@authup/server-core 1.0.0-beta.51 → 1.0.0-beta.53

package/dist/core/oauth2/mfa-login/module.mjs

@@ -0,0 +1,109 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { deriveAmrAcr } from "../authorization/helpers.mjs";
+import { buildOAuth2BearerTokenResponse } from "../response/bearer.mjs";
+import { EventName, EventRefType, EventScope, IdentityType, ScopeName, SessionAuthMethod } from "@authup/core-kit";
+import { OAuth2GrantError, OAuth2SubKind, OAuth2TokenGrant } from "@authup/specs";
+//#region src/core/oauth2/mfa-login/module.ts
+var OAuth2MfaLoginService = class {
+	sessionManager;
+	ticketIssuer;
+	accessTokenIssuer;
+	refreshTokenIssuer;
+	tokenRepository;
+	eventService;
+	metrics;
+	constructor(ctx) {
+		this.sessionManager = ctx.sessionManager;
+		this.ticketIssuer = ctx.ticketIssuer;
+		this.accessTokenIssuer = ctx.accessTokenIssuer;
+		this.refreshTokenIssuer = ctx.refreshTokenIssuer;
+		this.tokenRepository = ctx.tokenRepository;
+		this.eventService = ctx.eventService;
+		this.metrics = ctx.metrics;
+	}
+	async issueTicket(input, options = {}) {
+		const { user } = input;
+		const clientId = input.clientId ?? void 0;
+		const expiresAt = this.ticketIssuer.buildExp();
+		const session = await this.sessionManager.create({
+			user_agent: options.userAgent,
+			ip_address: options.ipAddress,
+			realm_id: user.realm_id,
+			client_id: clientId,
+			sub: user.id,
+			sub_kind: IdentityType.USER,
+			mfa_at: null,
+			auth_method: SessionAuthMethod.PASSWORD,
+			expires_at: (/* @__PURE__ */ new Date(expiresAt * 1e3)).toISOString()
+		});
+		const [token, payload] = await this.ticketIssuer.issue({
+			client_id: clientId,
+			session_id: session.id,
+			user_agent: session.user_agent,
+			remote_address: session.ip_address,
+			sub: user.id,
+			sub_kind: OAuth2SubKind.USER,
+			realm_id: user.realm_id,
+			realm_name: user.realm?.name,
+			...input.confirmation ? { cnf: input.confirmation } : {},
+			exp: expiresAt
+		});
+		return {
+			token,
+			expiresIn: payload.exp ? payload.exp - Math.floor(Date.now() / 1e3) : 0
+		};
+	}
+	async complete(input) {
+		const { ticket } = input;
+		const session = await this.sessionManager.refresh(input.session);
+		const amrAcr = deriveAmrAcr(session);
+		if (ticket.jti) {
+			if (!await this.tokenRepository.claimInactive(ticket.jti, ticket.exp)) throw OAuth2GrantError.invalid("mfa login ticket has already been used");
+		}
+		const issuePayload = {
+			client_id: session.client_id ?? void 0,
+			session_id: session.id,
+			user_agent: session.user_agent,
+			remote_address: session.ip_address,
+			scope: ScopeName.GLOBAL,
+			sub: session.sub,
+			sub_kind: OAuth2SubKind.USER,
+			realm_id: session.realm_id,
+			realm_name: ticket.realm_name,
+			...ticket.cnf ? { cnf: ticket.cnf } : {},
+			...amrAcr
+		};
+		const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);
+		const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);
+		await this.eventService?.record({
+			scope: EventScope.OAUTH2,
+			name: EventName.LOGIN,
+			refType: EventRefType.SESSION,
+			refId: session.id,
+			clientId: session.client_id ?? null,
+			actorType: IdentityType.USER,
+			actorId: session.sub,
+			actorName: input.userName ?? null,
+			realmId: session.realm_id,
+			requestIpAddress: session.ip_address ?? null,
+			requestUserAgent: session.user_agent ?? null,
+			data: {
+				grant_type: OAuth2TokenGrant.PASSWORD,
+				session_id: session.id
+			}
+		});
+		this.metrics?.recordLogin("success");
+		return buildOAuth2BearerTokenResponse({
+			accessToken,
+			accessTokenPayload,
+			refreshToken,
+			refreshTokenPayload
+		});
+	}
+};
+//#endregion
+export { OAuth2MfaLoginService };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/mfa-login/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["OAuth2GrantError","OAuth2SubKind","OAuth2TokenGrant","EventName","EventRefType","EventScope","IdentityType","ScopeName","SessionAuthMethod","deriveAmrAcr","buildOAuth2BearerTokenResponse","OAuth2MfaLoginService","sessionManager","ticketIssuer","accessTokenIssuer","refreshTokenIssuer","tokenRepository","eventService","metrics","ctx","issueTicket","input","options","user","clientId","undefined","expiresAt","buildExp","session","create","user_agent","userAgent","ip_address","ipAddress","realm_id","client_id","sub","id","sub_kind","USER","mfa_at","auth_method","PASSWORD","expires_at","Date","toISOString","token","payload","issue","session_id","remote_address","realm_name","realm","name","confirmation","cnf","exp","expiresIn","Math","floor","now","complete","ticket","refresh","amrAcr","jti","claimed","claimInactive","invalid","issuePayload","scope","GLOBAL","accessToken","accessTokenPayload","refreshToken","refreshTokenPayload","record","OAUTH2","LOGIN","refType","SESSION","refId","actorType","actorId","actorName","userName","realmId","requestIpAddress","requestUserAgent","data","grant_type","recordLogin"],"sources":["../../../../src/core/oauth2/mfa-login/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2GrantError, OAuth2SubKind, OAuth2TokenGrant } from '@authup/specs';\nimport {\n    EventName,\n    EventRefType,\n    EventScope,\n    IdentityType,\n    ScopeName,\n    SessionAuthMethod,\n} from '@authup/core-kit';\nimport type { IEventService } from '../../entities/index.ts';\nimport type { IAuthFlowMetrics } from '../../metrics/index.ts';\nimport type { ISessionManager } from '../../authentication/index.ts';\nimport { deriveAmrAcr } from '../authorization/helpers.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { IOAuth2TokenIssuer, IOAuth2TokenRepository } from '../token/index.ts';\nimport type {\n    IOAuth2MfaLoginService,\n    OAuth2MfaLoginCompleteInput,\n    OAuth2MfaLoginServiceContext,\n    OAuth2MfaLoginTicket,\n    OAuth2MfaLoginTicketIssueInput,\n    OAuth2MfaLoginTicketIssueOptions,\n} from './types.ts';\n\nexport class OAuth2MfaLoginService implements IOAuth2MfaLoginService {\n    protected sessionManager : ISessionManager;\n\n    protected ticketIssuer : IOAuth2TokenIssuer;\n\n    protected accessTokenIssuer : IOAuth2TokenIssuer;\n\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    protected tokenRepository : IOAuth2TokenRepository;\n\n    protected eventService? : IEventService;\n\n    protected metrics? : IAuthFlowMetrics;\n\n    constructor(ctx: OAuth2MfaLoginServiceContext) {\n        this.sessionManager = ctx.sessionManager;\n        this.ticketIssuer = ctx.ticketIssuer;\n        this.accessTokenIssuer = ctx.accessTokenIssuer;\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n        this.tokenRepository = ctx.tokenRepository;\n        this.eventService = ctx.eventService;\n        this.metrics = ctx.metrics;\n    }\n\n    async issueTicket(\n        input: OAuth2MfaLoginTicketIssueInput,\n        options: OAuth2MfaLoginTicketIssueOptions = {},\n    ) : Promise<OAuth2MfaLoginTicket> {\n        const { user } = input;\n        const clientId = input.clientId ?? undefined;\n\n        // One expiration instant for BOTH artifacts — the pending session\n        // lives exactly as long as the ticket (an abandoned login\n        // self-expires and is swept with the regular session sweep;\n        // completion extends it to the full lifetime). Computed once so\n        // the two cannot drift.\n        const expiresAt = this.ticketIssuer.buildExp();\n\n        const session = await this.sessionManager.create({\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: user.realm_id,\n            client_id: clientId,\n            sub: user.id,\n            sub_kind: IdentityType.USER,\n            mfa_at: null,\n            auth_method: SessionAuthMethod.PASSWORD,\n            expires_at: new Date(expiresAt * 1000).toISOString(),\n        });\n\n        // No scope, no role claims — the ticket is not a bearer; it only\n        // unlocks the challenge routes (which opt in by kind).\n        const [token, payload] = await this.ticketIssuer.issue({\n            client_id: clientId,\n            session_id: session.id,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            sub: user.id,\n            sub_kind: OAuth2SubKind.USER,\n            realm_id: user.realm_id,\n            realm_name: user.realm?.name,\n            ...(input.confirmation ? { cnf: input.confirmation } : {}),\n            exp: expiresAt,\n        });\n\n        return {\n            token,\n            expiresIn: payload.exp ?\n                payload.exp - Math.floor(Date.now() / 1000) :\n                0,\n        };\n    }\n\n    async complete(input: OAuth2MfaLoginCompleteInput) : Promise<OAuth2TokenGrantResponse> {\n        const { ticket } = input;\n\n        // Extend the ticket-scoped pending session to the regular session\n        // lifetime — the login is complete now.\n        const session = await this.sessionManager.refresh(input.session);\n\n        // mfa_at was stamped inside the verify unit of work, so the claims\n        // advertise the completed factor (amr +otp, acr urn:authup:mfa).\n        const amrAcr = deriveAmrAcr(session);\n\n        // Single use: atomically claim the ticket BEFORE minting so two\n        // concurrent completions (a mixed-kind user presenting two distinct\n        // fresh factors) cannot both issue a token pair — `claimInactive` is a\n        // set-if-absent write, so exactly one racer wins. The trade-off vs.\n        // claiming after minting is that a mint failure burns the ticket — the\n        // safer bias for a single-use login credential (the user re-authenticates).\n        if (ticket.jti) {\n            const claimed = await this.tokenRepository.claimInactive(ticket.jti, ticket.exp);\n            if (!claimed) {\n                throw OAuth2GrantError.invalid('mfa login ticket has already been used');\n            }\n        }\n\n        const issuePayload : Partial<OAuth2TokenPayload> = {\n            client_id: session.client_id ?? undefined,\n            session_id: session.id,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            scope: ScopeName.GLOBAL,\n            sub: session.sub,\n            sub_kind: OAuth2SubKind.USER,\n            realm_id: session.realm_id,\n            realm_name: ticket.realm_name,\n            ...(ticket.cnf ? { cnf: ticket.cnf } : {}),\n            ...amrAcr,\n        };\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);\n\n        await this.eventService?.record({\n            scope: EventScope.OAUTH2,\n            name: EventName.LOGIN,\n            refType: EventRefType.SESSION,\n            refId: session.id,\n            clientId: session.client_id ?? null,\n            actorType: IdentityType.USER,\n            actorId: session.sub,\n            actorName: input.userName ?? null,\n            realmId: session.realm_id,\n            requestIpAddress: session.ip_address ?? null,\n            requestUserAgent: session.user_agent ?? null,\n            data: {\n                grant_type: OAuth2TokenGrant.PASSWORD,\n                session_id: session.id,\n            },\n        });\n        this.metrics?.recordLogin('success');\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;;;;AAgCA,IAAaW,wBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAmC;EAC3C,KAAKP,iBAAiBO,IAAIP;EAC1B,KAAKC,eAAeM,IAAIN;EACxB,KAAKC,oBAAoBK,IAAIL;EAC7B,KAAKC,qBAAqBI,IAAIJ;EAC9B,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,eAAeE,IAAIF;EACxB,KAAKC,UAAUC,IAAID;CACvB;CAEA,MAAME,YACFC,OACAC,UAA4C,CAAC,GACf;EAC9B,MAAM,EAAEC,SAASF;EACjB,MAAMG,WAAWH,MAAMG,YAAYC,KAAAA;EAOnC,MAAMC,YAAY,KAAKb,aAAac,SAAQ;EAE5C,MAAMC,UAAU,MAAM,KAAKhB,eAAeiB,OAAO;GAC7CC,YAAYR,QAAQS;GACpBC,YAAYV,QAAQW;GACpBC,UAAUX,KAAKW;GACfC,WAAWX;GACXY,KAAKb,KAAKc;GACVC,UAAUhC,aAAaiC;GACvBC,QAAQ;GACRC,aAAajC,kBAAkBkC;GAC/BC,6BAAY,IAAIC,KAAKlB,YAAY,GAAA,EAAA,CAAMmB,YAAW;EACtD,CAAA;EAIA,MAAM,CAACC,OAAOC,WAAW,MAAM,KAAKlC,aAAamC,MAAM;GACnDb,WAAWX;GACXyB,YAAYrB,QAAQS;GACpBP,YAAYF,QAAQE;GACpBoB,gBAAgBtB,QAAQI;GACxBI,KAAKb,KAAKc;GACVC,UAAUrC,cAAcsC;GACxBL,UAAUX,KAAKW;GACfiB,YAAY5B,KAAK6B,OAAOC;GACxB,GAAIhC,MAAMiC,eAAe,EAAEC,KAAKlC,MAAMiC,aAAa,IAAI,CAAC;GACxDE,KAAK9B;EACT,CAAA;EAEA,OAAO;GACHoB;GACAW,WAAWV,QAAQS,MACfT,QAAQS,MAAME,KAAKC,MAAMf,KAAKgB,IAAG,IAAK,GAAA,IACtC;EACR;CACJ;CAEA,MAAMC,SAASxC,OAAwE;EACnF,MAAM,EAAEyC,WAAWzC;EAInB,MAAMO,UAAU,MAAM,KAAKhB,eAAemD,QAAQ1C,MAAMO,OAAO;EAI/D,MAAMoC,SAASvD,aAAamB,OAAAA;EAQ5B,IAAIkC,OAAOG;OAEH,CAACC,MADiB,KAAKlD,gBAAgBmD,cAAcL,OAAOG,KAAKH,OAAON,GAAG,GAE3E,MAAMxD,iBAAiBoE,QAAQ,wCAAA;EAAA;EAIvC,MAAMC,eAA6C;GAC/ClC,WAAWP,QAAQO,aAAaV,KAAAA;GAChCwB,YAAYrB,QAAQS;GACpBP,YAAYF,QAAQE;GACpBoB,gBAAgBtB,QAAQI;GACxBsC,OAAO/D,UAAUgE;GACjBnC,KAAKR,QAAQQ;GACbE,UAAUrC,cAAcsC;GACxBL,UAAUN,QAAQM;GAClBiB,YAAYW,OAAOX;GACnB,GAAIW,OAAOP,MAAM,EAAEA,KAAKO,OAAOP,IAAI,IAAI,CAAC;GACxC,GAAGS;EACP;EAEA,MAAM,CAACQ,aAAaC,sBAAsB,MAAM,KAAK3D,kBAAkBkC,MAAMqB,YAAAA;EAC7E,MAAM,CAACK,cAAcC,uBAAuB,MAAM,KAAK5D,mBAAmBiC,MAAMqB,YAAAA;EAEhF,MAAM,KAAKpD,cAAc2D,OAAO;GAC5BN,OAAOjE,WAAWwE;GAClBxB,MAAMlD,UAAU2E;GAChBC,SAAS3E,aAAa4E;GACtBC,OAAOrD,QAAQS;GACfb,UAAUI,QAAQO,aAAa;GAC/B+C,WAAW5E,aAAaiC;GACxB4C,SAASvD,QAAQQ;GACjBgD,WAAW/D,MAAMgE,YAAY;GAC7BC,SAAS1D,QAAQM;GACjBqD,kBAAkB3D,QAAQI,cAAc;GACxCwD,kBAAkB5D,QAAQE,cAAc;GACxC2D,MAAM;IACFC,YAAYxF,iBAAiBwC;IAC7BO,YAAYrB,QAAQS;GACxB;EACJ,CAAA;EACA,KAAKnB,SAASyE,YAAY,SAAA;EAE1B,OAAOjF,+BAA+B;GAClC8D;GACAC;GACAC;GACAC;EACJ,CAAA;CACJ;AACJ"}

package/dist/core/oauth2/mfa-login/types.d.ts

@@ -0,0 +1,64 @@
+import type { Session, User } from '@authup/core-kit';
+import type { OAuth2TokenConfirmation, OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';
+import type { IEventService } from '../../entities/index.ts';
+import type { IAuthFlowMetrics } from '../../metrics/index.ts';
+import type { ISessionManager } from '../../authentication/index.ts';
+import type { IOAuth2TokenIssuer, IOAuth2TokenRepository } from '../token/index.ts';
+export type OAuth2MfaLoginTicketIssueInput = {
+    user: User;
+    clientId?: string | null;
+    confirmation?: OAuth2TokenConfirmation;
+};
+export type OAuth2MfaLoginTicketIssueOptions = {
+    ipAddress?: string;
+    userAgent?: string;
+};
+export type OAuth2MfaLoginTicket = {
+    token: string;
+    expiresIn: number;
+};
+export type OAuth2MfaLoginCompleteInput = {
+    /**
+     * The pending session the ticket references — already mfa-stamped by
+     * the challenge verify (markMfaVerified runs in the verify unit of
+     * work, before completion).
+     */
+    session: Session;
+    /**
+     * The verified mfa_token payload the caller authenticated with.
+     */
+    ticket: OAuth2TokenPayload;
+    /**
+     * Actor name for the LOGIN security event.
+     */
+    userName?: string;
+};
+/**
+ * The "MFA-pending" login-ticket seam (issue #3242): the password grant
+ * issues a restricted ticket (kind: mfa_token) instead of failing closed
+ * when the second factor cannot ride the single POST (email / WebAuthn),
+ * and a successful interactive challenge completes the login by minting
+ * the full token pair for the now-MFA'd pending session.
+ */
+export interface IOAuth2MfaLoginService {
+    /**
+     * Create the pending session (mfa_at: null, ticket-scoped lifetime)
+     * and mint the mfa_token bound to it.
+     */
+    issueTicket(input: OAuth2MfaLoginTicketIssueInput, options?: OAuth2MfaLoginTicketIssueOptions): Promise<OAuth2MfaLoginTicket>;
+    /**
+     * Mint the full grant for the completed session, extend it to the
+     * regular session lifetime, and consume the ticket (single use).
+     */
+    complete(input: OAuth2MfaLoginCompleteInput): Promise<OAuth2TokenGrantResponse>;
+}
+export type OAuth2MfaLoginServiceContext = {
+    sessionManager: ISessionManager;
+    ticketIssuer: IOAuth2TokenIssuer;
+    accessTokenIssuer: IOAuth2TokenIssuer;
+    refreshTokenIssuer: IOAuth2TokenIssuer;
+    tokenRepository: IOAuth2TokenRepository;
+    eventService?: IEventService;
+    metrics?: IAuthFlowMetrics;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/core/oauth2/mfa-login/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/mfa-login/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EACR,uBAAuB,EACvB,wBAAwB,EACxB,kBAAkB,EACrB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAEpF,MAAM,MAAM,8BAA8B,GAAG;IACzC,IAAI,EAAE,IAAI,CAAC;IACX,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,YAAY,CAAC,EAAE,uBAAuB,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,gCAAgC,GAAG;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACtC;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;OAEG;IACH,MAAM,EAAE,kBAAkB,CAAC;IAC3B;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACnC;;;OAGG;IACH,WAAW,CACP,KAAK,EAAE,8BAA8B,EACrC,OAAO,CAAC,EAAE,gCAAgC,GAC3C,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEjC;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;CACnF;AAED,MAAM,MAAM,4BAA4B,GAAG;IACvC,cAAc,EAAE,eAAe,CAAC;IAChC,YAAY,EAAE,kBAAkB,CAAC;IACjC,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,eAAe,EAAE,sBAAsB,CAAC;IACxC,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,OAAO,CAAC,EAAE,gBAAgB,CAAC;CAC9B,CAAC"}

package/dist/core/oauth2/mfa-login/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/oauth2/session-token/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/session-token/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC"}

package/dist/core/oauth2/session-token/index.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/oauth2/session-token/types.d.ts

@@ -0,0 +1,70 @@
+import type { SessionToken, SessionTokenKind } from '@authup/core-kit';
+export type SessionTokenCreateInput = {
+    id: string;
+    session_id: string;
+    kind: SessionTokenKind;
+    parent_id?: string | null;
+    refresh_token_id?: string | null;
+    ip_address: string;
+    user_agent: string;
+    expires_at: string;
+};
+export type SessionTokenRef = {
+    id: string;
+    expires_at: string;
+};
+export interface ISessionTokenRepository {
+    /**
+     * Persist a newly issued session-token row.
+     */
+    create(input: SessionTokenCreateInput): Promise<SessionToken>;
+    /**
+     * Find a session-token row by its id (= jti).
+     */
+    findOneById(id: string): Promise<SessionToken | null>;
+    /**
+     * Inventory query — every token bound to a session.
+     */
+    findBySessionId(sessionId: string): Promise<SessionToken[]>;
+    /**
+     * Atomically consume a refresh-token row. Resolves `true` only when this
+     * call flipped a fresh (not consumed, not revoked) refresh row to consumed;
+     * `false` on a replay / concurrent-refresh loser.
+     *
+     * @param id jti
+     * @param at consumption timestamp (iso)
+     */
+    markRefreshConsumed(id: string, at: string): Promise<boolean>;
+    /**
+     * Whether any refresh-token row descended from `parentId` has itself been
+     * consumed — i.e. the rotation chain has advanced past `parentId`. Used to
+     * scope the grace window to the chain tip (a consumed descendant proves the
+     * presented token is a stale ancestor, not a benign concurrent re-use).
+     *
+     * @param parentId jti of the presented refresh token
+     */
+    hasConsumedChild(parentId: string): Promise<boolean>;
+    /**
+     * Soft-revoke a single token row (e.g. explicit `/token/revoke`).
+     *
+     * @param id jti
+     * @param at revocation timestamp (iso)
+     */
+    revokeById(id: string, at: string): Promise<void>;
+    /**
+     * Soft-revoke every token row of a session (family revoke). Returns the
+     * affected rows' jti + expiry so the caller can blocklist each in cache
+     * with a TTL pinned to the token's real lifetime.
+     *
+     * @param sessionId
+     * @param at revocation timestamp (iso)
+     */
+    revokeBySessionId(sessionId: string, at: string): Promise<SessionTokenRef[]>;
+    /**
+     * Delete every token row whose `expires_at` is before the given timestamp.
+     *
+     * @param before iso timestamp
+     */
+    deleteExpired(before: string): Promise<number>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/oauth2/session-token/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/session-token/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEvE,MAAM,MAAM,uBAAuB,GAAG;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,gBAAgB,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,WAAW,uBAAuB;IACpC;;OAEG;IACH,MAAM,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAE9D;;OAEG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAEtD;;OAEG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAE5D;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE9D;;;;;;;OAOG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAErD;;;;;OAKG;IACH,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElD;;;;;;;OAOG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAE7E;;;;OAIG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAClD"}

package/dist/core/oauth2/session-token/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/oauth2/token/index.mjs

@@ -2,6 +2,7 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { OAuth2AccessTokenIssuer } from "./issuer/access/module.mjs";
+import { OAuth2MfaTokenIssuer } from "./issuer/mfa/module.mjs";
 import { OAuth2OpenIDTokenIssuer } from "./issuer/open-id/module.mjs";
 import { OAuth2RefreshTokenIssuer } from "./issuer/refresh/module.mjs";
 import "./issuer/index.mjs";
@@ -11,4 +12,4 @@ import { OAuth2TokenSigner } from "./signer/module.mjs";
 import "./signer/index.mjs";
 import { OAuth2TokenVerifier } from "./verifier/module.mjs";
 import "./verifier/index.mjs";
-export { OAuth2AccessTokenIssuer, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenIssuer, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier };
+export { OAuth2AccessTokenIssuer, OAuth2MfaTokenIssuer, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenIssuer, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier };

package/dist/core/oauth2/token/issuer/access/module.d.ts

@@ -1,6 +1,7 @@
 import type { OAuth2TokenPayload } from '@authup/specs';
 import type { IOAuth2TokenSigner } from '../../signer/index.ts';
 import type { IOAuth2TokenRepository } from '../../repository/index.ts';
+import type { ISessionTokenRepository } from '../../../session-token/index.ts';
 import { OAuth2BaseTokenIssuer } from '../base.ts';
 import type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';
 import type { IIdentityRoleProvider } from '../../../../identity/index.ts';
@@ -8,7 +9,8 @@ export declare class OAuth2AccessTokenIssuer extends OAuth2BaseTokenIssuer imple
     protected repository: IOAuth2TokenRepository;
     protected signer: IOAuth2TokenSigner;
     protected identityRoleProvider?: IIdentityRoleProvider;
-    constructor(repository: IOAuth2TokenRepository, signer: IOAuth2TokenSigner, options?: OAuth2TokenIssuerOptions, identityRoleProvider?: IIdentityRoleProvider);
+    protected sessionTokenRepository?: ISessionTokenRepository;
+    constructor(repository: IOAuth2TokenRepository, signer: IOAuth2TokenSigner, options?: OAuth2TokenIssuerOptions, identityRoleProvider?: IIdentityRoleProvider, sessionTokenRepository?: ISessionTokenRepository);
     issue(input?: OAuth2TokenPayload): Promise<OAuth2TokenIssuerResponse>;
     protected buildAccessClaims(input: OAuth2TokenPayload): Promise<Pick<OAuth2TokenPayload, 'realm_access' | 'global_access'>>;
 }

package/dist/core/oauth2/token/issuer/access/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/token/issuer/access/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAC3G,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAE3E,qBAAa,uBAAwB,SAAQ,qBAAsB,YAAW,kBAAkB;IAC5F,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,MAAM,EAAG,kBAAkB,CAAC;IAEtC,SAAS,CAAC,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;gBAGnD,UAAU,EAAE,sBAAsB,EAClC,MAAM,EAAE,kBAAkB,EAC1B,OAAO,GAAE,wBAA6B,EACtC,oBAAoB,CAAC,EAAE,qBAAqB;IAS1C,KAAK,CAAC,KAAK,GAAE,kBAAuB,GAAI,OAAO,CAAC,yBAAyB,CAAC;cAoBhE,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,GAAI,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,cAAc,GAAG,eAAe,CAAC,CAAC;CA6BrI"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/token/issuer/access/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAC3G,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAE3E,qBAAa,uBAAwB,SAAQ,qBAAsB,YAAW,kBAAkB;IAC5F,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,MAAM,EAAG,kBAAkB,CAAC;IAEtC,SAAS,CAAC,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAEvD,SAAS,CAAC,sBAAsB,CAAC,EAAE,uBAAuB,CAAC;gBAGvD,UAAU,EAAE,sBAAsB,EAClC,MAAM,EAAE,kBAAkB,EAC1B,OAAO,GAAE,wBAA6B,EACtC,oBAAoB,CAAC,EAAE,qBAAqB,EAC5C,sBAAsB,CAAC,EAAE,uBAAuB;IAU9C,KAAK,CAAC,KAAK,GAAE,kBAAuB,GAAI,OAAO,CAAC,yBAAyB,CAAC;cAgChE,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,GAAI,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,cAAc,GAAG,eAAe,CAAC,CAAC;CA6BrI"}

package/dist/core/oauth2/token/issuer/access/module.mjs

@@ -8,11 +8,13 @@ var OAuth2AccessTokenIssuer = class extends OAuth2BaseTokenIssuer {
 	repository;
 	signer;
 	identityRoleProvider;
-	constructor(repository, signer, options = {}, identityRoleProvider) {
+	sessionTokenRepository;
+	constructor(repository, signer, options = {}, identityRoleProvider, sessionTokenRepository) {
 		super(options);
 		this.repository = repository;
 		this.signer = signer;
 		this.identityRoleProvider = identityRoleProvider;
+		this.sessionTokenRepository = sessionTokenRepository;
 	}
 	async issue(input = {}) {
 		const iss = this.buildIss(input);
@@ -26,6 +28,15 @@ var OAuth2AccessTokenIssuer = class extends OAuth2BaseTokenIssuer {
 		});
 		const token = await this.signer.sign(data);
 		await this.repository.saveWithSignature(data, token);
+		if (this.sessionTokenRepository && data.session_id && data.jti && typeof data.exp === "number") await this.sessionTokenRepository.create({
+			id: data.jti,
+			session_id: data.session_id,
+			kind: "access",
+			refresh_token_id: input.refresh_token_id ?? null,
+			ip_address: data.remote_address ?? "",
+			user_agent: data.user_agent ?? "",
+			expires_at: (/* @__PURE__ */ new Date(data.exp * 1e3)).toISOString()
+		});
 		return [token, data];
 	}
 	async buildAccessClaims(input) {

package/dist/core/oauth2/token/issuer/access/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2TokenKind","OAuth2BaseTokenIssuer","OAuth2AccessTokenIssuer","repository","signer","identityRoleProvider","options","issue","input","iss","buildIss","accessClaims","buildAccessClaims","data","insert","kind","ACCESS","exp","buildExp","token","sign","saveWithSignature","sub","sub_kind","roles","getRolesFor","type","id","clientId","client_id","realmId","realm_id","realmName","realm_name","realmRoles","globalRoles","role","push","name","realm_access","global_access"],"sources":["../../../../../../src/core/oauth2/token/issuer/access/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';\nimport type { IIdentityRoleProvider } from '../../../../identity/index.ts';\n\nexport class OAuth2AccessTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    protected identityRoleProvider?: IIdentityRoleProvider;\n\n    constructor(\n        repository: IOAuth2TokenRepository,\n        signer: IOAuth2TokenSigner,\n        options: OAuth2TokenIssuerOptions = {},\n        identityRoleProvider?: IIdentityRoleProvider,\n    ) {\n        super(options);\n\n        this.repository = repository;\n        this.signer = signer;\n        this.identityRoleProvider = identityRoleProvider;\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        const iss = this.buildIss(input);\n\n        const accessClaims = await this.buildAccessClaims(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            kind: OAuth2TokenKind.ACCESS,\n            exp: this.buildExp(input),\n            ...(iss ? { iss } : {}),\n            ...accessClaims,\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        return [token, data];\n    }\n\n    protected async buildAccessClaims(input: OAuth2TokenPayload) : Promise<Pick<OAuth2TokenPayload, 'realm_access' | 'global_access'>> {\n        if (!this.identityRoleProvider || !input.sub || !input.sub_kind) {\n            return {};\n        }\n\n        const roles = await this.identityRoleProvider.getRolesFor({\n            type: input.sub_kind,\n            id: input.sub,\n            clientId: input.client_id,\n            realmId: input.realm_id,\n            realmName: input.realm_name,\n        });\n\n        const realmRoles: string[] = [];\n        const globalRoles: string[] = [];\n\n        for (const role of roles) {\n            if (!role.realm_id) {\n                globalRoles.push(role.name);\n            } else if (input.realm_id && role.realm_id === input.realm_id) {\n                realmRoles.push(role.name);\n            }\n        }\n\n        return {\n            realm_access: { roles: realmRoles },\n            global_access: { roles: globalRoles },\n        };\n    }\n}\n"],"mappings":";;;;;;AAeA,IAAaE,0BAAb,cAA6CD,sBAAAA;CAC/BE;CAEAC;CAEAC;CAEV,YACIF,YACAC,QACAE,UAAoC,CAAC,GACrCD,sBACF;EACE,MAAMC,OAAAA;EAEN,KAAKH,aAAaA;EAClB,KAAKC,SAASA;EACd,KAAKC,uBAAuBA;CAChC;CAEA,MAAME,MAAMC,QAA4B,CAAC,GAAwC;EAC7E,MAAMC,MAAM,KAAKC,SAASF,KAAAA;EAE1B,MAAMG,eAAe,MAAM,KAAKC,kBAAkBJ,KAAAA;EAElD,MAAMK,OAAO,MAAM,KAAKV,WAAWW,OAAO;GACtC,GAAGN;GACHO,MAAMf,gBAAgBgB;GACtBC,KAAK,KAAKC,SAASV,KAAAA;GACnB,GAAIC,MAAM,EAAEA,IAAI,IAAI,CAAC;GACrB,GAAGE;EACP,CAAA;EAEA,MAAMQ,QAAQ,MAAM,KAAKf,OAAOgB,KAAKP,IAAAA;EAErC,MAAM,KAAKV,WAAWkB,kBAAkBR,MAAMM,KAAAA;EAE9C,OAAO,CAACA,OAAON,IAAAA;CACnB;CAEA,MAAgBD,kBAAkBJ,OAAiG;EAC/H,IAAI,CAAC,KAAKH,wBAAwB,CAACG,MAAMc,OAAO,CAACd,MAAMe,UACnD,OAAO,CAAC;EAGZ,MAAMC,QAAQ,MAAM,KAAKnB,qBAAqBoB,YAAY;GACtDC,MAAMlB,MAAMe;GACZI,IAAInB,MAAMc;GACVM,UAAUpB,MAAMqB;GAChBC,SAAStB,MAAMuB;GACfC,WAAWxB,MAAMyB;EACrB,CAAA;EAEA,MAAMC,aAAuB,CAAA;EAC7B,MAAMC,cAAwB,CAAA;EAE9B,KAAK,MAAMC,QAAQZ,OACf,IAAI,CAACY,KAAKL,UACNI,YAAYE,KAAKD,KAAKE,IAAI;OACvB,IAAI9B,MAAMuB,YAAYK,KAAKL,aAAavB,MAAMuB,UACjDG,WAAWG,KAAKD,KAAKE,IAAI;EAIjC,OAAO;GACHC,cAAc,EAAEf,OAAOU,WAAW;GAClCM,eAAe,EAAEhB,OAAOW,YAAY;EACxC;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["OAuth2TokenKind","OAuth2BaseTokenIssuer","OAuth2AccessTokenIssuer","repository","signer","identityRoleProvider","sessionTokenRepository","options","issue","input","iss","buildIss","accessClaims","buildAccessClaims","data","insert","kind","ACCESS","exp","buildExp","token","sign","saveWithSignature","session_id","jti","create","id","refresh_token_id","ip_address","remote_address","user_agent","expires_at","Date","toISOString","sub","sub_kind","roles","getRolesFor","type","clientId","client_id","realmId","realm_id","realmName","realm_name","realmRoles","globalRoles","role","push","name","realm_access","global_access"],"sources":["../../../../../../src/core/oauth2/token/issuer/access/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport type { ISessionTokenRepository } from '../../../session-token/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';\nimport type { IIdentityRoleProvider } from '../../../../identity/index.ts';\n\nexport class OAuth2AccessTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    protected identityRoleProvider?: IIdentityRoleProvider;\n\n    protected sessionTokenRepository?: ISessionTokenRepository;\n\n    constructor(\n        repository: IOAuth2TokenRepository,\n        signer: IOAuth2TokenSigner,\n        options: OAuth2TokenIssuerOptions = {},\n        identityRoleProvider?: IIdentityRoleProvider,\n        sessionTokenRepository?: ISessionTokenRepository,\n    ) {\n        super(options);\n\n        this.repository = repository;\n        this.signer = signer;\n        this.identityRoleProvider = identityRoleProvider;\n        this.sessionTokenRepository = sessionTokenRepository;\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        const iss = this.buildIss(input);\n\n        const accessClaims = await this.buildAccessClaims(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            kind: OAuth2TokenKind.ACCESS,\n            exp: this.buildExp(input),\n            ...(iss ? { iss } : {}),\n            ...accessClaims,\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        if (this.sessionTokenRepository && data.session_id && data.jti && typeof data.exp === 'number') {\n            await this.sessionTokenRepository.create({\n                id: data.jti,\n                session_id: data.session_id,\n                kind: 'access',\n                refresh_token_id: input.refresh_token_id ?? null,\n                ip_address: data.remote_address ?? '',\n                user_agent: data.user_agent ?? '',\n                expires_at: new Date(data.exp * 1000).toISOString(),\n            });\n        }\n\n        return [token, data];\n    }\n\n    protected async buildAccessClaims(input: OAuth2TokenPayload) : Promise<Pick<OAuth2TokenPayload, 'realm_access' | 'global_access'>> {\n        if (!this.identityRoleProvider || !input.sub || !input.sub_kind) {\n            return {};\n        }\n\n        const roles = await this.identityRoleProvider.getRolesFor({\n            type: input.sub_kind,\n            id: input.sub,\n            clientId: input.client_id,\n            realmId: input.realm_id,\n            realmName: input.realm_name,\n        });\n\n        const realmRoles: string[] = [];\n        const globalRoles: string[] = [];\n\n        for (const role of roles) {\n            if (!role.realm_id) {\n                globalRoles.push(role.name);\n            } else if (input.realm_id && role.realm_id === input.realm_id) {\n                realmRoles.push(role.name);\n            }\n        }\n\n        return {\n            realm_access: { roles: realmRoles },\n            global_access: { roles: globalRoles },\n        };\n    }\n}\n"],"mappings":";;;;;;AAgBA,IAAaE,0BAAb,cAA6CD,sBAAAA;CAC/BE;CAEAC;CAEAC;CAEAC;CAEV,YACIH,YACAC,QACAG,UAAoC,CAAC,GACrCF,sBACAC,wBACF;EACE,MAAMC,OAAAA;EAEN,KAAKJ,aAAaA;EAClB,KAAKC,SAASA;EACd,KAAKC,uBAAuBA;EAC5B,KAAKC,yBAAyBA;CAClC;CAEA,MAAME,MAAMC,QAA4B,CAAC,GAAwC;EAC7E,MAAMC,MAAM,KAAKC,SAASF,KAAAA;EAE1B,MAAMG,eAAe,MAAM,KAAKC,kBAAkBJ,KAAAA;EAElD,MAAMK,OAAO,MAAM,KAAKX,WAAWY,OAAO;GACtC,GAAGN;GACHO,MAAMhB,gBAAgBiB;GACtBC,KAAK,KAAKC,SAASV,KAAAA;GACnB,GAAIC,MAAM,EAAEA,IAAI,IAAI,CAAC;GACrB,GAAGE;EACP,CAAA;EAEA,MAAMQ,QAAQ,MAAM,KAAKhB,OAAOiB,KAAKP,IAAAA;EAErC,MAAM,KAAKX,WAAWmB,kBAAkBR,MAAMM,KAAAA;EAE9C,IAAI,KAAKd,0BAA0BQ,KAAKS,cAAcT,KAAKU,OAAO,OAAOV,KAAKI,QAAQ,UAClF,MAAM,KAAKZ,uBAAuBmB,OAAO;GACrCC,IAAIZ,KAAKU;GACTD,YAAYT,KAAKS;GACjBP,MAAM;GACNW,kBAAkBlB,MAAMkB,oBAAoB;GAC5CC,YAAYd,KAAKe,kBAAkB;GACnCC,YAAYhB,KAAKgB,cAAc;GAC/BC,6BAAY,IAAIC,KAAKlB,KAAKI,MAAM,GAAA,EAAA,CAAMe,YAAW;EACrD,CAAA;EAGJ,OAAO,CAACb,OAAON,IAAAA;CACnB;CAEA,MAAgBD,kBAAkBJ,OAAiG;EAC/H,IAAI,CAAC,KAAKJ,wBAAwB,CAACI,MAAMyB,OAAO,CAACzB,MAAM0B,UACnD,OAAO,CAAC;EAGZ,MAAMC,QAAQ,MAAM,KAAK/B,qBAAqBgC,YAAY;GACtDC,MAAM7B,MAAM0B;GACZT,IAAIjB,MAAMyB;GACVK,UAAU9B,MAAM+B;GAChBC,SAAShC,MAAMiC;GACfC,WAAWlC,MAAMmC;EACrB,CAAA;EAEA,MAAMC,aAAuB,CAAA;EAC7B,MAAMC,cAAwB,CAAA;EAE9B,KAAK,MAAMC,QAAQX,OACf,IAAI,CAACW,KAAKL,UACNI,YAAYE,KAAKD,KAAKE,IAAI;OACvB,IAAIxC,MAAMiC,YAAYK,KAAKL,aAAajC,MAAMiC,UACjDG,WAAWG,KAAKD,KAAKE,IAAI;EAIjC,OAAO;GACHC,cAAc,EAAEd,OAAOS,WAAW;GAClCM,eAAe,EAAEf,OAAOU,YAAY;EACxC;CACJ;AACJ"}

package/dist/core/oauth2/token/issuer/index.d.ts

@@ -1,4 +1,5 @@
 export * from './access/index.ts';
+export * from './mfa/index.ts';
 export * from './open-id/index.ts';
 export * from './refresh/index.ts';
 export * from './types.ts';

package/dist/core/oauth2/token/issuer/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/token/issuer/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AAEnC,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/token/issuer/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AAEnC,cAAc,YAAY,CAAC"}

package/dist/core/oauth2/token/issuer/index.mjs

@@ -3,8 +3,10 @@ import "node:url";
 import.meta.url;
 import { OAuth2AccessTokenIssuer } from "./access/module.mjs";
 import "./access/index.mjs";
+import { OAuth2MfaTokenIssuer } from "./mfa/module.mjs";
+import "./mfa/index.mjs";
 import { OAuth2OpenIDTokenIssuer } from "./open-id/module.mjs";
 import "./open-id/index.mjs";
 import { OAuth2RefreshTokenIssuer } from "./refresh/module.mjs";
 import "./refresh/index.mjs";
-export { OAuth2AccessTokenIssuer, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenIssuer };
+export { OAuth2AccessTokenIssuer, OAuth2MfaTokenIssuer, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenIssuer };

package/dist/core/oauth2/token/issuer/mfa/index.d.ts

@@ -0,0 +1,2 @@
+export * from './module.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/token/issuer/mfa/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/token/issuer/mfa/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC"}

package/dist/core/oauth2/token/issuer/mfa/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { OAuth2MfaTokenIssuer } from "./module.mjs";
+export { OAuth2MfaTokenIssuer };

package/dist/core/oauth2/token/issuer/mfa/module.d.ts

@@ -0,0 +1,18 @@
+import type { OAuth2TokenPayload } from '@authup/specs';
+import type { IOAuth2TokenSigner } from '../../signer/index.ts';
+import type { IOAuth2TokenRepository } from '../../repository/index.ts';
+import { OAuth2BaseTokenIssuer } from '../base.ts';
+import type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';
+/**
+ * Issues the short-lived "MFA-pending" login ticket (kind: mfa_token).
+ * Deliberately minimal: no role claims, no scope, no session-token
+ * inventory row — the ticket is not a bearer, it only unlocks the
+ * challenge routes (which opt in by kind).
+ */
+export declare class OAuth2MfaTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {
+    protected repository: IOAuth2TokenRepository;
+    protected signer: IOAuth2TokenSigner;
+    constructor(repository: IOAuth2TokenRepository, signer: IOAuth2TokenSigner, options?: OAuth2TokenIssuerOptions);
+    issue(input?: OAuth2TokenPayload): Promise<OAuth2TokenIssuerResponse>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/oauth2/token/issuer/mfa/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/token/issuer/mfa/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAE3G;;;;;GAKG;AACH,qBAAa,oBAAqB,SAAQ,qBAAsB,YAAW,kBAAkB;IACzF,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,MAAM,EAAG,kBAAkB,CAAC;gBAGlC,UAAU,EAAE,sBAAsB,EAClC,MAAM,EAAE,kBAAkB,EAC1B,OAAO,GAAE,wBAA6B;IAQpC,KAAK,CAAC,KAAK,GAAE,kBAAuB,GAAI,OAAO,CAAC,yBAAyB,CAAC;CAgBnF"}

package/dist/core/oauth2/token/issuer/mfa/module.mjs

@@ -0,0 +1,36 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { OAuth2BaseTokenIssuer } from "../base.mjs";
+import { OAuth2TokenKind } from "@authup/specs";
+//#region src/core/oauth2/token/issuer/mfa/module.ts
+/**
+* Issues the short-lived "MFA-pending" login ticket (kind: mfa_token).
+* Deliberately minimal: no role claims, no scope, no session-token
+* inventory row — the ticket is not a bearer, it only unlocks the
+* challenge routes (which opt in by kind).
+*/ var OAuth2MfaTokenIssuer = class extends OAuth2BaseTokenIssuer {
+	repository;
+	signer;
+	constructor(repository, signer, options = {}) {
+		super(options);
+		this.repository = repository;
+		this.signer = signer;
+	}
+	async issue(input = {}) {
+		const iss = this.buildIss(input);
+		const data = await this.repository.insert({
+			...input,
+			kind: OAuth2TokenKind.MFA,
+			exp: this.buildExp(input),
+			...iss ? { iss } : {}
+		});
+		const token = await this.signer.sign(data);
+		await this.repository.saveWithSignature(data, token);
+		return [token, data];
+	}
+};
+//#endregion
+export { OAuth2MfaTokenIssuer };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/token/issuer/mfa/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["OAuth2TokenKind","OAuth2BaseTokenIssuer","OAuth2MfaTokenIssuer","repository","signer","options","issue","input","iss","buildIss","data","insert","kind","MFA","exp","buildExp","token","sign","saveWithSignature"],"sources":["../../../../../../src/core/oauth2/token/issuer/mfa/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';\n\n/**\n * Issues the short-lived \"MFA-pending\" login ticket (kind: mfa_token).\n * Deliberately minimal: no role claims, no scope, no session-token\n * inventory row — the ticket is not a bearer, it only unlocks the\n * challenge routes (which opt in by kind).\n */\nexport class OAuth2MfaTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    constructor(\n        repository: IOAuth2TokenRepository,\n        signer: IOAuth2TokenSigner,\n        options: OAuth2TokenIssuerOptions = {},\n    ) {\n        super(options);\n\n        this.repository = repository;\n        this.signer = signer;\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        const iss = this.buildIss(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            kind: OAuth2TokenKind.MFA,\n            exp: this.buildExp(input),\n            ...(iss ? { iss } : {}),\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        return [token, data];\n    }\n}\n"],"mappings":";;;;;;;;;;;GAoBA,IAAaE,uBAAb,cAA0CD,sBAAAA;CAC5BE;CAEAC;CAEV,YACID,YACAC,QACAC,UAAoC,CAAC,GACvC;EACE,MAAMA,OAAAA;EAEN,KAAKF,aAAaA;EAClB,KAAKC,SAASA;CAClB;CAEA,MAAME,MAAMC,QAA4B,CAAC,GAAwC;EAC7E,MAAMC,MAAM,KAAKC,SAASF,KAAAA;EAE1B,MAAMG,OAAO,MAAM,KAAKP,WAAWQ,OAAO;GACtC,GAAGJ;GACHK,MAAMZ,gBAAgBa;GACtBC,KAAK,KAAKC,SAASR,KAAAA;GACnB,GAAIC,MAAM,EAAEA,IAAI,IAAI,CAAC;EACzB,CAAA;EAEA,MAAMQ,QAAQ,MAAM,KAAKZ,OAAOa,KAAKP,IAAAA;EAErC,MAAM,KAAKP,WAAWe,kBAAkBR,MAAMM,KAAAA;EAE9C,OAAO,CAACA,OAAON,IAAAA;CACnB;AACJ"}

package/dist/core/oauth2/token/issuer/open-id/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/token/issuer/open-id/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,KAAK,EAAE,wBAAwB,EAAE,8BAA8B,EAAE,MAAM,YAAY,CAAC;AAC3F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAEvE,qBAAa,uBAAwB,SAAQ,qBAAsB,YAAW,wBAAwB;IAClG,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,MAAM,EAAG,kBAAkB,CAAC;IAEtC,SAAS,CAAC,gBAAgB,EAAG,iBAAiB,CAAC;IAE/C,SAAS,CAAC,aAAa,EAAE,yBAAyB,CAAC;gBAEvC,GAAG,EAAE,8BAA8B;IAUzC,KAAK,CAAC,KAAK,GAAE,kBAAuB,GAAI,OAAO,CAAC,yBAAyB,CAAC;IAqB1E,iBAAiB,CACnB,KAAK,EAAE,kBAAkB,EACzB,QAAQ,EAAE,QAAQ,GACnB,OAAO,CAAC,yBAAyB,CAAC;CAwBxC"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/token/issuer/open-id/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,KAAK,EAAE,wBAAwB,EAAE,8BAA8B,EAAE,MAAM,YAAY,CAAC;AAC3F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAEvE,qBAAa,uBAAwB,SAAQ,qBAAsB,YAAW,wBAAwB;IAClG,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,MAAM,EAAG,kBAAkB,CAAC;IAEtC,SAAS,CAAC,gBAAgB,EAAG,iBAAiB,CAAC;IAE/C,SAAS,CAAC,aAAa,EAAE,yBAAyB,CAAC;gBAEvC,GAAG,EAAE,8BAA8B;IAUzC,KAAK,CAAC,KAAK,GAAE,kBAAuB,GAAI,OAAO,CAAC,yBAAyB,CAAC;IAqB1E,iBAAiB,CACnB,KAAK,EAAE,kBAAkB,EACzB,QAAQ,EAAE,QAAQ,GACnB,OAAO,CAAC,yBAAyB,CAAC;CA2BxC"}

package/dist/core/oauth2/token/issuer/open-id/module.mjs

@@ -33,7 +33,7 @@ var OAuth2OpenIDTokenIssuer = class extends OAuth2BaseTokenIssuer {
 			...input,
 			...claims,
 			kind: OAuth2TokenKind.ID_TOKEN,
-			auth_time: utc,
+			auth_time: typeof input.auth_time === "number" ? input.auth_time : utc,
 			exp: this.buildExp(input),
 			updated_at: utc,
 			...iss ? { iss } : {},

package/dist/core/oauth2/token/issuer/open-id/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["JWTError","OAuth2TokenKind","OAuth2OpenIDClaimsBuilder","OAuth2BaseTokenIssuer","OAuth2OpenIDTokenIssuer","repository","signer","identityResolver","claimsBuilder","ctx","options","issue","input","sub_kind","payloadPropertyInvalid","sub","identity","resolve","payloadInvalid","issueWithIdentity","claims","fromIdentity","utc","Math","floor","Date","getTime","iss","buildIss","data","insert","kind","ID_TOKEN","auth_time","exp","buildExp","updated_at","client_id","aud","token","sign","saveWithSignature"],"sources":["../../../../../../src/core/oauth2/token/issuer/open-id/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { JWTError, OAuth2TokenKind } from '@authup/specs';\nimport type { Identity } from '@authup/core-kit';\nimport { OAuth2OpenIDClaimsBuilder } from '../../../openid/index.ts';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { OAuth2TokenIssuerResponse } from '../types.ts';\nimport type { IOAuth2OpenIDTokenIssuer, OAuth2OpenIDTokenIssuerContext } from './types.ts';\nimport type { IIdentityResolver } from '../../../../identity/index.ts';\n\nexport class OAuth2OpenIDTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2OpenIDTokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    protected identityResolver : IIdentityResolver;\n\n    protected claimsBuilder: OAuth2OpenIDClaimsBuilder;\n\n    constructor(ctx: OAuth2OpenIDTokenIssuerContext) {\n        super(ctx.options);\n\n        this.repository = ctx.repository;\n        this.signer = ctx.signer;\n\n        this.identityResolver = ctx.identityResolver;\n        this.claimsBuilder = new OAuth2OpenIDClaimsBuilder();\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        if (!input.sub_kind) {\n            throw JWTError.payloadPropertyInvalid('sub_kind');\n        }\n\n        if (!input.sub) {\n            throw JWTError.payloadPropertyInvalid('sub');\n        }\n\n        const identity = await this.identityResolver.resolve(\n            input.sub_kind,\n            input.sub,\n        );\n\n        if (!identity) {\n            throw JWTError.payloadInvalid();\n        }\n\n        return this.issueWithIdentity(input, identity);\n    }\n\n    async issueWithIdentity(\n        input: OAuth2TokenPayload,\n        identity: Identity,\n    ): Promise<OAuth2TokenIssuerResponse> {\n        const claims = this.claimsBuilder.fromIdentity(identity);\n\n        const utc = Math.floor(new Date().getTime() / 1000);\n\n        const iss = this.buildIss(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            ...claims,\n            kind: OAuth2TokenKind.ID_TOKEN,\n            auth_time: utc,\n            exp: this.buildExp(input),\n            updated_at: utc,\n            ...(iss ? { iss } : {}),\n            ...(input.client_id ? { aud: input.client_id } : {}),\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        return [token, data];\n    }\n}\n"],"mappings":";;;;;;;;AAkBA,IAAaI,0BAAb,cAA6CD,sBAAAA;CAC/BE;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAMA,IAAIC,OAAO;EAEjB,KAAKL,aAAaI,IAAIJ;EACtB,KAAKC,SAASG,IAAIH;EAElB,KAAKC,mBAAmBE,IAAIF;EAC5B,KAAKC,gBAAgB,IAAIN,0BAAAA;CAC7B;CAEA,MAAMS,MAAMC,QAA4B,CAAC,GAAwC;EAC7E,IAAI,CAACA,MAAMC,UACP,MAAMb,SAASc,uBAAuB,UAAA;EAG1C,IAAI,CAACF,MAAMG,KACP,MAAMf,SAASc,uBAAuB,KAAA;EAG1C,MAAME,WAAW,MAAM,KAAKT,iBAAiBU,QACzCL,MAAMC,UACND,MAAMG,GAAG;EAGb,IAAI,CAACC,UACD,MAAMhB,SAASkB,eAAc;EAGjC,OAAO,KAAKC,kBAAkBP,OAAOI,QAAAA;CACzC;CAEA,MAAMG,kBACFP,OACAI,UACkC;EAClC,MAAMI,SAAS,KAAKZ,cAAca,aAAaL,QAAAA;EAE/C,MAAMM,MAAMC,KAAKC,uBAAM,IAAIC,KAAAA,EAAAA,CAAOC,QAAO,IAAK,GAAA;EAE9C,MAAMC,MAAM,KAAKC,SAAShB,KAAAA;EAE1B,MAAMiB,OAAO,MAAM,KAAKxB,WAAWyB,OAAO;GACtC,GAAGlB;GACH,GAAGQ;GACHW,MAAM9B,gBAAgB+B;GACtBC,WAAWX;GACXY,KAAK,KAAKC,SAASvB,KAAAA;GACnBwB,YAAYd;GACZ,GAAIK,MAAM,EAAEA,IAAI,IAAI,CAAC;GACrB,GAAIf,MAAMyB,YAAY,EAAEC,KAAK1B,MAAMyB,UAAU,IAAI,CAAC;EACtD,CAAA;EAEA,MAAME,QAAQ,MAAM,KAAKjC,OAAOkC,KAAKX,IAAAA;EAErC,MAAM,KAAKxB,WAAWoC,kBAAkBZ,MAAMU,KAAAA;EAE9C,OAAO,CAACA,OAAOV,IAAAA;CACnB;AACJ"}
+{"version":3,"file":"module.mjs","names":["JWTError","OAuth2TokenKind","OAuth2OpenIDClaimsBuilder","OAuth2BaseTokenIssuer","OAuth2OpenIDTokenIssuer","repository","signer","identityResolver","claimsBuilder","ctx","options","issue","input","sub_kind","payloadPropertyInvalid","sub","identity","resolve","payloadInvalid","issueWithIdentity","claims","fromIdentity","utc","Math","floor","Date","getTime","iss","buildIss","data","insert","kind","ID_TOKEN","auth_time","exp","buildExp","updated_at","client_id","aud","token","sign","saveWithSignature"],"sources":["../../../../../../src/core/oauth2/token/issuer/open-id/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { JWTError, OAuth2TokenKind } from '@authup/specs';\nimport type { Identity } from '@authup/core-kit';\nimport { OAuth2OpenIDClaimsBuilder } from '../../../openid/index.ts';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { OAuth2TokenIssuerResponse } from '../types.ts';\nimport type { IOAuth2OpenIDTokenIssuer, OAuth2OpenIDTokenIssuerContext } from './types.ts';\nimport type { IIdentityResolver } from '../../../../identity/index.ts';\n\nexport class OAuth2OpenIDTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2OpenIDTokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    protected identityResolver : IIdentityResolver;\n\n    protected claimsBuilder: OAuth2OpenIDClaimsBuilder;\n\n    constructor(ctx: OAuth2OpenIDTokenIssuerContext) {\n        super(ctx.options);\n\n        this.repository = ctx.repository;\n        this.signer = ctx.signer;\n\n        this.identityResolver = ctx.identityResolver;\n        this.claimsBuilder = new OAuth2OpenIDClaimsBuilder();\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        if (!input.sub_kind) {\n            throw JWTError.payloadPropertyInvalid('sub_kind');\n        }\n\n        if (!input.sub) {\n            throw JWTError.payloadPropertyInvalid('sub');\n        }\n\n        const identity = await this.identityResolver.resolve(\n            input.sub_kind,\n            input.sub,\n        );\n\n        if (!identity) {\n            throw JWTError.payloadInvalid();\n        }\n\n        return this.issueWithIdentity(input, identity);\n    }\n\n    async issueWithIdentity(\n        input: OAuth2TokenPayload,\n        identity: Identity,\n    ): Promise<OAuth2TokenIssuerResponse> {\n        const claims = this.claimsBuilder.fromIdentity(identity);\n\n        const utc = Math.floor(new Date().getTime() / 1000);\n\n        const iss = this.buildIss(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            ...claims,\n            kind: OAuth2TokenKind.ID_TOKEN,\n            // Real authentication time when threaded from the authorize flow\n            // (the session's creation instant); fall back to issuance time only\n            // for session-less id_token issuance. `sid` rides via ...input.\n            auth_time: typeof input.auth_time === 'number' ? input.auth_time : utc,\n            exp: this.buildExp(input),\n            updated_at: utc,\n            ...(iss ? { iss } : {}),\n            ...(input.client_id ? { aud: input.client_id } : {}),\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        return [token, data];\n    }\n}\n"],"mappings":";;;;;;;;AAkBA,IAAaI,0BAAb,cAA6CD,sBAAAA;CAC/BE;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAMA,IAAIC,OAAO;EAEjB,KAAKL,aAAaI,IAAIJ;EACtB,KAAKC,SAASG,IAAIH;EAElB,KAAKC,mBAAmBE,IAAIF;EAC5B,KAAKC,gBAAgB,IAAIN,0BAAAA;CAC7B;CAEA,MAAMS,MAAMC,QAA4B,CAAC,GAAwC;EAC7E,IAAI,CAACA,MAAMC,UACP,MAAMb,SAASc,uBAAuB,UAAA;EAG1C,IAAI,CAACF,MAAMG,KACP,MAAMf,SAASc,uBAAuB,KAAA;EAG1C,MAAME,WAAW,MAAM,KAAKT,iBAAiBU,QACzCL,MAAMC,UACND,MAAMG,GAAG;EAGb,IAAI,CAACC,UACD,MAAMhB,SAASkB,eAAc;EAGjC,OAAO,KAAKC,kBAAkBP,OAAOI,QAAAA;CACzC;CAEA,MAAMG,kBACFP,OACAI,UACkC;EAClC,MAAMI,SAAS,KAAKZ,cAAca,aAAaL,QAAAA;EAE/C,MAAMM,MAAMC,KAAKC,uBAAM,IAAIC,KAAAA,EAAAA,CAAOC,QAAO,IAAK,GAAA;EAE9C,MAAMC,MAAM,KAAKC,SAAShB,KAAAA;EAE1B,MAAMiB,OAAO,MAAM,KAAKxB,WAAWyB,OAAO;GACtC,GAAGlB;GACH,GAAGQ;GACHW,MAAM9B,gBAAgB+B;GAItBC,WAAW,OAAOrB,MAAMqB,cAAc,WAAWrB,MAAMqB,YAAYX;GACnEY,KAAK,KAAKC,SAASvB,KAAAA;GACnBwB,YAAYd;GACZ,GAAIK,MAAM,EAAEA,IAAI,IAAI,CAAC;GACrB,GAAIf,MAAMyB,YAAY,EAAEC,KAAK1B,MAAMyB,UAAU,IAAI,CAAC;EACtD,CAAA;EAEA,MAAME,QAAQ,MAAM,KAAKjC,OAAOkC,KAAKX,IAAAA;EAErC,MAAM,KAAKxB,WAAWoC,kBAAkBZ,MAAMU,KAAAA;EAE9C,OAAO,CAACA,OAAOV,IAAAA;CACnB;AACJ"}

package/dist/core/oauth2/token/issuer/refresh/module.d.ts

@@ -1,12 +1,14 @@
 import type { OAuth2TokenPayload } from '@authup/specs';
 import type { IOAuth2TokenSigner } from '../../signer/index.ts';
 import type { IOAuth2TokenRepository } from '../../repository/index.ts';
+import type { ISessionTokenRepository } from '../../../session-token/index.ts';
 import { OAuth2BaseTokenIssuer } from '../base.ts';
 import type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';
 export declare class OAuth2RefreshTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {
     protected repository: IOAuth2TokenRepository;
     protected signer: IOAuth2TokenSigner;
-    constructor(repository: IOAuth2TokenRepository, signer: IOAuth2TokenSigner, options?: OAuth2TokenIssuerOptions);
+    protected sessionTokenRepository?: ISessionTokenRepository;
+    constructor(repository: IOAuth2TokenRepository, signer: IOAuth2TokenSigner, options?: OAuth2TokenIssuerOptions, sessionTokenRepository?: ISessionTokenRepository);
     issue(input?: OAuth2TokenPayload): Promise<OAuth2TokenIssuerResponse>;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/core/oauth2/token/issuer/refresh/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/token/issuer/refresh/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAE3G,qBAAa,wBAAyB,SAAQ,qBAAsB,YAAW,kBAAkB;IAC7F,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,MAAM,EAAG,kBAAkB,CAAC;gBAGlC,UAAU,EAAE,sBAAsB,EAClC,MAAM,EAAE,kBAAkB,EAC1B,OAAO,GAAE,wBAA6B;IAQpC,KAAK,CAAC,KAAK,GAAE,kBAAuB,GAAI,OAAO,CAAC,yBAAyB,CAAC;CAgBnF"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/token/issuer/refresh/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAE3G,qBAAa,wBAAyB,SAAQ,qBAAsB,YAAW,kBAAkB;IAC7F,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,MAAM,EAAG,kBAAkB,CAAC;IAEtC,SAAS,CAAC,sBAAsB,CAAC,EAAE,uBAAuB,CAAC;gBAGvD,UAAU,EAAE,sBAAsB,EAClC,MAAM,EAAE,kBAAkB,EAC1B,OAAO,GAAE,wBAA6B,EACtC,sBAAsB,CAAC,EAAE,uBAAuB;IAS9C,KAAK,CAAC,KAAK,GAAE,kBAAuB,GAAI,OAAO,CAAC,yBAAyB,CAAC;CA4BnF"}

package/dist/core/oauth2/token/issuer/refresh/module.mjs

@@ -7,10 +7,12 @@ import { OAuth2TokenKind } from "@authup/specs";
 var OAuth2RefreshTokenIssuer = class extends OAuth2BaseTokenIssuer {
 	repository;
 	signer;
-	constructor(repository, signer, options = {}) {
+	sessionTokenRepository;
+	constructor(repository, signer, options = {}, sessionTokenRepository) {
 		super(options);
 		this.repository = repository;
 		this.signer = signer;
+		this.sessionTokenRepository = sessionTokenRepository;
 	}
 	async issue(input = {}) {
 		const iss = this.buildIss(input);
@@ -22,6 +24,15 @@ var OAuth2RefreshTokenIssuer = class extends OAuth2BaseTokenIssuer {
 		});
 		const token = await this.signer.sign(data);
 		await this.repository.saveWithSignature(data, token);
+		if (this.sessionTokenRepository && data.session_id && data.jti && typeof data.exp === "number") await this.sessionTokenRepository.create({
+			id: data.jti,
+			session_id: data.session_id,
+			kind: "refresh",
+			parent_id: input.parent_id ?? null,
+			ip_address: data.remote_address ?? "",
+			user_agent: data.user_agent ?? "",
+			expires_at: (/* @__PURE__ */ new Date(data.exp * 1e3)).toISOString()
+		});
 		return [token, data];
 	}
 };