@authup/server-core 1.0.0-beta.51 → 1.0.0-beta.53

package/dist/app/modules/metrics/index.mjs

@@ -0,0 +1,6 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { MetricsInjectionKey } from "./constants.mjs";
+import { PromAuthFlowMetrics } from "./prom.mjs";
+export { MetricsInjectionKey, PromAuthFlowMetrics };

package/dist/app/modules/metrics/prom.d.ts

@@ -0,0 +1,15 @@
+import { Counter } from 'prom-client';
+import type { OAuth2TokenGrant } from '@authup/specs';
+import type { AuthFlowAuthorizeOutcome, AuthFlowLoginResult, IAuthFlowMetrics } from '../../../core/index.ts';
+export declare class PromAuthFlowMetrics implements IAuthFlowMetrics {
+    protected loginCounter: Counter<'result'>;
+    protected tokenGrantCounter: Counter<'grant_type'>;
+    protected authorizeCounter: Counter<'outcome'>;
+    protected refreshReplayCounter: Counter;
+    constructor();
+    recordLogin(result: AuthFlowLoginResult): void;
+    recordTokenGrant(grantType: `${OAuth2TokenGrant}`): void;
+    recordAuthorize(outcome: AuthFlowAuthorizeOutcome): void;
+    recordRefreshReplay(): void;
+}
+//# sourceMappingURL=prom.d.ts.map

package/dist/app/modules/metrics/prom.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prom.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/metrics/prom.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,OAAO,EAAY,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EACR,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EACnB,MAAM,wBAAwB,CAAC;AAuBhC,qBAAa,mBAAoB,YAAW,gBAAgB;IACxD,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE1C,SAAS,CAAC,iBAAiB,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAEnD,SAAS,CAAC,gBAAgB,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAE/C,SAAS,CAAC,oBAAoB,EAAE,OAAO,CAAC;;IAwBxC,WAAW,CAAC,MAAM,EAAE,mBAAmB,GAAG,IAAI;IAI9C,gBAAgB,CAAC,SAAS,EAAE,GAAG,gBAAgB,EAAE,GAAG,IAAI;IAIxD,eAAe,CAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI;IAIxD,mBAAmB,IAAI,IAAI;CAG9B"}

package/dist/app/modules/metrics/prom.mjs

@@ -0,0 +1,42 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { Counter, register } from "prom-client";
+//#region src/app/modules/metrics/prom.ts
+function getOrCreateCounter(name, help, labelNames = []) {
+	const existing = register.getSingleMetric(name);
+	if (existing) return existing;
+	return new Counter({
+		name,
+		help,
+		labelNames
+	});
+}
+var PromAuthFlowMetrics = class {
+	loginCounter;
+	tokenGrantCounter;
+	authorizeCounter;
+	refreshReplayCounter;
+	constructor() {
+		this.loginCounter = getOrCreateCounter("authup_login_total", "Password-grant login attempts by result.", ["result"]);
+		this.tokenGrantCounter = getOrCreateCounter("authup_token_grant_total", "Successful token grants by grant_type; failures appear in the http_request_duration status codes.", ["grant_type"]);
+		this.authorizeCounter = getOrCreateCounter("authup_authorize_total", "Authorization decisions by outcome.", ["outcome"]);
+		this.refreshReplayCounter = getOrCreateCounter("authup_refresh_replay_total", "Detected refresh-token replays (family revocations).");
+	}
+	recordLogin(result) {
+		this.loginCounter.inc({ result });
+	}
+	recordTokenGrant(grantType) {
+		this.tokenGrantCounter.inc({ grant_type: grantType });
+	}
+	recordAuthorize(outcome) {
+		this.authorizeCounter.inc({ outcome });
+	}
+	recordRefreshReplay() {
+		this.refreshReplayCounter.inc();
+	}
+};
+//#endregion
+export { PromAuthFlowMetrics };
+
+//# sourceMappingURL=prom.mjs.map

package/dist/app/modules/metrics/prom.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"prom.mjs","names":["Counter","register","getOrCreateCounter","name","help","labelNames","existing","getSingleMetric","PromAuthFlowMetrics","loginCounter","tokenGrantCounter","authorizeCounter","refreshReplayCounter","recordLogin","result","inc","recordTokenGrant","grantType","grant_type","recordAuthorize","outcome","recordRefreshReplay"],"sources":["../../../../src/app/modules/metrics/prom.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { Counter, register } from 'prom-client';\nimport type { OAuth2TokenGrant } from '@authup/specs';\nimport type {\n    AuthFlowAuthorizeOutcome,\n    AuthFlowLoginResult,\n    IAuthFlowMetrics,\n} from '../../../core/index.ts';\n\n// Counters are created against prom-client's default registry — the\n// @routup/prometheus handler serves that registry, so no extra wiring is\n// needed. getSingleMetric keeps construction idempotent across app instances\n// in one process (prom-client throws on duplicate metric names).\nfunction getOrCreateCounter<T extends string>(\n    name: string,\n    help: string,\n    labelNames: T[] = [],\n): Counter<T> {\n    const existing = register.getSingleMetric(name);\n    if (existing) {\n        return existing as Counter<T>;\n    }\n\n    return new Counter<T>({\n        name, \n        help, \n        labelNames, \n    });\n}\n\nexport class PromAuthFlowMetrics implements IAuthFlowMetrics {\n    protected loginCounter: Counter<'result'>;\n\n    protected tokenGrantCounter: Counter<'grant_type'>;\n\n    protected authorizeCounter: Counter<'outcome'>;\n\n    protected refreshReplayCounter: Counter;\n\n    constructor() {\n        this.loginCounter = getOrCreateCounter(\n            'authup_login_total',\n            'Password-grant login attempts by result.',\n            ['result'],\n        );\n        this.tokenGrantCounter = getOrCreateCounter(\n            'authup_token_grant_total',\n            'Successful token grants by grant_type; failures appear in the http_request_duration status codes.',\n            ['grant_type'],\n        );\n        this.authorizeCounter = getOrCreateCounter(\n            'authup_authorize_total',\n            'Authorization decisions by outcome.',\n            ['outcome'],\n        );\n        this.refreshReplayCounter = getOrCreateCounter(\n            'authup_refresh_replay_total',\n            'Detected refresh-token replays (family revocations).',\n        );\n    }\n\n    recordLogin(result: AuthFlowLoginResult): void {\n        this.loginCounter.inc({ result });\n    }\n\n    recordTokenGrant(grantType: `${OAuth2TokenGrant}`): void {\n        this.tokenGrantCounter.inc({ grant_type: grantType });\n    }\n\n    recordAuthorize(outcome: AuthFlowAuthorizeOutcome): void {\n        this.authorizeCounter.inc({ outcome });\n    }\n\n    recordRefreshReplay(): void {\n        this.refreshReplayCounter.inc();\n    }\n}\n"],"mappings":";;;;;AAmBA,SAASE,mBACLC,MACAC,MACAC,aAAkB,CAAA,GAAE;CAEpB,MAAMC,WAAWL,SAASM,gBAAgBJ,IAAAA;CAC1C,IAAIG,UACA,OAAOA;CAGX,OAAO,IAAIN,QAAW;EAClBG;EACAC;EACAC;CACJ,CAAA;AACJ;AAEA,IAAaG,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,cAAc;EACV,KAAKH,eAAeP,mBAChB,sBACA,4CACA,CAAC,QAAA,CAAS;EAEd,KAAKQ,oBAAoBR,mBACrB,4BACA,qGACA,CAAC,YAAA,CAAa;EAElB,KAAKS,mBAAmBT,mBACpB,0BACA,uCACA,CAAC,SAAA,CAAU;EAEf,KAAKU,uBAAuBV,mBACxB,+BACA,sDAAA;CAER;CAEAW,YAAYC,QAAmC;EAC3C,KAAKL,aAAaM,IAAI,EAAED,OAAO,CAAA;CACnC;CAEAE,iBAAiBC,WAAwC;EACrD,KAAKP,kBAAkBK,IAAI,EAAEG,YAAYD,UAAU,CAAA;CACvD;CAEAE,gBAAgBC,SAAyC;EACrD,KAAKT,iBAAiBI,IAAI,EAAEK,QAAQ,CAAA;CACxC;CAEAC,sBAA4B;EACxB,KAAKT,qBAAqBG,IAAG;CACjC;AACJ"}

package/dist/app/modules/oauth2/constants.d.ts

@@ -1,5 +1,5 @@
 import { TypedToken } from 'eldin';
-import type { IOAuth2AuthorizationCodeIssuer, IOAuth2AuthorizationCodeRepository, IOAuth2AuthorizationCodeRequestVerifier, IOAuth2AuthorizationCodeVerifier, IOAuth2AuthorizationStateManager, IOAuth2AuthorizeStateRepository, IOAuth2ClientRepository, IOAuth2KeyRepository, IOAuth2OpenIDTokenIssuer, IOAuth2ScopeRepository, IOAuth2TokenIssuer, IOAuth2TokenRepository, IOAuth2TokenRevoker, IOAuth2TokenSigner, IOAuth2TokenVerifier } from '../../../core/index.ts';
+import type { IConsentRepository, IKeyRepository, IKeyStore, IOAuth2AuthorizationCodeIssuer, IOAuth2AuthorizationCodeRepository, IOAuth2AuthorizationCodeRequestVerifier, IOAuth2AuthorizationCodeVerifier, IOAuth2AuthorizationStateManager, IOAuth2AuthorizeStateRepository, IOAuth2ClientRepository, IOAuth2OpenIDTokenIssuer, IOAuth2ScopeRepository, IOAuth2TokenIssuer, IOAuth2TokenRepository, IOAuth2TokenRevoker, IOAuth2TokenSigner, IOAuth2TokenVerifier, ISessionTokenRepository } from '../../../core/index.ts';
 export declare const OAuth2InjectionToken: {
     readonly ClientRepository: TypedToken<IOAuth2ClientRepository>;
     readonly ScopeRepository: TypedToken<IOAuth2ScopeRepository>;
@@ -9,11 +9,19 @@ export declare const OAuth2InjectionToken: {
     readonly AuthorizationStateManager: TypedToken<IOAuth2AuthorizationStateManager>;
     readonly AuthorizationCodeRequestVerifier: TypedToken<IOAuth2AuthorizationCodeRequestVerifier>;
     readonly AuthorizationStateRepository: TypedToken<IOAuth2AuthorizeStateRepository>;
-    readonly KeyRepository: TypedToken<IOAuth2KeyRepository>;
+    /**
+     * One adapter instance serving both key ports: the material-resolving
+     * store (signer / verifier / realm cipher) and the entity CRUD surface
+     * (key management API).
+     */
+    readonly KeyStore: TypedToken<IKeyStore & IKeyRepository>;
     readonly AccessTokenIssuer: TypedToken<IOAuth2TokenIssuer>;
+    readonly MfaTokenIssuer: TypedToken<IOAuth2TokenIssuer>;
     readonly OpenIDTokenIssuer: TypedToken<IOAuth2OpenIDTokenIssuer>;
     readonly RefreshTokenIssuer: TypedToken<IOAuth2TokenIssuer>;
     readonly TokenRepository: TypedToken<IOAuth2TokenRepository>;
+    readonly SessionTokenRepository: TypedToken<ISessionTokenRepository>;
+    readonly ConsentRepository: TypedToken<IConsentRepository>;
     readonly TokenRevoker: TypedToken<IOAuth2TokenRevoker>;
     readonly TokenSigner: TypedToken<IOAuth2TokenSigner>;
     readonly TokenVerifier: TypedToken<IOAuth2TokenVerifier>;

package/dist/app/modules/oauth2/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/oauth2/constants.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,KAAK,EACR,8BAA8B,EAC9B,kCAAkC,EAClC,uCAAuC,EACvC,gCAAgC,EAChC,gCAAgC,EAChC,+BAA+B,EAC/B,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,EACxB,sBAAsB,EACtB,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,EACvB,MAAM,wBAAwB,CAAC;AAEhC,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;CAsBvB,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/oauth2/constants.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,KAAK,EACR,kBAAkB,EAClB,cAAc,EACd,SAAS,EACT,8BAA8B,EAC9B,kCAAkC,EAClC,uCAAuC,EACvC,gCAAgC,EAChC,gCAAgC,EAChC,+BAA+B,EAC/B,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,EACtB,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,EACpB,uBAAuB,EAC1B,MAAM,wBAAwB,CAAC;AAEhC,eAAO,MAAM,oBAAoB;;;;;;;;;IAY7B;;;;OAIG;;;;;;;;;;;;CAcG,CAAC"}

package/dist/app/modules/oauth2/constants.mjs

@@ -12,11 +12,18 @@ const OAuth2InjectionToken = {
 	AuthorizationStateManager: new TypedToken("AuthorizationStateManager"),
 	AuthorizationCodeRequestVerifier: new TypedToken("AuthorizationCodeRequestVerifier"),
 	AuthorizationStateRepository: new TypedToken("AuthorizationStateRepository"),
-	KeyRepository: new TypedToken("KeyRepository"),
+	/**
+	* One adapter instance serving both key ports: the material-resolving
+	* store (signer / verifier / realm cipher) and the entity CRUD surface
+	* (key management API).
+	*/ KeyStore: new TypedToken("KeyStore"),
 	AccessTokenIssuer: new TypedToken("AccessTokenIssuer"),
+	MfaTokenIssuer: new TypedToken("MfaTokenIssuer"),
 	OpenIDTokenIssuer: new TypedToken("OpenIDTokenIssuer"),
 	RefreshTokenIssuer: new TypedToken("RefreshTokenIssuer"),
 	TokenRepository: new TypedToken("TokenRepository"),
+	SessionTokenRepository: new TypedToken("SessionTokenRepository"),
+	ConsentRepository: new TypedToken("OAuth2ConsentRepository"),
 	TokenRevoker: new TypedToken("TokenRevoker"),
 	TokenSigner: new TypedToken("TokenSigner"),
 	TokenVerifier: new TypedToken("TokenVerifier")

package/dist/app/modules/oauth2/constants.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"constants.mjs","names":["TypedToken","OAuth2InjectionToken","ClientRepository","ScopeRepository","AuthorizationCodeIssuer","AuthorizationCodeRepository","AuthorizationCodeVerifier","AuthorizationStateManager","AuthorizationCodeRequestVerifier","AuthorizationStateRepository","KeyRepository","AccessTokenIssuer","OpenIDTokenIssuer","RefreshTokenIssuer","TokenRepository","TokenRevoker","TokenSigner","TokenVerifier"],"sources":["../../../../src/app/modules/oauth2/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { TypedToken } from 'eldin';\nimport type {\n    IOAuth2AuthorizationCodeIssuer,\n    IOAuth2AuthorizationCodeRepository,\n    IOAuth2AuthorizationCodeRequestVerifier,\n    IOAuth2AuthorizationCodeVerifier,\n    IOAuth2AuthorizationStateManager,\n    IOAuth2AuthorizeStateRepository,\n    IOAuth2ClientRepository,\n    IOAuth2KeyRepository,\n    IOAuth2OpenIDTokenIssuer,\n    IOAuth2ScopeRepository,\n    IOAuth2TokenIssuer,\n    IOAuth2TokenRepository,\n    IOAuth2TokenRevoker,\n    IOAuth2TokenSigner,\n    IOAuth2TokenVerifier,\n} from '../../../core/index.ts';\n\nexport const OAuth2InjectionToken = {\n    ClientRepository: new TypedToken<IOAuth2ClientRepository>('ClientRepository'),\n    ScopeRepository: new TypedToken<IOAuth2ScopeRepository>('ScopeRepository'),\n\n    AuthorizationCodeIssuer: new TypedToken<IOAuth2AuthorizationCodeIssuer>('AuthorizationCodeIssuer'),\n    AuthorizationCodeRepository: new TypedToken<IOAuth2AuthorizationCodeRepository>('AuthorizationCodeRepository'),\n    AuthorizationCodeVerifier: new TypedToken<IOAuth2AuthorizationCodeVerifier>('AuthorizationCodeVerifier'),\n    AuthorizationStateManager: new TypedToken<IOAuth2AuthorizationStateManager>('AuthorizationStateManager'),\n    AuthorizationCodeRequestVerifier: new TypedToken<IOAuth2AuthorizationCodeRequestVerifier>('AuthorizationCodeRequestVerifier'),\n\n    AuthorizationStateRepository: new TypedToken<IOAuth2AuthorizeStateRepository>('AuthorizationStateRepository'),\n\n    KeyRepository: new TypedToken<IOAuth2KeyRepository>('KeyRepository'),\n\n    AccessTokenIssuer: new TypedToken<IOAuth2TokenIssuer>('AccessTokenIssuer'),\n    OpenIDTokenIssuer: new TypedToken<IOAuth2OpenIDTokenIssuer>('OpenIDTokenIssuer'),\n    RefreshTokenIssuer: new TypedToken<IOAuth2TokenIssuer>('RefreshTokenIssuer'),\n\n    TokenRepository: new TypedToken<IOAuth2TokenRepository>('TokenRepository'),\n    TokenRevoker: new TypedToken<IOAuth2TokenRevoker>('TokenRevoker'),\n    TokenSigner: new TypedToken<IOAuth2TokenSigner>('TokenSigner'),\n    TokenVerifier: new TypedToken<IOAuth2TokenVerifier>('TokenVerifier'),\n} as const;\n"],"mappings":";;;;;AA0BA,MAAaC,uBAAuB;CAChCC,kBAAkB,IAAIF,WAAoC,kBAAA;CAC1DG,iBAAiB,IAAIH,WAAmC,iBAAA;CAExDI,yBAAyB,IAAIJ,WAA2C,yBAAA;CACxEK,6BAA6B,IAAIL,WAA+C,6BAAA;CAChFM,2BAA2B,IAAIN,WAA6C,2BAAA;CAC5EO,2BAA2B,IAAIP,WAA6C,2BAAA;CAC5EQ,kCAAkC,IAAIR,WAAoD,kCAAA;CAE1FS,8BAA8B,IAAIT,WAA4C,8BAAA;CAE9EU,eAAe,IAAIV,WAAiC,eAAA;CAEpDW,mBAAmB,IAAIX,WAA+B,mBAAA;CACtDY,mBAAmB,IAAIZ,WAAqC,mBAAA;CAC5Da,oBAAoB,IAAIb,WAA+B,oBAAA;CAEvDc,iBAAiB,IAAId,WAAmC,iBAAA;CACxDe,cAAc,IAAIf,WAAgC,cAAA;CAClDgB,aAAa,IAAIhB,WAA+B,aAAA;CAChDiB,eAAe,IAAIjB,WAAiC,eAAA;AACxD"}
+{"version":3,"file":"constants.mjs","names":["TypedToken","OAuth2InjectionToken","ClientRepository","ScopeRepository","AuthorizationCodeIssuer","AuthorizationCodeRepository","AuthorizationCodeVerifier","AuthorizationStateManager","AuthorizationCodeRequestVerifier","AuthorizationStateRepository","KeyStore","AccessTokenIssuer","MfaTokenIssuer","OpenIDTokenIssuer","RefreshTokenIssuer","TokenRepository","SessionTokenRepository","ConsentRepository","TokenRevoker","TokenSigner","TokenVerifier"],"sources":["../../../../src/app/modules/oauth2/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { TypedToken } from 'eldin';\nimport type {\n    IConsentRepository,\n    IKeyRepository,\n    IKeyStore,\n    IOAuth2AuthorizationCodeIssuer,\n    IOAuth2AuthorizationCodeRepository,\n    IOAuth2AuthorizationCodeRequestVerifier,\n    IOAuth2AuthorizationCodeVerifier,\n    IOAuth2AuthorizationStateManager,\n    IOAuth2AuthorizeStateRepository,\n    IOAuth2ClientRepository,\n    IOAuth2OpenIDTokenIssuer,\n    IOAuth2ScopeRepository,\n    IOAuth2TokenIssuer,\n    IOAuth2TokenRepository,\n    IOAuth2TokenRevoker,\n    IOAuth2TokenSigner,\n    IOAuth2TokenVerifier,\n    ISessionTokenRepository,\n} from '../../../core/index.ts';\n\nexport const OAuth2InjectionToken = {\n    ClientRepository: new TypedToken<IOAuth2ClientRepository>('ClientRepository'),\n    ScopeRepository: new TypedToken<IOAuth2ScopeRepository>('ScopeRepository'),\n\n    AuthorizationCodeIssuer: new TypedToken<IOAuth2AuthorizationCodeIssuer>('AuthorizationCodeIssuer'),\n    AuthorizationCodeRepository: new TypedToken<IOAuth2AuthorizationCodeRepository>('AuthorizationCodeRepository'),\n    AuthorizationCodeVerifier: new TypedToken<IOAuth2AuthorizationCodeVerifier>('AuthorizationCodeVerifier'),\n    AuthorizationStateManager: new TypedToken<IOAuth2AuthorizationStateManager>('AuthorizationStateManager'),\n    AuthorizationCodeRequestVerifier: new TypedToken<IOAuth2AuthorizationCodeRequestVerifier>('AuthorizationCodeRequestVerifier'),\n\n    AuthorizationStateRepository: new TypedToken<IOAuth2AuthorizeStateRepository>('AuthorizationStateRepository'),\n\n    /**\n     * One adapter instance serving both key ports: the material-resolving\n     * store (signer / verifier / realm cipher) and the entity CRUD surface\n     * (key management API).\n     */\n    KeyStore: new TypedToken<IKeyStore & IKeyRepository>('KeyStore'),\n\n    AccessTokenIssuer: new TypedToken<IOAuth2TokenIssuer>('AccessTokenIssuer'),\n    MfaTokenIssuer: new TypedToken<IOAuth2TokenIssuer>('MfaTokenIssuer'),\n    OpenIDTokenIssuer: new TypedToken<IOAuth2OpenIDTokenIssuer>('OpenIDTokenIssuer'),\n    RefreshTokenIssuer: new TypedToken<IOAuth2TokenIssuer>('RefreshTokenIssuer'),\n\n    TokenRepository: new TypedToken<IOAuth2TokenRepository>('TokenRepository'),\n    SessionTokenRepository: new TypedToken<ISessionTokenRepository>('SessionTokenRepository'),\n    ConsentRepository: new TypedToken<IConsentRepository>('OAuth2ConsentRepository'),\n    TokenRevoker: new TypedToken<IOAuth2TokenRevoker>('TokenRevoker'),\n    TokenSigner: new TypedToken<IOAuth2TokenSigner>('TokenSigner'),\n    TokenVerifier: new TypedToken<IOAuth2TokenVerifier>('TokenVerifier'),\n} as const;\n"],"mappings":";;;;;AA6BA,MAAaC,uBAAuB;CAChCC,kBAAkB,IAAIF,WAAoC,kBAAA;CAC1DG,iBAAiB,IAAIH,WAAmC,iBAAA;CAExDI,yBAAyB,IAAIJ,WAA2C,yBAAA;CACxEK,6BAA6B,IAAIL,WAA+C,6BAAA;CAChFM,2BAA2B,IAAIN,WAA6C,2BAAA;CAC5EO,2BAA2B,IAAIP,WAA6C,2BAAA;CAC5EQ,kCAAkC,IAAIR,WAAoD,kCAAA;CAE1FS,8BAA8B,IAAIT,WAA4C,8BAAA;;;;;IAO9EU,UAAU,IAAIV,WAAuC,UAAA;CAErDW,mBAAmB,IAAIX,WAA+B,mBAAA;CACtDY,gBAAgB,IAAIZ,WAA+B,gBAAA;CACnDa,mBAAmB,IAAIb,WAAqC,mBAAA;CAC5Dc,oBAAoB,IAAId,WAA+B,oBAAA;CAEvDe,iBAAiB,IAAIf,WAAmC,iBAAA;CACxDgB,wBAAwB,IAAIhB,WAAoC,wBAAA;CAChEiB,mBAAmB,IAAIjB,WAA+B,yBAAA;CACtDkB,cAAc,IAAIlB,WAAgC,cAAA;CAClDmB,aAAa,IAAInB,WAA+B,aAAA;CAChDoB,eAAe,IAAIpB,WAAiC,eAAA;AACxD"}

package/dist/app/modules/oauth2/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/oauth2/module.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AA6BrC,qBAAa,YAAa,YAAW,OAAO;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;;IAO1B,KAAK,CAAC,SAAS,EAAE,UAAU,GAAI,OAAO,CAAC,IAAI,CAAC;CAwKrD"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/oauth2/module.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAiCrC,qBAAa,YAAa,YAAW,OAAO;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;;IAO1B,KAAK,CAAC,SAAS,EAAE,UAAU,GAAI,OAAO,CAAC,IAAI,CAAC;CA2NrD"}

package/dist/app/modules/oauth2/module.mjs

@@ -9,6 +9,7 @@ import { OAuth2AuthorizationCodeVerifier } from "../../../core/oauth2/authorizat
 import { OAuth2AuthorizationCodeRequestVerifier } from "../../../core/oauth2/authorization/code-request/verifier/module.mjs";
 import { OAuth2AuthorizationStateManager } from "../../../core/oauth2/authorization/state/module.mjs";
 import { OAuth2AccessTokenIssuer } from "../../../core/oauth2/token/issuer/access/module.mjs";
+import { OAuth2MfaTokenIssuer } from "../../../core/oauth2/token/issuer/mfa/module.mjs";
 import { OAuth2OpenIDTokenIssuer } from "../../../core/oauth2/token/issuer/open-id/module.mjs";
 import { OAuth2RefreshTokenIssuer } from "../../../core/oauth2/token/issuer/refresh/module.mjs";
 import { OAuth2TokenRevoker } from "../../../core/oauth2/token/revoker/module.mjs";
@@ -20,18 +21,24 @@ import { ModuleName } from "../constants.mjs";
 import { ConfigInjectionKey } from "../config/constants.mjs";
 import "../config/index.mjs";
 import "../cache/index.mjs";
+import { KeyRepositoryAdapter } from "../database/repositories/key/repository.mjs";
+import "../database/repositories/index.mjs";
 import { DatabaseInjectionKey } from "../database/constants.mjs";
+import { LoggerInjectionKey } from "../logger/constants.mjs";
+import "../logger/index.mjs";
 import "../database/index.mjs";
 import { OAuth2InjectionToken } from "./constants.mjs";
 import { OAuth2AuthorizationCodeRepository } from "./repositories/authorize/code/repository.mjs";
 import { OAuth2AuthorizationStateRepository } from "./repositories/authorize/state/repository.mjs";
 import { OAuth2ClientRepository } from "./repositories/client/repository.mjs";
+import { ConsentRepositoryAdapter } from "./repositories/consent/repository.mjs";
 import { OAuth2ScopeRepository } from "./repositories/scope/repository.mjs";
-import { OAuth2KeyRepository } from "./repositories/key/repository.mjs";
+import { SessionTokenRepositoryAdapter } from "./repositories/session-token/repository.mjs";
 import { OAuth2TokenRepository } from "./repositories/token/repository.mjs";
 import "./repositories/index.mjs";
 import { IdentityInjectionKey } from "../identity/constants.mjs";
 import "../identity/index.mjs";
+import { SymmetricCipher } from "@authup/server-kit";
 //#region src/app/modules/oauth2/module.ts
 var OAuth2Module = class {
 	name;
@@ -62,9 +69,17 @@ var OAuth2Module = class {
 		container.register(OAuth2InjectionToken.TokenRepository, { useFactory: (c) => {
 			return new OAuth2TokenRepository(c.resolve(CacheInjectionKey));
 		} });
-		container.register(OAuth2InjectionToken.KeyRepository, { useFactory: (c) => new OAuth2KeyRepository(c.resolve(DatabaseInjectionKey.DataSource)) });
+		container.register(OAuth2InjectionToken.SessionTokenRepository, { useFactory: (c) => new SessionTokenRepositoryAdapter(c.resolve(DatabaseInjectionKey.DataSource)) });
+		container.register(OAuth2InjectionToken.ConsentRepository, { useFactory: (c) => new ConsentRepositoryAdapter(c.resolve(DatabaseInjectionKey.DataSource)) });
+		container.register(OAuth2InjectionToken.KeyStore, { useFactory: (c) => {
+			const config = c.resolve(ConfigInjectionKey);
+			let secretsCipher = null;
+			if (config.secretsEncryptionKey) secretsCipher = new SymmetricCipher(config.secretsEncryptionKey);
+			else if (config.env === "production") c.resolve(LoggerInjectionKey).warn("The realm key store persists key material unwrapped; set SECRETS_ENCRYPTION_KEY to wrap it at rest.");
+			return new KeyRepositoryAdapter(c.resolve(DatabaseInjectionKey.DataSource), { secretsCipher });
+		} });
 		container.register(OAuth2InjectionToken.TokenSigner, { useFactory: (c) => {
-			return new OAuth2TokenSigner(c.resolve(OAuth2InjectionToken.KeyRepository));
+			return new OAuth2TokenSigner(c.resolve(OAuth2InjectionToken.KeyStore));
 		} });
 		container.register(OAuth2InjectionToken.AuthorizationCodeIssuer, { useFactory: (c) => {
 			return new OAuth2AuthorizationCodeIssuer(c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository), { maxAge: config.tokenAccessMaxAge });
@@ -82,25 +97,35 @@ var OAuth2Module = class {
 			return new OAuth2AuthorizationStateManager(c.resolve(OAuth2InjectionToken.AuthorizationStateRepository));
 		} });
 		container.register(OAuth2InjectionToken.TokenRevoker, { useFactory: (c) => {
-			return new OAuth2TokenRevoker(c.resolve(OAuth2InjectionToken.TokenRepository));
+			return new OAuth2TokenRevoker(c.resolve(OAuth2InjectionToken.TokenRepository), c.resolve(OAuth2InjectionToken.SessionTokenRepository));
 		} });
 		container.register(OAuth2InjectionToken.TokenVerifier, { useFactory: (c) => {
-			return new OAuth2TokenVerifier(c.resolve(OAuth2InjectionToken.KeyRepository), c.resolve(OAuth2InjectionToken.TokenRepository));
+			return new OAuth2TokenVerifier(c.resolve(OAuth2InjectionToken.KeyStore), c.resolve(OAuth2InjectionToken.TokenRepository));
 		} });
 		container.register(OAuth2InjectionToken.AccessTokenIssuer, { useFactory: (c) => {
 			const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);
 			const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);
 			const identityRoleProvider = c.resolve(IdentityInjectionKey.RoleProvider);
+			const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);
 			return new OAuth2AccessTokenIssuer(tokenRepository, tokenSigner, {
 				maxAge: config.tokenAccessMaxAge,
 				issuer: config.publicUrl
-			}, identityRoleProvider);
+			}, identityRoleProvider, sessionTokenRepository);
+		} });
+		container.register(OAuth2InjectionToken.MfaTokenIssuer, { useFactory: (c) => {
+			return new OAuth2MfaTokenIssuer(c.resolve(OAuth2InjectionToken.TokenRepository), c.resolve(OAuth2InjectionToken.TokenSigner), {
+				maxAge: config.mfaTicketMaxAge,
+				issuer: config.publicUrl
+			});
 		} });
 		container.register(OAuth2InjectionToken.RefreshTokenIssuer, { useFactory: (c) => {
-			return new OAuth2RefreshTokenIssuer(c.resolve(OAuth2InjectionToken.TokenRepository), c.resolve(OAuth2InjectionToken.TokenSigner), {
+			const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);
+			const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);
+			const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);
+			return new OAuth2RefreshTokenIssuer(tokenRepository, tokenSigner, {
 				maxAge: config.tokenRefreshMaxAge,
 				issuer: config.publicUrl
-			});
+			}, sessionTokenRepository);
 		} });
 		container.register(OAuth2InjectionToken.OpenIDTokenIssuer, { useFactory: (c) => {
 			return new OAuth2OpenIDTokenIssuer({

package/dist/app/modules/oauth2/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["CacheInjectionKey","ModuleName","OAuth2AuthorizationCodeRepository","OAuth2AuthorizationStateRepository","OAuth2ClientRepository","OAuth2KeyRepository","OAuth2ScopeRepository","OAuth2TokenRepository","OAuth2AccessTokenIssuer","OAuth2AuthorizationCodeIssuer","OAuth2AuthorizationCodeRequestVerifier","OAuth2AuthorizationCodeVerifier","OAuth2AuthorizationStateManager","OAuth2OpenIDTokenIssuer","OAuth2RefreshTokenIssuer","OAuth2TokenRevoker","OAuth2TokenSigner","OAuth2TokenVerifier","OAuth2InjectionToken","IdentityInjectionKey","ClientEntity","ClientScopeEntity","ConfigInjectionKey","DatabaseInjectionKey","OAuth2Module","name","dependencies","OAUTH2","DATABASE","CACHE","CONFIG","IDENTITY","setup","container","config","resolve","register","ClientRepository","useFactory","c","repository","ScopeRepository","AuthorizationCodeRepository","cache","AuthorizationStateRepository","TokenRepository","KeyRepository","DataSource","TokenSigner","keyRepository","AuthorizationCodeIssuer","codeRepository","maxAge","tokenAccessMaxAge","AuthorizationCodeVerifier","AuthorizationCodeRequestVerifier","clientRepository","clientScopeRepository","scopeRepository","AuthorizationStateManager","stateRepository","TokenRevoker","tokenRepository","TokenVerifier","AccessTokenIssuer","tokenSigner","identityRoleProvider","RoleProvider","issuer","publicUrl","RefreshTokenIssuer","tokenRefreshMaxAge","OpenIDTokenIssuer","signer","identityResolver","Resolver","options"],"sources":["../../../../src/app/modules/oauth2/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Repository } from 'typeorm';\nimport { CacheInjectionKey } from '../cache/index.ts';\nimport type { IContainer } from 'eldin';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\n\nimport {\n    OAuth2AuthorizationCodeRepository,\n    OAuth2AuthorizationStateRepository,\n    OAuth2ClientRepository,\n    OAuth2KeyRepository,\n    OAuth2ScopeRepository,\n    OAuth2TokenRepository,\n} from './repositories/index.ts';\nimport {\n    OAuth2AccessTokenIssuer,\n    OAuth2AuthorizationCodeIssuer,\n    OAuth2AuthorizationCodeRequestVerifier,\n    OAuth2AuthorizationCodeVerifier,\n    OAuth2AuthorizationStateManager,\n    OAuth2OpenIDTokenIssuer,\n    OAuth2RefreshTokenIssuer,\n    OAuth2TokenRevoker,\n    OAuth2TokenSigner,\n    OAuth2TokenVerifier,\n} from '../../../core/index.ts';\nimport { OAuth2InjectionToken } from './constants.ts';\nimport { IdentityInjectionKey } from '../identity/index.ts';\nimport { ClientEntity, ClientScopeEntity } from '../../../adapters/database/domains/index.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\n\nexport class OAuth2Module implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    constructor() {\n        this.name = ModuleName.OAUTH2;\n        this.dependencies = [ModuleName.DATABASE, ModuleName.CACHE, ModuleName.CONFIG, ModuleName.IDENTITY];\n    }\n\n    async setup(container: IContainer) : Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        container.register(OAuth2InjectionToken.ClientRepository, {\n            useFactory: (c) => {\n                const repository = c.resolve<Repository<ClientEntity>>(ClientEntity);\n                return new OAuth2ClientRepository(repository);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.ScopeRepository, {\n            useFactory: (c) => {\n                const repository = c.resolve<Repository<ClientScopeEntity>>(ClientScopeEntity);\n                return new OAuth2ScopeRepository(repository);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationCodeRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2AuthorizationCodeRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationStateRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2AuthorizationStateRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.TokenRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2TokenRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.KeyRepository, {\n            // todo: cache use here\n            useFactory: (c) => new OAuth2KeyRepository(c.resolve(DatabaseInjectionKey.DataSource)),\n        });\n\n        container.register(OAuth2InjectionToken.TokenSigner, {\n            useFactory: (c) => {\n                const keyRepository = c.resolve(OAuth2InjectionToken.KeyRepository);\n                return new OAuth2TokenSigner(keyRepository);\n            },\n        });\n\n        // authorization code issuer\n        container.register(OAuth2InjectionToken.AuthorizationCodeIssuer, {\n            useFactory: (c) => {\n                const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);\n\n                return new OAuth2AuthorizationCodeIssuer(\n                    codeRepository,\n                    {\n                        // todo: own constant here\n                        maxAge: config.tokenAccessMaxAge,\n                    },\n                );\n            },\n        });\n        container.register(OAuth2InjectionToken.AuthorizationCodeVerifier, {\n            useFactory: (c) => {\n                const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);\n\n                return new OAuth2AuthorizationCodeVerifier(codeRepository);\n            },\n        });\n\n        // authorization code request verifier\n        container.register(OAuth2InjectionToken.AuthorizationCodeRequestVerifier, {\n            useFactory: (c) => {\n                const clientRepository = c.resolve(OAuth2InjectionToken.ClientRepository);\n                const clientScopeRepository = c.resolve(OAuth2InjectionToken.ScopeRepository);\n\n                return new OAuth2AuthorizationCodeRequestVerifier({\n                    clientRepository,\n                    scopeRepository: clientScopeRepository,\n                });\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationStateManager, {\n            useFactory: (c) => {\n                const stateRepository = c.resolve(OAuth2InjectionToken.AuthorizationStateRepository);\n\n                return new OAuth2AuthorizationStateManager(stateRepository);\n            },\n        });\n\n        // token revoker\n        container.register(OAuth2InjectionToken.TokenRevoker, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                return new OAuth2TokenRevoker(tokenRepository);\n            },\n        });\n\n        // token verifier\n        container.register(OAuth2InjectionToken.TokenVerifier, {\n            useFactory: (c) => {\n                const keyRepository = c.resolve(OAuth2InjectionToken.KeyRepository);\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n\n                return new OAuth2TokenVerifier(keyRepository, tokenRepository);\n            },\n        });\n\n        // access token issuer\n        container.register(OAuth2InjectionToken.AccessTokenIssuer, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n                const identityRoleProvider = c.resolve(IdentityInjectionKey.RoleProvider);\n                return new OAuth2AccessTokenIssuer(\n                    tokenRepository,\n                    tokenSigner,\n                    {\n                        maxAge: config.tokenAccessMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                    identityRoleProvider,\n                );\n            },\n        });\n\n        // refresh token issuer\n        container.register(OAuth2InjectionToken.RefreshTokenIssuer, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n\n                return new OAuth2RefreshTokenIssuer(\n                    tokenRepository,\n                    tokenSigner,\n                    {\n                        maxAge: config.tokenRefreshMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                );\n            },\n        });\n\n        // open-id token issuer\n        container.register(OAuth2InjectionToken.OpenIDTokenIssuer, {\n            useFactory: (c) => {\n                const repository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const signer = c.resolve(OAuth2InjectionToken.TokenSigner);\n                const identityResolver = c.resolve(IdentityInjectionKey.Resolver);\n\n                return new OAuth2OpenIDTokenIssuer({\n                    repository,\n                    signer,\n\n                    identityResolver,\n\n                    options: {\n                        // todo: own constant here\n                        maxAge: config.tokenAccessMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                });\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCA,IAAawB,eAAb,MAAaA;CACAC;CAEAC;CAET,cAAc;EACV,KAAKD,OAAOxB,WAAW0B;EACvB,KAAKD,eAAe;GAACzB,WAAW2B;GAAU3B,WAAW4B;GAAO5B,WAAW6B;GAAQ7B,WAAW8B;;CAC9F;CAEA,MAAMC,MAAMC,WAAuC;EAC/C,MAAMC,SAASD,UAAUE,QAAQb,kBAAAA;EAEjCW,UAAUG,SAASlB,qBAAqBmB,kBAAkB,EACtDC,aAAaC,MAAAA;GAET,OAAO,IAAInC,uBADQmC,EAAEJ,QAAkCf,YACrBoB,CAAAA;EACtC,EACJ,CAAA;EAEAP,UAAUG,SAASlB,qBAAqBuB,iBAAiB,EACrDH,aAAaC,MAAAA;GAET,OAAO,IAAIjC,sBADQiC,EAAEJ,QAAuCd,iBAC3BmB,CAAAA;EACrC,EACJ,CAAA;EAEAP,UAAUG,SAASlB,qBAAqBwB,6BAA6B,EACjEJ,aAAaC,MAAAA;GAET,OAAO,IAAIrC,kCADGqC,EAAEJ,QAAQnC,iBACqB2C,CAAAA;EACjD,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB0B,8BAA8B,EAClEN,aAAaC,MAAAA;GAET,OAAO,IAAIpC,mCADGoC,EAAEJ,QAAQnC,iBACsB2C,CAAAA;EAClD,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB2B,iBAAiB,EACrDP,aAAaC,MAAAA;GAET,OAAO,IAAIhC,sBADGgC,EAAEJ,QAAQnC,iBACS2C,CAAAA;EACrC,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB4B,eAAe,EAEnDR,aAAaC,MAAM,IAAIlC,oBAAoBkC,EAAEJ,QAAQZ,qBAAqBwB,UAAU,CAAA,EACxF,CAAA;EAEAd,UAAUG,SAASlB,qBAAqB8B,aAAa,EACjDV,aAAaC,MAAAA;GAET,OAAO,IAAIvB,kBADWuB,EAAEJ,QAAQjB,qBAAqB4B,aACxBG,CAAAA;EACjC,EACJ,CAAA;EAGAhB,UAAUG,SAASlB,qBAAqBgC,yBAAyB,EAC7DZ,aAAaC,MAAAA;GAGT,OAAO,IAAI9B,8BAFY8B,EAAEJ,QAAQjB,qBAAqBwB,2BAGlDS,GACA,EAEIC,QAAQlB,OAAOmB,kBACnB,CAAA;EAER,EACJ,CAAA;EACApB,UAAUG,SAASlB,qBAAqBoC,2BAA2B,EAC/DhB,aAAaC,MAAAA;GAGT,OAAO,IAAI5B,gCAFY4B,EAAEJ,QAAQjB,qBAAqBwB,2BAEXS,CAAAA;EAC/C,EACJ,CAAA;EAGAlB,UAAUG,SAASlB,qBAAqBqC,kCAAkC,EACtEjB,aAAaC,MAAAA;GAIT,OAAO,IAAI7B,uCAAuC;IAC9C8C,kBAJqBjB,EAAEJ,QAAQjB,qBAAqBmB,gBAIpDmB;IACAE,iBAJ0BnB,EAAEJ,QAAQjB,qBAAqBuB,eAIxCgB;GACrB,CAAA;EACJ,EACJ,CAAA;EAEAxB,UAAUG,SAASlB,qBAAqByC,2BAA2B,EAC/DrB,aAAaC,MAAAA;GAGT,OAAO,IAAI3B,gCAFa2B,EAAEJ,QAAQjB,qBAAqB0B,4BAEZgB,CAAAA;EAC/C,EACJ,CAAA;EAGA3B,UAAUG,SAASlB,qBAAqB2C,cAAc,EAClDvB,aAAaC,MAAAA;GAET,OAAO,IAAIxB,mBADawB,EAAEJ,QAAQjB,qBAAqB2B,eACzBiB,CAAAA;EAClC,EACJ,CAAA;EAGA7B,UAAUG,SAASlB,qBAAqB6C,eAAe,EACnDzB,aAAaC,MAAAA;GAIT,OAAO,IAAItB,oBAHWsB,EAAEJ,QAAQjB,qBAAqB4B,aAGtBG,GAFPV,EAAEJ,QAAQjB,qBAAqB2B,eAETiB,CAAAA;EAClD,EACJ,CAAA;EAGA7B,UAAUG,SAASlB,qBAAqB8C,mBAAmB,EACvD1B,aAAaC,MAAAA;GACT,MAAMuB,kBAAkBvB,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GACtE,MAAMoB,cAAc1B,EAAEJ,QAAQjB,qBAAqB8B,WAAW;GAC9D,MAAMkB,uBAAuB3B,EAAEJ,QAAQhB,qBAAqBgD,YAAY;GACxE,OAAO,IAAI3D,wBACPsD,iBACAG,aACA;IACIb,QAAQlB,OAAOmB;IACfe,QAAQlC,OAAOmC;GACnB,GACAH,oBAAAA;EAER,EACJ,CAAA;EAGAjC,UAAUG,SAASlB,qBAAqBoD,oBAAoB,EACxDhC,aAAaC,MAAAA;GAIT,OAAO,IAAIzB,yBAHayB,EAAEJ,QAAQjB,qBAAqB2B,eAInDiB,GAHgBvB,EAAEJ,QAAQjB,qBAAqB8B,WAI/CiB,GACA;IACIb,QAAQlB,OAAOqC;IACfH,QAAQlC,OAAOmC;GACnB,CAAA;EAER,EACJ,CAAA;EAGApC,UAAUG,SAASlB,qBAAqBsD,mBAAmB,EACvDlC,aAAaC,MAAAA;GAKT,OAAO,IAAI1B,wBAAwB;IAC/B2B,YALeD,EAAEJ,QAAQjB,qBAAqB2B,eAK9CL;IACAiC,QALWlC,EAAEJ,QAAQjB,qBAAqB8B,WAK1CyB;IAEAC,kBANqBnC,EAAEJ,QAAQhB,qBAAqBwD,QAMpDD;IAEAE,SAAS;KAELxB,QAAQlB,OAAOmB;KACfe,QAAQlC,OAAOmC;IACnB;GACJ,CAAA;EACJ,EACJ,CAAA;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["SymmetricCipher","CacheInjectionKey","ModuleName","LoggerInjectionKey","ConsentRepositoryAdapter","OAuth2AuthorizationCodeRepository","OAuth2AuthorizationStateRepository","OAuth2ClientRepository","OAuth2ScopeRepository","OAuth2TokenRepository","SessionTokenRepositoryAdapter","KeyRepositoryAdapter","OAuth2AccessTokenIssuer","OAuth2AuthorizationCodeIssuer","OAuth2AuthorizationCodeRequestVerifier","OAuth2AuthorizationCodeVerifier","OAuth2AuthorizationStateManager","OAuth2MfaTokenIssuer","OAuth2OpenIDTokenIssuer","OAuth2RefreshTokenIssuer","OAuth2TokenRevoker","OAuth2TokenSigner","OAuth2TokenVerifier","OAuth2InjectionToken","IdentityInjectionKey","ClientEntity","ClientScopeEntity","ConfigInjectionKey","DatabaseInjectionKey","OAuth2Module","name","dependencies","OAUTH2","DATABASE","CACHE","CONFIG","IDENTITY","setup","container","config","resolve","register","ClientRepository","useFactory","c","repository","ScopeRepository","AuthorizationCodeRepository","cache","AuthorizationStateRepository","TokenRepository","SessionTokenRepository","DataSource","ConsentRepository","KeyStore","secretsCipher","secretsEncryptionKey","env","logger","warn","TokenSigner","keyStore","AuthorizationCodeIssuer","codeRepository","maxAge","tokenAccessMaxAge","AuthorizationCodeVerifier","AuthorizationCodeRequestVerifier","clientRepository","clientScopeRepository","scopeRepository","AuthorizationStateManager","stateRepository","TokenRevoker","tokenRepository","sessionTokenRepository","TokenVerifier","AccessTokenIssuer","tokenSigner","identityRoleProvider","RoleProvider","issuer","publicUrl","MfaTokenIssuer","mfaTicketMaxAge","RefreshTokenIssuer","tokenRefreshMaxAge","OpenIDTokenIssuer","signer","identityResolver","Resolver","options"],"sources":["../../../../src/app/modules/oauth2/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { SymmetricCipher } from '@authup/server-kit';\nimport type { Repository } from 'typeorm';\nimport { CacheInjectionKey } from '../cache/index.ts';\nimport type { IContainer } from 'eldin';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport { LoggerInjectionKey } from '../logger/index.ts';\n\nimport {\n    ConsentRepositoryAdapter,\n    OAuth2AuthorizationCodeRepository,\n    OAuth2AuthorizationStateRepository,\n    OAuth2ClientRepository,\n    OAuth2ScopeRepository,\n    OAuth2TokenRepository,\n    SessionTokenRepositoryAdapter,\n} from './repositories/index.ts';\nimport { KeyRepositoryAdapter } from '../database/repositories/index.ts';\nimport {\n    OAuth2AccessTokenIssuer,\n    OAuth2AuthorizationCodeIssuer,\n    OAuth2AuthorizationCodeRequestVerifier,\n    OAuth2AuthorizationCodeVerifier,\n    OAuth2AuthorizationStateManager,\n    OAuth2MfaTokenIssuer,\n    OAuth2OpenIDTokenIssuer,\n    OAuth2RefreshTokenIssuer,\n    OAuth2TokenRevoker,\n    OAuth2TokenSigner,\n    OAuth2TokenVerifier,\n} from '../../../core/index.ts';\nimport { OAuth2InjectionToken } from './constants.ts';\nimport { IdentityInjectionKey } from '../identity/index.ts';\nimport { ClientEntity, ClientScopeEntity } from '../../../adapters/database/domains/index.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\n\nexport class OAuth2Module implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    constructor() {\n        this.name = ModuleName.OAUTH2;\n        this.dependencies = [ModuleName.DATABASE, ModuleName.CACHE, ModuleName.CONFIG, ModuleName.IDENTITY];\n    }\n\n    async setup(container: IContainer) : Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        container.register(OAuth2InjectionToken.ClientRepository, {\n            useFactory: (c) => {\n                const repository = c.resolve<Repository<ClientEntity>>(ClientEntity);\n                return new OAuth2ClientRepository(repository);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.ScopeRepository, {\n            useFactory: (c) => {\n                const repository = c.resolve<Repository<ClientScopeEntity>>(ClientScopeEntity);\n                return new OAuth2ScopeRepository(repository);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationCodeRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2AuthorizationCodeRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationStateRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2AuthorizationStateRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.TokenRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2TokenRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.SessionTokenRepository, {\n            useFactory: (c) => new SessionTokenRepositoryAdapter(\n                c.resolve(DatabaseInjectionKey.DataSource),\n            ),\n        });\n\n        container.register(OAuth2InjectionToken.ConsentRepository, {\n            useFactory: (c) => new ConsentRepositoryAdapter(\n                c.resolve(DatabaseInjectionKey.DataSource),\n            ),\n        });\n\n        container.register(OAuth2InjectionToken.KeyStore, {\n            // todo: cache use here\n            useFactory: (c) => {\n                const config = c.resolve(ConfigInjectionKey);\n\n                let secretsCipher : SymmetricCipher | null = null;\n                if (config.secretsEncryptionKey) {\n                    secretsCipher = new SymmetricCipher(config.secretsEncryptionKey);\n                } else if (config.env === 'production') {\n                    // parity posture without a KEK (Keycloak/authentik store key\n                    // material plaintext too) — but say so once, loudly.\n                    const logger = c.resolve(LoggerInjectionKey);\n                    logger.warn(\n                        'The realm key store persists key material unwrapped; ' +\n                        'set SECRETS_ENCRYPTION_KEY to wrap it at rest.',\n                    );\n                }\n\n                return new KeyRepositoryAdapter(c.resolve(DatabaseInjectionKey.DataSource), { secretsCipher });\n            },\n        });\n\n        container.register(OAuth2InjectionToken.TokenSigner, {\n            useFactory: (c) => {\n                const keyStore = c.resolve(OAuth2InjectionToken.KeyStore);\n                return new OAuth2TokenSigner(keyStore);\n            },\n        });\n\n        // authorization code issuer\n        container.register(OAuth2InjectionToken.AuthorizationCodeIssuer, {\n            useFactory: (c) => {\n                const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);\n\n                return new OAuth2AuthorizationCodeIssuer(\n                    codeRepository,\n                    {\n                        // todo: own constant here\n                        maxAge: config.tokenAccessMaxAge,\n                    },\n                );\n            },\n        });\n        container.register(OAuth2InjectionToken.AuthorizationCodeVerifier, {\n            useFactory: (c) => {\n                const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);\n\n                return new OAuth2AuthorizationCodeVerifier(codeRepository);\n            },\n        });\n\n        // authorization code request verifier\n        container.register(OAuth2InjectionToken.AuthorizationCodeRequestVerifier, {\n            useFactory: (c) => {\n                const clientRepository = c.resolve(OAuth2InjectionToken.ClientRepository);\n                const clientScopeRepository = c.resolve(OAuth2InjectionToken.ScopeRepository);\n\n                return new OAuth2AuthorizationCodeRequestVerifier({\n                    clientRepository,\n                    scopeRepository: clientScopeRepository,\n                });\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationStateManager, {\n            useFactory: (c) => {\n                const stateRepository = c.resolve(OAuth2InjectionToken.AuthorizationStateRepository);\n\n                return new OAuth2AuthorizationStateManager(stateRepository);\n            },\n        });\n\n        // token revoker\n        container.register(OAuth2InjectionToken.TokenRevoker, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);\n                return new OAuth2TokenRevoker(tokenRepository, sessionTokenRepository);\n            },\n        });\n\n        // token verifier\n        container.register(OAuth2InjectionToken.TokenVerifier, {\n            useFactory: (c) => {\n                const keyStore = c.resolve(OAuth2InjectionToken.KeyStore);\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n\n                return new OAuth2TokenVerifier(keyStore, tokenRepository);\n            },\n        });\n\n        // access token issuer\n        container.register(OAuth2InjectionToken.AccessTokenIssuer, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n                const identityRoleProvider = c.resolve(IdentityInjectionKey.RoleProvider);\n                const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);\n                return new OAuth2AccessTokenIssuer(\n                    tokenRepository,\n                    tokenSigner,\n                    {\n                        maxAge: config.tokenAccessMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                    identityRoleProvider,\n                    sessionTokenRepository,\n                );\n            },\n        });\n\n        // mfa login-ticket issuer\n        container.register(OAuth2InjectionToken.MfaTokenIssuer, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n\n                return new OAuth2MfaTokenIssuer(\n                    tokenRepository,\n                    tokenSigner,\n                    {\n                        maxAge: config.mfaTicketMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                );\n            },\n        });\n\n        // refresh token issuer\n        container.register(OAuth2InjectionToken.RefreshTokenIssuer, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n                const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);\n\n                return new OAuth2RefreshTokenIssuer(\n                    tokenRepository,\n                    tokenSigner,\n                    {\n                        maxAge: config.tokenRefreshMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                    sessionTokenRepository,\n                );\n            },\n        });\n\n        // open-id token issuer\n        container.register(OAuth2InjectionToken.OpenIDTokenIssuer, {\n            useFactory: (c) => {\n                const repository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const signer = c.resolve(OAuth2InjectionToken.TokenSigner);\n                const identityResolver = c.resolve(IdentityInjectionKey.Resolver);\n\n                return new OAuth2OpenIDTokenIssuer({\n                    repository,\n                    signer,\n\n                    identityResolver,\n\n                    options: {\n                        // todo: own constant here\n                        maxAge: config.tokenAccessMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                });\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4CA,IAAa6B,eAAb,MAAaA;CACAC;CAEAC;CAET,cAAc;EACV,KAAKD,OAAO5B,WAAW8B;EACvB,KAAKD,eAAe;GAAC7B,WAAW+B;GAAU/B,WAAWgC;GAAOhC,WAAWiC;GAAQjC,WAAWkC;;CAC9F;CAEA,MAAMC,MAAMC,WAAuC;EAC/C,MAAMC,SAASD,UAAUE,QAAQb,kBAAAA;EAEjCW,UAAUG,SAASlB,qBAAqBmB,kBAAkB,EACtDC,aAAaC,MAAAA;GAET,OAAO,IAAIrC,uBADQqC,EAAEJ,QAAkCf,YACrBoB,CAAAA;EACtC,EACJ,CAAA;EAEAP,UAAUG,SAASlB,qBAAqBuB,iBAAiB,EACrDH,aAAaC,MAAAA;GAET,OAAO,IAAIpC,sBADQoC,EAAEJ,QAAuCd,iBAC3BmB,CAAAA;EACrC,EACJ,CAAA;EAEAP,UAAUG,SAASlB,qBAAqBwB,6BAA6B,EACjEJ,aAAaC,MAAAA;GAET,OAAO,IAAIvC,kCADGuC,EAAEJ,QAAQvC,iBACqB+C,CAAAA;EACjD,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB0B,8BAA8B,EAClEN,aAAaC,MAAAA;GAET,OAAO,IAAItC,mCADGsC,EAAEJ,QAAQvC,iBACsB+C,CAAAA;EAClD,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB2B,iBAAiB,EACrDP,aAAaC,MAAAA;GAET,OAAO,IAAInC,sBADGmC,EAAEJ,QAAQvC,iBACS+C,CAAAA;EACrC,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB4B,wBAAwB,EAC5DR,aAAaC,MAAM,IAAIlC,8BACnBkC,EAAEJ,QAAQZ,qBAAqBwB,UAAU,CAAA,EAEjD,CAAA;EAEAd,UAAUG,SAASlB,qBAAqB8B,mBAAmB,EACvDV,aAAaC,MAAM,IAAIxC,yBACnBwC,EAAEJ,QAAQZ,qBAAqBwB,UAAU,CAAA,EAEjD,CAAA;EAEAd,UAAUG,SAASlB,qBAAqB+B,UAAU,EAE9CX,aAAaC,MAAAA;GACT,MAAML,SAASK,EAAEJ,QAAQb,kBAAAA;GAEzB,IAAI4B,gBAAyC;GAC7C,IAAIhB,OAAOiB,sBACPD,gBAAgB,IAAIvD,gBAAgBuC,OAAOiB,oBAAoB;QAC5D,IAAIjB,OAAOkB,QAAQ,cAItBC,EADiBlB,QAAQrC,kBACzBuD,CAAAA,CAAOC,KACH,qGACA;GAIR,OAAO,IAAIhD,qBAAqBiC,EAAEJ,QAAQZ,qBAAqBwB,UAAU,GAAG,EAAEG,cAAc,CAAA;EAChG,EACJ,CAAA;EAEAjB,UAAUG,SAASlB,qBAAqBqC,aAAa,EACjDjB,aAAaC,MAAAA;GAET,OAAO,IAAIvB,kBADMuB,EAAEJ,QAAQjB,qBAAqB+B,QACnBO,CAAAA;EACjC,EACJ,CAAA;EAGAvB,UAAUG,SAASlB,qBAAqBuC,yBAAyB,EAC7DnB,aAAaC,MAAAA;GAGT,OAAO,IAAI/B,8BAFY+B,EAAEJ,QAAQjB,qBAAqBwB,2BAGlDgB,GACA,EAEIC,QAAQzB,OAAO0B,kBACnB,CAAA;EAER,EACJ,CAAA;EACA3B,UAAUG,SAASlB,qBAAqB2C,2BAA2B,EAC/DvB,aAAaC,MAAAA;GAGT,OAAO,IAAI7B,gCAFY6B,EAAEJ,QAAQjB,qBAAqBwB,2BAEXgB,CAAAA;EAC/C,EACJ,CAAA;EAGAzB,UAAUG,SAASlB,qBAAqB4C,kCAAkC,EACtExB,aAAaC,MAAAA;GAIT,OAAO,IAAI9B,uCAAuC;IAC9CsD,kBAJqBxB,EAAEJ,QAAQjB,qBAAqBmB,gBAIpD0B;IACAE,iBAJ0B1B,EAAEJ,QAAQjB,qBAAqBuB,eAIxCuB;GACrB,CAAA;EACJ,EACJ,CAAA;EAEA/B,UAAUG,SAASlB,qBAAqBgD,2BAA2B,EAC/D5B,aAAaC,MAAAA;GAGT,OAAO,IAAI5B,gCAFa4B,EAAEJ,QAAQjB,qBAAqB0B,4BAEZuB,CAAAA;EAC/C,EACJ,CAAA;EAGAlC,UAAUG,SAASlB,qBAAqBkD,cAAc,EAClD9B,aAAaC,MAAAA;GAGT,OAAO,IAAIxB,mBAFawB,EAAEJ,QAAQjB,qBAAqB2B,eAEzBwB,GADC9B,EAAEJ,QAAQjB,qBAAqB4B,sBACfwB,CAAAA;EACnD,EACJ,CAAA;EAGArC,UAAUG,SAASlB,qBAAqBqD,eAAe,EACnDjC,aAAaC,MAAAA;GAIT,OAAO,IAAItB,oBAHMsB,EAAEJ,QAAQjB,qBAAqB+B,QAGjBO,GAFPjB,EAAEJ,QAAQjB,qBAAqB2B,eAEdwB,CAAAA;EAC7C,EACJ,CAAA;EAGApC,UAAUG,SAASlB,qBAAqBsD,mBAAmB,EACvDlC,aAAaC,MAAAA;GACT,MAAM8B,kBAAkB9B,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GACtE,MAAM4B,cAAclC,EAAEJ,QAAQjB,qBAAqBqC,WAAW;GAC9D,MAAMmB,uBAAuBnC,EAAEJ,QAAQhB,qBAAqBwD,YAAY;GACxE,MAAML,yBAAyB/B,EAAEJ,QAAQjB,qBAAqB4B,sBAAsB;GACpF,OAAO,IAAIvC,wBACP8D,iBACAI,aACA;IACId,QAAQzB,OAAO0B;IACfgB,QAAQ1C,OAAO2C;GACnB,GACAH,sBACAJ,sBAAAA;EAER,EACJ,CAAA;EAGArC,UAAUG,SAASlB,qBAAqB4D,gBAAgB,EACpDxC,aAAaC,MAAAA;GAIT,OAAO,IAAI3B,qBAHa2B,EAAEJ,QAAQjB,qBAAqB2B,eAInDwB,GAHgB9B,EAAEJ,QAAQjB,qBAAqBqC,WAI/CkB,GACA;IACId,QAAQzB,OAAO6C;IACfH,QAAQ1C,OAAO2C;GACnB,CAAA;EAER,EACJ,CAAA;EAGA5C,UAAUG,SAASlB,qBAAqB8D,oBAAoB,EACxD1C,aAAaC,MAAAA;GACT,MAAM8B,kBAAkB9B,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GACtE,MAAM4B,cAAclC,EAAEJ,QAAQjB,qBAAqBqC,WAAW;GAC9D,MAAMe,yBAAyB/B,EAAEJ,QAAQjB,qBAAqB4B,sBAAsB;GAEpF,OAAO,IAAIhC,yBACPuD,iBACAI,aACA;IACId,QAAQzB,OAAO+C;IACfL,QAAQ1C,OAAO2C;GACnB,GACAP,sBAAAA;EAER,EACJ,CAAA;EAGArC,UAAUG,SAASlB,qBAAqBgE,mBAAmB,EACvD5C,aAAaC,MAAAA;GAKT,OAAO,IAAI1B,wBAAwB;IAC/B2B,YALeD,EAAEJ,QAAQjB,qBAAqB2B,eAK9CL;IACA2C,QALW5C,EAAEJ,QAAQjB,qBAAqBqC,WAK1C4B;IAEAC,kBANqB7C,EAAEJ,QAAQhB,qBAAqBkE,QAMpDD;IAEAE,SAAS;KAEL3B,QAAQzB,OAAO0B;KACfgB,QAAQ1C,OAAO2C;IACnB;GACJ,CAAA;EACJ,EACJ,CAAA;CACJ;AACJ"}

package/dist/app/modules/oauth2/repositories/consent/index.d.ts

@@ -0,0 +1,2 @@
+export * from './repository.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/app/modules/oauth2/repositories/consent/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/oauth2/repositories/consent/index.ts"],"names":[],"mappings":"AAOA,cAAc,iBAAiB,CAAC"}

package/dist/app/modules/oauth2/repositories/consent/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { ConsentRepositoryAdapter } from "./repository.mjs";
+export { ConsentRepositoryAdapter };

package/dist/app/modules/oauth2/repositories/consent/repository.d.ts

@@ -0,0 +1,20 @@
+import type { Consent } from '@authup/core-kit';
+import type { EntityRepositoryFindManyResult } from '@authup/server-kit';
+import type { DataSource, Repository } from 'typeorm';
+import { ConsentEntity } from '../../../../../adapters/database/domains/index.ts';
+import type { ConsentFindManyOptions, ConsentOwner, IConsentRepository } from '../../../../../core/index.ts';
+export declare class ConsentRepositoryAdapter implements IConsentRepository {
+    protected repository: Repository<ConsentEntity>;
+    constructor(dataSource: DataSource);
+    findMany(query: Record<string, any>, options?: ConsentFindManyOptions): Promise<EntityRepositoryFindManyResult<Consent>>;
+    findOneById(id: string): Promise<Consent | null>;
+    findAllBySubjectClient(clientId: string, owner: ConsentOwner): Promise<Consent[]>;
+    insertMissing(input: {
+        clientId: string;
+        realmId: string;
+        owner: ConsentOwner;
+        scopes: string[];
+    }): Promise<void>;
+    remove(entity: Consent): Promise<void>;
+}
+//# sourceMappingURL=repository.d.ts.map

package/dist/app/modules/oauth2/repositories/consent/repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/oauth2/repositories/consent/repository.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAEzE,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAEtD,OAAO,EAAe,aAAa,EAAE,MAAM,mDAAmD,CAAC;AAE/F,OAAO,KAAK,EACR,sBAAsB,EACtB,YAAY,EACZ,kBAAkB,EACrB,MAAM,8BAA8B,CAAC;AAItC,qBAAa,wBAAyB,YAAW,kBAAkB;IAC/D,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC;gBAEpC,UAAU,EAAE,UAAU;IAI5B,QAAQ,CACV,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,OAAO,GAAE,sBAA2B,GACrC,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC;IAyE7C,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAIhD,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAkBjF,aAAa,CAAC,KAAK,EAAE;QACvB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,YAAY,CAAC;QACpB,MAAM,EAAE,MAAM,EAAE,CAAA;KACnB,GAAG,OAAO,CAAC,IAAI,CAAC;IA8CX,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;CAG/C"}

package/dist/app/modules/oauth2/repositories/consent/repository.mjs

@@ -0,0 +1,116 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { CachePrefix } from "../../../../../adapters/database/domains/constants.mjs";
+import { CONSENT_FILTER_KEYS } from "../../../../../core/entities/consent/types.mjs";
+import { ConsentEntity } from "../../../../../adapters/database/domains/consent/entity.mjs";
+import "../../../../../adapters/database/domains/index.mjs";
+import "../../../../../core/index.mjs";
+import { applyRealmScopeSelect } from "../../../database/repositories/helpers.mjs";
+import { isUniqueConstraintDatabaseError } from "../../../../../adapters/database/errors/driver.mjs";
+import "../../../../../adapters/database/errors/index.mjs";
+import { IdentityType } from "@authup/core-kit";
+import { buildRedisKeyPath } from "@authup/server-kit";
+import { applyQuery } from "typeorm-extension";
+//#region src/app/modules/oauth2/repositories/consent/repository.ts
+var ConsentRepositoryAdapter = class {
+	repository;
+	constructor(dataSource) {
+		this.repository = dataSource.getRepository(ConsentEntity);
+	}
+	async findMany(query, options = {}) {
+		const qb = this.repository.createQueryBuilder("consent");
+		const { pagination } = applyQuery(qb, query, {
+			defaultAlias: "consent",
+			fields: { default: [
+				"id",
+				"client_id",
+				"realm_id",
+				"user_id",
+				"sub",
+				"sub_kind",
+				"scope",
+				"expires_at",
+				"created_at",
+				"updated_at"
+			] },
+			filters: { allowed: [...CONSENT_FILTER_KEYS] },
+			relations: { allowed: ["realm"] },
+			sort: { allowed: [
+				"created_at",
+				"updated_at",
+				"scope"
+			] },
+			pagination: { maxLimit: 50 }
+		});
+		applyRealmScopeSelect(qb, "consent", ["sub", "sub_kind"]);
+		qb.leftJoin("consent.client", "client").addSelect([
+			"client.id",
+			"client.name",
+			"client.display_name",
+			"client.built_in"
+		]);
+		if (options.owner) qb.andWhere("consent.sub = :ownerSub AND consent.sub_kind = :ownerSubKind", {
+			ownerSub: options.owner.sub,
+			ownerSubKind: options.owner.subKind
+		});
+		if (options.realmId) qb.andWhere("consent.realm_id = :realmId", { realmId: options.realmId });
+		const [entities, total] = await qb.getManyAndCount();
+		return {
+			data: entities,
+			meta: {
+				total,
+				...pagination
+			}
+		};
+	}
+	async findOneById(id) {
+		return this.repository.findOneBy({ id });
+	}
+	async findAllBySubjectClient(clientId, owner) {
+		const qb = this.repository.createQueryBuilder("consent");
+		qb.where("consent.client_id = :clientId AND consent.sub = :sub AND consent.sub_kind = :subKind", {
+			clientId,
+			sub: owner.sub,
+			subKind: owner.subKind
+		});
+		qb.cache(buildRedisKeyPath({
+			prefix: CachePrefix.CONSENT_COVERING,
+			key: `${clientId}:${owner.subKind}:${owner.sub}`
+		}), 6e4);
+		return qb.getMany();
+	}
+	async insertMissing(input) {
+		const existing = await this.repository.createQueryBuilder("consent").where("consent.client_id = :clientId AND consent.sub = :sub AND consent.sub_kind = :subKind", {
+			clientId: input.clientId,
+			sub: input.owner.sub,
+			subKind: input.owner.subKind
+		}).getMany();
+		const existingTokens = new Set(existing.map((row) => row.scope));
+		const missing = input.scopes.filter((token) => !existingTokens.has(token));
+		const userId = input.owner.subKind === IdentityType.USER ? input.owner.sub : null;
+		for (const scope of missing) {
+			const entity = this.repository.create({
+				client_id: input.clientId,
+				realm_id: input.realmId,
+				user_id: userId,
+				sub: input.owner.sub,
+				sub_kind: input.owner.subKind,
+				scope,
+				expires_at: null
+			});
+			try {
+				await this.repository.save(entity);
+			} catch (e) {
+				if (!isUniqueConstraintDatabaseError(e)) throw e;
+			}
+		}
+	}
+	async remove(entity) {
+		await this.repository.remove(entity);
+	}
+};
+//#endregion
+export { ConsentRepositoryAdapter };
+
+//# sourceMappingURL=repository.mjs.map

package/dist/app/modules/oauth2/repositories/consent/repository.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.mjs","names":["IdentityType","buildRedisKeyPath","applyQuery","CachePrefix","ConsentEntity","isUniqueConstraintDatabaseError","CONSENT_FILTER_KEYS","applyRealmScopeSelect","ConsentRepositoryAdapter","repository","dataSource","getRepository","findMany","query","options","qb","createQueryBuilder","pagination","defaultAlias","fields","default","filters","allowed","relations","sort","maxLimit","leftJoin","addSelect","owner","andWhere","ownerSub","sub","ownerSubKind","subKind","realmId","entities","total","getManyAndCount","data","meta","findOneById","id","findOneBy","findAllBySubjectClient","clientId","where","cache","prefix","CONSENT_COVERING","key","getMany","insertMissing","input","existing","existingTokens","Set","map","row","scope","missing","scopes","filter","token","has","userId","USER","entity","create","client_id","realm_id","user_id","sub_kind","expires_at","save","e","remove"],"sources":["../../../../../../src/app/modules/oauth2/repositories/consent/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Consent } from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { buildRedisKeyPath } from '@authup/server-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport { applyQuery } from 'typeorm-extension';\nimport { CachePrefix, ConsentEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { isUniqueConstraintDatabaseError } from '../../../../../adapters/database/errors/index.ts';\nimport type {\n    ConsentFindManyOptions,\n    ConsentOwner,\n    IConsentRepository,\n} from '../../../../../core/index.ts';\nimport { CONSENT_FILTER_KEYS } from '../../../../../core/index.ts';\nimport { applyRealmScopeSelect } from '../../../database/repositories/helpers.ts';\n\nexport class ConsentRepositoryAdapter implements IConsentRepository {\n    protected repository: Repository<ConsentEntity>;\n\n    constructor(dataSource: DataSource) {\n        this.repository = dataSource.getRepository(ConsentEntity);\n    }\n\n    async findMany(\n        query: Record<string, any>,\n        options: ConsentFindManyOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<Consent>> {\n        const qb = this.repository.createQueryBuilder('consent');\n\n        const { pagination } = applyQuery(qb, query, {\n            defaultAlias: 'consent',\n            fields: {\n                // `default` (not just `allowed`) so applyQuery adds an explicit\n                // per-column SELECT: it populates expressionMap.selects, which\n                // applyRealmScopeSelect dedupes against. Without it the default\n                // \"select all\" is implicit (empty selects) and the force-select\n                // re-adds consent.sub — a duplicate `consent_sub` alias that\n                // mysql rejects under the client join (see helpers.ts).\n                default: [\n                    'id',\n                    'client_id',\n                    'realm_id',\n                    'user_id',\n                    'sub',\n                    'sub_kind',\n                    'scope',\n                    'expires_at',\n                    'created_at',\n                    'updated_at',\n                ],\n            },\n            filters: { allowed: [...CONSENT_FILTER_KEYS] },\n            relations: { allowed: ['realm'] },\n            sort: { allowed: ['created_at', 'updated_at', 'scope'] },\n            pagination: { maxLimit: 50 },\n        });\n\n        applyRealmScopeSelect(qb, 'consent', ['sub', 'sub_kind']);\n\n        // Always expose only a client SUMMARY (id / name / display_name /\n        // built_in) — NEVER the full ClientEntity (redirect_uri + post-logout\n        // patterns = the trusted-origin set, grant_types, base_url/root_url,\n        // secret-storage flags, access_policy_id). `client` is deliberately\n        // absent from relations.allowed so a raw ?include=client cannot force\n        // the full-column join; the self-service Applications tab still gets\n        // the display name from this fixed projection.\n        qb.leftJoin('consent.client', 'client')\n            .addSelect([\n                'client.id',\n                'client.name',\n                'client.display_name',\n                'client.built_in',\n            ]);\n\n        if (options.owner) {\n            // mandatory constraint — not overridable by a rapiq filter\n            qb.andWhere('consent.sub = :ownerSub AND consent.sub_kind = :ownerSubKind', {\n                ownerSub: options.owner.sub,\n                ownerSubKind: options.owner.subKind,\n            });\n        }\n\n        if (options.realmId) {\n            // nested `/realms/:realmId/consents` mount — mandatory constraint,\n            // not overridable by a rapiq filter\n            qb.andWhere('consent.realm_id = :realmId', { realmId: options.realmId });\n        }\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: entities,\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findOneById(id: string): Promise<Consent | null> {\n        return this.repository.findOneBy({ id });\n    }\n\n    async findAllBySubjectClient(clientId: string, owner: ConsentOwner): Promise<Consent[]> {\n        const qb = this.repository.createQueryBuilder('consent');\n        qb.where('consent.client_id = :clientId AND consent.sub = :sub AND consent.sub_kind = :subKind', {\n            clientId,\n            sub: owner.sub,\n            subKind: owner.subKind,\n        });\n        qb.cache(\n            buildRedisKeyPath({\n                prefix: CachePrefix.CONSENT_COVERING,\n                key: `${clientId}:${owner.subKind}:${owner.sub}`,\n            }),\n            60_000,\n        );\n\n        return qb.getMany();\n    }\n\n    async insertMissing(input: {\n        clientId: string,\n        realmId: string,\n        owner: ConsentOwner,\n        scopes: string[]\n    }): Promise<void> {\n        // uncached read — the diff must see the latest rows, and the covering\n        // cache entry must not be refreshed on the write path.\n        const existing = await this.repository.createQueryBuilder('consent')\n            .where('consent.client_id = :clientId AND consent.sub = :sub AND consent.sub_kind = :subKind', {\n                clientId: input.clientId,\n                sub: input.owner.sub,\n                subKind: input.owner.subKind,\n            })\n            .getMany();\n\n        const existingTokens = new Set(existing.map((row) => row.scope));\n        const missing = input.scopes.filter((token) => !existingTokens.has(token));\n\n        // save-per-row (never a raw qb insert): entity-manager saves fire the\n        // ConsentEntitySubscriber — covering-cache invalidation, realtime\n        // destinations and audit mirroring depend on it. A duplicate-key\n        // violation is the benign race outcome under the unique index.\n        // Set the user_id FK only when the subject is a user, so a user\n        // deletion cascade-drops its consent rows; non-user subjects leave it\n        // null (the row is still cleaned up when its client/realm is deleted).\n        const userId = input.owner.subKind === IdentityType.USER ?\n            input.owner.sub :\n            null;\n\n        for (const scope of missing) {\n            const entity = this.repository.create({\n                client_id: input.clientId,\n                realm_id: input.realmId,\n                user_id: userId,\n                sub: input.owner.sub,\n                sub_kind: input.owner.subKind,\n                scope,\n                expires_at: null,\n            });\n\n            try {\n                await this.repository.save(entity);\n            } catch (e) {\n                if (!isUniqueConstraintDatabaseError(e)) {\n                    throw e;\n                }\n            }\n        }\n    }\n\n    async remove(entity: Consent): Promise<void> {\n        await this.repository.remove(entity as ConsentEntity);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAuBA,IAAaQ,2BAAb,MAAaA;CACCC;CAEV,YAAYC,YAAwB;EAChC,KAAKD,aAAaC,WAAWC,cAAcP,aAAAA;CAC/C;CAEA,MAAMQ,SACFC,OACAC,UAAkC,CAAC,GACa;EAChD,MAAMC,KAAK,KAAKN,WAAWO,mBAAmB,SAAA;EAE9C,MAAM,EAAEC,eAAef,WAAWa,IAAIF,OAAO;GACzCK,cAAc;GACdC,QAAQ,EAOJC,SAAS;IACL;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;KAER;GACAC,SAAS,EAAEC,SAAS,CAAA,GAAIhB,mBAAAA,EAAqB;GAC7CiB,WAAW,EAAED,SAAS,CAAC,OAAA,EAAS;GAChCE,MAAM,EAAEF,SAAS;IAAC;IAAc;IAAc;KAAS;GACvDL,YAAY,EAAEQ,UAAU,GAAG;EAC/B,CAAA;EAEAlB,sBAAsBQ,IAAI,WAAW,CAAC,OAAO,UAAA,CAAW;EASxDA,GAAGW,SAAS,kBAAkB,QAAA,CAAA,CACzBC,UAAU;GACP;GACA;GACA;GACA;GACH;EAEL,IAAIb,QAAQc,OAERb,GAAGc,SAAS,gEAAgE;GACxEC,UAAUhB,QAAQc,MAAMG;GACxBC,cAAclB,QAAQc,MAAMK;EAChC,CAAA;EAGJ,IAAInB,QAAQoB,SAGRnB,GAAGc,SAAS,+BAA+B,EAAEK,SAASpB,QAAQoB,QAAQ,CAAA;EAG1E,MAAM,CAACC,UAAUC,SAAS,MAAMrB,GAAGsB,gBAAe;EAElD,OAAO;GACHC,MAAMH;GACNI,MAAM;IACFH;IACA,GAAGnB;GACP;EACJ;CACJ;CAEA,MAAMuB,YAAYC,IAAqC;EACnD,OAAO,KAAKhC,WAAWiC,UAAU,EAAED,GAAG,CAAA;CAC1C;CAEA,MAAME,uBAAuBC,UAAkBhB,OAAyC;EACpF,MAAMb,KAAK,KAAKN,WAAWO,mBAAmB,SAAA;EAC9CD,GAAG8B,MAAM,wFAAwF;GAC7FD;GACAb,KAAKH,MAAMG;GACXE,SAASL,MAAMK;EACnB,CAAA;EACAlB,GAAG+B,MACC7C,kBAAkB;GACd8C,QAAQ5C,YAAY6C;GACpBC,KAAK,GAAGL,SAAS,GAAGhB,MAAMK,QAAQ,GAAGL,MAAMG;EAC/C,CAAA,GACA,GAAA;EAGJ,OAAOhB,GAAGmC,QAAO;CACrB;CAEA,MAAMC,cAAcC,OAKF;EAGd,MAAMC,WAAW,MAAM,KAAK5C,WAAWO,mBAAmB,SAAA,CAAA,CACrD6B,MAAM,wFAAwF;GAC3FD,UAAUQ,MAAMR;GAChBb,KAAKqB,MAAMxB,MAAMG;GACjBE,SAASmB,MAAMxB,MAAMK;EACzB,CAAA,CAAA,CACCiB,QAAO;EAEZ,MAAMI,iBAAiB,IAAIC,IAAIF,SAASG,KAAKC,QAAQA,IAAIC,KAAK,CAAA;EAC9D,MAAMC,UAAUP,MAAMQ,OAAOC,QAAQC,UAAU,CAACR,eAAeS,IAAID,KAAAA,CAAAA;EASnE,MAAME,SAASZ,MAAMxB,MAAMK,YAAYjC,aAAaiE,OAChDb,MAAMxB,MAAMG,MACZ;EAEJ,KAAK,MAAM2B,SAASC,SAAS;GACzB,MAAMO,SAAS,KAAKzD,WAAW0D,OAAO;IAClCC,WAAWhB,MAAMR;IACjByB,UAAUjB,MAAMlB;IAChBoC,SAASN;IACTjC,KAAKqB,MAAMxB,MAAMG;IACjBwC,UAAUnB,MAAMxB,MAAMK;IACtByB;IACAc,YAAY;GAChB,CAAA;GAEA,IAAI;IACA,MAAM,KAAK/D,WAAWgE,KAAKP,MAAAA;GAC/B,SAASQ,GAAG;IACR,IAAI,CAACrE,gCAAgCqE,CAAAA,GACjC,MAAMA;GAEd;EACJ;CACJ;CAEA,MAAMC,OAAOT,QAAgC;EACzC,MAAM,KAAKzD,WAAWkE,OAAOT,MAAAA;CACjC;AACJ"}

package/dist/app/modules/oauth2/repositories/index.d.ts

@@ -1,6 +1,7 @@
 export * from './authorize/index.ts';
 export * from './client/index.ts';
+export * from './consent/index.ts';
 export * from './scope/index.ts';
-export * from './key/index.ts';
+export * from './session-token/index.ts';
 export * from './token/index.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/app/modules/oauth2/repositories/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/oauth2/repositories/index.ts"],"names":[],"mappings":"AAOA,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/oauth2/repositories/index.ts"],"names":[],"mappings":"AAOA,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC"}

package/dist/app/modules/oauth2/repositories/index.mjs

@@ -6,9 +6,11 @@ import { OAuth2AuthorizationStateRepository } from "./authorize/state/repository
 import "./authorize/index.mjs";
 import { OAuth2ClientRepository } from "./client/repository.mjs";
 import "./client/index.mjs";
+import { ConsentRepositoryAdapter } from "./consent/repository.mjs";
+import "./consent/index.mjs";
 import { OAuth2ScopeRepository } from "./scope/repository.mjs";
-import { OAuth2KeyRepository } from "./key/repository.mjs";
-import "./key/index.mjs";
+import { SessionTokenRepositoryAdapter } from "./session-token/repository.mjs";
+import "./session-token/index.mjs";
 import { OAuth2TokenRepository } from "./token/repository.mjs";
 import "./token/index.mjs";
-export { OAuth2AuthorizationCodeRepository, OAuth2AuthorizationStateRepository, OAuth2ClientRepository, OAuth2KeyRepository, OAuth2ScopeRepository, OAuth2TokenRepository };
+export { ConsentRepositoryAdapter, OAuth2AuthorizationCodeRepository, OAuth2AuthorizationStateRepository, OAuth2ClientRepository, OAuth2ScopeRepository, OAuth2TokenRepository, SessionTokenRepositoryAdapter };

package/dist/app/modules/oauth2/repositories/session-token/index.d.ts

@@ -0,0 +1,2 @@
+export * from './repository.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/app/modules/oauth2/repositories/session-token/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/oauth2/repositories/session-token/index.ts"],"names":[],"mappings":"AAOA,cAAc,iBAAiB,CAAC"}

package/dist/app/modules/oauth2/repositories/session-token/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { SessionTokenRepositoryAdapter } from "./repository.mjs";
+export { SessionTokenRepositoryAdapter };

package/dist/app/modules/oauth2/repositories/session-token/repository.d.ts

@@ -0,0 +1,17 @@
+import type { SessionToken } from '@authup/core-kit';
+import type { DataSource, Repository } from 'typeorm';
+import { SessionTokenEntity } from '../../../../../adapters/database/domains/index.ts';
+import type { ISessionTokenRepository, SessionTokenCreateInput, SessionTokenRef } from '../../../../../core/index.ts';
+export declare class SessionTokenRepositoryAdapter implements ISessionTokenRepository {
+    protected repository: Repository<SessionTokenEntity>;
+    constructor(dataSource: DataSource);
+    create(input: SessionTokenCreateInput): Promise<SessionToken>;
+    findOneById(id: string): Promise<SessionToken | null>;
+    findBySessionId(sessionId: string): Promise<SessionToken[]>;
+    markRefreshConsumed(id: string, at: string): Promise<boolean>;
+    hasConsumedChild(parentId: string): Promise<boolean>;
+    revokeById(id: string, at: string): Promise<void>;
+    revokeBySessionId(sessionId: string, at: string): Promise<SessionTokenRef[]>;
+    deleteExpired(before: string): Promise<number>;
+}
+//# sourceMappingURL=repository.d.ts.map

package/dist/app/modules/oauth2/repositories/session-token/repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/oauth2/repositories/session-token/repository.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAEtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mDAAmD,CAAC;AACvF,OAAO,KAAK,EACR,uBAAuB,EACvB,uBAAuB,EACvB,eAAe,EAClB,MAAM,8BAA8B,CAAC;AAEtC,qBAAa,6BAA8B,YAAW,uBAAuB;IACzE,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC;gBAEzC,UAAU,EAAE,UAAU;IAI5B,MAAM,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,YAAY,CAAC;IAyB7D,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAIrD,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAI3D,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAa7D,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IASpD,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASjD,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAsB5E,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAKvD"}