@authup/server-core 1.0.0-beta.51 → 1.0.0-beta.52

package/dist/adapters/http/controllers/workflows/logout/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/logout/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAE7E,MAAM,MAAM,uBAAuB,GAAG;IAClC,OAAO,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IAClC,OAAO,EAAE,uBAAuB,CAAC;IACjC,iBAAiB,EAAE,wBAAwB,CAAC;CAC/C,CAAC"}

package/dist/adapters/http/controllers/workflows/logout/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/adapters/http/controllers/workflows/status/module.mjs

@@ -3,8 +3,8 @@ import "node:url";
 import.meta.url;
 import { PACKAGE_PATH } from "../../../../../path.mjs";
 import path from "node:path";
-import { DController, DGet } from "@routup/decorators";
 import { load } from "locter";
+import { DController, DGet } from "@routup/decorators";
 //#region src/adapters/http/controllers/workflows/status/module.ts
 function _ts_decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;

package/dist/adapters/http/controllers/workflows/token/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/token/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,gCAAgC,EAAyB,MAAM,eAAe,CAAC;AACvH,OAAO,EAA4C,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAQ3F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGxC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,KAAK,EACR,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACvB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAWnE,qBAEa,eAAe;IACxB,SAAS,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;IAEjD,SAAS,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;IAEhD,SAAS,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAE9C,SAAS,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAE5C,SAAS,CAAC,gBAAgB,EAAG,iBAAiB,CAAC;IAE/C,SAAS,CAAC,0BAA0B,EAAG,2BAA2B,CAAC;IAEnE,SAAS,CAAC,WAAW,EAAG,MAAM,CAAC,GAAG,gBAAgB,EAAE,EAAE,gBAAgB,CAAC,CAAC;gBAI5D,GAAG,EAAE,sBAAsB;IAgDjC,aAAa,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,gCAAgC,CAAC;IAKtF,cAAc,CACJ,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,gCAAgC,CAAC;IA4DtC,WAAW,CACD,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,IAAI,CAAC;IAkBV,WAAW,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAarF"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/token/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,gCAAgC,EAAyB,MAAM,eAAe,CAAC;AACvH,OAAO,EAA4C,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAQ3F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGxC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,KAAK,EACR,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACvB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAWnE,qBAEa,eAAe;IACxB,SAAS,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;IAEjD,SAAS,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;IAEhD,SAAS,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAE9C,SAAS,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAE5C,SAAS,CAAC,gBAAgB,EAAG,iBAAiB,CAAC;IAE/C,SAAS,CAAC,0BAA0B,EAAG,2BAA2B,CAAC;IAEnE,SAAS,CAAC,WAAW,EAAG,MAAM,CAAC,GAAG,gBAAgB,EAAE,EAAE,gBAAgB,CAAC,CAAC;gBAI5D,GAAG,EAAE,sBAAsB;IAuDjC,aAAa,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,gCAAgC,CAAC;IAKtF,cAAc,CACJ,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,gCAAgC,CAAC;IA4DtC,WAAW,CACD,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,IAAI,CAAC;IAkBV,WAAW,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAarF"}

package/dist/adapters/http/controllers/workflows/token/module.mjs

@@ -53,7 +53,10 @@ var TokenController = class {
 				clientAuthenticator: ctx.oauth2ClientAuthenticator,
 				accessTokenIssuer: ctx.accessTokenIssuer,
 				refreshTokenIssuer: ctx.refreshTokenIssuer,
-				sessionManager: ctx.sessionManager
+				openIdTokenIssuer: ctx.openIdTokenIssuer,
+				keyRepository: ctx.keyRepository,
+				sessionManager: ctx.sessionManager,
+				realmRepository: ctx.realmRepository
 			}),
 			[OAuth2TokenGrant.CLIENT_CREDENTIALS]: new HTTPClientCredentialsGrant({
 				accessTokenIssuer: ctx.accessTokenIssuer,
@@ -77,9 +80,13 @@ var TokenController = class {
 				accessTokenIssuer: ctx.accessTokenIssuer,
 				refreshTokenIssuer: ctx.refreshTokenIssuer,
 				tokenVerifier: ctx.tokenVerifier,
-				tokenRevoker: ctx.tokenRevoker,
+				tokenRepository: ctx.tokenRepository,
+				sessionTokenRepository: ctx.sessionTokenRepository,
 				sessionManager: ctx.sessionManager,
-				clientAuthenticator: ctx.oauth2ClientAuthenticator
+				clientAuthenticator: ctx.oauth2ClientAuthenticator,
+				realmRepository: ctx.realmRepository,
+				logger: ctx.logger,
+				options: { gracePeriod: ctx.tokenRefreshGracePeriod }
 			})
 		};
 	}

package/dist/adapters/http/controllers/workflows/token/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2GrantTypeError","OAuth2RequestError","OAuth2TokenGrant","DContext","DController","DGet","DPost","DTags","buildPermissionKey","toOAuth2Error","OAuth2OpenIDClaimsBuilder","HTTPClientCredentialsGrant","HTTPOAuth2AuthorizeGrant","HTTPOAuth2RefreshTokenGrant","HTTPPasswordGrant","HTTPRobotCredentialsGrant","guessOauth2GrantTypeByRequest","extractTokenFromRequest","TokenController","refreshTokenIssuer","accessTokenIssuer","tokenVerifier","tokenRevoker","identityResolver","identityPermissionProvider","tokenGrants","ctx","AUTHORIZATION_CODE","codeVerifier","clientAuthenticator","oauth2ClientAuthenticator","sessionManager","CLIENT_CREDENTIALS","authenticator","ROBOT_CREDENTIALS","robotAuthenticator","PASSWORD","userAuthenticator","realmRepository","REFRESH_TOKEN","getIntrospect","event","postIntrospect","token","payload","verify","skipActiveCheck","sub","sub_kind","identityInvalid","permissions","getFor","id","type","clientId","client_id","realmId","realm_id","identity","resolve","claimsBuilder","claims","fromIdentity","active","jti","isInactive","Object","values","reduce","acc","binding","key","permission","name","e","revokeToken","revoke","response","status","createToken","grantType","unsupported","grant","runWithRequest"],"sources":["../../../../../../src/adapters/http/controllers/workflows/token/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenIntrospectionResponse, OAuth2TokenPermission } from '@authup/specs';\nimport { OAuth2GrantTypeError, OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPost,\n    DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport { buildPermissionKey } from '@authup/access';\nimport { toOAuth2Error } from '../../../../../core/oauth2/helpers/index.ts';\nimport type { TokenControllerContext } from './types.ts';\nimport type {\n    IIdentityPermissionProvider,\n    IIdentityResolver,\n    IOAuth2TokenIssuer,\n    IOAuth2TokenRevoker,\n    IOAuth2TokenVerifier,\n} from '../../../../../core/index.ts';\nimport { OAuth2OpenIDClaimsBuilder } from '../../../../../core/index.ts';\nimport type { IHTTPOAuth2Grant } from '../../../adapters/index.ts';\nimport {\n    HTTPClientCredentialsGrant,\n    HTTPOAuth2AuthorizeGrant,\n    HTTPOAuth2RefreshTokenGrant,\n    HTTPPasswordGrant,\n    HTTPRobotCredentialsGrant,\n    guessOauth2GrantTypeByRequest,\n} from '../../../adapters/index.ts';\nimport { extractTokenFromRequest } from './utils/index.ts';\n\n@DTags('auth')\n@DController('/token')\nexport class TokenController {\n    protected refreshTokenIssuer: IOAuth2TokenIssuer;\n\n    protected accessTokenIssuer: IOAuth2TokenIssuer;\n\n    protected tokenVerifier: IOAuth2TokenVerifier;\n\n    protected tokenRevoker: IOAuth2TokenRevoker;\n\n    protected identityResolver : IIdentityResolver;\n\n    protected identityPermissionProvider : IIdentityPermissionProvider;\n\n    protected tokenGrants : Record<`${OAuth2TokenGrant}`, IHTTPOAuth2Grant>;\n\n    // -------------------------------------------\n\n    constructor(ctx: TokenControllerContext) {\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n        this.accessTokenIssuer = ctx.accessTokenIssuer;\n        this.tokenVerifier = ctx.tokenVerifier;\n        this.tokenRevoker = ctx.tokenRevoker;\n        this.identityResolver = ctx.identityResolver;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n\n        this.tokenGrants = {\n            [OAuth2TokenGrant.AUTHORIZATION_CODE]: new HTTPOAuth2AuthorizeGrant({\n                codeVerifier: ctx.codeVerifier,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                sessionManager: ctx.sessionManager,\n            }),\n            [OAuth2TokenGrant.CLIENT_CREDENTIALS]: new HTTPClientCredentialsGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                authenticator: ctx.clientAuthenticator,\n                sessionManager: ctx.sessionManager,\n            }),\n            [OAuth2TokenGrant.ROBOT_CREDENTIALS]: new HTTPRobotCredentialsGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                authenticator: ctx.robotAuthenticator,\n                sessionManager: ctx.sessionManager,\n            }),\n            [OAuth2TokenGrant.PASSWORD]: new HTTPPasswordGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                authenticator: ctx.userAuthenticator,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                sessionManager: ctx.sessionManager,\n                realmRepository: ctx.realmRepository,\n            }),\n            [OAuth2TokenGrant.REFRESH_TOKEN]: new HTTPOAuth2RefreshTokenGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                tokenVerifier: ctx.tokenVerifier,\n                tokenRevoker: ctx.tokenRevoker,\n                sessionManager: ctx.sessionManager,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n            }),\n        };\n    }\n\n    // -------------------------------------------\n\n    @DGet('/introspect', [])\n    async getIntrospect(@DContext() event: IAppEvent): Promise<OAuth2TokenIntrospectionResponse> {\n        return this.postIntrospect(event);\n    }\n\n    @DPost('/introspect', [])\n    async postIntrospect(\n        @DContext() event: IAppEvent,\n    ): Promise<OAuth2TokenIntrospectionResponse> {\n        try {\n            const token = await extractTokenFromRequest(event);\n            const payload = await this.tokenVerifier.verify(token, { skipActiveCheck: true });\n            if (!payload.sub || !payload.sub_kind) {\n                throw OAuth2RequestError.identityInvalid();\n            }\n\n            // todo: only receive client specific permissions\n            const permissions = await this.identityPermissionProvider.getFor({\n                id: payload.sub,\n                type: payload.sub_kind,\n                clientId: payload.client_id,\n                realmId: payload.realm_id,\n            });\n\n            const identity = await this.identityResolver.resolve(payload.sub_kind, payload.sub);\n            if (!identity) {\n                // todo: differentiate between client, robot & user\n                throw OAuth2RequestError.identityInvalid();\n            }\n\n            const claimsBuilder = new OAuth2OpenIDClaimsBuilder();\n            const claims = claimsBuilder.fromIdentity(identity);\n\n            let active : boolean;\n            if (payload.jti) {\n                const isInactive = await this.tokenVerifier.isInactive(payload.jti);\n                active = !isInactive;\n            } else {\n                active = false;\n            }\n\n            return {\n                active,\n                // todo: permissions property should be removed.\n                permissions: Object.values(\n                    permissions.reduce((acc, binding) => {\n                        const key = buildPermissionKey(binding.permission);\n                        if (!acc[key]) {\n                            acc[key] = {\n                                name: binding.permission.name,\n                                client_id: binding.permission.client_id,\n                                realm_id: binding.permission.realm_id,\n                            } as OAuth2TokenPermission;\n                        }\n                        return acc;\n                    }, {} as Record<string, OAuth2TokenPermission>),\n                ),\n                ...payload,\n                ...claims,\n            };\n        } catch (e) {\n            throw toOAuth2Error(e);\n        }\n    }\n\n    // ----------------------------------------------------------\n\n    @DPost('/revoke', [])\n    async revokeToken(\n        @DContext() event: IAppEvent,\n    ): Promise<null> {\n        try {\n            const token = await extractTokenFromRequest(event);\n\n            const payload = await this.tokenVerifier.verify(token);\n\n            await this.tokenRevoker.revoke(payload);\n\n            event.response.status = 202;\n            return null;\n        } catch (e) {\n            throw toOAuth2Error(e);\n        }\n    }\n\n    // ----------------------------------------------------------\n\n    @DPost('', [])\n    async createToken(@DContext() event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const grantType = await guessOauth2GrantTypeByRequest(event);\n        if (!grantType) {\n            throw OAuth2GrantTypeError.unsupported();\n        }\n\n        const grant = this.tokenGrants[grantType];\n        if (!grant) {\n            throw OAuth2GrantTypeError.unsupported();\n        }\n\n        return grant.runWithRequest(event);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAKC,SAAA,aAAA,YAAA,QAAA,KAAA,MAAA;;;;;;;;;;;;;;AAoCD,IAAakB,kBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAA6B;EACrC,KAAKP,qBAAqBO,IAAIP;EAC9B,KAAKC,oBAAoBM,IAAIN;EAC7B,KAAKC,gBAAgBK,IAAIL;EACzB,KAAKC,eAAeI,IAAIJ;EACxB,KAAKC,mBAAmBG,IAAIH;EAC5B,KAAKC,6BAA6BE,IAAIF;EAEtC,KAAKC,cAAc;IACdvB,iBAAiByB,qBAAqB,IAAIf,yBAAyB;IAChEgB,cAAcF,IAAIE;IAClBC,qBAAqBH,IAAII;IACzBV,mBAAmBM,IAAIN;IACvBD,oBAAoBO,IAAIP;IACxBY,gBAAgBL,IAAIK;GACxB,CAAA;IACC7B,iBAAiB8B,qBAAqB,IAAIrB,2BAA2B;IAClES,mBAAmBM,IAAIN;IACvBa,eAAeP,IAAIG;IACnBE,gBAAgBL,IAAIK;GACxB,CAAA;IACC7B,iBAAiBgC,oBAAoB,IAAInB,0BAA0B;IAChEK,mBAAmBM,IAAIN;IACvBa,eAAeP,IAAIS;IACnBJ,gBAAgBL,IAAIK;GACxB,CAAA;IACC7B,iBAAiBkC,WAAW,IAAItB,kBAAkB;IAC/CM,mBAAmBM,IAAIN;IACvBD,oBAAoBO,IAAIP;IACxBc,eAAeP,IAAIW;IACnBR,qBAAqBH,IAAII;IACzBC,gBAAgBL,IAAIK;IACpBO,iBAAiBZ,IAAIY;GACzB,CAAA;IACCpC,iBAAiBqC,gBAAgB,IAAI1B,4BAA4B;IAC9DO,mBAAmBM,IAAIN;IACvBD,oBAAoBO,IAAIP;IACxBE,eAAeK,IAAIL;IACnBC,cAAcI,IAAIJ;IAClBS,gBAAgBL,IAAIK;IACpBF,qBAAqBH,IAAII;GAC7B,CAAA;EACJ;CACJ;CAIA,MACMU,cAAc,OAAyE;EACzF,OAAO,KAAKE,eAAeD,KAAAA;CAC/B;CAEA,MACMC,eACF,OACyC;EACzC,IAAI;GACA,MAAMC,QAAQ,MAAM1B,wBAAwBwB,KAAAA;GAC5C,MAAMG,UAAU,MAAM,KAAKvB,cAAcwB,OAAOF,OAAO,EAAEG,iBAAiB,KAAK,CAAA;GAC/E,IAAI,CAACF,QAAQG,OAAO,CAACH,QAAQI,UACzB,MAAM/C,mBAAmBgD,gBAAe;GAI5C,MAAMC,cAAc,MAAM,KAAK1B,2BAA2B2B,OAAO;IAC7DC,IAAIR,QAAQG;IACZM,MAAMT,QAAQI;IACdM,UAAUV,QAAQW;IAClBC,SAASZ,QAAQa;GACrB,CAAA;GAEA,MAAMC,WAAW,MAAM,KAAKnC,iBAAiBoC,QAAQf,QAAQI,UAAUJ,QAAQG,GAAG;GAClF,IAAI,CAACW,UAED,MAAMzD,mBAAmBgD,gBAAe;GAI5C,MAAMY,SAASD,IADWlD,0BACXkD,CAAAA,CAAcE,aAAaJ,QAAAA;GAE1C,IAAIK;GACJ,IAAInB,QAAQoB,KAERD,SAAS,CAACE,MADe,KAAK5C,cAAc4C,WAAWrB,QAAQoB,GAAG;QAGlED,SAAS;GAGb,OAAO;IACHA;IAEAb,aAAagB,OAAOC,OAChBjB,YAAYkB,QAAQC,KAAKC,YAAAA;KACrB,MAAMC,MAAM/D,mBAAmB8D,QAAQE,UAAU;KACjD,IAAI,CAACH,IAAIE,MACLF,IAAIE,OAAO;MACPE,MAAMH,QAAQE,WAAWC;MACzBlB,WAAWe,QAAQE,WAAWjB;MAC9BE,UAAUa,QAAQE,WAAWf;KACjC;KAEJ,OAAOY;IACX,GAAG,CAAC,CAAA,CAAA;IAER,GAAGzB;IACH,GAAGiB;GACP;EACJ,SAASa,GAAG;GACR,MAAMjE,cAAciE,CAAAA;EACxB;CACJ;CAIA,MACMC,YACF,OACa;EACb,IAAI;GACA,MAAMhC,QAAQ,MAAM1B,wBAAwBwB,KAAAA;GAE5C,MAAMG,UAAU,MAAM,KAAKvB,cAAcwB,OAAOF,KAAAA;GAEhD,MAAM,KAAKrB,aAAasD,OAAOhC,OAAAA;GAE/BH,MAAMoC,SAASC,SAAS;GACxB,OAAO;EACX,SAASJ,GAAG;GACR,MAAMjE,cAAciE,CAAAA;EACxB;CACJ;CAIA,MACMK,YAAY,OAAiE;EAC/E,MAAMC,YAAY,MAAMhE,8BAA8ByB,KAAAA;EACtD,IAAI,CAACuC,WACD,MAAMhF,qBAAqBiF,YAAW;EAG1C,MAAMC,QAAQ,KAAKzD,YAAYuD;EAC/B,IAAI,CAACE,OACD,MAAMlF,qBAAqBiF,YAAW;EAG1C,OAAOC,MAAMC,eAAe1C,KAAAA;CAChC;AACJ"}
+{"version":3,"file":"module.mjs","names":["OAuth2GrantTypeError","OAuth2RequestError","OAuth2TokenGrant","DContext","DController","DGet","DPost","DTags","buildPermissionKey","toOAuth2Error","OAuth2OpenIDClaimsBuilder","HTTPClientCredentialsGrant","HTTPOAuth2AuthorizeGrant","HTTPOAuth2RefreshTokenGrant","HTTPPasswordGrant","HTTPRobotCredentialsGrant","guessOauth2GrantTypeByRequest","extractTokenFromRequest","TokenController","refreshTokenIssuer","accessTokenIssuer","tokenVerifier","tokenRevoker","identityResolver","identityPermissionProvider","tokenGrants","ctx","AUTHORIZATION_CODE","codeVerifier","clientAuthenticator","oauth2ClientAuthenticator","openIdTokenIssuer","keyRepository","sessionManager","realmRepository","CLIENT_CREDENTIALS","authenticator","ROBOT_CREDENTIALS","robotAuthenticator","PASSWORD","userAuthenticator","REFRESH_TOKEN","tokenRepository","sessionTokenRepository","logger","options","gracePeriod","tokenRefreshGracePeriod","getIntrospect","event","postIntrospect","token","payload","verify","skipActiveCheck","sub","sub_kind","identityInvalid","permissions","getFor","id","type","clientId","client_id","realmId","realm_id","identity","resolve","claimsBuilder","claims","fromIdentity","active","jti","isInactive","Object","values","reduce","acc","binding","key","permission","name","e","revokeToken","revoke","response","status","createToken","grantType","unsupported","grant","runWithRequest"],"sources":["../../../../../../src/adapters/http/controllers/workflows/token/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenIntrospectionResponse, OAuth2TokenPermission } from '@authup/specs';\nimport { OAuth2GrantTypeError, OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPost,\n    DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport { buildPermissionKey } from '@authup/access';\nimport { toOAuth2Error } from '../../../../../core/oauth2/helpers/index.ts';\nimport type { TokenControllerContext } from './types.ts';\nimport type {\n    IIdentityPermissionProvider,\n    IIdentityResolver,\n    IOAuth2TokenIssuer,\n    IOAuth2TokenRevoker,\n    IOAuth2TokenVerifier,\n} from '../../../../../core/index.ts';\nimport { OAuth2OpenIDClaimsBuilder } from '../../../../../core/index.ts';\nimport type { IHTTPOAuth2Grant } from '../../../adapters/index.ts';\nimport {\n    HTTPClientCredentialsGrant,\n    HTTPOAuth2AuthorizeGrant,\n    HTTPOAuth2RefreshTokenGrant,\n    HTTPPasswordGrant,\n    HTTPRobotCredentialsGrant,\n    guessOauth2GrantTypeByRequest,\n} from '../../../adapters/index.ts';\nimport { extractTokenFromRequest } from './utils/index.ts';\n\n@DTags('auth')\n@DController('/token')\nexport class TokenController {\n    protected refreshTokenIssuer: IOAuth2TokenIssuer;\n\n    protected accessTokenIssuer: IOAuth2TokenIssuer;\n\n    protected tokenVerifier: IOAuth2TokenVerifier;\n\n    protected tokenRevoker: IOAuth2TokenRevoker;\n\n    protected identityResolver : IIdentityResolver;\n\n    protected identityPermissionProvider : IIdentityPermissionProvider;\n\n    protected tokenGrants : Record<`${OAuth2TokenGrant}`, IHTTPOAuth2Grant>;\n\n    // -------------------------------------------\n\n    constructor(ctx: TokenControllerContext) {\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n        this.accessTokenIssuer = ctx.accessTokenIssuer;\n        this.tokenVerifier = ctx.tokenVerifier;\n        this.tokenRevoker = ctx.tokenRevoker;\n        this.identityResolver = ctx.identityResolver;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n\n        this.tokenGrants = {\n            [OAuth2TokenGrant.AUTHORIZATION_CODE]: new HTTPOAuth2AuthorizeGrant({\n                codeVerifier: ctx.codeVerifier,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                openIdTokenIssuer: ctx.openIdTokenIssuer,\n                keyRepository: ctx.keyRepository,\n                sessionManager: ctx.sessionManager,\n                realmRepository: ctx.realmRepository,\n            }),\n            [OAuth2TokenGrant.CLIENT_CREDENTIALS]: new HTTPClientCredentialsGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                authenticator: ctx.clientAuthenticator,\n                sessionManager: ctx.sessionManager,\n            }),\n            [OAuth2TokenGrant.ROBOT_CREDENTIALS]: new HTTPRobotCredentialsGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                authenticator: ctx.robotAuthenticator,\n                sessionManager: ctx.sessionManager,\n            }),\n            [OAuth2TokenGrant.PASSWORD]: new HTTPPasswordGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                authenticator: ctx.userAuthenticator,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                sessionManager: ctx.sessionManager,\n                realmRepository: ctx.realmRepository,\n            }),\n            [OAuth2TokenGrant.REFRESH_TOKEN]: new HTTPOAuth2RefreshTokenGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                tokenVerifier: ctx.tokenVerifier,\n                tokenRepository: ctx.tokenRepository,\n                sessionTokenRepository: ctx.sessionTokenRepository,\n                sessionManager: ctx.sessionManager,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                realmRepository: ctx.realmRepository,\n                logger: ctx.logger,\n                options: { gracePeriod: ctx.tokenRefreshGracePeriod },\n            }),\n        };\n    }\n\n    // -------------------------------------------\n\n    @DGet('/introspect', [])\n    async getIntrospect(@DContext() event: IAppEvent): Promise<OAuth2TokenIntrospectionResponse> {\n        return this.postIntrospect(event);\n    }\n\n    @DPost('/introspect', [])\n    async postIntrospect(\n        @DContext() event: IAppEvent,\n    ): Promise<OAuth2TokenIntrospectionResponse> {\n        try {\n            const token = await extractTokenFromRequest(event);\n            const payload = await this.tokenVerifier.verify(token, { skipActiveCheck: true });\n            if (!payload.sub || !payload.sub_kind) {\n                throw OAuth2RequestError.identityInvalid();\n            }\n\n            // todo: only receive client specific permissions\n            const permissions = await this.identityPermissionProvider.getFor({\n                id: payload.sub,\n                type: payload.sub_kind,\n                clientId: payload.client_id,\n                realmId: payload.realm_id,\n            });\n\n            const identity = await this.identityResolver.resolve(payload.sub_kind, payload.sub);\n            if (!identity) {\n                // todo: differentiate between client, robot & user\n                throw OAuth2RequestError.identityInvalid();\n            }\n\n            const claimsBuilder = new OAuth2OpenIDClaimsBuilder();\n            const claims = claimsBuilder.fromIdentity(identity);\n\n            let active : boolean;\n            if (payload.jti) {\n                const isInactive = await this.tokenVerifier.isInactive(payload.jti);\n                active = !isInactive;\n            } else {\n                active = false;\n            }\n\n            return {\n                active,\n                // todo: permissions property should be removed.\n                permissions: Object.values(\n                    permissions.reduce((acc, binding) => {\n                        const key = buildPermissionKey(binding.permission);\n                        if (!acc[key]) {\n                            acc[key] = {\n                                name: binding.permission.name,\n                                client_id: binding.permission.client_id,\n                                realm_id: binding.permission.realm_id,\n                            } as OAuth2TokenPermission;\n                        }\n                        return acc;\n                    }, {} as Record<string, OAuth2TokenPermission>),\n                ),\n                ...payload,\n                ...claims,\n            };\n        } catch (e) {\n            throw toOAuth2Error(e);\n        }\n    }\n\n    // ----------------------------------------------------------\n\n    @DPost('/revoke', [])\n    async revokeToken(\n        @DContext() event: IAppEvent,\n    ): Promise<null> {\n        try {\n            const token = await extractTokenFromRequest(event);\n\n            const payload = await this.tokenVerifier.verify(token);\n\n            await this.tokenRevoker.revoke(payload);\n\n            event.response.status = 202;\n            return null;\n        } catch (e) {\n            throw toOAuth2Error(e);\n        }\n    }\n\n    // ----------------------------------------------------------\n\n    @DPost('', [])\n    async createToken(@DContext() event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const grantType = await guessOauth2GrantTypeByRequest(event);\n        if (!grantType) {\n            throw OAuth2GrantTypeError.unsupported();\n        }\n\n        const grant = this.tokenGrants[grantType];\n        if (!grant) {\n            throw OAuth2GrantTypeError.unsupported();\n        }\n\n        return grant.runWithRequest(event);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAKC,SAAA,aAAA,YAAA,QAAA,KAAA,MAAA;;;;;;;;;;;;;;AAoCD,IAAakB,kBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAA6B;EACrC,KAAKP,qBAAqBO,IAAIP;EAC9B,KAAKC,oBAAoBM,IAAIN;EAC7B,KAAKC,gBAAgBK,IAAIL;EACzB,KAAKC,eAAeI,IAAIJ;EACxB,KAAKC,mBAAmBG,IAAIH;EAC5B,KAAKC,6BAA6BE,IAAIF;EAEtC,KAAKC,cAAc;IACdvB,iBAAiByB,qBAAqB,IAAIf,yBAAyB;IAChEgB,cAAcF,IAAIE;IAClBC,qBAAqBH,IAAII;IACzBV,mBAAmBM,IAAIN;IACvBD,oBAAoBO,IAAIP;IACxBY,mBAAmBL,IAAIK;IACvBC,eAAeN,IAAIM;IACnBC,gBAAgBP,IAAIO;IACpBC,iBAAiBR,IAAIQ;GACzB,CAAA;IACChC,iBAAiBiC,qBAAqB,IAAIxB,2BAA2B;IAClES,mBAAmBM,IAAIN;IACvBgB,eAAeV,IAAIG;IACnBI,gBAAgBP,IAAIO;GACxB,CAAA;IACC/B,iBAAiBmC,oBAAoB,IAAItB,0BAA0B;IAChEK,mBAAmBM,IAAIN;IACvBgB,eAAeV,IAAIY;IACnBL,gBAAgBP,IAAIO;GACxB,CAAA;IACC/B,iBAAiBqC,WAAW,IAAIzB,kBAAkB;IAC/CM,mBAAmBM,IAAIN;IACvBD,oBAAoBO,IAAIP;IACxBiB,eAAeV,IAAIc;IACnBX,qBAAqBH,IAAII;IACzBG,gBAAgBP,IAAIO;IACpBC,iBAAiBR,IAAIQ;GACzB,CAAA;IACChC,iBAAiBuC,gBAAgB,IAAI5B,4BAA4B;IAC9DO,mBAAmBM,IAAIN;IACvBD,oBAAoBO,IAAIP;IACxBE,eAAeK,IAAIL;IACnBqB,iBAAiBhB,IAAIgB;IACrBC,wBAAwBjB,IAAIiB;IAC5BV,gBAAgBP,IAAIO;IACpBJ,qBAAqBH,IAAII;IACzBI,iBAAiBR,IAAIQ;IACrBU,QAAQlB,IAAIkB;IACZC,SAAS,EAAEC,aAAapB,IAAIqB,wBAAwB;GACxD,CAAA;EACJ;CACJ;CAIA,MACMC,cAAc,OAAyE;EACzF,OAAO,KAAKE,eAAeD,KAAAA;CAC/B;CAEA,MACMC,eACF,OACyC;EACzC,IAAI;GACA,MAAMC,QAAQ,MAAMlC,wBAAwBgC,KAAAA;GAC5C,MAAMG,UAAU,MAAM,KAAK/B,cAAcgC,OAAOF,OAAO,EAAEG,iBAAiB,KAAK,CAAA;GAC/E,IAAI,CAACF,QAAQG,OAAO,CAACH,QAAQI,UACzB,MAAMvD,mBAAmBwD,gBAAe;GAI5C,MAAMC,cAAc,MAAM,KAAKlC,2BAA2BmC,OAAO;IAC7DC,IAAIR,QAAQG;IACZM,MAAMT,QAAQI;IACdM,UAAUV,QAAQW;IAClBC,SAASZ,QAAQa;GACrB,CAAA;GAEA,MAAMC,WAAW,MAAM,KAAK3C,iBAAiB4C,QAAQf,QAAQI,UAAUJ,QAAQG,GAAG;GAClF,IAAI,CAACW,UAED,MAAMjE,mBAAmBwD,gBAAe;GAI5C,MAAMY,SAASD,IADW1D,0BACX0D,CAAAA,CAAcE,aAAaJ,QAAAA;GAE1C,IAAIK;GACJ,IAAInB,QAAQoB,KAERD,SAAS,CAACE,MADe,KAAKpD,cAAcoD,WAAWrB,QAAQoB,GAAG;QAGlED,SAAS;GAGb,OAAO;IACHA;IAEAb,aAAagB,OAAOC,OAChBjB,YAAYkB,QAAQC,KAAKC,YAAAA;KACrB,MAAMC,MAAMvE,mBAAmBsE,QAAQE,UAAU;KACjD,IAAI,CAACH,IAAIE,MACLF,IAAIE,OAAO;MACPE,MAAMH,QAAQE,WAAWC;MACzBlB,WAAWe,QAAQE,WAAWjB;MAC9BE,UAAUa,QAAQE,WAAWf;KACjC;KAEJ,OAAOY;IACX,GAAG,CAAC,CAAA,CAAA;IAER,GAAGzB;IACH,GAAGiB;GACP;EACJ,SAASa,GAAG;GACR,MAAMzE,cAAcyE,CAAAA;EACxB;CACJ;CAIA,MACMC,YACF,OACa;EACb,IAAI;GACA,MAAMhC,QAAQ,MAAMlC,wBAAwBgC,KAAAA;GAE5C,MAAMG,UAAU,MAAM,KAAK/B,cAAcgC,OAAOF,KAAAA;GAEhD,MAAM,KAAK7B,aAAa8D,OAAOhC,OAAAA;GAE/BH,MAAMoC,SAASC,SAAS;GACxB,OAAO;EACX,SAASJ,GAAG;GACR,MAAMzE,cAAcyE,CAAAA;EACxB;CACJ;CAIA,MACMK,YAAY,OAAiE;EAC/E,MAAMC,YAAY,MAAMxE,8BAA8BiC,KAAAA;EACtD,IAAI,CAACuC,WACD,MAAMxF,qBAAqByF,YAAW;EAG1C,MAAMC,QAAQ,KAAKjE,YAAY+D;EAC/B,IAAI,CAACE,OACD,MAAM1F,qBAAqByF,YAAW;EAG1C,OAAOC,MAAMC,eAAe1C,KAAAA;CAChC;AACJ"}

package/dist/adapters/http/controllers/workflows/token/types.d.ts

@@ -1,11 +1,18 @@
 import type { Client, Robot, User } from '@authup/core-kit';
-import type { ICredentialsAuthenticator, IIdentityPermissionProvider, IIdentityResolver, IOAuth2AuthorizationCodeVerifier, IOAuth2TokenIssuer, IOAuth2TokenRevoker, IOAuth2TokenVerifier, IRealmRepository, ISessionManager, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';
+import type { Logger } from '@authup/server-kit';
+import type { ICredentialsAuthenticator, IIdentityPermissionProvider, IIdentityResolver, IOAuth2AuthorizationCodeVerifier, IOAuth2KeyRepository, IOAuth2OpenIDTokenIssuer, IOAuth2TokenIssuer, IOAuth2TokenRepository, IOAuth2TokenRevoker, IOAuth2TokenVerifier, IRealmRepository, ISessionManager, ISessionTokenRepository, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';
 export type TokenControllerContext = {
     codeVerifier: IOAuth2AuthorizationCodeVerifier;
     accessTokenIssuer: IOAuth2TokenIssuer;
     refreshTokenIssuer: IOAuth2TokenIssuer;
+    openIdTokenIssuer: IOAuth2OpenIDTokenIssuer;
+    keyRepository: IOAuth2KeyRepository;
     tokenVerifier: IOAuth2TokenVerifier;
     tokenRevoker: IOAuth2TokenRevoker;
+    tokenRepository: IOAuth2TokenRepository;
+    sessionTokenRepository: ISessionTokenRepository;
+    tokenRefreshGracePeriod?: number;
+    logger?: Logger;
     sessionManager: ISessionManager;
     identityResolver: IIdentityResolver;
     identityPermissionProvider: IIdentityPermissionProvider;

package/dist/adapters/http/controllers/workflows/token/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/token/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,EACR,yBAAyB,EACzB,2BAA2B,EAC3B,iBAAiB,EACjB,gCAAgC,EAChC,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,yBAAyB,EAC5B,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,sBAAsB,GAAG;IACjC,YAAY,EAAE,gCAAgC,CAAC;IAE/C,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,aAAa,EAAE,oBAAoB,CAAC;IACpC,YAAY,EAAE,mBAAmB,CAAC;IAElC,cAAc,EAAE,eAAe,CAAC;IAEhC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,0BAA0B,EAAE,2BAA2B,CAAC;IAExD,mBAAmB,EAAE,yBAAyB,CAAC,MAAM,CAAC,CAAA;IACtD,kBAAkB,EAAE,yBAAyB,CAAC,KAAK,CAAC,CAAA;IACpD,iBAAiB,EAAE,yBAAyB,CAAC,IAAI,CAAC,CAAA;IAElD,yBAAyB,EAAE,yBAAyB,CAAA;IAEpD,eAAe,EAAE,gBAAgB,CAAA;CACpC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/token/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EACR,yBAAyB,EACzB,2BAA2B,EAC3B,iBAAiB,EACjB,gCAAgC,EAChC,oBAAoB,EACpB,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,uBAAuB,EACvB,yBAAyB,EAC5B,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,sBAAsB,GAAG;IACjC,YAAY,EAAE,gCAAgC,CAAC;IAE/C,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,iBAAiB,EAAE,wBAAwB,CAAC;IAC5C,aAAa,EAAE,oBAAoB,CAAC;IACpC,aAAa,EAAE,oBAAoB,CAAC;IACpC,YAAY,EAAE,mBAAmB,CAAC;IAClC,eAAe,EAAE,sBAAsB,CAAC;IACxC,sBAAsB,EAAE,uBAAuB,CAAC;IAEhD,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,cAAc,EAAE,eAAe,CAAC;IAEhC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,0BAA0B,EAAE,2BAA2B,CAAC;IAExD,mBAAmB,EAAE,yBAAyB,CAAC,MAAM,CAAC,CAAA;IACtD,kBAAkB,EAAE,yBAAyB,CAAC,KAAK,CAAC,CAAA;IACpD,iBAAiB,EAAE,yBAAyB,CAAC,IAAI,CAAC,CAAA;IAElD,yBAAyB,EAAE,yBAAyB,CAAA;IAEpD,eAAe,EAAE,gBAAgB,CAAA;CACpC,CAAC"}

package/dist/adapters/http/index.mjs

@@ -12,19 +12,10 @@ import { getRequestParamID, getRequestStringParam, getRequestStringParamOrFail,
 import { applyRouteRealmIDToBody, getRequestRealmID, setRequestRealmID } from "./request/helpers/realm-id.mjs";
 import { sanitizeRelativeRedirect } from "./request/helpers/redirect.mjs";
 import { setRequestScopes, useRequestScopes } from "./request/helpers/scopes.mjs";
+import { setRequestSessionId, useRequestSessionId } from "./request/helpers/session-id.mjs";
 import { setRequestToken, useRequestToken } from "./request/helpers/token.mjs";
 import { RequestPermissionEvaluator } from "./request/permission/module.mjs";
 import "./request/index.mjs";
-import { HTTPOAuth2Authorizer } from "./adapters/oauth2/authorization/module.mjs";
-import { extractClientCredentialsFromRequest, readStringField } from "./adapters/oauth2/grant-types/utils/credentials.mjs";
-import { guessOauth2GrantTypeByRequest } from "./adapters/oauth2/grant-types/utils/guess.mjs";
-import { HTTPOAuth2AuthorizeGrant } from "./adapters/oauth2/grant-types/authorize.mjs";
-import { HTTPClientCredentialsGrant } from "./adapters/oauth2/grant-types/client-credentials.mjs";
-import { HTTPOAuth2IdentityGrantType } from "./adapters/oauth2/grant-types/identity.mjs";
-import { HTTPPasswordGrant } from "./adapters/oauth2/grant-types/password.mjs";
-import { HTTPOAuth2RefreshTokenGrant } from "./adapters/oauth2/grant-types/refresh_token.mjs";
-import { HTTPRobotCredentialsGrant } from "./adapters/oauth2/grant-types/robot-credentials.mjs";
-import "./adapters/index.mjs";
 import { AuthorizationMiddleware } from "./middleware/built-in/authorization/module.mjs";
 import { createAuthorizationMiddleware } from "./middleware/built-in/authorization/factory.mjs";
 import { ForceLoggedInMiddleware } from "./middleware/built-in/loggedin/module.mjs";
@@ -35,12 +26,23 @@ import { VITE_SERVER_STORE_KEY, registerAssetsMiddleware } from "./middleware/bu
 import { registerBasicMiddleware } from "./middleware/built-in/basic.mjs";
 import { registerCorsMiddleware } from "./middleware/built-in/cors.mjs";
 import { registerErrorMiddleware } from "./middleware/built-in/error.mjs";
-import { createLoggerMiddleware } from "./middleware/built-in/logger.mjs";
+import { createLoggerMiddleware, redactSensitiveURLParams } from "./middleware/built-in/logger.mjs";
 import { registerPrometheusMiddleware } from "./middleware/built-in/prometheus.mjs";
 import { registerRateLimitMiddleware } from "./middleware/built-in/rate-limit.mjs";
 import { createSwaggerMiddleware } from "./middleware/built-in/swagger.mjs";
 import { UI_HTTP_CLIENT_FACTORY_STORE_KEY, registerUIHttpClientMiddleware } from "./middleware/built-in/ui-http-client.mjs";
 import "./middleware/index.mjs";
+import { HTTPOAuth2Authorizer } from "./adapters/oauth2/authorization/module.mjs";
+import { extractClientCredentialsFromRequest, readStringField } from "./adapters/oauth2/grant-types/utils/credentials.mjs";
+import { guessOauth2GrantTypeByRequest } from "./adapters/oauth2/grant-types/utils/guess.mjs";
+import { readRealmHint } from "./adapters/oauth2/grant-types/utils/realm.mjs";
+import { HTTPOAuth2AuthorizeGrant } from "./adapters/oauth2/grant-types/authorize.mjs";
+import { HTTPClientCredentialsGrant } from "./adapters/oauth2/grant-types/client-credentials.mjs";
+import { HTTPOAuth2IdentityGrantType } from "./adapters/oauth2/grant-types/identity.mjs";
+import { HTTPPasswordGrant } from "./adapters/oauth2/grant-types/password.mjs";
+import { HTTPOAuth2RefreshTokenGrant } from "./adapters/oauth2/grant-types/refresh_token.mjs";
+import { HTTPRobotCredentialsGrant } from "./adapters/oauth2/grant-types/robot-credentials.mjs";
+import "./adapters/index.mjs";
 import { ClientController } from "./controllers/entities/client/module.mjs";
 import { ClientPermissionController } from "./controllers/entities/client-permission/module.mjs";
 import { ClientPermissionRequestValidator } from "./controllers/entities/client-permission/utils/validation.mjs";
@@ -56,6 +58,7 @@ import { ActivateController } from "./controllers/workflows/activate/module.mjs"
 import { AuthorizeController } from "./controllers/workflows/authorize/module.mjs";
 import { getJwkRouteHandler, getJwksRouteHandler } from "./controllers/workflows/jwks/handlers/read.mjs";
 import { JwkController } from "./controllers/workflows/jwks/module.mjs";
+import { LogoutController } from "./controllers/workflows/logout/module.mjs";
 import { OpenIDController } from "./controllers/workflows/openid/module.mjs";
 import { PasswordForgotController } from "./controllers/workflows/password-forgot/module.mjs";
 import { PasswordResetController } from "./controllers/workflows/password-reset/module.mjs";
@@ -77,6 +80,7 @@ import { PolicyController } from "./controllers/entities/policy/module.mjs";
 import { PolicyAttributesValidator } from "./controllers/entities/policy/utils/attributes-validator.mjs";
 import { PolicyValidator } from "./controllers/entities/policy/utils/validation.mjs";
 import { ScopeController } from "./controllers/entities/scope/module.mjs";
+import { SessionController } from "./controllers/entities/session/module.mjs";
 import { UserController } from "./controllers/entities/user/module.mjs";
 import { UserAttributeController } from "./controllers/entities/user-attribute/module.mjs";
 import { UserAttributeRequestValidator } from "./controllers/entities/user-attribute/utils/validation.mjs";
@@ -85,4 +89,4 @@ import { UserPermissionRequestValidator } from "./controllers/entities/user-perm
 import { UserRoleController } from "./controllers/entities/user-role/module.mjs";
 import { UserRoleRequestValidator } from "./controllers/entities/user-role/utils/validation.mjs";
 import "./controllers/index.mjs";
-export { ActivateController, AuthorizationMiddleware, AuthorizeController, ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, IdentityProviderController, IdentityProviderRoleMappingController, JwkController, LOCALE_COOKIE, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RealmResolverMiddleware, RegisterController, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, RobotController, RobotPermissionController, RobotPermissionRequestValidator, RobotRoleController, RobotRoleRequestValidator, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, StatusController, TokenController, UI_HTTP_CLIENT_FACTORY_STORE_KEY, UserAttributeController, UserAttributeRequestValidator, UserController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator, VITE_SERVER_STORE_KEY, applyRouteRealmIDToBody, buildActorContext, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createSwaggerMiddleware, extractClientCredentialsFromRequest, getBodyRealmID, getJwkRouteHandler, getJwksRouteHandler, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, guessOauth2GrantTypeByRequest, readFromLocations, readStringField, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerUIHttpClientMiddleware, sanitizeRelativeRedirect, setRequestIdentity, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestToken, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestToken };
+export { ActivateController, AuthorizationMiddleware, AuthorizeController, ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, IdentityProviderController, IdentityProviderRoleMappingController, JwkController, LOCALE_COOKIE, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RealmResolverMiddleware, RegisterController, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, RobotController, RobotPermissionController, RobotPermissionRequestValidator, RobotRoleController, RobotRoleRequestValidator, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, StatusController, TokenController, UI_HTTP_CLIENT_FACTORY_STORE_KEY, UserAttributeController, UserAttributeRequestValidator, UserController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator, VITE_SERVER_STORE_KEY, applyRouteRealmIDToBody, buildActorContext, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createSwaggerMiddleware, extractClientCredentialsFromRequest, getBodyRealmID, getJwkRouteHandler, getJwksRouteHandler, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, guessOauth2GrantTypeByRequest, readFromLocations, readRealmHint, readStringField, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerUIHttpClientMiddleware, sanitizeRelativeRedirect, setRequestIdentity, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestSessionId, useRequestToken };

package/dist/adapters/http/middleware/built-in/authorization/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/middleware/built-in/authorization/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAE3D,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAO5D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAEH,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAEjC,MAAM,OAAO,CAAC;AAOf,OAAO,KAAK,EACR,yBAAyB,EACzB,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EAClB,MAAM,8BAA8B,CAAC;AAQtC,OAAO,KAAK,EAAE,kCAAkC,EAAE,kCAAkC,EAAE,MAAM,YAAY,CAAC;AAEzG,qBAAa,uBAAuB;IAChC,SAAS,CAAC,OAAO,EAAE,kCAAkC,CAAC;IAItD,SAAS,CAAC,mBAAmB,EAAE,oBAAoB,CAAC;IAEpD,SAAS,CAAC,mBAAmB,EAAE,oBAAoB,CAAC;IAIpD,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,cAAc,EAAG,eAAe,CAAC;IAI3C,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAElE,SAAS,CAAC,kBAAkB,EAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;IAEhE,SAAS,CAAC,iBAAiB,EAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;gBAIlD,GAAG,EAAE,kCAAkC;IAsB7C,GAAG,CAAC,KAAK,EAAE,SAAS;IA2B1B;;OAEG;cACa,+BAA+B,CAC3C,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,yBAAyB;cAwDrB,8BAA8B,CAC1C,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,wBAAwB;CA+CvC"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/middleware/built-in/authorization/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAE3D,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAO5D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAEH,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAEjC,MAAM,OAAO,CAAC;AAOf,OAAO,KAAK,EACR,yBAAyB,EACzB,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EAClB,MAAM,8BAA8B,CAAC;AAStC,OAAO,KAAK,EAAE,kCAAkC,EAAE,kCAAkC,EAAE,MAAM,YAAY,CAAC;AAEzG,qBAAa,uBAAuB;IAChC,SAAS,CAAC,OAAO,EAAE,kCAAkC,CAAC;IAItD,SAAS,CAAC,mBAAmB,EAAE,oBAAoB,CAAC;IAEpD,SAAS,CAAC,mBAAmB,EAAE,oBAAoB,CAAC;IAIpD,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,cAAc,EAAG,eAAe,CAAC;IAI3C,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAElE,SAAS,CAAC,kBAAkB,EAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;IAEhE,SAAS,CAAC,iBAAiB,EAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;gBAIlD,GAAG,EAAE,kCAAkC;IAsB7C,GAAG,CAAC,KAAK,EAAE,SAAS;IA2B1B;;OAEG;cACa,+BAA+B,CAC3C,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,yBAAyB;cA0DrB,8BAA8B,CAC1C,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,wBAAwB;CA+CvC"}

package/dist/adapters/http/middleware/built-in/authorization/module.mjs

@@ -9,6 +9,7 @@ import "../../../../../core/index.mjs";
 import { setRequestPermissionEvaluator } from "../../../request/permission/helper.mjs";
 import { setRequestIdentity } from "../../../request/helpers/identity.mjs";
 import { setRequestScopes } from "../../../request/helpers/scopes.mjs";
+import { setRequestSessionId } from "../../../request/helpers/session-id.mjs";
 import { setRequestToken } from "../../../request/helpers/token.mjs";
 import { RequestPermissionEvaluator } from "../../../request/permission/module.mjs";
 import "../../../request/index.mjs";
@@ -74,6 +75,7 @@ var AuthorizationMiddleware = class {
 			throw JWTError.expired();
 		}
 		await this.sessionManager.ping(session);
+		setRequestSessionId(event, payload.session_id);
 		if (!payload.sub_kind) throw JWTError.payloadPropertyInvalid("sub_kind");
 		if (!payload.sub) throw JWTError.payloadPropertyInvalid("sub");
 		const identity = await this.identityResolver.resolve(payload.sub_kind, payload.sub);

package/dist/adapters/http/middleware/built-in/authorization/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["PermissionEvaluator","IdentityType","ScopeName","AuthHeaderError","JWTError","OAuth2TokenKind","deserializeOAuth2Scope","AuthorizationHeaderType","parseAuthorizationHeader","ClientAuthenticator","PolicyEngine","RobotAuthenticator","UserAuthenticator","RequestPermissionEvaluator","setRequestIdentity","setRequestPermissionEvaluator","setRequestScopes","setRequestToken","AuthorizationMiddleware","options","oauth2TokenVerifier","permissionEvaluator","identityResolver","sessionManager","clientAuthenticator","robotAuthenticator","userAuthenticator","ctx","provider","permissionProvider","policyEngine","identityPermissionProvider","realmId","clientId","run","event","requestAccessContext","headerValue","headers","get","header","type","BEARER","verifyBearerAuthorizationHeader","BASIC","verifyBasicAuthorizationHeader","unsupportedType","payload","verify","token","kind","ACCESS","payloadPropertyInvalid","realm_id","scope","session_id","session","findOneById","expired","ping","sub_kind","sub","identity","resolve","clientAuthBasic","authenticator","safeAuthenticate","username","password","success","GLOBAL","CLIENT","data","userAuthBasic","authenticated","USER","robotAuthBasic","ROBOT"],"sources":["../../../../../../src/adapters/http/middleware/built-in/authorization/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IPermissionEvaluator } from '@authup/access';\nimport { PermissionEvaluator } from '@authup/access';\nimport type { Client, Robot, User } from '@authup/core-kit';\nimport {\n    IdentityType,\n    ScopeName,\n} from '@authup/core-kit';\nimport { AuthHeaderError } from '@authup/errors';\nimport { JWTError, OAuth2TokenKind, deserializeOAuth2Scope } from '@authup/specs';\nimport type { IAppEvent } from 'routup';\nimport {\n    AuthorizationHeaderType,\n    type BasicAuthorizationHeader,\n    type BearerAuthorizationHeader,\n    parseAuthorizationHeader,\n} from 'hapic';\nimport {\n    ClientAuthenticator,\n    PolicyEngine,\n    RobotAuthenticator,\n    UserAuthenticator, \n} from '../../../../../core/index.ts';\nimport type {\n    ICredentialsAuthenticator, \n    IIdentityResolver,\n    IOAuth2TokenVerifier, \n    ISessionManager,\n} from '../../../../../core/index.ts';\nimport {\n    RequestPermissionEvaluator,\n    setRequestIdentity,\n    setRequestPermissionEvaluator,\n    setRequestScopes,\n    setRequestToken,\n} from '../../../request/index.ts';\nimport type { HTTPAuthorizationMiddlewareContext, HTTPAuthorizationMiddlewareOptions } from './types.ts';\n\nexport class AuthorizationMiddleware {\n    protected options: HTTPAuthorizationMiddlewareOptions;\n\n    // --------------------------------------\n\n    protected oauth2TokenVerifier: IOAuth2TokenVerifier;\n\n    protected permissionEvaluator: IPermissionEvaluator;\n\n    // --------------------------------------\n\n    protected identityResolver: IIdentityResolver;\n\n    protected sessionManager : ISessionManager;\n\n    // --------------------------------------\n\n    protected clientAuthenticator : ICredentialsAuthenticator<Client>;\n\n    protected robotAuthenticator : ICredentialsAuthenticator<Robot>;\n\n    protected userAuthenticator : ICredentialsAuthenticator<User>;\n\n    // --------------------------------------\n\n    constructor(ctx: HTTPAuthorizationMiddlewareContext) {\n        this.options = ctx.options || {};\n\n        this.identityResolver = ctx.identityResolver;\n        this.sessionManager = ctx.sessionManager;\n\n        this.clientAuthenticator = new ClientAuthenticator(ctx.identityResolver);\n        this.robotAuthenticator = new RobotAuthenticator(ctx.identityResolver);\n        this.userAuthenticator = new UserAuthenticator(ctx.identityResolver);\n\n        this.oauth2TokenVerifier = ctx.oauth2TokenVerifier;\n\n        this.permissionEvaluator = new PermissionEvaluator({\n            provider: ctx.permissionProvider,\n            policyEngine: new PolicyEngine(ctx.identityPermissionProvider),\n            realmId: null,\n            clientId: null,\n        });\n    }\n\n    // --------------------------------------\n\n    async run(event: IAppEvent) {\n        const requestAccessContext = new RequestPermissionEvaluator(\n            event,\n            this.permissionEvaluator,\n        );\n        setRequestPermissionEvaluator(event, requestAccessContext);\n\n        const headerValue = event.headers.get('authorization');\n        if (!headerValue) {\n            return;\n        }\n\n        const header = parseAuthorizationHeader(headerValue);\n\n        if (header.type === AuthorizationHeaderType.BEARER) {\n            await this.verifyBearerAuthorizationHeader(event, header);\n            return;\n        }\n\n        if (header.type === AuthorizationHeaderType.BASIC) {\n            await this.verifyBasicAuthorizationHeader(event, header);\n            return;\n        }\n\n        throw AuthHeaderError.unsupportedType(header.type);\n    }\n\n    /**\n     * @throws JWTError\n     */\n    protected async verifyBearerAuthorizationHeader(\n        event: IAppEvent,\n        header: BearerAuthorizationHeader,\n    ) {\n        const payload = await this.oauth2TokenVerifier.verify(header.token);\n        if (payload.kind !== OAuth2TokenKind.ACCESS) {\n            throw JWTError.payloadPropertyInvalid('kind');\n        }\n\n        if (!payload.realm_id) {\n            throw JWTError.payloadPropertyInvalid('realm_id');\n        }\n\n        setRequestToken(event, header.token);\n\n        if (payload.scope) {\n            setRequestScopes(event, deserializeOAuth2Scope(payload.scope));\n        }\n\n        // -------------------------------------------------------\n\n        if (!payload.session_id) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        const session = await this.sessionManager.findOneById(payload.session_id);\n        if (!session) {\n            throw JWTError.expired();\n        }\n\n        try {\n            await this.sessionManager.verify(session);\n        } catch {\n            throw JWTError.expired();\n        }\n\n        await this.sessionManager.ping(session);\n\n        // -------------------------------------------------------\n\n        if (!payload.sub_kind) {\n            throw JWTError.payloadPropertyInvalid('sub_kind');\n        }\n\n        if (!payload.sub) {\n            throw JWTError.payloadPropertyInvalid('sub');\n        }\n\n        const identity = await this.identityResolver.resolve(\n            payload.sub_kind,\n            payload.sub,\n        );\n\n        if (identity) {\n            setRequestIdentity(event, identity);\n        }\n    }\n\n    protected async verifyBasicAuthorizationHeader(\n        event: IAppEvent,\n        header: BasicAuthorizationHeader,\n    ) {\n        if (this.options.clientAuthBasic) {\n            const authenticator = await this.clientAuthenticator.safeAuthenticate(\n                header.username,\n                header.password,\n            );\n            if (authenticator.success) {\n                setRequestScopes(event, [ScopeName.GLOBAL]);\n                setRequestIdentity(event, {\n                    type: IdentityType.CLIENT,\n                    data: authenticator.data,\n                });\n            }\n        }\n\n        if (this.options.userAuthBasic) {\n            const authenticated = await this.userAuthenticator.safeAuthenticate(\n                header.username,\n                header.password,\n            );\n\n            if (authenticated.success) {\n                setRequestScopes(event, [ScopeName.GLOBAL]);\n                setRequestIdentity(event, {\n                    type: IdentityType.USER,\n                    data: authenticated.data,\n                });\n\n                return;\n            }\n        }\n\n        if (this.options.robotAuthBasic) {\n            const authenticated = await this.robotAuthenticator.safeAuthenticate(\n                header.username,\n                header.password,\n            );\n            if (authenticated.success) {\n                setRequestScopes(event, [ScopeName.GLOBAL]);\n                setRequestIdentity(event, {\n                    type: IdentityType.ROBOT,\n                    data: authenticated.data,\n                });\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA4CA,IAAakB,0BAAb,MAAaA;CACCC;CAIAC;CAEAC;CAIAC;CAEAC;CAIAC;CAEAC;CAEAC;CAIV,YAAYC,KAAyC;EACjD,KAAKR,UAAUQ,IAAIR,WAAW,CAAC;EAE/B,KAAKG,mBAAmBK,IAAIL;EAC5B,KAAKC,iBAAiBI,IAAIJ;EAE1B,KAAKC,sBAAsB,IAAIf,oBAAoBkB,IAAIL,gBAAgB;EACvE,KAAKG,qBAAqB,IAAId,mBAAmBgB,IAAIL,gBAAgB;EACrE,KAAKI,oBAAoB,IAAId,kBAAkBe,IAAIL,gBAAgB;EAEnE,KAAKF,sBAAsBO,IAAIP;EAE/B,KAAKC,sBAAsB,IAAIrB,oBAAoB;GAC/C4B,UAAUD,IAAIE;GACdC,cAAc,IAAIpB,eAAaiB,IAAII,0BAA0B;GAC7DC,SAAS;GACTC,UAAU;EACd,CAAA;CACJ;CAIA,MAAMC,IAAIC,OAAkB;EAKxBpB,8BAA8BoB,OAAOC,IAJJvB,2BAC7BsB,OACA,KAAKd,mBAE4Be,CAAAA;EAErC,MAAMC,cAAcF,MAAMG,QAAQC,IAAI,eAAA;EACtC,IAAI,CAACF,aACD;EAGJ,MAAMG,SAAShC,yBAAyB6B,WAAAA;EAExC,IAAIG,OAAOC,SAASlC,wBAAwBmC,QAAQ;GAChD,MAAM,KAAKC,gCAAgCR,OAAOK,MAAAA;GAClD;EACJ;EAEA,IAAIA,OAAOC,SAASlC,wBAAwBqC,OAAO;GAC/C,MAAM,KAAKC,+BAA+BV,OAAOK,MAAAA;GACjD;EACJ;EAEA,MAAMrC,gBAAgB2C,gBAAgBN,OAAOC,IAAI;CACrD;;;IAKA,MAAgBE,gCACZR,OACAK,QACF;EACE,MAAMO,UAAU,MAAM,KAAK3B,oBAAoB4B,OAAOR,OAAOS,KAAK;EAClE,IAAIF,QAAQG,SAAS7C,gBAAgB8C,QACjC,MAAM/C,SAASgD,uBAAuB,MAAA;EAG1C,IAAI,CAACL,QAAQM,UACT,MAAMjD,SAASgD,uBAAuB,UAAA;EAG1CnC,gBAAgBkB,OAAOK,OAAOS,KAAK;EAEnC,IAAIF,QAAQO,OACRtC,iBAAiBmB,OAAO7B,uBAAuByC,QAAQO,KAAK,CAAA;EAKhE,IAAI,CAACP,QAAQQ,YACT,MAAMnD,SAASgD,uBAAuB,YAAA;EAG1C,MAAMI,UAAU,MAAM,KAAKjC,eAAekC,YAAYV,QAAQQ,UAAU;EACxE,IAAI,CAACC,SACD,MAAMpD,SAASsD,QAAO;EAG1B,IAAI;GACA,MAAM,KAAKnC,eAAeyB,OAAOQ,OAAAA;EACrC,QAAQ;GACJ,MAAMpD,SAASsD,QAAO;EAC1B;EAEA,MAAM,KAAKnC,eAAeoC,KAAKH,OAAAA;EAI/B,IAAI,CAACT,QAAQa,UACT,MAAMxD,SAASgD,uBAAuB,UAAA;EAG1C,IAAI,CAACL,QAAQc,KACT,MAAMzD,SAASgD,uBAAuB,KAAA;EAG1C,MAAMU,WAAW,MAAM,KAAKxC,iBAAiByC,QACzChB,QAAQa,UACRb,QAAQc,GAAG;EAGf,IAAIC,UACAhD,mBAAmBqB,OAAO2B,QAAAA;CAElC;CAEA,MAAgBjB,+BACZV,OACAK,QACF;EACE,IAAI,KAAKrB,QAAQ6C,iBAAiB;GAC9B,MAAMC,gBAAgB,MAAM,KAAKzC,oBAAoB0C,iBACjD1B,OAAO2B,UACP3B,OAAO4B,QAAQ;GAEnB,IAAIH,cAAcI,SAAS;IACvBrD,iBAAiBmB,OAAO,CAACjC,UAAUoE,MAAAA,CAAO;IAC1CxD,mBAAmBqB,OAAO;KACtBM,MAAMxC,aAAasE;KACnBC,MAAMP,cAAcO;IACxB,CAAA;GACJ;EACJ;EAEA,IAAI,KAAKrD,QAAQsD,eAAe;GAC5B,MAAMC,gBAAgB,MAAM,KAAKhD,kBAAkBwC,iBAC/C1B,OAAO2B,UACP3B,OAAO4B,QAAQ;GAGnB,IAAIM,cAAcL,SAAS;IACvBrD,iBAAiBmB,OAAO,CAACjC,UAAUoE,MAAAA,CAAO;IAC1CxD,mBAAmBqB,OAAO;KACtBM,MAAMxC,aAAa0E;KACnBH,MAAME,cAAcF;IACxB,CAAA;IAEA;GACJ;EACJ;EAEA,IAAI,KAAKrD,QAAQyD,gBAAgB;GAC7B,MAAMF,gBAAgB,MAAM,KAAKjD,mBAAmByC,iBAChD1B,OAAO2B,UACP3B,OAAO4B,QAAQ;GAEnB,IAAIM,cAAcL,SAAS;IACvBrD,iBAAiBmB,OAAO,CAACjC,UAAUoE,MAAAA,CAAO;IAC1CxD,mBAAmBqB,OAAO;KACtBM,MAAMxC,aAAa4E;KACnBL,MAAME,cAAcF;IACxB,CAAA;GACJ;EACJ;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["PermissionEvaluator","IdentityType","ScopeName","AuthHeaderError","JWTError","OAuth2TokenKind","deserializeOAuth2Scope","AuthorizationHeaderType","parseAuthorizationHeader","ClientAuthenticator","PolicyEngine","RobotAuthenticator","UserAuthenticator","RequestPermissionEvaluator","setRequestIdentity","setRequestPermissionEvaluator","setRequestScopes","setRequestSessionId","setRequestToken","AuthorizationMiddleware","options","oauth2TokenVerifier","permissionEvaluator","identityResolver","sessionManager","clientAuthenticator","robotAuthenticator","userAuthenticator","ctx","provider","permissionProvider","policyEngine","identityPermissionProvider","realmId","clientId","run","event","requestAccessContext","headerValue","headers","get","header","type","BEARER","verifyBearerAuthorizationHeader","BASIC","verifyBasicAuthorizationHeader","unsupportedType","payload","verify","token","kind","ACCESS","payloadPropertyInvalid","realm_id","scope","session_id","session","findOneById","expired","ping","sub_kind","sub","identity","resolve","clientAuthBasic","authenticator","safeAuthenticate","username","password","success","GLOBAL","CLIENT","data","userAuthBasic","authenticated","USER","robotAuthBasic","ROBOT"],"sources":["../../../../../../src/adapters/http/middleware/built-in/authorization/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IPermissionEvaluator } from '@authup/access';\nimport { PermissionEvaluator } from '@authup/access';\nimport type { Client, Robot, User } from '@authup/core-kit';\nimport {\n    IdentityType,\n    ScopeName,\n} from '@authup/core-kit';\nimport { AuthHeaderError } from '@authup/errors';\nimport { JWTError, OAuth2TokenKind, deserializeOAuth2Scope } from '@authup/specs';\nimport type { IAppEvent } from 'routup';\nimport {\n    AuthorizationHeaderType,\n    type BasicAuthorizationHeader,\n    type BearerAuthorizationHeader,\n    parseAuthorizationHeader,\n} from 'hapic';\nimport {\n    ClientAuthenticator,\n    PolicyEngine,\n    RobotAuthenticator,\n    UserAuthenticator, \n} from '../../../../../core/index.ts';\nimport type {\n    ICredentialsAuthenticator, \n    IIdentityResolver,\n    IOAuth2TokenVerifier, \n    ISessionManager,\n} from '../../../../../core/index.ts';\nimport {\n    RequestPermissionEvaluator,\n    setRequestIdentity,\n    setRequestPermissionEvaluator,\n    setRequestScopes,\n    setRequestSessionId,\n    setRequestToken,\n} from '../../../request/index.ts';\nimport type { HTTPAuthorizationMiddlewareContext, HTTPAuthorizationMiddlewareOptions } from './types.ts';\n\nexport class AuthorizationMiddleware {\n    protected options: HTTPAuthorizationMiddlewareOptions;\n\n    // --------------------------------------\n\n    protected oauth2TokenVerifier: IOAuth2TokenVerifier;\n\n    protected permissionEvaluator: IPermissionEvaluator;\n\n    // --------------------------------------\n\n    protected identityResolver: IIdentityResolver;\n\n    protected sessionManager : ISessionManager;\n\n    // --------------------------------------\n\n    protected clientAuthenticator : ICredentialsAuthenticator<Client>;\n\n    protected robotAuthenticator : ICredentialsAuthenticator<Robot>;\n\n    protected userAuthenticator : ICredentialsAuthenticator<User>;\n\n    // --------------------------------------\n\n    constructor(ctx: HTTPAuthorizationMiddlewareContext) {\n        this.options = ctx.options || {};\n\n        this.identityResolver = ctx.identityResolver;\n        this.sessionManager = ctx.sessionManager;\n\n        this.clientAuthenticator = new ClientAuthenticator(ctx.identityResolver);\n        this.robotAuthenticator = new RobotAuthenticator(ctx.identityResolver);\n        this.userAuthenticator = new UserAuthenticator(ctx.identityResolver);\n\n        this.oauth2TokenVerifier = ctx.oauth2TokenVerifier;\n\n        this.permissionEvaluator = new PermissionEvaluator({\n            provider: ctx.permissionProvider,\n            policyEngine: new PolicyEngine(ctx.identityPermissionProvider),\n            realmId: null,\n            clientId: null,\n        });\n    }\n\n    // --------------------------------------\n\n    async run(event: IAppEvent) {\n        const requestAccessContext = new RequestPermissionEvaluator(\n            event,\n            this.permissionEvaluator,\n        );\n        setRequestPermissionEvaluator(event, requestAccessContext);\n\n        const headerValue = event.headers.get('authorization');\n        if (!headerValue) {\n            return;\n        }\n\n        const header = parseAuthorizationHeader(headerValue);\n\n        if (header.type === AuthorizationHeaderType.BEARER) {\n            await this.verifyBearerAuthorizationHeader(event, header);\n            return;\n        }\n\n        if (header.type === AuthorizationHeaderType.BASIC) {\n            await this.verifyBasicAuthorizationHeader(event, header);\n            return;\n        }\n\n        throw AuthHeaderError.unsupportedType(header.type);\n    }\n\n    /**\n     * @throws JWTError\n     */\n    protected async verifyBearerAuthorizationHeader(\n        event: IAppEvent,\n        header: BearerAuthorizationHeader,\n    ) {\n        const payload = await this.oauth2TokenVerifier.verify(header.token);\n        if (payload.kind !== OAuth2TokenKind.ACCESS) {\n            throw JWTError.payloadPropertyInvalid('kind');\n        }\n\n        if (!payload.realm_id) {\n            throw JWTError.payloadPropertyInvalid('realm_id');\n        }\n\n        setRequestToken(event, header.token);\n\n        if (payload.scope) {\n            setRequestScopes(event, deserializeOAuth2Scope(payload.scope));\n        }\n\n        // -------------------------------------------------------\n\n        if (!payload.session_id) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        const session = await this.sessionManager.findOneById(payload.session_id);\n        if (!session) {\n            throw JWTError.expired();\n        }\n\n        try {\n            await this.sessionManager.verify(session);\n        } catch {\n            throw JWTError.expired();\n        }\n\n        await this.sessionManager.ping(session);\n\n        setRequestSessionId(event, payload.session_id);\n\n        // -------------------------------------------------------\n\n        if (!payload.sub_kind) {\n            throw JWTError.payloadPropertyInvalid('sub_kind');\n        }\n\n        if (!payload.sub) {\n            throw JWTError.payloadPropertyInvalid('sub');\n        }\n\n        const identity = await this.identityResolver.resolve(\n            payload.sub_kind,\n            payload.sub,\n        );\n\n        if (identity) {\n            setRequestIdentity(event, identity);\n        }\n    }\n\n    protected async verifyBasicAuthorizationHeader(\n        event: IAppEvent,\n        header: BasicAuthorizationHeader,\n    ) {\n        if (this.options.clientAuthBasic) {\n            const authenticator = await this.clientAuthenticator.safeAuthenticate(\n                header.username,\n                header.password,\n            );\n            if (authenticator.success) {\n                setRequestScopes(event, [ScopeName.GLOBAL]);\n                setRequestIdentity(event, {\n                    type: IdentityType.CLIENT,\n                    data: authenticator.data,\n                });\n            }\n        }\n\n        if (this.options.userAuthBasic) {\n            const authenticated = await this.userAuthenticator.safeAuthenticate(\n                header.username,\n                header.password,\n            );\n\n            if (authenticated.success) {\n                setRequestScopes(event, [ScopeName.GLOBAL]);\n                setRequestIdentity(event, {\n                    type: IdentityType.USER,\n                    data: authenticated.data,\n                });\n\n                return;\n            }\n        }\n\n        if (this.options.robotAuthBasic) {\n            const authenticated = await this.robotAuthenticator.safeAuthenticate(\n                header.username,\n                header.password,\n            );\n            if (authenticated.success) {\n                setRequestScopes(event, [ScopeName.GLOBAL]);\n                setRequestIdentity(event, {\n                    type: IdentityType.ROBOT,\n                    data: authenticated.data,\n                });\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AA6CA,IAAamB,0BAAb,MAAaA;CACCC;CAIAC;CAEAC;CAIAC;CAEAC;CAIAC;CAEAC;CAEAC;CAIV,YAAYC,KAAyC;EACjD,KAAKR,UAAUQ,IAAIR,WAAW,CAAC;EAE/B,KAAKG,mBAAmBK,IAAIL;EAC5B,KAAKC,iBAAiBI,IAAIJ;EAE1B,KAAKC,sBAAsB,IAAIhB,oBAAoBmB,IAAIL,gBAAgB;EACvE,KAAKG,qBAAqB,IAAIf,mBAAmBiB,IAAIL,gBAAgB;EACrE,KAAKI,oBAAoB,IAAIf,kBAAkBgB,IAAIL,gBAAgB;EAEnE,KAAKF,sBAAsBO,IAAIP;EAE/B,KAAKC,sBAAsB,IAAItB,oBAAoB;GAC/C6B,UAAUD,IAAIE;GACdC,cAAc,IAAIrB,eAAakB,IAAII,0BAA0B;GAC7DC,SAAS;GACTC,UAAU;EACd,CAAA;CACJ;CAIA,MAAMC,IAAIC,OAAkB;EAKxBrB,8BAA8BqB,OAAOC,IAJJxB,2BAC7BuB,OACA,KAAKd,mBAE4Be,CAAAA;EAErC,MAAMC,cAAcF,MAAMG,QAAQC,IAAI,eAAA;EACtC,IAAI,CAACF,aACD;EAGJ,MAAMG,SAASjC,yBAAyB8B,WAAAA;EAExC,IAAIG,OAAOC,SAASnC,wBAAwBoC,QAAQ;GAChD,MAAM,KAAKC,gCAAgCR,OAAOK,MAAAA;GAClD;EACJ;EAEA,IAAIA,OAAOC,SAASnC,wBAAwBsC,OAAO;GAC/C,MAAM,KAAKC,+BAA+BV,OAAOK,MAAAA;GACjD;EACJ;EAEA,MAAMtC,gBAAgB4C,gBAAgBN,OAAOC,IAAI;CACrD;;;IAKA,MAAgBE,gCACZR,OACAK,QACF;EACE,MAAMO,UAAU,MAAM,KAAK3B,oBAAoB4B,OAAOR,OAAOS,KAAK;EAClE,IAAIF,QAAQG,SAAS9C,gBAAgB+C,QACjC,MAAMhD,SAASiD,uBAAuB,MAAA;EAG1C,IAAI,CAACL,QAAQM,UACT,MAAMlD,SAASiD,uBAAuB,UAAA;EAG1CnC,gBAAgBkB,OAAOK,OAAOS,KAAK;EAEnC,IAAIF,QAAQO,OACRvC,iBAAiBoB,OAAO9B,uBAAuB0C,QAAQO,KAAK,CAAA;EAKhE,IAAI,CAACP,QAAQQ,YACT,MAAMpD,SAASiD,uBAAuB,YAAA;EAG1C,MAAMI,UAAU,MAAM,KAAKjC,eAAekC,YAAYV,QAAQQ,UAAU;EACxE,IAAI,CAACC,SACD,MAAMrD,SAASuD,QAAO;EAG1B,IAAI;GACA,MAAM,KAAKnC,eAAeyB,OAAOQ,OAAAA;EACrC,QAAQ;GACJ,MAAMrD,SAASuD,QAAO;EAC1B;EAEA,MAAM,KAAKnC,eAAeoC,KAAKH,OAAAA;EAE/BxC,oBAAoBmB,OAAOY,QAAQQ,UAAU;EAI7C,IAAI,CAACR,QAAQa,UACT,MAAMzD,SAASiD,uBAAuB,UAAA;EAG1C,IAAI,CAACL,QAAQc,KACT,MAAM1D,SAASiD,uBAAuB,KAAA;EAG1C,MAAMU,WAAW,MAAM,KAAKxC,iBAAiByC,QACzChB,QAAQa,UACRb,QAAQc,GAAG;EAGf,IAAIC,UACAjD,mBAAmBsB,OAAO2B,QAAAA;CAElC;CAEA,MAAgBjB,+BACZV,OACAK,QACF;EACE,IAAI,KAAKrB,QAAQ6C,iBAAiB;GAC9B,MAAMC,gBAAgB,MAAM,KAAKzC,oBAAoB0C,iBACjD1B,OAAO2B,UACP3B,OAAO4B,QAAQ;GAEnB,IAAIH,cAAcI,SAAS;IACvBtD,iBAAiBoB,OAAO,CAAClC,UAAUqE,MAAAA,CAAO;IAC1CzD,mBAAmBsB,OAAO;KACtBM,MAAMzC,aAAauE;KACnBC,MAAMP,cAAcO;IACxB,CAAA;GACJ;EACJ;EAEA,IAAI,KAAKrD,QAAQsD,eAAe;GAC5B,MAAMC,gBAAgB,MAAM,KAAKhD,kBAAkBwC,iBAC/C1B,OAAO2B,UACP3B,OAAO4B,QAAQ;GAGnB,IAAIM,cAAcL,SAAS;IACvBtD,iBAAiBoB,OAAO,CAAClC,UAAUqE,MAAAA,CAAO;IAC1CzD,mBAAmBsB,OAAO;KACtBM,MAAMzC,aAAa2E;KACnBH,MAAME,cAAcF;IACxB,CAAA;IAEA;GACJ;EACJ;EAEA,IAAI,KAAKrD,QAAQyD,gBAAgB;GAC7B,MAAMF,gBAAgB,MAAM,KAAKjD,mBAAmByC,iBAChD1B,OAAO2B,UACP3B,OAAO4B,QAAQ;GAEnB,IAAIM,cAAcL,SAAS;IACvBtD,iBAAiBoB,OAAO,CAAClC,UAAUqE,MAAAA,CAAO;IAC1CzD,mBAAmBsB,OAAO;KACtBM,MAAMzC,aAAa6E;KACnBL,MAAME,cAAcF;IACxB,CAAA;GACJ;EACJ;CACJ;AACJ"}

package/dist/adapters/http/middleware/built-in/index.mjs

@@ -14,9 +14,9 @@ import { VITE_SERVER_STORE_KEY, registerAssetsMiddleware } from "./assets.mjs";
 import { registerBasicMiddleware } from "./basic.mjs";
 import { registerCorsMiddleware } from "./cors.mjs";
 import { registerErrorMiddleware } from "./error.mjs";
-import { createLoggerMiddleware } from "./logger.mjs";
+import { createLoggerMiddleware, redactSensitiveURLParams } from "./logger.mjs";
 import { registerPrometheusMiddleware } from "./prometheus.mjs";
 import { registerRateLimitMiddleware } from "./rate-limit.mjs";
 import { createSwaggerMiddleware } from "./swagger.mjs";
 import { UI_HTTP_CLIENT_FACTORY_STORE_KEY, registerUIHttpClientMiddleware } from "./ui-http-client.mjs";
-export { AuthorizationMiddleware, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, RealmResolverMiddleware, UI_HTTP_CLIENT_FACTORY_STORE_KEY, VITE_SERVER_STORE_KEY, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createSwaggerMiddleware, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerUIHttpClientMiddleware };
+export { AuthorizationMiddleware, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, RealmResolverMiddleware, UI_HTTP_CLIENT_FACTORY_STORE_KEY, VITE_SERVER_STORE_KEY, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createSwaggerMiddleware, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerUIHttpClientMiddleware };

package/dist/adapters/http/middleware/built-in/logger.d.ts

@@ -4,6 +4,7 @@ type LoggerMiddlewareOptions = {
     env: string;
     logger: Logger;
 };
+export declare function redactSensitiveURLParams(url: string): string;
 export declare function createLoggerMiddleware(options: LoggerMiddlewareOptions): Handler;
 export {};
 //# sourceMappingURL=logger.d.ts.map

package/dist/adapters/http/middleware/built-in/logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/logger.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAEtC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAGjD,KAAK,uBAAuB,GAAG;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAA;CACjB,CAAC;AAEF,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,uBAAuB,GAAI,OAAO,CA6BjF"}
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/logger.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAEtC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAGjD,KAAK,uBAAuB,GAAG;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAA;CACjB,CAAC;AAeF,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAoB5D;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,uBAAuB,GAAI,OAAO,CA6BjF"}

package/dist/adapters/http/middleware/built-in/logger.mjs

@@ -5,13 +5,34 @@ import { EnvironmentName } from "@authup/kit";
 import { getRequestIP } from "routup";
 import { logger } from "@routup/logger";
 //#region src/adapters/http/middleware/built-in/logger.ts
+const SENSITIVE_QUERY_PARAMS = [
+	"id_token_hint",
+	"id_token",
+	"access_token",
+	"refresh_token",
+	"token",
+	"code",
+	"client_secret"
+];
+function redactSensitiveURLParams(url) {
+	const queryIndex = url.indexOf("?");
+	if (queryIndex === -1) return url;
+	const params = new URLSearchParams(url.substring(queryIndex + 1));
+	let redacted = false;
+	for (const name of SENSITIVE_QUERY_PARAMS) if (params.has(name)) {
+		params.set(name, "***");
+		redacted = true;
+	}
+	if (!redacted) return url;
+	return `${url.substring(0, queryIndex)}?${params.toString()}`;
+}
 function createLoggerMiddleware(options) {
 	return logger({
 		format: (tokens, event, response) => [
 			getRequestIP(event) || "-",
 			"-",
 			tokens.method(event, response) ?? "-",
-			tokens.url(event, response) ?? "-",
+			redactSensitiveURLParams(tokens.url(event, response) ?? "-"),
 			tokens.status(event, response) ?? "-",
 			"-",
 			tokens["response-time"](event, response) ?? "-"
@@ -28,6 +49,6 @@ function createLoggerMiddleware(options) {
 	});
 }
 //#endregion
-export { createLoggerMiddleware };
+export { createLoggerMiddleware, redactSensitiveURLParams };
 
 //# sourceMappingURL=logger.mjs.map

package/dist/adapters/http/middleware/built-in/logger.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"logger.mjs","names":["logger","getRequestIP","EnvironmentName","createLoggerMiddleware","options","format","tokens","event","response","method","url","status","join","write","line","env","TEST","http","skip","path","length","PRODUCTION"],"sources":["../../../../../src/adapters/http/middleware/built-in/logger.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { logger } from '@routup/logger';\nimport type { Handler } from 'routup';\nimport { getRequestIP } from 'routup';\nimport type { Logger } from '@authup/server-kit';\nimport { EnvironmentName } from '@authup/kit';\n\ntype LoggerMiddlewareOptions = {\n    env: string,\n    logger: Logger\n};\n\nexport function createLoggerMiddleware(options: LoggerMiddlewareOptions) : Handler {\n    return logger({\n        format: (tokens, event, response) => [\n            getRequestIP(event) || '-',\n            '-',\n            tokens.method(event, response) ?? '-',\n            tokens.url(event, response) ?? '-',\n            tokens.status(event, response) ?? '-',\n            '-',\n            tokens['response-time'](event, response) ?? '-',\n        ].join(' '),\n        write(line) {\n            if (options.env !== EnvironmentName.TEST) {\n                options.logger.http(line);\n            }\n        },\n        skip(event, response): boolean {\n            const path = event.path || '';\n            if (path.length === 0 || path === '/') {\n                return true;\n            }\n\n            if (options.env === EnvironmentName.PRODUCTION) {\n                return (response?.status ?? 0) < 400;\n            }\n\n            return false;\n        },\n    });\n}\n"],"mappings":";;;;;;;AAkBA,SAAgBG,uBAAuBC,SAAgC;CACnE,OAAOJ,OAAO;EACVK,SAASC,QAAQC,OAAOC,aAAa;GACjCP,aAAaM,KAAAA,KAAU;GACvB;GACAD,OAAOG,OAAOF,OAAOC,QAAAA,KAAa;GAClCF,OAAOI,IAAIH,OAAOC,QAAAA,KAAa;GAC/BF,OAAOK,OAAOJ,OAAOC,QAAAA,KAAa;GAClC;GACAF,OAAO,gBAAgB,CAACC,OAAOC,QAAAA,KAAa;GAC/C,CAACI,KAAK,GAAA;EACPC,MAAMC,MAAI;GACN,IAAIV,QAAQW,QAAQb,gBAAgBc,MAChCZ,QAAQJ,OAAOiB,KAAKH,IAAAA;EAE5B;EACAI,KAAKX,OAAOC,UAAQ;GAChB,MAAMW,OAAOZ,MAAMY,QAAQ;GAC3B,IAAIA,KAAKC,WAAW,KAAKD,SAAS,KAC9B,OAAO;GAGX,IAAIf,QAAQW,QAAQb,gBAAgBmB,YAChC,QAAQb,UAAUG,UAAU,KAAK;GAGrC,OAAO;EACX;CACJ,CAAA;AACJ"}
+{"version":3,"file":"logger.mjs","names":["logger","getRequestIP","EnvironmentName","SENSITIVE_QUERY_PARAMS","redactSensitiveURLParams","url","queryIndex","indexOf","params","URLSearchParams","substring","redacted","name","has","set","toString","createLoggerMiddleware","options","format","tokens","event","response","method","status","join","write","line","env","TEST","http","skip","path","length","PRODUCTION"],"sources":["../../../../../src/adapters/http/middleware/built-in/logger.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { logger } from '@routup/logger';\nimport type { Handler } from 'routup';\nimport { getRequestIP } from 'routup';\nimport type { Logger } from '@authup/server-kit';\nimport { EnvironmentName } from '@authup/kit';\n\ntype LoggerMiddlewareOptions = {\n    env: string,\n    logger: Logger\n};\n\n// Query params whose values are credentials/tokens — the access log must never\n// persist them (a GET /logout?id_token_hint=<jwt> would otherwise write a\n// signature-valid token into the log).\nconst SENSITIVE_QUERY_PARAMS = [\n    'id_token_hint',\n    'id_token',\n    'access_token',\n    'refresh_token',\n    'token',\n    'code',\n    'client_secret',\n];\n\nexport function redactSensitiveURLParams(url: string): string {\n    const queryIndex = url.indexOf('?');\n    if (queryIndex === -1) {\n        return url;\n    }\n\n    const params = new URLSearchParams(url.substring(queryIndex + 1));\n    let redacted = false;\n    for (const name of SENSITIVE_QUERY_PARAMS) {\n        if (params.has(name)) {\n            params.set(name, '***');\n            redacted = true;\n        }\n    }\n\n    if (!redacted) {\n        return url;\n    }\n\n    return `${url.substring(0, queryIndex)}?${params.toString()}`;\n}\n\nexport function createLoggerMiddleware(options: LoggerMiddlewareOptions) : Handler {\n    return logger({\n        format: (tokens, event, response) => [\n            getRequestIP(event) || '-',\n            '-',\n            tokens.method(event, response) ?? '-',\n            redactSensitiveURLParams(tokens.url(event, response) ?? '-'),\n            tokens.status(event, response) ?? '-',\n            '-',\n            tokens['response-time'](event, response) ?? '-',\n        ].join(' '),\n        write(line) {\n            if (options.env !== EnvironmentName.TEST) {\n                options.logger.http(line);\n            }\n        },\n        skip(event, response): boolean {\n            const path = event.path || '';\n            if (path.length === 0 || path === '/') {\n                return true;\n            }\n\n            if (options.env === EnvironmentName.PRODUCTION) {\n                return (response?.status ?? 0) < 400;\n            }\n\n            return false;\n        },\n    });\n}\n"],"mappings":";;;;;;;AAqBA,MAAMG,yBAAyB;CAC3B;CACA;CACA;CACA;CACA;CACA;CACA;;AAGJ,SAAgBC,yBAAyBC,KAAW;CAChD,MAAMC,aAAaD,IAAIE,QAAQ,GAAA;CAC/B,IAAID,eAAe,IACf,OAAOD;CAGX,MAAMG,SAAS,IAAIC,gBAAgBJ,IAAIK,UAAUJ,aAAa,CAAA,CAAA;CAC9D,IAAIK,WAAW;CACf,KAAK,MAAMC,QAAQT,wBACf,IAAIK,OAAOK,IAAID,IAAAA,GAAO;EAClBJ,OAAOM,IAAIF,MAAM,KAAA;EACjBD,WAAW;CACf;CAGJ,IAAI,CAACA,UACD,OAAON;CAGX,OAAO,GAAGA,IAAIK,UAAU,GAAGJ,UAAAA,EAAY,GAAGE,OAAOO,SAAQ;AAC7D;AAEA,SAAgBC,uBAAuBC,SAAgC;CACnE,OAAOjB,OAAO;EACVkB,SAASC,QAAQC,OAAOC,aAAa;GACjCpB,aAAamB,KAAAA,KAAU;GACvB;GACAD,OAAOG,OAAOF,OAAOC,QAAAA,KAAa;GAClCjB,yBAAyBe,OAAOd,IAAIe,OAAOC,QAAAA,KAAa,GAAA;GACxDF,OAAOI,OAAOH,OAAOC,QAAAA,KAAa;GAClC;GACAF,OAAO,gBAAgB,CAACC,OAAOC,QAAAA,KAAa;GAC/C,CAACG,KAAK,GAAA;EACPC,MAAMC,MAAI;GACN,IAAIT,QAAQU,QAAQzB,gBAAgB0B,MAChCX,QAAQjB,OAAO6B,KAAKH,IAAAA;EAE5B;EACAI,KAAKV,OAAOC,UAAQ;GAChB,MAAMU,OAAOX,MAAMW,QAAQ;GAC3B,IAAIA,KAAKC,WAAW,KAAKD,SAAS,KAC9B,OAAO;GAGX,IAAId,QAAQU,QAAQzB,gBAAgB+B,YAChC,QAAQZ,UAAUE,UAAU,KAAK;GAGrC,OAAO;EACX;CACJ,CAAA;AACJ"}

package/dist/adapters/http/middleware/built-in/prometheus.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prometheus.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/prometheus.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAElC,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,YAAY,QAuB7E"}
+{"version":3,"file":"prometheus.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/prometheus.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAElC,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,YAAY,QAqB7E"}

package/dist/adapters/http/middleware/built-in/prometheus.mjs

@@ -7,7 +7,7 @@ function registerPrometheusMiddleware(router, input) {
 	let options = { skip(event) {
 		let { path } = event;
 		if (!path.startsWith("/")) path = `/${path}`;
-		return path.startsWith("/authorize") || path.startsWith("/token") || path.startsWith("/metrics") || path === "/";
+		return path.startsWith("/metrics") || path === "/";
 	} };
 	if (input) options = {
 		...options,

package/dist/adapters/http/middleware/built-in/prometheus.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"prometheus.mjs","names":["prometheus","registerPrometheusMiddleware","router","input","options","skip","event","path","startsWith","use"],"sources":["../../../../../src/adapters/http/middleware/built-in/prometheus.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OptionsInput } from '@routup/prometheus';\nimport { prometheus } from '@routup/prometheus';\nimport type { App } from 'routup';\n\nexport function registerPrometheusMiddleware(router: App, input?: OptionsInput) {\n    let options : OptionsInput = {\n        skip(event) {\n            let { path } = event;\n            if (!path.startsWith('/')) {\n                path = `/${path}`;\n            }\n\n            return path.startsWith('/authorize') ||\n                path.startsWith('/token') ||\n                path.startsWith('/metrics') ||\n                path === '/';\n        },\n    };\n\n    if (input) {\n        options = {\n            ...options,\n            ...input,\n        };\n    }\n\n    router.use(prometheus(options));\n}\n"],"mappings":";;;;;AAWA,SAAgBC,6BAA6BC,QAAaC,OAAoB;CAC1E,IAAIC,UAAyB,EACzBC,KAAKC,OAAK;EACN,IAAI,EAAEC,SAASD;EACf,IAAI,CAACC,KAAKC,WAAW,GAAA,GACjBD,OAAO,IAAIA;EAGf,OAAOA,KAAKC,WAAW,YAAA,KACnBD,KAAKC,WAAW,QAAA,KAChBD,KAAKC,WAAW,UAAA,KAChBD,SAAS;CACjB,EACJ;CAEA,IAAIJ,OACAC,UAAU;EACN,GAAGA;EACH,GAAGD;CACP;CAGJD,OAAOO,IAAIT,WAAWI,OAAAA,CAAAA;AAC1B"}
+{"version":3,"file":"prometheus.mjs","names":["prometheus","registerPrometheusMiddleware","router","input","options","skip","event","path","startsWith","use"],"sources":["../../../../../src/adapters/http/middleware/built-in/prometheus.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OptionsInput } from '@routup/prometheus';\nimport { prometheus } from '@routup/prometheus';\nimport type { App } from 'routup';\n\nexport function registerPrometheusMiddleware(router: App, input?: OptionsInput) {\n    let options : OptionsInput = {\n        skip(event) {\n            let { path } = event;\n            if (!path.startsWith('/')) {\n                path = `/${path}`;\n            }\n\n            return path.startsWith('/metrics') ||\n                path === '/';\n        },\n    };\n\n    if (input) {\n        options = {\n            ...options,\n            ...input,\n        };\n    }\n\n    router.use(prometheus(options));\n}\n"],"mappings":";;;;;AAWA,SAAgBC,6BAA6BC,QAAaC,OAAoB;CAC1E,IAAIC,UAAyB,EACzBC,KAAKC,OAAK;EACN,IAAI,EAAEC,SAASD;EACf,IAAI,CAACC,KAAKC,WAAW,GAAA,GACjBD,OAAO,IAAIA;EAGf,OAAOA,KAAKC,WAAW,UAAA,KACnBD,SAAS;CACjB,EACJ;CAEA,IAAIJ,OACAC,UAAU;EACN,GAAGA;EACH,GAAGD;CACP;CAGJD,OAAOO,IAAIT,WAAWI,OAAAA,CAAAA;AAC1B"}

package/dist/adapters/http/middleware/built-in/realm-resolver/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/middleware/built-in/realm-resolver/module.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,YAAY,CAAC;AAEjE,qBAAa,uBAAuB;IAChC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;gBAEhC,GAAG,EAAE,8BAA8B;IAIzC,GAAG,CAAC,KAAK,EAAE,SAAS;CAkB7B"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/middleware/built-in/realm-resolver/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,YAAY,CAAC;AAEjE,qBAAa,uBAAuB;IAChC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;gBAEhC,GAAG,EAAE,8BAA8B;IAIzC,GAAG,CAAC,KAAK,EAAE,SAAS;CAa7B"}

package/dist/adapters/http/middleware/built-in/realm-resolver/module.mjs

@@ -3,7 +3,6 @@ import "node:url";
 import.meta.url;
 import { setRequestRealmID } from "../../../request/helpers/realm-id.mjs";
 import "../../../request/index.mjs";
-import { isUUID } from "@authup/kit";
 import { EntityNotFoundError } from "@authup/errors";
 //#region src/adapters/http/middleware/built-in/realm-resolver/module.ts
 var RealmResolverMiddleware = class {
@@ -14,13 +13,9 @@ var RealmResolverMiddleware = class {
 	async run(event) {
 		const value = event.params.realmId;
 		if (typeof value !== "string" || !value) return;
-		if (isUUID(value)) {
-			setRequestRealmID(event, value);
-			return;
-		}
-		const realm = await this.realmRepository.resolve(value);
-		if (!realm) throw new EntityNotFoundError(`realm '${value}' not found`);
-		setRequestRealmID(event, realm.id);
+		const realmId = await this.realmRepository.resolveId(value);
+		if (!realmId) throw new EntityNotFoundError(`realm '${value}' not found`);
+		setRequestRealmID(event, realmId);
 	}
 };
 //#endregion

package/dist/adapters/http/middleware/built-in/realm-resolver/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["isUUID","EntityNotFoundError","setRequestRealmID","RealmResolverMiddleware","realmRepository","ctx","run","event","value","params","realmId","realm","resolve","id"],"sources":["../../../../../../src/adapters/http/middleware/built-in/realm-resolver/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isUUID } from '@authup/kit';\nimport { EntityNotFoundError } from '@authup/errors';\nimport type { IAppEvent } from 'routup';\nimport type { IRealmRepository } from '../../../../../core/index.ts';\nimport { setRequestRealmID } from '../../../request/index.ts';\nimport type { RealmResolverMiddlewareContext } from './types.ts';\n\nexport class RealmResolverMiddleware {\n    protected realmRepository: IRealmRepository;\n\n    constructor(ctx: RealmResolverMiddlewareContext) {\n        this.realmRepository = ctx.realmRepository;\n    }\n\n    async run(event: IAppEvent) {\n        const value = event.params.realmId;\n        if (typeof value !== 'string' || !value) {\n            return;\n        }\n\n        if (isUUID(value)) {\n            setRequestRealmID(event, value);\n            return;\n        }\n\n        const realm = await this.realmRepository.resolve(value);\n        if (!realm) {\n            throw new EntityNotFoundError(`realm '${value}' not found`);\n        }\n\n        setRequestRealmID(event, realm.id);\n    }\n}\n"],"mappings":";;;;;;;;AAcA,IAAaG,0BAAb,MAAaA;CACCC;CAEV,YAAYC,KAAqC;EAC7C,KAAKD,kBAAkBC,IAAID;CAC/B;CAEA,MAAME,IAAIC,OAAkB;EACxB,MAAMC,QAAQD,MAAME,OAAOC;EAC3B,IAAI,OAAOF,UAAU,YAAY,CAACA,OAC9B;EAGJ,IAAIR,OAAOQ,KAAAA,GAAQ;GACfN,kBAAkBK,OAAOC,KAAAA;GACzB;EACJ;EAEA,MAAMG,QAAQ,MAAM,KAAKP,gBAAgBQ,QAAQJ,KAAAA;EACjD,IAAI,CAACG,OACD,MAAM,IAAIV,oBAAoB,UAAUO,MAAM,YAAY;EAG9DN,kBAAkBK,OAAOI,MAAME,EAAE;CACrC;AACJ"}
+{"version":3,"file":"module.mjs","names":["EntityNotFoundError","setRequestRealmID","RealmResolverMiddleware","realmRepository","ctx","run","event","value","params","realmId","resolveId"],"sources":["../../../../../../src/adapters/http/middleware/built-in/realm-resolver/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { EntityNotFoundError } from '@authup/errors';\nimport type { IAppEvent } from 'routup';\nimport type { IRealmRepository } from '../../../../../core/index.ts';\nimport { setRequestRealmID } from '../../../request/index.ts';\nimport type { RealmResolverMiddlewareContext } from './types.ts';\n\nexport class RealmResolverMiddleware {\n    protected realmRepository: IRealmRepository;\n\n    constructor(ctx: RealmResolverMiddlewareContext) {\n        this.realmRepository = ctx.realmRepository;\n    }\n\n    async run(event: IAppEvent) {\n        const value = event.params.realmId;\n        if (typeof value !== 'string' || !value) {\n            return;\n        }\n\n        const realmId = await this.realmRepository.resolveId(value);\n        if (!realmId) {\n            throw new EntityNotFoundError(`realm '${value}' not found`);\n        }\n\n        setRequestRealmID(event, realmId);\n    }\n}\n"],"mappings":";;;;;;;AAaA,IAAaE,0BAAb,MAAaA;CACCC;CAEV,YAAYC,KAAqC;EAC7C,KAAKD,kBAAkBC,IAAID;CAC/B;CAEA,MAAME,IAAIC,OAAkB;EACxB,MAAMC,QAAQD,MAAME,OAAOC;EAC3B,IAAI,OAAOF,UAAU,YAAY,CAACA,OAC9B;EAGJ,MAAME,UAAU,MAAM,KAAKN,gBAAgBO,UAAUH,KAAAA;EACrD,IAAI,CAACE,SACD,MAAM,IAAIT,oBAAoB,UAAUO,MAAM,YAAY;EAG9DN,kBAAkBK,OAAOG,OAAAA;CAC7B;AACJ"}

package/dist/adapters/http/middleware/built-in/ui-http-client.d.ts

@@ -7,8 +7,8 @@ import type { App } from 'routup';
  * whose registration carries `lifetime: 'transient'`, so every SSR
  * render resolves a fresh client — never share one client instance
  * across renders (the authentication hook writes per-user state onto
- * it). Mounted only when the token is bound (test injection);
- * production mounts nothing.
+ * it). Production binds the internal loopback client by default
+ * (`HTTPModule.registerUIHttpClient`); tests may pre-register a fake.
  */
 export declare const UI_HTTP_CLIENT_FACTORY_STORE_KEY: unique symbol;
 export declare function registerUIHttpClientMiddleware(router: App, httpClientFactory: () => IClient): void;

package/dist/adapters/http/middleware/built-in/ui-http-client.mjs

@@ -10,8 +10,8 @@ import { defineCoreHandler } from "routup";
 * whose registration carries `lifetime: 'transient'`, so every SSR
 * render resolves a fresh client — never share one client instance
 * across renders (the authentication hook writes per-user state onto
-* it). Mounted only when the token is bound (test injection);
-* production mounts nothing.
+* it). Production binds the internal loopback client by default
+* (`HTTPModule.registerUIHttpClient`); tests may pre-register a fake.
 */ const UI_HTTP_CLIENT_FACTORY_STORE_KEY = Symbol("UIHttpClientFactory");
 function registerUIHttpClientMiddleware(router, httpClientFactory) {
 	router.use(defineCoreHandler((event) => {

package/dist/adapters/http/middleware/built-in/ui-http-client.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"ui-http-client.mjs","names":["defineCoreHandler","UI_HTTP_CLIENT_FACTORY_STORE_KEY","Symbol","registerUIHttpClientMiddleware","router","httpClientFactory","use","event","store","next"],"sources":["../../../../../src/adapters/http/middleware/built-in/ui-http-client.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IClient } from '@authup/core-http-kit';\nimport type { App } from 'routup';\nimport { defineCoreHandler } from 'routup';\n\n/**\n * Per-request handoff of an HTTP-client factory into renderUIPage —\n * same mechanism as VITE_SERVER_STORE_KEY. The wiring passes a thunk\n * over the DI container (`() => container.resolve(UIHttpClient)`)\n * whose registration carries `lifetime: 'transient'`, so every SSR\n * render resolves a fresh client — never share one client instance\n * across renders (the authentication hook writes per-user state onto\n * it). Mounted only when the token is bound (test injection);\n * production mounts nothing.\n */\nexport const UI_HTTP_CLIENT_FACTORY_STORE_KEY = Symbol('UIHttpClientFactory');\n\nexport function registerUIHttpClientMiddleware(router: App, httpClientFactory: () => IClient) {\n    router.use(defineCoreHandler((event) => {\n        event.store[UI_HTTP_CLIENT_FACTORY_STORE_KEY] = httpClientFactory;\n        return event.next();\n    }));\n}\n"],"mappings":";;;;;;;;;;;;;;GAqBA,MAAaC,mCAAmCC,OAAO,qBAAA;AAEvD,SAAgBC,+BAA+BC,QAAaC,mBAAgC;CACxFD,OAAOE,IAAIN,mBAAmBO,UAAAA;EAC1BA,MAAMC,MAAMP,oCAAoCI;EAChD,OAAOE,MAAME,KAAI;CACrB,CAAA,CAAA;AACJ"}
+{"version":3,"file":"ui-http-client.mjs","names":["defineCoreHandler","UI_HTTP_CLIENT_FACTORY_STORE_KEY","Symbol","registerUIHttpClientMiddleware","router","httpClientFactory","use","event","store","next"],"sources":["../../../../../src/adapters/http/middleware/built-in/ui-http-client.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IClient } from '@authup/core-http-kit';\nimport type { App } from 'routup';\nimport { defineCoreHandler } from 'routup';\n\n/**\n * Per-request handoff of an HTTP-client factory into renderUIPage —\n * same mechanism as VITE_SERVER_STORE_KEY. The wiring passes a thunk\n * over the DI container (`() => container.resolve(UIHttpClient)`)\n * whose registration carries `lifetime: 'transient'`, so every SSR\n * render resolves a fresh client — never share one client instance\n * across renders (the authentication hook writes per-user state onto\n * it). Production binds the internal loopback client by default\n * (`HTTPModule.registerUIHttpClient`); tests may pre-register a fake.\n */\nexport const UI_HTTP_CLIENT_FACTORY_STORE_KEY = Symbol('UIHttpClientFactory');\n\nexport function registerUIHttpClientMiddleware(router: App, httpClientFactory: () => IClient) {\n    router.use(defineCoreHandler((event) => {\n        event.store[UI_HTTP_CLIENT_FACTORY_STORE_KEY] = httpClientFactory;\n        return event.next();\n    }));\n}\n"],"mappings":";;;;;;;;;;;;;;GAqBA,MAAaC,mCAAmCC,OAAO,qBAAA;AAEvD,SAAgBC,+BAA+BC,QAAaC,mBAAgC;CACxFD,OAAOE,IAAIN,mBAAmBO,UAAAA;EAC1BA,MAAMC,MAAMP,oCAAoCI;EAChD,OAAOE,MAAME,KAAI;CACrB,CAAA,CAAA;AACJ"}

package/dist/adapters/http/middleware/index.mjs

@@ -11,10 +11,10 @@ import { VITE_SERVER_STORE_KEY, registerAssetsMiddleware } from "./built-in/asse
 import { registerBasicMiddleware } from "./built-in/basic.mjs";
 import { registerCorsMiddleware } from "./built-in/cors.mjs";
 import { registerErrorMiddleware } from "./built-in/error.mjs";
-import { createLoggerMiddleware } from "./built-in/logger.mjs";
+import { createLoggerMiddleware, redactSensitiveURLParams } from "./built-in/logger.mjs";
 import { registerPrometheusMiddleware } from "./built-in/prometheus.mjs";
 import { registerRateLimitMiddleware } from "./built-in/rate-limit.mjs";
 import { createSwaggerMiddleware } from "./built-in/swagger.mjs";
 import { UI_HTTP_CLIENT_FACTORY_STORE_KEY, registerUIHttpClientMiddleware } from "./built-in/ui-http-client.mjs";
 import "./built-in/index.mjs";
-export { AuthorizationMiddleware, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, RealmResolverMiddleware, UI_HTTP_CLIENT_FACTORY_STORE_KEY, VITE_SERVER_STORE_KEY, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createSwaggerMiddleware, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerUIHttpClientMiddleware };
+export { AuthorizationMiddleware, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, RealmResolverMiddleware, UI_HTTP_CLIENT_FACTORY_STORE_KEY, VITE_SERVER_STORE_KEY, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createSwaggerMiddleware, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerUIHttpClientMiddleware };

package/dist/adapters/http/request/helpers/index.d.ts

@@ -7,5 +7,6 @@ export * from './param-id.ts';
 export * from './realm-id.ts';
 export * from './redirect.ts';
 export * from './scopes.ts';
+export * from './session-id.ts';
 export * from './token.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/request/helpers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/helpers/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/helpers/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,YAAY,CAAC"}

package/dist/adapters/http/request/helpers/index.mjs

@@ -10,5 +10,6 @@ import { getRequestParamID, getRequestStringParam, getRequestStringParamOrFail,
 import { applyRouteRealmIDToBody, getRequestRealmID, setRequestRealmID } from "./realm-id.mjs";
 import { sanitizeRelativeRedirect } from "./redirect.mjs";
 import { setRequestScopes, useRequestScopes } from "./scopes.mjs";
+import { setRequestSessionId, useRequestSessionId } from "./session-id.mjs";
 import { setRequestToken, useRequestToken } from "./token.mjs";
-export { LOCALE_COOKIE, RequestIdentity, applyRouteRealmIDToBody, buildActorContext, getBodyRealmID, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, readFromLocations, sanitizeRelativeRedirect, setRequestIdentity, setRequestRealmID, setRequestScopes, setRequestToken, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestParamID, useRequestScopes, useRequestToken };
+export { LOCALE_COOKIE, RequestIdentity, applyRouteRealmIDToBody, buildActorContext, getBodyRealmID, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, readFromLocations, sanitizeRelativeRedirect, setRequestIdentity, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestParamID, useRequestScopes, useRequestSessionId, useRequestToken };

package/dist/adapters/http/request/helpers/session-id.d.ts

@@ -0,0 +1,9 @@
+import type { IAppEvent } from 'routup';
+/**
+ * The id of the session the current bearer token belongs to (stashed by the
+ * authorization middleware). Used by `/sessions` self-service (e.g. "revoke all
+ * my other sessions").
+ */
+export declare function useRequestSessionId(event: IAppEvent): string | undefined;
+export declare function setRequestSessionId(event: IAppEvent, id: string): void;
+//# sourceMappingURL=session-id.d.ts.map

package/dist/adapters/http/request/helpers/session-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-id.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/helpers/session-id.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAIxC;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS,CAExE;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,CAEtE"}