@authup/server-core 1.0.0-beta.51 → 1.0.0-beta.53

package/dist/adapters/http/controllers/workflows/jwks/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["JWKError","JWKType","AsymmetricKey","DContext","DController","DGet","DPath","In","getRequestStringParam","JwkController","repository","ctx","getManyJwks","event","realmId","entities","find","where","type","RSA","EC","realm_id","order","priority","promises","filter","entity","encryption_key","map","fromBase64","format","key","options","buildImportOptionsForJWTAlgorithm","signature_algorithm","then","container","toJWK","kid","id","alg","keys","Promise","all","getOneJwks","findOne","notFound","encryptionKeyMissing","jsonWebKey"],"sources":["../../../../../../src/adapters/http/controllers/workflows/jwks/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2JsonWebKey } from '@authup/specs';\nimport { JWKError, JWKType } from '@authup/specs';\nimport { AsymmetricKey } from '@authup/server-kit';\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPath,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport type { Repository } from 'typeorm';\nimport { In } from 'typeorm';\nimport type { KeyEntity } from '../../../../database/domains/index.ts';\nimport { getRequestStringParam } from '../../../request/index.ts';\n\nexport type JwkControllerContext = {\n    repository: Repository<KeyEntity>\n};\n\n@DController('')\nexport class JwkController {\n    protected repository: Repository<KeyEntity>;\n\n    constructor(ctx: JwkControllerContext) {\n        this.repository = ctx.repository;\n    }\n\n    @DGet('/jwks', [])\n    async getManyJwks(\n        @DContext() event: IAppEvent,\n    ): Promise<{ keys: OAuth2JsonWebKey[] }> {\n        const realmId = getRequestStringParam(event, 'realmId');\n\n        const entities = await this.repository.find({\n            where: {\n                type: In([JWKType.RSA, JWKType.EC]),\n                ...(realmId ? { realm_id: realmId } : {}),\n            },\n            order: { priority: 'DESC' },\n        });\n\n        const promises = entities\n            .filter((entity): entity is KeyEntity & { encryption_key: string } => !!entity.encryption_key)\n            .map(\n                (entity) => AsymmetricKey\n                    .fromBase64({\n                        format: 'spki',\n                        key: entity.encryption_key,\n                        options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signature_algorithm),\n                    })\n                    .then((container) => container.toJWK())\n                    .then((key) => ({\n                        ...key,\n                        kid: entity.id,\n                        alg: entity.signature_algorithm,\n                    })),\n            );\n\n        const keys = await Promise.all(promises);\n\n        return { keys };\n    }\n\n    @DGet('/jwks/:id', [])\n    async getOneJwks(@DPath('id') id: string): Promise<OAuth2JsonWebKey> {\n        const entity = await this.repository.findOne({\n            where: {\n                type: In([JWKType.RSA, JWKType.EC]),\n                id,\n            },\n        });\n\n        if (!entity) {\n            throw JWKError.notFound(id);\n        }\n\n        if (!entity.encryption_key) {\n            throw JWKError.encryptionKeyMissing();\n        }\n\n        const container = await AsymmetricKey\n            .fromBase64({\n                format: 'spki',\n                key: entity.encryption_key,\n                options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signature_algorithm),\n            });\n\n        const jsonWebKey = await container.toJWK();\n\n        return {\n            ...jsonWebKey,\n            kid: entity.id,\n            alg: entity.signature_algorithm,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;AAKC,SAAA,aAAA,YAAA,QAAA,KAAA,MAAA;;;;;;;;;;;;;;AAsBD,IAAaS,gBAAb,MAAaA;CACCC;CAEV,YAAYC,KAA2B;EACnC,KAAKD,aAAaC,IAAID;CAC1B;CAEA,MACME,YACF,OACqC;EACrC,MAAME,UAAUN,sBAAsBK,OAAO,SAAA;EAU7C,MAAMW,YAAWT,MARM,KAAKL,WAAWM,KAAK;GACxCC,OAAO;IACHC,MAAMX,GAAG,CAACN,QAAQkB,KAAKlB,QAAQmB,EAAAA,CAAG;IAClC,GAAIN,UAAU,EAAEO,UAAUP,QAAQ,IAAI,CAAC;GAC3C;GACAQ,OAAO,EAAEC,UAAU,OAAO;EAC9B,CAAA,EAAA,CAGKE,QAAQC,WAA6D,CAAC,CAACA,OAAOC,cAAc,CAAA,CAC5FC,KACIF,WAAWxB,cACP2B,WAAW;GACRC,QAAQ;GACRC,KAAKL,OAAOC;GACZK,SAAS9B,cAAc+B,kCAAkCP,OAAOQ,mBAAmB;EACvF,CAAA,CAAA,CACCC,MAAMC,cAAcA,UAAUC,MAAK,CAAA,CAAA,CACnCF,MAAMJ,SAAS;GACZ,GAAGA;GACHO,KAAKZ,OAAOa;GACZC,KAAKd,OAAOQ;EAChB,EAAA,CAAA;EAKZ,OAAO,EAAEO,MAAAA,MAFUC,QAAQC,IAAInB,QAAAA,EAEjB;CAClB;CAEA,MACMoB,WAAW,IAAoD;EACjE,MAAMlB,SAAS,MAAM,KAAKhB,WAAWmC,QAAQ,EACzC5B,OAAO;GACHC,MAAMX,GAAG,CAACN,QAAQkB,KAAKlB,QAAQmB,EAAAA,CAAG;GAClCmB;EACJ,EACJ,CAAA;EAEA,IAAI,CAACb,QACD,MAAM1B,SAAS8C,SAASP,EAAAA;EAG5B,IAAI,CAACb,OAAOC,gBACR,MAAM3B,SAAS+C,qBAAoB;EAYvC,OAAO;GACH,GAAGC,OAHkBZ,MAPDlC,cACnB2B,WAAW;IACRC,QAAQ;IACRC,KAAKL,OAAOC;IACZK,SAAS9B,cAAc+B,kCAAkCP,OAAOQ,mBAAmB;GACvF,CAAA,EAAA,CAE+BG,MAAK;GAIpCC,KAAKZ,OAAOa;GACZC,KAAKd,OAAOQ;EAChB;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["KeyStatus","JWKError","JWKType","JWKUse","AsymmetricKey","DContext","DController","DGet","DPath","In","buildCertificateJwkFields","getRequestStringParam","JwkController","repository","ctx","getManyJwks","event","realmId","entities","find","where","type","RSA","EC","use","SIGNATURE","status","ACTIVE","PASSIVE","realm_id","order","priority","promises","filter","entity","encryption_key","signature_algorithm","map","fromBase64","format","key","options","buildImportOptionsForJWTAlgorithm","then","container","toJWK","certificateFields","certificate","kid","id","alg","keys","Promise","all","getOneJwks","findOne","notFound","encryptionKeyMissing","jsonWebKey"],"sources":["../../../../../../src/adapters/http/controllers/workflows/jwks/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { KeyStatus } from '@authup/core-kit';\nimport type { JWTAlgorithm, OAuth2JsonWebKey } from '@authup/specs';\nimport { JWKError, JWKType, JWKUse } from '@authup/specs';\nimport { AsymmetricKey } from '@authup/server-kit';\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPath,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport type { Repository } from 'typeorm';\nimport { In } from 'typeorm';\nimport type { KeyEntity } from '../../../../database/domains/index.ts';\nimport { buildCertificateJwkFields } from '../../../../../core/index.ts';\nimport { getRequestStringParam } from '../../../request/index.ts';\n\nexport type JwkControllerContext = {\n    repository: Repository<KeyEntity>\n};\n\n@DController('')\nexport class JwkController {\n    protected repository: Repository<KeyEntity>;\n\n    constructor(ctx: JwkControllerContext) {\n        this.repository = ctx.repository;\n    }\n\n    @DGet('/jwks', [])\n    async getManyJwks(\n        @DContext() event: IAppEvent,\n    ): Promise<{ keys: OAuth2JsonWebKey[] }> {\n        const realmId = getRequestStringParam(event, 'realmId');\n\n        const entities = await this.repository.find({\n            where: {\n                type: In([JWKType.RSA, JWKType.EC]),\n                use: JWKUse.SIGNATURE,\n                // active + passive verify; disabled keys never publish.\n                status: In([KeyStatus.ACTIVE, KeyStatus.PASSIVE]),\n                ...(realmId ? { realm_id: realmId } : {}),\n            },\n            order: { priority: 'DESC' },\n        });\n\n        const promises = entities\n            .filter(\n                (entity): entity is KeyEntity & { encryption_key: string, signature_algorithm: `${JWTAlgorithm}` } => !!entity.encryption_key &&\n                    !!entity.signature_algorithm,\n            )\n            .map(\n                (entity) => AsymmetricKey\n                    .fromBase64({\n                        format: 'spki',\n                        key: entity.encryption_key,\n                        options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signature_algorithm),\n                    })\n                    .then((container) => container.toJWK())\n                    .then(async (key) => {\n                        const certificateFields = await buildCertificateJwkFields(entity.certificate);\n\n                        return {\n                            ...key,\n                            kid: entity.id,\n                            alg: entity.signature_algorithm,\n                            ...certificateFields,\n                        };\n                    }),\n            );\n\n        const keys = await Promise.all(promises);\n\n        return { keys };\n    }\n\n    @DGet('/jwks/:id', [])\n    async getOneJwks(@DPath('id') id: string): Promise<OAuth2JsonWebKey> {\n        const entity = await this.repository.findOne({\n            where: {\n                type: In([JWKType.RSA, JWKType.EC]),\n                use: JWKUse.SIGNATURE,\n                status: In([KeyStatus.ACTIVE, KeyStatus.PASSIVE]),\n                id,\n            },\n        });\n\n        if (!entity) {\n            throw JWKError.notFound(id);\n        }\n\n        if (!entity.encryption_key || !entity.signature_algorithm) {\n            throw JWKError.encryptionKeyMissing();\n        }\n\n        const container = await AsymmetricKey\n            .fromBase64({\n                format: 'spki',\n                key: entity.encryption_key,\n                options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signature_algorithm),\n            });\n\n        const jsonWebKey = await container.toJWK();\n        const certificateFields = await buildCertificateJwkFields(entity.certificate);\n\n        return {\n            ...jsonWebKey,\n            kid: entity.id,\n            alg: entity.signature_algorithm,\n            ...certificateFields,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,IAAaY,gBAAb,MAAaA;CACCC;CAEV,YAAYC,KAA2B;EACnC,KAAKD,aAAaC,IAAID;CAC1B;CAEA,MACME,YACF,OACqC;EACrC,MAAME,UAAUN,sBAAsBK,OAAO,SAAA;EAa7C,MAAMgB,YAAWd,MAXM,KAAKL,WAAWM,KAAK;GACxCC,OAAO;IACHC,MAAMZ,GAAG,CAACP,QAAQoB,KAAKpB,QAAQqB,EAAAA,CAAG;IAClCC,KAAKrB,OAAOsB;IAEZC,QAAQjB,GAAG,CAACT,UAAU2B,QAAQ3B,UAAU4B,OAAAA,CAAQ;IAChD,GAAIX,UAAU,EAAEY,UAAUZ,QAAQ,IAAI,CAAC;GAC3C;GACAa,OAAO,EAAEC,UAAU,OAAO;EAC9B,CAAA,EAAA,CAGKE,QACIC,WAAqG,CAAC,CAACA,OAAOC,kBAC3G,CAAC,CAACD,OAAOE,mBAAmB,CAAA,CAEnCC,KACIH,WAAW9B,cACPkC,WAAW;GACRC,QAAQ;GACRC,KAAKN,OAAOC;GACZM,SAASrC,cAAcsC,kCAAkCR,OAAOE,mBAAmB;EACvF,CAAA,CAAA,CACCO,MAAMC,cAAcA,UAAUC,MAAK,CAAA,CAAA,CACnCF,KAAK,OAAOH,QAAAA;GACT,MAAMM,oBAAoB,MAAMpC,0BAA0BwB,OAAOa,WAAW;GAE5E,OAAO;IACH,GAAGP;IACHQ,KAAKd,OAAOe;IACZC,KAAKhB,OAAOE;IACZ,GAAGU;GACP;EACJ,CAAA,CAAA;EAKZ,OAAO,EAAEK,MAAAA,MAFUC,QAAQC,IAAIrB,QAAAA,EAEjB;CAClB;CAEA,MACMsB,WAAW,IAAoD;EACjE,MAAMpB,SAAS,MAAM,KAAKrB,WAAW0C,QAAQ,EACzCnC,OAAO;GACHC,MAAMZ,GAAG,CAACP,QAAQoB,KAAKpB,QAAQqB,EAAAA,CAAG;GAClCC,KAAKrB,OAAOsB;GACZC,QAAQjB,GAAG,CAACT,UAAU2B,QAAQ3B,UAAU4B,OAAAA,CAAQ;GAChDqB;EACJ,EACJ,CAAA;EAEA,IAAI,CAACf,QACD,MAAMjC,SAASuD,SAASP,EAAAA;EAG5B,IAAI,CAACf,OAAOC,kBAAkB,CAACD,OAAOE,qBAClC,MAAMnC,SAASwD,qBAAoB;EAUvC,MAAMC,aAAa,OAAMd,MAPDxC,cACnBkC,WAAW;GACRC,QAAQ;GACRC,KAAKN,OAAOC;GACZM,SAASrC,cAAcsC,kCAAkCR,OAAOE,mBAAmB;EACvF,CAAA,EAAA,CAE+BS,MAAK;EACxC,MAAMC,oBAAoB,MAAMpC,0BAA0BwB,OAAOa,WAAW;EAE5E,OAAO;GACH,GAAGW;GACHV,KAAKd,OAAOe;GACZC,KAAKhB,OAAOE;GACZ,GAAGU;EACP;CACJ;AACJ"}

package/dist/adapters/http/controllers/workflows/logout/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/controllers/workflows/logout/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/logout/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/adapters/http/controllers/workflows/logout/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { LogoutController } from "./module.mjs";
+export { LogoutController };

package/dist/adapters/http/controllers/workflows/logout/module.d.ts

@@ -0,0 +1,14 @@
+import type { IAppEvent } from 'routup';
+import type { IOAuth2EndSessionService } from '../../../../../core/index.ts';
+import { OAuth2EndSessionRequestValidator } from '../../../../../core/index.ts';
+import type { LogoutControllerContext, LogoutControllerOptions } from './types.ts';
+export declare class LogoutController {
+    protected options: LogoutControllerOptions;
+    protected endSessionService: IOAuth2EndSessionService;
+    protected validator: OAuth2EndSessionRequestValidator;
+    constructor(ctx: LogoutControllerContext);
+    serve(event: IAppEvent): Promise<string | Response>;
+    execute(event: IAppEvent): Promise<string | Response>;
+    protected handle(event: IAppEvent): Promise<string | Response>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/controllers/workflows/logout/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/logout/module.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,wBAAwB,EAA2B,MAAM,8BAA8B,CAAC;AACtG,OAAO,EAAE,gCAAgC,EAAE,MAAM,8BAA8B,CAAC;AAGhF,OAAO,KAAK,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAEnF,qBACa,gBAAgB;IACzB,SAAS,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAE3C,SAAS,CAAC,iBAAiB,EAAE,wBAAwB,CAAC;IAEtD,SAAS,CAAC,SAAS,EAAE,gCAAgC,CAAC;gBAE1C,GAAG,EAAE,uBAAuB;IAOlC,KAAK,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC;IAM/D,OAAO,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC;cAIvD,MAAM,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC;CAyEvE"}

package/dist/adapters/http/controllers/workflows/logout/module.mjs

@@ -0,0 +1,101 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { OAuth2EndSessionRequestValidator } from "../../../../../core/oauth2/end-session/validator.mjs";
+import "../../../../../core/index.mjs";
+import { readFromLocations } from "../../../request/helpers/locations.mjs";
+import "../../../request/index.mjs";
+import { renderUIPage } from "../../../ui/render.mjs";
+import "../../../ui/index.mjs";
+import { URL } from "node:url";
+import { sendRedirect } from "routup";
+import { DContext, DController, DGet, DPost } from "@routup/decorators";
+//#region src/adapters/http/controllers/workflows/logout/module.ts
+function _ts_decorate(decorators, target, key, desc) {
+	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+	return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(k, v) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+function _ts_param(paramIndex, decorator) {
+	return function(target, key) {
+		decorator(target, key, paramIndex);
+	};
+}
+var LogoutController = class {
+	options;
+	endSessionService;
+	validator;
+	constructor(ctx) {
+		this.options = ctx.options;
+		this.endSessionService = ctx.endSessionService;
+		this.validator = new OAuth2EndSessionRequestValidator();
+	}
+	async serve(event) {
+		return this.handle(event);
+	}
+	async execute(event) {
+		return this.handle(event);
+	}
+	async handle(event) {
+		const merged = await readFromLocations(event, ["body", "query"]);
+		let data;
+		try {
+			data = await this.validator.run(merged);
+		} catch {
+			data = {};
+		}
+		const result = await this.endSessionService.verify(data);
+		let serverRevoked = false;
+		if (result.hintVerified && result.sessionId && result.sub && result.subKind) serverRevoked = await this.endSessionService.revoke(result.sessionId, result.sub, result.subKind);
+		let redirect;
+		if (result.redirectUri) {
+			const url = new URL(result.redirectUri);
+			if (result.state) url.searchParams.set("state", result.state);
+			redirect = url.href;
+		}
+		if (serverRevoked && redirect) return sendRedirect(event, redirect);
+		const requestURL = new URL(event.request.url);
+		return renderUIPage(event, {
+			url: "/logout",
+			payload: {
+				config: { baseURL: this.options.baseURL },
+				data: {
+					client: result.clientName ? { name: result.clientName } : void 0,
+					hintVerified: result.hintVerified,
+					hintSub: result.hintVerified ? result.sub : void 0,
+					hintSubKind: result.hintVerified ? result.subKind : void 0,
+					serverRevoked,
+					redirect,
+					requestPath: `${requestURL.pathname}${requestURL.search}`
+				}
+			}
+		});
+	}
+};
+_ts_decorate([
+	DGet("", []),
+	_ts_param(0, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], LogoutController.prototype, "serve", null);
+_ts_decorate([
+	DPost("", []),
+	_ts_param(0, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], LogoutController.prototype, "execute", null);
+LogoutController = _ts_decorate([
+	DController("/logout"),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof LogoutControllerContext === "undefined" ? Object : LogoutControllerContext])
+], LogoutController);
+//#endregion
+export { LogoutController };
+
+//# sourceMappingURL=module.mjs.map

package/dist/adapters/http/controllers/workflows/logout/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["DContext","DController","DGet","DPost","URL","sendRedirect","OAuth2EndSessionRequestValidator","readFromLocations","renderUIPage","LogoutController","options","endSessionService","validator","ctx","serve","event","handle","execute","merged","data","run","result","verify","serverRevoked","hintVerified","sessionId","sub","subKind","revoke","redirect","redirectUri","url","state","searchParams","set","href","requestURL","request","payload","config","baseURL","client","clientName","name","undefined","hintSub","hintSubKind","requestPath","pathname","search"],"sources":["../../../../../../src/adapters/http/controllers/workflows/logout/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPost,\n} from '@routup/decorators';\nimport { URL } from 'node:url';\nimport type { IAppEvent } from 'routup';\nimport { sendRedirect } from 'routup';\nimport type { IOAuth2EndSessionService, OAuth2EndSessionRequest } from '../../../../../core/index.ts';\nimport { OAuth2EndSessionRequestValidator } from '../../../../../core/index.ts';\nimport { readFromLocations } from '../../../request/index.ts';\nimport { renderUIPage } from '../../../ui/index.ts';\nimport type { LogoutControllerContext, LogoutControllerOptions } from './types.ts';\n\n@DController('/logout')\nexport class LogoutController {\n    protected options: LogoutControllerOptions;\n\n    protected endSessionService: IOAuth2EndSessionService;\n\n    protected validator: OAuth2EndSessionRequestValidator;\n\n    constructor(ctx: LogoutControllerContext) {\n        this.options = ctx.options;\n        this.endSessionService = ctx.endSessionService;\n        this.validator = new OAuth2EndSessionRequestValidator();\n    }\n\n    @DGet('', [])\n    async serve(@DContext() event: IAppEvent): Promise<string | Response> {\n        return this.handle(event);\n    }\n\n    // OIDC RP-Initiated Logout allows form_post on the same endpoint.\n    @DPost('', [])\n    async execute(@DContext() event: IAppEvent): Promise<string | Response> {\n        return this.handle(event);\n    }\n\n    protected async handle(event: IAppEvent): Promise<string | Response> {\n        const merged = await readFromLocations(event, ['body', 'query']);\n\n        // Malformed input (oversized / duplicated params) must never dead-end\n        // the human behind the browser on a JSON error: fall back to a\n        // parameter-less confirm page — every attacker-controlled value is\n        // dropped, the click-gated sign-out keeps working.\n        let data: OAuth2EndSessionRequest;\n        try {\n            data = await this.validator.run(merged);\n        } catch {\n            data = {};\n        }\n\n        const result = await this.endSessionService.verify(data);\n\n        // A signature-verified id_token_hint proves possession — revoke the\n        // referenced session server-side immediately (only if it belongs to the\n        // hint's subject). Without a hint we mutate nothing; the SSR page's\n        // sign-out is a click-gated, bearer-authenticated action.\n        let serverRevoked = false;\n        if (result.hintVerified && result.sessionId && result.sub && result.subKind) {\n            serverRevoked = await this.endSessionService.revoke(\n                result.sessionId,\n                result.sub,\n                result.subKind,\n            );\n        }\n\n        // Build the validated post-logout redirect (the open-redirect guard\n        // lives in the service; `state` rides only alongside a validated uri).\n        let redirect: string | undefined;\n        if (result.redirectUri) {\n            const url = new URL(result.redirectUri);\n            if (result.state) {\n                url.searchParams.set('state', result.state);\n            }\n\n            redirect = url.href;\n        }\n\n        // Bounce straight back to the RP ONLY when the logout was actually\n        // performed server-side (a verified hint revoked the session). A\n        // hint-less or forged request MUST NOT silently redirect without ending\n        // the session — otherwise the RP treats a no-op round-trip as a\n        // successful logout while the authup session survives. Instead render\n        // the click-gated confirm page, which performs the bearer-authenticated\n        // sign-out and then redirects.\n        if (serverRevoked && redirect) {\n            return sendRedirect(event, redirect);\n        }\n\n        const requestURL = new URL(event.request.url);\n\n        return renderUIPage(event, {\n            url: '/logout',\n            payload: {\n                config: { baseURL: this.options.baseURL },\n                data: {\n                    client: result.clientName ? { name: result.clientName } : undefined,\n                    hintVerified: result.hintVerified,\n                    // never reflect an unverified hint's claims\n                    hintSub: result.hintVerified ? result.sub : undefined,\n                    hintSubKind: result.hintVerified ? result.subKind : undefined,\n                    serverRevoked,\n                    // the (already validated) uri to return to after a click-gated\n                    // sign-out; carries `state` when present\n                    redirect,\n                    requestPath: `${requestURL.pathname}${requestURL.search}`,\n                },\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAuBA,IAAaS,mBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA8B;EACtC,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,oBAAoBE,IAAIF;EAC7B,KAAKC,YAAY,IAAIN,iCAAAA;CACzB;CAEA,MACMQ,MAAM,OAA0D;EAClE,OAAO,KAAKE,OAAOD,KAAAA;CACvB;CAGA,MACME,QAAQ,OAA0D;EACpE,OAAO,KAAKD,OAAOD,KAAAA;CACvB;CAEA,MAAgBC,OAAOD,OAA8C;EACjE,MAAMG,SAAS,MAAMX,kBAAkBQ,OAAO,CAAC,QAAQ,OAAA,CAAQ;EAM/D,IAAII;EACJ,IAAI;GACAA,OAAO,MAAM,KAAKP,UAAUQ,IAAIF,MAAAA;EACpC,QAAQ;GACJC,OAAO,CAAC;EACZ;EAEA,MAAME,SAAS,MAAM,KAAKV,kBAAkBW,OAAOH,IAAAA;EAMnD,IAAII,gBAAgB;EACpB,IAAIF,OAAOG,gBAAgBH,OAAOI,aAAaJ,OAAOK,OAAOL,OAAOM,SAChEJ,gBAAgB,MAAM,KAAKZ,kBAAkBiB,OACzCP,OAAOI,WACPJ,OAAOK,KACPL,OAAOM,OAAO;EAMtB,IAAIE;EACJ,IAAIR,OAAOS,aAAa;GACpB,MAAMC,MAAM,IAAI3B,IAAIiB,OAAOS,WAAW;GACtC,IAAIT,OAAOW,OACPD,IAAIE,aAAaC,IAAI,SAASb,OAAOW,KAAK;GAG9CH,WAAWE,IAAII;EACnB;EASA,IAAIZ,iBAAiBM,UACjB,OAAOxB,aAAaU,OAAOc,QAAAA;EAG/B,MAAMO,aAAa,IAAIhC,IAAIW,MAAMsB,QAAQN,GAAG;EAE5C,OAAOvB,aAAaO,OAAO;GACvBgB,KAAK;GACLO,SAAS;IACLC,QAAQ,EAAEC,SAAS,KAAK9B,QAAQ8B,QAAQ;IACxCrB,MAAM;KACFsB,QAAQpB,OAAOqB,aAAa,EAAEC,MAAMtB,OAAOqB,WAAW,IAAIE,KAAAA;KAC1DpB,cAAcH,OAAOG;KAErBqB,SAASxB,OAAOG,eAAeH,OAAOK,MAAMkB,KAAAA;KAC5CE,aAAazB,OAAOG,eAAeH,OAAOM,UAAUiB,KAAAA;KACpDrB;KAGAM;KACAkB,aAAa,GAAGX,WAAWY,WAAWZ,WAAWa;IACrD;GACJ;EACJ,CAAA;CACJ;AACJ"}

package/dist/adapters/http/controllers/workflows/logout/types.d.ts

@@ -0,0 +1,9 @@
+import type { IOAuth2EndSessionService } from '../../../../../core/index.ts';
+export type LogoutControllerOptions = {
+    baseURL: string;
+};
+export type LogoutControllerContext = {
+    options: LogoutControllerOptions;
+    endSessionService: IOAuth2EndSessionService;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/controllers/workflows/logout/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/logout/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAE7E,MAAM,MAAM,uBAAuB,GAAG;IAClC,OAAO,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IAClC,OAAO,EAAE,uBAAuB,CAAC;IACjC,iBAAiB,EAAE,wBAAwB,CAAC;CAC/C,CAAC"}

package/dist/adapters/http/controllers/workflows/status/module.mjs

@@ -3,8 +3,8 @@ import "node:url";
 import.meta.url;
 import { PACKAGE_PATH } from "../../../../../path.mjs";
 import path from "node:path";
-import { DController, DGet } from "@routup/decorators";
 import { load } from "locter";
+import { DController, DGet } from "@routup/decorators";
 //#region src/adapters/http/controllers/workflows/status/module.ts
 function _ts_decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;

package/dist/adapters/http/controllers/workflows/token/module.d.ts

@@ -2,7 +2,7 @@ import type { OAuth2TokenGrantResponse, OAuth2TokenIntrospectionResponse } from
 import { OAuth2TokenGrant } from '@authup/specs';
 import type { IAppEvent } from 'routup';
 import type { TokenControllerContext } from './types.ts';
-import type { IIdentityPermissionProvider, IIdentityResolver, IOAuth2TokenIssuer, IOAuth2TokenRevoker, IOAuth2TokenVerifier } from '../../../../../core/index.ts';
+import type { IAuthFlowMetrics, IIdentityPermissionProvider, IIdentityResolver, IOAuth2TokenIssuer, IOAuth2TokenRevoker, IOAuth2TokenVerifier } from '../../../../../core/index.ts';
 import type { IHTTPOAuth2Grant } from '../../../adapters/index.ts';
 export declare class TokenController {
     protected refreshTokenIssuer: IOAuth2TokenIssuer;
@@ -11,6 +11,7 @@ export declare class TokenController {
     protected tokenRevoker: IOAuth2TokenRevoker;
     protected identityResolver: IIdentityResolver;
     protected identityPermissionProvider: IIdentityPermissionProvider;
+    protected metrics?: IAuthFlowMetrics;
     protected tokenGrants: Record<`${OAuth2TokenGrant}`, IHTTPOAuth2Grant>;
     constructor(ctx: TokenControllerContext);
     getIntrospect(event: IAppEvent): Promise<OAuth2TokenIntrospectionResponse>;

package/dist/adapters/http/controllers/workflows/token/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/token/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,gCAAgC,EAAyB,MAAM,eAAe,CAAC;AACvH,OAAO,EAA4C,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAQ3F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGxC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,KAAK,EACR,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACvB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAWnE,qBAEa,eAAe;IACxB,SAAS,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;IAEjD,SAAS,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;IAEhD,SAAS,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAE9C,SAAS,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAE5C,SAAS,CAAC,gBAAgB,EAAG,iBAAiB,CAAC;IAE/C,SAAS,CAAC,0BAA0B,EAAG,2BAA2B,CAAC;IAEnE,SAAS,CAAC,WAAW,EAAG,MAAM,CAAC,GAAG,gBAAgB,EAAE,EAAE,gBAAgB,CAAC,CAAC;gBAI5D,GAAG,EAAE,sBAAsB;IAgDjC,aAAa,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,gCAAgC,CAAC;IAKtF,cAAc,CACJ,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,gCAAgC,CAAC;IA4DtC,WAAW,CACD,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,IAAI,CAAC;IAkBV,WAAW,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAarF"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/token/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,gCAAgC,EAAyB,MAAM,eAAe,CAAC;AACvH,OAAO,EAA4C,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAQ3F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGxC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,KAAK,EACR,gBAAgB,EAChB,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACvB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAWnE,qBAEa,eAAe;IACxB,SAAS,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;IAEjD,SAAS,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;IAEhD,SAAS,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAE9C,SAAS,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAE5C,SAAS,CAAC,gBAAgB,EAAG,iBAAiB,CAAC;IAE/C,SAAS,CAAC,0BAA0B,EAAG,2BAA2B,CAAC;IAEnE,SAAS,CAAC,OAAO,CAAC,EAAG,gBAAgB,CAAC;IAEtC,SAAS,CAAC,WAAW,EAAG,MAAM,CAAC,GAAG,gBAAgB,EAAE,EAAE,gBAAgB,CAAC,CAAC;gBAI5D,GAAG,EAAE,sBAAsB;IAqEjC,aAAa,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,gCAAgC,CAAC;IAKtF,cAAc,CACJ,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,gCAAgC,CAAC;IA4DtC,WAAW,CACD,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,IAAI,CAAC;IA+BV,WAAW,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAiBrF"}

package/dist/adapters/http/controllers/workflows/token/module.mjs

@@ -39,6 +39,7 @@ var TokenController = class {
 	tokenRevoker;
 	identityResolver;
 	identityPermissionProvider;
+	metrics;
 	tokenGrants;
 	constructor(ctx) {
 		this.refreshTokenIssuer = ctx.refreshTokenIssuer;
@@ -47,18 +48,25 @@ var TokenController = class {
 		this.tokenRevoker = ctx.tokenRevoker;
 		this.identityResolver = ctx.identityResolver;
 		this.identityPermissionProvider = ctx.identityPermissionProvider;
+		this.metrics = ctx.metrics;
 		this.tokenGrants = {
 			[OAuth2TokenGrant.AUTHORIZATION_CODE]: new HTTPOAuth2AuthorizeGrant({
 				codeVerifier: ctx.codeVerifier,
 				clientAuthenticator: ctx.oauth2ClientAuthenticator,
 				accessTokenIssuer: ctx.accessTokenIssuer,
 				refreshTokenIssuer: ctx.refreshTokenIssuer,
-				sessionManager: ctx.sessionManager
+				openIdTokenIssuer: ctx.openIdTokenIssuer,
+				keyStore: ctx.keyStore,
+				sessionManager: ctx.sessionManager,
+				realmRepository: ctx.realmRepository,
+				accessPolicyEvaluator: ctx.accessPolicyEvaluator,
+				certificateSource: ctx.certificateSource
 			}),
 			[OAuth2TokenGrant.CLIENT_CREDENTIALS]: new HTTPClientCredentialsGrant({
 				accessTokenIssuer: ctx.accessTokenIssuer,
-				authenticator: ctx.clientAuthenticator,
-				sessionManager: ctx.sessionManager
+				clientAuthenticator: ctx.oauth2ClientAuthenticator,
+				sessionManager: ctx.sessionManager,
+				certificateSource: ctx.certificateSource
 			}),
 			[OAuth2TokenGrant.ROBOT_CREDENTIALS]: new HTTPRobotCredentialsGrant({
 				accessTokenIssuer: ctx.accessTokenIssuer,
@@ -71,15 +79,29 @@ var TokenController = class {
 				authenticator: ctx.userAuthenticator,
 				clientAuthenticator: ctx.oauth2ClientAuthenticator,
 				sessionManager: ctx.sessionManager,
-				realmRepository: ctx.realmRepository
+				realmRepository: ctx.realmRepository,
+				eventService: ctx.eventService,
+				metrics: ctx.metrics,
+				loginThrottleService: ctx.loginThrottleService,
+				userAuthenticatorService: ctx.userAuthenticatorService,
+				mfaLoginService: ctx.mfaLoginService,
+				logger: ctx.logger,
+				certificateSource: ctx.certificateSource
 			}),
 			[OAuth2TokenGrant.REFRESH_TOKEN]: new HTTPOAuth2RefreshTokenGrant({
 				accessTokenIssuer: ctx.accessTokenIssuer,
 				refreshTokenIssuer: ctx.refreshTokenIssuer,
 				tokenVerifier: ctx.tokenVerifier,
-				tokenRevoker: ctx.tokenRevoker,
+				tokenRepository: ctx.tokenRepository,
+				sessionTokenRepository: ctx.sessionTokenRepository,
 				sessionManager: ctx.sessionManager,
-				clientAuthenticator: ctx.oauth2ClientAuthenticator
+				clientAuthenticator: ctx.oauth2ClientAuthenticator,
+				realmRepository: ctx.realmRepository,
+				eventService: ctx.eventService,
+				metrics: ctx.metrics,
+				logger: ctx.logger,
+				options: { gracePeriod: ctx.tokenRefreshGracePeriod },
+				certificateSource: ctx.certificateSource
 			})
 		};
 	}
@@ -124,7 +146,10 @@ var TokenController = class {
 	async revokeToken(event) {
 		try {
 			const token = await extractTokenFromRequest(event);
-			const payload = await this.tokenVerifier.verify(token);
+			const payload = await this.tokenVerifier.verify(token, {
+				ignoreExpiry: true,
+				skipActiveCheck: true
+			});
 			await this.tokenRevoker.revoke(payload);
 			event.response.status = 202;
 			return null;
@@ -137,7 +162,9 @@ var TokenController = class {
 		if (!grantType) throw OAuth2GrantTypeError.unsupported();
 		const grant = this.tokenGrants[grantType];
 		if (!grant) throw OAuth2GrantTypeError.unsupported();
-		return grant.runWithRequest(event);
+		const response = await grant.runWithRequest(event);
+		this.metrics?.recordTokenGrant(grantType);
+		return response;
 	}
 };
 _ts_decorate([

package/dist/adapters/http/controllers/workflows/token/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2GrantTypeError","OAuth2RequestError","OAuth2TokenGrant","DContext","DController","DGet","DPost","DTags","buildPermissionKey","toOAuth2Error","OAuth2OpenIDClaimsBuilder","HTTPClientCredentialsGrant","HTTPOAuth2AuthorizeGrant","HTTPOAuth2RefreshTokenGrant","HTTPPasswordGrant","HTTPRobotCredentialsGrant","guessOauth2GrantTypeByRequest","extractTokenFromRequest","TokenController","refreshTokenIssuer","accessTokenIssuer","tokenVerifier","tokenRevoker","identityResolver","identityPermissionProvider","tokenGrants","ctx","AUTHORIZATION_CODE","codeVerifier","clientAuthenticator","oauth2ClientAuthenticator","sessionManager","CLIENT_CREDENTIALS","authenticator","ROBOT_CREDENTIALS","robotAuthenticator","PASSWORD","userAuthenticator","realmRepository","REFRESH_TOKEN","getIntrospect","event","postIntrospect","token","payload","verify","skipActiveCheck","sub","sub_kind","identityInvalid","permissions","getFor","id","type","clientId","client_id","realmId","realm_id","identity","resolve","claimsBuilder","claims","fromIdentity","active","jti","isInactive","Object","values","reduce","acc","binding","key","permission","name","e","revokeToken","revoke","response","status","createToken","grantType","unsupported","grant","runWithRequest"],"sources":["../../../../../../src/adapters/http/controllers/workflows/token/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenIntrospectionResponse, OAuth2TokenPermission } from '@authup/specs';\nimport { OAuth2GrantTypeError, OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPost,\n    DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport { buildPermissionKey } from '@authup/access';\nimport { toOAuth2Error } from '../../../../../core/oauth2/helpers/index.ts';\nimport type { TokenControllerContext } from './types.ts';\nimport type {\n    IIdentityPermissionProvider,\n    IIdentityResolver,\n    IOAuth2TokenIssuer,\n    IOAuth2TokenRevoker,\n    IOAuth2TokenVerifier,\n} from '../../../../../core/index.ts';\nimport { OAuth2OpenIDClaimsBuilder } from '../../../../../core/index.ts';\nimport type { IHTTPOAuth2Grant } from '../../../adapters/index.ts';\nimport {\n    HTTPClientCredentialsGrant,\n    HTTPOAuth2AuthorizeGrant,\n    HTTPOAuth2RefreshTokenGrant,\n    HTTPPasswordGrant,\n    HTTPRobotCredentialsGrant,\n    guessOauth2GrantTypeByRequest,\n} from '../../../adapters/index.ts';\nimport { extractTokenFromRequest } from './utils/index.ts';\n\n@DTags('auth')\n@DController('/token')\nexport class TokenController {\n    protected refreshTokenIssuer: IOAuth2TokenIssuer;\n\n    protected accessTokenIssuer: IOAuth2TokenIssuer;\n\n    protected tokenVerifier: IOAuth2TokenVerifier;\n\n    protected tokenRevoker: IOAuth2TokenRevoker;\n\n    protected identityResolver : IIdentityResolver;\n\n    protected identityPermissionProvider : IIdentityPermissionProvider;\n\n    protected tokenGrants : Record<`${OAuth2TokenGrant}`, IHTTPOAuth2Grant>;\n\n    // -------------------------------------------\n\n    constructor(ctx: TokenControllerContext) {\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n        this.accessTokenIssuer = ctx.accessTokenIssuer;\n        this.tokenVerifier = ctx.tokenVerifier;\n        this.tokenRevoker = ctx.tokenRevoker;\n        this.identityResolver = ctx.identityResolver;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n\n        this.tokenGrants = {\n            [OAuth2TokenGrant.AUTHORIZATION_CODE]: new HTTPOAuth2AuthorizeGrant({\n                codeVerifier: ctx.codeVerifier,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                sessionManager: ctx.sessionManager,\n            }),\n            [OAuth2TokenGrant.CLIENT_CREDENTIALS]: new HTTPClientCredentialsGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                authenticator: ctx.clientAuthenticator,\n                sessionManager: ctx.sessionManager,\n            }),\n            [OAuth2TokenGrant.ROBOT_CREDENTIALS]: new HTTPRobotCredentialsGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                authenticator: ctx.robotAuthenticator,\n                sessionManager: ctx.sessionManager,\n            }),\n            [OAuth2TokenGrant.PASSWORD]: new HTTPPasswordGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                authenticator: ctx.userAuthenticator,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                sessionManager: ctx.sessionManager,\n                realmRepository: ctx.realmRepository,\n            }),\n            [OAuth2TokenGrant.REFRESH_TOKEN]: new HTTPOAuth2RefreshTokenGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                tokenVerifier: ctx.tokenVerifier,\n                tokenRevoker: ctx.tokenRevoker,\n                sessionManager: ctx.sessionManager,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n            }),\n        };\n    }\n\n    // -------------------------------------------\n\n    @DGet('/introspect', [])\n    async getIntrospect(@DContext() event: IAppEvent): Promise<OAuth2TokenIntrospectionResponse> {\n        return this.postIntrospect(event);\n    }\n\n    @DPost('/introspect', [])\n    async postIntrospect(\n        @DContext() event: IAppEvent,\n    ): Promise<OAuth2TokenIntrospectionResponse> {\n        try {\n            const token = await extractTokenFromRequest(event);\n            const payload = await this.tokenVerifier.verify(token, { skipActiveCheck: true });\n            if (!payload.sub || !payload.sub_kind) {\n                throw OAuth2RequestError.identityInvalid();\n            }\n\n            // todo: only receive client specific permissions\n            const permissions = await this.identityPermissionProvider.getFor({\n                id: payload.sub,\n                type: payload.sub_kind,\n                clientId: payload.client_id,\n                realmId: payload.realm_id,\n            });\n\n            const identity = await this.identityResolver.resolve(payload.sub_kind, payload.sub);\n            if (!identity) {\n                // todo: differentiate between client, robot & user\n                throw OAuth2RequestError.identityInvalid();\n            }\n\n            const claimsBuilder = new OAuth2OpenIDClaimsBuilder();\n            const claims = claimsBuilder.fromIdentity(identity);\n\n            let active : boolean;\n            if (payload.jti) {\n                const isInactive = await this.tokenVerifier.isInactive(payload.jti);\n                active = !isInactive;\n            } else {\n                active = false;\n            }\n\n            return {\n                active,\n                // todo: permissions property should be removed.\n                permissions: Object.values(\n                    permissions.reduce((acc, binding) => {\n                        const key = buildPermissionKey(binding.permission);\n                        if (!acc[key]) {\n                            acc[key] = {\n                                name: binding.permission.name,\n                                client_id: binding.permission.client_id,\n                                realm_id: binding.permission.realm_id,\n                            } as OAuth2TokenPermission;\n                        }\n                        return acc;\n                    }, {} as Record<string, OAuth2TokenPermission>),\n                ),\n                ...payload,\n                ...claims,\n            };\n        } catch (e) {\n            throw toOAuth2Error(e);\n        }\n    }\n\n    // ----------------------------------------------------------\n\n    @DPost('/revoke', [])\n    async revokeToken(\n        @DContext() event: IAppEvent,\n    ): Promise<null> {\n        try {\n            const token = await extractTokenFromRequest(event);\n\n            const payload = await this.tokenVerifier.verify(token);\n\n            await this.tokenRevoker.revoke(payload);\n\n            event.response.status = 202;\n            return null;\n        } catch (e) {\n            throw toOAuth2Error(e);\n        }\n    }\n\n    // ----------------------------------------------------------\n\n    @DPost('', [])\n    async createToken(@DContext() event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const grantType = await guessOauth2GrantTypeByRequest(event);\n        if (!grantType) {\n            throw OAuth2GrantTypeError.unsupported();\n        }\n\n        const grant = this.tokenGrants[grantType];\n        if (!grant) {\n            throw OAuth2GrantTypeError.unsupported();\n        }\n\n        return grant.runWithRequest(event);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAKC,SAAA,aAAA,YAAA,QAAA,KAAA,MAAA;;;;;;;;;;;;;;AAoCD,IAAakB,kBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAA6B;EACrC,KAAKP,qBAAqBO,IAAIP;EAC9B,KAAKC,oBAAoBM,IAAIN;EAC7B,KAAKC,gBAAgBK,IAAIL;EACzB,KAAKC,eAAeI,IAAIJ;EACxB,KAAKC,mBAAmBG,IAAIH;EAC5B,KAAKC,6BAA6BE,IAAIF;EAEtC,KAAKC,cAAc;IACdvB,iBAAiByB,qBAAqB,IAAIf,yBAAyB;IAChEgB,cAAcF,IAAIE;IAClBC,qBAAqBH,IAAII;IACzBV,mBAAmBM,IAAIN;IACvBD,oBAAoBO,IAAIP;IACxBY,gBAAgBL,IAAIK;GACxB,CAAA;IACC7B,iBAAiB8B,qBAAqB,IAAIrB,2BAA2B;IAClES,mBAAmBM,IAAIN;IACvBa,eAAeP,IAAIG;IACnBE,gBAAgBL,IAAIK;GACxB,CAAA;IACC7B,iBAAiBgC,oBAAoB,IAAInB,0BAA0B;IAChEK,mBAAmBM,IAAIN;IACvBa,eAAeP,IAAIS;IACnBJ,gBAAgBL,IAAIK;GACxB,CAAA;IACC7B,iBAAiBkC,WAAW,IAAItB,kBAAkB;IAC/CM,mBAAmBM,IAAIN;IACvBD,oBAAoBO,IAAIP;IACxBc,eAAeP,IAAIW;IACnBR,qBAAqBH,IAAII;IACzBC,gBAAgBL,IAAIK;IACpBO,iBAAiBZ,IAAIY;GACzB,CAAA;IACCpC,iBAAiBqC,gBAAgB,IAAI1B,4BAA4B;IAC9DO,mBAAmBM,IAAIN;IACvBD,oBAAoBO,IAAIP;IACxBE,eAAeK,IAAIL;IACnBC,cAAcI,IAAIJ;IAClBS,gBAAgBL,IAAIK;IACpBF,qBAAqBH,IAAII;GAC7B,CAAA;EACJ;CACJ;CAIA,MACMU,cAAc,OAAyE;EACzF,OAAO,KAAKE,eAAeD,KAAAA;CAC/B;CAEA,MACMC,eACF,OACyC;EACzC,IAAI;GACA,MAAMC,QAAQ,MAAM1B,wBAAwBwB,KAAAA;GAC5C,MAAMG,UAAU,MAAM,KAAKvB,cAAcwB,OAAOF,OAAO,EAAEG,iBAAiB,KAAK,CAAA;GAC/E,IAAI,CAACF,QAAQG,OAAO,CAACH,QAAQI,UACzB,MAAM/C,mBAAmBgD,gBAAe;GAI5C,MAAMC,cAAc,MAAM,KAAK1B,2BAA2B2B,OAAO;IAC7DC,IAAIR,QAAQG;IACZM,MAAMT,QAAQI;IACdM,UAAUV,QAAQW;IAClBC,SAASZ,QAAQa;GACrB,CAAA;GAEA,MAAMC,WAAW,MAAM,KAAKnC,iBAAiBoC,QAAQf,QAAQI,UAAUJ,QAAQG,GAAG;GAClF,IAAI,CAACW,UAED,MAAMzD,mBAAmBgD,gBAAe;GAI5C,MAAMY,SAASD,IADWlD,0BACXkD,CAAAA,CAAcE,aAAaJ,QAAAA;GAE1C,IAAIK;GACJ,IAAInB,QAAQoB,KAERD,SAAS,CAACE,MADe,KAAK5C,cAAc4C,WAAWrB,QAAQoB,GAAG;QAGlED,SAAS;GAGb,OAAO;IACHA;IAEAb,aAAagB,OAAOC,OAChBjB,YAAYkB,QAAQC,KAAKC,YAAAA;KACrB,MAAMC,MAAM/D,mBAAmB8D,QAAQE,UAAU;KACjD,IAAI,CAACH,IAAIE,MACLF,IAAIE,OAAO;MACPE,MAAMH,QAAQE,WAAWC;MACzBlB,WAAWe,QAAQE,WAAWjB;MAC9BE,UAAUa,QAAQE,WAAWf;KACjC;KAEJ,OAAOY;IACX,GAAG,CAAC,CAAA,CAAA;IAER,GAAGzB;IACH,GAAGiB;GACP;EACJ,SAASa,GAAG;GACR,MAAMjE,cAAciE,CAAAA;EACxB;CACJ;CAIA,MACMC,YACF,OACa;EACb,IAAI;GACA,MAAMhC,QAAQ,MAAM1B,wBAAwBwB,KAAAA;GAE5C,MAAMG,UAAU,MAAM,KAAKvB,cAAcwB,OAAOF,KAAAA;GAEhD,MAAM,KAAKrB,aAAasD,OAAOhC,OAAAA;GAE/BH,MAAMoC,SAASC,SAAS;GACxB,OAAO;EACX,SAASJ,GAAG;GACR,MAAMjE,cAAciE,CAAAA;EACxB;CACJ;CAIA,MACMK,YAAY,OAAiE;EAC/E,MAAMC,YAAY,MAAMhE,8BAA8ByB,KAAAA;EACtD,IAAI,CAACuC,WACD,MAAMhF,qBAAqBiF,YAAW;EAG1C,MAAMC,QAAQ,KAAKzD,YAAYuD;EAC/B,IAAI,CAACE,OACD,MAAMlF,qBAAqBiF,YAAW;EAG1C,OAAOC,MAAMC,eAAe1C,KAAAA;CAChC;AACJ"}
+{"version":3,"file":"module.mjs","names":["OAuth2GrantTypeError","OAuth2RequestError","OAuth2TokenGrant","DContext","DController","DGet","DPost","DTags","buildPermissionKey","toOAuth2Error","OAuth2OpenIDClaimsBuilder","HTTPClientCredentialsGrant","HTTPOAuth2AuthorizeGrant","HTTPOAuth2RefreshTokenGrant","HTTPPasswordGrant","HTTPRobotCredentialsGrant","guessOauth2GrantTypeByRequest","extractTokenFromRequest","TokenController","refreshTokenIssuer","accessTokenIssuer","tokenVerifier","tokenRevoker","identityResolver","identityPermissionProvider","metrics","tokenGrants","ctx","AUTHORIZATION_CODE","codeVerifier","clientAuthenticator","oauth2ClientAuthenticator","openIdTokenIssuer","keyStore","sessionManager","realmRepository","accessPolicyEvaluator","certificateSource","CLIENT_CREDENTIALS","ROBOT_CREDENTIALS","authenticator","robotAuthenticator","PASSWORD","userAuthenticator","eventService","loginThrottleService","userAuthenticatorService","mfaLoginService","logger","REFRESH_TOKEN","tokenRepository","sessionTokenRepository","options","gracePeriod","tokenRefreshGracePeriod","getIntrospect","event","postIntrospect","token","payload","verify","skipActiveCheck","sub","sub_kind","identityInvalid","permissions","getFor","id","type","clientId","client_id","realmId","realm_id","identity","resolve","claimsBuilder","claims","fromIdentity","active","jti","isInactive","Object","values","reduce","acc","binding","key","permission","name","e","revokeToken","ignoreExpiry","revoke","response","status","createToken","grantType","unsupported","grant","runWithRequest","recordTokenGrant"],"sources":["../../../../../../src/adapters/http/controllers/workflows/token/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenIntrospectionResponse, OAuth2TokenPermission } from '@authup/specs';\nimport { OAuth2GrantTypeError, OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPost,\n    DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport { buildPermissionKey } from '@authup/access';\nimport { toOAuth2Error } from '../../../../../core/oauth2/helpers/index.ts';\nimport type { TokenControllerContext } from './types.ts';\nimport type {\n    IAuthFlowMetrics,\n    IIdentityPermissionProvider,\n    IIdentityResolver,\n    IOAuth2TokenIssuer,\n    IOAuth2TokenRevoker,\n    IOAuth2TokenVerifier,\n} from '../../../../../core/index.ts';\nimport { OAuth2OpenIDClaimsBuilder } from '../../../../../core/index.ts';\nimport type { IHTTPOAuth2Grant } from '../../../adapters/index.ts';\nimport {\n    HTTPClientCredentialsGrant,\n    HTTPOAuth2AuthorizeGrant,\n    HTTPOAuth2RefreshTokenGrant,\n    HTTPPasswordGrant,\n    HTTPRobotCredentialsGrant,\n    guessOauth2GrantTypeByRequest,\n} from '../../../adapters/index.ts';\nimport { extractTokenFromRequest } from './utils/index.ts';\n\n@DTags('auth')\n@DController('/token')\nexport class TokenController {\n    protected refreshTokenIssuer: IOAuth2TokenIssuer;\n\n    protected accessTokenIssuer: IOAuth2TokenIssuer;\n\n    protected tokenVerifier: IOAuth2TokenVerifier;\n\n    protected tokenRevoker: IOAuth2TokenRevoker;\n\n    protected identityResolver : IIdentityResolver;\n\n    protected identityPermissionProvider : IIdentityPermissionProvider;\n\n    protected metrics? : IAuthFlowMetrics;\n\n    protected tokenGrants : Record<`${OAuth2TokenGrant}`, IHTTPOAuth2Grant>;\n\n    // -------------------------------------------\n\n    constructor(ctx: TokenControllerContext) {\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n        this.accessTokenIssuer = ctx.accessTokenIssuer;\n        this.tokenVerifier = ctx.tokenVerifier;\n        this.tokenRevoker = ctx.tokenRevoker;\n        this.identityResolver = ctx.identityResolver;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n        this.metrics = ctx.metrics;\n\n        this.tokenGrants = {\n            [OAuth2TokenGrant.AUTHORIZATION_CODE]: new HTTPOAuth2AuthorizeGrant({\n                codeVerifier: ctx.codeVerifier,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                openIdTokenIssuer: ctx.openIdTokenIssuer,\n                keyStore: ctx.keyStore,\n                sessionManager: ctx.sessionManager,\n                realmRepository: ctx.realmRepository,\n                accessPolicyEvaluator: ctx.accessPolicyEvaluator,\n                certificateSource: ctx.certificateSource,\n            }),\n            [OAuth2TokenGrant.CLIENT_CREDENTIALS]: new HTTPClientCredentialsGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                sessionManager: ctx.sessionManager,\n                certificateSource: ctx.certificateSource,\n            }),\n            [OAuth2TokenGrant.ROBOT_CREDENTIALS]: new HTTPRobotCredentialsGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                authenticator: ctx.robotAuthenticator,\n                sessionManager: ctx.sessionManager,\n            }),\n            [OAuth2TokenGrant.PASSWORD]: new HTTPPasswordGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                authenticator: ctx.userAuthenticator,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                sessionManager: ctx.sessionManager,\n                realmRepository: ctx.realmRepository,\n                eventService: ctx.eventService,\n                metrics: ctx.metrics,\n                loginThrottleService: ctx.loginThrottleService,\n                userAuthenticatorService: ctx.userAuthenticatorService,\n                mfaLoginService: ctx.mfaLoginService,\n                logger: ctx.logger,\n                certificateSource: ctx.certificateSource,\n            }),\n            [OAuth2TokenGrant.REFRESH_TOKEN]: new HTTPOAuth2RefreshTokenGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                tokenVerifier: ctx.tokenVerifier,\n                tokenRepository: ctx.tokenRepository,\n                sessionTokenRepository: ctx.sessionTokenRepository,\n                sessionManager: ctx.sessionManager,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                realmRepository: ctx.realmRepository,\n                eventService: ctx.eventService,\n                metrics: ctx.metrics,\n                logger: ctx.logger,\n                options: { gracePeriod: ctx.tokenRefreshGracePeriod },\n                certificateSource: ctx.certificateSource,\n            }),\n        };\n    }\n\n    // -------------------------------------------\n\n    @DGet('/introspect', [])\n    async getIntrospect(@DContext() event: IAppEvent): Promise<OAuth2TokenIntrospectionResponse> {\n        return this.postIntrospect(event);\n    }\n\n    @DPost('/introspect', [])\n    async postIntrospect(\n        @DContext() event: IAppEvent,\n    ): Promise<OAuth2TokenIntrospectionResponse> {\n        try {\n            const token = await extractTokenFromRequest(event);\n            const payload = await this.tokenVerifier.verify(token, { skipActiveCheck: true });\n            if (!payload.sub || !payload.sub_kind) {\n                throw OAuth2RequestError.identityInvalid();\n            }\n\n            // todo: only receive client specific permissions\n            const permissions = await this.identityPermissionProvider.getFor({\n                id: payload.sub,\n                type: payload.sub_kind,\n                clientId: payload.client_id,\n                realmId: payload.realm_id,\n            });\n\n            const identity = await this.identityResolver.resolve(payload.sub_kind, payload.sub);\n            if (!identity) {\n                // todo: differentiate between client, robot & user\n                throw OAuth2RequestError.identityInvalid();\n            }\n\n            const claimsBuilder = new OAuth2OpenIDClaimsBuilder();\n            const claims = claimsBuilder.fromIdentity(identity);\n\n            let active : boolean;\n            if (payload.jti) {\n                const isInactive = await this.tokenVerifier.isInactive(payload.jti);\n                active = !isInactive;\n            } else {\n                active = false;\n            }\n\n            return {\n                active,\n                // todo: permissions property should be removed.\n                permissions: Object.values(\n                    permissions.reduce((acc, binding) => {\n                        const key = buildPermissionKey(binding.permission);\n                        if (!acc[key]) {\n                            acc[key] = {\n                                name: binding.permission.name,\n                                client_id: binding.permission.client_id,\n                                realm_id: binding.permission.realm_id,\n                            } as OAuth2TokenPermission;\n                        }\n                        return acc;\n                    }, {} as Record<string, OAuth2TokenPermission>),\n                ),\n                ...payload,\n                ...claims,\n            };\n        } catch (e) {\n            throw toOAuth2Error(e);\n        }\n    }\n\n    // ----------------------------------------------------------\n\n    @DPost('/revoke', [])\n    async revokeToken(\n        @DContext() event: IAppEvent,\n    ): Promise<null> {\n        try {\n            const token = await extractTokenFromRequest(event);\n\n            // RFC 7009 §2.2: revoking an invalid token — here one that is expired\n            // or already inactive — MUST still succeed. The client cannot act on\n            // an error, and the token's invalidation (the point of the request)\n            // is already achieved. Signature + kind still anchor the token, so a\n            // forged/garbage token is rejected; `ignoreExpiry` additionally keeps\n            // this exp-bypass out of the shared claims cache (see\n            // OAuth2TokenVerifier). Without this, revoking a stale refresh token\n            // threw `expired_token`, so the caller's revoke-then-clear-cookie\n            // flow aborted, the durable row was never soft-revoked, and the stale\n            // refresh cookie survived into the next login.\n            const payload = await this.tokenVerifier.verify(token, {\n                ignoreExpiry: true,\n                skipActiveCheck: true,\n            });\n\n            await this.tokenRevoker.revoke(payload);\n\n            event.response.status = 202;\n            return null;\n        } catch (e) {\n            throw toOAuth2Error(e);\n        }\n    }\n\n    // ----------------------------------------------------------\n\n    @DPost('', [])\n    async createToken(@DContext() event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const grantType = await guessOauth2GrantTypeByRequest(event);\n        if (!grantType) {\n            throw OAuth2GrantTypeError.unsupported();\n        }\n\n        const grant = this.tokenGrants[grantType];\n        if (!grant) {\n            throw OAuth2GrantTypeError.unsupported();\n        }\n\n        const response = await grant.runWithRequest(event);\n\n        this.metrics?.recordTokenGrant(grantType);\n\n        return response;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAKC,SAAA,aAAA,YAAA,QAAA,KAAA,MAAA;;;;;;;;;;;;;;AAqCD,IAAakB,kBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAA6B;EACrC,KAAKR,qBAAqBQ,IAAIR;EAC9B,KAAKC,oBAAoBO,IAAIP;EAC7B,KAAKC,gBAAgBM,IAAIN;EACzB,KAAKC,eAAeK,IAAIL;EACxB,KAAKC,mBAAmBI,IAAIJ;EAC5B,KAAKC,6BAA6BG,IAAIH;EACtC,KAAKC,UAAUE,IAAIF;EAEnB,KAAKC,cAAc;IACdxB,iBAAiB0B,qBAAqB,IAAIhB,yBAAyB;IAChEiB,cAAcF,IAAIE;IAClBC,qBAAqBH,IAAII;IACzBX,mBAAmBO,IAAIP;IACvBD,oBAAoBQ,IAAIR;IACxBa,mBAAmBL,IAAIK;IACvBC,UAAUN,IAAIM;IACdC,gBAAgBP,IAAIO;IACpBC,iBAAiBR,IAAIQ;IACrBC,uBAAuBT,IAAIS;IAC3BC,mBAAmBV,IAAIU;GAC3B,CAAA;IACCnC,iBAAiBoC,qBAAqB,IAAI3B,2BAA2B;IAClES,mBAAmBO,IAAIP;IACvBU,qBAAqBH,IAAII;IACzBG,gBAAgBP,IAAIO;IACpBG,mBAAmBV,IAAIU;GAC3B,CAAA;IACCnC,iBAAiBqC,oBAAoB,IAAIxB,0BAA0B;IAChEK,mBAAmBO,IAAIP;IACvBoB,eAAeb,IAAIc;IACnBP,gBAAgBP,IAAIO;GACxB,CAAA;IACChC,iBAAiBwC,WAAW,IAAI5B,kBAAkB;IAC/CM,mBAAmBO,IAAIP;IACvBD,oBAAoBQ,IAAIR;IACxBqB,eAAeb,IAAIgB;IACnBb,qBAAqBH,IAAII;IACzBG,gBAAgBP,IAAIO;IACpBC,iBAAiBR,IAAIQ;IACrBS,cAAcjB,IAAIiB;IAClBnB,SAASE,IAAIF;IACboB,sBAAsBlB,IAAIkB;IAC1BC,0BAA0BnB,IAAImB;IAC9BC,iBAAiBpB,IAAIoB;IACrBC,QAAQrB,IAAIqB;IACZX,mBAAmBV,IAAIU;GAC3B,CAAA;IACCnC,iBAAiB+C,gBAAgB,IAAIpC,4BAA4B;IAC9DO,mBAAmBO,IAAIP;IACvBD,oBAAoBQ,IAAIR;IACxBE,eAAeM,IAAIN;IACnB6B,iBAAiBvB,IAAIuB;IACrBC,wBAAwBxB,IAAIwB;IAC5BjB,gBAAgBP,IAAIO;IACpBJ,qBAAqBH,IAAII;IACzBI,iBAAiBR,IAAIQ;IACrBS,cAAcjB,IAAIiB;IAClBnB,SAASE,IAAIF;IACbuB,QAAQrB,IAAIqB;IACZI,SAAS,EAAEC,aAAa1B,IAAI2B,wBAAwB;IACpDjB,mBAAmBV,IAAIU;GAC3B,CAAA;EACJ;CACJ;CAIA,MACMkB,cAAc,OAAyE;EACzF,OAAO,KAAKE,eAAeD,KAAAA;CAC/B;CAEA,MACMC,eACF,OACyC;EACzC,IAAI;GACA,MAAMC,QAAQ,MAAMzC,wBAAwBuC,KAAAA;GAC5C,MAAMG,UAAU,MAAM,KAAKtC,cAAcuC,OAAOF,OAAO,EAAEG,iBAAiB,KAAK,CAAA;GAC/E,IAAI,CAACF,QAAQG,OAAO,CAACH,QAAQI,UACzB,MAAM9D,mBAAmB+D,gBAAe;GAI5C,MAAMC,cAAc,MAAM,KAAKzC,2BAA2B0C,OAAO;IAC7DC,IAAIR,QAAQG;IACZM,MAAMT,QAAQI;IACdM,UAAUV,QAAQW;IAClBC,SAASZ,QAAQa;GACrB,CAAA;GAEA,MAAMC,WAAW,MAAM,KAAKlD,iBAAiBmD,QAAQf,QAAQI,UAAUJ,QAAQG,GAAG;GAClF,IAAI,CAACW,UAED,MAAMxE,mBAAmB+D,gBAAe;GAI5C,MAAMY,SAASD,IADWjE,0BACXiE,CAAAA,CAAcE,aAAaJ,QAAAA;GAE1C,IAAIK;GACJ,IAAInB,QAAQoB,KAERD,SAAS,CAACE,MADe,KAAK3D,cAAc2D,WAAWrB,QAAQoB,GAAG;QAGlED,SAAS;GAGb,OAAO;IACHA;IAEAb,aAAagB,OAAOC,OAChBjB,YAAYkB,QAAQC,KAAKC,YAAAA;KACrB,MAAMC,MAAM9E,mBAAmB6E,QAAQE,UAAU;KACjD,IAAI,CAACH,IAAIE,MACLF,IAAIE,OAAO;MACPE,MAAMH,QAAQE,WAAWC;MACzBlB,WAAWe,QAAQE,WAAWjB;MAC9BE,UAAUa,QAAQE,WAAWf;KACjC;KAEJ,OAAOY;IACX,GAAG,CAAC,CAAA,CAAA;IAER,GAAGzB;IACH,GAAGiB;GACP;EACJ,SAASa,GAAG;GACR,MAAMhF,cAAcgF,CAAAA;EACxB;CACJ;CAIA,MACMC,YACF,OACa;EACb,IAAI;GACA,MAAMhC,QAAQ,MAAMzC,wBAAwBuC,KAAAA;GAY5C,MAAMG,UAAU,MAAM,KAAKtC,cAAcuC,OAAOF,OAAO;IACnDiC,cAAc;IACd9B,iBAAiB;GACrB,CAAA;GAEA,MAAM,KAAKvC,aAAasE,OAAOjC,OAAAA;GAE/BH,MAAMqC,SAASC,SAAS;GACxB,OAAO;EACX,SAASL,GAAG;GACR,MAAMhF,cAAcgF,CAAAA;EACxB;CACJ;CAIA,MACMM,YAAY,OAAiE;EAC/E,MAAMC,YAAY,MAAMhF,8BAA8BwC,KAAAA;EACtD,IAAI,CAACwC,WACD,MAAMhG,qBAAqBiG,YAAW;EAG1C,MAAMC,QAAQ,KAAKxE,YAAYsE;EAC/B,IAAI,CAACE,OACD,MAAMlG,qBAAqBiG,YAAW;EAG1C,MAAMJ,WAAW,MAAMK,MAAMC,eAAe3C,KAAAA;EAE5C,KAAK/B,SAAS2E,iBAAiBJ,SAAAA;EAE/B,OAAOH;CACX;AACJ"}

package/dist/adapters/http/controllers/workflows/token/types.d.ts

@@ -1,18 +1,32 @@
-import type { Client, Robot, User } from '@authup/core-kit';
-import type { ICredentialsAuthenticator, IIdentityPermissionProvider, IIdentityResolver, IOAuth2AuthorizationCodeVerifier, IOAuth2TokenIssuer, IOAuth2TokenRevoker, IOAuth2TokenVerifier, IRealmRepository, ISessionManager, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';
+import type { Robot, User } from '@authup/core-kit';
+import type { Logger } from '@authup/server-kit';
+import type { IAuthFlowMetrics, ICredentialsAuthenticator, IEventService, IIdentityPermissionProvider, IIdentityResolver, IKeyStore, ILoginThrottleService, IOAuth2AccessPolicyEvaluator, IOAuth2AuthorizationCodeVerifier, IOAuth2MfaLoginService, IOAuth2OpenIDTokenIssuer, IOAuth2TokenIssuer, IOAuth2TokenRepository, IOAuth2TokenRevoker, IOAuth2TokenVerifier, IRealmRepository, ISessionManager, ISessionTokenRepository, IUserAuthenticatorService, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';
+import type { CertificateSource } from '../../../request/index.ts';
 export type TokenControllerContext = {
     codeVerifier: IOAuth2AuthorizationCodeVerifier;
     accessTokenIssuer: IOAuth2TokenIssuer;
     refreshTokenIssuer: IOAuth2TokenIssuer;
+    openIdTokenIssuer: IOAuth2OpenIDTokenIssuer;
+    keyStore: IKeyStore;
     tokenVerifier: IOAuth2TokenVerifier;
     tokenRevoker: IOAuth2TokenRevoker;
+    tokenRepository: IOAuth2TokenRepository;
+    sessionTokenRepository: ISessionTokenRepository;
+    eventService?: IEventService;
+    metrics?: IAuthFlowMetrics;
+    loginThrottleService?: ILoginThrottleService;
+    userAuthenticatorService?: IUserAuthenticatorService;
+    mfaLoginService?: IOAuth2MfaLoginService;
+    accessPolicyEvaluator?: IOAuth2AccessPolicyEvaluator;
+    tokenRefreshGracePeriod?: number;
+    logger?: Logger;
     sessionManager: ISessionManager;
     identityResolver: IIdentityResolver;
     identityPermissionProvider: IIdentityPermissionProvider;
-    clientAuthenticator: ICredentialsAuthenticator<Client>;
     robotAuthenticator: ICredentialsAuthenticator<Robot>;
     userAuthenticator: ICredentialsAuthenticator<User>;
     oauth2ClientAuthenticator: OAuth2ClientAuthenticator;
     realmRepository: IRealmRepository;
+    certificateSource: CertificateSource;
 };
 //# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/controllers/workflows/token/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/token/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,EACR,yBAAyB,EACzB,2BAA2B,EAC3B,iBAAiB,EACjB,gCAAgC,EAChC,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,yBAAyB,EAC5B,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,sBAAsB,GAAG;IACjC,YAAY,EAAE,gCAAgC,CAAC;IAE/C,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,aAAa,EAAE,oBAAoB,CAAC;IACpC,YAAY,EAAE,mBAAmB,CAAC;IAElC,cAAc,EAAE,eAAe,CAAC;IAEhC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,0BAA0B,EAAE,2BAA2B,CAAC;IAExD,mBAAmB,EAAE,yBAAyB,CAAC,MAAM,CAAC,CAAA;IACtD,kBAAkB,EAAE,yBAAyB,CAAC,KAAK,CAAC,CAAA;IACpD,iBAAiB,EAAE,yBAAyB,CAAC,IAAI,CAAC,CAAA;IAElD,yBAAyB,EAAE,yBAAyB,CAAA;IAEpD,eAAe,EAAE,gBAAgB,CAAA;CACpC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/token/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EACR,gBAAgB,EAChB,yBAAyB,EACzB,aAAa,EACb,2BAA2B,EAC3B,iBAAiB,EACjB,SAAS,EACT,qBAAqB,EACrB,4BAA4B,EAC5B,gCAAgC,EAChC,sBAAsB,EACtB,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,uBAAuB,EACvB,yBAAyB,EACzB,yBAAyB,EAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,MAAM,MAAM,sBAAsB,GAAG;IACjC,YAAY,EAAE,gCAAgC,CAAC;IAE/C,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,iBAAiB,EAAE,wBAAwB,CAAC;IAC5C,QAAQ,EAAE,SAAS,CAAC;IACpB,aAAa,EAAE,oBAAoB,CAAC;IACpC,YAAY,EAAE,mBAAmB,CAAC;IAClC,eAAe,EAAE,sBAAsB,CAAC;IACxC,sBAAsB,EAAE,uBAAuB,CAAC;IAEhD,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAC7C,wBAAwB,CAAC,EAAE,yBAAyB,CAAC;IACrD,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,qBAAqB,CAAC,EAAE,4BAA4B,CAAC;IAErD,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,cAAc,EAAE,eAAe,CAAC;IAEhC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,0BAA0B,EAAE,2BAA2B,CAAC;IAExD,kBAAkB,EAAE,yBAAyB,CAAC,KAAK,CAAC,CAAA;IACpD,iBAAiB,EAAE,yBAAyB,CAAC,IAAI,CAAC,CAAA;IAElD,yBAAyB,EAAE,yBAAyB,CAAA;IAEpD,eAAe,EAAE,gBAAgB,CAAC;IAClC,iBAAiB,EAAE,iBAAiB,CAAC;CACxC,CAAC"}

package/dist/adapters/http/index.mjs

@@ -1,30 +1,24 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { RequestHandlerOperation } from "./request/constants.mjs";
+import { CERTIFICATE_SOURCES, RequestHandlerOperation } from "./request/constants.mjs";
+import { extractClientCertificateEvidence } from "./request/client-certificate.mjs";
 import { setRequestPermissionEvaluator, useRequestPermissionEvaluator } from "./request/permission/helper.mjs";
 import { RequestIdentity, setRequestIdentity, useRequestIdentity, useRequestIdentityOrFail } from "./request/helpers/identity.mjs";
 import { buildActorContext } from "./request/helpers/actor.mjs";
 import { getBodyRealmID } from "./request/helpers/body-realm-id.mjs";
 import { LOCALE_COOKIE, useRequestLocale } from "./request/helpers/locale.mjs";
 import { readFromLocations } from "./request/helpers/locations.mjs";
+import { setRequestMfaLoginTicket, useRequestMfaLoginTicket } from "./request/helpers/mfa-login-ticket.mjs";
 import { getRequestParamID, getRequestStringParam, getRequestStringParamOrFail, useRequestParamID } from "./request/helpers/param-id.mjs";
 import { applyRouteRealmIDToBody, getRequestRealmID, setRequestRealmID } from "./request/helpers/realm-id.mjs";
 import { sanitizeRelativeRedirect } from "./request/helpers/redirect.mjs";
 import { setRequestScopes, useRequestScopes } from "./request/helpers/scopes.mjs";
+import { setRequestSessionId, useRequestSessionId } from "./request/helpers/session-id.mjs";
 import { setRequestToken, useRequestToken } from "./request/helpers/token.mjs";
+import { createRequestEventContextMiddleware, runWithRequestEventContext, useRequestEventContext } from "./request/event-context.mjs";
 import { RequestPermissionEvaluator } from "./request/permission/module.mjs";
 import "./request/index.mjs";
-import { HTTPOAuth2Authorizer } from "./adapters/oauth2/authorization/module.mjs";
-import { extractClientCredentialsFromRequest, readStringField } from "./adapters/oauth2/grant-types/utils/credentials.mjs";
-import { guessOauth2GrantTypeByRequest } from "./adapters/oauth2/grant-types/utils/guess.mjs";
-import { HTTPOAuth2AuthorizeGrant } from "./adapters/oauth2/grant-types/authorize.mjs";
-import { HTTPClientCredentialsGrant } from "./adapters/oauth2/grant-types/client-credentials.mjs";
-import { HTTPOAuth2IdentityGrantType } from "./adapters/oauth2/grant-types/identity.mjs";
-import { HTTPPasswordGrant } from "./adapters/oauth2/grant-types/password.mjs";
-import { HTTPOAuth2RefreshTokenGrant } from "./adapters/oauth2/grant-types/refresh_token.mjs";
-import { HTTPRobotCredentialsGrant } from "./adapters/oauth2/grant-types/robot-credentials.mjs";
-import "./adapters/index.mjs";
 import { AuthorizationMiddleware } from "./middleware/built-in/authorization/module.mjs";
 import { createAuthorizationMiddleware } from "./middleware/built-in/authorization/factory.mjs";
 import { ForceLoggedInMiddleware } from "./middleware/built-in/loggedin/module.mjs";
@@ -35,12 +29,24 @@ import { VITE_SERVER_STORE_KEY, registerAssetsMiddleware } from "./middleware/bu
 import { registerBasicMiddleware } from "./middleware/built-in/basic.mjs";
 import { registerCorsMiddleware } from "./middleware/built-in/cors.mjs";
 import { registerErrorMiddleware } from "./middleware/built-in/error.mjs";
-import { createLoggerMiddleware } from "./middleware/built-in/logger.mjs";
-import { registerPrometheusMiddleware } from "./middleware/built-in/prometheus.mjs";
+import { createLoggerMiddleware, redactSensitiveURLParams } from "./middleware/built-in/logger.mjs";
+import { createRouteTemplateNormalizePath, registerPrometheusMiddleware } from "./middleware/built-in/prometheus.mjs";
 import { registerRateLimitMiddleware } from "./middleware/built-in/rate-limit.mjs";
 import { createSwaggerMiddleware } from "./middleware/built-in/swagger.mjs";
 import { UI_HTTP_CLIENT_FACTORY_STORE_KEY, registerUIHttpClientMiddleware } from "./middleware/built-in/ui-http-client.mjs";
 import "./middleware/index.mjs";
+import { HTTPOAuth2Authorizer } from "./adapters/oauth2/authorization/module.mjs";
+import { extractOAuth2ClientCertificateEvidence } from "./adapters/oauth2/grant-types/utils/certificate.mjs";
+import { extractClientCredentialsFromRequest, readStringField } from "./adapters/oauth2/grant-types/utils/credentials.mjs";
+import { guessOauth2GrantTypeByRequest } from "./adapters/oauth2/grant-types/utils/guess.mjs";
+import { readRealmHint } from "./adapters/oauth2/grant-types/utils/realm.mjs";
+import { HTTPOAuth2AuthorizeGrant } from "./adapters/oauth2/grant-types/authorize.mjs";
+import { HTTPClientCredentialsGrant } from "./adapters/oauth2/grant-types/client-credentials.mjs";
+import { HTTPOAuth2IdentityGrantType } from "./adapters/oauth2/grant-types/identity.mjs";
+import { HTTPPasswordGrant } from "./adapters/oauth2/grant-types/password.mjs";
+import { HTTPOAuth2RefreshTokenGrant } from "./adapters/oauth2/grant-types/refresh_token.mjs";
+import { HTTPRobotCredentialsGrant } from "./adapters/oauth2/grant-types/robot-credentials.mjs";
+import "./adapters/index.mjs";
 import { ClientController } from "./controllers/entities/client/module.mjs";
 import { ClientPermissionController } from "./controllers/entities/client-permission/module.mjs";
 import { ClientPermissionRequestValidator } from "./controllers/entities/client-permission/utils/validation.mjs";
@@ -48,14 +54,19 @@ import { ClientRoleRequestValidator } from "./controllers/entities/client-role/u
 import { ClientRoleController } from "./controllers/entities/client-role/module.mjs";
 import { ClientScopeController } from "./controllers/entities/client-scope/module.mjs";
 import { ClientScopeRequestValidator } from "./controllers/entities/client-scope/utils/validator.mjs";
+import { ConsentController } from "./controllers/entities/consent/module.mjs";
+import { EventController } from "./controllers/entities/event/module.mjs";
 import { IdentityProviderController } from "./controllers/entities/identity-provider/module.mjs";
 import { IdentityProviderRoleMappingController } from "./controllers/entities/identity-provide-role/module.mjs";
+import { KeyController } from "./controllers/entities/key/module.mjs";
 import { PermissionController } from "./controllers/entities/permission/module.mjs";
 import { PermissionPolicyController } from "./controllers/entities/permission-policy/module.mjs";
 import { ActivateController } from "./controllers/workflows/activate/module.mjs";
+import { AuthenticatorChallengeController } from "./controllers/workflows/authenticator-challenge/module.mjs";
 import { AuthorizeController } from "./controllers/workflows/authorize/module.mjs";
 import { getJwkRouteHandler, getJwksRouteHandler } from "./controllers/workflows/jwks/handlers/read.mjs";
 import { JwkController } from "./controllers/workflows/jwks/module.mjs";
+import { LogoutController } from "./controllers/workflows/logout/module.mjs";
 import { OpenIDController } from "./controllers/workflows/openid/module.mjs";
 import { PasswordForgotController } from "./controllers/workflows/password-forgot/module.mjs";
 import { PasswordResetController } from "./controllers/workflows/password-reset/module.mjs";
@@ -77,12 +88,15 @@ import { PolicyController } from "./controllers/entities/policy/module.mjs";
 import { PolicyAttributesValidator } from "./controllers/entities/policy/utils/attributes-validator.mjs";
 import { PolicyValidator } from "./controllers/entities/policy/utils/validation.mjs";
 import { ScopeController } from "./controllers/entities/scope/module.mjs";
+import { SessionController } from "./controllers/entities/session/module.mjs";
+import { TrustAnchorController } from "./controllers/entities/trust-anchor/module.mjs";
 import { UserController } from "./controllers/entities/user/module.mjs";
 import { UserAttributeController } from "./controllers/entities/user-attribute/module.mjs";
 import { UserAttributeRequestValidator } from "./controllers/entities/user-attribute/utils/validation.mjs";
+import { UserAuthenticatorController } from "./controllers/entities/user-authenticator/module.mjs";
 import { UserPermissionController } from "./controllers/entities/user-permission/module.mjs";
 import { UserPermissionRequestValidator } from "./controllers/entities/user-permission/utils/validation.mjs";
 import { UserRoleController } from "./controllers/entities/user-role/module.mjs";
 import { UserRoleRequestValidator } from "./controllers/entities/user-role/utils/validation.mjs";
 import "./controllers/index.mjs";
-export { ActivateController, AuthorizationMiddleware, AuthorizeController, ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, IdentityProviderController, IdentityProviderRoleMappingController, JwkController, LOCALE_COOKIE, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RealmResolverMiddleware, RegisterController, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, RobotController, RobotPermissionController, RobotPermissionRequestValidator, RobotRoleController, RobotRoleRequestValidator, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, StatusController, TokenController, UI_HTTP_CLIENT_FACTORY_STORE_KEY, UserAttributeController, UserAttributeRequestValidator, UserController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator, VITE_SERVER_STORE_KEY, applyRouteRealmIDToBody, buildActorContext, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createSwaggerMiddleware, extractClientCredentialsFromRequest, getBodyRealmID, getJwkRouteHandler, getJwksRouteHandler, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, guessOauth2GrantTypeByRequest, readFromLocations, readStringField, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerUIHttpClientMiddleware, sanitizeRelativeRedirect, setRequestIdentity, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestToken, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestToken };
+export { ActivateController, AuthenticatorChallengeController, AuthorizationMiddleware, AuthorizeController, CERTIFICATE_SOURCES, ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ConsentController, EventController, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, IdentityProviderController, IdentityProviderRoleMappingController, JwkController, KeyController, LOCALE_COOKIE, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RealmResolverMiddleware, RegisterController, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, RobotController, RobotPermissionController, RobotPermissionRequestValidator, RobotRoleController, RobotRoleRequestValidator, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, StatusController, TokenController, TrustAnchorController, UI_HTTP_CLIENT_FACTORY_STORE_KEY, UserAttributeController, UserAttributeRequestValidator, UserAuthenticatorController, UserController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator, VITE_SERVER_STORE_KEY, applyRouteRealmIDToBody, buildActorContext, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createRequestEventContextMiddleware, createRouteTemplateNormalizePath, createSwaggerMiddleware, extractClientCertificateEvidence, extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, getBodyRealmID, getJwkRouteHandler, getJwksRouteHandler, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, guessOauth2GrantTypeByRequest, readFromLocations, readRealmHint, readStringField, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerUIHttpClientMiddleware, runWithRequestEventContext, sanitizeRelativeRedirect, setRequestIdentity, setRequestMfaLoginTicket, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestEventContext, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestMfaLoginTicket, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestSessionId, useRequestToken };

package/dist/adapters/http/middleware/built-in/assets.mjs

@@ -3,8 +3,8 @@ import "node:url";
 import.meta.url;
 import { PACKAGE_PATH, UI_DIST_PATH, UI_SOURCE_PATH } from "../../../../path.mjs";
 import path from "node:path";
-import { CodeTransformation, isCodeTransformation } from "typeorm-extension";
 import { defineCoreHandler } from "routup";
+import { CodeTransformation, isCodeTransformation } from "typeorm-extension";
 import { fromNodeMiddleware } from "routup/node";
 import { load } from "locter";
 import { createHandler } from "@routup/assets";

package/dist/adapters/http/middleware/built-in/authorization/module.d.ts

@@ -1,5 +1,6 @@
 import type { IPermissionEvaluator } from '@authup/access';
 import type { Client, Robot, User } from '@authup/core-kit';
+import type { OAuth2TokenPayload } from '@authup/specs';
 import type { IAppEvent } from 'routup';
 import { type BasicAuthorizationHeader, type BearerAuthorizationHeader } from 'hapic';
 import type { ICredentialsAuthenticator, IIdentityResolver, IOAuth2TokenVerifier, ISessionManager } from '../../../../../core/index.ts';
@@ -19,6 +20,18 @@ export declare class AuthorizationMiddleware {
      * @throws JWTError
      */
     protected verifyBearerAuthorizationHeader(event: IAppEvent, header: BearerAuthorizationHeader): Promise<void>;
+    protected verifyCertificateBinding(event: IAppEvent, payload: OAuth2TokenPayload): Promise<void>;
+    /**
+     * An "MFA-pending" login ticket (issue #3242). Verified with the same
+     * rigor as an access token (session existence + subject match), but
+     * stashed on a DEDICATED request slot — the main identity / scope /
+     * session slots stay empty, so every identity-gated route rejects a
+     * ticket bearer (default-deny); only the challenge routes opt in via
+     * useRequestMfaLoginTicket.
+     *
+     * @throws JWTError
+     */
+    protected verifyMfaLoginTicket(event: IAppEvent, payload: OAuth2TokenPayload): Promise<void>;
     protected verifyBasicAuthorizationHeader(event: IAppEvent, header: BasicAuthorizationHeader): Promise<void>;
 }
 //# sourceMappingURL=module.d.ts.map