@authup/server-core 1.0.0-beta.51 → 1.0.0-beta.52

package/dist/core/oauth2/grant-types/types.d.ts

@@ -1,13 +1,22 @@
 import type { ObjectLiteral } from '@authup/kit';
 import type { OAuth2TokenGrantResponse } from '@authup/specs';
+import type { Logger } from '@authup/server-kit';
 import type { ISessionManager } from '../../authentication/index.ts';
-import type { IOAuth2TokenIssuer, IOAuth2TokenRevoker, IOAuth2TokenVerifier } from '../token/index.ts';
+import type { IOAuth2KeyRepository } from '../key/index.ts';
+import type { ISessionTokenRepository } from '../session-token/index.ts';
+import type { IOAuth2OpenIDTokenIssuer, IOAuth2TokenIssuer, IOAuth2TokenRepository, IOAuth2TokenVerifier } from '../token/index.ts';
 export type BaseGrantContext = {
     accessTokenIssuer: IOAuth2TokenIssuer;
     sessionManager: ISessionManager;
 };
 export type OAuth2AuthorizeGrantContext = BaseGrantContext & {
     refreshTokenIssuer: IOAuth2TokenIssuer;
+    openIdTokenIssuer: IOAuth2OpenIDTokenIssuer;
+    /**
+     * The realm's signing key determines the id_token's JWS alg — and with it
+     * the at_hash digest (OIDC Core §3.1.3.6).
+     */
+    keyRepository: IOAuth2KeyRepository;
 };
 export type OAuth2IdentityGrantContext = BaseGrantContext & {
     refreshTokenIssuer: IOAuth2TokenIssuer;
@@ -15,10 +24,21 @@ export type OAuth2IdentityGrantContext = BaseGrantContext & {
 export type OAuth2PasswordGrantContext = BaseGrantContext & {
     refreshTokenIssuer: IOAuth2TokenIssuer;
 };
+export type OAuth2RefreshTokenGrantOptions = {
+    /**
+     * Grace period (seconds) during which a just-consumed refresh token still
+     * mints new chain-linked tokens instead of triggering replay detection.
+     * default: 0 (strict).
+     */
+    gracePeriod?: number;
+};
 export type OAuth2RefreshTokenGrantContext = BaseGrantContext & {
     refreshTokenIssuer: IOAuth2TokenIssuer;
     tokenVerifier: IOAuth2TokenVerifier;
-    tokenRevoker: IOAuth2TokenRevoker;
+    tokenRepository: IOAuth2TokenRepository;
+    sessionTokenRepository: ISessionTokenRepository;
+    logger?: Logger;
+    options?: OAuth2RefreshTokenGrantOptions;
 };
 export type OAuth2GrantRunWIthOptions = {
     userAgent?: string;

package/dist/core/oauth2/grant-types/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/grant-types/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEvG,MAAM,MAAM,gBAAgB,GAAG;IAC3B,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,cAAc,EAAE,eAAe,CAAA;CAClC,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG,gBAAgB,GAAG;IACzD,kBAAkB,EAAE,kBAAkB,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,gBAAgB,GAAG;IACxD,kBAAkB,EAAE,kBAAkB,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,gBAAgB,GAAG;IACxD,kBAAkB,EAAE,kBAAkB,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG,gBAAgB,GAAG;IAC5D,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,aAAa,EAAE,oBAAoB,CAAC;IACpC,YAAY,EAAE,mBAAmB,CAAA;CACpC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,aAAa;IAC3C,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,yBAAyB,GAAI,OAAO,CAAC,wBAAwB,CAAC,CAAC;CAC1F"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/grant-types/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,KAAK,EACR,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,EACvB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,gBAAgB,GAAG;IAC3B,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,cAAc,EAAE,eAAe,CAAA;CAClC,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG,gBAAgB,GAAG;IACzD,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,iBAAiB,EAAE,wBAAwB,CAAC;IAC5C;;;OAGG;IACH,aAAa,EAAE,oBAAoB,CAAC;CACvC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,gBAAgB,GAAG;IACxD,kBAAkB,EAAE,kBAAkB,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,gBAAgB,GAAG;IACxD,kBAAkB,EAAE,kBAAkB,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IACzC;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG,gBAAgB,GAAG;IAC5D,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,aAAa,EAAE,oBAAoB,CAAC;IACpC,eAAe,EAAE,sBAAsB,CAAC;IACxC,sBAAsB,EAAE,uBAAuB,CAAC;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,8BAA8B,CAAC;CAC5C,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,aAAa;IAC3C,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,yBAAyB,GAAI,OAAO,CAAC,wBAAwB,CAAC,CAAC;CAC1F"}

package/dist/core/oauth2/index.d.ts

@@ -1,9 +1,11 @@
 export * from './authorization/index.ts';
 export * from './client/index.ts';
+export * from './end-session/index.ts';
 export * from './grant-types/index.ts';
 export * from './key/index.ts';
 export * from './openid/index.ts';
 export * from './response/index.ts';
 export * from './scope/index.ts';
+export * from './session-token/index.ts';
 export * from './token/index.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/oauth2/index.ts"],"names":[],"mappings":"AAOA,cAAc,0BAA0B,CAAC;AACzC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/oauth2/index.ts"],"names":[],"mappings":"AAOA,cAAc,0BAA0B,CAAC;AACzC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,wBAAwB,CAAC;AACvC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC"}

package/dist/core/oauth2/index.mjs

@@ -4,13 +4,17 @@ import.meta.url;
 import { OAuth2AuthorizationCodeIssuer } from "./authorization/code/issuer/module.mjs";
 import { base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, generateOAuth2CodeVerifier } from "./authorization/helpers.mjs";
 import { OAuth2AuthorizationCodeVerifier } from "./authorization/code/verifier/module.mjs";
+import { OAuth2ClientAuthenticator } from "./client/authenticator.mjs";
+import { assertClientGrantAllowed } from "./client/grant-type.mjs";
+import "./client/index.mjs";
 import { OAuth2AuthorizationCodeRequestVerifier } from "./authorization/code-request/verifier/module.mjs";
 import { OAuth2AuthorizationCodeRequestValidator } from "./authorization/code-request/validator.mjs";
 import { OAuth2AuthorizationStateManager } from "./authorization/state/module.mjs";
 import { OAuth2Authorization } from "./authorization/module.mjs";
 import "./authorization/index.mjs";
-import { OAuth2ClientAuthenticator } from "./client/authenticator.mjs";
-import "./client/index.mjs";
+import { OAuth2EndSessionService } from "./end-session/service.mjs";
+import { OAuth2EndSessionRequestValidator } from "./end-session/validator.mjs";
+import "./end-session/index.mjs";
 import { buildOAuth2BearerTokenResponse } from "./response/bearer.mjs";
 import { OAuth2AuthorizeGrant } from "./grant-types/authorize.mjs";
 import { ClientCredentialsGrant } from "./grant-types/client-credentials.mjs";
@@ -30,4 +34,4 @@ import { OAuth2TokenRevoker } from "./token/revoker/module.mjs";
 import { OAuth2TokenSigner } from "./token/signer/module.mjs";
 import { OAuth2TokenVerifier } from "./token/verifier/module.mjs";
 import "./token/index.mjs";
-export { ClientCredentialsGrant, IdentityGrantType, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2ClientAuthenticator, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PasswordGrantType, RobotCredentialsGrant, base64URLEncode, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, generateOAuth2CodeVerifier };
+export { ClientCredentialsGrant, IdentityGrantType, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2ClientAuthenticator, OAuth2EndSessionRequestValidator, OAuth2EndSessionService, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PasswordGrantType, RobotCredentialsGrant, assertClientGrantAllowed, base64URLEncode, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, generateOAuth2CodeVerifier };

package/dist/core/oauth2/session-token/index.d.ts

@@ -0,0 +1,2 @@
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/session-token/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/session-token/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC"}

package/dist/core/oauth2/session-token/index.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/oauth2/session-token/types.d.ts

@@ -0,0 +1,70 @@
+import type { SessionToken, SessionTokenKind } from '@authup/core-kit';
+export type SessionTokenCreateInput = {
+    id: string;
+    session_id: string;
+    kind: SessionTokenKind;
+    parent_id?: string | null;
+    refresh_token_id?: string | null;
+    ip_address: string;
+    user_agent: string;
+    expires_at: string;
+};
+export type SessionTokenRef = {
+    id: string;
+    expires_at: string;
+};
+export interface ISessionTokenRepository {
+    /**
+     * Persist a newly issued session-token row.
+     */
+    create(input: SessionTokenCreateInput): Promise<SessionToken>;
+    /**
+     * Find a session-token row by its id (= jti).
+     */
+    findOneById(id: string): Promise<SessionToken | null>;
+    /**
+     * Inventory query — every token bound to a session.
+     */
+    findBySessionId(sessionId: string): Promise<SessionToken[]>;
+    /**
+     * Atomically consume a refresh-token row. Resolves `true` only when this
+     * call flipped a fresh (not consumed, not revoked) refresh row to consumed;
+     * `false` on a replay / concurrent-refresh loser.
+     *
+     * @param id jti
+     * @param at consumption timestamp (iso)
+     */
+    markRefreshConsumed(id: string, at: string): Promise<boolean>;
+    /**
+     * Whether any refresh-token row descended from `parentId` has itself been
+     * consumed — i.e. the rotation chain has advanced past `parentId`. Used to
+     * scope the grace window to the chain tip (a consumed descendant proves the
+     * presented token is a stale ancestor, not a benign concurrent re-use).
+     *
+     * @param parentId jti of the presented refresh token
+     */
+    hasConsumedChild(parentId: string): Promise<boolean>;
+    /**
+     * Soft-revoke a single token row (e.g. explicit `/token/revoke`).
+     *
+     * @param id jti
+     * @param at revocation timestamp (iso)
+     */
+    revokeById(id: string, at: string): Promise<void>;
+    /**
+     * Soft-revoke every token row of a session (family revoke). Returns the
+     * affected rows' jti + expiry so the caller can blocklist each in cache
+     * with a TTL pinned to the token's real lifetime.
+     *
+     * @param sessionId
+     * @param at revocation timestamp (iso)
+     */
+    revokeBySessionId(sessionId: string, at: string): Promise<SessionTokenRef[]>;
+    /**
+     * Delete every token row whose `expires_at` is before the given timestamp.
+     *
+     * @param before iso timestamp
+     */
+    deleteExpired(before: string): Promise<number>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/oauth2/session-token/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/session-token/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEvE,MAAM,MAAM,uBAAuB,GAAG;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,gBAAgB,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,WAAW,uBAAuB;IACpC;;OAEG;IACH,MAAM,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAE9D;;OAEG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAEtD;;OAEG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAE5D;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE9D;;;;;;;OAOG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAErD;;;;;OAKG;IACH,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElD;;;;;;;OAOG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAE7E;;;;OAIG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAClD"}

package/dist/core/oauth2/session-token/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/oauth2/token/issuer/access/module.d.ts

@@ -1,6 +1,7 @@
 import type { OAuth2TokenPayload } from '@authup/specs';
 import type { IOAuth2TokenSigner } from '../../signer/index.ts';
 import type { IOAuth2TokenRepository } from '../../repository/index.ts';
+import type { ISessionTokenRepository } from '../../../session-token/index.ts';
 import { OAuth2BaseTokenIssuer } from '../base.ts';
 import type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';
 import type { IIdentityRoleProvider } from '../../../../identity/index.ts';
@@ -8,7 +9,8 @@ export declare class OAuth2AccessTokenIssuer extends OAuth2BaseTokenIssuer imple
     protected repository: IOAuth2TokenRepository;
     protected signer: IOAuth2TokenSigner;
     protected identityRoleProvider?: IIdentityRoleProvider;
-    constructor(repository: IOAuth2TokenRepository, signer: IOAuth2TokenSigner, options?: OAuth2TokenIssuerOptions, identityRoleProvider?: IIdentityRoleProvider);
+    protected sessionTokenRepository?: ISessionTokenRepository;
+    constructor(repository: IOAuth2TokenRepository, signer: IOAuth2TokenSigner, options?: OAuth2TokenIssuerOptions, identityRoleProvider?: IIdentityRoleProvider, sessionTokenRepository?: ISessionTokenRepository);
     issue(input?: OAuth2TokenPayload): Promise<OAuth2TokenIssuerResponse>;
     protected buildAccessClaims(input: OAuth2TokenPayload): Promise<Pick<OAuth2TokenPayload, 'realm_access' | 'global_access'>>;
 }

package/dist/core/oauth2/token/issuer/access/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/token/issuer/access/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAC3G,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAE3E,qBAAa,uBAAwB,SAAQ,qBAAsB,YAAW,kBAAkB;IAC5F,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,MAAM,EAAG,kBAAkB,CAAC;IAEtC,SAAS,CAAC,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;gBAGnD,UAAU,EAAE,sBAAsB,EAClC,MAAM,EAAE,kBAAkB,EAC1B,OAAO,GAAE,wBAA6B,EACtC,oBAAoB,CAAC,EAAE,qBAAqB;IAS1C,KAAK,CAAC,KAAK,GAAE,kBAAuB,GAAI,OAAO,CAAC,yBAAyB,CAAC;cAoBhE,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,GAAI,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,cAAc,GAAG,eAAe,CAAC,CAAC;CA6BrI"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/token/issuer/access/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAC3G,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAE3E,qBAAa,uBAAwB,SAAQ,qBAAsB,YAAW,kBAAkB;IAC5F,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,MAAM,EAAG,kBAAkB,CAAC;IAEtC,SAAS,CAAC,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAEvD,SAAS,CAAC,sBAAsB,CAAC,EAAE,uBAAuB,CAAC;gBAGvD,UAAU,EAAE,sBAAsB,EAClC,MAAM,EAAE,kBAAkB,EAC1B,OAAO,GAAE,wBAA6B,EACtC,oBAAoB,CAAC,EAAE,qBAAqB,EAC5C,sBAAsB,CAAC,EAAE,uBAAuB;IAU9C,KAAK,CAAC,KAAK,GAAE,kBAAuB,GAAI,OAAO,CAAC,yBAAyB,CAAC;cAgChE,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,GAAI,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,cAAc,GAAG,eAAe,CAAC,CAAC;CA6BrI"}

package/dist/core/oauth2/token/issuer/access/module.mjs

@@ -8,11 +8,13 @@ var OAuth2AccessTokenIssuer = class extends OAuth2BaseTokenIssuer {
 	repository;
 	signer;
 	identityRoleProvider;
-	constructor(repository, signer, options = {}, identityRoleProvider) {
+	sessionTokenRepository;
+	constructor(repository, signer, options = {}, identityRoleProvider, sessionTokenRepository) {
 		super(options);
 		this.repository = repository;
 		this.signer = signer;
 		this.identityRoleProvider = identityRoleProvider;
+		this.sessionTokenRepository = sessionTokenRepository;
 	}
 	async issue(input = {}) {
 		const iss = this.buildIss(input);
@@ -26,6 +28,15 @@ var OAuth2AccessTokenIssuer = class extends OAuth2BaseTokenIssuer {
 		});
 		const token = await this.signer.sign(data);
 		await this.repository.saveWithSignature(data, token);
+		if (this.sessionTokenRepository && data.session_id && data.jti && typeof data.exp === "number") await this.sessionTokenRepository.create({
+			id: data.jti,
+			session_id: data.session_id,
+			kind: "access",
+			refresh_token_id: input.refresh_token_id ?? null,
+			ip_address: data.remote_address ?? "",
+			user_agent: data.user_agent ?? "",
+			expires_at: (/* @__PURE__ */ new Date(data.exp * 1e3)).toISOString()
+		});
 		return [token, data];
 	}
 	async buildAccessClaims(input) {

package/dist/core/oauth2/token/issuer/access/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2TokenKind","OAuth2BaseTokenIssuer","OAuth2AccessTokenIssuer","repository","signer","identityRoleProvider","options","issue","input","iss","buildIss","accessClaims","buildAccessClaims","data","insert","kind","ACCESS","exp","buildExp","token","sign","saveWithSignature","sub","sub_kind","roles","getRolesFor","type","id","clientId","client_id","realmId","realm_id","realmName","realm_name","realmRoles","globalRoles","role","push","name","realm_access","global_access"],"sources":["../../../../../../src/core/oauth2/token/issuer/access/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';\nimport type { IIdentityRoleProvider } from '../../../../identity/index.ts';\n\nexport class OAuth2AccessTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    protected identityRoleProvider?: IIdentityRoleProvider;\n\n    constructor(\n        repository: IOAuth2TokenRepository,\n        signer: IOAuth2TokenSigner,\n        options: OAuth2TokenIssuerOptions = {},\n        identityRoleProvider?: IIdentityRoleProvider,\n    ) {\n        super(options);\n\n        this.repository = repository;\n        this.signer = signer;\n        this.identityRoleProvider = identityRoleProvider;\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        const iss = this.buildIss(input);\n\n        const accessClaims = await this.buildAccessClaims(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            kind: OAuth2TokenKind.ACCESS,\n            exp: this.buildExp(input),\n            ...(iss ? { iss } : {}),\n            ...accessClaims,\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        return [token, data];\n    }\n\n    protected async buildAccessClaims(input: OAuth2TokenPayload) : Promise<Pick<OAuth2TokenPayload, 'realm_access' | 'global_access'>> {\n        if (!this.identityRoleProvider || !input.sub || !input.sub_kind) {\n            return {};\n        }\n\n        const roles = await this.identityRoleProvider.getRolesFor({\n            type: input.sub_kind,\n            id: input.sub,\n            clientId: input.client_id,\n            realmId: input.realm_id,\n            realmName: input.realm_name,\n        });\n\n        const realmRoles: string[] = [];\n        const globalRoles: string[] = [];\n\n        for (const role of roles) {\n            if (!role.realm_id) {\n                globalRoles.push(role.name);\n            } else if (input.realm_id && role.realm_id === input.realm_id) {\n                realmRoles.push(role.name);\n            }\n        }\n\n        return {\n            realm_access: { roles: realmRoles },\n            global_access: { roles: globalRoles },\n        };\n    }\n}\n"],"mappings":";;;;;;AAeA,IAAaE,0BAAb,cAA6CD,sBAAAA;CAC/BE;CAEAC;CAEAC;CAEV,YACIF,YACAC,QACAE,UAAoC,CAAC,GACrCD,sBACF;EACE,MAAMC,OAAAA;EAEN,KAAKH,aAAaA;EAClB,KAAKC,SAASA;EACd,KAAKC,uBAAuBA;CAChC;CAEA,MAAME,MAAMC,QAA4B,CAAC,GAAwC;EAC7E,MAAMC,MAAM,KAAKC,SAASF,KAAAA;EAE1B,MAAMG,eAAe,MAAM,KAAKC,kBAAkBJ,KAAAA;EAElD,MAAMK,OAAO,MAAM,KAAKV,WAAWW,OAAO;GACtC,GAAGN;GACHO,MAAMf,gBAAgBgB;GACtBC,KAAK,KAAKC,SAASV,KAAAA;GACnB,GAAIC,MAAM,EAAEA,IAAI,IAAI,CAAC;GACrB,GAAGE;EACP,CAAA;EAEA,MAAMQ,QAAQ,MAAM,KAAKf,OAAOgB,KAAKP,IAAAA;EAErC,MAAM,KAAKV,WAAWkB,kBAAkBR,MAAMM,KAAAA;EAE9C,OAAO,CAACA,OAAON,IAAAA;CACnB;CAEA,MAAgBD,kBAAkBJ,OAAiG;EAC/H,IAAI,CAAC,KAAKH,wBAAwB,CAACG,MAAMc,OAAO,CAACd,MAAMe,UACnD,OAAO,CAAC;EAGZ,MAAMC,QAAQ,MAAM,KAAKnB,qBAAqBoB,YAAY;GACtDC,MAAMlB,MAAMe;GACZI,IAAInB,MAAMc;GACVM,UAAUpB,MAAMqB;GAChBC,SAAStB,MAAMuB;GACfC,WAAWxB,MAAMyB;EACrB,CAAA;EAEA,MAAMC,aAAuB,CAAA;EAC7B,MAAMC,cAAwB,CAAA;EAE9B,KAAK,MAAMC,QAAQZ,OACf,IAAI,CAACY,KAAKL,UACNI,YAAYE,KAAKD,KAAKE,IAAI;OACvB,IAAI9B,MAAMuB,YAAYK,KAAKL,aAAavB,MAAMuB,UACjDG,WAAWG,KAAKD,KAAKE,IAAI;EAIjC,OAAO;GACHC,cAAc,EAAEf,OAAOU,WAAW;GAClCM,eAAe,EAAEhB,OAAOW,YAAY;EACxC;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["OAuth2TokenKind","OAuth2BaseTokenIssuer","OAuth2AccessTokenIssuer","repository","signer","identityRoleProvider","sessionTokenRepository","options","issue","input","iss","buildIss","accessClaims","buildAccessClaims","data","insert","kind","ACCESS","exp","buildExp","token","sign","saveWithSignature","session_id","jti","create","id","refresh_token_id","ip_address","remote_address","user_agent","expires_at","Date","toISOString","sub","sub_kind","roles","getRolesFor","type","clientId","client_id","realmId","realm_id","realmName","realm_name","realmRoles","globalRoles","role","push","name","realm_access","global_access"],"sources":["../../../../../../src/core/oauth2/token/issuer/access/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport type { ISessionTokenRepository } from '../../../session-token/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';\nimport type { IIdentityRoleProvider } from '../../../../identity/index.ts';\n\nexport class OAuth2AccessTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    protected identityRoleProvider?: IIdentityRoleProvider;\n\n    protected sessionTokenRepository?: ISessionTokenRepository;\n\n    constructor(\n        repository: IOAuth2TokenRepository,\n        signer: IOAuth2TokenSigner,\n        options: OAuth2TokenIssuerOptions = {},\n        identityRoleProvider?: IIdentityRoleProvider,\n        sessionTokenRepository?: ISessionTokenRepository,\n    ) {\n        super(options);\n\n        this.repository = repository;\n        this.signer = signer;\n        this.identityRoleProvider = identityRoleProvider;\n        this.sessionTokenRepository = sessionTokenRepository;\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        const iss = this.buildIss(input);\n\n        const accessClaims = await this.buildAccessClaims(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            kind: OAuth2TokenKind.ACCESS,\n            exp: this.buildExp(input),\n            ...(iss ? { iss } : {}),\n            ...accessClaims,\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        if (this.sessionTokenRepository && data.session_id && data.jti && typeof data.exp === 'number') {\n            await this.sessionTokenRepository.create({\n                id: data.jti,\n                session_id: data.session_id,\n                kind: 'access',\n                refresh_token_id: input.refresh_token_id ?? null,\n                ip_address: data.remote_address ?? '',\n                user_agent: data.user_agent ?? '',\n                expires_at: new Date(data.exp * 1000).toISOString(),\n            });\n        }\n\n        return [token, data];\n    }\n\n    protected async buildAccessClaims(input: OAuth2TokenPayload) : Promise<Pick<OAuth2TokenPayload, 'realm_access' | 'global_access'>> {\n        if (!this.identityRoleProvider || !input.sub || !input.sub_kind) {\n            return {};\n        }\n\n        const roles = await this.identityRoleProvider.getRolesFor({\n            type: input.sub_kind,\n            id: input.sub,\n            clientId: input.client_id,\n            realmId: input.realm_id,\n            realmName: input.realm_name,\n        });\n\n        const realmRoles: string[] = [];\n        const globalRoles: string[] = [];\n\n        for (const role of roles) {\n            if (!role.realm_id) {\n                globalRoles.push(role.name);\n            } else if (input.realm_id && role.realm_id === input.realm_id) {\n                realmRoles.push(role.name);\n            }\n        }\n\n        return {\n            realm_access: { roles: realmRoles },\n            global_access: { roles: globalRoles },\n        };\n    }\n}\n"],"mappings":";;;;;;AAgBA,IAAaE,0BAAb,cAA6CD,sBAAAA;CAC/BE;CAEAC;CAEAC;CAEAC;CAEV,YACIH,YACAC,QACAG,UAAoC,CAAC,GACrCF,sBACAC,wBACF;EACE,MAAMC,OAAAA;EAEN,KAAKJ,aAAaA;EAClB,KAAKC,SAASA;EACd,KAAKC,uBAAuBA;EAC5B,KAAKC,yBAAyBA;CAClC;CAEA,MAAME,MAAMC,QAA4B,CAAC,GAAwC;EAC7E,MAAMC,MAAM,KAAKC,SAASF,KAAAA;EAE1B,MAAMG,eAAe,MAAM,KAAKC,kBAAkBJ,KAAAA;EAElD,MAAMK,OAAO,MAAM,KAAKX,WAAWY,OAAO;GACtC,GAAGN;GACHO,MAAMhB,gBAAgBiB;GACtBC,KAAK,KAAKC,SAASV,KAAAA;GACnB,GAAIC,MAAM,EAAEA,IAAI,IAAI,CAAC;GACrB,GAAGE;EACP,CAAA;EAEA,MAAMQ,QAAQ,MAAM,KAAKhB,OAAOiB,KAAKP,IAAAA;EAErC,MAAM,KAAKX,WAAWmB,kBAAkBR,MAAMM,KAAAA;EAE9C,IAAI,KAAKd,0BAA0BQ,KAAKS,cAAcT,KAAKU,OAAO,OAAOV,KAAKI,QAAQ,UAClF,MAAM,KAAKZ,uBAAuBmB,OAAO;GACrCC,IAAIZ,KAAKU;GACTD,YAAYT,KAAKS;GACjBP,MAAM;GACNW,kBAAkBlB,MAAMkB,oBAAoB;GAC5CC,YAAYd,KAAKe,kBAAkB;GACnCC,YAAYhB,KAAKgB,cAAc;GAC/BC,6BAAY,IAAIC,KAAKlB,KAAKI,MAAM,GAAA,EAAA,CAAMe,YAAW;EACrD,CAAA;EAGJ,OAAO,CAACb,OAAON,IAAAA;CACnB;CAEA,MAAgBD,kBAAkBJ,OAAiG;EAC/H,IAAI,CAAC,KAAKJ,wBAAwB,CAACI,MAAMyB,OAAO,CAACzB,MAAM0B,UACnD,OAAO,CAAC;EAGZ,MAAMC,QAAQ,MAAM,KAAK/B,qBAAqBgC,YAAY;GACtDC,MAAM7B,MAAM0B;GACZT,IAAIjB,MAAMyB;GACVK,UAAU9B,MAAM+B;GAChBC,SAAShC,MAAMiC;GACfC,WAAWlC,MAAMmC;EACrB,CAAA;EAEA,MAAMC,aAAuB,CAAA;EAC7B,MAAMC,cAAwB,CAAA;EAE9B,KAAK,MAAMC,QAAQX,OACf,IAAI,CAACW,KAAKL,UACNI,YAAYE,KAAKD,KAAKE,IAAI;OACvB,IAAIxC,MAAMiC,YAAYK,KAAKL,aAAajC,MAAMiC,UACjDG,WAAWG,KAAKD,KAAKE,IAAI;EAIjC,OAAO;GACHC,cAAc,EAAEd,OAAOS,WAAW;GAClCM,eAAe,EAAEf,OAAOU,YAAY;EACxC;CACJ;AACJ"}

package/dist/core/oauth2/token/issuer/open-id/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/token/issuer/open-id/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,KAAK,EAAE,wBAAwB,EAAE,8BAA8B,EAAE,MAAM,YAAY,CAAC;AAC3F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAEvE,qBAAa,uBAAwB,SAAQ,qBAAsB,YAAW,wBAAwB;IAClG,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,MAAM,EAAG,kBAAkB,CAAC;IAEtC,SAAS,CAAC,gBAAgB,EAAG,iBAAiB,CAAC;IAE/C,SAAS,CAAC,aAAa,EAAE,yBAAyB,CAAC;gBAEvC,GAAG,EAAE,8BAA8B;IAUzC,KAAK,CAAC,KAAK,GAAE,kBAAuB,GAAI,OAAO,CAAC,yBAAyB,CAAC;IAqB1E,iBAAiB,CACnB,KAAK,EAAE,kBAAkB,EACzB,QAAQ,EAAE,QAAQ,GACnB,OAAO,CAAC,yBAAyB,CAAC;CAwBxC"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/token/issuer/open-id/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,KAAK,EAAE,wBAAwB,EAAE,8BAA8B,EAAE,MAAM,YAAY,CAAC;AAC3F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAEvE,qBAAa,uBAAwB,SAAQ,qBAAsB,YAAW,wBAAwB;IAClG,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,MAAM,EAAG,kBAAkB,CAAC;IAEtC,SAAS,CAAC,gBAAgB,EAAG,iBAAiB,CAAC;IAE/C,SAAS,CAAC,aAAa,EAAE,yBAAyB,CAAC;gBAEvC,GAAG,EAAE,8BAA8B;IAUzC,KAAK,CAAC,KAAK,GAAE,kBAAuB,GAAI,OAAO,CAAC,yBAAyB,CAAC;IAqB1E,iBAAiB,CACnB,KAAK,EAAE,kBAAkB,EACzB,QAAQ,EAAE,QAAQ,GACnB,OAAO,CAAC,yBAAyB,CAAC;CA2BxC"}

package/dist/core/oauth2/token/issuer/open-id/module.mjs

@@ -33,7 +33,7 @@ var OAuth2OpenIDTokenIssuer = class extends OAuth2BaseTokenIssuer {
 			...input,
 			...claims,
 			kind: OAuth2TokenKind.ID_TOKEN,
-			auth_time: utc,
+			auth_time: typeof input.auth_time === "number" ? input.auth_time : utc,
 			exp: this.buildExp(input),
 			updated_at: utc,
 			...iss ? { iss } : {},

package/dist/core/oauth2/token/issuer/open-id/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["JWTError","OAuth2TokenKind","OAuth2OpenIDClaimsBuilder","OAuth2BaseTokenIssuer","OAuth2OpenIDTokenIssuer","repository","signer","identityResolver","claimsBuilder","ctx","options","issue","input","sub_kind","payloadPropertyInvalid","sub","identity","resolve","payloadInvalid","issueWithIdentity","claims","fromIdentity","utc","Math","floor","Date","getTime","iss","buildIss","data","insert","kind","ID_TOKEN","auth_time","exp","buildExp","updated_at","client_id","aud","token","sign","saveWithSignature"],"sources":["../../../../../../src/core/oauth2/token/issuer/open-id/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { JWTError, OAuth2TokenKind } from '@authup/specs';\nimport type { Identity } from '@authup/core-kit';\nimport { OAuth2OpenIDClaimsBuilder } from '../../../openid/index.ts';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { OAuth2TokenIssuerResponse } from '../types.ts';\nimport type { IOAuth2OpenIDTokenIssuer, OAuth2OpenIDTokenIssuerContext } from './types.ts';\nimport type { IIdentityResolver } from '../../../../identity/index.ts';\n\nexport class OAuth2OpenIDTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2OpenIDTokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    protected identityResolver : IIdentityResolver;\n\n    protected claimsBuilder: OAuth2OpenIDClaimsBuilder;\n\n    constructor(ctx: OAuth2OpenIDTokenIssuerContext) {\n        super(ctx.options);\n\n        this.repository = ctx.repository;\n        this.signer = ctx.signer;\n\n        this.identityResolver = ctx.identityResolver;\n        this.claimsBuilder = new OAuth2OpenIDClaimsBuilder();\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        if (!input.sub_kind) {\n            throw JWTError.payloadPropertyInvalid('sub_kind');\n        }\n\n        if (!input.sub) {\n            throw JWTError.payloadPropertyInvalid('sub');\n        }\n\n        const identity = await this.identityResolver.resolve(\n            input.sub_kind,\n            input.sub,\n        );\n\n        if (!identity) {\n            throw JWTError.payloadInvalid();\n        }\n\n        return this.issueWithIdentity(input, identity);\n    }\n\n    async issueWithIdentity(\n        input: OAuth2TokenPayload,\n        identity: Identity,\n    ): Promise<OAuth2TokenIssuerResponse> {\n        const claims = this.claimsBuilder.fromIdentity(identity);\n\n        const utc = Math.floor(new Date().getTime() / 1000);\n\n        const iss = this.buildIss(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            ...claims,\n            kind: OAuth2TokenKind.ID_TOKEN,\n            auth_time: utc,\n            exp: this.buildExp(input),\n            updated_at: utc,\n            ...(iss ? { iss } : {}),\n            ...(input.client_id ? { aud: input.client_id } : {}),\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        return [token, data];\n    }\n}\n"],"mappings":";;;;;;;;AAkBA,IAAaI,0BAAb,cAA6CD,sBAAAA;CAC/BE;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAMA,IAAIC,OAAO;EAEjB,KAAKL,aAAaI,IAAIJ;EACtB,KAAKC,SAASG,IAAIH;EAElB,KAAKC,mBAAmBE,IAAIF;EAC5B,KAAKC,gBAAgB,IAAIN,0BAAAA;CAC7B;CAEA,MAAMS,MAAMC,QAA4B,CAAC,GAAwC;EAC7E,IAAI,CAACA,MAAMC,UACP,MAAMb,SAASc,uBAAuB,UAAA;EAG1C,IAAI,CAACF,MAAMG,KACP,MAAMf,SAASc,uBAAuB,KAAA;EAG1C,MAAME,WAAW,MAAM,KAAKT,iBAAiBU,QACzCL,MAAMC,UACND,MAAMG,GAAG;EAGb,IAAI,CAACC,UACD,MAAMhB,SAASkB,eAAc;EAGjC,OAAO,KAAKC,kBAAkBP,OAAOI,QAAAA;CACzC;CAEA,MAAMG,kBACFP,OACAI,UACkC;EAClC,MAAMI,SAAS,KAAKZ,cAAca,aAAaL,QAAAA;EAE/C,MAAMM,MAAMC,KAAKC,uBAAM,IAAIC,KAAAA,EAAAA,CAAOC,QAAO,IAAK,GAAA;EAE9C,MAAMC,MAAM,KAAKC,SAAShB,KAAAA;EAE1B,MAAMiB,OAAO,MAAM,KAAKxB,WAAWyB,OAAO;GACtC,GAAGlB;GACH,GAAGQ;GACHW,MAAM9B,gBAAgB+B;GACtBC,WAAWX;GACXY,KAAK,KAAKC,SAASvB,KAAAA;GACnBwB,YAAYd;GACZ,GAAIK,MAAM,EAAEA,IAAI,IAAI,CAAC;GACrB,GAAIf,MAAMyB,YAAY,EAAEC,KAAK1B,MAAMyB,UAAU,IAAI,CAAC;EACtD,CAAA;EAEA,MAAME,QAAQ,MAAM,KAAKjC,OAAOkC,KAAKX,IAAAA;EAErC,MAAM,KAAKxB,WAAWoC,kBAAkBZ,MAAMU,KAAAA;EAE9C,OAAO,CAACA,OAAOV,IAAAA;CACnB;AACJ"}
+{"version":3,"file":"module.mjs","names":["JWTError","OAuth2TokenKind","OAuth2OpenIDClaimsBuilder","OAuth2BaseTokenIssuer","OAuth2OpenIDTokenIssuer","repository","signer","identityResolver","claimsBuilder","ctx","options","issue","input","sub_kind","payloadPropertyInvalid","sub","identity","resolve","payloadInvalid","issueWithIdentity","claims","fromIdentity","utc","Math","floor","Date","getTime","iss","buildIss","data","insert","kind","ID_TOKEN","auth_time","exp","buildExp","updated_at","client_id","aud","token","sign","saveWithSignature"],"sources":["../../../../../../src/core/oauth2/token/issuer/open-id/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { JWTError, OAuth2TokenKind } from '@authup/specs';\nimport type { Identity } from '@authup/core-kit';\nimport { OAuth2OpenIDClaimsBuilder } from '../../../openid/index.ts';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { OAuth2TokenIssuerResponse } from '../types.ts';\nimport type { IOAuth2OpenIDTokenIssuer, OAuth2OpenIDTokenIssuerContext } from './types.ts';\nimport type { IIdentityResolver } from '../../../../identity/index.ts';\n\nexport class OAuth2OpenIDTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2OpenIDTokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    protected identityResolver : IIdentityResolver;\n\n    protected claimsBuilder: OAuth2OpenIDClaimsBuilder;\n\n    constructor(ctx: OAuth2OpenIDTokenIssuerContext) {\n        super(ctx.options);\n\n        this.repository = ctx.repository;\n        this.signer = ctx.signer;\n\n        this.identityResolver = ctx.identityResolver;\n        this.claimsBuilder = new OAuth2OpenIDClaimsBuilder();\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        if (!input.sub_kind) {\n            throw JWTError.payloadPropertyInvalid('sub_kind');\n        }\n\n        if (!input.sub) {\n            throw JWTError.payloadPropertyInvalid('sub');\n        }\n\n        const identity = await this.identityResolver.resolve(\n            input.sub_kind,\n            input.sub,\n        );\n\n        if (!identity) {\n            throw JWTError.payloadInvalid();\n        }\n\n        return this.issueWithIdentity(input, identity);\n    }\n\n    async issueWithIdentity(\n        input: OAuth2TokenPayload,\n        identity: Identity,\n    ): Promise<OAuth2TokenIssuerResponse> {\n        const claims = this.claimsBuilder.fromIdentity(identity);\n\n        const utc = Math.floor(new Date().getTime() / 1000);\n\n        const iss = this.buildIss(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            ...claims,\n            kind: OAuth2TokenKind.ID_TOKEN,\n            // Real authentication time when threaded from the authorize flow\n            // (the session's creation instant); fall back to issuance time only\n            // for session-less id_token issuance. `sid` rides via ...input.\n            auth_time: typeof input.auth_time === 'number' ? input.auth_time : utc,\n            exp: this.buildExp(input),\n            updated_at: utc,\n            ...(iss ? { iss } : {}),\n            ...(input.client_id ? { aud: input.client_id } : {}),\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        return [token, data];\n    }\n}\n"],"mappings":";;;;;;;;AAkBA,IAAaI,0BAAb,cAA6CD,sBAAAA;CAC/BE;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAMA,IAAIC,OAAO;EAEjB,KAAKL,aAAaI,IAAIJ;EACtB,KAAKC,SAASG,IAAIH;EAElB,KAAKC,mBAAmBE,IAAIF;EAC5B,KAAKC,gBAAgB,IAAIN,0BAAAA;CAC7B;CAEA,MAAMS,MAAMC,QAA4B,CAAC,GAAwC;EAC7E,IAAI,CAACA,MAAMC,UACP,MAAMb,SAASc,uBAAuB,UAAA;EAG1C,IAAI,CAACF,MAAMG,KACP,MAAMf,SAASc,uBAAuB,KAAA;EAG1C,MAAME,WAAW,MAAM,KAAKT,iBAAiBU,QACzCL,MAAMC,UACND,MAAMG,GAAG;EAGb,IAAI,CAACC,UACD,MAAMhB,SAASkB,eAAc;EAGjC,OAAO,KAAKC,kBAAkBP,OAAOI,QAAAA;CACzC;CAEA,MAAMG,kBACFP,OACAI,UACkC;EAClC,MAAMI,SAAS,KAAKZ,cAAca,aAAaL,QAAAA;EAE/C,MAAMM,MAAMC,KAAKC,uBAAM,IAAIC,KAAAA,EAAAA,CAAOC,QAAO,IAAK,GAAA;EAE9C,MAAMC,MAAM,KAAKC,SAAShB,KAAAA;EAE1B,MAAMiB,OAAO,MAAM,KAAKxB,WAAWyB,OAAO;GACtC,GAAGlB;GACH,GAAGQ;GACHW,MAAM9B,gBAAgB+B;GAItBC,WAAW,OAAOrB,MAAMqB,cAAc,WAAWrB,MAAMqB,YAAYX;GACnEY,KAAK,KAAKC,SAASvB,KAAAA;GACnBwB,YAAYd;GACZ,GAAIK,MAAM,EAAEA,IAAI,IAAI,CAAC;GACrB,GAAIf,MAAMyB,YAAY,EAAEC,KAAK1B,MAAMyB,UAAU,IAAI,CAAC;EACtD,CAAA;EAEA,MAAME,QAAQ,MAAM,KAAKjC,OAAOkC,KAAKX,IAAAA;EAErC,MAAM,KAAKxB,WAAWoC,kBAAkBZ,MAAMU,KAAAA;EAE9C,OAAO,CAACA,OAAOV,IAAAA;CACnB;AACJ"}

package/dist/core/oauth2/token/issuer/refresh/module.d.ts

@@ -1,12 +1,14 @@
 import type { OAuth2TokenPayload } from '@authup/specs';
 import type { IOAuth2TokenSigner } from '../../signer/index.ts';
 import type { IOAuth2TokenRepository } from '../../repository/index.ts';
+import type { ISessionTokenRepository } from '../../../session-token/index.ts';
 import { OAuth2BaseTokenIssuer } from '../base.ts';
 import type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';
 export declare class OAuth2RefreshTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {
     protected repository: IOAuth2TokenRepository;
     protected signer: IOAuth2TokenSigner;
-    constructor(repository: IOAuth2TokenRepository, signer: IOAuth2TokenSigner, options?: OAuth2TokenIssuerOptions);
+    protected sessionTokenRepository?: ISessionTokenRepository;
+    constructor(repository: IOAuth2TokenRepository, signer: IOAuth2TokenSigner, options?: OAuth2TokenIssuerOptions, sessionTokenRepository?: ISessionTokenRepository);
     issue(input?: OAuth2TokenPayload): Promise<OAuth2TokenIssuerResponse>;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/core/oauth2/token/issuer/refresh/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/token/issuer/refresh/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAE3G,qBAAa,wBAAyB,SAAQ,qBAAsB,YAAW,kBAAkB;IAC7F,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,MAAM,EAAG,kBAAkB,CAAC;gBAGlC,UAAU,EAAE,sBAAsB,EAClC,MAAM,EAAE,kBAAkB,EAC1B,OAAO,GAAE,wBAA6B;IAQpC,KAAK,CAAC,KAAK,GAAE,kBAAuB,GAAI,OAAO,CAAC,yBAAyB,CAAC;CAgBnF"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/token/issuer/refresh/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAE3G,qBAAa,wBAAyB,SAAQ,qBAAsB,YAAW,kBAAkB;IAC7F,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,MAAM,EAAG,kBAAkB,CAAC;IAEtC,SAAS,CAAC,sBAAsB,CAAC,EAAE,uBAAuB,CAAC;gBAGvD,UAAU,EAAE,sBAAsB,EAClC,MAAM,EAAE,kBAAkB,EAC1B,OAAO,GAAE,wBAA6B,EACtC,sBAAsB,CAAC,EAAE,uBAAuB;IAS9C,KAAK,CAAC,KAAK,GAAE,kBAAuB,GAAI,OAAO,CAAC,yBAAyB,CAAC;CA4BnF"}

package/dist/core/oauth2/token/issuer/refresh/module.mjs

@@ -7,10 +7,12 @@ import { OAuth2TokenKind } from "@authup/specs";
 var OAuth2RefreshTokenIssuer = class extends OAuth2BaseTokenIssuer {
 	repository;
 	signer;
-	constructor(repository, signer, options = {}) {
+	sessionTokenRepository;
+	constructor(repository, signer, options = {}, sessionTokenRepository) {
 		super(options);
 		this.repository = repository;
 		this.signer = signer;
+		this.sessionTokenRepository = sessionTokenRepository;
 	}
 	async issue(input = {}) {
 		const iss = this.buildIss(input);
@@ -22,6 +24,15 @@ var OAuth2RefreshTokenIssuer = class extends OAuth2BaseTokenIssuer {
 		});
 		const token = await this.signer.sign(data);
 		await this.repository.saveWithSignature(data, token);
+		if (this.sessionTokenRepository && data.session_id && data.jti && typeof data.exp === "number") await this.sessionTokenRepository.create({
+			id: data.jti,
+			session_id: data.session_id,
+			kind: "refresh",
+			parent_id: input.parent_id ?? null,
+			ip_address: data.remote_address ?? "",
+			user_agent: data.user_agent ?? "",
+			expires_at: (/* @__PURE__ */ new Date(data.exp * 1e3)).toISOString()
+		});
 		return [token, data];
 	}
 };

package/dist/core/oauth2/token/issuer/refresh/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2TokenKind","OAuth2BaseTokenIssuer","OAuth2RefreshTokenIssuer","repository","signer","options","issue","input","iss","buildIss","data","insert","kind","REFRESH","exp","buildExp","token","sign","saveWithSignature"],"sources":["../../../../../../src/core/oauth2/token/issuer/refresh/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';\n\nexport class OAuth2RefreshTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    constructor(\n        repository: IOAuth2TokenRepository,\n        signer: IOAuth2TokenSigner,\n        options: OAuth2TokenIssuerOptions = {},\n    ) {\n        super(options);\n\n        this.repository = repository;\n        this.signer = signer;\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        const iss = this.buildIss(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            kind: OAuth2TokenKind.REFRESH,\n            exp: this.buildExp(input),\n            ...(iss ? { iss } : {}),\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        return [token, data];\n    }\n}\n"],"mappings":";;;;;;AAcA,IAAaE,2BAAb,cAA8CD,sBAAAA;CAChCE;CAEAC;CAEV,YACID,YACAC,QACAC,UAAoC,CAAC,GACvC;EACE,MAAMA,OAAAA;EAEN,KAAKF,aAAaA;EAClB,KAAKC,SAASA;CAClB;CAEA,MAAME,MAAMC,QAA4B,CAAC,GAAwC;EAC7E,MAAMC,MAAM,KAAKC,SAASF,KAAAA;EAE1B,MAAMG,OAAO,MAAM,KAAKP,WAAWQ,OAAO;GACtC,GAAGJ;GACHK,MAAMZ,gBAAgBa;GACtBC,KAAK,KAAKC,SAASR,KAAAA;GACnB,GAAIC,MAAM,EAAEA,IAAI,IAAI,CAAC;EACzB,CAAA;EAEA,MAAMQ,QAAQ,MAAM,KAAKZ,OAAOa,KAAKP,IAAAA;EAErC,MAAM,KAAKP,WAAWe,kBAAkBR,MAAMM,KAAAA;EAE9C,OAAO,CAACA,OAAON,IAAAA;CACnB;AACJ"}
+{"version":3,"file":"module.mjs","names":["OAuth2TokenKind","OAuth2BaseTokenIssuer","OAuth2RefreshTokenIssuer","repository","signer","sessionTokenRepository","options","issue","input","iss","buildIss","data","insert","kind","REFRESH","exp","buildExp","token","sign","saveWithSignature","session_id","jti","create","id","parent_id","ip_address","remote_address","user_agent","expires_at","Date","toISOString"],"sources":["../../../../../../src/core/oauth2/token/issuer/refresh/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport type { ISessionTokenRepository } from '../../../session-token/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';\n\nexport class OAuth2RefreshTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    protected sessionTokenRepository?: ISessionTokenRepository;\n\n    constructor(\n        repository: IOAuth2TokenRepository,\n        signer: IOAuth2TokenSigner,\n        options: OAuth2TokenIssuerOptions = {},\n        sessionTokenRepository?: ISessionTokenRepository,\n    ) {\n        super(options);\n\n        this.repository = repository;\n        this.signer = signer;\n        this.sessionTokenRepository = sessionTokenRepository;\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        const iss = this.buildIss(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            kind: OAuth2TokenKind.REFRESH,\n            exp: this.buildExp(input),\n            ...(iss ? { iss } : {}),\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        if (this.sessionTokenRepository && data.session_id && data.jti && typeof data.exp === 'number') {\n            await this.sessionTokenRepository.create({\n                id: data.jti,\n                session_id: data.session_id,\n                kind: 'refresh',\n                parent_id: input.parent_id ?? null,\n                ip_address: data.remote_address ?? '',\n                user_agent: data.user_agent ?? '',\n                expires_at: new Date(data.exp * 1000).toISOString(),\n            });\n        }\n\n        return [token, data];\n    }\n}\n"],"mappings":";;;;;;AAeA,IAAaE,2BAAb,cAA8CD,sBAAAA;CAChCE;CAEAC;CAEAC;CAEV,YACIF,YACAC,QACAE,UAAoC,CAAC,GACrCD,wBACF;EACE,MAAMC,OAAAA;EAEN,KAAKH,aAAaA;EAClB,KAAKC,SAASA;EACd,KAAKC,yBAAyBA;CAClC;CAEA,MAAME,MAAMC,QAA4B,CAAC,GAAwC;EAC7E,MAAMC,MAAM,KAAKC,SAASF,KAAAA;EAE1B,MAAMG,OAAO,MAAM,KAAKR,WAAWS,OAAO;GACtC,GAAGJ;GACHK,MAAMb,gBAAgBc;GACtBC,KAAK,KAAKC,SAASR,KAAAA;GACnB,GAAIC,MAAM,EAAEA,IAAI,IAAI,CAAC;EACzB,CAAA;EAEA,MAAMQ,QAAQ,MAAM,KAAKb,OAAOc,KAAKP,IAAAA;EAErC,MAAM,KAAKR,WAAWgB,kBAAkBR,MAAMM,KAAAA;EAE9C,IAAI,KAAKZ,0BAA0BM,KAAKS,cAAcT,KAAKU,OAAO,OAAOV,KAAKI,QAAQ,UAClF,MAAM,KAAKV,uBAAuBiB,OAAO;GACrCC,IAAIZ,KAAKU;GACTD,YAAYT,KAAKS;GACjBP,MAAM;GACNW,WAAWhB,MAAMgB,aAAa;GAC9BC,YAAYd,KAAKe,kBAAkB;GACnCC,YAAYhB,KAAKgB,cAAc;GAC/BC,6BAAY,IAAIC,KAAKlB,KAAKI,MAAM,GAAA,EAAA,CAAMe,YAAW;EACrD,CAAA;EAGJ,OAAO,CAACb,OAAON,IAAAA;CACnB;AACJ"}

package/dist/core/oauth2/token/revoker/module.d.ts

@@ -1,9 +1,11 @@
 import type { OAuth2TokenPayload } from '@authup/specs';
 import type { IOAuth2TokenRepository } from '../repository/index.ts';
+import type { ISessionTokenRepository } from '../../session-token/index.ts';
 import type { IOAuth2TokenRevoker } from './types.ts';
 export declare class OAuth2TokenRevoker implements IOAuth2TokenRevoker {
     protected repository: IOAuth2TokenRepository;
-    constructor(repository: IOAuth2TokenRepository);
+    protected sessionTokenRepository?: ISessionTokenRepository;
+    constructor(repository: IOAuth2TokenRepository, sessionTokenRepository?: ISessionTokenRepository);
     revoke(input: OAuth2TokenPayload): Promise<void>;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/core/oauth2/token/revoker/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/token/revoker/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,qBAAa,kBAAmB,YAAW,mBAAmB;IAC1D,SAAS,CAAC,UAAU,EAAG,sBAAsB,CAAC;gBAElC,UAAU,EAAG,sBAAsB;IAIzC,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAI,OAAO,CAAC,IAAI,CAAC;CAO1D"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/token/revoker/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,qBAAa,kBAAmB,YAAW,mBAAmB;IAC1D,SAAS,CAAC,UAAU,EAAG,sBAAsB,CAAC;IAE9C,SAAS,CAAC,sBAAsB,CAAC,EAAG,uBAAuB,CAAC;gBAGxD,UAAU,EAAG,sBAAsB,EACnC,sBAAsB,CAAC,EAAG,uBAAuB;IAM/C,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAI,OAAO,CAAC,IAAI,CAAC;CAa1D"}

package/dist/core/oauth2/token/revoker/module.mjs

@@ -5,12 +5,15 @@ import { JWTError } from "@authup/specs";
 //#region src/core/oauth2/token/revoker/module.ts
 var OAuth2TokenRevoker = class {
 	repository;
-	constructor(repository) {
+	sessionTokenRepository;
+	constructor(repository, sessionTokenRepository) {
 		this.repository = repository;
+		this.sessionTokenRepository = sessionTokenRepository;
 	}
 	async revoke(input) {
 		if (!input.jti) throw JWTError.payloadPropertyInvalid("jti");
 		await this.repository.removeById(input.jti);
+		if (this.sessionTokenRepository) await this.sessionTokenRepository.revokeById(input.jti, (/* @__PURE__ */ new Date()).toISOString());
 	}
 };
 //#endregion

package/dist/core/oauth2/token/revoker/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["JWTError","OAuth2TokenRevoker","repository","revoke","input","jti","payloadPropertyInvalid","removeById"],"sources":["../../../../../src/core/oauth2/token/revoker/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { JWTError } from '@authup/specs';\nimport type { IOAuth2TokenRepository } from '../repository/index.ts';\nimport type { IOAuth2TokenRevoker } from './types.ts';\n\nexport class OAuth2TokenRevoker implements IOAuth2TokenRevoker {\n    protected repository : IOAuth2TokenRepository;\n\n    constructor(repository : IOAuth2TokenRepository) {\n        this.repository = repository;\n    }\n\n    async revoke(input: OAuth2TokenPayload) : Promise<void> {\n        if (!input.jti) {\n            throw JWTError.payloadPropertyInvalid('jti');\n        }\n\n        await this.repository.removeById(input.jti);\n    }\n}\n"],"mappings":";;;;;AAYA,IAAaC,qBAAb,MAAaA;CACCC;CAEV,YAAYA,YAAqC;EAC7C,KAAKA,aAAaA;CACtB;CAEA,MAAMC,OAAOC,OAA2C;EACpD,IAAI,CAACA,MAAMC,KACP,MAAML,SAASM,uBAAuB,KAAA;EAG1C,MAAM,KAAKJ,WAAWK,WAAWH,MAAMC,GAAG;CAC9C;AACJ"}
+{"version":3,"file":"module.mjs","names":["JWTError","OAuth2TokenRevoker","repository","sessionTokenRepository","revoke","input","jti","payloadPropertyInvalid","removeById","revokeById","Date","toISOString"],"sources":["../../../../../src/core/oauth2/token/revoker/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { JWTError } from '@authup/specs';\nimport type { IOAuth2TokenRepository } from '../repository/index.ts';\nimport type { ISessionTokenRepository } from '../../session-token/index.ts';\nimport type { IOAuth2TokenRevoker } from './types.ts';\n\nexport class OAuth2TokenRevoker implements IOAuth2TokenRevoker {\n    protected repository : IOAuth2TokenRepository;\n\n    protected sessionTokenRepository? : ISessionTokenRepository;\n\n    constructor(\n        repository : IOAuth2TokenRepository,\n        sessionTokenRepository? : ISessionTokenRepository,\n    ) {\n        this.repository = repository;\n        this.sessionTokenRepository = sessionTokenRepository;\n    }\n\n    async revoke(input: OAuth2TokenPayload) : Promise<void> {\n        if (!input.jti) {\n            throw JWTError.payloadPropertyInvalid('jti');\n        }\n\n        await this.repository.removeById(input.jti);\n\n        // Soft-revoke the durable row so a refresh grant (which trusts the row,\n        // not the cache blocklist) rejects an explicitly revoked refresh token.\n        if (this.sessionTokenRepository) {\n            await this.sessionTokenRepository.revokeById(input.jti, new Date().toISOString());\n        }\n    }\n}\n"],"mappings":";;;;;AAaA,IAAaC,qBAAb,MAAaA;CACCC;CAEAC;CAEV,YACID,YACAC,wBACF;EACE,KAAKD,aAAaA;EAClB,KAAKC,yBAAyBA;CAClC;CAEA,MAAMC,OAAOC,OAA2C;EACpD,IAAI,CAACA,MAAMC,KACP,MAAMN,SAASO,uBAAuB,KAAA;EAG1C,MAAM,KAAKL,WAAWM,WAAWH,MAAMC,GAAG;EAI1C,IAAI,KAAKH,wBACL,MAAM,KAAKA,uBAAuBM,WAAWJ,MAAMC,sBAAK,IAAII,KAAAA,EAAAA,CAAOC,YAAW,CAAA;CAEtF;AACJ"}

package/dist/core/oauth2/token/verifier/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/token/verifier/module.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAEjF,qBAAa,mBAAoB,YAAW,oBAAoB;IAC5D,SAAS,CAAC,aAAa,EAAG,oBAAoB,CAAC;IAE/C,SAAS,CAAC,eAAe,EAAG,sBAAsB,CAAC;gBAG/C,aAAa,EAAG,oBAAoB,EACpC,eAAe,EAAG,sBAAsB;IAMtC,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIxC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,wBAA6B,GAAI,OAAO,CAAC,kBAAkB,CAAC;CAgGpG"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/token/verifier/module.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAEjF,qBAAa,mBAAoB,YAAW,oBAAoB;IAC5D,SAAS,CAAC,aAAa,EAAG,oBAAoB,CAAC;IAE/C,SAAS,CAAC,eAAe,EAAG,sBAAsB,CAAC;gBAG/C,aAAa,EAAG,oBAAoB,EACpC,eAAe,EAAG,sBAAsB;IAMtC,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIxC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,wBAA6B,GAAI,OAAO,CAAC,kBAAkB,CAAC;CA6GpG"}

package/dist/core/oauth2/token/verifier/module.mjs

@@ -33,7 +33,7 @@ var OAuth2TokenVerifier = class {
 				payload = await verifyToken(token, {
 					type: JWKType.OCT,
 					key: key.decryption_key
-				});
+				}, { ignoreExpiry: options.ignoreExpiry });
 				break;
 			case JWKType.EC:
 				if (!key.encryption_key) throw JWKError.decryptionKeyMissing();
@@ -41,7 +41,7 @@ var OAuth2TokenVerifier = class {
 					type: key.type,
 					key: key.encryption_key,
 					...key.signature_algorithm ? { algorithms: [key.signature_algorithm] } : []
-				});
+				}, { ignoreExpiry: options.ignoreExpiry });
 				break;
 			default:
 				if (!key.encryption_key) throw JWKError.decryptionKeyMissing();
@@ -49,10 +49,10 @@ var OAuth2TokenVerifier = class {
 					type: key.type,
 					key: key.encryption_key,
 					...key.signature_algorithm ? { algorithms: [key.signature_algorithm] } : []
-				});
+				}, { ignoreExpiry: options.ignoreExpiry });
 		}
 		if (!payload.jti) throw JWTError.payloadPropertyInvalid("jti");
-		await this.tokenRepository.saveWithSignature(payload, token);
+		if (!options.ignoreExpiry) await this.tokenRepository.saveWithSignature(payload, token);
 		if (!options.skipActiveCheck) {
 			if (await this.isInactive(payload.jti)) throw JWTError.notActive();
 		}

package/dist/core/oauth2/token/verifier/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["extractTokenHeader","verifyToken","JWKError","JWKType","JWTError","OAuth2TokenVerifier","keyRepository","tokenRepository","isInactive","id","verify","token","options","payload","findOneBySignature","jti","payloadPropertyInvalid","skipActiveCheck","notActive","header","kid","headerPropertyInvalid","key","findById","notFound","type","OCT","decryption_key","decryptionKeyMissing","EC","encryption_key","signature_algorithm","algorithms","saveWithSignature"],"sources":["../../../../../src/core/oauth2/token/verifier/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    type TokenECAlgorithm, \n    type TokenRSAAlgorithm, \n    extractTokenHeader, \n    verifyToken,\n} from '@authup/server-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { JWKError, JWKType, JWTError } from '@authup/specs';\nimport type { IOAuth2KeyRepository } from '../../key/index.ts';\nimport type { IOAuth2TokenRepository } from '../repository/types.ts';\nimport type { IOAuth2TokenVerifier, OAuth2TokenVerifyOptions } from './types.ts';\n\nexport class OAuth2TokenVerifier implements IOAuth2TokenVerifier {\n    protected keyRepository : IOAuth2KeyRepository;\n\n    protected tokenRepository : IOAuth2TokenRepository;\n\n    constructor(\n        keyRepository : IOAuth2KeyRepository,\n        tokenRepository : IOAuth2TokenRepository,\n    ) {\n        this.keyRepository = keyRepository;\n        this.tokenRepository = tokenRepository;\n    }\n\n    async isInactive(id: string): Promise<boolean> {\n        return this.tokenRepository.isInactive(id);\n    }\n\n    async verify(token: string, options: OAuth2TokenVerifyOptions = {}) : Promise<OAuth2TokenPayload> {\n        let payload = await this.tokenRepository.findOneBySignature(token);\n        if (payload) {\n            if (!payload.jti) {\n                throw JWTError.payloadPropertyInvalid('jti');\n            }\n\n            if (!options.skipActiveCheck) {\n                const isInactive = await this.isInactive(payload.jti);\n                if (isInactive) {\n                    throw JWTError.notActive();\n                }\n            }\n\n            return payload;\n        }\n\n        const header = extractTokenHeader(token);\n        if (!header.kid) {\n            throw JWTError.headerPropertyInvalid('kid');\n        }\n\n        const key = await this.keyRepository.findById(header.kid);\n        if (!key) {\n            throw JWKError.notFound(header.kid);\n        }\n\n        switch (key.type) {\n            case JWKType.OCT: {\n                if (!key.decryption_key) {\n                    throw JWKError.decryptionKeyMissing();\n                }\n\n                payload = await verifyToken(\n                    token,\n                    {\n                        type: JWKType.OCT,\n                        key: key.decryption_key,\n                    },\n                );\n                break;\n            }\n            case JWKType.EC: {\n                if (!key.encryption_key) {\n                    throw JWKError.decryptionKeyMissing();\n                }\n\n                payload = await verifyToken(\n                    token,\n                    {\n                        type: key.type,\n                        key: key.encryption_key,\n                        ...(\n                            key.signature_algorithm ?\n                                { algorithms: [key.signature_algorithm] } :\n                                []\n                        ) as TokenECAlgorithm[],\n                    },\n                );\n                break;\n            }\n            default: {\n                if (!key.encryption_key) {\n                    throw JWKError.decryptionKeyMissing();\n                }\n\n                payload = await verifyToken(\n                    token,\n                    {\n                        type: key.type,\n                        key: key.encryption_key,\n                        ...(\n                            key.signature_algorithm ?\n                                { algorithms: [key.signature_algorithm] } :\n                                []\n                        ) as TokenRSAAlgorithm[],\n                    },\n                );\n            }\n        }\n\n        if (!payload.jti) {\n            throw JWTError.payloadPropertyInvalid('jti');\n        }\n\n        await this.tokenRepository.saveWithSignature(payload, token);\n\n        if (!options.skipActiveCheck) {\n            const isInactive = await this.isInactive(payload.jti);\n            if (isInactive) {\n                throw JWTError.notActive();\n            }\n        }\n\n        return payload;\n    }\n}\n"],"mappings":";;;;;;AAmBA,IAAaK,sBAAb,MAAaA;CACCC;CAEAC;CAEV,YACID,eACAC,iBACF;EACE,KAAKD,gBAAgBA;EACrB,KAAKC,kBAAkBA;CAC3B;CAEA,MAAMC,WAAWC,IAA8B;EAC3C,OAAO,KAAKF,gBAAgBC,WAAWC,EAAAA;CAC3C;CAEA,MAAMC,OAAOC,OAAeC,UAAoC,CAAC,GAAiC;EAC9F,IAAIC,UAAU,MAAM,KAAKN,gBAAgBO,mBAAmBH,KAAAA;EAC5D,IAAIE,SAAS;GACT,IAAI,CAACA,QAAQE,KACT,MAAMX,SAASY,uBAAuB,KAAA;GAG1C,IAAI,CAACJ,QAAQK;QAELT,MADqB,KAAKA,WAAWK,QAAQE,GAAG,GAEhD,MAAMX,SAASc,UAAS;GAAA;GAIhC,OAAOL;EACX;EAEA,MAAMM,SAASnB,mBAAmBW,KAAAA;EAClC,IAAI,CAACQ,OAAOC,KACR,MAAMhB,SAASiB,sBAAsB,KAAA;EAGzC,MAAMC,MAAM,MAAM,KAAKhB,cAAciB,SAASJ,OAAOC,GAAG;EACxD,IAAI,CAACE,KACD,MAAMpB,SAASsB,SAASL,OAAOC,GAAG;EAGtC,QAAQE,IAAIG,MAAZ;GACI,KAAKtB,QAAQuB;IACT,IAAI,CAACJ,IAAIK,gBACL,MAAMzB,SAAS0B,qBAAoB;IAGvCf,UAAU,MAAMZ,YACZU,OACA;KACIc,MAAMtB,QAAQuB;KACdJ,KAAKA,IAAIK;IACb,CAAA;IAEJ;GAEJ,KAAKxB,QAAQ0B;IACT,IAAI,CAACP,IAAIQ,gBACL,MAAM5B,SAAS0B,qBAAoB;IAGvCf,UAAU,MAAMZ,YACZU,OACA;KACIc,MAAMH,IAAIG;KACVH,KAAKA,IAAIQ;KACT,GACIR,IAAIS,sBACA,EAAEC,YAAY,CAACV,IAAIS,mBAAAA,EAAqB,IACxC,CAAA;IAEZ,CAAA;IAEJ;GAEJ;IACI,IAAI,CAACT,IAAIQ,gBACL,MAAM5B,SAAS0B,qBAAoB;IAGvCf,UAAU,MAAMZ,YACZU,OACA;KACIc,MAAMH,IAAIG;KACVH,KAAKA,IAAIQ;KACT,GACIR,IAAIS,sBACA,EAAEC,YAAY,CAACV,IAAIS,mBAAAA,EAAqB,IACxC,CAAA;IAEZ,CAAA;EAGZ;EAEA,IAAI,CAAClB,QAAQE,KACT,MAAMX,SAASY,uBAAuB,KAAA;EAG1C,MAAM,KAAKT,gBAAgB0B,kBAAkBpB,SAASF,KAAAA;EAEtD,IAAI,CAACC,QAAQK;OAELT,MADqB,KAAKA,WAAWK,QAAQE,GAAG,GAEhD,MAAMX,SAASc,UAAS;EAAA;EAIhC,OAAOL;CACX;AACJ"}
+{"version":3,"file":"module.mjs","names":["extractTokenHeader","verifyToken","JWKError","JWKType","JWTError","OAuth2TokenVerifier","keyRepository","tokenRepository","isInactive","id","verify","token","options","payload","findOneBySignature","jti","payloadPropertyInvalid","skipActiveCheck","notActive","header","kid","headerPropertyInvalid","key","findById","notFound","type","OCT","decryption_key","decryptionKeyMissing","ignoreExpiry","EC","encryption_key","signature_algorithm","algorithms","saveWithSignature"],"sources":["../../../../../src/core/oauth2/token/verifier/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    type TokenECAlgorithm,\n    type TokenRSAAlgorithm,\n    extractTokenHeader,\n    verifyToken,\n} from '@authup/server-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { JWKError, JWKType, JWTError } from '@authup/specs';\nimport type { IOAuth2KeyRepository } from '../../key/index.ts';\nimport type { IOAuth2TokenRepository } from '../repository/types.ts';\nimport type { IOAuth2TokenVerifier, OAuth2TokenVerifyOptions } from './types.ts';\n\nexport class OAuth2TokenVerifier implements IOAuth2TokenVerifier {\n    protected keyRepository : IOAuth2KeyRepository;\n\n    protected tokenRepository : IOAuth2TokenRepository;\n\n    constructor(\n        keyRepository : IOAuth2KeyRepository,\n        tokenRepository : IOAuth2TokenRepository,\n    ) {\n        this.keyRepository = keyRepository;\n        this.tokenRepository = tokenRepository;\n    }\n\n    async isInactive(id: string): Promise<boolean> {\n        return this.tokenRepository.isInactive(id);\n    }\n\n    async verify(token: string, options: OAuth2TokenVerifyOptions = {}) : Promise<OAuth2TokenPayload> {\n        let payload = await this.tokenRepository.findOneBySignature(token);\n        if (payload) {\n            if (!payload.jti) {\n                throw JWTError.payloadPropertyInvalid('jti');\n            }\n\n            if (!options.skipActiveCheck) {\n                const isInactive = await this.isInactive(payload.jti);\n                if (isInactive) {\n                    throw JWTError.notActive();\n                }\n            }\n\n            return payload;\n        }\n\n        const header = extractTokenHeader(token);\n        if (!header.kid) {\n            throw JWTError.headerPropertyInvalid('kid');\n        }\n\n        const key = await this.keyRepository.findById(header.kid);\n        if (!key) {\n            throw JWKError.notFound(header.kid);\n        }\n\n        switch (key.type) {\n            case JWKType.OCT: {\n                if (!key.decryption_key) {\n                    throw JWKError.decryptionKeyMissing();\n                }\n\n                payload = await verifyToken(\n                    token,\n                    {\n                        type: JWKType.OCT,\n                        key: key.decryption_key,\n                    },\n                    { ignoreExpiry: options.ignoreExpiry },\n                );\n                break;\n            }\n            case JWKType.EC: {\n                if (!key.encryption_key) {\n                    throw JWKError.decryptionKeyMissing();\n                }\n\n                payload = await verifyToken(\n                    token,\n                    {\n                        type: key.type,\n                        key: key.encryption_key,\n                        ...(\n                            key.signature_algorithm ?\n                                { algorithms: [key.signature_algorithm] } :\n                                []\n                        ) as TokenECAlgorithm[],\n                    },\n                    { ignoreExpiry: options.ignoreExpiry },\n                );\n                break;\n            }\n            default: {\n                if (!key.encryption_key) {\n                    throw JWKError.decryptionKeyMissing();\n                }\n\n                payload = await verifyToken(\n                    token,\n                    {\n                        type: key.type,\n                        key: key.encryption_key,\n                        ...(\n                            key.signature_algorithm ?\n                                { algorithms: [key.signature_algorithm] } :\n                                []\n                        ) as TokenRSAAlgorithm[],\n                    },\n                    { ignoreExpiry: options.ignoreExpiry },\n                );\n            }\n        }\n\n        if (!payload.jti) {\n            throw JWTError.payloadPropertyInvalid('jti');\n        }\n\n        // Never populate the shared signature-keyed claims cache on the\n        // exp-ignoring path. An expired token verified with `ignoreExpiry`\n        // (the RP-initiated-logout id_token_hint) would otherwise be re-cached\n        // with buildTTL's 1h fallback (a past exp yields a non-positive ttl),\n        // and the cache-first branch above returns it with no exp re-check on\n        // every subsequent verify — so `/token/introspect` would report an\n        // expired token as active for up to an hour (RFC 7662). Keep the\n        // exp-bypass scoped to this single call.\n        if (!options.ignoreExpiry) {\n            await this.tokenRepository.saveWithSignature(payload, token);\n        }\n\n        if (!options.skipActiveCheck) {\n            const isInactive = await this.isInactive(payload.jti);\n            if (isInactive) {\n                throw JWTError.notActive();\n            }\n        }\n\n        return payload;\n    }\n}\n"],"mappings":";;;;;;AAmBA,IAAaK,sBAAb,MAAaA;CACCC;CAEAC;CAEV,YACID,eACAC,iBACF;EACE,KAAKD,gBAAgBA;EACrB,KAAKC,kBAAkBA;CAC3B;CAEA,MAAMC,WAAWC,IAA8B;EAC3C,OAAO,KAAKF,gBAAgBC,WAAWC,EAAAA;CAC3C;CAEA,MAAMC,OAAOC,OAAeC,UAAoC,CAAC,GAAiC;EAC9F,IAAIC,UAAU,MAAM,KAAKN,gBAAgBO,mBAAmBH,KAAAA;EAC5D,IAAIE,SAAS;GACT,IAAI,CAACA,QAAQE,KACT,MAAMX,SAASY,uBAAuB,KAAA;GAG1C,IAAI,CAACJ,QAAQK;QAELT,MADqB,KAAKA,WAAWK,QAAQE,GAAG,GAEhD,MAAMX,SAASc,UAAS;GAAA;GAIhC,OAAOL;EACX;EAEA,MAAMM,SAASnB,mBAAmBW,KAAAA;EAClC,IAAI,CAACQ,OAAOC,KACR,MAAMhB,SAASiB,sBAAsB,KAAA;EAGzC,MAAMC,MAAM,MAAM,KAAKhB,cAAciB,SAASJ,OAAOC,GAAG;EACxD,IAAI,CAACE,KACD,MAAMpB,SAASsB,SAASL,OAAOC,GAAG;EAGtC,QAAQE,IAAIG,MAAZ;GACI,KAAKtB,QAAQuB;IACT,IAAI,CAACJ,IAAIK,gBACL,MAAMzB,SAAS0B,qBAAoB;IAGvCf,UAAU,MAAMZ,YACZU,OACA;KACIc,MAAMtB,QAAQuB;KACdJ,KAAKA,IAAIK;IACb,GACA,EAAEE,cAAcjB,QAAQiB,aAAa,CAAA;IAEzC;GAEJ,KAAK1B,QAAQ2B;IACT,IAAI,CAACR,IAAIS,gBACL,MAAM7B,SAAS0B,qBAAoB;IAGvCf,UAAU,MAAMZ,YACZU,OACA;KACIc,MAAMH,IAAIG;KACVH,KAAKA,IAAIS;KACT,GACIT,IAAIU,sBACA,EAAEC,YAAY,CAACX,IAAIU,mBAAAA,EAAqB,IACxC,CAAA;IAEZ,GACA,EAAEH,cAAcjB,QAAQiB,aAAa,CAAA;IAEzC;GAEJ;IACI,IAAI,CAACP,IAAIS,gBACL,MAAM7B,SAAS0B,qBAAoB;IAGvCf,UAAU,MAAMZ,YACZU,OACA;KACIc,MAAMH,IAAIG;KACVH,KAAKA,IAAIS;KACT,GACIT,IAAIU,sBACA,EAAEC,YAAY,CAACX,IAAIU,mBAAAA,EAAqB,IACxC,CAAA;IAEZ,GACA,EAAEH,cAAcjB,QAAQiB,aAAa,CAAA;EAGjD;EAEA,IAAI,CAAChB,QAAQE,KACT,MAAMX,SAASY,uBAAuB,KAAA;EAW1C,IAAI,CAACJ,QAAQiB,cACT,MAAM,KAAKtB,gBAAgB2B,kBAAkBrB,SAASF,KAAAA;EAG1D,IAAI,CAACC,QAAQK;OAELT,MADqB,KAAKA,WAAWK,QAAQE,GAAG,GAEhD,MAAMX,SAASc,UAAS;EAAA;EAIhC,OAAOL;CACX;AACJ"}

package/dist/core/oauth2/token/verifier/types.d.ts

@@ -1,6 +1,12 @@
 import type { OAuth2TokenPayload } from '@authup/specs';
 export type OAuth2TokenVerifyOptions = {
     skipActiveCheck?: boolean;
+    /**
+     * Skip ONLY the `exp` check (signature, issuer, nbf still enforced). For
+     * verifying an `id_token_hint` on RP-initiated logout, which is routinely
+     * expired by the time the user logs out.
+     */
+    ignoreExpiry?: boolean;
 };
 export interface IOAuth2TokenVerifier {
     isInactive(token: string): Promise<boolean>;

package/dist/core/oauth2/token/verifier/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/token/verifier/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,MAAM,MAAM,wBAAwB,GAAG;IACnC,eAAe,CAAC,EAAE,OAAO,CAAA;CAC5B,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACjC,UAAU,CAAC,KAAK,EAAE,MAAM,GAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE7C,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,wBAAwB,GAAI,OAAO,CAAC,kBAAkB,CAAC,CAAA;CAC1F"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/token/verifier/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,MAAM,MAAM,wBAAwB,GAAG;IACnC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;CACzB,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACjC,UAAU,CAAC,KAAK,EAAE,MAAM,GAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE7C,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,wBAAwB,GAAI,OAAO,CAAC,kBAAkB,CAAC,CAAA;CAC1F"}

package/dist/core/provisioning/entities/client/relations-validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"relations-validator.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/client/relations-validator.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAIpC,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAE9D,qBAAa,oCAAqC,SAAQ,SAAS,CAAC,2BAA2B,CAAC;IAC5F,SAAS,CAAC,UAAU;CA0BvB"}
+{"version":3,"file":"relations-validator.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/client/relations-validator.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAKpC,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAE9D,qBAAa,oCAAqC,SAAQ,SAAS,CAAC,2BAA2B,CAAC;IAC5F,SAAS,CAAC,UAAU;CAkCvB"}

package/dist/core/provisioning/entities/client/relations-validator.mjs

@@ -5,6 +5,7 @@ import { PermissionProvisioningValidator } from "../permission/validator.mjs";
 import "../permission/index.mjs";
 import { RoleProvisioningValidator } from "../role/validator.mjs";
 import "../role/index.mjs";
+import { createProvisioningEntitiesValidator } from "../utils.mjs";
 import { Container } from "validup";
 import { createValidator } from "@validup/zod";
 import { z } from "zod";
@@ -14,10 +15,10 @@ var ClientProvisioningRelationsValidator = class extends Container {
 		super.initialize();
 		const permissionValidator = new PermissionProvisioningValidator();
 		const roleValidator = new RoleProvisioningValidator();
-		this.mount("permissions.*", { optional: true }, permissionValidator);
+		this.mount("permissions", { optional: true }, createValidator(z.array(z.any()).check(createProvisioningEntitiesValidator(permissionValidator))));
 		this.mount("realmPermissions", { optional: true }, createValidator(z.array(z.string())));
 		this.mount("globalPermissions", { optional: true }, createValidator(z.array(z.string())));
-		this.mount("roles.*", { optional: true }, roleValidator);
+		this.mount("roles", { optional: true }, createValidator(z.array(z.any()).check(createProvisioningEntitiesValidator(roleValidator))));
 		this.mount("realmRoles", { optional: true }, createValidator(z.array(z.string())));
 		this.mount("globalRoles", { optional: true }, createValidator(z.array(z.string())));
 	}