@authup/server-core 1.0.0-beta.51 → 1.0.0-beta.53

package/dist/adapters/database/subscriber/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["EntityDefaultEventName","buildEntityChannelName","buildEntityNamespaceName","buildEntityDestinations","type","realmIds","data","destinations","channel","id","items","seen","Set","realmId","has","add","push","namespace","EntitySubscriber","ctx","publisher","setPublisher","listenTo","target","afterInsert","event","entity","cache","onInsert","dropCacheKeys","connection","publish","CREATED","afterUpdate","UPDATED","afterRemove","DELETED","queryResultCache","remove","keys","safePublish","content"],"sources":["../../../../src/adapters/database/subscriber/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { EntityType } from '@authup/core-kit';\nimport {\n    EntityDefaultEventName,\n    buildEntityChannelName,\n    buildEntityNamespaceName,\n} from '@authup/core-kit';\nimport type { DomainEventDestinations, IDomainEventPublisher } from '@authup/server-kit';\nimport type {\n    DataSource,\n    EntitySubscriberInterface,\n    InsertEvent,\n    ObjectLiteral,\n    RemoveEvent,\n    UpdateEvent,\n} from 'typeorm';\nimport type { EntitySubscriberContext } from './types.ts';\n\nexport function buildEntityDestinations<T extends ObjectLiteral>(\n    type: `${EntityType}`,\n    realmIds?: (data: T) => (string | null | undefined)[],\n) : (data: T) => DomainEventDestinations {\n    return (data) => {\n        const destinations : DomainEventDestinations = [\n            { channel: (id) => buildEntityChannelName(type, id) },\n        ];\n\n        if (realmIds) {\n            const items = realmIds(data);\n            const seen = new Set<string>();\n            for (const realmId of items) {\n                if (realmId && !seen.has(realmId)) {\n                    seen.add(realmId);\n                    destinations.push({\n                        channel: (id) => buildEntityChannelName(type, id),\n                        namespace: buildEntityNamespaceName(realmId),\n                    });\n                }\n            }\n        }\n\n        return destinations;\n    };\n}\n\nexport class EntitySubscriber<T extends ObjectLiteral> implements EntitySubscriberInterface<T> {\n    protected ctx : EntitySubscriberContext<T>;\n\n    protected publisher? : IDomainEventPublisher;\n\n    constructor(ctx: EntitySubscriberContext<T>) {\n        this.ctx = ctx;\n        this.publisher = ctx.publisher;\n    }\n\n    setPublisher(publisher: IDomainEventPublisher) : void {\n        this.publisher = publisher;\n    }\n\n    // eslint-disable-next-line @typescript-eslint/no-unsafe-function-type\n    listenTo() : Function | string {\n        return this.ctx.target;\n    }\n\n    async afterInsert(event: InsertEvent<T>): Promise<any> {\n        if (!event.entity) {\n            return;\n        }\n\n        if (this.ctx.cache && this.ctx.cache.onInsert) {\n            await this.dropCacheKeys(event.connection, event.entity);\n        }\n\n        await this.publish(EntityDefaultEventName.CREATED, event.entity);\n    }\n\n    async afterUpdate(event: UpdateEvent<T>): Promise<any> {\n        if (!event.entity) {\n            return;\n        }\n\n        await this.dropCacheKeys(event.connection, event.entity as T);\n\n        await this.publish(EntityDefaultEventName.UPDATED, event.entity as T);\n    }\n\n    async afterRemove(event: RemoveEvent<T>): Promise<any> {\n        if (!event.entity) {\n            return;\n        }\n\n        await this.dropCacheKeys(event.connection, event.entity);\n\n        await this.publish(EntityDefaultEventName.DELETED, event.entity);\n    }\n\n    protected async dropCacheKeys(connection: DataSource, data: T) : Promise<void> {\n        if (!this.ctx.cache || !connection.queryResultCache) {\n            return;\n        }\n\n        await connection.queryResultCache.remove(this.ctx.cache.keys(data));\n    }\n\n    protected async publish(event: `${EntityDefaultEventName}`, data: T) : Promise<void> {\n        if (!this.publisher) {\n            return;\n        }\n\n        await this.publisher.safePublish({\n            content: {\n                type: this.ctx.type,\n                event,\n                data,\n            },\n            destinations: this.ctx.destinations(data),\n        });\n    }\n}\n"],"mappings":";;;;;AAwBA,SAAgBG,wBACZC,MACAC,UAAqD;CAErD,QAAQC,SAAAA;EACJ,MAAMC,eAAyC,CAC3C,EAAEC,UAAUC,OAAOR,uBAAuBG,MAAMK,EAAAA,EAAI,CAAA;EAGxD,IAAIJ,UAAU;GACV,MAAMK,QAAQL,SAASC,IAAAA;GACvB,MAAMK,uBAAO,IAAIC,IAAAA;GACjB,KAAK,MAAMC,WAAWH,OAClB,IAAIG,WAAW,CAACF,KAAKG,IAAID,OAAAA,GAAU;IAC/BF,KAAKI,IAAIF,OAAAA;IACTN,aAAaS,KAAK;KACdR,UAAUC,OAAOR,uBAAuBG,MAAMK,EAAAA;KAC9CQ,WAAWf,yBAAyBW,OAAAA;IACxC,CAAA;GACJ;EAER;EAEA,OAAON;CACX;AACJ;AAEA,IAAaW,mBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,KAAiC;EACzC,KAAKA,MAAMA;EACX,KAAKC,YAAYD,IAAIC;CACzB;CAEAC,aAAaD,WAAyC;EAClD,KAAKA,YAAYA;CACrB;CAGAE,WAA+B;EAC3B,OAAO,KAAKH,IAAII;CACpB;CAEA,MAAMC,YAAYC,OAAqC;EACnD,IAAI,CAACA,MAAMC,QACP;EAGJ,IAAI,KAAKP,IAAIQ,SAAS,KAAKR,IAAIQ,MAAMC,UACjC,MAAM,KAAKC,cAAcJ,MAAMK,YAAYL,MAAMC,MAAM;EAG3D,MAAM,KAAKK,QAAQ/B,uBAAuBgC,SAASP,MAAMC,MAAM;CACnE;CAEA,MAAMO,YAAYR,OAAqC;EACnD,IAAI,CAACA,MAAMC,QACP;EAGJ,MAAM,KAAKG,cAAcJ,MAAMK,YAAYL,MAAMC,MAAM;EAEvD,MAAM,KAAKK,QAAQ/B,uBAAuBkC,SAAST,MAAMC,MAAM;CACnE;CAEA,MAAMS,YAAYV,OAAqC;EACnD,IAAI,CAACA,MAAMC,QACP;EAGJ,MAAM,KAAKG,cAAcJ,MAAMK,YAAYL,MAAMC,MAAM;EAEvD,MAAM,KAAKK,QAAQ/B,uBAAuBoC,SAASX,MAAMC,MAAM;CACnE;CAEA,MAAgBG,cAAcC,YAAwBxB,MAAyB;EAC3E,IAAI,CAAC,KAAKa,IAAIQ,SAAS,CAACG,WAAWO,kBAC/B;EAGJ,MAAMP,WAAWO,iBAAiBC,OAAO,KAAKnB,IAAIQ,MAAMY,KAAKjC,IAAAA,CAAAA;CACjE;CAEA,MAAgByB,QAAQN,OAAoCnB,MAAyB;EACjF,IAAI,CAAC,KAAKc,WACN;EAGJ,MAAM,KAAKA,UAAUoB,YAAY;GAC7BC,SAAS;IACLrC,MAAM,KAAKe,IAAIf;IACfqB;IACAnB;GACJ;GACAC,cAAc,KAAKY,IAAIZ,aAAaD,IAAAA;EACxC,CAAA;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["EntityDefaultEventName","buildEntityChannelName","buildEntityNamespaceName","buildEntityDestinations","type","realmIds","data","destinations","channel","id","items","seen","Set","realmId","has","add","push","namespace","EntitySubscriber","ctx","publisher","setPublisher","listenTo","target","afterInsert","event","entity","cache","onInsert","dropCacheKeys","connection","publish","CREATED","afterUpdate","UPDATED","databaseEntity","afterRemove","DELETED","queryResultCache","remove","keys","dataPrevious","safePublish","content"],"sources":["../../../../src/adapters/database/subscriber/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { EntityType } from '@authup/core-kit';\nimport {\n    EntityDefaultEventName,\n    buildEntityChannelName,\n    buildEntityNamespaceName,\n} from '@authup/core-kit';\nimport type { DomainEventDestinations, IDomainEventPublisher } from '@authup/server-kit';\nimport type {\n    DataSource,\n    EntitySubscriberInterface,\n    InsertEvent,\n    ObjectLiteral,\n    RemoveEvent,\n    UpdateEvent,\n} from 'typeorm';\nimport type { EntitySubscriberContext } from './types.ts';\n\nexport function buildEntityDestinations<T extends ObjectLiteral>(\n    type: `${EntityType}`,\n    realmIds?: (data: T) => (string | null | undefined)[],\n) : (data: T) => DomainEventDestinations {\n    return (data) => {\n        const destinations : DomainEventDestinations = [\n            { channel: (id) => buildEntityChannelName(type, id) },\n        ];\n\n        if (realmIds) {\n            const items = realmIds(data);\n            const seen = new Set<string>();\n            for (const realmId of items) {\n                if (realmId && !seen.has(realmId)) {\n                    seen.add(realmId);\n                    destinations.push({\n                        channel: (id) => buildEntityChannelName(type, id),\n                        namespace: buildEntityNamespaceName(realmId),\n                    });\n                }\n            }\n        }\n\n        return destinations;\n    };\n}\n\nexport class EntitySubscriber<T extends ObjectLiteral> implements EntitySubscriberInterface<T> {\n    protected ctx : EntitySubscriberContext<T>;\n\n    protected publisher? : IDomainEventPublisher;\n\n    constructor(ctx: EntitySubscriberContext<T>) {\n        this.ctx = ctx;\n        this.publisher = ctx.publisher;\n    }\n\n    setPublisher(publisher: IDomainEventPublisher) : void {\n        this.publisher = publisher;\n    }\n\n    // eslint-disable-next-line @typescript-eslint/no-unsafe-function-type\n    listenTo() : Function | string {\n        return this.ctx.target;\n    }\n\n    async afterInsert(event: InsertEvent<T>): Promise<any> {\n        if (!event.entity) {\n            return;\n        }\n\n        if (this.ctx.cache && this.ctx.cache.onInsert) {\n            await this.dropCacheKeys(event.connection, event.entity);\n        }\n\n        await this.publish(EntityDefaultEventName.CREATED, event.entity);\n    }\n\n    async afterUpdate(event: UpdateEvent<T>): Promise<any> {\n        if (!event.entity) {\n            return;\n        }\n\n        await this.dropCacheKeys(event.connection, event.entity as T);\n\n        await this.publish(EntityDefaultEventName.UPDATED, event.entity as T, event.databaseEntity);\n    }\n\n    async afterRemove(event: RemoveEvent<T>): Promise<any> {\n        // remove() strips the primary key from event.entity before the\n        // subscriber runs — databaseEntity is the pre-removal row and keeps\n        // the id-keyed cache invalidation (and the DELETED payload) intact.\n        const entity = event.databaseEntity ?? event.entity;\n        if (!entity) {\n            return;\n        }\n\n        await this.dropCacheKeys(event.connection, entity);\n\n        await this.publish(EntityDefaultEventName.DELETED, entity);\n    }\n\n    protected async dropCacheKeys(connection: DataSource, data: T) : Promise<void> {\n        if (!this.ctx.cache || !connection.queryResultCache) {\n            return;\n        }\n\n        await connection.queryResultCache.remove(this.ctx.cache.keys(data));\n    }\n\n    protected async publish(\n        event: `${EntityDefaultEventName}`,\n        data: T,\n        dataPrevious?: T,\n    ) : Promise<void> {\n        if (!this.publisher) {\n            return;\n        }\n\n        await this.publisher.safePublish({\n            content: {\n                type: this.ctx.type,\n                event,\n                data,\n            },\n            destinations: this.ctx.destinations(data),\n            ...(dataPrevious ? { dataPrevious } : {}),\n        });\n    }\n}\n"],"mappings":";;;;;AAwBA,SAAgBG,wBACZC,MACAC,UAAqD;CAErD,QAAQC,SAAAA;EACJ,MAAMC,eAAyC,CAC3C,EAAEC,UAAUC,OAAOR,uBAAuBG,MAAMK,EAAAA,EAAI,CAAA;EAGxD,IAAIJ,UAAU;GACV,MAAMK,QAAQL,SAASC,IAAAA;GACvB,MAAMK,uBAAO,IAAIC,IAAAA;GACjB,KAAK,MAAMC,WAAWH,OAClB,IAAIG,WAAW,CAACF,KAAKG,IAAID,OAAAA,GAAU;IAC/BF,KAAKI,IAAIF,OAAAA;IACTN,aAAaS,KAAK;KACdR,UAAUC,OAAOR,uBAAuBG,MAAMK,EAAAA;KAC9CQ,WAAWf,yBAAyBW,OAAAA;IACxC,CAAA;GACJ;EAER;EAEA,OAAON;CACX;AACJ;AAEA,IAAaW,mBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,KAAiC;EACzC,KAAKA,MAAMA;EACX,KAAKC,YAAYD,IAAIC;CACzB;CAEAC,aAAaD,WAAyC;EAClD,KAAKA,YAAYA;CACrB;CAGAE,WAA+B;EAC3B,OAAO,KAAKH,IAAII;CACpB;CAEA,MAAMC,YAAYC,OAAqC;EACnD,IAAI,CAACA,MAAMC,QACP;EAGJ,IAAI,KAAKP,IAAIQ,SAAS,KAAKR,IAAIQ,MAAMC,UACjC,MAAM,KAAKC,cAAcJ,MAAMK,YAAYL,MAAMC,MAAM;EAG3D,MAAM,KAAKK,QAAQ/B,uBAAuBgC,SAASP,MAAMC,MAAM;CACnE;CAEA,MAAMO,YAAYR,OAAqC;EACnD,IAAI,CAACA,MAAMC,QACP;EAGJ,MAAM,KAAKG,cAAcJ,MAAMK,YAAYL,MAAMC,MAAM;EAEvD,MAAM,KAAKK,QAAQ/B,uBAAuBkC,SAAST,MAAMC,QAAaD,MAAMU,cAAc;CAC9F;CAEA,MAAMC,YAAYX,OAAqC;EAInD,MAAMC,SAASD,MAAMU,kBAAkBV,MAAMC;EAC7C,IAAI,CAACA,QACD;EAGJ,MAAM,KAAKG,cAAcJ,MAAMK,YAAYJ,MAAAA;EAE3C,MAAM,KAAKK,QAAQ/B,uBAAuBqC,SAASX,MAAAA;CACvD;CAEA,MAAgBG,cAAcC,YAAwBxB,MAAyB;EAC3E,IAAI,CAAC,KAAKa,IAAIQ,SAAS,CAACG,WAAWQ,kBAC/B;EAGJ,MAAMR,WAAWQ,iBAAiBC,OAAO,KAAKpB,IAAIQ,MAAMa,KAAKlC,IAAAA,CAAAA;CACjE;CAEA,MAAgByB,QACZN,OACAnB,MACAmC,cACc;EACd,IAAI,CAAC,KAAKrB,WACN;EAGJ,MAAM,KAAKA,UAAUsB,YAAY;GAC7BC,SAAS;IACLvC,MAAM,KAAKe,IAAIf;IACfqB;IACAnB;GACJ;GACAC,cAAc,KAAKY,IAAIZ,aAAaD,IAAAA;GACpC,GAAImC,eAAe,EAAEA,aAAa,IAAI,CAAC;EAC3C,CAAA;CACJ;AACJ"}

package/dist/adapters/http/adapters/index.mjs

@@ -2,8 +2,10 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { HTTPOAuth2Authorizer } from "./oauth2/authorization/module.mjs";
+import { extractOAuth2ClientCertificateEvidence } from "./oauth2/grant-types/utils/certificate.mjs";
 import { extractClientCredentialsFromRequest, readStringField } from "./oauth2/grant-types/utils/credentials.mjs";
 import { guessOauth2GrantTypeByRequest } from "./oauth2/grant-types/utils/guess.mjs";
+import { readRealmHint } from "./oauth2/grant-types/utils/realm.mjs";
 import { HTTPOAuth2AuthorizeGrant } from "./oauth2/grant-types/authorize.mjs";
 import { HTTPClientCredentialsGrant } from "./oauth2/grant-types/client-credentials.mjs";
 import { HTTPOAuth2IdentityGrantType } from "./oauth2/grant-types/identity.mjs";
@@ -11,4 +13,4 @@ import { HTTPPasswordGrant } from "./oauth2/grant-types/password.mjs";
 import { HTTPOAuth2RefreshTokenGrant } from "./oauth2/grant-types/refresh_token.mjs";
 import { HTTPRobotCredentialsGrant } from "./oauth2/grant-types/robot-credentials.mjs";
 import "./oauth2/index.mjs";
-export { HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, extractClientCredentialsFromRequest, guessOauth2GrantTypeByRequest, readStringField };
+export { HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, guessOauth2GrantTypeByRequest, readRealmHint, readStringField };

package/dist/adapters/http/adapters/oauth2/authorization/module.d.ts

@@ -1,11 +1,14 @@
 import type { IAppEvent } from 'routup';
+import type { Logger } from '@authup/server-kit';
 import type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';
-import type { IOAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationResult } from '../../../../../core/index.ts';
+import type { IConsentService, IOAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationResult } from '../../../../../core/index.ts';
 import { OAuth2Authorization, OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';
 import type { HTTPOAuth2AuthorizationManagerContext } from './types.ts';
 export declare class HTTPOAuth2Authorizer extends OAuth2Authorization {
     protected codeRequestVerifier: IOAuth2AuthorizationCodeRequestVerifier;
     protected requestValidator: OAuth2AuthorizationCodeRequestValidator;
+    protected consentService?: IConsentService;
+    protected logger?: Logger;
     constructor(ctx: HTTPOAuth2AuthorizationManagerContext);
     authorizeWithRequest(event: IAppEvent): Promise<OAuth2AuthorizationResult>;
     /**

package/dist/adapters/http/adapters/oauth2/authorization/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/authorization/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,KAAK,EAAE,uCAAuC,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACvH,OAAO,EAAE,mBAAmB,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AAE5G,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,YAAY,CAAC;AAExE,qBAAa,oBAAqB,SAAQ,mBAAmB;IACzD,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,gBAAgB,EAAG,uCAAuC,CAAC;gBAEzD,GAAG,EAAE,qCAAqC;IAQhD,oBAAoB,CAAC,KAAK,EAAE,SAAS,GAAI,OAAO,CAAC,yBAAyB,CAAC;IAUjF;;;;OAIG;IACG,mBAAmB,CACrB,KAAK,EAAE,SAAS,GAChB,OAAO,CAAC,8BAA8B,CAAC;CAI9C"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/authorization/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,KAAK,EAAE,eAAe,EAAE,uCAAuC,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACxI,OAAO,EAAE,mBAAmB,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AAE5G,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,YAAY,CAAC;AAExE,qBAAa,oBAAqB,SAAQ,mBAAmB;IACzD,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,gBAAgB,EAAG,uCAAuC,CAAC;IAErE,SAAS,CAAC,cAAc,CAAC,EAAG,eAAe,CAAC;IAE5C,SAAS,CAAC,MAAM,CAAC,EAAG,MAAM,CAAC;gBAEf,GAAG,EAAE,qCAAqC;IAUhD,oBAAoB,CAAC,KAAK,EAAE,SAAS,GAAI,OAAO,CAAC,yBAAyB,CAAC;IA6CjF;;;;OAIG;IACG,mBAAmB,CACrB,KAAK,EAAE,SAAS,GAChB,OAAO,CAAC,8BAA8B,CAAC;CAI9C"}

package/dist/adapters/http/adapters/oauth2/authorization/module.mjs

@@ -6,21 +6,47 @@ import { OAuth2Authorization } from "../../../../../core/oauth2/authorization/mo
 import "../../../../../core/index.mjs";
 import { useRequestIdentityOrFail } from "../../../request/helpers/identity.mjs";
 import { readFromLocations } from "../../../request/helpers/locations.mjs";
+import { useRequestSessionId } from "../../../request/helpers/session-id.mjs";
 import "../../../request/index.mjs";
 //#region src/adapters/http/adapters/oauth2/authorization/module.ts
 var HTTPOAuth2Authorizer = class extends OAuth2Authorization {
 	codeRequestVerifier;
 	requestValidator;
+	consentService;
+	logger;
 	constructor(ctx) {
 		super(ctx);
 		this.codeRequestVerifier = ctx.codeRequestVerifier;
+		this.consentService = ctx.consentService;
+		this.logger = ctx.logger;
 		this.requestValidator = new OAuth2AuthorizationCodeRequestValidator();
 	}
 	async authorizeWithRequest(event) {
 		const codeRequestValidated = await this.validateWithRequest(event);
-		const { data } = await this.codeRequestVerifier.verify(codeRequestValidated);
+		const { data, client, redirectUriVerified } = await this.codeRequestVerifier.verify(codeRequestValidated);
 		const identity = useRequestIdentityOrFail(event);
-		return this.authorize(data, identity.raw);
+		const result = await this.authorize(data, identity.raw, {
+			sessionId: useRequestSessionId(event),
+			client,
+			redirectUriVerified
+		});
+		if (this.consentService && client && !client.built_in) try {
+			await this.consentService.record({
+				clientId: client.id,
+				realmId: client.realm_id,
+				owner: {
+					sub: identity.raw.data.id,
+					subKind: identity.raw.type
+				},
+				scope: data.scope ?? null
+			});
+		} catch (e) {
+			this.logger?.warn("Recording the OAuth2 consent grant failed.", {
+				clientId: client.id,
+				error: e
+			});
+		}
+		return result;
 	}
 	/**
 	* Validate authorization request.

package/dist/adapters/http/adapters/oauth2/authorization/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2Authorization","OAuth2AuthorizationCodeRequestValidator","readFromLocations","useRequestIdentityOrFail","HTTPOAuth2Authorizer","codeRequestVerifier","requestValidator","ctx","authorizeWithRequest","event","codeRequestValidated","validateWithRequest","data","verify","identity","authorize","raw","run"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/authorization/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IAppEvent } from 'routup';\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport type { IOAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationResult } from '../../../../../core/index.ts';\nimport { OAuth2Authorization, OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';\nimport { readFromLocations, useRequestIdentityOrFail } from '../../../request/index.ts';\nimport type { HTTPOAuth2AuthorizationManagerContext } from './types.ts';\n\nexport class HTTPOAuth2Authorizer extends OAuth2Authorization {\n    protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n    protected requestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n    constructor(ctx: HTTPOAuth2AuthorizationManagerContext) {\n        super(ctx);\n\n        this.codeRequestVerifier = ctx.codeRequestVerifier;\n\n        this.requestValidator = new OAuth2AuthorizationCodeRequestValidator();\n    }\n\n    async authorizeWithRequest(event: IAppEvent) : Promise<OAuth2AuthorizationResult> {\n        const codeRequestValidated = await this.validateWithRequest(event);\n\n        const { data } = await this.codeRequestVerifier.verify(codeRequestValidated);\n\n        const identity = useRequestIdentityOrFail(event);\n\n        return this.authorize(data, identity.raw);\n    }\n\n    /**\n     * Validate authorization request.\n     *\n     * @throws OAuth2Error\n     */\n    async validateWithRequest(\n        event: IAppEvent,\n    ) : Promise<OAuth2AuthorizationCodeRequest> {\n        const data = await readFromLocations(event, ['body', 'query']);\n        return this.requestValidator.run(data);\n    }\n}\n"],"mappings":";;;;;;;;;;AAcA,IAAaI,uBAAb,cAA0CJ,oBAAAA;CAC5BK;CAEAC;CAEV,YAAYC,KAA4C;EACpD,MAAMA,GAAAA;EAEN,KAAKF,sBAAsBE,IAAIF;EAE/B,KAAKC,mBAAmB,IAAIL,wCAAAA;CAChC;CAEA,MAAMO,qBAAqBC,OAAuD;EAC9E,MAAMC,uBAAuB,MAAM,KAAKC,oBAAoBF,KAAAA;EAE5D,MAAM,EAAEG,SAAS,MAAM,KAAKP,oBAAoBQ,OAAOH,oBAAAA;EAEvD,MAAMI,WAAWX,yBAAyBM,KAAAA;EAE1C,OAAO,KAAKM,UAAUH,MAAME,SAASE,GAAG;CAC5C;;;;;IAOA,MAAML,oBACFF,OACwC;EACxC,MAAMG,OAAO,MAAMV,kBAAkBO,OAAO,CAAC,QAAQ,OAAA,CAAQ;EAC7D,OAAO,KAAKH,iBAAiBW,IAAIL,IAAAA;CACrC;AACJ"}
+{"version":3,"file":"module.mjs","names":["OAuth2Authorization","OAuth2AuthorizationCodeRequestValidator","readFromLocations","useRequestIdentityOrFail","useRequestSessionId","HTTPOAuth2Authorizer","codeRequestVerifier","requestValidator","consentService","logger","ctx","authorizeWithRequest","event","codeRequestValidated","validateWithRequest","data","client","redirectUriVerified","verify","identity","result","authorize","raw","sessionId","built_in","record","clientId","id","realmId","realm_id","owner","sub","subKind","type","scope","e","warn","error","run"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/authorization/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IAppEvent } from 'routup';\nimport type { Logger } from '@authup/server-kit';\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport type { IConsentService, IOAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationResult } from '../../../../../core/index.ts';\nimport { OAuth2Authorization, OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';\nimport { readFromLocations, useRequestIdentityOrFail, useRequestSessionId } from '../../../request/index.ts';\nimport type { HTTPOAuth2AuthorizationManagerContext } from './types.ts';\n\nexport class HTTPOAuth2Authorizer extends OAuth2Authorization {\n    protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n    protected requestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n    protected consentService? : IConsentService;\n\n    protected logger? : Logger;\n\n    constructor(ctx: HTTPOAuth2AuthorizationManagerContext) {\n        super(ctx);\n\n        this.codeRequestVerifier = ctx.codeRequestVerifier;\n        this.consentService = ctx.consentService;\n        this.logger = ctx.logger;\n\n        this.requestValidator = new OAuth2AuthorizationCodeRequestValidator();\n    }\n\n    async authorizeWithRequest(event: IAppEvent) : Promise<OAuth2AuthorizationResult> {\n        const codeRequestValidated = await this.validateWithRequest(event);\n\n        const {\n            data,\n            client,\n            redirectUriVerified,\n        } = await this.codeRequestVerifier.verify(codeRequestValidated);\n\n        const identity = useRequestIdentityOrFail(event);\n\n        const result = await this.authorize(data, identity.raw, {\n            sessionId: useRequestSessionId(event),\n            client,\n            redirectUriVerified,\n        });\n\n        // Persisted per-scope consent (plan 055): recorded only after a\n        // successful approval — an access-policy denial throws inside\n        // authorize() above, so a denied identity never writes a row.\n        // built_in clients keep zero rows (locked); insert-missing makes\n        // re-recording idempotent (union/keep).\n        if (this.consentService && client && !client.built_in) {\n            try {\n                await this.consentService.record({\n                    clientId: client.id,\n                    realmId: client.realm_id,\n                    owner: {\n                        sub: identity.raw.data.id,\n                        subKind: identity.raw.type,\n                    },\n                    scope: data.scope ?? null,\n                });\n            } catch (e) {\n                // never fail an issued code over a consent-write failure\n                this.logger?.warn('Recording the OAuth2 consent grant failed.', {\n                    clientId: client.id,\n                    error: e,\n                });\n            }\n        }\n\n        return result;\n    }\n\n    /**\n     * Validate authorization request.\n     *\n     * @throws OAuth2Error\n     */\n    async validateWithRequest(\n        event: IAppEvent,\n    ) : Promise<OAuth2AuthorizationCodeRequest> {\n        const data = await readFromLocations(event, ['body', 'query']);\n        return this.requestValidator.run(data);\n    }\n}\n"],"mappings":";;;;;;;;;;;AAeA,IAAaK,uBAAb,cAA0CL,oBAAAA;CAC5BM;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA4C;EACpD,MAAMA,GAAAA;EAEN,KAAKJ,sBAAsBI,IAAIJ;EAC/B,KAAKE,iBAAiBE,IAAIF;EAC1B,KAAKC,SAASC,IAAID;EAElB,KAAKF,mBAAmB,IAAIN,wCAAAA;CAChC;CAEA,MAAMU,qBAAqBC,OAAuD;EAC9E,MAAMC,uBAAuB,MAAM,KAAKC,oBAAoBF,KAAAA;EAE5D,MAAM,EACFG,MACAC,QACAC,wBACA,MAAM,KAAKX,oBAAoBY,OAAOL,oBAAAA;EAE1C,MAAMM,WAAWhB,yBAAyBS,KAAAA;EAE1C,MAAMQ,SAAS,MAAM,KAAKC,UAAUN,MAAMI,SAASG,KAAK;GACpDC,WAAWnB,oBAAoBQ,KAAAA;GAC/BI;GACAC;EACJ,CAAA;EAOA,IAAI,KAAKT,kBAAkBQ,UAAU,CAACA,OAAOQ,UACzC,IAAI;GACA,MAAM,KAAKhB,eAAeiB,OAAO;IAC7BC,UAAUV,OAAOW;IACjBC,SAASZ,OAAOa;IAChBC,OAAO;KACHC,KAAKZ,SAASG,IAAIP,KAAKY;KACvBK,SAASb,SAASG,IAAIW;IAC1B;IACAC,OAAOnB,KAAKmB,SAAS;GACzB,CAAA;EACJ,SAASC,GAAG;GAER,KAAK1B,QAAQ2B,KAAK,8CAA8C;IAC5DV,UAAUV,OAAOW;IACjBU,OAAOF;GACX,CAAA;EACJ;EAGJ,OAAOf;CACX;;;;;IAOA,MAAMN,oBACFF,OACwC;EACxC,MAAMG,OAAO,MAAMb,kBAAkBU,OAAO,CAAC,QAAQ,OAAA,CAAQ;EAC7D,OAAO,KAAKL,iBAAiB+B,IAAIvB,IAAAA;CACrC;AACJ"}

package/dist/adapters/http/adapters/oauth2/authorization/types.d.ts

@@ -1,5 +1,13 @@
-import type { IOAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationManagerContext } from '../../../../../core/index.ts';
+import type { Logger } from '@authup/server-kit';
+import type { IConsentService, IOAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationManagerContext } from '../../../../../core/index.ts';
 export type HTTPOAuth2AuthorizationManagerContext = OAuth2AuthorizationManagerContext & {
     codeRequestVerifier: IOAuth2AuthorizationCodeRequestVerifier;
+    /**
+     * Persisted per-scope consent (plan 055): records the approved scope
+     * tokens after a successful (non-built_in) authorization. Absent =
+     * feature inert.
+     */
+    consentService?: IConsentService;
+    logger?: Logger;
 };
 //# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/adapters/oauth2/authorization/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/authorization/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uCAAuC,EAAE,iCAAiC,EAAE,MAAM,8BAA8B,CAAC;AAE/H,MAAM,MAAM,qCAAqC,GAAG,iCAAiC,GAAG;IACpF,mBAAmB,EAAE,uCAAuC,CAAC;CAChE,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/authorization/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EACR,eAAe,EACf,uCAAuC,EACvC,iCAAiC,EACpC,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,qCAAqC,GAAG,iCAAiC,GAAG;IACpF,mBAAmB,EAAE,uCAAuC,CAAC;IAC7D;;;;OAIG;IACH,cAAc,CAAC,EAAE,eAAe,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC"}

package/dist/adapters/http/adapters/oauth2/grant-types/authorize.d.ts

@@ -1,11 +1,15 @@
 import type { OAuth2TokenGrantResponse } from '@authup/specs';
 import type { IAppEvent } from 'routup';
 import { OAuth2AuthorizeGrant } from '../../../../../core/index.ts';
-import type { IOAuth2AuthorizationCodeVerifier, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';
+import type { IOAuth2AccessPolicyEvaluator, IOAuth2AuthorizationCodeVerifier, IRealmRepository, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';
 import type { HTTPOAuth2AuthorizeGrantContext, IHTTPOAuth2Grant } from './types.ts';
+import type { CertificateSource } from '../../../request/index.ts';
 export declare class HTTPOAuth2AuthorizeGrant extends OAuth2AuthorizeGrant implements IHTTPOAuth2Grant {
     protected codeVerifier: IOAuth2AuthorizationCodeVerifier;
     protected clientAuthenticator: OAuth2ClientAuthenticator;
+    protected realmRepository: IRealmRepository;
+    protected accessPolicyEvaluator?: IOAuth2AccessPolicyEvaluator;
+    protected certificateSource: CertificateSource;
     constructor(ctx: HTTPOAuth2AuthorizeGrantContext);
     runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse>;
     protected pickStringParam(body: Record<string, any> | undefined, query: Record<string, any> | undefined, key: string): string | undefined;

package/dist/adapters/http/adapters/oauth2/grant-types/authorize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/authorize.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAI9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EACR,gCAAgC,EAChC,yBAAyB,EAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,+BAA+B,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAGpF,qBAAa,wBAAyB,SAAQ,oBAAqB,YAAW,gBAAgB;IAC1F,SAAS,CAAC,YAAY,EAAG,gCAAgC,CAAC;IAE1D,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;gBAE9C,GAAG,EAAE,+BAA+B;IAO1C,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;IA6BzE,SAAS,CAAC,eAAe,CACrB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACrC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACtC,GAAG,EAAE,MAAM,GACZ,MAAM,GAAG,SAAS;CAIxB"}
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/authorize.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAK9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,EAAE,oBAAoB,EAA4B,MAAM,8BAA8B,CAAC;AAC9F,OAAO,KAAK,EACR,4BAA4B,EAC5B,gCAAgC,EAChC,gBAAgB,EAChB,yBAAyB,EAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,+BAA+B,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACpF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAOnE,qBAAa,wBAAyB,SAAQ,oBAAqB,YAAW,gBAAgB;IAC1F,SAAS,CAAC,YAAY,EAAG,gCAAgC,CAAC;IAE1D,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;IAE1D,SAAS,CAAC,eAAe,EAAG,gBAAgB,CAAC;IAE7C,SAAS,CAAC,qBAAqB,CAAC,EAAG,4BAA4B,CAAC;IAEhE,SAAS,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;gBAEnC,GAAG,EAAE,+BAA+B;IAU1C,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;IA8DzE,SAAS,CAAC,eAAe,CACrB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACrC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACtC,GAAG,EAAE,MAAM,GACZ,MAAM,GAAG,SAAS;CAIxB"}

package/dist/adapters/http/adapters/oauth2/grant-types/authorize.mjs

@@ -1,11 +1,15 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { assertClientGrantAllowed } from "../../../../../core/oauth2/client/grant-type.mjs";
 import { OAuth2AuthorizeGrant } from "../../../../../core/oauth2/grant-types/authorize.mjs";
 import "../../../../../core/index.mjs";
+import { extractOAuth2ClientCertificateEvidence } from "./utils/certificate.mjs";
 import { extractClientCredentialsFromRequest } from "./utils/credentials.mjs";
+import { readRealmHint } from "./utils/realm.mjs";
 import "./utils/index.mjs";
-import { OAuth2RequestError } from "@authup/specs";
+import { isClientPublic } from "@authup/core-kit";
+import { OAuth2GrantError, OAuth2RequestError, OAuth2TokenGrant } from "@authup/specs";
 import { getRequestHeader, getRequestIP } from "routup";
 import { readRequestBody } from "@routup/basic/body";
 import { useRequestQuery } from "@routup/basic/query";
@@ -13,10 +17,16 @@ import { useRequestQuery } from "@routup/basic/query";
 var HTTPOAuth2AuthorizeGrant = class extends OAuth2AuthorizeGrant {
 	codeVerifier;
 	clientAuthenticator;
+	realmRepository;
+	accessPolicyEvaluator;
+	certificateSource;
 	constructor(ctx) {
 		super(ctx);
 		this.codeVerifier = ctx.codeVerifier;
 		this.clientAuthenticator = ctx.clientAuthenticator;
+		this.realmRepository = ctx.realmRepository;
+		this.accessPolicyEvaluator = ctx.accessPolicyEvaluator;
+		this.certificateSource = ctx.certificateSource ?? "disabled";
 	}
 	async runWithRequest(event) {
 		const body = await readRequestBody(event);
@@ -26,15 +36,31 @@ var HTTPOAuth2AuthorizeGrant = class extends OAuth2AuthorizeGrant {
 		const codeVerifier = this.pickStringParam(body, query, "code_verifier");
 		if (!code) throw OAuth2RequestError.malformed();
 		const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);
-		const realmId = this.pickStringParam(body, query, "realm_id");
-		const client = await this.clientAuthenticator.authenticate(clientId, clientSecret, realmId);
+		const realm = await this.realmRepository.resolve(readRealmHint(body, query), true);
+		const certificateEvidence = await extractOAuth2ClientCertificateEvidence(event, this.certificateSource);
+		const client = await this.clientAuthenticator.authenticate(clientId, clientSecret, realm.id, certificateEvidence);
+		const confirmation = this.clientAuthenticator.resolveTokenBinding(client, certificateEvidence);
+		assertClientGrantAllowed(client, OAuth2TokenGrant.AUTHORIZATION_CODE);
 		const entity = await this.codeVerifier.verify(code, {
 			redirectUri,
 			codeVerifier,
 			clientId: client.id,
-			clientIsPublic: !client.is_confidential
+			clientIsPublic: isClientPublic(client),
+			realmId: client.realm_id
 		});
+		if (client.access_policy_id) {
+			let allowed = false;
+			if (this.accessPolicyEvaluator) allowed = await this.accessPolicyEvaluator.evaluate(client.access_policy_id, {
+				type: entity.sub_kind,
+				id: entity.sub,
+				realmId: entity.realm_id ?? null,
+				realmName: entity.realm_name ?? null,
+				clientId: entity.client_id ?? null
+			});
+			if (!allowed) throw OAuth2GrantError.invalid();
+		}
 		return this.runWith(entity, {
+			confirmation,
 			ipAddress: getRequestIP(event, { trustProxy: true }) ?? void 0,
 			userAgent: getRequestHeader(event, "user-agent") ?? void 0
 		});

package/dist/adapters/http/adapters/oauth2/grant-types/authorize.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.mjs","names":["OAuth2RequestError","readRequestBody","useRequestQuery","getRequestHeader","getRequestIP","OAuth2AuthorizeGrant","extractClientCredentialsFromRequest","HTTPOAuth2AuthorizeGrant","codeVerifier","clientAuthenticator","ctx","runWithRequest","event","body","query","code","pickStringParam","redirectUri","malformed","clientId","clientSecret","realmId","client","authenticate","entity","verify","id","clientIsPublic","is_confidential","runWith","ipAddress","trustProxy","undefined","userAgent","key","value","length"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/authorize.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2RequestError } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport { OAuth2AuthorizeGrant } from '../../../../../core/index.ts';\nimport type {\n    IOAuth2AuthorizationCodeVerifier,\n    OAuth2ClientAuthenticator,\n} from '../../../../../core/index.ts';\nimport type { HTTPOAuth2AuthorizeGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport { extractClientCredentialsFromRequest } from './utils/index.ts';\n\nexport class HTTPOAuth2AuthorizeGrant extends OAuth2AuthorizeGrant implements IHTTPOAuth2Grant {\n    protected codeVerifier : IOAuth2AuthorizationCodeVerifier;\n\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    constructor(ctx: HTTPOAuth2AuthorizeGrantContext) {\n        super(ctx);\n\n        this.codeVerifier = ctx.codeVerifier;\n        this.clientAuthenticator = ctx.clientAuthenticator;\n    }\n\n    async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const body = await readRequestBody(event);\n        const query = useRequestQuery(event);\n\n        const code = this.pickStringParam(body, query, 'code');\n        const redirectUri = this.pickStringParam(body, query, 'redirect_uri');\n        const codeVerifier = this.pickStringParam(body, query, 'code_verifier');\n        if (!code) {\n            throw OAuth2RequestError.malformed();\n        }\n\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n        const realmId = this.pickStringParam(body, query, 'realm_id');\n\n        const client = await this.clientAuthenticator.authenticate(clientId, clientSecret, realmId);\n\n        const entity = await this.codeVerifier.verify(code, {\n            redirectUri,\n            codeVerifier,\n            clientId: client.id,\n            clientIsPublic: !client.is_confidential,\n        });\n\n        return this.runWith(entity, {\n            ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n\n    protected pickStringParam(\n        body: Record<string, any> | undefined,\n        query: Record<string, any> | undefined,\n        key: string,\n    ): string | undefined {\n        const value = body?.[key] ?? query?.[key];\n        return typeof value === 'string' && value.length > 0 ? value : undefined;\n    }\n}\n"],"mappings":";;;;;;;;;;;;AAqBA,IAAaO,2BAAb,cAA8CF,qBAAAA;CAChCG;CAEAC;CAEV,YAAYC,KAAsC;EAC9C,MAAMA,GAAAA;EAEN,KAAKF,eAAeE,IAAIF;EACxB,KAAKC,sBAAsBC,IAAID;CACnC;CAEA,MAAME,eAAeC,OAAqD;EACtE,MAAMC,OAAO,MAAMZ,gBAAgBW,KAAAA;EACnC,MAAME,QAAQZ,gBAAgBU,KAAAA;EAE9B,MAAMG,OAAO,KAAKC,gBAAgBH,MAAMC,OAAO,MAAA;EAC/C,MAAMG,cAAc,KAAKD,gBAAgBH,MAAMC,OAAO,cAAA;EACtD,MAAMN,eAAe,KAAKQ,gBAAgBH,MAAMC,OAAO,eAAA;EACvD,IAAI,CAACC,MACD,MAAMf,mBAAmBkB,UAAS;EAGtC,MAAM,EAAEC,UAAUC,iBAAiB,MAAMd,oCAAoCM,KAAAA;EAC7E,MAAMS,UAAU,KAAKL,gBAAgBH,MAAMC,OAAO,UAAA;EAElD,MAAMQ,SAAS,MAAM,KAAKb,oBAAoBc,aAAaJ,UAAUC,cAAcC,OAAAA;EAEnF,MAAMG,SAAS,MAAM,KAAKhB,aAAaiB,OAAOV,MAAM;GAChDE;GACAT;GACAW,UAAUG,OAAOI;GACjBC,gBAAgB,CAACL,OAAOM;EAC5B,CAAA;EAEA,OAAO,KAAKC,QAAQL,QAAQ;GACxBM,WAAW1B,aAAaQ,OAAO,EAAEmB,YAAY,KAAK,CAAA,KAAMC,KAAAA;GACxDC,WAAW9B,iBAAiBS,OAAO,YAAA,KAAiBoB,KAAAA;EACxD,CAAA;CACJ;CAEUhB,gBACNH,MACAC,OACAoB,KACkB;EAClB,MAAMC,QAAQtB,OAAOqB,QAAQpB,QAAQoB;EACrC,OAAO,OAAOC,UAAU,YAAYA,MAAMC,SAAS,IAAID,QAAQH,KAAAA;CACnE;AACJ"}
+{"version":3,"file":"authorize.mjs","names":["isClientPublic","OAuth2GrantError","OAuth2RequestError","OAuth2TokenGrant","readRequestBody","useRequestQuery","getRequestHeader","getRequestIP","OAuth2AuthorizeGrant","assertClientGrantAllowed","extractClientCredentialsFromRequest","extractOAuth2ClientCertificateEvidence","readRealmHint","HTTPOAuth2AuthorizeGrant","codeVerifier","clientAuthenticator","realmRepository","accessPolicyEvaluator","certificateSource","ctx","runWithRequest","event","body","query","code","pickStringParam","redirectUri","malformed","clientId","clientSecret","realm","resolve","certificateEvidence","client","authenticate","id","confirmation","resolveTokenBinding","AUTHORIZATION_CODE","entity","verify","clientIsPublic","realmId","realm_id","access_policy_id","allowed","evaluate","type","sub_kind","sub","realmName","realm_name","client_id","invalid","runWith","ipAddress","trustProxy","undefined","userAgent","key","value","length"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/authorize.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { isClientPublic } from '@authup/core-kit';\nimport { OAuth2GrantError, OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport { OAuth2AuthorizeGrant, assertClientGrantAllowed } from '../../../../../core/index.ts';\nimport type {\n    IOAuth2AccessPolicyEvaluator,\n    IOAuth2AuthorizationCodeVerifier,\n    IRealmRepository,\n    OAuth2ClientAuthenticator,\n} from '../../../../../core/index.ts';\nimport type { HTTPOAuth2AuthorizeGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport type { CertificateSource } from '../../../request/index.ts';\nimport {\n    extractClientCredentialsFromRequest,\n    extractOAuth2ClientCertificateEvidence,\n    readRealmHint,\n} from './utils/index.ts';\n\nexport class HTTPOAuth2AuthorizeGrant extends OAuth2AuthorizeGrant implements IHTTPOAuth2Grant {\n    protected codeVerifier : IOAuth2AuthorizationCodeVerifier;\n\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    protected realmRepository : IRealmRepository;\n\n    protected accessPolicyEvaluator? : IOAuth2AccessPolicyEvaluator;\n\n    protected certificateSource: CertificateSource;\n\n    constructor(ctx: HTTPOAuth2AuthorizeGrantContext) {\n        super(ctx);\n\n        this.codeVerifier = ctx.codeVerifier;\n        this.clientAuthenticator = ctx.clientAuthenticator;\n        this.realmRepository = ctx.realmRepository;\n        this.accessPolicyEvaluator = ctx.accessPolicyEvaluator;\n        this.certificateSource = ctx.certificateSource ?? 'disabled';\n    }\n\n    async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const body = await readRequestBody(event);\n        const query = useRequestQuery(event);\n\n        const code = this.pickStringParam(body, query, 'code');\n        const redirectUri = this.pickStringParam(body, query, 'redirect_uri');\n        const codeVerifier = this.pickStringParam(body, query, 'code_verifier');\n        if (!code) {\n            throw OAuth2RequestError.malformed();\n        }\n\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n        const realm = await this.realmRepository.resolve(readRealmHint(body, query), true);\n        const certificateEvidence = await extractOAuth2ClientCertificateEvidence(event, this.certificateSource);\n\n        const client = await this.clientAuthenticator.authenticate(\n            clientId,\n            clientSecret,\n            realm.id,\n            certificateEvidence,\n        );\n        const confirmation = this.clientAuthenticator.resolveTokenBinding(client, certificateEvidence);\n\n        assertClientGrantAllowed(client, OAuth2TokenGrant.AUTHORIZATION_CODE);\n\n        const entity = await this.codeVerifier.verify(code, {\n            redirectUri,\n            codeVerifier,\n            clientId: client.id,\n            clientIsPublic: isClientPublic(client),\n            realmId: client.realm_id,\n        });\n\n        // Application access policy (plan 052), /token backstop: a code\n        // minted before the policy was attached (or outside authorize())\n        // must not redeem. The subject is built from the code-blob scalars —\n        // no DB identity load; attribute-rich policies are enforced at the\n        // issuance legs. Denial = invalid_grant, never access_denied here.\n        if (client.access_policy_id) {\n            let allowed = false;\n            if (this.accessPolicyEvaluator) {\n                allowed = await this.accessPolicyEvaluator.evaluate(client.access_policy_id, {\n                    type: entity.sub_kind,\n                    id: entity.sub,\n                    realmId: entity.realm_id ?? null,\n                    realmName: entity.realm_name ?? null,\n                    clientId: entity.client_id ?? null,\n                });\n            }\n\n            if (!allowed) {\n                throw OAuth2GrantError.invalid();\n            }\n        }\n\n        return this.runWith(entity, {\n            confirmation,\n            ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n\n    protected pickStringParam(\n        body: Record<string, any> | undefined,\n        query: Record<string, any> | undefined,\n        key: string,\n    ): string | undefined {\n        const value = body?.[key] ?? query?.[key];\n        return typeof value === 'string' && value.length > 0 ? value : undefined;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA6BA,IAAaa,2BAAb,cAA8CL,qBAAAA;CAChCM;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAsC;EAC9C,MAAMA,GAAAA;EAEN,KAAKL,eAAeK,IAAIL;EACxB,KAAKC,sBAAsBI,IAAIJ;EAC/B,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,wBAAwBE,IAAIF;EACjC,KAAKC,oBAAoBC,IAAID,qBAAqB;CACtD;CAEA,MAAME,eAAeC,OAAqD;EACtE,MAAMC,OAAO,MAAMlB,gBAAgBiB,KAAAA;EACnC,MAAME,QAAQlB,gBAAgBgB,KAAAA;EAE9B,MAAMG,OAAO,KAAKC,gBAAgBH,MAAMC,OAAO,MAAA;EAC/C,MAAMG,cAAc,KAAKD,gBAAgBH,MAAMC,OAAO,cAAA;EACtD,MAAMT,eAAe,KAAKW,gBAAgBH,MAAMC,OAAO,eAAA;EACvD,IAAI,CAACC,MACD,MAAMtB,mBAAmByB,UAAS;EAGtC,MAAM,EAAEC,UAAUC,iBAAiB,MAAMnB,oCAAoCW,KAAAA;EAC7E,MAAMS,QAAQ,MAAM,KAAKd,gBAAgBe,QAAQnB,cAAcU,MAAMC,KAAAA,GAAQ,IAAA;EAC7E,MAAMS,sBAAsB,MAAMrB,uCAAuCU,OAAO,KAAKH,iBAAiB;EAEtG,MAAMe,SAAS,MAAM,KAAKlB,oBAAoBmB,aAC1CN,UACAC,cACAC,MAAMK,IACNH,mBAAAA;EAEJ,MAAMI,eAAe,KAAKrB,oBAAoBsB,oBAAoBJ,QAAQD,mBAAAA;EAE1EvB,yBAAyBwB,QAAQ9B,iBAAiBmC,kBAAkB;EAEpE,MAAMC,SAAS,MAAM,KAAKzB,aAAa0B,OAAOhB,MAAM;GAChDE;GACAZ;GACAc,UAAUK,OAAOE;GACjBM,gBAAgBzC,eAAeiC,MAAAA;GAC/BS,SAAST,OAAOU;EACpB,CAAA;EAOA,IAAIV,OAAOW,kBAAkB;GACzB,IAAIC,UAAU;GACd,IAAI,KAAK5B,uBACL4B,UAAU,MAAM,KAAK5B,sBAAsB6B,SAASb,OAAOW,kBAAkB;IACzEG,MAAMR,OAAOS;IACbb,IAAII,OAAOU;IACXP,SAASH,OAAOI,YAAY;IAC5BO,WAAWX,OAAOY,cAAc;IAChCvB,UAAUW,OAAOa,aAAa;GAClC,CAAA;GAGJ,IAAI,CAACP,SACD,MAAM5C,iBAAiBoD,QAAO;EAEtC;EAEA,OAAO,KAAKC,QAAQf,QAAQ;GACxBH;GACAmB,WAAWhD,aAAac,OAAO,EAAEmC,YAAY,KAAK,CAAA,KAAMC,KAAAA;GACxDC,WAAWpD,iBAAiBe,OAAO,YAAA,KAAiBoC,KAAAA;EACxD,CAAA;CACJ;CAEUhC,gBACNH,MACAC,OACAoC,KACkB;EAClB,MAAMC,QAAQtC,OAAOqC,QAAQpC,QAAQoC;EACrC,OAAO,OAAOC,UAAU,YAAYA,MAAMC,SAAS,IAAID,QAAQH,KAAAA;CACnE;AACJ"}

package/dist/adapters/http/adapters/oauth2/grant-types/client-credentials.d.ts

@@ -1,11 +1,12 @@
 import type { OAuth2TokenGrantResponse } from '@authup/specs';
-import type { Client } from '@authup/core-kit';
 import type { IAppEvent } from 'routup';
-import type { ICredentialsAuthenticator } from '../../../../../core/index.ts';
+import type { OAuth2ClientAuthenticator } from '../../../../../core/index.ts';
 import { ClientCredentialsGrant } from '../../../../../core/index.ts';
 import type { HTTPOAuth2ClientCredentialsGrantContext, IHTTPOAuth2Grant } from './types.ts';
+import type { CertificateSource } from '../../../request/index.ts';
 export declare class HTTPClientCredentialsGrant extends ClientCredentialsGrant implements IHTTPOAuth2Grant {
-    protected authenticator: ICredentialsAuthenticator<Client>;
+    protected clientAuthenticator: OAuth2ClientAuthenticator;
+    protected certificateSource: CertificateSource;
     constructor(ctx: HTTPOAuth2ClientCredentialsGrantContext);
     runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse>;
 }

package/dist/adapters/http/adapters/oauth2/grant-types/client-credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-credentials.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/client-credentials.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAE9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,KAAK,EAAE,uCAAuC,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAG5F,qBAAa,0BAA2B,SAAQ,sBAAuB,YAAW,gBAAgB;IAC9F,SAAS,CAAC,aAAa,EAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;gBAEhD,GAAG,EAAE,uCAAuC;IAMlD,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAgB5E"}
+{"version":3,"file":"client-credentials.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/client-credentials.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAI9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,sBAAsB,EAA4B,MAAM,8BAA8B,CAAC;AAChG,OAAO,KAAK,EAAE,uCAAuC,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC5F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAMnE,qBAAa,0BAA2B,SAAQ,sBAAuB,YAAW,gBAAgB;IAC9F,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;IAE1D,SAAS,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;gBAEnC,GAAG,EAAE,uCAAuC;IAOlD,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;CA6B5E"}

package/dist/adapters/http/adapters/oauth2/grant-types/client-credentials.mjs

@@ -1,26 +1,36 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { assertClientGrantAllowed } from "../../../../../core/oauth2/client/grant-type.mjs";
 import { ClientCredentialsGrant } from "../../../../../core/oauth2/grant-types/client-credentials.mjs";
 import "../../../../../core/index.mjs";
+import { extractOAuth2ClientCertificateEvidence } from "./utils/certificate.mjs";
 import { extractClientCredentialsFromRequest } from "./utils/credentials.mjs";
 import "./utils/index.mjs";
-import { EntityCredentialsInvalidError } from "@authup/errors";
+import { ClientAuthMethod } from "@authup/core-kit";
+import { OAuth2ClientError, OAuth2TokenGrant } from "@authup/specs";
 import { getRequestHeader, getRequestIP } from "routup";
 import { readRequestBody } from "@routup/basic/body";
 //#region src/adapters/http/adapters/oauth2/grant-types/client-credentials.ts
 var HTTPClientCredentialsGrant = class extends ClientCredentialsGrant {
-	authenticator;
+	clientAuthenticator;
+	certificateSource;
 	constructor(ctx) {
 		super(ctx);
-		this.authenticator = ctx.authenticator;
+		this.clientAuthenticator = ctx.clientAuthenticator;
+		this.certificateSource = ctx.certificateSource ?? "disabled";
 	}
 	async runWithRequest(event) {
 		const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);
 		const realmId = (await readRequestBody(event))?.realm_id;
-		if (!clientId) throw new EntityCredentialsInvalidError({ entity: "client" });
-		const client = await this.authenticator.authenticate(clientId, clientSecret ?? "", realmId);
+		if (!clientId) throw OAuth2ClientError.invalid();
+		const certificateEvidence = await extractOAuth2ClientCertificateEvidence(event, this.certificateSource);
+		const client = await this.clientAuthenticator.authenticate(clientId, clientSecret, realmId, certificateEvidence);
+		if (client.auth_method === ClientAuthMethod.NONE) throw OAuth2ClientError.invalid();
+		const confirmation = this.clientAuthenticator.resolveTokenBinding(client, certificateEvidence);
+		assertClientGrantAllowed(client, OAuth2TokenGrant.CLIENT_CREDENTIALS);
 		return this.runWith(client, {
+			confirmation,
 			ipAddress: getRequestIP(event, { trustProxy: true }) ?? void 0,
 			userAgent: getRequestHeader(event, "user-agent") ?? void 0
 		});

package/dist/adapters/http/adapters/oauth2/grant-types/client-credentials.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"client-credentials.mjs","names":["readRequestBody","EntityCredentialsInvalidError","getRequestHeader","getRequestIP","ClientCredentialsGrant","extractClientCredentialsFromRequest","HTTPClientCredentialsGrant","authenticator","ctx","runWithRequest","event","clientId","clientSecret","body","realmId","realm_id","entity","client","authenticate","runWith","ipAddress","trustProxy","undefined","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/client-credentials.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport type { Client } from '@authup/core-kit';\nimport { EntityCredentialsInvalidError } from '@authup/errors';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type { ICredentialsAuthenticator } from '../../../../../core/index.ts';\nimport { ClientCredentialsGrant } from '../../../../../core/index.ts';\nimport type { HTTPOAuth2ClientCredentialsGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport { extractClientCredentialsFromRequest } from './utils/index.ts';\n\nexport class HTTPClientCredentialsGrant extends ClientCredentialsGrant implements IHTTPOAuth2Grant {\n    protected authenticator : ICredentialsAuthenticator<Client>;\n\n    constructor(ctx: HTTPOAuth2ClientCredentialsGrantContext) {\n        super(ctx);\n\n        this.authenticator = ctx.authenticator;\n    }\n\n    async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n        const body = await readRequestBody(event);\n        const realmId = body?.realm_id;\n\n        if (!clientId) {\n            throw new EntityCredentialsInvalidError({ entity: 'client' });\n        }\n\n        const client = await this.authenticator.authenticate(clientId, clientSecret ?? '', realmId);\n\n        return this.runWith(client, {\n            ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;AAkBA,IAAaM,6BAAb,cAAgDF,uBAAAA;CAClCG;CAEV,YAAYC,KAA8C;EACtD,MAAMA,GAAAA;EAEN,KAAKD,gBAAgBC,IAAID;CAC7B;CAEA,MAAME,eAAeC,OAAqD;EACtE,MAAM,EAAEC,UAAUC,iBAAiB,MAAMP,oCAAoCK,KAAAA;EAE7E,MAAMI,WAAUD,MADGb,gBAAgBU,KAAAA,EAAAA,EACbK;EAEtB,IAAI,CAACJ,UACD,MAAM,IAAIV,8BAA8B,EAAEe,QAAQ,SAAS,CAAA;EAG/D,MAAMC,SAAS,MAAM,KAAKV,cAAcW,aAAaP,UAAUC,gBAAgB,IAAIE,OAAAA;EAEnF,OAAO,KAAKK,QAAQF,QAAQ;GACxBG,WAAWjB,aAAaO,OAAO,EAAEW,YAAY,KAAK,CAAA,KAAMC,KAAAA;GACxDC,WAAWrB,iBAAiBQ,OAAO,YAAA,KAAiBY,KAAAA;EACxD,CAAA;CACJ;AACJ"}
+{"version":3,"file":"client-credentials.mjs","names":["OAuth2ClientError","OAuth2TokenGrant","readRequestBody","ClientAuthMethod","getRequestHeader","getRequestIP","ClientCredentialsGrant","assertClientGrantAllowed","extractClientCredentialsFromRequest","extractOAuth2ClientCertificateEvidence","HTTPClientCredentialsGrant","clientAuthenticator","certificateSource","ctx","runWithRequest","event","clientId","clientSecret","body","realmId","realm_id","invalid","certificateEvidence","client","authenticate","auth_method","NONE","confirmation","resolveTokenBinding","CLIENT_CREDENTIALS","runWith","ipAddress","trustProxy","undefined","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/client-credentials.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2ClientError, OAuth2TokenGrant  } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport { ClientAuthMethod } from '@authup/core-kit';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type { OAuth2ClientAuthenticator } from '../../../../../core/index.ts';\nimport { ClientCredentialsGrant, assertClientGrantAllowed } from '../../../../../core/index.ts';\nimport type { HTTPOAuth2ClientCredentialsGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport type { CertificateSource } from '../../../request/index.ts';\nimport {\n    extractClientCredentialsFromRequest,\n    extractOAuth2ClientCertificateEvidence,\n} from './utils/index.ts';\n\nexport class HTTPClientCredentialsGrant extends ClientCredentialsGrant implements IHTTPOAuth2Grant {\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    protected certificateSource: CertificateSource;\n\n    constructor(ctx: HTTPOAuth2ClientCredentialsGrantContext) {\n        super(ctx);\n\n        this.clientAuthenticator = ctx.clientAuthenticator;\n        this.certificateSource = ctx.certificateSource ?? 'disabled';\n    }\n\n    async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n        const body = await readRequestBody(event);\n        const realmId = body?.realm_id;\n\n        if (!clientId) {\n            throw OAuth2ClientError.invalid();\n        }\n\n        const certificateEvidence = await extractOAuth2ClientCertificateEvidence(event, this.certificateSource);\n        const client = await this.clientAuthenticator.authenticate(\n            clientId,\n            clientSecret,\n            realmId,\n            certificateEvidence,\n        );\n        if (client.auth_method === ClientAuthMethod.NONE) {\n            throw OAuth2ClientError.invalid();\n        }\n        const confirmation = this.clientAuthenticator.resolveTokenBinding(client, certificateEvidence);\n\n        assertClientGrantAllowed(client, OAuth2TokenGrant.CLIENT_CREDENTIALS);\n\n        return this.runWith(client, {\n            confirmation,\n            ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;AAsBA,IAAaU,6BAAb,cAAgDJ,uBAAAA;CAClCK;CAEAC;CAEV,YAAYC,KAA8C;EACtD,MAAMA,GAAAA;EAEN,KAAKF,sBAAsBE,IAAIF;EAC/B,KAAKC,oBAAoBC,IAAID,qBAAqB;CACtD;CAEA,MAAME,eAAeC,OAAqD;EACtE,MAAM,EAAEC,UAAUC,iBAAiB,MAAMT,oCAAoCO,KAAAA;EAE7E,MAAMI,WAAUD,MADGhB,gBAAgBa,KAAAA,EAAAA,EACbK;EAEtB,IAAI,CAACJ,UACD,MAAMhB,kBAAkBqB,QAAO;EAGnC,MAAMC,sBAAsB,MAAMb,uCAAuCM,OAAO,KAAKH,iBAAiB;EACtG,MAAMW,SAAS,MAAM,KAAKZ,oBAAoBa,aAC1CR,UACAC,cACAE,SACAG,mBAAAA;EAEJ,IAAIC,OAAOE,gBAAgBtB,iBAAiBuB,MACxC,MAAM1B,kBAAkBqB,QAAO;EAEnC,MAAMM,eAAe,KAAKhB,oBAAoBiB,oBAAoBL,QAAQD,mBAAAA;EAE1Ef,yBAAyBgB,QAAQtB,iBAAiB4B,kBAAkB;EAEpE,OAAO,KAAKC,QAAQP,QAAQ;GACxBI;GACAI,WAAW1B,aAAaU,OAAO,EAAEiB,YAAY,KAAK,CAAA,KAAMC,KAAAA;GACxDC,WAAW9B,iBAAiBW,OAAO,YAAA,KAAiBkB,KAAAA;EACxD,CAAA;CACJ;AACJ"}

package/dist/adapters/http/adapters/oauth2/grant-types/index.mjs

@@ -1,8 +1,10 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { extractOAuth2ClientCertificateEvidence } from "./utils/certificate.mjs";
 import { extractClientCredentialsFromRequest, readStringField } from "./utils/credentials.mjs";
 import { guessOauth2GrantTypeByRequest } from "./utils/guess.mjs";
+import { readRealmHint } from "./utils/realm.mjs";
 import "./utils/index.mjs";
 import { HTTPOAuth2AuthorizeGrant } from "./authorize.mjs";
 import { HTTPClientCredentialsGrant } from "./client-credentials.mjs";
@@ -10,4 +12,4 @@ import { HTTPOAuth2IdentityGrantType } from "./identity.mjs";
 import { HTTPPasswordGrant } from "./password.mjs";
 import { HTTPOAuth2RefreshTokenGrant } from "./refresh_token.mjs";
 import { HTTPRobotCredentialsGrant } from "./robot-credentials.mjs";
-export { HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, extractClientCredentialsFromRequest, guessOauth2GrantTypeByRequest, readStringField };
+export { HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, guessOauth2GrantTypeByRequest, readRealmHint, readStringField };

package/dist/adapters/http/adapters/oauth2/grant-types/password.d.ts

@@ -1,14 +1,50 @@
 import type { User } from '@authup/core-kit';
-import type { OAuth2TokenGrantResponse } from '@authup/specs';
+import { UserAuthenticatorKind } from '@authup/core-kit';
+import type { Logger } from '@authup/server-kit';
+import type { OAuth2TokenConfirmation, OAuth2TokenGrantResponse } from '@authup/specs';
 import type { IAppEvent } from 'routup';
-import type { ICredentialsAuthenticator, IRealmRepository, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';
+import type { ICredentialsAuthenticator, ILoginThrottleService, IOAuth2MfaLoginService, IRealmRepository, IUserAuthenticatorService, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';
 import { PasswordGrantType } from '../../../../../core/index.ts';
 import type { HTTPOAuth2PasswordGrantContext, IHTTPOAuth2Grant } from './types.ts';
+import type { CertificateSource } from '../../../request/index.ts';
 export declare class HTTPPasswordGrant extends PasswordGrantType implements IHTTPOAuth2Grant {
     protected authenticator: ICredentialsAuthenticator<User>;
     protected clientAuthenticator: OAuth2ClientAuthenticator;
     protected realmRepository: IRealmRepository;
+    protected loginThrottleService?: ILoginThrottleService;
+    protected userAuthenticatorService?: IUserAuthenticatorService;
+    protected mfaLoginService?: IOAuth2MfaLoginService;
+    protected logger?: Logger;
+    protected certificateSource: CertificateSource;
     constructor(ctx: HTTPOAuth2PasswordGrantContext);
     runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse>;
+    /**
+     * MFA gate on the direct password grant: a user holding a confirmed
+     * device must send a valid `otp` form parameter (TOTP or recovery
+     * code, classified by shape) — otherwise `mfa_required`. Users
+     * without a device pass through (they could never enroll otherwise).
+     */
+    protected verifySecondFactor(user: User, body: Record<string, any>, ctx: {
+        ipAddress?: string;
+        userAgent?: string;
+        clientId: string | null;
+        confirmation?: OAuth2TokenConfirmation;
+    }): Promise<string | undefined>;
+    /**
+     * Issue the MFA-pending ticket for factor kinds that cannot complete
+     * inside the single grant POST (email needs a server-sent code,
+     * WebAuthn an interactive ceremony). TOTP/recovery-only users keep
+     * the inline `otp` fast-path and get no ticket — a pending session
+     * per plain code entry would be pure churn.
+     */
+    protected issueMfaTicket(user: User, kinds: `${UserAuthenticatorKind}`[], ctx: {
+        ipAddress?: string;
+        userAgent?: string;
+        clientId: string | null;
+        confirmation?: OAuth2TokenConfirmation;
+    }): Promise<{
+        token: string;
+        expiresIn: number;
+    } | null>;
 }
 //# sourceMappingURL=password.d.ts.map

package/dist/adapters/http/adapters/oauth2/grant-types/password.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/password.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAG9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAC3H,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAE,8BAA8B,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAGnF,qBAAa,iBAAkB,SAAQ,iBAAkB,YAAW,gBAAgB;IAChF,SAAS,CAAC,aAAa,EAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAE1D,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;IAE1D,SAAS,CAAC,eAAe,EAAG,gBAAgB,CAAC;gBAEjC,GAAG,EAAE,8BAA8B;IAQzC,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAuC5E"}
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/password.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAyB,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAGvF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EACR,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EACtB,gBAAgB,EAChB,yBAAyB,EACzB,yBAAyB,EAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACH,iBAAiB,EAGpB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,8BAA8B,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACnF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAQnE,qBAAa,iBAAkB,SAAQ,iBAAkB,YAAW,gBAAgB;IAChF,SAAS,CAAC,aAAa,EAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAE1D,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;IAE1D,SAAS,CAAC,eAAe,EAAG,gBAAgB,CAAC;IAE7C,SAAS,CAAC,oBAAoB,CAAC,EAAG,qBAAqB,CAAC;IAExD,SAAS,CAAC,wBAAwB,CAAC,EAAG,yBAAyB,CAAC;IAEhE,SAAS,CAAC,eAAe,CAAC,EAAG,sBAAsB,CAAC;IAEpD,SAAS,CAAC,MAAM,CAAC,EAAG,MAAM,CAAC;IAE3B,SAAS,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;gBAEnC,GAAG,EAAE,8BAA8B;IAazC,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;IA0FzE;;;;;OAKG;cACa,kBAAkB,CAC9B,IAAI,EAAE,IAAI,EACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,GAAG,EAAE;QACD,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,YAAY,CAAC,EAAE,uBAAuB,CAAC;KAC1C,GACF,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAwD9B;;;;;;OAMG;cACa,cAAc,CAC1B,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,GAAG,qBAAqB,EAAE,EAAE,EACnC,GAAG,EAAE;QACD,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,YAAY,CAAC,EAAE,uBAAuB,CAAC;KAC1C,GACD,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAkC3D"}