@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.53

package/dist/adapters/http/controllers/workflows/authorize/module.mjs

@@ -13,7 +13,9 @@ import { renderUIPage } from "../../../ui/render.mjs";
 import "../../../ui/index.mjs";
 import { HTTPOAuth2Authorizer } from "../../../adapters/oauth2/authorization/module.mjs";
 import "../../../adapters/index.mjs";
+import { OAuth2AccessDeniedError, OAuth2ErrorCode, isOAuth2AccessDeniedError } from "@authup/specs";
 import { URL } from "node:url";
+import { useRequestQuery } from "@routup/basic/query";
 import { DContext, DController, DGet, DPost } from "@routup/decorators";
 //#region src/adapters/http/controllers/workflows/authorize/module.ts
 function _ts_decorate(decorators, target, key, desc) {
@@ -43,15 +45,32 @@ var AuthorizeController = class {
 			codeRequestVerifier: this.codeRequestVerifier,
 			codeIssuer: ctx.codeIssuer,
 			sessionManager: ctx.sessionManager,
-			promptLoginMaxAge: ctx.options.promptLoginMaxAge
+			eventService: ctx.eventService,
+			metrics: ctx.metrics,
+			promptLoginMaxAge: ctx.options.promptLoginMaxAge,
+			mfaFreshnessMaxAge: ctx.options.mfaFreshnessMaxAge,
+			mfaChallengeProvider: ctx.mfaChallengeProvider,
+			accessPolicyEvaluator: ctx.accessPolicyEvaluator,
+			consentService: ctx.consentService,
+			logger: ctx.logger
 		});
 	}
 	async confirm(event) {
-		const result = await this.authorizer.authorizeWithRequest(event);
-		const url = new URL(result.redirectUri);
-		if (result.state) url.searchParams.set("state", result.state);
-		if (result.authorizationCode) url.searchParams.set("code", result.authorizationCode);
-		return { url: url.href };
+		try {
+			const result = await this.authorizer.authorizeWithRequest(event);
+			const url = new URL(result.redirectUri);
+			if (result.state) url.searchParams.set("state", result.state);
+			if (result.authorizationCode) url.searchParams.set("code", result.authorizationCode);
+			return { url: url.href };
+		} catch (e) {
+			if (isOAuth2AccessDeniedError(e) && e.redirectUri) {
+				const url = new URL(e.redirectUri);
+				url.searchParams.set("error", OAuth2ErrorCode.ACCESS_DENIED);
+				if (e.state) url.searchParams.set("state", e.state);
+				return { url: url.href };
+			}
+			throw e;
+		}
 	}
 	async serve(event) {
 		let codeRequest;
@@ -86,6 +105,15 @@ var AuthorizeController = class {
 				message: normalized.message
 			};
 		}
+		if (!error) {
+			if (useRequestQuery(event).error === OAuth2ErrorCode.ACCESS_DENIED) {
+				const normalized = sanitizeError(OAuth2AccessDeniedError.forClient());
+				error = {
+					...normalized,
+					message: normalized.message
+				};
+			}
+		}
 		const requestURL = new URL(event.request.url);
 		return renderUIPage(event, {
 			url: "/authorize",

package/dist/adapters/http/controllers/workflows/authorize/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["DContext","DController","DGet","DPost","URL","ForceUserLoggedInMiddleware","HTTPOAuth2Authorizer","renderUIPage","readFromLocations","OAuth2AuthorizationCodeRequestValidator","sanitizeError","AuthorizeController","options","codeRequestVerifier","codeRequestValidator","authorizer","ctx","codeIssuer","sessionManager","promptLoginMaxAge","confirm","event","result","authorizeWithRequest","url","redirectUri","state","searchParams","set","authorizationCode","href","serve","codeRequest","client","scopes","realm","redirectUriVerified","error","merged","data","run","verify","id","name","display_name","built_in","created_at","e","normalized","message","requestURL","request","payload","config","baseURL","features","requestPath","pathname","search"],"sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPost,\n} from '@routup/decorators';\nimport { URL } from 'node:url';\n\nimport type { IAppEvent } from 'routup';\nimport type {\n    Client,\n    OAuth2AuthorizationCodeRequest,\n    Realm,\n    Scope,\n} from '@authup/core-kit';\nimport { ForceUserLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { HTTPOAuth2Authorizer } from '../../../adapters/index.ts';\nimport { renderUIPage } from '../../../ui/index.ts';\nimport { readFromLocations } from '../../../request/index.ts';\nimport type { IOAuth2AuthorizationCodeRequestVerifier } from '../../../../../core/index.ts';\nimport { OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';\nimport type { AuthorizeControllerContext, AuthorizeControllerOptions } from './types.ts';\nimport { sanitizeError } from '../../../../../utils/index.ts';\n\ntype RealmSummary = Pick<Realm, 'id' | 'name' | 'display_name'>;\ntype ClientSummary = Pick<Client, 'id' | 'name' | 'display_name' | 'built_in' | 'created_at'>;\n\n@DController('/authorize')\nexport class AuthorizeController {\n    // todo: maybe /realms/<realm>/protocol/openid-connect/authorize\n    // todo: maybe /realms/<realm>/[...]/authorize\n\n    protected options: AuthorizeControllerOptions;\n\n    protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n    protected codeRequestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n    protected authorizer: HTTPOAuth2Authorizer;\n\n    // ---------------------------------------------------------\n\n    constructor(ctx: AuthorizeControllerContext) {\n        this.options = ctx.options;\n\n        this.codeRequestVerifier = ctx.codeRequestVerifier;\n\n        this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();\n\n        this.authorizer = new HTTPOAuth2Authorizer({\n            codeRequestVerifier: this.codeRequestVerifier,\n            codeIssuer: ctx.codeIssuer,\n            sessionManager: ctx.sessionManager,\n            promptLoginMaxAge: ctx.options.promptLoginMaxAge,\n        });\n    }\n\n    // ---------------------------------------------------------\n\n    @DPost('', [ForceUserLoggedInMiddleware])\n    async confirm(@DContext() event: IAppEvent): Promise<{ url: string }> {\n        const result = await this.authorizer.authorizeWithRequest(event);\n\n        const url = new URL(result.redirectUri);\n        if (result.state) {\n            url.searchParams.set('state', result.state);\n        }\n\n        if (result.authorizationCode) {\n            url.searchParams.set('code', result.authorizationCode);\n        }\n\n        return { url: url.href };\n    }\n\n    @DGet('', [])\n    async serve(@DContext() event: IAppEvent): Promise<string> {\n        let codeRequest : OAuth2AuthorizationCodeRequest | undefined;\n\n        let client : ClientSummary | undefined;\n        let scopes : Scope[] | undefined;\n\n        // Target realm summary (the client's realm) — the UI names it in the\n        // realm-mismatch notice. codeRequest.realm_id is only the id.\n        let realm : RealmSummary | undefined;\n\n        // Whether the request redirect_uri matched a registered client pattern —\n        // the UI must not offer an automatic \"return to application\" redirect to\n        // an unverified (pattern-less-client) redirect_uri.\n        let redirectUriVerified = false;\n\n        let error : Error | undefined;\n\n        try {\n            const merged = await readFromLocations(event, ['body', 'query']);\n            const data = await this.codeRequestValidator.run(merged);\n\n            const result = await this.codeRequestVerifier.verify(data);\n\n            // Trim the client to a deliberate DTO before it reaches the\n            // anonymous SSR hydration payload — never disclose redirect_uri\n            // patterns (the trusted-origin set), grant_types, internal\n            // base/root URLs, is_confidential, or the secret storage flags to an\n            // unauthenticated visitor. (ClientEntity.secret is additionally\n            // select:false, so the secret is never loaded — but the DTO must not\n            // rely on that alone: a future entity/query change could unset it.)\n            client = {\n                id: result.client.id,\n                name: result.client.name,\n                display_name: result.client.display_name,\n                built_in: result.client.built_in,\n                created_at: result.client.created_at,\n            };\n            scopes = result.scopes;\n            redirectUriVerified = result.redirectUriVerified;\n\n            if (result.client.realm) {\n                realm = {\n                    id: result.client.realm.id,\n                    name: result.client.realm.name,\n                    display_name: result.client.realm.display_name,\n                };\n            }\n\n            codeRequest = result.data;\n        } catch (e) {\n            const normalized = sanitizeError(e);\n            error = {\n                ...normalized,\n                message: normalized.message,\n            };\n        }\n\n        // Path + query of the original request — the SSR page uses it as\n        // the same-origin `redirect` parameter on register / password links\n        // so those pages can lead back into this authorize request.\n        const requestURL = new URL(event.request.url);\n\n        return renderUIPage(event, {\n            url: '/authorize',\n            payload: {\n                config: { baseURL: this.options.baseURL },\n                data: {\n                    codeRequest,\n                    error,\n                    client,\n                    scopes,\n                    realm,\n                    redirectUriVerified,\n                    features: this.options.features,\n                    requestPath: `${requestURL.pathname}${requestURL.search}`,\n                },\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmCA,IAAaW,sBAAb,MAAaA;CAICC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAiC;EACzC,KAAKJ,UAAUI,IAAIJ;EAEnB,KAAKC,sBAAsBG,IAAIH;EAE/B,KAAKC,uBAAuB,IAAIL,wCAAAA;EAEhC,KAAKM,aAAa,IAAIT,qBAAqB;GACvCO,qBAAqB,KAAKA;GAC1BI,YAAYD,IAAIC;GAChBC,gBAAgBF,IAAIE;GACpBC,mBAAmBH,IAAIJ,QAAQO;EACnC,CAAA;CACJ;CAIA,MACMC,QAAQ,OAAwD;EAClE,MAAME,SAAS,MAAM,KAAKP,WAAWQ,qBAAqBF,KAAAA;EAE1D,MAAMG,MAAM,IAAIpB,IAAIkB,OAAOG,WAAW;EACtC,IAAIH,OAAOI,OACPF,IAAIG,aAAaC,IAAI,SAASN,OAAOI,KAAK;EAG9C,IAAIJ,OAAOO,mBACPL,IAAIG,aAAaC,IAAI,QAAQN,OAAOO,iBAAiB;EAGzD,OAAO,EAAEL,KAAKA,IAAIM,KAAK;CAC3B;CAEA,MACMC,MAAM,OAA+C;EACvD,IAAIC;EAEJ,IAAIC;EACJ,IAAIC;EAIJ,IAAIC;EAKJ,IAAIC,sBAAsB;EAE1B,IAAIC;EAEJ,IAAI;GACA,MAAMC,SAAS,MAAM9B,kBAAkBa,OAAO,CAAC,QAAQ,OAAA,CAAQ;GAC/D,MAAMkB,OAAO,MAAM,KAAKzB,qBAAqB0B,IAAIF,MAAAA;GAEjD,MAAMhB,SAAS,MAAM,KAAKT,oBAAoB4B,OAAOF,IAAAA;GASrDN,SAAS;IACLS,IAAIpB,OAAOW,OAAOS;IAClBC,MAAMrB,OAAOW,OAAOU;IACpBC,cAActB,OAAOW,OAAOW;IAC5BC,UAAUvB,OAAOW,OAAOY;IACxBC,YAAYxB,OAAOW,OAAOa;GAC9B;GACAZ,SAASZ,OAAOY;GAChBE,sBAAsBd,OAAOc;GAE7B,IAAId,OAAOW,OAAOE,OACdA,QAAQ;IACJO,IAAIpB,OAAOW,OAAOE,MAAMO;IACxBC,MAAMrB,OAAOW,OAAOE,MAAMQ;IAC1BC,cAActB,OAAOW,OAAOE,MAAMS;GACtC;GAGJZ,cAAcV,OAAOiB;EACzB,SAASQ,GAAG;GACR,MAAMC,aAAatC,cAAcqC,CAAAA;GACjCV,QAAQ;IACJ,GAAGW;IACHC,SAASD,WAAWC;GACxB;EACJ;EAKA,MAAMC,aAAa,IAAI9C,IAAIiB,MAAM8B,QAAQ3B,GAAG;EAE5C,OAAOjB,aAAac,OAAO;GACvBG,KAAK;GACL4B,SAAS;IACLC,QAAQ,EAAEC,SAAS,KAAK1C,QAAQ0C,QAAQ;IACxCf,MAAM;KACFP;KACAK;KACAJ;KACAC;KACAC;KACAC;KACAmB,UAAU,KAAK3C,QAAQ2C;KACvBC,aAAa,GAAGN,WAAWO,WAAWP,WAAWQ;IACrD;GACJ;EACJ,CAAA;CACJ;AACJ;;YAhGgBrD,2BAAAA,CAAAA"}
+{"version":3,"file":"module.mjs","names":["DContext","DController","DGet","DPost","URL","useRequestQuery","OAuth2AccessDeniedError","OAuth2ErrorCode","isOAuth2AccessDeniedError","ForceUserLoggedInMiddleware","HTTPOAuth2Authorizer","renderUIPage","readFromLocations","OAuth2AuthorizationCodeRequestValidator","sanitizeError","AuthorizeController","options","codeRequestVerifier","codeRequestValidator","authorizer","ctx","codeIssuer","sessionManager","eventService","metrics","promptLoginMaxAge","mfaFreshnessMaxAge","mfaChallengeProvider","accessPolicyEvaluator","consentService","logger","confirm","event","result","authorizeWithRequest","url","redirectUri","state","searchParams","set","authorizationCode","href","e","ACCESS_DENIED","serve","codeRequest","client","scopes","realm","redirectUriVerified","error","merged","data","run","verify","id","name","display_name","built_in","created_at","normalized","message","query","forClient","requestURL","request","payload","config","baseURL","features","requestPath","pathname","search"],"sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPost,\n} from '@routup/decorators';\nimport { URL } from 'node:url';\n\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type {\n    Client,\n    OAuth2AuthorizationCodeRequest,\n    Realm,\n    Scope,\n} from '@authup/core-kit';\nimport { OAuth2AccessDeniedError, OAuth2ErrorCode, isOAuth2AccessDeniedError } from '@authup/specs';\nimport { ForceUserLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { HTTPOAuth2Authorizer } from '../../../adapters/index.ts';\nimport { renderUIPage } from '../../../ui/index.ts';\nimport { readFromLocations } from '../../../request/index.ts';\nimport type { IOAuth2AuthorizationCodeRequestVerifier } from '../../../../../core/index.ts';\nimport { OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';\nimport type { AuthorizeControllerContext, AuthorizeControllerOptions } from './types.ts';\nimport { sanitizeError } from '../../../../../utils/index.ts';\n\ntype RealmSummary = Pick<Realm, 'id' | 'name' | 'display_name'>;\ntype ClientSummary = Pick<Client, 'id' | 'name' | 'display_name' | 'built_in' | 'created_at'>;\n\n@DController('/authorize')\nexport class AuthorizeController {\n    // todo: maybe /realms/<realm>/protocol/openid-connect/authorize\n    // todo: maybe /realms/<realm>/[...]/authorize\n\n    protected options: AuthorizeControllerOptions;\n\n    protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n    protected codeRequestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n    protected authorizer: HTTPOAuth2Authorizer;\n\n    // ---------------------------------------------------------\n\n    constructor(ctx: AuthorizeControllerContext) {\n        this.options = ctx.options;\n\n        this.codeRequestVerifier = ctx.codeRequestVerifier;\n\n        this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();\n\n        this.authorizer = new HTTPOAuth2Authorizer({\n            codeRequestVerifier: this.codeRequestVerifier,\n            codeIssuer: ctx.codeIssuer,\n            sessionManager: ctx.sessionManager,\n            eventService: ctx.eventService,\n            metrics: ctx.metrics,\n            promptLoginMaxAge: ctx.options.promptLoginMaxAge,\n            mfaFreshnessMaxAge: ctx.options.mfaFreshnessMaxAge,\n            mfaChallengeProvider: ctx.mfaChallengeProvider,\n            accessPolicyEvaluator: ctx.accessPolicyEvaluator,\n            consentService: ctx.consentService,\n            logger: ctx.logger,\n        });\n    }\n\n    // ---------------------------------------------------------\n\n    @DPost('', [ForceUserLoggedInMiddleware])\n    async confirm(@DContext() event: IAppEvent): Promise<{ url: string }> {\n        try {\n            const result = await this.authorizer.authorizeWithRequest(event);\n\n            const url = new URL(result.redirectUri);\n            if (result.state) {\n                url.searchParams.set('state', result.state);\n            }\n\n            if (result.authorizationCode) {\n                url.searchParams.set('code', result.authorizationCode);\n            }\n\n            return { url: url.href };\n        } catch (e) {\n            // Access-policy denial (plan 052): with a pattern-verified\n            // redirect_uri the denial is answered as an error redirect\n            // (RFC 6749 §4.1.2.1) — the kit navigates the returned url like\n            // any success. Unverified → rethrow → 400 body → interactive\n            // denial card.\n            if (isOAuth2AccessDeniedError(e) && e.redirectUri) {\n                const url = new URL(e.redirectUri);\n                url.searchParams.set('error', OAuth2ErrorCode.ACCESS_DENIED);\n                if (e.state) {\n                    url.searchParams.set('state', e.state);\n                }\n\n                return { url: url.href };\n            }\n\n            throw e;\n        }\n    }\n\n    @DGet('', [])\n    async serve(@DContext() event: IAppEvent): Promise<string> {\n        let codeRequest : OAuth2AuthorizationCodeRequest | undefined;\n\n        let client : ClientSummary | undefined;\n        let scopes : Scope[] | undefined;\n\n        // Target realm summary (the client's realm) — the UI names it in the\n        // realm-mismatch notice. codeRequest.realm_id is only the id.\n        let realm : RealmSummary | undefined;\n\n        // Whether the request redirect_uri matched a registered client pattern —\n        // the UI must not offer an automatic \"return to application\" redirect to\n        // an unverified (pattern-less-client) redirect_uri.\n        let redirectUriVerified = false;\n\n        let error : Error | undefined;\n\n        try {\n            const merged = await readFromLocations(event, ['body', 'query']);\n            const data = await this.codeRequestValidator.run(merged);\n\n            const result = await this.codeRequestVerifier.verify(data);\n\n            // Trim the client to a deliberate DTO before it reaches the\n            // anonymous SSR hydration payload — never disclose redirect_uri\n            // patterns (the trusted-origin set), grant_types, internal\n            // base/root URLs, auth methods, or the secret storage flags to an\n            // unauthenticated visitor. (ClientEntity.secret is additionally\n            // select:false, so the secret is never loaded — but the DTO must not\n            // rely on that alone: a future entity/query change could unset it.)\n            client = {\n                id: result.client.id,\n                name: result.client.name,\n                display_name: result.client.display_name,\n                built_in: result.client.built_in,\n                created_at: result.client.created_at,\n            };\n            scopes = result.scopes;\n            redirectUriVerified = result.redirectUriVerified;\n\n            if (result.client.realm) {\n                realm = {\n                    id: result.client.realm.id,\n                    name: result.client.realm.name,\n                    display_name: result.client.realm.display_name,\n                };\n            }\n\n            codeRequest = result.data;\n        } catch (e) {\n            const normalized = sanitizeError(e);\n            error = {\n                ...normalized,\n                message: normalized.message,\n            };\n        }\n\n        // A recognized `error` query param (the federated-IdP callback\n        // redirects back here with error=access_denied on a policy denial)\n        // is mapped onto the hydration payload's error — neutral message,\n        // never attacker-controlled text.\n        if (!error) {\n            const query = useRequestQuery(event);\n            if (query.error === OAuth2ErrorCode.ACCESS_DENIED) {\n                const normalized = sanitizeError(OAuth2AccessDeniedError.forClient());\n                error = {\n                    ...normalized,\n                    message: normalized.message,\n                };\n            }\n        }\n\n        // Path + query of the original request — the SSR page uses it as\n        // the same-origin `redirect` parameter on register / password links\n        // so those pages can lead back into this authorize request.\n        const requestURL = new URL(event.request.url);\n\n        return renderUIPage(event, {\n            url: '/authorize',\n            payload: {\n                config: { baseURL: this.options.baseURL },\n                data: {\n                    codeRequest,\n                    error,\n                    client,\n                    scopes,\n                    realm,\n                    redirectUriVerified,\n                    features: this.options.features,\n                    requestPath: `${requestURL.pathname}${requestURL.search}`,\n                },\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,IAAae,sBAAb,MAAaA;CAICC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAiC;EACzC,KAAKJ,UAAUI,IAAIJ;EAEnB,KAAKC,sBAAsBG,IAAIH;EAE/B,KAAKC,uBAAuB,IAAIL,wCAAAA;EAEhC,KAAKM,aAAa,IAAIT,qBAAqB;GACvCO,qBAAqB,KAAKA;GAC1BI,YAAYD,IAAIC;GAChBC,gBAAgBF,IAAIE;GACpBC,cAAcH,IAAIG;GAClBC,SAASJ,IAAII;GACbC,mBAAmBL,IAAIJ,QAAQS;GAC/BC,oBAAoBN,IAAIJ,QAAQU;GAChCC,sBAAsBP,IAAIO;GAC1BC,uBAAuBR,IAAIQ;GAC3BC,gBAAgBT,IAAIS;GACpBC,QAAQV,IAAIU;EAChB,CAAA;CACJ;CAIA,MACMC,QAAQ,OAAwD;EAClE,IAAI;GACA,MAAME,SAAS,MAAM,KAAKd,WAAWe,qBAAqBF,KAAAA;GAE1D,MAAMG,MAAM,IAAI/B,IAAI6B,OAAOG,WAAW;GACtC,IAAIH,OAAOI,OACPF,IAAIG,aAAaC,IAAI,SAASN,OAAOI,KAAK;GAG9C,IAAIJ,OAAOO,mBACPL,IAAIG,aAAaC,IAAI,QAAQN,OAAOO,iBAAiB;GAGzD,OAAO,EAAEL,KAAKA,IAAIM,KAAK;EAC3B,SAASC,GAAG;GAMR,IAAIlC,0BAA0BkC,CAAAA,KAAMA,EAAEN,aAAa;IAC/C,MAAMD,MAAM,IAAI/B,IAAIsC,EAAEN,WAAW;IACjCD,IAAIG,aAAaC,IAAI,SAAShC,gBAAgBoC,aAAa;IAC3D,IAAID,EAAEL,OACFF,IAAIG,aAAaC,IAAI,SAASG,EAAEL,KAAK;IAGzC,OAAO,EAAEF,KAAKA,IAAIM,KAAK;GAC3B;GAEA,MAAMC;EACV;CACJ;CAEA,MACME,MAAM,OAA+C;EACvD,IAAIC;EAEJ,IAAIC;EACJ,IAAIC;EAIJ,IAAIC;EAKJ,IAAIC,sBAAsB;EAE1B,IAAIC;EAEJ,IAAI;GACA,MAAMC,SAAS,MAAMvC,kBAAkBoB,OAAO,CAAC,QAAQ,OAAA,CAAQ;GAC/D,MAAMoB,OAAO,MAAM,KAAKlC,qBAAqBmC,IAAIF,MAAAA;GAEjD,MAAMlB,SAAS,MAAM,KAAKhB,oBAAoBqC,OAAOF,IAAAA;GASrDN,SAAS;IACLS,IAAItB,OAAOa,OAAOS;IAClBC,MAAMvB,OAAOa,OAAOU;IACpBC,cAAcxB,OAAOa,OAAOW;IAC5BC,UAAUzB,OAAOa,OAAOY;IACxBC,YAAY1B,OAAOa,OAAOa;GAC9B;GACAZ,SAASd,OAAOc;GAChBE,sBAAsBhB,OAAOgB;GAE7B,IAAIhB,OAAOa,OAAOE,OACdA,QAAQ;IACJO,IAAItB,OAAOa,OAAOE,MAAMO;IACxBC,MAAMvB,OAAOa,OAAOE,MAAMQ;IAC1BC,cAAcxB,OAAOa,OAAOE,MAAMS;GACtC;GAGJZ,cAAcZ,OAAOmB;EACzB,SAASV,GAAG;GACR,MAAMkB,aAAa9C,cAAc4B,CAAAA;GACjCQ,QAAQ;IACJ,GAAGU;IACHC,SAASD,WAAWC;GACxB;EACJ;EAMA,IAAI,CAACX;OACa7C,gBAAgB2B,KAC1B8B,CAAAA,CAAMZ,UAAU3C,gBAAgBoC,eAAe;IAC/C,MAAMiB,aAAa9C,cAAcR,wBAAwByD,UAAS,CAAA;IAClEb,QAAQ;KACJ,GAAGU;KACHC,SAASD,WAAWC;IACxB;GACJ;;EAMJ,MAAMG,aAAa,IAAI5D,IAAI4B,MAAMiC,QAAQ9B,GAAG;EAE5C,OAAOxB,aAAaqB,OAAO;GACvBG,KAAK;GACL+B,SAAS;IACLC,QAAQ,EAAEC,SAAS,KAAKpD,QAAQoD,QAAQ;IACxChB,MAAM;KACFP;KACAK;KACAJ;KACAC;KACAC;KACAC;KACAoB,UAAU,KAAKrD,QAAQqD;KACvBC,aAAa,GAAGN,WAAWO,WAAWP,WAAWQ;IACrD;GACJ;EACJ,CAAA;CACJ;AACJ;;YAlIgB/D,2BAAAA,CAAAA"}

package/dist/adapters/http/controllers/workflows/authorize/types.d.ts

@@ -1,5 +1,6 @@
 import type { StatusResponseFeatures } from '@authup/core-http-kit';
-import type { IOAuth2AuthorizationCodeIssuer, IOAuth2AuthorizationCodeRequestVerifier, ISessionManager } from '../../../../../core/index.ts';
+import type { Logger } from '@authup/server-kit';
+import type { IAuthFlowMetrics, IConsentService, IEventService, IOAuth2AccessPolicyEvaluator, IOAuth2AuthorizationCodeIssuer, IOAuth2AuthorizationCodeRequestVerifier, ISessionManager, IUserAuthenticatorChallengeProvider } from '../../../../../core/index.ts';
 export type AuthorizeControllerOptions = {
     baseURL: string;
     features: StatusResponseFeatures;
@@ -8,11 +9,26 @@ export type AuthorizeControllerOptions = {
      * (config `promptLoginMaxAge`).
      */
     promptLoginMaxAge?: number;
+    /**
+     * Max age (seconds) of the session's mfa_at an acr_values step-up request
+     * accepts before forcing a fresh challenge (config `mfaFreshnessMaxAge`).
+     */
+    mfaFreshnessMaxAge?: number;
 };
 export type AuthorizeControllerContext = {
     options: AuthorizeControllerOptions;
     codeIssuer: IOAuth2AuthorizationCodeIssuer;
     codeRequestVerifier: IOAuth2AuthorizationCodeRequestVerifier;
     sessionManager: ISessionManager;
+    eventService?: IEventService;
+    metrics?: IAuthFlowMetrics;
+    mfaChallengeProvider?: IUserAuthenticatorChallengeProvider;
+    accessPolicyEvaluator?: IOAuth2AccessPolicyEvaluator;
+    /**
+     * Persisted per-scope consent (plan 055): records the approved scope
+     * tokens after a successful (non-built_in) POST /authorize approval.
+     */
+    consentService?: IConsentService;
+    logger?: Logger;
 };
 //# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/controllers/workflows/authorize/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,EACR,8BAA8B,EAC9B,uCAAuC,EACvC,eAAe,EAClB,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,0BAA0B,GAAG;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,sBAAsB,CAAC;IACjC;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACrC,OAAO,EAAE,0BAA0B,CAAC;IAEpC,UAAU,EAAE,8BAA8B,CAAC;IAC3C,mBAAmB,EAAE,uCAAuC,CAAC;IAE7D,cAAc,EAAE,eAAe,CAAA;CAClC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EACR,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,4BAA4B,EAC5B,8BAA8B,EAC9B,uCAAuC,EACvC,eAAe,EACf,mCAAmC,EACtC,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,0BAA0B,GAAG;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,sBAAsB,CAAC;IACjC;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACrC,OAAO,EAAE,0BAA0B,CAAC;IAEpC,UAAU,EAAE,8BAA8B,CAAC;IAC3C,mBAAmB,EAAE,uCAAuC,CAAC;IAE7D,cAAc,EAAE,eAAe,CAAC;IAEhC,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAE3B,oBAAoB,CAAC,EAAE,mCAAmC,CAAC;IAC3D,qBAAqB,CAAC,EAAE,4BAA4B,CAAC;IAErD;;;OAGG;IACH,cAAc,CAAC,EAAE,eAAe,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC"}

package/dist/adapters/http/controllers/workflows/index.d.ts

@@ -1,4 +1,5 @@
 export * from './activate/index.ts';
+export * from './authenticator-challenge/index.ts';
 export * from './authorize/index.ts';
 export * from './jwks/index.ts';
 export * from './logout/index.ts';

package/dist/adapters/http/controllers/workflows/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/controllers/workflows/index.ts"],"names":[],"mappings":"AAOA,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/controllers/workflows/index.ts"],"names":[],"mappings":"AAOA,cAAc,qBAAqB,CAAC;AACpC,cAAc,oCAAoC,CAAC;AACnD,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC"}

package/dist/adapters/http/controllers/workflows/index.mjs

@@ -3,6 +3,8 @@ import "node:url";
 import.meta.url;
 import { ActivateController } from "./activate/module.mjs";
 import "./activate/index.mjs";
+import { AuthenticatorChallengeController } from "./authenticator-challenge/module.mjs";
+import "./authenticator-challenge/index.mjs";
 import { AuthorizeController } from "./authorize/module.mjs";
 import "./authorize/index.mjs";
 import { getJwkRouteHandler, getJwksRouteHandler } from "./jwks/handlers/read.mjs";
@@ -22,4 +24,4 @@ import { StatusController } from "./status/module.mjs";
 import "./status/index.mjs";
 import { TokenController } from "./token/module.mjs";
 import "./token/index.mjs";
-export { ActivateController, AuthorizeController, JwkController, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, RegisterController, StatusController, TokenController, getJwkRouteHandler, getJwksRouteHandler };
+export { ActivateController, AuthenticatorChallengeController, AuthorizeController, JwkController, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, RegisterController, StatusController, TokenController, getJwkRouteHandler, getJwksRouteHandler };

package/dist/adapters/http/controllers/workflows/jwks/handlers/read.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../../../../../../src/adapters/http/controllers/workflows/jwks/handlers/read.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0CAA0C,CAAC;AAE1E,wBAAsB,mBAAmB,CACrC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EACjC,OAAO,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,IAAI,EAAE,gBAAgB,EAAE,CAAA;CAAE,CAAC,CA6BxC;AAED,wBAAsB,kBAAkB,CACpC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EACjC,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,gBAAgB,CAAC,CA+B5B"}
+{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../../../../../../src/adapters/http/controllers/workflows/jwks/handlers/read.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAgB,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0CAA0C,CAAC;AAG1E,wBAAsB,mBAAmB,CACrC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EACjC,OAAO,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,IAAI,EAAE,gBAAgB,EAAE,CAAA;CAAE,CAAC,CAwCxC;AAED,wBAAsB,kBAAkB,CACpC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EACjC,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,gBAAgB,CAAC,CAmC5B"}

package/dist/adapters/http/controllers/workflows/jwks/handlers/read.mjs

@@ -1,44 +1,58 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { buildCertificateJwkFields } from "../../../../../../core/key/certificate.mjs";
+import "../../../../../../core/index.mjs";
 import { In } from "typeorm";
+import { KeyStatus } from "@authup/core-kit";
 import { AsymmetricKey } from "@authup/server-kit";
-import { JWKError, JWKType } from "@authup/specs";
+import { JWKError, JWKType, JWKUse } from "@authup/specs";
 //#region src/adapters/http/controllers/workflows/jwks/handlers/read.ts
 async function getJwksRouteHandler(repository, realmId) {
 	const promises = (await repository.find({
 		where: {
 			type: In([JWKType.RSA, JWKType.EC]),
+			use: JWKUse.SIGNATURE,
+			status: In([KeyStatus.ACTIVE, KeyStatus.PASSIVE]),
 			...realmId ? { realm_id: realmId } : {}
 		},
 		order: { priority: "DESC" }
-	})).filter((entity) => !!entity.encryption_key).map((entity) => AsymmetricKey.fromBase64({
+	})).filter((entity) => !!entity.encryption_key && !!entity.signature_algorithm).map((entity) => AsymmetricKey.fromBase64({
 		format: "spki",
 		key: entity.encryption_key,
 		options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signature_algorithm)
-	}).then((container) => container.toJWK()).then((key) => ({
-		...key,
-		kid: entity.id,
-		alg: entity.signature_algorithm
-	})));
+	}).then((container) => container.toJWK()).then(async (key) => {
+		const certificateFields = await buildCertificateJwkFields(entity.certificate);
+		return {
+			...key,
+			kid: entity.id,
+			alg: entity.signature_algorithm,
+			...certificateFields
+		};
+	}));
 	return { keys: await Promise.all(promises) };
 }
 async function getJwkRouteHandler(repository, keyId, realmId) {
 	const entity = await repository.findOne({ where: {
 		type: In([JWKType.RSA, JWKType.EC]),
+		use: JWKUse.SIGNATURE,
+		status: In([KeyStatus.ACTIVE, KeyStatus.PASSIVE]),
 		id: keyId,
 		...realmId ? { realm_id: realmId } : {}
 	} });
 	if (!entity) throw JWKError.notFound(keyId);
-	if (!entity.encryption_key) throw JWKError.encryptionKeyMissing();
+	if (!entity.encryption_key || !entity.signature_algorithm) throw JWKError.encryptionKeyMissing();
+	const jsonWebKey = await (await AsymmetricKey.fromBase64({
+		format: "spki",
+		key: entity.encryption_key,
+		options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signature_algorithm)
+	})).toJWK();
+	const certificateFields = await buildCertificateJwkFields(entity.certificate);
 	return {
-		...await (await AsymmetricKey.fromBase64({
-			format: "spki",
-			key: entity.encryption_key,
-			options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signature_algorithm)
-		})).toJWK(),
+		...jsonWebKey,
 		kid: entity.id,
-		alg: entity.signature_algorithm
+		alg: entity.signature_algorithm,
+		...certificateFields
 	};
 }
 //#endregion

package/dist/adapters/http/controllers/workflows/jwks/handlers/read.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"read.mjs","names":["AsymmetricKey","JWKError","JWKType","In","getJwksRouteHandler","repository","realmId","entities","find","where","type","RSA","EC","realm_id","order","priority","promises","filter","entity","encryption_key","map","fromBase64","format","key","options","buildImportOptionsForJWTAlgorithm","signature_algorithm","then","container","toJWK","kid","id","alg","keys","Promise","all","getJwkRouteHandler","keyId","findOne","notFound","encryptionKeyMissing","jsonWebKey"],"sources":["../../../../../../../src/adapters/http/controllers/workflows/jwks/handlers/read.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { AsymmetricKey } from '@authup/server-kit';\nimport type { OAuth2JsonWebKey } from '@authup/specs';\nimport { JWKError, JWKType } from '@authup/specs';\nimport type { Repository } from 'typeorm';\nimport { In } from 'typeorm';\nimport type { KeyEntity } from '../../../../../database/domains/index.ts';\n\nexport async function getJwksRouteHandler(\n    repository: Repository<KeyEntity>,\n    realmId?: string,\n) : Promise<{ keys: OAuth2JsonWebKey[] }> {\n    const entities = await repository.find({\n        where: {\n            type: In([JWKType.RSA, JWKType.EC]),\n            ...(realmId ? { realm_id: realmId } : {}),\n        },\n        order: { priority: 'DESC' },\n    });\n\n    const promises = entities\n        .filter((entity): entity is KeyEntity & { encryption_key: string } => !!entity.encryption_key)\n        .map(\n            (entity) => AsymmetricKey\n                .fromBase64({\n                    format: 'spki',\n                    key: entity.encryption_key,\n                    options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signature_algorithm),\n                })\n                .then((container) => container.toJWK())\n                .then((key) => ({\n                    ...key,\n                    kid: entity.id,\n                    alg: entity.signature_algorithm,\n                })),\n        );\n\n    const keys = await Promise.all(promises);\n\n    return { keys };\n}\n\nexport async function getJwkRouteHandler(\n    repository: Repository<KeyEntity>,\n    keyId: string,\n    realmId?: string,\n) : Promise<OAuth2JsonWebKey> {\n    const entity = await repository.findOne({\n        where: {\n            type: In([JWKType.RSA, JWKType.EC]),\n            id: keyId,\n            ...(realmId ? { realm_id: realmId } : {}),\n        },\n    });\n\n    if (!entity) {\n        throw JWKError.notFound(keyId);\n    }\n\n    if (!entity.encryption_key) {\n        throw JWKError.encryptionKeyMissing();\n    }\n\n    const container = await AsymmetricKey\n        .fromBase64({\n            format: 'spki',\n            key: entity.encryption_key,\n            options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signature_algorithm),\n        });\n\n    const jsonWebKey = await container.toJWK();\n\n    return {\n        ...jsonWebKey,\n        kid: entity.id,\n        alg: entity.signature_algorithm,\n    };\n}\n"],"mappings":";;;;;;;AAcA,eAAsBI,oBAClBC,YACAC,SAAgB;CAUhB,MAAMU,YAAWT,MARMF,WAAWG,KAAK;EACnCC,OAAO;GACHC,MAAMP,GAAG,CAACD,QAAQS,KAAKT,QAAQU,EAAAA,CAAG;GAClC,GAAIN,UAAU,EAAEO,UAAUP,QAAQ,IAAI,CAAC;EAC3C;EACAQ,OAAO,EAAEC,UAAU,OAAO;CAC9B,CAAA,EAAA,CAGKE,QAAQC,WAA6D,CAAC,CAACA,OAAOC,cAAc,CAAA,CAC5FC,KACIF,WAAWlB,cACPqB,WAAW;EACRC,QAAQ;EACRC,KAAKL,OAAOC;EACZK,SAASxB,cAAcyB,kCAAkCP,OAAOQ,mBAAmB;CACvF,CAAA,CAAA,CACCC,MAAMC,cAAcA,UAAUC,MAAK,CAAA,CAAA,CACnCF,MAAMJ,SAAS;EACZ,GAAGA;EACHO,KAAKZ,OAAOa;EACZC,KAAKd,OAAOQ;CAChB,EAAA,CAAA;CAKZ,OAAO,EAAEO,MAAAA,MAFUC,QAAQC,IAAInB,QAAAA,EAEjB;AAClB;AAEA,eAAsBoB,mBAClB/B,YACAgC,OACA/B,SAAgB;CAEhB,MAAMY,SAAS,MAAMb,WAAWiC,QAAQ,EACpC7B,OAAO;EACHC,MAAMP,GAAG,CAACD,QAAQS,KAAKT,QAAQU,EAAAA,CAAG;EAClCmB,IAAIM;EACJ,GAAI/B,UAAU,EAAEO,UAAUP,QAAQ,IAAI,CAAC;CAC3C,EACJ,CAAA;CAEA,IAAI,CAACY,QACD,MAAMjB,SAASsC,SAASF,KAAAA;CAG5B,IAAI,CAACnB,OAAOC,gBACR,MAAMlB,SAASuC,qBAAoB;CAYvC,OAAO;EACH,GAAGC,OAHkBb,MAPD5B,cACnBqB,WAAW;GACRC,QAAQ;GACRC,KAAKL,OAAOC;GACZK,SAASxB,cAAcyB,kCAAkCP,OAAOQ,mBAAmB;EACvF,CAAA,EAAA,CAE+BG,MAAK;EAIpCC,KAAKZ,OAAOa;EACZC,KAAKd,OAAOQ;CAChB;AACJ"}
+{"version":3,"file":"read.mjs","names":["KeyStatus","AsymmetricKey","JWKError","JWKType","JWKUse","In","buildCertificateJwkFields","getJwksRouteHandler","repository","realmId","entities","find","where","type","RSA","EC","use","SIGNATURE","status","ACTIVE","PASSIVE","realm_id","order","priority","promises","filter","entity","encryption_key","signature_algorithm","map","fromBase64","format","key","options","buildImportOptionsForJWTAlgorithm","then","container","toJWK","certificateFields","certificate","kid","id","alg","keys","Promise","all","getJwkRouteHandler","keyId","findOne","notFound","encryptionKeyMissing","jsonWebKey"],"sources":["../../../../../../../src/adapters/http/controllers/workflows/jwks/handlers/read.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { KeyStatus } from '@authup/core-kit';\nimport { AsymmetricKey } from '@authup/server-kit';\nimport type { JWTAlgorithm, OAuth2JsonWebKey } from '@authup/specs';\nimport { JWKError, JWKType, JWKUse } from '@authup/specs';\nimport type { Repository } from 'typeorm';\nimport { In } from 'typeorm';\nimport type { KeyEntity } from '../../../../../database/domains/index.ts';\nimport { buildCertificateJwkFields } from '../../../../../../core/index.ts';\n\nexport async function getJwksRouteHandler(\n    repository: Repository<KeyEntity>,\n    realmId?: string,\n) : Promise<{ keys: OAuth2JsonWebKey[] }> {\n    const entities = await repository.find({\n        where: {\n            type: In([JWKType.RSA, JWKType.EC]),\n            use: JWKUse.SIGNATURE,\n            // active + passive verify; disabled keys never publish.\n            status: In([KeyStatus.ACTIVE, KeyStatus.PASSIVE]),\n            ...(realmId ? { realm_id: realmId } : {}),\n        },\n        order: { priority: 'DESC' },\n    });\n\n    const promises = entities\n        .filter(\n            (entity): entity is KeyEntity & { encryption_key: string, signature_algorithm: `${JWTAlgorithm}` } => !!entity.encryption_key &&\n                !!entity.signature_algorithm,\n        )\n        .map(\n            (entity) => AsymmetricKey\n                .fromBase64({\n                    format: 'spki',\n                    key: entity.encryption_key,\n                    options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signature_algorithm),\n                })\n                .then((container) => container.toJWK())\n                .then(async (key) => {\n                    const certificateFields = await buildCertificateJwkFields(entity.certificate);\n\n                    return {\n                        ...key,\n                        kid: entity.id,\n                        alg: entity.signature_algorithm,\n                        ...certificateFields,\n                    };\n                }),\n        );\n\n    const keys = await Promise.all(promises);\n\n    return { keys };\n}\n\nexport async function getJwkRouteHandler(\n    repository: Repository<KeyEntity>,\n    keyId: string,\n    realmId?: string,\n) : Promise<OAuth2JsonWebKey> {\n    const entity = await repository.findOne({\n        where: {\n            type: In([JWKType.RSA, JWKType.EC]),\n            use: JWKUse.SIGNATURE,\n            status: In([KeyStatus.ACTIVE, KeyStatus.PASSIVE]),\n            id: keyId,\n            ...(realmId ? { realm_id: realmId } : {}),\n        },\n    });\n\n    if (!entity) {\n        throw JWKError.notFound(keyId);\n    }\n\n    if (!entity.encryption_key || !entity.signature_algorithm) {\n        throw JWKError.encryptionKeyMissing();\n    }\n\n    const container = await AsymmetricKey\n        .fromBase64({\n            format: 'spki',\n            key: entity.encryption_key,\n            options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signature_algorithm),\n        });\n\n    const jsonWebKey = await container.toJWK();\n    const certificateFields = await buildCertificateJwkFields(entity.certificate);\n\n    return {\n        ...jsonWebKey,\n        kid: entity.id,\n        alg: entity.signature_algorithm,\n        ...certificateFields,\n    };\n}\n"],"mappings":";;;;;;;;;;AAgBA,eAAsBO,oBAClBC,YACAC,SAAgB;CAahB,MAAMe,YAAWd,MAXMF,WAAWG,KAAK;EACnCC,OAAO;GACHC,MAAMR,GAAG,CAACF,QAAQW,KAAKX,QAAQY,EAAAA,CAAG;GAClCC,KAAKZ,OAAOa;GAEZC,QAAQb,GAAG,CAACL,UAAUmB,QAAQnB,UAAUoB,OAAAA,CAAQ;GAChD,GAAIX,UAAU,EAAEY,UAAUZ,QAAQ,IAAI,CAAC;EAC3C;EACAa,OAAO,EAAEC,UAAU,OAAO;CAC9B,CAAA,EAAA,CAGKE,QACIC,WAAqG,CAAC,CAACA,OAAOC,kBAC3G,CAAC,CAACD,OAAOE,mBAAmB,CAAA,CAEnCC,KACIH,WAAWzB,cACP6B,WAAW;EACRC,QAAQ;EACRC,KAAKN,OAAOC;EACZM,SAAShC,cAAciC,kCAAkCR,OAAOE,mBAAmB;CACvF,CAAA,CAAA,CACCO,MAAMC,cAAcA,UAAUC,MAAK,CAAA,CAAA,CACnCF,KAAK,OAAOH,QAAAA;EACT,MAAMM,oBAAoB,MAAMhC,0BAA0BoB,OAAOa,WAAW;EAE5E,OAAO;GACH,GAAGP;GACHQ,KAAKd,OAAOe;GACZC,KAAKhB,OAAOE;GACZ,GAAGU;EACP;CACJ,CAAA,CAAA;CAKZ,OAAO,EAAEK,MAAAA,MAFUC,QAAQC,IAAIrB,QAAAA,EAEjB;AAClB;AAEA,eAAsBsB,mBAClBtC,YACAuC,OACAtC,SAAgB;CAEhB,MAAMiB,SAAS,MAAMlB,WAAWwC,QAAQ,EACpCpC,OAAO;EACHC,MAAMR,GAAG,CAACF,QAAQW,KAAKX,QAAQY,EAAAA,CAAG;EAClCC,KAAKZ,OAAOa;EACZC,QAAQb,GAAG,CAACL,UAAUmB,QAAQnB,UAAUoB,OAAAA,CAAQ;EAChDqB,IAAIM;EACJ,GAAItC,UAAU,EAAEY,UAAUZ,QAAQ,IAAI,CAAC;CAC3C,EACJ,CAAA;CAEA,IAAI,CAACiB,QACD,MAAMxB,SAAS+C,SAASF,KAAAA;CAG5B,IAAI,CAACrB,OAAOC,kBAAkB,CAACD,OAAOE,qBAClC,MAAM1B,SAASgD,qBAAoB;CAUvC,MAAMC,aAAa,OAAMf,MAPDnC,cACnB6B,WAAW;EACRC,QAAQ;EACRC,KAAKN,OAAOC;EACZM,SAAShC,cAAciC,kCAAkCR,OAAOE,mBAAmB;CACvF,CAAA,EAAA,CAE+BS,MAAK;CACxC,MAAMC,oBAAoB,MAAMhC,0BAA0BoB,OAAOa,WAAW;CAE5E,OAAO;EACH,GAAGY;EACHX,KAAKd,OAAOe;EACZC,KAAKhB,OAAOE;EACZ,GAAGU;CACP;AACJ"}

package/dist/adapters/http/controllers/workflows/jwks/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/jwks/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAStD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAC;AAGvE,MAAM,MAAM,oBAAoB,GAAG;IAC/B,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAA;CACpC,CAAC;AAEF,qBACa,aAAa;IACtB,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;gBAEhC,GAAG,EAAE,oBAAoB;IAK/B,WAAW,CACD,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC;QAAE,IAAI,EAAE,gBAAgB,EAAE,CAAA;KAAE,CAAC;IAkClC,UAAU,CAAc,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;CA+BvE"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/jwks/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAgB,gBAAgB,EAAE,MAAM,eAAe,CAAC;AASpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAC;AAIvE,MAAM,MAAM,oBAAoB,GAAG;IAC/B,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAA;CACpC,CAAC;AAEF,qBACa,aAAa;IACtB,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;gBAEhC,GAAG,EAAE,oBAAoB;IAK/B,WAAW,CACD,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC;QAAE,IAAI,EAAE,gBAAgB,EAAE,CAAA;KAAE,CAAC;IA6ClC,UAAU,CAAc,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;CAmCvE"}

package/dist/adapters/http/controllers/workflows/jwks/module.mjs

@@ -1,11 +1,14 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { buildCertificateJwkFields } from "../../../../../core/key/certificate.mjs";
+import "../../../../../core/index.mjs";
 import { getRequestStringParam } from "../../../request/helpers/param-id.mjs";
 import "../../../request/index.mjs";
 import { In } from "typeorm";
+import { KeyStatus } from "@authup/core-kit";
 import { AsymmetricKey } from "@authup/server-kit";
-import { JWKError, JWKType } from "@authup/specs";
+import { JWKError, JWKType, JWKUse } from "@authup/specs";
 import { DContext, DController, DGet, DPath } from "@routup/decorators";
 //#region src/adapters/http/controllers/workflows/jwks/module.ts
 function _ts_decorate(decorators, target, key, desc) {
@@ -32,35 +35,46 @@ var JwkController = class {
 		const promises = (await this.repository.find({
 			where: {
 				type: In([JWKType.RSA, JWKType.EC]),
+				use: JWKUse.SIGNATURE,
+				status: In([KeyStatus.ACTIVE, KeyStatus.PASSIVE]),
 				...realmId ? { realm_id: realmId } : {}
 			},
 			order: { priority: "DESC" }
-		})).filter((entity) => !!entity.encryption_key).map((entity) => AsymmetricKey.fromBase64({
+		})).filter((entity) => !!entity.encryption_key && !!entity.signature_algorithm).map((entity) => AsymmetricKey.fromBase64({
 			format: "spki",
 			key: entity.encryption_key,
 			options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signature_algorithm)
-		}).then((container) => container.toJWK()).then((key) => ({
-			...key,
-			kid: entity.id,
-			alg: entity.signature_algorithm
-		})));
+		}).then((container) => container.toJWK()).then(async (key) => {
+			const certificateFields = await buildCertificateJwkFields(entity.certificate);
+			return {
+				...key,
+				kid: entity.id,
+				alg: entity.signature_algorithm,
+				...certificateFields
+			};
+		}));
 		return { keys: await Promise.all(promises) };
 	}
 	async getOneJwks(id) {
 		const entity = await this.repository.findOne({ where: {
 			type: In([JWKType.RSA, JWKType.EC]),
+			use: JWKUse.SIGNATURE,
+			status: In([KeyStatus.ACTIVE, KeyStatus.PASSIVE]),
 			id
 		} });
 		if (!entity) throw JWKError.notFound(id);
-		if (!entity.encryption_key) throw JWKError.encryptionKeyMissing();
+		if (!entity.encryption_key || !entity.signature_algorithm) throw JWKError.encryptionKeyMissing();
+		const jsonWebKey = await (await AsymmetricKey.fromBase64({
+			format: "spki",
+			key: entity.encryption_key,
+			options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signature_algorithm)
+		})).toJWK();
+		const certificateFields = await buildCertificateJwkFields(entity.certificate);
 		return {
-			...await (await AsymmetricKey.fromBase64({
-				format: "spki",
-				key: entity.encryption_key,
-				options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signature_algorithm)
-			})).toJWK(),
+			...jsonWebKey,
 			kid: entity.id,
-			alg: entity.signature_algorithm
+			alg: entity.signature_algorithm,
+			...certificateFields
 		};
 	}
 };

package/dist/adapters/http/controllers/workflows/jwks/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["JWKError","JWKType","AsymmetricKey","DContext","DController","DGet","DPath","In","getRequestStringParam","JwkController","repository","ctx","getManyJwks","event","realmId","entities","find","where","type","RSA","EC","realm_id","order","priority","promises","filter","entity","encryption_key","map","fromBase64","format","key","options","buildImportOptionsForJWTAlgorithm","signature_algorithm","then","container","toJWK","kid","id","alg","keys","Promise","all","getOneJwks","findOne","notFound","encryptionKeyMissing","jsonWebKey"],"sources":["../../../../../../src/adapters/http/controllers/workflows/jwks/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2JsonWebKey } from '@authup/specs';\nimport { JWKError, JWKType } from '@authup/specs';\nimport { AsymmetricKey } from '@authup/server-kit';\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPath,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport type { Repository } from 'typeorm';\nimport { In } from 'typeorm';\nimport type { KeyEntity } from '../../../../database/domains/index.ts';\nimport { getRequestStringParam } from '../../../request/index.ts';\n\nexport type JwkControllerContext = {\n    repository: Repository<KeyEntity>\n};\n\n@DController('')\nexport class JwkController {\n    protected repository: Repository<KeyEntity>;\n\n    constructor(ctx: JwkControllerContext) {\n        this.repository = ctx.repository;\n    }\n\n    @DGet('/jwks', [])\n    async getManyJwks(\n        @DContext() event: IAppEvent,\n    ): Promise<{ keys: OAuth2JsonWebKey[] }> {\n        const realmId = getRequestStringParam(event, 'realmId');\n\n        const entities = await this.repository.find({\n            where: {\n                type: In([JWKType.RSA, JWKType.EC]),\n                ...(realmId ? { realm_id: realmId } : {}),\n            },\n            order: { priority: 'DESC' },\n        });\n\n        const promises = entities\n            .filter((entity): entity is KeyEntity & { encryption_key: string } => !!entity.encryption_key)\n            .map(\n                (entity) => AsymmetricKey\n                    .fromBase64({\n                        format: 'spki',\n                        key: entity.encryption_key,\n                        options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signature_algorithm),\n                    })\n                    .then((container) => container.toJWK())\n                    .then((key) => ({\n                        ...key,\n                        kid: entity.id,\n                        alg: entity.signature_algorithm,\n                    })),\n            );\n\n        const keys = await Promise.all(promises);\n\n        return { keys };\n    }\n\n    @DGet('/jwks/:id', [])\n    async getOneJwks(@DPath('id') id: string): Promise<OAuth2JsonWebKey> {\n        const entity = await this.repository.findOne({\n            where: {\n                type: In([JWKType.RSA, JWKType.EC]),\n                id,\n            },\n        });\n\n        if (!entity) {\n            throw JWKError.notFound(id);\n        }\n\n        if (!entity.encryption_key) {\n            throw JWKError.encryptionKeyMissing();\n        }\n\n        const container = await AsymmetricKey\n            .fromBase64({\n                format: 'spki',\n                key: entity.encryption_key,\n                options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signature_algorithm),\n            });\n\n        const jsonWebKey = await container.toJWK();\n\n        return {\n            ...jsonWebKey,\n            kid: entity.id,\n            alg: entity.signature_algorithm,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;AAKC,SAAA,aAAA,YAAA,QAAA,KAAA,MAAA;;;;;;;;;;;;;;AAsBD,IAAaS,gBAAb,MAAaA;CACCC;CAEV,YAAYC,KAA2B;EACnC,KAAKD,aAAaC,IAAID;CAC1B;CAEA,MACME,YACF,OACqC;EACrC,MAAME,UAAUN,sBAAsBK,OAAO,SAAA;EAU7C,MAAMW,YAAWT,MARM,KAAKL,WAAWM,KAAK;GACxCC,OAAO;IACHC,MAAMX,GAAG,CAACN,QAAQkB,KAAKlB,QAAQmB,EAAAA,CAAG;IAClC,GAAIN,UAAU,EAAEO,UAAUP,QAAQ,IAAI,CAAC;GAC3C;GACAQ,OAAO,EAAEC,UAAU,OAAO;EAC9B,CAAA,EAAA,CAGKE,QAAQC,WAA6D,CAAC,CAACA,OAAOC,cAAc,CAAA,CAC5FC,KACIF,WAAWxB,cACP2B,WAAW;GACRC,QAAQ;GACRC,KAAKL,OAAOC;GACZK,SAAS9B,cAAc+B,kCAAkCP,OAAOQ,mBAAmB;EACvF,CAAA,CAAA,CACCC,MAAMC,cAAcA,UAAUC,MAAK,CAAA,CAAA,CACnCF,MAAMJ,SAAS;GACZ,GAAGA;GACHO,KAAKZ,OAAOa;GACZC,KAAKd,OAAOQ;EAChB,EAAA,CAAA;EAKZ,OAAO,EAAEO,MAAAA,MAFUC,QAAQC,IAAInB,QAAAA,EAEjB;CAClB;CAEA,MACMoB,WAAW,IAAoD;EACjE,MAAMlB,SAAS,MAAM,KAAKhB,WAAWmC,QAAQ,EACzC5B,OAAO;GACHC,MAAMX,GAAG,CAACN,QAAQkB,KAAKlB,QAAQmB,EAAAA,CAAG;GAClCmB;EACJ,EACJ,CAAA;EAEA,IAAI,CAACb,QACD,MAAM1B,SAAS8C,SAASP,EAAAA;EAG5B,IAAI,CAACb,OAAOC,gBACR,MAAM3B,SAAS+C,qBAAoB;EAYvC,OAAO;GACH,GAAGC,OAHkBZ,MAPDlC,cACnB2B,WAAW;IACRC,QAAQ;IACRC,KAAKL,OAAOC;IACZK,SAAS9B,cAAc+B,kCAAkCP,OAAOQ,mBAAmB;GACvF,CAAA,EAAA,CAE+BG,MAAK;GAIpCC,KAAKZ,OAAOa;GACZC,KAAKd,OAAOQ;EAChB;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["KeyStatus","JWKError","JWKType","JWKUse","AsymmetricKey","DContext","DController","DGet","DPath","In","buildCertificateJwkFields","getRequestStringParam","JwkController","repository","ctx","getManyJwks","event","realmId","entities","find","where","type","RSA","EC","use","SIGNATURE","status","ACTIVE","PASSIVE","realm_id","order","priority","promises","filter","entity","encryption_key","signature_algorithm","map","fromBase64","format","key","options","buildImportOptionsForJWTAlgorithm","then","container","toJWK","certificateFields","certificate","kid","id","alg","keys","Promise","all","getOneJwks","findOne","notFound","encryptionKeyMissing","jsonWebKey"],"sources":["../../../../../../src/adapters/http/controllers/workflows/jwks/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { KeyStatus } from '@authup/core-kit';\nimport type { JWTAlgorithm, OAuth2JsonWebKey } from '@authup/specs';\nimport { JWKError, JWKType, JWKUse } from '@authup/specs';\nimport { AsymmetricKey } from '@authup/server-kit';\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPath,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport type { Repository } from 'typeorm';\nimport { In } from 'typeorm';\nimport type { KeyEntity } from '../../../../database/domains/index.ts';\nimport { buildCertificateJwkFields } from '../../../../../core/index.ts';\nimport { getRequestStringParam } from '../../../request/index.ts';\n\nexport type JwkControllerContext = {\n    repository: Repository<KeyEntity>\n};\n\n@DController('')\nexport class JwkController {\n    protected repository: Repository<KeyEntity>;\n\n    constructor(ctx: JwkControllerContext) {\n        this.repository = ctx.repository;\n    }\n\n    @DGet('/jwks', [])\n    async getManyJwks(\n        @DContext() event: IAppEvent,\n    ): Promise<{ keys: OAuth2JsonWebKey[] }> {\n        const realmId = getRequestStringParam(event, 'realmId');\n\n        const entities = await this.repository.find({\n            where: {\n                type: In([JWKType.RSA, JWKType.EC]),\n                use: JWKUse.SIGNATURE,\n                // active + passive verify; disabled keys never publish.\n                status: In([KeyStatus.ACTIVE, KeyStatus.PASSIVE]),\n                ...(realmId ? { realm_id: realmId } : {}),\n            },\n            order: { priority: 'DESC' },\n        });\n\n        const promises = entities\n            .filter(\n                (entity): entity is KeyEntity & { encryption_key: string, signature_algorithm: `${JWTAlgorithm}` } => !!entity.encryption_key &&\n                    !!entity.signature_algorithm,\n            )\n            .map(\n                (entity) => AsymmetricKey\n                    .fromBase64({\n                        format: 'spki',\n                        key: entity.encryption_key,\n                        options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signature_algorithm),\n                    })\n                    .then((container) => container.toJWK())\n                    .then(async (key) => {\n                        const certificateFields = await buildCertificateJwkFields(entity.certificate);\n\n                        return {\n                            ...key,\n                            kid: entity.id,\n                            alg: entity.signature_algorithm,\n                            ...certificateFields,\n                        };\n                    }),\n            );\n\n        const keys = await Promise.all(promises);\n\n        return { keys };\n    }\n\n    @DGet('/jwks/:id', [])\n    async getOneJwks(@DPath('id') id: string): Promise<OAuth2JsonWebKey> {\n        const entity = await this.repository.findOne({\n            where: {\n                type: In([JWKType.RSA, JWKType.EC]),\n                use: JWKUse.SIGNATURE,\n                status: In([KeyStatus.ACTIVE, KeyStatus.PASSIVE]),\n                id,\n            },\n        });\n\n        if (!entity) {\n            throw JWKError.notFound(id);\n        }\n\n        if (!entity.encryption_key || !entity.signature_algorithm) {\n            throw JWKError.encryptionKeyMissing();\n        }\n\n        const container = await AsymmetricKey\n            .fromBase64({\n                format: 'spki',\n                key: entity.encryption_key,\n                options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signature_algorithm),\n            });\n\n        const jsonWebKey = await container.toJWK();\n        const certificateFields = await buildCertificateJwkFields(entity.certificate);\n\n        return {\n            ...jsonWebKey,\n            kid: entity.id,\n            alg: entity.signature_algorithm,\n            ...certificateFields,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,IAAaY,gBAAb,MAAaA;CACCC;CAEV,YAAYC,KAA2B;EACnC,KAAKD,aAAaC,IAAID;CAC1B;CAEA,MACME,YACF,OACqC;EACrC,MAAME,UAAUN,sBAAsBK,OAAO,SAAA;EAa7C,MAAMgB,YAAWd,MAXM,KAAKL,WAAWM,KAAK;GACxCC,OAAO;IACHC,MAAMZ,GAAG,CAACP,QAAQoB,KAAKpB,QAAQqB,EAAAA,CAAG;IAClCC,KAAKrB,OAAOsB;IAEZC,QAAQjB,GAAG,CAACT,UAAU2B,QAAQ3B,UAAU4B,OAAAA,CAAQ;IAChD,GAAIX,UAAU,EAAEY,UAAUZ,QAAQ,IAAI,CAAC;GAC3C;GACAa,OAAO,EAAEC,UAAU,OAAO;EAC9B,CAAA,EAAA,CAGKE,QACIC,WAAqG,CAAC,CAACA,OAAOC,kBAC3G,CAAC,CAACD,OAAOE,mBAAmB,CAAA,CAEnCC,KACIH,WAAW9B,cACPkC,WAAW;GACRC,QAAQ;GACRC,KAAKN,OAAOC;GACZM,SAASrC,cAAcsC,kCAAkCR,OAAOE,mBAAmB;EACvF,CAAA,CAAA,CACCO,MAAMC,cAAcA,UAAUC,MAAK,CAAA,CAAA,CACnCF,KAAK,OAAOH,QAAAA;GACT,MAAMM,oBAAoB,MAAMpC,0BAA0BwB,OAAOa,WAAW;GAE5E,OAAO;IACH,GAAGP;IACHQ,KAAKd,OAAOe;IACZC,KAAKhB,OAAOE;IACZ,GAAGU;GACP;EACJ,CAAA,CAAA;EAKZ,OAAO,EAAEK,MAAAA,MAFUC,QAAQC,IAAIrB,QAAAA,EAEjB;CAClB;CAEA,MACMsB,WAAW,IAAoD;EACjE,MAAMpB,SAAS,MAAM,KAAKrB,WAAW0C,QAAQ,EACzCnC,OAAO;GACHC,MAAMZ,GAAG,CAACP,QAAQoB,KAAKpB,QAAQqB,EAAAA,CAAG;GAClCC,KAAKrB,OAAOsB;GACZC,QAAQjB,GAAG,CAACT,UAAU2B,QAAQ3B,UAAU4B,OAAAA,CAAQ;GAChDqB;EACJ,EACJ,CAAA;EAEA,IAAI,CAACf,QACD,MAAMjC,SAASuD,SAASP,EAAAA;EAG5B,IAAI,CAACf,OAAOC,kBAAkB,CAACD,OAAOE,qBAClC,MAAMnC,SAASwD,qBAAoB;EAUvC,MAAMC,aAAa,OAAMd,MAPDxC,cACnBkC,WAAW;GACRC,QAAQ;GACRC,KAAKN,OAAOC;GACZM,SAASrC,cAAcsC,kCAAkCR,OAAOE,mBAAmB;EACvF,CAAA,EAAA,CAE+BS,MAAK;EACxC,MAAMC,oBAAoB,MAAMpC,0BAA0BwB,OAAOa,WAAW;EAE5E,OAAO;GACH,GAAGW;GACHV,KAAKd,OAAOe;GACZC,KAAKhB,OAAOE;GACZ,GAAGU;EACP;CACJ;AACJ"}

package/dist/adapters/http/controllers/workflows/token/module.d.ts

@@ -2,7 +2,7 @@ import type { OAuth2TokenGrantResponse, OAuth2TokenIntrospectionResponse } from
 import { OAuth2TokenGrant } from '@authup/specs';
 import type { IAppEvent } from 'routup';
 import type { TokenControllerContext } from './types.ts';
-import type { IIdentityPermissionProvider, IIdentityResolver, IOAuth2TokenIssuer, IOAuth2TokenRevoker, IOAuth2TokenVerifier } from '../../../../../core/index.ts';
+import type { IAuthFlowMetrics, IIdentityPermissionProvider, IIdentityResolver, IOAuth2TokenIssuer, IOAuth2TokenRevoker, IOAuth2TokenVerifier } from '../../../../../core/index.ts';
 import type { IHTTPOAuth2Grant } from '../../../adapters/index.ts';
 export declare class TokenController {
     protected refreshTokenIssuer: IOAuth2TokenIssuer;
@@ -11,6 +11,7 @@ export declare class TokenController {
     protected tokenRevoker: IOAuth2TokenRevoker;
     protected identityResolver: IIdentityResolver;
     protected identityPermissionProvider: IIdentityPermissionProvider;
+    protected metrics?: IAuthFlowMetrics;
     protected tokenGrants: Record<`${OAuth2TokenGrant}`, IHTTPOAuth2Grant>;
     constructor(ctx: TokenControllerContext);
     getIntrospect(event: IAppEvent): Promise<OAuth2TokenIntrospectionResponse>;

package/dist/adapters/http/controllers/workflows/token/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/token/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,gCAAgC,EAAyB,MAAM,eAAe,CAAC;AACvH,OAAO,EAA4C,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAQ3F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGxC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,KAAK,EACR,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACvB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAWnE,qBAEa,eAAe;IACxB,SAAS,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;IAEjD,SAAS,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;IAEhD,SAAS,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAE9C,SAAS,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAE5C,SAAS,CAAC,gBAAgB,EAAG,iBAAiB,CAAC;IAE/C,SAAS,CAAC,0BAA0B,EAAG,2BAA2B,CAAC;IAEnE,SAAS,CAAC,WAAW,EAAG,MAAM,CAAC,GAAG,gBAAgB,EAAE,EAAE,gBAAgB,CAAC,CAAC;gBAI5D,GAAG,EAAE,sBAAsB;IAuDjC,aAAa,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,gCAAgC,CAAC;IAKtF,cAAc,CACJ,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,gCAAgC,CAAC;IA4DtC,WAAW,CACD,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,IAAI,CAAC;IAkBV,WAAW,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAarF"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/token/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,gCAAgC,EAAyB,MAAM,eAAe,CAAC;AACvH,OAAO,EAA4C,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAQ3F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGxC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,KAAK,EACR,gBAAgB,EAChB,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACvB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAWnE,qBAEa,eAAe;IACxB,SAAS,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;IAEjD,SAAS,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;IAEhD,SAAS,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAE9C,SAAS,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAE5C,SAAS,CAAC,gBAAgB,EAAG,iBAAiB,CAAC;IAE/C,SAAS,CAAC,0BAA0B,EAAG,2BAA2B,CAAC;IAEnE,SAAS,CAAC,OAAO,CAAC,EAAG,gBAAgB,CAAC;IAEtC,SAAS,CAAC,WAAW,EAAG,MAAM,CAAC,GAAG,gBAAgB,EAAE,EAAE,gBAAgB,CAAC,CAAC;gBAI5D,GAAG,EAAE,sBAAsB;IAqEjC,aAAa,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,gCAAgC,CAAC;IAKtF,cAAc,CACJ,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,gCAAgC,CAAC;IA4DtC,WAAW,CACD,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,IAAI,CAAC;IA+BV,WAAW,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAiBrF"}

package/dist/adapters/http/controllers/workflows/token/module.mjs

@@ -39,6 +39,7 @@ var TokenController = class {
 	tokenRevoker;
 	identityResolver;
 	identityPermissionProvider;
+	metrics;
 	tokenGrants;
 	constructor(ctx) {
 		this.refreshTokenIssuer = ctx.refreshTokenIssuer;
@@ -47,6 +48,7 @@ var TokenController = class {
 		this.tokenRevoker = ctx.tokenRevoker;
 		this.identityResolver = ctx.identityResolver;
 		this.identityPermissionProvider = ctx.identityPermissionProvider;
+		this.metrics = ctx.metrics;
 		this.tokenGrants = {
 			[OAuth2TokenGrant.AUTHORIZATION_CODE]: new HTTPOAuth2AuthorizeGrant({
 				codeVerifier: ctx.codeVerifier,
@@ -54,14 +56,17 @@ var TokenController = class {
 				accessTokenIssuer: ctx.accessTokenIssuer,
 				refreshTokenIssuer: ctx.refreshTokenIssuer,
 				openIdTokenIssuer: ctx.openIdTokenIssuer,
-				keyRepository: ctx.keyRepository,
+				keyStore: ctx.keyStore,
 				sessionManager: ctx.sessionManager,
-				realmRepository: ctx.realmRepository
+				realmRepository: ctx.realmRepository,
+				accessPolicyEvaluator: ctx.accessPolicyEvaluator,
+				certificateSource: ctx.certificateSource
 			}),
 			[OAuth2TokenGrant.CLIENT_CREDENTIALS]: new HTTPClientCredentialsGrant({
 				accessTokenIssuer: ctx.accessTokenIssuer,
-				authenticator: ctx.clientAuthenticator,
-				sessionManager: ctx.sessionManager
+				clientAuthenticator: ctx.oauth2ClientAuthenticator,
+				sessionManager: ctx.sessionManager,
+				certificateSource: ctx.certificateSource
 			}),
 			[OAuth2TokenGrant.ROBOT_CREDENTIALS]: new HTTPRobotCredentialsGrant({
 				accessTokenIssuer: ctx.accessTokenIssuer,
@@ -74,7 +79,14 @@ var TokenController = class {
 				authenticator: ctx.userAuthenticator,
 				clientAuthenticator: ctx.oauth2ClientAuthenticator,
 				sessionManager: ctx.sessionManager,
-				realmRepository: ctx.realmRepository
+				realmRepository: ctx.realmRepository,
+				eventService: ctx.eventService,
+				metrics: ctx.metrics,
+				loginThrottleService: ctx.loginThrottleService,
+				userAuthenticatorService: ctx.userAuthenticatorService,
+				mfaLoginService: ctx.mfaLoginService,
+				logger: ctx.logger,
+				certificateSource: ctx.certificateSource
 			}),
 			[OAuth2TokenGrant.REFRESH_TOKEN]: new HTTPOAuth2RefreshTokenGrant({
 				accessTokenIssuer: ctx.accessTokenIssuer,
@@ -85,8 +97,11 @@ var TokenController = class {
 				sessionManager: ctx.sessionManager,
 				clientAuthenticator: ctx.oauth2ClientAuthenticator,
 				realmRepository: ctx.realmRepository,
+				eventService: ctx.eventService,
+				metrics: ctx.metrics,
 				logger: ctx.logger,
-				options: { gracePeriod: ctx.tokenRefreshGracePeriod }
+				options: { gracePeriod: ctx.tokenRefreshGracePeriod },
+				certificateSource: ctx.certificateSource
 			})
 		};
 	}
@@ -131,7 +146,10 @@ var TokenController = class {
 	async revokeToken(event) {
 		try {
 			const token = await extractTokenFromRequest(event);
-			const payload = await this.tokenVerifier.verify(token);
+			const payload = await this.tokenVerifier.verify(token, {
+				ignoreExpiry: true,
+				skipActiveCheck: true
+			});
 			await this.tokenRevoker.revoke(payload);
 			event.response.status = 202;
 			return null;
@@ -144,7 +162,9 @@ var TokenController = class {
 		if (!grantType) throw OAuth2GrantTypeError.unsupported();
 		const grant = this.tokenGrants[grantType];
 		if (!grant) throw OAuth2GrantTypeError.unsupported();
-		return grant.runWithRequest(event);
+		const response = await grant.runWithRequest(event);
+		this.metrics?.recordTokenGrant(grantType);
+		return response;
 	}
 };
 _ts_decorate([

package/dist/adapters/http/controllers/workflows/token/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2GrantTypeError","OAuth2RequestError","OAuth2TokenGrant","DContext","DController","DGet","DPost","DTags","buildPermissionKey","toOAuth2Error","OAuth2OpenIDClaimsBuilder","HTTPClientCredentialsGrant","HTTPOAuth2AuthorizeGrant","HTTPOAuth2RefreshTokenGrant","HTTPPasswordGrant","HTTPRobotCredentialsGrant","guessOauth2GrantTypeByRequest","extractTokenFromRequest","TokenController","refreshTokenIssuer","accessTokenIssuer","tokenVerifier","tokenRevoker","identityResolver","identityPermissionProvider","tokenGrants","ctx","AUTHORIZATION_CODE","codeVerifier","clientAuthenticator","oauth2ClientAuthenticator","openIdTokenIssuer","keyRepository","sessionManager","realmRepository","CLIENT_CREDENTIALS","authenticator","ROBOT_CREDENTIALS","robotAuthenticator","PASSWORD","userAuthenticator","REFRESH_TOKEN","tokenRepository","sessionTokenRepository","logger","options","gracePeriod","tokenRefreshGracePeriod","getIntrospect","event","postIntrospect","token","payload","verify","skipActiveCheck","sub","sub_kind","identityInvalid","permissions","getFor","id","type","clientId","client_id","realmId","realm_id","identity","resolve","claimsBuilder","claims","fromIdentity","active","jti","isInactive","Object","values","reduce","acc","binding","key","permission","name","e","revokeToken","revoke","response","status","createToken","grantType","unsupported","grant","runWithRequest"],"sources":["../../../../../../src/adapters/http/controllers/workflows/token/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenIntrospectionResponse, OAuth2TokenPermission } from '@authup/specs';\nimport { OAuth2GrantTypeError, OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPost,\n    DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport { buildPermissionKey } from '@authup/access';\nimport { toOAuth2Error } from '../../../../../core/oauth2/helpers/index.ts';\nimport type { TokenControllerContext } from './types.ts';\nimport type {\n    IIdentityPermissionProvider,\n    IIdentityResolver,\n    IOAuth2TokenIssuer,\n    IOAuth2TokenRevoker,\n    IOAuth2TokenVerifier,\n} from '../../../../../core/index.ts';\nimport { OAuth2OpenIDClaimsBuilder } from '../../../../../core/index.ts';\nimport type { IHTTPOAuth2Grant } from '../../../adapters/index.ts';\nimport {\n    HTTPClientCredentialsGrant,\n    HTTPOAuth2AuthorizeGrant,\n    HTTPOAuth2RefreshTokenGrant,\n    HTTPPasswordGrant,\n    HTTPRobotCredentialsGrant,\n    guessOauth2GrantTypeByRequest,\n} from '../../../adapters/index.ts';\nimport { extractTokenFromRequest } from './utils/index.ts';\n\n@DTags('auth')\n@DController('/token')\nexport class TokenController {\n    protected refreshTokenIssuer: IOAuth2TokenIssuer;\n\n    protected accessTokenIssuer: IOAuth2TokenIssuer;\n\n    protected tokenVerifier: IOAuth2TokenVerifier;\n\n    protected tokenRevoker: IOAuth2TokenRevoker;\n\n    protected identityResolver : IIdentityResolver;\n\n    protected identityPermissionProvider : IIdentityPermissionProvider;\n\n    protected tokenGrants : Record<`${OAuth2TokenGrant}`, IHTTPOAuth2Grant>;\n\n    // -------------------------------------------\n\n    constructor(ctx: TokenControllerContext) {\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n        this.accessTokenIssuer = ctx.accessTokenIssuer;\n        this.tokenVerifier = ctx.tokenVerifier;\n        this.tokenRevoker = ctx.tokenRevoker;\n        this.identityResolver = ctx.identityResolver;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n\n        this.tokenGrants = {\n            [OAuth2TokenGrant.AUTHORIZATION_CODE]: new HTTPOAuth2AuthorizeGrant({\n                codeVerifier: ctx.codeVerifier,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                openIdTokenIssuer: ctx.openIdTokenIssuer,\n                keyRepository: ctx.keyRepository,\n                sessionManager: ctx.sessionManager,\n                realmRepository: ctx.realmRepository,\n            }),\n            [OAuth2TokenGrant.CLIENT_CREDENTIALS]: new HTTPClientCredentialsGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                authenticator: ctx.clientAuthenticator,\n                sessionManager: ctx.sessionManager,\n            }),\n            [OAuth2TokenGrant.ROBOT_CREDENTIALS]: new HTTPRobotCredentialsGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                authenticator: ctx.robotAuthenticator,\n                sessionManager: ctx.sessionManager,\n            }),\n            [OAuth2TokenGrant.PASSWORD]: new HTTPPasswordGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                authenticator: ctx.userAuthenticator,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                sessionManager: ctx.sessionManager,\n                realmRepository: ctx.realmRepository,\n            }),\n            [OAuth2TokenGrant.REFRESH_TOKEN]: new HTTPOAuth2RefreshTokenGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                tokenVerifier: ctx.tokenVerifier,\n                tokenRepository: ctx.tokenRepository,\n                sessionTokenRepository: ctx.sessionTokenRepository,\n                sessionManager: ctx.sessionManager,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                realmRepository: ctx.realmRepository,\n                logger: ctx.logger,\n                options: { gracePeriod: ctx.tokenRefreshGracePeriod },\n            }),\n        };\n    }\n\n    // -------------------------------------------\n\n    @DGet('/introspect', [])\n    async getIntrospect(@DContext() event: IAppEvent): Promise<OAuth2TokenIntrospectionResponse> {\n        return this.postIntrospect(event);\n    }\n\n    @DPost('/introspect', [])\n    async postIntrospect(\n        @DContext() event: IAppEvent,\n    ): Promise<OAuth2TokenIntrospectionResponse> {\n        try {\n            const token = await extractTokenFromRequest(event);\n            const payload = await this.tokenVerifier.verify(token, { skipActiveCheck: true });\n            if (!payload.sub || !payload.sub_kind) {\n                throw OAuth2RequestError.identityInvalid();\n            }\n\n            // todo: only receive client specific permissions\n            const permissions = await this.identityPermissionProvider.getFor({\n                id: payload.sub,\n                type: payload.sub_kind,\n                clientId: payload.client_id,\n                realmId: payload.realm_id,\n            });\n\n            const identity = await this.identityResolver.resolve(payload.sub_kind, payload.sub);\n            if (!identity) {\n                // todo: differentiate between client, robot & user\n                throw OAuth2RequestError.identityInvalid();\n            }\n\n            const claimsBuilder = new OAuth2OpenIDClaimsBuilder();\n            const claims = claimsBuilder.fromIdentity(identity);\n\n            let active : boolean;\n            if (payload.jti) {\n                const isInactive = await this.tokenVerifier.isInactive(payload.jti);\n                active = !isInactive;\n            } else {\n                active = false;\n            }\n\n            return {\n                active,\n                // todo: permissions property should be removed.\n                permissions: Object.values(\n                    permissions.reduce((acc, binding) => {\n                        const key = buildPermissionKey(binding.permission);\n                        if (!acc[key]) {\n                            acc[key] = {\n                                name: binding.permission.name,\n                                client_id: binding.permission.client_id,\n                                realm_id: binding.permission.realm_id,\n                            } as OAuth2TokenPermission;\n                        }\n                        return acc;\n                    }, {} as Record<string, OAuth2TokenPermission>),\n                ),\n                ...payload,\n                ...claims,\n            };\n        } catch (e) {\n            throw toOAuth2Error(e);\n        }\n    }\n\n    // ----------------------------------------------------------\n\n    @DPost('/revoke', [])\n    async revokeToken(\n        @DContext() event: IAppEvent,\n    ): Promise<null> {\n        try {\n            const token = await extractTokenFromRequest(event);\n\n            const payload = await this.tokenVerifier.verify(token);\n\n            await this.tokenRevoker.revoke(payload);\n\n            event.response.status = 202;\n            return null;\n        } catch (e) {\n            throw toOAuth2Error(e);\n        }\n    }\n\n    // ----------------------------------------------------------\n\n    @DPost('', [])\n    async createToken(@DContext() event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const grantType = await guessOauth2GrantTypeByRequest(event);\n        if (!grantType) {\n            throw OAuth2GrantTypeError.unsupported();\n        }\n\n        const grant = this.tokenGrants[grantType];\n        if (!grant) {\n            throw OAuth2GrantTypeError.unsupported();\n        }\n\n        return grant.runWithRequest(event);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAKC,SAAA,aAAA,YAAA,QAAA,KAAA,MAAA;;;;;;;;;;;;;;AAoCD,IAAakB,kBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAA6B;EACrC,KAAKP,qBAAqBO,IAAIP;EAC9B,KAAKC,oBAAoBM,IAAIN;EAC7B,KAAKC,gBAAgBK,IAAIL;EACzB,KAAKC,eAAeI,IAAIJ;EACxB,KAAKC,mBAAmBG,IAAIH;EAC5B,KAAKC,6BAA6BE,IAAIF;EAEtC,KAAKC,cAAc;IACdvB,iBAAiByB,qBAAqB,IAAIf,yBAAyB;IAChEgB,cAAcF,IAAIE;IAClBC,qBAAqBH,IAAII;IACzBV,mBAAmBM,IAAIN;IACvBD,oBAAoBO,IAAIP;IACxBY,mBAAmBL,IAAIK;IACvBC,eAAeN,IAAIM;IACnBC,gBAAgBP,IAAIO;IACpBC,iBAAiBR,IAAIQ;GACzB,CAAA;IACChC,iBAAiBiC,qBAAqB,IAAIxB,2BAA2B;IAClES,mBAAmBM,IAAIN;IACvBgB,eAAeV,IAAIG;IACnBI,gBAAgBP,IAAIO;GACxB,CAAA;IACC/B,iBAAiBmC,oBAAoB,IAAItB,0BAA0B;IAChEK,mBAAmBM,IAAIN;IACvBgB,eAAeV,IAAIY;IACnBL,gBAAgBP,IAAIO;GACxB,CAAA;IACC/B,iBAAiBqC,WAAW,IAAIzB,kBAAkB;IAC/CM,mBAAmBM,IAAIN;IACvBD,oBAAoBO,IAAIP;IACxBiB,eAAeV,IAAIc;IACnBX,qBAAqBH,IAAII;IACzBG,gBAAgBP,IAAIO;IACpBC,iBAAiBR,IAAIQ;GACzB,CAAA;IACChC,iBAAiBuC,gBAAgB,IAAI5B,4BAA4B;IAC9DO,mBAAmBM,IAAIN;IACvBD,oBAAoBO,IAAIP;IACxBE,eAAeK,IAAIL;IACnBqB,iBAAiBhB,IAAIgB;IACrBC,wBAAwBjB,IAAIiB;IAC5BV,gBAAgBP,IAAIO;IACpBJ,qBAAqBH,IAAII;IACzBI,iBAAiBR,IAAIQ;IACrBU,QAAQlB,IAAIkB;IACZC,SAAS,EAAEC,aAAapB,IAAIqB,wBAAwB;GACxD,CAAA;EACJ;CACJ;CAIA,MACMC,cAAc,OAAyE;EACzF,OAAO,KAAKE,eAAeD,KAAAA;CAC/B;CAEA,MACMC,eACF,OACyC;EACzC,IAAI;GACA,MAAMC,QAAQ,MAAMlC,wBAAwBgC,KAAAA;GAC5C,MAAMG,UAAU,MAAM,KAAK/B,cAAcgC,OAAOF,OAAO,EAAEG,iBAAiB,KAAK,CAAA;GAC/E,IAAI,CAACF,QAAQG,OAAO,CAACH,QAAQI,UACzB,MAAMvD,mBAAmBwD,gBAAe;GAI5C,MAAMC,cAAc,MAAM,KAAKlC,2BAA2BmC,OAAO;IAC7DC,IAAIR,QAAQG;IACZM,MAAMT,QAAQI;IACdM,UAAUV,QAAQW;IAClBC,SAASZ,QAAQa;GACrB,CAAA;GAEA,MAAMC,WAAW,MAAM,KAAK3C,iBAAiB4C,QAAQf,QAAQI,UAAUJ,QAAQG,GAAG;GAClF,IAAI,CAACW,UAED,MAAMjE,mBAAmBwD,gBAAe;GAI5C,MAAMY,SAASD,IADW1D,0BACX0D,CAAAA,CAAcE,aAAaJ,QAAAA;GAE1C,IAAIK;GACJ,IAAInB,QAAQoB,KAERD,SAAS,CAACE,MADe,KAAKpD,cAAcoD,WAAWrB,QAAQoB,GAAG;QAGlED,SAAS;GAGb,OAAO;IACHA;IAEAb,aAAagB,OAAOC,OAChBjB,YAAYkB,QAAQC,KAAKC,YAAAA;KACrB,MAAMC,MAAMvE,mBAAmBsE,QAAQE,UAAU;KACjD,IAAI,CAACH,IAAIE,MACLF,IAAIE,OAAO;MACPE,MAAMH,QAAQE,WAAWC;MACzBlB,WAAWe,QAAQE,WAAWjB;MAC9BE,UAAUa,QAAQE,WAAWf;KACjC;KAEJ,OAAOY;IACX,GAAG,CAAC,CAAA,CAAA;IAER,GAAGzB;IACH,GAAGiB;GACP;EACJ,SAASa,GAAG;GACR,MAAMzE,cAAcyE,CAAAA;EACxB;CACJ;CAIA,MACMC,YACF,OACa;EACb,IAAI;GACA,MAAMhC,QAAQ,MAAMlC,wBAAwBgC,KAAAA;GAE5C,MAAMG,UAAU,MAAM,KAAK/B,cAAcgC,OAAOF,KAAAA;GAEhD,MAAM,KAAK7B,aAAa8D,OAAOhC,OAAAA;GAE/BH,MAAMoC,SAASC,SAAS;GACxB,OAAO;EACX,SAASJ,GAAG;GACR,MAAMzE,cAAcyE,CAAAA;EACxB;CACJ;CAIA,MACMK,YAAY,OAAiE;EAC/E,MAAMC,YAAY,MAAMxE,8BAA8BiC,KAAAA;EACtD,IAAI,CAACuC,WACD,MAAMxF,qBAAqByF,YAAW;EAG1C,MAAMC,QAAQ,KAAKjE,YAAY+D;EAC/B,IAAI,CAACE,OACD,MAAM1F,qBAAqByF,YAAW;EAG1C,OAAOC,MAAMC,eAAe1C,KAAAA;CAChC;AACJ"}
+{"version":3,"file":"module.mjs","names":["OAuth2GrantTypeError","OAuth2RequestError","OAuth2TokenGrant","DContext","DController","DGet","DPost","DTags","buildPermissionKey","toOAuth2Error","OAuth2OpenIDClaimsBuilder","HTTPClientCredentialsGrant","HTTPOAuth2AuthorizeGrant","HTTPOAuth2RefreshTokenGrant","HTTPPasswordGrant","HTTPRobotCredentialsGrant","guessOauth2GrantTypeByRequest","extractTokenFromRequest","TokenController","refreshTokenIssuer","accessTokenIssuer","tokenVerifier","tokenRevoker","identityResolver","identityPermissionProvider","metrics","tokenGrants","ctx","AUTHORIZATION_CODE","codeVerifier","clientAuthenticator","oauth2ClientAuthenticator","openIdTokenIssuer","keyStore","sessionManager","realmRepository","accessPolicyEvaluator","certificateSource","CLIENT_CREDENTIALS","ROBOT_CREDENTIALS","authenticator","robotAuthenticator","PASSWORD","userAuthenticator","eventService","loginThrottleService","userAuthenticatorService","mfaLoginService","logger","REFRESH_TOKEN","tokenRepository","sessionTokenRepository","options","gracePeriod","tokenRefreshGracePeriod","getIntrospect","event","postIntrospect","token","payload","verify","skipActiveCheck","sub","sub_kind","identityInvalid","permissions","getFor","id","type","clientId","client_id","realmId","realm_id","identity","resolve","claimsBuilder","claims","fromIdentity","active","jti","isInactive","Object","values","reduce","acc","binding","key","permission","name","e","revokeToken","ignoreExpiry","revoke","response","status","createToken","grantType","unsupported","grant","runWithRequest","recordTokenGrant"],"sources":["../../../../../../src/adapters/http/controllers/workflows/token/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenIntrospectionResponse, OAuth2TokenPermission } from '@authup/specs';\nimport { OAuth2GrantTypeError, OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPost,\n    DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport { buildPermissionKey } from '@authup/access';\nimport { toOAuth2Error } from '../../../../../core/oauth2/helpers/index.ts';\nimport type { TokenControllerContext } from './types.ts';\nimport type {\n    IAuthFlowMetrics,\n    IIdentityPermissionProvider,\n    IIdentityResolver,\n    IOAuth2TokenIssuer,\n    IOAuth2TokenRevoker,\n    IOAuth2TokenVerifier,\n} from '../../../../../core/index.ts';\nimport { OAuth2OpenIDClaimsBuilder } from '../../../../../core/index.ts';\nimport type { IHTTPOAuth2Grant } from '../../../adapters/index.ts';\nimport {\n    HTTPClientCredentialsGrant,\n    HTTPOAuth2AuthorizeGrant,\n    HTTPOAuth2RefreshTokenGrant,\n    HTTPPasswordGrant,\n    HTTPRobotCredentialsGrant,\n    guessOauth2GrantTypeByRequest,\n} from '../../../adapters/index.ts';\nimport { extractTokenFromRequest } from './utils/index.ts';\n\n@DTags('auth')\n@DController('/token')\nexport class TokenController {\n    protected refreshTokenIssuer: IOAuth2TokenIssuer;\n\n    protected accessTokenIssuer: IOAuth2TokenIssuer;\n\n    protected tokenVerifier: IOAuth2TokenVerifier;\n\n    protected tokenRevoker: IOAuth2TokenRevoker;\n\n    protected identityResolver : IIdentityResolver;\n\n    protected identityPermissionProvider : IIdentityPermissionProvider;\n\n    protected metrics? : IAuthFlowMetrics;\n\n    protected tokenGrants : Record<`${OAuth2TokenGrant}`, IHTTPOAuth2Grant>;\n\n    // -------------------------------------------\n\n    constructor(ctx: TokenControllerContext) {\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n        this.accessTokenIssuer = ctx.accessTokenIssuer;\n        this.tokenVerifier = ctx.tokenVerifier;\n        this.tokenRevoker = ctx.tokenRevoker;\n        this.identityResolver = ctx.identityResolver;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n        this.metrics = ctx.metrics;\n\n        this.tokenGrants = {\n            [OAuth2TokenGrant.AUTHORIZATION_CODE]: new HTTPOAuth2AuthorizeGrant({\n                codeVerifier: ctx.codeVerifier,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                openIdTokenIssuer: ctx.openIdTokenIssuer,\n                keyStore: ctx.keyStore,\n                sessionManager: ctx.sessionManager,\n                realmRepository: ctx.realmRepository,\n                accessPolicyEvaluator: ctx.accessPolicyEvaluator,\n                certificateSource: ctx.certificateSource,\n            }),\n            [OAuth2TokenGrant.CLIENT_CREDENTIALS]: new HTTPClientCredentialsGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                sessionManager: ctx.sessionManager,\n                certificateSource: ctx.certificateSource,\n            }),\n            [OAuth2TokenGrant.ROBOT_CREDENTIALS]: new HTTPRobotCredentialsGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                authenticator: ctx.robotAuthenticator,\n                sessionManager: ctx.sessionManager,\n            }),\n            [OAuth2TokenGrant.PASSWORD]: new HTTPPasswordGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                authenticator: ctx.userAuthenticator,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                sessionManager: ctx.sessionManager,\n                realmRepository: ctx.realmRepository,\n                eventService: ctx.eventService,\n                metrics: ctx.metrics,\n                loginThrottleService: ctx.loginThrottleService,\n                userAuthenticatorService: ctx.userAuthenticatorService,\n                mfaLoginService: ctx.mfaLoginService,\n                logger: ctx.logger,\n                certificateSource: ctx.certificateSource,\n            }),\n            [OAuth2TokenGrant.REFRESH_TOKEN]: new HTTPOAuth2RefreshTokenGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                tokenVerifier: ctx.tokenVerifier,\n                tokenRepository: ctx.tokenRepository,\n                sessionTokenRepository: ctx.sessionTokenRepository,\n                sessionManager: ctx.sessionManager,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                realmRepository: ctx.realmRepository,\n                eventService: ctx.eventService,\n                metrics: ctx.metrics,\n                logger: ctx.logger,\n                options: { gracePeriod: ctx.tokenRefreshGracePeriod },\n                certificateSource: ctx.certificateSource,\n            }),\n        };\n    }\n\n    // -------------------------------------------\n\n    @DGet('/introspect', [])\n    async getIntrospect(@DContext() event: IAppEvent): Promise<OAuth2TokenIntrospectionResponse> {\n        return this.postIntrospect(event);\n    }\n\n    @DPost('/introspect', [])\n    async postIntrospect(\n        @DContext() event: IAppEvent,\n    ): Promise<OAuth2TokenIntrospectionResponse> {\n        try {\n            const token = await extractTokenFromRequest(event);\n            const payload = await this.tokenVerifier.verify(token, { skipActiveCheck: true });\n            if (!payload.sub || !payload.sub_kind) {\n                throw OAuth2RequestError.identityInvalid();\n            }\n\n            // todo: only receive client specific permissions\n            const permissions = await this.identityPermissionProvider.getFor({\n                id: payload.sub,\n                type: payload.sub_kind,\n                clientId: payload.client_id,\n                realmId: payload.realm_id,\n            });\n\n            const identity = await this.identityResolver.resolve(payload.sub_kind, payload.sub);\n            if (!identity) {\n                // todo: differentiate between client, robot & user\n                throw OAuth2RequestError.identityInvalid();\n            }\n\n            const claimsBuilder = new OAuth2OpenIDClaimsBuilder();\n            const claims = claimsBuilder.fromIdentity(identity);\n\n            let active : boolean;\n            if (payload.jti) {\n                const isInactive = await this.tokenVerifier.isInactive(payload.jti);\n                active = !isInactive;\n            } else {\n                active = false;\n            }\n\n            return {\n                active,\n                // todo: permissions property should be removed.\n                permissions: Object.values(\n                    permissions.reduce((acc, binding) => {\n                        const key = buildPermissionKey(binding.permission);\n                        if (!acc[key]) {\n                            acc[key] = {\n                                name: binding.permission.name,\n                                client_id: binding.permission.client_id,\n                                realm_id: binding.permission.realm_id,\n                            } as OAuth2TokenPermission;\n                        }\n                        return acc;\n                    }, {} as Record<string, OAuth2TokenPermission>),\n                ),\n                ...payload,\n                ...claims,\n            };\n        } catch (e) {\n            throw toOAuth2Error(e);\n        }\n    }\n\n    // ----------------------------------------------------------\n\n    @DPost('/revoke', [])\n    async revokeToken(\n        @DContext() event: IAppEvent,\n    ): Promise<null> {\n        try {\n            const token = await extractTokenFromRequest(event);\n\n            // RFC 7009 §2.2: revoking an invalid token — here one that is expired\n            // or already inactive — MUST still succeed. The client cannot act on\n            // an error, and the token's invalidation (the point of the request)\n            // is already achieved. Signature + kind still anchor the token, so a\n            // forged/garbage token is rejected; `ignoreExpiry` additionally keeps\n            // this exp-bypass out of the shared claims cache (see\n            // OAuth2TokenVerifier). Without this, revoking a stale refresh token\n            // threw `expired_token`, so the caller's revoke-then-clear-cookie\n            // flow aborted, the durable row was never soft-revoked, and the stale\n            // refresh cookie survived into the next login.\n            const payload = await this.tokenVerifier.verify(token, {\n                ignoreExpiry: true,\n                skipActiveCheck: true,\n            });\n\n            await this.tokenRevoker.revoke(payload);\n\n            event.response.status = 202;\n            return null;\n        } catch (e) {\n            throw toOAuth2Error(e);\n        }\n    }\n\n    // ----------------------------------------------------------\n\n    @DPost('', [])\n    async createToken(@DContext() event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const grantType = await guessOauth2GrantTypeByRequest(event);\n        if (!grantType) {\n            throw OAuth2GrantTypeError.unsupported();\n        }\n\n        const grant = this.tokenGrants[grantType];\n        if (!grant) {\n            throw OAuth2GrantTypeError.unsupported();\n        }\n\n        const response = await grant.runWithRequest(event);\n\n        this.metrics?.recordTokenGrant(grantType);\n\n        return response;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAKC,SAAA,aAAA,YAAA,QAAA,KAAA,MAAA;;;;;;;;;;;;;;AAqCD,IAAakB,kBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAA6B;EACrC,KAAKR,qBAAqBQ,IAAIR;EAC9B,KAAKC,oBAAoBO,IAAIP;EAC7B,KAAKC,gBAAgBM,IAAIN;EACzB,KAAKC,eAAeK,IAAIL;EACxB,KAAKC,mBAAmBI,IAAIJ;EAC5B,KAAKC,6BAA6BG,IAAIH;EACtC,KAAKC,UAAUE,IAAIF;EAEnB,KAAKC,cAAc;IACdxB,iBAAiB0B,qBAAqB,IAAIhB,yBAAyB;IAChEiB,cAAcF,IAAIE;IAClBC,qBAAqBH,IAAII;IACzBX,mBAAmBO,IAAIP;IACvBD,oBAAoBQ,IAAIR;IACxBa,mBAAmBL,IAAIK;IACvBC,UAAUN,IAAIM;IACdC,gBAAgBP,IAAIO;IACpBC,iBAAiBR,IAAIQ;IACrBC,uBAAuBT,IAAIS;IAC3BC,mBAAmBV,IAAIU;GAC3B,CAAA;IACCnC,iBAAiBoC,qBAAqB,IAAI3B,2BAA2B;IAClES,mBAAmBO,IAAIP;IACvBU,qBAAqBH,IAAII;IACzBG,gBAAgBP,IAAIO;IACpBG,mBAAmBV,IAAIU;GAC3B,CAAA;IACCnC,iBAAiBqC,oBAAoB,IAAIxB,0BAA0B;IAChEK,mBAAmBO,IAAIP;IACvBoB,eAAeb,IAAIc;IACnBP,gBAAgBP,IAAIO;GACxB,CAAA;IACChC,iBAAiBwC,WAAW,IAAI5B,kBAAkB;IAC/CM,mBAAmBO,IAAIP;IACvBD,oBAAoBQ,IAAIR;IACxBqB,eAAeb,IAAIgB;IACnBb,qBAAqBH,IAAII;IACzBG,gBAAgBP,IAAIO;IACpBC,iBAAiBR,IAAIQ;IACrBS,cAAcjB,IAAIiB;IAClBnB,SAASE,IAAIF;IACboB,sBAAsBlB,IAAIkB;IAC1BC,0BAA0BnB,IAAImB;IAC9BC,iBAAiBpB,IAAIoB;IACrBC,QAAQrB,IAAIqB;IACZX,mBAAmBV,IAAIU;GAC3B,CAAA;IACCnC,iBAAiB+C,gBAAgB,IAAIpC,4BAA4B;IAC9DO,mBAAmBO,IAAIP;IACvBD,oBAAoBQ,IAAIR;IACxBE,eAAeM,IAAIN;IACnB6B,iBAAiBvB,IAAIuB;IACrBC,wBAAwBxB,IAAIwB;IAC5BjB,gBAAgBP,IAAIO;IACpBJ,qBAAqBH,IAAII;IACzBI,iBAAiBR,IAAIQ;IACrBS,cAAcjB,IAAIiB;IAClBnB,SAASE,IAAIF;IACbuB,QAAQrB,IAAIqB;IACZI,SAAS,EAAEC,aAAa1B,IAAI2B,wBAAwB;IACpDjB,mBAAmBV,IAAIU;GAC3B,CAAA;EACJ;CACJ;CAIA,MACMkB,cAAc,OAAyE;EACzF,OAAO,KAAKE,eAAeD,KAAAA;CAC/B;CAEA,MACMC,eACF,OACyC;EACzC,IAAI;GACA,MAAMC,QAAQ,MAAMzC,wBAAwBuC,KAAAA;GAC5C,MAAMG,UAAU,MAAM,KAAKtC,cAAcuC,OAAOF,OAAO,EAAEG,iBAAiB,KAAK,CAAA;GAC/E,IAAI,CAACF,QAAQG,OAAO,CAACH,QAAQI,UACzB,MAAM9D,mBAAmB+D,gBAAe;GAI5C,MAAMC,cAAc,MAAM,KAAKzC,2BAA2B0C,OAAO;IAC7DC,IAAIR,QAAQG;IACZM,MAAMT,QAAQI;IACdM,UAAUV,QAAQW;IAClBC,SAASZ,QAAQa;GACrB,CAAA;GAEA,MAAMC,WAAW,MAAM,KAAKlD,iBAAiBmD,QAAQf,QAAQI,UAAUJ,QAAQG,GAAG;GAClF,IAAI,CAACW,UAED,MAAMxE,mBAAmB+D,gBAAe;GAI5C,MAAMY,SAASD,IADWjE,0BACXiE,CAAAA,CAAcE,aAAaJ,QAAAA;GAE1C,IAAIK;GACJ,IAAInB,QAAQoB,KAERD,SAAS,CAACE,MADe,KAAK3D,cAAc2D,WAAWrB,QAAQoB,GAAG;QAGlED,SAAS;GAGb,OAAO;IACHA;IAEAb,aAAagB,OAAOC,OAChBjB,YAAYkB,QAAQC,KAAKC,YAAAA;KACrB,MAAMC,MAAM9E,mBAAmB6E,QAAQE,UAAU;KACjD,IAAI,CAACH,IAAIE,MACLF,IAAIE,OAAO;MACPE,MAAMH,QAAQE,WAAWC;MACzBlB,WAAWe,QAAQE,WAAWjB;MAC9BE,UAAUa,QAAQE,WAAWf;KACjC;KAEJ,OAAOY;IACX,GAAG,CAAC,CAAA,CAAA;IAER,GAAGzB;IACH,GAAGiB;GACP;EACJ,SAASa,GAAG;GACR,MAAMhF,cAAcgF,CAAAA;EACxB;CACJ;CAIA,MACMC,YACF,OACa;EACb,IAAI;GACA,MAAMhC,QAAQ,MAAMzC,wBAAwBuC,KAAAA;GAY5C,MAAMG,UAAU,MAAM,KAAKtC,cAAcuC,OAAOF,OAAO;IACnDiC,cAAc;IACd9B,iBAAiB;GACrB,CAAA;GAEA,MAAM,KAAKvC,aAAasE,OAAOjC,OAAAA;GAE/BH,MAAMqC,SAASC,SAAS;GACxB,OAAO;EACX,SAASL,GAAG;GACR,MAAMhF,cAAcgF,CAAAA;EACxB;CACJ;CAIA,MACMM,YAAY,OAAiE;EAC/E,MAAMC,YAAY,MAAMhF,8BAA8BwC,KAAAA;EACtD,IAAI,CAACwC,WACD,MAAMhG,qBAAqBiG,YAAW;EAG1C,MAAMC,QAAQ,KAAKxE,YAAYsE;EAC/B,IAAI,CAACE,OACD,MAAMlG,qBAAqBiG,YAAW;EAG1C,MAAMJ,WAAW,MAAMK,MAAMC,eAAe3C,KAAAA;EAE5C,KAAK/B,SAAS2E,iBAAiBJ,SAAAA;EAE/B,OAAOH;CACX;AACJ"}