@authup/server-core 1.0.0-beta.51 → 1.0.0-beta.53

package/dist/core/oauth2/token/issuer/refresh/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2TokenKind","OAuth2BaseTokenIssuer","OAuth2RefreshTokenIssuer","repository","signer","options","issue","input","iss","buildIss","data","insert","kind","REFRESH","exp","buildExp","token","sign","saveWithSignature"],"sources":["../../../../../../src/core/oauth2/token/issuer/refresh/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';\n\nexport class OAuth2RefreshTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    constructor(\n        repository: IOAuth2TokenRepository,\n        signer: IOAuth2TokenSigner,\n        options: OAuth2TokenIssuerOptions = {},\n    ) {\n        super(options);\n\n        this.repository = repository;\n        this.signer = signer;\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        const iss = this.buildIss(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            kind: OAuth2TokenKind.REFRESH,\n            exp: this.buildExp(input),\n            ...(iss ? { iss } : {}),\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        return [token, data];\n    }\n}\n"],"mappings":";;;;;;AAcA,IAAaE,2BAAb,cAA8CD,sBAAAA;CAChCE;CAEAC;CAEV,YACID,YACAC,QACAC,UAAoC,CAAC,GACvC;EACE,MAAMA,OAAAA;EAEN,KAAKF,aAAaA;EAClB,KAAKC,SAASA;CAClB;CAEA,MAAME,MAAMC,QAA4B,CAAC,GAAwC;EAC7E,MAAMC,MAAM,KAAKC,SAASF,KAAAA;EAE1B,MAAMG,OAAO,MAAM,KAAKP,WAAWQ,OAAO;GACtC,GAAGJ;GACHK,MAAMZ,gBAAgBa;GACtBC,KAAK,KAAKC,SAASR,KAAAA;GACnB,GAAIC,MAAM,EAAEA,IAAI,IAAI,CAAC;EACzB,CAAA;EAEA,MAAMQ,QAAQ,MAAM,KAAKZ,OAAOa,KAAKP,IAAAA;EAErC,MAAM,KAAKP,WAAWe,kBAAkBR,MAAMM,KAAAA;EAE9C,OAAO,CAACA,OAAON,IAAAA;CACnB;AACJ"}
+{"version":3,"file":"module.mjs","names":["OAuth2TokenKind","OAuth2BaseTokenIssuer","OAuth2RefreshTokenIssuer","repository","signer","sessionTokenRepository","options","issue","input","iss","buildIss","data","insert","kind","REFRESH","exp","buildExp","token","sign","saveWithSignature","session_id","jti","create","id","parent_id","ip_address","remote_address","user_agent","expires_at","Date","toISOString"],"sources":["../../../../../../src/core/oauth2/token/issuer/refresh/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport type { ISessionTokenRepository } from '../../../session-token/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';\n\nexport class OAuth2RefreshTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    protected sessionTokenRepository?: ISessionTokenRepository;\n\n    constructor(\n        repository: IOAuth2TokenRepository,\n        signer: IOAuth2TokenSigner,\n        options: OAuth2TokenIssuerOptions = {},\n        sessionTokenRepository?: ISessionTokenRepository,\n    ) {\n        super(options);\n\n        this.repository = repository;\n        this.signer = signer;\n        this.sessionTokenRepository = sessionTokenRepository;\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        const iss = this.buildIss(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            kind: OAuth2TokenKind.REFRESH,\n            exp: this.buildExp(input),\n            ...(iss ? { iss } : {}),\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        if (this.sessionTokenRepository && data.session_id && data.jti && typeof data.exp === 'number') {\n            await this.sessionTokenRepository.create({\n                id: data.jti,\n                session_id: data.session_id,\n                kind: 'refresh',\n                parent_id: input.parent_id ?? null,\n                ip_address: data.remote_address ?? '',\n                user_agent: data.user_agent ?? '',\n                expires_at: new Date(data.exp * 1000).toISOString(),\n            });\n        }\n\n        return [token, data];\n    }\n}\n"],"mappings":";;;;;;AAeA,IAAaE,2BAAb,cAA8CD,sBAAAA;CAChCE;CAEAC;CAEAC;CAEV,YACIF,YACAC,QACAE,UAAoC,CAAC,GACrCD,wBACF;EACE,MAAMC,OAAAA;EAEN,KAAKH,aAAaA;EAClB,KAAKC,SAASA;EACd,KAAKC,yBAAyBA;CAClC;CAEA,MAAME,MAAMC,QAA4B,CAAC,GAAwC;EAC7E,MAAMC,MAAM,KAAKC,SAASF,KAAAA;EAE1B,MAAMG,OAAO,MAAM,KAAKR,WAAWS,OAAO;GACtC,GAAGJ;GACHK,MAAMb,gBAAgBc;GACtBC,KAAK,KAAKC,SAASR,KAAAA;GACnB,GAAIC,MAAM,EAAEA,IAAI,IAAI,CAAC;EACzB,CAAA;EAEA,MAAMQ,QAAQ,MAAM,KAAKb,OAAOc,KAAKP,IAAAA;EAErC,MAAM,KAAKR,WAAWgB,kBAAkBR,MAAMM,KAAAA;EAE9C,IAAI,KAAKZ,0BAA0BM,KAAKS,cAAcT,KAAKU,OAAO,OAAOV,KAAKI,QAAQ,UAClF,MAAM,KAAKV,uBAAuBiB,OAAO;GACrCC,IAAIZ,KAAKU;GACTD,YAAYT,KAAKS;GACjBP,MAAM;GACNW,WAAWhB,MAAMgB,aAAa;GAC9BC,YAAYd,KAAKe,kBAAkB;GACnCC,YAAYhB,KAAKgB,cAAc;GAC/BC,6BAAY,IAAIC,KAAKlB,KAAKI,MAAM,GAAA,EAAA,CAAMe,YAAW;EACrD,CAAA;EAGJ,OAAO,CAACb,OAAON,IAAAA;CACnB;AACJ"}

package/dist/core/oauth2/token/repository/types.d.ts

@@ -7,6 +7,16 @@ export interface IOAuth2TokenRepository {
      * @param exp Expiration date in unix timestamp
      */
     setInactive(id: string, exp?: number): Promise<void>;
+    /**
+     * Atomically mark a token inactive, returning whether THIS call performed
+     * the transition (true) or the token was already inactive (false). Backed
+     * by a set-if-absent write, so it is safe for single-use enforcement under
+     * concurrency (no isInactive→setInactive TOCTOU).
+     *
+     * @param id JTI
+     * @param exp Expiration date in unix timestamp
+     */
+    claimInactive(id: string, exp?: number): Promise<boolean>;
     /**
      * Check if a token by its jti is active.
      *

package/dist/core/oauth2/token/repository/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/token/repository/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,MAAM,WAAW,sBAAsB;IACnC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtD;;;;OAIG;IACH,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAIzC;;;;OAIG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAE7D;;;OAGG;IACH,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAIvE;;;;OAIG;IACH,UAAU,CAAC,EAAE,EAAE,MAAM,GAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAIvC;;;;OAIG;IACH,MAAM,CAAC,OAAO,EAAE,kBAAkB,GAAI,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAElE;;;;OAIG;IACH,IAAI,CAAC,OAAO,EAAE,kBAAkB,GAAI,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAEhE;;;;;OAKG;IACH,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,GAAI,OAAO,CAAC,kBAAkB,CAAC,CAAC;CACnG"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/token/repository/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,MAAM,WAAW,sBAAsB;IACnC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtD;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE3D;;;;OAIG;IACH,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAIzC;;;;OAIG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAE7D;;;OAGG;IACH,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAIvE;;;;OAIG;IACH,UAAU,CAAC,EAAE,EAAE,MAAM,GAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAIvC;;;;OAIG;IACH,MAAM,CAAC,OAAO,EAAE,kBAAkB,GAAI,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAElE;;;;OAIG;IACH,IAAI,CAAC,OAAO,EAAE,kBAAkB,GAAI,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAEhE;;;;;OAKG;IACH,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,GAAI,OAAO,CAAC,kBAAkB,CAAC,CAAC;CACnG"}

package/dist/core/oauth2/token/revoker/module.d.ts

@@ -1,9 +1,11 @@
 import type { OAuth2TokenPayload } from '@authup/specs';
 import type { IOAuth2TokenRepository } from '../repository/index.ts';
+import type { ISessionTokenRepository } from '../../session-token/index.ts';
 import type { IOAuth2TokenRevoker } from './types.ts';
 export declare class OAuth2TokenRevoker implements IOAuth2TokenRevoker {
     protected repository: IOAuth2TokenRepository;
-    constructor(repository: IOAuth2TokenRepository);
+    protected sessionTokenRepository?: ISessionTokenRepository;
+    constructor(repository: IOAuth2TokenRepository, sessionTokenRepository?: ISessionTokenRepository);
     revoke(input: OAuth2TokenPayload): Promise<void>;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/core/oauth2/token/revoker/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/token/revoker/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,qBAAa,kBAAmB,YAAW,mBAAmB;IAC1D,SAAS,CAAC,UAAU,EAAG,sBAAsB,CAAC;gBAElC,UAAU,EAAG,sBAAsB;IAIzC,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAI,OAAO,CAAC,IAAI,CAAC;CAO1D"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/token/revoker/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,qBAAa,kBAAmB,YAAW,mBAAmB;IAC1D,SAAS,CAAC,UAAU,EAAG,sBAAsB,CAAC;IAE9C,SAAS,CAAC,sBAAsB,CAAC,EAAG,uBAAuB,CAAC;gBAGxD,UAAU,EAAG,sBAAsB,EACnC,sBAAsB,CAAC,EAAG,uBAAuB;IAM/C,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAI,OAAO,CAAC,IAAI,CAAC;CAoB1D"}

package/dist/core/oauth2/token/revoker/module.mjs

@@ -5,12 +5,16 @@ import { JWTError } from "@authup/specs";
 //#region src/core/oauth2/token/revoker/module.ts
 var OAuth2TokenRevoker = class {
 	repository;
-	constructor(repository) {
+	sessionTokenRepository;
+	constructor(repository, sessionTokenRepository) {
 		this.repository = repository;
+		this.sessionTokenRepository = sessionTokenRepository;
 	}
 	async revoke(input) {
 		if (!input.jti) throw JWTError.payloadPropertyInvalid("jti");
 		await this.repository.removeById(input.jti);
+		await this.repository.setInactive(input.jti, input.exp);
+		if (this.sessionTokenRepository) await this.sessionTokenRepository.revokeById(input.jti, (/* @__PURE__ */ new Date()).toISOString());
 	}
 };
 //#endregion

package/dist/core/oauth2/token/revoker/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["JWTError","OAuth2TokenRevoker","repository","revoke","input","jti","payloadPropertyInvalid","removeById"],"sources":["../../../../../src/core/oauth2/token/revoker/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { JWTError } from '@authup/specs';\nimport type { IOAuth2TokenRepository } from '../repository/index.ts';\nimport type { IOAuth2TokenRevoker } from './types.ts';\n\nexport class OAuth2TokenRevoker implements IOAuth2TokenRevoker {\n    protected repository : IOAuth2TokenRepository;\n\n    constructor(repository : IOAuth2TokenRepository) {\n        this.repository = repository;\n    }\n\n    async revoke(input: OAuth2TokenPayload) : Promise<void> {\n        if (!input.jti) {\n            throw JWTError.payloadPropertyInvalid('jti');\n        }\n\n        await this.repository.removeById(input.jti);\n    }\n}\n"],"mappings":";;;;;AAYA,IAAaC,qBAAb,MAAaA;CACCC;CAEV,YAAYA,YAAqC;EAC7C,KAAKA,aAAaA;CACtB;CAEA,MAAMC,OAAOC,OAA2C;EACpD,IAAI,CAACA,MAAMC,KACP,MAAML,SAASM,uBAAuB,KAAA;EAG1C,MAAM,KAAKJ,WAAWK,WAAWH,MAAMC,GAAG;CAC9C;AACJ"}
+{"version":3,"file":"module.mjs","names":["JWTError","OAuth2TokenRevoker","repository","sessionTokenRepository","revoke","input","jti","payloadPropertyInvalid","removeById","setInactive","exp","revokeById","Date","toISOString"],"sources":["../../../../../src/core/oauth2/token/revoker/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { JWTError } from '@authup/specs';\nimport type { IOAuth2TokenRepository } from '../repository/index.ts';\nimport type { ISessionTokenRepository } from '../../session-token/index.ts';\nimport type { IOAuth2TokenRevoker } from './types.ts';\n\nexport class OAuth2TokenRevoker implements IOAuth2TokenRevoker {\n    protected repository : IOAuth2TokenRepository;\n\n    protected sessionTokenRepository? : ISessionTokenRepository;\n\n    constructor(\n        repository : IOAuth2TokenRepository,\n        sessionTokenRepository? : ISessionTokenRepository,\n    ) {\n        this.repository = repository;\n        this.sessionTokenRepository = sessionTokenRepository;\n    }\n\n    async revoke(input: OAuth2TokenPayload) : Promise<void> {\n        if (!input.jti) {\n            throw JWTError.payloadPropertyInvalid('jti');\n        }\n\n        await this.repository.removeById(input.jti);\n\n        // Blocklist explicitly from the verified payload. `removeById` only\n        // writes the inactive marker when the id-keyed cache entry is still\n        // present, so after a cache flush/eviction an otherwise-valid access\n        // token would return 202 from /token/revoke yet stay active until its\n        // natural expiry. Idempotent with the removeById path on a cache hit.\n        await this.repository.setInactive(input.jti, input.exp);\n\n        // Soft-revoke the durable row so a refresh grant (which trusts the row,\n        // not the cache blocklist) rejects an explicitly revoked refresh token.\n        if (this.sessionTokenRepository) {\n            await this.sessionTokenRepository.revokeById(input.jti, new Date().toISOString());\n        }\n    }\n}\n"],"mappings":";;;;;AAaA,IAAaC,qBAAb,MAAaA;CACCC;CAEAC;CAEV,YACID,YACAC,wBACF;EACE,KAAKD,aAAaA;EAClB,KAAKC,yBAAyBA;CAClC;CAEA,MAAMC,OAAOC,OAA2C;EACpD,IAAI,CAACA,MAAMC,KACP,MAAMN,SAASO,uBAAuB,KAAA;EAG1C,MAAM,KAAKL,WAAWM,WAAWH,MAAMC,GAAG;EAO1C,MAAM,KAAKJ,WAAWO,YAAYJ,MAAMC,KAAKD,MAAMK,GAAG;EAItD,IAAI,KAAKP,wBACL,MAAM,KAAKA,uBAAuBQ,WAAWN,MAAMC,sBAAK,IAAIM,KAAAA,EAAAA,CAAOC,YAAW,CAAA;CAEtF;AACJ"}

package/dist/core/oauth2/token/signer/module.d.ts

@@ -1,9 +1,9 @@
 import type { OAuth2TokenPayload } from '@authup/specs';
-import type { IOAuth2KeyRepository } from '../../key/index.ts';
+import type { IKeyStore } from '../../../key/index.ts';
 import type { IOAuth2TokenSigner } from './types.ts';
 export declare class OAuth2TokenSigner implements IOAuth2TokenSigner {
-    protected keyRepository: IOAuth2KeyRepository;
-    constructor(keyRepository: IOAuth2KeyRepository);
+    protected keyStore: IKeyStore;
+    constructor(keyStore: IKeyStore);
     sign<T extends OAuth2TokenPayload>(payload: T): Promise<string>;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/core/oauth2/token/signer/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/token/signer/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD,qBAAa,iBAAkB,YAAW,kBAAkB;IACxD,SAAS,CAAC,aAAa,EAAG,oBAAoB,CAAC;gBAEnC,aAAa,EAAG,oBAAoB;IAI1C,IAAI,CAAC,CAAC,SAAS,kBAAkB,EAAE,OAAO,EAAE,CAAC,GAAI,OAAO,CAAC,MAAM,CAAC;CAgDzE"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/token/signer/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD,qBAAa,iBAAkB,YAAW,kBAAkB;IACxD,SAAS,CAAC,QAAQ,EAAG,SAAS,CAAC;gBAEnB,QAAQ,EAAG,SAAS;IAI1B,IAAI,CAAC,CAAC,SAAS,kBAAkB,EAAE,OAAO,EAAE,CAAC,GAAI,OAAO,CAAC,MAAM,CAAC;CA+CzE"}

package/dist/core/oauth2/token/signer/module.mjs

@@ -2,17 +2,16 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { signToken } from "@authup/server-kit";
-import { JWKError, JWKType } from "@authup/specs";
+import { JWKError, JWKType, JWKUse } from "@authup/specs";
 //#region src/core/oauth2/token/signer/module.ts
 var OAuth2TokenSigner = class {
-	keyRepository;
-	constructor(keyRepository) {
-		this.keyRepository = keyRepository;
+	keyStore;
+	constructor(keyStore) {
+		this.keyStore = keyStore;
 	}
 	async sign(payload) {
 		if (!payload.realm_id) throw JWKError.invalidRealm();
-		const key = await this.keyRepository.findByRealmId(payload.realm_id);
-		if (!key) throw JWKError.notFoundForRealm(payload.realm_id, payload.realm_name);
+		const key = await this.keyStore.resolveOrCreate(payload.realm_id, JWKUse.SIGNATURE);
 		if (!key.decryption_key) throw JWKError.decryptionKeyMissing();
 		let token;
 		if (key.type === JWKType.OCT) token = await signToken(payload, {

package/dist/core/oauth2/token/signer/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["signToken","JWKError","JWKType","OAuth2TokenSigner","keyRepository","sign","payload","realm_id","invalidRealm","key","findByRealmId","notFoundForRealm","realm_name","decryption_key","decryptionKeyMissing","token","type","OCT","keyId","id","EC","algorithm","signature_algorithm"],"sources":["../../../../../src/core/oauth2/token/signer/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { type TokenECAlgorithm, type TokenRSAAlgorithm, signToken } from '@authup/server-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { JWKError, JWKType } from '@authup/specs';\nimport type { IOAuth2KeyRepository } from '../../key/index.ts';\nimport type { IOAuth2TokenSigner } from './types.ts';\n\nexport class OAuth2TokenSigner implements IOAuth2TokenSigner {\n    protected keyRepository : IOAuth2KeyRepository;\n\n    constructor(keyRepository : IOAuth2KeyRepository) {\n        this.keyRepository = keyRepository;\n    }\n\n    async sign<T extends OAuth2TokenPayload>(payload: T) : Promise<string> {\n        if (!payload.realm_id) {\n            throw JWKError.invalidRealm();\n        }\n\n        const key = await this.keyRepository.findByRealmId(payload.realm_id);\n        if (!key) {\n            throw JWKError.notFoundForRealm(payload.realm_id, payload.realm_name);\n        }\n\n        if (!key.decryption_key) {\n            throw JWKError.decryptionKeyMissing();\n        }\n\n        let token : string;\n        if (key.type === JWKType.OCT) {\n            token = await signToken(\n                payload,\n                {\n                    type: JWKType.OCT,\n                    key: key.decryption_key,\n                    keyId: key.id,\n                },\n            );\n        } else if (key.type === JWKType.EC) {\n            token = await signToken(\n                payload,\n                {\n                    type: key.type,\n                    key: key.decryption_key,\n                    algorithm: key.signature_algorithm as TokenECAlgorithm,\n                    keyId: key.id,\n                },\n            );\n        } else {\n            token = await signToken(\n                payload,\n                {\n                    type: key.type,\n                    key: key.decryption_key,\n                    algorithm: key.signature_algorithm as TokenRSAAlgorithm,\n                    keyId: key.id,\n                },\n            );\n        }\n\n        return token;\n    }\n}\n"],"mappings":";;;;;;AAaA,IAAaG,oBAAb,MAAaA;CACCC;CAEV,YAAYA,eAAsC;EAC9C,KAAKA,gBAAgBA;CACzB;CAEA,MAAMC,KAAmCC,SAA8B;EACnE,IAAI,CAACA,QAAQC,UACT,MAAMN,SAASO,aAAY;EAG/B,MAAMC,MAAM,MAAM,KAAKL,cAAcM,cAAcJ,QAAQC,QAAQ;EACnE,IAAI,CAACE,KACD,MAAMR,SAASU,iBAAiBL,QAAQC,UAAUD,QAAQM,UAAU;EAGxE,IAAI,CAACH,IAAII,gBACL,MAAMZ,SAASa,qBAAoB;EAGvC,IAAIC;EACJ,IAAIN,IAAIO,SAASd,QAAQe,KACrBF,QAAQ,MAAMf,UACVM,SACA;GACIU,MAAMd,QAAQe;GACdR,KAAKA,IAAII;GACTK,OAAOT,IAAIU;EACf,CAAA;OAED,IAAIV,IAAIO,SAASd,QAAQkB,IAC5BL,QAAQ,MAAMf,UACVM,SACA;GACIU,MAAMP,IAAIO;GACVP,KAAKA,IAAII;GACTQ,WAAWZ,IAAIa;GACfJ,OAAOT,IAAIU;EACf,CAAA;OAGJJ,QAAQ,MAAMf,UACVM,SACA;GACIU,MAAMP,IAAIO;GACVP,KAAKA,IAAII;GACTQ,WAAWZ,IAAIa;GACfJ,OAAOT,IAAIU;EACf,CAAA;EAIR,OAAOJ;CACX;AACJ"}
+{"version":3,"file":"module.mjs","names":["signToken","JWKError","JWKType","JWKUse","OAuth2TokenSigner","keyStore","sign","payload","realm_id","invalidRealm","key","resolveOrCreate","SIGNATURE","decryption_key","decryptionKeyMissing","token","type","OCT","keyId","id","EC","algorithm","signature_algorithm"],"sources":["../../../../../src/core/oauth2/token/signer/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { type TokenECAlgorithm, type TokenRSAAlgorithm, signToken } from '@authup/server-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { JWKError, JWKType, JWKUse } from '@authup/specs';\nimport type { IKeyStore } from '../../../key/index.ts';\nimport type { IOAuth2TokenSigner } from './types.ts';\n\nexport class OAuth2TokenSigner implements IOAuth2TokenSigner {\n    protected keyStore : IKeyStore;\n\n    constructor(keyStore : IKeyStore) {\n        this.keyStore = keyStore;\n    }\n\n    async sign<T extends OAuth2TokenPayload>(payload: T) : Promise<string> {\n        if (!payload.realm_id) {\n            throw JWKError.invalidRealm();\n        }\n\n        // highest-priority ACTIVE key — passive keys only verify, and an\n        // all-disabled realm fails loud inside the store.\n        const key = await this.keyStore.resolveOrCreate(payload.realm_id, JWKUse.SIGNATURE);\n\n        if (!key.decryption_key) {\n            throw JWKError.decryptionKeyMissing();\n        }\n\n        let token : string;\n        if (key.type === JWKType.OCT) {\n            token = await signToken(\n                payload,\n                {\n                    type: JWKType.OCT,\n                    key: key.decryption_key,\n                    keyId: key.id,\n                },\n            );\n        } else if (key.type === JWKType.EC) {\n            token = await signToken(\n                payload,\n                {\n                    type: key.type,\n                    key: key.decryption_key,\n                    algorithm: key.signature_algorithm as TokenECAlgorithm,\n                    keyId: key.id,\n                },\n            );\n        } else {\n            token = await signToken(\n                payload,\n                {\n                    type: key.type,\n                    key: key.decryption_key,\n                    algorithm: key.signature_algorithm as TokenRSAAlgorithm,\n                    keyId: key.id,\n                },\n            );\n        }\n\n        return token;\n    }\n}\n"],"mappings":";;;;;;AAaA,IAAaI,oBAAb,MAAaA;CACCC;CAEV,YAAYA,UAAsB;EAC9B,KAAKA,WAAWA;CACpB;CAEA,MAAMC,KAAmCC,SAA8B;EACnE,IAAI,CAACA,QAAQC,UACT,MAAMP,SAASQ,aAAY;EAK/B,MAAMC,MAAM,MAAM,KAAKL,SAASM,gBAAgBJ,QAAQC,UAAUL,OAAOS,SAAS;EAElF,IAAI,CAACF,IAAIG,gBACL,MAAMZ,SAASa,qBAAoB;EAGvC,IAAIC;EACJ,IAAIL,IAAIM,SAASd,QAAQe,KACrBF,QAAQ,MAAMf,UACVO,SACA;GACIS,MAAMd,QAAQe;GACdP,KAAKA,IAAIG;GACTK,OAAOR,IAAIS;EACf,CAAA;OAED,IAAIT,IAAIM,SAASd,QAAQkB,IAC5BL,QAAQ,MAAMf,UACVO,SACA;GACIS,MAAMN,IAAIM;GACVN,KAAKA,IAAIG;GACTQ,WAAWX,IAAIY;GACfJ,OAAOR,IAAIS;EACf,CAAA;OAGJJ,QAAQ,MAAMf,UACVO,SACA;GACIS,MAAMN,IAAIM;GACVN,KAAKA,IAAIG;GACTQ,WAAWX,IAAIY;GACfJ,OAAOR,IAAIS;EACf,CAAA;EAIR,OAAOJ;CACX;AACJ"}

package/dist/core/oauth2/token/verifier/module.d.ts

@@ -1,11 +1,11 @@
 import type { OAuth2TokenPayload } from '@authup/specs';
-import type { IOAuth2KeyRepository } from '../../key/index.ts';
+import type { IKeyStore } from '../../../key/index.ts';
 import type { IOAuth2TokenRepository } from '../repository/types.ts';
 import type { IOAuth2TokenVerifier, OAuth2TokenVerifyOptions } from './types.ts';
 export declare class OAuth2TokenVerifier implements IOAuth2TokenVerifier {
-    protected keyRepository: IOAuth2KeyRepository;
+    protected keyStore: IKeyStore;
     protected tokenRepository: IOAuth2TokenRepository;
-    constructor(keyRepository: IOAuth2KeyRepository, tokenRepository: IOAuth2TokenRepository);
+    constructor(keyStore: IKeyStore, tokenRepository: IOAuth2TokenRepository);
     isInactive(id: string): Promise<boolean>;
     verify(token: string, options?: OAuth2TokenVerifyOptions): Promise<OAuth2TokenPayload>;
 }

package/dist/core/oauth2/token/verifier/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/token/verifier/module.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAEjF,qBAAa,mBAAoB,YAAW,oBAAoB;IAC5D,SAAS,CAAC,aAAa,EAAG,oBAAoB,CAAC;IAE/C,SAAS,CAAC,eAAe,EAAG,sBAAsB,CAAC;gBAG/C,aAAa,EAAG,oBAAoB,EACpC,eAAe,EAAG,sBAAsB;IAMtC,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIxC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,wBAA6B,GAAI,OAAO,CAAC,kBAAkB,CAAC;CAgGpG"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/token/verifier/module.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAOxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAEjF,qBAAa,mBAAoB,YAAW,oBAAoB;IAC5D,SAAS,CAAC,QAAQ,EAAG,SAAS,CAAC;IAE/B,SAAS,CAAC,eAAe,EAAG,sBAAsB,CAAC;gBAG/C,QAAQ,EAAG,SAAS,EACpB,eAAe,EAAG,sBAAsB;IAMtC,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIxC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,wBAA6B,GAAI,OAAO,CAAC,kBAAkB,CAAC;CAwHpG"}

package/dist/core/oauth2/token/verifier/module.mjs

@@ -1,14 +1,15 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { KeyStatus } from "@authup/core-kit";
 import { extractTokenHeader, verifyToken } from "@authup/server-kit";
-import { JWKError, JWKType, JWTError } from "@authup/specs";
+import { JWKError, JWKType, JWKUse, JWTError } from "@authup/specs";
 //#region src/core/oauth2/token/verifier/module.ts
 var OAuth2TokenVerifier = class {
-	keyRepository;
+	keyStore;
 	tokenRepository;
-	constructor(keyRepository, tokenRepository) {
-		this.keyRepository = keyRepository;
+	constructor(keyStore, tokenRepository) {
+		this.keyStore = keyStore;
 		this.tokenRepository = tokenRepository;
 	}
 	async isInactive(id) {
@@ -25,15 +26,17 @@ var OAuth2TokenVerifier = class {
 		}
 		const header = extractTokenHeader(token);
 		if (!header.kid) throw JWTError.headerPropertyInvalid("kid");
-		const key = await this.keyRepository.findById(header.kid);
+		const key = await this.keyStore.resolveById(header.kid);
 		if (!key) throw JWKError.notFound(header.kid);
+		if (key.use !== JWKUse.SIGNATURE) throw JWKError.notFound(header.kid);
+		if (key.status === KeyStatus.DISABLED) throw JWKError.notFound(header.kid);
 		switch (key.type) {
 			case JWKType.OCT:
 				if (!key.decryption_key) throw JWKError.decryptionKeyMissing();
 				payload = await verifyToken(token, {
 					type: JWKType.OCT,
 					key: key.decryption_key
-				});
+				}, { ignoreExpiry: options.ignoreExpiry });
 				break;
 			case JWKType.EC:
 				if (!key.encryption_key) throw JWKError.decryptionKeyMissing();
@@ -41,7 +44,7 @@ var OAuth2TokenVerifier = class {
 					type: key.type,
 					key: key.encryption_key,
 					...key.signature_algorithm ? { algorithms: [key.signature_algorithm] } : []
-				});
+				}, { ignoreExpiry: options.ignoreExpiry });
 				break;
 			default:
 				if (!key.encryption_key) throw JWKError.decryptionKeyMissing();
@@ -49,10 +52,10 @@ var OAuth2TokenVerifier = class {
 					type: key.type,
 					key: key.encryption_key,
 					...key.signature_algorithm ? { algorithms: [key.signature_algorithm] } : []
-				});
+				}, { ignoreExpiry: options.ignoreExpiry });
 		}
 		if (!payload.jti) throw JWTError.payloadPropertyInvalid("jti");
-		await this.tokenRepository.saveWithSignature(payload, token);
+		if (!options.ignoreExpiry) await this.tokenRepository.saveWithSignature(payload, token);
 		if (!options.skipActiveCheck) {
 			if (await this.isInactive(payload.jti)) throw JWTError.notActive();
 		}

package/dist/core/oauth2/token/verifier/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["extractTokenHeader","verifyToken","JWKError","JWKType","JWTError","OAuth2TokenVerifier","keyRepository","tokenRepository","isInactive","id","verify","token","options","payload","findOneBySignature","jti","payloadPropertyInvalid","skipActiveCheck","notActive","header","kid","headerPropertyInvalid","key","findById","notFound","type","OCT","decryption_key","decryptionKeyMissing","EC","encryption_key","signature_algorithm","algorithms","saveWithSignature"],"sources":["../../../../../src/core/oauth2/token/verifier/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    type TokenECAlgorithm, \n    type TokenRSAAlgorithm, \n    extractTokenHeader, \n    verifyToken,\n} from '@authup/server-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { JWKError, JWKType, JWTError } from '@authup/specs';\nimport type { IOAuth2KeyRepository } from '../../key/index.ts';\nimport type { IOAuth2TokenRepository } from '../repository/types.ts';\nimport type { IOAuth2TokenVerifier, OAuth2TokenVerifyOptions } from './types.ts';\n\nexport class OAuth2TokenVerifier implements IOAuth2TokenVerifier {\n    protected keyRepository : IOAuth2KeyRepository;\n\n    protected tokenRepository : IOAuth2TokenRepository;\n\n    constructor(\n        keyRepository : IOAuth2KeyRepository,\n        tokenRepository : IOAuth2TokenRepository,\n    ) {\n        this.keyRepository = keyRepository;\n        this.tokenRepository = tokenRepository;\n    }\n\n    async isInactive(id: string): Promise<boolean> {\n        return this.tokenRepository.isInactive(id);\n    }\n\n    async verify(token: string, options: OAuth2TokenVerifyOptions = {}) : Promise<OAuth2TokenPayload> {\n        let payload = await this.tokenRepository.findOneBySignature(token);\n        if (payload) {\n            if (!payload.jti) {\n                throw JWTError.payloadPropertyInvalid('jti');\n            }\n\n            if (!options.skipActiveCheck) {\n                const isInactive = await this.isInactive(payload.jti);\n                if (isInactive) {\n                    throw JWTError.notActive();\n                }\n            }\n\n            return payload;\n        }\n\n        const header = extractTokenHeader(token);\n        if (!header.kid) {\n            throw JWTError.headerPropertyInvalid('kid');\n        }\n\n        const key = await this.keyRepository.findById(header.kid);\n        if (!key) {\n            throw JWKError.notFound(header.kid);\n        }\n\n        switch (key.type) {\n            case JWKType.OCT: {\n                if (!key.decryption_key) {\n                    throw JWKError.decryptionKeyMissing();\n                }\n\n                payload = await verifyToken(\n                    token,\n                    {\n                        type: JWKType.OCT,\n                        key: key.decryption_key,\n                    },\n                );\n                break;\n            }\n            case JWKType.EC: {\n                if (!key.encryption_key) {\n                    throw JWKError.decryptionKeyMissing();\n                }\n\n                payload = await verifyToken(\n                    token,\n                    {\n                        type: key.type,\n                        key: key.encryption_key,\n                        ...(\n                            key.signature_algorithm ?\n                                { algorithms: [key.signature_algorithm] } :\n                                []\n                        ) as TokenECAlgorithm[],\n                    },\n                );\n                break;\n            }\n            default: {\n                if (!key.encryption_key) {\n                    throw JWKError.decryptionKeyMissing();\n                }\n\n                payload = await verifyToken(\n                    token,\n                    {\n                        type: key.type,\n                        key: key.encryption_key,\n                        ...(\n                            key.signature_algorithm ?\n                                { algorithms: [key.signature_algorithm] } :\n                                []\n                        ) as TokenRSAAlgorithm[],\n                    },\n                );\n            }\n        }\n\n        if (!payload.jti) {\n            throw JWTError.payloadPropertyInvalid('jti');\n        }\n\n        await this.tokenRepository.saveWithSignature(payload, token);\n\n        if (!options.skipActiveCheck) {\n            const isInactive = await this.isInactive(payload.jti);\n            if (isInactive) {\n                throw JWTError.notActive();\n            }\n        }\n\n        return payload;\n    }\n}\n"],"mappings":";;;;;;AAmBA,IAAaK,sBAAb,MAAaA;CACCC;CAEAC;CAEV,YACID,eACAC,iBACF;EACE,KAAKD,gBAAgBA;EACrB,KAAKC,kBAAkBA;CAC3B;CAEA,MAAMC,WAAWC,IAA8B;EAC3C,OAAO,KAAKF,gBAAgBC,WAAWC,EAAAA;CAC3C;CAEA,MAAMC,OAAOC,OAAeC,UAAoC,CAAC,GAAiC;EAC9F,IAAIC,UAAU,MAAM,KAAKN,gBAAgBO,mBAAmBH,KAAAA;EAC5D,IAAIE,SAAS;GACT,IAAI,CAACA,QAAQE,KACT,MAAMX,SAASY,uBAAuB,KAAA;GAG1C,IAAI,CAACJ,QAAQK;QAELT,MADqB,KAAKA,WAAWK,QAAQE,GAAG,GAEhD,MAAMX,SAASc,UAAS;GAAA;GAIhC,OAAOL;EACX;EAEA,MAAMM,SAASnB,mBAAmBW,KAAAA;EAClC,IAAI,CAACQ,OAAOC,KACR,MAAMhB,SAASiB,sBAAsB,KAAA;EAGzC,MAAMC,MAAM,MAAM,KAAKhB,cAAciB,SAASJ,OAAOC,GAAG;EACxD,IAAI,CAACE,KACD,MAAMpB,SAASsB,SAASL,OAAOC,GAAG;EAGtC,QAAQE,IAAIG,MAAZ;GACI,KAAKtB,QAAQuB;IACT,IAAI,CAACJ,IAAIK,gBACL,MAAMzB,SAAS0B,qBAAoB;IAGvCf,UAAU,MAAMZ,YACZU,OACA;KACIc,MAAMtB,QAAQuB;KACdJ,KAAKA,IAAIK;IACb,CAAA;IAEJ;GAEJ,KAAKxB,QAAQ0B;IACT,IAAI,CAACP,IAAIQ,gBACL,MAAM5B,SAAS0B,qBAAoB;IAGvCf,UAAU,MAAMZ,YACZU,OACA;KACIc,MAAMH,IAAIG;KACVH,KAAKA,IAAIQ;KACT,GACIR,IAAIS,sBACA,EAAEC,YAAY,CAACV,IAAIS,mBAAAA,EAAqB,IACxC,CAAA;IAEZ,CAAA;IAEJ;GAEJ;IACI,IAAI,CAACT,IAAIQ,gBACL,MAAM5B,SAAS0B,qBAAoB;IAGvCf,UAAU,MAAMZ,YACZU,OACA;KACIc,MAAMH,IAAIG;KACVH,KAAKA,IAAIQ;KACT,GACIR,IAAIS,sBACA,EAAEC,YAAY,CAACV,IAAIS,mBAAAA,EAAqB,IACxC,CAAA;IAEZ,CAAA;EAGZ;EAEA,IAAI,CAAClB,QAAQE,KACT,MAAMX,SAASY,uBAAuB,KAAA;EAG1C,MAAM,KAAKT,gBAAgB0B,kBAAkBpB,SAASF,KAAAA;EAEtD,IAAI,CAACC,QAAQK;OAELT,MADqB,KAAKA,WAAWK,QAAQE,GAAG,GAEhD,MAAMX,SAASc,UAAS;EAAA;EAIhC,OAAOL;CACX;AACJ"}
+{"version":3,"file":"module.mjs","names":["extractTokenHeader","verifyToken","KeyStatus","JWKError","JWKType","JWKUse","JWTError","OAuth2TokenVerifier","keyStore","tokenRepository","isInactive","id","verify","token","options","payload","findOneBySignature","jti","payloadPropertyInvalid","skipActiveCheck","notActive","header","kid","headerPropertyInvalid","key","resolveById","notFound","use","SIGNATURE","status","DISABLED","type","OCT","decryption_key","decryptionKeyMissing","ignoreExpiry","EC","encryption_key","signature_algorithm","algorithms","saveWithSignature"],"sources":["../../../../../src/core/oauth2/token/verifier/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    type TokenECAlgorithm,\n    type TokenRSAAlgorithm,\n    extractTokenHeader,\n    verifyToken,\n} from '@authup/server-kit';\nimport { KeyStatus } from '@authup/core-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport {\n    JWKError,\n    JWKType,\n    JWKUse,\n    JWTError,\n} from '@authup/specs';\nimport type { IKeyStore } from '../../../key/index.ts';\nimport type { IOAuth2TokenRepository } from '../repository/types.ts';\nimport type { IOAuth2TokenVerifier, OAuth2TokenVerifyOptions } from './types.ts';\n\nexport class OAuth2TokenVerifier implements IOAuth2TokenVerifier {\n    protected keyStore : IKeyStore;\n\n    protected tokenRepository : IOAuth2TokenRepository;\n\n    constructor(\n        keyStore : IKeyStore,\n        tokenRepository : IOAuth2TokenRepository,\n    ) {\n        this.keyStore = keyStore;\n        this.tokenRepository = tokenRepository;\n    }\n\n    async isInactive(id: string): Promise<boolean> {\n        return this.tokenRepository.isInactive(id);\n    }\n\n    async verify(token: string, options: OAuth2TokenVerifyOptions = {}) : Promise<OAuth2TokenPayload> {\n        let payload = await this.tokenRepository.findOneBySignature(token);\n        if (payload) {\n            if (!payload.jti) {\n                throw JWTError.payloadPropertyInvalid('jti');\n            }\n\n            if (!options.skipActiveCheck) {\n                const isInactive = await this.isInactive(payload.jti);\n                if (isInactive) {\n                    throw JWTError.notActive();\n                }\n            }\n\n            return payload;\n        }\n\n        const header = extractTokenHeader(token);\n        if (!header.kid) {\n            throw JWTError.headerPropertyInvalid('kid');\n        }\n\n        const key = await this.keyStore.resolveById(header.kid);\n        if (!key) {\n            throw JWKError.notFound(header.kid);\n        }\n\n        // the key store also holds at-rest encryption keys (use: enc) —\n        // those must never verify a token.\n        if (key.use !== JWKUse.SIGNATURE) {\n            throw JWKError.notFound(header.kid);\n        }\n\n        // disabled = neither signs nor verifies (passive still verifies).\n        if (key.status === KeyStatus.DISABLED) {\n            throw JWKError.notFound(header.kid);\n        }\n\n        switch (key.type) {\n            case JWKType.OCT: {\n                if (!key.decryption_key) {\n                    throw JWKError.decryptionKeyMissing();\n                }\n\n                payload = await verifyToken(\n                    token,\n                    {\n                        type: JWKType.OCT,\n                        key: key.decryption_key,\n                    },\n                    { ignoreExpiry: options.ignoreExpiry },\n                );\n                break;\n            }\n            case JWKType.EC: {\n                if (!key.encryption_key) {\n                    throw JWKError.decryptionKeyMissing();\n                }\n\n                payload = await verifyToken(\n                    token,\n                    {\n                        type: key.type,\n                        key: key.encryption_key,\n                        ...(\n                            key.signature_algorithm ?\n                                { algorithms: [key.signature_algorithm] } :\n                                []\n                        ) as TokenECAlgorithm[],\n                    },\n                    { ignoreExpiry: options.ignoreExpiry },\n                );\n                break;\n            }\n            default: {\n                if (!key.encryption_key) {\n                    throw JWKError.decryptionKeyMissing();\n                }\n\n                payload = await verifyToken(\n                    token,\n                    {\n                        type: key.type,\n                        key: key.encryption_key,\n                        ...(\n                            key.signature_algorithm ?\n                                { algorithms: [key.signature_algorithm] } :\n                                []\n                        ) as TokenRSAAlgorithm[],\n                    },\n                    { ignoreExpiry: options.ignoreExpiry },\n                );\n            }\n        }\n\n        if (!payload.jti) {\n            throw JWTError.payloadPropertyInvalid('jti');\n        }\n\n        // Never populate the shared signature-keyed claims cache on the\n        // exp-ignoring path. An expired token verified with `ignoreExpiry`\n        // (the RP-initiated-logout id_token_hint) would otherwise be re-cached\n        // with buildTTL's 1h fallback (a past exp yields a non-positive ttl),\n        // and the cache-first branch above returns it with no exp re-check on\n        // every subsequent verify — so `/token/introspect` would report an\n        // expired token as active for up to an hour (RFC 7662). Keep the\n        // exp-bypass scoped to this single call.\n        if (!options.ignoreExpiry) {\n            await this.tokenRepository.saveWithSignature(payload, token);\n        }\n\n        if (!options.skipActiveCheck) {\n            const isInactive = await this.isInactive(payload.jti);\n            if (isInactive) {\n                throw JWTError.notActive();\n            }\n        }\n\n        return payload;\n    }\n}\n"],"mappings":";;;;;;;AAyBA,IAAaO,sBAAb,MAAaA;CACCC;CAEAC;CAEV,YACID,UACAC,iBACF;EACE,KAAKD,WAAWA;EAChB,KAAKC,kBAAkBA;CAC3B;CAEA,MAAMC,WAAWC,IAA8B;EAC3C,OAAO,KAAKF,gBAAgBC,WAAWC,EAAAA;CAC3C;CAEA,MAAMC,OAAOC,OAAeC,UAAoC,CAAC,GAAiC;EAC9F,IAAIC,UAAU,MAAM,KAAKN,gBAAgBO,mBAAmBH,KAAAA;EAC5D,IAAIE,SAAS;GACT,IAAI,CAACA,QAAQE,KACT,MAAMX,SAASY,uBAAuB,KAAA;GAG1C,IAAI,CAACJ,QAAQK;QAELT,MADqB,KAAKA,WAAWK,QAAQE,GAAG,GAEhD,MAAMX,SAASc,UAAS;GAAA;GAIhC,OAAOL;EACX;EAEA,MAAMM,SAASrB,mBAAmBa,KAAAA;EAClC,IAAI,CAACQ,OAAOC,KACR,MAAMhB,SAASiB,sBAAsB,KAAA;EAGzC,MAAMC,MAAM,MAAM,KAAKhB,SAASiB,YAAYJ,OAAOC,GAAG;EACtD,IAAI,CAACE,KACD,MAAMrB,SAASuB,SAASL,OAAOC,GAAG;EAKtC,IAAIE,IAAIG,QAAQtB,OAAOuB,WACnB,MAAMzB,SAASuB,SAASL,OAAOC,GAAG;EAItC,IAAIE,IAAIK,WAAW3B,UAAU4B,UACzB,MAAM3B,SAASuB,SAASL,OAAOC,GAAG;EAGtC,QAAQE,IAAIO,MAAZ;GACI,KAAK3B,QAAQ4B;IACT,IAAI,CAACR,IAAIS,gBACL,MAAM9B,SAAS+B,qBAAoB;IAGvCnB,UAAU,MAAMd,YACZY,OACA;KACIkB,MAAM3B,QAAQ4B;KACdR,KAAKA,IAAIS;IACb,GACA,EAAEE,cAAcrB,QAAQqB,aAAa,CAAA;IAEzC;GAEJ,KAAK/B,QAAQgC;IACT,IAAI,CAACZ,IAAIa,gBACL,MAAMlC,SAAS+B,qBAAoB;IAGvCnB,UAAU,MAAMd,YACZY,OACA;KACIkB,MAAMP,IAAIO;KACVP,KAAKA,IAAIa;KACT,GACIb,IAAIc,sBACA,EAAEC,YAAY,CAACf,IAAIc,mBAAAA,EAAqB,IACxC,CAAA;IAEZ,GACA,EAAEH,cAAcrB,QAAQqB,aAAa,CAAA;IAEzC;GAEJ;IACI,IAAI,CAACX,IAAIa,gBACL,MAAMlC,SAAS+B,qBAAoB;IAGvCnB,UAAU,MAAMd,YACZY,OACA;KACIkB,MAAMP,IAAIO;KACVP,KAAKA,IAAIa;KACT,GACIb,IAAIc,sBACA,EAAEC,YAAY,CAACf,IAAIc,mBAAAA,EAAqB,IACxC,CAAA;IAEZ,GACA,EAAEH,cAAcrB,QAAQqB,aAAa,CAAA;EAGjD;EAEA,IAAI,CAACpB,QAAQE,KACT,MAAMX,SAASY,uBAAuB,KAAA;EAW1C,IAAI,CAACJ,QAAQqB,cACT,MAAM,KAAK1B,gBAAgB+B,kBAAkBzB,SAASF,KAAAA;EAG1D,IAAI,CAACC,QAAQK;OAELT,MADqB,KAAKA,WAAWK,QAAQE,GAAG,GAEhD,MAAMX,SAASc,UAAS;EAAA;EAIhC,OAAOL;CACX;AACJ"}

package/dist/core/oauth2/token/verifier/types.d.ts

@@ -1,6 +1,12 @@
 import type { OAuth2TokenPayload } from '@authup/specs';
 export type OAuth2TokenVerifyOptions = {
     skipActiveCheck?: boolean;
+    /**
+     * Skip ONLY the `exp` check (signature, issuer, nbf still enforced). For
+     * verifying an `id_token_hint` on RP-initiated logout, which is routinely
+     * expired by the time the user logs out.
+     */
+    ignoreExpiry?: boolean;
 };
 export interface IOAuth2TokenVerifier {
     isInactive(token: string): Promise<boolean>;

package/dist/core/oauth2/token/verifier/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/token/verifier/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,MAAM,MAAM,wBAAwB,GAAG;IACnC,eAAe,CAAC,EAAE,OAAO,CAAA;CAC5B,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACjC,UAAU,CAAC,KAAK,EAAE,MAAM,GAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE7C,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,wBAAwB,GAAI,OAAO,CAAC,kBAAkB,CAAC,CAAA;CAC1F"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/token/verifier/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,MAAM,MAAM,wBAAwB,GAAG;IACnC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;CACzB,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACjC,UAAU,CAAC,KAAK,EAAE,MAAM,GAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE7C,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,wBAAwB,GAAI,OAAO,CAAC,kBAAkB,CAAC,CAAA;CAC1F"}

package/dist/core/provisioning/entities/client/relations-validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"relations-validator.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/client/relations-validator.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAIpC,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAE9D,qBAAa,oCAAqC,SAAQ,SAAS,CAAC,2BAA2B,CAAC;IAC5F,SAAS,CAAC,UAAU;CA0BvB"}
+{"version":3,"file":"relations-validator.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/client/relations-validator.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAKpC,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAE9D,qBAAa,oCAAqC,SAAQ,SAAS,CAAC,2BAA2B,CAAC;IAC5F,SAAS,CAAC,UAAU;CAkCvB"}

package/dist/core/provisioning/entities/client/relations-validator.mjs

@@ -5,6 +5,7 @@ import { PermissionProvisioningValidator } from "../permission/validator.mjs";
 import "../permission/index.mjs";
 import { RoleProvisioningValidator } from "../role/validator.mjs";
 import "../role/index.mjs";
+import { createProvisioningEntitiesValidator } from "../utils.mjs";
 import { Container } from "validup";
 import { createValidator } from "@validup/zod";
 import { z } from "zod";
@@ -14,10 +15,10 @@ var ClientProvisioningRelationsValidator = class extends Container {
 		super.initialize();
 		const permissionValidator = new PermissionProvisioningValidator();
 		const roleValidator = new RoleProvisioningValidator();
-		this.mount("permissions.*", { optional: true }, permissionValidator);
+		this.mount("permissions", { optional: true }, createValidator(z.array(z.any()).check(createProvisioningEntitiesValidator(permissionValidator))));
 		this.mount("realmPermissions", { optional: true }, createValidator(z.array(z.string())));
 		this.mount("globalPermissions", { optional: true }, createValidator(z.array(z.string())));
-		this.mount("roles.*", { optional: true }, roleValidator);
+		this.mount("roles", { optional: true }, createValidator(z.array(z.any()).check(createProvisioningEntitiesValidator(roleValidator))));
 		this.mount("realmRoles", { optional: true }, createValidator(z.array(z.string())));
 		this.mount("globalRoles", { optional: true }, createValidator(z.array(z.string())));
 	}

package/dist/core/provisioning/entities/client/relations-validator.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"relations-validator.mjs","names":["createValidator","Container","z","PermissionProvisioningValidator","RoleProvisioningValidator","ClientProvisioningRelationsValidator","initialize","permissionValidator","roleValidator","mount","optional","array","string"],"sources":["../../../../../src/core/provisioning/entities/client/relations-validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createValidator } from '@validup/zod';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport { PermissionProvisioningValidator } from '../permission/index.ts';\nimport { RoleProvisioningValidator } from '../role/index.ts';\nimport type { ClientProvisioningRelations } from './types.ts';\n\nexport class ClientProvisioningRelationsValidator extends Container<ClientProvisioningRelations> {\n    protected initialize() {\n        super.initialize();\n\n        const permissionValidator = new PermissionProvisioningValidator();\n        const roleValidator = new RoleProvisioningValidator();\n\n        this.mount('permissions.*', { optional: true }, permissionValidator);\n\n        this.mount('realmPermissions', { optional: true }, createValidator(\n            z.array(z.string()),\n        ));\n\n        this.mount('globalPermissions', { optional: true }, createValidator(\n            z.array(z.string()),\n        ));\n\n        this.mount('roles.*', { optional: true }, roleValidator);\n\n        this.mount('realmRoles', { optional: true }, createValidator(\n            z.array(z.string()),\n        ));\n\n        this.mount('globalRoles', { optional: true }, createValidator(\n            z.array(z.string()),\n        ));\n    }\n}\n"],"mappings":";;;;;;;;;;;AAcA,IAAaK,uCAAb,cAA0DJ,UAAAA;CAC5CK,aAAa;EACnB,MAAMA,WAAAA;EAEN,MAAMC,sBAAsB,IAAIJ,gCAAAA;EAChC,MAAMK,gBAAgB,IAAIJ,0BAAAA;EAE1B,KAAKK,MAAM,iBAAiB,EAAEC,UAAU,KAAK,GAAGH,mBAAAA;EAEhD,KAAKE,MAAM,oBAAoB,EAAEC,UAAU,KAAK,GAAGV,gBAC/CE,EAAES,MAAMT,EAAEU,OAAM,CAAA,CAAA,CAAA;EAGpB,KAAKH,MAAM,qBAAqB,EAAEC,UAAU,KAAK,GAAGV,gBAChDE,EAAES,MAAMT,EAAEU,OAAM,CAAA,CAAA,CAAA;EAGpB,KAAKH,MAAM,WAAW,EAAEC,UAAU,KAAK,GAAGF,aAAAA;EAE1C,KAAKC,MAAM,cAAc,EAAEC,UAAU,KAAK,GAAGV,gBACzCE,EAAES,MAAMT,EAAEU,OAAM,CAAA,CAAA,CAAA;EAGpB,KAAKH,MAAM,eAAe,EAAEC,UAAU,KAAK,GAAGV,gBAC1CE,EAAES,MAAMT,EAAEU,OAAM,CAAA,CAAA,CAAA;CAExB;AACJ"}
+{"version":3,"file":"relations-validator.mjs","names":["createValidator","Container","z","PermissionProvisioningValidator","RoleProvisioningValidator","createProvisioningEntitiesValidator","ClientProvisioningRelationsValidator","initialize","permissionValidator","roleValidator","mount","optional","array","any","check","string"],"sources":["../../../../../src/core/provisioning/entities/client/relations-validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createValidator } from '@validup/zod';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport { PermissionProvisioningValidator } from '../permission/index.ts';\nimport { RoleProvisioningValidator } from '../role/index.ts';\nimport { createProvisioningEntitiesValidator } from '../utils.ts';\nimport type { ClientProvisioningRelations } from './types.ts';\n\nexport class ClientProvisioningRelationsValidator extends Container<ClientProvisioningRelations> {\n    protected initialize() {\n        super.initialize();\n\n        const permissionValidator = new PermissionProvisioningValidator();\n        const roleValidator = new RoleProvisioningValidator();\n\n        this.mount('permissions', { optional: true }, createValidator(\n            z\n                .array(z.any())\n                .check(createProvisioningEntitiesValidator(permissionValidator)),\n        ));\n\n        this.mount('realmPermissions', { optional: true }, createValidator(\n            z.array(z.string()),\n        ));\n\n        this.mount('globalPermissions', { optional: true }, createValidator(\n            z.array(z.string()),\n        ));\n\n        this.mount('roles', { optional: true }, createValidator(\n            z\n                .array(z.any())\n                .check(createProvisioningEntitiesValidator(roleValidator)),\n        ));\n\n        this.mount('realmRoles', { optional: true }, createValidator(\n            z.array(z.string()),\n        ));\n\n        this.mount('globalRoles', { optional: true }, createValidator(\n            z.array(z.string()),\n        ));\n    }\n}\n"],"mappings":";;;;;;;;;;;;AAeA,IAAaM,uCAAb,cAA0DL,UAAAA;CAC5CM,aAAa;EACnB,MAAMA,WAAAA;EAEN,MAAMC,sBAAsB,IAAIL,gCAAAA;EAChC,MAAMM,gBAAgB,IAAIL,0BAAAA;EAE1B,KAAKM,MAAM,eAAe,EAAEC,UAAU,KAAK,GAAGX,gBAC1CE,EACKU,MAAMV,EAAEW,IAAG,CAAA,CAAA,CACXC,MAAMT,oCAAoCG,mBAAAA,CAAAA,CAAAA,CAAAA;EAGnD,KAAKE,MAAM,oBAAoB,EAAEC,UAAU,KAAK,GAAGX,gBAC/CE,EAAEU,MAAMV,EAAEa,OAAM,CAAA,CAAA,CAAA;EAGpB,KAAKL,MAAM,qBAAqB,EAAEC,UAAU,KAAK,GAAGX,gBAChDE,EAAEU,MAAMV,EAAEa,OAAM,CAAA,CAAA,CAAA;EAGpB,KAAKL,MAAM,SAAS,EAAEC,UAAU,KAAK,GAAGX,gBACpCE,EACKU,MAAMV,EAAEW,IAAG,CAAA,CAAA,CACXC,MAAMT,oCAAoCI,aAAAA,CAAAA,CAAAA,CAAAA;EAGnD,KAAKC,MAAM,cAAc,EAAEC,UAAU,KAAK,GAAGX,gBACzCE,EAAEU,MAAMV,EAAEa,OAAM,CAAA,CAAA,CAAA;EAGpB,KAAKL,MAAM,eAAe,EAAEC,UAAU,KAAK,GAAGX,gBAC1CE,EAAEU,MAAMV,EAAEa,OAAM,CAAA,CAAA,CAAA;CAExB;AACJ"}

package/dist/core/provisioning/entities/index.d.ts

@@ -8,4 +8,5 @@ export * from './root/index.ts';
 export * from './scope/index.ts';
 export * from './user/index.ts';
 export * from './types.ts';
+export * from './utils.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/provisioning/entities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/provisioning/entities/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAEhC,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/provisioning/entities/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAEhC,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC"}

package/dist/core/provisioning/entities/index.mjs

@@ -1,12 +1,16 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { PermissionProvisioningRelationsValidator } from "./permission/relations-validator.mjs";
 import { PermissionProvisioningValidator } from "./permission/validator.mjs";
 import "./permission/index.mjs";
 import { RoleProvisioningValidator } from "./role/validator.mjs";
 import "./role/index.mjs";
+import { createProvisioningEntitiesValidator } from "./utils.mjs";
 import { ClientProvisioningValidator } from "./client/validator.mjs";
 import "./client/index.mjs";
+import { PolicyProvisioningValidator } from "./policy/validator.mjs";
+import "./policy/index.mjs";
 import { RobotProvisioningValidator } from "./robot/validator.mjs";
 import "./robot/index.mjs";
 import { ScopeProvisioningValidator } from "./scope/validator.mjs";
@@ -17,4 +21,4 @@ import { RealmProvisioningValidator } from "./realm/validator.mjs";
 import "./realm/index.mjs";
 import { RootProvisioningValidator } from "./root/validator.mjs";
 import "./root/index.mjs";
-export { ClientProvisioningValidator, PermissionProvisioningValidator, RealmProvisioningValidator, RobotProvisioningValidator, RoleProvisioningValidator, RootProvisioningValidator, ScopeProvisioningValidator, UserProvisioningValidator };
+export { ClientProvisioningValidator, PermissionProvisioningRelationsValidator, PermissionProvisioningValidator, PolicyProvisioningValidator, RealmProvisioningValidator, RobotProvisioningValidator, RoleProvisioningValidator, RootProvisioningValidator, ScopeProvisioningValidator, UserProvisioningValidator, createProvisioningEntitiesValidator };

package/dist/core/provisioning/entities/permission/index.d.ts

@@ -1,3 +1,4 @@
+export * from './relations-validator.ts';
 export * from './types.ts';
 export * from './validator.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/provisioning/entities/permission/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/permission/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/permission/index.ts"],"names":[],"mappings":"AAOA,cAAc,0BAA0B,CAAC;AACzC,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC"}

package/dist/core/provisioning/entities/permission/index.mjs

@@ -1,5 +1,6 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { PermissionProvisioningRelationsValidator } from "./relations-validator.mjs";
 import { PermissionProvisioningValidator } from "./validator.mjs";
-export { PermissionProvisioningValidator };
+export { PermissionProvisioningRelationsValidator, PermissionProvisioningValidator };

package/dist/core/provisioning/entities/permission/relations-validator.d.ts

@@ -0,0 +1,6 @@
+import { Container } from 'validup';
+import type { PermissionProvisioningRelations } from './types.ts';
+export declare class PermissionProvisioningRelationsValidator extends Container<PermissionProvisioningRelations> {
+    protected initialize(): void;
+}
+//# sourceMappingURL=relations-validator.d.ts.map

package/dist/core/provisioning/entities/permission/relations-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relations-validator.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/permission/relations-validator.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEpC,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,YAAY,CAAC;AAElE,qBAAa,wCAAyC,SAAQ,SAAS,CAAC,+BAA+B,CAAC;IACpG,SAAS,CAAC,UAAU;CAOvB"}

package/dist/core/provisioning/entities/permission/relations-validator.mjs

@@ -0,0 +1,17 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { Container } from "validup";
+import { createValidator } from "@validup/zod";
+import { z } from "zod";
+//#region src/core/provisioning/entities/permission/relations-validator.ts
+var PermissionProvisioningRelationsValidator = class extends Container {
+	initialize() {
+		super.initialize();
+		this.mount("policies", { optional: true }, createValidator(z.array(z.string())));
+	}
+};
+//#endregion
+export { PermissionProvisioningRelationsValidator };
+
+//# sourceMappingURL=relations-validator.mjs.map

package/dist/core/provisioning/entities/permission/relations-validator.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"relations-validator.mjs","names":["createValidator","Container","z","PermissionProvisioningRelationsValidator","initialize","mount","optional","array","string"],"sources":["../../../../../src/core/provisioning/entities/permission/relations-validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createValidator } from '@validup/zod';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport type { PermissionProvisioningRelations } from './types.ts';\n\nexport class PermissionProvisioningRelationsValidator extends Container<PermissionProvisioningRelations> {\n    protected initialize() {\n        super.initialize();\n\n        this.mount('policies', { optional: true }, createValidator(\n            z.array(z.string()),\n        ));\n    }\n}\n"],"mappings":";;;;;;;AAYA,IAAaG,2CAAb,cAA8DF,UAAAA;CAChDG,aAAa;EACnB,MAAMA,WAAAA;EAEN,KAAKC,MAAM,YAAY,EAAEC,UAAU,KAAK,GAAGN,gBACvCE,EAAEK,MAAML,EAAEM,OAAM,CAAA,CAAA,CAAA;CAExB;AACJ"}

package/dist/core/provisioning/entities/permission/validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/permission/validator.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAGpC,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAE/D,qBAAa,+BAAgC,SAAQ,SAAS,CAAC,4BAA4B,CAAC;IACxF,SAAS,CAAC,UAAU;CASvB"}
+{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/permission/validator.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAIpC,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAE/D,qBAAa,+BAAgC,SAAQ,SAAS,CAAC,4BAA4B,CAAC;IACxF,SAAS,CAAC,UAAU;CAYvB"}

package/dist/core/provisioning/entities/permission/validator.mjs

@@ -3,6 +3,7 @@ import "node:url";
 import.meta.url;
 import { ProvisioningStrategyValidator } from "../../strategy/validator.mjs";
 import "../../strategy/index.mjs";
+import { PermissionProvisioningRelationsValidator } from "./relations-validator.mjs";
 import { PermissionValidator } from "@authup/core-kit";
 import { Container } from "validup";
 //#region src/core/provisioning/entities/permission/validator.ts
@@ -13,6 +14,8 @@ var PermissionProvisioningValidator = class extends Container {
 		this.mount("strategy", { optional: true }, strategyValidator);
 		const attributesValidator = new PermissionValidator();
 		this.mount("attributes", attributesValidator);
+		const relationsValidator = new PermissionProvisioningRelationsValidator();
+		this.mount("relations", { optional: true }, relationsValidator);
 	}
 };
 //#endregion

package/dist/core/provisioning/entities/permission/validator.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"validator.mjs","names":["PermissionValidator","Container","ProvisioningStrategyValidator","PermissionProvisioningValidator","initialize","strategyValidator","mount","optional","attributesValidator"],"sources":["../../../../../src/core/provisioning/entities/permission/validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { PermissionValidator } from '@authup/core-kit';\nimport { Container } from 'validup';\nimport { ProvisioningStrategyValidator } from '../../strategy/index.ts';\n\nimport type { PermissionProvisioningEntity } from './types.ts';\n\nexport class PermissionProvisioningValidator extends Container<PermissionProvisioningEntity> {\n    protected initialize() {\n        super.initialize();\n\n        const strategyValidator = new ProvisioningStrategyValidator();\n        this.mount('strategy', { optional: true }, strategyValidator);\n\n        const attributesValidator = new PermissionValidator();\n        this.mount('attributes', attributesValidator);\n    }\n}\n"],"mappings":";;;;;;;;AAaA,IAAaG,kCAAb,cAAqDF,UAAAA;CACvCG,aAAa;EACnB,MAAMA,WAAAA;EAEN,MAAMC,oBAAoB,IAAIH,8BAAAA;EAC9B,KAAKI,MAAM,YAAY,EAAEC,UAAU,KAAK,GAAGF,iBAAAA;EAE3C,MAAMG,sBAAsB,IAAIR,oBAAAA;EAChC,KAAKM,MAAM,cAAcE,mBAAAA;CAC7B;AACJ"}
+{"version":3,"file":"validator.mjs","names":["PermissionValidator","Container","ProvisioningStrategyValidator","PermissionProvisioningRelationsValidator","PermissionProvisioningValidator","initialize","strategyValidator","mount","optional","attributesValidator","relationsValidator"],"sources":["../../../../../src/core/provisioning/entities/permission/validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { PermissionValidator } from '@authup/core-kit';\nimport { Container } from 'validup';\nimport { ProvisioningStrategyValidator } from '../../strategy/index.ts';\nimport { PermissionProvisioningRelationsValidator } from './relations-validator.ts';\n\nimport type { PermissionProvisioningEntity } from './types.ts';\n\nexport class PermissionProvisioningValidator extends Container<PermissionProvisioningEntity> {\n    protected initialize() {\n        super.initialize();\n\n        const strategyValidator = new ProvisioningStrategyValidator();\n        this.mount('strategy', { optional: true }, strategyValidator);\n\n        const attributesValidator = new PermissionValidator();\n        this.mount('attributes', attributesValidator);\n\n        const relationsValidator = new PermissionProvisioningRelationsValidator();\n        this.mount('relations', { optional: true }, relationsValidator);\n    }\n}\n"],"mappings":";;;;;;;;;AAcA,IAAaI,kCAAb,cAAqDH,UAAAA;CACvCI,aAAa;EACnB,MAAMA,WAAAA;EAEN,MAAMC,oBAAoB,IAAIJ,8BAAAA;EAC9B,KAAKK,MAAM,YAAY,EAAEC,UAAU,KAAK,GAAGF,iBAAAA;EAE3C,MAAMG,sBAAsB,IAAIT,oBAAAA;EAChC,KAAKO,MAAM,cAAcE,mBAAAA;EAEzB,MAAMC,qBAAqB,IAAIP,yCAAAA;EAC/B,KAAKI,MAAM,aAAa,EAAEC,UAAU,KAAK,GAAGE,kBAAAA;CAChD;AACJ"}

package/dist/core/provisioning/entities/policy/index.d.ts

@@ -1,2 +1,3 @@
 export * from './types.ts';
+export * from './validator.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/provisioning/entities/policy/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/policy/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/policy/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC"}

package/dist/core/provisioning/entities/policy/index.mjs

@@ -1,4 +1,5 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-export {};
+import { PolicyProvisioningValidator } from "./validator.mjs";
+export { PolicyProvisioningValidator };

package/dist/core/provisioning/entities/policy/validator.d.ts

@@ -0,0 +1,6 @@
+import { Container } from 'validup';
+import type { PolicyProvisioningEntity } from './types.ts';
+export declare class PolicyProvisioningValidator extends Container<PolicyProvisioningEntity> {
+    protected initialize(): void;
+}
+//# sourceMappingURL=validator.d.ts.map

package/dist/core/provisioning/entities/policy/validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/policy/validator.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAIpC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE3D,qBAAa,2BAA4B,SAAQ,SAAS,CAAC,wBAAwB,CAAC;IAChF,SAAS,CAAC,UAAU;CAmBvB"}

package/dist/core/provisioning/entities/policy/validator.mjs

@@ -0,0 +1,26 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { ProvisioningStrategyValidator } from "../../strategy/validator.mjs";
+import "../../strategy/index.mjs";
+import { createProvisioningEntitiesValidator } from "../utils.mjs";
+import { PolicyValidator } from "@authup/core-kit";
+import { Container } from "validup";
+import { createValidator } from "@validup/zod";
+import { z } from "zod";
+//#region src/core/provisioning/entities/policy/validator.ts
+var PolicyProvisioningValidator = class extends Container {
+	initialize() {
+		super.initialize();
+		const strategyValidator = new ProvisioningStrategyValidator();
+		this.mount("strategy", { optional: true }, strategyValidator);
+		const attributesValidator = new PolicyValidator();
+		this.mount("attributes", attributesValidator);
+		this.mount("extraAttributes", { optional: true }, createValidator(z.record(z.string(), z.any())));
+		this.mount("children", { optional: true }, createValidator(z.array(z.any()).check(createProvisioningEntitiesValidator(this))));
+	}
+};
+//#endregion
+export { PolicyProvisioningValidator };
+
+//# sourceMappingURL=validator.mjs.map

package/dist/core/provisioning/entities/policy/validator.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"validator.mjs","names":["PolicyValidator","createValidator","Container","z","ProvisioningStrategyValidator","createProvisioningEntitiesValidator","PolicyProvisioningValidator","initialize","strategyValidator","mount","optional","attributesValidator","record","string","any","array","check"],"sources":["../../../../../src/core/provisioning/entities/policy/validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { PolicyValidator } from '@authup/core-kit';\nimport { createValidator } from '@validup/zod';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport { ProvisioningStrategyValidator } from '../../strategy/index.ts';\nimport { createProvisioningEntitiesValidator } from '../utils.ts';\nimport type { PolicyProvisioningEntity } from './types.ts';\n\nexport class PolicyProvisioningValidator extends Container<PolicyProvisioningEntity> {\n    protected initialize() {\n        super.initialize();\n\n        const strategyValidator = new ProvisioningStrategyValidator();\n        this.mount('strategy', { optional: true }, strategyValidator);\n\n        const attributesValidator = new PolicyValidator();\n        this.mount('attributes', attributesValidator);\n\n        this.mount('extraAttributes', { optional: true }, createValidator(\n            z.record(z.string(), z.any()),\n        ));\n\n        this.mount('children', { optional: true }, createValidator(\n            z\n                .array(z.any())\n                .check(createProvisioningEntitiesValidator(this)),\n        ));\n    }\n}\n"],"mappings":";;;;;;;;;;;AAeA,IAAaM,8BAAb,cAAiDJ,UAAAA;CACnCK,aAAa;EACnB,MAAMA,WAAAA;EAEN,MAAMC,oBAAoB,IAAIJ,8BAAAA;EAC9B,KAAKK,MAAM,YAAY,EAAEC,UAAU,KAAK,GAAGF,iBAAAA;EAE3C,MAAMG,sBAAsB,IAAIX,gBAAAA;EAChC,KAAKS,MAAM,cAAcE,mBAAAA;EAEzB,KAAKF,MAAM,mBAAmB,EAAEC,UAAU,KAAK,GAAGT,gBAC9CE,EAAES,OAAOT,EAAEU,OAAM,GAAIV,EAAEW,IAAG,CAAA,CAAA,CAAA;EAG9B,KAAKL,MAAM,YAAY,EAAEC,UAAU,KAAK,GAAGT,gBACvCE,EACKY,MAAMZ,EAAEW,IAAG,CAAA,CAAA,CACXE,MAAMX,oCAAoC,IAAI,CAAA,CAAA,CAAA;CAE3D;AACJ"}

package/dist/core/provisioning/entities/realm/relations-validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"relations-validator.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/realm/relations-validator.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,SAAS,EAAkB,MAAM,SAAS,CAAC;AAQpD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAE7D,qBAAa,mCAAoC,SAAQ,SAAS,CAAC,0BAA0B,CAAC;IAC1F,SAAS,CAAC,UAAU;CAgHvB"}
+{"version":3,"file":"relations-validator.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/realm/relations-validator.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AASpC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAE7D,qBAAa,mCAAoC,SAAQ,SAAS,CAAC,0BAA0B,CAAC;IAC1F,SAAS,CAAC,UAAU;CA8CvB"}