@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.53

package/dist/core/oauth2/client/authenticator.mjs

@@ -3,33 +3,70 @@ import "node:url";
 import.meta.url;
 import { ClientCredentialsService } from "../../authentication/credential/entities/client/module.mjs";
 import "../../authentication/credential/index.mjs";
-import { IdentityType } from "@authup/core-kit";
+import { ClientAuthMethod, ClientTokenBindingMethod, IdentityType } from "@authup/core-kit";
+import { isValidationError } from "@authup/errors";
 import { OAuth2ClientError } from "@authup/specs";
 //#region src/core/oauth2/client/authenticator.ts
 /**
-* Authenticates a client at the OAuth2 token endpoint. Confidential clients
-* MUST present a valid client_secret (RFC 6749 §3.2.1, §4.1.3, §4.3.2, §6);
-* public clients identify via client_id only.
+* Authenticates a client at the OAuth2 token endpoint according to its
+* exclusive method: public id only, shared secret, or trusted TLS evidence.
 *
-* Used by authorization_code, refresh_token, and password grants.
+* Used by every standard client-resolving grant.
 */ var OAuth2ClientAuthenticator = class {
 	identityResolver;
 	credentialsService;
-	constructor(identityResolver) {
-		this.identityResolver = identityResolver;
+	certificateValidator;
+	constructor(ctx) {
+		if ("identityResolver" in ctx) {
+			this.identityResolver = ctx.identityResolver;
+			this.certificateValidator = ctx.certificateValidator;
+		} else this.identityResolver = ctx;
 		this.credentialsService = new ClientCredentialsService();
 	}
-	async authenticate(clientId, clientSecret, realmId) {
+	async authenticate(clientId, clientSecret, realmId, certificateEvidence) {
 		if (!clientId) throw OAuth2ClientError.invalid();
+		const client = await this.resolve(clientId, realmId);
+		switch (client.auth_method) {
+			case ClientAuthMethod.NONE:
+				if (typeof clientSecret === "string") throw OAuth2ClientError.invalid();
+				break;
+			case ClientAuthMethod.SECRET:
+				if (!clientSecret) throw OAuth2ClientError.invalid();
+				if (!await this.credentialsService.verify(clientSecret, client)) throw OAuth2ClientError.invalid();
+				break;
+			case ClientAuthMethod.TLS:
+				if (typeof clientSecret === "string" || !certificateEvidence || !this.certificateValidator) throw OAuth2ClientError.invalid();
+				try {
+					await this.certificateValidator.validateForAuthentication(client, certificateEvidence);
+				} catch (e) {
+					if (isValidationError(e)) throw OAuth2ClientError.invalid();
+					throw e;
+				}
+				break;
+			default: throw OAuth2ClientError.invalid();
+		}
+		return client;
+	}
+	async resolve(clientId, realmId) {
 		const identity = await this.identityResolver.resolve(IdentityType.CLIENT, clientId, realmId);
 		if (!identity || identity.type !== IdentityType.CLIENT) throw OAuth2ClientError.invalid();
 		if (!identity.data.active) throw OAuth2ClientError.inactive();
-		if (identity.data.is_confidential) {
-			if (!clientSecret) throw OAuth2ClientError.invalid();
-			if (!await this.credentialsService.verify(clientSecret, identity.data)) throw OAuth2ClientError.invalid();
-		}
 		return identity.data;
 	}
+	resolveTokenBinding(client, certificateEvidence) {
+		if (client.token_binding_method === ClientTokenBindingMethod.NONE) return;
+		if (client.token_binding_method !== ClientTokenBindingMethod.TLS) throw OAuth2ClientError.invalid();
+		return this.validateCertificateEvidenceForBinding(certificateEvidence);
+	}
+	validateCertificateEvidenceForBinding(certificateEvidence) {
+		if (!certificateEvidence || !this.certificateValidator) throw OAuth2ClientError.invalid();
+		try {
+			this.certificateValidator.validateForBinding(certificateEvidence);
+		} catch {
+			throw OAuth2ClientError.invalid();
+		}
+		return { "x5t#S256": certificateEvidence.thumbprint };
+	}
 };
 //#endregion
 export { OAuth2ClientAuthenticator };

package/dist/core/oauth2/client/authenticator.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"authenticator.mjs","names":["IdentityType","OAuth2ClientError","ClientCredentialsService","OAuth2ClientAuthenticator","identityResolver","credentialsService","authenticate","clientId","clientSecret","realmId","invalid","identity","resolve","CLIENT","type","data","active","inactive","is_confidential","verified","verify"],"sources":["../../../../src/core/oauth2/client/authenticator.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Client } from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { OAuth2ClientError } from '@authup/specs';\nimport { ClientCredentialsService } from '../../authentication/credential/index.ts';\nimport type { IIdentityResolver } from '../../identity/index.ts';\n\n/**\n * Authenticates a client at the OAuth2 token endpoint. Confidential clients\n * MUST present a valid client_secret (RFC 6749 §3.2.1, §4.1.3, §4.3.2, §6);\n * public clients identify via client_id only.\n *\n * Used by authorization_code, refresh_token, and password grants.\n */\nexport class OAuth2ClientAuthenticator {\n    protected identityResolver: IIdentityResolver;\n\n    protected credentialsService: ClientCredentialsService;\n\n    constructor(identityResolver: IIdentityResolver) {\n        this.identityResolver = identityResolver;\n        this.credentialsService = new ClientCredentialsService();\n    }\n\n    async authenticate(\n        clientId: string | undefined,\n        clientSecret?: string,\n        realmId?: string,\n    ): Promise<Client> {\n        if (!clientId) {\n            throw OAuth2ClientError.invalid();\n        }\n\n        const identity = await this.identityResolver.resolve(IdentityType.CLIENT, clientId, realmId);\n        if (!identity || identity.type !== IdentityType.CLIENT) {\n            throw OAuth2ClientError.invalid();\n        }\n\n        if (!identity.data.active) {\n            throw OAuth2ClientError.inactive();\n        }\n\n        if (identity.data.is_confidential) {\n            if (!clientSecret) {\n                throw OAuth2ClientError.invalid();\n            }\n\n            const verified = await this.credentialsService.verify(clientSecret, identity.data);\n            if (!verified) {\n                throw OAuth2ClientError.invalid();\n            }\n        }\n\n        return identity.data;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;GAoBA,IAAaG,4BAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,kBAAqC;EAC7C,KAAKA,mBAAmBA;EACxB,KAAKC,qBAAqB,IAAIH,yBAAAA;CAClC;CAEA,MAAMI,aACFC,UACAC,cACAC,SACe;EACf,IAAI,CAACF,UACD,MAAMN,kBAAkBS,QAAO;EAGnC,MAAMC,WAAW,MAAM,KAAKP,iBAAiBQ,QAAQZ,aAAaa,QAAQN,UAAUE,OAAAA;EACpF,IAAI,CAACE,YAAYA,SAASG,SAASd,aAAaa,QAC5C,MAAMZ,kBAAkBS,QAAO;EAGnC,IAAI,CAACC,SAASI,KAAKC,QACf,MAAMf,kBAAkBgB,SAAQ;EAGpC,IAAIN,SAASI,KAAKG,iBAAiB;GAC/B,IAAI,CAACV,cACD,MAAMP,kBAAkBS,QAAO;GAInC,IAAI,CAACS,MADkB,KAAKd,mBAAmBe,OAAOZ,cAAcG,SAASI,IAAI,GAE7E,MAAMd,kBAAkBS,QAAO;EAEvC;EAEA,OAAOC,SAASI;CACpB;AACJ"}
+{"version":3,"file":"authenticator.mjs","names":["ClientAuthMethod","ClientTokenBindingMethod","IdentityType","OAuth2ClientError","isValidationError","ClientCredentialsService","OAuth2ClientAuthenticator","identityResolver","credentialsService","certificateValidator","ctx","authenticate","clientId","clientSecret","realmId","certificateEvidence","invalid","client","resolve","auth_method","NONE","SECRET","verified","verify","TLS","validateForAuthentication","e","identity","CLIENT","type","data","active","inactive","resolveTokenBinding","token_binding_method","undefined","validateCertificateEvidenceForBinding","validateForBinding","thumbprint"],"sources":["../../../../src/core/oauth2/client/authenticator.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    type Client,\n    ClientAuthMethod,\n    ClientTokenBindingMethod,\n    IdentityType,\n} from '@authup/core-kit';\nimport type { OAuth2TokenConfirmation } from '@authup/specs';\nimport { OAuth2ClientError } from '@authup/specs';\nimport { isValidationError } from '@authup/errors';\nimport { ClientCredentialsService } from '../../authentication/credential/index.ts';\nimport type {\n    ClientCertificateEvidence,\n    IClientCertificateValidator,\n} from '../../client-certificate/index.ts';\nimport type { IIdentityResolver } from '../../identity/index.ts';\n\nexport type OAuth2ClientAuthenticatorContext = {\n    identityResolver: IIdentityResolver,\n    certificateValidator: IClientCertificateValidator,\n};\n\n/**\n * Authenticates a client at the OAuth2 token endpoint according to its\n * exclusive method: public id only, shared secret, or trusted TLS evidence.\n *\n * Used by every standard client-resolving grant.\n */\nexport class OAuth2ClientAuthenticator {\n    protected identityResolver: IIdentityResolver;\n\n    protected credentialsService: ClientCredentialsService;\n\n    protected certificateValidator?: IClientCertificateValidator;\n\n    constructor(ctx: IIdentityResolver | OAuth2ClientAuthenticatorContext) {\n        if ('identityResolver' in ctx) {\n            this.identityResolver = ctx.identityResolver;\n            this.certificateValidator = ctx.certificateValidator;\n        } else {\n            // Kept as a compatibility seam for focused secret/public-client\n            // unit tests. Production wiring always supplies the validator.\n            this.identityResolver = ctx;\n        }\n        this.credentialsService = new ClientCredentialsService();\n    }\n\n    async authenticate(\n        clientId: string | undefined,\n        clientSecret?: string,\n        realmId?: string,\n        certificateEvidence?: ClientCertificateEvidence,\n    ): Promise<Client> {\n        if (!clientId) {\n            throw OAuth2ClientError.invalid();\n        }\n\n        const client = await this.resolve(clientId, realmId);\n\n        switch (client.auth_method) {\n            case ClientAuthMethod.NONE:\n                if (typeof clientSecret === 'string') {\n                    throw OAuth2ClientError.invalid();\n                }\n                break;\n            case ClientAuthMethod.SECRET: {\n                if (!clientSecret) {\n                    throw OAuth2ClientError.invalid();\n                }\n\n                const verified = await this.credentialsService.verify(clientSecret, client);\n                if (!verified) {\n                    throw OAuth2ClientError.invalid();\n                }\n                break;\n            }\n            case ClientAuthMethod.TLS:\n                if (\n                    typeof clientSecret === 'string' ||\n                    !certificateEvidence ||\n                    !this.certificateValidator\n                ) {\n                    throw OAuth2ClientError.invalid();\n                }\n\n                try {\n                    await this.certificateValidator.validateForAuthentication(client, certificateEvidence);\n                } catch (e) {\n                    // A validation failure deliberately reveals neither the\n                    // certificate identity nor which realm anchor failed. An\n                    // infrastructure fault (e.g. the trust-anchor store being\n                    // unreachable) must NOT masquerade as a bad certificate —\n                    // let it surface as a server error instead.\n                    if (isValidationError(e)) {\n                        throw OAuth2ClientError.invalid();\n                    }\n                    throw e;\n                }\n                break;\n            default:\n                throw OAuth2ClientError.invalid();\n        }\n\n        return client;\n    }\n\n    async resolve(clientId: string, realmId?: string): Promise<Client> {\n        const identity = await this.identityResolver.resolve(IdentityType.CLIENT, clientId, realmId);\n        if (!identity || identity.type !== IdentityType.CLIENT) {\n            throw OAuth2ClientError.invalid();\n        }\n\n        if (!identity.data.active) {\n            throw OAuth2ClientError.inactive();\n        }\n\n        return identity.data;\n    }\n\n    resolveTokenBinding(\n        client: Pick<Client, 'token_binding_method'>,\n        certificateEvidence?: ClientCertificateEvidence,\n    ): OAuth2TokenConfirmation | undefined {\n        if (client.token_binding_method === ClientTokenBindingMethod.NONE) {\n            return undefined;\n        }\n\n        if (client.token_binding_method !== ClientTokenBindingMethod.TLS) {\n            throw OAuth2ClientError.invalid();\n        }\n\n        return this.validateCertificateEvidenceForBinding(certificateEvidence);\n    }\n\n    validateCertificateEvidenceForBinding(\n        certificateEvidence?: ClientCertificateEvidence,\n    ): OAuth2TokenConfirmation {\n        if (!certificateEvidence || !this.certificateValidator) {\n            throw OAuth2ClientError.invalid();\n        }\n\n        try {\n            this.certificateValidator.validateForBinding(certificateEvidence);\n        } catch {\n            throw OAuth2ClientError.invalid();\n        }\n\n        return { 'x5t#S256': certificateEvidence.thumbprint };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;GAkCA,IAAaM,4BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA2D;EACnE,IAAI,sBAAsBA,KAAK;GAC3B,KAAKH,mBAAmBG,IAAIH;GAC5B,KAAKE,uBAAuBC,IAAID;EACpC,OAGI,KAAKF,mBAAmBG;EAE5B,KAAKF,qBAAqB,IAAIH,yBAAAA;CAClC;CAEA,MAAMM,aACFC,UACAC,cACAC,SACAC,qBACe;EACf,IAAI,CAACH,UACD,MAAMT,kBAAkBa,QAAO;EAGnC,MAAMC,SAAS,MAAM,KAAKC,QAAQN,UAAUE,OAAAA;EAE5C,QAAQG,OAAOE,aAAf;GACI,KAAKnB,iBAAiBoB;IAClB,IAAI,OAAOP,iBAAiB,UACxB,MAAMV,kBAAkBa,QAAO;IAEnC;GACJ,KAAKhB,iBAAiBqB;IAClB,IAAI,CAACR,cACD,MAAMV,kBAAkBa,QAAO;IAInC,IAAI,CAACM,MADkB,KAAKd,mBAAmBe,OAAOV,cAAcI,MAAAA,GAEhE,MAAMd,kBAAkBa,QAAO;IAEnC;GAEJ,KAAKhB,iBAAiBwB;IAClB,IACI,OAAOX,iBAAiB,YACxB,CAACE,uBACD,CAAC,KAAKN,sBAEN,MAAMN,kBAAkBa,QAAO;IAGnC,IAAI;KACA,MAAM,KAAKP,qBAAqBgB,0BAA0BR,QAAQF,mBAAAA;IACtE,SAASW,GAAG;KAMR,IAAItB,kBAAkBsB,CAAAA,GAClB,MAAMvB,kBAAkBa,QAAO;KAEnC,MAAMU;IACV;IACA;GACJ,SACI,MAAMvB,kBAAkBa,QAAO;EACvC;EAEA,OAAOC;CACX;CAEA,MAAMC,QAAQN,UAAkBE,SAAmC;EAC/D,MAAMa,WAAW,MAAM,KAAKpB,iBAAiBW,QAAQhB,aAAa0B,QAAQhB,UAAUE,OAAAA;EACpF,IAAI,CAACa,YAAYA,SAASE,SAAS3B,aAAa0B,QAC5C,MAAMzB,kBAAkBa,QAAO;EAGnC,IAAI,CAACW,SAASG,KAAKC,QACf,MAAM5B,kBAAkB6B,SAAQ;EAGpC,OAAOL,SAASG;CACpB;CAEAG,oBACIhB,QACAF,qBACmC;EACnC,IAAIE,OAAOiB,yBAAyBjC,yBAAyBmB,MACzD;EAGJ,IAAIH,OAAOiB,yBAAyBjC,yBAAyBuB,KACzD,MAAMrB,kBAAkBa,QAAO;EAGnC,OAAO,KAAKoB,sCAAsCrB,mBAAAA;CACtD;CAEAqB,sCACIrB,qBACuB;EACvB,IAAI,CAACA,uBAAuB,CAAC,KAAKN,sBAC9B,MAAMN,kBAAkBa,QAAO;EAGnC,IAAI;GACA,KAAKP,qBAAqB4B,mBAAmBtB,mBAAAA;EACjD,QAAQ;GACJ,MAAMZ,kBAAkBa,QAAO;EACnC;EAEA,OAAO,EAAE,YAAYD,oBAAoBuB,WAAW;CACxD;AACJ"}

package/dist/core/oauth2/end-session/service.d.ts

@@ -1,5 +1,5 @@
 import type { OAuth2TokenPayload } from '@authup/specs';
-import type { IRealmRepository } from '../../entities/index.ts';
+import type { IEventService, IRealmRepository } from '../../entities/index.ts';
 import type { ISessionManager } from '../../authentication/index.ts';
 import type { IOAuth2ClientRepository } from '../client/index.ts';
 import type { IOAuth2TokenVerifier } from '../token/index.ts';
@@ -9,6 +9,7 @@ export declare class OAuth2EndSessionService implements IOAuth2EndSessionService
     protected sessionManager: ISessionManager;
     protected clientRepository: IOAuth2ClientRepository;
     protected realmRepository: IRealmRepository;
+    protected eventService?: IEventService;
     protected hintGracePeriod: number;
     constructor(ctx: OAuth2EndSessionServiceContext);
     verify(data: OAuth2EndSessionRequest): Promise<OAuth2EndSessionResult>;

package/dist/core/oauth2/end-session/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/end-session/service.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,KAAK,EACR,wBAAwB,EACxB,uBAAuB,EACvB,sBAAsB,EACtB,8BAA8B,EACjC,MAAM,YAAY,CAAC;AAEpB,qBAAa,uBAAwB,YAAW,wBAAwB;IACpE,SAAS,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAE9C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;IAEpD,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,eAAe,EAAE,MAAM,CAAC;gBAEtB,GAAG,EAAE,8BAA8B;IAQzC,MAAM,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IA+GtE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAe/E;;;;;OAKG;IACH,SAAS,CAAC,uBAAuB,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO;IAcvE;;;;OAIG;IACH,SAAS,CAAC,yBAAyB,CAC/B,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACrC,SAAS,EAAE,MAAM,GAClB,OAAO;CAkBb"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/end-session/service.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,KAAK,EACR,wBAAwB,EACxB,uBAAuB,EACvB,sBAAsB,EACtB,8BAA8B,EACjC,MAAM,YAAY,CAAC;AAEpB,qBAAa,uBAAwB,YAAW,wBAAwB;IACpE,SAAS,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAE9C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;IAEpD,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;IAEvC,SAAS,CAAC,eAAe,EAAE,MAAM,CAAC;gBAEtB,GAAG,EAAE,8BAA8B;IASzC,MAAM,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IA+GtE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA2B/E;;;;;OAKG;IACH,SAAS,CAAC,uBAAuB,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO;IAcvE;;;;OAIG;IACH,SAAS,CAAC,yBAAyB,CAC/B,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACrC,SAAS,EAAE,MAAM,GAClB,OAAO;CAkBb"}

package/dist/core/oauth2/end-session/service.mjs

@@ -2,6 +2,7 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { isSimpleMatch, isUUID } from "@authup/kit";
+import { EventName, EventRefType, EventScope } from "@authup/core-kit";
 import { OAuth2TokenKind } from "@authup/specs";
 //#region src/core/oauth2/end-session/service.ts
 var OAuth2EndSessionService = class {
@@ -9,12 +10,14 @@ var OAuth2EndSessionService = class {
 	sessionManager;
 	clientRepository;
 	realmRepository;
+	eventService;
 	hintGracePeriod;
 	constructor(ctx) {
 		this.tokenVerifier = ctx.tokenVerifier;
 		this.sessionManager = ctx.sessionManager;
 		this.clientRepository = ctx.clientRepository;
 		this.realmRepository = ctx.realmRepository;
+		this.eventService = ctx.eventService;
 		this.hintGracePeriod = ctx.hintGracePeriod ?? 0;
 	}
 	async verify(data) {
@@ -83,6 +86,16 @@ var OAuth2EndSessionService = class {
 		if (!session) return false;
 		if (session.sub !== sub || session.sub_kind !== subKind) return false;
 		await this.sessionManager.revoke(sessionId);
+		await this.eventService?.record({
+			scope: EventScope.OAUTH2,
+			name: EventName.LOGOUT,
+			refType: EventRefType.SESSION,
+			refId: sessionId,
+			actorType: session.sub_kind,
+			actorId: session.sub,
+			realmId: session.realm_id,
+			data: { revoked_session_id: sessionId }
+		});
 		return true;
 	}
 	/**

package/dist/core/oauth2/end-session/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["isSimpleMatch","isUUID","OAuth2TokenKind","OAuth2EndSessionService","tokenVerifier","sessionManager","clientRepository","realmRepository","hintGracePeriod","ctx","verify","data","hintVerified","sub","subKind","sessionId","hintRealmId","audiences","id_token_hint","payload","ignoreExpiry","skipActiveCheck","kind","ID_TOKEN","isWithinHintGraceWindow","sub_kind","sid","session_id","undefined","realm_id","aud","Array","isArray","filter","entry","clientId","client_id","length","client","realmKey","realm_name","realm","resolve","findOneByIdOrName","id","expected","includes","clientName","redirectUri","name","post_logout_redirect_uri","isValidPostLogoutRedirect","state","revoke","session","findOneById","exp","nowSeconds","Math","floor","Date","now","registered","candidate","parsed","URL","protocol","split"],"sources":["../../../../src/core/oauth2/end-session/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isSimpleMatch, isUUID } from '@authup/kit';\nimport type { Client } from '@authup/core-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IRealmRepository } from '../../entities/index.ts';\nimport type { ISessionManager } from '../../authentication/index.ts';\nimport type { IOAuth2ClientRepository } from '../client/index.ts';\nimport type { IOAuth2TokenVerifier } from '../token/index.ts';\nimport type {\n    IOAuth2EndSessionService,\n    OAuth2EndSessionRequest,\n    OAuth2EndSessionResult,\n    OAuth2EndSessionServiceContext,\n} from './types.ts';\n\nexport class OAuth2EndSessionService implements IOAuth2EndSessionService {\n    protected tokenVerifier: IOAuth2TokenVerifier;\n\n    protected sessionManager: ISessionManager;\n\n    protected clientRepository: IOAuth2ClientRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected hintGracePeriod: number;\n\n    constructor(ctx: OAuth2EndSessionServiceContext) {\n        this.tokenVerifier = ctx.tokenVerifier;\n        this.sessionManager = ctx.sessionManager;\n        this.clientRepository = ctx.clientRepository;\n        this.realmRepository = ctx.realmRepository;\n        this.hintGracePeriod = ctx.hintGracePeriod ?? 0;\n    }\n\n    async verify(data: OAuth2EndSessionRequest): Promise<OAuth2EndSessionResult> {\n        let hintVerified = false;\n        let sub: string | undefined;\n        let subKind: string | undefined;\n        let sessionId: string | undefined;\n        let hintRealmId: string | undefined;\n        let audiences: string[] = [];\n\n        if (data.id_token_hint) {\n            try {\n                // Signature + kind are the anchors; exp is skipped (a logout hint\n                // is routinely expired) and the cache blocklist is irrelevant.\n                const payload = await this.tokenVerifier.verify(data.id_token_hint, {\n                    ignoreExpiry: true,\n                    skipActiveCheck: true,\n                });\n\n                // MUST be an id_token — access/refresh tokens also carry\n                // session_id, so accepting them would let a leaked access token\n                // act as a logout weapon.\n                if (payload.kind === OAuth2TokenKind.ID_TOKEN && this.isWithinHintGraceWindow(payload)) {\n                    hintVerified = true;\n                    sub = payload.sub;\n                    subKind = payload.sub_kind;\n                    sessionId = payload.sid ?? payload.session_id ?? undefined;\n                    hintRealmId = payload.realm_id ?? undefined;\n                    // aud may be a single string or an array (JWT spec).\n                    const { aud } = payload;\n                    if (Array.isArray(aud)) {\n                        audiences = aud.filter((entry): entry is string => typeof entry === 'string');\n                    } else if (typeof aud === 'string') {\n                        audiences = [aud];\n                    }\n                }\n            } catch {\n                // forged / unverifiable hint → stays unverified (no revoke)\n            }\n        }\n\n        // Resolve a single client for the aud cross-check and redirect\n        // validation: the request's client_id, else the hint's sole audience\n        // (ambiguous for a multi-aud hint).\n        const clientId = data.client_id ?? (audiences.length === 1 ? audiences[0] : undefined);\n\n        let client: Client | null = null;\n        if (clientId) {\n            // Scope a name-identified client to the request's realm hint; a\n            // VERIFIED hint's own realm claim serves as fallback (claims from an\n            // unverified hint are never trusted). No master fallback here\n            // (unlike /token): a bogus hint must NOT silently resolve a\n            // same-named client in master → null realm.\n            const realmKey = data.realm_id ?? data.realm_name ?? (hintVerified ? hintRealmId : undefined);\n            const realm = await this.realmRepository.resolve(realmKey, false);\n\n            // Fail closed instead of dropping the realm predicate: a supplied\n            // realm key that does not resolve never degrades to an unscoped\n            // lookup, and a NAME-form client_id without any realm key is\n            // ambiguous (every realm has a built-in `web` client — same rule as\n            // the /authorize verifier). A UUID is globally unique and needs no\n            // scope; the sole-aud-derived clientId is always a UUID.\n            if (realm) {\n                client = await this.clientRepository.findOneByIdOrName(clientId, realm.id);\n            } else if (!realmKey && isUUID(clientId)) {\n                client = await this.clientRepository.findOneByIdOrName(clientId);\n            }\n        }\n\n        // aud/client_id cross-check: when the request supplies a client_id on a\n        // verified hint, it MUST denote one of the hint's audiences. The aud is\n        // the client UUID, so a name-form client_id is compared via its resolved\n        // client's id. Fail closed: an aud-less hint, or a name that did not\n        // resolve, counts as unverified.\n        if (hintVerified && data.client_id) {\n            const expected = isUUID(data.client_id) ? data.client_id : client?.id;\n            if (audiences.length === 0 || !expected || !audiences.includes(expected)) {\n                hintVerified = false;\n                sub = undefined;\n                subKind = undefined;\n                sessionId = undefined;\n            }\n        }\n\n        let clientName: string | undefined;\n        let redirectUri: string | undefined;\n\n        // Redirect validation is independent of hint verification — the\n        // click-gated confirm page (unverified hint / hint-less request) still\n        // honors a registered post-logout redirect.\n        if (client) {\n            clientName = client.name;\n            if (\n                data.post_logout_redirect_uri &&\n                this.isValidPostLogoutRedirect(client.post_logout_redirect_uri, data.post_logout_redirect_uri)\n            ) {\n                redirectUri = data.post_logout_redirect_uri;\n            }\n        }\n\n        return {\n            hintVerified,\n            ...(hintVerified ? {\n                sub,\n                subKind,\n                sessionId,\n            } : {}),\n            ...(clientId ? { clientId } : {}),\n            ...(clientName ? { clientName } : {}),\n            ...(redirectUri ? { redirectUri, ...(data.state ? { state: data.state } : {}) } : {}),\n        };\n    }\n\n    async revoke(sessionId: string, sub: string, subKind: string): Promise<boolean> {\n        const session = await this.sessionManager.findOneById(sessionId);\n        if (!session) {\n            return false;\n        }\n\n        // Never revoke a session that does not belong to the hint's subject.\n        if (session.sub !== sub || session.sub_kind !== subKind) {\n            return false;\n        }\n\n        await this.sessionManager.revoke(sessionId);\n        return true;\n    }\n\n    /**\n     * With a positive `hintGracePeriod`, an expired hint is honored only within\n     * the window past `exp` — beyond it a leaked id_token stops being a\n     * replayable remote logout (the hint counts as unverified; the click-gated\n     * confirm page still works). 0 keeps spec/Keycloak parity: any expired hint.\n     */\n    protected isWithinHintGraceWindow(payload: OAuth2TokenPayload): boolean {\n        if (this.hintGracePeriod <= 0) {\n            return true;\n        }\n\n        // a bounded window without an exp claim to judge against fails closed\n        if (typeof payload.exp !== 'number') {\n            return false;\n        }\n\n        const nowSeconds = Math.floor(Date.now() / 1000);\n        return nowSeconds - payload.exp <= this.hintGracePeriod;\n    }\n\n    /**\n     * A post-logout redirect is honored only when it is an absolute http(s) URL\n     * that matches a registered client redirect pattern (defense against open\n     * redirects to attacker-controlled URLs).\n     */\n    protected isValidPostLogoutRedirect(\n        registered: string | null | undefined,\n        candidate: string,\n    ): boolean {\n        let parsed: URL;\n        try {\n            parsed = new URL(candidate);\n        } catch {\n            return false;\n        }\n\n        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {\n            return false;\n        }\n\n        if (!registered) {\n            return false;\n        }\n\n        return isSimpleMatch(candidate, registered.split(','));\n    }\n}\n"],"mappings":";;;;;;AAsBA,IAAaG,0BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,KAAKL,gBAAgBK,IAAIL;EACzB,KAAKC,iBAAiBI,IAAIJ;EAC1B,KAAKC,mBAAmBG,IAAIH;EAC5B,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,kBAAkBC,IAAID,mBAAmB;CAClD;CAEA,MAAME,OAAOC,MAAgE;EACzE,IAAIC,eAAe;EACnB,IAAIC;EACJ,IAAIC;EACJ,IAAIC;EACJ,IAAIC;EACJ,IAAIC,YAAsB,CAAA;EAE1B,IAAIN,KAAKO,eACL,IAAI;GAGA,MAAMC,UAAU,MAAM,KAAKf,cAAcM,OAAOC,KAAKO,eAAe;IAChEE,cAAc;IACdC,iBAAiB;GACrB,CAAA;GAKA,IAAIF,QAAQG,SAASpB,gBAAgBqB,YAAY,KAAKC,wBAAwBL,OAAAA,GAAU;IACpFP,eAAe;IACfC,MAAMM,QAAQN;IACdC,UAAUK,QAAQM;IAClBV,YAAYI,QAAQO,OAAOP,QAAQQ,cAAcC,KAAAA;IACjDZ,cAAcG,QAAQU,YAAYD,KAAAA;IAElC,MAAM,EAAEE,QAAQX;IAChB,IAAIY,MAAMC,QAAQF,GAAAA,GACdb,YAAYa,IAAIG,QAAQC,UAA2B,OAAOA,UAAU,QAAA;SACjE,IAAI,OAAOJ,QAAQ,UACtBb,YAAY,CAACa,GAAAA;GAErB;EACJ,QAAQ,CAER;EAMJ,MAAMK,WAAWxB,KAAKyB,cAAcnB,UAAUoB,WAAW,IAAIpB,UAAU,KAAKW,KAAAA;EAE5E,IAAIU,SAAwB;EAC5B,IAAIH,UAAU;GAMV,MAAMI,WAAW5B,KAAKkB,YAAYlB,KAAK6B,eAAe5B,eAAeI,cAAcY,KAAAA;GACnF,MAAMa,QAAQ,MAAM,KAAKlC,gBAAgBmC,QAAQH,UAAU,KAAA;GAQ3D,IAAIE,OACAH,SAAS,MAAM,KAAKhC,iBAAiBqC,kBAAkBR,UAAUM,MAAMG,EAAE;QACtE,IAAI,CAACL,YAAYtC,OAAOkC,QAAAA,GAC3BG,SAAS,MAAM,KAAKhC,iBAAiBqC,kBAAkBR,QAAAA;EAE/D;EAOA,IAAIvB,gBAAgBD,KAAKyB,WAAW;GAChC,MAAMS,WAAW5C,OAAOU,KAAKyB,SAAS,IAAIzB,KAAKyB,YAAYE,QAAQM;GACnE,IAAI3B,UAAUoB,WAAW,KAAK,CAACQ,YAAY,CAAC5B,UAAU6B,SAASD,QAAAA,GAAW;IACtEjC,eAAe;IACfC,MAAMe,KAAAA;IACNd,UAAUc,KAAAA;IACVb,YAAYa,KAAAA;GAChB;EACJ;EAEA,IAAImB;EACJ,IAAIC;EAKJ,IAAIV,QAAQ;GACRS,aAAaT,OAAOW;GACpB,IACItC,KAAKuC,4BACL,KAAKC,0BAA0Bb,OAAOY,0BAA0BvC,KAAKuC,wBAAwB,GAE7FF,cAAcrC,KAAKuC;EAE3B;EAEA,OAAO;GACHtC;GACA,GAAIA,eAAe;IACfC;IACAC;IACAC;GACJ,IAAI,CAAC;GACL,GAAIoB,WAAW,EAAEA,SAAS,IAAI,CAAC;GAC/B,GAAIY,aAAa,EAAEA,WAAW,IAAI,CAAC;GACnC,GAAIC,cAAc;IAAEA;IAAa,GAAIrC,KAAKyC,QAAQ,EAAEA,OAAOzC,KAAKyC,MAAM,IAAI,CAAC;GAAG,IAAI,CAAC;EACvF;CACJ;CAEA,MAAMC,OAAOtC,WAAmBF,KAAaC,SAAmC;EAC5E,MAAMwC,UAAU,MAAM,KAAKjD,eAAekD,YAAYxC,SAAAA;EACtD,IAAI,CAACuC,SACD,OAAO;EAIX,IAAIA,QAAQzC,QAAQA,OAAOyC,QAAQ7B,aAAaX,SAC5C,OAAO;EAGX,MAAM,KAAKT,eAAegD,OAAOtC,SAAAA;EACjC,OAAO;CACX;;;;;;IAQA,wBAAkCI,SAAsC;EACpE,IAAI,KAAKX,mBAAmB,GACxB,OAAO;EAIX,IAAI,OAAOW,QAAQqC,QAAQ,UACvB,OAAO;EAIX,OADmBE,KAAKC,MAAMC,KAAKC,IAAG,IAAK,GACpCJ,IAAatC,QAAQqC,OAAO,KAAKhD;CAC5C;;;;;IAOA,0BACIsD,YACAC,WACO;EACP,IAAIC;EACJ,IAAI;GACAA,SAAS,IAAIC,IAAIF,SAAAA;EACrB,QAAQ;GACJ,OAAO;EACX;EAEA,IAAIC,OAAOE,aAAa,WAAWF,OAAOE,aAAa,UACnD,OAAO;EAGX,IAAI,CAACJ,YACD,OAAO;EAGX,OAAO9D,cAAc+D,WAAWD,WAAWK,MAAM,GAAA,CAAA;CACrD;AACJ"}
+{"version":3,"file":"service.mjs","names":["isSimpleMatch","isUUID","EventName","EventRefType","EventScope","OAuth2TokenKind","OAuth2EndSessionService","tokenVerifier","sessionManager","clientRepository","realmRepository","eventService","hintGracePeriod","ctx","verify","data","hintVerified","sub","subKind","sessionId","hintRealmId","audiences","id_token_hint","payload","ignoreExpiry","skipActiveCheck","kind","ID_TOKEN","isWithinHintGraceWindow","sub_kind","sid","session_id","undefined","realm_id","aud","Array","isArray","filter","entry","clientId","client_id","length","client","realmKey","realm_name","realm","resolve","findOneByIdOrName","id","expected","includes","clientName","redirectUri","name","post_logout_redirect_uri","isValidPostLogoutRedirect","state","revoke","session","findOneById","record","scope","OAUTH2","LOGOUT","refType","SESSION","refId","actorType","actorId","realmId","revoked_session_id","exp","nowSeconds","Math","floor","Date","now","registered","candidate","parsed","URL","protocol","split"],"sources":["../../../../src/core/oauth2/end-session/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isSimpleMatch, isUUID } from '@authup/kit';\nimport type { Client, IdentityType } from '@authup/core-kit';\nimport { EventName, EventRefType, EventScope } from '@authup/core-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IEventService, IRealmRepository } from '../../entities/index.ts';\nimport type { ISessionManager } from '../../authentication/index.ts';\nimport type { IOAuth2ClientRepository } from '../client/index.ts';\nimport type { IOAuth2TokenVerifier } from '../token/index.ts';\nimport type {\n    IOAuth2EndSessionService,\n    OAuth2EndSessionRequest,\n    OAuth2EndSessionResult,\n    OAuth2EndSessionServiceContext,\n} from './types.ts';\n\nexport class OAuth2EndSessionService implements IOAuth2EndSessionService {\n    protected tokenVerifier: IOAuth2TokenVerifier;\n\n    protected sessionManager: ISessionManager;\n\n    protected clientRepository: IOAuth2ClientRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected eventService?: IEventService;\n\n    protected hintGracePeriod: number;\n\n    constructor(ctx: OAuth2EndSessionServiceContext) {\n        this.tokenVerifier = ctx.tokenVerifier;\n        this.sessionManager = ctx.sessionManager;\n        this.clientRepository = ctx.clientRepository;\n        this.realmRepository = ctx.realmRepository;\n        this.eventService = ctx.eventService;\n        this.hintGracePeriod = ctx.hintGracePeriod ?? 0;\n    }\n\n    async verify(data: OAuth2EndSessionRequest): Promise<OAuth2EndSessionResult> {\n        let hintVerified = false;\n        let sub: string | undefined;\n        let subKind: string | undefined;\n        let sessionId: string | undefined;\n        let hintRealmId: string | undefined;\n        let audiences: string[] = [];\n\n        if (data.id_token_hint) {\n            try {\n                // Signature + kind are the anchors; exp is skipped (a logout hint\n                // is routinely expired) and the cache blocklist is irrelevant.\n                const payload = await this.tokenVerifier.verify(data.id_token_hint, {\n                    ignoreExpiry: true,\n                    skipActiveCheck: true,\n                });\n\n                // MUST be an id_token — access/refresh tokens also carry\n                // session_id, so accepting them would let a leaked access token\n                // act as a logout weapon.\n                if (payload.kind === OAuth2TokenKind.ID_TOKEN && this.isWithinHintGraceWindow(payload)) {\n                    hintVerified = true;\n                    sub = payload.sub;\n                    subKind = payload.sub_kind;\n                    sessionId = payload.sid ?? payload.session_id ?? undefined;\n                    hintRealmId = payload.realm_id ?? undefined;\n                    // aud may be a single string or an array (JWT spec).\n                    const { aud } = payload;\n                    if (Array.isArray(aud)) {\n                        audiences = aud.filter((entry): entry is string => typeof entry === 'string');\n                    } else if (typeof aud === 'string') {\n                        audiences = [aud];\n                    }\n                }\n            } catch {\n                // forged / unverifiable hint → stays unverified (no revoke)\n            }\n        }\n\n        // Resolve a single client for the aud cross-check and redirect\n        // validation: the request's client_id, else the hint's sole audience\n        // (ambiguous for a multi-aud hint).\n        const clientId = data.client_id ?? (audiences.length === 1 ? audiences[0] : undefined);\n\n        let client: Client | null = null;\n        if (clientId) {\n            // Scope a name-identified client to the request's realm hint; a\n            // VERIFIED hint's own realm claim serves as fallback (claims from an\n            // unverified hint are never trusted). No master fallback here\n            // (unlike /token): a bogus hint must NOT silently resolve a\n            // same-named client in master → null realm.\n            const realmKey = data.realm_id ?? data.realm_name ?? (hintVerified ? hintRealmId : undefined);\n            const realm = await this.realmRepository.resolve(realmKey, false);\n\n            // Fail closed instead of dropping the realm predicate: a supplied\n            // realm key that does not resolve never degrades to an unscoped\n            // lookup, and a NAME-form client_id without any realm key is\n            // ambiguous (every realm has a built-in `web` client — same rule as\n            // the /authorize verifier). A UUID is globally unique and needs no\n            // scope; the sole-aud-derived clientId is always a UUID.\n            if (realm) {\n                client = await this.clientRepository.findOneByIdOrName(clientId, realm.id);\n            } else if (!realmKey && isUUID(clientId)) {\n                client = await this.clientRepository.findOneByIdOrName(clientId);\n            }\n        }\n\n        // aud/client_id cross-check: when the request supplies a client_id on a\n        // verified hint, it MUST denote one of the hint's audiences. The aud is\n        // the client UUID, so a name-form client_id is compared via its resolved\n        // client's id. Fail closed: an aud-less hint, or a name that did not\n        // resolve, counts as unverified.\n        if (hintVerified && data.client_id) {\n            const expected = isUUID(data.client_id) ? data.client_id : client?.id;\n            if (audiences.length === 0 || !expected || !audiences.includes(expected)) {\n                hintVerified = false;\n                sub = undefined;\n                subKind = undefined;\n                sessionId = undefined;\n            }\n        }\n\n        let clientName: string | undefined;\n        let redirectUri: string | undefined;\n\n        // Redirect validation is independent of hint verification — the\n        // click-gated confirm page (unverified hint / hint-less request) still\n        // honors a registered post-logout redirect.\n        if (client) {\n            clientName = client.name;\n            if (\n                data.post_logout_redirect_uri &&\n                this.isValidPostLogoutRedirect(client.post_logout_redirect_uri, data.post_logout_redirect_uri)\n            ) {\n                redirectUri = data.post_logout_redirect_uri;\n            }\n        }\n\n        return {\n            hintVerified,\n            ...(hintVerified ? {\n                sub,\n                subKind,\n                sessionId,\n            } : {}),\n            ...(clientId ? { clientId } : {}),\n            ...(clientName ? { clientName } : {}),\n            ...(redirectUri ? { redirectUri, ...(data.state ? { state: data.state } : {}) } : {}),\n        };\n    }\n\n    async revoke(sessionId: string, sub: string, subKind: string): Promise<boolean> {\n        const session = await this.sessionManager.findOneById(sessionId);\n        if (!session) {\n            return false;\n        }\n\n        // Never revoke a session that does not belong to the hint's subject.\n        if (session.sub !== sub || session.sub_kind !== subKind) {\n            return false;\n        }\n\n        await this.sessionManager.revoke(sessionId);\n\n        await this.eventService?.record({\n            scope: EventScope.OAUTH2,\n            name: EventName.LOGOUT,\n            refType: EventRefType.SESSION,\n            refId: sessionId,\n            actorType: session.sub_kind as `${IdentityType}`,\n            actorId: session.sub,\n            realmId: session.realm_id,\n            data: { revoked_session_id: sessionId },\n        });\n\n        return true;\n    }\n\n    /**\n     * With a positive `hintGracePeriod`, an expired hint is honored only within\n     * the window past `exp` — beyond it a leaked id_token stops being a\n     * replayable remote logout (the hint counts as unverified; the click-gated\n     * confirm page still works). 0 keeps spec/Keycloak parity: any expired hint.\n     */\n    protected isWithinHintGraceWindow(payload: OAuth2TokenPayload): boolean {\n        if (this.hintGracePeriod <= 0) {\n            return true;\n        }\n\n        // a bounded window without an exp claim to judge against fails closed\n        if (typeof payload.exp !== 'number') {\n            return false;\n        }\n\n        const nowSeconds = Math.floor(Date.now() / 1000);\n        return nowSeconds - payload.exp <= this.hintGracePeriod;\n    }\n\n    /**\n     * A post-logout redirect is honored only when it is an absolute http(s) URL\n     * that matches a registered client redirect pattern (defense against open\n     * redirects to attacker-controlled URLs).\n     */\n    protected isValidPostLogoutRedirect(\n        registered: string | null | undefined,\n        candidate: string,\n    ): boolean {\n        let parsed: URL;\n        try {\n            parsed = new URL(candidate);\n        } catch {\n            return false;\n        }\n\n        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {\n            return false;\n        }\n\n        if (!registered) {\n            return false;\n        }\n\n        return isSimpleMatch(candidate, registered.split(','));\n    }\n}\n"],"mappings":";;;;;;;AAuBA,IAAaM,0BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,KAAKN,gBAAgBM,IAAIN;EACzB,KAAKC,iBAAiBK,IAAIL;EAC1B,KAAKC,mBAAmBI,IAAIJ;EAC5B,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,eAAeE,IAAIF;EACxB,KAAKC,kBAAkBC,IAAID,mBAAmB;CAClD;CAEA,MAAME,OAAOC,MAAgE;EACzE,IAAIC,eAAe;EACnB,IAAIC;EACJ,IAAIC;EACJ,IAAIC;EACJ,IAAIC;EACJ,IAAIC,YAAsB,CAAA;EAE1B,IAAIN,KAAKO,eACL,IAAI;GAGA,MAAMC,UAAU,MAAM,KAAKhB,cAAcO,OAAOC,KAAKO,eAAe;IAChEE,cAAc;IACdC,iBAAiB;GACrB,CAAA;GAKA,IAAIF,QAAQG,SAASrB,gBAAgBsB,YAAY,KAAKC,wBAAwBL,OAAAA,GAAU;IACpFP,eAAe;IACfC,MAAMM,QAAQN;IACdC,UAAUK,QAAQM;IAClBV,YAAYI,QAAQO,OAAOP,QAAQQ,cAAcC,KAAAA;IACjDZ,cAAcG,QAAQU,YAAYD,KAAAA;IAElC,MAAM,EAAEE,QAAQX;IAChB,IAAIY,MAAMC,QAAQF,GAAAA,GACdb,YAAYa,IAAIG,QAAQC,UAA2B,OAAOA,UAAU,QAAA;SACjE,IAAI,OAAOJ,QAAQ,UACtBb,YAAY,CAACa,GAAAA;GAErB;EACJ,QAAQ,CAER;EAMJ,MAAMK,WAAWxB,KAAKyB,cAAcnB,UAAUoB,WAAW,IAAIpB,UAAU,KAAKW,KAAAA;EAE5E,IAAIU,SAAwB;EAC5B,IAAIH,UAAU;GAMV,MAAMI,WAAW5B,KAAKkB,YAAYlB,KAAK6B,eAAe5B,eAAeI,cAAcY,KAAAA;GACnF,MAAMa,QAAQ,MAAM,KAAKnC,gBAAgBoC,QAAQH,UAAU,KAAA;GAQ3D,IAAIE,OACAH,SAAS,MAAM,KAAKjC,iBAAiBsC,kBAAkBR,UAAUM,MAAMG,EAAE;QACtE,IAAI,CAACL,YAAY1C,OAAOsC,QAAAA,GAC3BG,SAAS,MAAM,KAAKjC,iBAAiBsC,kBAAkBR,QAAAA;EAE/D;EAOA,IAAIvB,gBAAgBD,KAAKyB,WAAW;GAChC,MAAMS,WAAWhD,OAAOc,KAAKyB,SAAS,IAAIzB,KAAKyB,YAAYE,QAAQM;GACnE,IAAI3B,UAAUoB,WAAW,KAAK,CAACQ,YAAY,CAAC5B,UAAU6B,SAASD,QAAAA,GAAW;IACtEjC,eAAe;IACfC,MAAMe,KAAAA;IACNd,UAAUc,KAAAA;IACVb,YAAYa,KAAAA;GAChB;EACJ;EAEA,IAAImB;EACJ,IAAIC;EAKJ,IAAIV,QAAQ;GACRS,aAAaT,OAAOW;GACpB,IACItC,KAAKuC,4BACL,KAAKC,0BAA0Bb,OAAOY,0BAA0BvC,KAAKuC,wBAAwB,GAE7FF,cAAcrC,KAAKuC;EAE3B;EAEA,OAAO;GACHtC;GACA,GAAIA,eAAe;IACfC;IACAC;IACAC;GACJ,IAAI,CAAC;GACL,GAAIoB,WAAW,EAAEA,SAAS,IAAI,CAAC;GAC/B,GAAIY,aAAa,EAAEA,WAAW,IAAI,CAAC;GACnC,GAAIC,cAAc;IAAEA;IAAa,GAAIrC,KAAKyC,QAAQ,EAAEA,OAAOzC,KAAKyC,MAAM,IAAI,CAAC;GAAG,IAAI,CAAC;EACvF;CACJ;CAEA,MAAMC,OAAOtC,WAAmBF,KAAaC,SAAmC;EAC5E,MAAMwC,UAAU,MAAM,KAAKlD,eAAemD,YAAYxC,SAAAA;EACtD,IAAI,CAACuC,SACD,OAAO;EAIX,IAAIA,QAAQzC,QAAQA,OAAOyC,QAAQ7B,aAAaX,SAC5C,OAAO;EAGX,MAAM,KAAKV,eAAeiD,OAAOtC,SAAAA;EAEjC,MAAM,KAAKR,cAAciD,OAAO;GAC5BC,OAAOzD,WAAW0D;GAClBT,MAAMnD,UAAU6D;GAChBC,SAAS7D,aAAa8D;GACtBC,OAAO/C;GACPgD,WAAWT,QAAQ7B;GACnBuC,SAASV,QAAQzC;GACjBoD,SAASX,QAAQzB;GACjBlB,MAAM,EAAEuD,oBAAoBnD,UAAU;EAC1C,CAAA;EAEA,OAAO;CACX;;;;;;IAQA,wBAAkCI,SAAsC;EACpE,IAAI,KAAKX,mBAAmB,GACxB,OAAO;EAIX,IAAI,OAAOW,QAAQgD,QAAQ,UACvB,OAAO;EAIX,OADmBE,KAAKC,MAAMC,KAAKC,IAAG,IAAK,GACpCJ,IAAajD,QAAQgD,OAAO,KAAK3D;CAC5C;;;;;IAOA,0BACIiE,YACAC,WACO;EACP,IAAIC;EACJ,IAAI;GACAA,SAAS,IAAIC,IAAIF,SAAAA;EACrB,QAAQ;GACJ,OAAO;EACX;EAEA,IAAIC,OAAOE,aAAa,WAAWF,OAAOE,aAAa,UACnD,OAAO;EAGX,IAAI,CAACJ,YACD,OAAO;EAGX,OAAO7E,cAAc8E,WAAWD,WAAWK,MAAM,GAAA,CAAA;CACrD;AACJ"}

package/dist/core/oauth2/end-session/types.d.ts

@@ -1,4 +1,4 @@
-import type { IRealmRepository } from '../../entities/index.ts';
+import type { IEventService, IRealmRepository } from '../../entities/index.ts';
 import type { ISessionManager } from '../../authentication/index.ts';
 import type { IOAuth2ClientRepository } from '../client/index.ts';
 import type { IOAuth2TokenVerifier } from '../token/index.ts';
@@ -33,6 +33,7 @@ export type OAuth2EndSessionServiceContext = {
     sessionManager: ISessionManager;
     clientRepository: IOAuth2ClientRepository;
     realmRepository: IRealmRepository;
+    eventService?: IEventService;
     /**
      * Seconds past its `exp` an (expired) id_token_hint is still accepted for
      * a server-side revoke (config `endSessionHintGracePeriod`).

package/dist/core/oauth2/end-session/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/end-session/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAE9D,MAAM,MAAM,uBAAuB,GAAG;IAClC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACjC;;;OAGG;IACH,YAAY,EAAE,OAAO,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IACzC,aAAa,EAAE,oBAAoB,CAAC;IACpC,cAAc,EAAE,eAAe,CAAC;IAChC,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,eAAe,EAAE,gBAAgB,CAAC;IAClC;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,MAAM,WAAW,wBAAwB;IACrC;;;OAGG;IACH,MAAM,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAEvE;;;OAGG;IACH,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7E"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/end-session/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAE9D,MAAM,MAAM,uBAAuB,GAAG;IAClC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACjC;;;OAGG;IACH,YAAY,EAAE,OAAO,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IACzC,aAAa,EAAE,oBAAoB,CAAC;IACpC,cAAc,EAAE,eAAe,CAAC;IAChC,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,eAAe,EAAE,gBAAgB,CAAC;IAClC,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,MAAM,WAAW,wBAAwB;IACrC;;;OAGG;IACH,MAAM,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAEvE;;;OAGG;IACH,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7E"}

package/dist/core/oauth2/grant-types/authorize.d.ts

@@ -1,13 +1,13 @@
 import type { OAuth2TokenGrantResponse } from '@authup/specs';
 import type { OAuth2AuthorizationCode, Session } from '@authup/core-kit';
-import type { IOAuth2KeyRepository } from '../key/index.ts';
+import type { IKeyStore } from '../../key/index.ts';
 import type { IOAuth2OpenIDTokenIssuer, IOAuth2TokenIssuer } from '../token/index.ts';
 import { OAuth2BaseGrant } from './base.ts';
 import type { IOAuth2Grant, OAuth2AuthorizeGrantContext, OAuth2GrantRunWIthOptions } from './types.ts';
 export declare class OAuth2AuthorizeGrant extends OAuth2BaseGrant<OAuth2AuthorizationCode> implements IOAuth2Grant {
     protected refreshTokenIssuer: IOAuth2TokenIssuer;
     protected openIdTokenIssuer: IOAuth2OpenIDTokenIssuer;
-    protected keyRepository: IOAuth2KeyRepository;
+    protected keyStore: IKeyStore;
     constructor(ctx: OAuth2AuthorizeGrantContext);
     runWith(authorizationCode: OAuth2AuthorizationCode, options?: OAuth2GrantRunWIthOptions): Promise<OAuth2TokenGrantResponse>;
     /**

package/dist/core/oauth2/grant-types/authorize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/grant-types/authorize.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAsB,MAAM,eAAe,CAAC;AAElF,OAAO,KAAK,EAAE,uBAAuB,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAGzE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACtF,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,YAAY,EAAE,2BAA2B,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAIvG,qBAAa,oBAAqB,SAAQ,eAAe,CAAC,uBAAuB,CAAE,YAAW,YAAY;IACtG,SAAS,CAAC,kBAAkB,EAAG,kBAAkB,CAAC;IAElD,SAAS,CAAC,iBAAiB,EAAG,wBAAwB,CAAC;IAEvD,SAAS,CAAC,aAAa,EAAG,oBAAoB,CAAC;gBAEnC,GAAG,EAAE,2BAA2B;IAWtC,OAAO,CACT,iBAAiB,EAAE,uBAAuB,EAC1C,OAAO,GAAE,yBAA8B,GACvC,OAAO,CAAC,wBAAwB,CAAC;IA6DrC;;;;;;;;;;;;OAYG;cACa,cAAc,CAC1B,iBAAiB,EAAE,uBAAuB,EAC1C,OAAO,EAAE,yBAAyB,GAClC,OAAO,CAAC,OAAO,CAAC;CAwBvB"}
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/grant-types/authorize.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAsB,MAAM,eAAe,CAAC;AAElF,OAAO,KAAK,EAAE,uBAAuB,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAGzE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,KAAK,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACtF,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,YAAY,EAAE,2BAA2B,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAIvG,qBAAa,oBAAqB,SAAQ,eAAe,CAAC,uBAAuB,CAAE,YAAW,YAAY;IACtG,SAAS,CAAC,kBAAkB,EAAG,kBAAkB,CAAC;IAElD,SAAS,CAAC,iBAAiB,EAAG,wBAAwB,CAAC;IAEvD,SAAS,CAAC,QAAQ,EAAG,SAAS,CAAC;gBAEnB,GAAG,EAAE,2BAA2B;IAWtC,OAAO,CACT,iBAAiB,EAAE,uBAAuB,EAC1C,OAAO,GAAE,yBAA8B,GACvC,OAAO,CAAC,wBAAwB,CAAC;IAmErC;;;;;;;;;;;;OAYG;cACa,cAAc,CAC1B,iBAAiB,EAAE,uBAAuB,EAC1C,OAAO,EAAE,yBAAyB,GAClC,OAAO,CAAC,OAAO,CAAC;CAyBvB"}

package/dist/core/oauth2/grant-types/authorize.mjs

@@ -1,16 +1,16 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { buildOAuth2TokenHash } from "../authorization/helpers.mjs";
+import { buildOAuth2TokenHash, deriveAmrAcr } from "../authorization/helpers.mjs";
 import { OAuth2BaseGrant } from "./base.mjs";
 import { buildOAuth2BearerTokenResponse } from "../response/bearer.mjs";
 import { ScopeName } from "@authup/core-kit";
-import { JWKError, hasOAuth2Scopes } from "@authup/specs";
+import { JWKUse, hasOAuth2Scopes } from "@authup/specs";
 //#region src/core/oauth2/grant-types/authorize.ts
 var OAuth2AuthorizeGrant = class extends OAuth2BaseGrant {
 	refreshTokenIssuer;
 	openIdTokenIssuer;
-	keyRepository;
+	keyStore;
 	constructor(ctx) {
 		super({
 			accessTokenIssuer: ctx.accessTokenIssuer,
@@ -18,10 +18,11 @@ var OAuth2AuthorizeGrant = class extends OAuth2BaseGrant {
 		});
 		this.refreshTokenIssuer = ctx.refreshTokenIssuer;
 		this.openIdTokenIssuer = ctx.openIdTokenIssuer;
-		this.keyRepository = ctx.keyRepository;
+		this.keyStore = ctx.keyStore;
 	}
 	async runWith(authorizationCode, options = {}) {
 		const session = await this.resolveSession(authorizationCode, options);
+		const amrAcr = deriveAmrAcr(session);
 		const issuePayload = {
 			user_agent: options.userAgent,
 			remote_address: options.ipAddress,
@@ -31,7 +32,9 @@ var OAuth2AuthorizeGrant = class extends OAuth2BaseGrant {
 			realm_id: authorizationCode.realm_id,
 			realm_name: authorizationCode.realm_name,
 			scope: authorizationCode.scope || void 0,
-			client_id: authorizationCode.client_id || void 0
+			client_id: authorizationCode.client_id || void 0,
+			...options.confirmation ? { cnf: options.confirmation } : {},
+			...amrAcr
 		};
 		const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);
 		const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);
@@ -42,8 +45,7 @@ var OAuth2AuthorizeGrant = class extends OAuth2BaseGrant {
 			refreshTokenPayload
 		};
 		if (authorizationCode.scope && hasOAuth2Scopes(authorizationCode.scope, ScopeName.OPEN_ID)) {
-			const key = await this.keyRepository.findByRealmId(authorizationCode.realm_id);
-			if (!key) throw JWKError.notFoundForRealm(authorizationCode.realm_id, authorizationCode.realm_name);
+			const key = await this.keyStore.resolveOrCreate(authorizationCode.realm_id, JWKUse.SIGNATURE);
 			const [idToken] = await this.openIdTokenIssuer.issue({
 				sub: authorizationCode.sub || void 0,
 				sub_kind: authorizationCode.sub_kind,
@@ -53,6 +55,7 @@ var OAuth2AuthorizeGrant = class extends OAuth2BaseGrant {
 				client_id: authorizationCode.client_id || void 0,
 				...authorizationCode.nonce ? { nonce: authorizationCode.nonce } : {},
 				...typeof authorizationCode.auth_time === "number" ? { auth_time: authorizationCode.auth_time } : {},
+				...amrAcr,
 				sid: session.id,
 				at_hash: await buildOAuth2TokenHash(accessToken, key.signature_algorithm)
 			});
@@ -86,7 +89,8 @@ var OAuth2AuthorizeGrant = class extends OAuth2BaseGrant {
 			realm_id: authorizationCode.realm_id,
 			client_id: authorizationCode.client_id,
 			sub_kind: authorizationCode.sub_kind,
-			sub: authorizationCode.sub
+			sub: authorizationCode.sub,
+			auth_method: authorizationCode.auth_method ?? null
 		});
 	}
 };

package/dist/core/oauth2/grant-types/authorize.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.mjs","names":["JWKError","hasOAuth2Scopes","ScopeName","buildOAuth2TokenHash","OAuth2BaseGrant","buildOAuth2BearerTokenResponse","OAuth2AuthorizeGrant","refreshTokenIssuer","openIdTokenIssuer","keyRepository","ctx","accessTokenIssuer","sessionManager","runWith","authorizationCode","options","session","resolveSession","issuePayload","user_agent","userAgent","remote_address","ipAddress","session_id","id","sub","undefined","sub_kind","realm_id","realm_name","scope","client_id","accessToken","accessTokenPayload","issue","refreshToken","refreshTokenPayload","buildContext","OPEN_ID","key","findByRealmId","notFoundForRealm","idToken","nonce","auth_time","sid","at_hash","signature_algorithm","existing","findOneById","refresh","create","ip_address"],"sources":["../../../../src/core/oauth2/grant-types/authorize.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { JWKError, hasOAuth2Scopes } from '@authup/specs';\nimport type { OAuth2AuthorizationCode, Session } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport { buildOAuth2TokenHash } from '../authorization/helpers.ts';\nimport type { IOAuth2KeyRepository } from '../key/index.ts';\nimport type { IOAuth2OpenIDTokenIssuer, IOAuth2TokenIssuer } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport type { IOAuth2Grant, OAuth2AuthorizeGrantContext, OAuth2GrantRunWIthOptions } from './types.ts';\nimport type { OAuth2BearerResponseBuildContext } from '../response/index.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\n\nexport class OAuth2AuthorizeGrant extends OAuth2BaseGrant<OAuth2AuthorizationCode> implements IOAuth2Grant {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    protected openIdTokenIssuer : IOAuth2OpenIDTokenIssuer;\n\n    protected keyRepository : IOAuth2KeyRepository;\n\n    constructor(ctx: OAuth2AuthorizeGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n        this.openIdTokenIssuer = ctx.openIdTokenIssuer;\n        this.keyRepository = ctx.keyRepository;\n    }\n\n    async runWith(\n        authorizationCode: OAuth2AuthorizationCode,\n        options: OAuth2GrantRunWIthOptions = {},\n    ) : Promise<OAuth2TokenGrantResponse> {\n        const session = await this.resolveSession(authorizationCode, options);\n\n        const issuePayload : Partial<OAuth2TokenPayload> = {\n            user_agent: options.userAgent,\n            remote_address: options.ipAddress,\n            session_id: session.id,\n            sub: authorizationCode.sub || undefined,\n            sub_kind: authorizationCode.sub_kind,\n            realm_id: authorizationCode.realm_id,\n            realm_name: authorizationCode.realm_name,\n            scope: authorizationCode.scope || undefined,\n            client_id: authorizationCode.client_id || undefined,\n        };\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);\n\n        const buildContext : OAuth2BearerResponseBuildContext = {\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        };\n\n        // The id_token is minted HERE — after resolveSession — so its `sid`\n        // references the real backing session for the reuse branch, the\n        // fallback branch, and session-less (federated IdP) codes alike.\n        // `auth_time` is the authentication instant captured on the code.\n        if (\n            authorizationCode.scope &&\n            hasOAuth2Scopes(authorizationCode.scope, ScopeName.OPEN_ID)\n        ) {\n            // The at_hash digest follows the id_token's JWS alg (OIDC Core\n            // §3.1.3.6) — the alg of the realm key the openid issuer signs\n            // with. The access token above was signed with the same key, so a\n            // missing key would already have thrown; this guard fails closed.\n            const key = await this.keyRepository.findByRealmId(authorizationCode.realm_id);\n            if (!key) {\n                throw JWKError.notFoundForRealm(authorizationCode.realm_id, authorizationCode.realm_name);\n            }\n\n            const [idToken] = await this.openIdTokenIssuer.issue({\n                sub: authorizationCode.sub || undefined,\n                sub_kind: authorizationCode.sub_kind,\n                realm_id: authorizationCode.realm_id,\n                realm_name: authorizationCode.realm_name,\n                scope: authorizationCode.scope || undefined,\n                client_id: authorizationCode.client_id || undefined,\n                ...(authorizationCode.nonce ? { nonce: authorizationCode.nonce } : {}),\n                ...(typeof authorizationCode.auth_time === 'number' ? { auth_time: authorizationCode.auth_time } : {}),\n                sid: session.id,\n                at_hash: await buildOAuth2TokenHash(accessToken, key.signature_algorithm),\n            });\n\n            buildContext.idToken = idToken;\n        }\n\n        return buildOAuth2BearerTokenResponse(buildContext);\n    }\n\n    /**\n     * Reuse the bearer's session when the authorization code was issued from an\n     * (interactive) `/authorize` request that carried one — otherwise the\n     * interactive login would create a second session (the abandoned bearer\n     * session that authenticated `POST /authorize`, plus this one).\n     *\n     * The reuse is gated on the session still existing and belonging to the\n     * same subject/realm as the code (defense in depth — the id is\n     * server-derived from the authenticated bearer, never client input). Any\n     * mismatch, or a session-less authorize flow (external IdP, non-interactive\n     * clients), falls back to creating a fresh session — preserving prior\n     * behavior.\n     */\n    protected async resolveSession(\n        authorizationCode: OAuth2AuthorizationCode,\n        options: OAuth2GrantRunWIthOptions,\n    ) : Promise<Session> {\n        if (authorizationCode.session_id) {\n            const existing = await this.sessionManager.findOneById(authorizationCode.session_id);\n            if (\n                existing &&\n                existing.sub === authorizationCode.sub &&\n                existing.sub_kind === authorizationCode.sub_kind &&\n                existing.realm_id === authorizationCode.realm_id\n            ) {\n                existing.client_id = authorizationCode.client_id || null;\n\n                return this.sessionManager.refresh(existing);\n            }\n        }\n\n        return this.sessionManager.create({\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: authorizationCode.realm_id,\n            client_id: authorizationCode.client_id,\n            sub_kind: authorizationCode.sub_kind,\n            sub: authorizationCode.sub,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;AAmBA,IAAaM,uBAAb,cAA0CF,gBAAAA;CAC5BG;CAEAC;CAEAC;CAEV,YAAYC,KAAkC;EAC1C,MAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;EACxB,CAAA;EAEA,KAAKL,qBAAqBG,IAAIH;EAC9B,KAAKC,oBAAoBE,IAAIF;EAC7B,KAAKC,gBAAgBC,IAAID;CAC7B;CAEA,MAAMI,QACFC,mBACAC,UAAqC,CAAC,GACJ;EAClC,MAAMC,UAAU,MAAM,KAAKC,eAAeH,mBAAmBC,OAAAA;EAE7D,MAAMG,eAA6C;GAC/CC,YAAYJ,QAAQK;GACpBC,gBAAgBN,QAAQO;GACxBC,YAAYP,QAAQQ;GACpBC,KAAKX,kBAAkBW,OAAOC,KAAAA;GAC9BC,UAAUb,kBAAkBa;GAC5BC,UAAUd,kBAAkBc;GAC5BC,YAAYf,kBAAkBe;GAC9BC,OAAOhB,kBAAkBgB,SAASJ,KAAAA;GAClCK,WAAWjB,kBAAkBiB,aAAaL,KAAAA;EAC9C;EAEA,MAAM,CAACM,aAAaC,sBAAsB,MAAM,KAAKtB,kBAAkBuB,MAAMhB,YAAAA;EAC7E,MAAM,CAACiB,cAAcC,uBAAuB,MAAM,KAAK7B,mBAAmB2B,MAAMhB,YAAAA;EAEhF,MAAMmB,eAAkD;GACpDL;GACAC;GACAE;GACAC;EACJ;EAMA,IACItB,kBAAkBgB,SAClB7B,gBAAgBa,kBAAkBgB,OAAO5B,UAAUoC,OAAO,GAC5D;GAKE,MAAMC,MAAM,MAAM,KAAK9B,cAAc+B,cAAc1B,kBAAkBc,QAAQ;GAC7E,IAAI,CAACW,KACD,MAAMvC,SAASyC,iBAAiB3B,kBAAkBc,UAAUd,kBAAkBe,UAAU;GAG5F,MAAM,CAACa,WAAW,MAAM,KAAKlC,kBAAkB0B,MAAM;IACjDT,KAAKX,kBAAkBW,OAAOC,KAAAA;IAC9BC,UAAUb,kBAAkBa;IAC5BC,UAAUd,kBAAkBc;IAC5BC,YAAYf,kBAAkBe;IAC9BC,OAAOhB,kBAAkBgB,SAASJ,KAAAA;IAClCK,WAAWjB,kBAAkBiB,aAAaL,KAAAA;IAC1C,GAAIZ,kBAAkB6B,QAAQ,EAAEA,OAAO7B,kBAAkB6B,MAAM,IAAI,CAAC;IACpE,GAAI,OAAO7B,kBAAkB8B,cAAc,WAAW,EAAEA,WAAW9B,kBAAkB8B,UAAU,IAAI,CAAC;IACpGC,KAAK7B,QAAQQ;IACbsB,SAAS,MAAM3C,qBAAqB6B,aAAaO,IAAIQ,mBAAmB;GAC5E,CAAA;GAEAV,aAAaK,UAAUA;EAC3B;EAEA,OAAOrC,+BAA+BgC,YAAAA;CAC1C;;;;;;;;;;;;;IAeA,MAAgBpB,eACZH,mBACAC,SACiB;EACjB,IAAID,kBAAkBS,YAAY;GAC9B,MAAMyB,WAAW,MAAM,KAAKpC,eAAeqC,YAAYnC,kBAAkBS,UAAU;GACnF,IACIyB,YACAA,SAASvB,QAAQX,kBAAkBW,OACnCuB,SAASrB,aAAab,kBAAkBa,YACxCqB,SAASpB,aAAad,kBAAkBc,UAC1C;IACEoB,SAASjB,YAAYjB,kBAAkBiB,aAAa;IAEpD,OAAO,KAAKnB,eAAesC,QAAQF,QAAAA;GACvC;EACJ;EAEA,OAAO,KAAKpC,eAAeuC,OAAO;GAC9BhC,YAAYJ,QAAQK;GACpBgC,YAAYrC,QAAQO;GACpBM,UAAUd,kBAAkBc;GAC5BG,WAAWjB,kBAAkBiB;GAC7BJ,UAAUb,kBAAkBa;GAC5BF,KAAKX,kBAAkBW;EAC3B,CAAA;CACJ;AACJ"}
+{"version":3,"file":"authorize.mjs","names":["JWKUse","hasOAuth2Scopes","ScopeName","buildOAuth2TokenHash","deriveAmrAcr","OAuth2BaseGrant","buildOAuth2BearerTokenResponse","OAuth2AuthorizeGrant","refreshTokenIssuer","openIdTokenIssuer","keyStore","ctx","accessTokenIssuer","sessionManager","runWith","authorizationCode","options","session","resolveSession","amrAcr","issuePayload","user_agent","userAgent","remote_address","ipAddress","session_id","id","sub","undefined","sub_kind","realm_id","realm_name","scope","client_id","confirmation","cnf","accessToken","accessTokenPayload","issue","refreshToken","refreshTokenPayload","buildContext","OPEN_ID","key","resolveOrCreate","SIGNATURE","idToken","nonce","auth_time","sid","at_hash","signature_algorithm","existing","findOneById","refresh","create","ip_address","auth_method"],"sources":["../../../../src/core/oauth2/grant-types/authorize.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { JWKUse, hasOAuth2Scopes } from '@authup/specs';\nimport type { OAuth2AuthorizationCode, Session } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport { buildOAuth2TokenHash, deriveAmrAcr } from '../authorization/helpers.ts';\nimport type { IKeyStore } from '../../key/index.ts';\nimport type { IOAuth2OpenIDTokenIssuer, IOAuth2TokenIssuer } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport type { IOAuth2Grant, OAuth2AuthorizeGrantContext, OAuth2GrantRunWIthOptions } from './types.ts';\nimport type { OAuth2BearerResponseBuildContext } from '../response/index.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\n\nexport class OAuth2AuthorizeGrant extends OAuth2BaseGrant<OAuth2AuthorizationCode> implements IOAuth2Grant {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    protected openIdTokenIssuer : IOAuth2OpenIDTokenIssuer;\n\n    protected keyStore : IKeyStore;\n\n    constructor(ctx: OAuth2AuthorizeGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n        this.openIdTokenIssuer = ctx.openIdTokenIssuer;\n        this.keyStore = ctx.keyStore;\n    }\n\n    async runWith(\n        authorizationCode: OAuth2AuthorizationCode,\n        options: OAuth2GrantRunWIthOptions = {},\n    ) : Promise<OAuth2TokenGrantResponse> {\n        const session = await this.resolveSession(authorizationCode, options);\n\n        // amr/acr derive from the RESOLVED session (auth_method + mfa_at) —\n        // deliberately on every token kind, not only the id_token, so\n        // resource servers can read the method without parsing an id_token.\n        const amrAcr = deriveAmrAcr(session);\n\n        const issuePayload : Partial<OAuth2TokenPayload> = {\n            user_agent: options.userAgent,\n            remote_address: options.ipAddress,\n            session_id: session.id,\n            sub: authorizationCode.sub || undefined,\n            sub_kind: authorizationCode.sub_kind,\n            realm_id: authorizationCode.realm_id,\n            realm_name: authorizationCode.realm_name,\n            scope: authorizationCode.scope || undefined,\n            client_id: authorizationCode.client_id || undefined,\n            ...(options.confirmation ? { cnf: options.confirmation } : {}),\n            ...amrAcr,\n        };\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);\n\n        const buildContext : OAuth2BearerResponseBuildContext = {\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        };\n\n        // The id_token is minted HERE — after resolveSession — so its `sid`\n        // references the real backing session for the reuse branch, the\n        // fallback branch, and session-less (federated IdP) codes alike.\n        // `auth_time` is the authentication instant captured on the code.\n        if (\n            authorizationCode.scope &&\n            hasOAuth2Scopes(authorizationCode.scope, ScopeName.OPEN_ID)\n        ) {\n            // The at_hash digest follows the id_token's JWS alg (OIDC Core\n            // §3.1.3.6) — the alg of the realm key the openid issuer signs\n            // with. The access token above was signed with the same key, so a\n            // missing key would already have thrown; this resolves the same\n            // active key.\n            const key = await this.keyStore.resolveOrCreate(authorizationCode.realm_id, JWKUse.SIGNATURE);\n\n            const [idToken] = await this.openIdTokenIssuer.issue({\n                sub: authorizationCode.sub || undefined,\n                sub_kind: authorizationCode.sub_kind,\n                realm_id: authorizationCode.realm_id,\n                realm_name: authorizationCode.realm_name,\n                scope: authorizationCode.scope || undefined,\n                client_id: authorizationCode.client_id || undefined,\n                ...(authorizationCode.nonce ? { nonce: authorizationCode.nonce } : {}),\n                ...(typeof authorizationCode.auth_time === 'number' ? { auth_time: authorizationCode.auth_time } : {}),\n                ...amrAcr,\n                sid: session.id,\n                at_hash: await buildOAuth2TokenHash(accessToken, key.signature_algorithm),\n            });\n\n            buildContext.idToken = idToken;\n        }\n\n        return buildOAuth2BearerTokenResponse(buildContext);\n    }\n\n    /**\n     * Reuse the bearer's session when the authorization code was issued from an\n     * (interactive) `/authorize` request that carried one — otherwise the\n     * interactive login would create a second session (the abandoned bearer\n     * session that authenticated `POST /authorize`, plus this one).\n     *\n     * The reuse is gated on the session still existing and belonging to the\n     * same subject/realm as the code (defense in depth — the id is\n     * server-derived from the authenticated bearer, never client input). Any\n     * mismatch, or a session-less authorize flow (external IdP, non-interactive\n     * clients), falls back to creating a fresh session — preserving prior\n     * behavior.\n     */\n    protected async resolveSession(\n        authorizationCode: OAuth2AuthorizationCode,\n        options: OAuth2GrantRunWIthOptions,\n    ) : Promise<Session> {\n        if (authorizationCode.session_id) {\n            const existing = await this.sessionManager.findOneById(authorizationCode.session_id);\n            if (\n                existing &&\n                existing.sub === authorizationCode.sub &&\n                existing.sub_kind === authorizationCode.sub_kind &&\n                existing.realm_id === authorizationCode.realm_id\n            ) {\n                existing.client_id = authorizationCode.client_id || null;\n\n                return this.sessionManager.refresh(existing);\n            }\n        }\n\n        return this.sessionManager.create({\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: authorizationCode.realm_id,\n            client_id: authorizationCode.client_id,\n            sub_kind: authorizationCode.sub_kind,\n            sub: authorizationCode.sub,\n            auth_method: authorizationCode.auth_method ?? null,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;AAmBA,IAAaO,uBAAb,cAA0CF,gBAAAA;CAC5BG;CAEAC;CAEAC;CAEV,YAAYC,KAAkC;EAC1C,MAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;EACxB,CAAA;EAEA,KAAKL,qBAAqBG,IAAIH;EAC9B,KAAKC,oBAAoBE,IAAIF;EAC7B,KAAKC,WAAWC,IAAID;CACxB;CAEA,MAAMI,QACFC,mBACAC,UAAqC,CAAC,GACJ;EAClC,MAAMC,UAAU,MAAM,KAAKC,eAAeH,mBAAmBC,OAAAA;EAK7D,MAAMG,SAASf,aAAaa,OAAAA;EAE5B,MAAMG,eAA6C;GAC/CC,YAAYL,QAAQM;GACpBC,gBAAgBP,QAAQQ;GACxBC,YAAYR,QAAQS;GACpBC,KAAKZ,kBAAkBY,OAAOC,KAAAA;GAC9BC,UAAUd,kBAAkBc;GAC5BC,UAAUf,kBAAkBe;GAC5BC,YAAYhB,kBAAkBgB;GAC9BC,OAAOjB,kBAAkBiB,SAASJ,KAAAA;GAClCK,WAAWlB,kBAAkBkB,aAAaL,KAAAA;GAC1C,GAAIZ,QAAQkB,eAAe,EAAEC,KAAKnB,QAAQkB,aAAa,IAAI,CAAC;GAC5D,GAAGf;EACP;EAEA,MAAM,CAACiB,aAAaC,sBAAsB,MAAM,KAAKzB,kBAAkB0B,MAAMlB,YAAAA;EAC7E,MAAM,CAACmB,cAAcC,uBAAuB,MAAM,KAAKhC,mBAAmB8B,MAAMlB,YAAAA;EAEhF,MAAMqB,eAAkD;GACpDL;GACAC;GACAE;GACAC;EACJ;EAMA,IACIzB,kBAAkBiB,SAClB/B,gBAAgBc,kBAAkBiB,OAAO9B,UAAUwC,OAAO,GAC5D;GAME,MAAMC,MAAM,MAAM,KAAKjC,SAASkC,gBAAgB7B,kBAAkBe,UAAU9B,OAAO6C,SAAS;GAE5F,MAAM,CAACC,WAAW,MAAM,KAAKrC,kBAAkB6B,MAAM;IACjDX,KAAKZ,kBAAkBY,OAAOC,KAAAA;IAC9BC,UAAUd,kBAAkBc;IAC5BC,UAAUf,kBAAkBe;IAC5BC,YAAYhB,kBAAkBgB;IAC9BC,OAAOjB,kBAAkBiB,SAASJ,KAAAA;IAClCK,WAAWlB,kBAAkBkB,aAAaL,KAAAA;IAC1C,GAAIb,kBAAkBgC,QAAQ,EAAEA,OAAOhC,kBAAkBgC,MAAM,IAAI,CAAC;IACpE,GAAI,OAAOhC,kBAAkBiC,cAAc,WAAW,EAAEA,WAAWjC,kBAAkBiC,UAAU,IAAI,CAAC;IACpG,GAAG7B;IACH8B,KAAKhC,QAAQS;IACbwB,SAAS,MAAM/C,qBAAqBiC,aAAaO,IAAIQ,mBAAmB;GAC5E,CAAA;GAEAV,aAAaK,UAAUA;EAC3B;EAEA,OAAOxC,+BAA+BmC,YAAAA;CAC1C;;;;;;;;;;;;;IAeA,MAAgBvB,eACZH,mBACAC,SACiB;EACjB,IAAID,kBAAkBU,YAAY;GAC9B,MAAM2B,WAAW,MAAM,KAAKvC,eAAewC,YAAYtC,kBAAkBU,UAAU;GACnF,IACI2B,YACAA,SAASzB,QAAQZ,kBAAkBY,OACnCyB,SAASvB,aAAad,kBAAkBc,YACxCuB,SAAStB,aAAaf,kBAAkBe,UAC1C;IACEsB,SAASnB,YAAYlB,kBAAkBkB,aAAa;IAEpD,OAAO,KAAKpB,eAAeyC,QAAQF,QAAAA;GACvC;EACJ;EAEA,OAAO,KAAKvC,eAAe0C,OAAO;GAC9BlC,YAAYL,QAAQM;GACpBkC,YAAYxC,QAAQQ;GACpBM,UAAUf,kBAAkBe;GAC5BG,WAAWlB,kBAAkBkB;GAC7BJ,UAAUd,kBAAkBc;GAC5BF,KAAKZ,kBAAkBY;GACvB8B,aAAa1C,kBAAkB0C,eAAe;EAClD,CAAA;CACJ;AACJ"}

package/dist/core/oauth2/grant-types/client-credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-credentials.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/grant-types/client-credentials.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAE9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAK/C,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAE5D,qBAAa,sBAAuB,SAAQ,eAAe,CAAC,MAAM,CAAC;IACzD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,yBAA8B,GAAI,OAAO,CAAC,wBAAwB,CAAC;CA0B5G"}
+{"version":3,"file":"client-credentials.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/grant-types/client-credentials.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAE9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAM/C,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAE5D,qBAAa,sBAAuB,SAAQ,eAAe,CAAC,MAAM,CAAC;IACzD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,yBAA8B,GAAI,OAAO,CAAC,wBAAwB,CAAC;CA4B5G"}

package/dist/core/oauth2/grant-types/client-credentials.mjs

@@ -3,7 +3,7 @@ import "node:url";
 import.meta.url;
 import { OAuth2BaseGrant } from "./base.mjs";
 import { buildOAuth2BearerTokenResponse } from "../response/bearer.mjs";
-import { IdentityType, ScopeName } from "@authup/core-kit";
+import { IdentityType, ScopeName, SessionAuthMethod } from "@authup/core-kit";
 import { OAuth2SubKind } from "@authup/specs";
 //#region src/core/oauth2/grant-types/client-credentials.ts
 var ClientCredentialsGrant = class extends OAuth2BaseGrant {
@@ -13,7 +13,8 @@ var ClientCredentialsGrant = class extends OAuth2BaseGrant {
 			ip_address: options.ipAddress,
 			realm_id: input.realm_id,
 			sub: input.id,
-			sub_kind: IdentityType.CLIENT
+			sub_kind: IdentityType.CLIENT,
+			auth_method: SessionAuthMethod.CLIENT
 		});
 		const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({
 			user_agent: session.user_agent,
@@ -24,7 +25,8 @@ var ClientCredentialsGrant = class extends OAuth2BaseGrant {
 			sub_kind: OAuth2SubKind.CLIENT,
 			realm_id: input.realm.id,
 			realm_name: input.realm.name,
-			client_id: input.id
+			client_id: input.id,
+			...options.confirmation ? { cnf: options.confirmation } : {}
 		});
 		return buildOAuth2BearerTokenResponse({
 			accessToken,

package/dist/core/oauth2/grant-types/client-credentials.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"client-credentials.mjs","names":["OAuth2SubKind","IdentityType","ScopeName","OAuth2BaseGrant","buildOAuth2BearerTokenResponse","ClientCredentialsGrant","runWith","input","options","session","sessionManager","create","user_agent","userAgent","ip_address","ipAddress","realm_id","sub","id","sub_kind","CLIENT","accessToken","accessTokenPayload","accessTokenIssuer","issue","remote_address","session_id","scope","GLOBAL","realm","realm_name","name","client_id"],"sources":["../../../../src/core/oauth2/grant-types/client-credentials.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2SubKind } from '@authup/specs';\nimport type { Client } from '@authup/core-kit';\nimport {\n    IdentityType,\n    ScopeName,\n} from '@authup/core-kit';\nimport { OAuth2BaseGrant } from './base.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { OAuth2GrantRunWIthOptions } from './types.ts';\n\nexport class ClientCredentialsGrant extends OAuth2BaseGrant<Client> {\n    async runWith(input: Client, options: OAuth2GrantRunWIthOptions = {}) : Promise<OAuth2TokenGrantResponse> {\n        const session = await this.sessionManager.create({\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: input.realm_id,\n            sub: input.id,\n            sub_kind: IdentityType.CLIENT,\n        });\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            session_id: session.id,\n            scope: ScopeName.GLOBAL,\n            sub: input.id,\n            sub_kind: OAuth2SubKind.CLIENT,\n            realm_id: input.realm.id,\n            realm_name: input.realm.name,\n            client_id: input.id,\n        });\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;;;;AAkBA,IAAaK,yBAAb,cAA4CF,gBAAAA;CACxC,MAAMG,QAAQC,OAAeC,UAAqC,CAAC,GAAuC;EACtG,MAAMC,UAAU,MAAM,KAAKC,eAAeC,OAAO;GAC7CC,YAAYJ,QAAQK;GACpBC,YAAYN,QAAQO;GACpBC,UAAUT,MAAMS;GAChBC,KAAKV,MAAMW;GACXC,UAAUlB,aAAamB;EAC3B,CAAA;EAEA,MAAM,CAACC,aAAaC,sBAAsB,MAAM,KAAKC,kBAAkBC,MAAM;GACzEZ,YAAYH,QAAQG;GACpBa,gBAAgBhB,QAAQK;GACxBY,YAAYjB,QAAQS;GACpBS,OAAOzB,UAAU0B;GACjBX,KAAKV,MAAMW;GACXC,UAAUnB,cAAcoB;GACxBJ,UAAUT,MAAMsB,MAAMX;GACtBY,YAAYvB,MAAMsB,MAAME;GACxBC,WAAWzB,MAAMW;EACrB,CAAA;EAEA,OAAOd,+BAA+B;GAClCiB;GACAC;EACJ,CAAA;CACJ;AACJ"}
+{"version":3,"file":"client-credentials.mjs","names":["OAuth2SubKind","IdentityType","ScopeName","SessionAuthMethod","OAuth2BaseGrant","buildOAuth2BearerTokenResponse","ClientCredentialsGrant","runWith","input","options","session","sessionManager","create","user_agent","userAgent","ip_address","ipAddress","realm_id","sub","id","sub_kind","CLIENT","auth_method","accessToken","accessTokenPayload","accessTokenIssuer","issue","remote_address","session_id","scope","GLOBAL","realm","realm_name","name","client_id","confirmation","cnf"],"sources":["../../../../src/core/oauth2/grant-types/client-credentials.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2SubKind } from '@authup/specs';\nimport type { Client } from '@authup/core-kit';\nimport {\n    IdentityType,\n    ScopeName, \n    SessionAuthMethod,\n} from '@authup/core-kit';\nimport { OAuth2BaseGrant } from './base.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { OAuth2GrantRunWIthOptions } from './types.ts';\n\nexport class ClientCredentialsGrant extends OAuth2BaseGrant<Client> {\n    async runWith(input: Client, options: OAuth2GrantRunWIthOptions = {}) : Promise<OAuth2TokenGrantResponse> {\n        const session = await this.sessionManager.create({\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: input.realm_id,\n            sub: input.id,\n            sub_kind: IdentityType.CLIENT,\n            auth_method: SessionAuthMethod.CLIENT,\n        });\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            session_id: session.id,\n            scope: ScopeName.GLOBAL,\n            sub: input.id,\n            sub_kind: OAuth2SubKind.CLIENT,\n            realm_id: input.realm.id,\n            realm_name: input.realm.name,\n            client_id: input.id,\n            ...(options.confirmation ? { cnf: options.confirmation } : {}),\n        });\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;;;;AAmBA,IAAaM,yBAAb,cAA4CF,gBAAAA;CACxC,MAAMG,QAAQC,OAAeC,UAAqC,CAAC,GAAuC;EACtG,MAAMC,UAAU,MAAM,KAAKC,eAAeC,OAAO;GAC7CC,YAAYJ,QAAQK;GACpBC,YAAYN,QAAQO;GACpBC,UAAUT,MAAMS;GAChBC,KAAKV,MAAMW;GACXC,UAAUnB,aAAaoB;GACvBC,aAAanB,kBAAkBkB;EACnC,CAAA;EAEA,MAAM,CAACE,aAAaC,sBAAsB,MAAM,KAAKC,kBAAkBC,MAAM;GACzEb,YAAYH,QAAQG;GACpBc,gBAAgBjB,QAAQK;GACxBa,YAAYlB,QAAQS;GACpBU,OAAO3B,UAAU4B;GACjBZ,KAAKV,MAAMW;GACXC,UAAUpB,cAAcqB;GACxBJ,UAAUT,MAAMuB,MAAMZ;GACtBa,YAAYxB,MAAMuB,MAAME;GACxBC,WAAW1B,MAAMW;GACjB,GAAIV,QAAQ0B,eAAe,EAAEC,KAAK3B,QAAQ0B,aAAa,IAAI,CAAC;EAChE,CAAA;EAEA,OAAO9B,+BAA+B;GAClCkB;GACAC;EACJ,CAAA;CACJ;AACJ"}

package/dist/core/oauth2/grant-types/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/grant-types/identity.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAsB,MAAM,eAAe,CAAC;AAClF,OAAO,KAAK,EAAE,QAAQ,EAAW,MAAM,kBAAkB,CAAC;AAE1D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C,OAAO,KAAK,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAExF,qBAAa,iBAAkB,SAAQ,eAAe,CAAC,QAAQ,CAAC;IAC5D,SAAS,CAAC,kBAAkB,EAAG,kBAAkB,CAAC;gBAEtC,GAAG,EAAE,0BAA0B;IASrC,OAAO,CACT,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,yBAA8B,GACxC,OAAO,CAAC,wBAAwB,CAAC;CAgCvC"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/grant-types/identity.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAsB,MAAM,eAAe,CAAC;AAClF,OAAO,KAAK,EAAE,QAAQ,EAAW,MAAM,kBAAkB,CAAC;AAE1D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAG5C,OAAO,KAAK,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAExF,qBAAa,iBAAkB,SAAQ,eAAe,CAAC,QAAQ,CAAC;IAC5D,SAAS,CAAC,kBAAkB,EAAG,kBAAkB,CAAC;gBAEtC,GAAG,EAAE,0BAA0B;IASrC,OAAO,CACT,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,yBAA8B,GACxC,OAAO,CAAC,wBAAwB,CAAC;CA0CvC"}

package/dist/core/oauth2/grant-types/identity.mjs

@@ -1,9 +1,10 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { deriveAmrAcr } from "../authorization/helpers.mjs";
 import { OAuth2BaseGrant } from "./base.mjs";
 import { buildOAuth2BearerTokenResponse } from "../response/bearer.mjs";
-import { ScopeName } from "@authup/core-kit";
+import { ScopeName, SessionAuthMethod } from "@authup/core-kit";
 //#region src/core/oauth2/grant-types/identity.ts
 var IdentityGrantType = class extends OAuth2BaseGrant {
 	refreshTokenIssuer;
@@ -20,9 +21,14 @@ var IdentityGrantType = class extends OAuth2BaseGrant {
 			ip_address: options.ipAddress,
 			realm_id: identity.data.realm_id,
 			sub: identity.data.id,
-			sub_kind: identity.type
+			sub_kind: identity.type,
+			auth_method: SessionAuthMethod.EXTERNAL
 		};
 		const { id: sessionId } = await this.sessionManager.create(session);
+		const amrAcr = deriveAmrAcr({
+			auth_method: session.auth_method ?? null,
+			mfa_at: session.mfa_at ?? null
+		});
 		const issuePayload = {
 			session_id: sessionId,
 			user_agent: session.user_agent,
@@ -31,7 +37,8 @@ var IdentityGrantType = class extends OAuth2BaseGrant {
 			realm_id: identity.data.realm_id,
 			realm_name: identity.data.realm?.name,
 			sub: identity.data.id,
-			sub_kind: identity.type
+			sub_kind: identity.type,
+			...amrAcr
 		};
 		const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);
 		const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);

package/dist/core/oauth2/grant-types/identity.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"identity.mjs","names":["ScopeName","OAuth2BaseGrant","buildOAuth2BearerTokenResponse","IdentityGrantType","refreshTokenIssuer","ctx","accessTokenIssuer","sessionManager","runWith","identity","options","session","user_agent","userAgent","ip_address","ipAddress","realm_id","data","sub","id","sub_kind","type","sessionId","create","issuePayload","session_id","remote_address","scope","GLOBAL","realm_name","realm","name","accessToken","accessTokenPayload","issue","refreshToken","refreshTokenPayload"],"sources":["../../../../src/core/oauth2/grant-types/identity.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport type { Identity, Session } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport type { IOAuth2TokenIssuer } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { OAuth2GrantRunWIthOptions, OAuth2IdentityGrantContext } from './types.ts';\n\nexport class IdentityGrantType extends OAuth2BaseGrant<Identity> {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    constructor(ctx: OAuth2IdentityGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n    }\n\n    async runWith(\n        identity: Identity,\n        options: OAuth2GrantRunWIthOptions = {},\n    ): Promise<OAuth2TokenGrantResponse> {\n        const session : Partial<Session> = {\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: identity.data.realm_id,\n            sub: identity.data.id,\n            sub_kind: identity.type,\n        };\n\n        const { id: sessionId } = await this.sessionManager.create(session);\n\n        const issuePayload : Partial<OAuth2TokenPayload> = {\n            session_id: sessionId,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            scope: ScopeName.GLOBAL,\n            realm_id: identity.data.realm_id,\n            realm_name: identity.data.realm?.name,\n            sub: identity.data.id,\n            sub_kind: identity.type,\n        };\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;;;AAeA,IAAaG,oBAAb,cAAuCF,gBAAAA;CACzBG;CAEV,YAAYC,KAAiC;EACzC,MAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;EACxB,CAAA;EAEA,KAAKH,qBAAqBC,IAAID;CAClC;CAEA,MAAMI,QACFC,UACAC,UAAqC,CAAC,GACL;EACjC,MAAMC,UAA6B;GAC/BC,YAAYF,QAAQG;GACpBC,YAAYJ,QAAQK;GACpBC,UAAUP,SAASQ,KAAKD;GACxBE,KAAKT,SAASQ,KAAKE;GACnBC,UAAUX,SAASY;EACvB;EAEA,MAAM,EAAEF,IAAIG,cAAc,MAAM,KAAKf,eAAegB,OAAOZ,OAAAA;EAE3D,MAAMa,eAA6C;GAC/CC,YAAYH;GACZV,YAAYD,QAAQC;GACpBc,gBAAgBf,QAAQG;GACxBa,OAAO3B,UAAU4B;GACjBZ,UAAUP,SAASQ,KAAKD;GACxBa,YAAYpB,SAASQ,KAAKa,OAAOC;GACjCb,KAAKT,SAASQ,KAAKE;GACnBC,UAAUX,SAASY;EACvB;EAEA,MAAM,CAACW,aAAaC,sBAAsB,MAAM,KAAK3B,kBAAkB4B,MAAMV,YAAAA;EAC7E,MAAM,CAACW,cAAcC,uBAAuB,MAAM,KAAKhC,mBAAmB8B,MAAMV,YAAAA;EAEhF,OAAOtB,+BAA+B;GAClC8B;GACAC;GACAE;GACAC;EACJ,CAAA;CACJ;AACJ"}
+{"version":3,"file":"identity.mjs","names":["ScopeName","SessionAuthMethod","OAuth2BaseGrant","deriveAmrAcr","buildOAuth2BearerTokenResponse","IdentityGrantType","refreshTokenIssuer","ctx","accessTokenIssuer","sessionManager","runWith","identity","options","session","user_agent","userAgent","ip_address","ipAddress","realm_id","data","sub","id","sub_kind","type","auth_method","EXTERNAL","sessionId","create","amrAcr","mfa_at","issuePayload","session_id","remote_address","scope","GLOBAL","realm_name","realm","name","accessToken","accessTokenPayload","issue","refreshToken","refreshTokenPayload"],"sources":["../../../../src/core/oauth2/grant-types/identity.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport type { Identity, Session } from '@authup/core-kit';\nimport { ScopeName, SessionAuthMethod } from '@authup/core-kit';\nimport type { IOAuth2TokenIssuer } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport { deriveAmrAcr } from '../authorization/helpers.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { OAuth2GrantRunWIthOptions, OAuth2IdentityGrantContext } from './types.ts';\n\nexport class IdentityGrantType extends OAuth2BaseGrant<Identity> {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    constructor(ctx: OAuth2IdentityGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n    }\n\n    async runWith(\n        identity: Identity,\n        options: OAuth2GrantRunWIthOptions = {},\n    ): Promise<OAuth2TokenGrantResponse> {\n        const session : Partial<Session> = {\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: identity.data.realm_id,\n            sub: identity.data.id,\n            sub_kind: identity.type,\n            auth_method: SessionAuthMethod.EXTERNAL,\n        };\n\n        const { id: sessionId } = await this.sessionManager.create(session);\n\n        // amr/acr derive from the session's auth_method + mfa_at — deliberately\n        // on every token kind, so a direct identity grant's tokens advertise the\n        // (external) method the same way the authorization_code exchange does.\n        const amrAcr = deriveAmrAcr({\n            auth_method: session.auth_method ?? null,\n            mfa_at: session.mfa_at ?? null,\n        });\n\n        const issuePayload : Partial<OAuth2TokenPayload> = {\n            session_id: sessionId,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            scope: ScopeName.GLOBAL,\n            realm_id: identity.data.realm_id,\n            realm_name: identity.data.realm?.name,\n            sub: identity.data.id,\n            sub_kind: identity.type,\n            ...amrAcr,\n        };\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;;;;AAgBA,IAAaK,oBAAb,cAAuCH,gBAAAA;CACzBI;CAEV,YAAYC,KAAiC;EACzC,MAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;EACxB,CAAA;EAEA,KAAKH,qBAAqBC,IAAID;CAClC;CAEA,MAAMI,QACFC,UACAC,UAAqC,CAAC,GACL;EACjC,MAAMC,UAA6B;GAC/BC,YAAYF,QAAQG;GACpBC,YAAYJ,QAAQK;GACpBC,UAAUP,SAASQ,KAAKD;GACxBE,KAAKT,SAASQ,KAAKE;GACnBC,UAAUX,SAASY;GACnBC,aAAavB,kBAAkBwB;EACnC;EAEA,MAAM,EAAEJ,IAAIK,cAAc,MAAM,KAAKjB,eAAekB,OAAOd,OAAAA;EAK3D,MAAMe,SAASzB,aAAa;GACxBqB,aAAaX,QAAQW,eAAe;GACpCK,QAAQhB,QAAQgB,UAAU;EAC9B,CAAA;EAEA,MAAMC,eAA6C;GAC/CC,YAAYL;GACZZ,YAAYD,QAAQC;GACpBkB,gBAAgBnB,QAAQG;GACxBiB,OAAOjC,UAAUkC;GACjBhB,UAAUP,SAASQ,KAAKD;GACxBiB,YAAYxB,SAASQ,KAAKiB,OAAOC;GACjCjB,KAAKT,SAASQ,KAAKE;GACnBC,UAAUX,SAASY;GACnB,GAAGK;EACP;EAEA,MAAM,CAACU,aAAaC,sBAAsB,MAAM,KAAK/B,kBAAkBgC,MAAMV,YAAAA;EAC7E,MAAM,CAACW,cAAcC,uBAAuB,MAAM,KAAKpC,mBAAmBkC,MAAMV,YAAAA;EAEhF,OAAO1B,+BAA+B;GAClCkC;GACAC;GACAE;GACAC;EACJ,CAAA;CACJ;AACJ"}

package/dist/core/oauth2/grant-types/password.d.ts

@@ -1,14 +1,23 @@
 import type { OAuth2TokenGrantResponse } from '@authup/specs';
 import type { Client, User } from '@authup/core-kit';
+import type { IEventService } from '../../entities/index.ts';
+import type { IAuthFlowMetrics } from '../../metrics/index.ts';
 import type { IOAuth2TokenIssuer } from '../token/index.ts';
 import { OAuth2BaseGrant } from './base.ts';
 import type { OAuth2GrantRunWIthOptions, OAuth2PasswordGrantContext } from './types.ts';
 export type OAuth2PasswordGrantInput = {
     user: User;
     client?: Client;
+    /**
+     * Instant the user passed a second-factor challenge alongside the
+     * grant (the `otp` parameter) — stamped onto the session as mfa_at.
+     */
+    mfaVerifiedAt?: string;
 };
 export declare class PasswordGrantType extends OAuth2BaseGrant<OAuth2PasswordGrantInput> {
     protected refreshTokenIssuer: IOAuth2TokenIssuer;
+    protected eventService?: IEventService;
+    protected metrics?: IAuthFlowMetrics;
     constructor(ctx: OAuth2PasswordGrantContext);
     runWith(input: OAuth2PasswordGrantInput, options?: OAuth2GrantRunWIthOptions): Promise<OAuth2TokenGrantResponse>;
 }

package/dist/core/oauth2/grant-types/password.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/grant-types/password.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAsB,MAAM,eAAe,CAAC;AAElF,OAAO,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAMrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAExF,MAAM,MAAM,wBAAwB,GAAG;IACnC,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,qBAAa,iBAAkB,SAAQ,eAAe,CAAC,wBAAwB,CAAC;IAC5E,SAAS,CAAC,kBAAkB,EAAG,kBAAkB,CAAC;gBAEtC,GAAG,EAAE,0BAA0B;IASrC,OAAO,CAAC,KAAK,EAAE,wBAAwB,EAAE,OAAO,GAAE,yBAA8B,GAAI,OAAO,CAAC,wBAAwB,CAAC;CAmC9H"}
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/grant-types/password.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAsB,MAAM,eAAe,CAAC;AAElF,OAAO,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AASrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG/D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAExF,MAAM,MAAM,wBAAwB,GAAG;IACnC,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,qBAAa,iBAAkB,SAAQ,eAAe,CAAC,wBAAwB,CAAC;IAC5E,SAAS,CAAC,kBAAkB,EAAG,kBAAkB,CAAC;IAElD,SAAS,CAAC,YAAY,CAAC,EAAG,aAAa,CAAC;IAExC,SAAS,CAAC,OAAO,CAAC,EAAG,gBAAgB,CAAC;gBAE1B,GAAG,EAAE,0BAA0B;IAWrC,OAAO,CAAC,KAAK,EAAE,wBAAwB,EAAE,OAAO,GAAE,yBAA8B,GAAI,OAAO,CAAC,wBAAwB,CAAC;CA+D9H"}