@authup/server-core 1.0.0-beta.51 → 1.0.0-beta.53

package/dist/adapters/http/request/client-certificate.mjs

@@ -0,0 +1,88 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { buildClientCertificateThumbprint, parseClientCertificateChain } from "../../../core/client-certificate/module.mjs";
+import "../../../core/index.mjs";
+import { base64ToArrayBuffer } from "@authup/kit";
+import { BadRequestError } from "@authup/errors";
+import { X509Certificate } from "@peculiar/x509";
+//#region src/adapters/http/request/client-certificate.ts
+const MAX_CERTIFICATE_HEADER_LENGTH = 128 * 1024;
+const MAX_CERTIFICATE_CHAIN_LENGTH = 10;
+const STRUCTURED_BINARY_PATTERN = /^:([A-Za-z0-9+/]*={0,2}):$/;
+async function extractClientCertificateEvidence(event, source) {
+	if (source === "disabled") return;
+	let result;
+	if (source === "standard") result = extractStandardEvidence(event);
+	else if (source === "forwarded") result = extractForwardedEvidence(event);
+	else throw new BadRequestError("The client certificate source is not configured correctly.");
+	if (!result) return;
+	return {
+		...result,
+		thumbprint: await buildClientCertificateThumbprint(result.certificate)
+	};
+}
+function extractStandardEvidence(event) {
+	const leafHeader = event.headers.get("client-cert");
+	const chainHeader = event.headers.get("client-cert-chain");
+	if (!leafHeader) {
+		if (chainHeader) throw certificateHeaderError();
+		return;
+	}
+	assertHeaderLength(leafHeader);
+	return {
+		certificate: parseStructuredCertificate(leafHeader),
+		chain: chainHeader ? parseStructuredCertificateList(chainHeader) : []
+	};
+}
+function extractForwardedEvidence(event) {
+	const value = event.headers.get("x-forwarded-tls-client-cert");
+	if (!value) return;
+	assertHeaderLength(value);
+	let pem;
+	try {
+		pem = value.includes("-----BEGIN CERTIFICATE-----") ? value : decodeURIComponent(value.replace(/\+/g, "%20"));
+	} catch {
+		throw certificateHeaderError();
+	}
+	let certificates;
+	try {
+		certificates = parseClientCertificateChain(pem);
+	} catch {
+		throw certificateHeaderError();
+	}
+	if (certificates.length !== 1 || !certificates[0]) throw certificateHeaderError();
+	return {
+		certificate: certificates[0],
+		chain: []
+	};
+}
+function parseStructuredCertificateList(value) {
+	assertHeaderLength(value);
+	const items = value.split(",").map((item) => item.trim());
+	if (items.length > MAX_CERTIFICATE_CHAIN_LENGTH || items.some((item) => item.length === 0)) throw certificateHeaderError();
+	return items.map(parseStructuredCertificate);
+}
+function parseStructuredCertificate(value) {
+	const match = STRUCTURED_BINARY_PATTERN.exec(value.trim());
+	if (!match?.[1]) throw certificateHeaderError();
+	try {
+		const raw = base64ToArrayBuffer(match[1]);
+		if (raw.byteLength === 0) throw certificateHeaderError();
+		const certificate = new X509Certificate(raw);
+		if (certificate.toString("base64").replace(/=+$/, "") !== match[1].replace(/=+$/, "")) throw certificateHeaderError();
+		return certificate;
+	} catch {
+		throw certificateHeaderError();
+	}
+}
+function assertHeaderLength(value) {
+	if (value.length > MAX_CERTIFICATE_HEADER_LENGTH) throw certificateHeaderError();
+}
+function certificateHeaderError() {
+	return new BadRequestError("The forwarded client certificate header is malformed.");
+}
+//#endregion
+export { extractClientCertificateEvidence };
+
+//# sourceMappingURL=client-certificate.mjs.map

package/dist/adapters/http/request/client-certificate.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-certificate.mjs","names":["X509Certificate","BadRequestError","base64ToArrayBuffer","buildClientCertificateThumbprint","parseClientCertificateChain","MAX_CERTIFICATE_HEADER_LENGTH","MAX_CERTIFICATE_CHAIN_LENGTH","STRUCTURED_BINARY_PATTERN","extractClientCertificateEvidence","event","source","undefined","result","extractStandardEvidence","extractForwardedEvidence","thumbprint","certificate","leafHeader","headers","get","chainHeader","certificateHeaderError","assertHeaderLength","parseStructuredCertificate","chain","parseStructuredCertificateList","value","pem","includes","decodeURIComponent","replace","certificates","length","items","split","map","item","trim","some","match","exec","raw","byteLength","toString"],"sources":["../../../../src/adapters/http/request/client-certificate.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { X509Certificate } from '@peculiar/x509';\nimport { BadRequestError } from '@authup/errors';\nimport { base64ToArrayBuffer } from '@authup/kit';\nimport type { IAppEvent } from 'routup';\nimport type { ClientCertificateEvidence } from '../../../core/index.ts';\nimport {\n    buildClientCertificateThumbprint,\n    parseClientCertificateChain,\n} from '../../../core/index.ts';\nimport type { CertificateSource } from './types.ts';\n\nconst MAX_CERTIFICATE_HEADER_LENGTH = 128 * 1024;\nconst MAX_CERTIFICATE_CHAIN_LENGTH = 10;\nconst STRUCTURED_BINARY_PATTERN = /^:([A-Za-z0-9+/]*={0,2}):$/;\n\nexport async function extractClientCertificateEvidence(\n    event: IAppEvent,\n    source: CertificateSource,\n): Promise<ClientCertificateEvidence | undefined> {\n    if (source === 'disabled') {\n        return undefined;\n    }\n\n    let result: Omit<ClientCertificateEvidence, 'thumbprint'> | undefined;\n    if (source === 'standard') {\n        result = extractStandardEvidence(event);\n    } else if (source === 'forwarded') {\n        result = extractForwardedEvidence(event);\n    } else {\n        throw new BadRequestError('The client certificate source is not configured correctly.');\n    }\n    if (!result) {\n        return undefined;\n    }\n\n    return {\n        ...result,\n        thumbprint: await buildClientCertificateThumbprint(result.certificate),\n    };\n}\n\nfunction extractStandardEvidence(\n    event: IAppEvent,\n): Omit<ClientCertificateEvidence, 'thumbprint'> | undefined {\n    const leafHeader = event.headers.get('client-cert');\n    const chainHeader = event.headers.get('client-cert-chain');\n\n    if (!leafHeader) {\n        if (chainHeader) {\n            throw certificateHeaderError();\n        }\n        return undefined;\n    }\n\n    assertHeaderLength(leafHeader);\n    const certificate = parseStructuredCertificate(leafHeader);\n    const chain = chainHeader ? parseStructuredCertificateList(chainHeader) : [];\n\n    return { certificate, chain };\n}\n\nfunction extractForwardedEvidence(\n    event: IAppEvent,\n): Omit<ClientCertificateEvidence, 'thumbprint'> | undefined {\n    const value = event.headers.get('x-forwarded-tls-client-cert');\n    if (!value) {\n        return undefined;\n    }\n\n    assertHeaderLength(value);\n\n    let pem: string;\n    try {\n        // Native raw PEM is useful in tests and a few proxy integrations. The\n        // NGINX/Traefik contract is escaped PEM: query-style `+` represents a\n        // space, while literal base64 plus signs arrive as `%2B`.\n        pem = value.includes('-----BEGIN CERTIFICATE-----') ?\n            value :\n            decodeURIComponent(value.replace(/\\+/g, '%20'));\n    } catch {\n        throw certificateHeaderError();\n    }\n\n    let certificates: X509Certificate[];\n    try {\n        certificates = parseClientCertificateChain(pem);\n    } catch {\n        throw certificateHeaderError();\n    }\n\n    if (certificates.length !== 1 || !certificates[0]) {\n        throw certificateHeaderError();\n    }\n\n    return {\n        certificate: certificates[0],\n        chain: [],\n    };\n}\n\nfunction parseStructuredCertificateList(value: string): X509Certificate[] {\n    assertHeaderLength(value);\n    const items = value.split(',').map((item) => item.trim());\n    if (items.length > MAX_CERTIFICATE_CHAIN_LENGTH || items.some((item) => item.length === 0)) {\n        throw certificateHeaderError();\n    }\n\n    return items.map(parseStructuredCertificate);\n}\n\nfunction parseStructuredCertificate(value: string): X509Certificate {\n    const match = STRUCTURED_BINARY_PATTERN.exec(value.trim());\n    if (!match?.[1]) {\n        throw certificateHeaderError();\n    }\n\n    try {\n        const raw = base64ToArrayBuffer(match[1]);\n        if (raw.byteLength === 0) {\n            throw certificateHeaderError();\n        }\n\n        const certificate = new X509Certificate(raw);\n        if (\n            certificate.toString('base64').replace(/=+$/, '') !==\n            match[1].replace(/=+$/, '')\n        ) {\n            throw certificateHeaderError();\n        }\n\n        return certificate;\n    } catch {\n        throw certificateHeaderError();\n    }\n}\n\nfunction assertHeaderLength(value: string): void {\n    if (value.length > MAX_CERTIFICATE_HEADER_LENGTH) {\n        throw certificateHeaderError();\n    }\n}\n\nfunction certificateHeaderError(): BadRequestError {\n    return new BadRequestError('The forwarded client certificate header is malformed.');\n}\n"],"mappings":";;;;;;;;;AAkBA,MAAMK,gCAAgC,MAAM;AAC5C,MAAMC,+BAA+B;AACrC,MAAMC,4BAA4B;AAElC,eAAsBC,iCAClBC,OACAC,QAAyB;CAEzB,IAAIA,WAAW,YACX;CAGJ,IAAIE;CACJ,IAAIF,WAAW,YACXE,SAASC,wBAAwBJ,KAAAA;MAC9B,IAAIC,WAAW,aAClBE,SAASE,yBAAyBL,KAAAA;MAElC,MAAM,IAAIR,gBAAgB,4DAAA;CAE9B,IAAI,CAACW,QACD;CAGJ,OAAO;EACH,GAAGA;EACHG,YAAY,MAAMZ,iCAAiCS,OAAOI,WAAW;CACzE;AACJ;AAEA,SAASH,wBACLJ,OAAgB;CAEhB,MAAMQ,aAAaR,MAAMS,QAAQC,IAAI,aAAA;CACrC,MAAMC,cAAcX,MAAMS,QAAQC,IAAI,mBAAA;CAEtC,IAAI,CAACF,YAAY;EACb,IAAIG,aACA,MAAMC,uBAAAA;EAEV;CACJ;CAEAC,mBAAmBL,UAAAA;CAInB,OAAO;EAAED,aAHWO,2BAA2BN,UAGtCD;EAAaQ,OAFRJ,cAAcK,+BAA+BL,WAAAA,IAAe,CAAA;CAE9C;AAChC;AAEA,SAASN,yBACLL,OAAgB;CAEhB,MAAMiB,QAAQjB,MAAMS,QAAQC,IAAI,6BAAA;CAChC,IAAI,CAACO,OACD;CAGJJ,mBAAmBI,KAAAA;CAEnB,IAAIC;CACJ,IAAI;EAIAA,MAAMD,MAAME,SAAS,6BAAA,IACjBF,QACAG,mBAAmBH,MAAMI,QAAQ,OAAO,KAAA,CAAA;CAChD,QAAQ;EACJ,MAAMT,uBAAAA;CACV;CAEA,IAAIU;CACJ,IAAI;EACAA,eAAe3B,4BAA4BuB,GAAAA;CAC/C,QAAQ;EACJ,MAAMN,uBAAAA;CACV;CAEA,IAAIU,aAAaC,WAAW,KAAK,CAACD,aAAa,IAC3C,MAAMV,uBAAAA;CAGV,OAAO;EACHL,aAAae,aAAa;EAC1BP,OAAO,CAAA;CACX;AACJ;AAEA,SAASC,+BAA+BC,OAAa;CACjDJ,mBAAmBI,KAAAA;CACnB,MAAMO,QAAQP,MAAMQ,MAAM,GAAA,CAAA,CAAKC,KAAKC,SAASA,KAAKC,KAAI,CAAA;CACtD,IAAIJ,MAAMD,SAAS1B,gCAAgC2B,MAAMK,MAAMF,SAASA,KAAKJ,WAAW,CAAA,GACpF,MAAMX,uBAAAA;CAGV,OAAOY,MAAME,IAAIZ,0BAAAA;AACrB;AAEA,SAASA,2BAA2BG,OAAa;CAC7C,MAAMa,QAAQhC,0BAA0BiC,KAAKd,MAAMW,KAAI,CAAA;CACvD,IAAI,CAACE,QAAQ,IACT,MAAMlB,uBAAAA;CAGV,IAAI;EACA,MAAMoB,MAAMvC,oBAAoBqC,MAAM,EAAE;EACxC,IAAIE,IAAIC,eAAe,GACnB,MAAMrB,uBAAAA;EAGV,MAAML,cAAc,IAAIhB,gBAAgByC,GAAAA;EACxC,IACIzB,YAAY2B,SAAS,QAAA,CAAA,CAAUb,QAAQ,OAAO,EAAA,MAC9CS,MAAM,EAAE,CAACT,QAAQ,OAAO,EAAA,GAExB,MAAMT,uBAAAA;EAGV,OAAOL;CACX,QAAQ;EACJ,MAAMK,uBAAAA;CACV;AACJ;AAEA,SAASC,mBAAmBI,OAAa;CACrC,IAAIA,MAAMM,SAAS3B,+BACf,MAAMgB,uBAAAA;AAEd;AAEA,SAASA,yBAAAA;CACL,OAAO,IAAIpB,gBAAgB,uDAAA;AAC/B"}

package/dist/adapters/http/request/constants.d.ts

@@ -5,4 +5,5 @@ export declare enum RequestHandlerOperation {
     UPDATE = "update",
     DELETE = "delete"
 }
+export declare const CERTIFICATE_SOURCES: readonly ["disabled", "standard", "forwarded"];
 //# sourceMappingURL=constants.d.ts.map

package/dist/adapters/http/request/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/request/constants.ts"],"names":[],"mappings":"AAOA,oBAAY,uBAAuB;IAC/B,OAAO,YAAY;IACnB,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,MAAM,WAAW;IACjB,MAAM,WAAW;CACpB"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/request/constants.ts"],"names":[],"mappings":"AAOA,oBAAY,uBAAuB;IAC/B,OAAO,YAAY;IACnB,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,MAAM,WAAW;IACjB,MAAM,WAAW;CACpB;AAED,eAAO,MAAM,mBAAmB,gDAItB,CAAC"}

package/dist/adapters/http/request/constants.mjs

@@ -10,7 +10,12 @@ var RequestHandlerOperation = /*#__PURE__*/ function(RequestHandlerOperation) {
 	RequestHandlerOperation["DELETE"] = "delete";
 	return RequestHandlerOperation;
 }({});
+const CERTIFICATE_SOURCES = [
+	"disabled",
+	"standard",
+	"forwarded"
+];
 //#endregion
-export { RequestHandlerOperation };
+export { CERTIFICATE_SOURCES, RequestHandlerOperation };
 
 //# sourceMappingURL=constants.mjs.map

package/dist/adapters/http/request/constants.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"constants.mjs","names":["RequestHandlerOperation"],"sources":["../../../../src/adapters/http/request/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nexport enum RequestHandlerOperation {\n    COMMAND = 'command',\n    CREATE = 'create',\n    READ = 'read',\n    UPDATE = 'update',\n    DELETE = 'delete',\n}\n"],"mappings":";;;;AAOA,IAAO,0BAAKA,uBAAAA,yBAAAA;;;;;;QAAAA"}
+{"version":3,"file":"constants.mjs","names":["RequestHandlerOperation","CERTIFICATE_SOURCES"],"sources":["../../../../src/adapters/http/request/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nexport enum RequestHandlerOperation {\n    COMMAND = 'command',\n    CREATE = 'create',\n    READ = 'read',\n    UPDATE = 'update',\n    DELETE = 'delete',\n}\n\nexport const CERTIFICATE_SOURCES = [\n    'disabled',\n    'standard',\n    'forwarded',\n] as const;\n"],"mappings":";;;;AAOA,IAAO,0BAAKA,uBAAAA,yBAAAA;;;;;;QAAAA;;AAQZ,MAAaC,sBAAsB;CAC/B;CACA;CACA"}

package/dist/adapters/http/request/event-context.d.ts

@@ -0,0 +1,19 @@
+import type { Handler } from 'routup';
+import type { EventRequestContext } from '../../../core/index.ts';
+/**
+ * Actor + request attribution snapshot for entity-CRUD audit rows, carried
+ * across the request's async continuation via AsyncLocalStorage so the
+ * database subscribers (which have no request handle) can attribute their
+ * writes. Writes outside HTTP (provisioning, CLI, cron) have no store —
+ * the getter returns undefined, the correct "system" semantics.
+ */
+export type RequestEventContext = EventRequestContext;
+export declare function runWithRequestEventContext<R>(ctx: RequestEventContext, fn: () => R): R;
+export declare function useRequestEventContext(): RequestEventContext | undefined;
+/**
+ * Builds the {@link RequestEventContext} from the routup event and wraps the
+ * downstream pipeline in it. Must be mounted AFTER the authorization
+ * middleware — the identity has to be resolved for actor attribution.
+ */
+export declare function createRequestEventContextMiddleware(): Handler;
+//# sourceMappingURL=event-context.d.ts.map

package/dist/adapters/http/request/event-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-context.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/request/event-context.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAGlE;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAItD,wBAAgB,0BAA0B,CAAC,CAAC,EACxC,GAAG,EAAE,mBAAmB,EACxB,EAAE,EAAE,MAAM,CAAC,GACZ,CAAC,CAEH;AAED,wBAAgB,sBAAsB,IAAI,mBAAmB,GAAG,SAAS,CAExE;AAED;;;;GAIG;AACH,wBAAgB,mCAAmC,IAAK,OAAO,CAgB9D"}

package/dist/adapters/http/request/event-context.mjs

@@ -0,0 +1,37 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { useRequestIdentity } from "./helpers/identity.mjs";
+import "./helpers/index.mjs";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { defineCoreHandler, getRequestHeader, getRequestIP } from "routup";
+//#region src/adapters/http/request/event-context.ts
+const storage = new AsyncLocalStorage();
+function runWithRequestEventContext(ctx, fn) {
+	return storage.run(ctx, fn);
+}
+function useRequestEventContext() {
+	return storage.getStore();
+}
+/**
+* Builds the {@link RequestEventContext} from the routup event and wraps the
+* downstream pipeline in it. Must be mounted AFTER the authorization
+* middleware — the identity has to be resolved for actor attribution.
+*/ function createRequestEventContextMiddleware() {
+	return defineCoreHandler(async (event) => {
+		const identity = useRequestIdentity(event);
+		return runWithRequestEventContext({
+			actorType: identity ? identity.type : null,
+			actorId: identity ? identity.id : null,
+			actorName: identity ? identity.data.name ?? null : null,
+			requestPath: event.path,
+			requestMethod: event.method,
+			requestIpAddress: getRequestIP(event, { trustProxy: true }) ?? null,
+			requestUserAgent: getRequestHeader(event, "user-agent") ?? null
+		}, () => event.next());
+	});
+}
+//#endregion
+export { createRequestEventContextMiddleware, runWithRequestEventContext, useRequestEventContext };
+
+//# sourceMappingURL=event-context.mjs.map

package/dist/adapters/http/request/event-context.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-context.mjs","names":["AsyncLocalStorage","defineCoreHandler","getRequestHeader","getRequestIP","useRequestIdentity","storage","runWithRequestEventContext","ctx","fn","run","useRequestEventContext","getStore","createRequestEventContextMiddleware","event","identity","actorType","type","actorId","id","actorName","data","name","requestPath","path","requestMethod","method","requestIpAddress","trustProxy","requestUserAgent","next"],"sources":["../../../../src/adapters/http/request/event-context.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { AsyncLocalStorage } from 'node:async_hooks';\nimport { defineCoreHandler, getRequestHeader, getRequestIP } from 'routup';\nimport type { Handler } from 'routup';\nimport type { EventRequestContext } from '../../../core/index.ts';\nimport { useRequestIdentity } from './helpers/index.ts';\n\n/**\n * Actor + request attribution snapshot for entity-CRUD audit rows, carried\n * across the request's async continuation via AsyncLocalStorage so the\n * database subscribers (which have no request handle) can attribute their\n * writes. Writes outside HTTP (provisioning, CLI, cron) have no store —\n * the getter returns undefined, the correct \"system\" semantics.\n */\nexport type RequestEventContext = EventRequestContext;\n\nconst storage = new AsyncLocalStorage<RequestEventContext>();\n\nexport function runWithRequestEventContext<R>(\n    ctx: RequestEventContext,\n    fn: () => R,\n): R {\n    return storage.run(ctx, fn);\n}\n\nexport function useRequestEventContext(): RequestEventContext | undefined {\n    return storage.getStore();\n}\n\n/**\n * Builds the {@link RequestEventContext} from the routup event and wraps the\n * downstream pipeline in it. Must be mounted AFTER the authorization\n * middleware — the identity has to be resolved for actor attribution.\n */\nexport function createRequestEventContextMiddleware() : Handler {\n    return defineCoreHandler(async (event) => {\n        const identity = useRequestIdentity(event);\n\n        const ctx : RequestEventContext = {\n            actorType: identity ? identity.type : null,\n            actorId: identity ? identity.id : null,\n            actorName: identity ? identity.data.name ?? null : null,\n            requestPath: event.path,\n            requestMethod: event.method,\n            requestIpAddress: getRequestIP(event, { trustProxy: true }) ?? null,\n            requestUserAgent: getRequestHeader(event, 'user-agent') ?? null,\n        };\n\n        return runWithRequestEventContext(ctx, () => event.next());\n    });\n}\n"],"mappings":";;;;;;;;AAsBA,MAAMK,UAAU,IAAIL,kBAAAA;AAEpB,SAAgBM,2BACZC,KACAC,IAAW;CAEX,OAAOH,QAAQI,IAAIF,KAAKC,EAAAA;AAC5B;AAEA,SAAgBE,yBAAAA;CACZ,OAAOL,QAAQM,SAAQ;AAC3B;;;;;GAOA,SAAgBC,sCAAAA;CACZ,OAAOX,kBAAkB,OAAOY,UAAAA;EAC5B,MAAMC,WAAWV,mBAAmBS,KAAAA;EAYpC,OAAOP,2BAA2BC;GAT9BQ,WAAWD,WAAWA,SAASE,OAAO;GACtCC,SAASH,WAAWA,SAASI,KAAK;GAClCC,WAAWL,WAAWA,SAASM,KAAKC,QAAQ,OAAO;GACnDC,aAAaT,MAAMU;GACnBC,eAAeX,MAAMY;GACrBC,kBAAkBvB,aAAaU,OAAO,EAAEc,YAAY,KAAK,CAAA,KAAM;GAC/DC,kBAAkB1B,iBAAiBW,OAAO,YAAA,KAAiB;EAG7BN,SAAWM,MAAMgB,KAAI,CAAA;CAC3D,CAAA;AACJ"}

package/dist/adapters/http/request/helpers/index.d.ts

@@ -3,9 +3,11 @@ export * from './body-realm-id.ts';
 export * from './identity.ts';
 export * from './locale.ts';
 export * from './locations.ts';
+export * from './mfa-login-ticket.ts';
 export * from './param-id.ts';
 export * from './realm-id.ts';
 export * from './redirect.ts';
 export * from './scopes.ts';
+export * from './session-id.ts';
 export * from './token.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/request/helpers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/helpers/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/helpers/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,YAAY,CAAC"}

package/dist/adapters/http/request/helpers/index.mjs

@@ -6,9 +6,11 @@ import { buildActorContext } from "./actor.mjs";
 import { getBodyRealmID } from "./body-realm-id.mjs";
 import { LOCALE_COOKIE, useRequestLocale } from "./locale.mjs";
 import { readFromLocations } from "./locations.mjs";
+import { setRequestMfaLoginTicket, useRequestMfaLoginTicket } from "./mfa-login-ticket.mjs";
 import { getRequestParamID, getRequestStringParam, getRequestStringParamOrFail, useRequestParamID } from "./param-id.mjs";
 import { applyRouteRealmIDToBody, getRequestRealmID, setRequestRealmID } from "./realm-id.mjs";
 import { sanitizeRelativeRedirect } from "./redirect.mjs";
 import { setRequestScopes, useRequestScopes } from "./scopes.mjs";
+import { setRequestSessionId, useRequestSessionId } from "./session-id.mjs";
 import { setRequestToken, useRequestToken } from "./token.mjs";
-export { LOCALE_COOKIE, RequestIdentity, applyRouteRealmIDToBody, buildActorContext, getBodyRealmID, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, readFromLocations, sanitizeRelativeRedirect, setRequestIdentity, setRequestRealmID, setRequestScopes, setRequestToken, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestParamID, useRequestScopes, useRequestToken };
+export { LOCALE_COOKIE, RequestIdentity, applyRouteRealmIDToBody, buildActorContext, getBodyRealmID, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, readFromLocations, sanitizeRelativeRedirect, setRequestIdentity, setRequestMfaLoginTicket, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestMfaLoginTicket, useRequestParamID, useRequestScopes, useRequestSessionId, useRequestToken };

package/dist/adapters/http/request/helpers/mfa-login-ticket.d.ts

@@ -0,0 +1,16 @@
+import type { OAuth2TokenPayload } from '@authup/specs';
+import type { IAppEvent } from 'routup';
+import type { RequestIdentity } from './identity.ts';
+/**
+ * A verified "MFA-pending" login ticket (kind: mfa_token, issue #3242) —
+ * stashed on its own request slot, NEVER the main identity slot, so every
+ * identity-gated route stays default-deny for a ticket bearer. Only the
+ * challenge routes read it.
+ */
+export type RequestMfaLoginTicket = {
+    identity: RequestIdentity;
+    payload: OAuth2TokenPayload;
+};
+export declare function useRequestMfaLoginTicket(event: IAppEvent): RequestMfaLoginTicket | undefined;
+export declare function setRequestMfaLoginTicket(event: IAppEvent, input: RequestMfaLoginTicket): void;
+//# sourceMappingURL=mfa-login-ticket.d.ts.map

package/dist/adapters/http/request/helpers/mfa-login-ticket.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-login-ticket.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/helpers/mfa-login-ticket.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAIrD;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAChC,QAAQ,EAAE,eAAe,CAAC;IAC1B,OAAO,EAAE,kBAAkB,CAAC;CAC/B,CAAC;AAEF,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,SAAS,GAAI,qBAAqB,GAAG,SAAS,CAE7F;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,qBAAqB,GAAI,IAAI,CAE9F"}

package/dist/adapters/http/request/helpers/mfa-login-ticket.mjs

@@ -0,0 +1,15 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/adapters/http/request/helpers/mfa-login-ticket.ts
+const sym = Symbol("RMfaLoginTicket");
+function useRequestMfaLoginTicket(event) {
+	return event.store[sym];
+}
+function setRequestMfaLoginTicket(event, input) {
+	event.store[sym] = input;
+}
+//#endregion
+export { setRequestMfaLoginTicket, useRequestMfaLoginTicket };
+
+//# sourceMappingURL=mfa-login-ticket.mjs.map

package/dist/adapters/http/request/helpers/mfa-login-ticket.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-login-ticket.mjs","names":["sym","Symbol","useRequestMfaLoginTicket","event","store","setRequestMfaLoginTicket","input"],"sources":["../../../../../src/adapters/http/request/helpers/mfa-login-ticket.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport type { IAppEvent } from 'routup';\nimport type { RequestIdentity } from './identity.ts';\n\nconst sym = Symbol('RMfaLoginTicket');\n\n/**\n * A verified \"MFA-pending\" login ticket (kind: mfa_token, issue #3242) —\n * stashed on its own request slot, NEVER the main identity slot, so every\n * identity-gated route stays default-deny for a ticket bearer. Only the\n * challenge routes read it.\n */\nexport type RequestMfaLoginTicket = {\n    identity: RequestIdentity,\n    payload: OAuth2TokenPayload,\n};\n\nexport function useRequestMfaLoginTicket(event: IAppEvent) : RequestMfaLoginTicket | undefined {\n    return event.store[sym] as RequestMfaLoginTicket | undefined;\n}\n\nexport function setRequestMfaLoginTicket(event: IAppEvent, input: RequestMfaLoginTicket) : void {\n    event.store[sym] = input;\n}\n"],"mappings":";;;;AAWA,MAAMA,MAAMC,OAAO,iBAAA;AAanB,SAAgBC,yBAAyBC,OAAgB;CACrD,OAAOA,MAAMC,MAAMJ;AACvB;AAEA,SAAgBK,yBAAyBF,OAAkBG,OAA4B;CACnFH,MAAMC,MAAMJ,OAAOM;AACvB"}

package/dist/adapters/http/request/helpers/session-id.d.ts

@@ -0,0 +1,9 @@
+import type { IAppEvent } from 'routup';
+/**
+ * The id of the session the current bearer token belongs to (stashed by the
+ * authorization middleware). Used by `/sessions` self-service (e.g. "revoke all
+ * my other sessions").
+ */
+export declare function useRequestSessionId(event: IAppEvent): string | undefined;
+export declare function setRequestSessionId(event: IAppEvent, id: string): void;
+//# sourceMappingURL=session-id.d.ts.map

package/dist/adapters/http/request/helpers/session-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-id.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/helpers/session-id.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAIxC;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS,CAExE;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,CAEtE"}

package/dist/adapters/http/request/helpers/session-id.mjs

@@ -0,0 +1,19 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/adapters/http/request/helpers/session-id.ts
+const sym = Symbol("RSessionId");
+/**
+* The id of the session the current bearer token belongs to (stashed by the
+* authorization middleware). Used by `/sessions` self-service (e.g. "revoke all
+* my other sessions").
+*/ function useRequestSessionId(event) {
+	return event.store[sym];
+}
+function setRequestSessionId(event, id) {
+	event.store[sym] = id;
+}
+//#endregion
+export { setRequestSessionId, useRequestSessionId };
+
+//# sourceMappingURL=session-id.mjs.map

package/dist/adapters/http/request/helpers/session-id.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-id.mjs","names":["sym","Symbol","useRequestSessionId","event","store","setRequestSessionId","id"],"sources":["../../../../../src/adapters/http/request/helpers/session-id.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IAppEvent } from 'routup';\n\nconst sym = Symbol('RSessionId');\n\n/**\n * The id of the session the current bearer token belongs to (stashed by the\n * authorization middleware). Used by `/sessions` self-service (e.g. \"revoke all\n * my other sessions\").\n */\nexport function useRequestSessionId(event: IAppEvent): string | undefined {\n    return event.store[sym] as string | undefined;\n}\n\nexport function setRequestSessionId(event: IAppEvent, id: string): void {\n    event.store[sym] = id;\n}\n"],"mappings":";;;;AASA,MAAMA,MAAMC,OAAO,YAAA;;;;;GAOnB,SAAgBC,oBAAoBC,OAAgB;CAChD,OAAOA,MAAMC,MAAMJ;AACvB;AAEA,SAAgBK,oBAAoBF,OAAkBG,IAAU;CAC5DH,MAAMC,MAAMJ,OAAOM;AACvB"}

package/dist/adapters/http/request/index.d.ts

@@ -1,4 +1,7 @@
 export * from './constants.ts';
+export * from './client-certificate.ts';
+export * from './event-context.ts';
 export * from './helpers/index.ts';
 export * from './permission/index.ts';
+export * from './types.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/request/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/request/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/request/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC;AACtC,cAAc,YAAY,CAAC"}

package/dist/adapters/http/request/index.mjs

@@ -1,19 +1,23 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { RequestHandlerOperation } from "./constants.mjs";
+import { CERTIFICATE_SOURCES, RequestHandlerOperation } from "./constants.mjs";
+import { extractClientCertificateEvidence } from "./client-certificate.mjs";
 import { setRequestPermissionEvaluator, useRequestPermissionEvaluator } from "./permission/helper.mjs";
 import { RequestIdentity, setRequestIdentity, useRequestIdentity, useRequestIdentityOrFail } from "./helpers/identity.mjs";
 import { buildActorContext } from "./helpers/actor.mjs";
 import { getBodyRealmID } from "./helpers/body-realm-id.mjs";
 import { LOCALE_COOKIE, useRequestLocale } from "./helpers/locale.mjs";
 import { readFromLocations } from "./helpers/locations.mjs";
+import { setRequestMfaLoginTicket, useRequestMfaLoginTicket } from "./helpers/mfa-login-ticket.mjs";
 import { getRequestParamID, getRequestStringParam, getRequestStringParamOrFail, useRequestParamID } from "./helpers/param-id.mjs";
 import { applyRouteRealmIDToBody, getRequestRealmID, setRequestRealmID } from "./helpers/realm-id.mjs";
 import { sanitizeRelativeRedirect } from "./helpers/redirect.mjs";
 import { setRequestScopes, useRequestScopes } from "./helpers/scopes.mjs";
+import { setRequestSessionId, useRequestSessionId } from "./helpers/session-id.mjs";
 import { setRequestToken, useRequestToken } from "./helpers/token.mjs";
 import "./helpers/index.mjs";
+import { createRequestEventContextMiddleware, runWithRequestEventContext, useRequestEventContext } from "./event-context.mjs";
 import { RequestPermissionEvaluator } from "./permission/module.mjs";
 import "./permission/index.mjs";
-export { LOCALE_COOKIE, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, applyRouteRealmIDToBody, buildActorContext, getBodyRealmID, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, readFromLocations, sanitizeRelativeRedirect, setRequestIdentity, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestToken, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestToken };
+export { CERTIFICATE_SOURCES, LOCALE_COOKIE, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, applyRouteRealmIDToBody, buildActorContext, createRequestEventContextMiddleware, extractClientCertificateEvidence, getBodyRealmID, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, readFromLocations, runWithRequestEventContext, sanitizeRelativeRedirect, setRequestIdentity, setRequestMfaLoginTicket, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestEventContext, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestMfaLoginTicket, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestSessionId, useRequestToken };

package/dist/adapters/http/request/permission/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/permission/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACR,oBAAoB,EACpB,2BAA2B,EAC9B,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGxC,qBAAa,0BAA2B,YAAW,oBAAoB;IACnE,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC;IAE3B,SAAS,CAAC,SAAS,EAAE,oBAAoB,CAAC;gBAE9B,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,oBAAoB;IAOvD,QAAQ,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAI1D,WAAW,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAM7D,gBAAgB,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAIlE,aAAa,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAMrE,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,2BAA2B;CAS3D"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/permission/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACR,oBAAoB,EACpB,2BAA2B,EAC9B,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGxC,qBAAa,0BAA2B,YAAW,oBAAoB;IACnE,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC;IAE3B,SAAS,CAAC,SAAS,EAAE,oBAAoB,CAAC;gBAE9B,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,oBAAoB;IAOvD,QAAQ,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAI1D,WAAW,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAM7D,gBAAgB,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAIlE,aAAa,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAMrE,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,2BAA2B;CAiB3D"}

package/dist/adapters/http/request/permission/module.mjs

@@ -27,9 +27,11 @@ var RequestPermissionEvaluator = class {
 		return this.evaluator.evaluateOneOf(this.extendContext(ctx));
 	}
 	extendContext(ctx) {
-		if (useRequestScopes(this.event).includes(ScopeName.GLOBAL)) {
+		const scopes = useRequestScopes(this.event);
+		const identity = useRequestIdentity(this.event);
+		if (scopes.includes(ScopeName.GLOBAL) && identity) {
 			ctx.data = ctx.data || new PolicyData();
-			ctx.data.set(BuiltInPolicyType.IDENTITY, useRequestIdentity(this.event));
+			ctx.data.set(BuiltInPolicyType.IDENTITY, identity);
 		}
 		return ctx;
 	}

package/dist/adapters/http/request/permission/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["ScopeName","BuiltInPolicyType","PolicyData","useRequestIdentity","useRequestScopes","RequestPermissionEvaluator","event","evaluator","evaluate","ctx","extendContext","preEvaluate","preEvaluateOneOf","evaluateOneOf","scopes","includes","GLOBAL","data","set","IDENTITY"],"sources":["../../../../../src/adapters/http/request/permission/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ScopeName } from '@authup/core-kit';\nimport type {\n    IPermissionEvaluator,\n    PermissionEvaluationContext,\n} from '@authup/access';\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport type { IAppEvent } from 'routup';\nimport { useRequestIdentity, useRequestScopes } from '../helpers/index.ts';\n\nexport class RequestPermissionEvaluator implements IPermissionEvaluator {\n    protected event: IAppEvent;\n\n    protected evaluator: IPermissionEvaluator;\n\n    constructor(event: IAppEvent, evaluator: IPermissionEvaluator) {\n        this.event = event;\n        this.evaluator = evaluator;\n    }\n\n    // --------------------------------------------------------------\n\n    async evaluate(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.evaluate(this.extendContext(ctx));\n    }\n\n    async preEvaluate(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.preEvaluate(this.extendContext(ctx));\n    }\n\n    // --------------------------------------------------------------\n\n    async preEvaluateOneOf(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.preEvaluateOneOf(this.extendContext(ctx));\n    }\n\n    async evaluateOneOf(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.evaluateOneOf(this.extendContext(ctx));\n    }\n\n    // --------------------------------------------------------------\n\n    protected extendContext(ctx: PermissionEvaluationContext) {\n        const scopes = useRequestScopes(this.event);\n        if (scopes.includes(ScopeName.GLOBAL)) {\n            ctx.data = ctx.data || new PolicyData();\n            ctx.data.set(BuiltInPolicyType.IDENTITY, useRequestIdentity(this.event));\n        }\n\n        return ctx;\n    }\n}\n"],"mappings":";;;;;;;;;AAgBA,IAAaK,6BAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,OAAkBC,WAAiC;EAC3D,KAAKD,QAAQA;EACb,KAAKC,YAAYA;CACrB;CAIA,MAAMC,SAASC,KAAkD;EAC7D,OAAO,KAAKF,UAAUC,SAAS,KAAKE,cAAcD,GAAAA,CAAAA;CACtD;CAEA,MAAME,YAAYF,KAAkD;EAChE,OAAO,KAAKF,UAAUI,YAAY,KAAKD,cAAcD,GAAAA,CAAAA;CACzD;CAIA,MAAMG,iBAAiBH,KAAkD;EACrE,OAAO,KAAKF,UAAUK,iBAAiB,KAAKF,cAAcD,GAAAA,CAAAA;CAC9D;CAEA,MAAMI,cAAcJ,KAAkD;EAClE,OAAO,KAAKF,UAAUM,cAAc,KAAKH,cAAcD,GAAAA,CAAAA;CAC3D;CAIUC,cAAcD,KAAkC;EAEtD,IADeL,iBAAiB,KAAKE,KACjCQ,CAAAA,CAAOC,SAASf,UAAUgB,MAAM,GAAG;GACnCP,IAAIQ,OAAOR,IAAIQ,QAAQ,IAAIf,WAAAA;GAC3BO,IAAIQ,KAAKC,IAAIjB,kBAAkBkB,UAAUhB,mBAAmB,KAAKG,KAAK,CAAA;EAC1E;EAEA,OAAOG;CACX;AACJ"}
+{"version":3,"file":"module.mjs","names":["ScopeName","BuiltInPolicyType","PolicyData","useRequestIdentity","useRequestScopes","RequestPermissionEvaluator","event","evaluator","evaluate","ctx","extendContext","preEvaluate","preEvaluateOneOf","evaluateOneOf","scopes","identity","includes","GLOBAL","data","set","IDENTITY"],"sources":["../../../../../src/adapters/http/request/permission/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ScopeName } from '@authup/core-kit';\nimport type {\n    IPermissionEvaluator,\n    PermissionEvaluationContext,\n} from '@authup/access';\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport type { IAppEvent } from 'routup';\nimport { useRequestIdentity, useRequestScopes } from '../helpers/index.ts';\n\nexport class RequestPermissionEvaluator implements IPermissionEvaluator {\n    protected event: IAppEvent;\n\n    protected evaluator: IPermissionEvaluator;\n\n    constructor(event: IAppEvent, evaluator: IPermissionEvaluator) {\n        this.event = event;\n        this.evaluator = evaluator;\n    }\n\n    // --------------------------------------------------------------\n\n    async evaluate(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.evaluate(this.extendContext(ctx));\n    }\n\n    async preEvaluate(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.preEvaluate(this.extendContext(ctx));\n    }\n\n    // --------------------------------------------------------------\n\n    async preEvaluateOneOf(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.preEvaluateOneOf(this.extendContext(ctx));\n    }\n\n    async evaluateOneOf(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.evaluateOneOf(this.extendContext(ctx));\n    }\n\n    // --------------------------------------------------------------\n\n    protected extendContext(ctx: PermissionEvaluationContext) {\n        const scopes = useRequestScopes(this.event);\n        const identity = useRequestIdentity(this.event);\n\n        // Only attach the identity policy data when an identity was actually\n        // resolved. Setting it to `undefined` would still make\n        // `PolicyData.has('identity')` true (key presence), so the built-in\n        // identity evaluator would run its validator against `undefined` and\n        // throw an uncaught error instead of a clean permission denial — see\n        // the deleted-subject edge case in issue #3184.\n        if (scopes.includes(ScopeName.GLOBAL) && identity) {\n            ctx.data = ctx.data || new PolicyData();\n            ctx.data.set(BuiltInPolicyType.IDENTITY, identity);\n        }\n\n        return ctx;\n    }\n}\n"],"mappings":";;;;;;;;;AAgBA,IAAaK,6BAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,OAAkBC,WAAiC;EAC3D,KAAKD,QAAQA;EACb,KAAKC,YAAYA;CACrB;CAIA,MAAMC,SAASC,KAAkD;EAC7D,OAAO,KAAKF,UAAUC,SAAS,KAAKE,cAAcD,GAAAA,CAAAA;CACtD;CAEA,MAAME,YAAYF,KAAkD;EAChE,OAAO,KAAKF,UAAUI,YAAY,KAAKD,cAAcD,GAAAA,CAAAA;CACzD;CAIA,MAAMG,iBAAiBH,KAAkD;EACrE,OAAO,KAAKF,UAAUK,iBAAiB,KAAKF,cAAcD,GAAAA,CAAAA;CAC9D;CAEA,MAAMI,cAAcJ,KAAkD;EAClE,OAAO,KAAKF,UAAUM,cAAc,KAAKH,cAAcD,GAAAA,CAAAA;CAC3D;CAIUC,cAAcD,KAAkC;EACtD,MAAMK,SAASV,iBAAiB,KAAKE,KAAK;EAC1C,MAAMS,WAAWZ,mBAAmB,KAAKG,KAAK;EAQ9C,IAAIQ,OAAOE,SAAShB,UAAUiB,MAAM,KAAKF,UAAU;GAC/CN,IAAIS,OAAOT,IAAIS,QAAQ,IAAIhB,WAAAA;GAC3BO,IAAIS,KAAKC,IAAIlB,kBAAkBmB,UAAUL,QAAAA;EAC7C;EAEA,OAAON;CACX;AACJ"}

package/dist/adapters/http/request/types.d.ts

@@ -0,0 +1,3 @@
+import type { CERTIFICATE_SOURCES } from './constants.ts';
+export type CertificateSource = typeof CERTIFICATE_SOURCES[number];
+//# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/request/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/request/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,MAAM,MAAM,iBAAiB,GAAG,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC"}

package/dist/adapters/http/ui/index.d.ts

@@ -1,4 +1,5 @@
 export * from './base-path.ts';
+export * from './internal-http-client.ts';
 export * from './render.ts';
 export * from './serve.ts';
 export * from './types.ts';

package/dist/adapters/http/ui/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/ui/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/ui/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC"}

package/dist/adapters/http/ui/index.mjs

@@ -2,6 +2,7 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { rebasePublicAssetURLs } from "./base-path.mjs";
+import { createInternalUIHttpClient, createPublicToInternalURLRewriter } from "./internal-http-client.mjs";
 import { renderUIPage } from "./render.mjs";
 import { serveWorkflowPage } from "./serve.mjs";
-export { rebasePublicAssetURLs, renderUIPage, serveWorkflowPage };
+export { createInternalUIHttpClient, createPublicToInternalURLRewriter, rebasePublicAssetURLs, renderUIPage, serveWorkflowPage };

package/dist/adapters/http/ui/internal-http-client.d.ts

@@ -0,0 +1,22 @@
+import type { IClient } from '@authup/core-http-kit';
+import type { InternalUIHttpClientContext } from './types.ts';
+/**
+ * Build a rewriter that maps URLs under the public base URL
+ * (scheme://host[/prefix]) onto the server's own listen address. URLs
+ * outside the public origin/prefix pass through untouched.
+ */
+export declare function createPublicToInternalURLRewriter(publicURL: string, internalURL: string): (url: string) => string;
+/**
+ * HTTP client for the SSR'd UI pages: the render's API calls target the
+ * server itself, so they are dispatched against its own listen address —
+ * no reverse-proxy round-trip, no TLS (a self-signed publicUrl certificate
+ * would otherwise fail Node's fetch), no dependency on the public hostname
+ * resolving from inside the deployment.
+ *
+ * The rewrite happens at the TRANSPORT layer only: `baseURL` must stay the
+ * public URL because the rendered HTML derives user-facing URLs from it
+ * (e.g. the identity-provider authorize hrefs via `getAuthorizeUri`), and
+ * hydration does not patch attribute mismatches.
+ */
+export declare function createInternalUIHttpClient(ctx: InternalUIHttpClientContext): IClient;
+//# sourceMappingURL=internal-http-client.d.ts.map

package/dist/adapters/http/ui/internal-http-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-http-client.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/ui/internal-http-client.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAE9D;;;;GAIG;AACH,wBAAgB,iCAAiC,CAC7C,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GACnB,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAmC1B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAOrF"}

package/dist/adapters/http/ui/internal-http-client.mjs

@@ -0,0 +1,52 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { Client } from "@authup/core-http-kit";
+import { FetchTransport, fetch } from "hapic";
+//#region src/adapters/http/ui/internal-http-client.ts
+/**
+* Build a rewriter that maps URLs under the public base URL
+* (scheme://host[/prefix]) onto the server's own listen address. URLs
+* outside the public origin/prefix pass through untouched.
+*/ function createPublicToInternalURLRewriter(publicURL, internalURL) {
+	const publicParsed = new URL(publicURL);
+	const internalParsed = new URL(internalURL);
+	if (internalParsed.hostname === "0.0.0.0" || internalParsed.hostname === "[::]") internalParsed.hostname = "127.0.0.1";
+	const basePath = publicParsed.pathname.replace(/\/+$/, "");
+	return (url) => {
+		let parsed;
+		try {
+			parsed = new URL(url);
+		} catch {
+			return url;
+		}
+		if (parsed.origin !== publicParsed.origin) return url;
+		let { pathname } = parsed;
+		if (basePath) if (pathname === basePath) pathname = "/";
+		else if (pathname.startsWith(`${basePath}/`)) pathname = pathname.substring(basePath.length);
+		else return url;
+		return new URL(pathname + parsed.search, internalParsed.origin).href;
+	};
+}
+/**
+* HTTP client for the SSR'd UI pages: the render's API calls target the
+* server itself, so they are dispatched against its own listen address —
+* no reverse-proxy round-trip, no TLS (a self-signed publicUrl certificate
+* would otherwise fail Node's fetch), no dependency on the public hostname
+* resolving from inside the deployment.
+*
+* The rewrite happens at the TRANSPORT layer only: `baseURL` must stay the
+* public URL because the rendered HTML derives user-facing URLs from it
+* (e.g. the identity-provider authorize hrefs via `getAuthorizeUri`), and
+* hydration does not patch attribute mismatches.
+*/ function createInternalUIHttpClient(ctx) {
+	const rewriteURL = createPublicToInternalURLRewriter(ctx.publicURL, ctx.internalURL);
+	return new Client({
+		baseURL: ctx.publicURL,
+		transport: new FetchTransport({ fetch: (input, init) => fetch(rewriteURL(input), init) })
+	});
+}
+//#endregion
+export { createInternalUIHttpClient, createPublicToInternalURLRewriter };
+
+//# sourceMappingURL=internal-http-client.mjs.map

package/dist/adapters/http/ui/internal-http-client.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-http-client.mjs","names":["Client","FetchTransport","fetch","createPublicToInternalURLRewriter","publicURL","internalURL","publicParsed","URL","internalParsed","hostname","basePath","pathname","replace","url","parsed","origin","startsWith","substring","length","search","href","createInternalUIHttpClient","ctx","rewriteURL","baseURL","transport","input","init"],"sources":["../../../../src/adapters/http/ui/internal-http-client.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { Client } from '@authup/core-http-kit';\nimport type { IClient } from '@authup/core-http-kit';\nimport { FetchTransport, fetch } from 'hapic';\nimport type { InternalUIHttpClientContext } from './types.ts';\n\n/**\n * Build a rewriter that maps URLs under the public base URL\n * (scheme://host[/prefix]) onto the server's own listen address. URLs\n * outside the public origin/prefix pass through untouched.\n */\nexport function createPublicToInternalURLRewriter(\n    publicURL: string,\n    internalURL: string,\n) : (url: string) => string {\n    const publicParsed = new URL(publicURL);\n    const internalParsed = new URL(internalURL);\n    // a wildcard listen address (0.0.0.0 / [::]) is not reliably dialable —\n    // loop back explicitly\n    if (internalParsed.hostname === '0.0.0.0' || internalParsed.hostname === '[::]') {\n        internalParsed.hostname = '127.0.0.1';\n    }\n    const basePath = publicParsed.pathname.replace(/\\/+$/, '');\n\n    return (url: string) => {\n        let parsed : URL;\n        try {\n            parsed = new URL(url);\n        } catch {\n            return url;\n        }\n\n        if (parsed.origin !== publicParsed.origin) {\n            return url;\n        }\n\n        let { pathname } = parsed;\n        if (basePath) {\n            if (pathname === basePath) {\n                pathname = '/';\n            } else if (pathname.startsWith(`${basePath}/`)) {\n                pathname = pathname.substring(basePath.length);\n            } else {\n                return url;\n            }\n        }\n\n        return new URL(pathname + parsed.search, internalParsed.origin).href;\n    };\n}\n\n/**\n * HTTP client for the SSR'd UI pages: the render's API calls target the\n * server itself, so they are dispatched against its own listen address —\n * no reverse-proxy round-trip, no TLS (a self-signed publicUrl certificate\n * would otherwise fail Node's fetch), no dependency on the public hostname\n * resolving from inside the deployment.\n *\n * The rewrite happens at the TRANSPORT layer only: `baseURL` must stay the\n * public URL because the rendered HTML derives user-facing URLs from it\n * (e.g. the identity-provider authorize hrefs via `getAuthorizeUri`), and\n * hydration does not patch attribute mismatches.\n */\nexport function createInternalUIHttpClient(ctx: InternalUIHttpClientContext) : IClient {\n    const rewriteURL = createPublicToInternalURLRewriter(ctx.publicURL, ctx.internalURL);\n\n    return new Client({\n        baseURL: ctx.publicURL,\n        transport: new FetchTransport({ fetch: (input, init) => fetch(rewriteURL(input), init) }),\n    });\n}\n"],"mappings":";;;;;;;;;;GAiBA,SAAgBG,kCACZC,WACAC,aAAmB;CAEnB,MAAMC,eAAe,IAAIC,IAAIH,SAAAA;CAC7B,MAAMI,iBAAiB,IAAID,IAAIF,WAAAA;CAG/B,IAAIG,eAAeC,aAAa,aAAaD,eAAeC,aAAa,QACrED,eAAeC,WAAW;CAE9B,MAAMC,WAAWJ,aAAaK,SAASC,QAAQ,QAAQ,EAAA;CAEvD,QAAQC,QAAAA;EACJ,IAAIC;EACJ,IAAI;GACAA,SAAS,IAAIP,IAAIM,GAAAA;EACrB,QAAQ;GACJ,OAAOA;EACX;EAEA,IAAIC,OAAOC,WAAWT,aAAaS,QAC/B,OAAOF;EAGX,IAAI,EAAEF,aAAaG;EACnB,IAAIJ,UACA,IAAIC,aAAaD,UACbC,WAAW;OACR,IAAIA,SAASK,WAAW,GAAGN,SAAS,EAAE,GACzCC,WAAWA,SAASM,UAAUP,SAASQ,MAAM;OAE7C,OAAOL;EAIf,OAAO,IAAIN,IAAII,WAAWG,OAAOK,QAAQX,eAAeO,MAAM,CAAA,CAAEK;CACpE;AACJ;;;;;;;;;;;;GAcA,SAAgBC,2BAA2BC,KAAgC;CACvE,MAAMC,aAAapB,kCAAkCmB,IAAIlB,WAAWkB,IAAIjB,WAAW;CAEnF,OAAO,IAAIL,OAAO;EACdwB,SAASF,IAAIlB;EACbqB,WAAW,IAAIxB,eAAe,EAAEC,QAAQwB,OAAOC,SAASzB,MAAMqB,WAAWG,KAAAA,GAAQC,IAAAA,EAAM,CAAA;CAC3F,CAAA;AACJ"}

package/dist/adapters/http/ui/render.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/ui/render.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAQxC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAYlD,wBAAsB,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAwE1F"}
+{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/ui/render.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAQxC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAYlD,wBAAsB,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAqF1F"}

package/dist/adapters/http/ui/render.mjs

@@ -2,15 +2,15 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { LOCALE_COOKIE } from "../request/helpers/locale.mjs";
+import { rebasePublicAssetURLs } from "./base-path.mjs";
 import { UI_DIST_PATH, UI_SOURCE_PATH } from "../../../path.mjs";
 import { VITE_SERVER_STORE_KEY } from "../middleware/built-in/assets.mjs";
 import { UI_HTTP_CLIENT_FACTORY_STORE_KEY } from "../middleware/built-in/ui-http-client.mjs";
 import "../middleware/index.mjs";
-import { rebasePublicAssetURLs } from "./base-path.mjs";
 import { getURLBasePath } from "@authup/kit";
 import path from "node:path";
-import { CodeTransformation, isCodeTransformation } from "typeorm-extension";
 import { useRequestCookie } from "@routup/basic/cookie";
+import { CodeTransformation, isCodeTransformation } from "typeorm-extension";
 import { load } from "locter";
 import fs from "node:fs";
 //#region src/adapters/http/ui/render.ts
@@ -52,6 +52,9 @@ async function renderUIPage(event, ctx) {
 	body = body.replace(/<html\b[^>]*>/i, `<html ${htmlAttrs}>`);
 	body = rebasePublicAssetURLs(body, getURLBasePath(ctx.payload.config.baseURL));
 	event.response.headers.set("content-type", "text/html; charset=utf-8");
+	event.response.headers.set("content-security-policy", "frame-ancestors 'none'");
+	event.response.headers.set("x-frame-options", "DENY");
+	event.response.headers.set("referrer-policy", "no-referrer");
 	return body;
 }
 //#endregion