuth2AuthorizationCodeVerifier, IRealmRepository, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';
 import type { HTTPOAuth2AuthorizeGrantContext, IHTTPOAuth2Grant } from './types.ts';
 export declare class HTTPOAuth2AuthorizeGrant extends OAuth2AuthorizeGrant implements IHTTPOAuth2Grant {
     protected codeVerifier: IOAuth2AuthorizationCodeVerifier;
     protected clientAuthenticator: OAuth2ClientAuthenticator;
+    protected realmRepository: IRealmRepository;
     constructor(ctx: HTTPOAuth2AuthorizeGrantContext);
     runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse>;
     protected pickStringParam(body: Record<string, any> | undefined, query: Record<string, any> | undefined, key: string): string | undefined;

package/dist/adapters/http/adapters/oauth2/grant-types/authorize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/authorize.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAI9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EACR,gCAAgC,EAChC,yBAAyB,EAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,+BAA+B,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAGpF,qBAAa,wBAAyB,SAAQ,oBAAqB,YAAW,gBAAgB;IAC1F,SAAS,CAAC,YAAY,EAAG,gCAAgC,CAAC;IAE1D,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;gBAE9C,GAAG,EAAE,+BAA+B;IAO1C,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;IA6BzE,SAAS,CAAC,eAAe,CACrB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACrC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACtC,GAAG,EAAE,MAAM,GACZ,MAAM,GAAG,SAAS;CAIxB"}
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/authorize.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAI9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,EAAE,oBAAoB,EAA4B,MAAM,8BAA8B,CAAC;AAC9F,OAAO,KAAK,EACR,gCAAgC,EAChC,gBAAgB,EAChB,yBAAyB,EAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,+BAA+B,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAGpF,qBAAa,wBAAyB,SAAQ,oBAAqB,YAAW,gBAAgB;IAC1F,SAAS,CAAC,YAAY,EAAG,gCAAgC,CAAC;IAE1D,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;IAE1D,SAAS,CAAC,eAAe,EAAG,gBAAgB,CAAC;gBAEjC,GAAG,EAAE,+BAA+B;IAQ1C,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAgCzE,SAAS,CAAC,eAAe,CACrB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACrC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACtC,GAAG,EAAE,MAAM,GACZ,MAAM,GAAG,SAAS;CAIxB"}

package/dist/adapters/http/adapters/oauth2/grant-types/authorize.mjs

@@ -1,11 +1,13 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { assertClientGrantAllowed } from "../../../../../core/oauth2/client/grant-type.mjs";
 import { OAuth2AuthorizeGrant } from "../../../../../core/oauth2/grant-types/authorize.mjs";
 import "../../../../../core/index.mjs";
 import { extractClientCredentialsFromRequest } from "./utils/credentials.mjs";
+import { readRealmHint } from "./utils/realm.mjs";
 import "./utils/index.mjs";
-import { OAuth2RequestError } from "@authup/specs";
+import { OAuth2RequestError, OAuth2TokenGrant } from "@authup/specs";
 import { getRequestHeader, getRequestIP } from "routup";
 import { readRequestBody } from "@routup/basic/body";
 import { useRequestQuery } from "@routup/basic/query";
@@ -13,10 +15,12 @@ import { useRequestQuery } from "@routup/basic/query";
 var HTTPOAuth2AuthorizeGrant = class extends OAuth2AuthorizeGrant {
 	codeVerifier;
 	clientAuthenticator;
+	realmRepository;
 	constructor(ctx) {
 		super(ctx);
 		this.codeVerifier = ctx.codeVerifier;
 		this.clientAuthenticator = ctx.clientAuthenticator;
+		this.realmRepository = ctx.realmRepository;
 	}
 	async runWithRequest(event) {
 		const body = await readRequestBody(event);
@@ -26,13 +30,15 @@ var HTTPOAuth2AuthorizeGrant = class extends OAuth2AuthorizeGrant {
 		const codeVerifier = this.pickStringParam(body, query, "code_verifier");
 		if (!code) throw OAuth2RequestError.malformed();
 		const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);
-		const realmId = this.pickStringParam(body, query, "realm_id");
-		const client = await this.clientAuthenticator.authenticate(clientId, clientSecret, realmId);
+		const realm = await this.realmRepository.resolve(readRealmHint(body, query), true);
+		const client = await this.clientAuthenticator.authenticate(clientId, clientSecret, realm.id);
+		assertClientGrantAllowed(client, OAuth2TokenGrant.AUTHORIZATION_CODE);
 		const entity = await this.codeVerifier.verify(code, {
 			redirectUri,
 			codeVerifier,
 			clientId: client.id,
-			clientIsPublic: !client.is_confidential
+			clientIsPublic: !client.is_confidential,
+			realmId: client.realm_id
 		});
 		return this.runWith(entity, {
 			ipAddress: getRequestIP(event, { trustProxy: true }) ?? void 0,

package/dist/adapters/http/adapters/oauth2/grant-types/authorize.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.mjs","names":["OAuth2RequestError","readRequestBody","useRequestQuery","getRequestHeader","getRequestIP","OAuth2AuthorizeGrant","extractClientCredentialsFromRequest","HTTPOAuth2AuthorizeGrant","codeVerifier","clientAuthenticator","ctx","runWithRequest","event","body","query","code","pickStringParam","redirectUri","malformed","clientId","clientSecret","realmId","client","authenticate","entity","verify","id","clientIsPublic","is_confidential","runWith","ipAddress","trustProxy","undefined","userAgent","key","value","length"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/authorize.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2RequestError } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport { OAuth2AuthorizeGrant } from '../../../../../core/index.ts';\nimport type {\n    IOAuth2AuthorizationCodeVerifier,\n    OAuth2ClientAuthenticator,\n} from '../../../../../core/index.ts';\nimport type { HTTPOAuth2AuthorizeGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport { extractClientCredentialsFromRequest } from './utils/index.ts';\n\nexport class HTTPOAuth2AuthorizeGrant extends OAuth2AuthorizeGrant implements IHTTPOAuth2Grant {\n    protected codeVerifier : IOAuth2AuthorizationCodeVerifier;\n\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    constructor(ctx: HTTPOAuth2AuthorizeGrantContext) {\n        super(ctx);\n\n        this.codeVerifier = ctx.codeVerifier;\n        this.clientAuthenticator = ctx.clientAuthenticator;\n    }\n\n    async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const body = await readRequestBody(event);\n        const query = useRequestQuery(event);\n\n        const code = this.pickStringParam(body, query, 'code');\n        const redirectUri = this.pickStringParam(body, query, 'redirect_uri');\n        const codeVerifier = this.pickStringParam(body, query, 'code_verifier');\n        if (!code) {\n            throw OAuth2RequestError.malformed();\n        }\n\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n        const realmId = this.pickStringParam(body, query, 'realm_id');\n\n        const client = await this.clientAuthenticator.authenticate(clientId, clientSecret, realmId);\n\n        const entity = await this.codeVerifier.verify(code, {\n            redirectUri,\n            codeVerifier,\n            clientId: client.id,\n            clientIsPublic: !client.is_confidential,\n        });\n\n        return this.runWith(entity, {\n            ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n\n    protected pickStringParam(\n        body: Record<string, any> | undefined,\n        query: Record<string, any> | undefined,\n        key: string,\n    ): string | undefined {\n        const value = body?.[key] ?? query?.[key];\n        return typeof value === 'string' && value.length > 0 ? value : undefined;\n    }\n}\n"],"mappings":";;;;;;;;;;;;AAqBA,IAAaO,2BAAb,cAA8CF,qBAAAA;CAChCG;CAEAC;CAEV,YAAYC,KAAsC;EAC9C,MAAMA,GAAAA;EAEN,KAAKF,eAAeE,IAAIF;EACxB,KAAKC,sBAAsBC,IAAID;CACnC;CAEA,MAAME,eAAeC,OAAqD;EACtE,MAAMC,OAAO,MAAMZ,gBAAgBW,KAAAA;EACnC,MAAME,QAAQZ,gBAAgBU,KAAAA;EAE9B,MAAMG,OAAO,KAAKC,gBAAgBH,MAAMC,OAAO,MAAA;EAC/C,MAAMG,cAAc,KAAKD,gBAAgBH,MAAMC,OAAO,cAAA;EACtD,MAAMN,eAAe,KAAKQ,gBAAgBH,MAAMC,OAAO,eAAA;EACvD,IAAI,CAACC,MACD,MAAMf,mBAAmBkB,UAAS;EAGtC,MAAM,EAAEC,UAAUC,iBAAiB,MAAMd,oCAAoCM,KAAAA;EAC7E,MAAMS,UAAU,KAAKL,gBAAgBH,MAAMC,OAAO,UAAA;EAElD,MAAMQ,SAAS,MAAM,KAAKb,oBAAoBc,aAAaJ,UAAUC,cAAcC,OAAAA;EAEnF,MAAMG,SAAS,MAAM,KAAKhB,aAAaiB,OAAOV,MAAM;GAChDE;GACAT;GACAW,UAAUG,OAAOI;GACjBC,gBAAgB,CAACL,OAAOM;EAC5B,CAAA;EAEA,OAAO,KAAKC,QAAQL,QAAQ;GACxBM,WAAW1B,aAAaQ,OAAO,EAAEmB,YAAY,KAAK,CAAA,KAAMC,KAAAA;GACxDC,WAAW9B,iBAAiBS,OAAO,YAAA,KAAiBoB,KAAAA;EACxD,CAAA;CACJ;CAEUhB,gBACNH,MACAC,OACAoB,KACkB;EAClB,MAAMC,QAAQtB,OAAOqB,QAAQpB,QAAQoB;EACrC,OAAO,OAAOC,UAAU,YAAYA,MAAMC,SAAS,IAAID,QAAQH,KAAAA;CACnE;AACJ"}
+{"version":3,"file":"authorize.mjs","names":["OAuth2RequestError","OAuth2TokenGrant","readRequestBody","useRequestQuery","getRequestHeader","getRequestIP","OAuth2AuthorizeGrant","assertClientGrantAllowed","extractClientCredentialsFromRequest","readRealmHint","HTTPOAuth2AuthorizeGrant","codeVerifier","clientAuthenticator","realmRepository","ctx","runWithRequest","event","body","query","code","pickStringParam","redirectUri","malformed","clientId","clientSecret","realm","resolve","client","authenticate","id","AUTHORIZATION_CODE","entity","verify","clientIsPublic","is_confidential","realmId","realm_id","runWith","ipAddress","trustProxy","undefined","userAgent","key","value","length"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/authorize.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport { OAuth2AuthorizeGrant, assertClientGrantAllowed } from '../../../../../core/index.ts';\nimport type {\n    IOAuth2AuthorizationCodeVerifier,\n    IRealmRepository,\n    OAuth2ClientAuthenticator,\n} from '../../../../../core/index.ts';\nimport type { HTTPOAuth2AuthorizeGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport { extractClientCredentialsFromRequest, readRealmHint } from './utils/index.ts';\n\nexport class HTTPOAuth2AuthorizeGrant extends OAuth2AuthorizeGrant implements IHTTPOAuth2Grant {\n    protected codeVerifier : IOAuth2AuthorizationCodeVerifier;\n\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    protected realmRepository : IRealmRepository;\n\n    constructor(ctx: HTTPOAuth2AuthorizeGrantContext) {\n        super(ctx);\n\n        this.codeVerifier = ctx.codeVerifier;\n        this.clientAuthenticator = ctx.clientAuthenticator;\n        this.realmRepository = ctx.realmRepository;\n    }\n\n    async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const body = await readRequestBody(event);\n        const query = useRequestQuery(event);\n\n        const code = this.pickStringParam(body, query, 'code');\n        const redirectUri = this.pickStringParam(body, query, 'redirect_uri');\n        const codeVerifier = this.pickStringParam(body, query, 'code_verifier');\n        if (!code) {\n            throw OAuth2RequestError.malformed();\n        }\n\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n        const realm = await this.realmRepository.resolve(readRealmHint(body, query), true);\n\n        const client = await this.clientAuthenticator.authenticate(clientId, clientSecret, realm.id);\n\n        assertClientGrantAllowed(client, OAuth2TokenGrant.AUTHORIZATION_CODE);\n\n        const entity = await this.codeVerifier.verify(code, {\n            redirectUri,\n            codeVerifier,\n            clientId: client.id,\n            clientIsPublic: !client.is_confidential,\n            realmId: client.realm_id,\n        });\n\n        return this.runWith(entity, {\n            ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n\n    protected pickStringParam(\n        body: Record<string, any> | undefined,\n        query: Record<string, any> | undefined,\n        key: string,\n    ): string | undefined {\n        const value = body?.[key] ?? query?.[key];\n        return typeof value === 'string' && value.length > 0 ? value : undefined;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;AAsBA,IAAaU,2BAAb,cAA8CJ,qBAAAA;CAChCK;CAEAC;CAEAC;CAEV,YAAYC,KAAsC;EAC9C,MAAMA,GAAAA;EAEN,KAAKH,eAAeG,IAAIH;EACxB,KAAKC,sBAAsBE,IAAIF;EAC/B,KAAKC,kBAAkBC,IAAID;CAC/B;CAEA,MAAME,eAAeC,OAAqD;EACtE,MAAMC,OAAO,MAAMf,gBAAgBc,KAAAA;EACnC,MAAME,QAAQf,gBAAgBa,KAAAA;EAE9B,MAAMG,OAAO,KAAKC,gBAAgBH,MAAMC,OAAO,MAAA;EAC/C,MAAMG,cAAc,KAAKD,gBAAgBH,MAAMC,OAAO,cAAA;EACtD,MAAMP,eAAe,KAAKS,gBAAgBH,MAAMC,OAAO,eAAA;EACvD,IAAI,CAACC,MACD,MAAMnB,mBAAmBsB,UAAS;EAGtC,MAAM,EAAEC,UAAUC,iBAAiB,MAAMhB,oCAAoCQ,KAAAA;EAC7E,MAAMS,QAAQ,MAAM,KAAKZ,gBAAgBa,QAAQjB,cAAcQ,MAAMC,KAAAA,GAAQ,IAAA;EAE7E,MAAMS,SAAS,MAAM,KAAKf,oBAAoBgB,aAAaL,UAAUC,cAAcC,MAAMI,EAAE;EAE3FtB,yBAAyBoB,QAAQ1B,iBAAiB6B,kBAAkB;EAEpE,MAAMC,SAAS,MAAM,KAAKpB,aAAaqB,OAAOb,MAAM;GAChDE;GACAV;GACAY,UAAUI,OAAOE;GACjBI,gBAAgB,CAACN,OAAOO;GACxBC,SAASR,OAAOS;EACpB,CAAA;EAEA,OAAO,KAAKC,QAAQN,QAAQ;GACxBO,WAAWjC,aAAaW,OAAO,EAAEuB,YAAY,KAAK,CAAA,KAAMC,KAAAA;GACxDC,WAAWrC,iBAAiBY,OAAO,YAAA,KAAiBwB,KAAAA;EACxD,CAAA;CACJ;CAEUpB,gBACNH,MACAC,OACAwB,KACkB;EAClB,MAAMC,QAAQ1B,OAAOyB,QAAQxB,QAAQwB;EACrC,OAAO,OAAOC,UAAU,YAAYA,MAAMC,SAAS,IAAID,QAAQH,KAAAA;CACnE;AACJ"}

package/dist/adapters/http/adapters/oauth2/grant-types/client-credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-credentials.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/client-credentials.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAE9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,KAAK,EAAE,uCAAuC,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAG5F,qBAAa,0BAA2B,SAAQ,sBAAuB,YAAW,gBAAgB;IAC9F,SAAS,CAAC,aAAa,EAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;gBAEhD,GAAG,EAAE,uCAAuC;IAMlD,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAgB5E"}
+{"version":3,"file":"client-credentials.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/client-credentials.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAG9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,sBAAsB,EAA4B,MAAM,8BAA8B,CAAC;AAChG,OAAO,KAAK,EAAE,uCAAuC,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAG5F,qBAAa,0BAA2B,SAAQ,sBAAuB,YAAW,gBAAgB;IAC9F,SAAS,CAAC,aAAa,EAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;gBAEhD,GAAG,EAAE,uCAAuC;IAMlD,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAkB5E"}

package/dist/adapters/http/adapters/oauth2/grant-types/client-credentials.mjs

@@ -1,11 +1,13 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { assertClientGrantAllowed } from "../../../../../core/oauth2/client/grant-type.mjs";
 import { ClientCredentialsGrant } from "../../../../../core/oauth2/grant-types/client-credentials.mjs";
 import "../../../../../core/index.mjs";
 import { extractClientCredentialsFromRequest } from "./utils/credentials.mjs";
 import "./utils/index.mjs";
 import { EntityCredentialsInvalidError } from "@authup/errors";
+import { OAuth2TokenGrant } from "@authup/specs";
 import { getRequestHeader, getRequestIP } from "routup";
 import { readRequestBody } from "@routup/basic/body";
 //#region src/adapters/http/adapters/oauth2/grant-types/client-credentials.ts
@@ -20,6 +22,7 @@ var HTTPClientCredentialsGrant = class extends ClientCredentialsGrant {
 		const realmId = (await readRequestBody(event))?.realm_id;
 		if (!clientId) throw new EntityCredentialsInvalidError({ entity: "client" });
 		const client = await this.authenticator.authenticate(clientId, clientSecret ?? "", realmId);
+		assertClientGrantAllowed(client, OAuth2TokenGrant.CLIENT_CREDENTIALS);
 		return this.runWith(client, {
 			ipAddress: getRequestIP(event, { trustProxy: true }) ?? void 0,
 			userAgent: getRequestHeader(event, "user-agent") ?? void 0

package/dist/adapters/http/adapters/oauth2/grant-types/client-credentials.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"client-credentials.mjs","names":["readRequestBody","EntityCredentialsInvalidError","getRequestHeader","getRequestIP","ClientCredentialsGrant","extractClientCredentialsFromRequest","HTTPClientCredentialsGrant","authenticator","ctx","runWithRequest","event","clientId","clientSecret","body","realmId","realm_id","entity","client","authenticate","runWith","ipAddress","trustProxy","undefined","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/client-credentials.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport type { Client } from '@authup/core-kit';\nimport { EntityCredentialsInvalidError } from '@authup/errors';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type { ICredentialsAuthenticator } from '../../../../../core/index.ts';\nimport { ClientCredentialsGrant } from '../../../../../core/index.ts';\nimport type { HTTPOAuth2ClientCredentialsGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport { extractClientCredentialsFromRequest } from './utils/index.ts';\n\nexport class HTTPClientCredentialsGrant extends ClientCredentialsGrant implements IHTTPOAuth2Grant {\n    protected authenticator : ICredentialsAuthenticator<Client>;\n\n    constructor(ctx: HTTPOAuth2ClientCredentialsGrantContext) {\n        super(ctx);\n\n        this.authenticator = ctx.authenticator;\n    }\n\n    async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n        const body = await readRequestBody(event);\n        const realmId = body?.realm_id;\n\n        if (!clientId) {\n            throw new EntityCredentialsInvalidError({ entity: 'client' });\n        }\n\n        const client = await this.authenticator.authenticate(clientId, clientSecret ?? '', realmId);\n\n        return this.runWith(client, {\n            ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;AAkBA,IAAaM,6BAAb,cAAgDF,uBAAAA;CAClCG;CAEV,YAAYC,KAA8C;EACtD,MAAMA,GAAAA;EAEN,KAAKD,gBAAgBC,IAAID;CAC7B;CAEA,MAAME,eAAeC,OAAqD;EACtE,MAAM,EAAEC,UAAUC,iBAAiB,MAAMP,oCAAoCK,KAAAA;EAE7E,MAAMI,WAAUD,MADGb,gBAAgBU,KAAAA,EAAAA,EACbK;EAEtB,IAAI,CAACJ,UACD,MAAM,IAAIV,8BAA8B,EAAEe,QAAQ,SAAS,CAAA;EAG/D,MAAMC,SAAS,MAAM,KAAKV,cAAcW,aAAaP,UAAUC,gBAAgB,IAAIE,OAAAA;EAEnF,OAAO,KAAKK,QAAQF,QAAQ;GACxBG,WAAWjB,aAAaO,OAAO,EAAEW,YAAY,KAAK,CAAA,KAAMC,KAAAA;GACxDC,WAAWrB,iBAAiBQ,OAAO,YAAA,KAAiBY,KAAAA;EACxD,CAAA;CACJ;AACJ"}
+{"version":3,"file":"client-credentials.mjs","names":["OAuth2TokenGrant","readRequestBody","EntityCredentialsInvalidError","getRequestHeader","getRequestIP","ClientCredentialsGrant","assertClientGrantAllowed","extractClientCredentialsFromRequest","HTTPClientCredentialsGrant","authenticator","ctx","runWithRequest","event","clientId","clientSecret","body","realmId","realm_id","entity","client","authenticate","CLIENT_CREDENTIALS","runWith","ipAddress","trustProxy","undefined","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/client-credentials.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2TokenGrant } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport type { Client } from '@authup/core-kit';\nimport { EntityCredentialsInvalidError } from '@authup/errors';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type { ICredentialsAuthenticator } from '../../../../../core/index.ts';\nimport { ClientCredentialsGrant, assertClientGrantAllowed } from '../../../../../core/index.ts';\nimport type { HTTPOAuth2ClientCredentialsGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport { extractClientCredentialsFromRequest } from './utils/index.ts';\n\nexport class HTTPClientCredentialsGrant extends ClientCredentialsGrant implements IHTTPOAuth2Grant {\n    protected authenticator : ICredentialsAuthenticator<Client>;\n\n    constructor(ctx: HTTPOAuth2ClientCredentialsGrantContext) {\n        super(ctx);\n\n        this.authenticator = ctx.authenticator;\n    }\n\n    async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n        const body = await readRequestBody(event);\n        const realmId = body?.realm_id;\n\n        if (!clientId) {\n            throw new EntityCredentialsInvalidError({ entity: 'client' });\n        }\n\n        const client = await this.authenticator.authenticate(clientId, clientSecret ?? '', realmId);\n\n        assertClientGrantAllowed(client, OAuth2TokenGrant.CLIENT_CREDENTIALS);\n\n        return this.runWith(client, {\n            ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AAmBA,IAAaQ,6BAAb,cAAgDH,uBAAAA;CAClCI;CAEV,YAAYC,KAA8C;EACtD,MAAMA,GAAAA;EAEN,KAAKD,gBAAgBC,IAAID;CAC7B;CAEA,MAAME,eAAeC,OAAqD;EACtE,MAAM,EAAEC,UAAUC,iBAAiB,MAAMP,oCAAoCK,KAAAA;EAE7E,MAAMI,WAAUD,MADGd,gBAAgBW,KAAAA,EAAAA,EACbK;EAEtB,IAAI,CAACJ,UACD,MAAM,IAAIX,8BAA8B,EAAEgB,QAAQ,SAAS,CAAA;EAG/D,MAAMC,SAAS,MAAM,KAAKV,cAAcW,aAAaP,UAAUC,gBAAgB,IAAIE,OAAAA;EAEnFV,yBAAyBa,QAAQnB,iBAAiBqB,kBAAkB;EAEpE,OAAO,KAAKC,QAAQH,QAAQ;GACxBI,WAAWnB,aAAaQ,OAAO,EAAEY,YAAY,KAAK,CAAA,KAAMC,KAAAA;GACxDC,WAAWvB,iBAAiBS,OAAO,YAAA,KAAiBa,KAAAA;EACxD,CAAA;CACJ;AACJ"}

package/dist/adapters/http/adapters/oauth2/grant-types/index.mjs

@@ -1,8 +1,9 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { extractClientCredentialsFromRequest } from "./utils/credentials.mjs";
+import { extractClientCredentialsFromRequest, readStringField } from "./utils/credentials.mjs";
 import { guessOauth2GrantTypeByRequest } from "./utils/guess.mjs";
+import { readRealmHint } from "./utils/realm.mjs";
 import "./utils/index.mjs";
 import { HTTPOAuth2AuthorizeGrant } from "./authorize.mjs";
 import { HTTPClientCredentialsGrant } from "./client-credentials.mjs";
@@ -10,4 +11,4 @@ import { HTTPOAuth2IdentityGrantType } from "./identity.mjs";
 import { HTTPPasswordGrant } from "./password.mjs";
 import { HTTPOAuth2RefreshTokenGrant } from "./refresh_token.mjs";
 import { HTTPRobotCredentialsGrant } from "./robot-credentials.mjs";
-export { HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, extractClientCredentialsFromRequest, guessOauth2GrantTypeByRequest };
+export { HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, extractClientCredentialsFromRequest, guessOauth2GrantTypeByRequest, readRealmHint, readStringField };

package/dist/adapters/http/adapters/oauth2/grant-types/password.d.ts

@@ -1,12 +1,13 @@
 import type { User } from '@authup/core-kit';
 import type { OAuth2TokenGrantResponse } from '@authup/specs';
 import type { IAppEvent } from 'routup';
-import type { ICredentialsAuthenticator, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';
+import type { ICredentialsAuthenticator, IRealmRepository, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';
 import { PasswordGrantType } from '../../../../../core/index.ts';
 import type { HTTPOAuth2PasswordGrantContext, IHTTPOAuth2Grant } from './types.ts';
 export declare class HTTPPasswordGrant extends PasswordGrantType implements IHTTPOAuth2Grant {
     protected authenticator: ICredentialsAuthenticator<User>;
     protected clientAuthenticator: OAuth2ClientAuthenticator;
+    protected realmRepository: IRealmRepository;
     constructor(ctx: HTTPOAuth2PasswordGrantContext);
     runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse>;
 }

package/dist/adapters/http/adapters/oauth2/grant-types/password.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/password.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAE9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACzG,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAE,8BAA8B,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAGnF,qBAAa,iBAAkB,SAAQ,iBAAkB,YAAW,gBAAgB;IAChF,SAAS,CAAC,aAAa,EAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAE1D,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;gBAE9C,GAAG,EAAE,8BAA8B;IAOzC,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;CA4B5E"}
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/password.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAG9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAC3H,OAAO,EAAE,iBAAiB,EAA4B,MAAM,8BAA8B,CAAC;AAC3F,OAAO,KAAK,EAAE,8BAA8B,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAGnF,qBAAa,iBAAkB,SAAQ,iBAAkB,YAAW,gBAAgB;IAChF,SAAS,CAAC,aAAa,EAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAE1D,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;IAE1D,SAAS,CAAC,eAAe,EAAG,gBAAgB,CAAC;gBAEjC,GAAG,EAAE,8BAA8B;IAQzC,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAmC5E"}

package/dist/adapters/http/adapters/oauth2/grant-types/password.mjs

@@ -1,26 +1,36 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { assertClientGrantAllowed } from "../../../../../core/oauth2/client/grant-type.mjs";
 import { PasswordGrantType } from "../../../../../core/oauth2/grant-types/password.mjs";
 import "../../../../../core/index.mjs";
-import { extractClientCredentialsFromRequest } from "./utils/credentials.mjs";
+import { extractClientCredentialsFromRequest, readStringField } from "./utils/credentials.mjs";
+import { readRealmHint } from "./utils/realm.mjs";
 import "./utils/index.mjs";
+import { OAuth2RequestError, OAuth2TokenGrant } from "@authup/specs";
 import { getRequestHeader, getRequestIP } from "routup";
 import { readRequestBody } from "@routup/basic/body";
 //#region src/adapters/http/adapters/oauth2/grant-types/password.ts
 var HTTPPasswordGrant = class extends PasswordGrantType {
 	authenticator;
 	clientAuthenticator;
+	realmRepository;
 	constructor(ctx) {
 		super(ctx);
 		this.authenticator = ctx.authenticator;
 		this.clientAuthenticator = ctx.clientAuthenticator;
+		this.realmRepository = ctx.realmRepository;
 	}
 	async runWithRequest(event) {
-		const { username, password, realm_id: realmId } = await readRequestBody(event) || {};
+		const body = await readRequestBody(event);
+		const username = readStringField(body, "username");
+		const password = readStringField(body, "password");
+		if (!username || !password) throw OAuth2RequestError.malformed("username and password must be provided.");
 		const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);
-		const client = clientId ? await this.clientAuthenticator.authenticate(clientId, clientSecret, typeof realmId === "string" ? realmId : void 0) : void 0;
-		const user = await this.authenticator.authenticate(username, password, realmId);
+		const realm = await this.realmRepository.resolve(readRealmHint(body), true);
+		const client = clientId ? await this.clientAuthenticator.authenticate(clientId, clientSecret, realm.id) : void 0;
+		if (client) assertClientGrantAllowed(client, OAuth2TokenGrant.PASSWORD);
+		const user = await this.authenticator.authenticate(username, password, realm.id);
 		return this.runWith({
 			user,
 			client

package/dist/adapters/http/adapters/oauth2/grant-types/password.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"password.mjs","names":["readRequestBody","getRequestHeader","getRequestIP","PasswordGrantType","extractClientCredentialsFromRequest","HTTPPasswordGrant","authenticator","clientAuthenticator","ctx","runWithRequest","event","body","username","password","realm_id","realmId","clientId","clientSecret","client","authenticate","undefined","user","runWith","ipAddress","trustProxy","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/password.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { User } from '@authup/core-kit';\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type { ICredentialsAuthenticator, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';\nimport { PasswordGrantType } from '../../../../../core/index.ts';\nimport type { HTTPOAuth2PasswordGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport { extractClientCredentialsFromRequest } from './utils/index.ts';\n\nexport class HTTPPasswordGrant extends PasswordGrantType implements IHTTPOAuth2Grant {\n    protected authenticator : ICredentialsAuthenticator<User>;\n\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    constructor(ctx: HTTPOAuth2PasswordGrantContext) {\n        super(ctx);\n\n        this.authenticator = ctx.authenticator;\n        this.clientAuthenticator = ctx.clientAuthenticator;\n    }\n\n    async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const body = await readRequestBody(event);\n        const {\n            username,\n            password,\n            realm_id: realmId,\n        } = body || {};\n\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n\n        const client = clientId ?\n            await this.clientAuthenticator.authenticate(\n                clientId,\n                clientSecret,\n                typeof realmId === 'string' ? realmId : undefined,\n            ) :\n            undefined;\n\n        const user = await this.authenticator.authenticate(username, password, realmId);\n\n        return this.runWith(\n            { user, client },\n            {\n                ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n                userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n            },\n        );\n    }\n}\n"],"mappings":";;;;;;;;;;AAiBA,IAAaK,oBAAb,cAAuCF,kBAAAA;CACzBG;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAMA,GAAAA;EAEN,KAAKF,gBAAgBE,IAAIF;EACzB,KAAKC,sBAAsBC,IAAID;CACnC;CAEA,MAAME,eAAeC,OAAqD;EAEtE,MAAM,EACFE,UACAC,UACAC,UAAUC,YACVJ,MALeX,gBAAgBU,KAAAA,KAKvB,CAAC;EAEb,MAAM,EAAEM,UAAUC,iBAAiB,MAAMb,oCAAoCM,KAAAA;EAE7E,MAAMQ,SAASF,WACX,MAAM,KAAKT,oBAAoBY,aAC3BH,UACAC,cACA,OAAOF,YAAY,WAAWA,UAAUK,KAAAA,CAAAA,IAE5CA,KAAAA;EAEJ,MAAMC,OAAO,MAAM,KAAKf,cAAca,aAAaP,UAAUC,UAAUE,OAAAA;EAEvE,OAAO,KAAKO,QACR;GAAED;GAAMH;EAAO,GACf;GACIK,WAAWrB,aAAaQ,OAAO,EAAEc,YAAY,KAAK,CAAA,KAAMJ,KAAAA;GACxDK,WAAWxB,iBAAiBS,OAAO,YAAA,KAAiBU,KAAAA;EACxD,CAAA;CAER;AACJ"}
+{"version":3,"file":"password.mjs","names":["OAuth2RequestError","OAuth2TokenGrant","readRequestBody","getRequestHeader","getRequestIP","PasswordGrantType","assertClientGrantAllowed","extractClientCredentialsFromRequest","readRealmHint","readStringField","HTTPPasswordGrant","authenticator","clientAuthenticator","realmRepository","ctx","runWithRequest","event","body","username","password","malformed","clientId","clientSecret","realm","resolve","client","authenticate","id","undefined","PASSWORD","user","runWith","ipAddress","trustProxy","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/password.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { User } from '@authup/core-kit';\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type { ICredentialsAuthenticator, IRealmRepository, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';\nimport { PasswordGrantType, assertClientGrantAllowed } from '../../../../../core/index.ts';\nimport type { HTTPOAuth2PasswordGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport { extractClientCredentialsFromRequest, readRealmHint, readStringField } from './utils/index.ts';\n\nexport class HTTPPasswordGrant extends PasswordGrantType implements IHTTPOAuth2Grant {\n    protected authenticator : ICredentialsAuthenticator<User>;\n\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    protected realmRepository : IRealmRepository;\n\n    constructor(ctx: HTTPOAuth2PasswordGrantContext) {\n        super(ctx);\n\n        this.authenticator = ctx.authenticator;\n        this.clientAuthenticator = ctx.clientAuthenticator;\n        this.realmRepository = ctx.realmRepository;\n    }\n\n    async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const body = await readRequestBody(event);\n\n        const username = readStringField(body, 'username');\n        const password = readStringField(body, 'password');\n        if (!username || !password) {\n            throw OAuth2RequestError.malformed('username and password must be provided.');\n        }\n\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n\n        const realm = await this.realmRepository.resolve(readRealmHint(body), true);\n\n        const client = clientId ?\n            await this.clientAuthenticator.authenticate(\n                clientId,\n                clientSecret,\n                realm.id,\n            ) :\n            undefined;\n\n        if (client) {\n            assertClientGrantAllowed(client, OAuth2TokenGrant.PASSWORD);\n        }\n\n        const user = await this.authenticator.authenticate(username, password, realm.id);\n\n        return this.runWith(\n            { user, client },\n            {\n                ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n                userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n            },\n        );\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AAkBA,IAAaU,oBAAb,cAAuCL,kBAAAA;CACzBM;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAMA,GAAAA;EAEN,KAAKH,gBAAgBG,IAAIH;EACzB,KAAKC,sBAAsBE,IAAIF;EAC/B,KAAKC,kBAAkBC,IAAID;CAC/B;CAEA,MAAME,eAAeC,OAAqD;EACtE,MAAMC,OAAO,MAAMf,gBAAgBc,KAAAA;EAEnC,MAAME,WAAWT,gBAAgBQ,MAAM,UAAA;EACvC,MAAME,WAAWV,gBAAgBQ,MAAM,UAAA;EACvC,IAAI,CAACC,YAAY,CAACC,UACd,MAAMnB,mBAAmBoB,UAAU,yCAAA;EAGvC,MAAM,EAAEC,UAAUC,iBAAiB,MAAMf,oCAAoCS,KAAAA;EAE7E,MAAMO,QAAQ,MAAM,KAAKV,gBAAgBW,QAAQhB,cAAcS,IAAAA,GAAO,IAAA;EAEtE,MAAMQ,SAASJ,WACX,MAAM,KAAKT,oBAAoBc,aAC3BL,UACAC,cACAC,MAAMI,EAAE,IAEZC,KAAAA;EAEJ,IAAIH,QACAnB,yBAAyBmB,QAAQxB,iBAAiB4B,QAAQ;EAG9D,MAAMC,OAAO,MAAM,KAAKnB,cAAce,aAAaR,UAAUC,UAAUI,MAAMI,EAAE;EAE/E,OAAO,KAAKI,QACR;GAAED;GAAML;EAAO,GACf;GACIO,WAAW5B,aAAaY,OAAO,EAAEiB,YAAY,KAAK,CAAA,KAAML,KAAAA;GACxDM,WAAW/B,iBAAiBa,OAAO,YAAA,KAAiBY,KAAAA;EACxD,CAAA;CAER;AACJ"}

package/dist/adapters/http/adapters/oauth2/grant-types/refresh_token.d.ts

@@ -1,11 +1,12 @@
 import type { OAuth2TokenGrantResponse } from '@authup/specs';
 import type { IAppEvent } from 'routup';
 import { OAuth2RefreshTokenGrant } from '../../../../../core/index.ts';
-import type { IOAuth2TokenVerifier, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';
+import type { IOAuth2TokenVerifier, IRealmRepository, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';
 import type { HTTPOAuth2RefreshTokenGrantContext, IHTTPOAuth2Grant } from './types.ts';
 export declare class HTTPOAuth2RefreshTokenGrant extends OAuth2RefreshTokenGrant implements IHTTPOAuth2Grant {
     protected clientAuthenticator: OAuth2ClientAuthenticator;
     protected refreshTokenVerifier: IOAuth2TokenVerifier;
+    protected realmRepository: IRealmRepository;
     constructor(ctx: HTTPOAuth2RefreshTokenGrantContext);
     runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse>;
 }

package/dist/adapters/http/adapters/oauth2/grant-types/refresh_token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refresh_token.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/refresh_token.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAG9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,KAAK,EACR,oBAAoB,EACpB,yBAAyB,EAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,kCAAkC,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAGvF,qBAAa,2BAA4B,SAAQ,uBAAwB,YAAW,gBAAgB;IAChG,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;IAE1D,SAAS,CAAC,oBAAoB,EAAG,oBAAoB,CAAC;gBAE1C,GAAG,EAAE,kCAAkC;IAO7C,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAqC5E"}
+{"version":3,"file":"refresh_token.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/refresh_token.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAG9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,EAAE,uBAAuB,EAA4B,MAAM,8BAA8B,CAAC;AACjG,OAAO,KAAK,EACR,oBAAoB,EACpB,gBAAgB,EAChB,yBAAyB,EAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,kCAAkC,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAGvF,qBAAa,2BAA4B,SAAQ,uBAAwB,YAAW,gBAAgB;IAChG,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;IAE1D,SAAS,CAAC,oBAAoB,EAAG,oBAAoB,CAAC;IAEtD,SAAS,CAAC,eAAe,EAAG,gBAAgB,CAAC;gBAEjC,GAAG,EAAE,kCAAkC;IAQ7C,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;CA2E5E"}

package/dist/adapters/http/adapters/oauth2/grant-types/refresh_token.mjs

@@ -1,33 +1,40 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { assertClientGrantAllowed } from "../../../../../core/oauth2/client/grant-type.mjs";
 import { OAuth2RefreshTokenGrant } from "../../../../../core/oauth2/grant-types/refresh-token.mjs";
 import "../../../../../core/index.mjs";
 import { extractClientCredentialsFromRequest } from "./utils/credentials.mjs";
+import { readRealmHint } from "./utils/realm.mjs";
 import "./utils/index.mjs";
-import { OAuth2ClientError, OAuth2GrantError, OAuth2RequestError } from "@authup/specs";
+import { OAuth2GrantError, OAuth2RequestError, OAuth2TokenGrant } from "@authup/specs";
 import { getRequestHeader, getRequestIP } from "routup";
 import { readRequestBody } from "@routup/basic/body";
 //#region src/adapters/http/adapters/oauth2/grant-types/refresh_token.ts
 var HTTPOAuth2RefreshTokenGrant = class extends OAuth2RefreshTokenGrant {
 	clientAuthenticator;
 	refreshTokenVerifier;
+	realmRepository;
 	constructor(ctx) {
 		super(ctx);
 		this.clientAuthenticator = ctx.clientAuthenticator;
 		this.refreshTokenVerifier = ctx.tokenVerifier;
+		this.realmRepository = ctx.realmRepository;
 	}
 	async runWithRequest(event) {
 		const body = await readRequestBody(event);
 		const refreshToken = body?.refresh_token;
 		if (typeof refreshToken !== "string" || refreshToken.length === 0) throw OAuth2RequestError.malformed();
 		const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);
-		const realmId = body?.realm_id;
-		const payload = await this.refreshTokenVerifier.verify(refreshToken);
+		const payload = await this.refreshTokenVerifier.verify(refreshToken, { skipActiveCheck: true });
+		let client;
 		if (clientId) {
-			const client = await this.clientAuthenticator.authenticate(clientId, clientSecret, typeof realmId === "string" ? realmId : void 0);
+			const realm = await this.realmRepository.resolve(readRealmHint(body), true);
+			client = await this.clientAuthenticator.authenticate(clientId, clientSecret, realm.id);
 			if (payload.client_id && payload.client_id !== client.id) throw OAuth2GrantError.invalid();
-		} else if (payload.client_id) throw OAuth2ClientError.invalid();
+		} else if (payload.client_id) client = await this.clientAuthenticator.authenticate(payload.client_id);
+		if (client) assertClientGrantAllowed(client, OAuth2TokenGrant.REFRESH_TOKEN);
+		if (client && !client.is_confidential && payload.realm_id && payload.realm_id !== client.realm_id) throw OAuth2GrantError.invalid();
 		return this.runWith(payload, {
 			ipAddress: getRequestIP(event, { trustProxy: true }) ?? void 0,
 			userAgent: getRequestHeader(event, "user-agent") ?? void 0

package/dist/adapters/http/adapters/oauth2/grant-types/refresh_token.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"refresh_token.mjs","names":["OAuth2ClientError","OAuth2GrantError","OAuth2RequestError","readRequestBody","getRequestHeader","getRequestIP","OAuth2RefreshTokenGrant","extractClientCredentialsFromRequest","HTTPOAuth2RefreshTokenGrant","clientAuthenticator","refreshTokenVerifier","ctx","tokenVerifier","runWithRequest","event","body","refreshToken","refresh_token","length","malformed","clientId","clientSecret","realmId","realm_id","payload","verify","client","authenticate","undefined","client_id","id","invalid","runWith","ipAddress","trustProxy","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/refresh_token.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2ClientError, OAuth2GrantError, OAuth2RequestError } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport { OAuth2RefreshTokenGrant } from '../../../../../core/index.ts';\nimport type {\n    IOAuth2TokenVerifier,\n    OAuth2ClientAuthenticator,\n} from '../../../../../core/index.ts';\nimport type { HTTPOAuth2RefreshTokenGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport { extractClientCredentialsFromRequest } from './utils/index.ts';\n\nexport class HTTPOAuth2RefreshTokenGrant extends OAuth2RefreshTokenGrant implements IHTTPOAuth2Grant {\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    protected refreshTokenVerifier : IOAuth2TokenVerifier;\n\n    constructor(ctx: HTTPOAuth2RefreshTokenGrantContext) {\n        super(ctx);\n\n        this.clientAuthenticator = ctx.clientAuthenticator;\n        this.refreshTokenVerifier = ctx.tokenVerifier;\n    }\n\n    async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const body = await readRequestBody(event);\n        const refreshToken = body?.refresh_token;\n        if (typeof refreshToken !== 'string' || refreshToken.length === 0) {\n            throw OAuth2RequestError.malformed();\n        }\n\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n        const realmId = body?.realm_id;\n\n        // RFC 6749 §6: verify the refresh token first to learn its bound\n        // client (if any), then enforce binding. Authenticate the requesting\n        // client when credentials are present, or when the token requires\n        // a client binding.\n        const payload = await this.refreshTokenVerifier.verify(refreshToken);\n\n        if (clientId) {\n            const client = await this.clientAuthenticator.authenticate(\n                clientId,\n                clientSecret,\n                typeof realmId === 'string' ? realmId : undefined,\n            );\n\n            if (payload.client_id && payload.client_id !== client.id) {\n                throw OAuth2GrantError.invalid();\n            }\n        } else if (payload.client_id) {\n            // Token was issued to a specific client — that client MUST\n            // re-authenticate (RFC 6749 §6 binding requirement).\n            throw OAuth2ClientError.invalid();\n        }\n\n        return this.runWith(payload, {\n            ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;AAoBA,IAAaQ,8BAAb,cAAiDF,wBAAAA;CACnCG;CAEAC;CAEV,YAAYC,KAAyC;EACjD,MAAMA,GAAAA;EAEN,KAAKF,sBAAsBE,IAAIF;EAC/B,KAAKC,uBAAuBC,IAAIC;CACpC;CAEA,MAAMC,eAAeC,OAAqD;EACtE,MAAMC,OAAO,MAAMZ,gBAAgBW,KAAAA;EACnC,MAAME,eAAeD,MAAME;EAC3B,IAAI,OAAOD,iBAAiB,YAAYA,aAAaE,WAAW,GAC5D,MAAMhB,mBAAmBiB,UAAS;EAGtC,MAAM,EAAEC,UAAUC,iBAAiB,MAAMd,oCAAoCO,KAAAA;EAC7E,MAAMQ,UAAUP,MAAMQ;EAMtB,MAAMC,UAAU,MAAM,KAAKd,qBAAqBe,OAAOT,YAAAA;EAEvD,IAAII,UAAU;GACV,MAAMM,SAAS,MAAM,KAAKjB,oBAAoBkB,aAC1CP,UACAC,cACA,OAAOC,YAAY,WAAWA,UAAUM,KAAAA,CAAAA;GAG5C,IAAIJ,QAAQK,aAAaL,QAAQK,cAAcH,OAAOI,IAClD,MAAM7B,iBAAiB8B,QAAO;EAEtC,OAAO,IAAIP,QAAQK,WAGf,MAAM7B,kBAAkB+B,QAAO;EAGnC,OAAO,KAAKC,QAAQR,SAAS;GACzBS,WAAW5B,aAAaS,OAAO,EAAEoB,YAAY,KAAK,CAAA,KAAMN,KAAAA;GACxDO,WAAW/B,iBAAiBU,OAAO,YAAA,KAAiBc,KAAAA;EACxD,CAAA;CACJ;AACJ"}
+{"version":3,"file":"refresh_token.mjs","names":["OAuth2GrantError","OAuth2RequestError","OAuth2TokenGrant","readRequestBody","getRequestHeader","getRequestIP","OAuth2RefreshTokenGrant","assertClientGrantAllowed","extractClientCredentialsFromRequest","readRealmHint","HTTPOAuth2RefreshTokenGrant","clientAuthenticator","refreshTokenVerifier","realmRepository","ctx","tokenVerifier","runWithRequest","event","body","refreshToken","refresh_token","length","malformed","clientId","clientSecret","payload","verify","skipActiveCheck","client","realm","resolve","authenticate","id","client_id","invalid","REFRESH_TOKEN","is_confidential","realm_id","runWith","ipAddress","trustProxy","undefined","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/refresh_token.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Client } from '@authup/core-kit';\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2GrantError, OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport { OAuth2RefreshTokenGrant, assertClientGrantAllowed } from '../../../../../core/index.ts';\nimport type {\n    IOAuth2TokenVerifier,\n    IRealmRepository,\n    OAuth2ClientAuthenticator,\n} from '../../../../../core/index.ts';\nimport type { HTTPOAuth2RefreshTokenGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport { extractClientCredentialsFromRequest, readRealmHint } from './utils/index.ts';\n\nexport class HTTPOAuth2RefreshTokenGrant extends OAuth2RefreshTokenGrant implements IHTTPOAuth2Grant {\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    protected refreshTokenVerifier : IOAuth2TokenVerifier;\n\n    protected realmRepository : IRealmRepository;\n\n    constructor(ctx: HTTPOAuth2RefreshTokenGrantContext) {\n        super(ctx);\n\n        this.clientAuthenticator = ctx.clientAuthenticator;\n        this.refreshTokenVerifier = ctx.tokenVerifier;\n        this.realmRepository = ctx.realmRepository;\n    }\n\n    async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const body = await readRequestBody(event);\n        const refreshToken = body?.refresh_token;\n        if (typeof refreshToken !== 'string' || refreshToken.length === 0) {\n            throw OAuth2RequestError.malformed();\n        }\n\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n\n        // RFC 6749 §6: verify the refresh token first to learn its bound\n        // client (if any), then enforce binding. Authenticate the requesting\n        // client when credentials are present, or when the token requires\n        // a client binding.\n        //\n        // skipActiveCheck: the durable auth_session_tokens row (not the cache\n        // blocklist) is the refresh-token authority, so a replayed/consumed\n        // token must reach runWith() to trigger family revocation instead of\n        // being rejected here with JWT_INACTIVE.\n        const payload = await this.refreshTokenVerifier.verify(refreshToken, { skipActiveCheck: true });\n\n        let client: Client | undefined;\n\n        if (clientId) {\n            // A client authenticated itself. Resolve by the presented\n            // id/secret (name resolution scoped by the realm hint — resolved\n            // lazily so a bare refresh skips the SELECT) and enforce the\n            // token↔client binding.\n            const realm = await this.realmRepository.resolve(readRealmHint(body), true);\n\n            client = await this.clientAuthenticator.authenticate(\n                clientId,\n                clientSecret,\n                realm.id,\n            );\n\n            if (payload.client_id && payload.client_id !== client.id) {\n                throw OAuth2GrantError.invalid();\n            }\n        } else if (payload.client_id) {\n            // No client credentials were presented, but the token is bound to\n            // a client. RFC 6749 §10.4: a public client cannot authenticate\n            // (no secret) and is not required to — the bound identity is read\n            // from the signed token (client_id is server-minted, so trusted)\n            // and refresh-token rotation/replay detection is the abuse control.\n            // A confidential client MUST still authenticate: authenticate()\n            // with no secret throws invalid_client for it, so a confidential-\n            // bound token presented without credentials is rejected here.\n            client = await this.clientAuthenticator.authenticate(payload.client_id);\n        }\n\n        if (client) {\n            assertClientGrantAllowed(client, OAuth2TokenGrant.REFRESH_TOKEN);\n        }\n\n        // Realm parity for PUBLIC clients only: a public client may not refresh\n        // a token whose realm differs from the (bound) client's own realm.\n        // Kills cross-realm refresh tokens minted for a public `web` client\n        // before the authorize-side realm gate existed. Confidential clients\n        // are exempt — the client secret already proves identity, and the\n        // documented cross-realm password grant (UUID-identified user against a\n        // master-realm client) depends on that exemption.\n        if (\n            client &&\n            !client.is_confidential &&\n            payload.realm_id &&\n            payload.realm_id !== client.realm_id\n        ) {\n            throw OAuth2GrantError.invalid();\n        }\n\n        return this.runWith(payload, {\n            ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AAsBA,IAAaU,8BAAb,cAAiDJ,wBAAAA;CACnCK;CAEAC;CAEAC;CAEV,YAAYC,KAAyC;EACjD,MAAMA,GAAAA;EAEN,KAAKH,sBAAsBG,IAAIH;EAC/B,KAAKC,uBAAuBE,IAAIC;EAChC,KAAKF,kBAAkBC,IAAID;CAC/B;CAEA,MAAMG,eAAeC,OAAqD;EACtE,MAAMC,OAAO,MAAMf,gBAAgBc,KAAAA;EACnC,MAAME,eAAeD,MAAME;EAC3B,IAAI,OAAOD,iBAAiB,YAAYA,aAAaE,WAAW,GAC5D,MAAMpB,mBAAmBqB,UAAS;EAGtC,MAAM,EAAEC,UAAUC,iBAAiB,MAAMhB,oCAAoCS,KAAAA;EAW7E,MAAMQ,UAAU,MAAM,KAAKb,qBAAqBc,OAAOP,cAAc,EAAEQ,iBAAiB,KAAK,CAAA;EAE7F,IAAIC;EAEJ,IAAIL,UAAU;GAKV,MAAMM,QAAQ,MAAM,KAAKhB,gBAAgBiB,QAAQrB,cAAcS,IAAAA,GAAO,IAAA;GAEtEU,SAAS,MAAM,KAAKjB,oBAAoBoB,aACpCR,UACAC,cACAK,MAAMG,EAAE;GAGZ,IAAIP,QAAQQ,aAAaR,QAAQQ,cAAcL,OAAOI,IAClD,MAAMhC,iBAAiBkC,QAAO;EAEtC,OAAO,IAAIT,QAAQQ,WASfL,SAAS,MAAM,KAAKjB,oBAAoBoB,aAAaN,QAAQQ,SAAS;EAG1E,IAAIL,QACArB,yBAAyBqB,QAAQ1B,iBAAiBiC,aAAa;EAUnE,IACIP,UACA,CAACA,OAAOQ,mBACRX,QAAQY,YACRZ,QAAQY,aAAaT,OAAOS,UAE5B,MAAMrC,iBAAiBkC,QAAO;EAGlC,OAAO,KAAKI,QAAQb,SAAS;GACzBc,WAAWlC,aAAaY,OAAO,EAAEuB,YAAY,KAAK,CAAA,KAAMC,KAAAA;GACxDC,WAAWtC,iBAAiBa,OAAO,YAAA,KAAiBwB,KAAAA;EACxD,CAAA;CACJ;AACJ"}

package/dist/adapters/http/adapters/oauth2/grant-types/types.d.ts

@@ -1,10 +1,11 @@
 import type { Client, Robot, User } from '@authup/core-kit';
 import type { OAuth2TokenGrantResponse } from '@authup/specs';
 import type { IAppEvent } from 'routup';
-import type { BaseGrantContext, ICredentialsAuthenticator, IOAuth2AuthorizationCodeVerifier, OAuth2AuthorizeGrantContext, OAuth2ClientAuthenticator, OAuth2PasswordGrantContext, OAuth2RefreshTokenGrantContext } from '../../../../../core/index.ts';
+import type { BaseGrantContext, ICredentialsAuthenticator, IOAuth2AuthorizationCodeVerifier, IRealmRepository, OAuth2AuthorizeGrantContext, OAuth2ClientAuthenticator, OAuth2PasswordGrantContext, OAuth2RefreshTokenGrantContext } from '../../../../../core/index.ts';
 export type HTTPOAuth2AuthorizeGrantContext = OAuth2AuthorizeGrantContext & {
     codeVerifier: IOAuth2AuthorizationCodeVerifier;
     clientAuthenticator: OAuth2ClientAuthenticator;
+    realmRepository: IRealmRepository;
 };
 export interface IHTTPOAuth2Grant {
     runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse>;
@@ -12,9 +13,11 @@ export interface IHTTPOAuth2Grant {
 export type HTTPOAuth2PasswordGrantContext = OAuth2PasswordGrantContext & {
     authenticator: ICredentialsAuthenticator<User>;
     clientAuthenticator: OAuth2ClientAuthenticator;
+    realmRepository: IRealmRepository;
 };
 export type HTTPOAuth2RefreshTokenGrantContext = OAuth2RefreshTokenGrantContext & {
     clientAuthenticator: OAuth2ClientAuthenticator;
+    realmRepository: IRealmRepository;
 };
 export type HTTPOAuth2ClientCredentialsGrantContext = BaseGrantContext & {
     authenticator: ICredentialsAuthenticator<Client>;

package/dist/adapters/http/adapters/oauth2/grant-types/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EACR,gBAAgB,EAChB,yBAAyB,EACzB,gCAAgC,EAChC,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,8BAA8B,EACjC,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,+BAA+B,GAAG,2BAA2B,GAAG;IACxE,YAAY,EAAE,gCAAgC,CAAC;IAC/C,mBAAmB,EAAE,yBAAyB,CAAC;CAClD,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC7B,cAAc,CAAC,KAAK,EAAE,SAAS,GAAI,OAAO,CAAC,wBAAwB,CAAC,CAAA;CACvE;AAED,MAAM,MAAM,8BAA8B,GAAG,0BAA0B,GAAG;IACtE,aAAa,EAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAChD,mBAAmB,EAAE,yBAAyB,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,kCAAkC,GAAG,8BAA8B,GAAG;IAC9E,mBAAmB,EAAE,yBAAyB,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,uCAAuC,GAAG,gBAAgB,GAAG;IACrE,aAAa,EAAG,yBAAyB,CAAC,MAAM,CAAC,CAAA;CACpD,CAAC;AAEF,MAAM,MAAM,sCAAsC,GAAG,gBAAgB,GAAG;IACpE,aAAa,EAAG,yBAAyB,CAAC,KAAK,CAAC,CAAA;CACnD,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EACR,gBAAgB,EAChB,yBAAyB,EACzB,gCAAgC,EAChC,gBAAgB,EAChB,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,8BAA8B,EACjC,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,+BAA+B,GAAG,2BAA2B,GAAG;IACxE,YAAY,EAAE,gCAAgC,CAAC;IAC/C,mBAAmB,EAAE,yBAAyB,CAAC;IAC/C,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC7B,cAAc,CAAC,KAAK,EAAE,SAAS,GAAI,OAAO,CAAC,wBAAwB,CAAC,CAAA;CACvE;AAED,MAAM,MAAM,8BAA8B,GAAG,0BAA0B,GAAG;IACtE,aAAa,EAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAChD,mBAAmB,EAAE,yBAAyB,CAAC;IAC/C,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,kCAAkC,GAAG,8BAA8B,GAAG;IAC9E,mBAAmB,EAAE,yBAAyB,CAAC;IAC/C,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,uCAAuC,GAAG,gBAAgB,GAAG;IACrE,aAAa,EAAG,yBAAyB,CAAC,MAAM,CAAC,CAAA;CACpD,CAAC;AAEF,MAAM,MAAM,sCAAsC,GAAG,gBAAgB,GAAG;IACpE,aAAa,EAAG,yBAAyB,CAAC,KAAK,CAAC,CAAA;CACnD,CAAC"}

package/dist/adapters/http/adapters/oauth2/grant-types/utils/credentials.d.ts

@@ -12,4 +12,5 @@ export type ExtractedClientCredentials = {
  * request body.
  */
 export declare function extractClientCredentialsFromRequest(event: IAppEvent): Promise<ExtractedClientCredentials>;
+export declare function readStringField(body: Record<string, any> | undefined, key: string): string | undefined;
 //# sourceMappingURL=credentials.d.ts.map

package/dist/adapters/http/adapters/oauth2/grant-types/utils/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/credentials.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,MAAM,MAAM,0BAA0B,GAAG;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAsB,mCAAmC,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,0BAA0B,CAAC,CA6B/G"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/credentials.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,MAAM,MAAM,0BAA0B,GAAG;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAsB,mCAAmC,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,0BAA0B,CAAC,CA6B/G;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGtG"}

package/dist/adapters/http/adapters/oauth2/grant-types/utils/credentials.mjs

@@ -2,8 +2,8 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { OAuth2RequestError } from "@authup/specs";
-import { readRequestBody } from "@routup/basic/body";
 import { AuthorizationHeaderType, parseAuthorizationHeader } from "hapic";
+import { readRequestBody } from "@routup/basic/body";
 //#region src/adapters/http/adapters/oauth2/grant-types/utils/credentials.ts
 /**
 * Extract client credentials from an OAuth2 token endpoint request.
@@ -56,6 +56,6 @@ function formDecode(value) {
 	}
 }
 //#endregion
-export { extractClientCredentialsFromRequest };
+export { extractClientCredentialsFromRequest, readStringField };
 
 //# sourceMappingURL=credentials.mjs.map

package/dist/adapters/http/adapters/oauth2/grant-types/utils/credentials.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.mjs","names":["OAuth2RequestError","readRequestBody","AuthorizationHeaderType","parseAuthorizationHeader","extractClientCredentialsFromRequest","event","body","bodyClientId","readStringField","bodyClientSecret","hasBodyCredentials","basicCredentials","parseBasicCredentials","malformed","clientId","clientSecret","key","value","length","undefined","headerValue","headers","get","header","type","BASIC","formDecode","username","password","decodeURIComponent","replace"],"sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/credentials.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { OAuth2RequestError } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport { AuthorizationHeaderType, parseAuthorizationHeader } from 'hapic';\nimport type { IAppEvent } from 'routup';\n\nexport type ExtractedClientCredentials = {\n    clientId?: string,\n    clientSecret?: string,\n};\n\n/**\n * Extract client credentials from an OAuth2 token endpoint request.\n *\n * Per RFC 6749 §2.3.1, the server MUST NOT support multiple client\n * authentication methods in a single request. This helper rejects requests\n * that present credentials in BOTH the Basic Authorization header and the\n * request body.\n */\nexport async function extractClientCredentialsFromRequest(event: IAppEvent): Promise<ExtractedClientCredentials> {\n    const body = await readRequestBody(event);\n    const bodyClientId = readStringField(body, 'client_id');\n    const bodyClientSecret = readStringField(body, 'client_secret');\n    const hasBodyCredentials = !!bodyClientId || !!bodyClientSecret;\n\n    const basicCredentials = parseBasicCredentials(event);\n\n    if (hasBodyCredentials && basicCredentials) {\n        throw OAuth2RequestError.malformed(\n            'Client credentials must be provided either via Basic Authorization header or request body, not both.',\n        );\n    }\n\n    if (hasBodyCredentials) {\n        // Reject stray client_secret without client_id — otherwise grants\n        // that gate auth on `if (clientId)` would silently skip\n        // authentication and leak through with the secret discarded.\n        if (!bodyClientId) {\n            throw OAuth2RequestError.malformed('client_secret was provided without client_id.');\n        }\n        return { clientId: bodyClientId, clientSecret: bodyClientSecret };\n    }\n\n    if (basicCredentials) {\n        return basicCredentials;\n    }\n\n    return {};\n}\n\nfunction readStringField(body: Record<string, any> | undefined, key: string): string | undefined {\n    const value = body?.[key];\n    return typeof value === 'string' && value.length > 0 ? value : undefined;\n}\n\nfunction parseBasicCredentials(event: IAppEvent): ExtractedClientCredentials | undefined {\n    const headerValue = event.headers.get('authorization');\n    if (!headerValue) {\n        return undefined;\n    }\n\n    let header;\n    try {\n        header = parseAuthorizationHeader(headerValue);\n    } catch {\n        // Malformed Authorization header — surface as 400 invalid_request\n        // rather than letting hapic's error propagate as 500.\n        throw OAuth2RequestError.malformed('Malformed Authorization header.');\n    }\n\n    if (header.type !== AuthorizationHeaderType.BASIC) {\n        return undefined;\n    }\n\n    // RFC 6749 §2.3.1 + Appendix B: client_id and client_secret are\n    // application/x-www-form-urlencoded BEFORE base64 encoding in the\n    // Authorization header. hapic only base64-decodes; we form-decode here\n    // so credentials containing reserved characters (`:`, `+`, `%`, `&`,\n    // `=`, etc.) round-trip correctly.\n    return {\n        clientId: formDecode(header.username),\n        clientSecret: formDecode(header.password),\n    };\n}\n\nfunction formDecode(value: string): string {\n    try {\n        // application/x-www-form-urlencoded: '+' represents space; %XX is\n        // percent-encoded UTF-8.\n        return decodeURIComponent(value.replace(/\\+/g, ' '));\n    } catch {\n        // Malformed percent-encoding — return raw value rather than\n        // throwing; the caller will still validate via authentication.\n        return value;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;GAyBA,eAAsBI,oCAAoCC,OAAgB;CACtE,MAAMC,OAAO,MAAML,gBAAgBI,KAAAA;CACnC,MAAME,eAAeC,gBAAgBF,MAAM,WAAA;CAC3C,MAAMG,mBAAmBD,gBAAgBF,MAAM,eAAA;CAC/C,MAAMI,qBAAqB,CAAC,CAACH,gBAAgB,CAAC,CAACE;CAE/C,MAAME,mBAAmBC,sBAAsBP,KAAAA;CAE/C,IAAIK,sBAAsBC,kBACtB,MAAMX,mBAAmBa,UACrB,sGAAA;CAIR,IAAIH,oBAAoB;EAIpB,IAAI,CAACH,cACD,MAAMP,mBAAmBa,UAAU,+CAAA;EAEvC,OAAO;GAAEC,UAAUP;GAAcQ,cAAcN;EAAiB;CACpE;CAEA,IAAIE,kBACA,OAAOA;CAGX,OAAO,CAAC;AACZ;AAEA,SAASH,gBAAgBF,MAAuCU,KAAW;CACvE,MAAMC,QAAQX,OAAOU;CACrB,OAAO,OAAOC,UAAU,YAAYA,MAAMC,SAAS,IAAID,QAAQE,KAAAA;AACnE;AAEA,SAASP,sBAAsBP,OAAgB;CAC3C,MAAMe,cAAcf,MAAMgB,QAAQC,IAAI,eAAA;CACtC,IAAI,CAACF,aACD;CAGJ,IAAIG;CACJ,IAAI;EACAA,SAASpB,yBAAyBiB,WAAAA;CACtC,QAAQ;EAGJ,MAAMpB,mBAAmBa,UAAU,iCAAA;CACvC;CAEA,IAAIU,OAAOC,SAAStB,wBAAwBuB,OACxC;CAQJ,OAAO;EACHX,UAAUY,WAAWH,OAAOI,QAAQ;EACpCZ,cAAcW,WAAWH,OAAOK,QAAQ;CAC5C;AACJ;AAEA,SAASF,WAAWT,OAAa;CAC7B,IAAI;EAGA,OAAOY,mBAAmBZ,MAAMa,QAAQ,OAAO,GAAA,CAAA;CACnD,QAAQ;EAGJ,OAAOb;CACX;AACJ"}
+{"version":3,"file":"credentials.mjs","names":["OAuth2RequestError","readRequestBody","AuthorizationHeaderType","parseAuthorizationHeader","extractClientCredentialsFromRequest","event","body","bodyClientId","readStringField","bodyClientSecret","hasBodyCredentials","basicCredentials","parseBasicCredentials","malformed","clientId","clientSecret","key","value","length","undefined","headerValue","headers","get","header","type","BASIC","formDecode","username","password","decodeURIComponent","replace"],"sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/credentials.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { OAuth2RequestError } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport { AuthorizationHeaderType, parseAuthorizationHeader } from 'hapic';\nimport type { IAppEvent } from 'routup';\n\nexport type ExtractedClientCredentials = {\n    clientId?: string,\n    clientSecret?: string,\n};\n\n/**\n * Extract client credentials from an OAuth2 token endpoint request.\n *\n * Per RFC 6749 §2.3.1, the server MUST NOT support multiple client\n * authentication methods in a single request. This helper rejects requests\n * that present credentials in BOTH the Basic Authorization header and the\n * request body.\n */\nexport async function extractClientCredentialsFromRequest(event: IAppEvent): Promise<ExtractedClientCredentials> {\n    const body = await readRequestBody(event);\n    const bodyClientId = readStringField(body, 'client_id');\n    const bodyClientSecret = readStringField(body, 'client_secret');\n    const hasBodyCredentials = !!bodyClientId || !!bodyClientSecret;\n\n    const basicCredentials = parseBasicCredentials(event);\n\n    if (hasBodyCredentials && basicCredentials) {\n        throw OAuth2RequestError.malformed(\n            'Client credentials must be provided either via Basic Authorization header or request body, not both.',\n        );\n    }\n\n    if (hasBodyCredentials) {\n        // Reject stray client_secret without client_id — otherwise grants\n        // that gate auth on `if (clientId)` would silently skip\n        // authentication and leak through with the secret discarded.\n        if (!bodyClientId) {\n            throw OAuth2RequestError.malformed('client_secret was provided without client_id.');\n        }\n        return { clientId: bodyClientId, clientSecret: bodyClientSecret };\n    }\n\n    if (basicCredentials) {\n        return basicCredentials;\n    }\n\n    return {};\n}\n\nexport function readStringField(body: Record<string, any> | undefined, key: string): string | undefined {\n    const value = body?.[key];\n    return typeof value === 'string' && value.length > 0 ? value : undefined;\n}\n\nfunction parseBasicCredentials(event: IAppEvent): ExtractedClientCredentials | undefined {\n    const headerValue = event.headers.get('authorization');\n    if (!headerValue) {\n        return undefined;\n    }\n\n    let header;\n    try {\n        header = parseAuthorizationHeader(headerValue);\n    } catch {\n        // Malformed Authorization header — surface as 400 invalid_request\n        // rather than letting hapic's error propagate as 500.\n        throw OAuth2RequestError.malformed('Malformed Authorization header.');\n    }\n\n    if (header.type !== AuthorizationHeaderType.BASIC) {\n        return undefined;\n    }\n\n    // RFC 6749 §2.3.1 + Appendix B: client_id and client_secret are\n    // application/x-www-form-urlencoded BEFORE base64 encoding in the\n    // Authorization header. hapic only base64-decodes; we form-decode here\n    // so credentials containing reserved characters (`:`, `+`, `%`, `&`,\n    // `=`, etc.) round-trip correctly.\n    return {\n        clientId: formDecode(header.username),\n        clientSecret: formDecode(header.password),\n    };\n}\n\nfunction formDecode(value: string): string {\n    try {\n        // application/x-www-form-urlencoded: '+' represents space; %XX is\n        // percent-encoded UTF-8.\n        return decodeURIComponent(value.replace(/\\+/g, ' '));\n    } catch {\n        // Malformed percent-encoding — return raw value rather than\n        // throwing; the caller will still validate via authentication.\n        return value;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;GAyBA,eAAsBI,oCAAoCC,OAAgB;CACtE,MAAMC,OAAO,MAAML,gBAAgBI,KAAAA;CACnC,MAAME,eAAeC,gBAAgBF,MAAM,WAAA;CAC3C,MAAMG,mBAAmBD,gBAAgBF,MAAM,eAAA;CAC/C,MAAMI,qBAAqB,CAAC,CAACH,gBAAgB,CAAC,CAACE;CAE/C,MAAME,mBAAmBC,sBAAsBP,KAAAA;CAE/C,IAAIK,sBAAsBC,kBACtB,MAAMX,mBAAmBa,UACrB,sGAAA;CAIR,IAAIH,oBAAoB;EAIpB,IAAI,CAACH,cACD,MAAMP,mBAAmBa,UAAU,+CAAA;EAEvC,OAAO;GAAEC,UAAUP;GAAcQ,cAAcN;EAAiB;CACpE;CAEA,IAAIE,kBACA,OAAOA;CAGX,OAAO,CAAC;AACZ;AAEA,SAAgBH,gBAAgBF,MAAuCU,KAAW;CAC9E,MAAMC,QAAQX,OAAOU;CACrB,OAAO,OAAOC,UAAU,YAAYA,MAAMC,SAAS,IAAID,QAAQE,KAAAA;AACnE;AAEA,SAASP,sBAAsBP,OAAgB;CAC3C,MAAMe,cAAcf,MAAMgB,QAAQC,IAAI,eAAA;CACtC,IAAI,CAACF,aACD;CAGJ,IAAIG;CACJ,IAAI;EACAA,SAASpB,yBAAyBiB,WAAAA;CACtC,QAAQ;EAGJ,MAAMpB,mBAAmBa,UAAU,iCAAA;CACvC;CAEA,IAAIU,OAAOC,SAAStB,wBAAwBuB,OACxC;CAQJ,OAAO;EACHX,UAAUY,WAAWH,OAAOI,QAAQ;EACpCZ,cAAcW,WAAWH,OAAOK,QAAQ;CAC5C;AACJ;AAEA,SAASF,WAAWT,OAAa;CAC7B,IAAI;EAGA,OAAOY,mBAAmBZ,MAAMa,QAAQ,OAAO,GAAA,CAAA;CACnD,QAAQ;EAGJ,OAAOb;CACX;AACJ"}

package/dist/adapters/http/adapters/oauth2/grant-types/utils/guess.mjs

@@ -2,9 +2,9 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { OAuth2TokenGrant } from "@authup/specs";
+import { AuthorizationHeaderType, parseAuthorizationHeader } from "hapic";
 import { readRequestBody } from "@routup/basic/body";
 import { useRequestQuery } from "@routup/basic/query";
-import { AuthorizationHeaderType, parseAuthorizationHeader } from "hapic";
 //#region src/adapters/http/adapters/oauth2/grant-types/utils/guess.ts
 async function guessOauth2GrantTypeByRequest(event) {
 	const body = await readRequestBody(event);

package/dist/adapters/http/adapters/oauth2/grant-types/utils/index.d.ts

@@ -1,3 +1,4 @@
 export * from './credentials.ts';
 export * from './guess.ts';
+export * from './realm.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/adapters/oauth2/grant-types/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/index.ts"],"names":[],"mappings":"AAOA,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/index.ts"],"names":[],"mappings":"AAOA,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC"}