@authup/server-core 1.0.0-beta.51 → 1.0.0-beta.53

package/dist/adapters/http/controllers/workflows/authenticator-challenge/module.mjs

@@ -0,0 +1,132 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { useRequestIdentity } from "../../../request/helpers/identity.mjs";
+import { useRequestLocale } from "../../../request/helpers/locale.mjs";
+import { useRequestMfaLoginTicket } from "../../../request/helpers/mfa-login-ticket.mjs";
+import { useRequestSessionId } from "../../../request/helpers/session-id.mjs";
+import "../../../request/index.mjs";
+import { IdentityType, UserAuthenticatorKind } from "@authup/core-kit";
+import { BadRequestError, EntityCredentialsInvalidError, UnauthorizedError } from "@authup/errors";
+import { getRequestHeader, getRequestIP } from "routup";
+import { DBody, DContext, DController, DGet, DPost, DTags } from "@routup/decorators";
+//#region src/adapters/http/controllers/workflows/authenticator-challenge/module.ts
+function _ts_decorate(decorators, target, key, desc) {
+	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+	return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(k, v) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+function _ts_param(paramIndex, decorator) {
+	return function(target, key) {
+		decorator(target, key, paramIndex);
+	};
+}
+var AuthenticatorChallengeController = class {
+	service;
+	sessionManager;
+	mfaLoginService;
+	constructor(ctx) {
+		this.service = ctx.service;
+		this.sessionManager = ctx.sessionManager;
+		this.mfaLoginService = ctx.mfaLoginService;
+	}
+	/**
+	* Resolve the acting subject: the regular request identity (access
+	* bearer — the middleware never sets it for a ticket) or the stashed
+	* MFA-pending ticket. Anything else is unauthorized — the previous
+	* ForceLoggedInMiddleware contract, widened by exactly one bearer kind.
+	*/ resolveActor(event) {
+		const identity = useRequestIdentity(event);
+		if (identity) return {
+			identity,
+			ticket: null
+		};
+		const ticket = useRequestMfaLoginTicket(event);
+		if (ticket) return {
+			identity: ticket.identity,
+			ticket
+		};
+		throw new UnauthorizedError();
+	}
+	async status(event) {
+		const { identity } = this.resolveActor(event);
+		if (identity.type !== IdentityType.USER) return {
+			required: false,
+			enrollmentRequired: false,
+			kinds: []
+		};
+		return this.service.challenge(identity.id);
+	}
+	async send(data, event) {
+		const { identity } = this.resolveActor(event);
+		if (identity.type !== IdentityType.USER) throw new BadRequestError("Only user identities can request a challenge.");
+		if (!data || !Object.values(UserAuthenticatorKind).includes(data.kind)) throw new BadRequestError("A kind must be provided.");
+		await this.service.sendChallenge(identity.id, data.kind, { locale: useRequestLocale(event) });
+		return { success: true };
+	}
+	async verify(data, event) {
+		const { identity, ticket } = this.resolveActor(event);
+		if (identity.type !== IdentityType.USER) throw new BadRequestError("Only user identities can complete a challenge.");
+		if (!data || typeof data.response !== "string" || !data.response || !Object.values(UserAuthenticatorKind).includes(data.kind)) throw new BadRequestError("A kind and response must be provided.");
+		const sessionId = ticket ? ticket.payload.session_id : useRequestSessionId(event);
+		const session = sessionId ? await this.sessionManager.findOneById(sessionId) : null;
+		if (ticket && !session) throw new UnauthorizedError();
+		if (!await this.service.verify(identity.id, {
+			kind: data.kind,
+			response: data.response
+		}, {
+			ipAddress: getRequestIP(event, { trustProxy: true }) ?? null,
+			userAgent: getRequestHeader(event, "user-agent") ?? null,
+			clientId: identity.clientId,
+			...session ? { onVerified: async () => {
+				await this.sessionManager.markMfaVerified(session);
+			} } : {}
+		})) throw new EntityCredentialsInvalidError();
+		if (ticket && session && this.mfaLoginService) return {
+			verified: true,
+			token: await this.mfaLoginService.complete({
+				session,
+				ticket: ticket.payload,
+				userName: identity.data.name
+			})
+		};
+		return { verified: true };
+	}
+};
+_ts_decorate([
+	DGet(""),
+	_ts_param(0, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], AuthenticatorChallengeController.prototype, "status", null);
+_ts_decorate([
+	DPost("/send"),
+	_ts_param(0, DBody()),
+	_ts_param(1, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof UserAuthenticatorChallengeSendPayload === "undefined" ? Object : UserAuthenticatorChallengeSendPayload, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], AuthenticatorChallengeController.prototype, "send", null);
+_ts_decorate([
+	DPost(""),
+	_ts_param(0, DBody()),
+	_ts_param(1, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof UserAuthenticatorChallengeVerifyPayload === "undefined" ? Object : UserAuthenticatorChallengeVerifyPayload, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], AuthenticatorChallengeController.prototype, "verify", null);
+AuthenticatorChallengeController = _ts_decorate([
+	DTags("userAuthenticator"),
+	DController("/authenticators/challenge"),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof AuthenticatorChallengeControllerContext === "undefined" ? Object : AuthenticatorChallengeControllerContext])
+], AuthenticatorChallengeController);
+//#endregion
+export { AuthenticatorChallengeController };
+
+//# sourceMappingURL=module.mjs.map

package/dist/adapters/http/controllers/workflows/authenticator-challenge/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["DBody","DContext","DController","DGet","DPost","DTags","IdentityType","UserAuthenticatorKind","BadRequestError","EntityCredentialsInvalidError","UnauthorizedError","getRequestHeader","getRequestIP","useRequestIdentity","useRequestLocale","useRequestMfaLoginTicket","useRequestSessionId","AuthenticatorChallengeController","service","sessionManager","mfaLoginService","ctx","resolveActor","event","identity","ticket","status","type","USER","required","enrollmentRequired","kinds","challenge","id","send","data","Object","values","includes","kind","sendChallenge","locale","success","verify","response","sessionId","payload","session_id","session","findOneById","verified","ipAddress","trustProxy","userAgent","clientId","onVerified","markMfaVerified","token","complete","userName","name"],"sources":["../../../../../../src/adapters/http/controllers/workflows/authenticator-challenge/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DBody,\n    DContext,\n    DController,\n    DGet,\n    DPost,\n    DTags,\n} from '@routup/decorators';\nimport { IdentityType, UserAuthenticatorKind } from '@authup/core-kit';\nimport { BadRequestError, EntityCredentialsInvalidError, UnauthorizedError } from '@authup/errors';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type {\n    UserAuthenticatorChallengeResponse,\n    UserAuthenticatorChallengeSendPayload,\n    UserAuthenticatorChallengeVerifyPayload,\n    UserAuthenticatorChallengeVerifyResponse,\n} from '@authup/core-http-kit';\nimport type { IOAuth2MfaLoginService, ISessionManager, IUserAuthenticatorService } from '../../../../../core/index.ts';\nimport type { RequestIdentity, RequestMfaLoginTicket } from '../../../request/index.ts';\nimport {\n    useRequestIdentity,\n    useRequestLocale,\n    useRequestMfaLoginTicket,\n    useRequestSessionId,\n} from '../../../request/index.ts';\n\nexport type AuthenticatorChallengeControllerContext = {\n    service: IUserAuthenticatorService,\n    sessionManager: ISessionManager,\n    mfaLoginService?: IOAuth2MfaLoginService,\n};\n\ntype ChallengeActor = {\n    identity: RequestIdentity,\n    ticket: RequestMfaLoginTicket | null,\n};\n\n/**\n * Login-time challenge surface, scoped to the CURRENT bearer identity.\n * GET reports whether (and how) the caller must present a second factor;\n * POST verifies a factor and stamps mfa_at onto the backing session so\n * the /authorize backstop passes.\n *\n * Besides a regular access bearer, these routes accept the \"MFA-pending\"\n * login ticket (kind: mfa_token, issue #3242) the password grant issues\n * for factor kinds that cannot ride the single grant POST (email /\n * WebAuthn). A ticket-authenticated verify additionally completes the\n * login: the response carries the full token grant for the now-MFA'd\n * pending session.\n */\n@DTags('userAuthenticator')\n@DController('/authenticators/challenge')\nexport class AuthenticatorChallengeController {\n    protected service: IUserAuthenticatorService;\n\n    protected sessionManager: ISessionManager;\n\n    protected mfaLoginService?: IOAuth2MfaLoginService;\n\n    constructor(ctx: AuthenticatorChallengeControllerContext) {\n        this.service = ctx.service;\n        this.sessionManager = ctx.sessionManager;\n        this.mfaLoginService = ctx.mfaLoginService;\n    }\n\n    /**\n     * Resolve the acting subject: the regular request identity (access\n     * bearer — the middleware never sets it for a ticket) or the stashed\n     * MFA-pending ticket. Anything else is unauthorized — the previous\n     * ForceLoggedInMiddleware contract, widened by exactly one bearer kind.\n     */\n    protected resolveActor(event: IAppEvent) : ChallengeActor {\n        const identity = useRequestIdentity(event);\n        if (identity) {\n            return { identity, ticket: null };\n        }\n\n        const ticket = useRequestMfaLoginTicket(event);\n        if (ticket) {\n            return { identity: ticket.identity, ticket };\n        }\n\n        throw new UnauthorizedError();\n    }\n\n    @DGet('')\n    async status(\n        @DContext() event: IAppEvent,\n    ): Promise<UserAuthenticatorChallengeResponse> {\n        const { identity } = this.resolveActor(event);\n        if (identity.type !== IdentityType.USER) {\n            return {\n                required: false,\n                enrollmentRequired: false,\n                kinds: [],\n            };\n        }\n\n        return this.service.challenge(identity.id);\n    }\n\n    @DPost('/send')\n    async send(\n        @DBody() data: UserAuthenticatorChallengeSendPayload,\n        @DContext() event: IAppEvent,\n    ): Promise<{ success: true }> {\n        const { identity } = this.resolveActor(event);\n        if (identity.type !== IdentityType.USER) {\n            throw new BadRequestError('Only user identities can request a challenge.');\n        }\n\n        if (\n            !data ||\n            !Object.values(UserAuthenticatorKind).includes(data.kind as UserAuthenticatorKind)\n        ) {\n            throw new BadRequestError('A kind must be provided.');\n        }\n\n        await this.service.sendChallenge(identity.id, data.kind, { locale: useRequestLocale(event) });\n\n        // uniform 200 regardless of whether a code was actually mailed —\n        // no enrollment-status oracle for the caller.\n        return { success: true };\n    }\n\n    @DPost('')\n    async verify(\n        @DBody() data: UserAuthenticatorChallengeVerifyPayload,\n        @DContext() event: IAppEvent,\n    ): Promise<UserAuthenticatorChallengeVerifyResponse> {\n        const { identity, ticket } = this.resolveActor(event);\n        if (identity.type !== IdentityType.USER) {\n            throw new BadRequestError('Only user identities can complete a challenge.');\n        }\n\n        if (\n            !data ||\n            typeof data.response !== 'string' ||\n            !data.response ||\n            !Object.values(UserAuthenticatorKind).includes(data.kind as UserAuthenticatorKind)\n        ) {\n            throw new BadRequestError('A kind and response must be provided.');\n        }\n\n        // Bind the proof to the backing session — the /authorize backstop\n        // reads session.mfa_at. The session id is server-derived (stashed\n        // by the authorization middleware / carried by the verified ticket),\n        // never client input. The stamp runs INSIDE the verify unit of work\n        // (before the code consumption persists), so a stamp failure never\n        // burns a single-use code.\n        const sessionId = ticket ?\n            ticket.payload.session_id :\n            useRequestSessionId(event);\n        const session = sessionId ?\n            await this.sessionManager.findOneById(sessionId) :\n            null;\n\n        // a ticket references exactly one pending session — without it\n        // (swept / expired mid-flight) the login can not complete.\n        if (ticket && !session) {\n            throw new UnauthorizedError();\n        }\n\n        const verified = await this.service.verify(\n            identity.id,\n            {\n                kind: data.kind,\n                response: data.response,\n            },\n            {\n                ipAddress: getRequestIP(event, { trustProxy: true }) ?? null,\n                userAgent: getRequestHeader(event, 'user-agent') ?? null,\n                clientId: identity.clientId,\n                ...(session ? {\n                    onVerified: async () => {\n                        await this.sessionManager.markMfaVerified(session);\n                    },\n                } : {}),\n            },\n        );\n        if (!verified) {\n            throw new EntityCredentialsInvalidError();\n        }\n\n        // Ticket flow: the factor is verified and mfa_at stamped — complete\n        // the login by minting the full grant for the pending session and\n        // consuming the ticket (single use).\n        if (ticket && session && this.mfaLoginService) {\n            const token = await this.mfaLoginService.complete({\n                session,\n                ticket: ticket.payload,\n                userName: identity.data.name,\n            });\n\n            return { verified: true, token };\n        }\n\n        return { verified: true };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AA4DA,IAAaiB,mCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA8C;EACtD,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,kBAAkBC,IAAID;CAC/B;;;;;;IAQA,aAAuBG,OAAmC;EACtD,MAAMC,WAAWX,mBAAmBU,KAAAA;EACpC,IAAIC,UACA,OAAO;GAAEA;GAAUC,QAAQ;EAAK;EAGpC,MAAMA,SAASV,yBAAyBQ,KAAAA;EACxC,IAAIE,QACA,OAAO;GAAED,UAAUC,OAAOD;GAAUC;EAAO;EAG/C,MAAM,IAAIf,kBAAAA;CACd;CAEA,MACMgB,OACF,OAC2C;EAC3C,MAAM,EAAEF,aAAa,KAAKF,aAAaC,KAAAA;EACvC,IAAIC,SAASG,SAASrB,aAAasB,MAC/B,OAAO;GACHC,UAAU;GACVC,oBAAoB;GACpBC,OAAO,CAAA;EACX;EAGJ,OAAO,KAAKb,QAAQc,UAAUR,SAASS,EAAE;CAC7C;CAEA,MACMC,KACF,MACA,OAC0B;EAC1B,MAAM,EAAEV,aAAa,KAAKF,aAAaC,KAAAA;EACvC,IAAIC,SAASG,SAASrB,aAAasB,MAC/B,MAAM,IAAIpB,gBAAgB,+CAAA;EAG9B,IACI,CAAC2B,QACD,CAACC,OAAOC,OAAO9B,qBAAAA,CAAAA,CAAuB+B,SAASH,KAAKI,IAAI,GAExD,MAAM,IAAI/B,gBAAgB,0BAAA;EAG9B,MAAM,KAAKU,QAAQsB,cAAchB,SAASS,IAAIE,KAAKI,MAAM,EAAEE,QAAQ3B,iBAAiBS,KAAAA,EAAO,CAAA;EAI3F,OAAO,EAAEmB,SAAS,KAAK;CAC3B;CAEA,MACMC,OACF,MACA,OACiD;EACjD,MAAM,EAAEnB,UAAUC,WAAW,KAAKH,aAAaC,KAAAA;EAC/C,IAAIC,SAASG,SAASrB,aAAasB,MAC/B,MAAM,IAAIpB,gBAAgB,gDAAA;EAG9B,IACI,CAAC2B,QACD,OAAOA,KAAKS,aAAa,YACzB,CAACT,KAAKS,YACN,CAACR,OAAOC,OAAO9B,qBAAAA,CAAAA,CAAuB+B,SAASH,KAAKI,IAAI,GAExD,MAAM,IAAI/B,gBAAgB,uCAAA;EAS9B,MAAMqC,YAAYpB,SACdA,OAAOqB,QAAQC,aACf/B,oBAAoBO,KAAAA;EACxB,MAAMyB,UAAUH,YACZ,MAAM,KAAK1B,eAAe8B,YAAYJ,SAAAA,IACtC;EAIJ,IAAIpB,UAAU,CAACuB,SACX,MAAM,IAAItC,kBAAAA;EAoBd,IAAI,CAACwC,MAjBkB,KAAKhC,QAAQyB,OAChCnB,SAASS,IACT;GACIM,MAAMJ,KAAKI;GACXK,UAAUT,KAAKS;EACnB,GACA;GACIO,WAAWvC,aAAaW,OAAO,EAAE6B,YAAY,KAAK,CAAA,KAAM;GACxDC,WAAW1C,iBAAiBY,OAAO,YAAA,KAAiB;GACpD+B,UAAU9B,SAAS8B;GACnB,GAAIN,UAAU,EACVO,YAAY,YAAA;IACR,MAAM,KAAKpC,eAAeqC,gBAAgBR,OAAAA;GAC9C,EACJ,IAAI,CAAC;EACT,CAAA,GAGA,MAAM,IAAIvC,8BAAAA;EAMd,IAAIgB,UAAUuB,WAAW,KAAK5B,iBAO1B,OAAO;GAAE8B,UAAU;GAAMO,OAAAA,MANL,KAAKrC,gBAAgBsC,SAAS;IAC9CV;IACAvB,QAAQA,OAAOqB;IACfa,UAAUnC,SAASW,KAAKyB;GAC5B,CAAA;EAE+B;EAGnC,OAAO,EAAEV,UAAU,KAAK;CAC5B;AACJ"}

package/dist/adapters/http/controllers/workflows/authorize/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/module.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGxC,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAGlE,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AACvF,OAAO,KAAK,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAGzF,qBACa,mBAAmB;IAI5B,SAAS,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAE9C,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,oBAAoB,EAAG,uCAAuC,CAAC;IAEzE,SAAS,CAAC,UAAU,EAAE,oBAAoB,CAAC;gBAI/B,GAAG,EAAE,0BAA0B;IAmBrC,OAAO,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAwB/D,KAAK,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;CA6C7D"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/module.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAUxC,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAGlE,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AACvF,OAAO,KAAK,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAMzF,qBACa,mBAAmB;IAI5B,SAAS,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAE9C,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,oBAAoB,EAAG,uCAAuC,CAAC;IAEzE,SAAS,CAAC,UAAU,EAAE,oBAAoB,CAAC;gBAI/B,GAAG,EAAE,0BAA0B;IAyBrC,OAAO,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAmC/D,KAAK,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;CA8F7D"}

package/dist/adapters/http/controllers/workflows/authorize/module.mjs

@@ -5,15 +5,17 @@ import { OAuth2AuthorizationCodeRequestValidator } from "../../../../../core/oau
 import "../../../../../core/index.mjs";
 import { readFromLocations } from "../../../request/helpers/locations.mjs";
 import "../../../request/index.mjs";
-import { HTTPOAuth2Authorizer } from "../../../adapters/oauth2/authorization/module.mjs";
-import "../../../adapters/index.mjs";
+import { ForceUserLoggedInMiddleware } from "../../../middleware/built-in/loggedin/user.mjs";
 import { sanitizeError } from "../../../../../utils/error.mjs";
 import "../../../../../utils/index.mjs";
-import { ForceUserLoggedInMiddleware } from "../../../middleware/built-in/loggedin/user.mjs";
 import "../../../middleware/index.mjs";
 import { renderUIPage } from "../../../ui/render.mjs";
 import "../../../ui/index.mjs";
+import { HTTPOAuth2Authorizer } from "../../../adapters/oauth2/authorization/module.mjs";
+import "../../../adapters/index.mjs";
+import { OAuth2AccessDeniedError, OAuth2ErrorCode, isOAuth2AccessDeniedError } from "@authup/specs";
 import { URL } from "node:url";
+import { useRequestQuery } from "@routup/basic/query";
 import { DContext, DController, DGet, DPost } from "@routup/decorators";
 //#region src/adapters/http/controllers/workflows/authorize/module.ts
 function _ts_decorate(decorators, target, key, desc) {
@@ -41,32 +43,60 @@ var AuthorizeController = class {
 		this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();
 		this.authorizer = new HTTPOAuth2Authorizer({
 			codeRequestVerifier: this.codeRequestVerifier,
-			accessTokenIssuer: ctx.accessTokenIssuer,
-			openIdTokenIssuer: ctx.openIdTokenIssuer,
 			codeIssuer: ctx.codeIssuer,
-			identityResolver: ctx.identityResolver
+			sessionManager: ctx.sessionManager,
+			eventService: ctx.eventService,
+			metrics: ctx.metrics,
+			promptLoginMaxAge: ctx.options.promptLoginMaxAge,
+			mfaFreshnessMaxAge: ctx.options.mfaFreshnessMaxAge,
+			mfaChallengeProvider: ctx.mfaChallengeProvider,
+			accessPolicyEvaluator: ctx.accessPolicyEvaluator,
+			consentService: ctx.consentService,
+			logger: ctx.logger
 		});
 	}
 	async confirm(event) {
-		const result = await this.authorizer.authorizeWithRequest(event);
-		const url = new URL(result.redirectUri);
-		if (result.state) url.searchParams.set("state", result.state);
-		if (result.authorizationCode) url.searchParams.set("code", result.authorizationCode);
-		if (result.accessToken) url.searchParams.set("access_token", result.accessToken);
-		if (result.idToken) url.searchParams.set("id_token", result.idToken);
-		return { url: url.href };
+		try {
+			const result = await this.authorizer.authorizeWithRequest(event);
+			const url = new URL(result.redirectUri);
+			if (result.state) url.searchParams.set("state", result.state);
+			if (result.authorizationCode) url.searchParams.set("code", result.authorizationCode);
+			return { url: url.href };
+		} catch (e) {
+			if (isOAuth2AccessDeniedError(e) && e.redirectUri) {
+				const url = new URL(e.redirectUri);
+				url.searchParams.set("error", OAuth2ErrorCode.ACCESS_DENIED);
+				if (e.state) url.searchParams.set("state", e.state);
+				return { url: url.href };
+			}
+			throw e;
+		}
 	}
 	async serve(event) {
 		let codeRequest;
 		let client;
 		let scopes;
+		let realm;
+		let redirectUriVerified = false;
 		let error;
 		try {
 			const merged = await readFromLocations(event, ["body", "query"]);
 			const data = await this.codeRequestValidator.run(merged);
 			const result = await this.codeRequestVerifier.verify(data);
-			client = result.client;
+			client = {
+				id: result.client.id,
+				name: result.client.name,
+				display_name: result.client.display_name,
+				built_in: result.client.built_in,
+				created_at: result.client.created_at
+			};
 			scopes = result.scopes;
+			redirectUriVerified = result.redirectUriVerified;
+			if (result.client.realm) realm = {
+				id: result.client.realm.id,
+				name: result.client.realm.name,
+				display_name: result.client.realm.display_name
+			};
 			codeRequest = result.data;
 		} catch (e) {
 			const normalized = sanitizeError(e);
@@ -75,6 +105,15 @@ var AuthorizeController = class {
 				message: normalized.message
 			};
 		}
+		if (!error) {
+			if (useRequestQuery(event).error === OAuth2ErrorCode.ACCESS_DENIED) {
+				const normalized = sanitizeError(OAuth2AccessDeniedError.forClient());
+				error = {
+					...normalized,
+					message: normalized.message
+				};
+			}
+		}
 		const requestURL = new URL(event.request.url);
 		return renderUIPage(event, {
 			url: "/authorize",
@@ -85,6 +124,8 @@ var AuthorizeController = class {
 					error,
 					client,
 					scopes,
+					realm,
+					redirectUriVerified,
 					features: this.options.features,
 					requestPath: `${requestURL.pathname}${requestURL.search}`
 				}

package/dist/adapters/http/controllers/workflows/authorize/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["DContext","DController","DGet","DPost","URL","ForceUserLoggedInMiddleware","HTTPOAuth2Authorizer","renderUIPage","readFromLocations","OAuth2AuthorizationCodeRequestValidator","sanitizeError","AuthorizeController","options","codeRequestVerifier","codeRequestValidator","authorizer","ctx","accessTokenIssuer","openIdTokenIssuer","codeIssuer","identityResolver","confirm","event","result","authorizeWithRequest","url","redirectUri","state","searchParams","set","authorizationCode","accessToken","idToken","href","serve","codeRequest","client","scopes","error","merged","data","run","verify","e","normalized","message","requestURL","request","payload","config","baseURL","features","requestPath","pathname","search"],"sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPost,\n} from '@routup/decorators';\nimport { URL } from 'node:url';\n\nimport type { IAppEvent } from 'routup';\nimport type { Client, OAuth2AuthorizationCodeRequest, Scope } from '@authup/core-kit';\nimport { ForceUserLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { HTTPOAuth2Authorizer } from '../../../adapters/index.ts';\nimport { renderUIPage } from '../../../ui/index.ts';\nimport { readFromLocations } from '../../../request/index.ts';\nimport type { IOAuth2AuthorizationCodeRequestVerifier } from '../../../../../core/index.ts';\nimport { OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';\nimport type { AuthorizeControllerContext, AuthorizeControllerOptions } from './types.ts';\nimport { sanitizeError } from '../../../../../utils/index.ts';\n\n@DController('/authorize')\nexport class AuthorizeController {\n    // todo: maybe /realms/<realm>/protocol/openid-connect/authorize\n    // todo: maybe /realms/<realm>/[...]/authorize\n\n    protected options: AuthorizeControllerOptions;\n\n    protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n    protected codeRequestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n    protected authorizer: HTTPOAuth2Authorizer;\n\n    // ---------------------------------------------------------\n\n    constructor(ctx: AuthorizeControllerContext) {\n        this.options = ctx.options;\n\n        this.codeRequestVerifier = ctx.codeRequestVerifier;\n\n        this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();\n\n        this.authorizer = new HTTPOAuth2Authorizer({\n            codeRequestVerifier: this.codeRequestVerifier,\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            openIdTokenIssuer: ctx.openIdTokenIssuer,\n            codeIssuer: ctx.codeIssuer,\n            identityResolver: ctx.identityResolver,\n        });\n    }\n\n    // ---------------------------------------------------------\n\n    @DPost('', [ForceUserLoggedInMiddleware])\n    async confirm(@DContext() event: IAppEvent): Promise<{ url: string }> {\n        const result = await this.authorizer.authorizeWithRequest(event);\n\n        const url = new URL(result.redirectUri);\n        if (result.state) {\n            url.searchParams.set('state', result.state);\n        }\n\n        if (result.authorizationCode) {\n            url.searchParams.set('code', result.authorizationCode);\n        }\n\n        if (result.accessToken) {\n            url.searchParams.set('access_token', result.accessToken);\n        }\n\n        if (result.idToken) {\n            url.searchParams.set('id_token', result.idToken);\n        }\n\n        return { url: url.href };\n    }\n\n    @DGet('', [])\n    async serve(@DContext() event: IAppEvent): Promise<string> {\n        let codeRequest : OAuth2AuthorizationCodeRequest | undefined;\n\n        let client : Client | undefined;\n        let scopes : Scope[] | undefined;\n\n        let error : Error | undefined;\n\n        try {\n            const merged = await readFromLocations(event, ['body', 'query']);\n            const data = await this.codeRequestValidator.run(merged);\n\n            const result = await this.codeRequestVerifier.verify(data);\n            client = result.client;\n            scopes = result.scopes;\n\n            codeRequest = result.data;\n        } catch (e) {\n            const normalized = sanitizeError(e);\n            error = {\n                ...normalized,\n                message: normalized.message,\n            };\n        }\n\n        // Path + query of the original request — the SSR page uses it as\n        // the same-origin `redirect` parameter on register / password links\n        // so those pages can lead back into this authorize request.\n        const requestURL = new URL(event.request.url);\n\n        return renderUIPage(event, {\n            url: '/authorize',\n            payload: {\n                config: { baseURL: this.options.baseURL },\n                data: {\n                    codeRequest,\n                    error,\n                    client,\n                    scopes,\n                    features: this.options.features,\n                    requestPath: `${requestURL.pathname}${requestURL.search}`,\n                },\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,IAAaW,sBAAb,MAAaA;CAICC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAiC;EACzC,KAAKJ,UAAUI,IAAIJ;EAEnB,KAAKC,sBAAsBG,IAAIH;EAE/B,KAAKC,uBAAuB,IAAIL,wCAAAA;EAEhC,KAAKM,aAAa,IAAIT,qBAAqB;GACvCO,qBAAqB,KAAKA;GAC1BI,mBAAmBD,IAAIC;GACvBC,mBAAmBF,IAAIE;GACvBC,YAAYH,IAAIG;GAChBC,kBAAkBJ,IAAII;EAC1B,CAAA;CACJ;CAIA,MACMC,QAAQ,OAAwD;EAClE,MAAME,SAAS,MAAM,KAAKR,WAAWS,qBAAqBF,KAAAA;EAE1D,MAAMG,MAAM,IAAIrB,IAAImB,OAAOG,WAAW;EACtC,IAAIH,OAAOI,OACPF,IAAIG,aAAaC,IAAI,SAASN,OAAOI,KAAK;EAG9C,IAAIJ,OAAOO,mBACPL,IAAIG,aAAaC,IAAI,QAAQN,OAAOO,iBAAiB;EAGzD,IAAIP,OAAOQ,aACPN,IAAIG,aAAaC,IAAI,gBAAgBN,OAAOQ,WAAW;EAG3D,IAAIR,OAAOS,SACPP,IAAIG,aAAaC,IAAI,YAAYN,OAAOS,OAAO;EAGnD,OAAO,EAAEP,KAAKA,IAAIQ,KAAK;CAC3B;CAEA,MACMC,MAAM,OAA+C;EACvD,IAAIC;EAEJ,IAAIC;EACJ,IAAIC;EAEJ,IAAIC;EAEJ,IAAI;GACA,MAAMC,SAAS,MAAM/B,kBAAkBc,OAAO,CAAC,QAAQ,OAAA,CAAQ;GAC/D,MAAMkB,OAAO,MAAM,KAAK1B,qBAAqB2B,IAAIF,MAAAA;GAEjD,MAAMhB,SAAS,MAAM,KAAKV,oBAAoB6B,OAAOF,IAAAA;GACrDJ,SAASb,OAAOa;GAChBC,SAASd,OAAOc;GAEhBF,cAAcZ,OAAOiB;EACzB,SAASG,GAAG;GACR,MAAMC,aAAalC,cAAciC,CAAAA;GACjCL,QAAQ;IACJ,GAAGM;IACHC,SAASD,WAAWC;GACxB;EACJ;EAKA,MAAMC,aAAa,IAAI1C,IAAIkB,MAAMyB,QAAQtB,GAAG;EAE5C,OAAOlB,aAAae,OAAO;GACvBG,KAAK;GACLuB,SAAS;IACLC,QAAQ,EAAEC,SAAS,KAAKtC,QAAQsC,QAAQ;IACxCV,MAAM;KACFL;KACAG;KACAF;KACAC;KACAc,UAAU,KAAKvC,QAAQuC;KACvBC,aAAa,GAAGN,WAAWO,WAAWP,WAAWQ;IACrD;GACJ;EACJ,CAAA;CACJ;AACJ;;YAtEgBjD,2BAAAA,CAAAA"}
+{"version":3,"file":"module.mjs","names":["DContext","DController","DGet","DPost","URL","useRequestQuery","OAuth2AccessDeniedError","OAuth2ErrorCode","isOAuth2AccessDeniedError","ForceUserLoggedInMiddleware","HTTPOAuth2Authorizer","renderUIPage","readFromLocations","OAuth2AuthorizationCodeRequestValidator","sanitizeError","AuthorizeController","options","codeRequestVerifier","codeRequestValidator","authorizer","ctx","codeIssuer","sessionManager","eventService","metrics","promptLoginMaxAge","mfaFreshnessMaxAge","mfaChallengeProvider","accessPolicyEvaluator","consentService","logger","confirm","event","result","authorizeWithRequest","url","redirectUri","state","searchParams","set","authorizationCode","href","e","ACCESS_DENIED","serve","codeRequest","client","scopes","realm","redirectUriVerified","error","merged","data","run","verify","id","name","display_name","built_in","created_at","normalized","message","query","forClient","requestURL","request","payload","config","baseURL","features","requestPath","pathname","search"],"sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPost,\n} from '@routup/decorators';\nimport { URL } from 'node:url';\n\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type {\n    Client,\n    OAuth2AuthorizationCodeRequest,\n    Realm,\n    Scope,\n} from '@authup/core-kit';\nimport { OAuth2AccessDeniedError, OAuth2ErrorCode, isOAuth2AccessDeniedError } from '@authup/specs';\nimport { ForceUserLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { HTTPOAuth2Authorizer } from '../../../adapters/index.ts';\nimport { renderUIPage } from '../../../ui/index.ts';\nimport { readFromLocations } from '../../../request/index.ts';\nimport type { IOAuth2AuthorizationCodeRequestVerifier } from '../../../../../core/index.ts';\nimport { OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';\nimport type { AuthorizeControllerContext, AuthorizeControllerOptions } from './types.ts';\nimport { sanitizeError } from '../../../../../utils/index.ts';\n\ntype RealmSummary = Pick<Realm, 'id' | 'name' | 'display_name'>;\ntype ClientSummary = Pick<Client, 'id' | 'name' | 'display_name' | 'built_in' | 'created_at'>;\n\n@DController('/authorize')\nexport class AuthorizeController {\n    // todo: maybe /realms/<realm>/protocol/openid-connect/authorize\n    // todo: maybe /realms/<realm>/[...]/authorize\n\n    protected options: AuthorizeControllerOptions;\n\n    protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n    protected codeRequestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n    protected authorizer: HTTPOAuth2Authorizer;\n\n    // ---------------------------------------------------------\n\n    constructor(ctx: AuthorizeControllerContext) {\n        this.options = ctx.options;\n\n        this.codeRequestVerifier = ctx.codeRequestVerifier;\n\n        this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();\n\n        this.authorizer = new HTTPOAuth2Authorizer({\n            codeRequestVerifier: this.codeRequestVerifier,\n            codeIssuer: ctx.codeIssuer,\n            sessionManager: ctx.sessionManager,\n            eventService: ctx.eventService,\n            metrics: ctx.metrics,\n            promptLoginMaxAge: ctx.options.promptLoginMaxAge,\n            mfaFreshnessMaxAge: ctx.options.mfaFreshnessMaxAge,\n            mfaChallengeProvider: ctx.mfaChallengeProvider,\n            accessPolicyEvaluator: ctx.accessPolicyEvaluator,\n            consentService: ctx.consentService,\n            logger: ctx.logger,\n        });\n    }\n\n    // ---------------------------------------------------------\n\n    @DPost('', [ForceUserLoggedInMiddleware])\n    async confirm(@DContext() event: IAppEvent): Promise<{ url: string }> {\n        try {\n            const result = await this.authorizer.authorizeWithRequest(event);\n\n            const url = new URL(result.redirectUri);\n            if (result.state) {\n                url.searchParams.set('state', result.state);\n            }\n\n            if (result.authorizationCode) {\n                url.searchParams.set('code', result.authorizationCode);\n            }\n\n            return { url: url.href };\n        } catch (e) {\n            // Access-policy denial (plan 052): with a pattern-verified\n            // redirect_uri the denial is answered as an error redirect\n            // (RFC 6749 §4.1.2.1) — the kit navigates the returned url like\n            // any success. Unverified → rethrow → 400 body → interactive\n            // denial card.\n            if (isOAuth2AccessDeniedError(e) && e.redirectUri) {\n                const url = new URL(e.redirectUri);\n                url.searchParams.set('error', OAuth2ErrorCode.ACCESS_DENIED);\n                if (e.state) {\n                    url.searchParams.set('state', e.state);\n                }\n\n                return { url: url.href };\n            }\n\n            throw e;\n        }\n    }\n\n    @DGet('', [])\n    async serve(@DContext() event: IAppEvent): Promise<string> {\n        let codeRequest : OAuth2AuthorizationCodeRequest | undefined;\n\n        let client : ClientSummary | undefined;\n        let scopes : Scope[] | undefined;\n\n        // Target realm summary (the client's realm) — the UI names it in the\n        // realm-mismatch notice. codeRequest.realm_id is only the id.\n        let realm : RealmSummary | undefined;\n\n        // Whether the request redirect_uri matched a registered client pattern —\n        // the UI must not offer an automatic \"return to application\" redirect to\n        // an unverified (pattern-less-client) redirect_uri.\n        let redirectUriVerified = false;\n\n        let error : Error | undefined;\n\n        try {\n            const merged = await readFromLocations(event, ['body', 'query']);\n            const data = await this.codeRequestValidator.run(merged);\n\n            const result = await this.codeRequestVerifier.verify(data);\n\n            // Trim the client to a deliberate DTO before it reaches the\n            // anonymous SSR hydration payload — never disclose redirect_uri\n            // patterns (the trusted-origin set), grant_types, internal\n            // base/root URLs, auth methods, or the secret storage flags to an\n            // unauthenticated visitor. (ClientEntity.secret is additionally\n            // select:false, so the secret is never loaded — but the DTO must not\n            // rely on that alone: a future entity/query change could unset it.)\n            client = {\n                id: result.client.id,\n                name: result.client.name,\n                display_name: result.client.display_name,\n                built_in: result.client.built_in,\n                created_at: result.client.created_at,\n            };\n            scopes = result.scopes;\n            redirectUriVerified = result.redirectUriVerified;\n\n            if (result.client.realm) {\n                realm = {\n                    id: result.client.realm.id,\n                    name: result.client.realm.name,\n                    display_name: result.client.realm.display_name,\n                };\n            }\n\n            codeRequest = result.data;\n        } catch (e) {\n            const normalized = sanitizeError(e);\n            error = {\n                ...normalized,\n                message: normalized.message,\n            };\n        }\n\n        // A recognized `error` query param (the federated-IdP callback\n        // redirects back here with error=access_denied on a policy denial)\n        // is mapped onto the hydration payload's error — neutral message,\n        // never attacker-controlled text.\n        if (!error) {\n            const query = useRequestQuery(event);\n            if (query.error === OAuth2ErrorCode.ACCESS_DENIED) {\n                const normalized = sanitizeError(OAuth2AccessDeniedError.forClient());\n                error = {\n                    ...normalized,\n                    message: normalized.message,\n                };\n            }\n        }\n\n        // Path + query of the original request — the SSR page uses it as\n        // the same-origin `redirect` parameter on register / password links\n        // so those pages can lead back into this authorize request.\n        const requestURL = new URL(event.request.url);\n\n        return renderUIPage(event, {\n            url: '/authorize',\n            payload: {\n                config: { baseURL: this.options.baseURL },\n                data: {\n                    codeRequest,\n                    error,\n                    client,\n                    scopes,\n                    realm,\n                    redirectUriVerified,\n                    features: this.options.features,\n                    requestPath: `${requestURL.pathname}${requestURL.search}`,\n                },\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,IAAae,sBAAb,MAAaA;CAICC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAiC;EACzC,KAAKJ,UAAUI,IAAIJ;EAEnB,KAAKC,sBAAsBG,IAAIH;EAE/B,KAAKC,uBAAuB,IAAIL,wCAAAA;EAEhC,KAAKM,aAAa,IAAIT,qBAAqB;GACvCO,qBAAqB,KAAKA;GAC1BI,YAAYD,IAAIC;GAChBC,gBAAgBF,IAAIE;GACpBC,cAAcH,IAAIG;GAClBC,SAASJ,IAAII;GACbC,mBAAmBL,IAAIJ,QAAQS;GAC/BC,oBAAoBN,IAAIJ,QAAQU;GAChCC,sBAAsBP,IAAIO;GAC1BC,uBAAuBR,IAAIQ;GAC3BC,gBAAgBT,IAAIS;GACpBC,QAAQV,IAAIU;EAChB,CAAA;CACJ;CAIA,MACMC,QAAQ,OAAwD;EAClE,IAAI;GACA,MAAME,SAAS,MAAM,KAAKd,WAAWe,qBAAqBF,KAAAA;GAE1D,MAAMG,MAAM,IAAI/B,IAAI6B,OAAOG,WAAW;GACtC,IAAIH,OAAOI,OACPF,IAAIG,aAAaC,IAAI,SAASN,OAAOI,KAAK;GAG9C,IAAIJ,OAAOO,mBACPL,IAAIG,aAAaC,IAAI,QAAQN,OAAOO,iBAAiB;GAGzD,OAAO,EAAEL,KAAKA,IAAIM,KAAK;EAC3B,SAASC,GAAG;GAMR,IAAIlC,0BAA0BkC,CAAAA,KAAMA,EAAEN,aAAa;IAC/C,MAAMD,MAAM,IAAI/B,IAAIsC,EAAEN,WAAW;IACjCD,IAAIG,aAAaC,IAAI,SAAShC,gBAAgBoC,aAAa;IAC3D,IAAID,EAAEL,OACFF,IAAIG,aAAaC,IAAI,SAASG,EAAEL,KAAK;IAGzC,OAAO,EAAEF,KAAKA,IAAIM,KAAK;GAC3B;GAEA,MAAMC;EACV;CACJ;CAEA,MACME,MAAM,OAA+C;EACvD,IAAIC;EAEJ,IAAIC;EACJ,IAAIC;EAIJ,IAAIC;EAKJ,IAAIC,sBAAsB;EAE1B,IAAIC;EAEJ,IAAI;GACA,MAAMC,SAAS,MAAMvC,kBAAkBoB,OAAO,CAAC,QAAQ,OAAA,CAAQ;GAC/D,MAAMoB,OAAO,MAAM,KAAKlC,qBAAqBmC,IAAIF,MAAAA;GAEjD,MAAMlB,SAAS,MAAM,KAAKhB,oBAAoBqC,OAAOF,IAAAA;GASrDN,SAAS;IACLS,IAAItB,OAAOa,OAAOS;IAClBC,MAAMvB,OAAOa,OAAOU;IACpBC,cAAcxB,OAAOa,OAAOW;IAC5BC,UAAUzB,OAAOa,OAAOY;IACxBC,YAAY1B,OAAOa,OAAOa;GAC9B;GACAZ,SAASd,OAAOc;GAChBE,sBAAsBhB,OAAOgB;GAE7B,IAAIhB,OAAOa,OAAOE,OACdA,QAAQ;IACJO,IAAItB,OAAOa,OAAOE,MAAMO;IACxBC,MAAMvB,OAAOa,OAAOE,MAAMQ;IAC1BC,cAAcxB,OAAOa,OAAOE,MAAMS;GACtC;GAGJZ,cAAcZ,OAAOmB;EACzB,SAASV,GAAG;GACR,MAAMkB,aAAa9C,cAAc4B,CAAAA;GACjCQ,QAAQ;IACJ,GAAGU;IACHC,SAASD,WAAWC;GACxB;EACJ;EAMA,IAAI,CAACX;OACa7C,gBAAgB2B,KAC1B8B,CAAAA,CAAMZ,UAAU3C,gBAAgBoC,eAAe;IAC/C,MAAMiB,aAAa9C,cAAcR,wBAAwByD,UAAS,CAAA;IAClEb,QAAQ;KACJ,GAAGU;KACHC,SAASD,WAAWC;IACxB;GACJ;;EAMJ,MAAMG,aAAa,IAAI5D,IAAI4B,MAAMiC,QAAQ9B,GAAG;EAE5C,OAAOxB,aAAaqB,OAAO;GACvBG,KAAK;GACL+B,SAAS;IACLC,QAAQ,EAAEC,SAAS,KAAKpD,QAAQoD,QAAQ;IACxChB,MAAM;KACFP;KACAK;KACAJ;KACAC;KACAC;KACAC;KACAoB,UAAU,KAAKrD,QAAQqD;KACvBC,aAAa,GAAGN,WAAWO,WAAWP,WAAWQ;IACrD;GACJ;EACJ,CAAA;CACJ;AACJ;;YAlIgB/D,2BAAAA,CAAAA"}

package/dist/adapters/http/controllers/workflows/authorize/types.d.ts

@@ -1,15 +1,34 @@
 import type { StatusResponseFeatures } from '@authup/core-http-kit';
-import type { IIdentityResolver, IOAuth2AuthorizationCodeIssuer, IOAuth2AuthorizationCodeRequestVerifier, IOAuth2OpenIDTokenIssuer, IOAuth2TokenIssuer } from '../../../../../core/index.ts';
+import type { Logger } from '@authup/server-kit';
+import type { IAuthFlowMetrics, IConsentService, IEventService, IOAuth2AccessPolicyEvaluator, IOAuth2AuthorizationCodeIssuer, IOAuth2AuthorizationCodeRequestVerifier, ISessionManager, IUserAuthenticatorChallengeProvider } from '../../../../../core/index.ts';
 export type AuthorizeControllerOptions = {
     baseURL: string;
     features: StatusResponseFeatures;
+    /**
+     * Max age (seconds) a `prompt=login` request accepts before forcing re-auth
+     * (config `promptLoginMaxAge`).
+     */
+    promptLoginMaxAge?: number;
+    /**
+     * Max age (seconds) of the session's mfa_at an acr_values step-up request
+     * accepts before forcing a fresh challenge (config `mfaFreshnessMaxAge`).
+     */
+    mfaFreshnessMaxAge?: number;
 };
 export type AuthorizeControllerContext = {
     options: AuthorizeControllerOptions;
-    accessTokenIssuer: IOAuth2TokenIssuer;
-    openIdTokenIssuer: IOAuth2OpenIDTokenIssuer;
     codeIssuer: IOAuth2AuthorizationCodeIssuer;
     codeRequestVerifier: IOAuth2AuthorizationCodeRequestVerifier;
-    identityResolver: IIdentityResolver;
+    sessionManager: ISessionManager;
+    eventService?: IEventService;
+    metrics?: IAuthFlowMetrics;
+    mfaChallengeProvider?: IUserAuthenticatorChallengeProvider;
+    accessPolicyEvaluator?: IOAuth2AccessPolicyEvaluator;
+    /**
+     * Persisted per-scope consent (plan 055): records the approved scope
+     * tokens after a successful (non-built_in) POST /authorize approval.
+     */
+    consentService?: IConsentService;
+    logger?: Logger;
 };
 //# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/controllers/workflows/authorize/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,EACR,iBAAiB,EACjB,8BAA8B,EAC9B,uCAAuC,EACvC,wBAAwB,EACxB,kBAAkB,EACrB,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,0BAA0B,GAAG;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,sBAAsB,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACrC,OAAO,EAAE,0BAA0B,CAAC;IAEpC,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,iBAAiB,EAAE,wBAAwB,CAAC;IAE5C,UAAU,EAAE,8BAA8B,CAAC;IAC3C,mBAAmB,EAAE,uCAAuC,CAAC;IAE7D,gBAAgB,EAAE,iBAAiB,CAAA;CACtC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EACR,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,4BAA4B,EAC5B,8BAA8B,EAC9B,uCAAuC,EACvC,eAAe,EACf,mCAAmC,EACtC,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,0BAA0B,GAAG;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,sBAAsB,CAAC;IACjC;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACrC,OAAO,EAAE,0BAA0B,CAAC;IAEpC,UAAU,EAAE,8BAA8B,CAAC;IAC3C,mBAAmB,EAAE,uCAAuC,CAAC;IAE7D,cAAc,EAAE,eAAe,CAAC;IAEhC,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAE3B,oBAAoB,CAAC,EAAE,mCAAmC,CAAC;IAC3D,qBAAqB,CAAC,EAAE,4BAA4B,CAAC;IAErD;;;OAGG;IACH,cAAc,CAAC,EAAE,eAAe,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC"}

package/dist/adapters/http/controllers/workflows/index.d.ts

@@ -1,6 +1,8 @@
 export * from './activate/index.ts';
+export * from './authenticator-challenge/index.ts';
 export * from './authorize/index.ts';
 export * from './jwks/index.ts';
+export * from './logout/index.ts';
 export * from './openid/index.ts';
 export * from './password-forgot/index.ts';
 export * from './password-reset/index.ts';

package/dist/adapters/http/controllers/workflows/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/controllers/workflows/index.ts"],"names":[],"mappings":"AAOA,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/controllers/workflows/index.ts"],"names":[],"mappings":"AAOA,cAAc,qBAAqB,CAAC;AACpC,cAAc,oCAAoC,CAAC;AACnD,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC"}

package/dist/adapters/http/controllers/workflows/index.mjs

@@ -3,11 +3,15 @@ import "node:url";
 import.meta.url;
 import { ActivateController } from "./activate/module.mjs";
 import "./activate/index.mjs";
+import { AuthenticatorChallengeController } from "./authenticator-challenge/module.mjs";
+import "./authenticator-challenge/index.mjs";
 import { AuthorizeController } from "./authorize/module.mjs";
 import "./authorize/index.mjs";
 import { getJwkRouteHandler, getJwksRouteHandler } from "./jwks/handlers/read.mjs";
 import { JwkController } from "./jwks/module.mjs";
 import "./jwks/index.mjs";
+import { LogoutController } from "./logout/module.mjs";
+import "./logout/index.mjs";
 import { OpenIDController } from "./openid/module.mjs";
 import "./openid/index.mjs";
 import { PasswordForgotController } from "./password-forgot/module.mjs";
@@ -20,4 +24,4 @@ import { StatusController } from "./status/module.mjs";
 import "./status/index.mjs";
 import { TokenController } from "./token/module.mjs";
 import "./token/index.mjs";
-export { ActivateController, AuthorizeController, JwkController, OpenIDController, PasswordForgotController, PasswordResetController, RegisterController, StatusController, TokenController, getJwkRouteHandler, getJwksRouteHandler };
+export { ActivateController, AuthenticatorChallengeController, AuthorizeController, JwkController, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, RegisterController, StatusController, TokenController, getJwkRouteHandler, getJwksRouteHandler };

package/dist/adapters/http/controllers/workflows/jwks/handlers/read.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../../../../../../src/adapters/http/controllers/workflows/jwks/handlers/read.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0CAA0C,CAAC;AAE1E,wBAAsB,mBAAmB,CACrC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EACjC,OAAO,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,IAAI,EAAE,gBAAgB,EAAE,CAAA;CAAE,CAAC,CA6BxC;AAED,wBAAsB,kBAAkB,CACpC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EACjC,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,gBAAgB,CAAC,CA+B5B"}
+{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../../../../../../src/adapters/http/controllers/workflows/jwks/handlers/read.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAgB,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0CAA0C,CAAC;AAG1E,wBAAsB,mBAAmB,CACrC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EACjC,OAAO,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,IAAI,EAAE,gBAAgB,EAAE,CAAA;CAAE,CAAC,CAwCxC;AAED,wBAAsB,kBAAkB,CACpC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EACjC,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,gBAAgB,CAAC,CAmC5B"}

package/dist/adapters/http/controllers/workflows/jwks/handlers/read.mjs

@@ -1,44 +1,58 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { buildCertificateJwkFields } from "../../../../../../core/key/certificate.mjs";
+import "../../../../../../core/index.mjs";
 import { In } from "typeorm";
+import { KeyStatus } from "@authup/core-kit";
 import { AsymmetricKey } from "@authup/server-kit";
-import { JWKError, JWKType } from "@authup/specs";
+import { JWKError, JWKType, JWKUse } from "@authup/specs";
 //#region src/adapters/http/controllers/workflows/jwks/handlers/read.ts
 async function getJwksRouteHandler(repository, realmId) {
 	const promises = (await repository.find({
 		where: {
 			type: In([JWKType.RSA, JWKType.EC]),
+			use: JWKUse.SIGNATURE,
+			status: In([KeyStatus.ACTIVE, KeyStatus.PASSIVE]),
 			...realmId ? { realm_id: realmId } : {}
 		},
 		order: { priority: "DESC" }
-	})).filter((entity) => !!entity.encryption_key).map((entity) => AsymmetricKey.fromBase64({
+	})).filter((entity) => !!entity.encryption_key && !!entity.signature_algorithm).map((entity) => AsymmetricKey.fromBase64({
 		format: "spki",
 		key: entity.encryption_key,
 		options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signature_algorithm)
-	}).then((container) => container.toJWK()).then((key) => ({
-		...key,
-		kid: entity.id,
-		alg: entity.signature_algorithm
-	})));
+	}).then((container) => container.toJWK()).then(async (key) => {
+		const certificateFields = await buildCertificateJwkFields(entity.certificate);
+		return {
+			...key,
+			kid: entity.id,
+			alg: entity.signature_algorithm,
+			...certificateFields
+		};
+	}));
 	return { keys: await Promise.all(promises) };
 }
 async function getJwkRouteHandler(repository, keyId, realmId) {
 	const entity = await repository.findOne({ where: {
 		type: In([JWKType.RSA, JWKType.EC]),
+		use: JWKUse.SIGNATURE,
+		status: In([KeyStatus.ACTIVE, KeyStatus.PASSIVE]),
 		id: keyId,
 		...realmId ? { realm_id: realmId } : {}
 	} });
 	if (!entity) throw JWKError.notFound(keyId);
-	if (!entity.encryption_key) throw JWKError.encryptionKeyMissing();
+	if (!entity.encryption_key || !entity.signature_algorithm) throw JWKError.encryptionKeyMissing();
+	const jsonWebKey = await (await AsymmetricKey.fromBase64({
+		format: "spki",
+		key: entity.encryption_key,
+		options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signature_algorithm)
+	})).toJWK();
+	const certificateFields = await buildCertificateJwkFields(entity.certificate);
 	return {
-		...await (await AsymmetricKey.fromBase64({
-			format: "spki",
-			key: entity.encryption_key,
-			options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signature_algorithm)
-		})).toJWK(),
+		...jsonWebKey,
 		kid: entity.id,
-		alg: entity.signature_algorithm
+		alg: entity.signature_algorithm,
+		...certificateFields
 	};
 }
 //#endregion

package/dist/adapters/http/controllers/workflows/jwks/handlers/read.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"read.mjs","names":["AsymmetricKey","JWKError","JWKType","In","getJwksRouteHandler","repository","realmId","entities","find","where","type","RSA","EC","realm_id","order","priority","promises","filter","entity","encryption_key","map","fromBase64","format","key","options","buildImportOptionsForJWTAlgorithm","signature_algorithm","then","container","toJWK","kid","id","alg","keys","Promise","all","getJwkRouteHandler","keyId","findOne","notFound","encryptionKeyMissing","jsonWebKey"],"sources":["../../../../../../../src/adapters/http/controllers/workflows/jwks/handlers/read.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { AsymmetricKey } from '@authup/server-kit';\nimport type { OAuth2JsonWebKey } from '@authup/specs';\nimport { JWKError, JWKType } from '@authup/specs';\nimport type { Repository } from 'typeorm';\nimport { In } from 'typeorm';\nimport type { KeyEntity } from '../../../../../database/domains/index.ts';\n\nexport async function getJwksRouteHandler(\n    repository: Repository<KeyEntity>,\n    realmId?: string,\n) : Promise<{ keys: OAuth2JsonWebKey[] }> {\n    const entities = await repository.find({\n        where: {\n            type: In([JWKType.RSA, JWKType.EC]),\n            ...(realmId ? { realm_id: realmId } : {}),\n        },\n        order: { priority: 'DESC' },\n    });\n\n    const promises = entities\n        .filter((entity): entity is KeyEntity & { encryption_key: string } => !!entity.encryption_key)\n        .map(\n            (entity) => AsymmetricKey\n                .fromBase64({\n                    format: 'spki',\n                    key: entity.encryption_key,\n                    options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signature_algorithm),\n                })\n                .then((container) => container.toJWK())\n                .then((key) => ({\n                    ...key,\n                    kid: entity.id,\n                    alg: entity.signature_algorithm,\n                })),\n        );\n\n    const keys = await Promise.all(promises);\n\n    return { keys };\n}\n\nexport async function getJwkRouteHandler(\n    repository: Repository<KeyEntity>,\n    keyId: string,\n    realmId?: string,\n) : Promise<OAuth2JsonWebKey> {\n    const entity = await repository.findOne({\n        where: {\n            type: In([JWKType.RSA, JWKType.EC]),\n            id: keyId,\n            ...(realmId ? { realm_id: realmId } : {}),\n        },\n    });\n\n    if (!entity) {\n        throw JWKError.notFound(keyId);\n    }\n\n    if (!entity.encryption_key) {\n        throw JWKError.encryptionKeyMissing();\n    }\n\n    const container = await AsymmetricKey\n        .fromBase64({\n            format: 'spki',\n            key: entity.encryption_key,\n            options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signature_algorithm),\n        });\n\n    const jsonWebKey = await container.toJWK();\n\n    return {\n        ...jsonWebKey,\n        kid: entity.id,\n        alg: entity.signature_algorithm,\n    };\n}\n"],"mappings":";;;;;;;AAcA,eAAsBI,oBAClBC,YACAC,SAAgB;CAUhB,MAAMU,YAAWT,MARMF,WAAWG,KAAK;EACnCC,OAAO;GACHC,MAAMP,GAAG,CAACD,QAAQS,KAAKT,QAAQU,EAAAA,CAAG;GAClC,GAAIN,UAAU,EAAEO,UAAUP,QAAQ,IAAI,CAAC;EAC3C;EACAQ,OAAO,EAAEC,UAAU,OAAO;CAC9B,CAAA,EAAA,CAGKE,QAAQC,WAA6D,CAAC,CAACA,OAAOC,cAAc,CAAA,CAC5FC,KACIF,WAAWlB,cACPqB,WAAW;EACRC,QAAQ;EACRC,KAAKL,OAAOC;EACZK,SAASxB,cAAcyB,kCAAkCP,OAAOQ,mBAAmB;CACvF,CAAA,CAAA,CACCC,MAAMC,cAAcA,UAAUC,MAAK,CAAA,CAAA,CACnCF,MAAMJ,SAAS;EACZ,GAAGA;EACHO,KAAKZ,OAAOa;EACZC,KAAKd,OAAOQ;CAChB,EAAA,CAAA;CAKZ,OAAO,EAAEO,MAAAA,MAFUC,QAAQC,IAAInB,QAAAA,EAEjB;AAClB;AAEA,eAAsBoB,mBAClB/B,YACAgC,OACA/B,SAAgB;CAEhB,MAAMY,SAAS,MAAMb,WAAWiC,QAAQ,EACpC7B,OAAO;EACHC,MAAMP,GAAG,CAACD,QAAQS,KAAKT,QAAQU,EAAAA,CAAG;EAClCmB,IAAIM;EACJ,GAAI/B,UAAU,EAAEO,UAAUP,QAAQ,IAAI,CAAC;CAC3C,EACJ,CAAA;CAEA,IAAI,CAACY,QACD,MAAMjB,SAASsC,SAASF,KAAAA;CAG5B,IAAI,CAACnB,OAAOC,gBACR,MAAMlB,SAASuC,qBAAoB;CAYvC,OAAO;EACH,GAAGC,OAHkBb,MAPD5B,cACnBqB,WAAW;GACRC,QAAQ;GACRC,KAAKL,OAAOC;GACZK,SAASxB,cAAcyB,kCAAkCP,OAAOQ,mBAAmB;EACvF,CAAA,EAAA,CAE+BG,MAAK;EAIpCC,KAAKZ,OAAOa;EACZC,KAAKd,OAAOQ;CAChB;AACJ"}
+{"version":3,"file":"read.mjs","names":["KeyStatus","AsymmetricKey","JWKError","JWKType","JWKUse","In","buildCertificateJwkFields","getJwksRouteHandler","repository","realmId","entities","find","where","type","RSA","EC","use","SIGNATURE","status","ACTIVE","PASSIVE","realm_id","order","priority","promises","filter","entity","encryption_key","signature_algorithm","map","fromBase64","format","key","options","buildImportOptionsForJWTAlgorithm","then","container","toJWK","certificateFields","certificate","kid","id","alg","keys","Promise","all","getJwkRouteHandler","keyId","findOne","notFound","encryptionKeyMissing","jsonWebKey"],"sources":["../../../../../../../src/adapters/http/controllers/workflows/jwks/handlers/read.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { KeyStatus } from '@authup/core-kit';\nimport { AsymmetricKey } from '@authup/server-kit';\nimport type { JWTAlgorithm, OAuth2JsonWebKey } from '@authup/specs';\nimport { JWKError, JWKType, JWKUse } from '@authup/specs';\nimport type { Repository } from 'typeorm';\nimport { In } from 'typeorm';\nimport type { KeyEntity } from '../../../../../database/domains/index.ts';\nimport { buildCertificateJwkFields } from '../../../../../../core/index.ts';\n\nexport async function getJwksRouteHandler(\n    repository: Repository<KeyEntity>,\n    realmId?: string,\n) : Promise<{ keys: OAuth2JsonWebKey[] }> {\n    const entities = await repository.find({\n        where: {\n            type: In([JWKType.RSA, JWKType.EC]),\n            use: JWKUse.SIGNATURE,\n            // active + passive verify; disabled keys never publish.\n            status: In([KeyStatus.ACTIVE, KeyStatus.PASSIVE]),\n            ...(realmId ? { realm_id: realmId } : {}),\n        },\n        order: { priority: 'DESC' },\n    });\n\n    const promises = entities\n        .filter(\n            (entity): entity is KeyEntity & { encryption_key: string, signature_algorithm: `${JWTAlgorithm}` } => !!entity.encryption_key &&\n                !!entity.signature_algorithm,\n        )\n        .map(\n            (entity) => AsymmetricKey\n                .fromBase64({\n                    format: 'spki',\n                    key: entity.encryption_key,\n                    options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signature_algorithm),\n                })\n                .then((container) => container.toJWK())\n                .then(async (key) => {\n                    const certificateFields = await buildCertificateJwkFields(entity.certificate);\n\n                    return {\n                        ...key,\n                        kid: entity.id,\n                        alg: entity.signature_algorithm,\n                        ...certificateFields,\n                    };\n                }),\n        );\n\n    const keys = await Promise.all(promises);\n\n    return { keys };\n}\n\nexport async function getJwkRouteHandler(\n    repository: Repository<KeyEntity>,\n    keyId: string,\n    realmId?: string,\n) : Promise<OAuth2JsonWebKey> {\n    const entity = await repository.findOne({\n        where: {\n            type: In([JWKType.RSA, JWKType.EC]),\n            use: JWKUse.SIGNATURE,\n            status: In([KeyStatus.ACTIVE, KeyStatus.PASSIVE]),\n            id: keyId,\n            ...(realmId ? { realm_id: realmId } : {}),\n        },\n    });\n\n    if (!entity) {\n        throw JWKError.notFound(keyId);\n    }\n\n    if (!entity.encryption_key || !entity.signature_algorithm) {\n        throw JWKError.encryptionKeyMissing();\n    }\n\n    const container = await AsymmetricKey\n        .fromBase64({\n            format: 'spki',\n            key: entity.encryption_key,\n            options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signature_algorithm),\n        });\n\n    const jsonWebKey = await container.toJWK();\n    const certificateFields = await buildCertificateJwkFields(entity.certificate);\n\n    return {\n        ...jsonWebKey,\n        kid: entity.id,\n        alg: entity.signature_algorithm,\n        ...certificateFields,\n    };\n}\n"],"mappings":";;;;;;;;;;AAgBA,eAAsBO,oBAClBC,YACAC,SAAgB;CAahB,MAAMe,YAAWd,MAXMF,WAAWG,KAAK;EACnCC,OAAO;GACHC,MAAMR,GAAG,CAACF,QAAQW,KAAKX,QAAQY,EAAAA,CAAG;GAClCC,KAAKZ,OAAOa;GAEZC,QAAQb,GAAG,CAACL,UAAUmB,QAAQnB,UAAUoB,OAAAA,CAAQ;GAChD,GAAIX,UAAU,EAAEY,UAAUZ,QAAQ,IAAI,CAAC;EAC3C;EACAa,OAAO,EAAEC,UAAU,OAAO;CAC9B,CAAA,EAAA,CAGKE,QACIC,WAAqG,CAAC,CAACA,OAAOC,kBAC3G,CAAC,CAACD,OAAOE,mBAAmB,CAAA,CAEnCC,KACIH,WAAWzB,cACP6B,WAAW;EACRC,QAAQ;EACRC,KAAKN,OAAOC;EACZM,SAAShC,cAAciC,kCAAkCR,OAAOE,mBAAmB;CACvF,CAAA,CAAA,CACCO,MAAMC,cAAcA,UAAUC,MAAK,CAAA,CAAA,CACnCF,KAAK,OAAOH,QAAAA;EACT,MAAMM,oBAAoB,MAAMhC,0BAA0BoB,OAAOa,WAAW;EAE5E,OAAO;GACH,GAAGP;GACHQ,KAAKd,OAAOe;GACZC,KAAKhB,OAAOE;GACZ,GAAGU;EACP;CACJ,CAAA,CAAA;CAKZ,OAAO,EAAEK,MAAAA,MAFUC,QAAQC,IAAIrB,QAAAA,EAEjB;AAClB;AAEA,eAAsBsB,mBAClBtC,YACAuC,OACAtC,SAAgB;CAEhB,MAAMiB,SAAS,MAAMlB,WAAWwC,QAAQ,EACpCpC,OAAO;EACHC,MAAMR,GAAG,CAACF,QAAQW,KAAKX,QAAQY,EAAAA,CAAG;EAClCC,KAAKZ,OAAOa;EACZC,QAAQb,GAAG,CAACL,UAAUmB,QAAQnB,UAAUoB,OAAAA,CAAQ;EAChDqB,IAAIM;EACJ,GAAItC,UAAU,EAAEY,UAAUZ,QAAQ,IAAI,CAAC;CAC3C,EACJ,CAAA;CAEA,IAAI,CAACiB,QACD,MAAMxB,SAAS+C,SAASF,KAAAA;CAG5B,IAAI,CAACrB,OAAOC,kBAAkB,CAACD,OAAOE,qBAClC,MAAM1B,SAASgD,qBAAoB;CAUvC,MAAMC,aAAa,OAAMf,MAPDnC,cACnB6B,WAAW;EACRC,QAAQ;EACRC,KAAKN,OAAOC;EACZM,SAAShC,cAAciC,kCAAkCR,OAAOE,mBAAmB;CACvF,CAAA,EAAA,CAE+BS,MAAK;CACxC,MAAMC,oBAAoB,MAAMhC,0BAA0BoB,OAAOa,WAAW;CAE5E,OAAO;EACH,GAAGY;EACHX,KAAKd,OAAOe;EACZC,KAAKhB,OAAOE;EACZ,GAAGU;CACP;AACJ"}

package/dist/adapters/http/controllers/workflows/jwks/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/jwks/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAStD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAC;AAGvE,MAAM,MAAM,oBAAoB,GAAG;IAC/B,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAA;CACpC,CAAC;AAEF,qBACa,aAAa;IACtB,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;gBAEhC,GAAG,EAAE,oBAAoB;IAK/B,WAAW,CACD,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC;QAAE,IAAI,EAAE,gBAAgB,EAAE,CAAA;KAAE,CAAC;IAkClC,UAAU,CAAc,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;CA+BvE"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/jwks/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAgB,gBAAgB,EAAE,MAAM,eAAe,CAAC;AASpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAC;AAIvE,MAAM,MAAM,oBAAoB,GAAG;IAC/B,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAA;CACpC,CAAC;AAEF,qBACa,aAAa;IACtB,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;gBAEhC,GAAG,EAAE,oBAAoB;IAK/B,WAAW,CACD,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC;QAAE,IAAI,EAAE,gBAAgB,EAAE,CAAA;KAAE,CAAC;IA6ClC,UAAU,CAAc,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;CAmCvE"}

package/dist/adapters/http/controllers/workflows/jwks/module.mjs

@@ -1,11 +1,14 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { buildCertificateJwkFields } from "../../../../../core/key/certificate.mjs";
+import "../../../../../core/index.mjs";
 import { getRequestStringParam } from "../../../request/helpers/param-id.mjs";
 import "../../../request/index.mjs";
 import { In } from "typeorm";
+import { KeyStatus } from "@authup/core-kit";
 import { AsymmetricKey } from "@authup/server-kit";
-import { JWKError, JWKType } from "@authup/specs";
+import { JWKError, JWKType, JWKUse } from "@authup/specs";
 import { DContext, DController, DGet, DPath } from "@routup/decorators";
 //#region src/adapters/http/controllers/workflows/jwks/module.ts
 function _ts_decorate(decorators, target, key, desc) {
@@ -32,35 +35,46 @@ var JwkController = class {
 		const promises = (await this.repository.find({
 			where: {
 				type: In([JWKType.RSA, JWKType.EC]),
+				use: JWKUse.SIGNATURE,
+				status: In([KeyStatus.ACTIVE, KeyStatus.PASSIVE]),
 				...realmId ? { realm_id: realmId } : {}
 			},
 			order: { priority: "DESC" }
-		})).filter((entity) => !!entity.encryption_key).map((entity) => AsymmetricKey.fromBase64({
+		})).filter((entity) => !!entity.encryption_key && !!entity.signature_algorithm).map((entity) => AsymmetricKey.fromBase64({
 			format: "spki",
 			key: entity.encryption_key,
 			options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signature_algorithm)
-		}).then((container) => container.toJWK()).then((key) => ({
-			...key,
-			kid: entity.id,
-			alg: entity.signature_algorithm
-		})));
+		}).then((container) => container.toJWK()).then(async (key) => {
+			const certificateFields = await buildCertificateJwkFields(entity.certificate);
+			return {
+				...key,
+				kid: entity.id,
+				alg: entity.signature_algorithm,
+				...certificateFields
+			};
+		}));
 		return { keys: await Promise.all(promises) };
 	}
 	async getOneJwks(id) {
 		const entity = await this.repository.findOne({ where: {
 			type: In([JWKType.RSA, JWKType.EC]),
+			use: JWKUse.SIGNATURE,
+			status: In([KeyStatus.ACTIVE, KeyStatus.PASSIVE]),
 			id
 		} });
 		if (!entity) throw JWKError.notFound(id);
-		if (!entity.encryption_key) throw JWKError.encryptionKeyMissing();
+		if (!entity.encryption_key || !entity.signature_algorithm) throw JWKError.encryptionKeyMissing();
+		const jsonWebKey = await (await AsymmetricKey.fromBase64({
+			format: "spki",
+			key: entity.encryption_key,
+			options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signature_algorithm)
+		})).toJWK();
+		const certificateFields = await buildCertificateJwkFields(entity.certificate);
 		return {
-			...await (await AsymmetricKey.fromBase64({
-				format: "spki",
-				key: entity.encryption_key,
-				options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signature_algorithm)
-			})).toJWK(),
+			...jsonWebKey,
 			kid: entity.id,
-			alg: entity.signature_algorithm
+			alg: entity.signature_algorithm,
+			...certificateFields
 		};
 	}
 };