@authup/server-core 1.0.0-beta.51 → 1.0.0-beta.52

package/dist/adapters/http/controllers/entities/role-permission/module.mjs

@@ -5,8 +5,8 @@ import { buildActorContext } from "../../../request/helpers/actor.mjs";
 import "../../../request/index.mjs";
 import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
 import "../../../middleware/index.mjs";
-import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DTags } from "@routup/decorators";
 import { useRequestQuery } from "@routup/basic/query";
+import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DTags } from "@routup/decorators";
 //#region src/adapters/http/controllers/entities/role-permission/module.ts
 function _ts_decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;

package/dist/adapters/http/controllers/entities/scope/module.mjs

@@ -5,8 +5,8 @@ import { buildActorContext } from "../../../request/helpers/actor.mjs";
 import "../../../request/index.mjs";
 import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
 import "../../../middleware/index.mjs";
-import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DPut, DTags } from "@routup/decorators";
 import { useRequestQuery } from "@routup/basic/query";
+import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DPut, DTags } from "@routup/decorators";
 //#region src/adapters/http/controllers/entities/scope/module.ts
 function _ts_decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;

package/dist/adapters/http/controllers/entities/session/index.d.ts

@@ -0,0 +1,2 @@
+export * from './module.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/controllers/entities/session/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/session/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC"}

package/dist/adapters/http/controllers/entities/session/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { SessionController } from "./module.mjs";
+export { SessionController };

package/dist/adapters/http/controllers/entities/session/module.d.ts

@@ -0,0 +1,16 @@
+import type { Session } from '@authup/core-kit';
+import type { IAppEvent } from 'routup';
+import type { EntityCollectionResponse, SessionDeleteManyResponse } from '@authup/core-http-kit';
+import type { ISessionService } from '../../../../../core/index.ts';
+export type SessionControllerContext = {
+    service: ISessionService;
+};
+export declare class SessionController {
+    protected service: ISessionService;
+    constructor(ctx: SessionControllerContext);
+    getMany(event: IAppEvent): Promise<EntityCollectionResponse<Session>>;
+    getOne(id: string, event: IAppEvent): Promise<Session>;
+    dropMany(event: IAppEvent): Promise<SessionDeleteManyResponse>;
+    drop(id: string, event: IAppEvent): Promise<Session>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/controllers/entities/session/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/session/module.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAEjG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAIpE,MAAM,MAAM,wBAAwB,GAAG;IACnC,OAAO,EAAE,eAAe,CAAC;CAC5B,CAAC;AAEF,qBAEa,iBAAiB;IAC1B,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC;gBAEvB,GAAG,EAAE,wBAAwB;IAKnC,OAAO,CACG,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAcvC,MAAM,CACK,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,OAAO,CAAC;IAUb,QAAQ,CACE,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,yBAAyB,CAAC;IAgB/B,IAAI,CACO,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,OAAO,CAAC;CAStB"}

package/dist/adapters/http/controllers/entities/session/module.mjs

@@ -0,0 +1,102 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { buildActorContext } from "../../../request/helpers/actor.mjs";
+import { useRequestSessionId } from "../../../request/helpers/session-id.mjs";
+import "../../../request/index.mjs";
+import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
+import { isSelfToken } from "../../../../../utils/self-id.mjs";
+import "../../../../../utils/index.mjs";
+import "../../../middleware/index.mjs";
+import { useRequestQuery } from "@routup/basic/query";
+import { DContext, DController, DDelete, DGet, DPath, DTags } from "@routup/decorators";
+//#region src/adapters/http/controllers/entities/session/module.ts
+function _ts_decorate(decorators, target, key, desc) {
+	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+	return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(k, v) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+function _ts_param(paramIndex, decorator) {
+	return function(target, key) {
+		decorator(target, key, paramIndex);
+	};
+}
+var SessionController = class {
+	service;
+	constructor(ctx) {
+		this.service = ctx.service;
+	}
+	async getMany(event) {
+		const actor = buildActorContext(event);
+		const { data, meta } = await this.service.getMany(useRequestQuery(event), actor);
+		return {
+			data,
+			meta
+		};
+	}
+	async getOne(id, event) {
+		const actor = buildActorContext(event);
+		const resolvedId = isSelfToken(id) ? useRequestSessionId(event) ?? id : id;
+		return this.service.getOne(resolvedId, actor);
+	}
+	async dropMany(event) {
+		const actor = buildActorContext(event);
+		const result = await this.service.deleteMany(actor, {
+			query: useRequestQuery(event),
+			currentSessionId: useRequestSessionId(event)
+		});
+		event.response.status = 202;
+		return result;
+	}
+	async drop(id, event) {
+		const actor = buildActorContext(event);
+		const resolvedId = isSelfToken(id) ? useRequestSessionId(event) ?? id : id;
+		const entity = await this.service.delete(resolvedId, actor);
+		event.response.status = 202;
+		return entity;
+	}
+};
+_ts_decorate([
+	DGet("", [ForceLoggedInMiddleware]),
+	_ts_param(0, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], SessionController.prototype, "getMany", null);
+_ts_decorate([
+	DGet("/:id", [ForceLoggedInMiddleware]),
+	_ts_param(0, DPath("id")),
+	_ts_param(1, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [String, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], SessionController.prototype, "getOne", null);
+_ts_decorate([
+	DDelete("", [ForceLoggedInMiddleware]),
+	_ts_param(0, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], SessionController.prototype, "dropMany", null);
+_ts_decorate([
+	DDelete("/:id", [ForceLoggedInMiddleware]),
+	_ts_param(0, DPath("id")),
+	_ts_param(1, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [String, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], SessionController.prototype, "drop", null);
+SessionController = _ts_decorate([
+	DTags("session"),
+	DController(["/sessions", "/realms/:realmId/sessions"]),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof SessionControllerContext === "undefined" ? Object : SessionControllerContext])
+], SessionController);
+//#endregion
+export { SessionController };
+
+//# sourceMappingURL=module.mjs.map

package/dist/adapters/http/controllers/entities/session/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["DContext","DController","DDelete","DGet","DPath","DTags","useRequestQuery","isSelfToken","ForceLoggedInMiddleware","buildActorContext","useRequestSessionId","SessionController","service","ctx","getMany","event","actor","data","meta","getOne","id","resolvedId","dropMany","result","deleteMany","query","currentSessionId","response","status","drop","entity","delete"],"sources":["../../../../../../src/adapters/http/controllers/entities/session/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DContext,\n    DController,\n    DDelete,\n    DGet,\n    DPath,\n    DTags,\n} from '@routup/decorators';\nimport type { Session } from '@authup/core-kit';\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { EntityCollectionResponse, SessionDeleteManyResponse } from '@authup/core-http-kit';\nimport { isSelfToken } from '../../../../../utils/index.ts';\nimport type { ISessionService } from '../../../../../core/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { buildActorContext, useRequestSessionId } from '../../../request/index.ts';\n\nexport type SessionControllerContext = {\n    service: ISessionService,\n};\n\n@DTags('session')\n@DController(['/sessions', '/realms/:realmId/sessions'])\nexport class SessionController {\n    protected service: ISessionService;\n\n    constructor(ctx: SessionControllerContext) {\n        this.service = ctx.service;\n    }\n\n    @DGet('', [ForceLoggedInMiddleware])\n    async getMany(\n        @DContext() event: IAppEvent,\n    ): Promise<EntityCollectionResponse<Session>> {\n        const actor = buildActorContext(event);\n        const {\n            data,\n            meta,\n        } = await this.service.getMany(useRequestQuery(event), actor);\n\n        return {\n            data,\n            meta,\n        };\n    }\n\n    @DGet('/:id', [ForceLoggedInMiddleware])\n    async getOne(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ): Promise<Session> {\n        const actor = buildActorContext(event);\n\n        // `@me` / `@self` resolve to the caller's current session.\n        const resolvedId = isSelfToken(id) ? (useRequestSessionId(event) ?? id) : id;\n\n        return this.service.getOne(resolvedId, actor);\n    }\n\n    @DDelete('', [ForceLoggedInMiddleware])\n    async dropMany(\n        @DContext() event: IAppEvent,\n    ): Promise<SessionDeleteManyResponse> {\n        const actor = buildActorContext(event);\n\n        // A recognized target filter (e.g. `?filter[user_id]=<uuid>`) → admin\n        // force-logout (SESSION_DELETE + per-session realm-match). No filter →\n        // self-service \"log out my other devices\" (keeps the current session).\n        const result = await this.service.deleteMany(actor, {\n            query: useRequestQuery(event),\n            currentSessionId: useRequestSessionId(event),\n        });\n\n        event.response.status = 202;\n        return result;\n    }\n\n    @DDelete('/:id', [ForceLoggedInMiddleware])\n    async drop(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ): Promise<Session> {\n        const actor = buildActorContext(event);\n\n        const resolvedId = isSelfToken(id) ? (useRequestSessionId(event) ?? id) : id;\n        const entity = await this.service.delete(resolvedId, actor);\n\n        event.response.status = 202;\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,IAAaW,oBAAb,MAAaA;CACCC;CAEV,YAAYC,KAA+B;EACvC,KAAKD,UAAUC,IAAID;CACvB;CAEA,MACME,QACF,OAC0C;EAC1C,MAAME,QAAQP,kBAAkBM,KAAAA;EAChC,MAAM,EACFE,MACAC,SACA,MAAM,KAAKN,QAAQE,QAAQR,gBAAgBS,KAAAA,GAAQC,KAAAA;EAEvD,OAAO;GACHC;GACAC;EACJ;CACJ;CAEA,MACMC,OACF,IACA,OACgB;EAChB,MAAMH,QAAQP,kBAAkBM,KAAAA;EAGhC,MAAMM,aAAad,YAAYa,EAAAA,IAAOV,oBAAoBK,KAAAA,KAAUK,KAAMA;EAE1E,OAAO,KAAKR,QAAQO,OAAOE,YAAYL,KAAAA;CAC3C;CAEA,MACMM,SACF,OACkC;EAClC,MAAMN,QAAQP,kBAAkBM,KAAAA;EAKhC,MAAMQ,SAAS,MAAM,KAAKX,QAAQY,WAAWR,OAAO;GAChDS,OAAOnB,gBAAgBS,KAAAA;GACvBW,kBAAkBhB,oBAAoBK,KAAAA;EAC1C,CAAA;EAEAA,MAAMY,SAASC,SAAS;EACxB,OAAOL;CACX;CAEA,MACMM,KACF,IACA,OACgB;EAChB,MAAMb,QAAQP,kBAAkBM,KAAAA;EAEhC,MAAMM,aAAad,YAAYa,EAAAA,IAAOV,oBAAoBK,KAAAA,KAAUK,KAAMA;EAC1E,MAAMU,SAAS,MAAM,KAAKlB,QAAQmB,OAAOV,YAAYL,KAAAA;EAErDD,MAAMY,SAASC,SAAS;EACxB,OAAOE;CACX;AACJ;;WA5DetB,uBAAAA,CAAAA;;;;;;;eAgBIA,uBAAAA,CAAAA;;;;;;;;cAaDA,uBAAAA,CAAAA;;;;;;;kBAkBIA,uBAAAA,CAAAA;;;;;;;;;cAvDR,aAAa,2BAAA,CAAA"}

package/dist/adapters/http/controllers/entities/user/module.mjs

@@ -4,12 +4,12 @@ import.meta.url;
 import { buildActorContext } from "../../../request/helpers/actor.mjs";
 import { applyRouteRealmIDToBody, getRequestRealmID } from "../../../request/helpers/realm-id.mjs";
 import "../../../request/index.mjs";
+import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
 import { isSelfToken } from "../../../../../utils/self-id.mjs";
 import "../../../../../utils/index.mjs";
-import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
 import "../../../middleware/index.mjs";
-import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DPut, DTags } from "@routup/decorators";
 import { useRequestQuery } from "@routup/basic/query";
+import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DPut, DTags } from "@routup/decorators";
 //#region src/adapters/http/controllers/entities/user/module.ts
 function _ts_decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;

package/dist/adapters/http/controllers/entities/user-attribute/module.mjs

@@ -5,8 +5,8 @@ import { buildActorContext } from "../../../request/helpers/actor.mjs";
 import "../../../request/index.mjs";
 import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
 import "../../../middleware/index.mjs";
-import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DTags } from "@routup/decorators";
 import { useRequestQuery } from "@routup/basic/query";
+import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DTags } from "@routup/decorators";
 //#region src/adapters/http/controllers/entities/user-attribute/module.ts
 function _ts_decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;

package/dist/adapters/http/controllers/entities/user-permission/module.mjs

@@ -5,8 +5,8 @@ import { buildActorContext } from "../../../request/helpers/actor.mjs";
 import "../../../request/index.mjs";
 import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
 import "../../../middleware/index.mjs";
-import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DTags } from "@routup/decorators";
 import { useRequestQuery } from "@routup/basic/query";
+import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DTags } from "@routup/decorators";
 //#region src/adapters/http/controllers/entities/user-permission/module.ts
 function _ts_decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;

package/dist/adapters/http/controllers/entities/user-role/module.mjs

@@ -5,8 +5,8 @@ import { buildActorContext } from "../../../request/helpers/actor.mjs";
 import "../../../request/index.mjs";
 import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
 import "../../../middleware/index.mjs";
-import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DTags } from "@routup/decorators";
 import { useRequestQuery } from "@routup/basic/query";
+import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DTags } from "@routup/decorators";
 //#region src/adapters/http/controllers/entities/user-role/module.ts
 function _ts_decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;

package/dist/adapters/http/controllers/index.mjs

@@ -16,6 +16,7 @@ import { ActivateController } from "./workflows/activate/module.mjs";
 import { AuthorizeController } from "./workflows/authorize/module.mjs";
 import { getJwkRouteHandler, getJwksRouteHandler } from "./workflows/jwks/handlers/read.mjs";
 import { JwkController } from "./workflows/jwks/module.mjs";
+import { LogoutController } from "./workflows/logout/module.mjs";
 import { OpenIDController } from "./workflows/openid/module.mjs";
 import { PasswordForgotController } from "./workflows/password-forgot/module.mjs";
 import { PasswordResetController } from "./workflows/password-reset/module.mjs";
@@ -38,6 +39,7 @@ import { PolicyController } from "./entities/policy/module.mjs";
 import { PolicyAttributesValidator } from "./entities/policy/utils/attributes-validator.mjs";
 import { PolicyValidator } from "./entities/policy/utils/validation.mjs";
 import { ScopeController } from "./entities/scope/module.mjs";
+import { SessionController } from "./entities/session/module.mjs";
 import { UserController } from "./entities/user/module.mjs";
 import { UserAttributeController } from "./entities/user-attribute/module.mjs";
 import { UserAttributeRequestValidator } from "./entities/user-attribute/utils/validation.mjs";
@@ -46,4 +48,4 @@ import { UserPermissionRequestValidator } from "./entities/user-permission/utils
 import { UserRoleController } from "./entities/user-role/module.mjs";
 import { UserRoleRequestValidator } from "./entities/user-role/utils/validation.mjs";
 import "./entities/index.mjs";
-export { ActivateController, AuthorizeController, ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, IdentityProviderController, IdentityProviderRoleMappingController, JwkController, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RegisterController, RobotController, RobotPermissionController, RobotPermissionRequestValidator, RobotRoleController, RobotRoleRequestValidator, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, StatusController, TokenController, UserAttributeController, UserAttributeRequestValidator, UserController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator, getJwkRouteHandler, getJwksRouteHandler };
+export { ActivateController, AuthorizeController, ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, IdentityProviderController, IdentityProviderRoleMappingController, JwkController, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RegisterController, RobotController, RobotPermissionController, RobotPermissionRequestValidator, RobotRoleController, RobotRoleRequestValidator, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, StatusController, TokenController, UserAttributeController, UserAttributeRequestValidator, UserController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator, getJwkRouteHandler, getJwksRouteHandler };

package/dist/adapters/http/controllers/workflows/authorize/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/module.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGxC,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAGlE,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AACvF,OAAO,KAAK,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAGzF,qBACa,mBAAmB;IAI5B,SAAS,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAE9C,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,oBAAoB,EAAG,uCAAuC,CAAC;IAEzE,SAAS,CAAC,UAAU,EAAE,oBAAoB,CAAC;gBAI/B,GAAG,EAAE,0BAA0B;IAmBrC,OAAO,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAwB/D,KAAK,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;CA6C7D"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/module.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAQxC,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAGlE,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AACvF,OAAO,KAAK,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAMzF,qBACa,mBAAmB;IAI5B,SAAS,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAE9C,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,oBAAoB,EAAG,uCAAuC,CAAC;IAEzE,SAAS,CAAC,UAAU,EAAE,oBAAoB,CAAC;gBAI/B,GAAG,EAAE,0BAA0B;IAkBrC,OAAO,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAgB/D,KAAK,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;CA+E7D"}

package/dist/adapters/http/controllers/workflows/authorize/module.mjs

@@ -5,14 +5,14 @@ import { OAuth2AuthorizationCodeRequestValidator } from "../../../../../core/oau
 import "../../../../../core/index.mjs";
 import { readFromLocations } from "../../../request/helpers/locations.mjs";
 import "../../../request/index.mjs";
-import { HTTPOAuth2Authorizer } from "../../../adapters/oauth2/authorization/module.mjs";
-import "../../../adapters/index.mjs";
+import { ForceUserLoggedInMiddleware } from "../../../middleware/built-in/loggedin/user.mjs";
 import { sanitizeError } from "../../../../../utils/error.mjs";
 import "../../../../../utils/index.mjs";
-import { ForceUserLoggedInMiddleware } from "../../../middleware/built-in/loggedin/user.mjs";
 import "../../../middleware/index.mjs";
 import { renderUIPage } from "../../../ui/render.mjs";
 import "../../../ui/index.mjs";
+import { HTTPOAuth2Authorizer } from "../../../adapters/oauth2/authorization/module.mjs";
+import "../../../adapters/index.mjs";
 import { URL } from "node:url";
 import { DContext, DController, DGet, DPost } from "@routup/decorators";
 //#region src/adapters/http/controllers/workflows/authorize/module.ts
@@ -41,10 +41,9 @@ var AuthorizeController = class {
 		this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();
 		this.authorizer = new HTTPOAuth2Authorizer({
 			codeRequestVerifier: this.codeRequestVerifier,
-			accessTokenIssuer: ctx.accessTokenIssuer,
-			openIdTokenIssuer: ctx.openIdTokenIssuer,
 			codeIssuer: ctx.codeIssuer,
-			identityResolver: ctx.identityResolver
+			sessionManager: ctx.sessionManager,
+			promptLoginMaxAge: ctx.options.promptLoginMaxAge
 		});
 	}
 	async confirm(event) {
@@ -52,21 +51,33 @@ var AuthorizeController = class {
 		const url = new URL(result.redirectUri);
 		if (result.state) url.searchParams.set("state", result.state);
 		if (result.authorizationCode) url.searchParams.set("code", result.authorizationCode);
-		if (result.accessToken) url.searchParams.set("access_token", result.accessToken);
-		if (result.idToken) url.searchParams.set("id_token", result.idToken);
 		return { url: url.href };
 	}
 	async serve(event) {
 		let codeRequest;
 		let client;
 		let scopes;
+		let realm;
+		let redirectUriVerified = false;
 		let error;
 		try {
 			const merged = await readFromLocations(event, ["body", "query"]);
 			const data = await this.codeRequestValidator.run(merged);
 			const result = await this.codeRequestVerifier.verify(data);
-			client = result.client;
+			client = {
+				id: result.client.id,
+				name: result.client.name,
+				display_name: result.client.display_name,
+				built_in: result.client.built_in,
+				created_at: result.client.created_at
+			};
 			scopes = result.scopes;
+			redirectUriVerified = result.redirectUriVerified;
+			if (result.client.realm) realm = {
+				id: result.client.realm.id,
+				name: result.client.realm.name,
+				display_name: result.client.realm.display_name
+			};
 			codeRequest = result.data;
 		} catch (e) {
 			const normalized = sanitizeError(e);
@@ -85,6 +96,8 @@ var AuthorizeController = class {
 					error,
 					client,
 					scopes,
+					realm,
+					redirectUriVerified,
 					features: this.options.features,
 					requestPath: `${requestURL.pathname}${requestURL.search}`
 				}

package/dist/adapters/http/controllers/workflows/authorize/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["DContext","DController","DGet","DPost","URL","ForceUserLoggedInMiddleware","HTTPOAuth2Authorizer","renderUIPage","readFromLocations","OAuth2AuthorizationCodeRequestValidator","sanitizeError","AuthorizeController","options","codeRequestVerifier","codeRequestValidator","authorizer","ctx","accessTokenIssuer","openIdTokenIssuer","codeIssuer","identityResolver","confirm","event","result","authorizeWithRequest","url","redirectUri","state","searchParams","set","authorizationCode","accessToken","idToken","href","serve","codeRequest","client","scopes","error","merged","data","run","verify","e","normalized","message","requestURL","request","payload","config","baseURL","features","requestPath","pathname","search"],"sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPost,\n} from '@routup/decorators';\nimport { URL } from 'node:url';\n\nimport type { IAppEvent } from 'routup';\nimport type { Client, OAuth2AuthorizationCodeRequest, Scope } from '@authup/core-kit';\nimport { ForceUserLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { HTTPOAuth2Authorizer } from '../../../adapters/index.ts';\nimport { renderUIPage } from '../../../ui/index.ts';\nimport { readFromLocations } from '../../../request/index.ts';\nimport type { IOAuth2AuthorizationCodeRequestVerifier } from '../../../../../core/index.ts';\nimport { OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';\nimport type { AuthorizeControllerContext, AuthorizeControllerOptions } from './types.ts';\nimport { sanitizeError } from '../../../../../utils/index.ts';\n\n@DController('/authorize')\nexport class AuthorizeController {\n    // todo: maybe /realms/<realm>/protocol/openid-connect/authorize\n    // todo: maybe /realms/<realm>/[...]/authorize\n\n    protected options: AuthorizeControllerOptions;\n\n    protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n    protected codeRequestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n    protected authorizer: HTTPOAuth2Authorizer;\n\n    // ---------------------------------------------------------\n\n    constructor(ctx: AuthorizeControllerContext) {\n        this.options = ctx.options;\n\n        this.codeRequestVerifier = ctx.codeRequestVerifier;\n\n        this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();\n\n        this.authorizer = new HTTPOAuth2Authorizer({\n            codeRequestVerifier: this.codeRequestVerifier,\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            openIdTokenIssuer: ctx.openIdTokenIssuer,\n            codeIssuer: ctx.codeIssuer,\n            identityResolver: ctx.identityResolver,\n        });\n    }\n\n    // ---------------------------------------------------------\n\n    @DPost('', [ForceUserLoggedInMiddleware])\n    async confirm(@DContext() event: IAppEvent): Promise<{ url: string }> {\n        const result = await this.authorizer.authorizeWithRequest(event);\n\n        const url = new URL(result.redirectUri);\n        if (result.state) {\n            url.searchParams.set('state', result.state);\n        }\n\n        if (result.authorizationCode) {\n            url.searchParams.set('code', result.authorizationCode);\n        }\n\n        if (result.accessToken) {\n            url.searchParams.set('access_token', result.accessToken);\n        }\n\n        if (result.idToken) {\n            url.searchParams.set('id_token', result.idToken);\n        }\n\n        return { url: url.href };\n    }\n\n    @DGet('', [])\n    async serve(@DContext() event: IAppEvent): Promise<string> {\n        let codeRequest : OAuth2AuthorizationCodeRequest | undefined;\n\n        let client : Client | undefined;\n        let scopes : Scope[] | undefined;\n\n        let error : Error | undefined;\n\n        try {\n            const merged = await readFromLocations(event, ['body', 'query']);\n            const data = await this.codeRequestValidator.run(merged);\n\n            const result = await this.codeRequestVerifier.verify(data);\n            client = result.client;\n            scopes = result.scopes;\n\n            codeRequest = result.data;\n        } catch (e) {\n            const normalized = sanitizeError(e);\n            error = {\n                ...normalized,\n                message: normalized.message,\n            };\n        }\n\n        // Path + query of the original request — the SSR page uses it as\n        // the same-origin `redirect` parameter on register / password links\n        // so those pages can lead back into this authorize request.\n        const requestURL = new URL(event.request.url);\n\n        return renderUIPage(event, {\n            url: '/authorize',\n            payload: {\n                config: { baseURL: this.options.baseURL },\n                data: {\n                    codeRequest,\n                    error,\n                    client,\n                    scopes,\n                    features: this.options.features,\n                    requestPath: `${requestURL.pathname}${requestURL.search}`,\n                },\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,IAAaW,sBAAb,MAAaA;CAICC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAiC;EACzC,KAAKJ,UAAUI,IAAIJ;EAEnB,KAAKC,sBAAsBG,IAAIH;EAE/B,KAAKC,uBAAuB,IAAIL,wCAAAA;EAEhC,KAAKM,aAAa,IAAIT,qBAAqB;GACvCO,qBAAqB,KAAKA;GAC1BI,mBAAmBD,IAAIC;GACvBC,mBAAmBF,IAAIE;GACvBC,YAAYH,IAAIG;GAChBC,kBAAkBJ,IAAII;EAC1B,CAAA;CACJ;CAIA,MACMC,QAAQ,OAAwD;EAClE,MAAME,SAAS,MAAM,KAAKR,WAAWS,qBAAqBF,KAAAA;EAE1D,MAAMG,MAAM,IAAIrB,IAAImB,OAAOG,WAAW;EACtC,IAAIH,OAAOI,OACPF,IAAIG,aAAaC,IAAI,SAASN,OAAOI,KAAK;EAG9C,IAAIJ,OAAOO,mBACPL,IAAIG,aAAaC,IAAI,QAAQN,OAAOO,iBAAiB;EAGzD,IAAIP,OAAOQ,aACPN,IAAIG,aAAaC,IAAI,gBAAgBN,OAAOQ,WAAW;EAG3D,IAAIR,OAAOS,SACPP,IAAIG,aAAaC,IAAI,YAAYN,OAAOS,OAAO;EAGnD,OAAO,EAAEP,KAAKA,IAAIQ,KAAK;CAC3B;CAEA,MACMC,MAAM,OAA+C;EACvD,IAAIC;EAEJ,IAAIC;EACJ,IAAIC;EAEJ,IAAIC;EAEJ,IAAI;GACA,MAAMC,SAAS,MAAM/B,kBAAkBc,OAAO,CAAC,QAAQ,OAAA,CAAQ;GAC/D,MAAMkB,OAAO,MAAM,KAAK1B,qBAAqB2B,IAAIF,MAAAA;GAEjD,MAAMhB,SAAS,MAAM,KAAKV,oBAAoB6B,OAAOF,IAAAA;GACrDJ,SAASb,OAAOa;GAChBC,SAASd,OAAOc;GAEhBF,cAAcZ,OAAOiB;EACzB,SAASG,GAAG;GACR,MAAMC,aAAalC,cAAciC,CAAAA;GACjCL,QAAQ;IACJ,GAAGM;IACHC,SAASD,WAAWC;GACxB;EACJ;EAKA,MAAMC,aAAa,IAAI1C,IAAIkB,MAAMyB,QAAQtB,GAAG;EAE5C,OAAOlB,aAAae,OAAO;GACvBG,KAAK;GACLuB,SAAS;IACLC,QAAQ,EAAEC,SAAS,KAAKtC,QAAQsC,QAAQ;IACxCV,MAAM;KACFL;KACAG;KACAF;KACAC;KACAc,UAAU,KAAKvC,QAAQuC;KACvBC,aAAa,GAAGN,WAAWO,WAAWP,WAAWQ;IACrD;GACJ;EACJ,CAAA;CACJ;AACJ;;YAtEgBjD,2BAAAA,CAAAA"}
+{"version":3,"file":"module.mjs","names":["DContext","DController","DGet","DPost","URL","ForceUserLoggedInMiddleware","HTTPOAuth2Authorizer","renderUIPage","readFromLocations","OAuth2AuthorizationCodeRequestValidator","sanitizeError","AuthorizeController","options","codeRequestVerifier","codeRequestValidator","authorizer","ctx","codeIssuer","sessionManager","promptLoginMaxAge","confirm","event","result","authorizeWithRequest","url","redirectUri","state","searchParams","set","authorizationCode","href","serve","codeRequest","client","scopes","realm","redirectUriVerified","error","merged","data","run","verify","id","name","display_name","built_in","created_at","e","normalized","message","requestURL","request","payload","config","baseURL","features","requestPath","pathname","search"],"sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPost,\n} from '@routup/decorators';\nimport { URL } from 'node:url';\n\nimport type { IAppEvent } from 'routup';\nimport type {\n    Client,\n    OAuth2AuthorizationCodeRequest,\n    Realm,\n    Scope,\n} from '@authup/core-kit';\nimport { ForceUserLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { HTTPOAuth2Authorizer } from '../../../adapters/index.ts';\nimport { renderUIPage } from '../../../ui/index.ts';\nimport { readFromLocations } from '../../../request/index.ts';\nimport type { IOAuth2AuthorizationCodeRequestVerifier } from '../../../../../core/index.ts';\nimport { OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';\nimport type { AuthorizeControllerContext, AuthorizeControllerOptions } from './types.ts';\nimport { sanitizeError } from '../../../../../utils/index.ts';\n\ntype RealmSummary = Pick<Realm, 'id' | 'name' | 'display_name'>;\ntype ClientSummary = Pick<Client, 'id' | 'name' | 'display_name' | 'built_in' | 'created_at'>;\n\n@DController('/authorize')\nexport class AuthorizeController {\n    // todo: maybe /realms/<realm>/protocol/openid-connect/authorize\n    // todo: maybe /realms/<realm>/[...]/authorize\n\n    protected options: AuthorizeControllerOptions;\n\n    protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n    protected codeRequestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n    protected authorizer: HTTPOAuth2Authorizer;\n\n    // ---------------------------------------------------------\n\n    constructor(ctx: AuthorizeControllerContext) {\n        this.options = ctx.options;\n\n        this.codeRequestVerifier = ctx.codeRequestVerifier;\n\n        this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();\n\n        this.authorizer = new HTTPOAuth2Authorizer({\n            codeRequestVerifier: this.codeRequestVerifier,\n            codeIssuer: ctx.codeIssuer,\n            sessionManager: ctx.sessionManager,\n            promptLoginMaxAge: ctx.options.promptLoginMaxAge,\n        });\n    }\n\n    // ---------------------------------------------------------\n\n    @DPost('', [ForceUserLoggedInMiddleware])\n    async confirm(@DContext() event: IAppEvent): Promise<{ url: string }> {\n        const result = await this.authorizer.authorizeWithRequest(event);\n\n        const url = new URL(result.redirectUri);\n        if (result.state) {\n            url.searchParams.set('state', result.state);\n        }\n\n        if (result.authorizationCode) {\n            url.searchParams.set('code', result.authorizationCode);\n        }\n\n        return { url: url.href };\n    }\n\n    @DGet('', [])\n    async serve(@DContext() event: IAppEvent): Promise<string> {\n        let codeRequest : OAuth2AuthorizationCodeRequest | undefined;\n\n        let client : ClientSummary | undefined;\n        let scopes : Scope[] | undefined;\n\n        // Target realm summary (the client's realm) — the UI names it in the\n        // realm-mismatch notice. codeRequest.realm_id is only the id.\n        let realm : RealmSummary | undefined;\n\n        // Whether the request redirect_uri matched a registered client pattern —\n        // the UI must not offer an automatic \"return to application\" redirect to\n        // an unverified (pattern-less-client) redirect_uri.\n        let redirectUriVerified = false;\n\n        let error : Error | undefined;\n\n        try {\n            const merged = await readFromLocations(event, ['body', 'query']);\n            const data = await this.codeRequestValidator.run(merged);\n\n            const result = await this.codeRequestVerifier.verify(data);\n\n            // Trim the client to a deliberate DTO before it reaches the\n            // anonymous SSR hydration payload — never disclose redirect_uri\n            // patterns (the trusted-origin set), grant_types, internal\n            // base/root URLs, is_confidential, or the secret storage flags to an\n            // unauthenticated visitor. (ClientEntity.secret is additionally\n            // select:false, so the secret is never loaded — but the DTO must not\n            // rely on that alone: a future entity/query change could unset it.)\n            client = {\n                id: result.client.id,\n                name: result.client.name,\n                display_name: result.client.display_name,\n                built_in: result.client.built_in,\n                created_at: result.client.created_at,\n            };\n            scopes = result.scopes;\n            redirectUriVerified = result.redirectUriVerified;\n\n            if (result.client.realm) {\n                realm = {\n                    id: result.client.realm.id,\n                    name: result.client.realm.name,\n                    display_name: result.client.realm.display_name,\n                };\n            }\n\n            codeRequest = result.data;\n        } catch (e) {\n            const normalized = sanitizeError(e);\n            error = {\n                ...normalized,\n                message: normalized.message,\n            };\n        }\n\n        // Path + query of the original request — the SSR page uses it as\n        // the same-origin `redirect` parameter on register / password links\n        // so those pages can lead back into this authorize request.\n        const requestURL = new URL(event.request.url);\n\n        return renderUIPage(event, {\n            url: '/authorize',\n            payload: {\n                config: { baseURL: this.options.baseURL },\n                data: {\n                    codeRequest,\n                    error,\n                    client,\n                    scopes,\n                    realm,\n                    redirectUriVerified,\n                    features: this.options.features,\n                    requestPath: `${requestURL.pathname}${requestURL.search}`,\n                },\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmCA,IAAaW,sBAAb,MAAaA;CAICC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAiC;EACzC,KAAKJ,UAAUI,IAAIJ;EAEnB,KAAKC,sBAAsBG,IAAIH;EAE/B,KAAKC,uBAAuB,IAAIL,wCAAAA;EAEhC,KAAKM,aAAa,IAAIT,qBAAqB;GACvCO,qBAAqB,KAAKA;GAC1BI,YAAYD,IAAIC;GAChBC,gBAAgBF,IAAIE;GACpBC,mBAAmBH,IAAIJ,QAAQO;EACnC,CAAA;CACJ;CAIA,MACMC,QAAQ,OAAwD;EAClE,MAAME,SAAS,MAAM,KAAKP,WAAWQ,qBAAqBF,KAAAA;EAE1D,MAAMG,MAAM,IAAIpB,IAAIkB,OAAOG,WAAW;EACtC,IAAIH,OAAOI,OACPF,IAAIG,aAAaC,IAAI,SAASN,OAAOI,KAAK;EAG9C,IAAIJ,OAAOO,mBACPL,IAAIG,aAAaC,IAAI,QAAQN,OAAOO,iBAAiB;EAGzD,OAAO,EAAEL,KAAKA,IAAIM,KAAK;CAC3B;CAEA,MACMC,MAAM,OAA+C;EACvD,IAAIC;EAEJ,IAAIC;EACJ,IAAIC;EAIJ,IAAIC;EAKJ,IAAIC,sBAAsB;EAE1B,IAAIC;EAEJ,IAAI;GACA,MAAMC,SAAS,MAAM9B,kBAAkBa,OAAO,CAAC,QAAQ,OAAA,CAAQ;GAC/D,MAAMkB,OAAO,MAAM,KAAKzB,qBAAqB0B,IAAIF,MAAAA;GAEjD,MAAMhB,SAAS,MAAM,KAAKT,oBAAoB4B,OAAOF,IAAAA;GASrDN,SAAS;IACLS,IAAIpB,OAAOW,OAAOS;IAClBC,MAAMrB,OAAOW,OAAOU;IACpBC,cAActB,OAAOW,OAAOW;IAC5BC,UAAUvB,OAAOW,OAAOY;IACxBC,YAAYxB,OAAOW,OAAOa;GAC9B;GACAZ,SAASZ,OAAOY;GAChBE,sBAAsBd,OAAOc;GAE7B,IAAId,OAAOW,OAAOE,OACdA,QAAQ;IACJO,IAAIpB,OAAOW,OAAOE,MAAMO;IACxBC,MAAMrB,OAAOW,OAAOE,MAAMQ;IAC1BC,cAActB,OAAOW,OAAOE,MAAMS;GACtC;GAGJZ,cAAcV,OAAOiB;EACzB,SAASQ,GAAG;GACR,MAAMC,aAAatC,cAAcqC,CAAAA;GACjCV,QAAQ;IACJ,GAAGW;IACHC,SAASD,WAAWC;GACxB;EACJ;EAKA,MAAMC,aAAa,IAAI9C,IAAIiB,MAAM8B,QAAQ3B,GAAG;EAE5C,OAAOjB,aAAac,OAAO;GACvBG,KAAK;GACL4B,SAAS;IACLC,QAAQ,EAAEC,SAAS,KAAK1C,QAAQ0C,QAAQ;IACxCf,MAAM;KACFP;KACAK;KACAJ;KACAC;KACAC;KACAC;KACAmB,UAAU,KAAK3C,QAAQ2C;KACvBC,aAAa,GAAGN,WAAWO,WAAWP,WAAWQ;IACrD;GACJ;EACJ,CAAA;CACJ;AACJ;;YAhGgBrD,2BAAAA,CAAAA"}

package/dist/adapters/http/controllers/workflows/authorize/types.d.ts

@@ -1,15 +1,18 @@
 import type { StatusResponseFeatures } from '@authup/core-http-kit';
-import type { IIdentityResolver, IOAuth2AuthorizationCodeIssuer, IOAuth2AuthorizationCodeRequestVerifier, IOAuth2OpenIDTokenIssuer, IOAuth2TokenIssuer } from '../../../../../core/index.ts';
+import type { IOAuth2AuthorizationCodeIssuer, IOAuth2AuthorizationCodeRequestVerifier, ISessionManager } from '../../../../../core/index.ts';
 export type AuthorizeControllerOptions = {
     baseURL: string;
     features: StatusResponseFeatures;
+    /**
+     * Max age (seconds) a `prompt=login` request accepts before forcing re-auth
+     * (config `promptLoginMaxAge`).
+     */
+    promptLoginMaxAge?: number;
 };
 export type AuthorizeControllerContext = {
     options: AuthorizeControllerOptions;
-    accessTokenIssuer: IOAuth2TokenIssuer;
-    openIdTokenIssuer: IOAuth2OpenIDTokenIssuer;
     codeIssuer: IOAuth2AuthorizationCodeIssuer;
     codeRequestVerifier: IOAuth2AuthorizationCodeRequestVerifier;
-    identityResolver: IIdentityResolver;
+    sessionManager: ISessionManager;
 };
 //# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/controllers/workflows/authorize/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,EACR,iBAAiB,EACjB,8BAA8B,EAC9B,uCAAuC,EACvC,wBAAwB,EACxB,kBAAkB,EACrB,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,0BAA0B,GAAG;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,sBAAsB,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACrC,OAAO,EAAE,0BAA0B,CAAC;IAEpC,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,iBAAiB,EAAE,wBAAwB,CAAC;IAE5C,UAAU,EAAE,8BAA8B,CAAC;IAC3C,mBAAmB,EAAE,uCAAuC,CAAC;IAE7D,gBAAgB,EAAE,iBAAiB,CAAA;CACtC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,EACR,8BAA8B,EAC9B,uCAAuC,EACvC,eAAe,EAClB,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,0BAA0B,GAAG;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,sBAAsB,CAAC;IACjC;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACrC,OAAO,EAAE,0BAA0B,CAAC;IAEpC,UAAU,EAAE,8BAA8B,CAAC;IAC3C,mBAAmB,EAAE,uCAAuC,CAAC;IAE7D,cAAc,EAAE,eAAe,CAAA;CAClC,CAAC"}

package/dist/adapters/http/controllers/workflows/index.d.ts

@@ -1,6 +1,7 @@
 export * from './activate/index.ts';
 export * from './authorize/index.ts';
 export * from './jwks/index.ts';
+export * from './logout/index.ts';
 export * from './openid/index.ts';
 export * from './password-forgot/index.ts';
 export * from './password-reset/index.ts';

package/dist/adapters/http/controllers/workflows/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/controllers/workflows/index.ts"],"names":[],"mappings":"AAOA,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/controllers/workflows/index.ts"],"names":[],"mappings":"AAOA,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC"}

package/dist/adapters/http/controllers/workflows/index.mjs

@@ -8,6 +8,8 @@ import "./authorize/index.mjs";
 import { getJwkRouteHandler, getJwksRouteHandler } from "./jwks/handlers/read.mjs";
 import { JwkController } from "./jwks/module.mjs";
 import "./jwks/index.mjs";
+import { LogoutController } from "./logout/module.mjs";
+import "./logout/index.mjs";
 import { OpenIDController } from "./openid/module.mjs";
 import "./openid/index.mjs";
 import { PasswordForgotController } from "./password-forgot/module.mjs";
@@ -20,4 +22,4 @@ import { StatusController } from "./status/module.mjs";
 import "./status/index.mjs";
 import { TokenController } from "./token/module.mjs";
 import "./token/index.mjs";
-export { ActivateController, AuthorizeController, JwkController, OpenIDController, PasswordForgotController, PasswordResetController, RegisterController, StatusController, TokenController, getJwkRouteHandler, getJwksRouteHandler };
+export { ActivateController, AuthorizeController, JwkController, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, RegisterController, StatusController, TokenController, getJwkRouteHandler, getJwksRouteHandler };

package/dist/adapters/http/controllers/workflows/logout/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/controllers/workflows/logout/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/logout/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/adapters/http/controllers/workflows/logout/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { LogoutController } from "./module.mjs";
+export { LogoutController };

package/dist/adapters/http/controllers/workflows/logout/module.d.ts

@@ -0,0 +1,14 @@
+import type { IAppEvent } from 'routup';
+import type { IOAuth2EndSessionService } from '../../../../../core/index.ts';
+import { OAuth2EndSessionRequestValidator } from '../../../../../core/index.ts';
+import type { LogoutControllerContext, LogoutControllerOptions } from './types.ts';
+export declare class LogoutController {
+    protected options: LogoutControllerOptions;
+    protected endSessionService: IOAuth2EndSessionService;
+    protected validator: OAuth2EndSessionRequestValidator;
+    constructor(ctx: LogoutControllerContext);
+    serve(event: IAppEvent): Promise<string | Response>;
+    execute(event: IAppEvent): Promise<string | Response>;
+    protected handle(event: IAppEvent): Promise<string | Response>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/controllers/workflows/logout/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/logout/module.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,wBAAwB,EAA2B,MAAM,8BAA8B,CAAC;AACtG,OAAO,EAAE,gCAAgC,EAAE,MAAM,8BAA8B,CAAC;AAGhF,OAAO,KAAK,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAEnF,qBACa,gBAAgB;IACzB,SAAS,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAE3C,SAAS,CAAC,iBAAiB,EAAE,wBAAwB,CAAC;IAEtD,SAAS,CAAC,SAAS,EAAE,gCAAgC,CAAC;gBAE1C,GAAG,EAAE,uBAAuB;IAOlC,KAAK,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC;IAM/D,OAAO,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC;cAIvD,MAAM,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC;CAyEvE"}

package/dist/adapters/http/controllers/workflows/logout/module.mjs

@@ -0,0 +1,101 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { OAuth2EndSessionRequestValidator } from "../../../../../core/oauth2/end-session/validator.mjs";
+import "../../../../../core/index.mjs";
+import { readFromLocations } from "../../../request/helpers/locations.mjs";
+import "../../../request/index.mjs";
+import { renderUIPage } from "../../../ui/render.mjs";
+import "../../../ui/index.mjs";
+import { URL } from "node:url";
+import { sendRedirect } from "routup";
+import { DContext, DController, DGet, DPost } from "@routup/decorators";
+//#region src/adapters/http/controllers/workflows/logout/module.ts
+function _ts_decorate(decorators, target, key, desc) {
+	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+	return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(k, v) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+function _ts_param(paramIndex, decorator) {
+	return function(target, key) {
+		decorator(target, key, paramIndex);
+	};
+}
+var LogoutController = class {
+	options;
+	endSessionService;
+	validator;
+	constructor(ctx) {
+		this.options = ctx.options;
+		this.endSessionService = ctx.endSessionService;
+		this.validator = new OAuth2EndSessionRequestValidator();
+	}
+	async serve(event) {
+		return this.handle(event);
+	}
+	async execute(event) {
+		return this.handle(event);
+	}
+	async handle(event) {
+		const merged = await readFromLocations(event, ["body", "query"]);
+		let data;
+		try {
+			data = await this.validator.run(merged);
+		} catch {
+			data = {};
+		}
+		const result = await this.endSessionService.verify(data);
+		let serverRevoked = false;
+		if (result.hintVerified && result.sessionId && result.sub && result.subKind) serverRevoked = await this.endSessionService.revoke(result.sessionId, result.sub, result.subKind);
+		let redirect;
+		if (result.redirectUri) {
+			const url = new URL(result.redirectUri);
+			if (result.state) url.searchParams.set("state", result.state);
+			redirect = url.href;
+		}
+		if (serverRevoked && redirect) return sendRedirect(event, redirect);
+		const requestURL = new URL(event.request.url);
+		return renderUIPage(event, {
+			url: "/logout",
+			payload: {
+				config: { baseURL: this.options.baseURL },
+				data: {
+					client: result.clientName ? { name: result.clientName } : void 0,
+					hintVerified: result.hintVerified,
+					hintSub: result.hintVerified ? result.sub : void 0,
+					hintSubKind: result.hintVerified ? result.subKind : void 0,
+					serverRevoked,
+					redirect,
+					requestPath: `${requestURL.pathname}${requestURL.search}`
+				}
+			}
+		});
+	}
+};
+_ts_decorate([
+	DGet("", []),
+	_ts_param(0, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], LogoutController.prototype, "serve", null);
+_ts_decorate([
+	DPost("", []),
+	_ts_param(0, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], LogoutController.prototype, "execute", null);
+LogoutController = _ts_decorate([
+	DController("/logout"),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof LogoutControllerContext === "undefined" ? Object : LogoutControllerContext])
+], LogoutController);
+//#endregion
+export { LogoutController };
+
+//# sourceMappingURL=module.mjs.map

package/dist/adapters/http/controllers/workflows/logout/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["DContext","DController","DGet","DPost","URL","sendRedirect","OAuth2EndSessionRequestValidator","readFromLocations","renderUIPage","LogoutController","options","endSessionService","validator","ctx","serve","event","handle","execute","merged","data","run","result","verify","serverRevoked","hintVerified","sessionId","sub","subKind","revoke","redirect","redirectUri","url","state","searchParams","set","href","requestURL","request","payload","config","baseURL","client","clientName","name","undefined","hintSub","hintSubKind","requestPath","pathname","search"],"sources":["../../../../../../src/adapters/http/controllers/workflows/logout/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPost,\n} from '@routup/decorators';\nimport { URL } from 'node:url';\nimport type { IAppEvent } from 'routup';\nimport { sendRedirect } from 'routup';\nimport type { IOAuth2EndSessionService, OAuth2EndSessionRequest } from '../../../../../core/index.ts';\nimport { OAuth2EndSessionRequestValidator } from '../../../../../core/index.ts';\nimport { readFromLocations } from '../../../request/index.ts';\nimport { renderUIPage } from '../../../ui/index.ts';\nimport type { LogoutControllerContext, LogoutControllerOptions } from './types.ts';\n\n@DController('/logout')\nexport class LogoutController {\n    protected options: LogoutControllerOptions;\n\n    protected endSessionService: IOAuth2EndSessionService;\n\n    protected validator: OAuth2EndSessionRequestValidator;\n\n    constructor(ctx: LogoutControllerContext) {\n        this.options = ctx.options;\n        this.endSessionService = ctx.endSessionService;\n        this.validator = new OAuth2EndSessionRequestValidator();\n    }\n\n    @DGet('', [])\n    async serve(@DContext() event: IAppEvent): Promise<string | Response> {\n        return this.handle(event);\n    }\n\n    // OIDC RP-Initiated Logout allows form_post on the same endpoint.\n    @DPost('', [])\n    async execute(@DContext() event: IAppEvent): Promise<string | Response> {\n        return this.handle(event);\n    }\n\n    protected async handle(event: IAppEvent): Promise<string | Response> {\n        const merged = await readFromLocations(event, ['body', 'query']);\n\n        // Malformed input (oversized / duplicated params) must never dead-end\n        // the human behind the browser on a JSON error: fall back to a\n        // parameter-less confirm page — every attacker-controlled value is\n        // dropped, the click-gated sign-out keeps working.\n        let data: OAuth2EndSessionRequest;\n        try {\n            data = await this.validator.run(merged);\n        } catch {\n            data = {};\n        }\n\n        const result = await this.endSessionService.verify(data);\n\n        // A signature-verified id_token_hint proves possession — revoke the\n        // referenced session server-side immediately (only if it belongs to the\n        // hint's subject). Without a hint we mutate nothing; the SSR page's\n        // sign-out is a click-gated, bearer-authenticated action.\n        let serverRevoked = false;\n        if (result.hintVerified && result.sessionId && result.sub && result.subKind) {\n            serverRevoked = await this.endSessionService.revoke(\n                result.sessionId,\n                result.sub,\n                result.subKind,\n            );\n        }\n\n        // Build the validated post-logout redirect (the open-redirect guard\n        // lives in the service; `state` rides only alongside a validated uri).\n        let redirect: string | undefined;\n        if (result.redirectUri) {\n            const url = new URL(result.redirectUri);\n            if (result.state) {\n                url.searchParams.set('state', result.state);\n            }\n\n            redirect = url.href;\n        }\n\n        // Bounce straight back to the RP ONLY when the logout was actually\n        // performed server-side (a verified hint revoked the session). A\n        // hint-less or forged request MUST NOT silently redirect without ending\n        // the session — otherwise the RP treats a no-op round-trip as a\n        // successful logout while the authup session survives. Instead render\n        // the click-gated confirm page, which performs the bearer-authenticated\n        // sign-out and then redirects.\n        if (serverRevoked && redirect) {\n            return sendRedirect(event, redirect);\n        }\n\n        const requestURL = new URL(event.request.url);\n\n        return renderUIPage(event, {\n            url: '/logout',\n            payload: {\n                config: { baseURL: this.options.baseURL },\n                data: {\n                    client: result.clientName ? { name: result.clientName } : undefined,\n                    hintVerified: result.hintVerified,\n                    // never reflect an unverified hint's claims\n                    hintSub: result.hintVerified ? result.sub : undefined,\n                    hintSubKind: result.hintVerified ? result.subKind : undefined,\n                    serverRevoked,\n                    // the (already validated) uri to return to after a click-gated\n                    // sign-out; carries `state` when present\n                    redirect,\n                    requestPath: `${requestURL.pathname}${requestURL.search}`,\n                },\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAuBA,IAAaS,mBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA8B;EACtC,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,oBAAoBE,IAAIF;EAC7B,KAAKC,YAAY,IAAIN,iCAAAA;CACzB;CAEA,MACMQ,MAAM,OAA0D;EAClE,OAAO,KAAKE,OAAOD,KAAAA;CACvB;CAGA,MACME,QAAQ,OAA0D;EACpE,OAAO,KAAKD,OAAOD,KAAAA;CACvB;CAEA,MAAgBC,OAAOD,OAA8C;EACjE,MAAMG,SAAS,MAAMX,kBAAkBQ,OAAO,CAAC,QAAQ,OAAA,CAAQ;EAM/D,IAAII;EACJ,IAAI;GACAA,OAAO,MAAM,KAAKP,UAAUQ,IAAIF,MAAAA;EACpC,QAAQ;GACJC,OAAO,CAAC;EACZ;EAEA,MAAME,SAAS,MAAM,KAAKV,kBAAkBW,OAAOH,IAAAA;EAMnD,IAAII,gBAAgB;EACpB,IAAIF,OAAOG,gBAAgBH,OAAOI,aAAaJ,OAAOK,OAAOL,OAAOM,SAChEJ,gBAAgB,MAAM,KAAKZ,kBAAkBiB,OACzCP,OAAOI,WACPJ,OAAOK,KACPL,OAAOM,OAAO;EAMtB,IAAIE;EACJ,IAAIR,OAAOS,aAAa;GACpB,MAAMC,MAAM,IAAI3B,IAAIiB,OAAOS,WAAW;GACtC,IAAIT,OAAOW,OACPD,IAAIE,aAAaC,IAAI,SAASb,OAAOW,KAAK;GAG9CH,WAAWE,IAAII;EACnB;EASA,IAAIZ,iBAAiBM,UACjB,OAAOxB,aAAaU,OAAOc,QAAAA;EAG/B,MAAMO,aAAa,IAAIhC,IAAIW,MAAMsB,QAAQN,GAAG;EAE5C,OAAOvB,aAAaO,OAAO;GACvBgB,KAAK;GACLO,SAAS;IACLC,QAAQ,EAAEC,SAAS,KAAK9B,QAAQ8B,QAAQ;IACxCrB,MAAM;KACFsB,QAAQpB,OAAOqB,aAAa,EAAEC,MAAMtB,OAAOqB,WAAW,IAAIE,KAAAA;KAC1DpB,cAAcH,OAAOG;KAErBqB,SAASxB,OAAOG,eAAeH,OAAOK,MAAMkB,KAAAA;KAC5CE,aAAazB,OAAOG,eAAeH,OAAOM,UAAUiB,KAAAA;KACpDrB;KAGAM;KACAkB,aAAa,GAAGX,WAAWY,WAAWZ,WAAWa;IACrD;GACJ;EACJ,CAAA;CACJ;AACJ"}

package/dist/adapters/http/controllers/workflows/logout/types.d.ts

@@ -0,0 +1,9 @@
+import type { IOAuth2EndSessionService } from '../../../../../core/index.ts';
+export type LogoutControllerOptions = {
+    baseURL: string;
+};
+export type LogoutControllerContext = {
+    options: LogoutControllerOptions;
+    endSessionService: IOAuth2EndSessionService;
+};
+//# sourceMappingURL=types.d.ts.map