@authup/server-core 1.0.0-beta.51 → 1.0.0-beta.52

package/dist/core/identity/provider/authentication/protocols/oauth2/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["buildIdentityProviderAuthorizeCallbackPath","extractTokenPayload","OAuth2Client","IdentityProviderOAuth2Authenticator","client","options","accountManager","provider","ctx","clientId","client_id","clientSecret","client_secret","redirectUri","baseURL","id","scope","authorizationEndpoint","authorize_url","tokenEndpoint","token_url","userinfoEndpoint","user_info_url","undefined","buildRedirectURL","parameters","authorize","buildURL","authenticate","params","token","createWithAuthorizationCode","identity","buildIdentityWithTokenGrantResponse","account","save","user","safeAuthenticate","data","success","e","error","input","payload","access_token","sub","attributeCandidates","name","email"],"sources":["../../../../../../../src/core/identity/provider/authentication/protocols/oauth2/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2IdentityProvider, OpenIDIdentityProvider, User } from '@authup/core-kit';\nimport { buildIdentityProviderAuthorizeCallbackPath } from '@authup/core-kit';\nimport type { Result } from '@authup/kit';\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { AuthorizeParameters, TokenGrantResponse } from '@hapic/oauth2';\nimport { OAuth2Client } from '@hapic/oauth2';\nimport type { IIdentityProviderAccountManager } from '../../../account/index.ts';\nimport type { IdentityProviderIdentity } from '../../../types.ts';\nimport type {\n    IOAuth2Authenticator,\n    IdentityProviderOAuth2AuthenticatorContext,\n    IdentityProviderOAuth2AuthenticatorOptions,\n    OAuth2AuthorizationCodeGrantPayload,\n} from './types.ts';\n\nexport class IdentityProviderOAuth2Authenticator implements IOAuth2Authenticator<User> {\n    protected client : OAuth2Client;\n\n    protected options : IdentityProviderOAuth2AuthenticatorOptions;\n\n    protected accountManager: IIdentityProviderAccountManager;\n\n    protected provider : OAuth2IdentityProvider | OpenIDIdentityProvider;\n\n    //----------------------------------------------------------------------\n\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        this.options = ctx.options;\n        this.accountManager = ctx.accountManager;\n        this.provider = ctx.provider;\n\n        this.client = new OAuth2Client({\n            options: {\n                clientId: ctx.provider.client_id,\n                clientSecret: ctx.provider.client_secret,\n                redirectUri: `${ctx.options.baseURL}${buildIdentityProviderAuthorizeCallbackPath(ctx.provider.id)}`,\n                scope: ctx.provider.scope,\n                authorizationEndpoint: ctx.provider.authorize_url,\n                tokenEndpoint: ctx.provider.token_url,\n                userinfoEndpoint: ctx.provider.user_info_url || undefined,\n            },\n        });\n    }\n\n    //----------------------------------------------------------------------\n\n    buildRedirectURL(parameters: Partial<AuthorizeParameters> = {}) : string {\n        return this.client.authorize.buildURL(parameters);\n    }\n\n    //----------------------------------------------------------------------\n\n    async authenticate(params: OAuth2AuthorizationCodeGrantPayload): Promise<User> {\n        const token = await this.client.token.createWithAuthorizationCode(params);\n\n        const identity = await this.buildIdentityWithTokenGrantResponse(token);\n        if (this.options.clientId) {\n            identity.clientId = this.options.clientId;\n        }\n\n        const account = await this.accountManager.save(identity);\n\n        return account.user;\n    }\n\n    async safeAuthenticate(params: OAuth2AuthorizationCodeGrantPayload): Promise<Result<User>> {\n        try {\n            const data = await this.authenticate(params);\n            return {\n                success: true,\n                data, \n            };\n        } catch (e) {\n            return {\n                success: false,\n                error: e as Error, \n            };\n        }\n    }\n\n    //----------------------------------------------------------------------\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse) : Promise<IdentityProviderIdentity> {\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: payload.sub!,\n            attributeCandidates: {\n                name: [\n                    payload.sub,\n                ],\n                email: [\n                    payload.email,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;;;;AAsBA,IAAaG,sCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAiD;EACzD,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,WAAWC,IAAID;EAEpB,KAAKH,SAAS,IAAIF,aAAa,EAC3BG,SAAS;GACLI,UAAUD,IAAID,SAASG;GACvBC,cAAcH,IAAID,SAASK;GAC3BC,aAAa,GAAGL,IAAIH,QAAQS,UAAUd,2CAA2CQ,IAAID,SAASQ,EAAE;GAChGC,OAAOR,IAAID,SAASS;GACpBC,uBAAuBT,IAAID,SAASW;GACpCC,eAAeX,IAAID,SAASa;GAC5BC,kBAAkBb,IAAID,SAASe,iBAAiBC,KAAAA;EACpD,EACJ,CAAA;CACJ;CAIAC,iBAAiBC,aAA2C,CAAC,GAAY;EACrE,OAAO,KAAKrB,OAAOsB,UAAUC,SAASF,UAAAA;CAC1C;CAIA,MAAMG,aAAaC,QAA4D;EAC3E,MAAMC,QAAQ,MAAM,KAAK1B,OAAO0B,MAAMC,4BAA4BF,MAAAA;EAElE,MAAMG,WAAW,MAAM,KAAKC,oCAAoCH,KAAAA;EAChE,IAAI,KAAKzB,QAAQI,UACbuB,SAASvB,WAAW,KAAKJ,QAAQI;EAKrC,QAAOyB,MAFe,KAAK5B,eAAe6B,KAAKH,QAAAA,EAAAA,CAEhCI;CACnB;CAEA,MAAMC,iBAAiBR,QAAoE;EACvF,IAAI;GAEA,OAAO;IACHU,SAAS;IACTD,MAAAA,MAHe,KAAKV,aAAaC,MAAAA;GAIrC;EACJ,SAASW,GAAG;GACR,OAAO;IACHD,SAAS;IACTE,OAAOD;GACX;EACJ;CACJ;CAIA,MAAgBP,oCAAoCS,OAA+D;EAC/G,MAAMC,UAAU1C,oBAAoByC,MAAME,YAAY;EAEtD,OAAO;GACH7B,IAAI4B,QAAQE;GACZC,qBAAqB;IACjBC,MAAM,CACFJ,QAAQE,GAAAA;IAEZG,OAAO,CACHL,QAAQK,KAAAA;GAEhB;GACAV,MAAMK;GACNpC,UAAU,KAAKA;EACnB;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["buildIdentityProviderAuthorizeCallbackPath","BadRequestError","extractTokenPayload","OAuth2Client","IdentityProviderOAuth2Authenticator","client","options","accountManager","provider","ctx","clientId","client_id","clientSecret","client_secret","redirectUri","baseURL","id","scope","undefined","authorizationEndpoint","authorize_url","tokenEndpoint","token_url","userinfoEndpoint","user_info_url","buildRedirectURL","parameters","authorize","buildURL","authenticate","params","token","createWithAuthorizationCode","identity","buildIdentityWithTokenGrantResponse","account","save","user","safeAuthenticate","data","success","e","error","input","payload","access_token","sub","attributeCandidates","name","email"],"sources":["../../../../../../../src/core/identity/provider/authentication/protocols/oauth2/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2IdentityProvider, OpenIDIdentityProvider, User } from '@authup/core-kit';\nimport { buildIdentityProviderAuthorizeCallbackPath } from '@authup/core-kit';\nimport { BadRequestError } from '@authup/errors';\nimport type { Result } from '@authup/kit';\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { AuthorizeParameters, TokenGrantResponse } from '@hapic/oauth2';\nimport { OAuth2Client } from '@hapic/oauth2';\nimport type { IIdentityProviderAccountManager } from '../../../account/index.ts';\nimport type { IdentityProviderIdentity } from '../../../types.ts';\nimport type {\n    IOAuth2Authenticator,\n    IdentityProviderOAuth2AuthenticatorContext,\n    IdentityProviderOAuth2AuthenticatorOptions,\n    OAuth2AuthorizationCodeGrantPayload,\n} from './types.ts';\n\nexport class IdentityProviderOAuth2Authenticator implements IOAuth2Authenticator<User> {\n    protected client : OAuth2Client;\n\n    protected options : IdentityProviderOAuth2AuthenticatorOptions;\n\n    protected accountManager: IIdentityProviderAccountManager;\n\n    protected provider : OAuth2IdentityProvider | OpenIDIdentityProvider;\n\n    //----------------------------------------------------------------------\n\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        this.options = ctx.options;\n        this.accountManager = ctx.accountManager;\n        this.provider = ctx.provider;\n\n        this.client = new OAuth2Client({\n            options: {\n                clientId: ctx.provider.client_id,\n                clientSecret: ctx.provider.client_secret,\n                redirectUri: `${ctx.options.baseURL}${buildIdentityProviderAuthorizeCallbackPath(ctx.provider.id)}`,\n                scope: ctx.provider.scope || undefined,\n                authorizationEndpoint: ctx.provider.authorize_url,\n                tokenEndpoint: ctx.provider.token_url,\n                userinfoEndpoint: ctx.provider.user_info_url || undefined,\n            },\n        });\n    }\n\n    //----------------------------------------------------------------------\n\n    buildRedirectURL(parameters: Partial<AuthorizeParameters> = {}) : string {\n        try {\n            return this.client.authorize.buildURL(parameters);\n        } catch {\n            throw new BadRequestError(\n                'The identity provider is misconfigured and has an invalid or missing authorize URL.',\n            );\n        }\n    }\n\n    //----------------------------------------------------------------------\n\n    async authenticate(params: OAuth2AuthorizationCodeGrantPayload): Promise<User> {\n        const token = await this.client.token.createWithAuthorizationCode(params);\n\n        const identity = await this.buildIdentityWithTokenGrantResponse(token);\n        if (this.options.clientId) {\n            identity.clientId = this.options.clientId;\n        }\n\n        const account = await this.accountManager.save(identity);\n\n        return account.user;\n    }\n\n    async safeAuthenticate(params: OAuth2AuthorizationCodeGrantPayload): Promise<Result<User>> {\n        try {\n            const data = await this.authenticate(params);\n            return {\n                success: true,\n                data, \n            };\n        } catch (e) {\n            return {\n                success: false,\n                error: e as Error, \n            };\n        }\n    }\n\n    //----------------------------------------------------------------------\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse) : Promise<IdentityProviderIdentity> {\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: payload.sub!,\n            attributeCandidates: {\n                name: [\n                    payload.sub,\n                ],\n                email: [\n                    payload.email,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;;;;;AAuBA,IAAaI,sCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAiD;EACzD,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,WAAWC,IAAID;EAEpB,KAAKH,SAAS,IAAIF,aAAa,EAC3BG,SAAS;GACLI,UAAUD,IAAID,SAASG;GACvBC,cAAcH,IAAID,SAASK;GAC3BC,aAAa,GAAGL,IAAIH,QAAQS,UAAUf,2CAA2CS,IAAID,SAASQ,EAAE;GAChGC,OAAOR,IAAID,SAASS,SAASC,KAAAA;GAC7BC,uBAAuBV,IAAID,SAASY;GACpCC,eAAeZ,IAAID,SAASc;GAC5BC,kBAAkBd,IAAID,SAASgB,iBAAiBN,KAAAA;EACpD,EACJ,CAAA;CACJ;CAIAO,iBAAiBC,aAA2C,CAAC,GAAY;EACrE,IAAI;GACA,OAAO,KAAKrB,OAAOsB,UAAUC,SAASF,UAAAA;EAC1C,QAAQ;GACJ,MAAM,IAAIzB,gBACN,qFAAA;EAER;CACJ;CAIA,MAAM4B,aAAaC,QAA4D;EAC3E,MAAMC,QAAQ,MAAM,KAAK1B,OAAO0B,MAAMC,4BAA4BF,MAAAA;EAElE,MAAMG,WAAW,MAAM,KAAKC,oCAAoCH,KAAAA;EAChE,IAAI,KAAKzB,QAAQI,UACbuB,SAASvB,WAAW,KAAKJ,QAAQI;EAKrC,QAAOyB,MAFe,KAAK5B,eAAe6B,KAAKH,QAAAA,EAAAA,CAEhCI;CACnB;CAEA,MAAMC,iBAAiBR,QAAoE;EACvF,IAAI;GAEA,OAAO;IACHU,SAAS;IACTD,MAAAA,MAHe,KAAKV,aAAaC,MAAAA;GAIrC;EACJ,SAASW,GAAG;GACR,OAAO;IACHD,SAAS;IACTE,OAAOD;GACX;EACJ;CACJ;CAIA,MAAgBP,oCAAoCS,OAA+D;EAC/G,MAAMC,UAAU1C,oBAAoByC,MAAME,YAAY;EAEtD,OAAO;GACH7B,IAAI4B,QAAQE;GACZC,qBAAqB;IACjBC,MAAM,CACFJ,QAAQE,GAAAA;IAEZG,OAAO,CACHL,QAAQK,KAAAA;GAEhB;GACAV,MAAMK;GACNpC,UAAU,KAAKA;EACnB;CACJ;AACJ"}

package/dist/core/identity/provider/authentication/protocols/open-id/module.d.ts

@@ -1,7 +1,9 @@
 import type { TokenGrantResponse } from '@hapic/oauth2';
 import type { IdentityProviderIdentity } from '../../../types.ts';
+import type { IdentityProviderOAuth2AuthenticatorContext } from '../oauth2/index.ts';
 import { IdentityProviderOAuth2Authenticator } from '../oauth2/index.ts';
 export declare class IdentityProviderOpenIDAuthenticator extends IdentityProviderOAuth2Authenticator {
+    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext);
     protected buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity>;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/core/identity/provider/authentication/protocols/open-id/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../../src/core/identity/provider/authentication/protocols/open-id/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,mCAAmC,EAAE,MAAM,oBAAoB,CAAC;AAEzE,qBAAa,mCAAoC,SAAQ,mCAAmC;cACxE,mCAAmC,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAmBpH"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../../src/core/identity/provider/authentication/protocols/open-id/module.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,oBAAoB,CAAC;AACrF,OAAO,EAAE,mCAAmC,EAAE,MAAM,oBAAoB,CAAC;AAEzE,qBAAa,mCAAoC,SAAQ,mCAAmC;gBAC5E,GAAG,EAAE,0CAA0C;cAU3C,mCAAmC,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAmBpH"}

package/dist/core/identity/provider/authentication/protocols/open-id/module.mjs

@@ -4,8 +4,13 @@ import.meta.url;
 import { IdentityProviderOAuth2Authenticator } from "../oauth2/module.mjs";
 import "../oauth2/index.mjs";
 import { extractTokenPayload } from "@authup/server-kit";
+import { mergeOAuth2Scopes } from "@authup/specs";
 //#region src/core/identity/provider/authentication/protocols/open-id/module.ts
 var IdentityProviderOpenIDAuthenticator = class extends IdentityProviderOAuth2Authenticator {
+	constructor(ctx) {
+		ctx.provider.scope = mergeOAuth2Scopes("openid", ctx.provider.scope || "openid profile email");
+		super(ctx);
+	}
 	async buildIdentityWithTokenGrantResponse(input) {
 		const payload = extractTokenPayload(input.access_token);
 		return {

package/dist/core/identity/provider/authentication/protocols/open-id/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["extractTokenPayload","IdentityProviderOAuth2Authenticator","IdentityProviderOpenIDAuthenticator","buildIdentityWithTokenGrantResponse","input","payload","access_token","id","sub","attributeCandidates","name","preferred_username","nickname","email","data","provider"],"sources":["../../../../../../../src/core/identity/provider/authentication/protocols/open-id/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../../types.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../oauth2/index.ts';\n\nexport class IdentityProviderOpenIDAuthenticator extends IdentityProviderOAuth2Authenticator {\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: payload.sub!,\n            attributeCandidates: {\n                name: [\n                    payload.preferred_username,\n                    payload.nickname,\n                    payload.sub,\n                ],\n                email: [\n                    payload.email,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;;;;AAYA,IAAaE,sCAAb,cAAyDD,oCAAAA;CACrD,MAAgBE,oCAAoCC,OAA8D;EAC9G,MAAMC,UAAUL,oBAAoBI,MAAME,YAAY;EAEtD,OAAO;GACHC,IAAIF,QAAQG;GACZC,qBAAqB;IACjBC,MAAM;KACFL,QAAQM;KACRN,QAAQO;KACRP,QAAQG;;IAEZK,OAAO,CACHR,QAAQQ,KAAAA;GAEhB;GACAC,MAAMT;GACNU,UAAU,KAAKA;EACnB;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["extractTokenPayload","mergeOAuth2Scopes","IdentityProviderOAuth2Authenticator","IdentityProviderOpenIDAuthenticator","ctx","provider","scope","buildIdentityWithTokenGrantResponse","input","payload","access_token","id","sub","attributeCandidates","name","preferred_username","nickname","email","data"],"sources":["../../../../../../../src/core/identity/provider/authentication/protocols/open-id/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { extractTokenPayload } from '@authup/server-kit';\nimport { mergeOAuth2Scopes } from '@authup/specs';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../../types.ts';\nimport type { IdentityProviderOAuth2AuthenticatorContext } from '../oauth2/index.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../oauth2/index.ts';\n\nexport class IdentityProviderOpenIDAuthenticator extends IdentityProviderOAuth2Authenticator {\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        // OIDC requires the openid scope (Core §3.1.2.1)\n        ctx.provider.scope = mergeOAuth2Scopes(\n            'openid',\n            ctx.provider.scope || 'openid profile email',\n        );\n\n        super(ctx);\n    }\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: payload.sub!,\n            attributeCandidates: {\n                name: [\n                    payload.preferred_username,\n                    payload.nickname,\n                    payload.sub,\n                ],\n                email: [\n                    payload.email,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;;;;;AAcA,IAAaG,sCAAb,cAAyDD,oCAAAA;CACrD,YAAYE,KAAiD;EAEzDA,IAAIC,SAASC,QAAQL,kBACjB,UACAG,IAAIC,SAASC,SAAS,sBAAA;EAG1B,MAAMF,GAAAA;CACV;CAEA,MAAgBG,oCAAoCC,OAA8D;EAC9G,MAAMC,UAAUT,oBAAoBQ,MAAME,YAAY;EAEtD,OAAO;GACHC,IAAIF,QAAQG;GACZC,qBAAqB;IACjBC,MAAM;KACFL,QAAQM;KACRN,QAAQO;KACRP,QAAQG;;IAEZK,OAAO,CACHR,QAAQQ,KAAAA;GAEhB;GACAC,MAAMT;GACNJ,UAAU,KAAKA;EACnB;CACJ;AACJ"}

package/dist/core/identity/registration/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/registration/service.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EACR,oBAAoB,EACpB,kBAAkB,EAClB,0BAA0B,EAC1B,0BAA0B,EAC7B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE3D,qBAAa,mBAAoB,YAAW,oBAAoB;IAC5D,SAAS,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAE9C,SAAS,CAAC,UAAU,EAAE,WAAW,CAAC;IAElC,SAAS,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;IAEtD,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC;IAEtC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;gBAEhC,GAAG,EAAE,0BAA0B;IAQrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAsDnG,QAAQ,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAczD"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/registration/service.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EACR,oBAAoB,EACpB,kBAAkB,EAClB,0BAA0B,EAC1B,0BAA0B,EAC7B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE3D,qBAAa,mBAAoB,YAAW,oBAAoB;IAC5D,SAAS,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAE9C,SAAS,CAAC,UAAU,EAAE,WAAW,CAAC;IAElC,SAAS,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;IAEtD,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC;IAEtC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;gBAEhC,GAAG,EAAE,0BAA0B;IAQrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAyDnG,QAAQ,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAczD"}

package/dist/core/identity/registration/service.mjs

@@ -27,12 +27,15 @@ var RegistrationService = class {
 	async register(data, context) {
 		if (!this.options.registrationEnabled) throw new RegistrationDisabledError();
 		const validator = new Container({});
-		validator.mount(new UserValidator({ pathsToInclude: [
-			"email",
-			"name",
-			"password",
-			"realm_id"
-		] }));
+		validator.mount(new UserValidator({
+			pathsToInclude: [
+				"email",
+				"name",
+				"password",
+				"realm_id"
+			],
+			passwordMinLength: this.options.passwordMinLength
+		}));
 		const validated = await validator.run(data, { group: "create" });
 		await this.repository.validateJoinColumns(validated);
 		if (this.options.emailVerificationEnabled) {

package/dist/core/identity/registration/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["UserValidator","createNanoID","BadRequestError","EntityNotFoundError","RegistrationDisabledError","randomBytes","Container","UserCredentialsService","MailTemplateName","RegistrationService","options","mailClient","mailTemplateRenderer","repository","realmRepository","ctx","register","data","context","registrationEnabled","validator","mount","pathsToInclude","validated","run","group","validateJoinColumns","emailVerificationEnabled","active","activate_hash","toString","entity","create","credentialsService","password","protect","realm","resolve","realm_id","id","save","activateUrl","publicUrl","replace","undefined","mail","render","template","REGISTRATION_ACTIVATION","params","code","url","locale","send","to","email","remove","activate","findOneBy","token","merged","merge"],"sources":["../../../../src/core/identity/registration/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { UserValidator } from '@authup/core-kit';\nimport { createNanoID } from '@authup/kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport { RegistrationDisabledError } from './error.ts';\nimport { randomBytes } from 'node:crypto';\nimport { Container } from 'validup';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type {\n    IRegistrationService,\n    RegistrationResult,\n    RegistrationServiceContext,\n    RegistrationServiceOptions,\n} from './types.ts';\nimport type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';\nimport { MailTemplateName } from '../../mail/index.ts';\nimport type { IRealmRepository, IUserRepository } from '../../entities/index.ts';\nimport type { IdentityWorkflowContext } from '../types.ts';\n\nexport class RegistrationService implements IRegistrationService {\n    protected options: RegistrationServiceOptions;\n\n    protected mailClient: IMailClient;\n\n    protected mailTemplateRenderer: IMailTemplateRenderer;\n\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    constructor(ctx: RegistrationServiceContext) {\n        this.options = ctx.options;\n        this.mailClient = ctx.mailClient;\n        this.mailTemplateRenderer = ctx.mailTemplateRenderer;\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n    }\n\n    async register(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<RegistrationResult> {\n        if (!this.options.registrationEnabled) {\n            throw new RegistrationDisabledError();\n        }\n\n        const validator = new Container({});\n        validator.mount(new UserValidator({ pathsToInclude: ['email', 'name', 'password', 'realm_id'] }));\n        const validated = await validator.run(data, { group: 'create' });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (this.options.emailVerificationEnabled) {\n            validated.active = false;\n            validated.activate_hash = randomBytes(32).toString('hex');\n        } else {\n            validated.active = true;\n        }\n\n        const entity = this.repository.create(validated);\n\n        const credentialsService = new UserCredentialsService();\n        entity.password = entity.password || createNanoID(64);\n        entity.password = await credentialsService.protect(entity.password);\n\n        const realm = await this.realmRepository.resolve(entity.realm_id, true);\n        entity.realm_id = realm.id;\n\n        await this.repository.save(entity);\n\n        if (this.options.emailVerificationEnabled) {\n            try {\n                const activateUrl = this.options.publicUrl ?\n                    `${this.options.publicUrl.replace(/\\/+$/, '')}/activate?token=${entity.activate_hash}` :\n                    undefined;\n\n                const mail = await this.mailTemplateRenderer.render({\n                    template: MailTemplateName.REGISTRATION_ACTIVATION,\n                    params: { code: entity.activate_hash!, url: activateUrl },\n                    locale: context?.locale,\n                });\n\n                await this.mailClient.send({\n                    to: entity.email,\n                    ...mail,\n                });\n            } catch {\n                await this.repository.remove(entity);\n                throw new BadRequestError('Registration failed. Could not send activation email.');\n            }\n        }\n\n        return { active: entity.active };\n    }\n\n    async activate(data: { token: string }): Promise<void> {\n        const entity = await this.repository.findOneBy({ activate_hash: data.token });\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const merged = this.repository.merge(entity, {\n            active: true,\n            activate_hash: null,\n        });\n\n        await this.repository.save(merged);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AAyBA,IAAaS,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAiC;EACzC,KAAKL,UAAUK,IAAIL;EACnB,KAAKC,aAAaI,IAAIJ;EACtB,KAAKC,uBAAuBG,IAAIH;EAChC,KAAKC,aAAaE,IAAIF;EACtB,KAAKC,kBAAkBC,IAAID;CAC/B;CAEA,MAAME,SAASC,MAA2BC,SAAgE;EACtG,IAAI,CAAC,KAAKR,QAAQS,qBACd,MAAM,IAAIf,0BAAAA;EAGd,MAAMgB,YAAY,IAAId,UAAU,CAAC,CAAA;EACjCc,UAAUC,MAAM,IAAIrB,cAAc,EAAEsB,gBAAgB;GAAC;GAAS;GAAQ;GAAY;IAAY,CAAA,CAAA;EAC9F,MAAMC,YAAY,MAAMH,UAAUI,IAAIP,MAAM,EAAEQ,OAAO,SAAS,CAAA;EAE9D,MAAM,KAAKZ,WAAWa,oBAAoBH,SAAAA;EAE1C,IAAI,KAAKb,QAAQiB,0BAA0B;GACvCJ,UAAUK,SAAS;GACnBL,UAAUM,gBAAgBxB,YAAY,EAAA,CAAA,CAAIyB,SAAS,KAAA;EACvD,OACIP,UAAUK,SAAS;EAGvB,MAAMG,SAAS,KAAKlB,WAAWmB,OAAOT,SAAAA;EAEtC,MAAMU,qBAAqB,IAAI1B,uBAAAA;EAC/BwB,OAAOG,WAAWH,OAAOG,YAAYjC,aAAa,EAAA;EAClD8B,OAAOG,WAAW,MAAMD,mBAAmBE,QAAQJ,OAAOG,QAAQ;EAGlEH,OAAOO,YAAWF,MADE,KAAKtB,gBAAgBuB,QAAQN,OAAOO,UAAU,IAAA,EAAA,CAC1CC;EAExB,MAAM,KAAK1B,WAAW2B,KAAKT,MAAAA;EAE3B,IAAI,KAAKrB,QAAQiB,0BACb,IAAI;GACA,MAAMc,cAAc,KAAK/B,QAAQgC,YAC7B,GAAG,KAAKhC,QAAQgC,UAAUC,QAAQ,QAAQ,EAAA,EAAI,kBAAkBZ,OAAOF,kBACvEe,KAAAA;GAEJ,MAAMC,OAAO,MAAM,KAAKjC,qBAAqBkC,OAAO;IAChDC,UAAUvC,iBAAiBwC;IAC3BC,QAAQ;KAAEC,MAAMnB,OAAOF;KAAgBsB,KAAKV;IAAY;IACxDW,QAAQlC,SAASkC;GACrB,CAAA;GAEA,MAAM,KAAKzC,WAAW0C,KAAK;IACvBC,IAAIvB,OAAOwB;IACX,GAAGV;GACP,CAAA;EACJ,QAAQ;GACJ,MAAM,KAAKhC,WAAW2C,OAAOzB,MAAAA;GAC7B,MAAM,IAAI7B,gBAAgB,uDAAA;EAC9B;EAGJ,OAAO,EAAE0B,QAAQG,OAAOH,OAAO;CACnC;CAEA,MAAM6B,SAASxC,MAAwC;EACnD,MAAMc,SAAS,MAAM,KAAKlB,WAAW6C,UAAU,EAAE7B,eAAeZ,KAAK0C,MAAM,CAAA;EAE3E,IAAI,CAAC5B,QACD,MAAM,IAAI5B,oBAAAA;EAGd,MAAMyD,SAAS,KAAK/C,WAAWgD,MAAM9B,QAAQ;GACzCH,QAAQ;GACRC,eAAe;EACnB,CAAA;EAEA,MAAM,KAAKhB,WAAW2B,KAAKoB,MAAAA;CAC/B;AACJ"}
+{"version":3,"file":"service.mjs","names":["UserValidator","createNanoID","BadRequestError","EntityNotFoundError","RegistrationDisabledError","randomBytes","Container","UserCredentialsService","MailTemplateName","RegistrationService","options","mailClient","mailTemplateRenderer","repository","realmRepository","ctx","register","data","context","registrationEnabled","validator","mount","pathsToInclude","passwordMinLength","validated","run","group","validateJoinColumns","emailVerificationEnabled","active","activate_hash","toString","entity","create","credentialsService","password","protect","realm","resolve","realm_id","id","save","activateUrl","publicUrl","replace","undefined","mail","render","template","REGISTRATION_ACTIVATION","params","code","url","locale","send","to","email","remove","activate","findOneBy","token","merged","merge"],"sources":["../../../../src/core/identity/registration/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { UserValidator } from '@authup/core-kit';\nimport { createNanoID } from '@authup/kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport { RegistrationDisabledError } from './error.ts';\nimport { randomBytes } from 'node:crypto';\nimport { Container } from 'validup';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type {\n    IRegistrationService,\n    RegistrationResult,\n    RegistrationServiceContext,\n    RegistrationServiceOptions,\n} from './types.ts';\nimport type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';\nimport { MailTemplateName } from '../../mail/index.ts';\nimport type { IRealmRepository, IUserRepository } from '../../entities/index.ts';\nimport type { IdentityWorkflowContext } from '../types.ts';\n\nexport class RegistrationService implements IRegistrationService {\n    protected options: RegistrationServiceOptions;\n\n    protected mailClient: IMailClient;\n\n    protected mailTemplateRenderer: IMailTemplateRenderer;\n\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    constructor(ctx: RegistrationServiceContext) {\n        this.options = ctx.options;\n        this.mailClient = ctx.mailClient;\n        this.mailTemplateRenderer = ctx.mailTemplateRenderer;\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n    }\n\n    async register(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<RegistrationResult> {\n        if (!this.options.registrationEnabled) {\n            throw new RegistrationDisabledError();\n        }\n\n        const validator = new Container({});\n        validator.mount(new UserValidator({\n            pathsToInclude: ['email', 'name', 'password', 'realm_id'],\n            passwordMinLength: this.options.passwordMinLength,\n        }));\n        const validated = await validator.run(data, { group: 'create' });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (this.options.emailVerificationEnabled) {\n            validated.active = false;\n            validated.activate_hash = randomBytes(32).toString('hex');\n        } else {\n            validated.active = true;\n        }\n\n        const entity = this.repository.create(validated);\n\n        const credentialsService = new UserCredentialsService();\n        entity.password = entity.password || createNanoID(64);\n        entity.password = await credentialsService.protect(entity.password);\n\n        const realm = await this.realmRepository.resolve(entity.realm_id, true);\n        entity.realm_id = realm.id;\n\n        await this.repository.save(entity);\n\n        if (this.options.emailVerificationEnabled) {\n            try {\n                const activateUrl = this.options.publicUrl ?\n                    `${this.options.publicUrl.replace(/\\/+$/, '')}/activate?token=${entity.activate_hash}` :\n                    undefined;\n\n                const mail = await this.mailTemplateRenderer.render({\n                    template: MailTemplateName.REGISTRATION_ACTIVATION,\n                    params: { code: entity.activate_hash!, url: activateUrl },\n                    locale: context?.locale,\n                });\n\n                await this.mailClient.send({\n                    to: entity.email,\n                    ...mail,\n                });\n            } catch {\n                await this.repository.remove(entity);\n                throw new BadRequestError('Registration failed. Could not send activation email.');\n            }\n        }\n\n        return { active: entity.active };\n    }\n\n    async activate(data: { token: string }): Promise<void> {\n        const entity = await this.repository.findOneBy({ activate_hash: data.token });\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const merged = this.repository.merge(entity, {\n            active: true,\n            activate_hash: null,\n        });\n\n        await this.repository.save(merged);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AAyBA,IAAaS,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAiC;EACzC,KAAKL,UAAUK,IAAIL;EACnB,KAAKC,aAAaI,IAAIJ;EACtB,KAAKC,uBAAuBG,IAAIH;EAChC,KAAKC,aAAaE,IAAIF;EACtB,KAAKC,kBAAkBC,IAAID;CAC/B;CAEA,MAAME,SAASC,MAA2BC,SAAgE;EACtG,IAAI,CAAC,KAAKR,QAAQS,qBACd,MAAM,IAAIf,0BAAAA;EAGd,MAAMgB,YAAY,IAAId,UAAU,CAAC,CAAA;EACjCc,UAAUC,MAAM,IAAIrB,cAAc;GAC9BsB,gBAAgB;IAAC;IAAS;IAAQ;IAAY;;GAC9CC,mBAAmB,KAAKb,QAAQa;EACpC,CAAA,CAAA;EACA,MAAMC,YAAY,MAAMJ,UAAUK,IAAIR,MAAM,EAAES,OAAO,SAAS,CAAA;EAE9D,MAAM,KAAKb,WAAWc,oBAAoBH,SAAAA;EAE1C,IAAI,KAAKd,QAAQkB,0BAA0B;GACvCJ,UAAUK,SAAS;GACnBL,UAAUM,gBAAgBzB,YAAY,EAAA,CAAA,CAAI0B,SAAS,KAAA;EACvD,OACIP,UAAUK,SAAS;EAGvB,MAAMG,SAAS,KAAKnB,WAAWoB,OAAOT,SAAAA;EAEtC,MAAMU,qBAAqB,IAAI3B,uBAAAA;EAC/ByB,OAAOG,WAAWH,OAAOG,YAAYlC,aAAa,EAAA;EAClD+B,OAAOG,WAAW,MAAMD,mBAAmBE,QAAQJ,OAAOG,QAAQ;EAGlEH,OAAOO,YAAWF,MADE,KAAKvB,gBAAgBwB,QAAQN,OAAOO,UAAU,IAAA,EAAA,CAC1CC;EAExB,MAAM,KAAK3B,WAAW4B,KAAKT,MAAAA;EAE3B,IAAI,KAAKtB,QAAQkB,0BACb,IAAI;GACA,MAAMc,cAAc,KAAKhC,QAAQiC,YAC7B,GAAG,KAAKjC,QAAQiC,UAAUC,QAAQ,QAAQ,EAAA,EAAI,kBAAkBZ,OAAOF,kBACvEe,KAAAA;GAEJ,MAAMC,OAAO,MAAM,KAAKlC,qBAAqBmC,OAAO;IAChDC,UAAUxC,iBAAiByC;IAC3BC,QAAQ;KAAEC,MAAMnB,OAAOF;KAAgBsB,KAAKV;IAAY;IACxDW,QAAQnC,SAASmC;GACrB,CAAA;GAEA,MAAM,KAAK1C,WAAW2C,KAAK;IACvBC,IAAIvB,OAAOwB;IACX,GAAGV;GACP,CAAA;EACJ,QAAQ;GACJ,MAAM,KAAKjC,WAAW4C,OAAOzB,MAAAA;GAC7B,MAAM,IAAI9B,gBAAgB,uDAAA;EAC9B;EAGJ,OAAO,EAAE2B,QAAQG,OAAOH,OAAO;CACnC;CAEA,MAAM6B,SAASzC,MAAwC;EACnD,MAAMe,SAAS,MAAM,KAAKnB,WAAW8C,UAAU,EAAE7B,eAAeb,KAAK2C,MAAM,CAAA;EAE3E,IAAI,CAAC5B,QACD,MAAM,IAAI7B,oBAAAA;EAGd,MAAM0D,SAAS,KAAKhD,WAAWiD,MAAM9B,QAAQ;GACzCH,QAAQ;GACRC,eAAe;EACnB,CAAA;EAEA,MAAM,KAAKjB,WAAW4B,KAAKoB,MAAAA;CAC/B;AACJ"}

package/dist/core/identity/registration/types.d.ts

@@ -5,6 +5,7 @@ export type RegistrationServiceOptions = {
     registrationEnabled?: boolean;
     emailVerificationEnabled?: boolean;
     publicUrl?: string;
+    passwordMinLength?: number;
 };
 export type RegistrationServiceContext = {
     options: RegistrationServiceOptions;

package/dist/core/identity/registration/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/registration/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE3D,MAAM,MAAM,0BAA0B,GAAG;IACrC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACrC,OAAO,EAAE,0BAA0B,CAAC;IACpC,UAAU,EAAE,WAAW,CAAC;IACxB,oBAAoB,EAAE,qBAAqB,CAAC;IAC5C,UAAU,EAAE,eAAe,CAAC;IAC5B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC7B,MAAM,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACpG,QAAQ,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/registration/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE3D,MAAM,MAAM,0BAA0B,GAAG;IACrC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACrC,OAAO,EAAE,0BAA0B,CAAC;IACpC,UAAU,EAAE,WAAW,CAAC;IACxB,oBAAoB,EAAE,qBAAqB,CAAC;IAC5C,UAAU,EAAE,eAAe,CAAC;IAC5B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC7B,MAAM,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACpG,QAAQ,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD"}

package/dist/core/identity/resolver/module.d.ts

@@ -7,6 +7,13 @@ export declare class IdentityResolver implements IIdentityResolver {
     protected userRepository: IUserIdentityRepository;
     protected robotRepository: IRobotIdentityRepository;
     constructor(ctx: IdentityResolverContext);
+    /**
+     * A UUID key is resolved globally by primary key — `realmKey` scopes NAME
+     * resolution only (UUIDs are globally unique, and the realm hint on the
+     * password grant is always set via the master fallback, so applying it to
+     * UUID keys would break realm-less id-identified logins). See
+     * architecture.md → Password grant realm resolution.
+     */
     resolve(type: `${IdentityType}`, key: string, realmKey?: string): Promise<Identity | null>;
     private resolveClient;
     private resolveRobot;

package/dist/core/identity/resolver/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/resolver/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAGR,QAAQ,EAKX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,KAAK,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAC7E,OAAO,KAAK,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAEzH,qBAAa,gBAAiB,YAAW,iBAAiB;IACtD,SAAS,CAAC,gBAAgB,EAAE,yBAAyB,CAAC;IAEtD,SAAS,CAAC,cAAc,EAAE,uBAAuB,CAAC;IAElD,SAAS,CAAC,eAAe,EAAE,wBAAwB,CAAC;gBAExC,GAAG,EAAE,uBAAuB;IAMlC,OAAO,CACT,IAAI,EAAE,GAAG,YAAY,EAAE,EACvB,GAAG,EAAE,MAAM,EACX,QAAQ,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;YAgBb,aAAa;YAsBb,YAAY;YAsBZ,WAAW;CAqB5B"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/resolver/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAGR,QAAQ,EAKX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,KAAK,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAC7E,OAAO,KAAK,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAEzH,qBAAa,gBAAiB,YAAW,iBAAiB;IACtD,SAAS,CAAC,gBAAgB,EAAE,yBAAyB,CAAC;IAEtD,SAAS,CAAC,cAAc,EAAE,uBAAuB,CAAC;IAElD,SAAS,CAAC,eAAe,EAAE,wBAAwB,CAAC;gBAExC,GAAG,EAAE,uBAAuB;IAMxC;;;;;;OAMG;IACG,OAAO,CACT,IAAI,EAAE,GAAG,YAAY,EAAE,EACvB,GAAG,EAAE,MAAM,EACX,QAAQ,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;YAgBb,aAAa;YAsBb,YAAY;YAsBZ,WAAW;CAqB5B"}

package/dist/core/identity/resolver/module.mjs

@@ -13,7 +13,13 @@ var IdentityResolver = class {
 		this.userRepository = ctx.userRepository;
 		this.robotRepository = ctx.robotRepository;
 	}
-	async resolve(type, key, realmKey) {
+	/**
+	* A UUID key is resolved globally by primary key — `realmKey` scopes NAME
+	* resolution only (UUIDs are globally unique, and the realm hint on the
+	* password grant is always set via the master fallback, so applying it to
+	* UUID keys would break realm-less id-identified logins). See
+	* architecture.md → Password grant realm resolution.
+	*/ async resolve(type, key, realmKey) {
 		switch (type) {
 			case IdentityType.CLIENT: return this.resolveClient(key, realmKey);
 			case IdentityType.ROBOT: return this.resolveRobot(key, realmKey);

package/dist/core/identity/resolver/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["IdentityType","isUUID","IdentityResolver","clientRepository","userRepository","robotRepository","ctx","resolve","type","key","realmKey","CLIENT","resolveClient","ROBOT","resolveRobot","USER","resolveUser","data","findOneById","findOneByName"],"sources":["../../../../src/core/identity/resolver/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Client, \n    ClientIdentity, \n    Identity, \n    Robot, \n    RobotIdentity, \n    User, \n    UserIdentity,\n} from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { isUUID } from '@authup/kit';\nimport type { IIdentityResolver, IdentityResolverContext } from './types.ts';\nimport type { IClientIdentityRepository, IRobotIdentityRepository, IUserIdentityRepository } from '../entities/index.ts';\n\nexport class IdentityResolver implements IIdentityResolver {\n    protected clientRepository: IClientIdentityRepository;\n\n    protected userRepository: IUserIdentityRepository;\n\n    protected robotRepository: IRobotIdentityRepository;\n\n    constructor(ctx: IdentityResolverContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.userRepository = ctx.userRepository;\n        this.robotRepository = ctx.robotRepository;\n    }\n\n    async resolve(\n        type: `${IdentityType}`,\n        key: string,\n        realmKey?: string,\n    ): Promise<Identity | null> {\n        switch (type) {\n            case IdentityType.CLIENT: {\n                return this.resolveClient(key, realmKey);\n            }\n            case IdentityType.ROBOT: {\n                return this.resolveRobot(key, realmKey);\n            }\n            case IdentityType.USER: {\n                return this.resolveUser(key, realmKey);\n            }\n        }\n\n        return null;\n    }\n\n    private async resolveClient(\n        key: string,\n        realmKey?: string,\n    ) : Promise<ClientIdentity | null> {\n        let data : Client | null;\n\n        if (isUUID(key)) {\n            data = await this.clientRepository.findOneById(key);\n        } else {\n            data = await this.clientRepository.findOneByName(key, realmKey);\n        }\n\n        if (data) {\n            return {\n                type: IdentityType.CLIENT,\n                data, \n            };\n        }\n\n        return null;\n    }\n\n    private async resolveRobot(\n        key: string,\n        realmKey?: string,\n    ) : Promise<RobotIdentity | null> {\n        let data : Robot | null;\n\n        if (isUUID(key)) {\n            data = await this.robotRepository.findOneById(key);\n        } else {\n            data = await this.robotRepository.findOneByName(key, realmKey);\n        }\n\n        if (data) {\n            return {\n                type: IdentityType.ROBOT,\n                data, \n            };\n        }\n\n        return null;\n    }\n\n    private async resolveUser(\n        key: string,\n        realmKey?: string,\n    ) : Promise<UserIdentity | null> {\n        let data : User | null;\n\n        if (isUUID(key)) {\n            data = await this.userRepository.findOneById(key);\n        } else {\n            data = await this.userRepository.findOneByName(key, realmKey);\n        }\n\n        if (data) {\n            return {\n                type: IdentityType.USER,\n                data, \n            };\n        }\n\n        return null;\n    }\n}\n"],"mappings":";;;;;;AAqBA,IAAaE,mBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA8B;EACtC,KAAKH,mBAAmBG,IAAIH;EAC5B,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,kBAAkBC,IAAID;CAC/B;CAEA,MAAME,QACFC,MACAC,KACAC,UACwB;EACxB,QAAQF,MAAR;GACI,KAAKR,aAAaW,QACd,OAAO,KAAKC,cAAcH,KAAKC,QAAAA;GAEnC,KAAKV,aAAaa,OACd,OAAO,KAAKC,aAAaL,KAAKC,QAAAA;GAElC,KAAKV,aAAae,MACd,OAAO,KAAKC,YAAYP,KAAKC,QAAAA;EAErC;EAEA,OAAO;CACX;CAEA,MAAcE,cACVH,KACAC,UAC+B;EAC/B,IAAIO;EAEJ,IAAIhB,OAAOQ,GAAAA,GACPQ,OAAO,MAAM,KAAKd,iBAAiBe,YAAYT,GAAAA;OAE/CQ,OAAO,MAAM,KAAKd,iBAAiBgB,cAAcV,KAAKC,QAAAA;EAG1D,IAAIO,MACA,OAAO;GACHT,MAAMR,aAAaW;GACnBM;EACJ;EAGJ,OAAO;CACX;CAEA,MAAcH,aACVL,KACAC,UAC8B;EAC9B,IAAIO;EAEJ,IAAIhB,OAAOQ,GAAAA,GACPQ,OAAO,MAAM,KAAKZ,gBAAgBa,YAAYT,GAAAA;OAE9CQ,OAAO,MAAM,KAAKZ,gBAAgBc,cAAcV,KAAKC,QAAAA;EAGzD,IAAIO,MACA,OAAO;GACHT,MAAMR,aAAaa;GACnBI;EACJ;EAGJ,OAAO;CACX;CAEA,MAAcD,YACVP,KACAC,UAC6B;EAC7B,IAAIO;EAEJ,IAAIhB,OAAOQ,GAAAA,GACPQ,OAAO,MAAM,KAAKb,eAAec,YAAYT,GAAAA;OAE7CQ,OAAO,MAAM,KAAKb,eAAee,cAAcV,KAAKC,QAAAA;EAGxD,IAAIO,MACA,OAAO;GACHT,MAAMR,aAAae;GACnBE;EACJ;EAGJ,OAAO;CACX;AACJ"}
+{"version":3,"file":"module.mjs","names":["IdentityType","isUUID","IdentityResolver","clientRepository","userRepository","robotRepository","ctx","resolve","type","key","realmKey","CLIENT","resolveClient","ROBOT","resolveRobot","USER","resolveUser","data","findOneById","findOneByName"],"sources":["../../../../src/core/identity/resolver/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Client, \n    ClientIdentity, \n    Identity, \n    Robot, \n    RobotIdentity, \n    User, \n    UserIdentity,\n} from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { isUUID } from '@authup/kit';\nimport type { IIdentityResolver, IdentityResolverContext } from './types.ts';\nimport type { IClientIdentityRepository, IRobotIdentityRepository, IUserIdentityRepository } from '../entities/index.ts';\n\nexport class IdentityResolver implements IIdentityResolver {\n    protected clientRepository: IClientIdentityRepository;\n\n    protected userRepository: IUserIdentityRepository;\n\n    protected robotRepository: IRobotIdentityRepository;\n\n    constructor(ctx: IdentityResolverContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.userRepository = ctx.userRepository;\n        this.robotRepository = ctx.robotRepository;\n    }\n\n    /**\n     * A UUID key is resolved globally by primary key — `realmKey` scopes NAME\n     * resolution only (UUIDs are globally unique, and the realm hint on the\n     * password grant is always set via the master fallback, so applying it to\n     * UUID keys would break realm-less id-identified logins). See\n     * architecture.md → Password grant realm resolution.\n     */\n    async resolve(\n        type: `${IdentityType}`,\n        key: string,\n        realmKey?: string,\n    ): Promise<Identity | null> {\n        switch (type) {\n            case IdentityType.CLIENT: {\n                return this.resolveClient(key, realmKey);\n            }\n            case IdentityType.ROBOT: {\n                return this.resolveRobot(key, realmKey);\n            }\n            case IdentityType.USER: {\n                return this.resolveUser(key, realmKey);\n            }\n        }\n\n        return null;\n    }\n\n    private async resolveClient(\n        key: string,\n        realmKey?: string,\n    ) : Promise<ClientIdentity | null> {\n        let data : Client | null;\n\n        if (isUUID(key)) {\n            data = await this.clientRepository.findOneById(key);\n        } else {\n            data = await this.clientRepository.findOneByName(key, realmKey);\n        }\n\n        if (data) {\n            return {\n                type: IdentityType.CLIENT,\n                data, \n            };\n        }\n\n        return null;\n    }\n\n    private async resolveRobot(\n        key: string,\n        realmKey?: string,\n    ) : Promise<RobotIdentity | null> {\n        let data : Robot | null;\n\n        if (isUUID(key)) {\n            data = await this.robotRepository.findOneById(key);\n        } else {\n            data = await this.robotRepository.findOneByName(key, realmKey);\n        }\n\n        if (data) {\n            return {\n                type: IdentityType.ROBOT,\n                data, \n            };\n        }\n\n        return null;\n    }\n\n    private async resolveUser(\n        key: string,\n        realmKey?: string,\n    ) : Promise<UserIdentity | null> {\n        let data : User | null;\n\n        if (isUUID(key)) {\n            data = await this.userRepository.findOneById(key);\n        } else {\n            data = await this.userRepository.findOneByName(key, realmKey);\n        }\n\n        if (data) {\n            return {\n                type: IdentityType.USER,\n                data, \n            };\n        }\n\n        return null;\n    }\n}\n"],"mappings":";;;;;;AAqBA,IAAaE,mBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA8B;EACtC,KAAKH,mBAAmBG,IAAIH;EAC5B,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,kBAAkBC,IAAID;CAC/B;;;;;;;IASA,MAAME,QACFC,MACAC,KACAC,UACwB;EACxB,QAAQF,MAAR;GACI,KAAKR,aAAaW,QACd,OAAO,KAAKC,cAAcH,KAAKC,QAAAA;GAEnC,KAAKV,aAAaa,OACd,OAAO,KAAKC,aAAaL,KAAKC,QAAAA;GAElC,KAAKV,aAAae,MACd,OAAO,KAAKC,YAAYP,KAAKC,QAAAA;EAErC;EAEA,OAAO;CACX;CAEA,MAAcE,cACVH,KACAC,UAC+B;EAC/B,IAAIO;EAEJ,IAAIhB,OAAOQ,GAAAA,GACPQ,OAAO,MAAM,KAAKd,iBAAiBe,YAAYT,GAAAA;OAE/CQ,OAAO,MAAM,KAAKd,iBAAiBgB,cAAcV,KAAKC,QAAAA;EAG1D,IAAIO,MACA,OAAO;GACHT,MAAMR,aAAaW;GACnBM;EACJ;EAGJ,OAAO;CACX;CAEA,MAAcH,aACVL,KACAC,UAC8B;EAC9B,IAAIO;EAEJ,IAAIhB,OAAOQ,GAAAA,GACPQ,OAAO,MAAM,KAAKZ,gBAAgBa,YAAYT,GAAAA;OAE9CQ,OAAO,MAAM,KAAKZ,gBAAgBc,cAAcV,KAAKC,QAAAA;EAGzD,IAAIO,MACA,OAAO;GACHT,MAAMR,aAAaa;GACnBI;EACJ;EAGJ,OAAO;CACX;CAEA,MAAcD,YACVP,KACAC,UAC6B;EAC7B,IAAIO;EAEJ,IAAIhB,OAAOQ,GAAAA,GACPQ,OAAO,MAAM,KAAKb,eAAec,YAAYT,GAAAA;OAE7CQ,OAAO,MAAM,KAAKb,eAAee,cAAcV,KAAKC,QAAAA;EAGxD,IAAIO,MACA,OAAO;GACHT,MAAMR,aAAae;GACnBE;EACJ;EAGJ,OAAO;CACX;AACJ"}

package/dist/core/index.mjs

@@ -10,6 +10,7 @@ import { RobotAuthenticator } from "./authentication/entities/robot/module.mjs";
 import { UserAuthenticator } from "./authentication/entities/user/module.mjs";
 import { CredentialsAuthenticator } from "./authentication/module.mjs";
 import { SessionManager } from "./authentication/session/module.mjs";
+import { SESSION_FILTER_KEYS } from "./authentication/session/types.mjs";
 import "./authentication/index.mjs";
 import { ClientService } from "./entities/client/service.mjs";
 import { WebClientProvisioner, buildWebClientAttributes } from "./entities/client/web-client.mjs";
@@ -28,6 +29,7 @@ import { RoleService } from "./entities/role/service.mjs";
 import { RoleAttributeService } from "./entities/role-attribute/service.mjs";
 import { RolePermissionService } from "./entities/role-permission/service.mjs";
 import { ScopeService } from "./entities/scope/service.mjs";
+import { SessionService } from "./entities/session/service.mjs";
 import { UserService } from "./entities/user/service.mjs";
 import { UserAttributeService } from "./entities/user-attribute/service.mjs";
 import { UserPermissionService } from "./entities/user-permission/service.mjs";
@@ -42,11 +44,14 @@ import "./mail/index.mjs";
 import { OAuth2AuthorizationCodeIssuer } from "./oauth2/authorization/code/issuer/module.mjs";
 import { base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, generateOAuth2CodeVerifier } from "./oauth2/authorization/helpers.mjs";
 import { OAuth2AuthorizationCodeVerifier } from "./oauth2/authorization/code/verifier/module.mjs";
+import { OAuth2ClientAuthenticator } from "./oauth2/client/authenticator.mjs";
+import { assertClientGrantAllowed } from "./oauth2/client/grant-type.mjs";
 import { OAuth2AuthorizationCodeRequestVerifier } from "./oauth2/authorization/code-request/verifier/module.mjs";
 import { OAuth2AuthorizationCodeRequestValidator } from "./oauth2/authorization/code-request/validator.mjs";
 import { OAuth2AuthorizationStateManager } from "./oauth2/authorization/state/module.mjs";
 import { OAuth2Authorization } from "./oauth2/authorization/module.mjs";
-import { OAuth2ClientAuthenticator } from "./oauth2/client/authenticator.mjs";
+import { OAuth2EndSessionService } from "./oauth2/end-session/service.mjs";
+import { OAuth2EndSessionRequestValidator } from "./oauth2/end-session/validator.mjs";
 import { buildOAuth2BearerTokenResponse } from "./oauth2/response/bearer.mjs";
 import { OAuth2AuthorizeGrant } from "./oauth2/grant-types/authorize.mjs";
 import { ClientCredentialsGrant } from "./oauth2/grant-types/client-credentials.mjs";
@@ -94,9 +99,12 @@ import "./identity/index.mjs";
 import { ProvisioningEntityStrategyType } from "./provisioning/strategy/constants.mjs";
 import { normalizeEntityProvisioningStrategy } from "./provisioning/strategy/normalize.mjs";
 import { ProvisioningStrategyValidator } from "./provisioning/strategy/validator.mjs";
+import { PermissionProvisioningRelationsValidator } from "./provisioning/entities/permission/relations-validator.mjs";
 import { PermissionProvisioningValidator } from "./provisioning/entities/permission/validator.mjs";
 import { RoleProvisioningValidator } from "./provisioning/entities/role/validator.mjs";
+import { createProvisioningEntitiesValidator } from "./provisioning/entities/utils.mjs";
 import { ClientProvisioningValidator } from "./provisioning/entities/client/validator.mjs";
+import { PolicyProvisioningValidator } from "./provisioning/entities/policy/validator.mjs";
 import { RobotProvisioningValidator } from "./provisioning/entities/robot/validator.mjs";
 import { ScopeProvisioningValidator } from "./provisioning/entities/scope/validator.mjs";
 import { UserProvisioningValidator } from "./provisioning/entities/user/validator.mjs";
@@ -115,4 +123,4 @@ import { ScopeProvisioningSynchronizer } from "./provisioning/synchronizer/scope
 import { UserProvisioningSynchronizer } from "./provisioning/synchronizer/user/module.mjs";
 import "./provisioning/index.mjs";
 import "./security/index.mjs";
-export { BaseCredentialsAuthenticator, ClientAuthenticator, ClientCredentialsGrant, ClientCredentialsService, ClientPermissionService, ClientProvisioningSynchronizer, ClientProvisioningValidator, ClientRoleService, ClientScopeService, ClientService, CredentialsAuthenticator, GraphProvisioningSynchronizer, IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityGrantType, IdentityPermissionProvider, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityProviderRoleMappingService, IdentityResolver, IdentityRoleProvider, MAIL_TEMPLATE_REGISTRY, MailTemplateName, MailTemplateRenderer, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2ClientAuthenticator, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PASSWORD_RESET_EXPIRES_IN_MINUTES, PasswordGrantType, PasswordRecoveryService, PermissionBindingPolicyEvaluator, PermissionCheckerService, PermissionPolicyService, PermissionProvisioningSynchronizer, PermissionProvisioningValidator, PermissionService, PolicyCheckerService, PolicyEngine, PolicyProvisioningSynchronizer, PolicyService, ProvisioningEntityResolver, ProvisioningEntityStrategyType, ProvisioningJunctionSynchronizer, ProvisioningStrategyValidator, RealmProvisioningSynchronizer, RealmProvisioningValidator, RealmService, RegistrationService, RobotAuthenticator, RobotCredentialsGrant, RobotCredentialsService, RobotPermissionService, RobotProvisioningSynchronizer, RobotProvisioningValidator, RobotRoleService, RobotService, RoleAttributeService, RolePermissionService, RoleProvisioningSynchronizer, RoleProvisioningValidator, RoleService, RootProvisioningValidator, ScopeProvisioningSynchronizer, ScopeProvisioningValidator, ScopeService, SessionManager, UserAttributeService, UserAuthenticator, UserCredentialsService, UserPermissionService, UserProvisioningSynchronizer, UserProvisioningValidator, UserRoleService, UserService, WebClientProvisioner, applyJunctionCreateGrant, base64URLEncode, buildJunctionUpdateData, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, buildWebClientAttributes, createIdentityProviderOAuth2Authenticator, defineMailTemplate, generateOAuth2CodeVerifier, normalizeEntityProvisioningStrategy };
+export { BaseCredentialsAuthenticator, ClientAuthenticator, ClientCredentialsGrant, ClientCredentialsService, ClientPermissionService, ClientProvisioningSynchronizer, ClientProvisioningValidator, ClientRoleService, ClientScopeService, ClientService, CredentialsAuthenticator, GraphProvisioningSynchronizer, IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityGrantType, IdentityPermissionProvider, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityProviderRoleMappingService, IdentityResolver, IdentityRoleProvider, MAIL_TEMPLATE_REGISTRY, MailTemplateName, MailTemplateRenderer, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2ClientAuthenticator, OAuth2EndSessionRequestValidator, OAuth2EndSessionService, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PASSWORD_RESET_EXPIRES_IN_MINUTES, PasswordGrantType, PasswordRecoveryService, PermissionBindingPolicyEvaluator, PermissionCheckerService, PermissionPolicyService, PermissionProvisioningRelationsValidator, PermissionProvisioningSynchronizer, PermissionProvisioningValidator, PermissionService, PolicyCheckerService, PolicyEngine, PolicyProvisioningSynchronizer, PolicyProvisioningValidator, PolicyService, ProvisioningEntityResolver, ProvisioningEntityStrategyType, ProvisioningJunctionSynchronizer, ProvisioningStrategyValidator, RealmProvisioningSynchronizer, RealmProvisioningValidator, RealmService, RegistrationService, RobotAuthenticator, RobotCredentialsGrant, RobotCredentialsService, RobotPermissionService, RobotProvisioningSynchronizer, RobotProvisioningValidator, RobotRoleService, RobotService, RoleAttributeService, RolePermissionService, RoleProvisioningSynchronizer, RoleProvisioningValidator, RoleService, RootProvisioningValidator, SESSION_FILTER_KEYS, ScopeProvisioningSynchronizer, ScopeProvisioningValidator, ScopeService, SessionManager, SessionService, UserAttributeService, UserAuthenticator, UserCredentialsService, UserPermissionService, UserProvisioningSynchronizer, UserProvisioningValidator, UserRoleService, UserService, WebClientProvisioner, applyJunctionCreateGrant, assertClientGrantAllowed, base64URLEncode, buildJunctionUpdateData, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, buildWebClientAttributes, createIdentityProviderOAuth2Authenticator, createProvisioningEntitiesValidator, defineMailTemplate, generateOAuth2CodeVerifier, normalizeEntityProvisioningStrategy };

package/dist/core/oauth2/authorization/code/index.mjs

@@ -2,6 +2,7 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { OAuth2AuthorizationCodeIssuer } from "./issuer/module.mjs";
+import "./issuer/index.mjs";
 import { OAuth2AuthorizationCodeVerifier } from "./verifier/module.mjs";
 import "./verifier/index.mjs";
 export { OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeVerifier };

package/dist/core/oauth2/authorization/code/issuer/module.d.ts

@@ -6,6 +6,5 @@ export declare class OAuth2AuthorizationCodeIssuer implements IOAuth2Authorizati
     protected options: OAuth2AuthorizationCodeIssuerOptions;
     constructor(repository: IOAuth2AuthorizationCodeRepository, options?: OAuth2AuthorizationCodeIssuerOptions);
     issue(input: OAuth2AuthorizationCodeRequest, identity: Identity, options?: OAuth2AuthorizationCodeIssuerOptions): Promise<OAuth2AuthorizationCode>;
-    updateIdToken(entity: OAuth2AuthorizationCode, idToken: string): Promise<void>;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/core/oauth2/authorization/code/issuer/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code/issuer/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,uBAAuB,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAC1G,OAAO,KAAK,EAAE,kCAAkC,EAAgC,MAAM,wBAAwB,CAAC;AAC/G,OAAO,KAAK,EAAE,8BAA8B,EAAE,oCAAoC,EAAE,MAAM,YAAY,CAAC;AAEvG,qBAAa,6BAA8B,YAAW,8BAA8B;IAChF,SAAS,CAAC,UAAU,EAAE,kCAAkC,CAAC;IAEzD,SAAS,CAAC,OAAO,EAAE,oCAAoC,CAAC;gBAGpD,UAAU,EAAE,kCAAkC,EAC9C,OAAO,GAAE,oCAAyC;IAMhD,KAAK,CACP,KAAK,EAAE,8BAA8B,EACrC,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,oCAAyC,GAClD,OAAO,CAAC,uBAAuB,CAAC;IAsB9B,aAAa,CACf,MAAM,EAAE,uBAAuB,EAC/B,OAAO,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;CAKpB"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code/issuer/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,uBAAuB,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAE1G,OAAO,KAAK,EAAE,kCAAkC,EAAgC,MAAM,wBAAwB,CAAC;AAC/G,OAAO,KAAK,EAAE,8BAA8B,EAAE,oCAAoC,EAAE,MAAM,YAAY,CAAC;AAEvG,qBAAa,6BAA8B,YAAW,8BAA8B;IAChF,SAAS,CAAC,UAAU,EAAE,kCAAkC,CAAC;IAEzD,SAAS,CAAC,OAAO,EAAE,oCAAoC,CAAC;gBAGpD,UAAU,EAAE,kCAAkC,EAC9C,OAAO,GAAE,oCAAyC;IAMhD,KAAK,CACP,KAAK,EAAE,8BAA8B,EACrC,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,oCAAyC,GAClD,OAAO,CAAC,uBAAuB,CAAC;CA+BvC"}

package/dist/core/oauth2/authorization/code/issuer/module.mjs

@@ -1,6 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { OAuth2RequestError } from "@authup/specs";
 //#region src/core/oauth2/authorization/code/issuer/module.ts
 var OAuth2AuthorizationCodeIssuer = class {
 	repository;
@@ -10,6 +11,8 @@ var OAuth2AuthorizationCodeIssuer = class {
 		this.options = options;
 	}
 	async issue(input, identity, options = {}) {
+		const { realm } = identity.data;
+		if (!realm) throw OAuth2RequestError.identityInvalid();
 		const entity = {
 			redirect_uri: input.redirect_uri,
 			client_id: input.client_id,
@@ -17,18 +20,15 @@ var OAuth2AuthorizationCodeIssuer = class {
 			nonce: input.nonce,
 			code_challenge: input.code_challenge,
 			code_challenge_method: input.code_challenge_method,
-			realm_id: identity.data.realm.id,
-			realm_name: identity.data.realm.name,
+			auth_time: options.authTime ?? Math.floor(Date.now() / 1e3),
+			realm_id: realm.id,
+			realm_name: realm.name,
 			sub: identity.data.id,
 			sub_kind: identity.type
 		};
-		if (options.idToken) entity.id_token = options.idToken;
+		if (options.sessionId) entity.session_id = options.sessionId;
 		return this.repository.save(entity, { maxAge: options.maxAge ?? this.options.maxAge });
 	}
-	async updateIdToken(entity, idToken) {
-		entity.id_token = idToken;
-		await this.repository.save(entity, { maxAge: this.options.maxAge });
-	}
 };
 //#endregion
 export { OAuth2AuthorizationCodeIssuer };

package/dist/core/oauth2/authorization/code/issuer/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2AuthorizationCodeIssuer","repository","options","issue","input","identity","entity","redirect_uri","client_id","scope","nonce","code_challenge","code_challenge_method","realm_id","data","realm","id","realm_name","name","sub","sub_kind","type","idToken","id_token","save","maxAge","updateIdToken"],"sources":["../../../../../../src/core/oauth2/authorization/code/issuer/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Identity, OAuth2AuthorizationCode, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport type { IOAuth2AuthorizationCodeRepository, OAuth2AuthorizationCodeInput } from '../repository/index.ts';\nimport type { IOAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeIssuerOptions } from './types.ts';\n\nexport class OAuth2AuthorizationCodeIssuer implements IOAuth2AuthorizationCodeIssuer {\n    protected repository: IOAuth2AuthorizationCodeRepository;\n\n    protected options: OAuth2AuthorizationCodeIssuerOptions;\n\n    constructor(\n        repository: IOAuth2AuthorizationCodeRepository,\n        options: OAuth2AuthorizationCodeIssuerOptions = {},\n    ) {\n        this.repository = repository;\n        this.options = options;\n    }\n\n    async issue(\n        input: OAuth2AuthorizationCodeRequest,\n        identity: Identity,\n        options: OAuth2AuthorizationCodeIssuerOptions = {},\n    ) : Promise<OAuth2AuthorizationCode> {\n        const entity: OAuth2AuthorizationCodeInput = {\n            redirect_uri: input.redirect_uri,\n            client_id: input.client_id,\n            scope: input.scope,\n            nonce: input.nonce,\n            code_challenge: input.code_challenge,\n            code_challenge_method: input.code_challenge_method,\n\n            realm_id: identity.data.realm.id,\n            realm_name: identity.data.realm.name,\n            sub: identity.data.id,\n            sub_kind: identity.type,\n        };\n\n        if (options.idToken) {\n            entity.id_token = options.idToken;\n        }\n\n        return this.repository.save(entity, { maxAge: options.maxAge ?? this.options.maxAge });\n    }\n\n    async updateIdToken(\n        entity: OAuth2AuthorizationCode,\n        idToken: string,\n    ) : Promise<void> {\n        entity.id_token = idToken;\n\n        await this.repository.save(entity, { maxAge: this.options.maxAge });\n    }\n}\n"],"mappings":";;;;AAWA,IAAaA,gCAAb,MAAaA;CACCC;CAEAC;CAEV,YACID,YACAC,UAAgD,CAAC,GACnD;EACE,KAAKD,aAAaA;EAClB,KAAKC,UAAUA;CACnB;CAEA,MAAMC,MACFC,OACAC,UACAH,UAAgD,CAAC,GAChB;EACjC,MAAMI,SAAuC;GACzCC,cAAcH,MAAMG;GACpBC,WAAWJ,MAAMI;GACjBC,OAAOL,MAAMK;GACbC,OAAON,MAAMM;GACbC,gBAAgBP,MAAMO;GACtBC,uBAAuBR,MAAMQ;GAE7BC,UAAUR,SAASS,KAAKC,MAAMC;GAC9BC,YAAYZ,SAASS,KAAKC,MAAMG;GAChCC,KAAKd,SAASS,KAAKE;GACnBI,UAAUf,SAASgB;EACvB;EAEA,IAAInB,QAAQoB,SACRhB,OAAOiB,WAAWrB,QAAQoB;EAG9B,OAAO,KAAKrB,WAAWuB,KAAKlB,QAAQ,EAAEmB,QAAQvB,QAAQuB,UAAU,KAAKvB,QAAQuB,OAAO,CAAA;CACxF;CAEA,MAAMC,cACFpB,QACAgB,SACc;EACdhB,OAAOiB,WAAWD;EAElB,MAAM,KAAKrB,WAAWuB,KAAKlB,QAAQ,EAAEmB,QAAQ,KAAKvB,QAAQuB,OAAO,CAAA;CACrE;AACJ"}
+{"version":3,"file":"module.mjs","names":["OAuth2RequestError","OAuth2AuthorizationCodeIssuer","repository","options","issue","input","identity","realm","data","identityInvalid","entity","redirect_uri","client_id","scope","nonce","code_challenge","code_challenge_method","auth_time","authTime","Math","floor","Date","now","realm_id","id","realm_name","name","sub","sub_kind","type","sessionId","session_id","save","maxAge"],"sources":["../../../../../../src/core/oauth2/authorization/code/issuer/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Identity, OAuth2AuthorizationCode, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport { OAuth2RequestError } from '@authup/specs';\nimport type { IOAuth2AuthorizationCodeRepository, OAuth2AuthorizationCodeInput } from '../repository/index.ts';\nimport type { IOAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeIssuerOptions } from './types.ts';\n\nexport class OAuth2AuthorizationCodeIssuer implements IOAuth2AuthorizationCodeIssuer {\n    protected repository: IOAuth2AuthorizationCodeRepository;\n\n    protected options: OAuth2AuthorizationCodeIssuerOptions;\n\n    constructor(\n        repository: IOAuth2AuthorizationCodeRepository,\n        options: OAuth2AuthorizationCodeIssuerOptions = {},\n    ) {\n        this.repository = repository;\n        this.options = options;\n    }\n\n    async issue(\n        input: OAuth2AuthorizationCodeRequest,\n        identity: Identity,\n        options: OAuth2AuthorizationCodeIssuerOptions = {},\n    ) : Promise<OAuth2AuthorizationCode> {\n        // The code carries the identity's realm id + name. A dangling realm\n        // relation (realm row deleted without cascade) must fail closed as a\n        // clean OAuth2 error — never a TypeError → 500.\n        const { realm } = identity.data;\n        if (!realm) {\n            throw OAuth2RequestError.identityInvalid();\n        }\n\n        const entity: OAuth2AuthorizationCodeInput = {\n            redirect_uri: input.redirect_uri,\n            client_id: input.client_id,\n            scope: input.scope,\n            nonce: input.nonce,\n            code_challenge: input.code_challenge,\n            code_challenge_method: input.code_challenge_method,\n\n            auth_time: options.authTime ?? Math.floor(Date.now() / 1000),\n\n            realm_id: realm.id,\n            realm_name: realm.name,\n            sub: identity.data.id,\n            sub_kind: identity.type,\n        };\n\n        if (options.sessionId) {\n            entity.session_id = options.sessionId;\n        }\n\n        return this.repository.save(entity, { maxAge: options.maxAge ?? this.options.maxAge });\n    }\n}\n"],"mappings":";;;;;AAYA,IAAaC,gCAAb,MAAaA;CACCC;CAEAC;CAEV,YACID,YACAC,UAAgD,CAAC,GACnD;EACE,KAAKD,aAAaA;EAClB,KAAKC,UAAUA;CACnB;CAEA,MAAMC,MACFC,OACAC,UACAH,UAAgD,CAAC,GAChB;EAIjC,MAAM,EAAEI,UAAUD,SAASE;EAC3B,IAAI,CAACD,OACD,MAAMP,mBAAmBS,gBAAe;EAG5C,MAAMC,SAAuC;GACzCC,cAAcN,MAAMM;GACpBC,WAAWP,MAAMO;GACjBC,OAAOR,MAAMQ;GACbC,OAAOT,MAAMS;GACbC,gBAAgBV,MAAMU;GACtBC,uBAAuBX,MAAMW;GAE7BC,WAAWd,QAAQe,YAAYC,KAAKC,MAAMC,KAAKC,IAAG,IAAK,GAAA;GAEvDC,UAAUhB,MAAMiB;GAChBC,YAAYlB,MAAMmB;GAClBC,KAAKrB,SAASE,KAAKgB;GACnBI,UAAUtB,SAASuB;EACvB;EAEA,IAAI1B,QAAQ2B,WACRpB,OAAOqB,aAAa5B,QAAQ2B;EAGhC,OAAO,KAAK5B,WAAW8B,KAAKtB,QAAQ,EAAEuB,QAAQ9B,QAAQ8B,UAAU,KAAK9B,QAAQ8B,OAAO,CAAA;CACxF;AACJ"}

package/dist/core/oauth2/authorization/code/issuer/types.d.ts

@@ -4,10 +4,19 @@ export type OAuth2AuthorizationCodeIssuerOptions = {
      * Max duration in seconds
      */
     maxAge?: number;
-    idToken?: string;
+    /**
+     * The id of the session the authorizing bearer belongs to, persisted on the
+     * authorization code so the token exchange can reuse it.
+     */
+    sessionId?: string | null;
+    /**
+     * The authentication instant (seconds since epoch) — persisted on the code
+     * for the id_token `auth_time` claim minted at the /token exchange.
+     * Defaults to the issuance instant (session-less flows authenticate now).
+     */
+    authTime?: number;
 };
 export interface IOAuth2AuthorizationCodeIssuer {
     issue(input: OAuth2AuthorizationCodeRequest, identity: Identity, options?: OAuth2AuthorizationCodeIssuerOptions): Promise<OAuth2AuthorizationCode>;
-    updateIdToken(entity: OAuth2AuthorizationCode, idToken: string): Promise<void>;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/core/oauth2/authorization/code/issuer/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code/issuer/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,uBAAuB,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAE1G,MAAM,MAAM,oCAAoC,GAAG;IAC/C;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,WAAW,8BAA8B;IAC3C,KAAK,CACD,KAAK,EAAE,8BAA8B,EACrC,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE,oCAAoC,GAC9C,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAErC,aAAa,CACT,MAAM,EAAE,uBAAuB,EAC/B,OAAO,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAAC;CACrB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code/issuer/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,uBAAuB,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAE1G,MAAM,MAAM,oCAAoC,GAAG;IAC/C;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,WAAW,8BAA8B;IAC3C,KAAK,CACD,KAAK,EAAE,8BAA8B,EACrC,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE,oCAAoC,GAC9C,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACxC"}

package/dist/core/oauth2/authorization/code/verifier/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code/verifier/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAIhE,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,wBAAwB,CAAC;AACjF,OAAO,KAAK,EAAE,gCAAgC,EAAE,qCAAqC,EAAE,MAAM,YAAY,CAAC;AAE1G,qBAAa,+BAAgC,YAAW,gCAAgC;IACpF,SAAS,CAAC,UAAU,EAAG,kCAAkC,CAAC;gBAE9C,UAAU,EAAE,kCAAkC;IAIpD,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qCAAqC,GAAI,OAAO,CAAC,uBAAuB,CAAC;CAiDhH"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code/verifier/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAIhE,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,wBAAwB,CAAC;AACjF,OAAO,KAAK,EAAE,gCAAgC,EAAE,qCAAqC,EAAE,MAAM,YAAY,CAAC;AAE1G,qBAAa,+BAAgC,YAAW,gCAAgC;IACpF,SAAS,CAAC,UAAU,EAAG,kCAAkC,CAAC;gBAE9C,UAAU,EAAE,kCAAkC;IAIpD,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qCAAqC,GAAI,OAAO,CAAC,uBAAuB,CAAC;CA0DhH"}

package/dist/core/oauth2/authorization/code/verifier/module.mjs

@@ -15,6 +15,7 @@ var OAuth2AuthorizationCodeVerifier = class {
 		if (entity.client_id) {
 			if (!options.clientId || options.clientId !== entity.client_id) throw OAuth2GrantError.invalid();
 		}
+		if (options.realmId && entity.realm_id && entity.realm_id !== options.realmId) throw OAuth2GrantError.invalid();
 		if (entity.redirect_uri) {
 			if (!options.redirectUri || entity.redirect_uri !== options.redirectUri) throw OAuth2GrantError.redirectUriMismatch();
 		}

package/dist/core/oauth2/authorization/code/verifier/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2AuthorizationCodeChallengeMethod","OAuth2GrantError","buildOAuth2CodeChallenge","OAuth2AuthorizationCodeVerifier","repository","verify","code","options","entity","popOneById","invalid","client_id","clientId","redirect_uri","redirectUri","redirectUriMismatch","clientIsPublic","code_challenge","codeVerifier","code_challenge_method","SHA_256","codeVerifierHash"],"sources":["../../../../../../src/core/oauth2/authorization/code/verifier/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2AuthorizationCode } from '@authup/core-kit';\nimport { OAuth2AuthorizationCodeChallengeMethod, OAuth2GrantError } from '@authup/specs';\nimport { buildOAuth2CodeChallenge } from '../../helpers.ts';\n\nimport type { IOAuth2AuthorizationCodeRepository } from '../repository/index.ts';\nimport type { IOAuth2AuthorizationCodeVerifier, IOAuth2AuthorizationCodeVerifyOptions } from './types.ts';\n\nexport class OAuth2AuthorizationCodeVerifier implements IOAuth2AuthorizationCodeVerifier {\n    protected repository : IOAuth2AuthorizationCodeRepository;\n\n    constructor(repository: IOAuth2AuthorizationCodeRepository) {\n        this.repository = repository;\n    }\n\n    async verify(code: string, options: IOAuth2AuthorizationCodeVerifyOptions) : Promise<OAuth2AuthorizationCode> {\n        const entity = await this.repository.popOneById(code);\n        if (!entity) {\n            throw OAuth2GrantError.invalid();\n        }\n\n        // RFC 6749 §4.1.3: if the client was issued a client_id, verify the\n        // authorization code was issued to the authenticated client. Always\n        // require a clientId to be supplied so a malformed token request can't\n        // bypass the binding by omitting it.\n        if (entity.client_id) {\n            if (!options.clientId || options.clientId !== entity.client_id) {\n                throw OAuth2GrantError.invalid();\n            }\n        }\n\n        if (entity.redirect_uri) {\n            if (!options.redirectUri || entity.redirect_uri !== options.redirectUri) {\n                throw OAuth2GrantError.redirectUriMismatch();\n            }\n        }\n\n        // Public clients MUST use PKCE (RFC 7636). Defense in depth in case\n        // the authorize-side check was bypassed or the client's\n        // is_confidential flag changed between authorize and token.\n        if (options.clientIsPublic && !entity.code_challenge) {\n            throw OAuth2GrantError.invalid('PKCE is required for public clients.');\n        }\n\n        if (entity.code_challenge) {\n            if (!options.codeVerifier) {\n                throw OAuth2GrantError.invalid('Code verifier invalid.');\n            }\n\n            // RFC 7636 §4.3: code_challenge_method defaults to \"plain\" when\n            // absent. Only treat the challenge as S256 when the client\n            // explicitly sent code_challenge_method=S256.\n            if (entity.code_challenge_method === OAuth2AuthorizationCodeChallengeMethod.SHA_256) {\n                const codeVerifierHash = await buildOAuth2CodeChallenge(options.codeVerifier);\n                if (codeVerifierHash !== entity.code_challenge) {\n                    throw OAuth2GrantError.invalid('PKCE code_verifier mismatch.');\n                }\n            } else if (options.codeVerifier !== entity.code_challenge) {\n                throw OAuth2GrantError.invalid('PKCE code_verifier mismatch.');\n            }\n        }\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;AAcA,IAAaG,kCAAb,MAAaA;CACCC;CAEV,YAAYA,YAAgD;EACxD,KAAKA,aAAaA;CACtB;CAEA,MAAMC,OAAOC,MAAcC,SAAmF;EAC1G,MAAMC,SAAS,MAAM,KAAKJ,WAAWK,WAAWH,IAAAA;EAChD,IAAI,CAACE,QACD,MAAMP,iBAAiBS,QAAO;EAOlC,IAAIF,OAAOG;OACH,CAACJ,QAAQK,YAAYL,QAAQK,aAAaJ,OAAOG,WACjD,MAAMV,iBAAiBS,QAAO;EAAA;EAItC,IAAIF,OAAOK;OACH,CAACN,QAAQO,eAAeN,OAAOK,iBAAiBN,QAAQO,aACxD,MAAMb,iBAAiBc,oBAAmB;EAAA;EAOlD,IAAIR,QAAQS,kBAAkB,CAACR,OAAOS,gBAClC,MAAMhB,iBAAiBS,QAAQ,sCAAA;EAGnC,IAAIF,OAAOS,gBAAgB;GACvB,IAAI,CAACV,QAAQW,cACT,MAAMjB,iBAAiBS,QAAQ,wBAAA;GAMnC,IAAIF,OAAOW,0BAA0BnB,uCAAuCoB;QAEpEC,MAD2BnB,yBAAyBK,QAAQW,YAAY,MACnDV,OAAOS,gBAC5B,MAAMhB,iBAAiBS,QAAQ,8BAAA;GAAA,OAEhC,IAAIH,QAAQW,iBAAiBV,OAAOS,gBACvC,MAAMhB,iBAAiBS,QAAQ,8BAAA;EAEvC;EAEA,OAAOF;CACX;AACJ"}
+{"version":3,"file":"module.mjs","names":["OAuth2AuthorizationCodeChallengeMethod","OAuth2GrantError","buildOAuth2CodeChallenge","OAuth2AuthorizationCodeVerifier","repository","verify","code","options","entity","popOneById","invalid","client_id","clientId","realmId","realm_id","redirect_uri","redirectUri","redirectUriMismatch","clientIsPublic","code_challenge","codeVerifier","code_challenge_method","SHA_256","codeVerifierHash"],"sources":["../../../../../../src/core/oauth2/authorization/code/verifier/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2AuthorizationCode } from '@authup/core-kit';\nimport { OAuth2AuthorizationCodeChallengeMethod, OAuth2GrantError } from '@authup/specs';\nimport { buildOAuth2CodeChallenge } from '../../helpers.ts';\n\nimport type { IOAuth2AuthorizationCodeRepository } from '../repository/index.ts';\nimport type { IOAuth2AuthorizationCodeVerifier, IOAuth2AuthorizationCodeVerifyOptions } from './types.ts';\n\nexport class OAuth2AuthorizationCodeVerifier implements IOAuth2AuthorizationCodeVerifier {\n    protected repository : IOAuth2AuthorizationCodeRepository;\n\n    constructor(repository: IOAuth2AuthorizationCodeRepository) {\n        this.repository = repository;\n    }\n\n    async verify(code: string, options: IOAuth2AuthorizationCodeVerifyOptions) : Promise<OAuth2AuthorizationCode> {\n        const entity = await this.repository.popOneById(code);\n        if (!entity) {\n            throw OAuth2GrantError.invalid();\n        }\n\n        // RFC 6749 §4.1.3: if the client was issued a client_id, verify the\n        // authorization code was issued to the authenticated client. Always\n        // require a clientId to be supplied so a malformed token request can't\n        // bypass the binding by omitting it.\n        if (entity.client_id) {\n            if (!options.clientId || options.clientId !== entity.client_id) {\n                throw OAuth2GrantError.invalid();\n            }\n        }\n\n        // Realm binding (defense in depth): the code's realm (the authorizing\n        // identity's realm) must match the authenticated client's realm. Blocks\n        // redeeming a realm-A identity's code against a realm-B client — covers\n        // codes minted outside OAuth2Authorization.authorize() (identity-provider\n        // callback) and any in-flight codes issued before the authorize-side gate.\n        if (options.realmId && entity.realm_id && entity.realm_id !== options.realmId) {\n            throw OAuth2GrantError.invalid();\n        }\n\n        if (entity.redirect_uri) {\n            if (!options.redirectUri || entity.redirect_uri !== options.redirectUri) {\n                throw OAuth2GrantError.redirectUriMismatch();\n            }\n        }\n\n        // Public clients MUST use PKCE (RFC 7636). Defense in depth in case\n        // the authorize-side check was bypassed or the client's\n        // is_confidential flag changed between authorize and token.\n        if (options.clientIsPublic && !entity.code_challenge) {\n            throw OAuth2GrantError.invalid('PKCE is required for public clients.');\n        }\n\n        if (entity.code_challenge) {\n            if (!options.codeVerifier) {\n                throw OAuth2GrantError.invalid('Code verifier invalid.');\n            }\n\n            // RFC 7636 §4.3: code_challenge_method defaults to \"plain\" when\n            // absent. Only treat the challenge as S256 when the client\n            // explicitly sent code_challenge_method=S256.\n            if (entity.code_challenge_method === OAuth2AuthorizationCodeChallengeMethod.SHA_256) {\n                const codeVerifierHash = await buildOAuth2CodeChallenge(options.codeVerifier);\n                if (codeVerifierHash !== entity.code_challenge) {\n                    throw OAuth2GrantError.invalid('PKCE code_verifier mismatch.');\n                }\n            } else if (options.codeVerifier !== entity.code_challenge) {\n                throw OAuth2GrantError.invalid('PKCE code_verifier mismatch.');\n            }\n        }\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;AAcA,IAAaG,kCAAb,MAAaA;CACCC;CAEV,YAAYA,YAAgD;EACxD,KAAKA,aAAaA;CACtB;CAEA,MAAMC,OAAOC,MAAcC,SAAmF;EAC1G,MAAMC,SAAS,MAAM,KAAKJ,WAAWK,WAAWH,IAAAA;EAChD,IAAI,CAACE,QACD,MAAMP,iBAAiBS,QAAO;EAOlC,IAAIF,OAAOG;OACH,CAACJ,QAAQK,YAAYL,QAAQK,aAAaJ,OAAOG,WACjD,MAAMV,iBAAiBS,QAAO;EAAA;EAStC,IAAIH,QAAQM,WAAWL,OAAOM,YAAYN,OAAOM,aAAaP,QAAQM,SAClE,MAAMZ,iBAAiBS,QAAO;EAGlC,IAAIF,OAAOO;OACH,CAACR,QAAQS,eAAeR,OAAOO,iBAAiBR,QAAQS,aACxD,MAAMf,iBAAiBgB,oBAAmB;EAAA;EAOlD,IAAIV,QAAQW,kBAAkB,CAACV,OAAOW,gBAClC,MAAMlB,iBAAiBS,QAAQ,sCAAA;EAGnC,IAAIF,OAAOW,gBAAgB;GACvB,IAAI,CAACZ,QAAQa,cACT,MAAMnB,iBAAiBS,QAAQ,wBAAA;GAMnC,IAAIF,OAAOa,0BAA0BrB,uCAAuCsB;QAEpEC,MAD2BrB,yBAAyBK,QAAQa,YAAY,MACnDZ,OAAOW,gBAC5B,MAAMlB,iBAAiBS,QAAQ,8BAAA;GAAA,OAEhC,IAAIH,QAAQa,iBAAiBZ,OAAOW,gBACvC,MAAMlB,iBAAiBS,QAAQ,8BAAA;EAEvC;EAEA,OAAOF;CACX;AACJ"}

package/dist/core/oauth2/authorization/code/verifier/types.d.ts

@@ -4,6 +4,7 @@ export type IOAuth2AuthorizationCodeVerifyOptions = {
     codeVerifier?: string;
     clientId?: string;
     clientIsPublic?: boolean;
+    realmId?: string;
 };
 export interface IOAuth2AuthorizationCodeVerifier {
     verify(code: string, options: IOAuth2AuthorizationCodeVerifyOptions): Promise<OAuth2AuthorizationCode>;

package/dist/core/oauth2/authorization/code/verifier/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code/verifier/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAEhE,MAAM,MAAM,qCAAqC,GAAG;IAChD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC5B,CAAC;AAEF,MAAM,WAAW,gCAAgC;IAC7C,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qCAAqC,GAAI,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC3G"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code/verifier/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAEhE,MAAM,MAAM,qCAAqC,GAAG;IAChD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,WAAW,gCAAgC;IAC7C,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qCAAqC,GAAI,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC3G"}

package/dist/core/oauth2/authorization/code-request/validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/authorization/code-request/validator.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAQvE,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAGpC,qBAAa,uCAAwC,SAAQ,SAAS,CAAC,8BAA8B,CAAC;IAClG,SAAS,CAAC,UAAU;CA0EvB"}
+{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/authorization/code-request/validator.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAUvE,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAGpC,qBAAa,uCAAwC,SAAQ,SAAS,CAAC,8BAA8B,CAAC;IAClG,SAAS,CAAC,UAAU;CAsIvB"}

package/dist/core/oauth2/authorization/code-request/validator.mjs

@@ -1,7 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { OAuth2AuthorizationCodeChallengeMethod, OAuth2AuthorizationResponseType, OAuth2ResponseTypeError } from "@authup/specs";
+import { OAuth2AuthorizationCodeChallengeMethod, OAuth2AuthorizationPrompt, OAuth2AuthorizationResponseType, OAuth2RequestError, OAuth2ResponseTypeError } from "@authup/specs";
 import { Container } from "validup";
 import { createValidator } from "@validup/zod";
 import { z } from "zod";
@@ -10,12 +10,11 @@ var OAuth2AuthorizationCodeRequestValidator = class extends Container {
 	initialize() {
 		super.initialize();
 		this.mount("response_type", createValidator(z.string().nonempty().check((ctx) => {
-			const availableResponseTypes = Object.values(OAuth2AuthorizationResponseType);
-			const responseTypes = ctx.value.split(" ");
-			for (const responseType of responseTypes) if (!availableResponseTypes.includes(responseType)) {
+			const responseTypes = ctx.value.split(" ").filter(Boolean);
+			if (responseTypes.length !== 1 || responseTypes[0] !== OAuth2AuthorizationResponseType.CODE) {
 				const error = OAuth2ResponseTypeError.unsupported();
 				ctx.issues.push({
-					input: responseType,
+					input: ctx.value,
 					code: "custom",
 					message: error.message
 				});
@@ -28,6 +27,21 @@ var OAuth2AuthorizationCodeRequestValidator = class extends Container {
 		this.mount("code_challenge", { optional: true }, createValidator(z.string().min(1).max(256).nullable()));
 		this.mount("code_challenge_method", { optional: true }, createValidator(z.enum(OAuth2AuthorizationCodeChallengeMethod).nullable()));
 		this.mount("nonce", { optional: true }, createValidator(z.string().min(1).max(512).nullable()));
+		this.mount("prompt", { optional: true }, createValidator(z.string().min(1).max(128).nullable().check((ctx) => {
+			if (!ctx.value) return z.NEVER;
+			const values = ctx.value.split(" ").filter(Boolean);
+			if (values.includes(OAuth2AuthorizationPrompt.NONE) && values.length > 1) {
+				const error = OAuth2RequestError.malformed("prompt=none must not be combined with other prompt values.");
+				ctx.issues.push({
+					input: ctx.value,
+					code: "custom",
+					message: error.message
+				});
+			}
+			return z.NEVER;
+		})));
+		this.mount("max_age", { optional: true }, createValidator(z.preprocess((value) => typeof value === "string" && value.trim() === "" ? void 0 : value, z.coerce.number().int().min(0).nullable().optional())));
+		this.mount("login_hint", { optional: true }, createValidator(z.string().trim().toLowerCase().min(1).max(256).nullable()));
 		this.mount("realm_id", { optional: true }, createValidator(z.string().nonempty()));
 		this.mount("client_id", createValidator(z.string().nonempty()));
 	}

package/dist/core/oauth2/authorization/code-request/validator.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"validator.mjs","names":["OAuth2AuthorizationCodeChallengeMethod","OAuth2AuthorizationResponseType","OAuth2ResponseTypeError","createValidator","Container","z","OAuth2AuthorizationCodeRequestValidator","initialize","mount","string","nonempty","check","ctx","availableResponseTypes","Object","values","responseTypes","value","split","responseType","includes","error","unsupported","issues","push","input","code","message","NEVER","url","min","max","optional","nullable","enum"],"sources":["../../../../../src/core/oauth2/authorization/code-request/validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport {\n    OAuth2AuthorizationCodeChallengeMethod,\n    OAuth2AuthorizationResponseType,\n    OAuth2ResponseTypeError,\n} from '@authup/specs';\n\nimport { createValidator } from '@validup/zod';\nimport { Container } from 'validup';\nimport { z } from 'zod';\n\nexport class OAuth2AuthorizationCodeRequestValidator extends Container<OAuth2AuthorizationCodeRequest> {\n    protected initialize() {\n        super.initialize();\n\n        this.mount(\n            'response_type',\n            createValidator(\n                z\n                    .string()\n                    .nonempty()\n                    .check((ctx) => {\n                        const availableResponseTypes = Object.values(OAuth2AuthorizationResponseType);\n                        const responseTypes = ctx.value.split(' ') as OAuth2AuthorizationResponseType[];\n\n                        for (const responseType of responseTypes) {\n                            if (!availableResponseTypes.includes(responseType)) {\n                                const error = OAuth2ResponseTypeError.unsupported();\n                                ctx.issues.push({\n                                    input: responseType,\n                                    code: 'custom',\n                                    message: error.message,\n                                });\n                            }\n                        }\n\n                        return z.NEVER;\n                    }),\n            ),\n        );\n\n        this.mount(\n            'redirect_uri',\n            createValidator(z.string().url()),\n        );\n\n        this.mount(\n            'scope',\n            createValidator(z.string().min(3).max(512)),\n        );\n\n        this.mount(\n            'state',\n            { optional: true },\n            createValidator(z.string().min(5).max(2048).nullable()),\n        );\n\n        this.mount(\n            'code_challenge',\n            { optional: true },\n            createValidator(z.string().min(1).max(256).nullable()),\n        );\n\n        this.mount(\n            'code_challenge_method',\n            { optional: true },\n            createValidator(z.enum(OAuth2AuthorizationCodeChallengeMethod).nullable()),\n        );\n\n        this.mount(\n            'nonce',\n            { optional: true },\n            createValidator(z.string().min(1).max(512).nullable()),\n        );\n\n        this.mount(\n            'realm_id',\n            { optional: true },\n            createValidator(z.string().nonempty()),\n        );\n\n        this.mount(\n            'client_id',\n            createValidator(z.string().nonempty()),\n        );\n    }\n}\n"],"mappings":";;;;;;;;AAkBA,IAAaM,0CAAb,cAA6DF,UAAAA;CAC/CG,aAAa;EACnB,MAAMA,WAAAA;EAEN,KAAKC,MACD,iBACAL,gBACIE,EACKI,OAAM,CAAA,CACNC,SAAQ,CAAA,CACRC,OAAOC,QAAAA;GACJ,MAAMC,yBAAyBC,OAAOC,OAAOd,+BAAAA;GAC7C,MAAMe,gBAAgBJ,IAAIK,MAAMC,MAAM,GAAA;GAEtC,KAAK,MAAMC,gBAAgBH,eACvB,IAAI,CAACH,uBAAuBO,SAASD,YAAAA,GAAe;IAChD,MAAME,QAAQnB,wBAAwBoB,YAAW;IACjDV,IAAIW,OAAOC,KAAK;KACZC,OAAON;KACPO,MAAM;KACNC,SAASN,MAAMM;IACnB,CAAA;GACJ;GAGJ,OAAOtB,EAAEuB;EACb,CAAA,CAAA,CAAA;EAIZ,KAAKpB,MACD,gBACAL,gBAAgBE,EAAEI,OAAM,CAAA,CAAGoB,IAAG,CAAA,CAAA;EAGlC,KAAKrB,MACD,SACAL,gBAAgBE,EAAEI,OAAM,CAAA,CAAGqB,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA,CAAA;EAG1C,KAAKvB,MACD,SACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAEI,OAAM,CAAA,CAAGqB,IAAI,CAAA,CAAA,CAAGC,IAAI,IAAA,CAAA,CAAME,SAAQ,CAAA,CAAA;EAGxD,KAAKzB,MACD,kBACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAEI,OAAM,CAAA,CAAGqB,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA,CAAKE,SAAQ,CAAA,CAAA;EAGvD,KAAKzB,MACD,yBACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAE6B,KAAKlC,sCAAAA,CAAAA,CAAwCiC,SAAQ,CAAA,CAAA;EAG3E,KAAKzB,MACD,SACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAEI,OAAM,CAAA,CAAGqB,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA,CAAKE,SAAQ,CAAA,CAAA;EAGvD,KAAKzB,MACD,YACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAEI,OAAM,CAAA,CAAGC,SAAQ,CAAA,CAAA;EAGvC,KAAKF,MACD,aACAL,gBAAgBE,EAAEI,OAAM,CAAA,CAAGC,SAAQ,CAAA,CAAA;CAE3C;AACJ"}
+{"version":3,"file":"validator.mjs","names":["OAuth2AuthorizationCodeChallengeMethod","OAuth2AuthorizationPrompt","OAuth2AuthorizationResponseType","OAuth2RequestError","OAuth2ResponseTypeError","createValidator","Container","z","OAuth2AuthorizationCodeRequestValidator","initialize","mount","string","nonempty","check","ctx","responseTypes","value","split","filter","Boolean","invalid","length","CODE","error","unsupported","issues","push","input","code","message","NEVER","url","min","max","optional","nullable","enum","values","includes","NONE","malformed","preprocess","trim","undefined","coerce","number","int","toLowerCase"],"sources":["../../../../../src/core/oauth2/authorization/code-request/validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport {\n    OAuth2AuthorizationCodeChallengeMethod,\n    OAuth2AuthorizationPrompt,\n    OAuth2AuthorizationResponseType,\n    OAuth2RequestError,\n    OAuth2ResponseTypeError,\n} from '@authup/specs';\n\nimport { createValidator } from '@validup/zod';\nimport { Container } from 'validup';\nimport { z } from 'zod';\n\nexport class OAuth2AuthorizationCodeRequestValidator extends Container<OAuth2AuthorizationCodeRequest> {\n    protected initialize() {\n        super.initialize();\n\n        this.mount(\n            'response_type',\n            createValidator(\n                z\n                    .string()\n                    .nonempty()\n                    .check((ctx) => {\n                        // OAuth 2.1 posture: the authorization endpoint issues\n                        // codes only — the implicit/hybrid response types\n                        // (token, id_token, none) are not supported.\n                        const responseTypes = ctx.value.split(' ').filter(Boolean);\n\n                        const invalid = responseTypes.length !== 1 ||\n                            responseTypes[0] !== OAuth2AuthorizationResponseType.CODE;\n\n                        if (invalid) {\n                            const error = OAuth2ResponseTypeError.unsupported();\n                            ctx.issues.push({\n                                input: ctx.value,\n                                code: 'custom',\n                                message: error.message,\n                            });\n                        }\n\n                        return z.NEVER;\n                    }),\n            ),\n        );\n\n        this.mount(\n            'redirect_uri',\n            createValidator(z.string().url()),\n        );\n\n        this.mount(\n            'scope',\n            createValidator(z.string().min(3).max(512)),\n        );\n\n        this.mount(\n            'state',\n            { optional: true },\n            createValidator(z.string().min(5).max(2048).nullable()),\n        );\n\n        this.mount(\n            'code_challenge',\n            { optional: true },\n            createValidator(z.string().min(1).max(256).nullable()),\n        );\n\n        this.mount(\n            'code_challenge_method',\n            { optional: true },\n            createValidator(z.enum(OAuth2AuthorizationCodeChallengeMethod).nullable()),\n        );\n\n        this.mount(\n            'nonce',\n            { optional: true },\n            createValidator(z.string().min(1).max(512).nullable()),\n        );\n\n        this.mount(\n            'prompt',\n            { optional: true },\n            createValidator(\n                z\n                    .string()\n                    .min(1)\n                    .max(128)\n                    .nullable()\n                    .check((ctx) => {\n                        if (!ctx.value) {\n                            return z.NEVER;\n                        }\n\n                        // Unknown tokens are ignored (forward-compat). Only the\n                        // OIDC §3.1.2.1 rule \"none must not be combined\" is enforced.\n                        const values = ctx.value.split(' ').filter(Boolean);\n                        if (\n                            values.includes(OAuth2AuthorizationPrompt.NONE) &&\n                            values.length > 1\n                        ) {\n                            const error = OAuth2RequestError.malformed(\n                                'prompt=none must not be combined with other prompt values.',\n                            );\n                            ctx.issues.push({\n                                input: ctx.value,\n                                code: 'custom',\n                                message: error.message,\n                            });\n                        }\n\n                        return z.NEVER;\n                    }),\n            ),\n        );\n\n        this.mount(\n            'max_age',\n            { optional: true },\n            createValidator(\n                z.preprocess(\n                    // An empty / blank max_age (e.g. a stray `?max_age=` from an\n                    // RP template) is absent, not `max_age=0` — without this\n                    // z.coerce.number('') === 0 would silently force\n                    // re-authentication on every request for that RP.\n                    (value) => (typeof value === 'string' && value.trim() === '' ? undefined : value),\n                    z.coerce.number().int().min(0).nullable().optional(),\n                ),\n            ),\n        );\n\n        this.mount(\n            'login_hint',\n            { optional: true },\n            createValidator(z.string().trim().toLowerCase().min(1).max(256).nullable()),\n        );\n\n        this.mount(\n            'realm_id',\n            { optional: true },\n            createValidator(z.string().nonempty()),\n        );\n\n        this.mount(\n            'client_id',\n            createValidator(z.string().nonempty()),\n        );\n    }\n}\n"],"mappings":";;;;;;;;AAoBA,IAAaQ,0CAAb,cAA6DF,UAAAA;CAC/CG,aAAa;EACnB,MAAMA,WAAAA;EAEN,KAAKC,MACD,iBACAL,gBACIE,EACKI,OAAM,CAAA,CACNC,SAAQ,CAAA,CACRC,OAAOC,QAAAA;GAIJ,MAAMC,gBAAgBD,IAAIE,MAAMC,MAAM,GAAA,CAAA,CAAKC,OAAOC,OAAAA;GAKlD,IAHgBJ,cAAcM,WAAW,KACrCN,cAAc,OAAOb,gCAAgCoB,MAE5C;IACT,MAAMC,QAAQnB,wBAAwBoB,YAAW;IACjDV,IAAIW,OAAOC,KAAK;KACZC,OAAOb,IAAIE;KACXY,MAAM;KACNC,SAASN,MAAMM;IACnB,CAAA;GACJ;GAEA,OAAOtB,EAAEuB;EACb,CAAA,CAAA,CAAA;EAIZ,KAAKpB,MACD,gBACAL,gBAAgBE,EAAEI,OAAM,CAAA,CAAGoB,IAAG,CAAA,CAAA;EAGlC,KAAKrB,MACD,SACAL,gBAAgBE,EAAEI,OAAM,CAAA,CAAGqB,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA,CAAA;EAG1C,KAAKvB,MACD,SACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAEI,OAAM,CAAA,CAAGqB,IAAI,CAAA,CAAA,CAAGC,IAAI,IAAA,CAAA,CAAME,SAAQ,CAAA,CAAA;EAGxD,KAAKzB,MACD,kBACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAEI,OAAM,CAAA,CAAGqB,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA,CAAKE,SAAQ,CAAA,CAAA;EAGvD,KAAKzB,MACD,yBACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAE6B,KAAKpC,sCAAAA,CAAAA,CAAwCmC,SAAQ,CAAA,CAAA;EAG3E,KAAKzB,MACD,SACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAEI,OAAM,CAAA,CAAGqB,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA,CAAKE,SAAQ,CAAA,CAAA;EAGvD,KAAKzB,MACD,UACA,EAAEwB,UAAU,KAAK,GACjB7B,gBACIE,EACKI,OAAM,CAAA,CACNqB,IAAI,CAAA,CAAA,CACJC,IAAI,GAAA,CAAA,CACJE,SAAQ,CAAA,CACRtB,OAAOC,QAAAA;GACJ,IAAI,CAACA,IAAIE,OACL,OAAOT,EAAEuB;GAKb,MAAMO,SAASvB,IAAIE,MAAMC,MAAM,GAAA,CAAA,CAAKC,OAAOC,OAAAA;GAC3C,IACIkB,OAAOC,SAASrC,0BAA0BsC,IAAI,KAC9CF,OAAOhB,SAAS,GAClB;IACE,MAAME,QAAQpB,mBAAmBqC,UAC7B,4DAAA;IAEJ1B,IAAIW,OAAOC,KAAK;KACZC,OAAOb,IAAIE;KACXY,MAAM;KACNC,SAASN,MAAMM;IACnB,CAAA;GACJ;GAEA,OAAOtB,EAAEuB;EACb,CAAA,CAAA,CAAA;EAIZ,KAAKpB,MACD,WACA,EAAEwB,UAAU,KAAK,GACjB7B,gBACIE,EAAEkC,YAKGzB,UAAW,OAAOA,UAAU,YAAYA,MAAM0B,KAAI,MAAO,KAAKC,KAAAA,IAAY3B,OAC3ET,EAAEqC,OAAOC,OAAM,CAAA,CAAGC,IAAG,CAAA,CAAGd,IAAI,CAAA,CAAA,CAAGG,SAAQ,CAAA,CAAGD,SAAQ,CAAA,CAAA,CAAA;EAK9D,KAAKxB,MACD,cACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAEI,OAAM,CAAA,CAAG+B,KAAI,CAAA,CAAGK,YAAW,CAAA,CAAGf,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA,CAAKE,SAAQ,CAAA,CAAA;EAG5E,KAAKzB,MACD,YACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAEI,OAAM,CAAA,CAAGC,SAAQ,CAAA,CAAA;EAGvC,KAAKF,MACD,aACAL,gBAAgBE,EAAEI,OAAM,CAAA,CAAGC,SAAQ,CAAA,CAAA;CAE3C;AACJ"}

package/dist/core/oauth2/authorization/code-request/verifier/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code-request/verifier/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAWvE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,KAAK,EACR,uCAAuC,EACvC,gDAAgD,EAChD,6CAA6C,EAChD,MAAM,YAAY,CAAC;AASpB,qBAAa,sCAAuC,YAAW,uCAAuC;IAClG,SAAS,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;IAEpD,SAAS,CAAC,eAAe,EAAE,sBAAsB,CAAC;gBAEtC,GAAG,EAAE,6CAA6C;IAK9D;;;OAGG;IACG,MAAM,CACR,IAAI,EAAE,8BAA8B,GACpC,OAAO,CAAC,gDAAgD,CAAC;CA6DhE"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code-request/verifier/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAWvE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAExE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,KAAK,EACR,uCAAuC,EACvC,gDAAgD,EAChD,6CAA6C,EAChD,MAAM,YAAY,CAAC;AAEpB,qBAAa,sCAAuC,YAAW,uCAAuC;IAClG,SAAS,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;IAEpD,SAAS,CAAC,eAAe,EAAE,sBAAsB,CAAC;gBAEtC,GAAG,EAAE,6CAA6C;IAK9D;;;OAGG;IACG,MAAM,CACR,IAAI,EAAE,8BAA8B,GACpC,OAAO,CAAC,gDAAgD,CAAC;CAsFhE"}