@authup/server-core 1.0.0-beta.51 → 1.0.0-beta.53

package/dist/core/authentication/session/types.d.ts

@@ -1,6 +1,33 @@
 import type { Session } from '@authup/core-kit';
+import type { EntityRepositoryFindManyResult } from '@authup/server-kit';
+export type SessionOwner = {
+    sub: string;
+    subKind: string;
+};
+/**
+ * Filter keys a session query (list + bulk revoke) may target. Shared by the
+ * repository's rapiq `filters.allowed` and the service's "is this a targeted
+ * bulk revoke?" discriminator, so the two can never drift.
+ */
+export declare const SESSION_FILTER_KEYS: readonly ["id", "sub", "sub_kind", "user_id", "client_id", "robot_id", "realm_id"];
+export type SessionFindManyOptions = {
+    /**
+     * Force the result to a single subject (self-service). Applied as a
+     * mandatory WHERE that a rapiq query filter cannot override.
+     */
+    owner?: SessionOwner;
+};
 export interface ISessionRepository {
     findOneById(id: string): Promise<Session | null> | null;
+    findMany(query: Record<string, any>, options?: SessionFindManyOptions): Promise<EntityRepositoryFindManyResult<Session>>;
+    findAllByOwner(owner: SessionOwner): Promise<Session[]>;
+    /**
+     * Load EVERY session matching a rapiq query filter — **unbounded** (no
+     * pagination cap), because a bulk revoke must reach every match. Used by
+     * the admin "force-logout" path; per-session authorization is enforced by
+     * the caller (`SessionService`).
+     */
+    findAllByQuery(query: Record<string, any>): Promise<Session[]>;
     save(session: Partial<Session>): Promise<Session>;
     removeById(id: string): Promise<void>;
     remove(session: Session): Promise<void>;
@@ -34,6 +61,12 @@ export interface ISessionManager {
      * @param session
      */
     refresh(session: Session): Promise<Session>;
+    /**
+     * Stamp a successful second-factor challenge (mfa_at) onto the session.
+     *
+     * @param session
+     */
+    markMfaVerified(session: Session): Promise<Session>;
     /**
      * Check if session exists and is valid.
      *
@@ -47,5 +80,12 @@ export interface ISessionManager {
      * @param id
      */
     findOneById(id: string): Promise<Session | null>;
+    /**
+     * Revoke (delete) a session by id, forcing re-authentication. Idempotent —
+     * a no-op when the session does not exist.
+     *
+     * @param id
+     */
+    revoke(id: string): Promise<void>;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/core/authentication/session/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/session/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAEhD,MAAM,WAAW,kBAAkB;IAC/B,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAExD,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAElD,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtC,MAAM,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5C;AAED,MAAM,MAAM,qBAAqB,GAAG;IAChC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;CACjB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAChC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,UAAU,EAAE,kBAAkB,CAAC;CAClC,CAAC;AAEF,MAAM,WAAW,eAAe;IAC5B;;;;OAIG;IACH,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpD;;;;OAIG;IACH,IAAI,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1C;;;;OAIG;IACH,OAAO,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE7C;;;;;OAKG;IACH,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAExC;;;;OAIG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;CACpD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/session/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAEzE,MAAM,MAAM,YAAY,GAAG;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,oFAQtB,CAAC;AAEX,MAAM,MAAM,sBAAsB,GAAG;IACjC;;;OAGG;IACH,KAAK,CAAC,EAAE,YAAY,CAAC;CACxB,CAAC;AAEF,MAAM,WAAW,kBAAkB;IAC/B,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAExD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC,CAAC;IAEzH,cAAc,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAExD;;;;;OAKG;IACH,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAE/D,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAElD,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtC,MAAM,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5C;AAED,MAAM,MAAM,qBAAqB,GAAG;IAChC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;CACjB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAChC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,UAAU,EAAE,kBAAkB,CAAC;CAClC,CAAC;AAEF,MAAM,WAAW,eAAe;IAC5B;;;;OAIG;IACH,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpD;;;;OAIG;IACH,IAAI,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1C;;;;OAIG;IACH,OAAO,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE7C;;;;OAIG;IACH,eAAe,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAErD;;;;;OAKG;IACH,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAExC;;;;OAIG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAEjD;;;;;OAKG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC"}

package/dist/core/authentication/session/types.mjs

@@ -1,4 +1,21 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-export {};
+//#region src/core/authentication/session/types.ts
+/**
+* Filter keys a session query (list + bulk revoke) may target. Shared by the
+* repository's rapiq `filters.allowed` and the service's "is this a targeted
+* bulk revoke?" discriminator, so the two can never drift.
+*/ const SESSION_FILTER_KEYS = [
+	"id",
+	"sub",
+	"sub_kind",
+	"user_id",
+	"client_id",
+	"robot_id",
+	"realm_id"
+];
+//#endregion
+export { SESSION_FILTER_KEYS };
+
+//# sourceMappingURL=types.mjs.map

package/dist/core/authentication/session/types.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.mjs","names":["SESSION_FILTER_KEYS"],"sources":["../../../../src/core/authentication/session/types.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Session } from '@authup/core-kit';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\n\nexport type SessionOwner = {\n    sub: string,\n    subKind: string,\n};\n\n/**\n * Filter keys a session query (list + bulk revoke) may target. Shared by the\n * repository's rapiq `filters.allowed` and the service's \"is this a targeted\n * bulk revoke?\" discriminator, so the two can never drift.\n */\nexport const SESSION_FILTER_KEYS = [\n    'id',\n    'sub',\n    'sub_kind',\n    'user_id',\n    'client_id',\n    'robot_id',\n    'realm_id',\n] as const;\n\nexport type SessionFindManyOptions = {\n    /**\n     * Force the result to a single subject (self-service). Applied as a\n     * mandatory WHERE that a rapiq query filter cannot override.\n     */\n    owner?: SessionOwner,\n};\n\nexport interface ISessionRepository {\n    findOneById(id: string): Promise<Session | null> | null;\n\n    findMany(query: Record<string, any>, options?: SessionFindManyOptions): Promise<EntityRepositoryFindManyResult<Session>>;\n\n    findAllByOwner(owner: SessionOwner): Promise<Session[]>;\n\n    /**\n     * Load EVERY session matching a rapiq query filter — **unbounded** (no\n     * pagination cap), because a bulk revoke must reach every match. Used by\n     * the admin \"force-logout\" path; per-session authorization is enforced by\n     * the caller (`SessionService`).\n     */\n    findAllByQuery(query: Record<string, any>): Promise<Session[]>;\n\n    save(session: Partial<Session>): Promise<Session>;\n\n    removeById(id: string): Promise<void>;\n\n    remove(session: Session) : Promise<void>;\n}\n\nexport type SessionManagerOptions = {\n    /**\n     * Max age in seconds (sec).\n     */\n    maxAge: number\n};\n\nexport type SessionManagerContext = {\n    options: SessionManagerOptions,\n    repository: ISessionRepository,\n};\n\nexport interface ISessionManager {\n    /**\n     * Create new session.\n     *\n     * @param session\n     */\n    create(session: Partial<Session>): Promise<Session>;\n\n    /**\n     * Updates seen_at with current time.\n     *\n     * @param session\n     */\n    ping(session: Session) : Promise<Session>;\n\n    /**\n     * Updates refreshed_at, seen_at with current time.\n     *\n     * @param session\n     */\n    refresh(session: Session) : Promise<Session>;\n\n    /**\n     * Stamp a successful second-factor challenge (mfa_at) onto the session.\n     *\n     * @param session\n     */\n    markMfaVerified(session: Session) : Promise<Session>;\n\n    /**\n     * Check if session exists and is valid.\n     *\n     * @throws JWTError\n     * @param session\n     */\n    verify(session: Session): Promise<void>;\n\n    /**\n     * Find session by id.\n     *\n     * @param id\n     */\n    findOneById(id: string): Promise<Session | null>;\n\n    /**\n     * Revoke (delete) a session by id, forcing re-authentication. Idempotent —\n     * a no-op when the session does not exist.\n     *\n     * @param id\n     */\n    revoke(id: string): Promise<void>;\n}\n"],"mappings":";;;;;;;;GAoBA,MAAaA,sBAAsB;CAC/B;CACA;CACA;CACA;CACA;CACA;CACA"}

package/dist/core/client-certificate/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/client-certificate/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/client-certificate/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/client-certificate/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { ClientCertificateValidator, assertClientCertificateEvidenceValidForBinding, buildClientCertificateThumbprint, parseClientCertificateChain } from "./module.mjs";
+export { ClientCertificateValidator, assertClientCertificateEvidenceValidForBinding, buildClientCertificateThumbprint, parseClientCertificateChain };

package/dist/core/client-certificate/module.d.ts

@@ -0,0 +1,18 @@
+import { X509Certificate } from '@peculiar/x509';
+import type { Client } from '@authup/core-kit';
+import type { ClientCertificateEvidence, ClientCertificateValidatorContext, IClientCertificateValidator } from './types.ts';
+/**
+ * Validates client certificates without performing network I/O. AIA, CRL,
+ * and OCSP retrieval are deliberately outside the external-PKI first slice.
+ */
+export declare class ClientCertificateValidator implements IClientCertificateValidator {
+    protected trustAnchorRepository: ClientCertificateValidatorContext['trustAnchorRepository'];
+    protected crypto?: Crypto;
+    constructor(ctx: ClientCertificateValidatorContext);
+    validateForBinding(evidence: ClientCertificateEvidence): void;
+    validateForAuthentication(client: Pick<Client, 'id' | 'realm_id'>, evidence: ClientCertificateEvidence): Promise<void>;
+}
+export declare function assertClientCertificateEvidenceValidForBinding(evidence: ClientCertificateEvidence): void;
+export declare function parseClientCertificateChain(pem: string): X509Certificate[];
+export declare function buildClientCertificateThumbprint(certificate: X509Certificate, crypto?: Crypto): Promise<string>;
+//# sourceMappingURL=module.d.ts.map

package/dist/core/client-certificate/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/core/client-certificate/module.ts"],"names":[],"mappings":"AAOA,OAAO,EAUH,eAAe,EAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,kBAAkB,CAAC;AAO5D,OAAO,KAAK,EACR,yBAAyB,EACzB,iCAAiC,EACjC,2BAA2B,EAC9B,MAAM,YAAY,CAAC;AAuCpB;;;GAGG;AACH,qBAAa,0BAA2B,YAAW,2BAA2B;IAC1E,SAAS,CAAC,qBAAqB,EAAE,iCAAiC,CAAC,uBAAuB,CAAC,CAAC;IAE5F,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,iCAAiC;IAKlD,kBAAkB,CAAC,QAAQ,EAAE,yBAAyB,GAAG,IAAI;IAIvD,yBAAyB,CAC3B,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,UAAU,CAAC,EACvC,QAAQ,EAAE,yBAAyB,GACpC,OAAO,CAAC,IAAI,CAAC;CA0CnB;AAED,wBAAgB,8CAA8C,CAC1D,QAAQ,EAAE,yBAAyB,GACpC,IAAI,CAON;AAED,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,EAAE,CAW1E;AAED,wBAAsB,gCAAgC,CAClD,WAAW,EAAE,eAAe,EAC5B,MAAM,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAMjB"}

package/dist/core/client-certificate/module.mjs

@@ -0,0 +1,195 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { base64URLEncode } from "@authup/kit";
+import { CLIENT_CERTIFICATE_URI_PREFIX, buildClientCertificateURI } from "@authup/core-kit";
+import { ValidationError } from "@authup/errors";
+import { AuthorityKeyIdentifierExtension, BasicConstraintsExtension, ExtendedKeyUsage, ExtendedKeyUsageExtension, KeyUsageFlags, KeyUsagesExtension, SubjectAlternativeNameExtension, SubjectKeyIdentifierExtension, URL, X509Certificate } from "@peculiar/x509";
+//#region src/core/client-certificate/module.ts
+const MAX_CHAIN_DEPTH = 10;
+const CERTIFICATE_BLOCK_PATTERN = /-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g;
+/**
+* Hard ceiling on signature verifications performed while building a single
+* certification path. A legitimate chain of the maximum accepted length only
+* needs O(depth²) verifications; the ceiling exists purely to defuse the
+* factorial backtracking blow-up an attacker can induce with certificates
+* that mutually "issue" one another (shared key, identical subject/issuer
+* DNs). Reaching the ceiling is treated as "no path found" (fail closed).
+*/ const MAX_PATH_SIGNATURE_VERIFICATIONS = 64;
+/**
+* OIDs of the certificate extensions this validator actually processes. A
+* certificate carrying a *critical* extension outside this set is rejected
+* (RFC 5280 §4.2): an unprocessed critical constraint must never be silently
+* ignored. Because RFC 5280 requires the NameConstraints extension to be
+* marked critical, this also fails a name-constrained CA closed rather than
+* trusting a chain whose name constraints we do not evaluate.
+*/ const HANDLED_CRITICAL_EXTENSION_OIDS = /* @__PURE__ */ new Set([
+	"2.5.29.19",
+	"2.5.29.15",
+	"2.5.29.37",
+	"2.5.29.17",
+	"2.5.29.35",
+	"2.5.29.14"
+]);
+const WEAK_SIGNATURE_HASHES = /* @__PURE__ */ new Set([
+	"SHA-1",
+	"MD5",
+	"MD2",
+	"MD4"
+]);
+const ANY_EXTENDED_KEY_USAGE_OID = "2.5.29.37.0";
+/**
+* Validates client certificates without performing network I/O. AIA, CRL,
+* and OCSP retrieval are deliberately outside the external-PKI first slice.
+*/ var ClientCertificateValidator = class {
+	trustAnchorRepository;
+	crypto;
+	constructor(ctx) {
+		this.trustAnchorRepository = ctx.trustAnchorRepository;
+		this.crypto = ctx.crypto;
+	}
+	validateForBinding(evidence) {
+		assertClientCertificateEvidenceValidForBinding(evidence);
+	}
+	async validateForAuthentication(client, evidence) {
+		this.validateForBinding(evidence);
+		assertClientCertificatePurpose(evidence.certificate);
+		assertClientCertificateIdentity(evidence.certificate, client.id);
+		assertCertificateExtensionsUnderstood(evidence.certificate);
+		assertStrongSignature(evidence.certificate);
+		const anchors = await this.trustAnchorRepository.findManyBy({
+			realm_id: client.realm_id,
+			enabled: true
+		});
+		for (const anchor of anchors) {
+			const anchorCertificate = parseAnchorCertificate(anchor);
+			if (!anchorCertificate) continue;
+			const budget = { remaining: MAX_PATH_SIGNATURE_VERIFICATIONS };
+			const path = await buildPath(evidence.certificate, evidence.chain, anchorCertificate, budget, this.crypto);
+			if (!path) continue;
+			try {
+				assertCertificationPath(path);
+				return;
+			} catch {
+				continue;
+			}
+		}
+		throw new ValidationError("The client certificate is not trusted in this realm.");
+	}
+};
+function assertClientCertificateEvidenceValidForBinding(evidence) {
+	assertCertificateCurrent(evidence.certificate);
+	if (evidence.certificate.getExtension(BasicConstraintsExtension)?.ca) throw new ValidationError("A CA certificate cannot be used as a client certificate.");
+}
+function parseClientCertificateChain(pem) {
+	const blocks = pem.match(CERTIFICATE_BLOCK_PATTERN);
+	if (!blocks || blocks.length === 0) throw new ValidationError("The certificate chain could not be parsed.");
+	try {
+		return blocks.map((block) => new X509Certificate(block));
+	} catch {
+		throw new ValidationError("The certificate chain could not be parsed.");
+	}
+}
+async function buildClientCertificateThumbprint(certificate, crypto) {
+	const digest = await certificate.getThumbprint("SHA-256", crypto);
+	return base64URLEncode(String.fromCharCode(...new Uint8Array(digest)));
+}
+function parseAnchorCertificate(anchor) {
+	try {
+		return parseClientCertificateChain(anchor.certificate)[0];
+	} catch {
+		return;
+	}
+}
+async function buildPath(leaf, intermediates, anchor, budget, crypto) {
+	return continuePath(leaf, intermediates, anchor, [leaf], budget, crypto);
+}
+async function continuePath(current, available, anchor, path, budget, crypto) {
+	if (path.length > MAX_CHAIN_DEPTH) return;
+	if (sameCertificate(current, anchor)) return path;
+	if (await isIssuedBy(current, anchor, budget, crypto)) return [...path, anchor];
+	for (let index = 0; index < available.length; index += 1) {
+		const candidate = available[index];
+		if (!candidate || sameCertificate(current, candidate) || !await isIssuedBy(current, candidate, budget, crypto)) continue;
+		const next = await continuePath(candidate, available.filter((_item, candidateIndex) => candidateIndex !== index), anchor, [...path, candidate], budget, crypto);
+		if (next) return next;
+	}
+}
+async function isIssuedBy(certificate, issuer, budget, crypto) {
+	if (certificate.issuer !== issuer.subject) return false;
+	const authorityKeyIdentifier = certificate.getExtension(AuthorityKeyIdentifierExtension);
+	if (authorityKeyIdentifier?.keyId) {
+		const subjectKeyIdentifier = issuer.getExtension(SubjectKeyIdentifierExtension);
+		if (subjectKeyIdentifier && subjectKeyIdentifier.keyId !== authorityKeyIdentifier.keyId) return false;
+	}
+	if (budget.remaining <= 0) return false;
+	budget.remaining -= 1;
+	try {
+		return await certificate.verify({
+			publicKey: issuer,
+			signatureOnly: true
+		}, crypto);
+	} catch {
+		return false;
+	}
+}
+function sameCertificate(left, right) {
+	const leftRaw = new Uint8Array(left.rawData);
+	const rightRaw = new Uint8Array(right.rawData);
+	return leftRaw.length === rightRaw.length && leftRaw.every((value, index) => value === rightRaw[index]);
+}
+function assertCertificationPath(path) {
+	if (path.length < 2) throw new ValidationError("The client certificate chain is invalid.");
+	for (let index = 1; index < path.length; index += 1) {
+		const certificate = path[index];
+		if (!certificate) throw new ValidationError("The client certificate chain is invalid.");
+		if (!(index === path.length - 1)) {
+			assertCertificateExtensionsUnderstood(certificate);
+			assertStrongSignature(certificate);
+			assertIssuerExtendedKeyUsage(certificate);
+		}
+		assertCertificateCurrent(certificate);
+		const constraints = certificate.getExtension(BasicConstraintsExtension);
+		if (!constraints?.ca) throw new ValidationError("The client certificate chain contains a non-CA issuer.");
+		const keyUsage = certificate.getExtension(KeyUsagesExtension);
+		if (keyUsage && (keyUsage.usages & KeyUsageFlags.keyCertSign) === 0) throw new ValidationError("A client certificate issuer cannot sign certificates.");
+		if (typeof constraints.pathLength === "number" && index - 1 > constraints.pathLength) throw new ValidationError("The client certificate chain exceeds a CA path-length constraint.");
+	}
+}
+function assertClientCertificatePurpose(certificate) {
+	const extendedKeyUsage = certificate.getExtension(ExtendedKeyUsageExtension);
+	if (extendedKeyUsage && !extendedKeyUsage.usages.includes(ExtendedKeyUsage.clientAuth)) throw new ValidationError("The certificate is not valid for TLS client authentication.");
+	const keyUsage = certificate.getExtension(KeyUsagesExtension);
+	if (keyUsage && (keyUsage.usages & KeyUsageFlags.digitalSignature) === 0) throw new ValidationError("The certificate cannot prove possession of its private key.");
+}
+/**
+* EKU chaining (RFC 5280 §4.2.1.12): a CA whose Extended Key Usage is present
+* but omits both `clientAuth` and `anyExtendedKeyUsage` is not permitted to
+* issue TLS-client-authentication certificates, so a leaf beneath it must be
+* rejected. (A CA's EKU may be non-critical, so the critical-extension check
+* does not cover this.) A CA with no EKU extension is unconstrained.
+*/ function assertIssuerExtendedKeyUsage(certificate) {
+	const extendedKeyUsage = certificate.getExtension(ExtendedKeyUsageExtension);
+	if (extendedKeyUsage && !extendedKeyUsage.usages.includes(ExtendedKeyUsage.clientAuth) && !extendedKeyUsage.usages.includes(ANY_EXTENDED_KEY_USAGE_OID)) throw new ValidationError("A client certificate issuer is not permitted to issue TLS client-authentication certificates.");
+}
+function assertClientCertificateIdentity(certificate, clientId) {
+	const subjectAlternativeName = certificate.getExtension(SubjectAlternativeNameExtension);
+	const authupUris = subjectAlternativeName ? subjectAlternativeName.names.items.filter((name) => name.type === URL).map((name) => name.value).filter((value) => value.startsWith(CLIENT_CERTIFICATE_URI_PREFIX)) : [];
+	const expected = buildClientCertificateURI(clientId);
+	if (authupUris.length !== 1 || authupUris[0] !== expected) throw new ValidationError(`The certificate must contain exactly one Authup client URI SAN: ${expected}.`);
+}
+function assertCertificateCurrent(certificate) {
+	const now = Date.now();
+	if (certificate.notBefore.getTime() > now || certificate.notAfter.getTime() < now) throw new ValidationError("The client certificate is not currently valid.");
+}
+function assertCertificateExtensionsUnderstood(certificate) {
+	for (const extension of certificate.extensions) if (extension.critical && !HANDLED_CRITICAL_EXTENSION_OIDS.has(extension.type)) throw new ValidationError(`The certificate carries an unsupported critical extension (${extension.type}).`);
+}
+function assertStrongSignature(certificate) {
+	const hash = certificate.signatureAlgorithm?.hash?.name;
+	if (typeof hash === "string" && WEAK_SIGNATURE_HASHES.has(hash.toUpperCase())) throw new ValidationError(`The certificate is signed with a weak algorithm (${hash}).`);
+}
+//#endregion
+export { ClientCertificateValidator, assertClientCertificateEvidenceValidForBinding, buildClientCertificateThumbprint, parseClientCertificateChain };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/client-certificate/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["AuthorityKeyIdentifierExtension","BasicConstraintsExtension","ExtendedKeyUsage","ExtendedKeyUsageExtension","URL","GENERAL_NAME_URL","KeyUsageFlags","KeyUsagesExtension","SubjectAlternativeNameExtension","SubjectKeyIdentifierExtension","X509Certificate","CLIENT_CERTIFICATE_URI_PREFIX","buildClientCertificateURI","ValidationError","base64URLEncode","MAX_CHAIN_DEPTH","CERTIFICATE_BLOCK_PATTERN","MAX_PATH_SIGNATURE_VERIFICATIONS","HANDLED_CRITICAL_EXTENSION_OIDS","Set","WEAK_SIGNATURE_HASHES","ANY_EXTENDED_KEY_USAGE_OID","ClientCertificateValidator","trustAnchorRepository","crypto","ctx","validateForBinding","evidence","assertClientCertificateEvidenceValidForBinding","validateForAuthentication","client","assertClientCertificatePurpose","certificate","assertClientCertificateIdentity","id","assertCertificateExtensionsUnderstood","assertStrongSignature","anchors","findManyBy","realm_id","enabled","anchor","anchorCertificate","parseAnchorCertificate","budget","remaining","path","buildPath","chain","assertCertificationPath","assertCertificateCurrent","constraints","getExtension","ca","parseClientCertificateChain","pem","blocks","match","length","map","block","buildClientCertificateThumbprint","digest","getThumbprint","String","fromCharCode","Uint8Array","undefined","leaf","intermediates","continuePath","current","available","sameCertificate","isIssuedBy","index","candidate","next","filter","_item","candidateIndex","issuer","subject","authorityKeyIdentifier","keyId","subjectKeyIdentifier","verify","publicKey","signatureOnly","left","right","leftRaw","rawData","rightRaw","every","value","isAnchor","assertIssuerExtendedKeyUsage","keyUsage","usages","keyCertSign","pathLength","extendedKeyUsage","includes","clientAuth","digitalSignature","clientId","subjectAlternativeName","authupUris","names","items","name","type","startsWith","expected","now","Date","notBefore","getTime","notAfter","extension","extensions","critical","has","hash","signatureAlgorithm","toUpperCase"],"sources":["../../../src/core/client-certificate/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    AuthorityKeyIdentifierExtension,\n    BasicConstraintsExtension,\n    ExtendedKeyUsage,\n    ExtendedKeyUsageExtension,\n    URL as GENERAL_NAME_URL,\n    KeyUsageFlags,\n    KeyUsagesExtension,\n    SubjectAlternativeNameExtension,\n    SubjectKeyIdentifierExtension,\n    X509Certificate,\n} from '@peculiar/x509';\nimport type { Client, TrustAnchor } from '@authup/core-kit';\nimport {\n    CLIENT_CERTIFICATE_URI_PREFIX,\n    buildClientCertificateURI,\n} from '@authup/core-kit';\nimport { ValidationError } from '@authup/errors';\nimport { base64URLEncode } from '@authup/kit';\nimport type {\n    ClientCertificateEvidence,\n    ClientCertificateValidatorContext,\n    IClientCertificateValidator,\n} from './types.ts';\n\nconst MAX_CHAIN_DEPTH = 10;\nconst CERTIFICATE_BLOCK_PATTERN = /-----BEGIN CERTIFICATE-----[\\s\\S]*?-----END CERTIFICATE-----/g;\n\n/**\n * Hard ceiling on signature verifications performed while building a single\n * certification path. A legitimate chain of the maximum accepted length only\n * needs O(depth²) verifications; the ceiling exists purely to defuse the\n * factorial backtracking blow-up an attacker can induce with certificates\n * that mutually \"issue\" one another (shared key, identical subject/issuer\n * DNs). Reaching the ceiling is treated as \"no path found\" (fail closed).\n */\nconst MAX_PATH_SIGNATURE_VERIFICATIONS = 64;\n\n/**\n * OIDs of the certificate extensions this validator actually processes. A\n * certificate carrying a *critical* extension outside this set is rejected\n * (RFC 5280 §4.2): an unprocessed critical constraint must never be silently\n * ignored. Because RFC 5280 requires the NameConstraints extension to be\n * marked critical, this also fails a name-constrained CA closed rather than\n * trusting a chain whose name constraints we do not evaluate.\n */\nconst HANDLED_CRITICAL_EXTENSION_OIDS = new Set<string>([\n    '2.5.29.19', // basicConstraints\n    '2.5.29.15', // keyUsage\n    '2.5.29.37', // extKeyUsage\n    '2.5.29.17', // subjectAltName\n    '2.5.29.35', // authorityKeyIdentifier\n    '2.5.29.14', // subjectKeyIdentifier\n]);\n\nconst WEAK_SIGNATURE_HASHES = new Set<string>(['SHA-1', 'MD5', 'MD2', 'MD4']);\n\n// anyExtendedKeyUsage (RFC 5280 §4.2.1.12) — a CA carrying it is unconstrained.\nconst ANY_EXTENDED_KEY_USAGE_OID = '2.5.29.37.0';\n\ntype SignatureVerificationBudget = { remaining: number };\n\n/**\n * Validates client certificates without performing network I/O. AIA, CRL,\n * and OCSP retrieval are deliberately outside the external-PKI first slice.\n */\nexport class ClientCertificateValidator implements IClientCertificateValidator {\n    protected trustAnchorRepository: ClientCertificateValidatorContext['trustAnchorRepository'];\n\n    protected crypto?: Crypto;\n\n    constructor(ctx: ClientCertificateValidatorContext) {\n        this.trustAnchorRepository = ctx.trustAnchorRepository;\n        this.crypto = ctx.crypto;\n    }\n\n    validateForBinding(evidence: ClientCertificateEvidence): void {\n        assertClientCertificateEvidenceValidForBinding(evidence);\n    }\n\n    async validateForAuthentication(\n        client: Pick<Client, 'id' | 'realm_id'>,\n        evidence: ClientCertificateEvidence,\n    ): Promise<void> {\n        this.validateForBinding(evidence);\n        assertClientCertificatePurpose(evidence.certificate);\n        assertClientCertificateIdentity(evidence.certificate, client.id);\n        assertCertificateExtensionsUnderstood(evidence.certificate);\n        assertStrongSignature(evidence.certificate);\n\n        const anchors = await this.trustAnchorRepository.findManyBy({\n            realm_id: client.realm_id,\n            enabled: true,\n        });\n\n        for (const anchor of anchors) {\n            const anchorCertificate = parseAnchorCertificate(anchor);\n            if (!anchorCertificate) {\n                continue;\n            }\n\n            const budget: SignatureVerificationBudget = { remaining: MAX_PATH_SIGNATURE_VERIFICATIONS };\n            const path = await buildPath(\n                evidence.certificate,\n                evidence.chain,\n                anchorCertificate,\n                budget,\n                this.crypto,\n            );\n            if (!path) {\n                continue;\n            }\n\n            try {\n                assertCertificationPath(path);\n                return;\n            } catch {\n                // A chain reaching this anchor failed its CA constraints;\n                // another enabled anchor may still yield a valid path.\n                continue;\n            }\n        }\n\n        throw new ValidationError('The client certificate is not trusted in this realm.');\n    }\n}\n\nexport function assertClientCertificateEvidenceValidForBinding(\n    evidence: ClientCertificateEvidence,\n): void {\n    assertCertificateCurrent(evidence.certificate);\n\n    const constraints = evidence.certificate.getExtension(BasicConstraintsExtension);\n    if (constraints?.ca) {\n        throw new ValidationError('A CA certificate cannot be used as a client certificate.');\n    }\n}\n\nexport function parseClientCertificateChain(pem: string): X509Certificate[] {\n    const blocks = pem.match(CERTIFICATE_BLOCK_PATTERN);\n    if (!blocks || blocks.length === 0) {\n        throw new ValidationError('The certificate chain could not be parsed.');\n    }\n\n    try {\n        return blocks.map((block) => new X509Certificate(block));\n    } catch {\n        throw new ValidationError('The certificate chain could not be parsed.');\n    }\n}\n\nexport async function buildClientCertificateThumbprint(\n    certificate: X509Certificate,\n    crypto?: Crypto,\n): Promise<string> {\n    const digest = await certificate.getThumbprint('SHA-256', crypto);\n\n    return base64URLEncode(\n        String.fromCharCode(...new Uint8Array(digest)),\n    );\n}\n\nfunction parseAnchorCertificate(anchor: TrustAnchor): X509Certificate | undefined {\n    try {\n        return parseClientCertificateChain(anchor.certificate)[0];\n    } catch {\n        // Rows are validated on create. Treat a corrupt legacy/database row as\n        // unusable trust material instead of turning client authentication into\n        // a 500 or accidentally trusting another certificate in its PEM chain.\n        return undefined;\n    }\n}\n\nasync function buildPath(\n    leaf: X509Certificate,\n    intermediates: X509Certificate[],\n    anchor: X509Certificate,\n    budget: SignatureVerificationBudget,\n    crypto?: Crypto,\n): Promise<X509Certificate[] | undefined> {\n    return continuePath(leaf, intermediates, anchor, [leaf], budget, crypto);\n}\n\nasync function continuePath(\n    current: X509Certificate,\n    available: X509Certificate[],\n    anchor: X509Certificate,\n    path: X509Certificate[],\n    budget: SignatureVerificationBudget,\n    crypto?: Crypto,\n): Promise<X509Certificate[] | undefined> {\n    if (path.length > MAX_CHAIN_DEPTH) {\n        return undefined;\n    }\n\n    if (sameCertificate(current, anchor)) {\n        return path;\n    }\n\n    if (await isIssuedBy(current, anchor, budget, crypto)) {\n        return [...path, anchor];\n    }\n\n    for (let index = 0; index < available.length; index += 1) {\n        const candidate = available[index];\n        if (\n            !candidate ||\n            sameCertificate(current, candidate) ||\n            !await isIssuedBy(current, candidate, budget, crypto)\n        ) {\n            continue;\n        }\n\n        const next = await continuePath(\n            candidate,\n            available.filter((_item, candidateIndex) => candidateIndex !== index),\n            anchor,\n            [...path, candidate],\n            budget,\n            crypto,\n        );\n        if (next) {\n            return next;\n        }\n    }\n\n    return undefined;\n}\n\nasync function isIssuedBy(\n    certificate: X509Certificate,\n    issuer: X509Certificate,\n    budget: SignatureVerificationBudget,\n    crypto?: Crypto,\n): Promise<boolean> {\n    if (certificate.issuer !== issuer.subject) {\n        return false;\n    }\n\n    const authorityKeyIdentifier = certificate.getExtension(AuthorityKeyIdentifierExtension);\n    if (authorityKeyIdentifier?.keyId) {\n        const subjectKeyIdentifier = issuer.getExtension(SubjectKeyIdentifierExtension);\n        if (subjectKeyIdentifier && subjectKeyIdentifier.keyId !== authorityKeyIdentifier.keyId) {\n            return false;\n        }\n    }\n\n    // Spend from the shared verification budget only for the expensive\n    // cryptographic check (the DN / key-id pre-filters above are cheap). Once\n    // exhausted, treat every further edge as unverified so a maliciously\n    // crafted mutually-issuing certificate set cannot force factorial work.\n    if (budget.remaining <= 0) {\n        return false;\n    }\n    budget.remaining -= 1;\n\n    try {\n        return await certificate.verify({\n            publicKey: issuer,\n            signatureOnly: true,\n        }, crypto);\n    } catch {\n        return false;\n    }\n}\n\nfunction sameCertificate(left: X509Certificate, right: X509Certificate): boolean {\n    const leftRaw = new Uint8Array(left.rawData);\n    const rightRaw = new Uint8Array(right.rawData);\n\n    return leftRaw.length === rightRaw.length &&\n        leftRaw.every((value, index) => value === rightRaw[index]);\n}\n\nfunction assertCertificationPath(path: X509Certificate[]): void {\n    if (path.length < 2) {\n        throw new ValidationError('The client certificate chain is invalid.');\n    }\n\n    for (let index = 1; index < path.length; index += 1) {\n        const certificate = path[index];\n        if (!certificate) {\n            throw new ValidationError('The client certificate chain is invalid.');\n        }\n\n        // The last path element is the configured trust anchor, trusted a\n        // priori — its self-signature algorithm and any critical extensions\n        // it carries are the operator's responsibility, so the RFC 5280\n        // conformance checks below apply only to the issued intermediates.\n        const isAnchor = index === path.length - 1;\n        if (!isAnchor) {\n            assertCertificateExtensionsUnderstood(certificate);\n            assertStrongSignature(certificate);\n            assertIssuerExtendedKeyUsage(certificate);\n        }\n\n        assertCertificateCurrent(certificate);\n        const constraints = certificate.getExtension(BasicConstraintsExtension);\n        if (!constraints?.ca) {\n            throw new ValidationError('The client certificate chain contains a non-CA issuer.');\n        }\n\n        const keyUsage = certificate.getExtension(KeyUsagesExtension);\n        if (keyUsage && (keyUsage.usages & KeyUsageFlags.keyCertSign) === 0) {\n            throw new ValidationError('A client certificate issuer cannot sign certificates.');\n        }\n\n        // `index - 1` is the number of non-leaf CA certificates below this\n        // issuer in the selected path. A pathLenConstraint of zero therefore\n        // permits a directly-issued client leaf and no subordinate CA.\n        if (\n            typeof constraints.pathLength === 'number' &&\n            (index - 1) > constraints.pathLength\n        ) {\n            throw new ValidationError('The client certificate chain exceeds a CA path-length constraint.');\n        }\n    }\n}\n\nfunction assertClientCertificatePurpose(certificate: X509Certificate): void {\n    const extendedKeyUsage = certificate.getExtension(ExtendedKeyUsageExtension);\n    if (\n        extendedKeyUsage &&\n        !extendedKeyUsage.usages.includes(ExtendedKeyUsage.clientAuth)\n    ) {\n        throw new ValidationError('The certificate is not valid for TLS client authentication.');\n    }\n\n    const keyUsage = certificate.getExtension(KeyUsagesExtension);\n    if (keyUsage && (keyUsage.usages & KeyUsageFlags.digitalSignature) === 0) {\n        throw new ValidationError('The certificate cannot prove possession of its private key.');\n    }\n}\n\n/**\n * EKU chaining (RFC 5280 §4.2.1.12): a CA whose Extended Key Usage is present\n * but omits both `clientAuth` and `anyExtendedKeyUsage` is not permitted to\n * issue TLS-client-authentication certificates, so a leaf beneath it must be\n * rejected. (A CA's EKU may be non-critical, so the critical-extension check\n * does not cover this.) A CA with no EKU extension is unconstrained.\n */\nfunction assertIssuerExtendedKeyUsage(certificate: X509Certificate): void {\n    const extendedKeyUsage = certificate.getExtension(ExtendedKeyUsageExtension);\n    if (\n        extendedKeyUsage &&\n        !extendedKeyUsage.usages.includes(ExtendedKeyUsage.clientAuth) &&\n        !extendedKeyUsage.usages.includes(ANY_EXTENDED_KEY_USAGE_OID)\n    ) {\n        throw new ValidationError('A client certificate issuer is not permitted to issue TLS client-authentication certificates.');\n    }\n}\n\nfunction assertClientCertificateIdentity(certificate: X509Certificate, clientId: string): void {\n    const subjectAlternativeName = certificate.getExtension(SubjectAlternativeNameExtension);\n    const authupUris = subjectAlternativeName ?\n        subjectAlternativeName.names.items\n            .filter((name) => name.type === GENERAL_NAME_URL)\n            .map((name) => name.value)\n            .filter((value) => value.startsWith(CLIENT_CERTIFICATE_URI_PREFIX)) :\n        [];\n\n    const expected = buildClientCertificateURI(clientId);\n    if (authupUris.length !== 1 || authupUris[0] !== expected) {\n        throw new ValidationError(`The certificate must contain exactly one Authup client URI SAN: ${expected}.`);\n    }\n}\n\nfunction assertCertificateCurrent(certificate: X509Certificate): void {\n    const now = Date.now();\n    if (\n        certificate.notBefore.getTime() > now ||\n        certificate.notAfter.getTime() < now\n    ) {\n        throw new ValidationError('The client certificate is not currently valid.');\n    }\n}\n\nfunction assertCertificateExtensionsUnderstood(certificate: X509Certificate): void {\n    for (const extension of certificate.extensions) {\n        if (extension.critical && !HANDLED_CRITICAL_EXTENSION_OIDS.has(extension.type)) {\n            throw new ValidationError(\n                `The certificate carries an unsupported critical extension (${extension.type}).`,\n            );\n        }\n    }\n}\n\nfunction assertStrongSignature(certificate: X509Certificate): void {\n    const hash = certificate.signatureAlgorithm?.hash?.name;\n    if (typeof hash === 'string' && WEAK_SIGNATURE_HASHES.has(hash.toUpperCase())) {\n        throw new ValidationError(`The certificate is signed with a weak algorithm (${hash}).`);\n    }\n}\n"],"mappings":";;;;;;;;AAgCA,MAAMe,kBAAkB;AACxB,MAAMC,4BAA4B;;;;;;;;GAUlC,MAAMC,mCAAmC;;;;;;;;GAUzC,MAAMC,kDAAkC,IAAIC,IAAY;CACpD;CACA;CACA;CACA;CACA;CACA;CACH;AAED,MAAMC,wCAAwB,IAAID,IAAY;CAAC;CAAS;CAAO;CAAO;CAAM;AAG5E,MAAME,6BAA6B;;;;GAQnC,IAAaC,6BAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAwC;EAChD,KAAKF,wBAAwBE,IAAIF;EACjC,KAAKC,SAASC,IAAID;CACtB;CAEAE,mBAAmBC,UAA2C;EAC1DC,+CAA+CD,QAAAA;CACnD;CAEA,MAAME,0BACFC,QACAH,UACa;EACb,KAAKD,mBAAmBC,QAAAA;EACxBI,+BAA+BJ,SAASK,WAAW;EACnDC,gCAAgCN,SAASK,aAAaF,OAAOI,EAAE;EAC/DC,sCAAsCR,SAASK,WAAW;EAC1DI,sBAAsBT,SAASK,WAAW;EAE1C,MAAMK,UAAU,MAAM,KAAKd,sBAAsBe,WAAW;GACxDC,UAAUT,OAAOS;GACjBC,SAAS;EACb,CAAA;EAEA,KAAK,MAAMC,UAAUJ,SAAS;GAC1B,MAAMK,oBAAoBC,uBAAuBF,MAAAA;GACjD,IAAI,CAACC,mBACD;GAGJ,MAAME,SAAsC,EAAEC,WAAW5B,iCAAiC;GAC1F,MAAM6B,OAAO,MAAMC,UACfpB,SAASK,aACTL,SAASqB,OACTN,mBACAE,QACA,KAAKpB,MAAM;GAEf,IAAI,CAACsB,MACD;GAGJ,IAAI;IACAG,wBAAwBH,IAAAA;IACxB;GACJ,QAAQ;IAGJ;GACJ;EACJ;EAEA,MAAM,IAAIjC,gBAAgB,sDAAA;CAC9B;AACJ;AAEA,SAAgBe,+CACZD,UAAmC;CAEnCuB,yBAAyBvB,SAASK,WAAW;CAG7C,IADoBL,SAASK,YAAYoB,aAAanD,yBAClDkD,CAAAA,EAAaE,IACb,MAAM,IAAIxC,gBAAgB,0DAAA;AAElC;AAEA,SAAgByC,4BAA4BC,KAAW;CACnD,MAAMC,SAASD,IAAIE,MAAMzC,yBAAAA;CACzB,IAAI,CAACwC,UAAUA,OAAOE,WAAW,GAC7B,MAAM,IAAI7C,gBAAgB,4CAAA;CAG9B,IAAI;EACA,OAAO2C,OAAOG,KAAKC,UAAU,IAAIlD,gBAAgBkD,KAAAA,CAAAA;CACrD,QAAQ;EACJ,MAAM,IAAI/C,gBAAgB,4CAAA;CAC9B;AACJ;AAEA,eAAsBgD,iCAClB7B,aACAR,QAAe;CAEf,MAAMsC,SAAS,MAAM9B,YAAY+B,cAAc,WAAWvC,MAAAA;CAE1D,OAAOV,gBACHkD,OAAOC,aAAY,GAAI,IAAIC,WAAWJ,MAAAA,CAAAA,CAAAA;AAE9C;AAEA,SAASnB,uBAAuBF,QAAmB;CAC/C,IAAI;EACA,OAAOa,4BAA4Bb,OAAOT,WAAW,CAAC,CAAC;CAC3D,QAAQ;EAIJ;CACJ;AACJ;AAEA,eAAee,UACXqB,MACAC,eACA5B,QACAG,QACApB,QAAe;CAEf,OAAO8C,aAAaF,MAAMC,eAAe5B,QAAQ,CAAC2B,IAAAA,GAAOxB,QAAQpB,MAAAA;AACrE;AAEA,eAAe8C,aACXC,SACAC,WACA/B,QACAK,MACAF,QACApB,QAAe;CAEf,IAAIsB,KAAKY,SAAS3C,iBACd;CAGJ,IAAI0D,gBAAgBF,SAAS9B,MAAAA,GACzB,OAAOK;CAGX,IAAI,MAAM4B,WAAWH,SAAS9B,QAAQG,QAAQpB,MAAAA,GAC1C,OAAO,CAAA,GAAIsB,MAAML,MAAAA;CAGrB,KAAK,IAAIkC,QAAQ,GAAGA,QAAQH,UAAUd,QAAQiB,SAAS,GAAG;EACtD,MAAMC,YAAYJ,UAAUG;EAC5B,IACI,CAACC,aACDH,gBAAgBF,SAASK,SAAAA,KACzB,CAAC,MAAMF,WAAWH,SAASK,WAAWhC,QAAQpB,MAAAA,GAE9C;EAGJ,MAAMqD,OAAO,MAAMP,aACfM,WACAJ,UAAUM,QAAQC,OAAOC,mBAAmBA,mBAAmBL,KAAAA,GAC/DlC,QACA,CAAA,GAAIK,MAAM8B,SAAAA,GACVhC,QACApB,MAAAA;EAEJ,IAAIqD,MACA,OAAOA;CAEf;AAGJ;AAEA,eAAeH,WACX1C,aACAiD,QACArC,QACApB,QAAe;CAEf,IAAIQ,YAAYiD,WAAWA,OAAOC,SAC9B,OAAO;CAGX,MAAMC,yBAAyBnD,YAAYoB,aAAapD,+BAAAA;CACxD,IAAImF,wBAAwBC,OAAO;EAC/B,MAAMC,uBAAuBJ,OAAO7B,aAAa3C,6BAAAA;EACjD,IAAI4E,wBAAwBA,qBAAqBD,UAAUD,uBAAuBC,OAC9E,OAAO;CAEf;CAMA,IAAIxC,OAAOC,aAAa,GACpB,OAAO;CAEXD,OAAOC,aAAa;CAEpB,IAAI;EACA,OAAO,MAAMb,YAAYsD,OAAO;GAC5BC,WAAWN;GACXO,eAAe;EACnB,GAAGhE,MAAAA;CACP,QAAQ;EACJ,OAAO;CACX;AACJ;AAEA,SAASiD,gBAAgBgB,MAAuBC,OAAsB;CAClE,MAAMC,UAAU,IAAIzB,WAAWuB,KAAKG,OAAO;CAC3C,MAAMC,WAAW,IAAI3B,WAAWwB,MAAME,OAAO;CAE7C,OAAOD,QAAQjC,WAAWmC,SAASnC,UAC/BiC,QAAQG,OAAOC,OAAOpB,UAAUoB,UAAUF,SAASlB,MAAM;AACjE;AAEA,SAAS1B,wBAAwBH,MAAuB;CACpD,IAAIA,KAAKY,SAAS,GACd,MAAM,IAAI7C,gBAAgB,0CAAA;CAG9B,KAAK,IAAI8D,QAAQ,GAAGA,QAAQ7B,KAAKY,QAAQiB,SAAS,GAAG;EACjD,MAAM3C,cAAcc,KAAK6B;EACzB,IAAI,CAAC3C,aACD,MAAM,IAAInB,gBAAgB,0CAAA;EAQ9B,IAAI,EADa8D,UAAU7B,KAAKY,SAAS,IAC1B;GACXvB,sCAAsCH,WAAAA;GACtCI,sBAAsBJ,WAAAA;GACtBiE,6BAA6BjE,WAAAA;EACjC;EAEAkB,yBAAyBlB,WAAAA;EACzB,MAAMmB,cAAcnB,YAAYoB,aAAanD,yBAAAA;EAC7C,IAAI,CAACkD,aAAaE,IACd,MAAM,IAAIxC,gBAAgB,wDAAA;EAG9B,MAAMqF,WAAWlE,YAAYoB,aAAa7C,kBAAAA;EAC1C,IAAI2F,aAAaA,SAASC,SAAS7F,cAAc8F,iBAAiB,GAC9D,MAAM,IAAIvF,gBAAgB,uDAAA;EAM9B,IACI,OAAOsC,YAAYkD,eAAe,YAClC,QAAS,IAAKlD,YAAYkD,YAE1B,MAAM,IAAIxF,gBAAgB,mEAAA;CAElC;AACJ;AAEA,SAASkB,+BAA+BC,aAA4B;CAChE,MAAMsE,mBAAmBtE,YAAYoB,aAAajD,yBAAAA;CAClD,IACImG,oBACA,CAACA,iBAAiBH,OAAOI,SAASrG,iBAAiBsG,UAAU,GAE7D,MAAM,IAAI3F,gBAAgB,6DAAA;CAG9B,MAAMqF,WAAWlE,YAAYoB,aAAa7C,kBAAAA;CAC1C,IAAI2F,aAAaA,SAASC,SAAS7F,cAAcmG,sBAAsB,GACnE,MAAM,IAAI5F,gBAAgB,6DAAA;AAElC;;;;;;;GASA,SAASoF,6BAA6BjE,aAA4B;CAC9D,MAAMsE,mBAAmBtE,YAAYoB,aAAajD,yBAAAA;CAClD,IACImG,oBACA,CAACA,iBAAiBH,OAAOI,SAASrG,iBAAiBsG,UAAU,KAC7D,CAACF,iBAAiBH,OAAOI,SAASlF,0BAAAA,GAElC,MAAM,IAAIR,gBAAgB,+FAAA;AAElC;AAEA,SAASoB,gCAAgCD,aAA8B0E,UAAgB;CACnF,MAAMC,yBAAyB3E,YAAYoB,aAAa5C,+BAAAA;CACxD,MAAMoG,aAAaD,yBACfA,uBAAuBE,MAAMC,MACxBhC,QAAQiC,SAASA,KAAKC,SAAS3G,GAAAA,CAAAA,CAC/BsD,KAAKoD,SAASA,KAAKhB,KAAK,CAAA,CACxBjB,QAAQiB,UAAUA,MAAMkB,WAAWtG,6BAAAA,CAAAA,IACxC,CAAA;CAEJ,MAAMuG,WAAWtG,0BAA0B8F,QAAAA;CAC3C,IAAIE,WAAWlD,WAAW,KAAKkD,WAAW,OAAOM,UAC7C,MAAM,IAAIrG,gBAAgB,mEAAmEqG,SAAS,EAAE;AAEhH;AAEA,SAAShE,yBAAyBlB,aAA4B;CAC1D,MAAMmF,MAAMC,KAAKD,IAAG;CACpB,IACInF,YAAYqF,UAAUC,QAAO,IAAKH,OAClCnF,YAAYuF,SAASD,QAAO,IAAKH,KAEjC,MAAM,IAAItG,gBAAgB,gDAAA;AAElC;AAEA,SAASsB,sCAAsCH,aAA4B;CACvE,KAAK,MAAMwF,aAAaxF,YAAYyF,YAChC,IAAID,UAAUE,YAAY,CAACxG,gCAAgCyG,IAAIH,UAAUR,IAAI,GACzE,MAAM,IAAInG,gBACN,8DAA8D2G,UAAUR,KAAK,GAAG;AAIhG;AAEA,SAAS5E,sBAAsBJ,aAA4B;CACvD,MAAM4F,OAAO5F,YAAY6F,oBAAoBD,MAAMb;CACnD,IAAI,OAAOa,SAAS,YAAYxG,sBAAsBuG,IAAIC,KAAKE,YAAW,CAAA,GACtE,MAAM,IAAIjH,gBAAgB,oDAAoD+G,KAAK,GAAG;AAE9F"}

package/dist/core/client-certificate/types.d.ts

@@ -0,0 +1,22 @@
+import type { X509Certificate } from '@peculiar/x509';
+import type { Client } from '@authup/core-kit';
+import type { ITrustAnchorRepository } from '../entities/index.ts';
+/**
+ * Runtime-neutral evidence derived from the certificate used in the external
+ * client-facing TLS handshake. `chain` excludes the leaf and is ordered as it
+ * appeared on the wire when the forwarding format preserves that order.
+ */
+export type ClientCertificateEvidence = {
+    certificate: X509Certificate;
+    chain: X509Certificate[];
+    thumbprint: string;
+};
+export type ClientCertificateValidatorContext = {
+    trustAnchorRepository: Pick<ITrustAnchorRepository, 'findManyBy'>;
+    crypto?: Crypto;
+};
+export interface IClientCertificateValidator {
+    validateForBinding(evidence: ClientCertificateEvidence): void;
+    validateForAuthentication(client: Pick<Client, 'id' | 'realm_id'>, evidence: ClientCertificateEvidence): Promise<void>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/client-certificate/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/client-certificate/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAEnE;;;;GAIG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACpC,WAAW,EAAE,eAAe,CAAC;IAC7B,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,iCAAiC,GAAG;IAC5C,qBAAqB,EAAE,IAAI,CAAC,sBAAsB,EAAE,YAAY,CAAC,CAAC;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,WAAW,2BAA2B;IACxC,kBAAkB,CAAC,QAAQ,EAAE,yBAAyB,GAAG,IAAI,CAAC;IAC9D,yBAAyB,CACrB,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,UAAU,CAAC,EACvC,QAAQ,EAAE,yBAAyB,GACpC,OAAO,CAAC,IAAI,CAAC,CAAC;CACpB"}

package/dist/core/client-certificate/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/entities/client/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAEH,eAAe,EAElB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEpE,MAAM,MAAM,oBAAoB,GAAG;IAC/B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,qBAAa,aAAc,SAAQ,qBAAsB,YAAW,cAAc;IAC9E,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC;IAExC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC;gBAEzB,GAAG,EAAE,oBAAoB;IAO/B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAmD5C,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC;IA2CZ,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;IAuJI,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;CAmBrB"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAGH,eAAe,EAElB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEpE,MAAM,MAAM,oBAAoB,GAAG;IAC/B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,qBAAa,aAAc,SAAQ,qBAAsB,YAAW,cAAc;IAC9E,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC;IAExC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC;gBAEzB,GAAG,EAAE,oBAAoB;IAO/B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAmD5C,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC;IA2CZ,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;IA2JI,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;CAmBrB"}

package/dist/core/entities/client/service.mjs

@@ -3,10 +3,10 @@ import "node:url";
 import.meta.url;
 import { ClientCredentialsService } from "../../authentication/credential/entities/client/module.mjs";
 import { ValidatorGroup, isUUID } from "@authup/kit";
-import { CLIENT_RESERVED_NAMES, ClientValidator, PermissionName } from "@authup/core-kit";
+import { CLIENT_RESERVED_NAMES, ClientAuthMethod, ClientValidator, PermissionName } from "@authup/core-kit";
 import { AbstractEntityService } from "@authup/server-kit";
 import { BuiltInPolicyType, definePolicyData } from "@authup/access";
-import { BadRequestError, EntityNotFoundError } from "@authup/errors";
+import { EntityNotFoundError, ValidationError } from "@authup/errors";
 //#region src/core/entities/client/service.ts
 var ClientService = class extends AbstractEntityService {
 	repository;
@@ -115,7 +115,7 @@ var ClientService = class extends AbstractEntityService {
 			group = ValidatorGroup.CREATE;
 		}
 		const validated = await this.validator.run(data, { group });
-		if (typeof validated.name === "string" && CLIENT_RESERVED_NAMES.includes(validated.name) && !(entity && entity.built_in && entity.name === validated.name)) throw new BadRequestError(`The client name '${validated.name}' is reserved.`);
+		if (typeof validated.name === "string" && CLIENT_RESERVED_NAMES.includes(validated.name) && !(entity && entity.built_in && entity.name === validated.name)) throw new ValidationError(`The client name '${validated.name}' is reserved.`);
 		await this.repository.validateJoinColumns(validated);
 		await this.repository.checkUniqueness(validated, entity || void 0);
 		const credentialsService = new ClientCredentialsService();
@@ -139,10 +139,14 @@ var ClientService = class extends AbstractEntityService {
 					...this.resourceRealmMatch(entity)
 				})
 			});
-			if (entity.is_confidential) {
+			if (entity.auth_method === ClientAuthMethod.SECRET) {
 				if (!validated.secret && !entity.secret) validated.secret = credentialsService.generateSecret();
 				if (validated.secret) entity.secret = await credentialsService.protect(validated.secret, entity);
-			} else entity.secret = null;
+			} else {
+				entity.secret = null;
+				entity.secret_hashed = false;
+				entity.secret_encrypted = false;
+			}
 			await this.repository.save(entity);
 			return {
 				entity,
@@ -161,10 +165,14 @@ var ClientService = class extends AbstractEntityService {
 			})
 		});
 		entity = this.repository.create(validated);
-		if (entity.is_confidential) {
+		if (entity.auth_method === ClientAuthMethod.SECRET) {
 			if (!validated.secret) validated.secret = credentialsService.generateSecret();
 			entity.secret = await credentialsService.protect(validated.secret, validated);
-		} else entity.secret = null;
+		} else {
+			entity.secret = null;
+			entity.secret_hashed = false;
+			entity.secret_encrypted = false;
+		}
 		await this.repository.save(entity);
 		return {
 			entity,

package/dist/core/entities/client/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isUUID","BadRequestError","EntityNotFoundError","CLIENT_RESERVED_NAMES","ClientValidator","PermissionName","AbstractEntityService","ClientCredentialsService","ClientService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","CLIENT_READ","CLIENT_UPDATE","CLIENT_DELETE","data","entities","meta","findMany","total","entity","secret","secret_encrypted","secret_hashed","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","push","getOne","idOrName","realmId","permissionNames","isMe","identity","type","id","findOne","create","save","undefined","update","updateOnly","options","group","realm","realm_id","resolve","where","findOneWithSecret","isSelfEdit","preEvaluate","e","CLIENT_SELF_MANAGE","UPDATE","CLIENT_CREATE","CREATE","validated","run","includes","built_in","validateJoinColumns","checkUniqueness","credentialsService","actorRealmId","getActorRealmId","evaluate","merge","is_confidential","generateSecret","protect","created","delete","findOneBy","entityId","remove"],"sources":["../../../../src/core/entities/client/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isUUID } from '@authup/kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport {\n    CLIENT_RESERVED_NAMES,\n    ClientValidator,\n    PermissionName,\n} from '@authup/core-kit';\nimport type { Client } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { ClientCredentialsService } from '../../authentication/credential/entities/client/module.ts';\nimport type { IClientRepository, IClientService } from './types.ts';\n\nexport type ClientServiceContext = {\n    repository: IClientRepository;\n    realmRepository: IRealmRepository;\n};\n\nexport class ClientService extends AbstractEntityService implements IClientService {\n    protected repository: IClientRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected validator: ClientValidator;\n\n    constructor(ctx: ClientServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.validator = new ClientValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Client>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.CLIENT_READ,\n                PermissionName.CLIENT_UPDATE,\n                PermissionName.CLIENT_DELETE,\n            ],\n        });\n\n        const {\n            data: entities, \n            meta, \n        } = await this.repository.findMany(query);\n        let { total } = meta;\n\n        const data: Client[] = [];\n        for (const entity of entities) {\n            if (\n                entity.secret &&\n                !entity.secret_encrypted &&\n                !entity.secret_hashed\n            ) {\n                try {\n                    await actor.permissionEvaluator.evaluateOneOf({\n                        name: [\n                            PermissionName.CLIENT_READ,\n                            PermissionName.CLIENT_UPDATE,\n                            PermissionName.CLIENT_DELETE,\n                        ],\n                        data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n                    });\n                    data.push(entity);\n                } catch {\n                    total -= 1;\n                }\n\n                continue;\n            }\n\n            data.push(entity);\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total, \n            }, \n        };\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        query?: Record<string, any>,\n        realmId?: string,\n    ): Promise<Client> {\n        const permissionNames = [\n            PermissionName.CLIENT_READ,\n            PermissionName.CLIENT_UPDATE,\n            PermissionName.CLIENT_DELETE,\n        ];\n\n        let isMe = !!actor.identity &&\n            actor.identity.type === 'client' &&\n            (\n                actor.identity.data.id === idOrName ||\n                actor.identity.data.name === idOrName\n            );\n\n        if (!isMe) {\n            await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n        }\n\n        const entity = await this.repository.findOne(idOrName, query, realmId);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (isMe && actor.identity!.data.id !== entity.id) {\n            isMe = false;\n            await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n        }\n\n        if (\n            !isMe &&\n            entity.secret &&\n            !entity.secret_encrypted &&\n            !entity.secret_hashed\n        ) {\n            await actor.permissionEvaluator.evaluateOneOf({\n                name: permissionNames,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n            });\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Client> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Client> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Client,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realm_id === 'string' ?\n            await this.realmRepository.resolve(data.realm_id) :\n            undefined;\n\n        let entity: Client | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realm_id = realm.id;\n            }\n\n            entity = await this.repository.findOneWithSecret(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        let isSelfEdit = false;\n        if (entity) {\n            try {\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_UPDATE });\n            } catch (e) {\n                if (\n                    !actor.identity ||\n                    actor.identity.type !== 'client' ||\n                    actor.identity.data.id !== entity.id\n                ) {\n                    throw e;\n                }\n                isSelfEdit = true;\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SELF_MANAGE });\n            }\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        // Reserve the system-provisioned client names (`system`, `web`) so an\n        // API caller can't create or rename a client onto them — that would\n        // collide on unique(name, realm_id) or shadow the built_in client.\n        // Provisioning and runtime hooks bypass this service, so they remain\n        // free to manage the reserved clients. built_in clients are exempt\n        // (they ARE the provisioned ones) but API callers can never produce a\n        // built_in client since the validator strips the flag.\n        if (\n            typeof validated.name === 'string' &&\n            CLIENT_RESERVED_NAMES.includes(validated.name) &&\n            !(entity && entity.built_in && entity.name === validated.name)\n        ) {\n            throw new BadRequestError(`The client name '${validated.name}' is reserved.`);\n        }\n\n        await this.repository.validateJoinColumns(validated);\n        await this.repository.checkUniqueness(validated, entity || undefined);\n\n        const credentialsService = new ClientCredentialsService();\n\n        if (entity) {\n            if (\n                !isSelfEdit &&\n                !validated.realm_id &&\n                !entity.realm_id\n            ) {\n                const actorRealmId = this.getActorRealmId(actor);\n                if (actorRealmId) {\n                    validated.realm_id = actorRealmId;\n                }\n            }\n\n            if (isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.CLIENT_SELF_MANAGE,\n                    data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n                });\n            }\n\n            entity = this.repository.merge(entity, validated);\n\n            if (!isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.CLIENT_UPDATE,\n                    data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n                });\n            }\n\n            if (entity.is_confidential) {\n                if (!validated.secret && !entity.secret) {\n                    validated.secret = credentialsService.generateSecret();\n                }\n\n                if (validated.secret) {\n                    entity.secret = await credentialsService.protect(validated.secret, entity);\n                }\n            } else {\n                entity.secret = null;\n            }\n\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!validated.realm_id) {\n            const actorRealmId = this.getActorRealmId(actor);\n            if (actorRealmId) {\n                validated.realm_id = actorRealmId;\n            }\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n        });\n\n        entity = this.repository.create(validated);\n\n        if (entity.is_confidential) {\n            if (!validated.secret) {\n                validated.secret = credentialsService.generateSecret();\n            }\n\n            entity.secret = await credentialsService.protect(validated.secret, validated);\n        } else {\n            entity.secret = null;\n        }\n\n        await this.repository.save(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Client> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;AA2BA,IAAaW,gBAAb,cAAmCF,sBAAAA;CACrBG;CAEAC;CAEAC;CAEV,YAAYC,KAA2B;EACnC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIP,gBAAAA;CACzB;CAEA,MAAMS,QACFC,OACAC,OAC+C;EAC/C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFb,eAAec;GACfd,eAAee;GACff,eAAegB;IAEvB,CAAA;EAEA,MAAM,EACFC,MAAMC,UACNC,SACA,MAAM,KAAKf,WAAWgB,SAASX,KAAAA;EACnC,IAAI,EAAEY,UAAUF;EAEhB,MAAMF,OAAiB,CAAA;EACvB,KAAK,MAAMK,UAAUJ,UAAU;GAC3B,IACII,OAAOC,UACP,CAACD,OAAOE,oBACR,CAACF,OAAOG,eACV;IACE,IAAI;KACA,MAAMf,MAAMC,oBAAoBe,cAAc;MAC1Cb,MAAM;OACFb,eAAec;OACfd,eAAee;OACff,eAAegB;;MAEnBC,MAAMxB,iBAAiB;QAAGD,kBAAkBmC,aAAaL;OAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;MAAQ,CAAA;KACxG,CAAA;KACAL,KAAKY,KAAKP,MAAAA;IACd,QAAQ;KACJD,SAAS;IACb;IAEA;GACJ;GAEAJ,KAAKY,KAAKP,MAAAA;EACd;EAEA,OAAO;GACHL;GACAE,MAAM;IACF,GAAGA;IACHE;GACJ;EACJ;CACJ;CAEA,MAAMS,OACFC,UACArB,OACAD,OACAuB,SACe;EACf,MAAMC,kBAAkB;GACpBjC,eAAec;GACfd,eAAee;GACff,eAAegB;;EAGnB,IAAIkB,OAAO,CAAC,CAACxB,MAAMyB,YACfzB,MAAMyB,SAASC,SAAS,aAEpB1B,MAAMyB,SAASlB,KAAKoB,OAAON,YAC3BrB,MAAMyB,SAASlB,KAAKJ,SAASkB;EAGrC,IAAI,CAACG,MACD,MAAMxB,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMoB,gBAAgB,CAAA;EAG7E,MAAMX,SAAS,MAAM,KAAKlB,WAAWkC,QAAQP,UAAUtB,OAAOuB,OAAAA;EAC9D,IAAI,CAACV,QACD,MAAM,IAAIzB,oBAAAA;EAGd,IAAIqC,QAAQxB,MAAMyB,SAAUlB,KAAKoB,OAAOf,OAAOe,IAAI;GAC/CH,OAAO;GACP,MAAMxB,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMoB,gBAAgB,CAAA;EAC7E;EAEA,IACI,CAACC,QACDZ,OAAOC,UACP,CAACD,OAAOE,oBACR,CAACF,OAAOG,eAER,MAAMf,MAAMC,oBAAoBe,cAAc;GAC1Cb,MAAMoB;GACNhB,MAAMxB,iBAAiB;KAAGD,kBAAkBmC,aAAaL;IAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,OAAOA;CACX;CAEA,MAAMiB,OACFtB,MACAP,OACe;EACf,MAAM,EAAEY,WAAW,MAAM,KAAKkB,KAAKC,KAAAA,GAAWxB,MAAMP,KAAAA;EACpD,OAAOY;CACX;CAEA,MAAMoB,OACFX,UACAd,MACAP,OACe;EACf,MAAM,EAAEY,WAAW,MAAM,KAAKkB,KAAKT,UAAUd,MAAMP,OAAO,EAAEiC,YAAY,KAAK,CAAA;EAC7E,OAAOrB;CACX;CAEA,MAAMkB,KACFT,UACAd,MACAP,OACAkC,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAO7B,KAAK8B,aAAa,WACnC,MAAM,KAAK1C,gBAAgB2C,QAAQ/B,KAAK8B,QAAQ,IAChDN,KAAAA;EAEJ,IAAInB;EACJ,IAAIS,UAAU;GACV,MAAMkB,QAA6B,CAAC;GACpC,IAAItD,OAAOoC,QAAAA,GACPkB,MAAMZ,KAAKN;QAEXkB,MAAMpC,OAAOkB;GAGjB,IAAIe,OACAG,MAAMF,WAAWD,MAAMT;GAG3Bf,SAAS,MAAM,KAAKlB,WAAW8C,kBAAkBD,KAAAA;GACjD,IAAI,CAAC3B,UAAUsB,QAAQD,YACnB,MAAM,IAAI9C,oBAAAA;EAElB,OAAO,IAAI+C,QAAQD,YACf,MAAM,IAAI9C,oBAAAA;EAGd,IAAIsD,aAAa;EACjB,IAAI7B,QAAQ;GACR,IAAI;IACA,MAAMZ,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAee,cAAc,CAAA;GACrF,SAASsC,GAAG;IACR,IACI,CAAC3C,MAAMyB,YACPzB,MAAMyB,SAASC,SAAS,YACxB1B,MAAMyB,SAASlB,KAAKoB,OAAOf,OAAOe,IAElC,MAAMgB;IAEVF,aAAa;IACb,MAAMzC,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAesD,mBAAmB,CAAA;GAC1F;GACAT,QAAQnD,eAAe6D;EAC3B,OAAO;GACH,MAAM7C,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAewD,cAAc,CAAA;GACjFX,QAAQnD,eAAe+D;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKpD,UAAUqD,IAAI1C,MAAM,EAAE4B,MAAM,CAAA;EASzD,IACI,OAAOa,UAAU7C,SAAS,YAC1Bf,sBAAsB8D,SAASF,UAAU7C,IAAI,KAC7C,EAAES,UAAUA,OAAOuC,YAAYvC,OAAOT,SAAS6C,UAAU7C,OAEzD,MAAM,IAAIjB,gBAAgB,oBAAoB8D,UAAU7C,KAAK,eAAe;EAGhF,MAAM,KAAKT,WAAW0D,oBAAoBJ,SAAAA;EAC1C,MAAM,KAAKtD,WAAW2D,gBAAgBL,WAAWpC,UAAUmB,KAAAA,CAAAA;EAE3D,MAAMuB,qBAAqB,IAAI9D,yBAAAA;EAE/B,IAAIoB,QAAQ;GACR,IACI,CAAC6B,cACD,CAACO,UAAUX,YACX,CAACzB,OAAOyB,UACV;IACE,MAAMkB,eAAe,KAAKC,gBAAgBxD,KAAAA;IAC1C,IAAIuD,cACAP,UAAUX,WAAWkB;GAE7B;GAEA,IAAId,YACA,MAAMzC,MAAMC,oBAAoBwD,SAAS;IACrCtD,MAAMb,eAAesD;IACrBrC,MAAMxB,iBAAiB;MAAGD,kBAAkBmC,aAAa+B;KAAW,GAAG,KAAK9B,mBAAmB8B,SAAAA;IAAW,CAAA;GAC9G,CAAA;GAGJpC,SAAS,KAAKlB,WAAWgE,MAAM9C,QAAQoC,SAAAA;GAEvC,IAAI,CAACP,YACD,MAAMzC,MAAMC,oBAAoBwD,SAAS;IACrCtD,MAAMb,eAAee;IACrBE,MAAMxB,iBAAiB;MAAGD,kBAAkBmC,aAAaL;KAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;IAAQ,CAAA;GACxG,CAAA;GAGJ,IAAIA,OAAO+C,iBAAiB;IACxB,IAAI,CAACX,UAAUnC,UAAU,CAACD,OAAOC,QAC7BmC,UAAUnC,SAASyC,mBAAmBM,eAAc;IAGxD,IAAIZ,UAAUnC,QACVD,OAAOC,SAAS,MAAMyC,mBAAmBO,QAAQb,UAAUnC,QAAQD,MAAAA;GAE3E,OACIA,OAAOC,SAAS;GAGpB,MAAM,KAAKnB,WAAWoC,KAAKlB,MAAAA;GAE3B,OAAO;IACHA;IACAkD,SAAS;GACb;EACJ;EAEA,IAAI,CAACd,UAAUX,UAAU;GACrB,MAAMkB,eAAe,KAAKC,gBAAgBxD,KAAAA;GAC1C,IAAIuD,cACAP,UAAUX,WAAWkB;EAE7B;EAEA,MAAMvD,MAAMC,oBAAoBwD,SAAS;GACrCtD,MAAMb,eAAewD;GACrBvC,MAAMxB,iBAAiB;KAAGD,kBAAkBmC,aAAa+B;IAAW,GAAG,KAAK9B,mBAAmB8B,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEApC,SAAS,KAAKlB,WAAWmC,OAAOmB,SAAAA;EAEhC,IAAIpC,OAAO+C,iBAAiB;GACxB,IAAI,CAACX,UAAUnC,QACXmC,UAAUnC,SAASyC,mBAAmBM,eAAc;GAGxDhD,OAAOC,SAAS,MAAMyC,mBAAmBO,QAAQb,UAAUnC,QAAQmC,SAAAA;EACvE,OACIpC,OAAOC,SAAS;EAGpB,MAAM,KAAKnB,WAAWoC,KAAKlB,MAAAA;EAE3B,OAAO;GACHA;GACAkD,SAAS;EACb;CACJ;CAEA,MAAMC,OACFpC,IACA3B,OACe;EACf,MAAMA,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAegB,cAAc,CAAA;EAEjF,MAAMM,SAAS,MAAM,KAAKlB,WAAWsE,UAAU,EAAErC,GAAG,CAAA;EACpD,IAAI,CAACf,QACD,MAAM,IAAIzB,oBAAAA;EAGd,MAAMa,MAAMC,oBAAoBwD,SAAS;GACrCtD,MAAMb,eAAegB;GACrBC,MAAMxB,iBAAiB;KAAGD,kBAAkBmC,aAAaL;IAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEe,IAAIsC,aAAarD;EACzB,MAAM,KAAKlB,WAAWwE,OAAOtD,MAAAA;EAC7BA,OAAOe,KAAKsC;EAEZ,OAAOrD;CACX;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isUUID","EntityNotFoundError","ValidationError","CLIENT_RESERVED_NAMES","ClientAuthMethod","ClientValidator","PermissionName","AbstractEntityService","ClientCredentialsService","ClientService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","CLIENT_READ","CLIENT_UPDATE","CLIENT_DELETE","data","entities","meta","findMany","total","entity","secret","secret_encrypted","secret_hashed","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","push","getOne","idOrName","realmId","permissionNames","isMe","identity","type","id","findOne","create","save","undefined","update","updateOnly","options","group","realm","realm_id","resolve","where","findOneWithSecret","isSelfEdit","preEvaluate","e","CLIENT_SELF_MANAGE","UPDATE","CLIENT_CREATE","CREATE","validated","run","includes","built_in","validateJoinColumns","checkUniqueness","credentialsService","actorRealmId","getActorRealmId","evaluate","merge","auth_method","SECRET","generateSecret","protect","created","delete","findOneBy","entityId","remove"],"sources":["../../../../src/core/entities/client/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport {\n    CLIENT_RESERVED_NAMES,\n    ClientAuthMethod,\n    ClientValidator,\n    PermissionName,\n} from '@authup/core-kit';\nimport type { Client } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { ClientCredentialsService } from '../../authentication/credential/entities/client/module.ts';\nimport type { IClientRepository, IClientService } from './types.ts';\n\nexport type ClientServiceContext = {\n    repository: IClientRepository;\n    realmRepository: IRealmRepository;\n};\n\nexport class ClientService extends AbstractEntityService implements IClientService {\n    protected repository: IClientRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected validator: ClientValidator;\n\n    constructor(ctx: ClientServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.validator = new ClientValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Client>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.CLIENT_READ,\n                PermissionName.CLIENT_UPDATE,\n                PermissionName.CLIENT_DELETE,\n            ],\n        });\n\n        const {\n            data: entities, \n            meta, \n        } = await this.repository.findMany(query);\n        let { total } = meta;\n\n        const data: Client[] = [];\n        for (const entity of entities) {\n            if (\n                entity.secret &&\n                !entity.secret_encrypted &&\n                !entity.secret_hashed\n            ) {\n                try {\n                    await actor.permissionEvaluator.evaluateOneOf({\n                        name: [\n                            PermissionName.CLIENT_READ,\n                            PermissionName.CLIENT_UPDATE,\n                            PermissionName.CLIENT_DELETE,\n                        ],\n                        data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n                    });\n                    data.push(entity);\n                } catch {\n                    total -= 1;\n                }\n\n                continue;\n            }\n\n            data.push(entity);\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total, \n            }, \n        };\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        query?: Record<string, any>,\n        realmId?: string,\n    ): Promise<Client> {\n        const permissionNames = [\n            PermissionName.CLIENT_READ,\n            PermissionName.CLIENT_UPDATE,\n            PermissionName.CLIENT_DELETE,\n        ];\n\n        let isMe = !!actor.identity &&\n            actor.identity.type === 'client' &&\n            (\n                actor.identity.data.id === idOrName ||\n                actor.identity.data.name === idOrName\n            );\n\n        if (!isMe) {\n            await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n        }\n\n        const entity = await this.repository.findOne(idOrName, query, realmId);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (isMe && actor.identity!.data.id !== entity.id) {\n            isMe = false;\n            await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n        }\n\n        if (\n            !isMe &&\n            entity.secret &&\n            !entity.secret_encrypted &&\n            !entity.secret_hashed\n        ) {\n            await actor.permissionEvaluator.evaluateOneOf({\n                name: permissionNames,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n            });\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Client> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Client> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Client,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realm_id === 'string' ?\n            await this.realmRepository.resolve(data.realm_id) :\n            undefined;\n\n        let entity: Client | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realm_id = realm.id;\n            }\n\n            entity = await this.repository.findOneWithSecret(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        let isSelfEdit = false;\n        if (entity) {\n            try {\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_UPDATE });\n            } catch (e) {\n                if (\n                    !actor.identity ||\n                    actor.identity.type !== 'client' ||\n                    actor.identity.data.id !== entity.id\n                ) {\n                    throw e;\n                }\n                isSelfEdit = true;\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SELF_MANAGE });\n            }\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        // Reserve the system-provisioned client names (`system`, `web`) so an\n        // API caller can't create or rename a client onto them — that would\n        // collide on unique(name, realm_id) or shadow the built_in client.\n        // Provisioning and runtime hooks bypass this service, so they remain\n        // free to manage the reserved clients. built_in clients are exempt\n        // (they ARE the provisioned ones) but API callers can never produce a\n        // built_in client since the validator strips the flag.\n        if (\n            typeof validated.name === 'string' &&\n            CLIENT_RESERVED_NAMES.includes(validated.name) &&\n            !(entity && entity.built_in && entity.name === validated.name)\n        ) {\n            throw new ValidationError(`The client name '${validated.name}' is reserved.`);\n        }\n\n        await this.repository.validateJoinColumns(validated);\n        await this.repository.checkUniqueness(validated, entity || undefined);\n\n        const credentialsService = new ClientCredentialsService();\n\n        if (entity) {\n            if (\n                !isSelfEdit &&\n                !validated.realm_id &&\n                !entity.realm_id\n            ) {\n                const actorRealmId = this.getActorRealmId(actor);\n                if (actorRealmId) {\n                    validated.realm_id = actorRealmId;\n                }\n            }\n\n            if (isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.CLIENT_SELF_MANAGE,\n                    data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n                });\n            }\n\n            entity = this.repository.merge(entity, validated);\n\n            if (!isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.CLIENT_UPDATE,\n                    data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n                });\n            }\n\n            if (entity.auth_method === ClientAuthMethod.SECRET) {\n                if (!validated.secret && !entity.secret) {\n                    validated.secret = credentialsService.generateSecret();\n                }\n\n                if (validated.secret) {\n                    entity.secret = await credentialsService.protect(validated.secret, entity);\n                }\n            } else {\n                entity.secret = null;\n                entity.secret_hashed = false;\n                entity.secret_encrypted = false;\n            }\n\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!validated.realm_id) {\n            const actorRealmId = this.getActorRealmId(actor);\n            if (actorRealmId) {\n                validated.realm_id = actorRealmId;\n            }\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n        });\n\n        entity = this.repository.create(validated);\n\n        if (entity.auth_method === ClientAuthMethod.SECRET) {\n            if (!validated.secret) {\n                validated.secret = credentialsService.generateSecret();\n            }\n\n            entity.secret = await credentialsService.protect(validated.secret, validated);\n        } else {\n            entity.secret = null;\n            entity.secret_hashed = false;\n            entity.secret_encrypted = false;\n        }\n\n        await this.repository.save(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Client> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;AA4BA,IAAaY,gBAAb,cAAmCF,sBAAAA;CACrBG;CAEAC;CAEAC;CAEV,YAAYC,KAA2B;EACnC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIP,gBAAAA;CACzB;CAEA,MAAMS,QACFC,OACAC,OAC+C;EAC/C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFb,eAAec;GACfd,eAAee;GACff,eAAegB;IAEvB,CAAA;EAEA,MAAM,EACFC,MAAMC,UACNC,SACA,MAAM,KAAKf,WAAWgB,SAASX,KAAAA;EACnC,IAAI,EAAEY,UAAUF;EAEhB,MAAMF,OAAiB,CAAA;EACvB,KAAK,MAAMK,UAAUJ,UAAU;GAC3B,IACII,OAAOC,UACP,CAACD,OAAOE,oBACR,CAACF,OAAOG,eACV;IACE,IAAI;KACA,MAAMf,MAAMC,oBAAoBe,cAAc;MAC1Cb,MAAM;OACFb,eAAec;OACfd,eAAee;OACff,eAAegB;;MAEnBC,MAAMzB,iBAAiB;QAAGD,kBAAkBoC,aAAaL;OAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;MAAQ,CAAA;KACxG,CAAA;KACAL,KAAKY,KAAKP,MAAAA;IACd,QAAQ;KACJD,SAAS;IACb;IAEA;GACJ;GAEAJ,KAAKY,KAAKP,MAAAA;EACd;EAEA,OAAO;GACHL;GACAE,MAAM;IACF,GAAGA;IACHE;GACJ;EACJ;CACJ;CAEA,MAAMS,OACFC,UACArB,OACAD,OACAuB,SACe;EACf,MAAMC,kBAAkB;GACpBjC,eAAec;GACfd,eAAee;GACff,eAAegB;;EAGnB,IAAIkB,OAAO,CAAC,CAACxB,MAAMyB,YACfzB,MAAMyB,SAASC,SAAS,aAEpB1B,MAAMyB,SAASlB,KAAKoB,OAAON,YAC3BrB,MAAMyB,SAASlB,KAAKJ,SAASkB;EAGrC,IAAI,CAACG,MACD,MAAMxB,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMoB,gBAAgB,CAAA;EAG7E,MAAMX,SAAS,MAAM,KAAKlB,WAAWkC,QAAQP,UAAUtB,OAAOuB,OAAAA;EAC9D,IAAI,CAACV,QACD,MAAM,IAAI3B,oBAAAA;EAGd,IAAIuC,QAAQxB,MAAMyB,SAAUlB,KAAKoB,OAAOf,OAAOe,IAAI;GAC/CH,OAAO;GACP,MAAMxB,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMoB,gBAAgB,CAAA;EAC7E;EAEA,IACI,CAACC,QACDZ,OAAOC,UACP,CAACD,OAAOE,oBACR,CAACF,OAAOG,eAER,MAAMf,MAAMC,oBAAoBe,cAAc;GAC1Cb,MAAMoB;GACNhB,MAAMzB,iBAAiB;KAAGD,kBAAkBoC,aAAaL;IAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,OAAOA;CACX;CAEA,MAAMiB,OACFtB,MACAP,OACe;EACf,MAAM,EAAEY,WAAW,MAAM,KAAKkB,KAAKC,KAAAA,GAAWxB,MAAMP,KAAAA;EACpD,OAAOY;CACX;CAEA,MAAMoB,OACFX,UACAd,MACAP,OACe;EACf,MAAM,EAAEY,WAAW,MAAM,KAAKkB,KAAKT,UAAUd,MAAMP,OAAO,EAAEiC,YAAY,KAAK,CAAA;EAC7E,OAAOrB;CACX;CAEA,MAAMkB,KACFT,UACAd,MACAP,OACAkC,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAO7B,KAAK8B,aAAa,WACnC,MAAM,KAAK1C,gBAAgB2C,QAAQ/B,KAAK8B,QAAQ,IAChDN,KAAAA;EAEJ,IAAInB;EACJ,IAAIS,UAAU;GACV,MAAMkB,QAA6B,CAAC;GACpC,IAAIvD,OAAOqC,QAAAA,GACPkB,MAAMZ,KAAKN;QAEXkB,MAAMpC,OAAOkB;GAGjB,IAAIe,OACAG,MAAMF,WAAWD,MAAMT;GAG3Bf,SAAS,MAAM,KAAKlB,WAAW8C,kBAAkBD,KAAAA;GACjD,IAAI,CAAC3B,UAAUsB,QAAQD,YACnB,MAAM,IAAIhD,oBAAAA;EAElB,OAAO,IAAIiD,QAAQD,YACf,MAAM,IAAIhD,oBAAAA;EAGd,IAAIwD,aAAa;EACjB,IAAI7B,QAAQ;GACR,IAAI;IACA,MAAMZ,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAee,cAAc,CAAA;GACrF,SAASsC,GAAG;IACR,IACI,CAAC3C,MAAMyB,YACPzB,MAAMyB,SAASC,SAAS,YACxB1B,MAAMyB,SAASlB,KAAKoB,OAAOf,OAAOe,IAElC,MAAMgB;IAEVF,aAAa;IACb,MAAMzC,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAesD,mBAAmB,CAAA;GAC1F;GACAT,QAAQpD,eAAe8D;EAC3B,OAAO;GACH,MAAM7C,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAewD,cAAc,CAAA;GACjFX,QAAQpD,eAAegE;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKpD,UAAUqD,IAAI1C,MAAM,EAAE4B,MAAM,CAAA;EASzD,IACI,OAAOa,UAAU7C,SAAS,YAC1BhB,sBAAsB+D,SAASF,UAAU7C,IAAI,KAC7C,EAAES,UAAUA,OAAOuC,YAAYvC,OAAOT,SAAS6C,UAAU7C,OAEzD,MAAM,IAAIjB,gBAAgB,oBAAoB8D,UAAU7C,KAAK,eAAe;EAGhF,MAAM,KAAKT,WAAW0D,oBAAoBJ,SAAAA;EAC1C,MAAM,KAAKtD,WAAW2D,gBAAgBL,WAAWpC,UAAUmB,KAAAA,CAAAA;EAE3D,MAAMuB,qBAAqB,IAAI9D,yBAAAA;EAE/B,IAAIoB,QAAQ;GACR,IACI,CAAC6B,cACD,CAACO,UAAUX,YACX,CAACzB,OAAOyB,UACV;IACE,MAAMkB,eAAe,KAAKC,gBAAgBxD,KAAAA;IAC1C,IAAIuD,cACAP,UAAUX,WAAWkB;GAE7B;GAEA,IAAId,YACA,MAAMzC,MAAMC,oBAAoBwD,SAAS;IACrCtD,MAAMb,eAAesD;IACrBrC,MAAMzB,iBAAiB;MAAGD,kBAAkBoC,aAAa+B;KAAW,GAAG,KAAK9B,mBAAmB8B,SAAAA;IAAW,CAAA;GAC9G,CAAA;GAGJpC,SAAS,KAAKlB,WAAWgE,MAAM9C,QAAQoC,SAAAA;GAEvC,IAAI,CAACP,YACD,MAAMzC,MAAMC,oBAAoBwD,SAAS;IACrCtD,MAAMb,eAAee;IACrBE,MAAMzB,iBAAiB;MAAGD,kBAAkBoC,aAAaL;KAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;IAAQ,CAAA;GACxG,CAAA;GAGJ,IAAIA,OAAO+C,gBAAgBvE,iBAAiBwE,QAAQ;IAChD,IAAI,CAACZ,UAAUnC,UAAU,CAACD,OAAOC,QAC7BmC,UAAUnC,SAASyC,mBAAmBO,eAAc;IAGxD,IAAIb,UAAUnC,QACVD,OAAOC,SAAS,MAAMyC,mBAAmBQ,QAAQd,UAAUnC,QAAQD,MAAAA;GAE3E,OAAO;IACHA,OAAOC,SAAS;IAChBD,OAAOG,gBAAgB;IACvBH,OAAOE,mBAAmB;GAC9B;GAEA,MAAM,KAAKpB,WAAWoC,KAAKlB,MAAAA;GAE3B,OAAO;IACHA;IACAmD,SAAS;GACb;EACJ;EAEA,IAAI,CAACf,UAAUX,UAAU;GACrB,MAAMkB,eAAe,KAAKC,gBAAgBxD,KAAAA;GAC1C,IAAIuD,cACAP,UAAUX,WAAWkB;EAE7B;EAEA,MAAMvD,MAAMC,oBAAoBwD,SAAS;GACrCtD,MAAMb,eAAewD;GACrBvC,MAAMzB,iBAAiB;KAAGD,kBAAkBoC,aAAa+B;IAAW,GAAG,KAAK9B,mBAAmB8B,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEApC,SAAS,KAAKlB,WAAWmC,OAAOmB,SAAAA;EAEhC,IAAIpC,OAAO+C,gBAAgBvE,iBAAiBwE,QAAQ;GAChD,IAAI,CAACZ,UAAUnC,QACXmC,UAAUnC,SAASyC,mBAAmBO,eAAc;GAGxDjD,OAAOC,SAAS,MAAMyC,mBAAmBQ,QAAQd,UAAUnC,QAAQmC,SAAAA;EACvE,OAAO;GACHpC,OAAOC,SAAS;GAChBD,OAAOG,gBAAgB;GACvBH,OAAOE,mBAAmB;EAC9B;EAEA,MAAM,KAAKpB,WAAWoC,KAAKlB,MAAAA;EAE3B,OAAO;GACHA;GACAmD,SAAS;EACb;CACJ;CAEA,MAAMC,OACFrC,IACA3B,OACe;EACf,MAAMA,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAegB,cAAc,CAAA;EAEjF,MAAMM,SAAS,MAAM,KAAKlB,WAAWuE,UAAU,EAAEtC,GAAG,CAAA;EACpD,IAAI,CAACf,QACD,MAAM,IAAI3B,oBAAAA;EAGd,MAAMe,MAAMC,oBAAoBwD,SAAS;GACrCtD,MAAMb,eAAegB;GACrBC,MAAMzB,iBAAiB;KAAGD,kBAAkBoC,aAAaL;IAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEe,IAAIuC,aAAatD;EACzB,MAAM,KAAKlB,WAAWyE,OAAOvD,MAAAA;EAC7BA,OAAOe,KAAKuC;EAEZ,OAAOtD;CACX;AACJ"}

package/dist/core/entities/client/web-client.d.ts

@@ -15,9 +15,11 @@ export type WebClientProvisionerContext = {
  * `global` scope lets the issued token drive the management API (parity
  * with the legacy password-grant admin login); `openid` for the id-token.
  *
- * `grant_types` is metadata only — the auth-code grant issues a refresh
- * token regardless — but it documents the intended flow. `redirect_uri` is
- * one `<origin>/**` wildcard per trusted origin (matched by isSimpleMatch).
+ * `grant_types` is an enforced allowlist (`assertClientGrantAllowed` at the
+ * /token grants and the /authorize code-request verifier; null = allow-all),
+ * so it must list every flow the client uses. `redirect_uri` and
+ * `post_logout_redirect_uri` are each one `<origin>/**` wildcard per trusted
+ * origin (matched by isSimpleMatch).
  */
 export declare function buildWebClientAttributes(realm: Realm | {
     id: string;

package/dist/core/entities/client/web-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"web-client.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/web-client.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAE3E,MAAM,MAAM,2BAA2B,GAAG;IACtC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACpC,KAAK,EAAE,KAAK,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC7B,UAAU,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,MAAM,CAAC,CAWjB;AAED,qBAAa,oBAAqB,YAAW,qBAAqB;IAC9D,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAE/B,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,2BAA2B;IAMtC,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAsCrE"}
+{"version":3,"file":"web-client.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/web-client.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAE3E,MAAM,MAAM,2BAA2B,GAAG;IACtC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CACpC,KAAK,EAAE,KAAK,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC7B,UAAU,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,MAAM,CAAC,CAejB;AAED,qBAAa,oBAAqB,YAAW,qBAAqB;IAC9D,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAE/B,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,2BAA2B;IAMtC,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAsCrE"}