@authup/server-core 1.0.0-beta.51 → 1.0.0-beta.53

package/dist/core/oauth2/grant-types/password.mjs

@@ -1,19 +1,24 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { deriveAmrAcr } from "../authorization/helpers.mjs";
 import { OAuth2BaseGrant } from "./base.mjs";
 import { buildOAuth2BearerTokenResponse } from "../response/bearer.mjs";
-import { IdentityType, ScopeName } from "@authup/core-kit";
-import { OAuth2SubKind } from "@authup/specs";
+import { EventName, EventRefType, EventScope, IdentityType, ScopeName, SessionAuthMethod } from "@authup/core-kit";
+import { OAuth2SubKind, OAuth2TokenGrant } from "@authup/specs";
 //#region src/core/oauth2/grant-types/password.ts
 var PasswordGrantType = class extends OAuth2BaseGrant {
 	refreshTokenIssuer;
+	eventService;
+	metrics;
 	constructor(ctx) {
 		super({
 			accessTokenIssuer: ctx.accessTokenIssuer,
 			sessionManager: ctx.sessionManager
 		});
 		this.refreshTokenIssuer = ctx.refreshTokenIssuer;
+		this.eventService = ctx.eventService;
+		this.metrics = ctx.metrics;
 	}
 	async runWith(input, options = {}) {
 		const { user, client } = input;
@@ -24,8 +29,11 @@ var PasswordGrantType = class extends OAuth2BaseGrant {
 			realm_id: user.realm_id,
 			client_id: clientId,
 			sub: user.id,
-			sub_kind: IdentityType.USER
+			sub_kind: IdentityType.USER,
+			mfa_at: input.mfaVerifiedAt ?? null,
+			auth_method: SessionAuthMethod.PASSWORD
 		});
+		const amrAcr = deriveAmrAcr(session);
 		const issuePayload = {
 			client_id: clientId,
 			session_id: session.id,
@@ -35,10 +43,30 @@ var PasswordGrantType = class extends OAuth2BaseGrant {
 			sub: user.id,
 			sub_kind: OAuth2SubKind.USER,
 			realm_id: user.realm_id,
-			realm_name: user.realm?.name
+			realm_name: user.realm?.name,
+			...options.confirmation ? { cnf: options.confirmation } : {},
+			...amrAcr
 		};
 		const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);
 		const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);
+		await this.eventService?.record({
+			scope: EventScope.OAUTH2,
+			name: EventName.LOGIN,
+			refType: EventRefType.SESSION,
+			refId: session.id,
+			clientId: clientId ?? null,
+			actorType: IdentityType.USER,
+			actorId: user.id,
+			actorName: user.name,
+			realmId: user.realm_id,
+			requestIpAddress: options.ipAddress ?? null,
+			requestUserAgent: options.userAgent ?? null,
+			data: {
+				grant_type: OAuth2TokenGrant.PASSWORD,
+				session_id: session.id
+			}
+		});
+		this.metrics?.recordLogin("success");
 		return buildOAuth2BearerTokenResponse({
 			accessToken,
 			accessTokenPayload,

package/dist/core/oauth2/grant-types/password.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"password.mjs","names":["OAuth2SubKind","IdentityType","ScopeName","buildOAuth2BearerTokenResponse","OAuth2BaseGrant","PasswordGrantType","refreshTokenIssuer","ctx","accessTokenIssuer","sessionManager","runWith","input","options","user","client","clientId","id","session","create","user_agent","userAgent","ip_address","ipAddress","realm_id","client_id","sub","sub_kind","USER","issuePayload","session_id","remote_address","scope","GLOBAL","realm_name","realm","name","accessToken","accessTokenPayload","issue","refreshToken","refreshTokenPayload"],"sources":["../../../../src/core/oauth2/grant-types/password.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2SubKind } from '@authup/specs';\nimport type { Client, User } from '@authup/core-kit';\nimport {\n    IdentityType,\n    ScopeName,\n} from '@authup/core-kit';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { IOAuth2TokenIssuer } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport type { OAuth2GrantRunWIthOptions, OAuth2PasswordGrantContext } from './types.ts';\n\nexport type OAuth2PasswordGrantInput = {\n    user: User,\n    client?: Client,\n};\n\nexport class PasswordGrantType extends OAuth2BaseGrant<OAuth2PasswordGrantInput> {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    constructor(ctx: OAuth2PasswordGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n    }\n\n    async runWith(input: OAuth2PasswordGrantInput, options: OAuth2GrantRunWIthOptions = {}) : Promise<OAuth2TokenGrantResponse> {\n        const { user, client } = input;\n        const clientId = client?.id;\n\n        const session = await this.sessionManager.create({\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: user.realm_id,\n            client_id: clientId,\n            sub: user.id,\n            sub_kind: IdentityType.USER,\n        });\n\n        const issuePayload : Partial<OAuth2TokenPayload> = {\n            client_id: clientId,\n            session_id: session.id,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            scope: ScopeName.GLOBAL,\n            sub: user.id,\n            sub_kind: OAuth2SubKind.USER,\n            realm_id: user.realm_id,\n            realm_name: user.realm?.name,\n        };\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;;;;AAwBA,IAAaK,oBAAb,cAAuCD,gBAAAA;CACzBE;CAEV,YAAYC,KAAiC;EACzC,MAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;EACxB,CAAA;EAEA,KAAKH,qBAAqBC,IAAID;CAClC;CAEA,MAAMI,QAAQC,OAAiCC,UAAqC,CAAC,GAAuC;EACxH,MAAM,EAAEC,MAAMC,WAAWH;EACzB,MAAMI,WAAWD,QAAQE;EAEzB,MAAMC,UAAU,MAAM,KAAKR,eAAeS,OAAO;GAC7CC,YAAYP,QAAQQ;GACpBC,YAAYT,QAAQU;GACpBC,UAAUV,KAAKU;GACfC,WAAWT;GACXU,KAAKZ,KAAKG;GACVU,UAAUzB,aAAa0B;EAC3B,CAAA;EAEA,MAAMC,eAA6C;GAC/CJ,WAAWT;GACXc,YAAYZ,QAAQD;GACpBG,YAAYF,QAAQE;GACpBW,gBAAgBb,QAAQI;GACxBU,OAAO7B,UAAU8B;GACjBP,KAAKZ,KAAKG;GACVU,UAAU1B,cAAc2B;GACxBJ,UAAUV,KAAKU;GACfU,YAAYpB,KAAKqB,OAAOC;EAC5B;EAEA,MAAM,CAACC,aAAaC,sBAAsB,MAAM,KAAK7B,kBAAkB8B,MAAMV,YAAAA;EAC7E,MAAM,CAACW,cAAcC,uBAAuB,MAAM,KAAKlC,mBAAmBgC,MAAMV,YAAAA;EAEhF,OAAOzB,+BAA+B;GAClCiC;GACAC;GACAE;GACAC;EACJ,CAAA;CACJ;AACJ"}
+{"version":3,"file":"password.mjs","names":["OAuth2SubKind","OAuth2TokenGrant","EventName","EventRefType","EventScope","IdentityType","ScopeName","SessionAuthMethod","deriveAmrAcr","buildOAuth2BearerTokenResponse","OAuth2BaseGrant","PasswordGrantType","refreshTokenIssuer","eventService","metrics","ctx","accessTokenIssuer","sessionManager","runWith","input","options","user","client","clientId","id","session","create","user_agent","userAgent","ip_address","ipAddress","realm_id","client_id","sub","sub_kind","USER","mfa_at","mfaVerifiedAt","auth_method","PASSWORD","amrAcr","issuePayload","session_id","remote_address","scope","GLOBAL","realm_name","realm","name","confirmation","cnf","accessToken","accessTokenPayload","issue","refreshToken","refreshTokenPayload","record","OAUTH2","LOGIN","refType","SESSION","refId","actorType","actorId","actorName","realmId","requestIpAddress","requestUserAgent","data","grant_type","recordLogin"],"sources":["../../../../src/core/oauth2/grant-types/password.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2SubKind, OAuth2TokenGrant } from '@authup/specs';\nimport type { Client, User } from '@authup/core-kit';\nimport {\n    EventName,\n    EventRefType,\n    EventScope,\n    IdentityType,\n    ScopeName,\n    SessionAuthMethod,\n} from '@authup/core-kit';\nimport type { IEventService } from '../../entities/index.ts';\nimport type { IAuthFlowMetrics } from '../../metrics/index.ts';\nimport { deriveAmrAcr } from '../authorization/helpers.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { IOAuth2TokenIssuer } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport type { OAuth2GrantRunWIthOptions, OAuth2PasswordGrantContext } from './types.ts';\n\nexport type OAuth2PasswordGrantInput = {\n    user: User,\n    client?: Client,\n    /**\n     * Instant the user passed a second-factor challenge alongside the\n     * grant (the `otp` parameter) — stamped onto the session as mfa_at.\n     */\n    mfaVerifiedAt?: string,\n};\n\nexport class PasswordGrantType extends OAuth2BaseGrant<OAuth2PasswordGrantInput> {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    protected eventService? : IEventService;\n\n    protected metrics? : IAuthFlowMetrics;\n\n    constructor(ctx: OAuth2PasswordGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n        this.eventService = ctx.eventService;\n        this.metrics = ctx.metrics;\n    }\n\n    async runWith(input: OAuth2PasswordGrantInput, options: OAuth2GrantRunWIthOptions = {}) : Promise<OAuth2TokenGrantResponse> {\n        const { user, client } = input;\n        const clientId = client?.id;\n\n        const session = await this.sessionManager.create({\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: user.realm_id,\n            client_id: clientId,\n            sub: user.id,\n            sub_kind: IdentityType.USER,\n            mfa_at: input.mfaVerifiedAt ?? null,\n            auth_method: SessionAuthMethod.PASSWORD,\n        });\n\n        // amr/acr derive from the session's auth_method + mfa_at — deliberately\n        // on every token kind, so a direct password grant's tokens advertise the\n        // method the same way the authorization_code exchange does.\n        const amrAcr = deriveAmrAcr(session);\n\n        const issuePayload : Partial<OAuth2TokenPayload> = {\n            client_id: clientId,\n            session_id: session.id,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            scope: ScopeName.GLOBAL,\n            sub: user.id,\n            sub_kind: OAuth2SubKind.USER,\n            realm_id: user.realm_id,\n            realm_name: user.realm?.name,\n            ...(options.confirmation ? { cnf: options.confirmation } : {}),\n            ...amrAcr,\n        };\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);\n\n        await this.eventService?.record({\n            scope: EventScope.OAUTH2,\n            name: EventName.LOGIN,\n            refType: EventRefType.SESSION,\n            refId: session.id,\n            clientId: clientId ?? null,\n            actorType: IdentityType.USER,\n            actorId: user.id,\n            actorName: user.name,\n            realmId: user.realm_id,\n            requestIpAddress: options.ipAddress ?? null,\n            requestUserAgent: options.userAgent ?? null,\n            data: {\n                grant_type: OAuth2TokenGrant.PASSWORD,\n                session_id: session.id,\n            },\n        });\n        this.metrics?.recordLogin('success');\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;AAoCA,IAAaW,oBAAb,cAAuCD,gBAAAA;CACzBE;CAEAC;CAEAC;CAEV,YAAYC,KAAiC;EACzC,MAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;EACxB,CAAA;EAEA,KAAKL,qBAAqBG,IAAIH;EAC9B,KAAKC,eAAeE,IAAIF;EACxB,KAAKC,UAAUC,IAAID;CACvB;CAEA,MAAMI,QAAQC,OAAiCC,UAAqC,CAAC,GAAuC;EACxH,MAAM,EAAEC,MAAMC,WAAWH;EACzB,MAAMI,WAAWD,QAAQE;EAEzB,MAAMC,UAAU,MAAM,KAAKR,eAAeS,OAAO;GAC7CC,YAAYP,QAAQQ;GACpBC,YAAYT,QAAQU;GACpBC,UAAUV,KAAKU;GACfC,WAAWT;GACXU,KAAKZ,KAAKG;GACVU,UAAU7B,aAAa8B;GACvBC,QAAQjB,MAAMkB,iBAAiB;GAC/BC,aAAa/B,kBAAkBgC;EACnC,CAAA;EAKA,MAAMC,SAAShC,aAAaiB,OAAAA;EAE5B,MAAMgB,eAA6C;GAC/CT,WAAWT;GACXmB,YAAYjB,QAAQD;GACpBG,YAAYF,QAAQE;GACpBgB,gBAAgBlB,QAAQI;GACxBe,OAAOtC,UAAUuC;GACjBZ,KAAKZ,KAAKG;GACVU,UAAUlC,cAAcmC;GACxBJ,UAAUV,KAAKU;GACfe,YAAYzB,KAAK0B,OAAOC;GACxB,GAAI5B,QAAQ6B,eAAe,EAAEC,KAAK9B,QAAQ6B,aAAa,IAAI,CAAC;GAC5D,GAAGT;EACP;EAEA,MAAM,CAACW,aAAaC,sBAAsB,MAAM,KAAKpC,kBAAkBqC,MAAMZ,YAAAA;EAC7E,MAAM,CAACa,cAAcC,uBAAuB,MAAM,KAAK3C,mBAAmByC,MAAMZ,YAAAA;EAEhF,MAAM,KAAK5B,cAAc2C,OAAO;GAC5BZ,OAAOxC,WAAWqD;GAClBT,MAAM9C,UAAUwD;GAChBC,SAASxD,aAAayD;GACtBC,OAAOpC,QAAQD;GACfD,UAAUA,YAAY;GACtBuC,WAAWzD,aAAa8B;GACxB4B,SAAS1C,KAAKG;GACdwC,WAAW3C,KAAK2B;GAChBiB,SAAS5C,KAAKU;GACdmC,kBAAkB9C,QAAQU,aAAa;GACvCqC,kBAAkB/C,QAAQQ,aAAa;GACvCwC,MAAM;IACFC,YAAYpE,iBAAiBsC;IAC7BG,YAAYjB,QAAQD;GACxB;EACJ,CAAA;EACA,KAAKV,SAASwD,YAAY,SAAA;EAE1B,OAAO7D,+BAA+B;GAClC0C;GACAC;GACAE;GACAC;EACJ,CAAA;CACJ;AACJ"}

package/dist/core/oauth2/grant-types/refresh-token.d.ts

@@ -1,12 +1,35 @@
 import type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';
-import type { IOAuth2TokenIssuer, IOAuth2TokenRevoker, IOAuth2TokenVerifier } from '../token/index.ts';
+import type { Logger } from '@authup/server-kit';
+import type { IEventService } from '../../entities/index.ts';
+import type { IAuthFlowMetrics } from '../../metrics/index.ts';
+import type { ISessionTokenRepository } from '../session-token/index.ts';
+import type { IOAuth2TokenIssuer, IOAuth2TokenRepository, IOAuth2TokenVerifier } from '../token/index.ts';
 import { OAuth2BaseGrant } from './base.ts';
 import type { IOAuth2Grant, OAuth2GrantRunWIthOptions, OAuth2RefreshTokenGrantContext } from './types.ts';
 export declare class OAuth2RefreshTokenGrant extends OAuth2BaseGrant<string | OAuth2TokenPayload> implements IOAuth2Grant {
     protected refreshTokenIssuer: IOAuth2TokenIssuer;
     protected tokenVerifier: IOAuth2TokenVerifier;
-    protected tokenRevoker: IOAuth2TokenRevoker;
+    protected tokenRepository: IOAuth2TokenRepository;
+    protected sessionTokenRepository: ISessionTokenRepository;
+    protected eventService?: IEventService;
+    protected metrics?: IAuthFlowMetrics;
+    protected logger?: Logger;
+    protected gracePeriod: number;
     constructor(ctx: OAuth2RefreshTokenGrantContext);
     runWith(input: string | OAuth2TokenPayload, options?: OAuth2GrantRunWIthOptions): Promise<OAuth2TokenGrantResponse>;
+    /**
+     * The grace window (opt-in via `tokenRefreshGracePeriod`) absorbs benign
+     * concurrent / multi-tab refreshes of the SAME still-current token. It is
+     * scoped to the chain tip: a token whose descendant has already been
+     * consumed is a stale ancestor (a real replay), never a grace re-use.
+     */
+    protected isWithinGraceWindow(jti: string, now: Date): Promise<boolean>;
+    /**
+     * RFC 6819 §5.2.2.3 reaction strategy — revoke the whole token family
+     * (the auth_sessions row) on replay: soft-revoke every session-token row,
+     * blocklist their jtis in the cache, and delete the session so its access
+     * tokens stop verifying on authup's own API.
+     */
+    protected revokeFamily(sessionId: string, jti: string, at: string): Promise<void>;
 }
 //# sourceMappingURL=refresh-token.d.ts.map

package/dist/core/oauth2/grant-types/refresh-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refresh-token.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/grant-types/refresh-token.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAGlF,OAAO,KAAK,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACvG,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,YAAY,EAAE,yBAAyB,EAAE,8BAA8B,EAAE,MAAM,YAAY,CAAC;AAE1G,qBAAa,uBAAwB,SAAQ,eAAe,CAAC,MAAM,GAAG,kBAAkB,CAAE,YAAW,YAAY;IAC7G,SAAS,CAAC,kBAAkB,EAAG,kBAAkB,CAAC;IAElD,SAAS,CAAC,aAAa,EAAG,oBAAoB,CAAC;IAE/C,SAAS,CAAC,YAAY,EAAG,mBAAmB,CAAC;gBAEjC,GAAG,EAAE,8BAA8B;IAYzC,OAAO,CACT,KAAK,EAAE,MAAM,GAAG,kBAAkB,EAClC,OAAO,GAAE,yBAA8B,GACvC,OAAO,CAAC,wBAAwB,CAAC;CAkDxC"}
+{"version":3,"file":"refresh-token.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/grant-types/refresh-token.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAGlF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC1G,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,YAAY,EAAE,yBAAyB,EAAE,8BAA8B,EAAE,MAAM,YAAY,CAAC;AAE1G,qBAAa,uBAAwB,SAAQ,eAAe,CAAC,MAAM,GAAG,kBAAkB,CAAE,YAAW,YAAY;IAC7G,SAAS,CAAC,kBAAkB,EAAG,kBAAkB,CAAC;IAElD,SAAS,CAAC,aAAa,EAAG,oBAAoB,CAAC;IAE/C,SAAS,CAAC,eAAe,EAAG,sBAAsB,CAAC;IAEnD,SAAS,CAAC,sBAAsB,EAAG,uBAAuB,CAAC;IAE3D,SAAS,CAAC,YAAY,CAAC,EAAG,aAAa,CAAC;IAExC,SAAS,CAAC,OAAO,CAAC,EAAG,gBAAgB,CAAC;IAEtC,SAAS,CAAC,MAAM,CAAC,EAAG,MAAM,CAAC;IAE3B,SAAS,CAAC,WAAW,EAAG,MAAM,CAAC;gBAEnB,GAAG,EAAE,8BAA8B;IAgBzC,OAAO,CACT,KAAK,EAAE,MAAM,GAAG,kBAAkB,EAClC,OAAO,GAAE,yBAA8B,GACvC,OAAO,CAAC,wBAAwB,CAAC;IAuGrC;;;;;OAKG;cACa,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAI,OAAO,CAAC,OAAO,CAAC;IAqB9E;;;;;OAKG;cACa,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAI,OAAO,CAAC,IAAI,CAAC;CA4B3F"}

package/dist/core/oauth2/grant-types/refresh-token.mjs

@@ -3,12 +3,18 @@ import "node:url";
 import.meta.url;
 import { OAuth2BaseGrant } from "./base.mjs";
 import { buildOAuth2BearerTokenResponse } from "../response/bearer.mjs";
-import { JWTError } from "@authup/specs";
+import { EventName, EventRefType, EventScope } from "@authup/core-kit";
+import { JWTError, OAuth2GrantError, OAuth2TokenKind } from "@authup/specs";
 //#region src/core/oauth2/grant-types/refresh-token.ts
 var OAuth2RefreshTokenGrant = class extends OAuth2BaseGrant {
 	refreshTokenIssuer;
 	tokenVerifier;
-	tokenRevoker;
+	tokenRepository;
+	sessionTokenRepository;
+	eventService;
+	metrics;
+	logger;
+	gracePeriod;
 	constructor(ctx) {
 		super({
 			accessTokenIssuer: ctx.accessTokenIssuer,
@@ -16,31 +22,54 @@ var OAuth2RefreshTokenGrant = class extends OAuth2BaseGrant {
 		});
 		this.refreshTokenIssuer = ctx.refreshTokenIssuer;
 		this.tokenVerifier = ctx.tokenVerifier;
-		this.tokenRevoker = ctx.tokenRevoker;
+		this.tokenRepository = ctx.tokenRepository;
+		this.sessionTokenRepository = ctx.sessionTokenRepository;
+		this.eventService = ctx.eventService;
+		this.metrics = ctx.metrics;
+		this.logger = ctx.logger;
+		this.gracePeriod = ctx.options?.gracePeriod ?? 0;
 	}
 	async runWith(input, options = {}) {
 		let payload;
-		if (typeof input === "string") payload = await this.tokenVerifier.verify(input);
+		if (typeof input === "string") payload = await this.tokenVerifier.verify(input, { skipActiveCheck: true });
 		else payload = input;
-		await this.tokenRevoker.revoke(payload);
+		if (!payload.jti) throw JWTError.payloadPropertyInvalid("jti");
 		if (!payload.session_id) throw JWTError.payloadPropertyInvalid("session_id");
+		if (payload.kind && payload.kind !== OAuth2TokenKind.REFRESH) throw OAuth2GrantError.invalid("unexpected token kind");
+		const row = await this.sessionTokenRepository.findOneById(payload.jti);
+		if (!row || row.kind !== "refresh") throw OAuth2GrantError.invalid("refresh token is unknown");
+		if (row.revoked_at) throw OAuth2GrantError.invalid("refresh token has been revoked");
+		if (row.session_id !== payload.session_id) throw OAuth2GrantError.invalid("refresh token session mismatch");
+		const now = /* @__PURE__ */ new Date();
+		const nowISO = now.toISOString();
+		if (!await this.sessionTokenRepository.markRefreshConsumed(payload.jti, nowISO)) {
+			if (!await this.isWithinGraceWindow(payload.jti, now)) {
+				await this.revokeFamily(row.session_id, payload.jti, nowISO);
+				throw OAuth2GrantError.invalid("refresh token replay detected; session revoked");
+			}
+		}
+		await this.tokenRepository.setInactive(payload.jti, payload.exp);
 		const session = await this.sessionManager.findOneById(payload.session_id);
 		if (!session) throw JWTError.payloadPropertyInvalid("session_id");
 		await this.sessionManager.verify(session);
 		if (options.userAgent) session.user_agent = options.userAgent;
 		if (options.ipAddress) session.ip_address = options.ipAddress;
 		await this.sessionManager.refresh(session);
-		const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({
+		const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue({
 			...payload,
+			...options.confirmation ? { cnf: options.confirmation } : {},
 			user_agent: session.user_agent,
 			remote_address: session.ip_address,
-			exp: this.accessTokenIssuer.buildExp()
+			exp: this.refreshTokenIssuer.buildExp(),
+			parent_id: payload.jti
 		});
-		const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue({
+		const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({
 			...payload,
+			...options.confirmation ? { cnf: options.confirmation } : {},
 			user_agent: session.user_agent,
 			remote_address: session.ip_address,
-			exp: this.refreshTokenIssuer.buildExp()
+			exp: this.accessTokenIssuer.buildExp(),
+			refresh_token_id: refreshTokenPayload.jti
 		});
 		return buildOAuth2BearerTokenResponse({
 			accessToken,
@@ -49,6 +78,39 @@ var OAuth2RefreshTokenGrant = class extends OAuth2BaseGrant {
 			refreshTokenPayload
 		});
 	}
+	/**
+	* The grace window (opt-in via `tokenRefreshGracePeriod`) absorbs benign
+	* concurrent / multi-tab refreshes of the SAME still-current token. It is
+	* scoped to the chain tip: a token whose descendant has already been
+	* consumed is a stale ancestor (a real replay), never a grace re-use.
+	*/ async isWithinGraceWindow(jti, now) {
+		if (this.gracePeriod <= 0) return false;
+		const current = await this.sessionTokenRepository.findOneById(jti);
+		if (!current || current.revoked_at !== null || current.consumed_at === null || now.getTime() - new Date(current.consumed_at).getTime() > this.gracePeriod * 1e3) return false;
+		return !await this.sessionTokenRepository.hasConsumedChild(jti);
+	}
+	/**
+	* RFC 6819 §5.2.2.3 reaction strategy — revoke the whole token family
+	* (the auth_sessions row) on replay: soft-revoke every session-token row,
+	* blocklist their jtis in the cache, and delete the session so its access
+	* tokens stop verifying on authup's own API.
+	*/ async revokeFamily(sessionId, jti, at) {
+		this.logger?.warn("OAuth2 refresh token replay detected; revoking session", {
+			session_id: sessionId,
+			jti
+		});
+		await this.eventService?.record({
+			scope: EventScope.OAUTH2,
+			name: EventName.REFRESH_REPLAY_DETECTED,
+			refType: EventRefType.SESSION,
+			refId: sessionId,
+			data: { jti }
+		});
+		this.metrics?.recordRefreshReplay();
+		const rows = await this.sessionTokenRepository.revokeBySessionId(sessionId, at);
+		await Promise.allSettled(rows.map((row) => this.tokenRepository.setInactive(row.id, Math.floor(new Date(row.expires_at).getTime() / 1e3))));
+		await this.sessionManager.revoke(sessionId);
+	}
 };
 //#endregion
 export { OAuth2RefreshTokenGrant };

package/dist/core/oauth2/grant-types/refresh-token.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"refresh-token.mjs","names":["JWTError","buildOAuth2BearerTokenResponse","OAuth2BaseGrant","OAuth2RefreshTokenGrant","refreshTokenIssuer","tokenVerifier","tokenRevoker","ctx","accessTokenIssuer","sessionManager","runWith","input","options","payload","verify","revoke","session_id","payloadPropertyInvalid","session","findOneById","userAgent","user_agent","ipAddress","ip_address","refresh","accessToken","accessTokenPayload","issue","remote_address","exp","buildExp","refreshToken","refreshTokenPayload"],"sources":["../../../../src/core/oauth2/grant-types/refresh-token.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { JWTError } from '@authup/specs';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { IOAuth2TokenIssuer, IOAuth2TokenRevoker, IOAuth2TokenVerifier } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport type { IOAuth2Grant, OAuth2GrantRunWIthOptions, OAuth2RefreshTokenGrantContext } from './types.ts';\n\nexport class OAuth2RefreshTokenGrant extends OAuth2BaseGrant<string | OAuth2TokenPayload> implements IOAuth2Grant {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    protected tokenVerifier : IOAuth2TokenVerifier;\n\n    protected tokenRevoker : IOAuth2TokenRevoker;\n\n    constructor(ctx: OAuth2RefreshTokenGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n\n        this.tokenVerifier = ctx.tokenVerifier;\n        this.tokenRevoker = ctx.tokenRevoker;\n    }\n\n    async runWith(\n        input: string | OAuth2TokenPayload,\n        options: OAuth2GrantRunWIthOptions = {},\n    ) : Promise<OAuth2TokenGrantResponse> {\n        let payload : OAuth2TokenPayload;\n        if (typeof input === 'string') {\n            payload = await this.tokenVerifier.verify(input);\n        } else {\n            payload = input;\n        }\n\n        await this.tokenRevoker.revoke(payload);\n\n        if (!payload.session_id) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        const session = await this.sessionManager.findOneById(payload.session_id);\n        if (!session) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        await this.sessionManager.verify(session);\n\n        if (options.userAgent) {\n            session.user_agent = options.userAgent;\n        }\n        if (options.ipAddress) {\n            session.ip_address = options.ipAddress;\n        }\n        await this.sessionManager.refresh(session);\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({\n            ...payload,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            exp: this.accessTokenIssuer.buildExp(),\n        });\n\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue({\n            ...payload,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            exp: this.refreshTokenIssuer.buildExp(),\n        });\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;;;AAcA,IAAaG,0BAAb,cAA6CD,gBAAAA;CAC/BE;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;EACxB,CAAA;EAEA,KAAKL,qBAAqBG,IAAIH;EAE9B,KAAKC,gBAAgBE,IAAIF;EACzB,KAAKC,eAAeC,IAAID;CAC5B;CAEA,MAAMI,QACFC,OACAC,UAAqC,CAAC,GACJ;EAClC,IAAIC;EACJ,IAAI,OAAOF,UAAU,UACjBE,UAAU,MAAM,KAAKR,cAAcS,OAAOH,KAAAA;OAE1CE,UAAUF;EAGd,MAAM,KAAKL,aAAaS,OAAOF,OAAAA;EAE/B,IAAI,CAACA,QAAQG,YACT,MAAMhB,SAASiB,uBAAuB,YAAA;EAG1C,MAAMC,UAAU,MAAM,KAAKT,eAAeU,YAAYN,QAAQG,UAAU;EACxE,IAAI,CAACE,SACD,MAAMlB,SAASiB,uBAAuB,YAAA;EAG1C,MAAM,KAAKR,eAAeK,OAAOI,OAAAA;EAEjC,IAAIN,QAAQQ,WACRF,QAAQG,aAAaT,QAAQQ;EAEjC,IAAIR,QAAQU,WACRJ,QAAQK,aAAaX,QAAQU;EAEjC,MAAM,KAAKb,eAAee,QAAQN,OAAAA;EAElC,MAAM,CAACO,aAAaC,sBAAsB,MAAM,KAAKlB,kBAAkBmB,MAAM;GACzE,GAAGd;GACHQ,YAAYH,QAAQG;GACpBO,gBAAgBV,QAAQK;GACxBM,KAAK,KAAKrB,kBAAkBsB,SAAQ;EACxC,CAAA;EAEA,MAAM,CAACC,cAAcC,uBAAuB,MAAM,KAAK5B,mBAAmBuB,MAAM;GAC5E,GAAGd;GACHQ,YAAYH,QAAQG;GACpBO,gBAAgBV,QAAQK;GACxBM,KAAK,KAAKzB,mBAAmB0B,SAAQ;EACzC,CAAA;EAEA,OAAO7B,+BAA+B;GAClCwB;GACAC;GACAK;GACAC;EACJ,CAAA;CACJ;AACJ"}
+{"version":3,"file":"refresh-token.mjs","names":["JWTError","OAuth2GrantError","OAuth2TokenKind","EventName","EventRefType","EventScope","buildOAuth2BearerTokenResponse","OAuth2BaseGrant","OAuth2RefreshTokenGrant","refreshTokenIssuer","tokenVerifier","tokenRepository","sessionTokenRepository","eventService","metrics","logger","gracePeriod","ctx","accessTokenIssuer","sessionManager","options","runWith","input","payload","verify","skipActiveCheck","jti","payloadPropertyInvalid","session_id","kind","REFRESH","invalid","row","findOneById","revoked_at","now","Date","nowISO","toISOString","consumed","markRefreshConsumed","withinGrace","isWithinGraceWindow","revokeFamily","setInactive","exp","session","userAgent","user_agent","ipAddress","ip_address","refresh","refreshToken","refreshTokenPayload","issue","confirmation","cnf","remote_address","buildExp","parent_id","accessToken","accessTokenPayload","refresh_token_id","current","consumed_at","getTime","chainAdvanced","hasConsumedChild","sessionId","at","warn","record","scope","OAUTH2","name","REFRESH_REPLAY_DETECTED","refType","SESSION","refId","data","recordRefreshReplay","rows","revokeBySessionId","Promise","allSettled","map","id","Math","floor","expires_at","revoke"],"sources":["../../../../src/core/oauth2/grant-types/refresh-token.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { JWTError, OAuth2GrantError, OAuth2TokenKind } from '@authup/specs';\nimport { EventName, EventRefType, EventScope } from '@authup/core-kit';\nimport type { Logger } from '@authup/server-kit';\nimport type { IEventService } from '../../entities/index.ts';\nimport type { IAuthFlowMetrics } from '../../metrics/index.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { ISessionTokenRepository } from '../session-token/index.ts';\nimport type { IOAuth2TokenIssuer, IOAuth2TokenRepository, IOAuth2TokenVerifier } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport type { IOAuth2Grant, OAuth2GrantRunWIthOptions, OAuth2RefreshTokenGrantContext } from './types.ts';\n\nexport class OAuth2RefreshTokenGrant extends OAuth2BaseGrant<string | OAuth2TokenPayload> implements IOAuth2Grant {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    protected tokenVerifier : IOAuth2TokenVerifier;\n\n    protected tokenRepository : IOAuth2TokenRepository;\n\n    protected sessionTokenRepository : ISessionTokenRepository;\n\n    protected eventService? : IEventService;\n\n    protected metrics? : IAuthFlowMetrics;\n\n    protected logger? : Logger;\n\n    protected gracePeriod : number;\n\n    constructor(ctx: OAuth2RefreshTokenGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n        this.tokenVerifier = ctx.tokenVerifier;\n        this.tokenRepository = ctx.tokenRepository;\n        this.sessionTokenRepository = ctx.sessionTokenRepository;\n        this.eventService = ctx.eventService;\n        this.metrics = ctx.metrics;\n        this.logger = ctx.logger;\n        this.gracePeriod = ctx.options?.gracePeriod ?? 0;\n    }\n\n    async runWith(\n        input: string | OAuth2TokenPayload,\n        options: OAuth2GrantRunWIthOptions = {},\n    ) : Promise<OAuth2TokenGrantResponse> {\n        let payload : OAuth2TokenPayload;\n        if (typeof input === 'string') {\n            // The auth_session_tokens row — not the cache blocklist — is the\n            // authority for refresh-token validity, so skip the active check.\n            payload = await this.tokenVerifier.verify(input, { skipActiveCheck: true });\n        } else {\n            payload = input;\n        }\n\n        if (!payload.jti) {\n            throw JWTError.payloadPropertyInvalid('jti');\n        }\n        if (!payload.session_id) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        // Explicit kind guard (defense in depth). Authup signs access tokens\n        // and the MFA-pending login ticket with the same keys; only a refresh\n        // token may be exchanged here. The ticket is also rejected implicitly\n        // (it writes no auth_session_tokens row), but do not rely on that\n        // second-order fact alone.\n        if (payload.kind && payload.kind !== OAuth2TokenKind.REFRESH) {\n            throw OAuth2GrantError.invalid('unexpected token kind');\n        }\n\n        const row = await this.sessionTokenRepository.findOneById(payload.jti);\n        if (!row || row.kind !== 'refresh') {\n            // Row missing = expired-and-swept or a pre-rotation legacy token\n            // (hard cutover). Either way the client must re-authenticate.\n            throw OAuth2GrantError.invalid('refresh token is unknown');\n        }\n        if (row.revoked_at) {\n            throw OAuth2GrantError.invalid('refresh token has been revoked');\n        }\n        if (row.session_id !== payload.session_id) {\n            // The row is written with the token's own session_id and jti is\n            // globally unique, so a mismatch means corruption / jti reuse — fail\n            // closed rather than refresh or revoke against the wrong session.\n            throw OAuth2GrantError.invalid('refresh token session mismatch');\n        }\n\n        const now = new Date();\n        const nowISO = now.toISOString();\n\n        const consumed = await this.sessionTokenRepository.markRefreshConsumed(payload.jti, nowISO);\n        if (!consumed) {\n            // Lost the atomic consume — either a replay of an already-rotated\n            // token, or a benign concurrent-refresh race the grace window\n            // absorbs.\n            const withinGrace = await this.isWithinGraceWindow(payload.jti, now);\n            if (!withinGrace) {\n                await this.revokeFamily(row.session_id, payload.jti, nowISO);\n                throw OAuth2GrantError.invalid('refresh token replay detected; session revoked');\n            }\n        }\n\n        // Blocklist the presented refresh token in the cache so introspection\n        // reports it inactive. Deliberately NOT a DB revoke — that would set\n        // revoked_at and break the grace window.\n        await this.tokenRepository.setInactive(payload.jti, payload.exp);\n\n        const session = await this.sessionManager.findOneById(payload.session_id);\n        if (!session) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        await this.sessionManager.verify(session);\n\n        if (options.userAgent) {\n            session.user_agent = options.userAgent;\n        }\n        if (options.ipAddress) {\n            session.ip_address = options.ipAddress;\n        }\n        await this.sessionManager.refresh(session);\n\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue({\n            ...payload,\n            ...(options.confirmation ? { cnf: options.confirmation } : {}),\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            exp: this.refreshTokenIssuer.buildExp(),\n            parent_id: payload.jti,\n        });\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({\n            ...payload,\n            ...(options.confirmation ? { cnf: options.confirmation } : {}),\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            exp: this.accessTokenIssuer.buildExp(),\n            refresh_token_id: refreshTokenPayload.jti,\n        });\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        });\n    }\n\n    /**\n     * The grace window (opt-in via `tokenRefreshGracePeriod`) absorbs benign\n     * concurrent / multi-tab refreshes of the SAME still-current token. It is\n     * scoped to the chain tip: a token whose descendant has already been\n     * consumed is a stale ancestor (a real replay), never a grace re-use.\n     */\n    protected async isWithinGraceWindow(jti: string, now: Date) : Promise<boolean> {\n        if (this.gracePeriod <= 0) {\n            return false;\n        }\n\n        const current = await this.sessionTokenRepository.findOneById(jti);\n        if (\n            !current ||\n            current.revoked_at !== null ||\n            current.consumed_at === null ||\n            (now.getTime() - new Date(current.consumed_at).getTime()) > this.gracePeriod * 1_000\n        ) {\n            return false;\n        }\n\n        // Grace applies ONLY to the most-recent consumed token: a consumed\n        // descendant proves the rotation advanced past this one (stale replay).\n        const chainAdvanced = await this.sessionTokenRepository.hasConsumedChild(jti);\n        return !chainAdvanced;\n    }\n\n    /**\n     * RFC 6819 §5.2.2.3 reaction strategy — revoke the whole token family\n     * (the auth_sessions row) on replay: soft-revoke every session-token row,\n     * blocklist their jtis in the cache, and delete the session so its access\n     * tokens stop verifying on authup's own API.\n     */\n    protected async revokeFamily(sessionId: string, jti: string, at: string) : Promise<void> {\n        this.logger?.warn('OAuth2 refresh token replay detected; revoking session', {\n            session_id: sessionId,\n            jti,\n        });\n\n        await this.eventService?.record({\n            scope: EventScope.OAUTH2,\n            name: EventName.REFRESH_REPLAY_DETECTED,\n            refType: EventRefType.SESSION,\n            refId: sessionId,\n            data: { jti },\n        });\n        this.metrics?.recordRefreshReplay();\n\n        // Blocklisting is best-effort (cache) — settle all of them so one cache\n        // failure cannot skip the rest or, worse, abort the session delete\n        // below (the load-bearing part of the revocation). Pin each TTL to the\n        // token's real expiry (unix seconds) so a long-lived refresh token\n        // cannot resurface as active via introspection after the fallback 1h.\n        const rows = await this.sessionTokenRepository.revokeBySessionId(sessionId, at);\n        await Promise.allSettled(rows.map((row) => this.tokenRepository.setInactive(\n            row.id,\n            Math.floor(new Date(row.expires_at).getTime() / 1_000),\n        )));\n\n        await this.sessionManager.revoke(sessionId);\n    }\n}\n"],"mappings":";;;;;;;;AAmBA,IAAaQ,0BAAb,cAA6CD,gBAAAA;CAC/BE;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;EACxB,CAAA;EAEA,KAAKV,qBAAqBQ,IAAIR;EAC9B,KAAKC,gBAAgBO,IAAIP;EACzB,KAAKC,kBAAkBM,IAAIN;EAC3B,KAAKC,yBAAyBK,IAAIL;EAClC,KAAKC,eAAeI,IAAIJ;EACxB,KAAKC,UAAUG,IAAIH;EACnB,KAAKC,SAASE,IAAIF;EAClB,KAAKC,cAAcC,IAAIG,SAASJ,eAAe;CACnD;CAEA,MAAMK,QACFC,OACAF,UAAqC,CAAC,GACJ;EAClC,IAAIG;EACJ,IAAI,OAAOD,UAAU,UAGjBC,UAAU,MAAM,KAAKb,cAAcc,OAAOF,OAAO,EAAEG,iBAAiB,KAAK,CAAA;OAEzEF,UAAUD;EAGd,IAAI,CAACC,QAAQG,KACT,MAAM1B,SAAS2B,uBAAuB,KAAA;EAE1C,IAAI,CAACJ,QAAQK,YACT,MAAM5B,SAAS2B,uBAAuB,YAAA;EAQ1C,IAAIJ,QAAQM,QAAQN,QAAQM,SAAS3B,gBAAgB4B,SACjD,MAAM7B,iBAAiB8B,QAAQ,uBAAA;EAGnC,MAAMC,MAAM,MAAM,KAAKpB,uBAAuBqB,YAAYV,QAAQG,GAAG;EACrE,IAAI,CAACM,OAAOA,IAAIH,SAAS,WAGrB,MAAM5B,iBAAiB8B,QAAQ,0BAAA;EAEnC,IAAIC,IAAIE,YACJ,MAAMjC,iBAAiB8B,QAAQ,gCAAA;EAEnC,IAAIC,IAAIJ,eAAeL,QAAQK,YAI3B,MAAM3B,iBAAiB8B,QAAQ,gCAAA;EAGnC,MAAMI,sBAAM,IAAIC,KAAAA;EAChB,MAAMC,SAASF,IAAIG,YAAW;EAG9B,IAAI,CAACC,MADkB,KAAK3B,uBAAuB4B,oBAAoBjB,QAAQG,KAAKW,MAAAA;OAM5E,CAACI,MADqB,KAAKC,oBAAoBnB,QAAQG,KAAKS,GAAAA,GAC9C;IACd,MAAM,KAAKQ,aAAaX,IAAIJ,YAAYL,QAAQG,KAAKW,MAAAA;IACrD,MAAMpC,iBAAiB8B,QAAQ,gDAAA;GACnC;;EAMJ,MAAM,KAAKpB,gBAAgBiC,YAAYrB,QAAQG,KAAKH,QAAQsB,GAAG;EAE/D,MAAMC,UAAU,MAAM,KAAK3B,eAAec,YAAYV,QAAQK,UAAU;EACxE,IAAI,CAACkB,SACD,MAAM9C,SAAS2B,uBAAuB,YAAA;EAG1C,MAAM,KAAKR,eAAeK,OAAOsB,OAAAA;EAEjC,IAAI1B,QAAQ2B,WACRD,QAAQE,aAAa5B,QAAQ2B;EAEjC,IAAI3B,QAAQ6B,WACRH,QAAQI,aAAa9B,QAAQ6B;EAEjC,MAAM,KAAK9B,eAAegC,QAAQL,OAAAA;EAElC,MAAM,CAACM,cAAcC,uBAAuB,MAAM,KAAK5C,mBAAmB6C,MAAM;GAC5E,GAAG/B;GACH,GAAIH,QAAQmC,eAAe,EAAEC,KAAKpC,QAAQmC,aAAa,IAAI,CAAC;GAC5DP,YAAYF,QAAQE;GACpBS,gBAAgBX,QAAQI;GACxBL,KAAK,KAAKpC,mBAAmBiD,SAAQ;GACrCC,WAAWpC,QAAQG;EACvB,CAAA;EAEA,MAAM,CAACkC,aAAaC,sBAAsB,MAAM,KAAK3C,kBAAkBoC,MAAM;GACzE,GAAG/B;GACH,GAAIH,QAAQmC,eAAe,EAAEC,KAAKpC,QAAQmC,aAAa,IAAI,CAAC;GAC5DP,YAAYF,QAAQE;GACpBS,gBAAgBX,QAAQI;GACxBL,KAAK,KAAK3B,kBAAkBwC,SAAQ;GACpCI,kBAAkBT,oBAAoB3B;EAC1C,CAAA;EAEA,OAAOpB,+BAA+B;GAClCsD;GACAC;GACAT;GACAC;EACJ,CAAA;CACJ;;;;;;IAQA,MAAgBX,oBAAoBhB,KAAaS,KAA8B;EAC3E,IAAI,KAAKnB,eAAe,GACpB,OAAO;EAGX,MAAM+C,UAAU,MAAM,KAAKnD,uBAAuBqB,YAAYP,GAAAA;EAC9D,IACI,CAACqC,WACDA,QAAQ7B,eAAe,QACvB6B,QAAQC,gBAAgB,QACxB,IAAKC,QAAO,IAAK,IAAI7B,KAAK2B,QAAQC,WAAW,CAAA,CAAEC,QAAO,IAAM,KAAKjD,cAAc,KAE/E,OAAO;EAMX,OAAO,CAACkD,MADoB,KAAKtD,uBAAuBuD,iBAAiBzC,GAAAA;CAE7E;;;;;;IAQA,MAAgBiB,aAAayB,WAAmB1C,KAAa2C,IAA4B;EACrF,KAAKtD,QAAQuD,KAAK,0DAA0D;GACxE1C,YAAYwC;GACZ1C;EACJ,CAAA;EAEA,MAAM,KAAKb,cAAc0D,OAAO;GAC5BC,OAAOnE,WAAWoE;GAClBC,MAAMvE,UAAUwE;GAChBC,SAASxE,aAAayE;GACtBC,OAAOV;GACPW,MAAM,EAAErD,IAAI;EAChB,CAAA;EACA,KAAKZ,SAASkE,oBAAAA;EAOd,MAAMC,OAAO,MAAM,KAAKrE,uBAAuBsE,kBAAkBd,WAAWC,EAAAA;EAC5E,MAAMc,QAAQC,WAAWH,KAAKI,KAAKrD,QAAQ,KAAKrB,gBAAgBiC,YAC5DZ,IAAIsD,IACJC,KAAKC,MAAM,IAAIpD,KAAKJ,IAAIyD,UAAU,CAAA,CAAExB,QAAO,IAAK,GAAA,CAAA,CAAA,CAAA;EAGpD,MAAM,KAAK9C,eAAeuE,OAAOtB,SAAAA;CACrC;AACJ"}

package/dist/core/oauth2/grant-types/robot-credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"robot-credentials.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/grant-types/robot-credentials.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAE9D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAK9C,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAE5D,qBAAa,qBAAsB,SAAQ,eAAe,CAAC,KAAK,CAAC;IACvD,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,GAAE,yBAA8B,GAAI,OAAO,CAAC,wBAAwB,CAAC;CA0B3G"}
+{"version":3,"file":"robot-credentials.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/grant-types/robot-credentials.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAE9D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAM9C,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAE5D,qBAAa,qBAAsB,SAAQ,eAAe,CAAC,KAAK,CAAC;IACvD,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,GAAE,yBAA8B,GAAI,OAAO,CAAC,wBAAwB,CAAC;CA2B3G"}

package/dist/core/oauth2/grant-types/robot-credentials.mjs

@@ -3,7 +3,7 @@ import "node:url";
 import.meta.url;
 import { OAuth2BaseGrant } from "./base.mjs";
 import { buildOAuth2BearerTokenResponse } from "../response/bearer.mjs";
-import { IdentityType, ScopeName } from "@authup/core-kit";
+import { IdentityType, ScopeName, SessionAuthMethod } from "@authup/core-kit";
 import { OAuth2SubKind } from "@authup/specs";
 //#region src/core/oauth2/grant-types/robot-credentials.ts
 var RobotCredentialsGrant = class extends OAuth2BaseGrant {
@@ -13,7 +13,8 @@ var RobotCredentialsGrant = class extends OAuth2BaseGrant {
 			ip_address: options.ipAddress,
 			realm_id: input.realm_id,
 			sub: input.id,
-			sub_kind: IdentityType.ROBOT
+			sub_kind: IdentityType.ROBOT,
+			auth_method: SessionAuthMethod.ROBOT
 		});
 		const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({
 			session_id: session.id,

package/dist/core/oauth2/grant-types/robot-credentials.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"robot-credentials.mjs","names":["OAuth2SubKind","IdentityType","ScopeName","OAuth2BaseGrant","buildOAuth2BearerTokenResponse","RobotCredentialsGrant","runWith","input","options","session","sessionManager","create","user_agent","userAgent","ip_address","ipAddress","realm_id","sub","id","sub_kind","ROBOT","accessToken","accessTokenPayload","accessTokenIssuer","issue","session_id","remote_address","scope","GLOBAL","realm","realm_name","name","client_id","undefined"],"sources":["../../../../src/core/oauth2/grant-types/robot-credentials.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2SubKind } from '@authup/specs';\nimport type { Robot } from '@authup/core-kit';\nimport {\n    IdentityType,\n    ScopeName,\n} from '@authup/core-kit';\nimport { OAuth2BaseGrant } from './base.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { OAuth2GrantRunWIthOptions } from './types.ts';\n\nexport class RobotCredentialsGrant extends OAuth2BaseGrant<Robot> {\n    async runWith(input: Robot, options: OAuth2GrantRunWIthOptions = {}) : Promise<OAuth2TokenGrantResponse> {\n        const session = await this.sessionManager.create({\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: input.realm_id,\n            sub: input.id,\n            sub_kind: IdentityType.ROBOT,\n        });\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({\n            session_id: session.id,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            scope: ScopeName.GLOBAL,\n            sub: input.id,\n            sub_kind: OAuth2SubKind.ROBOT,\n            realm_id: input.realm.id,\n            realm_name: input.realm.name,\n            client_id: input.client_id || undefined,\n        });\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;;;;AAkBA,IAAaK,wBAAb,cAA2CF,gBAAAA;CACvC,MAAMG,QAAQC,OAAcC,UAAqC,CAAC,GAAuC;EACrG,MAAMC,UAAU,MAAM,KAAKC,eAAeC,OAAO;GAC7CC,YAAYJ,QAAQK;GACpBC,YAAYN,QAAQO;GACpBC,UAAUT,MAAMS;GAChBC,KAAKV,MAAMW;GACXC,UAAUlB,aAAamB;EAC3B,CAAA;EAEA,MAAM,CAACC,aAAaC,sBAAsB,MAAM,KAAKC,kBAAkBC,MAAM;GACzEC,YAAYhB,QAAQS;GACpBN,YAAYH,QAAQG;GACpBc,gBAAgBjB,QAAQK;GACxBa,OAAOzB,UAAU0B;GACjBX,KAAKV,MAAMW;GACXC,UAAUnB,cAAcoB;GACxBJ,UAAUT,MAAMsB,MAAMX;GACtBY,YAAYvB,MAAMsB,MAAME;GACxBC,WAAWzB,MAAMyB,aAAaC,KAAAA;EAClC,CAAA;EAEA,OAAO7B,+BAA+B;GAClCiB;GACAC;EACJ,CAAA;CACJ;AACJ"}
+{"version":3,"file":"robot-credentials.mjs","names":["OAuth2SubKind","IdentityType","ScopeName","SessionAuthMethod","OAuth2BaseGrant","buildOAuth2BearerTokenResponse","RobotCredentialsGrant","runWith","input","options","session","sessionManager","create","user_agent","userAgent","ip_address","ipAddress","realm_id","sub","id","sub_kind","ROBOT","auth_method","accessToken","accessTokenPayload","accessTokenIssuer","issue","session_id","remote_address","scope","GLOBAL","realm","realm_name","name","client_id","undefined"],"sources":["../../../../src/core/oauth2/grant-types/robot-credentials.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2SubKind } from '@authup/specs';\nimport type { Robot } from '@authup/core-kit';\nimport {\n    IdentityType,\n    ScopeName, \n    SessionAuthMethod,\n} from '@authup/core-kit';\nimport { OAuth2BaseGrant } from './base.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { OAuth2GrantRunWIthOptions } from './types.ts';\n\nexport class RobotCredentialsGrant extends OAuth2BaseGrant<Robot> {\n    async runWith(input: Robot, options: OAuth2GrantRunWIthOptions = {}) : Promise<OAuth2TokenGrantResponse> {\n        const session = await this.sessionManager.create({\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: input.realm_id,\n            sub: input.id,\n            sub_kind: IdentityType.ROBOT,\n            auth_method: SessionAuthMethod.ROBOT,\n        });\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({\n            session_id: session.id,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            scope: ScopeName.GLOBAL,\n            sub: input.id,\n            sub_kind: OAuth2SubKind.ROBOT,\n            realm_id: input.realm.id,\n            realm_name: input.realm.name,\n            client_id: input.client_id || undefined,\n        });\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;;;;AAmBA,IAAaM,wBAAb,cAA2CF,gBAAAA;CACvC,MAAMG,QAAQC,OAAcC,UAAqC,CAAC,GAAuC;EACrG,MAAMC,UAAU,MAAM,KAAKC,eAAeC,OAAO;GAC7CC,YAAYJ,QAAQK;GACpBC,YAAYN,QAAQO;GACpBC,UAAUT,MAAMS;GAChBC,KAAKV,MAAMW;GACXC,UAAUnB,aAAaoB;GACvBC,aAAanB,kBAAkBkB;EACnC,CAAA;EAEA,MAAM,CAACE,aAAaC,sBAAsB,MAAM,KAAKC,kBAAkBC,MAAM;GACzEC,YAAYjB,QAAQS;GACpBN,YAAYH,QAAQG;GACpBe,gBAAgBlB,QAAQK;GACxBc,OAAO3B,UAAU4B;GACjBZ,KAAKV,MAAMW;GACXC,UAAUpB,cAAcqB;GACxBJ,UAAUT,MAAMuB,MAAMZ;GACtBa,YAAYxB,MAAMuB,MAAME;GACxBC,WAAW1B,MAAM0B,aAAaC,KAAAA;EAClC,CAAA;EAEA,OAAO9B,+BAA+B;GAClCkB;GACAC;EACJ,CAAA;CACJ;AACJ"}

package/dist/core/oauth2/grant-types/types.d.ts

@@ -1,28 +1,55 @@
 import type { ObjectLiteral } from '@authup/kit';
-import type { OAuth2TokenGrantResponse } from '@authup/specs';
+import type { OAuth2TokenConfirmation, OAuth2TokenGrantResponse } from '@authup/specs';
+import type { Logger } from '@authup/server-kit';
 import type { ISessionManager } from '../../authentication/index.ts';
-import type { IOAuth2TokenIssuer, IOAuth2TokenRevoker, IOAuth2TokenVerifier } from '../token/index.ts';
+import type { IEventService } from '../../entities/index.ts';
+import type { IAuthFlowMetrics } from '../../metrics/index.ts';
+import type { IKeyStore } from '../../key/index.ts';
+import type { ISessionTokenRepository } from '../session-token/index.ts';
+import type { IOAuth2OpenIDTokenIssuer, IOAuth2TokenIssuer, IOAuth2TokenRepository, IOAuth2TokenVerifier } from '../token/index.ts';
 export type BaseGrantContext = {
     accessTokenIssuer: IOAuth2TokenIssuer;
     sessionManager: ISessionManager;
 };
 export type OAuth2AuthorizeGrantContext = BaseGrantContext & {
     refreshTokenIssuer: IOAuth2TokenIssuer;
+    openIdTokenIssuer: IOAuth2OpenIDTokenIssuer;
+    /**
+     * The realm's signing key determines the id_token's JWS alg — and with it
+     * the at_hash digest (OIDC Core §3.1.3.6).
+     */
+    keyStore: IKeyStore;
 };
 export type OAuth2IdentityGrantContext = BaseGrantContext & {
     refreshTokenIssuer: IOAuth2TokenIssuer;
 };
 export type OAuth2PasswordGrantContext = BaseGrantContext & {
     refreshTokenIssuer: IOAuth2TokenIssuer;
+    eventService?: IEventService;
+    metrics?: IAuthFlowMetrics;
+};
+export type OAuth2RefreshTokenGrantOptions = {
+    /**
+     * Grace period (seconds) during which a just-consumed refresh token still
+     * mints new chain-linked tokens instead of triggering replay detection.
+     * default: 0 (strict).
+     */
+    gracePeriod?: number;
 };
 export type OAuth2RefreshTokenGrantContext = BaseGrantContext & {
     refreshTokenIssuer: IOAuth2TokenIssuer;
     tokenVerifier: IOAuth2TokenVerifier;
-    tokenRevoker: IOAuth2TokenRevoker;
+    tokenRepository: IOAuth2TokenRepository;
+    sessionTokenRepository: ISessionTokenRepository;
+    eventService?: IEventService;
+    metrics?: IAuthFlowMetrics;
+    logger?: Logger;
+    options?: OAuth2RefreshTokenGrantOptions;
 };
 export type OAuth2GrantRunWIthOptions = {
     userAgent?: string;
     ipAddress?: string;
+    confirmation?: OAuth2TokenConfirmation;
 };
 export interface IOAuth2Grant<T = ObjectLiteral> {
     runWith(data: T, base?: OAuth2GrantRunWIthOptions): Promise<OAuth2TokenGrantResponse>;

package/dist/core/oauth2/grant-types/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/grant-types/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEvG,MAAM,MAAM,gBAAgB,GAAG;IAC3B,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,cAAc,EAAE,eAAe,CAAA;CAClC,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG,gBAAgB,GAAG;IACzD,kBAAkB,EAAE,kBAAkB,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,gBAAgB,GAAG;IACxD,kBAAkB,EAAE,kBAAkB,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,gBAAgB,GAAG;IACxD,kBAAkB,EAAE,kBAAkB,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG,gBAAgB,GAAG;IAC5D,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,aAAa,EAAE,oBAAoB,CAAC;IACpC,YAAY,EAAE,mBAAmB,CAAA;CACpC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,aAAa;IAC3C,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,yBAAyB,GAAI,OAAO,CAAC,wBAAwB,CAAC,CAAC;CAC1F"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/grant-types/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AACvF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,KAAK,EACR,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,EACvB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,gBAAgB,GAAG;IAC3B,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,cAAc,EAAE,eAAe,CAAA;CAClC,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG,gBAAgB,GAAG;IACzD,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,iBAAiB,EAAE,wBAAwB,CAAC;IAC5C;;;OAGG;IACH,QAAQ,EAAE,SAAS,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,gBAAgB,GAAG;IACxD,kBAAkB,EAAE,kBAAkB,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,gBAAgB,GAAG;IACxD,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,OAAO,CAAC,EAAE,gBAAgB,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IACzC;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG,gBAAgB,GAAG;IAC5D,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,aAAa,EAAE,oBAAoB,CAAC;IACpC,eAAe,EAAE,sBAAsB,CAAC;IACxC,sBAAsB,EAAE,uBAAuB,CAAC;IAChD,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,8BAA8B,CAAC;CAC5C,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,uBAAuB,CAAC;CAC1C,CAAC;AAEF,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,aAAa;IAC3C,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,yBAAyB,GAAI,OAAO,CAAC,wBAAwB,CAAC,CAAC;CAC1F"}

package/dist/core/oauth2/index.d.ts

@@ -1,9 +1,12 @@
+export * from './access-policy/index.ts';
 export * from './authorization/index.ts';
 export * from './client/index.ts';
+export * from './end-session/index.ts';
 export * from './grant-types/index.ts';
-export * from './key/index.ts';
+export * from './mfa-login/index.ts';
 export * from './openid/index.ts';
 export * from './response/index.ts';
 export * from './scope/index.ts';
+export * from './session-token/index.ts';
 export * from './token/index.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/oauth2/index.ts"],"names":[],"mappings":"AAOA,cAAc,0BAA0B,CAAC;AACzC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/oauth2/index.ts"],"names":[],"mappings":"AAOA,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC"}

package/dist/core/oauth2/index.mjs

@@ -1,16 +1,22 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { OAuth2AccessPolicyEvaluator } from "./access-policy/module.mjs";
+import "./access-policy/index.mjs";
 import { OAuth2AuthorizationCodeIssuer } from "./authorization/code/issuer/module.mjs";
-import { base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, generateOAuth2CodeVerifier } from "./authorization/helpers.mjs";
+import { base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, deriveAmrAcr, generateOAuth2CodeVerifier } from "./authorization/helpers.mjs";
 import { OAuth2AuthorizationCodeVerifier } from "./authorization/code/verifier/module.mjs";
+import { OAuth2ClientAuthenticator } from "./client/authenticator.mjs";
+import { assertClientGrantAllowed } from "./client/grant-type.mjs";
+import "./client/index.mjs";
 import { OAuth2AuthorizationCodeRequestVerifier } from "./authorization/code-request/verifier/module.mjs";
 import { OAuth2AuthorizationCodeRequestValidator } from "./authorization/code-request/validator.mjs";
 import { OAuth2AuthorizationStateManager } from "./authorization/state/module.mjs";
 import { OAuth2Authorization } from "./authorization/module.mjs";
 import "./authorization/index.mjs";
-import { OAuth2ClientAuthenticator } from "./client/authenticator.mjs";
-import "./client/index.mjs";
+import { OAuth2EndSessionService } from "./end-session/service.mjs";
+import { OAuth2EndSessionRequestValidator } from "./end-session/validator.mjs";
+import "./end-session/index.mjs";
 import { buildOAuth2BearerTokenResponse } from "./response/bearer.mjs";
 import { OAuth2AuthorizeGrant } from "./grant-types/authorize.mjs";
 import { ClientCredentialsGrant } from "./grant-types/client-credentials.mjs";
@@ -19,15 +25,18 @@ import { PasswordGrantType } from "./grant-types/password.mjs";
 import { OAuth2RefreshTokenGrant } from "./grant-types/refresh-token.mjs";
 import { RobotCredentialsGrant } from "./grant-types/robot-credentials.mjs";
 import "./grant-types/index.mjs";
+import { OAuth2MfaLoginService } from "./mfa-login/module.mjs";
+import "./mfa-login/index.mjs";
 import { OAuth2OpenIDClaimsBuilder } from "./openid/claims.mjs";
 import "./openid/index.mjs";
 import { OAuth2ScopeAttributesResolver } from "./scope/resolver.mjs";
 import "./scope/index.mjs";
 import { OAuth2AccessTokenIssuer } from "./token/issuer/access/module.mjs";
+import { OAuth2MfaTokenIssuer } from "./token/issuer/mfa/module.mjs";
 import { OAuth2OpenIDTokenIssuer } from "./token/issuer/open-id/module.mjs";
 import { OAuth2RefreshTokenIssuer } from "./token/issuer/refresh/module.mjs";
 import { OAuth2TokenRevoker } from "./token/revoker/module.mjs";
 import { OAuth2TokenSigner } from "./token/signer/module.mjs";
 import { OAuth2TokenVerifier } from "./token/verifier/module.mjs";
 import "./token/index.mjs";
-export { ClientCredentialsGrant, IdentityGrantType, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2ClientAuthenticator, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PasswordGrantType, RobotCredentialsGrant, base64URLEncode, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, generateOAuth2CodeVerifier };
+export { ClientCredentialsGrant, IdentityGrantType, OAuth2AccessPolicyEvaluator, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2ClientAuthenticator, OAuth2EndSessionRequestValidator, OAuth2EndSessionService, OAuth2MfaLoginService, OAuth2MfaTokenIssuer, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PasswordGrantType, RobotCredentialsGrant, assertClientGrantAllowed, base64URLEncode, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, deriveAmrAcr, generateOAuth2CodeVerifier };

package/dist/core/oauth2/mfa-login/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/mfa-login/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/mfa-login/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/oauth2/mfa-login/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { OAuth2MfaLoginService } from "./module.mjs";
+export { OAuth2MfaLoginService };

package/dist/core/oauth2/mfa-login/module.d.ts

@@ -0,0 +1,19 @@
+import type { OAuth2TokenGrantResponse } from '@authup/specs';
+import type { IEventService } from '../../entities/index.ts';
+import type { IAuthFlowMetrics } from '../../metrics/index.ts';
+import type { ISessionManager } from '../../authentication/index.ts';
+import type { IOAuth2TokenIssuer, IOAuth2TokenRepository } from '../token/index.ts';
+import type { IOAuth2MfaLoginService, OAuth2MfaLoginCompleteInput, OAuth2MfaLoginServiceContext, OAuth2MfaLoginTicket, OAuth2MfaLoginTicketIssueInput, OAuth2MfaLoginTicketIssueOptions } from './types.ts';
+export declare class OAuth2MfaLoginService implements IOAuth2MfaLoginService {
+    protected sessionManager: ISessionManager;
+    protected ticketIssuer: IOAuth2TokenIssuer;
+    protected accessTokenIssuer: IOAuth2TokenIssuer;
+    protected refreshTokenIssuer: IOAuth2TokenIssuer;
+    protected tokenRepository: IOAuth2TokenRepository;
+    protected eventService?: IEventService;
+    protected metrics?: IAuthFlowMetrics;
+    constructor(ctx: OAuth2MfaLoginServiceContext);
+    issueTicket(input: OAuth2MfaLoginTicketIssueInput, options?: OAuth2MfaLoginTicketIssueOptions): Promise<OAuth2MfaLoginTicket>;
+    complete(input: OAuth2MfaLoginCompleteInput): Promise<OAuth2TokenGrantResponse>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/oauth2/mfa-login/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/mfa-login/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAsB,MAAM,eAAe,CAAC;AAUlF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAGrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AACpF,OAAO,KAAK,EACR,sBAAsB,EACtB,2BAA2B,EAC3B,4BAA4B,EAC5B,oBAAoB,EACpB,8BAA8B,EAC9B,gCAAgC,EACnC,MAAM,YAAY,CAAC;AAEpB,qBAAa,qBAAsB,YAAW,sBAAsB;IAChE,SAAS,CAAC,cAAc,EAAG,eAAe,CAAC;IAE3C,SAAS,CAAC,YAAY,EAAG,kBAAkB,CAAC;IAE5C,SAAS,CAAC,iBAAiB,EAAG,kBAAkB,CAAC;IAEjD,SAAS,CAAC,kBAAkB,EAAG,kBAAkB,CAAC;IAElD,SAAS,CAAC,eAAe,EAAG,sBAAsB,CAAC;IAEnD,SAAS,CAAC,YAAY,CAAC,EAAG,aAAa,CAAC;IAExC,SAAS,CAAC,OAAO,CAAC,EAAG,gBAAgB,CAAC;gBAE1B,GAAG,EAAE,4BAA4B;IAUvC,WAAW,CACb,KAAK,EAAE,8BAA8B,EACrC,OAAO,GAAE,gCAAqC,GAC9C,OAAO,CAAC,oBAAoB,CAAC;IA8C3B,QAAQ,CAAC,KAAK,EAAE,2BAA2B,GAAI,OAAO,CAAC,wBAAwB,CAAC;CAmEzF"}