@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.53

package/dist/adapters/database/migrations/postgres/1783769340000-Default.mjs

@@ -0,0 +1,310 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/adapters/database/migrations/postgres/1783769340000-Default.ts
+/**
+* Security event log (plan 057), MFA — authenticator devices (plan 049) +
+* auth-method claims (plan 050), application access policy (plan 052) +
+* persisted consent (plan 055), realm key store (plans 069 + 071) and
+* RFC 8705 client authentication (plan 072).
+*
+* - Adds auth_events: append-only, PII-stripped security audit log. No FKs
+*   by design: a row must survive deletion of the realm/actor/client it
+*   references. Retention is per-row (`expires_at`, stamped at write from
+*   `eventLogRetentionDays`; NULL = keep forever) and swept by the
+*   event-cleaner component (plan 057).
+* - Adds auth_user_authenticators: polymorphic second-factor device rows
+*   (kind: totp/recovery/email/webauthn) hanging off a user. The TOTP seed
+*   (secret) is symmetrically encrypted at rest; recovery codes are hashed.
+*   FKs to auth_users / auth_realms (ON DELETE CASCADE).
+* - Adds auth_sessions.mfa_at: instant the subject last passed a
+*   second-factor challenge for the session (plan 049).
+* - Adds auth_sessions.auth_method: how the subject authenticated
+*   (pwd/ldap/ext/client/robot — plan 050); NULL for pre-existing sessions.
+* - Adds auth_clients.access_policy_id: nullable FK to auth_policies
+*   (ON DELETE SET NULL) — the policy that must pass for an identity to
+*   authorize against the client (null = default-allow; plan 052).
+* - Adds auth_consents: one row per (client_id, sub, sub_kind, scope token)
+*   a subject has approved at POST /authorize. Union/keep (missing tokens
+*   only, never deleted on re-approval); built_in clients keep zero rows;
+*   expires_at is dormant (always null in Stage 1) but honored by the
+*   covering check. FKs to auth_clients / auth_realms and a nullable user_id
+*   FK (all ON DELETE CASCADE, so a user deletion drops its consents;
+*   plan 055).
+* - Adds auth_keys.use: JWK-use discriminator (sig | enc, RFC 7517 §4.2) —
+*   generalizes auth_keys into the per-realm key store. enc rows hold the
+*   realm's auto-generated symmetric at-rest encryption key (oct) that the
+*   MFA seed cipher rides; existing rows default to sig (plan 069).
+* - Adds auth_keys.name (canonical identifier, backfilled from id),
+*   auth_keys.status (lifecycle: active/passive/disabled) and the dormant
+*   auth_keys.certificate (PEM chain, Stage B) — key management API
+*   (plan 071 Stage A).
+* - Adds auth_trust_anchors: realm-scoped public CA certificates used by
+*   RFC 8705 PKI client authentication (plan 071 Stage C).
+* - Replaces auth_clients.is_confidential with auth_method
+*   (none/secret/tls) and adds token_binding_method (none/tls) for RFC 8705
+*   client authentication and sender-constrained tokens (plan 072).
+*/ var Default1783769340000 = class {
+	name = "Default1783769340000";
+	async up(queryRunner) {
+		await queryRunner.query(`
+            CREATE TABLE "auth_events" (
+                "id" uuid NOT NULL,
+                "scope" character varying(64) NOT NULL,
+                "name" character varying(64) NOT NULL,
+                "ref_type" character varying(64),
+                "ref_id" character varying(64),
+                "client_id" uuid,
+                "actor_type" character varying(16),
+                "actor_id" uuid,
+                "actor_name" character varying(128),
+                "request_path" character varying(256),
+                "request_method" character varying(10),
+                "request_ip_address" character varying(45),
+                "request_user_agent" character varying(512),
+                "realm_id" uuid,
+                "data" text,
+                "expiring" boolean NOT NULL DEFAULT false,
+                "expires_at" character varying(28),
+                "created_at" TIMESTAMP NOT NULL DEFAULT now(),
+                CONSTRAINT "PK_auth_events" PRIMARY KEY ("id")
+            )
+        `);
+		await queryRunner.query("CREATE INDEX \"IDX_auth_events_name_scope\" ON \"auth_events\" (\"name\", \"scope\")");
+		await queryRunner.query("CREATE INDEX \"IDX_auth_events_ref_type_ref_id\" ON \"auth_events\" (\"ref_type\", \"ref_id\")");
+		await queryRunner.query("CREATE INDEX \"IDX_auth_events_client_id\" ON \"auth_events\" (\"client_id\")");
+		await queryRunner.query("CREATE INDEX \"IDX_auth_events_actor_id\" ON \"auth_events\" (\"actor_id\")");
+		await queryRunner.query("CREATE INDEX \"IDX_auth_events_actor_name\" ON \"auth_events\" (\"actor_name\")");
+		await queryRunner.query("CREATE INDEX \"IDX_auth_events_request_ip_address\" ON \"auth_events\" (\"request_ip_address\")");
+		await queryRunner.query("CREATE INDEX \"IDX_auth_events_realm_id\" ON \"auth_events\" (\"realm_id\")");
+		await queryRunner.query("CREATE INDEX \"IDX_auth_events_expiring\" ON \"auth_events\" (\"expiring\")");
+		await queryRunner.query("CREATE INDEX \"IDX_auth_events_expires_at\" ON \"auth_events\" (\"expires_at\")");
+		await queryRunner.query("CREATE INDEX \"IDX_auth_events_created_at\" ON \"auth_events\" (\"created_at\")");
+		await queryRunner.query(`
+            CREATE TABLE "auth_user_authenticators" (
+                "id" uuid NOT NULL DEFAULT uuid_generate_v4(),
+                "kind" character varying(16) NOT NULL,
+                "name" character varying(128),
+                "secret" text,
+                "parameters" text,
+                "codes" text,
+                "confirmed" boolean NOT NULL DEFAULT false,
+                "last_used_at" character varying(28),
+                "created_at" TIMESTAMP NOT NULL DEFAULT now(),
+                "updated_at" TIMESTAMP NOT NULL DEFAULT now(),
+                "user_id" uuid NOT NULL,
+                "realm_id" uuid NOT NULL,
+                CONSTRAINT "PK_auth_user_authenticators" PRIMARY KEY ("id")
+            )
+        `);
+		await queryRunner.query("CREATE INDEX \"IDX_auth_user_authenticators_kind\" ON \"auth_user_authenticators\" (\"kind\")");
+		await queryRunner.query("CREATE INDEX \"IDX_auth_user_authenticators_user_id\" ON \"auth_user_authenticators\" (\"user_id\")");
+		await queryRunner.query(`
+            ALTER TABLE "auth_user_authenticators"
+            ADD CONSTRAINT "FK_auth_user_authenticators_user_id" FOREIGN KEY ("user_id") REFERENCES "auth_users"("id") ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_user_authenticators"
+            ADD CONSTRAINT "FK_auth_user_authenticators_realm_id" FOREIGN KEY ("realm_id") REFERENCES "auth_realms"("id") ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_sessions" ADD "mfa_at" character varying(28)
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_sessions" ADD "auth_method" character varying(16)
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_clients" ADD "access_policy_id" uuid
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_clients"
+            ADD CONSTRAINT "FK_auth_clients_access_policy_id" FOREIGN KEY ("access_policy_id") REFERENCES "auth_policies"("id") ON DELETE SET NULL ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            CREATE TABLE "auth_consents" (
+                "id" uuid NOT NULL DEFAULT uuid_generate_v4(),
+                "sub" character varying(64) NOT NULL,
+                "sub_kind" character varying(64) NOT NULL,
+                "scope" character varying(128) NOT NULL,
+                "expires_at" character varying(28),
+                "created_at" TIMESTAMP NOT NULL DEFAULT now(),
+                "updated_at" TIMESTAMP NOT NULL DEFAULT now(),
+                "client_id" uuid NOT NULL,
+                "realm_id" uuid NOT NULL,
+                "user_id" uuid,
+                CONSTRAINT "UQ_auth_consents_subject_scope" UNIQUE ("client_id", "sub", "sub_kind", "scope"),
+                CONSTRAINT "PK_auth_consents" PRIMARY KEY ("id")
+            )
+        `);
+		await queryRunner.query("CREATE INDEX \"IDX_auth_consents_sub\" ON \"auth_consents\" (\"sub\")");
+		await queryRunner.query("CREATE INDEX \"IDX_auth_consents_client_id\" ON \"auth_consents\" (\"client_id\")");
+		await queryRunner.query("CREATE INDEX \"IDX_auth_consents_realm_id\" ON \"auth_consents\" (\"realm_id\")");
+		await queryRunner.query("CREATE INDEX \"IDX_auth_consents_user_id\" ON \"auth_consents\" (\"user_id\")");
+		await queryRunner.query(`
+            ALTER TABLE "auth_consents"
+            ADD CONSTRAINT "FK_auth_consents_client_id" FOREIGN KEY ("client_id") REFERENCES "auth_clients"("id") ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_consents"
+            ADD CONSTRAINT "FK_auth_consents_realm_id" FOREIGN KEY ("realm_id") REFERENCES "auth_realms"("id") ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_consents"
+            ADD CONSTRAINT "FK_auth_consents_user_id" FOREIGN KEY ("user_id") REFERENCES "auth_users"("id") ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_keys" ADD "use" character varying(64) NOT NULL DEFAULT 'sig'
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_keys" ADD "name" character varying(128)
+        `);
+		await queryRunner.query(`
+            UPDATE "auth_keys" SET "name" = "id"::text
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_keys" ALTER COLUMN "name" SET NOT NULL
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_keys"
+            ADD CONSTRAINT "UQ_auth_keys_name_realm_id" UNIQUE ("name", "realm_id")
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_keys" ADD "status" character varying(64) NOT NULL DEFAULT 'active'
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_keys" ADD "certificate" text
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_keys" ALTER COLUMN "decryption_key" TYPE text
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_keys" ALTER COLUMN "encryption_key" TYPE text
+        `);
+		await queryRunner.query(`
+            CREATE TABLE "auth_trust_anchors" (
+                "id" uuid NOT NULL DEFAULT uuid_generate_v4(),
+                "name" character varying(128) NOT NULL,
+                "certificate" text NOT NULL,
+                "enabled" boolean NOT NULL DEFAULT true,
+                "created_at" TIMESTAMP NOT NULL DEFAULT now(),
+                "updated_at" TIMESTAMP NOT NULL DEFAULT now(),
+                "realm_id" uuid NOT NULL,
+                CONSTRAINT "UQ_auth_trust_anchors_name_realm_id" UNIQUE ("name", "realm_id"),
+                CONSTRAINT "PK_auth_trust_anchors" PRIMARY KEY ("id")
+            )
+        `);
+		await queryRunner.query("CREATE INDEX \"IDX_auth_trust_anchors_realm_id\" ON \"auth_trust_anchors\" (\"realm_id\")");
+		await queryRunner.query(`
+            ALTER TABLE "auth_trust_anchors"
+            ADD CONSTRAINT "FK_auth_trust_anchors_realm_id" FOREIGN KEY ("realm_id") REFERENCES "auth_realms"("id") ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_clients" ADD "auth_method" character varying(16) NOT NULL DEFAULT 'none'
+        `);
+		await queryRunner.query(`
+            UPDATE "auth_clients" SET "auth_method" = 'secret' WHERE "is_confidential" = true
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_clients" ADD "token_binding_method" character varying(16) NOT NULL DEFAULT 'none'
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_clients" DROP COLUMN "is_confidential"
+        `);
+	}
+	async down(queryRunner) {
+		await queryRunner.query(`
+            ALTER TABLE "auth_clients" ADD "is_confidential" boolean NOT NULL DEFAULT false
+        `);
+		await queryRunner.query(`
+            UPDATE "auth_clients" SET "is_confidential" = true WHERE "auth_method" <> 'none'
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_clients" DROP COLUMN "token_binding_method"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_clients" DROP COLUMN "auth_method"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_trust_anchors" DROP CONSTRAINT "FK_auth_trust_anchors_realm_id"
+        `);
+		await queryRunner.query("DROP INDEX \"public\".\"IDX_auth_trust_anchors_realm_id\"");
+		await queryRunner.query(`
+            DROP TABLE "auth_trust_anchors"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_keys" ALTER COLUMN "encryption_key" TYPE character varying(4096)
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_keys" ALTER COLUMN "decryption_key" TYPE character varying(4096)
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_keys" DROP COLUMN "certificate"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_keys" DROP COLUMN "status"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_keys" DROP CONSTRAINT "UQ_auth_keys_name_realm_id"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_keys" DROP COLUMN "name"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_keys" DROP COLUMN "use"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_consents" DROP CONSTRAINT "FK_auth_consents_user_id"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_consents" DROP CONSTRAINT "FK_auth_consents_realm_id"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_consents" DROP CONSTRAINT "FK_auth_consents_client_id"
+        `);
+		await queryRunner.query("DROP INDEX \"public\".\"IDX_auth_consents_user_id\"");
+		await queryRunner.query("DROP INDEX \"public\".\"IDX_auth_consents_realm_id\"");
+		await queryRunner.query("DROP INDEX \"public\".\"IDX_auth_consents_client_id\"");
+		await queryRunner.query("DROP INDEX \"public\".\"IDX_auth_consents_sub\"");
+		await queryRunner.query(`
+            DROP TABLE "auth_consents"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_clients" DROP CONSTRAINT "FK_auth_clients_access_policy_id"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_clients" DROP COLUMN "access_policy_id"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_sessions" DROP COLUMN "auth_method"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_sessions" DROP COLUMN "mfa_at"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_user_authenticators" DROP CONSTRAINT "FK_auth_user_authenticators_realm_id"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_user_authenticators" DROP CONSTRAINT "FK_auth_user_authenticators_user_id"
+        `);
+		await queryRunner.query("DROP INDEX \"public\".\"IDX_auth_user_authenticators_user_id\"");
+		await queryRunner.query("DROP INDEX \"public\".\"IDX_auth_user_authenticators_kind\"");
+		await queryRunner.query(`
+            DROP TABLE "auth_user_authenticators"
+        `);
+		await queryRunner.query("DROP INDEX \"public\".\"IDX_auth_events_created_at\"");
+		await queryRunner.query("DROP INDEX \"public\".\"IDX_auth_events_expires_at\"");
+		await queryRunner.query("DROP INDEX \"public\".\"IDX_auth_events_expiring\"");
+		await queryRunner.query("DROP INDEX \"public\".\"IDX_auth_events_realm_id\"");
+		await queryRunner.query("DROP INDEX \"public\".\"IDX_auth_events_request_ip_address\"");
+		await queryRunner.query("DROP INDEX \"public\".\"IDX_auth_events_actor_name\"");
+		await queryRunner.query("DROP INDEX \"public\".\"IDX_auth_events_actor_id\"");
+		await queryRunner.query("DROP INDEX \"public\".\"IDX_auth_events_client_id\"");
+		await queryRunner.query("DROP INDEX \"public\".\"IDX_auth_events_ref_type_ref_id\"");
+		await queryRunner.query("DROP INDEX \"public\".\"IDX_auth_events_name_scope\"");
+		await queryRunner.query("DROP TABLE \"auth_events\"");
+	}
+};
+//#endregion
+export { Default1783769340000 };
+
+//# sourceMappingURL=1783769340000-Default.mjs.map

package/dist/adapters/database/migrations/postgres/1783769340000-Default.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"1783769340000-Default.mjs","names":["Default1783769340000","name","up","queryRunner","query","down"],"sources":["../../../../../src/adapters/database/migrations/postgres/1783769340000-Default.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { MigrationInterface, QueryRunner } from 'typeorm';\n\n/**\n * Security event log (plan 057), MFA — authenticator devices (plan 049) +\n * auth-method claims (plan 050), application access policy (plan 052) +\n * persisted consent (plan 055), realm key store (plans 069 + 071) and\n * RFC 8705 client authentication (plan 072).\n *\n * - Adds auth_events: append-only, PII-stripped security audit log. No FKs\n *   by design: a row must survive deletion of the realm/actor/client it\n *   references. Retention is per-row (`expires_at`, stamped at write from\n *   `eventLogRetentionDays`; NULL = keep forever) and swept by the\n *   event-cleaner component (plan 057).\n * - Adds auth_user_authenticators: polymorphic second-factor device rows\n *   (kind: totp/recovery/email/webauthn) hanging off a user. The TOTP seed\n *   (secret) is symmetrically encrypted at rest; recovery codes are hashed.\n *   FKs to auth_users / auth_realms (ON DELETE CASCADE).\n * - Adds auth_sessions.mfa_at: instant the subject last passed a\n *   second-factor challenge for the session (plan 049).\n * - Adds auth_sessions.auth_method: how the subject authenticated\n *   (pwd/ldap/ext/client/robot — plan 050); NULL for pre-existing sessions.\n * - Adds auth_clients.access_policy_id: nullable FK to auth_policies\n *   (ON DELETE SET NULL) — the policy that must pass for an identity to\n *   authorize against the client (null = default-allow; plan 052).\n * - Adds auth_consents: one row per (client_id, sub, sub_kind, scope token)\n *   a subject has approved at POST /authorize. Union/keep (missing tokens\n *   only, never deleted on re-approval); built_in clients keep zero rows;\n *   expires_at is dormant (always null in Stage 1) but honored by the\n *   covering check. FKs to auth_clients / auth_realms and a nullable user_id\n *   FK (all ON DELETE CASCADE, so a user deletion drops its consents;\n *   plan 055).\n * - Adds auth_keys.use: JWK-use discriminator (sig | enc, RFC 7517 §4.2) —\n *   generalizes auth_keys into the per-realm key store. enc rows hold the\n *   realm's auto-generated symmetric at-rest encryption key (oct) that the\n *   MFA seed cipher rides; existing rows default to sig (plan 069).\n * - Adds auth_keys.name (canonical identifier, backfilled from id),\n *   auth_keys.status (lifecycle: active/passive/disabled) and the dormant\n *   auth_keys.certificate (PEM chain, Stage B) — key management API\n *   (plan 071 Stage A).\n * - Adds auth_trust_anchors: realm-scoped public CA certificates used by\n *   RFC 8705 PKI client authentication (plan 071 Stage C).\n * - Replaces auth_clients.is_confidential with auth_method\n *   (none/secret/tls) and adds token_binding_method (none/tls) for RFC 8705\n *   client authentication and sender-constrained tokens (plan 072).\n */\nexport class Default1783769340000 implements MigrationInterface {\n    name = 'Default1783769340000';\n\n    public async up(queryRunner: QueryRunner): Promise<void> {\n        // security event log (plan 057)\n        await queryRunner.query(`\n            CREATE TABLE \"auth_events\" (\n                \"id\" uuid NOT NULL,\n                \"scope\" character varying(64) NOT NULL,\n                \"name\" character varying(64) NOT NULL,\n                \"ref_type\" character varying(64),\n                \"ref_id\" character varying(64),\n                \"client_id\" uuid,\n                \"actor_type\" character varying(16),\n                \"actor_id\" uuid,\n                \"actor_name\" character varying(128),\n                \"request_path\" character varying(256),\n                \"request_method\" character varying(10),\n                \"request_ip_address\" character varying(45),\n                \"request_user_agent\" character varying(512),\n                \"realm_id\" uuid,\n                \"data\" text,\n                \"expiring\" boolean NOT NULL DEFAULT false,\n                \"expires_at\" character varying(28),\n                \"created_at\" TIMESTAMP NOT NULL DEFAULT now(),\n                CONSTRAINT \"PK_auth_events\" PRIMARY KEY (\"id\")\n            )\n        `);\n        await queryRunner.query('CREATE INDEX \"IDX_auth_events_name_scope\" ON \"auth_events\" (\"name\", \"scope\")');\n        await queryRunner.query('CREATE INDEX \"IDX_auth_events_ref_type_ref_id\" ON \"auth_events\" (\"ref_type\", \"ref_id\")');\n        await queryRunner.query('CREATE INDEX \"IDX_auth_events_client_id\" ON \"auth_events\" (\"client_id\")');\n        await queryRunner.query('CREATE INDEX \"IDX_auth_events_actor_id\" ON \"auth_events\" (\"actor_id\")');\n        await queryRunner.query('CREATE INDEX \"IDX_auth_events_actor_name\" ON \"auth_events\" (\"actor_name\")');\n        await queryRunner.query('CREATE INDEX \"IDX_auth_events_request_ip_address\" ON \"auth_events\" (\"request_ip_address\")');\n        await queryRunner.query('CREATE INDEX \"IDX_auth_events_realm_id\" ON \"auth_events\" (\"realm_id\")');\n        await queryRunner.query('CREATE INDEX \"IDX_auth_events_expiring\" ON \"auth_events\" (\"expiring\")');\n        await queryRunner.query('CREATE INDEX \"IDX_auth_events_expires_at\" ON \"auth_events\" (\"expires_at\")');\n        await queryRunner.query('CREATE INDEX \"IDX_auth_events_created_at\" ON \"auth_events\" (\"created_at\")');\n\n        // MFA authenticator devices (plan 049)\n        await queryRunner.query(`\n            CREATE TABLE \"auth_user_authenticators\" (\n                \"id\" uuid NOT NULL DEFAULT uuid_generate_v4(),\n                \"kind\" character varying(16) NOT NULL,\n                \"name\" character varying(128),\n                \"secret\" text,\n                \"parameters\" text,\n                \"codes\" text,\n                \"confirmed\" boolean NOT NULL DEFAULT false,\n                \"last_used_at\" character varying(28),\n                \"created_at\" TIMESTAMP NOT NULL DEFAULT now(),\n                \"updated_at\" TIMESTAMP NOT NULL DEFAULT now(),\n                \"user_id\" uuid NOT NULL,\n                \"realm_id\" uuid NOT NULL,\n                CONSTRAINT \"PK_auth_user_authenticators\" PRIMARY KEY (\"id\")\n            )\n        `);\n        await queryRunner.query('CREATE INDEX \"IDX_auth_user_authenticators_kind\" ON \"auth_user_authenticators\" (\"kind\")');\n        await queryRunner.query('CREATE INDEX \"IDX_auth_user_authenticators_user_id\" ON \"auth_user_authenticators\" (\"user_id\")');\n\n        await queryRunner.query(`\n            ALTER TABLE \"auth_user_authenticators\"\n            ADD CONSTRAINT \"FK_auth_user_authenticators_user_id\" FOREIGN KEY (\"user_id\") REFERENCES \"auth_users\"(\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \"auth_user_authenticators\"\n            ADD CONSTRAINT \"FK_auth_user_authenticators_realm_id\" FOREIGN KEY (\"realm_id\") REFERENCES \"auth_realms\"(\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n        `);\n\n        await queryRunner.query(`\n            ALTER TABLE \"auth_sessions\" ADD \"mfa_at\" character varying(28)\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \"auth_sessions\" ADD \"auth_method\" character varying(16)\n        `);\n\n        // application access policy (plan 052)\n        await queryRunner.query(`\n            ALTER TABLE \"auth_clients\" ADD \"access_policy_id\" uuid\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \"auth_clients\"\n            ADD CONSTRAINT \"FK_auth_clients_access_policy_id\" FOREIGN KEY (\"access_policy_id\") REFERENCES \"auth_policies\"(\"id\") ON DELETE SET NULL ON UPDATE NO ACTION\n        `);\n\n        // persisted per-scope consent (plan 055)\n        await queryRunner.query(`\n            CREATE TABLE \"auth_consents\" (\n                \"id\" uuid NOT NULL DEFAULT uuid_generate_v4(),\n                \"sub\" character varying(64) NOT NULL,\n                \"sub_kind\" character varying(64) NOT NULL,\n                \"scope\" character varying(128) NOT NULL,\n                \"expires_at\" character varying(28),\n                \"created_at\" TIMESTAMP NOT NULL DEFAULT now(),\n                \"updated_at\" TIMESTAMP NOT NULL DEFAULT now(),\n                \"client_id\" uuid NOT NULL,\n                \"realm_id\" uuid NOT NULL,\n                \"user_id\" uuid,\n                CONSTRAINT \"UQ_auth_consents_subject_scope\" UNIQUE (\"client_id\", \"sub\", \"sub_kind\", \"scope\"),\n                CONSTRAINT \"PK_auth_consents\" PRIMARY KEY (\"id\")\n            )\n        `);\n        await queryRunner.query('CREATE INDEX \"IDX_auth_consents_sub\" ON \"auth_consents\" (\"sub\")');\n        await queryRunner.query('CREATE INDEX \"IDX_auth_consents_client_id\" ON \"auth_consents\" (\"client_id\")');\n        await queryRunner.query('CREATE INDEX \"IDX_auth_consents_realm_id\" ON \"auth_consents\" (\"realm_id\")');\n        await queryRunner.query('CREATE INDEX \"IDX_auth_consents_user_id\" ON \"auth_consents\" (\"user_id\")');\n\n        await queryRunner.query(`\n            ALTER TABLE \"auth_consents\"\n            ADD CONSTRAINT \"FK_auth_consents_client_id\" FOREIGN KEY (\"client_id\") REFERENCES \"auth_clients\"(\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \"auth_consents\"\n            ADD CONSTRAINT \"FK_auth_consents_realm_id\" FOREIGN KEY (\"realm_id\") REFERENCES \"auth_realms\"(\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \"auth_consents\"\n            ADD CONSTRAINT \"FK_auth_consents_user_id\" FOREIGN KEY (\"user_id\") REFERENCES \"auth_users\"(\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n        `);\n\n        // realm key store use discriminator (plan 069)\n        await queryRunner.query(`\n            ALTER TABLE \"auth_keys\" ADD \"use\" character varying(64) NOT NULL DEFAULT 'sig'\n        `);\n\n        // key management API (plan 071 Stage A)\n        await queryRunner.query(`\n            ALTER TABLE \"auth_keys\" ADD \"name\" character varying(128)\n        `);\n        await queryRunner.query(`\n            UPDATE \"auth_keys\" SET \"name\" = \"id\"::text\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \"auth_keys\" ALTER COLUMN \"name\" SET NOT NULL\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \"auth_keys\"\n            ADD CONSTRAINT \"UQ_auth_keys_name_realm_id\" UNIQUE (\"name\", \"realm_id\")\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \"auth_keys\" ADD \"status\" character varying(64) NOT NULL DEFAULT 'active'\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \"auth_keys\" ADD \"certificate\" text\n        `);\n        // Widen the key-material columns: an imported RSA-4096 private key\n        // wrapped under a SECRETS_ENCRYPTION_KEY exceeds character varying(4096).\n        await queryRunner.query(`\n            ALTER TABLE \"auth_keys\" ALTER COLUMN \"decryption_key\" TYPE text\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \"auth_keys\" ALTER COLUMN \"encryption_key\" TYPE text\n        `);\n\n        // RFC 8705 realm trust anchors (plan 071 Stage C)\n        await queryRunner.query(`\n            CREATE TABLE \"auth_trust_anchors\" (\n                \"id\" uuid NOT NULL DEFAULT uuid_generate_v4(),\n                \"name\" character varying(128) NOT NULL,\n                \"certificate\" text NOT NULL,\n                \"enabled\" boolean NOT NULL DEFAULT true,\n                \"created_at\" TIMESTAMP NOT NULL DEFAULT now(),\n                \"updated_at\" TIMESTAMP NOT NULL DEFAULT now(),\n                \"realm_id\" uuid NOT NULL,\n                CONSTRAINT \"UQ_auth_trust_anchors_name_realm_id\" UNIQUE (\"name\", \"realm_id\"),\n                CONSTRAINT \"PK_auth_trust_anchors\" PRIMARY KEY (\"id\")\n            )\n        `);\n        await queryRunner.query('CREATE INDEX \"IDX_auth_trust_anchors_realm_id\" ON \"auth_trust_anchors\" (\"realm_id\")');\n        await queryRunner.query(`\n            ALTER TABLE \"auth_trust_anchors\"\n            ADD CONSTRAINT \"FK_auth_trust_anchors_realm_id\" FOREIGN KEY (\"realm_id\") REFERENCES \"auth_realms\"(\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n        `);\n\n        // RFC 8705 client authentication and token binding (plan 072)\n        await queryRunner.query(`\n            ALTER TABLE \"auth_clients\" ADD \"auth_method\" character varying(16) NOT NULL DEFAULT 'none'\n        `);\n        await queryRunner.query(`\n            UPDATE \"auth_clients\" SET \"auth_method\" = 'secret' WHERE \"is_confidential\" = true\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \"auth_clients\" ADD \"token_binding_method\" character varying(16) NOT NULL DEFAULT 'none'\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \"auth_clients\" DROP COLUMN \"is_confidential\"\n        `);\n    }\n\n    public async down(queryRunner: QueryRunner): Promise<void> {\n        // RFC 8705 client authentication and token binding (plan 072)\n        await queryRunner.query(`\n            ALTER TABLE \"auth_clients\" ADD \"is_confidential\" boolean NOT NULL DEFAULT false\n        `);\n        await queryRunner.query(`\n            UPDATE \"auth_clients\" SET \"is_confidential\" = true WHERE \"auth_method\" <> 'none'\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \"auth_clients\" DROP COLUMN \"token_binding_method\"\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \"auth_clients\" DROP COLUMN \"auth_method\"\n        `);\n\n        // RFC 8705 realm trust anchors (plan 071 Stage C)\n        await queryRunner.query(`\n            ALTER TABLE \"auth_trust_anchors\" DROP CONSTRAINT \"FK_auth_trust_anchors_realm_id\"\n        `);\n        await queryRunner.query('DROP INDEX \"public\".\"IDX_auth_trust_anchors_realm_id\"');\n        await queryRunner.query(`\n            DROP TABLE \"auth_trust_anchors\"\n        `);\n\n        // key management API (plan 071 Stage A) — reverse last-in-first-out\n        await queryRunner.query(`\n            ALTER TABLE \"auth_keys\" ALTER COLUMN \"encryption_key\" TYPE character varying(4096)\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \"auth_keys\" ALTER COLUMN \"decryption_key\" TYPE character varying(4096)\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \"auth_keys\" DROP COLUMN \"certificate\"\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \"auth_keys\" DROP COLUMN \"status\"\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \"auth_keys\" DROP CONSTRAINT \"UQ_auth_keys_name_realm_id\"\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \"auth_keys\" DROP COLUMN \"name\"\n        `);\n\n        // realm key store use discriminator (plan 069)\n        await queryRunner.query(`\n            ALTER TABLE \"auth_keys\" DROP COLUMN \"use\"\n        `);\n\n        // persisted per-scope consent (plan 055)\n        await queryRunner.query(`\n            ALTER TABLE \"auth_consents\" DROP CONSTRAINT \"FK_auth_consents_user_id\"\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \"auth_consents\" DROP CONSTRAINT \"FK_auth_consents_realm_id\"\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \"auth_consents\" DROP CONSTRAINT \"FK_auth_consents_client_id\"\n        `);\n        await queryRunner.query('DROP INDEX \"public\".\"IDX_auth_consents_user_id\"');\n        await queryRunner.query('DROP INDEX \"public\".\"IDX_auth_consents_realm_id\"');\n        await queryRunner.query('DROP INDEX \"public\".\"IDX_auth_consents_client_id\"');\n        await queryRunner.query('DROP INDEX \"public\".\"IDX_auth_consents_sub\"');\n        await queryRunner.query(`\n            DROP TABLE \"auth_consents\"\n        `);\n\n        // application access policy (plan 052)\n        await queryRunner.query(`\n            ALTER TABLE \"auth_clients\" DROP CONSTRAINT \"FK_auth_clients_access_policy_id\"\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \"auth_clients\" DROP COLUMN \"access_policy_id\"\n        `);\n\n        await queryRunner.query(`\n            ALTER TABLE \"auth_sessions\" DROP COLUMN \"auth_method\"\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \"auth_sessions\" DROP COLUMN \"mfa_at\"\n        `);\n\n        await queryRunner.query(`\n            ALTER TABLE \"auth_user_authenticators\" DROP CONSTRAINT \"FK_auth_user_authenticators_realm_id\"\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \"auth_user_authenticators\" DROP CONSTRAINT \"FK_auth_user_authenticators_user_id\"\n        `);\n        await queryRunner.query('DROP INDEX \"public\".\"IDX_auth_user_authenticators_user_id\"');\n        await queryRunner.query('DROP INDEX \"public\".\"IDX_auth_user_authenticators_kind\"');\n        await queryRunner.query(`\n            DROP TABLE \"auth_user_authenticators\"\n        `);\n\n        // security event log (plan 057)\n        await queryRunner.query('DROP INDEX \"public\".\"IDX_auth_events_created_at\"');\n        await queryRunner.query('DROP INDEX \"public\".\"IDX_auth_events_expires_at\"');\n        await queryRunner.query('DROP INDEX \"public\".\"IDX_auth_events_expiring\"');\n        await queryRunner.query('DROP INDEX \"public\".\"IDX_auth_events_realm_id\"');\n        await queryRunner.query('DROP INDEX \"public\".\"IDX_auth_events_request_ip_address\"');\n        await queryRunner.query('DROP INDEX \"public\".\"IDX_auth_events_actor_name\"');\n        await queryRunner.query('DROP INDEX \"public\".\"IDX_auth_events_actor_id\"');\n        await queryRunner.query('DROP INDEX \"public\".\"IDX_auth_events_client_id\"');\n        await queryRunner.query('DROP INDEX \"public\".\"IDX_auth_events_ref_type_ref_id\"');\n        await queryRunner.query('DROP INDEX \"public\".\"IDX_auth_events_name_scope\"');\n        await queryRunner.query('DROP TABLE \"auth_events\"');\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDA,IAAaA,uBAAb,MAAaA;CACTC,OAAO;CAEP,MAAaC,GAAGC,aAAyC;EAErD,MAAMA,YAAYC,MAAM;;;;;;;;;;;;;;;;;;;;;;SAsBvB;EACD,MAAMD,YAAYC,MAAM,sFAAA;EACxB,MAAMD,YAAYC,MAAM,gGAAA;EACxB,MAAMD,YAAYC,MAAM,+EAAA;EACxB,MAAMD,YAAYC,MAAM,6EAAA;EACxB,MAAMD,YAAYC,MAAM,iFAAA;EACxB,MAAMD,YAAYC,MAAM,iGAAA;EACxB,MAAMD,YAAYC,MAAM,6EAAA;EACxB,MAAMD,YAAYC,MAAM,6EAAA;EACxB,MAAMD,YAAYC,MAAM,iFAAA;EACxB,MAAMD,YAAYC,MAAM,iFAAA;EAGxB,MAAMD,YAAYC,MAAM;;;;;;;;;;;;;;;;SAgBvB;EACD,MAAMD,YAAYC,MAAM,+FAAA;EACxB,MAAMD,YAAYC,MAAM,qGAAA;EAExB,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EAED,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EAGD,MAAMD,YAAYC,MAAM;;;;;;;;;;;;;;;SAevB;EACD,MAAMD,YAAYC,MAAM,uEAAA;EACxB,MAAMD,YAAYC,MAAM,mFAAA;EACxB,MAAMD,YAAYC,MAAM,iFAAA;EACxB,MAAMD,YAAYC,MAAM,+EAAA;EAExB,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;;;;;;;;;;;SAYvB;EACD,MAAMD,YAAYC,MAAM,2FAAA;EACxB,MAAMD,YAAYC,MAAM;;;SAGvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;CACL;CAEA,MAAaC,KAAKF,aAAyC;EAEvD,MAAMA,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM,2DAAA;EACxB,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM,qDAAA;EACxB,MAAMD,YAAYC,MAAM,sDAAA;EACxB,MAAMD,YAAYC,MAAM,uDAAA;EACxB,MAAMD,YAAYC,MAAM,iDAAA;EACxB,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAED,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAED,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM,gEAAA;EACxB,MAAMD,YAAYC,MAAM,6DAAA;EACxB,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM,sDAAA;EACxB,MAAMD,YAAYC,MAAM,sDAAA;EACxB,MAAMD,YAAYC,MAAM,oDAAA;EACxB,MAAMD,YAAYC,MAAM,oDAAA;EACxB,MAAMD,YAAYC,MAAM,8DAAA;EACxB,MAAMD,YAAYC,MAAM,sDAAA;EACxB,MAAMD,YAAYC,MAAM,oDAAA;EACxB,MAAMD,YAAYC,MAAM,qDAAA;EACxB,MAAMD,YAAYC,MAAM,2DAAA;EACxB,MAAMD,YAAYC,MAAM,sDAAA;EACxB,MAAMD,YAAYC,MAAM,4BAAA;CAC5B;AACJ"}

package/dist/adapters/database/subscriber/module.d.ts

@@ -14,6 +14,6 @@ export declare class EntitySubscriber<T extends ObjectLiteral> implements Entity
     afterUpdate(event: UpdateEvent<T>): Promise<any>;
     afterRemove(event: RemoveEvent<T>): Promise<any>;
     protected dropCacheKeys(connection: DataSource, data: T): Promise<void>;
-    protected publish(event: `${EntityDefaultEventName}`, data: T): Promise<void>;
+    protected publish(event: `${EntityDefaultEventName}`, data: T, dataPrevious?: T): Promise<void>;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/adapters/database/subscriber/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/adapters/database/subscriber/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EACH,sBAAsB,EAGzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACzF,OAAO,KAAK,EACR,UAAU,EACV,yBAAyB,EACzB,WAAW,EACX,aAAa,EACb,WAAW,EACX,WAAW,EACd,MAAM,SAAS,CAAC;AACjB,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE1D,wBAAgB,uBAAuB,CAAC,CAAC,SAAS,aAAa,EAC3D,IAAI,EAAE,GAAG,UAAU,EAAE,EACrB,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,EAAE,GACrD,CAAC,IAAI,EAAE,CAAC,KAAK,uBAAuB,CAsBvC;AAED,qBAAa,gBAAgB,CAAC,CAAC,SAAS,aAAa,CAAE,YAAW,yBAAyB,CAAC,CAAC,CAAC;IAC1F,SAAS,CAAC,GAAG,EAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC;IAE3C,SAAS,CAAC,SAAS,CAAC,EAAG,qBAAqB,CAAC;gBAEjC,GAAG,EAAE,uBAAuB,CAAC,CAAC,CAAC;IAK3C,YAAY,CAAC,SAAS,EAAE,qBAAqB,GAAI,IAAI;IAKrD,QAAQ,IAAK,QAAQ,GAAG,MAAM;IAIxB,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC;IAYhD,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC;IAUhD,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC;cActC,aAAa,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAI,OAAO,CAAC,IAAI,CAAC;cAQ9D,OAAO,CAAC,KAAK,EAAE,GAAG,sBAAsB,EAAE,EAAE,IAAI,EAAE,CAAC,GAAI,OAAO,CAAC,IAAI,CAAC;CAcvF"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/adapters/database/subscriber/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EACH,sBAAsB,EAGzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACzF,OAAO,KAAK,EACR,UAAU,EACV,yBAAyB,EACzB,WAAW,EACX,aAAa,EACb,WAAW,EACX,WAAW,EACd,MAAM,SAAS,CAAC;AACjB,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE1D,wBAAgB,uBAAuB,CAAC,CAAC,SAAS,aAAa,EAC3D,IAAI,EAAE,GAAG,UAAU,EAAE,EACrB,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,EAAE,GACrD,CAAC,IAAI,EAAE,CAAC,KAAK,uBAAuB,CAsBvC;AAED,qBAAa,gBAAgB,CAAC,CAAC,SAAS,aAAa,CAAE,YAAW,yBAAyB,CAAC,CAAC,CAAC;IAC1F,SAAS,CAAC,GAAG,EAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC;IAE3C,SAAS,CAAC,SAAS,CAAC,EAAG,qBAAqB,CAAC;gBAEjC,GAAG,EAAE,uBAAuB,CAAC,CAAC,CAAC;IAK3C,YAAY,CAAC,SAAS,EAAE,qBAAqB,GAAI,IAAI;IAKrD,QAAQ,IAAK,QAAQ,GAAG,MAAM;IAIxB,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC;IAYhD,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC;IAUhD,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC;cActC,aAAa,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAI,OAAO,CAAC,IAAI,CAAC;cAQ9D,OAAO,CACnB,KAAK,EAAE,GAAG,sBAAsB,EAAE,EAClC,IAAI,EAAE,CAAC,EACP,YAAY,CAAC,EAAE,CAAC,GAChB,OAAO,CAAC,IAAI,CAAC;CAepB"}

package/dist/adapters/database/subscriber/module.mjs

@@ -41,7 +41,7 @@ var EntitySubscriber = class {
 	async afterUpdate(event) {
 		if (!event.entity) return;
 		await this.dropCacheKeys(event.connection, event.entity);
-		await this.publish(EntityDefaultEventName.UPDATED, event.entity);
+		await this.publish(EntityDefaultEventName.UPDATED, event.entity, event.databaseEntity);
 	}
 	async afterRemove(event) {
 		const entity = event.databaseEntity ?? event.entity;
@@ -53,7 +53,7 @@ var EntitySubscriber = class {
 		if (!this.ctx.cache || !connection.queryResultCache) return;
 		await connection.queryResultCache.remove(this.ctx.cache.keys(data));
 	}
-	async publish(event, data) {
+	async publish(event, data, dataPrevious) {
 		if (!this.publisher) return;
 		await this.publisher.safePublish({
 			content: {
@@ -61,7 +61,8 @@ var EntitySubscriber = class {
 				event,
 				data
 			},
-			destinations: this.ctx.destinations(data)
+			destinations: this.ctx.destinations(data),
+			...dataPrevious ? { dataPrevious } : {}
 		});
 	}
 };

package/dist/adapters/database/subscriber/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["EntityDefaultEventName","buildEntityChannelName","buildEntityNamespaceName","buildEntityDestinations","type","realmIds","data","destinations","channel","id","items","seen","Set","realmId","has","add","push","namespace","EntitySubscriber","ctx","publisher","setPublisher","listenTo","target","afterInsert","event","entity","cache","onInsert","dropCacheKeys","connection","publish","CREATED","afterUpdate","UPDATED","afterRemove","databaseEntity","DELETED","queryResultCache","remove","keys","safePublish","content"],"sources":["../../../../src/adapters/database/subscriber/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { EntityType } from '@authup/core-kit';\nimport {\n    EntityDefaultEventName,\n    buildEntityChannelName,\n    buildEntityNamespaceName,\n} from '@authup/core-kit';\nimport type { DomainEventDestinations, IDomainEventPublisher } from '@authup/server-kit';\nimport type {\n    DataSource,\n    EntitySubscriberInterface,\n    InsertEvent,\n    ObjectLiteral,\n    RemoveEvent,\n    UpdateEvent,\n} from 'typeorm';\nimport type { EntitySubscriberContext } from './types.ts';\n\nexport function buildEntityDestinations<T extends ObjectLiteral>(\n    type: `${EntityType}`,\n    realmIds?: (data: T) => (string | null | undefined)[],\n) : (data: T) => DomainEventDestinations {\n    return (data) => {\n        const destinations : DomainEventDestinations = [\n            { channel: (id) => buildEntityChannelName(type, id) },\n        ];\n\n        if (realmIds) {\n            const items = realmIds(data);\n            const seen = new Set<string>();\n            for (const realmId of items) {\n                if (realmId && !seen.has(realmId)) {\n                    seen.add(realmId);\n                    destinations.push({\n                        channel: (id) => buildEntityChannelName(type, id),\n                        namespace: buildEntityNamespaceName(realmId),\n                    });\n                }\n            }\n        }\n\n        return destinations;\n    };\n}\n\nexport class EntitySubscriber<T extends ObjectLiteral> implements EntitySubscriberInterface<T> {\n    protected ctx : EntitySubscriberContext<T>;\n\n    protected publisher? : IDomainEventPublisher;\n\n    constructor(ctx: EntitySubscriberContext<T>) {\n        this.ctx = ctx;\n        this.publisher = ctx.publisher;\n    }\n\n    setPublisher(publisher: IDomainEventPublisher) : void {\n        this.publisher = publisher;\n    }\n\n    // eslint-disable-next-line @typescript-eslint/no-unsafe-function-type\n    listenTo() : Function | string {\n        return this.ctx.target;\n    }\n\n    async afterInsert(event: InsertEvent<T>): Promise<any> {\n        if (!event.entity) {\n            return;\n        }\n\n        if (this.ctx.cache && this.ctx.cache.onInsert) {\n            await this.dropCacheKeys(event.connection, event.entity);\n        }\n\n        await this.publish(EntityDefaultEventName.CREATED, event.entity);\n    }\n\n    async afterUpdate(event: UpdateEvent<T>): Promise<any> {\n        if (!event.entity) {\n            return;\n        }\n\n        await this.dropCacheKeys(event.connection, event.entity as T);\n\n        await this.publish(EntityDefaultEventName.UPDATED, event.entity as T);\n    }\n\n    async afterRemove(event: RemoveEvent<T>): Promise<any> {\n        // remove() strips the primary key from event.entity before the\n        // subscriber runs — databaseEntity is the pre-removal row and keeps\n        // the id-keyed cache invalidation (and the DELETED payload) intact.\n        const entity = event.databaseEntity ?? event.entity;\n        if (!entity) {\n            return;\n        }\n\n        await this.dropCacheKeys(event.connection, entity);\n\n        await this.publish(EntityDefaultEventName.DELETED, entity);\n    }\n\n    protected async dropCacheKeys(connection: DataSource, data: T) : Promise<void> {\n        if (!this.ctx.cache || !connection.queryResultCache) {\n            return;\n        }\n\n        await connection.queryResultCache.remove(this.ctx.cache.keys(data));\n    }\n\n    protected async publish(event: `${EntityDefaultEventName}`, data: T) : Promise<void> {\n        if (!this.publisher) {\n            return;\n        }\n\n        await this.publisher.safePublish({\n            content: {\n                type: this.ctx.type,\n                event,\n                data,\n            },\n            destinations: this.ctx.destinations(data),\n        });\n    }\n}\n"],"mappings":";;;;;AAwBA,SAAgBG,wBACZC,MACAC,UAAqD;CAErD,QAAQC,SAAAA;EACJ,MAAMC,eAAyC,CAC3C,EAAEC,UAAUC,OAAOR,uBAAuBG,MAAMK,EAAAA,EAAI,CAAA;EAGxD,IAAIJ,UAAU;GACV,MAAMK,QAAQL,SAASC,IAAAA;GACvB,MAAMK,uBAAO,IAAIC,IAAAA;GACjB,KAAK,MAAMC,WAAWH,OAClB,IAAIG,WAAW,CAACF,KAAKG,IAAID,OAAAA,GAAU;IAC/BF,KAAKI,IAAIF,OAAAA;IACTN,aAAaS,KAAK;KACdR,UAAUC,OAAOR,uBAAuBG,MAAMK,EAAAA;KAC9CQ,WAAWf,yBAAyBW,OAAAA;IACxC,CAAA;GACJ;EAER;EAEA,OAAON;CACX;AACJ;AAEA,IAAaW,mBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,KAAiC;EACzC,KAAKA,MAAMA;EACX,KAAKC,YAAYD,IAAIC;CACzB;CAEAC,aAAaD,WAAyC;EAClD,KAAKA,YAAYA;CACrB;CAGAE,WAA+B;EAC3B,OAAO,KAAKH,IAAII;CACpB;CAEA,MAAMC,YAAYC,OAAqC;EACnD,IAAI,CAACA,MAAMC,QACP;EAGJ,IAAI,KAAKP,IAAIQ,SAAS,KAAKR,IAAIQ,MAAMC,UACjC,MAAM,KAAKC,cAAcJ,MAAMK,YAAYL,MAAMC,MAAM;EAG3D,MAAM,KAAKK,QAAQ/B,uBAAuBgC,SAASP,MAAMC,MAAM;CACnE;CAEA,MAAMO,YAAYR,OAAqC;EACnD,IAAI,CAACA,MAAMC,QACP;EAGJ,MAAM,KAAKG,cAAcJ,MAAMK,YAAYL,MAAMC,MAAM;EAEvD,MAAM,KAAKK,QAAQ/B,uBAAuBkC,SAAST,MAAMC,MAAM;CACnE;CAEA,MAAMS,YAAYV,OAAqC;EAInD,MAAMC,SAASD,MAAMW,kBAAkBX,MAAMC;EAC7C,IAAI,CAACA,QACD;EAGJ,MAAM,KAAKG,cAAcJ,MAAMK,YAAYJ,MAAAA;EAE3C,MAAM,KAAKK,QAAQ/B,uBAAuBqC,SAASX,MAAAA;CACvD;CAEA,MAAgBG,cAAcC,YAAwBxB,MAAyB;EAC3E,IAAI,CAAC,KAAKa,IAAIQ,SAAS,CAACG,WAAWQ,kBAC/B;EAGJ,MAAMR,WAAWQ,iBAAiBC,OAAO,KAAKpB,IAAIQ,MAAMa,KAAKlC,IAAAA,CAAAA;CACjE;CAEA,MAAgByB,QAAQN,OAAoCnB,MAAyB;EACjF,IAAI,CAAC,KAAKc,WACN;EAGJ,MAAM,KAAKA,UAAUqB,YAAY;GAC7BC,SAAS;IACLtC,MAAM,KAAKe,IAAIf;IACfqB;IACAnB;GACJ;GACAC,cAAc,KAAKY,IAAIZ,aAAaD,IAAAA;EACxC,CAAA;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["EntityDefaultEventName","buildEntityChannelName","buildEntityNamespaceName","buildEntityDestinations","type","realmIds","data","destinations","channel","id","items","seen","Set","realmId","has","add","push","namespace","EntitySubscriber","ctx","publisher","setPublisher","listenTo","target","afterInsert","event","entity","cache","onInsert","dropCacheKeys","connection","publish","CREATED","afterUpdate","UPDATED","databaseEntity","afterRemove","DELETED","queryResultCache","remove","keys","dataPrevious","safePublish","content"],"sources":["../../../../src/adapters/database/subscriber/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { EntityType } from '@authup/core-kit';\nimport {\n    EntityDefaultEventName,\n    buildEntityChannelName,\n    buildEntityNamespaceName,\n} from '@authup/core-kit';\nimport type { DomainEventDestinations, IDomainEventPublisher } from '@authup/server-kit';\nimport type {\n    DataSource,\n    EntitySubscriberInterface,\n    InsertEvent,\n    ObjectLiteral,\n    RemoveEvent,\n    UpdateEvent,\n} from 'typeorm';\nimport type { EntitySubscriberContext } from './types.ts';\n\nexport function buildEntityDestinations<T extends ObjectLiteral>(\n    type: `${EntityType}`,\n    realmIds?: (data: T) => (string | null | undefined)[],\n) : (data: T) => DomainEventDestinations {\n    return (data) => {\n        const destinations : DomainEventDestinations = [\n            { channel: (id) => buildEntityChannelName(type, id) },\n        ];\n\n        if (realmIds) {\n            const items = realmIds(data);\n            const seen = new Set<string>();\n            for (const realmId of items) {\n                if (realmId && !seen.has(realmId)) {\n                    seen.add(realmId);\n                    destinations.push({\n                        channel: (id) => buildEntityChannelName(type, id),\n                        namespace: buildEntityNamespaceName(realmId),\n                    });\n                }\n            }\n        }\n\n        return destinations;\n    };\n}\n\nexport class EntitySubscriber<T extends ObjectLiteral> implements EntitySubscriberInterface<T> {\n    protected ctx : EntitySubscriberContext<T>;\n\n    protected publisher? : IDomainEventPublisher;\n\n    constructor(ctx: EntitySubscriberContext<T>) {\n        this.ctx = ctx;\n        this.publisher = ctx.publisher;\n    }\n\n    setPublisher(publisher: IDomainEventPublisher) : void {\n        this.publisher = publisher;\n    }\n\n    // eslint-disable-next-line @typescript-eslint/no-unsafe-function-type\n    listenTo() : Function | string {\n        return this.ctx.target;\n    }\n\n    async afterInsert(event: InsertEvent<T>): Promise<any> {\n        if (!event.entity) {\n            return;\n        }\n\n        if (this.ctx.cache && this.ctx.cache.onInsert) {\n            await this.dropCacheKeys(event.connection, event.entity);\n        }\n\n        await this.publish(EntityDefaultEventName.CREATED, event.entity);\n    }\n\n    async afterUpdate(event: UpdateEvent<T>): Promise<any> {\n        if (!event.entity) {\n            return;\n        }\n\n        await this.dropCacheKeys(event.connection, event.entity as T);\n\n        await this.publish(EntityDefaultEventName.UPDATED, event.entity as T, event.databaseEntity);\n    }\n\n    async afterRemove(event: RemoveEvent<T>): Promise<any> {\n        // remove() strips the primary key from event.entity before the\n        // subscriber runs — databaseEntity is the pre-removal row and keeps\n        // the id-keyed cache invalidation (and the DELETED payload) intact.\n        const entity = event.databaseEntity ?? event.entity;\n        if (!entity) {\n            return;\n        }\n\n        await this.dropCacheKeys(event.connection, entity);\n\n        await this.publish(EntityDefaultEventName.DELETED, entity);\n    }\n\n    protected async dropCacheKeys(connection: DataSource, data: T) : Promise<void> {\n        if (!this.ctx.cache || !connection.queryResultCache) {\n            return;\n        }\n\n        await connection.queryResultCache.remove(this.ctx.cache.keys(data));\n    }\n\n    protected async publish(\n        event: `${EntityDefaultEventName}`,\n        data: T,\n        dataPrevious?: T,\n    ) : Promise<void> {\n        if (!this.publisher) {\n            return;\n        }\n\n        await this.publisher.safePublish({\n            content: {\n                type: this.ctx.type,\n                event,\n                data,\n            },\n            destinations: this.ctx.destinations(data),\n            ...(dataPrevious ? { dataPrevious } : {}),\n        });\n    }\n}\n"],"mappings":";;;;;AAwBA,SAAgBG,wBACZC,MACAC,UAAqD;CAErD,QAAQC,SAAAA;EACJ,MAAMC,eAAyC,CAC3C,EAAEC,UAAUC,OAAOR,uBAAuBG,MAAMK,EAAAA,EAAI,CAAA;EAGxD,IAAIJ,UAAU;GACV,MAAMK,QAAQL,SAASC,IAAAA;GACvB,MAAMK,uBAAO,IAAIC,IAAAA;GACjB,KAAK,MAAMC,WAAWH,OAClB,IAAIG,WAAW,CAACF,KAAKG,IAAID,OAAAA,GAAU;IAC/BF,KAAKI,IAAIF,OAAAA;IACTN,aAAaS,KAAK;KACdR,UAAUC,OAAOR,uBAAuBG,MAAMK,EAAAA;KAC9CQ,WAAWf,yBAAyBW,OAAAA;IACxC,CAAA;GACJ;EAER;EAEA,OAAON;CACX;AACJ;AAEA,IAAaW,mBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,KAAiC;EACzC,KAAKA,MAAMA;EACX,KAAKC,YAAYD,IAAIC;CACzB;CAEAC,aAAaD,WAAyC;EAClD,KAAKA,YAAYA;CACrB;CAGAE,WAA+B;EAC3B,OAAO,KAAKH,IAAII;CACpB;CAEA,MAAMC,YAAYC,OAAqC;EACnD,IAAI,CAACA,MAAMC,QACP;EAGJ,IAAI,KAAKP,IAAIQ,SAAS,KAAKR,IAAIQ,MAAMC,UACjC,MAAM,KAAKC,cAAcJ,MAAMK,YAAYL,MAAMC,MAAM;EAG3D,MAAM,KAAKK,QAAQ/B,uBAAuBgC,SAASP,MAAMC,MAAM;CACnE;CAEA,MAAMO,YAAYR,OAAqC;EACnD,IAAI,CAACA,MAAMC,QACP;EAGJ,MAAM,KAAKG,cAAcJ,MAAMK,YAAYL,MAAMC,MAAM;EAEvD,MAAM,KAAKK,QAAQ/B,uBAAuBkC,SAAST,MAAMC,QAAaD,MAAMU,cAAc;CAC9F;CAEA,MAAMC,YAAYX,OAAqC;EAInD,MAAMC,SAASD,MAAMU,kBAAkBV,MAAMC;EAC7C,IAAI,CAACA,QACD;EAGJ,MAAM,KAAKG,cAAcJ,MAAMK,YAAYJ,MAAAA;EAE3C,MAAM,KAAKK,QAAQ/B,uBAAuBqC,SAASX,MAAAA;CACvD;CAEA,MAAgBG,cAAcC,YAAwBxB,MAAyB;EAC3E,IAAI,CAAC,KAAKa,IAAIQ,SAAS,CAACG,WAAWQ,kBAC/B;EAGJ,MAAMR,WAAWQ,iBAAiBC,OAAO,KAAKpB,IAAIQ,MAAMa,KAAKlC,IAAAA,CAAAA;CACjE;CAEA,MAAgByB,QACZN,OACAnB,MACAmC,cACc;EACd,IAAI,CAAC,KAAKrB,WACN;EAGJ,MAAM,KAAKA,UAAUsB,YAAY;GAC7BC,SAAS;IACLvC,MAAM,KAAKe,IAAIf;IACfqB;IACAnB;GACJ;GACAC,cAAc,KAAKY,IAAIZ,aAAaD,IAAAA;GACpC,GAAImC,eAAe,EAAEA,aAAa,IAAI,CAAC;EAC3C,CAAA;CACJ;AACJ"}

package/dist/adapters/http/adapters/index.mjs

@@ -2,6 +2,7 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { HTTPOAuth2Authorizer } from "./oauth2/authorization/module.mjs";
+import { extractOAuth2ClientCertificateEvidence } from "./oauth2/grant-types/utils/certificate.mjs";
 import { extractClientCredentialsFromRequest, readStringField } from "./oauth2/grant-types/utils/credentials.mjs";
 import { guessOauth2GrantTypeByRequest } from "./oauth2/grant-types/utils/guess.mjs";
 import { readRealmHint } from "./oauth2/grant-types/utils/realm.mjs";
@@ -12,4 +13,4 @@ import { HTTPPasswordGrant } from "./oauth2/grant-types/password.mjs";
 import { HTTPOAuth2RefreshTokenGrant } from "./oauth2/grant-types/refresh_token.mjs";
 import { HTTPRobotCredentialsGrant } from "./oauth2/grant-types/robot-credentials.mjs";
 import "./oauth2/index.mjs";
-export { HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, extractClientCredentialsFromRequest, guessOauth2GrantTypeByRequest, readRealmHint, readStringField };
+export { HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, guessOauth2GrantTypeByRequest, readRealmHint, readStringField };

package/dist/adapters/http/adapters/oauth2/authorization/module.d.ts

@@ -1,11 +1,14 @@
 import type { IAppEvent } from 'routup';
+import type { Logger } from '@authup/server-kit';
 import type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';
-import type { IOAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationResult } from '../../../../../core/index.ts';
+import type { IConsentService, IOAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationResult } from '../../../../../core/index.ts';
 import { OAuth2Authorization, OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';
 import type { HTTPOAuth2AuthorizationManagerContext } from './types.ts';
 export declare class HTTPOAuth2Authorizer extends OAuth2Authorization {
     protected codeRequestVerifier: IOAuth2AuthorizationCodeRequestVerifier;
     protected requestValidator: OAuth2AuthorizationCodeRequestValidator;
+    protected consentService?: IConsentService;
+    protected logger?: Logger;
     constructor(ctx: HTTPOAuth2AuthorizationManagerContext);
     authorizeWithRequest(event: IAppEvent): Promise<OAuth2AuthorizationResult>;
     /**

package/dist/adapters/http/adapters/oauth2/authorization/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/authorization/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,KAAK,EAAE,uCAAuC,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACvH,OAAO,EAAE,mBAAmB,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AAE5G,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,YAAY,CAAC;AAExE,qBAAa,oBAAqB,SAAQ,mBAAmB;IACzD,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,gBAAgB,EAAG,uCAAuC,CAAC;gBAEzD,GAAG,EAAE,qCAAqC;IAQhD,oBAAoB,CAAC,KAAK,EAAE,SAAS,GAAI,OAAO,CAAC,yBAAyB,CAAC;IAUjF;;;;OAIG;IACG,mBAAmB,CACrB,KAAK,EAAE,SAAS,GAChB,OAAO,CAAC,8BAA8B,CAAC;CAI9C"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/authorization/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,KAAK,EAAE,eAAe,EAAE,uCAAuC,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACxI,OAAO,EAAE,mBAAmB,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AAE5G,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,YAAY,CAAC;AAExE,qBAAa,oBAAqB,SAAQ,mBAAmB;IACzD,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,gBAAgB,EAAG,uCAAuC,CAAC;IAErE,SAAS,CAAC,cAAc,CAAC,EAAG,eAAe,CAAC;IAE5C,SAAS,CAAC,MAAM,CAAC,EAAG,MAAM,CAAC;gBAEf,GAAG,EAAE,qCAAqC;IAUhD,oBAAoB,CAAC,KAAK,EAAE,SAAS,GAAI,OAAO,CAAC,yBAAyB,CAAC;IA6CjF;;;;OAIG;IACG,mBAAmB,CACrB,KAAK,EAAE,SAAS,GAChB,OAAO,CAAC,8BAA8B,CAAC;CAI9C"}

package/dist/adapters/http/adapters/oauth2/authorization/module.mjs

@@ -12,16 +12,41 @@ import "../../../request/index.mjs";
 var HTTPOAuth2Authorizer = class extends OAuth2Authorization {
 	codeRequestVerifier;
 	requestValidator;
+	consentService;
+	logger;
 	constructor(ctx) {
 		super(ctx);
 		this.codeRequestVerifier = ctx.codeRequestVerifier;
+		this.consentService = ctx.consentService;
+		this.logger = ctx.logger;
 		this.requestValidator = new OAuth2AuthorizationCodeRequestValidator();
 	}
 	async authorizeWithRequest(event) {
 		const codeRequestValidated = await this.validateWithRequest(event);
-		const { data } = await this.codeRequestVerifier.verify(codeRequestValidated);
+		const { data, client, redirectUriVerified } = await this.codeRequestVerifier.verify(codeRequestValidated);
 		const identity = useRequestIdentityOrFail(event);
-		return this.authorize(data, identity.raw, { sessionId: useRequestSessionId(event) });
+		const result = await this.authorize(data, identity.raw, {
+			sessionId: useRequestSessionId(event),
+			client,
+			redirectUriVerified
+		});
+		if (this.consentService && client && !client.built_in) try {
+			await this.consentService.record({
+				clientId: client.id,
+				realmId: client.realm_id,
+				owner: {
+					sub: identity.raw.data.id,
+					subKind: identity.raw.type
+				},
+				scope: data.scope ?? null
+			});
+		} catch (e) {
+			this.logger?.warn("Recording the OAuth2 consent grant failed.", {
+				clientId: client.id,
+				error: e
+			});
+		}
+		return result;
 	}
 	/**
 	* Validate authorization request.

package/dist/adapters/http/adapters/oauth2/authorization/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2Authorization","OAuth2AuthorizationCodeRequestValidator","readFromLocations","useRequestIdentityOrFail","useRequestSessionId","HTTPOAuth2Authorizer","codeRequestVerifier","requestValidator","ctx","authorizeWithRequest","event","codeRequestValidated","validateWithRequest","data","verify","identity","authorize","raw","sessionId","run"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/authorization/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IAppEvent } from 'routup';\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport type { IOAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationResult } from '../../../../../core/index.ts';\nimport { OAuth2Authorization, OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';\nimport { readFromLocations, useRequestIdentityOrFail, useRequestSessionId } from '../../../request/index.ts';\nimport type { HTTPOAuth2AuthorizationManagerContext } from './types.ts';\n\nexport class HTTPOAuth2Authorizer extends OAuth2Authorization {\n    protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n    protected requestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n    constructor(ctx: HTTPOAuth2AuthorizationManagerContext) {\n        super(ctx);\n\n        this.codeRequestVerifier = ctx.codeRequestVerifier;\n\n        this.requestValidator = new OAuth2AuthorizationCodeRequestValidator();\n    }\n\n    async authorizeWithRequest(event: IAppEvent) : Promise<OAuth2AuthorizationResult> {\n        const codeRequestValidated = await this.validateWithRequest(event);\n\n        const { data } = await this.codeRequestVerifier.verify(codeRequestValidated);\n\n        const identity = useRequestIdentityOrFail(event);\n\n        return this.authorize(data, identity.raw, { sessionId: useRequestSessionId(event) });\n    }\n\n    /**\n     * Validate authorization request.\n     *\n     * @throws OAuth2Error\n     */\n    async validateWithRequest(\n        event: IAppEvent,\n    ) : Promise<OAuth2AuthorizationCodeRequest> {\n        const data = await readFromLocations(event, ['body', 'query']);\n        return this.requestValidator.run(data);\n    }\n}\n"],"mappings":";;;;;;;;;;;AAcA,IAAaK,uBAAb,cAA0CL,oBAAAA;CAC5BM;CAEAC;CAEV,YAAYC,KAA4C;EACpD,MAAMA,GAAAA;EAEN,KAAKF,sBAAsBE,IAAIF;EAE/B,KAAKC,mBAAmB,IAAIN,wCAAAA;CAChC;CAEA,MAAMQ,qBAAqBC,OAAuD;EAC9E,MAAMC,uBAAuB,MAAM,KAAKC,oBAAoBF,KAAAA;EAE5D,MAAM,EAAEG,SAAS,MAAM,KAAKP,oBAAoBQ,OAAOH,oBAAAA;EAEvD,MAAMI,WAAWZ,yBAAyBO,KAAAA;EAE1C,OAAO,KAAKM,UAAUH,MAAME,SAASE,KAAK,EAAEC,WAAWd,oBAAoBM,KAAAA,EAAO,CAAA;CACtF;;;;;IAOA,MAAME,oBACFF,OACwC;EACxC,MAAMG,OAAO,MAAMX,kBAAkBQ,OAAO,CAAC,QAAQ,OAAA,CAAQ;EAC7D,OAAO,KAAKH,iBAAiBY,IAAIN,IAAAA;CACrC;AACJ"}
+{"version":3,"file":"module.mjs","names":["OAuth2Authorization","OAuth2AuthorizationCodeRequestValidator","readFromLocations","useRequestIdentityOrFail","useRequestSessionId","HTTPOAuth2Authorizer","codeRequestVerifier","requestValidator","consentService","logger","ctx","authorizeWithRequest","event","codeRequestValidated","validateWithRequest","data","client","redirectUriVerified","verify","identity","result","authorize","raw","sessionId","built_in","record","clientId","id","realmId","realm_id","owner","sub","subKind","type","scope","e","warn","error","run"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/authorization/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IAppEvent } from 'routup';\nimport type { Logger } from '@authup/server-kit';\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport type { IConsentService, IOAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationResult } from '../../../../../core/index.ts';\nimport { OAuth2Authorization, OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';\nimport { readFromLocations, useRequestIdentityOrFail, useRequestSessionId } from '../../../request/index.ts';\nimport type { HTTPOAuth2AuthorizationManagerContext } from './types.ts';\n\nexport class HTTPOAuth2Authorizer extends OAuth2Authorization {\n    protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n    protected requestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n    protected consentService? : IConsentService;\n\n    protected logger? : Logger;\n\n    constructor(ctx: HTTPOAuth2AuthorizationManagerContext) {\n        super(ctx);\n\n        this.codeRequestVerifier = ctx.codeRequestVerifier;\n        this.consentService = ctx.consentService;\n        this.logger = ctx.logger;\n\n        this.requestValidator = new OAuth2AuthorizationCodeRequestValidator();\n    }\n\n    async authorizeWithRequest(event: IAppEvent) : Promise<OAuth2AuthorizationResult> {\n        const codeRequestValidated = await this.validateWithRequest(event);\n\n        const {\n            data,\n            client,\n            redirectUriVerified,\n        } = await this.codeRequestVerifier.verify(codeRequestValidated);\n\n        const identity = useRequestIdentityOrFail(event);\n\n        const result = await this.authorize(data, identity.raw, {\n            sessionId: useRequestSessionId(event),\n            client,\n            redirectUriVerified,\n        });\n\n        // Persisted per-scope consent (plan 055): recorded only after a\n        // successful approval — an access-policy denial throws inside\n        // authorize() above, so a denied identity never writes a row.\n        // built_in clients keep zero rows (locked); insert-missing makes\n        // re-recording idempotent (union/keep).\n        if (this.consentService && client && !client.built_in) {\n            try {\n                await this.consentService.record({\n                    clientId: client.id,\n                    realmId: client.realm_id,\n                    owner: {\n                        sub: identity.raw.data.id,\n                        subKind: identity.raw.type,\n                    },\n                    scope: data.scope ?? null,\n                });\n            } catch (e) {\n                // never fail an issued code over a consent-write failure\n                this.logger?.warn('Recording the OAuth2 consent grant failed.', {\n                    clientId: client.id,\n                    error: e,\n                });\n            }\n        }\n\n        return result;\n    }\n\n    /**\n     * Validate authorization request.\n     *\n     * @throws OAuth2Error\n     */\n    async validateWithRequest(\n        event: IAppEvent,\n    ) : Promise<OAuth2AuthorizationCodeRequest> {\n        const data = await readFromLocations(event, ['body', 'query']);\n        return this.requestValidator.run(data);\n    }\n}\n"],"mappings":";;;;;;;;;;;AAeA,IAAaK,uBAAb,cAA0CL,oBAAAA;CAC5BM;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA4C;EACpD,MAAMA,GAAAA;EAEN,KAAKJ,sBAAsBI,IAAIJ;EAC/B,KAAKE,iBAAiBE,IAAIF;EAC1B,KAAKC,SAASC,IAAID;EAElB,KAAKF,mBAAmB,IAAIN,wCAAAA;CAChC;CAEA,MAAMU,qBAAqBC,OAAuD;EAC9E,MAAMC,uBAAuB,MAAM,KAAKC,oBAAoBF,KAAAA;EAE5D,MAAM,EACFG,MACAC,QACAC,wBACA,MAAM,KAAKX,oBAAoBY,OAAOL,oBAAAA;EAE1C,MAAMM,WAAWhB,yBAAyBS,KAAAA;EAE1C,MAAMQ,SAAS,MAAM,KAAKC,UAAUN,MAAMI,SAASG,KAAK;GACpDC,WAAWnB,oBAAoBQ,KAAAA;GAC/BI;GACAC;EACJ,CAAA;EAOA,IAAI,KAAKT,kBAAkBQ,UAAU,CAACA,OAAOQ,UACzC,IAAI;GACA,MAAM,KAAKhB,eAAeiB,OAAO;IAC7BC,UAAUV,OAAOW;IACjBC,SAASZ,OAAOa;IAChBC,OAAO;KACHC,KAAKZ,SAASG,IAAIP,KAAKY;KACvBK,SAASb,SAASG,IAAIW;IAC1B;IACAC,OAAOnB,KAAKmB,SAAS;GACzB,CAAA;EACJ,SAASC,GAAG;GAER,KAAK1B,QAAQ2B,KAAK,8CAA8C;IAC5DV,UAAUV,OAAOW;IACjBU,OAAOF;GACX,CAAA;EACJ;EAGJ,OAAOf;CACX;;;;;IAOA,MAAMN,oBACFF,OACwC;EACxC,MAAMG,OAAO,MAAMb,kBAAkBU,OAAO,CAAC,QAAQ,OAAA,CAAQ;EAC7D,OAAO,KAAKL,iBAAiB+B,IAAIvB,IAAAA;CACrC;AACJ"}

package/dist/adapters/http/adapters/oauth2/authorization/types.d.ts

@@ -1,5 +1,13 @@
-import type { IOAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationManagerContext } from '../../../../../core/index.ts';
+import type { Logger } from '@authup/server-kit';
+import type { IConsentService, IOAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationManagerContext } from '../../../../../core/index.ts';
 export type HTTPOAuth2AuthorizationManagerContext = OAuth2AuthorizationManagerContext & {
     codeRequestVerifier: IOAuth2AuthorizationCodeRequestVerifier;
+    /**
+     * Persisted per-scope consent (plan 055): records the approved scope
+     * tokens after a successful (non-built_in) authorization. Absent =
+     * feature inert.
+     */
+    consentService?: IConsentService;
+    logger?: Logger;
 };
 //# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/adapters/oauth2/authorization/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/authorization/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uCAAuC,EAAE,iCAAiC,EAAE,MAAM,8BAA8B,CAAC;AAE/H,MAAM,MAAM,qCAAqC,GAAG,iCAAiC,GAAG;IACpF,mBAAmB,EAAE,uCAAuC,CAAC;CAChE,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/authorization/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EACR,eAAe,EACf,uCAAuC,EACvC,iCAAiC,EACpC,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,qCAAqC,GAAG,iCAAiC,GAAG;IACpF,mBAAmB,EAAE,uCAAuC,CAAC;IAC7D;;;;OAIG;IACH,cAAc,CAAC,EAAE,eAAe,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC"}

package/dist/adapters/http/adapters/oauth2/grant-types/authorize.d.ts

@@ -1,12 +1,15 @@
 import type { OAuth2TokenGrantResponse } from '@authup/specs';
 import type { IAppEvent } from 'routup';
 import { OAuth2AuthorizeGrant } from '../../../../../core/index.ts';
-import type { IOAuth2AuthorizationCodeVerifier, IRealmRepository, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';
+import type { IOAuth2AccessPolicyEvaluator, IOAuth2AuthorizationCodeVerifier, IRealmRepository, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';
 import type { HTTPOAuth2AuthorizeGrantContext, IHTTPOAuth2Grant } from './types.ts';
+import type { CertificateSource } from '../../../request/index.ts';
 export declare class HTTPOAuth2AuthorizeGrant extends OAuth2AuthorizeGrant implements IHTTPOAuth2Grant {
     protected codeVerifier: IOAuth2AuthorizationCodeVerifier;
     protected clientAuthenticator: OAuth2ClientAuthenticator;
     protected realmRepository: IRealmRepository;
+    protected accessPolicyEvaluator?: IOAuth2AccessPolicyEvaluator;
+    protected certificateSource: CertificateSource;
     constructor(ctx: HTTPOAuth2AuthorizeGrantContext);
     runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse>;
     protected pickStringParam(body: Record<string, any> | undefined, query: Record<string, any> | undefined, key: string): string | undefined;

package/dist/adapters/http/adapters/oauth2/grant-types/authorize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/authorize.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAI9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,EAAE,oBAAoB,EAA4B,MAAM,8BAA8B,CAAC;AAC9F,OAAO,KAAK,EACR,gCAAgC,EAChC,gBAAgB,EAChB,yBAAyB,EAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,+BAA+B,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAGpF,qBAAa,wBAAyB,SAAQ,oBAAqB,YAAW,gBAAgB;IAC1F,SAAS,CAAC,YAAY,EAAG,gCAAgC,CAAC;IAE1D,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;IAE1D,SAAS,CAAC,eAAe,EAAG,gBAAgB,CAAC;gBAEjC,GAAG,EAAE,+BAA+B;IAQ1C,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAgCzE,SAAS,CAAC,eAAe,CACrB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACrC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACtC,GAAG,EAAE,MAAM,GACZ,MAAM,GAAG,SAAS;CAIxB"}
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/authorize.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAK9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,EAAE,oBAAoB,EAA4B,MAAM,8BAA8B,CAAC;AAC9F,OAAO,KAAK,EACR,4BAA4B,EAC5B,gCAAgC,EAChC,gBAAgB,EAChB,yBAAyB,EAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,+BAA+B,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACpF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAOnE,qBAAa,wBAAyB,SAAQ,oBAAqB,YAAW,gBAAgB;IAC1F,SAAS,CAAC,YAAY,EAAG,gCAAgC,CAAC;IAE1D,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;IAE1D,SAAS,CAAC,eAAe,EAAG,gBAAgB,CAAC;IAE7C,SAAS,CAAC,qBAAqB,CAAC,EAAG,4BAA4B,CAAC;IAEhE,SAAS,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;gBAEnC,GAAG,EAAE,+BAA+B;IAU1C,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;IA8DzE,SAAS,CAAC,eAAe,CACrB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACrC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACtC,GAAG,EAAE,MAAM,GACZ,MAAM,GAAG,SAAS;CAIxB"}