@authup/server-core 1.0.0-beta.51 → 1.0.0-beta.53

package/dist/adapters/http/adapters/oauth2/grant-types/password.mjs

@@ -1,11 +1,17 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { guessUserAuthenticatorKindByResponse } from "../../../../../core/entities/user-authenticator/helpers.mjs";
+import { assertClientGrantAllowed } from "../../../../../core/oauth2/client/grant-type.mjs";
 import { PasswordGrantType } from "../../../../../core/oauth2/grant-types/password.mjs";
 import "../../../../../core/index.mjs";
+import { extractOAuth2ClientCertificateEvidence } from "./utils/certificate.mjs";
 import { extractClientCredentialsFromRequest, readStringField } from "./utils/credentials.mjs";
+import { readRealmHint } from "./utils/realm.mjs";
 import "./utils/index.mjs";
-import { OAuth2RequestError } from "@authup/specs";
+import { EventName, EventScope, UserAuthenticatorKind } from "@authup/core-kit";
+import { isEntityCredentialsInvalidError, isEntityInactiveError } from "@authup/errors";
+import { OAuth2MfaRequiredError, OAuth2RequestError, OAuth2TokenGrant } from "@authup/specs";
 import { getRequestHeader, getRequestIP } from "routup";
 import { readRequestBody } from "@routup/basic/body";
 //#region src/adapters/http/adapters/oauth2/grant-types/password.ts
@@ -13,11 +19,21 @@ var HTTPPasswordGrant = class extends PasswordGrantType {
 	authenticator;
 	clientAuthenticator;
 	realmRepository;
+	loginThrottleService;
+	userAuthenticatorService;
+	mfaLoginService;
+	logger;
+	certificateSource;
 	constructor(ctx) {
 		super(ctx);
 		this.authenticator = ctx.authenticator;
 		this.clientAuthenticator = ctx.clientAuthenticator;
 		this.realmRepository = ctx.realmRepository;
+		this.loginThrottleService = ctx.loginThrottleService;
+		this.userAuthenticatorService = ctx.userAuthenticatorService;
+		this.mfaLoginService = ctx.mfaLoginService;
+		this.logger = ctx.logger;
+		this.certificateSource = ctx.certificateSource ?? "disabled";
 	}
 	async runWithRequest(event) {
 		const body = await readRequestBody(event);
@@ -25,17 +41,116 @@ var HTTPPasswordGrant = class extends PasswordGrantType {
 		const password = readStringField(body, "password");
 		if (!username || !password) throw OAuth2RequestError.malformed("username and password must be provided.");
 		const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);
-		const realmHint = [readStringField(body, "realm_id"), readStringField(body, "realm_name")].map((value) => value?.trim().toLowerCase()).find((value) => !!value);
-		const realm = await this.realmRepository.resolve(realmHint, true);
-		const client = clientId ? await this.clientAuthenticator.authenticate(clientId, clientSecret, realm.id) : void 0;
-		const user = await this.authenticator.authenticate(username, password, realm.id);
+		const realm = await this.realmRepository.resolve(readRealmHint(body), true);
+		const certificateEvidence = await extractOAuth2ClientCertificateEvidence(event, this.certificateSource);
+		const client = clientId ? await this.clientAuthenticator.authenticate(clientId, clientSecret, realm.id, certificateEvidence) : void 0;
+		const confirmation = client ? this.clientAuthenticator.resolveTokenBinding(client, certificateEvidence) : void 0;
+		if (client) assertClientGrantAllowed(client, OAuth2TokenGrant.PASSWORD);
+		const ipAddress = getRequestIP(event, { trustProxy: true }) ?? void 0;
+		const userAgent = getRequestHeader(event, "user-agent") ?? void 0;
+		const identifier = username.trim().toLowerCase();
+		await this.loginThrottleService?.assertNotThrottled({
+			identifier,
+			ipAddress,
+			realmId: realm.id
+		});
+		let user;
+		try {
+			user = await this.authenticator.authenticate(username, password, realm.id);
+		} catch (e) {
+			if (isEntityCredentialsInvalidError(e) || isEntityInactiveError(e)) {
+				await this.eventService?.record({
+					scope: EventScope.OAUTH2,
+					name: EventName.LOGIN_FAILED,
+					actorType: null,
+					actorId: null,
+					actorName: identifier,
+					clientId: client?.id ?? null,
+					realmId: realm.id,
+					requestIpAddress: ipAddress ?? null,
+					requestUserAgent: userAgent ?? null,
+					requestPath: event.path,
+					requestMethod: event.method,
+					data: { error_code: e.code }
+				});
+				this.metrics?.recordLogin("failure");
+			}
+			throw e;
+		}
+		const mfaVerifiedAt = await this.verifySecondFactor(user, body, {
+			ipAddress,
+			userAgent,
+			clientId: client?.id ?? null,
+			confirmation
+		});
 		return this.runWith({
 			user,
-			client
+			client,
+			mfaVerifiedAt
+		}, {
+			confirmation,
+			ipAddress,
+			userAgent
+		});
+	}
+	/**
+	* MFA gate on the direct password grant: a user holding a confirmed
+	* device must send a valid `otp` form parameter (TOTP or recovery
+	* code, classified by shape) — otherwise `mfa_required`. Users
+	* without a device pass through (they could never enroll otherwise).
+	*/ async verifySecondFactor(user, body, ctx) {
+		if (!this.userAuthenticatorService) return;
+		const status = await this.userAuthenticatorService.challenge(user.id, { issueMaterial: false });
+		if (!status.required) return;
+		const otp = readStringField(body, "otp");
+		if (!otp) {
+			const ticket = await this.issueMfaTicket(user, status.kinds, ctx);
+			throw new OAuth2MfaRequiredError({
+				message: "Complete a second-factor challenge to continue.",
+				data: {
+					kinds: status.kinds,
+					...ticket ? {
+						mfa_token: ticket.token,
+						mfa_token_expires_in: ticket.expiresIn
+					} : {}
+				}
+			});
+		}
+		if (!await this.userAuthenticatorService.verify(user.id, {
+			kind: guessUserAuthenticatorKindByResponse(otp),
+			response: otp
 		}, {
-			ipAddress: getRequestIP(event, { trustProxy: true }) ?? void 0,
-			userAgent: getRequestHeader(event, "user-agent") ?? void 0
+			ipAddress: ctx.ipAddress ?? null,
+			userAgent: ctx.userAgent ?? null,
+			clientId: ctx.clientId
+		})) throw new OAuth2MfaRequiredError({
+			message: "The provided second factor is not valid.",
+			data: { kinds: status.kinds }
 		});
+		return (/* @__PURE__ */ new Date()).toISOString();
+	}
+	/**
+	* Issue the MFA-pending ticket for factor kinds that cannot complete
+	* inside the single grant POST (email needs a server-sent code,
+	* WebAuthn an interactive ceremony). TOTP/recovery-only users keep
+	* the inline `otp` fast-path and get no ticket — a pending session
+	* per plain code entry would be pure churn.
+	*/ async issueMfaTicket(user, kinds, ctx) {
+		if (!this.mfaLoginService) return null;
+		if (!(kinds.includes(UserAuthenticatorKind.EMAIL) || kinds.includes(UserAuthenticatorKind.WEBAUTHN))) return null;
+		try {
+			return await this.mfaLoginService.issueTicket({
+				user,
+				clientId: ctx.clientId,
+				confirmation: ctx.confirmation
+			}, {
+				ipAddress: ctx.ipAddress,
+				userAgent: ctx.userAgent
+			});
+		} catch (e) {
+			this.logger?.warn("Issuing the MFA-pending login ticket failed.", { error: e });
+			return null;
+		}
 	}
 };
 //#endregion

package/dist/adapters/http/adapters/oauth2/grant-types/password.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"password.mjs","names":["OAuth2RequestError","readRequestBody","getRequestHeader","getRequestIP","PasswordGrantType","extractClientCredentialsFromRequest","readStringField","HTTPPasswordGrant","authenticator","clientAuthenticator","realmRepository","ctx","runWithRequest","event","body","username","password","malformed","clientId","clientSecret","realmHint","map","value","trim","toLowerCase","find","realm","resolve","client","authenticate","id","undefined","user","runWith","ipAddress","trustProxy","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/password.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { User } from '@authup/core-kit';\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2RequestError } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type { ICredentialsAuthenticator, IRealmRepository, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';\nimport { PasswordGrantType } from '../../../../../core/index.ts';\nimport type { HTTPOAuth2PasswordGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport { extractClientCredentialsFromRequest, readStringField } from './utils/index.ts';\n\nexport class HTTPPasswordGrant extends PasswordGrantType implements IHTTPOAuth2Grant {\n    protected authenticator : ICredentialsAuthenticator<User>;\n\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    protected realmRepository : IRealmRepository;\n\n    constructor(ctx: HTTPOAuth2PasswordGrantContext) {\n        super(ctx);\n\n        this.authenticator = ctx.authenticator;\n        this.clientAuthenticator = ctx.clientAuthenticator;\n        this.realmRepository = ctx.realmRepository;\n    }\n\n    async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const body = await readRequestBody(event);\n\n        const username = readStringField(body, 'username');\n        const password = readStringField(body, 'password');\n        if (!username || !password) {\n            throw OAuth2RequestError.malformed('username and password must be provided.');\n        }\n\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n\n        // canonical identifier form: realm names are stored LOWER(TRIM(...))\n        const realmHint = [\n            readStringField(body, 'realm_id'),\n            readStringField(body, 'realm_name'),\n        ]\n            .map((value) => value?.trim().toLowerCase())\n            .find((value) => !!value);\n\n        const realm = await this.realmRepository.resolve(realmHint, true);\n\n        const client = clientId ?\n            await this.clientAuthenticator.authenticate(\n                clientId,\n                clientSecret,\n                realm.id,\n            ) :\n            undefined;\n\n        const user = await this.authenticator.authenticate(username, password, realm.id);\n\n        return this.runWith(\n            { user, client },\n            {\n                ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n                userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n            },\n        );\n    }\n}\n"],"mappings":";;;;;;;;;;;AAkBA,IAAaO,oBAAb,cAAuCH,kBAAAA;CACzBI;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAMA,GAAAA;EAEN,KAAKH,gBAAgBG,IAAIH;EACzB,KAAKC,sBAAsBE,IAAIF;EAC/B,KAAKC,kBAAkBC,IAAID;CAC/B;CAEA,MAAME,eAAeC,OAAqD;EACtE,MAAMC,OAAO,MAAMb,gBAAgBY,KAAAA;EAEnC,MAAME,WAAWT,gBAAgBQ,MAAM,UAAA;EACvC,MAAME,WAAWV,gBAAgBQ,MAAM,UAAA;EACvC,IAAI,CAACC,YAAY,CAACC,UACd,MAAMhB,mBAAmBiB,UAAU,yCAAA;EAGvC,MAAM,EAAEC,UAAUC,iBAAiB,MAAMd,oCAAoCQ,KAAAA;EAG7E,MAAMO,YAAY,CACdd,gBAAgBQ,MAAM,UAAA,GACtBR,gBAAgBQ,MAAM,YAAA,CAAA,CACzB,CACIO,KAAKC,UAAUA,OAAOC,KAAAA,CAAAA,CAAOC,YAAAA,CAAAA,CAAAA,CAC7BC,MAAMH,UAAU,CAAC,CAACA,KAAAA;EAEvB,MAAMI,QAAQ,MAAM,KAAKhB,gBAAgBiB,QAAQP,WAAW,IAAA;EAE5D,MAAMQ,SAASV,WACX,MAAM,KAAKT,oBAAoBoB,aAC3BX,UACAC,cACAO,MAAMI,EAAE,IAEZC,KAAAA;EAEJ,MAAMC,OAAO,MAAM,KAAKxB,cAAcqB,aAAad,UAAUC,UAAUU,MAAMI,EAAE;EAE/E,OAAO,KAAKG,QACR;GAAED;GAAMJ;EAAO,GACf;GACIM,WAAW/B,aAAaU,OAAO,EAAEsB,YAAY,KAAK,CAAA,KAAMJ,KAAAA;GACxDK,WAAWlC,iBAAiBW,OAAO,YAAA,KAAiBkB,KAAAA;EACxD,CAAA;CAER;AACJ"}
+{"version":3,"file":"password.mjs","names":["EventName","EventScope","UserAuthenticatorKind","isEntityCredentialsInvalidError","isEntityInactiveError","OAuth2MfaRequiredError","OAuth2RequestError","OAuth2TokenGrant","readRequestBody","getRequestHeader","getRequestIP","PasswordGrantType","assertClientGrantAllowed","guessUserAuthenticatorKindByResponse","extractClientCredentialsFromRequest","extractOAuth2ClientCertificateEvidence","readRealmHint","readStringField","HTTPPasswordGrant","authenticator","clientAuthenticator","realmRepository","loginThrottleService","userAuthenticatorService","mfaLoginService","logger","certificateSource","ctx","runWithRequest","event","body","username","password","malformed","clientId","clientSecret","realm","resolve","certificateEvidence","client","authenticate","id","undefined","confirmation","resolveTokenBinding","PASSWORD","ipAddress","trustProxy","userAgent","identifier","trim","toLowerCase","assertNotThrottled","realmId","user","e","eventService","record","scope","OAUTH2","name","LOGIN_FAILED","actorType","actorId","actorName","requestIpAddress","requestUserAgent","requestPath","path","requestMethod","method","data","error_code","code","metrics","recordLogin","mfaVerifiedAt","verifySecondFactor","runWith","status","challenge","issueMaterial","required","otp","ticket","issueMfaTicket","kinds","message","mfa_token","token","mfa_token_expires_in","expiresIn","verified","verify","kind","response","Date","toISOString","interactive","includes","EMAIL","WEBAUTHN","issueTicket","warn","error"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/password.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { User } from '@authup/core-kit';\nimport { EventName, EventScope, UserAuthenticatorKind } from '@authup/core-kit';\nimport type { Logger } from '@authup/server-kit';\nimport { isEntityCredentialsInvalidError, isEntityInactiveError } from '@authup/errors';\nimport type { OAuth2TokenConfirmation, OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2MfaRequiredError, OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type {\n    ICredentialsAuthenticator,\n    ILoginThrottleService,\n    IOAuth2MfaLoginService,\n    IRealmRepository,\n    IUserAuthenticatorService,\n    OAuth2ClientAuthenticator,\n} from '../../../../../core/index.ts';\nimport {\n    PasswordGrantType,\n    assertClientGrantAllowed,\n    guessUserAuthenticatorKindByResponse,\n} from '../../../../../core/index.ts';\nimport type { HTTPOAuth2PasswordGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport type { CertificateSource } from '../../../request/index.ts';\nimport {\n    extractClientCredentialsFromRequest,\n    extractOAuth2ClientCertificateEvidence,\n    readRealmHint,\n    readStringField,\n} from './utils/index.ts';\n\nexport class HTTPPasswordGrant extends PasswordGrantType implements IHTTPOAuth2Grant {\n    protected authenticator : ICredentialsAuthenticator<User>;\n\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    protected realmRepository : IRealmRepository;\n\n    protected loginThrottleService? : ILoginThrottleService;\n\n    protected userAuthenticatorService? : IUserAuthenticatorService;\n\n    protected mfaLoginService? : IOAuth2MfaLoginService;\n\n    protected logger? : Logger;\n\n    protected certificateSource: CertificateSource;\n\n    constructor(ctx: HTTPOAuth2PasswordGrantContext) {\n        super(ctx);\n\n        this.authenticator = ctx.authenticator;\n        this.clientAuthenticator = ctx.clientAuthenticator;\n        this.realmRepository = ctx.realmRepository;\n        this.loginThrottleService = ctx.loginThrottleService;\n        this.userAuthenticatorService = ctx.userAuthenticatorService;\n        this.mfaLoginService = ctx.mfaLoginService;\n        this.logger = ctx.logger;\n        this.certificateSource = ctx.certificateSource ?? 'disabled';\n    }\n\n    async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const body = await readRequestBody(event);\n\n        const username = readStringField(body, 'username');\n        const password = readStringField(body, 'password');\n        if (!username || !password) {\n            throw OAuth2RequestError.malformed('username and password must be provided.');\n        }\n\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n\n        const realm = await this.realmRepository.resolve(readRealmHint(body), true);\n        const certificateEvidence = await extractOAuth2ClientCertificateEvidence(event, this.certificateSource);\n\n        const client = clientId ?\n            await this.clientAuthenticator.authenticate(\n                clientId,\n                clientSecret,\n                realm.id,\n                certificateEvidence,\n            ) :\n            undefined;\n\n        const confirmation = client ?\n            this.clientAuthenticator.resolveTokenBinding(client, certificateEvidence) :\n            undefined;\n\n        if (client) {\n            assertClientGrantAllowed(client, OAuth2TokenGrant.PASSWORD);\n        }\n\n        const ipAddress = getRequestIP(event, { trustProxy: true }) ?? undefined;\n        const userAgent = getRequestHeader(event, 'user-agent') ?? undefined;\n\n        // canonical identifier form (layer 3) — the throttle key and the\n        // loginFailed actor_name must match what canonically stored rows carry.\n        const identifier = username.trim().toLowerCase();\n\n        await this.loginThrottleService?.assertNotThrottled({\n            identifier,\n            ipAddress,\n            realmId: realm.id,\n        });\n\n        let user : User;\n        try {\n            user = await this.authenticator.authenticate(username, password, realm.id);\n        } catch (e) {\n            if (isEntityCredentialsInvalidError(e) || isEntityInactiveError(e)) {\n                await this.eventService?.record({\n                    scope: EventScope.OAUTH2,\n                    name: EventName.LOGIN_FAILED,\n                    actorType: null,\n                    actorId: null,\n                    actorName: identifier,\n                    clientId: client?.id ?? null,\n                    realmId: realm.id,\n                    requestIpAddress: ipAddress ?? null,\n                    requestUserAgent: userAgent ?? null,\n                    requestPath: event.path,\n                    requestMethod: event.method,\n                    data: { error_code: e.code },\n                });\n                this.metrics?.recordLogin('failure');\n            }\n\n            throw e;\n        }\n\n        const mfaVerifiedAt = await this.verifySecondFactor(user, body, {\n            ipAddress,\n            userAgent,\n            clientId: client?.id ?? null,\n            confirmation,\n        });\n\n        return this.runWith(\n            {\n                user, \n                client, \n                mfaVerifiedAt, \n            },\n            {\n                confirmation,\n                ipAddress,\n                userAgent,\n            },\n        );\n    }\n\n    /**\n     * MFA gate on the direct password grant: a user holding a confirmed\n     * device must send a valid `otp` form parameter (TOTP or recovery\n     * code, classified by shape) — otherwise `mfa_required`. Users\n     * without a device pass through (they could never enroll otherwise).\n     */\n    protected async verifySecondFactor(\n        user: User,\n        body: Record<string, any>,\n        ctx: {\n            ipAddress?: string, \n            userAgent?: string, \n            clientId: string | null,\n            confirmation?: OAuth2TokenConfirmation,\n        },\n    ): Promise<string | undefined> {\n        if (!this.userAuthenticatorService) {\n            return undefined;\n        }\n\n        // requirement flags + kinds only — no webauthn material on the token path.\n        const status = await this.userAuthenticatorService.challenge(user.id, { issueMaterial: false });\n        if (!status.required) {\n            return undefined;\n        }\n\n        const otp = readStringField(body, 'otp');\n        if (!otp) {\n            // carry the challengeable kinds so a client (the hosted login form)\n            // can tell whether a single-POST factor (totp/recovery) is on offer\n            // or the user must complete an interactive challenge (email/webauthn).\n            // For the interactive kinds an \"MFA-pending\" ticket (issue #3242)\n            // rides along: a restricted mfa_token-kind bearer accepted ONLY by\n            // the challenge routes, backed by a short-lived pending session\n            // (mfa_at: null) — never a usable access/refresh pair.\n            const ticket = await this.issueMfaTicket(user, status.kinds, ctx);\n\n            throw new OAuth2MfaRequiredError({\n                message: 'Complete a second-factor challenge to continue.',\n                data: {\n                    kinds: status.kinds,\n                    ...(ticket ? {\n                        mfa_token: ticket.token,\n                        mfa_token_expires_in: ticket.expiresIn,\n                    } : {}),\n                },\n            });\n        }\n\n        const verified = await this.userAuthenticatorService.verify(\n            user.id,\n            {\n                kind: guessUserAuthenticatorKindByResponse(otp),\n                response: otp,\n            },\n            {\n                ipAddress: ctx.ipAddress ?? null,\n                userAgent: ctx.userAgent ?? null,\n                clientId: ctx.clientId,\n            },\n        );\n        if (!verified) {\n            throw new OAuth2MfaRequiredError({\n                message: 'The provided second factor is not valid.',\n                data: { kinds: status.kinds },\n            });\n        }\n\n        return new Date().toISOString();\n    }\n\n    /**\n     * Issue the MFA-pending ticket for factor kinds that cannot complete\n     * inside the single grant POST (email needs a server-sent code,\n     * WebAuthn an interactive ceremony). TOTP/recovery-only users keep\n     * the inline `otp` fast-path and get no ticket — a pending session\n     * per plain code entry would be pure churn.\n     */\n    protected async issueMfaTicket(\n        user: User,\n        kinds: `${UserAuthenticatorKind}`[],\n        ctx: {\n            ipAddress?: string,\n            userAgent?: string,\n            clientId: string | null,\n            confirmation?: OAuth2TokenConfirmation,\n        },\n    ) : Promise<{ token: string, expiresIn: number } | null> {\n        if (!this.mfaLoginService) {\n            return null;\n        }\n\n        const interactive = kinds.includes(UserAuthenticatorKind.EMAIL) ||\n            kinds.includes(UserAuthenticatorKind.WEBAUTHN);\n        if (!interactive) {\n            return null;\n        }\n\n        try {\n            return await this.mfaLoginService.issueTicket(\n                {\n                    user,\n                    clientId: ctx.clientId,\n                    confirmation: ctx.confirmation,\n                },\n                {\n                    ipAddress: ctx.ipAddress,\n                    userAgent: ctx.userAgent,\n                },\n            );\n        } catch (e) {\n            // degrade to a ticket-less mfa_required rather than letting a\n            // transient issuance failure (pending-session write, cache,\n            // signer) escape as a raw 500 from a controlled response path —\n            // an otp-capable device can still complete, and the credential\n            // retry re-attempts the ticket.\n            this.logger?.warn('Issuing the MFA-pending login ticket failed.', { error: e });\n\n            return null;\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAsCA,IAAakB,oBAAb,cAAuCP,kBAAAA;CACzBQ;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAMA,GAAAA;EAEN,KAAKR,gBAAgBQ,IAAIR;EACzB,KAAKC,sBAAsBO,IAAIP;EAC/B,KAAKC,kBAAkBM,IAAIN;EAC3B,KAAKC,uBAAuBK,IAAIL;EAChC,KAAKC,2BAA2BI,IAAIJ;EACpC,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,SAASE,IAAIF;EAClB,KAAKC,oBAAoBC,IAAID,qBAAqB;CACtD;CAEA,MAAME,eAAeC,OAAqD;EACtE,MAAMC,OAAO,MAAMtB,gBAAgBqB,KAAAA;EAEnC,MAAME,WAAWd,gBAAgBa,MAAM,UAAA;EACvC,MAAME,WAAWf,gBAAgBa,MAAM,UAAA;EACvC,IAAI,CAACC,YAAY,CAACC,UACd,MAAM1B,mBAAmB2B,UAAU,yCAAA;EAGvC,MAAM,EAAEC,UAAUC,iBAAiB,MAAMrB,oCAAoCe,KAAAA;EAE7E,MAAMO,QAAQ,MAAM,KAAKf,gBAAgBgB,QAAQrB,cAAcc,IAAAA,GAAO,IAAA;EACtE,MAAMQ,sBAAsB,MAAMvB,uCAAuCc,OAAO,KAAKH,iBAAiB;EAEtG,MAAMa,SAASL,WACX,MAAM,KAAKd,oBAAoBoB,aAC3BN,UACAC,cACAC,MAAMK,IACNH,mBAAAA,IAEJI,KAAAA;EAEJ,MAAMC,eAAeJ,SACjB,KAAKnB,oBAAoBwB,oBAAoBL,QAAQD,mBAAAA,IACrDI,KAAAA;EAEJ,IAAIH,QACA3B,yBAAyB2B,QAAQhC,iBAAiBsC,QAAQ;EAG9D,MAAMC,YAAYpC,aAAamB,OAAO,EAAEkB,YAAY,KAAK,CAAA,KAAML,KAAAA;EAC/D,MAAMM,YAAYvC,iBAAiBoB,OAAO,YAAA,KAAiBa,KAAAA;EAI3D,MAAMO,aAAalB,SAASmB,KAAI,CAAA,CAAGC,YAAW;EAE9C,MAAM,KAAK7B,sBAAsB8B,mBAAmB;GAChDH;GACAH;GACAO,SAASjB,MAAMK;EACnB,CAAA;EAEA,IAAIa;EACJ,IAAI;GACAA,OAAO,MAAM,KAAKnC,cAAcqB,aAAaT,UAAUC,UAAUI,MAAMK,EAAE;EAC7E,SAASc,GAAG;GACR,IAAIpD,gCAAgCoD,CAAAA,KAAMnD,sBAAsBmD,CAAAA,GAAI;IAChE,MAAM,KAAKC,cAAcC,OAAO;KAC5BC,OAAOzD,WAAW0D;KAClBC,MAAM5D,UAAU6D;KAChBC,WAAW;KACXC,SAAS;KACTC,WAAWf;KACXf,UAAUK,QAAQE,MAAM;KACxBY,SAASjB,MAAMK;KACfwB,kBAAkBnB,aAAa;KAC/BoB,kBAAkBlB,aAAa;KAC/BmB,aAAatC,MAAMuC;KACnBC,eAAexC,MAAMyC;KACrBC,MAAM,EAAEC,YAAYjB,EAAEkB,KAAK;IAC/B,CAAA;IACA,KAAKC,SAASC,YAAY,SAAA;GAC9B;GAEA,MAAMpB;EACV;EAEA,MAAMqB,gBAAgB,MAAM,KAAKC,mBAAmBvB,MAAMxB,MAAM;GAC5DgB;GACAE;GACAd,UAAUK,QAAQE,MAAM;GACxBE;EACJ,CAAA;EAEA,OAAO,KAAKmC,QACR;GACIxB;GACAf;GACAqC;EACJ,GACA;GACIjC;GACAG;GACAE;EACJ,CAAA;CAER;;;;;;IAQA,MAAgB6B,mBACZvB,MACAxB,MACAH,KAM2B;EAC3B,IAAI,CAAC,KAAKJ,0BACN;EAIJ,MAAMwD,SAAS,MAAM,KAAKxD,yBAAyByD,UAAU1B,KAAKb,IAAI,EAAEwC,eAAe,MAAM,CAAA;EAC7F,IAAI,CAACF,OAAOG,UACR;EAGJ,MAAMC,MAAMlE,gBAAgBa,MAAM,KAAA;EAClC,IAAI,CAACqD,KAAK;GAQN,MAAMC,SAAS,MAAM,KAAKC,eAAe/B,MAAMyB,OAAOO,OAAO3D,GAAAA;GAE7D,MAAM,IAAItB,uBAAuB;IAC7BkF,SAAS;IACThB,MAAM;KACFe,OAAOP,OAAOO;KACd,GAAIF,SAAS;MACTI,WAAWJ,OAAOK;MAClBC,sBAAsBN,OAAOO;KACjC,IAAI,CAAC;IACT;GACJ,CAAA;EACJ;EAcA,IAAI,CAACC,MAZkB,KAAKrE,yBAAyBsE,OACjDvC,KAAKb,IACL;GACIqD,MAAMjF,qCAAqCsE,GAAAA;GAC3CY,UAAUZ;EACd,GACA;GACIrC,WAAWnB,IAAImB,aAAa;GAC5BE,WAAWrB,IAAIqB,aAAa;GAC5Bd,UAAUP,IAAIO;EAClB,CAAA,GAGA,MAAM,IAAI7B,uBAAuB;GAC7BkF,SAAS;GACThB,MAAM,EAAEe,OAAOP,OAAOO,MAAM;EAChC,CAAA;EAGJ,wBAAO,IAAIU,KAAAA,EAAAA,CAAOC,YAAW;CACjC;;;;;;;IASA,MAAgBZ,eACZ/B,MACAgC,OACA3D,KAMqD;EACrD,IAAI,CAAC,KAAKH,iBACN,OAAO;EAKX,IAAI,EAFgB8D,MAAMa,SAASjG,sBAAsBkG,KAAK,KAC1Dd,MAAMa,SAASjG,sBAAsBmG,QAAQ,IAE7C,OAAO;EAGX,IAAI;GACA,OAAO,MAAM,KAAK7E,gBAAgB8E,YAC9B;IACIhD;IACApB,UAAUP,IAAIO;IACdS,cAAchB,IAAIgB;GACtB,GACA;IACIG,WAAWnB,IAAImB;IACfE,WAAWrB,IAAIqB;GACnB,CAAA;EAER,SAASO,GAAG;GAMR,KAAK9B,QAAQ8E,KAAK,gDAAgD,EAAEC,OAAOjD,EAAE,CAAA;GAE7E,OAAO;EACX;CACJ;AACJ"}

package/dist/adapters/http/adapters/oauth2/grant-types/refresh_token.d.ts

@@ -1,11 +1,14 @@
 import type { OAuth2TokenGrantResponse } from '@authup/specs';
 import type { IAppEvent } from 'routup';
 import { OAuth2RefreshTokenGrant } from '../../../../../core/index.ts';
-import type { IOAuth2TokenVerifier, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';
+import type { IOAuth2TokenVerifier, IRealmRepository, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';
 import type { HTTPOAuth2RefreshTokenGrantContext, IHTTPOAuth2Grant } from './types.ts';
+import type { CertificateSource } from '../../../request/index.ts';
 export declare class HTTPOAuth2RefreshTokenGrant extends OAuth2RefreshTokenGrant implements IHTTPOAuth2Grant {
     protected clientAuthenticator: OAuth2ClientAuthenticator;
     protected refreshTokenVerifier: IOAuth2TokenVerifier;
+    protected realmRepository: IRealmRepository;
+    protected certificateSource: CertificateSource;
     constructor(ctx: HTTPOAuth2RefreshTokenGrantContext);
     runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse>;
 }

package/dist/adapters/http/adapters/oauth2/grant-types/refresh_token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refresh_token.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/refresh_token.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAG9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,KAAK,EACR,oBAAoB,EACpB,yBAAyB,EAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,kCAAkC,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAGvF,qBAAa,2BAA4B,SAAQ,uBAAwB,YAAW,gBAAgB;IAChG,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;IAE1D,SAAS,CAAC,oBAAoB,EAAG,oBAAoB,CAAC;gBAE1C,GAAG,EAAE,kCAAkC;IAO7C,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAqC5E"}
+{"version":3,"file":"refresh_token.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/refresh_token.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAA2B,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAGvF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,EAAE,uBAAuB,EAA4B,MAAM,8BAA8B,CAAC;AACjG,OAAO,KAAK,EACR,oBAAoB,EACpB,gBAAgB,EAChB,yBAAyB,EAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,kCAAkC,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACvF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAOnE,qBAAa,2BAA4B,SAAQ,uBAAwB,YAAW,gBAAgB;IAChG,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;IAE1D,SAAS,CAAC,oBAAoB,EAAG,oBAAoB,CAAC;IAEtD,SAAS,CAAC,eAAe,EAAG,gBAAgB,CAAC;IAE7C,SAAS,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;gBAEnC,GAAG,EAAE,kCAAkC;IAS7C,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAqG5E"}

package/dist/adapters/http/adapters/oauth2/grant-types/refresh_token.mjs

@@ -1,34 +1,54 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { assertClientGrantAllowed } from "../../../../../core/oauth2/client/grant-type.mjs";
 import { OAuth2RefreshTokenGrant } from "../../../../../core/oauth2/grant-types/refresh-token.mjs";
 import "../../../../../core/index.mjs";
+import { extractOAuth2ClientCertificateEvidence } from "./utils/certificate.mjs";
 import { extractClientCredentialsFromRequest } from "./utils/credentials.mjs";
+import { readRealmHint } from "./utils/realm.mjs";
 import "./utils/index.mjs";
-import { OAuth2ClientError, OAuth2GrantError, OAuth2RequestError } from "@authup/specs";
+import { isClientPublic } from "@authup/core-kit";
+import { OAuth2GrantError, OAuth2RequestError, OAuth2TokenGrant } from "@authup/specs";
 import { getRequestHeader, getRequestIP } from "routup";
 import { readRequestBody } from "@routup/basic/body";
 //#region src/adapters/http/adapters/oauth2/grant-types/refresh_token.ts
 var HTTPOAuth2RefreshTokenGrant = class extends OAuth2RefreshTokenGrant {
 	clientAuthenticator;
 	refreshTokenVerifier;
+	realmRepository;
+	certificateSource;
 	constructor(ctx) {
 		super(ctx);
 		this.clientAuthenticator = ctx.clientAuthenticator;
 		this.refreshTokenVerifier = ctx.tokenVerifier;
+		this.realmRepository = ctx.realmRepository;
+		this.certificateSource = ctx.certificateSource ?? "disabled";
 	}
 	async runWithRequest(event) {
 		const body = await readRequestBody(event);
 		const refreshToken = body?.refresh_token;
 		if (typeof refreshToken !== "string" || refreshToken.length === 0) throw OAuth2RequestError.malformed();
 		const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);
-		const realmId = body?.realm_id;
-		const payload = await this.refreshTokenVerifier.verify(refreshToken);
+		const certificateEvidence = await extractOAuth2ClientCertificateEvidence(event, this.certificateSource);
+		const payload = await this.refreshTokenVerifier.verify(refreshToken, { skipActiveCheck: true });
+		let client;
 		if (clientId) {
-			const client = await this.clientAuthenticator.authenticate(clientId, clientSecret, typeof realmId === "string" ? realmId : void 0);
+			const realm = await this.realmRepository.resolve(readRealmHint(body), true);
+			client = await this.clientAuthenticator.authenticate(clientId, clientSecret, realm.id, certificateEvidence);
 			if (payload.client_id && payload.client_id !== client.id) throw OAuth2GrantError.invalid();
-		} else if (payload.client_id) throw OAuth2ClientError.invalid();
+		} else if (payload.client_id) client = await this.clientAuthenticator.authenticate(payload.client_id, void 0, void 0, certificateEvidence);
+		if (client) assertClientGrantAllowed(client, OAuth2TokenGrant.REFRESH_TOKEN);
+		let confirmation;
+		if (payload.cnf) {
+			const expectedThumbprint = payload.cnf["x5t#S256"];
+			if (typeof expectedThumbprint !== "string" || expectedThumbprint.length === 0) throw OAuth2GrantError.invalid();
+			confirmation = this.clientAuthenticator.validateCertificateEvidenceForBinding(certificateEvidence);
+			if (confirmation["x5t#S256"] !== expectedThumbprint) throw OAuth2GrantError.invalid();
+		} else if (client) confirmation = this.clientAuthenticator.resolveTokenBinding(client, certificateEvidence);
+		if (client && isClientPublic(client) && payload.realm_id && payload.realm_id !== client.realm_id) throw OAuth2GrantError.invalid();
 		return this.runWith(payload, {
+			confirmation,
 			ipAddress: getRequestIP(event, { trustProxy: true }) ?? void 0,
 			userAgent: getRequestHeader(event, "user-agent") ?? void 0
 		});

package/dist/adapters/http/adapters/oauth2/grant-types/refresh_token.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"refresh_token.mjs","names":["OAuth2ClientError","OAuth2GrantError","OAuth2RequestError","readRequestBody","getRequestHeader","getRequestIP","OAuth2RefreshTokenGrant","extractClientCredentialsFromRequest","HTTPOAuth2RefreshTokenGrant","clientAuthenticator","refreshTokenVerifier","ctx","tokenVerifier","runWithRequest","event","body","refreshToken","refresh_token","length","malformed","clientId","clientSecret","realmId","realm_id","payload","verify","client","authenticate","undefined","client_id","id","invalid","runWith","ipAddress","trustProxy","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/refresh_token.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2ClientError, OAuth2GrantError, OAuth2RequestError } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport { OAuth2RefreshTokenGrant } from '../../../../../core/index.ts';\nimport type {\n    IOAuth2TokenVerifier,\n    OAuth2ClientAuthenticator,\n} from '../../../../../core/index.ts';\nimport type { HTTPOAuth2RefreshTokenGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport { extractClientCredentialsFromRequest } from './utils/index.ts';\n\nexport class HTTPOAuth2RefreshTokenGrant extends OAuth2RefreshTokenGrant implements IHTTPOAuth2Grant {\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    protected refreshTokenVerifier : IOAuth2TokenVerifier;\n\n    constructor(ctx: HTTPOAuth2RefreshTokenGrantContext) {\n        super(ctx);\n\n        this.clientAuthenticator = ctx.clientAuthenticator;\n        this.refreshTokenVerifier = ctx.tokenVerifier;\n    }\n\n    async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const body = await readRequestBody(event);\n        const refreshToken = body?.refresh_token;\n        if (typeof refreshToken !== 'string' || refreshToken.length === 0) {\n            throw OAuth2RequestError.malformed();\n        }\n\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n        const realmId = body?.realm_id;\n\n        // RFC 6749 §6: verify the refresh token first to learn its bound\n        // client (if any), then enforce binding. Authenticate the requesting\n        // client when credentials are present, or when the token requires\n        // a client binding.\n        const payload = await this.refreshTokenVerifier.verify(refreshToken);\n\n        if (clientId) {\n            const client = await this.clientAuthenticator.authenticate(\n                clientId,\n                clientSecret,\n                typeof realmId === 'string' ? realmId : undefined,\n            );\n\n            if (payload.client_id && payload.client_id !== client.id) {\n                throw OAuth2GrantError.invalid();\n            }\n        } else if (payload.client_id) {\n            // Token was issued to a specific client — that client MUST\n            // re-authenticate (RFC 6749 §6 binding requirement).\n            throw OAuth2ClientError.invalid();\n        }\n\n        return this.runWith(payload, {\n            ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;AAoBA,IAAaQ,8BAAb,cAAiDF,wBAAAA;CACnCG;CAEAC;CAEV,YAAYC,KAAyC;EACjD,MAAMA,GAAAA;EAEN,KAAKF,sBAAsBE,IAAIF;EAC/B,KAAKC,uBAAuBC,IAAIC;CACpC;CAEA,MAAMC,eAAeC,OAAqD;EACtE,MAAMC,OAAO,MAAMZ,gBAAgBW,KAAAA;EACnC,MAAME,eAAeD,MAAME;EAC3B,IAAI,OAAOD,iBAAiB,YAAYA,aAAaE,WAAW,GAC5D,MAAMhB,mBAAmBiB,UAAS;EAGtC,MAAM,EAAEC,UAAUC,iBAAiB,MAAMd,oCAAoCO,KAAAA;EAC7E,MAAMQ,UAAUP,MAAMQ;EAMtB,MAAMC,UAAU,MAAM,KAAKd,qBAAqBe,OAAOT,YAAAA;EAEvD,IAAII,UAAU;GACV,MAAMM,SAAS,MAAM,KAAKjB,oBAAoBkB,aAC1CP,UACAC,cACA,OAAOC,YAAY,WAAWA,UAAUM,KAAAA,CAAAA;GAG5C,IAAIJ,QAAQK,aAAaL,QAAQK,cAAcH,OAAOI,IAClD,MAAM7B,iBAAiB8B,QAAO;EAEtC,OAAO,IAAIP,QAAQK,WAGf,MAAM7B,kBAAkB+B,QAAO;EAGnC,OAAO,KAAKC,QAAQR,SAAS;GACzBS,WAAW5B,aAAaS,OAAO,EAAEoB,YAAY,KAAK,CAAA,KAAMN,KAAAA;GACxDO,WAAW/B,iBAAiBU,OAAO,YAAA,KAAiBc,KAAAA;EACxD,CAAA;CACJ;AACJ"}
+{"version":3,"file":"refresh_token.mjs","names":["isClientPublic","OAuth2GrantError","OAuth2RequestError","OAuth2TokenGrant","readRequestBody","getRequestHeader","getRequestIP","OAuth2RefreshTokenGrant","assertClientGrantAllowed","extractClientCredentialsFromRequest","extractOAuth2ClientCertificateEvidence","readRealmHint","HTTPOAuth2RefreshTokenGrant","clientAuthenticator","refreshTokenVerifier","realmRepository","certificateSource","ctx","tokenVerifier","runWithRequest","event","body","refreshToken","refresh_token","length","malformed","clientId","clientSecret","certificateEvidence","payload","verify","skipActiveCheck","client","realm","resolve","authenticate","id","client_id","invalid","undefined","REFRESH_TOKEN","confirmation","cnf","expectedThumbprint","validateCertificateEvidenceForBinding","resolveTokenBinding","realm_id","runWith","ipAddress","trustProxy","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/refresh_token.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { type Client, isClientPublic } from '@authup/core-kit';\nimport type { OAuth2TokenConfirmation, OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2GrantError, OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport { OAuth2RefreshTokenGrant, assertClientGrantAllowed } from '../../../../../core/index.ts';\nimport type {\n    IOAuth2TokenVerifier,\n    IRealmRepository,\n    OAuth2ClientAuthenticator,\n} from '../../../../../core/index.ts';\nimport type { HTTPOAuth2RefreshTokenGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport type { CertificateSource } from '../../../request/index.ts';\nimport {\n    extractClientCredentialsFromRequest,\n    extractOAuth2ClientCertificateEvidence,\n    readRealmHint,\n} from './utils/index.ts';\n\nexport class HTTPOAuth2RefreshTokenGrant extends OAuth2RefreshTokenGrant implements IHTTPOAuth2Grant {\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    protected refreshTokenVerifier : IOAuth2TokenVerifier;\n\n    protected realmRepository : IRealmRepository;\n\n    protected certificateSource: CertificateSource;\n\n    constructor(ctx: HTTPOAuth2RefreshTokenGrantContext) {\n        super(ctx);\n\n        this.clientAuthenticator = ctx.clientAuthenticator;\n        this.refreshTokenVerifier = ctx.tokenVerifier;\n        this.realmRepository = ctx.realmRepository;\n        this.certificateSource = ctx.certificateSource ?? 'disabled';\n    }\n\n    async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const body = await readRequestBody(event);\n        const refreshToken = body?.refresh_token;\n        if (typeof refreshToken !== 'string' || refreshToken.length === 0) {\n            throw OAuth2RequestError.malformed();\n        }\n\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n        const certificateEvidence = await extractOAuth2ClientCertificateEvidence(event, this.certificateSource);\n\n        // RFC 6749 §6: verify the refresh token first to learn its bound\n        // client (if any), then enforce binding. Authenticate the requesting\n        // client when credentials are present, or when the token requires\n        // a client binding.\n        //\n        // skipActiveCheck: the durable auth_session_tokens row (not the cache\n        // blocklist) is the refresh-token authority, so a replayed/consumed\n        // token must reach runWith() to trigger family revocation instead of\n        // being rejected here with JWT_INACTIVE.\n        const payload = await this.refreshTokenVerifier.verify(refreshToken, { skipActiveCheck: true });\n\n        let client: Client | undefined;\n\n        if (clientId) {\n            // A client authenticated itself. Resolve by the presented\n            // id/secret (name resolution scoped by the realm hint — resolved\n            // lazily so a bare refresh skips the SELECT) and enforce the\n            // token↔client binding.\n            const realm = await this.realmRepository.resolve(readRealmHint(body), true);\n\n            client = await this.clientAuthenticator.authenticate(\n                clientId,\n                clientSecret,\n                realm.id,\n                certificateEvidence,\n            );\n\n            if (payload.client_id && payload.client_id !== client.id) {\n                throw OAuth2GrantError.invalid();\n            }\n        } else if (payload.client_id) {\n            // No client credentials were presented, but the token is bound to\n            // a client. RFC 6749 §10.4: a public client cannot authenticate\n            // (no secret) and is not required to — the bound identity is read\n            // from the signed token (client_id is server-minted, so trusted)\n            // and refresh-token rotation/replay detection is the abuse control.\n            // A client with an authentication method MUST still authenticate.\n            // Supplying the server-minted client id lets TLS clients prove\n            // themselves with the request certificate, while a secret client\n            // still fails because its secret is absent.\n            client = await this.clientAuthenticator.authenticate(\n                payload.client_id,\n                undefined,\n                undefined,\n                certificateEvidence,\n            );\n        }\n\n        if (client) {\n            assertClientGrantAllowed(client, OAuth2TokenGrant.REFRESH_TOKEN);\n        }\n\n        let confirmation: OAuth2TokenConfirmation | undefined;\n        if (payload.cnf) {\n            const expectedThumbprint = payload.cnf['x5t#S256'];\n            if (typeof expectedThumbprint !== 'string' || expectedThumbprint.length === 0) {\n                throw OAuth2GrantError.invalid();\n            }\n\n            confirmation = this.clientAuthenticator.validateCertificateEvidenceForBinding(\n                certificateEvidence,\n            );\n            if (confirmation['x5t#S256'] !== expectedThumbprint) {\n                throw OAuth2GrantError.invalid();\n            }\n        } else if (client) {\n            confirmation = this.clientAuthenticator.resolveTokenBinding(client, certificateEvidence);\n        }\n\n        // Realm parity for PUBLIC clients only: a public client may not refresh\n        // a token whose realm differs from the (bound) client's own realm.\n        // Kills cross-realm refresh tokens minted for a public `web` client\n        // before the authorize-side realm gate existed. Authenticated clients\n        // are exempt — the configured secret/certificate proves identity, and the\n        // documented cross-realm password grant (UUID-identified user against a\n        // master-realm client) depends on that exemption.\n        if (\n            client &&\n            isClientPublic(client) &&\n            payload.realm_id &&\n            payload.realm_id !== client.realm_id\n        ) {\n            throw OAuth2GrantError.invalid();\n        }\n\n        return this.runWith(payload, {\n            confirmation,\n            ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;AA2BA,IAAaY,8BAAb,cAAiDL,wBAAAA;CACnCM;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAyC;EACjD,MAAMA,GAAAA;EAEN,KAAKJ,sBAAsBI,IAAIJ;EAC/B,KAAKC,uBAAuBG,IAAIC;EAChC,KAAKH,kBAAkBE,IAAIF;EAC3B,KAAKC,oBAAoBC,IAAID,qBAAqB;CACtD;CAEA,MAAMG,eAAeC,OAAqD;EACtE,MAAMC,OAAO,MAAMjB,gBAAgBgB,KAAAA;EACnC,MAAME,eAAeD,MAAME;EAC3B,IAAI,OAAOD,iBAAiB,YAAYA,aAAaE,WAAW,GAC5D,MAAMtB,mBAAmBuB,UAAS;EAGtC,MAAM,EAAEC,UAAUC,iBAAiB,MAAMlB,oCAAoCW,KAAAA;EAC7E,MAAMQ,sBAAsB,MAAMlB,uCAAuCU,OAAO,KAAKJ,iBAAiB;EAWtG,MAAMa,UAAU,MAAM,KAAKf,qBAAqBgB,OAAOR,cAAc,EAAES,iBAAiB,KAAK,CAAA;EAE7F,IAAIC;EAEJ,IAAIN,UAAU;GAKV,MAAMO,QAAQ,MAAM,KAAKlB,gBAAgBmB,QAAQvB,cAAcU,IAAAA,GAAO,IAAA;GAEtEW,SAAS,MAAM,KAAKnB,oBAAoBsB,aACpCT,UACAC,cACAM,MAAMG,IACNR,mBAAAA;GAGJ,IAAIC,QAAQQ,aAAaR,QAAQQ,cAAcL,OAAOI,IAClD,MAAMnC,iBAAiBqC,QAAO;EAEtC,OAAO,IAAIT,QAAQQ,WAUfL,SAAS,MAAM,KAAKnB,oBAAoBsB,aACpCN,QAAQQ,WACRE,KAAAA,GACAA,KAAAA,GACAX,mBAAAA;EAIR,IAAII,QACAxB,yBAAyBwB,QAAQ7B,iBAAiBqC,aAAa;EAGnE,IAAIC;EACJ,IAAIZ,QAAQa,KAAK;GACb,MAAMC,qBAAqBd,QAAQa,IAAI;GACvC,IAAI,OAAOC,uBAAuB,YAAYA,mBAAmBnB,WAAW,GACxE,MAAMvB,iBAAiBqC,QAAO;GAGlCG,eAAe,KAAK5B,oBAAoB+B,sCACpChB,mBAAAA;GAEJ,IAAIa,aAAa,gBAAgBE,oBAC7B,MAAM1C,iBAAiBqC,QAAO;EAEtC,OAAO,IAAIN,QACPS,eAAe,KAAK5B,oBAAoBgC,oBAAoBb,QAAQJ,mBAAAA;EAUxE,IACII,UACAhC,eAAegC,MAAAA,KACfH,QAAQiB,YACRjB,QAAQiB,aAAad,OAAOc,UAE5B,MAAM7C,iBAAiBqC,QAAO;EAGlC,OAAO,KAAKS,QAAQlB,SAAS;GACzBY;GACAO,WAAW1C,aAAac,OAAO,EAAE6B,YAAY,KAAK,CAAA,KAAMV,KAAAA;GACxDW,WAAW7C,iBAAiBe,OAAO,YAAA,KAAiBmB,KAAAA;EACxD,CAAA;CACJ;AACJ"}

package/dist/adapters/http/adapters/oauth2/grant-types/types.d.ts

@@ -1,10 +1,15 @@
-import type { Client, Robot, User } from '@authup/core-kit';
+import type { Robot, User } from '@authup/core-kit';
+import type { Logger } from '@authup/server-kit';
 import type { OAuth2TokenGrantResponse } from '@authup/specs';
 import type { IAppEvent } from 'routup';
-import type { BaseGrantContext, ICredentialsAuthenticator, IOAuth2AuthorizationCodeVerifier, IRealmRepository, OAuth2AuthorizeGrantContext, OAuth2ClientAuthenticator, OAuth2PasswordGrantContext, OAuth2RefreshTokenGrantContext } from '../../../../../core/index.ts';
+import type { BaseGrantContext, ICredentialsAuthenticator, ILoginThrottleService, IOAuth2AccessPolicyEvaluator, IOAuth2AuthorizationCodeVerifier, IOAuth2MfaLoginService, IRealmRepository, IUserAuthenticatorService, OAuth2AuthorizeGrantContext, OAuth2ClientAuthenticator, OAuth2PasswordGrantContext, OAuth2RefreshTokenGrantContext } from '../../../../../core/index.ts';
+import type { CertificateSource } from '../../../request/index.ts';
 export type HTTPOAuth2AuthorizeGrantContext = OAuth2AuthorizeGrantContext & {
     codeVerifier: IOAuth2AuthorizationCodeVerifier;
     clientAuthenticator: OAuth2ClientAuthenticator;
+    realmRepository: IRealmRepository;
+    accessPolicyEvaluator?: IOAuth2AccessPolicyEvaluator;
+    certificateSource: CertificateSource;
 };
 export interface IHTTPOAuth2Grant {
     runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse>;
@@ -13,12 +18,20 @@ export type HTTPOAuth2PasswordGrantContext = OAuth2PasswordGrantContext & {
     authenticator: ICredentialsAuthenticator<User>;
     clientAuthenticator: OAuth2ClientAuthenticator;
     realmRepository: IRealmRepository;
+    loginThrottleService?: ILoginThrottleService;
+    userAuthenticatorService?: IUserAuthenticatorService;
+    mfaLoginService?: IOAuth2MfaLoginService;
+    logger?: Logger;
+    certificateSource: CertificateSource;
 };
 export type HTTPOAuth2RefreshTokenGrantContext = OAuth2RefreshTokenGrantContext & {
     clientAuthenticator: OAuth2ClientAuthenticator;
+    realmRepository: IRealmRepository;
+    certificateSource: CertificateSource;
 };
 export type HTTPOAuth2ClientCredentialsGrantContext = BaseGrantContext & {
-    authenticator: ICredentialsAuthenticator<Client>;
+    clientAuthenticator: OAuth2ClientAuthenticator;
+    certificateSource: CertificateSource;
 };
 export type HTTPOAuth2RobotCredentialsGrantContext = BaseGrantContext & {
     authenticator: ICredentialsAuthenticator<Robot>;

package/dist/adapters/http/adapters/oauth2/grant-types/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EACR,gBAAgB,EAChB,yBAAyB,EACzB,gCAAgC,EAChC,gBAAgB,EAChB,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,8BAA8B,EACjC,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,+BAA+B,GAAG,2BAA2B,GAAG;IACxE,YAAY,EAAE,gCAAgC,CAAC;IAC/C,mBAAmB,EAAE,yBAAyB,CAAC;CAClD,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC7B,cAAc,CAAC,KAAK,EAAE,SAAS,GAAI,OAAO,CAAC,wBAAwB,CAAC,CAAA;CACvE;AAED,MAAM,MAAM,8BAA8B,GAAG,0BAA0B,GAAG;IACtE,aAAa,EAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAChD,mBAAmB,EAAE,yBAAyB,CAAC;IAC/C,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,kCAAkC,GAAG,8BAA8B,GAAG;IAC9E,mBAAmB,EAAE,yBAAyB,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,uCAAuC,GAAG,gBAAgB,GAAG;IACrE,aAAa,EAAG,yBAAyB,CAAC,MAAM,CAAC,CAAA;CACpD,CAAC;AAEF,MAAM,MAAM,sCAAsC,GAAG,gBAAgB,GAAG;IACpE,aAAa,EAAG,yBAAyB,CAAC,KAAK,CAAC,CAAA;CACnD,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EACR,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,EACrB,4BAA4B,EAC5B,gCAAgC,EAChC,sBAAsB,EACtB,gBAAgB,EAChB,yBAAyB,EACzB,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,8BAA8B,EACjC,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,MAAM,MAAM,+BAA+B,GAAG,2BAA2B,GAAG;IACxE,YAAY,EAAE,gCAAgC,CAAC;IAC/C,mBAAmB,EAAE,yBAAyB,CAAC;IAC/C,eAAe,EAAE,gBAAgB,CAAC;IAClC,qBAAqB,CAAC,EAAE,4BAA4B,CAAC;IACrD,iBAAiB,EAAE,iBAAiB,CAAC;CACxC,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC7B,cAAc,CAAC,KAAK,EAAE,SAAS,GAAI,OAAO,CAAC,wBAAwB,CAAC,CAAA;CACvE;AAED,MAAM,MAAM,8BAA8B,GAAG,0BAA0B,GAAG;IACtE,aAAa,EAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAChD,mBAAmB,EAAE,yBAAyB,CAAC;IAC/C,eAAe,EAAE,gBAAgB,CAAC;IAClC,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAC7C,wBAAwB,CAAC,EAAE,yBAAyB,CAAC;IACrD,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,iBAAiB,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,kCAAkC,GAAG,8BAA8B,GAAG;IAC9E,mBAAmB,EAAE,yBAAyB,CAAC;IAC/C,eAAe,EAAE,gBAAgB,CAAC;IAClC,iBAAiB,EAAE,iBAAiB,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,uCAAuC,GAAG,gBAAgB,GAAG;IACrE,mBAAmB,EAAE,yBAAyB,CAAC;IAC/C,iBAAiB,EAAE,iBAAiB,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,sCAAsC,GAAG,gBAAgB,GAAG;IACpE,aAAa,EAAG,yBAAyB,CAAC,KAAK,CAAC,CAAA;CACnD,CAAC"}

package/dist/adapters/http/adapters/oauth2/grant-types/utils/certificate.d.ts

@@ -0,0 +1,5 @@
+import type { IAppEvent } from 'routup';
+import type { ClientCertificateEvidence } from '../../../../../../core/index.ts';
+import { type CertificateSource } from '../../../../request/index.ts';
+export declare function extractOAuth2ClientCertificateEvidence(event: IAppEvent, source: CertificateSource): Promise<ClientCertificateEvidence | undefined>;
+//# sourceMappingURL=certificate.d.ts.map

package/dist/adapters/http/adapters/oauth2/grant-types/utils/certificate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"certificate.d.ts","sourceRoot":"","sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/certificate.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AACjF,OAAO,EACH,KAAK,iBAAiB,EAEzB,MAAM,8BAA8B,CAAC;AAEtC,wBAAsB,sCAAsC,CACxD,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,iBAAiB,GAC1B,OAAO,CAAC,yBAAyB,GAAG,SAAS,CAAC,CAMhD"}

package/dist/adapters/http/adapters/oauth2/grant-types/utils/certificate.mjs

@@ -0,0 +1,18 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { extractClientCertificateEvidence } from "../../../../request/client-certificate.mjs";
+import "../../../../request/index.mjs";
+import { OAuth2ClientError } from "@authup/specs";
+//#region src/adapters/http/adapters/oauth2/grant-types/utils/certificate.ts
+async function extractOAuth2ClientCertificateEvidence(event, source) {
+	try {
+		return await extractClientCertificateEvidence(event, source);
+	} catch {
+		throw OAuth2ClientError.invalid();
+	}
+}
+//#endregion
+export { extractOAuth2ClientCertificateEvidence };
+
+//# sourceMappingURL=certificate.mjs.map

package/dist/adapters/http/adapters/oauth2/grant-types/utils/certificate.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"certificate.mjs","names":["OAuth2ClientError","extractClientCertificateEvidence","extractOAuth2ClientCertificateEvidence","event","source","invalid"],"sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/certificate.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { OAuth2ClientError } from '@authup/specs';\nimport type { IAppEvent } from 'routup';\nimport type { ClientCertificateEvidence } from '../../../../../../core/index.ts';\nimport {\n    type CertificateSource,\n    extractClientCertificateEvidence,\n} from '../../../../request/index.ts';\n\nexport async function extractOAuth2ClientCertificateEvidence(\n    event: IAppEvent,\n    source: CertificateSource,\n): Promise<ClientCertificateEvidence | undefined> {\n    try {\n        return await extractClientCertificateEvidence(event, source);\n    } catch {\n        throw OAuth2ClientError.invalid();\n    }\n}\n"],"mappings":";;;;;;;AAeA,eAAsBE,uCAClBC,OACAC,QAAyB;CAEzB,IAAI;EACA,OAAO,MAAMH,iCAAiCE,OAAOC,MAAAA;CACzD,QAAQ;EACJ,MAAMJ,kBAAkBK,QAAO;CACnC;AACJ"}

package/dist/adapters/http/adapters/oauth2/grant-types/utils/index.d.ts

@@ -1,3 +1,5 @@
+export * from './certificate.ts';
 export * from './credentials.ts';
 export * from './guess.ts';
+export * from './realm.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/adapters/oauth2/grant-types/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/index.ts"],"names":[],"mappings":"AAOA,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/index.ts"],"names":[],"mappings":"AAOA,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC"}

package/dist/adapters/http/adapters/oauth2/grant-types/utils/index.mjs

@@ -1,6 +1,8 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { extractOAuth2ClientCertificateEvidence } from "./certificate.mjs";
 import { extractClientCredentialsFromRequest, readStringField } from "./credentials.mjs";
 import { guessOauth2GrantTypeByRequest } from "./guess.mjs";
-export { extractClientCredentialsFromRequest, guessOauth2GrantTypeByRequest, readStringField };
+import { readRealmHint } from "./realm.mjs";
+export { extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, guessOauth2GrantTypeByRequest, readRealmHint, readStringField };

package/dist/adapters/http/adapters/oauth2/grant-types/utils/realm.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Read the realm hint (`realm_id` ?? `realm_name`) from the given request
+ * sources (checked in order). Both fields denote the same realm key and each
+ * accepts a realm UUID or name. Values are canonicalized at the ingress
+ * (`trim().toLowerCase()`, canonical identifier form layer 3) since no
+ * validator runs on the token body.
+ */
+export declare function readRealmHint(...sources: (Record<string, any> | undefined)[]): string | undefined;
+//# sourceMappingURL=realm.d.ts.map

package/dist/adapters/http/adapters/oauth2/grant-types/utils/realm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"realm.d.ts","sourceRoot":"","sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/realm.ts"],"names":[],"mappings":"AASA;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,GAAG,OAAO,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC,EAAE,GAAG,MAAM,GAAG,SAAS,CAejG"}

package/dist/adapters/http/adapters/oauth2/grant-types/utils/realm.mjs

@@ -0,0 +1,21 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { readStringField } from "./credentials.mjs";
+//#region src/adapters/http/adapters/oauth2/grant-types/utils/realm.ts
+/**
+* Read the realm hint (`realm_id` ?? `realm_name`) from the given request
+* sources (checked in order). Both fields denote the same realm key and each
+* accepts a realm UUID or name. Values are canonicalized at the ingress
+* (`trim().toLowerCase()`, canonical identifier form layer 3) since no
+* validator runs on the token body.
+*/ function readRealmHint(...sources) {
+	for (const source of sources) {
+		const hint = [readStringField(source, "realm_id"), readStringField(source, "realm_name")].map((value) => value?.trim().toLowerCase()).find((value) => !!value);
+		if (hint) return hint;
+	}
+}
+//#endregion
+export { readRealmHint };
+
+//# sourceMappingURL=realm.mjs.map

package/dist/adapters/http/adapters/oauth2/grant-types/utils/realm.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"realm.mjs","names":["readStringField","readRealmHint","sources","source","hint","map","value","trim","toLowerCase","find","undefined"],"sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/realm.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { readStringField } from './credentials.ts';\n\n/**\n * Read the realm hint (`realm_id` ?? `realm_name`) from the given request\n * sources (checked in order). Both fields denote the same realm key and each\n * accepts a realm UUID or name. Values are canonicalized at the ingress\n * (`trim().toLowerCase()`, canonical identifier form layer 3) since no\n * validator runs on the token body.\n */\nexport function readRealmHint(...sources: (Record<string, any> | undefined)[]): string | undefined {\n    for (const source of sources) {\n        const hint = [\n            readStringField(source, 'realm_id'),\n            readStringField(source, 'realm_name'),\n        ]\n            .map((value) => value?.trim().toLowerCase())\n            .find((value) => !!value);\n\n        if (hint) {\n            return hint;\n        }\n    }\n\n    return undefined;\n}\n"],"mappings":";;;;;;;;;;;GAgBA,SAAgBC,cAAc,GAAGC,SAA4C;CACzE,KAAK,MAAMC,UAAUD,SAAS;EAC1B,MAAME,OAAO,CACTJ,gBAAgBG,QAAQ,UAAA,GACxBH,gBAAgBG,QAAQ,YAAA,CAAA,CAC3B,CACIE,KAAKC,UAAUA,OAAOC,KAAAA,CAAAA,CAAOC,YAAAA,CAAAA,CAAAA,CAC7BC,MAAMH,UAAU,CAAC,CAACA,KAAAA;EAEvB,IAAIF,MACA,OAAOA;CAEf;AAGJ"}

package/dist/adapters/http/adapters/oauth2/index.mjs

@@ -3,8 +3,10 @@ import "node:url";
 import.meta.url;
 import { HTTPOAuth2Authorizer } from "./authorization/module.mjs";
 import "./authorization/index.mjs";
+import { extractOAuth2ClientCertificateEvidence } from "./grant-types/utils/certificate.mjs";
 import { extractClientCredentialsFromRequest, readStringField } from "./grant-types/utils/credentials.mjs";
 import { guessOauth2GrantTypeByRequest } from "./grant-types/utils/guess.mjs";
+import { readRealmHint } from "./grant-types/utils/realm.mjs";
 import { HTTPOAuth2AuthorizeGrant } from "./grant-types/authorize.mjs";
 import { HTTPClientCredentialsGrant } from "./grant-types/client-credentials.mjs";
 import { HTTPOAuth2IdentityGrantType } from "./grant-types/identity.mjs";
@@ -12,4 +14,4 @@ import { HTTPPasswordGrant } from "./grant-types/password.mjs";
 import { HTTPOAuth2RefreshTokenGrant } from "./grant-types/refresh_token.mjs";
 import { HTTPRobotCredentialsGrant } from "./grant-types/robot-credentials.mjs";
 import "./grant-types/index.mjs";
-export { HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, extractClientCredentialsFromRequest, guessOauth2GrantTypeByRequest, readStringField };
+export { HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, guessOauth2GrantTypeByRequest, readRealmHint, readStringField };

package/dist/adapters/http/controllers/entities/client/module.mjs

@@ -8,14 +8,14 @@ import { buildActorContext } from "../../../request/helpers/actor.mjs";
 import { applyRouteRealmIDToBody, getRequestRealmID } from "../../../request/helpers/realm-id.mjs";
 import { useRequestScopes } from "../../../request/helpers/scopes.mjs";
 import "../../../request/index.mjs";
+import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
 import { isSelfToken } from "../../../../../utils/self-id.mjs";
 import "../../../../../utils/index.mjs";
-import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
 import "../../../middleware/index.mjs";
 import { EntityNotFoundError } from "@authup/errors";
 import { OAuth2SubKind } from "@authup/specs";
-import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DPut, DTags } from "@routup/decorators";
 import { useRequestQuery } from "@routup/basic/query";
+import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DPut, DTags } from "@routup/decorators";
 //#region src/adapters/http/controllers/entities/client/module.ts
 function _ts_decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;

package/dist/adapters/http/controllers/entities/client-permission/module.mjs

@@ -5,8 +5,8 @@ import { buildActorContext } from "../../../request/helpers/actor.mjs";
 import "../../../request/index.mjs";
 import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
 import "../../../middleware/index.mjs";
-import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DTags } from "@routup/decorators";
 import { useRequestQuery } from "@routup/basic/query";
+import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DTags } from "@routup/decorators";
 //#region src/adapters/http/controllers/entities/client-permission/module.ts
 function _ts_decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;

package/dist/adapters/http/controllers/entities/client-role/module.mjs

@@ -5,8 +5,8 @@ import { buildActorContext } from "../../../request/helpers/actor.mjs";
 import "../../../request/index.mjs";
 import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
 import "../../../middleware/index.mjs";
-import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DTags } from "@routup/decorators";
 import { useRequestQuery } from "@routup/basic/query";
+import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DTags } from "@routup/decorators";
 //#region src/adapters/http/controllers/entities/client-role/module.ts
 function _ts_decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;

package/dist/adapters/http/controllers/entities/client-scope/module.mjs

@@ -5,8 +5,8 @@ import { buildActorContext } from "../../../request/helpers/actor.mjs";
 import "../../../request/index.mjs";
 import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
 import "../../../middleware/index.mjs";
-import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DTags } from "@routup/decorators";
 import { useRequestQuery } from "@routup/basic/query";
+import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DTags } from "@routup/decorators";
 //#region src/adapters/http/controllers/entities/client-scope/module.ts
 function _ts_decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;

package/dist/adapters/http/controllers/entities/consent/index.d.ts

@@ -0,0 +1,2 @@
+export * from './module.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/controllers/entities/consent/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/consent/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC"}

package/dist/adapters/http/controllers/entities/consent/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { ConsentController } from "./module.mjs";
+export { ConsentController };

package/dist/adapters/http/controllers/entities/consent/module.d.ts

@@ -0,0 +1,15 @@
+import type { Consent } from '@authup/core-kit';
+import type { IAppEvent } from 'routup';
+import type { EntityCollectionResponse } from '@authup/core-http-kit';
+import type { IConsentService } from '../../../../../core/index.ts';
+export type ConsentControllerContext = {
+    service: IConsentService;
+};
+export declare class ConsentController {
+    protected service: IConsentService;
+    constructor(ctx: ConsentControllerContext);
+    getMany(event: IAppEvent): Promise<EntityCollectionResponse<Consent>>;
+    getOne(id: string, event: IAppEvent): Promise<Consent>;
+    drop(id: string, event: IAppEvent): Promise<Consent>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/controllers/entities/consent/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/consent/module.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAIpE,MAAM,MAAM,wBAAwB,GAAG;IACnC,OAAO,EAAE,eAAe,CAAC;CAC5B,CAAC;AAEF,qBAEa,iBAAiB;IAC1B,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC;gBAEvB,GAAG,EAAE,wBAAwB;IAKnC,OAAO,CACG,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAcvC,MAAM,CACK,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,OAAO,CAAC;IAOb,IAAI,CACO,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,OAAO,CAAC;CAQtB"}