@authup/server-core 1.0.0-beta.51 → 1.0.0-beta.53

package/dist/cli/commands/migration.mjs

@@ -47,13 +47,17 @@ async function runMigrationOperation(container, operation) {
 			"migration"
 		]
 	});
-	await dataSource.initialize();
 	try {
+		await dataSource.initialize();
 		if (operation === "revert") await dataSource.undoLastMigration();
 		else if (operation === "status") await dataSource.showMigrations();
 		else await dataSource.runMigrations();
 	} finally {
-		await dataSource.destroy();
+		if (dataSource.isInitialized) try {
+			await dataSource.destroy();
+		} catch (e) {
+			logger.error(`Failed to destroy data source after migration operation: ${e}`);
+		}
 	}
 }
 async function generateMigrations() {
@@ -84,8 +88,8 @@ async function generateMigrations() {
 			synchronize: false
 		});
 		const dataSource = new DataSource(dataSourceOptions);
-		await dataSource.initialize();
 		try {
+			await dataSource.initialize();
 			await dataSource.runMigrations();
 			await generateMigration({
 				dataSource,
@@ -95,7 +99,11 @@ async function generateMigrations() {
 				prettify: true
 			});
 		} finally {
-			await dataSource.destroy();
+			if (dataSource.isInitialized) try {
+				await dataSource.destroy();
+			} catch (e) {
+				console.error(e);
+			}
 		}
 	}
 }

package/dist/cli/commands/migration.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"migration.mjs","names":["defineCommand","path","process","checkDatabase","createDatabase","dropDatabase","generateMigration","transformFilePath","DataSource","DataSourceOptionsBuilder","ApplicationBuilder","ConfigInjectionKey","LoggerInjectionKey","ModuleName","CODE_PATH","MigrationOperation","runMigrationOperation","container","operation","config","resolve","logger","optionsBuilder","options","db","buildWith","buildWithEnv","debug","type","database","Array","isArray","migrations","i","length","check","exists","synchronize","ifNotExist","dataSource","logging","initialize","undoLastMigration","showMigrations","runMigrations","destroy","generateMigrations","connections","host","port","username","password","baseDirectory","join","timestamp","Date","now","connection","dataSourceOptions","directoryPath","name","prettify","defineCLIMigrationCommand","meta","args","required","Object","values","valueHint","setup","context","app","withConfig","withLogger","build","addModule","DATABASE","dependencies","CONFIG","LOGGER","exit","e","console","error"],"sources":["../../../src/cli/commands/migration.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineCommand } from 'citty';\nimport path from 'node:path';\nimport process from 'node:process';\nimport {\n    checkDatabase,\n    createDatabase, \n    dropDatabase, \n    generateMigration, \n    transformFilePath,\n} from 'typeorm-extension';\nimport { DataSource, type DataSourceOptions } from 'typeorm';\nimport { DataSourceOptionsBuilder } from '../../adapters/database/index.ts';\nimport {\n    ApplicationBuilder, \n    ConfigInjectionKey, \n    LoggerInjectionKey, \n    ModuleName,\n} from '../../app/index.ts';\nimport type { IContainer } from 'eldin';\nimport { CODE_PATH } from '../../path.ts';\n\nenum MigrationOperation {\n    GENERATE = 'generate',\n    REVERT = 'revert',\n    STATUS = 'status',\n    RUN = 'run',\n}\n\nasync function runMigrationOperation(\n    container: IContainer,\n    operation: string,\n): Promise<void> {\n    const config = container.resolve(ConfigInjectionKey);\n    const logger = container.resolve(LoggerInjectionKey);\n\n    const optionsBuilder = new DataSourceOptionsBuilder();\n\n    let options: DataSourceOptions;\n    if (config.db) {\n        options = optionsBuilder.buildWith(config.db);\n    } else {\n        options = optionsBuilder.buildWithEnv();\n    }\n\n    logger.debug(`Type: ${options.type}`);\n    logger.debug(`Database: ${options.database}`);\n\n    if (Array.isArray(options.migrations)) {\n        for (let i = 0; i < options.migrations.length; i++) {\n            if (typeof options.migrations[i] === 'string') {\n                logger.debug(`Migration-Directory: ${options.migrations[i]}`);\n            }\n        }\n    } else if (typeof options.migrations === 'string') {\n        logger.debug(`Migration-Directory: ${options.migrations}`);\n    }\n\n    const check = await checkDatabase({ options });\n\n    if (!check.exists) {\n        await createDatabase({\n            options,\n            synchronize: false,\n            ifNotExist: true, \n        });\n    }\n\n    const dataSource = new DataSource({\n        ...options,\n        logging: ['error', 'schema', 'migration'],\n    });\n    await dataSource.initialize();\n\n    try {\n        if (operation === MigrationOperation.REVERT) {\n            await dataSource.undoLastMigration();\n        } else if (operation === MigrationOperation.STATUS) {\n            await dataSource.showMigrations();\n        } else {\n            await dataSource.runMigrations();\n        }\n    } finally {\n        await dataSource.destroy();\n    }\n}\n\nasync function generateMigrations(): Promise<void> {\n    const optionsBuilder = new DataSourceOptionsBuilder();\n\n    const connections: DataSourceOptions[] = [\n        {\n            type: 'postgres',\n            database: 'migrations',\n            host: 'localhost',\n            port: 5432,\n            username: 'postgres',\n            password: 'start123',\n        },\n        {\n            type: 'mysql',\n            database: 'migrations',\n            host: 'localhost',\n            port: 3306,\n            username: 'root',\n            password: 'start123',\n        },\n    ];\n\n    const baseDirectory = transformFilePath(\n        path.join(CODE_PATH, 'adapters', 'database', 'migrations'),\n        './src',\n        './dist',\n    );\n\n    const timestamp = Date.now();\n\n    for (const connection of connections) {\n        const dataSourceOptions = optionsBuilder.buildWith(connection);\n        const directoryPath = path.join(baseDirectory, dataSourceOptions.type);\n\n        await dropDatabase({ options: dataSourceOptions });\n        await createDatabase({\n            options: dataSourceOptions,\n            synchronize: false, \n        });\n\n        const dataSource = new DataSource(dataSourceOptions);\n        await dataSource.initialize();\n\n        try {\n            await dataSource.runMigrations();\n\n            await generateMigration({\n                dataSource,\n                name: 'Default',\n                directoryPath,\n                timestamp,\n                prettify: true,\n            });\n        } finally {\n            await dataSource.destroy();\n        }\n    }\n}\n\nexport function defineCLIMigrationCommand() {\n    return defineCommand({\n        meta: { name: 'migration' },\n        args: {\n            operation: {\n                required: true,\n                type: 'positional',\n                options: Object.values(MigrationOperation),\n                valueHint: Object.values(MigrationOperation).join('|'),\n            },\n        },\n        async setup(context) {\n            try {\n                if (context.args.operation === MigrationOperation.GENERATE) {\n                    await generateMigrations();\n                } else {\n                    const app = new ApplicationBuilder()\n                        .withConfig()\n                        .withLogger()\n                        .build();\n\n                    app.addModule({\n                        name: ModuleName.DATABASE,\n                        dependencies: [ModuleName.CONFIG, ModuleName.LOGGER],\n                        async setup(container: IContainer): Promise<void> {\n                            await runMigrationOperation(container, context.args.operation);\n                        },\n                    });\n\n                    await app.setup();\n                }\n\n                process.exit(0);\n            } catch (e) {\n                // eslint-disable-next-line no-console\n                console.error(e);\n\n                process.exit(1);\n            }\n        },\n    });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA4BA,IAAA,qBAAKe,uBAAAA,oBAAAA;;;;;QAAAA;EAAAA,sBAAAA,CAAAA,CAAAA;AAOL,eAAeC,sBACXC,WACAC,WAAiB;CAEjB,MAAMC,SAASF,UAAUG,QAAQT,kBAAAA;CACjC,MAAMU,SAASJ,UAAUG,QAAQR,kBAAAA;CAEjC,MAAMU,iBAAiB,IAAIb,yBAAAA;CAE3B,IAAIc;CACJ,IAAIJ,OAAOK,IACPD,UAAUD,eAAeG,UAAUN,OAAOK,EAAE;MAE5CD,UAAUD,eAAeI,aAAY;CAGzCL,OAAOM,MAAM,SAASJ,QAAQK,MAAM;CACpCP,OAAOM,MAAM,aAAaJ,QAAQM,UAAU;CAE5C,IAAIC,MAAMC,QAAQR,QAAQS,UAAU;OAC3B,IAAIC,IAAI,GAAGA,IAAIV,QAAQS,WAAWE,QAAQD,KAC3C,IAAI,OAAOV,QAAQS,WAAWC,OAAO,UACjCZ,OAAOM,MAAM,wBAAwBJ,QAAQS,WAAWC,IAAI;CAAA,OAGjE,IAAI,OAAOV,QAAQS,eAAe,UACrCX,OAAOM,MAAM,wBAAwBJ,QAAQS,YAAY;CAK7D,IAAI,EAACG,MAFehC,cAAc,EAAEoB,QAAQ,CAAA,EAAA,CAEjCa,QACP,MAAMhC,eAAe;EACjBmB;EACAc,aAAa;EACbC,YAAY;CAChB,CAAA;CAGJ,MAAMC,aAAa,IAAI/B,WAAW;EAC9B,GAAGe;EACHiB,SAAS;GAAC;GAAS;GAAU;;CACjC,CAAA;CACA,MAAMD,WAAWE,WAAU;CAE3B,IAAI;EACA,IAAIvB,cAAAA,UACA,MAAMqB,WAAWG,kBAAiB;OAC/B,IAAIxB,cAAAA,UACP,MAAMqB,WAAWI,eAAc;OAE/B,MAAMJ,WAAWK,cAAa;CAEtC,UAAU;EACN,MAAML,WAAWM,QAAO;CAC5B;AACJ;AAEA,eAAeC,qBAAAA;CACX,MAAMxB,iBAAiB,IAAIb,yBAAAA;CAE3B,MAAMsC,cAAmC,CACrC;EACInB,MAAM;EACNC,UAAU;EACVmB,MAAM;EACNC,MAAM;EACNC,UAAU;EACVC,UAAU;CACd,GACA;EACIvB,MAAM;EACNC,UAAU;EACVmB,MAAM;EACNC,MAAM;EACNC,UAAU;EACVC,UAAU;CACd,CAAA;CAGJ,MAAMC,gBAAgB7C,kBAClBN,KAAKoD,KAAKvC,WAAW,YAAY,YAAY,YAAA,GAC7C,SACA,QAAA;CAGJ,MAAMwC,YAAYC,KAAKC,IAAG;CAE1B,KAAK,MAAMC,cAAcV,aAAa;EAClC,MAAMW,oBAAoBpC,eAAeG,UAAUgC,UAAAA;EACnD,MAAME,gBAAgB1D,KAAKoD,KAAKD,eAAeM,kBAAkB9B,IAAI;EAErE,MAAMvB,aAAa,EAAEkB,SAASmC,kBAAkB,CAAA;EAChD,MAAMtD,eAAe;GACjBmB,SAASmC;GACTrB,aAAa;EACjB,CAAA;EAEA,MAAME,aAAa,IAAI/B,WAAWkD,iBAAAA;EAClC,MAAMnB,WAAWE,WAAU;EAE3B,IAAI;GACA,MAAMF,WAAWK,cAAa;GAE9B,MAAMtC,kBAAkB;IACpBiC;IACAqB,MAAM;IACND;IACAL;IACAO,UAAU;GACd,CAAA;EACJ,UAAU;GACN,MAAMtB,WAAWM,QAAO;EAC5B;CACJ;AACJ;AAEA,SAAgBiB,4BAAAA;CACZ,OAAO9D,cAAc;EACjB+D,MAAM,EAAEH,MAAM,YAAY;EAC1BI,MAAM,EACF9C,WAAW;GACP+C,UAAU;GACVrC,MAAM;GACNL,SAAS2C,OAAOC,OAAOpD,kBAAAA;GACvBqD,WAAWF,OAAOC,OAAOpD,kBAAAA,CAAAA,CAAoBsC,KAAK,GAAA;EACtD,EACJ;EACA,MAAMgB,MAAMC,SAAO;GACf,IAAI;IACA,IAAIA,QAAQN,KAAK9C,cAAS,YACtB,MAAM4B,mBAAAA;SACH;KACH,MAAMyB,MAAM,IAAI7D,mBAAAA,CAAAA,CACX8D,WAAU,CAAA,CACVC,WAAU,CAAA,CACVC,MAAK;KAEVH,IAAII,UAAU;MACVf,MAAM/C,WAAW+D;MACjBC,cAAc,CAAChE,WAAWiE,QAAQjE,WAAWkE,MAAAA;MAC7C,MAAMV,MAAMpD,WAAqB;OAC7B,MAAMD,sBAAsBC,WAAWqD,QAAQN,KAAK9C,SAAS;MACjE;KACJ,CAAA;KAEA,MAAMqD,IAAIF,MAAK;IACnB;IAEAnE,QAAQ8E,KAAK,CAAA;GACjB,SAASC,GAAG;IAERC,QAAQC,MAAMF,CAAAA;IAEd/E,QAAQ8E,KAAK,CAAA;GACjB;EACJ;CACJ,CAAA;AACJ"}
+{"version":3,"file":"migration.mjs","names":["defineCommand","path","process","checkDatabase","createDatabase","dropDatabase","generateMigration","transformFilePath","DataSource","DataSourceOptionsBuilder","ApplicationBuilder","ConfigInjectionKey","LoggerInjectionKey","ModuleName","CODE_PATH","MigrationOperation","runMigrationOperation","container","operation","config","resolve","logger","optionsBuilder","options","db","buildWith","buildWithEnv","debug","type","database","Array","isArray","migrations","i","length","check","exists","synchronize","ifNotExist","dataSource","logging","initialize","undoLastMigration","showMigrations","runMigrations","isInitialized","destroy","e","error","generateMigrations","connections","host","port","username","password","baseDirectory","join","timestamp","Date","now","connection","dataSourceOptions","directoryPath","name","prettify","console","defineCLIMigrationCommand","meta","args","required","Object","values","valueHint","setup","context","app","withConfig","withLogger","build","addModule","DATABASE","dependencies","CONFIG","LOGGER","exit"],"sources":["../../../src/cli/commands/migration.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineCommand } from 'citty';\nimport path from 'node:path';\nimport process from 'node:process';\nimport {\n    checkDatabase,\n    createDatabase, \n    dropDatabase, \n    generateMigration, \n    transformFilePath,\n} from 'typeorm-extension';\nimport { DataSource, type DataSourceOptions } from 'typeorm';\nimport { DataSourceOptionsBuilder } from '../../adapters/database/index.ts';\nimport {\n    ApplicationBuilder, \n    ConfigInjectionKey, \n    LoggerInjectionKey, \n    ModuleName,\n} from '../../app/index.ts';\nimport type { IContainer } from 'eldin';\nimport { CODE_PATH } from '../../path.ts';\n\nenum MigrationOperation {\n    GENERATE = 'generate',\n    REVERT = 'revert',\n    STATUS = 'status',\n    RUN = 'run',\n}\n\nasync function runMigrationOperation(\n    container: IContainer,\n    operation: string,\n): Promise<void> {\n    const config = container.resolve(ConfigInjectionKey);\n    const logger = container.resolve(LoggerInjectionKey);\n\n    const optionsBuilder = new DataSourceOptionsBuilder();\n\n    let options: DataSourceOptions;\n    if (config.db) {\n        options = optionsBuilder.buildWith(config.db);\n    } else {\n        options = optionsBuilder.buildWithEnv();\n    }\n\n    logger.debug(`Type: ${options.type}`);\n    logger.debug(`Database: ${options.database}`);\n\n    if (Array.isArray(options.migrations)) {\n        for (let i = 0; i < options.migrations.length; i++) {\n            if (typeof options.migrations[i] === 'string') {\n                logger.debug(`Migration-Directory: ${options.migrations[i]}`);\n            }\n        }\n    } else if (typeof options.migrations === 'string') {\n        logger.debug(`Migration-Directory: ${options.migrations}`);\n    }\n\n    const check = await checkDatabase({ options });\n\n    if (!check.exists) {\n        await createDatabase({\n            options,\n            synchronize: false,\n            ifNotExist: true, \n        });\n    }\n\n    const dataSource = new DataSource({\n        ...options,\n        logging: ['error', 'schema', 'migration'],\n    });\n\n    try {\n        await dataSource.initialize();\n\n        if (operation === MigrationOperation.REVERT) {\n            await dataSource.undoLastMigration();\n        } else if (operation === MigrationOperation.STATUS) {\n            await dataSource.showMigrations();\n        } else {\n            await dataSource.runMigrations();\n        }\n    } finally {\n        if (dataSource.isInitialized) {\n            try {\n                await dataSource.destroy();\n            } catch (e) {\n                logger.error(`Failed to destroy data source after migration operation: ${e}`);\n            }\n        }\n    }\n}\n\nasync function generateMigrations(): Promise<void> {\n    const optionsBuilder = new DataSourceOptionsBuilder();\n\n    const connections: DataSourceOptions[] = [\n        {\n            type: 'postgres',\n            database: 'migrations',\n            host: 'localhost',\n            port: 5432,\n            username: 'postgres',\n            password: 'start123',\n        },\n        {\n            type: 'mysql',\n            database: 'migrations',\n            host: 'localhost',\n            port: 3306,\n            username: 'root',\n            password: 'start123',\n        },\n    ];\n\n    const baseDirectory = transformFilePath(\n        path.join(CODE_PATH, 'adapters', 'database', 'migrations'),\n        './src',\n        './dist',\n    );\n\n    const timestamp = Date.now();\n\n    for (const connection of connections) {\n        const dataSourceOptions = optionsBuilder.buildWith(connection);\n        const directoryPath = path.join(baseDirectory, dataSourceOptions.type);\n\n        await dropDatabase({ options: dataSourceOptions });\n        await createDatabase({\n            options: dataSourceOptions,\n            synchronize: false, \n        });\n\n        const dataSource = new DataSource(dataSourceOptions);\n\n        try {\n            await dataSource.initialize();\n\n            await dataSource.runMigrations();\n\n            await generateMigration({\n                dataSource,\n                name: 'Default',\n                directoryPath,\n                timestamp,\n                prettify: true,\n            });\n        } finally {\n            if (dataSource.isInitialized) {\n                try {\n                    await dataSource.destroy();\n                } catch (e) {\n                    // eslint-disable-next-line no-console\n                    console.error(e);\n                }\n            }\n        }\n    }\n}\n\nexport function defineCLIMigrationCommand() {\n    return defineCommand({\n        meta: { name: 'migration' },\n        args: {\n            operation: {\n                required: true,\n                type: 'positional',\n                options: Object.values(MigrationOperation),\n                valueHint: Object.values(MigrationOperation).join('|'),\n            },\n        },\n        async setup(context) {\n            try {\n                if (context.args.operation === MigrationOperation.GENERATE) {\n                    await generateMigrations();\n                } else {\n                    const app = new ApplicationBuilder()\n                        .withConfig()\n                        .withLogger()\n                        .build();\n\n                    app.addModule({\n                        name: ModuleName.DATABASE,\n                        dependencies: [ModuleName.CONFIG, ModuleName.LOGGER],\n                        async setup(container: IContainer): Promise<void> {\n                            await runMigrationOperation(container, context.args.operation);\n                        },\n                    });\n\n                    await app.setup();\n                }\n\n                process.exit(0);\n            } catch (e) {\n                // eslint-disable-next-line no-console\n                console.error(e);\n\n                process.exit(1);\n            }\n        },\n    });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA4BA,IAAA,qBAAKe,uBAAAA,oBAAAA;;;;;QAAAA;EAAAA,sBAAAA,CAAAA,CAAAA;AAOL,eAAeC,sBACXC,WACAC,WAAiB;CAEjB,MAAMC,SAASF,UAAUG,QAAQT,kBAAAA;CACjC,MAAMU,SAASJ,UAAUG,QAAQR,kBAAAA;CAEjC,MAAMU,iBAAiB,IAAIb,yBAAAA;CAE3B,IAAIc;CACJ,IAAIJ,OAAOK,IACPD,UAAUD,eAAeG,UAAUN,OAAOK,EAAE;MAE5CD,UAAUD,eAAeI,aAAY;CAGzCL,OAAOM,MAAM,SAASJ,QAAQK,MAAM;CACpCP,OAAOM,MAAM,aAAaJ,QAAQM,UAAU;CAE5C,IAAIC,MAAMC,QAAQR,QAAQS,UAAU;OAC3B,IAAIC,IAAI,GAAGA,IAAIV,QAAQS,WAAWE,QAAQD,KAC3C,IAAI,OAAOV,QAAQS,WAAWC,OAAO,UACjCZ,OAAOM,MAAM,wBAAwBJ,QAAQS,WAAWC,IAAI;CAAA,OAGjE,IAAI,OAAOV,QAAQS,eAAe,UACrCX,OAAOM,MAAM,wBAAwBJ,QAAQS,YAAY;CAK7D,IAAI,EAACG,MAFehC,cAAc,EAAEoB,QAAQ,CAAA,EAAA,CAEjCa,QACP,MAAMhC,eAAe;EACjBmB;EACAc,aAAa;EACbC,YAAY;CAChB,CAAA;CAGJ,MAAMC,aAAa,IAAI/B,WAAW;EAC9B,GAAGe;EACHiB,SAAS;GAAC;GAAS;GAAU;;CACjC,CAAA;CAEA,IAAI;EACA,MAAMD,WAAWE,WAAU;EAE3B,IAAIvB,cAAAA,UACA,MAAMqB,WAAWG,kBAAiB;OAC/B,IAAIxB,cAAAA,UACP,MAAMqB,WAAWI,eAAc;OAE/B,MAAMJ,WAAWK,cAAa;CAEtC,UAAU;EACN,IAAIL,WAAWM,eACX,IAAI;GACA,MAAMN,WAAWO,QAAO;EAC5B,SAASC,GAAG;GACR1B,OAAO2B,MAAM,4DAA4DD,GAAG;EAChF;CAER;AACJ;AAEA,eAAeE,qBAAAA;CACX,MAAM3B,iBAAiB,IAAIb,yBAAAA;CAE3B,MAAMyC,cAAmC,CACrC;EACItB,MAAM;EACNC,UAAU;EACVsB,MAAM;EACNC,MAAM;EACNC,UAAU;EACVC,UAAU;CACd,GACA;EACI1B,MAAM;EACNC,UAAU;EACVsB,MAAM;EACNC,MAAM;EACNC,UAAU;EACVC,UAAU;CACd,CAAA;CAGJ,MAAMC,gBAAgBhD,kBAClBN,KAAKuD,KAAK1C,WAAW,YAAY,YAAY,YAAA,GAC7C,SACA,QAAA;CAGJ,MAAM2C,YAAYC,KAAKC,IAAG;CAE1B,KAAK,MAAMC,cAAcV,aAAa;EAClC,MAAMW,oBAAoBvC,eAAeG,UAAUmC,UAAAA;EACnD,MAAME,gBAAgB7D,KAAKuD,KAAKD,eAAeM,kBAAkBjC,IAAI;EAErE,MAAMvB,aAAa,EAAEkB,SAASsC,kBAAkB,CAAA;EAChD,MAAMzD,eAAe;GACjBmB,SAASsC;GACTxB,aAAa;EACjB,CAAA;EAEA,MAAME,aAAa,IAAI/B,WAAWqD,iBAAAA;EAElC,IAAI;GACA,MAAMtB,WAAWE,WAAU;GAE3B,MAAMF,WAAWK,cAAa;GAE9B,MAAMtC,kBAAkB;IACpBiC;IACAwB,MAAM;IACND;IACAL;IACAO,UAAU;GACd,CAAA;EACJ,UAAU;GACN,IAAIzB,WAAWM,eACX,IAAI;IACA,MAAMN,WAAWO,QAAO;GAC5B,SAASC,GAAG;IAERkB,QAAQjB,MAAMD,CAAAA;GAClB;EAER;CACJ;AACJ;AAEA,SAAgBmB,4BAAAA;CACZ,OAAOlE,cAAc;EACjBmE,MAAM,EAAEJ,MAAM,YAAY;EAC1BK,MAAM,EACFlD,WAAW;GACPmD,UAAU;GACVzC,MAAM;GACNL,SAAS+C,OAAOC,OAAOxD,kBAAAA;GACvByD,WAAWF,OAAOC,OAAOxD,kBAAAA,CAAAA,CAAoByC,KAAK,GAAA;EACtD,EACJ;EACA,MAAMiB,MAAMC,SAAO;GACf,IAAI;IACA,IAAIA,QAAQN,KAAKlD,cAAS,YACtB,MAAM+B,mBAAAA;SACH;KACH,MAAM0B,MAAM,IAAIjE,mBAAAA,CAAAA,CACXkE,WAAU,CAAA,CACVC,WAAU,CAAA,CACVC,MAAK;KAEVH,IAAII,UAAU;MACVhB,MAAMlD,WAAWmE;MACjBC,cAAc,CAACpE,WAAWqE,QAAQrE,WAAWsE,MAAAA;MAC7C,MAAMV,MAAMxD,WAAqB;OAC7B,MAAMD,sBAAsBC,WAAWyD,QAAQN,KAAKlD,SAAS;MACjE;KACJ,CAAA;KAEA,MAAMyD,IAAIF,MAAK;IACnB;IAEAvE,QAAQkF,KAAK,CAAA;GACjB,SAASrC,GAAG;IAERkB,QAAQjB,MAAMD,CAAAA;IAEd7C,QAAQkF,KAAK,CAAA;GACjB;EACJ;CACJ,CAAA;AACJ"}

package/dist/components/event-cleaner/index.d.ts

@@ -0,0 +1,2 @@
+export * from './module.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/components/event-cleaner/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/components/event-cleaner/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC"}

package/dist/components/event-cleaner/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { createEventCleanerComponent } from "./module.mjs";
+export { createEventCleanerComponent };

package/dist/components/event-cleaner/module.d.ts

@@ -0,0 +1,5 @@
+import type { Logger } from '@authup/server-kit';
+import type { DataSource } from 'typeorm';
+import type { Component } from '../types.ts';
+export declare function createEventCleanerComponent(dataSource: DataSource, logger?: Logger): Component;
+//# sourceMappingURL=module.d.ts.map

package/dist/components/event-cleaner/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/components/event-cleaner/module.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAG1C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,wBAAgB,2BAA2B,CACvC,UAAU,EAAE,UAAU,EACtB,MAAM,CAAC,EAAE,MAAM,GACf,SAAS,CA4BZ"}

package/dist/components/event-cleaner/module.mjs

@@ -0,0 +1,30 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { EventEntity } from "../../adapters/database/domains/event/entity.mjs";
+import "../../adapters/database/domains/index.mjs";
+import { EventRepositoryAdapter } from "../../app/modules/database/repositories/event/repository.mjs";
+import "../../app/modules/database/repositories/index.mjs";
+import cron from "node-cron";
+//#region src/components/event-cleaner/module.ts
+function createEventCleanerComponent(dataSource, logger) {
+	return { async start() {
+		const repository = new EventRepositoryAdapter(dataSource.getRepository(EventEntity));
+		const execute = async () => {
+			try {
+				await repository.deleteExpired((/* @__PURE__ */ new Date()).toISOString());
+			} catch (e) {
+				logger?.warn("Sweeping expired audit events failed.");
+				logger?.warn(e);
+			}
+		};
+		await execute();
+		cron.schedule("* * * * *", async () => {
+			await execute();
+		});
+	} };
+}
+//#endregion
+export { createEventCleanerComponent };
+
+//# sourceMappingURL=module.mjs.map

package/dist/components/event-cleaner/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["cron","EventEntity","EventRepositoryAdapter","createEventCleanerComponent","dataSource","logger","start","repository","getRepository","execute","deleteExpired","Date","toISOString","e","warn","schedule"],"sources":["../../../src/components/event-cleaner/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport cron from 'node-cron';\nimport type { Event } from '@authup/core-kit';\nimport type { Logger } from '@authup/server-kit';\nimport type { DataSource } from 'typeorm';\nimport { EventEntity } from '../../adapters/database/domains/index.ts';\nimport { EventRepositoryAdapter } from '../../app/modules/database/repositories/index.ts';\nimport type { Component } from '../types.ts';\n\nexport function createEventCleanerComponent(\n    dataSource: DataSource,\n    logger?: Logger,\n) : Component {\n    return {\n        async start() {\n            const repository = new EventRepositoryAdapter(\n                dataSource.getRepository<Event>(EventEntity),\n            );\n\n            // A failed sweep must never take the process down (start() is\n            // fire-and-forget → an uncaught rejection is fatal on modern\n            // node); the next tick simply retries.\n            const execute = async () => {\n                try {\n                    // Rows carry a per-row expires_at stamped at write time from\n                    // eventLogRetentionDays; null = keep forever.\n                    await repository.deleteExpired(new Date().toISOString());\n                } catch (e) {\n                    logger?.warn('Sweeping expired audit events failed.');\n                    logger?.warn(e);\n                }\n            };\n\n            await execute();\n\n            cron.schedule('* * * * *', async () => {\n                await execute();\n            });\n        },\n    };\n}\n"],"mappings":";;;;;;;;;AAeA,SAAgBG,4BACZC,YACAC,QAAe;CAEf,OAAO,EACH,MAAMC,QAAAA;EACF,MAAMC,aAAa,IAAIL,uBACnBE,WAAWI,cAAqBP,WAAAA,CAAAA;EAMpC,MAAMQ,UAAU,YAAA;GACZ,IAAI;IAGA,MAAMF,WAAWG,+BAAc,IAAIC,KAAAA,EAAAA,CAAOC,YAAW,CAAA;GACzD,SAASC,GAAG;IACRR,QAAQS,KAAK,uCAAA;IACbT,QAAQS,KAAKD,CAAAA;GACjB;EACJ;EAEA,MAAMJ,QAAAA;EAENT,KAAKe,SAAS,aAAa,YAAA;GACvB,MAAMN,QAAAA;EACV,CAAA;CACJ,EACJ;AACJ"}

package/dist/components/index.d.ts

@@ -1,4 +1,5 @@
 export * from './database/index.ts';
+export * from './event-cleaner/index.ts';
 export * from './oauth2-cleaner/index.ts';
 export * from './types.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/components/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/components/index.ts"],"names":[],"mappings":"AAOA,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/components/index.ts"],"names":[],"mappings":"AAOA,cAAc,qBAAqB,CAAC;AACpC,cAAc,0BAA0B,CAAC;AACzC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,YAAY,CAAC"}

package/dist/components/index.mjs

@@ -4,6 +4,8 @@ import.meta.url;
 import { DatabaseUniqueEntriesComponent } from "./database/unique-entries/module.mjs";
 import { createDatabaseUniqueEntriesComponent } from "./database/unique-entries/factory.mjs";
 import "./database/index.mjs";
+import { createEventCleanerComponent } from "./event-cleaner/module.mjs";
+import "./event-cleaner/index.mjs";
 import { createOAuth2CleanerComponent } from "./oauth2-cleaner/module.mjs";
 import "./oauth2-cleaner/index.mjs";
-export { DatabaseUniqueEntriesComponent, createDatabaseUniqueEntriesComponent, createOAuth2CleanerComponent };
+export { DatabaseUniqueEntriesComponent, createDatabaseUniqueEntriesComponent, createEventCleanerComponent, createOAuth2CleanerComponent };

package/dist/components/oauth2-cleaner/module.d.ts

@@ -1,4 +1,5 @@
+import type { Logger } from '@authup/server-kit';
 import type { DataSource } from 'typeorm';
 import type { Component } from '../types.ts';
-export declare function createOAuth2CleanerComponent(dataSource: DataSource): Component;
+export declare function createOAuth2CleanerComponent(dataSource: DataSource, logger?: Logger): Component;
 //# sourceMappingURL=module.d.ts.map

package/dist/components/oauth2-cleaner/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/components/oauth2-cleaner/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAG1C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,UAAU,GAAI,SAAS,CAmB/E"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/components/oauth2-cleaner/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAG1C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,wBAAgB,4BAA4B,CACxC,UAAU,EAAE,UAAU,EACtB,MAAM,CAAC,EAAE,MAAM,GACf,SAAS,CAkCZ"}

package/dist/components/oauth2-cleaner/module.mjs

@@ -2,16 +2,24 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { SessionEntity } from "../../adapters/database/domains/session/entity.mjs";
+import { SessionTokenEntity } from "../../adapters/database/domains/session-token/entity.mjs";
 import "../../adapters/database/domains/index.mjs";
 import { LessThan } from "typeorm";
 import cron from "node-cron";
 //#region src/components/oauth2-cleaner/module.ts
-function createOAuth2CleanerComponent(dataSource) {
+function createOAuth2CleanerComponent(dataSource, logger) {
 	return { async start() {
 		const sessionRepository = dataSource.getRepository(SessionEntity);
+		const sessionTokenRepository = dataSource.getRepository(SessionTokenEntity);
 		const execute = async () => {
-			const isoDate = (/* @__PURE__ */ new Date()).toISOString();
-			await sessionRepository.delete({ expires_at: LessThan(isoDate) });
+			try {
+				const isoDate = (/* @__PURE__ */ new Date()).toISOString();
+				await sessionTokenRepository.delete({ expires_at: LessThan(isoDate) });
+				await sessionRepository.delete({ expires_at: LessThan(isoDate) });
+			} catch (e) {
+				logger?.warn("Sweeping expired sessions failed.");
+				logger?.warn(e);
+			}
 		};
 		await execute();
 		cron.schedule("* * * * *", async () => {

package/dist/components/oauth2-cleaner/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["cron","LessThan","SessionEntity","createOAuth2CleanerComponent","dataSource","start","sessionRepository","getRepository","execute","isoDate","Date","toISOString","delete","expires_at","schedule"],"sources":["../../../src/components/oauth2-cleaner/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport cron from 'node-cron';\nimport type { DataSource } from 'typeorm';\nimport { LessThan } from 'typeorm';\nimport { SessionEntity } from '../../adapters/database/domains/index.ts';\nimport type { Component } from '../types.ts';\n\nexport function createOAuth2CleanerComponent(dataSource: DataSource) : Component {\n    return {\n        async start() {\n            const sessionRepository = dataSource.getRepository(SessionEntity);\n\n            const execute = async () => {\n                const isoDate = new Date().toISOString();\n\n                await sessionRepository\n                    .delete({ expires_at: LessThan(isoDate) });\n            };\n\n            await execute();\n\n            cron.schedule('* * * * *', async () => {\n                await execute();\n            });\n        },\n    };\n}\n"],"mappings":";;;;;;;;AAaA,SAAgBG,6BAA6BC,YAAsB;CAC/D,OAAO,EACH,MAAMC,QAAAA;EACF,MAAMC,oBAAoBF,WAAWG,cAAcL,aAAAA;EAEnD,MAAMM,UAAU,YAAA;GACZ,MAAMC,2BAAU,IAAIC,KAAAA,EAAAA,CAAOC,YAAW;GAEtC,MAAML,kBACDM,OAAO,EAAEC,YAAYZ,SAASQ,OAAAA,EAAS,CAAA;EAChD;EAEA,MAAMD,QAAAA;EAENR,KAAKc,SAAS,aAAa,YAAA;GACvB,MAAMN,QAAAA;EACV,CAAA;CACJ,EACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["cron","LessThan","SessionEntity","SessionTokenEntity","createOAuth2CleanerComponent","dataSource","logger","start","sessionRepository","getRepository","sessionTokenRepository","execute","isoDate","Date","toISOString","delete","expires_at","e","warn","schedule"],"sources":["../../../src/components/oauth2-cleaner/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport cron from 'node-cron';\nimport type { Logger } from '@authup/server-kit';\nimport type { DataSource } from 'typeorm';\nimport { LessThan } from 'typeorm';\nimport { SessionEntity, SessionTokenEntity } from '../../adapters/database/domains/index.ts';\nimport type { Component } from '../types.ts';\n\nexport function createOAuth2CleanerComponent(\n    dataSource: DataSource,\n    logger?: Logger,\n) : Component {\n    return {\n        async start() {\n            const sessionRepository = dataSource.getRepository(SessionEntity);\n            const sessionTokenRepository = dataSource.getRepository(SessionTokenEntity);\n\n            // A failed sweep must never take the process down (start() is\n            // fire-and-forget → an uncaught rejection is fatal on modern\n            // node); the next tick simply retries.\n            const execute = async () => {\n                try {\n                    const isoDate = new Date().toISOString();\n\n                    // Sweep expired session-token rows first: the auth_session_tokens\n                    // volume dominates (one row per access token, ~15min TTL) and a\n                    // deleted session cascade-drops its remaining rows anyway.\n                    await sessionTokenRepository\n                        .delete({ expires_at: LessThan(isoDate) });\n\n                    await sessionRepository\n                        .delete({ expires_at: LessThan(isoDate) });\n                } catch (e) {\n                    logger?.warn('Sweeping expired sessions failed.');\n                    logger?.warn(e);\n                }\n            };\n\n            await execute();\n\n            cron.schedule('* * * * *', async () => {\n                await execute();\n            });\n        },\n    };\n}\n"],"mappings":";;;;;;;;;AAcA,SAAgBI,6BACZC,YACAC,QAAe;CAEf,OAAO,EACH,MAAMC,QAAAA;EACF,MAAMC,oBAAoBH,WAAWI,cAAcP,aAAAA;EACnD,MAAMQ,yBAAyBL,WAAWI,cAAcN,kBAAAA;EAKxD,MAAMQ,UAAU,YAAA;GACZ,IAAI;IACA,MAAMC,2BAAU,IAAIC,KAAAA,EAAAA,CAAOC,YAAW;IAKtC,MAAMJ,uBACDK,OAAO,EAAEC,YAAYf,SAASW,OAAAA,EAAS,CAAA;IAE5C,MAAMJ,kBACDO,OAAO,EAAEC,YAAYf,SAASW,OAAAA,EAAS,CAAA;GAChD,SAASK,GAAG;IACRX,QAAQY,KAAK,mCAAA;IACbZ,QAAQY,KAAKD,CAAAA;GACjB;EACJ;EAEA,MAAMN,QAAAA;EAENX,KAAKmB,SAAS,aAAa,YAAA;GACvB,MAAMR,QAAAA;EACV,CAAA;CACJ,EACJ;AACJ"}

package/dist/core/authentication/credential/entities/client/module.d.ts

@@ -1,4 +1,4 @@
-import type { Client } from '@authup/core-kit';
+import { type Client } from '@authup/core-kit';
 import type { ICredentialService } from '../../types.ts';
 export declare class ClientCredentialsService implements ICredentialService<Client> {
     verify(input: string, entity: Client): Promise<boolean>;

package/dist/core/authentication/credential/entities/client/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/authentication/credential/entities/client/module.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEzD,qBAAa,wBAAyB,YAAW,kBAAkB,CAAC,MAAM,CAAC;IACjE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAcvD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IAYpF,cAAc;CAGjB"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/authentication/credential/entities/client/module.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,KAAK,MAAM,EAAoB,MAAM,kBAAkB,CAAC;AACjE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEzD,qBAAa,wBAAyB,YAAW,kBAAkB,CAAC,MAAM,CAAC;IACjE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAcvD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IAYpF,cAAc;CAGjB"}

package/dist/core/authentication/credential/entities/client/module.mjs

@@ -2,11 +2,12 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { createNanoID, isBCryptHash } from "@authup/kit";
+import { ClientAuthMethod } from "@authup/core-kit";
 import { compare, hash } from "@authup/server-kit";
 //#region src/core/authentication/credential/entities/client/module.ts
 var ClientCredentialsService = class {
 	async verify(input, entity) {
-		if (!entity.secret || !entity.is_confidential) return false;
+		if (!entity.secret || entity.auth_method !== ClientAuthMethod.SECRET) return false;
 		if (entity.secret_hashed) return compare(input, entity.secret);
 		return input === entity.secret;
 	}

package/dist/core/authentication/credential/entities/client/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["createNanoID","isBCryptHash","compare","hash","ClientCredentialsService","verify","input","entity","secret","is_confidential","secret_hashed","protect","generateSecret"],"sources":["../../../../../../src/core/authentication/credential/entities/client/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { createNanoID, isBCryptHash } from '@authup/kit';\nimport { compare, hash } from '@authup/server-kit';\nimport type { Client } from '@authup/core-kit';\nimport type { ICredentialService } from '../../types.ts';\n\nexport class ClientCredentialsService implements ICredentialService<Client> {\n    async verify(input: string, entity: Client): Promise<boolean> {\n        if (!entity.secret || !entity.is_confidential) {\n            return false;\n        }\n\n        if (entity.secret_hashed) {\n            return compare(input, entity.secret);\n        }\n\n        // todo: secret encrypted missing (decrypt)\n\n        return input === entity.secret;\n    }\n\n    async protect(input: string, entity: Pick<Client, 'secret_hashed'>): Promise<string> {\n        if (entity.secret_hashed) {\n            return isBCryptHash(input) ?\n                input :\n                hash(input);\n        }\n\n        // todo: secret encrypted missing (encrypt)\n\n        return input;\n    }\n\n    generateSecret() {\n        return createNanoID(64);\n    }\n}\n"],"mappings":";;;;;;AAYA,IAAaI,2BAAb,MAAaA;CACT,MAAMC,OAAOC,OAAeC,QAAkC;EAC1D,IAAI,CAACA,OAAOC,UAAU,CAACD,OAAOE,iBAC1B,OAAO;EAGX,IAAIF,OAAOG,eACP,OAAOR,QAAQI,OAAOC,OAAOC,MAAM;EAKvC,OAAOF,UAAUC,OAAOC;CAC5B;CAEA,MAAMG,QAAQL,OAAeC,QAAwD;EACjF,IAAIA,OAAOG,eACP,OAAOT,aAAaK,KAAAA,IAChBA,QACAH,KAAKG,KAAAA;EAKb,OAAOA;CACX;CAEAM,iBAAiB;EACb,OAAOZ,aAAa,EAAA;CACxB;AACJ"}
+{"version":3,"file":"module.mjs","names":["createNanoID","isBCryptHash","compare","hash","ClientAuthMethod","ClientCredentialsService","verify","input","entity","secret","auth_method","SECRET","secret_hashed","protect","generateSecret"],"sources":["../../../../../../src/core/authentication/credential/entities/client/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { createNanoID, isBCryptHash } from '@authup/kit';\nimport { compare, hash } from '@authup/server-kit';\nimport { type Client, ClientAuthMethod } from '@authup/core-kit';\nimport type { ICredentialService } from '../../types.ts';\n\nexport class ClientCredentialsService implements ICredentialService<Client> {\n    async verify(input: string, entity: Client): Promise<boolean> {\n        if (!entity.secret || entity.auth_method !== ClientAuthMethod.SECRET) {\n            return false;\n        }\n\n        if (entity.secret_hashed) {\n            return compare(input, entity.secret);\n        }\n\n        // todo: secret encrypted missing (decrypt)\n\n        return input === entity.secret;\n    }\n\n    async protect(input: string, entity: Pick<Client, 'secret_hashed'>): Promise<string> {\n        if (entity.secret_hashed) {\n            return isBCryptHash(input) ?\n                input :\n                hash(input);\n        }\n\n        // todo: secret encrypted missing (encrypt)\n\n        return input;\n    }\n\n    generateSecret() {\n        return createNanoID(64);\n    }\n}\n"],"mappings":";;;;;;;AAYA,IAAaK,2BAAb,MAAaA;CACT,MAAMC,OAAOC,OAAeC,QAAkC;EAC1D,IAAI,CAACA,OAAOC,UAAUD,OAAOE,gBAAgBN,iBAAiBO,QAC1D,OAAO;EAGX,IAAIH,OAAOI,eACP,OAAOV,QAAQK,OAAOC,OAAOC,MAAM;EAKvC,OAAOF,UAAUC,OAAOC;CAC5B;CAEA,MAAMI,QAAQN,OAAeC,QAAwD;EACjF,IAAIA,OAAOI,eACP,OAAOX,aAAaM,KAAAA,IAChBA,QACAJ,KAAKI,KAAAA;EAKb,OAAOA;CACX;CAEAO,iBAAiB;EACb,OAAOd,aAAa,EAAA;CACxB;AACJ"}

package/dist/core/authentication/entities/client/module.mjs

@@ -4,7 +4,7 @@ import.meta.url;
 import { ClientCredentialsService } from "../../credential/entities/client/module.mjs";
 import "../../credential/index.mjs";
 import { BaseCredentialsAuthenticator } from "../../base.mjs";
-import { IdentityType } from "@authup/core-kit";
+import { ClientAuthMethod, IdentityType } from "@authup/core-kit";
 import { EntityCredentialsInvalidError, EntityInactiveError } from "@authup/errors";
 import { OAuth2ClientError } from "@authup/specs";
 //#region src/core/authentication/entities/client/module.ts
@@ -20,7 +20,7 @@ var ClientAuthenticator = class extends BaseCredentialsAuthenticator {
 		const identity = await this.identityResolver.resolve(IdentityType.CLIENT, key, realmId);
 		if (!identity || identity.type !== IdentityType.CLIENT) throw new EntityCredentialsInvalidError({ entity: "client" });
 		if (!identity.data.active) throw new EntityInactiveError({ entity: "client" });
-		if (identity.data.is_confidential) {
+		if (identity.data.auth_method === ClientAuthMethod.SECRET) {
 			if (!await this.credentialsService.verify(secret, identity.data)) throw new EntityCredentialsInvalidError({ entity: "client" });
 		} else throw OAuth2ClientError.invalid();
 		return identity.data;

package/dist/core/authentication/entities/client/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["IdentityType","EntityCredentialsInvalidError","EntityInactiveError","OAuth2ClientError","ClientCredentialsService","BaseCredentialsAuthenticator","ClientAuthenticator","identityResolver","credentialsService","authenticate","key","secret","realmId","identity","resolve","CLIENT","type","entity","data","active","is_confidential","verified","verify","invalid"],"sources":["../../../../../src/core/authentication/entities/client/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Client } from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { EntityCredentialsInvalidError, EntityInactiveError } from '@authup/errors';\nimport { OAuth2ClientError } from '@authup/specs';\nimport type { IIdentityResolver } from '../../../identity/index.ts';\nimport { ClientCredentialsService } from '../../credential/index.ts';\nimport { BaseCredentialsAuthenticator } from '../../base.ts';\n\nexport class ClientAuthenticator extends BaseCredentialsAuthenticator<Client> {\n    protected identityResolver : IIdentityResolver;\n\n    protected credentialsService : ClientCredentialsService;\n\n    constructor(identityResolver: IIdentityResolver) {\n        super();\n\n        this.identityResolver = identityResolver;\n        this.credentialsService = new ClientCredentialsService();\n    }\n\n    async authenticate(key: string, secret: string, realmId?: string): Promise<Client> {\n        const identity = await this.identityResolver.resolve(IdentityType.CLIENT, key, realmId);\n        if (!identity || identity.type !== IdentityType.CLIENT) {\n            throw new EntityCredentialsInvalidError({ entity: 'client' });\n        }\n\n        if (!identity.data.active) {\n            throw new EntityInactiveError({ entity: 'client' });\n        }\n\n        if (identity.data.is_confidential) {\n            const verified = await this.credentialsService.verify(secret, identity.data);\n            if (!verified) {\n                throw new EntityCredentialsInvalidError({ entity: 'client' });\n            }\n        } else {\n            throw OAuth2ClientError.invalid();\n        }\n\n        return identity.data;\n    }\n}\n"],"mappings":";;;;;;;;;;AAeA,IAAaM,sBAAb,cAAyCD,6BAAAA;CAC3BE;CAEAC;CAEV,YAAYD,kBAAqC;EAC7C,MAAK;EAEL,KAAKA,mBAAmBA;EACxB,KAAKC,qBAAqB,IAAIJ,yBAAAA;CAClC;CAEA,MAAMK,aAAaC,KAAaC,QAAgBC,SAAmC;EAC/E,MAAMC,WAAW,MAAM,KAAKN,iBAAiBO,QAAQd,aAAae,QAAQL,KAAKE,OAAAA;EAC/E,IAAI,CAACC,YAAYA,SAASG,SAAShB,aAAae,QAC5C,MAAM,IAAId,8BAA8B,EAAEgB,QAAQ,SAAS,CAAA;EAG/D,IAAI,CAACJ,SAASK,KAAKC,QACf,MAAM,IAAIjB,oBAAoB,EAAEe,QAAQ,SAAS,CAAA;EAGrD,IAAIJ,SAASK,KAAKE;OAEV,CAACC,MADkB,KAAKb,mBAAmBc,OAAOX,QAAQE,SAASK,IAAI,GAEvE,MAAM,IAAIjB,8BAA8B,EAAEgB,QAAQ,SAAS,CAAA;EAAA,OAG/D,MAAMd,kBAAkBoB,QAAO;EAGnC,OAAOV,SAASK;CACpB;AACJ"}
+{"version":3,"file":"module.mjs","names":["ClientAuthMethod","IdentityType","EntityCredentialsInvalidError","EntityInactiveError","OAuth2ClientError","ClientCredentialsService","BaseCredentialsAuthenticator","ClientAuthenticator","identityResolver","credentialsService","authenticate","key","secret","realmId","identity","resolve","CLIENT","type","entity","data","active","auth_method","SECRET","verified","verify","invalid"],"sources":["../../../../../src/core/authentication/entities/client/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Client } from '@authup/core-kit';\nimport { ClientAuthMethod, IdentityType } from '@authup/core-kit';\nimport { EntityCredentialsInvalidError, EntityInactiveError } from '@authup/errors';\nimport { OAuth2ClientError } from '@authup/specs';\nimport type { IIdentityResolver } from '../../../identity/index.ts';\nimport { ClientCredentialsService } from '../../credential/index.ts';\nimport { BaseCredentialsAuthenticator } from '../../base.ts';\n\nexport class ClientAuthenticator extends BaseCredentialsAuthenticator<Client> {\n    protected identityResolver : IIdentityResolver;\n\n    protected credentialsService : ClientCredentialsService;\n\n    constructor(identityResolver: IIdentityResolver) {\n        super();\n\n        this.identityResolver = identityResolver;\n        this.credentialsService = new ClientCredentialsService();\n    }\n\n    async authenticate(key: string, secret: string, realmId?: string): Promise<Client> {\n        const identity = await this.identityResolver.resolve(IdentityType.CLIENT, key, realmId);\n        if (!identity || identity.type !== IdentityType.CLIENT) {\n            throw new EntityCredentialsInvalidError({ entity: 'client' });\n        }\n\n        if (!identity.data.active) {\n            throw new EntityInactiveError({ entity: 'client' });\n        }\n\n        if (identity.data.auth_method === ClientAuthMethod.SECRET) {\n            const verified = await this.credentialsService.verify(secret, identity.data);\n            if (!verified) {\n                throw new EntityCredentialsInvalidError({ entity: 'client' });\n            }\n        } else {\n            throw OAuth2ClientError.invalid();\n        }\n\n        return identity.data;\n    }\n}\n"],"mappings":";;;;;;;;;;AAeA,IAAaO,sBAAb,cAAyCD,6BAAAA;CAC3BE;CAEAC;CAEV,YAAYD,kBAAqC;EAC7C,MAAK;EAEL,KAAKA,mBAAmBA;EACxB,KAAKC,qBAAqB,IAAIJ,yBAAAA;CAClC;CAEA,MAAMK,aAAaC,KAAaC,QAAgBC,SAAmC;EAC/E,MAAMC,WAAW,MAAM,KAAKN,iBAAiBO,QAAQd,aAAae,QAAQL,KAAKE,OAAAA;EAC/E,IAAI,CAACC,YAAYA,SAASG,SAAShB,aAAae,QAC5C,MAAM,IAAId,8BAA8B,EAAEgB,QAAQ,SAAS,CAAA;EAG/D,IAAI,CAACJ,SAASK,KAAKC,QACf,MAAM,IAAIjB,oBAAoB,EAAEe,QAAQ,SAAS,CAAA;EAGrD,IAAIJ,SAASK,KAAKE,gBAAgBrB,iBAAiBsB;OAE3C,CAACC,MADkB,KAAKd,mBAAmBe,OAAOZ,QAAQE,SAASK,IAAI,GAEvE,MAAM,IAAIjB,8BAA8B,EAAEgB,QAAQ,SAAS,CAAA;EAAA,OAG/D,MAAMd,kBAAkBqB,QAAO;EAGnC,OAAOX,SAASK;CACpB;AACJ"}

package/dist/core/authentication/index.d.ts

@@ -1,5 +1,6 @@
 export * from './credential/index.ts';
 export * from './entities/index.ts';
+export * from './login-throttle/index.ts';
 export * from './base.ts';
 export * from './module.ts';
 export * from './session/index.ts';

package/dist/core/authentication/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/authentication/index.ts"],"names":[],"mappings":"AAOA,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,WAAW,CAAC;AAC1B,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/authentication/index.ts"],"names":[],"mappings":"AAOA,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,WAAW,CAAC;AAC1B,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,YAAY,CAAC"}

package/dist/core/authentication/index.mjs

@@ -10,7 +10,10 @@ import { ClientAuthenticator } from "./entities/client/module.mjs";
 import { RobotAuthenticator } from "./entities/robot/module.mjs";
 import { UserAuthenticator } from "./entities/user/module.mjs";
 import "./entities/index.mjs";
+import { LoginThrottleService } from "./login-throttle/service.mjs";
+import "./login-throttle/index.mjs";
 import { CredentialsAuthenticator } from "./module.mjs";
 import { SessionManager } from "./session/module.mjs";
+import { SESSION_FILTER_KEYS } from "./session/types.mjs";
 import "./session/index.mjs";
-export { BaseCredentialsAuthenticator, ClientAuthenticator, ClientCredentialsService, CredentialsAuthenticator, RobotAuthenticator, RobotCredentialsService, SessionManager, UserAuthenticator, UserCredentialsService };
+export { BaseCredentialsAuthenticator, ClientAuthenticator, ClientCredentialsService, CredentialsAuthenticator, LoginThrottleService, RobotAuthenticator, RobotCredentialsService, SESSION_FILTER_KEYS, SessionManager, UserAuthenticator, UserCredentialsService };

package/dist/core/authentication/login-throttle/index.d.ts

@@ -0,0 +1,3 @@
+export * from './service.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/authentication/login-throttle/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/login-throttle/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}

package/dist/core/authentication/login-throttle/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { LoginThrottleService } from "./service.mjs";
+export { LoginThrottleService };

package/dist/core/authentication/login-throttle/service.d.ts

@@ -0,0 +1,13 @@
+import type { IEventRepository } from '../../entities/index.ts';
+import type { ILoginThrottleService, LoginThrottleServiceContext, LoginThrottleServiceOptions } from './types.ts';
+export declare class LoginThrottleService implements ILoginThrottleService {
+    protected repository: IEventRepository;
+    protected options: LoginThrottleServiceOptions;
+    constructor(ctx: LoginThrottleServiceContext);
+    assertNotThrottled(ctx: {
+        identifier: string;
+        ipAddress?: string;
+        realmId?: string | null;
+    }): Promise<void>;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/core/authentication/login-throttle/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/login-throttle/service.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAKlH,qBAAa,oBAAqB,YAAW,qBAAqB;IAC9D,SAAS,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEvC,SAAS,CAAC,OAAO,EAAE,2BAA2B,CAAC;gBAEnC,GAAG,EAAE,2BAA2B;IAKtC,kBAAkB,CACpB,GAAG,EAAE;QACD,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAC1B,GACF,OAAO,CAAC,IAAI,CAAC;CA4BnB"}

package/dist/core/authentication/login-throttle/service.mjs

@@ -0,0 +1,33 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { EventName } from "@authup/core-kit";
+import { LoginThrottledError } from "@authup/errors";
+//#region src/core/authentication/login-throttle/service.ts
+const DEFAULT_THRESHOLD = 5;
+const DEFAULT_WINDOW_SECONDS = 900;
+var LoginThrottleService = class {
+	repository;
+	options;
+	constructor(ctx) {
+		this.repository = ctx.repository;
+		this.options = ctx.options ?? {};
+	}
+	async assertNotThrottled(ctx) {
+		if (!this.options.enabled) return;
+		if (!ctx.ipAddress) return;
+		const threshold = this.options.threshold ?? DEFAULT_THRESHOLD;
+		const windowSeconds = this.options.windowSeconds ?? DEFAULT_WINDOW_SECONDS;
+		if (await this.repository.countRecent({
+			name: EventName.LOGIN_FAILED,
+			actorName: ctx.identifier,
+			requestIpAddress: ctx.ipAddress,
+			realmId: ctx.realmId,
+			since: (/* @__PURE__ */ new Date(Date.now() - windowSeconds * 1e3)).toISOString()
+		}) >= threshold) throw new LoginThrottledError({ retryAfter: windowSeconds });
+	}
+};
+//#endregion
+export { LoginThrottleService };
+
+//# sourceMappingURL=service.mjs.map

package/dist/core/authentication/login-throttle/service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.mjs","names":["EventName","LoginThrottledError","DEFAULT_THRESHOLD","DEFAULT_WINDOW_SECONDS","LoginThrottleService","repository","options","ctx","assertNotThrottled","enabled","ipAddress","threshold","windowSeconds","count","countRecent","name","LOGIN_FAILED","actorName","identifier","requestIpAddress","realmId","since","Date","now","toISOString","retryAfter"],"sources":["../../../../src/core/authentication/login-throttle/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { EventName } from '@authup/core-kit';\nimport { LoginThrottledError } from '@authup/errors';\nimport type { IEventRepository } from '../../entities/index.ts';\nimport type { ILoginThrottleService, LoginThrottleServiceContext, LoginThrottleServiceOptions } from './types.ts';\n\nconst DEFAULT_THRESHOLD = 5;\nconst DEFAULT_WINDOW_SECONDS = 900;\n\nexport class LoginThrottleService implements ILoginThrottleService {\n    protected repository: IEventRepository;\n\n    protected options: LoginThrottleServiceOptions;\n\n    constructor(ctx: LoginThrottleServiceContext) {\n        this.repository = ctx.repository;\n        this.options = ctx.options ?? {};\n    }\n\n    async assertNotThrottled(\n        ctx: {\n            identifier: string, \n            ipAddress?: string, \n            realmId?: string | null \n        },\n    ): Promise<void> {\n        if (!this.options.enabled) {\n            return;\n        }\n\n        // The (identifier, ip) pair is the account-lockout-DoS mitigation: an\n        // attacker on one IP can never lock the victim's other IPs. Without a\n        // derivable IP the pair does not exist, so the throttle fails open\n        // instead of degrading to a lockable per-identifier key.\n        if (!ctx.ipAddress) {\n            return;\n        }\n\n        const threshold = this.options.threshold ?? DEFAULT_THRESHOLD;\n        const windowSeconds = this.options.windowSeconds ?? DEFAULT_WINDOW_SECONDS;\n\n        const count = await this.repository.countRecent({\n            name: EventName.LOGIN_FAILED,\n            actorName: ctx.identifier,\n            requestIpAddress: ctx.ipAddress,\n            realmId: ctx.realmId,\n            since: new Date(Date.now() - (windowSeconds * 1_000)).toISOString(),\n        });\n\n        if (count >= threshold) {\n            throw new LoginThrottledError({ retryAfter: windowSeconds });\n        }\n    }\n}\n"],"mappings":";;;;;;AAYA,MAAME,oBAAoB;AAC1B,MAAMC,yBAAyB;AAE/B,IAAaC,uBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAkC;EAC1C,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,UAAUC,IAAID,WAAW,CAAC;CACnC;CAEA,MAAME,mBACFD,KAKa;EACb,IAAI,CAAC,KAAKD,QAAQG,SACd;EAOJ,IAAI,CAACF,IAAIG,WACL;EAGJ,MAAMC,YAAY,KAAKL,QAAQK,aAAaT;EAC5C,MAAMU,gBAAgB,KAAKN,QAAQM,iBAAiBT;EAUpD,IAAIU,MARgB,KAAKR,WAAWS,YAAY;GAC5CC,MAAMf,UAAUgB;GAChBC,WAAWV,IAAIW;GACfC,kBAAkBZ,IAAIG;GACtBU,SAASb,IAAIa;GACbC,wBAAO,IAAIC,KAAKA,KAAKC,IAAG,IAAMX,gBAAgB,GAAA,EAAA,CAAQY,YAAW;EACrE,CAAA,KAEab,WACT,MAAM,IAAIV,oBAAoB,EAAEwB,YAAYb,cAAc,CAAA;CAElE;AACJ"}

package/dist/core/authentication/login-throttle/types.d.ts

@@ -0,0 +1,34 @@
+import type { IEventRepository } from '../../entities/index.ts';
+export type LoginThrottleServiceOptions = {
+    /**
+     * config.loginAttemptThrottleEnabled — default off.
+     */
+    enabled?: boolean;
+    /**
+     * config.loginAttemptThreshold — failed attempts per (identifier, ip) pair
+     * before the throttle trips. Default 5.
+     */
+    threshold?: number;
+    /**
+     * config.loginAttemptWindow — sliding window (seconds) the attempts are
+     * counted over. The window is also the lock: a success simply stops adding
+     * rows and the window slides past. Default 900.
+     */
+    windowSeconds?: number;
+};
+export type LoginThrottleServiceContext = {
+    repository: IEventRepository;
+    options?: LoginThrottleServiceOptions;
+};
+export interface ILoginThrottleService {
+    /**
+     * Throw LoginThrottledError when recent LOGIN_FAILED audit events for the
+     * (identifier, ip) pair hit the threshold.
+     */
+    assertNotThrottled(ctx: {
+        identifier: string;
+        ipAddress?: string;
+        realmId?: string | null;
+    }): Promise<void>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/authentication/login-throttle/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/login-throttle/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAEhE,MAAM,MAAM,2BAA2B,GAAG;IACtC;;OAEG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACtC,UAAU,EAAE,gBAAgB,CAAC;IAC7B,OAAO,CAAC,EAAE,2BAA2B,CAAC;CACzC,CAAC;AAEF,MAAM,WAAW,qBAAqB;IAClC;;;OAGG;IACH,kBAAkB,CAAC,GAAG,EAAE;QACpB,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAC1B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrB"}

package/dist/core/authentication/login-throttle/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/authentication/session/index.mjs

@@ -2,4 +2,5 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { SessionManager } from "./module.mjs";
-export { SessionManager };
+import { SESSION_FILTER_KEYS } from "./types.mjs";
+export { SESSION_FILTER_KEYS, SessionManager };

package/dist/core/authentication/session/module.d.ts

@@ -12,6 +12,7 @@ export declare class SessionManager implements ISessionManager {
     create(input: Partial<Session>): Promise<Session>;
     ping(session: Session): Promise<Session>;
     refresh(session: Session): Promise<Session>;
+    markMfaVerified(session: Session): Promise<Session>;
     /**
      * Verify session on token inspection/verification.
      *
@@ -19,6 +20,7 @@ export declare class SessionManager implements ISessionManager {
      * @throws JWTError
      */
     findOneById(id: string): Promise<Session | null>;
+    revoke(id: string): Promise<void>;
     verify(session: Session): Promise<void>;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/core/authentication/session/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/session/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAGhD,OAAO,KAAK,EACR,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACxB,MAAM,YAAY,CAAC;AAEpB,qBAAa,cAAe,YAAW,eAAe;IAClD,SAAS,CAAC,OAAO,EAAE,qBAAqB,CAAC;IAEzC,SAAS,CAAC,UAAU,EAAE,kBAAkB,CAAC;gBAI7B,GAAG,EAAE,qBAAqB;IAOtC;;;;OAIG;IACG,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IA2BjD,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBxC,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAcjD;;;;;OAKG;IACG,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAMhD,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;CAShD"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/session/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAGhD,OAAO,KAAK,EACR,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACxB,MAAM,YAAY,CAAC;AAEpB,qBAAa,cAAe,YAAW,eAAe;IAClD,SAAS,CAAC,OAAO,EAAE,qBAAqB,CAAC;IAEzC,SAAS,CAAC,UAAU,EAAE,kBAAkB,CAAC;gBAI7B,GAAG,EAAE,qBAAqB;IAOtC;;;;OAIG;IACG,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IA2BjD,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBxC,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAc3C,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAQzD;;;;;OAKG;IACG,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAMhD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMjC,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;CAShD"}

package/dist/core/authentication/session/module.mjs

@@ -46,6 +46,10 @@ var SessionManager = class {
 		session.expires_at = new Date(Date.now() + this.options.maxAge * 1e3).toISOString();
 		return this.repository.save(session);
 	}
+	async markMfaVerified(session) {
+		session.mfa_at = (/* @__PURE__ */ new Date()).toISOString();
+		return this.repository.save(session);
+	}
 	/**
 	* Verify session on token inspection/verification.
 	*
@@ -54,6 +58,9 @@ var SessionManager = class {
 	*/ async findOneById(id) {
 		return this.repository.findOneById(id);
 	}
+	async revoke(id) {
+		await this.repository.removeById(id);
+	}
 	async verify(session) {
 		const ms = new Date(session.expires_at).getTime();
 		if (Date.now() > ms) {

package/dist/core/authentication/session/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["IdentityType","JWTError","SessionManager","options","repository","ctx","create","input","ip_address","user_agent","expires_at","Date","now","maxAge","toISOString","sub_kind","CLIENT","client_id","sub","ROBOT","robot_id","USER","user_id","save","ping","session","seen_at","seenAt","getTime","threshold","refresh","refreshed_at","findOneById","id","verify","ms","remove","expired"],"sources":["../../../../src/core/authentication/session/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Session } from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { JWTError } from '@authup/specs';\nimport type {\n    ISessionManager, \n    ISessionRepository, \n    SessionManagerContext, \n    SessionManagerOptions,\n} from './types.ts';\n\nexport class SessionManager implements ISessionManager {\n    protected options: SessionManagerOptions;\n\n    protected repository: ISessionRepository;\n\n    // -----------------------------------------------------\n\n    constructor(ctx: SessionManagerContext) {\n        this.options = ctx.options;\n        this.repository = ctx.repository;\n    }\n\n    // -----------------------------------------------------\n\n    /**\n     * Create/Update session\n     *\n     * @param input\n     */\n    async create(input: Partial<Session>): Promise<Session> {\n        input.ip_address = input.ip_address || '127.0.0.1';\n        input.user_agent = input.user_agent || 'system';\n        input.expires_at = input.expires_at || new Date(\n            Date.now() + (this.options.maxAge * 1_000),\n        ).toISOString();\n\n        switch (input.sub_kind) {\n            case IdentityType.CLIENT: {\n                input.client_id = input.sub;\n                break;\n            }\n            case IdentityType.ROBOT: {\n                input.robot_id = input.sub;\n                break;\n            }\n            case IdentityType.USER: {\n                input.user_id = input.sub;\n                break;\n            }\n        }\n\n        return this.repository.save(input);\n    }\n\n    // -----------------------------------------------------\n\n    async ping(session: Session): Promise<Session> {\n        if (session.seen_at) {\n            const seenAt = new Date(session.seen_at).getTime();\n            const threshold = seenAt + (5 * 1_000);\n\n            if (threshold > Date.now()) {\n                return session;\n            }\n        }\n\n        session.seen_at = new Date().toISOString();\n\n        return this.repository.save(session);\n    }\n\n    // -----------------------------------------------------\n\n    async refresh(session: Session): Promise<Session> {\n        const now = new Date().toISOString();\n        session.refreshed_at = now;\n        session.seen_at = now;\n\n        session.expires_at = new Date(\n            Date.now() + (this.options.maxAge * 1_000),\n        ).toISOString();\n\n        return this.repository.save(session);\n    }\n\n    // -----------------------------------------------------\n\n    /**\n     * Verify session on token inspection/verification.\n     *\n     * @param id\n     * @throws JWTError\n     */\n    async findOneById(id: string): Promise<Session | null> {\n        return this.repository.findOneById(id);\n    }\n\n    // -----------------------------------------------------\n\n    async verify(session: Session): Promise<void> {\n        const ms = new Date(session.expires_at).getTime();\n        if (Date.now() > ms) {\n            await this.repository.remove(session);\n\n            // todo: better error\n            throw JWTError.expired();\n        }\n    }\n}\n"],"mappings":";;;;;;AAiBA,IAAaE,iBAAb,MAAaA;CACCC;CAEAC;CAIV,YAAYC,KAA4B;EACpC,KAAKF,UAAUE,IAAIF;EACnB,KAAKC,aAAaC,IAAID;CAC1B;;;;;IASA,MAAME,OAAOC,OAA2C;EACpDA,MAAMC,aAAaD,MAAMC,cAAc;EACvCD,MAAME,aAAaF,MAAME,cAAc;EACvCF,MAAMG,aAAaH,MAAMG,cAAc,IAAIC,KACvCA,KAAKC,IAAG,IAAM,KAAKT,QAAQU,SAAS,GAAA,CAAA,CACtCC,YAAW;EAEb,QAAQP,MAAMQ,UAAd;GACI,KAAKf,aAAagB;IACdT,MAAMU,YAAYV,MAAMW;IACxB;GAEJ,KAAKlB,aAAamB;IACdZ,MAAMa,WAAWb,MAAMW;IACvB;GAEJ,KAAKlB,aAAaqB;IACdd,MAAMe,UAAUf,MAAMW;IACtB;EAER;EAEA,OAAO,KAAKd,WAAWmB,KAAKhB,KAAAA;CAChC;CAIA,MAAMiB,KAAKC,SAAoC;EAC3C,IAAIA,QAAQC;OACO,IAAIf,KAAKc,QAAQC,OAAO,CAAA,CAAEE,QACvBD,IAAU,IAAI,MAEhBhB,KAAKC,IAAG,GACpB,OAAOa;EAAAA;EAIfA,QAAQC,2BAAU,IAAIf,KAAAA,EAAAA,CAAOG,YAAW;EAExC,OAAO,KAAKV,WAAWmB,KAAKE,OAAAA;CAChC;CAIA,MAAMK,QAAQL,SAAoC;EAC9C,MAAMb,uBAAM,IAAID,KAAAA,EAAAA,CAAOG,YAAW;EAClCW,QAAQM,eAAenB;EACvBa,QAAQC,UAAUd;EAElBa,QAAQf,aAAa,IAAIC,KACrBA,KAAKC,IAAG,IAAM,KAAKT,QAAQU,SAAS,GAAA,CAAA,CACtCC,YAAW;EAEb,OAAO,KAAKV,WAAWmB,KAAKE,OAAAA;CAChC;;;;;;IAUA,MAAMO,YAAYC,IAAqC;EACnD,OAAO,KAAK7B,WAAW4B,YAAYC,EAAAA;CACvC;CAIA,MAAMC,OAAOT,SAAiC;EAC1C,MAAMU,KAAK,IAAIxB,KAAKc,QAAQf,UAAU,CAAA,CAAEkB,QAAO;EAC/C,IAAIjB,KAAKC,IAAG,IAAKuB,IAAI;GACjB,MAAM,KAAK/B,WAAWgC,OAAOX,OAAAA;GAG7B,MAAMxB,SAASoC,QAAO;EAC1B;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["IdentityType","JWTError","SessionManager","options","repository","ctx","create","input","ip_address","user_agent","expires_at","Date","now","maxAge","toISOString","sub_kind","CLIENT","client_id","sub","ROBOT","robot_id","USER","user_id","save","ping","session","seen_at","seenAt","getTime","threshold","refresh","refreshed_at","markMfaVerified","mfa_at","findOneById","id","revoke","removeById","verify","ms","remove","expired"],"sources":["../../../../src/core/authentication/session/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Session } from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { JWTError } from '@authup/specs';\nimport type {\n    ISessionManager, \n    ISessionRepository, \n    SessionManagerContext, \n    SessionManagerOptions,\n} from './types.ts';\n\nexport class SessionManager implements ISessionManager {\n    protected options: SessionManagerOptions;\n\n    protected repository: ISessionRepository;\n\n    // -----------------------------------------------------\n\n    constructor(ctx: SessionManagerContext) {\n        this.options = ctx.options;\n        this.repository = ctx.repository;\n    }\n\n    // -----------------------------------------------------\n\n    /**\n     * Create/Update session\n     *\n     * @param input\n     */\n    async create(input: Partial<Session>): Promise<Session> {\n        input.ip_address = input.ip_address || '127.0.0.1';\n        input.user_agent = input.user_agent || 'system';\n        input.expires_at = input.expires_at || new Date(\n            Date.now() + (this.options.maxAge * 1_000),\n        ).toISOString();\n\n        switch (input.sub_kind) {\n            case IdentityType.CLIENT: {\n                input.client_id = input.sub;\n                break;\n            }\n            case IdentityType.ROBOT: {\n                input.robot_id = input.sub;\n                break;\n            }\n            case IdentityType.USER: {\n                input.user_id = input.sub;\n                break;\n            }\n        }\n\n        return this.repository.save(input);\n    }\n\n    // -----------------------------------------------------\n\n    async ping(session: Session): Promise<Session> {\n        if (session.seen_at) {\n            const seenAt = new Date(session.seen_at).getTime();\n            const threshold = seenAt + (5 * 1_000);\n\n            if (threshold > Date.now()) {\n                return session;\n            }\n        }\n\n        session.seen_at = new Date().toISOString();\n\n        return this.repository.save(session);\n    }\n\n    // -----------------------------------------------------\n\n    async refresh(session: Session): Promise<Session> {\n        const now = new Date().toISOString();\n        session.refreshed_at = now;\n        session.seen_at = now;\n\n        session.expires_at = new Date(\n            Date.now() + (this.options.maxAge * 1_000),\n        ).toISOString();\n\n        return this.repository.save(session);\n    }\n\n    // -----------------------------------------------------\n\n    async markMfaVerified(session: Session): Promise<Session> {\n        session.mfa_at = new Date().toISOString();\n\n        return this.repository.save(session);\n    }\n\n    // -----------------------------------------------------\n\n    /**\n     * Verify session on token inspection/verification.\n     *\n     * @param id\n     * @throws JWTError\n     */\n    async findOneById(id: string): Promise<Session | null> {\n        return this.repository.findOneById(id);\n    }\n\n    // -----------------------------------------------------\n\n    async revoke(id: string): Promise<void> {\n        await this.repository.removeById(id);\n    }\n\n    // -----------------------------------------------------\n\n    async verify(session: Session): Promise<void> {\n        const ms = new Date(session.expires_at).getTime();\n        if (Date.now() > ms) {\n            await this.repository.remove(session);\n\n            // todo: better error\n            throw JWTError.expired();\n        }\n    }\n}\n"],"mappings":";;;;;;AAiBA,IAAaE,iBAAb,MAAaA;CACCC;CAEAC;CAIV,YAAYC,KAA4B;EACpC,KAAKF,UAAUE,IAAIF;EACnB,KAAKC,aAAaC,IAAID;CAC1B;;;;;IASA,MAAME,OAAOC,OAA2C;EACpDA,MAAMC,aAAaD,MAAMC,cAAc;EACvCD,MAAME,aAAaF,MAAME,cAAc;EACvCF,MAAMG,aAAaH,MAAMG,cAAc,IAAIC,KACvCA,KAAKC,IAAG,IAAM,KAAKT,QAAQU,SAAS,GAAA,CAAA,CACtCC,YAAW;EAEb,QAAQP,MAAMQ,UAAd;GACI,KAAKf,aAAagB;IACdT,MAAMU,YAAYV,MAAMW;IACxB;GAEJ,KAAKlB,aAAamB;IACdZ,MAAMa,WAAWb,MAAMW;IACvB;GAEJ,KAAKlB,aAAaqB;IACdd,MAAMe,UAAUf,MAAMW;IACtB;EAER;EAEA,OAAO,KAAKd,WAAWmB,KAAKhB,KAAAA;CAChC;CAIA,MAAMiB,KAAKC,SAAoC;EAC3C,IAAIA,QAAQC;OACO,IAAIf,KAAKc,QAAQC,OAAO,CAAA,CAAEE,QACvBD,IAAU,IAAI,MAEhBhB,KAAKC,IAAG,GACpB,OAAOa;EAAAA;EAIfA,QAAQC,2BAAU,IAAIf,KAAAA,EAAAA,CAAOG,YAAW;EAExC,OAAO,KAAKV,WAAWmB,KAAKE,OAAAA;CAChC;CAIA,MAAMK,QAAQL,SAAoC;EAC9C,MAAMb,uBAAM,IAAID,KAAAA,EAAAA,CAAOG,YAAW;EAClCW,QAAQM,eAAenB;EACvBa,QAAQC,UAAUd;EAElBa,QAAQf,aAAa,IAAIC,KACrBA,KAAKC,IAAG,IAAM,KAAKT,QAAQU,SAAS,GAAA,CAAA,CACtCC,YAAW;EAEb,OAAO,KAAKV,WAAWmB,KAAKE,OAAAA;CAChC;CAIA,MAAMO,gBAAgBP,SAAoC;EACtDA,QAAQQ,0BAAS,IAAItB,KAAAA,EAAAA,CAAOG,YAAW;EAEvC,OAAO,KAAKV,WAAWmB,KAAKE,OAAAA;CAChC;;;;;;IAUA,MAAMS,YAAYC,IAAqC;EACnD,OAAO,KAAK/B,WAAW8B,YAAYC,EAAAA;CACvC;CAIA,MAAMC,OAAOD,IAA2B;EACpC,MAAM,KAAK/B,WAAWiC,WAAWF,EAAAA;CACrC;CAIA,MAAMG,OAAOb,SAAiC;EAC1C,MAAMc,KAAK,IAAI5B,KAAKc,QAAQf,UAAU,CAAA,CAAEkB,QAAO;EAC/C,IAAIjB,KAAKC,IAAG,IAAK2B,IAAI;GACjB,MAAM,KAAKnC,WAAWoC,OAAOf,OAAAA;GAG7B,MAAMxB,SAASwC,QAAO;EAC1B;CACJ;AACJ"}