@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.53

package/dist/adapters/http/adapters/oauth2/grant-types/authorize.mjs

@@ -4,10 +4,12 @@ import.meta.url;
 import { assertClientGrantAllowed } from "../../../../../core/oauth2/client/grant-type.mjs";
 import { OAuth2AuthorizeGrant } from "../../../../../core/oauth2/grant-types/authorize.mjs";
 import "../../../../../core/index.mjs";
+import { extractOAuth2ClientCertificateEvidence } from "./utils/certificate.mjs";
 import { extractClientCredentialsFromRequest } from "./utils/credentials.mjs";
 import { readRealmHint } from "./utils/realm.mjs";
 import "./utils/index.mjs";
-import { OAuth2RequestError, OAuth2TokenGrant } from "@authup/specs";
+import { isClientPublic } from "@authup/core-kit";
+import { OAuth2GrantError, OAuth2RequestError, OAuth2TokenGrant } from "@authup/specs";
 import { getRequestHeader, getRequestIP } from "routup";
 import { readRequestBody } from "@routup/basic/body";
 import { useRequestQuery } from "@routup/basic/query";
@@ -16,11 +18,15 @@ var HTTPOAuth2AuthorizeGrant = class extends OAuth2AuthorizeGrant {
 	codeVerifier;
 	clientAuthenticator;
 	realmRepository;
+	accessPolicyEvaluator;
+	certificateSource;
 	constructor(ctx) {
 		super(ctx);
 		this.codeVerifier = ctx.codeVerifier;
 		this.clientAuthenticator = ctx.clientAuthenticator;
 		this.realmRepository = ctx.realmRepository;
+		this.accessPolicyEvaluator = ctx.accessPolicyEvaluator;
+		this.certificateSource = ctx.certificateSource ?? "disabled";
 	}
 	async runWithRequest(event) {
 		const body = await readRequestBody(event);
@@ -31,16 +37,30 @@ var HTTPOAuth2AuthorizeGrant = class extends OAuth2AuthorizeGrant {
 		if (!code) throw OAuth2RequestError.malformed();
 		const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);
 		const realm = await this.realmRepository.resolve(readRealmHint(body, query), true);
-		const client = await this.clientAuthenticator.authenticate(clientId, clientSecret, realm.id);
+		const certificateEvidence = await extractOAuth2ClientCertificateEvidence(event, this.certificateSource);
+		const client = await this.clientAuthenticator.authenticate(clientId, clientSecret, realm.id, certificateEvidence);
+		const confirmation = this.clientAuthenticator.resolveTokenBinding(client, certificateEvidence);
 		assertClientGrantAllowed(client, OAuth2TokenGrant.AUTHORIZATION_CODE);
 		const entity = await this.codeVerifier.verify(code, {
 			redirectUri,
 			codeVerifier,
 			clientId: client.id,
-			clientIsPublic: !client.is_confidential,
+			clientIsPublic: isClientPublic(client),
 			realmId: client.realm_id
 		});
+		if (client.access_policy_id) {
+			let allowed = false;
+			if (this.accessPolicyEvaluator) allowed = await this.accessPolicyEvaluator.evaluate(client.access_policy_id, {
+				type: entity.sub_kind,
+				id: entity.sub,
+				realmId: entity.realm_id ?? null,
+				realmName: entity.realm_name ?? null,
+				clientId: entity.client_id ?? null
+			});
+			if (!allowed) throw OAuth2GrantError.invalid();
+		}
 		return this.runWith(entity, {
+			confirmation,
 			ipAddress: getRequestIP(event, { trustProxy: true }) ?? void 0,
 			userAgent: getRequestHeader(event, "user-agent") ?? void 0
 		});

package/dist/adapters/http/adapters/oauth2/grant-types/authorize.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.mjs","names":["OAuth2RequestError","OAuth2TokenGrant","readRequestBody","useRequestQuery","getRequestHeader","getRequestIP","OAuth2AuthorizeGrant","assertClientGrantAllowed","extractClientCredentialsFromRequest","readRealmHint","HTTPOAuth2AuthorizeGrant","codeVerifier","clientAuthenticator","realmRepository","ctx","runWithRequest","event","body","query","code","pickStringParam","redirectUri","malformed","clientId","clientSecret","realm","resolve","client","authenticate","id","AUTHORIZATION_CODE","entity","verify","clientIsPublic","is_confidential","realmId","realm_id","runWith","ipAddress","trustProxy","undefined","userAgent","key","value","length"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/authorize.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport { OAuth2AuthorizeGrant, assertClientGrantAllowed } from '../../../../../core/index.ts';\nimport type {\n    IOAuth2AuthorizationCodeVerifier,\n    IRealmRepository,\n    OAuth2ClientAuthenticator,\n} from '../../../../../core/index.ts';\nimport type { HTTPOAuth2AuthorizeGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport { extractClientCredentialsFromRequest, readRealmHint } from './utils/index.ts';\n\nexport class HTTPOAuth2AuthorizeGrant extends OAuth2AuthorizeGrant implements IHTTPOAuth2Grant {\n    protected codeVerifier : IOAuth2AuthorizationCodeVerifier;\n\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    protected realmRepository : IRealmRepository;\n\n    constructor(ctx: HTTPOAuth2AuthorizeGrantContext) {\n        super(ctx);\n\n        this.codeVerifier = ctx.codeVerifier;\n        this.clientAuthenticator = ctx.clientAuthenticator;\n        this.realmRepository = ctx.realmRepository;\n    }\n\n    async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const body = await readRequestBody(event);\n        const query = useRequestQuery(event);\n\n        const code = this.pickStringParam(body, query, 'code');\n        const redirectUri = this.pickStringParam(body, query, 'redirect_uri');\n        const codeVerifier = this.pickStringParam(body, query, 'code_verifier');\n        if (!code) {\n            throw OAuth2RequestError.malformed();\n        }\n\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n        const realm = await this.realmRepository.resolve(readRealmHint(body, query), true);\n\n        const client = await this.clientAuthenticator.authenticate(clientId, clientSecret, realm.id);\n\n        assertClientGrantAllowed(client, OAuth2TokenGrant.AUTHORIZATION_CODE);\n\n        const entity = await this.codeVerifier.verify(code, {\n            redirectUri,\n            codeVerifier,\n            clientId: client.id,\n            clientIsPublic: !client.is_confidential,\n            realmId: client.realm_id,\n        });\n\n        return this.runWith(entity, {\n            ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n\n    protected pickStringParam(\n        body: Record<string, any> | undefined,\n        query: Record<string, any> | undefined,\n        key: string,\n    ): string | undefined {\n        const value = body?.[key] ?? query?.[key];\n        return typeof value === 'string' && value.length > 0 ? value : undefined;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;AAsBA,IAAaU,2BAAb,cAA8CJ,qBAAAA;CAChCK;CAEAC;CAEAC;CAEV,YAAYC,KAAsC;EAC9C,MAAMA,GAAAA;EAEN,KAAKH,eAAeG,IAAIH;EACxB,KAAKC,sBAAsBE,IAAIF;EAC/B,KAAKC,kBAAkBC,IAAID;CAC/B;CAEA,MAAME,eAAeC,OAAqD;EACtE,MAAMC,OAAO,MAAMf,gBAAgBc,KAAAA;EACnC,MAAME,QAAQf,gBAAgBa,KAAAA;EAE9B,MAAMG,OAAO,KAAKC,gBAAgBH,MAAMC,OAAO,MAAA;EAC/C,MAAMG,cAAc,KAAKD,gBAAgBH,MAAMC,OAAO,cAAA;EACtD,MAAMP,eAAe,KAAKS,gBAAgBH,MAAMC,OAAO,eAAA;EACvD,IAAI,CAACC,MACD,MAAMnB,mBAAmBsB,UAAS;EAGtC,MAAM,EAAEC,UAAUC,iBAAiB,MAAMhB,oCAAoCQ,KAAAA;EAC7E,MAAMS,QAAQ,MAAM,KAAKZ,gBAAgBa,QAAQjB,cAAcQ,MAAMC,KAAAA,GAAQ,IAAA;EAE7E,MAAMS,SAAS,MAAM,KAAKf,oBAAoBgB,aAAaL,UAAUC,cAAcC,MAAMI,EAAE;EAE3FtB,yBAAyBoB,QAAQ1B,iBAAiB6B,kBAAkB;EAEpE,MAAMC,SAAS,MAAM,KAAKpB,aAAaqB,OAAOb,MAAM;GAChDE;GACAV;GACAY,UAAUI,OAAOE;GACjBI,gBAAgB,CAACN,OAAOO;GACxBC,SAASR,OAAOS;EACpB,CAAA;EAEA,OAAO,KAAKC,QAAQN,QAAQ;GACxBO,WAAWjC,aAAaW,OAAO,EAAEuB,YAAY,KAAK,CAAA,KAAMC,KAAAA;GACxDC,WAAWrC,iBAAiBY,OAAO,YAAA,KAAiBwB,KAAAA;EACxD,CAAA;CACJ;CAEUpB,gBACNH,MACAC,OACAwB,KACkB;EAClB,MAAMC,QAAQ1B,OAAOyB,QAAQxB,QAAQwB;EACrC,OAAO,OAAOC,UAAU,YAAYA,MAAMC,SAAS,IAAID,QAAQH,KAAAA;CACnE;AACJ"}
+{"version":3,"file":"authorize.mjs","names":["isClientPublic","OAuth2GrantError","OAuth2RequestError","OAuth2TokenGrant","readRequestBody","useRequestQuery","getRequestHeader","getRequestIP","OAuth2AuthorizeGrant","assertClientGrantAllowed","extractClientCredentialsFromRequest","extractOAuth2ClientCertificateEvidence","readRealmHint","HTTPOAuth2AuthorizeGrant","codeVerifier","clientAuthenticator","realmRepository","accessPolicyEvaluator","certificateSource","ctx","runWithRequest","event","body","query","code","pickStringParam","redirectUri","malformed","clientId","clientSecret","realm","resolve","certificateEvidence","client","authenticate","id","confirmation","resolveTokenBinding","AUTHORIZATION_CODE","entity","verify","clientIsPublic","realmId","realm_id","access_policy_id","allowed","evaluate","type","sub_kind","sub","realmName","realm_name","client_id","invalid","runWith","ipAddress","trustProxy","undefined","userAgent","key","value","length"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/authorize.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { isClientPublic } from '@authup/core-kit';\nimport { OAuth2GrantError, OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport { OAuth2AuthorizeGrant, assertClientGrantAllowed } from '../../../../../core/index.ts';\nimport type {\n    IOAuth2AccessPolicyEvaluator,\n    IOAuth2AuthorizationCodeVerifier,\n    IRealmRepository,\n    OAuth2ClientAuthenticator,\n} from '../../../../../core/index.ts';\nimport type { HTTPOAuth2AuthorizeGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport type { CertificateSource } from '../../../request/index.ts';\nimport {\n    extractClientCredentialsFromRequest,\n    extractOAuth2ClientCertificateEvidence,\n    readRealmHint,\n} from './utils/index.ts';\n\nexport class HTTPOAuth2AuthorizeGrant extends OAuth2AuthorizeGrant implements IHTTPOAuth2Grant {\n    protected codeVerifier : IOAuth2AuthorizationCodeVerifier;\n\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    protected realmRepository : IRealmRepository;\n\n    protected accessPolicyEvaluator? : IOAuth2AccessPolicyEvaluator;\n\n    protected certificateSource: CertificateSource;\n\n    constructor(ctx: HTTPOAuth2AuthorizeGrantContext) {\n        super(ctx);\n\n        this.codeVerifier = ctx.codeVerifier;\n        this.clientAuthenticator = ctx.clientAuthenticator;\n        this.realmRepository = ctx.realmRepository;\n        this.accessPolicyEvaluator = ctx.accessPolicyEvaluator;\n        this.certificateSource = ctx.certificateSource ?? 'disabled';\n    }\n\n    async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const body = await readRequestBody(event);\n        const query = useRequestQuery(event);\n\n        const code = this.pickStringParam(body, query, 'code');\n        const redirectUri = this.pickStringParam(body, query, 'redirect_uri');\n        const codeVerifier = this.pickStringParam(body, query, 'code_verifier');\n        if (!code) {\n            throw OAuth2RequestError.malformed();\n        }\n\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n        const realm = await this.realmRepository.resolve(readRealmHint(body, query), true);\n        const certificateEvidence = await extractOAuth2ClientCertificateEvidence(event, this.certificateSource);\n\n        const client = await this.clientAuthenticator.authenticate(\n            clientId,\n            clientSecret,\n            realm.id,\n            certificateEvidence,\n        );\n        const confirmation = this.clientAuthenticator.resolveTokenBinding(client, certificateEvidence);\n\n        assertClientGrantAllowed(client, OAuth2TokenGrant.AUTHORIZATION_CODE);\n\n        const entity = await this.codeVerifier.verify(code, {\n            redirectUri,\n            codeVerifier,\n            clientId: client.id,\n            clientIsPublic: isClientPublic(client),\n            realmId: client.realm_id,\n        });\n\n        // Application access policy (plan 052), /token backstop: a code\n        // minted before the policy was attached (or outside authorize())\n        // must not redeem. The subject is built from the code-blob scalars —\n        // no DB identity load; attribute-rich policies are enforced at the\n        // issuance legs. Denial = invalid_grant, never access_denied here.\n        if (client.access_policy_id) {\n            let allowed = false;\n            if (this.accessPolicyEvaluator) {\n                allowed = await this.accessPolicyEvaluator.evaluate(client.access_policy_id, {\n                    type: entity.sub_kind,\n                    id: entity.sub,\n                    realmId: entity.realm_id ?? null,\n                    realmName: entity.realm_name ?? null,\n                    clientId: entity.client_id ?? null,\n                });\n            }\n\n            if (!allowed) {\n                throw OAuth2GrantError.invalid();\n            }\n        }\n\n        return this.runWith(entity, {\n            confirmation,\n            ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n\n    protected pickStringParam(\n        body: Record<string, any> | undefined,\n        query: Record<string, any> | undefined,\n        key: string,\n    ): string | undefined {\n        const value = body?.[key] ?? query?.[key];\n        return typeof value === 'string' && value.length > 0 ? value : undefined;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA6BA,IAAaa,2BAAb,cAA8CL,qBAAAA;CAChCM;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAsC;EAC9C,MAAMA,GAAAA;EAEN,KAAKL,eAAeK,IAAIL;EACxB,KAAKC,sBAAsBI,IAAIJ;EAC/B,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,wBAAwBE,IAAIF;EACjC,KAAKC,oBAAoBC,IAAID,qBAAqB;CACtD;CAEA,MAAME,eAAeC,OAAqD;EACtE,MAAMC,OAAO,MAAMlB,gBAAgBiB,KAAAA;EACnC,MAAME,QAAQlB,gBAAgBgB,KAAAA;EAE9B,MAAMG,OAAO,KAAKC,gBAAgBH,MAAMC,OAAO,MAAA;EAC/C,MAAMG,cAAc,KAAKD,gBAAgBH,MAAMC,OAAO,cAAA;EACtD,MAAMT,eAAe,KAAKW,gBAAgBH,MAAMC,OAAO,eAAA;EACvD,IAAI,CAACC,MACD,MAAMtB,mBAAmByB,UAAS;EAGtC,MAAM,EAAEC,UAAUC,iBAAiB,MAAMnB,oCAAoCW,KAAAA;EAC7E,MAAMS,QAAQ,MAAM,KAAKd,gBAAgBe,QAAQnB,cAAcU,MAAMC,KAAAA,GAAQ,IAAA;EAC7E,MAAMS,sBAAsB,MAAMrB,uCAAuCU,OAAO,KAAKH,iBAAiB;EAEtG,MAAMe,SAAS,MAAM,KAAKlB,oBAAoBmB,aAC1CN,UACAC,cACAC,MAAMK,IACNH,mBAAAA;EAEJ,MAAMI,eAAe,KAAKrB,oBAAoBsB,oBAAoBJ,QAAQD,mBAAAA;EAE1EvB,yBAAyBwB,QAAQ9B,iBAAiBmC,kBAAkB;EAEpE,MAAMC,SAAS,MAAM,KAAKzB,aAAa0B,OAAOhB,MAAM;GAChDE;GACAZ;GACAc,UAAUK,OAAOE;GACjBM,gBAAgBzC,eAAeiC,MAAAA;GAC/BS,SAAST,OAAOU;EACpB,CAAA;EAOA,IAAIV,OAAOW,kBAAkB;GACzB,IAAIC,UAAU;GACd,IAAI,KAAK5B,uBACL4B,UAAU,MAAM,KAAK5B,sBAAsB6B,SAASb,OAAOW,kBAAkB;IACzEG,MAAMR,OAAOS;IACbb,IAAII,OAAOU;IACXP,SAASH,OAAOI,YAAY;IAC5BO,WAAWX,OAAOY,cAAc;IAChCvB,UAAUW,OAAOa,aAAa;GAClC,CAAA;GAGJ,IAAI,CAACP,SACD,MAAM5C,iBAAiBoD,QAAO;EAEtC;EAEA,OAAO,KAAKC,QAAQf,QAAQ;GACxBH;GACAmB,WAAWhD,aAAac,OAAO,EAAEmC,YAAY,KAAK,CAAA,KAAMC,KAAAA;GACxDC,WAAWpD,iBAAiBe,OAAO,YAAA,KAAiBoC,KAAAA;EACxD,CAAA;CACJ;CAEUhC,gBACNH,MACAC,OACAoC,KACkB;EAClB,MAAMC,QAAQtC,OAAOqC,QAAQpC,QAAQoC;EACrC,OAAO,OAAOC,UAAU,YAAYA,MAAMC,SAAS,IAAID,QAAQH,KAAAA;CACnE;AACJ"}

package/dist/adapters/http/adapters/oauth2/grant-types/client-credentials.d.ts

@@ -1,11 +1,12 @@
 import type { OAuth2TokenGrantResponse } from '@authup/specs';
-import type { Client } from '@authup/core-kit';
 import type { IAppEvent } from 'routup';
-import type { ICredentialsAuthenticator } from '../../../../../core/index.ts';
+import type { OAuth2ClientAuthenticator } from '../../../../../core/index.ts';
 import { ClientCredentialsGrant } from '../../../../../core/index.ts';
 import type { HTTPOAuth2ClientCredentialsGrantContext, IHTTPOAuth2Grant } from './types.ts';
+import type { CertificateSource } from '../../../request/index.ts';
 export declare class HTTPClientCredentialsGrant extends ClientCredentialsGrant implements IHTTPOAuth2Grant {
-    protected authenticator: ICredentialsAuthenticator<Client>;
+    protected clientAuthenticator: OAuth2ClientAuthenticator;
+    protected certificateSource: CertificateSource;
     constructor(ctx: HTTPOAuth2ClientCredentialsGrantContext);
     runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse>;
 }

package/dist/adapters/http/adapters/oauth2/grant-types/client-credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-credentials.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/client-credentials.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAG9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,sBAAsB,EAA4B,MAAM,8BAA8B,CAAC;AAChG,OAAO,KAAK,EAAE,uCAAuC,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAG5F,qBAAa,0BAA2B,SAAQ,sBAAuB,YAAW,gBAAgB;IAC9F,SAAS,CAAC,aAAa,EAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;gBAEhD,GAAG,EAAE,uCAAuC;IAMlD,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAkB5E"}
+{"version":3,"file":"client-credentials.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/client-credentials.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAI9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,sBAAsB,EAA4B,MAAM,8BAA8B,CAAC;AAChG,OAAO,KAAK,EAAE,uCAAuC,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC5F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAMnE,qBAAa,0BAA2B,SAAQ,sBAAuB,YAAW,gBAAgB;IAC9F,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;IAE1D,SAAS,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;gBAEnC,GAAG,EAAE,uCAAuC;IAOlD,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;CA6B5E"}

package/dist/adapters/http/adapters/oauth2/grant-types/client-credentials.mjs

@@ -4,26 +4,33 @@ import.meta.url;
 import { assertClientGrantAllowed } from "../../../../../core/oauth2/client/grant-type.mjs";
 import { ClientCredentialsGrant } from "../../../../../core/oauth2/grant-types/client-credentials.mjs";
 import "../../../../../core/index.mjs";
+import { extractOAuth2ClientCertificateEvidence } from "./utils/certificate.mjs";
 import { extractClientCredentialsFromRequest } from "./utils/credentials.mjs";
 import "./utils/index.mjs";
-import { EntityCredentialsInvalidError } from "@authup/errors";
-import { OAuth2TokenGrant } from "@authup/specs";
+import { ClientAuthMethod } from "@authup/core-kit";
+import { OAuth2ClientError, OAuth2TokenGrant } from "@authup/specs";
 import { getRequestHeader, getRequestIP } from "routup";
 import { readRequestBody } from "@routup/basic/body";
 //#region src/adapters/http/adapters/oauth2/grant-types/client-credentials.ts
 var HTTPClientCredentialsGrant = class extends ClientCredentialsGrant {
-	authenticator;
+	clientAuthenticator;
+	certificateSource;
 	constructor(ctx) {
 		super(ctx);
-		this.authenticator = ctx.authenticator;
+		this.clientAuthenticator = ctx.clientAuthenticator;
+		this.certificateSource = ctx.certificateSource ?? "disabled";
 	}
 	async runWithRequest(event) {
 		const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);
 		const realmId = (await readRequestBody(event))?.realm_id;
-		if (!clientId) throw new EntityCredentialsInvalidError({ entity: "client" });
-		const client = await this.authenticator.authenticate(clientId, clientSecret ?? "", realmId);
+		if (!clientId) throw OAuth2ClientError.invalid();
+		const certificateEvidence = await extractOAuth2ClientCertificateEvidence(event, this.certificateSource);
+		const client = await this.clientAuthenticator.authenticate(clientId, clientSecret, realmId, certificateEvidence);
+		if (client.auth_method === ClientAuthMethod.NONE) throw OAuth2ClientError.invalid();
+		const confirmation = this.clientAuthenticator.resolveTokenBinding(client, certificateEvidence);
 		assertClientGrantAllowed(client, OAuth2TokenGrant.CLIENT_CREDENTIALS);
 		return this.runWith(client, {
+			confirmation,
 			ipAddress: getRequestIP(event, { trustProxy: true }) ?? void 0,
 			userAgent: getRequestHeader(event, "user-agent") ?? void 0
 		});

package/dist/adapters/http/adapters/oauth2/grant-types/client-credentials.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"client-credentials.mjs","names":["OAuth2TokenGrant","readRequestBody","EntityCredentialsInvalidError","getRequestHeader","getRequestIP","ClientCredentialsGrant","assertClientGrantAllowed","extractClientCredentialsFromRequest","HTTPClientCredentialsGrant","authenticator","ctx","runWithRequest","event","clientId","clientSecret","body","realmId","realm_id","entity","client","authenticate","CLIENT_CREDENTIALS","runWith","ipAddress","trustProxy","undefined","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/client-credentials.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2TokenGrant } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport type { Client } from '@authup/core-kit';\nimport { EntityCredentialsInvalidError } from '@authup/errors';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type { ICredentialsAuthenticator } from '../../../../../core/index.ts';\nimport { ClientCredentialsGrant, assertClientGrantAllowed } from '../../../../../core/index.ts';\nimport type { HTTPOAuth2ClientCredentialsGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport { extractClientCredentialsFromRequest } from './utils/index.ts';\n\nexport class HTTPClientCredentialsGrant extends ClientCredentialsGrant implements IHTTPOAuth2Grant {\n    protected authenticator : ICredentialsAuthenticator<Client>;\n\n    constructor(ctx: HTTPOAuth2ClientCredentialsGrantContext) {\n        super(ctx);\n\n        this.authenticator = ctx.authenticator;\n    }\n\n    async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n        const body = await readRequestBody(event);\n        const realmId = body?.realm_id;\n\n        if (!clientId) {\n            throw new EntityCredentialsInvalidError({ entity: 'client' });\n        }\n\n        const client = await this.authenticator.authenticate(clientId, clientSecret ?? '', realmId);\n\n        assertClientGrantAllowed(client, OAuth2TokenGrant.CLIENT_CREDENTIALS);\n\n        return this.runWith(client, {\n            ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AAmBA,IAAaQ,6BAAb,cAAgDH,uBAAAA;CAClCI;CAEV,YAAYC,KAA8C;EACtD,MAAMA,GAAAA;EAEN,KAAKD,gBAAgBC,IAAID;CAC7B;CAEA,MAAME,eAAeC,OAAqD;EACtE,MAAM,EAAEC,UAAUC,iBAAiB,MAAMP,oCAAoCK,KAAAA;EAE7E,MAAMI,WAAUD,MADGd,gBAAgBW,KAAAA,EAAAA,EACbK;EAEtB,IAAI,CAACJ,UACD,MAAM,IAAIX,8BAA8B,EAAEgB,QAAQ,SAAS,CAAA;EAG/D,MAAMC,SAAS,MAAM,KAAKV,cAAcW,aAAaP,UAAUC,gBAAgB,IAAIE,OAAAA;EAEnFV,yBAAyBa,QAAQnB,iBAAiBqB,kBAAkB;EAEpE,OAAO,KAAKC,QAAQH,QAAQ;GACxBI,WAAWnB,aAAaQ,OAAO,EAAEY,YAAY,KAAK,CAAA,KAAMC,KAAAA;GACxDC,WAAWvB,iBAAiBS,OAAO,YAAA,KAAiBa,KAAAA;EACxD,CAAA;CACJ;AACJ"}
+{"version":3,"file":"client-credentials.mjs","names":["OAuth2ClientError","OAuth2TokenGrant","readRequestBody","ClientAuthMethod","getRequestHeader","getRequestIP","ClientCredentialsGrant","assertClientGrantAllowed","extractClientCredentialsFromRequest","extractOAuth2ClientCertificateEvidence","HTTPClientCredentialsGrant","clientAuthenticator","certificateSource","ctx","runWithRequest","event","clientId","clientSecret","body","realmId","realm_id","invalid","certificateEvidence","client","authenticate","auth_method","NONE","confirmation","resolveTokenBinding","CLIENT_CREDENTIALS","runWith","ipAddress","trustProxy","undefined","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/client-credentials.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2ClientError, OAuth2TokenGrant  } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport { ClientAuthMethod } from '@authup/core-kit';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type { OAuth2ClientAuthenticator } from '../../../../../core/index.ts';\nimport { ClientCredentialsGrant, assertClientGrantAllowed } from '../../../../../core/index.ts';\nimport type { HTTPOAuth2ClientCredentialsGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport type { CertificateSource } from '../../../request/index.ts';\nimport {\n    extractClientCredentialsFromRequest,\n    extractOAuth2ClientCertificateEvidence,\n} from './utils/index.ts';\n\nexport class HTTPClientCredentialsGrant extends ClientCredentialsGrant implements IHTTPOAuth2Grant {\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    protected certificateSource: CertificateSource;\n\n    constructor(ctx: HTTPOAuth2ClientCredentialsGrantContext) {\n        super(ctx);\n\n        this.clientAuthenticator = ctx.clientAuthenticator;\n        this.certificateSource = ctx.certificateSource ?? 'disabled';\n    }\n\n    async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n        const body = await readRequestBody(event);\n        const realmId = body?.realm_id;\n\n        if (!clientId) {\n            throw OAuth2ClientError.invalid();\n        }\n\n        const certificateEvidence = await extractOAuth2ClientCertificateEvidence(event, this.certificateSource);\n        const client = await this.clientAuthenticator.authenticate(\n            clientId,\n            clientSecret,\n            realmId,\n            certificateEvidence,\n        );\n        if (client.auth_method === ClientAuthMethod.NONE) {\n            throw OAuth2ClientError.invalid();\n        }\n        const confirmation = this.clientAuthenticator.resolveTokenBinding(client, certificateEvidence);\n\n        assertClientGrantAllowed(client, OAuth2TokenGrant.CLIENT_CREDENTIALS);\n\n        return this.runWith(client, {\n            confirmation,\n            ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;AAsBA,IAAaU,6BAAb,cAAgDJ,uBAAAA;CAClCK;CAEAC;CAEV,YAAYC,KAA8C;EACtD,MAAMA,GAAAA;EAEN,KAAKF,sBAAsBE,IAAIF;EAC/B,KAAKC,oBAAoBC,IAAID,qBAAqB;CACtD;CAEA,MAAME,eAAeC,OAAqD;EACtE,MAAM,EAAEC,UAAUC,iBAAiB,MAAMT,oCAAoCO,KAAAA;EAE7E,MAAMI,WAAUD,MADGhB,gBAAgBa,KAAAA,EAAAA,EACbK;EAEtB,IAAI,CAACJ,UACD,MAAMhB,kBAAkBqB,QAAO;EAGnC,MAAMC,sBAAsB,MAAMb,uCAAuCM,OAAO,KAAKH,iBAAiB;EACtG,MAAMW,SAAS,MAAM,KAAKZ,oBAAoBa,aAC1CR,UACAC,cACAE,SACAG,mBAAAA;EAEJ,IAAIC,OAAOE,gBAAgBtB,iBAAiBuB,MACxC,MAAM1B,kBAAkBqB,QAAO;EAEnC,MAAMM,eAAe,KAAKhB,oBAAoBiB,oBAAoBL,QAAQD,mBAAAA;EAE1Ef,yBAAyBgB,QAAQtB,iBAAiB4B,kBAAkB;EAEpE,OAAO,KAAKC,QAAQP,QAAQ;GACxBI;GACAI,WAAW1B,aAAaU,OAAO,EAAEiB,YAAY,KAAK,CAAA,KAAMC,KAAAA;GACxDC,WAAW9B,iBAAiBW,OAAO,YAAA,KAAiBkB,KAAAA;EACxD,CAAA;CACJ;AACJ"}

package/dist/adapters/http/adapters/oauth2/grant-types/index.mjs

@@ -1,6 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { extractOAuth2ClientCertificateEvidence } from "./utils/certificate.mjs";
 import { extractClientCredentialsFromRequest, readStringField } from "./utils/credentials.mjs";
 import { guessOauth2GrantTypeByRequest } from "./utils/guess.mjs";
 import { readRealmHint } from "./utils/realm.mjs";
@@ -11,4 +12,4 @@ import { HTTPOAuth2IdentityGrantType } from "./identity.mjs";
 import { HTTPPasswordGrant } from "./password.mjs";
 import { HTTPOAuth2RefreshTokenGrant } from "./refresh_token.mjs";
 import { HTTPRobotCredentialsGrant } from "./robot-credentials.mjs";
-export { HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, extractClientCredentialsFromRequest, guessOauth2GrantTypeByRequest, readRealmHint, readStringField };
+export { HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, guessOauth2GrantTypeByRequest, readRealmHint, readStringField };

package/dist/adapters/http/adapters/oauth2/grant-types/password.d.ts

@@ -1,14 +1,50 @@
 import type { User } from '@authup/core-kit';
-import type { OAuth2TokenGrantResponse } from '@authup/specs';
+import { UserAuthenticatorKind } from '@authup/core-kit';
+import type { Logger } from '@authup/server-kit';
+import type { OAuth2TokenConfirmation, OAuth2TokenGrantResponse } from '@authup/specs';
 import type { IAppEvent } from 'routup';
-import type { ICredentialsAuthenticator, IRealmRepository, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';
+import type { ICredentialsAuthenticator, ILoginThrottleService, IOAuth2MfaLoginService, IRealmRepository, IUserAuthenticatorService, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';
 import { PasswordGrantType } from '../../../../../core/index.ts';
 import type { HTTPOAuth2PasswordGrantContext, IHTTPOAuth2Grant } from './types.ts';
+import type { CertificateSource } from '../../../request/index.ts';
 export declare class HTTPPasswordGrant extends PasswordGrantType implements IHTTPOAuth2Grant {
     protected authenticator: ICredentialsAuthenticator<User>;
     protected clientAuthenticator: OAuth2ClientAuthenticator;
     protected realmRepository: IRealmRepository;
+    protected loginThrottleService?: ILoginThrottleService;
+    protected userAuthenticatorService?: IUserAuthenticatorService;
+    protected mfaLoginService?: IOAuth2MfaLoginService;
+    protected logger?: Logger;
+    protected certificateSource: CertificateSource;
     constructor(ctx: HTTPOAuth2PasswordGrantContext);
     runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse>;
+    /**
+     * MFA gate on the direct password grant: a user holding a confirmed
+     * device must send a valid `otp` form parameter (TOTP or recovery
+     * code, classified by shape) — otherwise `mfa_required`. Users
+     * without a device pass through (they could never enroll otherwise).
+     */
+    protected verifySecondFactor(user: User, body: Record<string, any>, ctx: {
+        ipAddress?: string;
+        userAgent?: string;
+        clientId: string | null;
+        confirmation?: OAuth2TokenConfirmation;
+    }): Promise<string | undefined>;
+    /**
+     * Issue the MFA-pending ticket for factor kinds that cannot complete
+     * inside the single grant POST (email needs a server-sent code,
+     * WebAuthn an interactive ceremony). TOTP/recovery-only users keep
+     * the inline `otp` fast-path and get no ticket — a pending session
+     * per plain code entry would be pure churn.
+     */
+    protected issueMfaTicket(user: User, kinds: `${UserAuthenticatorKind}`[], ctx: {
+        ipAddress?: string;
+        userAgent?: string;
+        clientId: string | null;
+        confirmation?: OAuth2TokenConfirmation;
+    }): Promise<{
+        token: string;
+        expiresIn: number;
+    } | null>;
 }
 //# sourceMappingURL=password.d.ts.map

package/dist/adapters/http/adapters/oauth2/grant-types/password.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/password.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAG9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAC3H,OAAO,EAAE,iBAAiB,EAA4B,MAAM,8BAA8B,CAAC;AAC3F,OAAO,KAAK,EAAE,8BAA8B,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAGnF,qBAAa,iBAAkB,SAAQ,iBAAkB,YAAW,gBAAgB;IAChF,SAAS,CAAC,aAAa,EAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAE1D,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;IAE1D,SAAS,CAAC,eAAe,EAAG,gBAAgB,CAAC;gBAEjC,GAAG,EAAE,8BAA8B;IAQzC,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAmC5E"}
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/password.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAyB,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAGvF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EACR,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EACtB,gBAAgB,EAChB,yBAAyB,EACzB,yBAAyB,EAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACH,iBAAiB,EAGpB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,8BAA8B,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACnF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAQnE,qBAAa,iBAAkB,SAAQ,iBAAkB,YAAW,gBAAgB;IAChF,SAAS,CAAC,aAAa,EAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAE1D,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;IAE1D,SAAS,CAAC,eAAe,EAAG,gBAAgB,CAAC;IAE7C,SAAS,CAAC,oBAAoB,CAAC,EAAG,qBAAqB,CAAC;IAExD,SAAS,CAAC,wBAAwB,CAAC,EAAG,yBAAyB,CAAC;IAEhE,SAAS,CAAC,eAAe,CAAC,EAAG,sBAAsB,CAAC;IAEpD,SAAS,CAAC,MAAM,CAAC,EAAG,MAAM,CAAC;IAE3B,SAAS,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;gBAEnC,GAAG,EAAE,8BAA8B;IAazC,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;IA0FzE;;;;;OAKG;cACa,kBAAkB,CAC9B,IAAI,EAAE,IAAI,EACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,GAAG,EAAE;QACD,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,YAAY,CAAC,EAAE,uBAAuB,CAAC;KAC1C,GACF,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAwD9B;;;;;;OAMG;cACa,cAAc,CAC1B,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,GAAG,qBAAqB,EAAE,EAAE,EACnC,GAAG,EAAE;QACD,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,YAAY,CAAC,EAAE,uBAAuB,CAAC;KAC1C,GACD,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAkC3D"}

package/dist/adapters/http/adapters/oauth2/grant-types/password.mjs

@@ -1,13 +1,17 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { guessUserAuthenticatorKindByResponse } from "../../../../../core/entities/user-authenticator/helpers.mjs";
 import { assertClientGrantAllowed } from "../../../../../core/oauth2/client/grant-type.mjs";
 import { PasswordGrantType } from "../../../../../core/oauth2/grant-types/password.mjs";
 import "../../../../../core/index.mjs";
+import { extractOAuth2ClientCertificateEvidence } from "./utils/certificate.mjs";
 import { extractClientCredentialsFromRequest, readStringField } from "./utils/credentials.mjs";
 import { readRealmHint } from "./utils/realm.mjs";
 import "./utils/index.mjs";
-import { OAuth2RequestError, OAuth2TokenGrant } from "@authup/specs";
+import { EventName, EventScope, UserAuthenticatorKind } from "@authup/core-kit";
+import { isEntityCredentialsInvalidError, isEntityInactiveError } from "@authup/errors";
+import { OAuth2MfaRequiredError, OAuth2RequestError, OAuth2TokenGrant } from "@authup/specs";
 import { getRequestHeader, getRequestIP } from "routup";
 import { readRequestBody } from "@routup/basic/body";
 //#region src/adapters/http/adapters/oauth2/grant-types/password.ts
@@ -15,11 +19,21 @@ var HTTPPasswordGrant = class extends PasswordGrantType {
 	authenticator;
 	clientAuthenticator;
 	realmRepository;
+	loginThrottleService;
+	userAuthenticatorService;
+	mfaLoginService;
+	logger;
+	certificateSource;
 	constructor(ctx) {
 		super(ctx);
 		this.authenticator = ctx.authenticator;
 		this.clientAuthenticator = ctx.clientAuthenticator;
 		this.realmRepository = ctx.realmRepository;
+		this.loginThrottleService = ctx.loginThrottleService;
+		this.userAuthenticatorService = ctx.userAuthenticatorService;
+		this.mfaLoginService = ctx.mfaLoginService;
+		this.logger = ctx.logger;
+		this.certificateSource = ctx.certificateSource ?? "disabled";
 	}
 	async runWithRequest(event) {
 		const body = await readRequestBody(event);
@@ -28,16 +42,115 @@ var HTTPPasswordGrant = class extends PasswordGrantType {
 		if (!username || !password) throw OAuth2RequestError.malformed("username and password must be provided.");
 		const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);
 		const realm = await this.realmRepository.resolve(readRealmHint(body), true);
-		const client = clientId ? await this.clientAuthenticator.authenticate(clientId, clientSecret, realm.id) : void 0;
+		const certificateEvidence = await extractOAuth2ClientCertificateEvidence(event, this.certificateSource);
+		const client = clientId ? await this.clientAuthenticator.authenticate(clientId, clientSecret, realm.id, certificateEvidence) : void 0;
+		const confirmation = client ? this.clientAuthenticator.resolveTokenBinding(client, certificateEvidence) : void 0;
 		if (client) assertClientGrantAllowed(client, OAuth2TokenGrant.PASSWORD);
-		const user = await this.authenticator.authenticate(username, password, realm.id);
+		const ipAddress = getRequestIP(event, { trustProxy: true }) ?? void 0;
+		const userAgent = getRequestHeader(event, "user-agent") ?? void 0;
+		const identifier = username.trim().toLowerCase();
+		await this.loginThrottleService?.assertNotThrottled({
+			identifier,
+			ipAddress,
+			realmId: realm.id
+		});
+		let user;
+		try {
+			user = await this.authenticator.authenticate(username, password, realm.id);
+		} catch (e) {
+			if (isEntityCredentialsInvalidError(e) || isEntityInactiveError(e)) {
+				await this.eventService?.record({
+					scope: EventScope.OAUTH2,
+					name: EventName.LOGIN_FAILED,
+					actorType: null,
+					actorId: null,
+					actorName: identifier,
+					clientId: client?.id ?? null,
+					realmId: realm.id,
+					requestIpAddress: ipAddress ?? null,
+					requestUserAgent: userAgent ?? null,
+					requestPath: event.path,
+					requestMethod: event.method,
+					data: { error_code: e.code }
+				});
+				this.metrics?.recordLogin("failure");
+			}
+			throw e;
+		}
+		const mfaVerifiedAt = await this.verifySecondFactor(user, body, {
+			ipAddress,
+			userAgent,
+			clientId: client?.id ?? null,
+			confirmation
+		});
 		return this.runWith({
 			user,
-			client
+			client,
+			mfaVerifiedAt
+		}, {
+			confirmation,
+			ipAddress,
+			userAgent
+		});
+	}
+	/**
+	* MFA gate on the direct password grant: a user holding a confirmed
+	* device must send a valid `otp` form parameter (TOTP or recovery
+	* code, classified by shape) — otherwise `mfa_required`. Users
+	* without a device pass through (they could never enroll otherwise).
+	*/ async verifySecondFactor(user, body, ctx) {
+		if (!this.userAuthenticatorService) return;
+		const status = await this.userAuthenticatorService.challenge(user.id, { issueMaterial: false });
+		if (!status.required) return;
+		const otp = readStringField(body, "otp");
+		if (!otp) {
+			const ticket = await this.issueMfaTicket(user, status.kinds, ctx);
+			throw new OAuth2MfaRequiredError({
+				message: "Complete a second-factor challenge to continue.",
+				data: {
+					kinds: status.kinds,
+					...ticket ? {
+						mfa_token: ticket.token,
+						mfa_token_expires_in: ticket.expiresIn
+					} : {}
+				}
+			});
+		}
+		if (!await this.userAuthenticatorService.verify(user.id, {
+			kind: guessUserAuthenticatorKindByResponse(otp),
+			response: otp
 		}, {
-			ipAddress: getRequestIP(event, { trustProxy: true }) ?? void 0,
-			userAgent: getRequestHeader(event, "user-agent") ?? void 0
+			ipAddress: ctx.ipAddress ?? null,
+			userAgent: ctx.userAgent ?? null,
+			clientId: ctx.clientId
+		})) throw new OAuth2MfaRequiredError({
+			message: "The provided second factor is not valid.",
+			data: { kinds: status.kinds }
 		});
+		return (/* @__PURE__ */ new Date()).toISOString();
+	}
+	/**
+	* Issue the MFA-pending ticket for factor kinds that cannot complete
+	* inside the single grant POST (email needs a server-sent code,
+	* WebAuthn an interactive ceremony). TOTP/recovery-only users keep
+	* the inline `otp` fast-path and get no ticket — a pending session
+	* per plain code entry would be pure churn.
+	*/ async issueMfaTicket(user, kinds, ctx) {
+		if (!this.mfaLoginService) return null;
+		if (!(kinds.includes(UserAuthenticatorKind.EMAIL) || kinds.includes(UserAuthenticatorKind.WEBAUTHN))) return null;
+		try {
+			return await this.mfaLoginService.issueTicket({
+				user,
+				clientId: ctx.clientId,
+				confirmation: ctx.confirmation
+			}, {
+				ipAddress: ctx.ipAddress,
+				userAgent: ctx.userAgent
+			});
+		} catch (e) {
+			this.logger?.warn("Issuing the MFA-pending login ticket failed.", { error: e });
+			return null;
+		}
 	}
 };
 //#endregion

package/dist/adapters/http/adapters/oauth2/grant-types/password.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"password.mjs","names":["OAuth2RequestError","OAuth2TokenGrant","readRequestBody","getRequestHeader","getRequestIP","PasswordGrantType","assertClientGrantAllowed","extractClientCredentialsFromRequest","readRealmHint","readStringField","HTTPPasswordGrant","authenticator","clientAuthenticator","realmRepository","ctx","runWithRequest","event","body","username","password","malformed","clientId","clientSecret","realm","resolve","client","authenticate","id","undefined","PASSWORD","user","runWith","ipAddress","trustProxy","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/password.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { User } from '@authup/core-kit';\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type { ICredentialsAuthenticator, IRealmRepository, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';\nimport { PasswordGrantType, assertClientGrantAllowed } from '../../../../../core/index.ts';\nimport type { HTTPOAuth2PasswordGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport { extractClientCredentialsFromRequest, readRealmHint, readStringField } from './utils/index.ts';\n\nexport class HTTPPasswordGrant extends PasswordGrantType implements IHTTPOAuth2Grant {\n    protected authenticator : ICredentialsAuthenticator<User>;\n\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    protected realmRepository : IRealmRepository;\n\n    constructor(ctx: HTTPOAuth2PasswordGrantContext) {\n        super(ctx);\n\n        this.authenticator = ctx.authenticator;\n        this.clientAuthenticator = ctx.clientAuthenticator;\n        this.realmRepository = ctx.realmRepository;\n    }\n\n    async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const body = await readRequestBody(event);\n\n        const username = readStringField(body, 'username');\n        const password = readStringField(body, 'password');\n        if (!username || !password) {\n            throw OAuth2RequestError.malformed('username and password must be provided.');\n        }\n\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n\n        const realm = await this.realmRepository.resolve(readRealmHint(body), true);\n\n        const client = clientId ?\n            await this.clientAuthenticator.authenticate(\n                clientId,\n                clientSecret,\n                realm.id,\n            ) :\n            undefined;\n\n        if (client) {\n            assertClientGrantAllowed(client, OAuth2TokenGrant.PASSWORD);\n        }\n\n        const user = await this.authenticator.authenticate(username, password, realm.id);\n\n        return this.runWith(\n            { user, client },\n            {\n                ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n                userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n            },\n        );\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AAkBA,IAAaU,oBAAb,cAAuCL,kBAAAA;CACzBM;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAMA,GAAAA;EAEN,KAAKH,gBAAgBG,IAAIH;EACzB,KAAKC,sBAAsBE,IAAIF;EAC/B,KAAKC,kBAAkBC,IAAID;CAC/B;CAEA,MAAME,eAAeC,OAAqD;EACtE,MAAMC,OAAO,MAAMf,gBAAgBc,KAAAA;EAEnC,MAAME,WAAWT,gBAAgBQ,MAAM,UAAA;EACvC,MAAME,WAAWV,gBAAgBQ,MAAM,UAAA;EACvC,IAAI,CAACC,YAAY,CAACC,UACd,MAAMnB,mBAAmBoB,UAAU,yCAAA;EAGvC,MAAM,EAAEC,UAAUC,iBAAiB,MAAMf,oCAAoCS,KAAAA;EAE7E,MAAMO,QAAQ,MAAM,KAAKV,gBAAgBW,QAAQhB,cAAcS,IAAAA,GAAO,IAAA;EAEtE,MAAMQ,SAASJ,WACX,MAAM,KAAKT,oBAAoBc,aAC3BL,UACAC,cACAC,MAAMI,EAAE,IAEZC,KAAAA;EAEJ,IAAIH,QACAnB,yBAAyBmB,QAAQxB,iBAAiB4B,QAAQ;EAG9D,MAAMC,OAAO,MAAM,KAAKnB,cAAce,aAAaR,UAAUC,UAAUI,MAAMI,EAAE;EAE/E,OAAO,KAAKI,QACR;GAAED;GAAML;EAAO,GACf;GACIO,WAAW5B,aAAaY,OAAO,EAAEiB,YAAY,KAAK,CAAA,KAAML,KAAAA;GACxDM,WAAW/B,iBAAiBa,OAAO,YAAA,KAAiBY,KAAAA;EACxD,CAAA;CAER;AACJ"}
+{"version":3,"file":"password.mjs","names":["EventName","EventScope","UserAuthenticatorKind","isEntityCredentialsInvalidError","isEntityInactiveError","OAuth2MfaRequiredError","OAuth2RequestError","OAuth2TokenGrant","readRequestBody","getRequestHeader","getRequestIP","PasswordGrantType","assertClientGrantAllowed","guessUserAuthenticatorKindByResponse","extractClientCredentialsFromRequest","extractOAuth2ClientCertificateEvidence","readRealmHint","readStringField","HTTPPasswordGrant","authenticator","clientAuthenticator","realmRepository","loginThrottleService","userAuthenticatorService","mfaLoginService","logger","certificateSource","ctx","runWithRequest","event","body","username","password","malformed","clientId","clientSecret","realm","resolve","certificateEvidence","client","authenticate","id","undefined","confirmation","resolveTokenBinding","PASSWORD","ipAddress","trustProxy","userAgent","identifier","trim","toLowerCase","assertNotThrottled","realmId","user","e","eventService","record","scope","OAUTH2","name","LOGIN_FAILED","actorType","actorId","actorName","requestIpAddress","requestUserAgent","requestPath","path","requestMethod","method","data","error_code","code","metrics","recordLogin","mfaVerifiedAt","verifySecondFactor","runWith","status","challenge","issueMaterial","required","otp","ticket","issueMfaTicket","kinds","message","mfa_token","token","mfa_token_expires_in","expiresIn","verified","verify","kind","response","Date","toISOString","interactive","includes","EMAIL","WEBAUTHN","issueTicket","warn","error"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/password.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { User } from '@authup/core-kit';\nimport { EventName, EventScope, UserAuthenticatorKind } from '@authup/core-kit';\nimport type { Logger } from '@authup/server-kit';\nimport { isEntityCredentialsInvalidError, isEntityInactiveError } from '@authup/errors';\nimport type { OAuth2TokenConfirmation, OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2MfaRequiredError, OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type {\n    ICredentialsAuthenticator,\n    ILoginThrottleService,\n    IOAuth2MfaLoginService,\n    IRealmRepository,\n    IUserAuthenticatorService,\n    OAuth2ClientAuthenticator,\n} from '../../../../../core/index.ts';\nimport {\n    PasswordGrantType,\n    assertClientGrantAllowed,\n    guessUserAuthenticatorKindByResponse,\n} from '../../../../../core/index.ts';\nimport type { HTTPOAuth2PasswordGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport type { CertificateSource } from '../../../request/index.ts';\nimport {\n    extractClientCredentialsFromRequest,\n    extractOAuth2ClientCertificateEvidence,\n    readRealmHint,\n    readStringField,\n} from './utils/index.ts';\n\nexport class HTTPPasswordGrant extends PasswordGrantType implements IHTTPOAuth2Grant {\n    protected authenticator : ICredentialsAuthenticator<User>;\n\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    protected realmRepository : IRealmRepository;\n\n    protected loginThrottleService? : ILoginThrottleService;\n\n    protected userAuthenticatorService? : IUserAuthenticatorService;\n\n    protected mfaLoginService? : IOAuth2MfaLoginService;\n\n    protected logger? : Logger;\n\n    protected certificateSource: CertificateSource;\n\n    constructor(ctx: HTTPOAuth2PasswordGrantContext) {\n        super(ctx);\n\n        this.authenticator = ctx.authenticator;\n        this.clientAuthenticator = ctx.clientAuthenticator;\n        this.realmRepository = ctx.realmRepository;\n        this.loginThrottleService = ctx.loginThrottleService;\n        this.userAuthenticatorService = ctx.userAuthenticatorService;\n        this.mfaLoginService = ctx.mfaLoginService;\n        this.logger = ctx.logger;\n        this.certificateSource = ctx.certificateSource ?? 'disabled';\n    }\n\n    async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const body = await readRequestBody(event);\n\n        const username = readStringField(body, 'username');\n        const password = readStringField(body, 'password');\n        if (!username || !password) {\n            throw OAuth2RequestError.malformed('username and password must be provided.');\n        }\n\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n\n        const realm = await this.realmRepository.resolve(readRealmHint(body), true);\n        const certificateEvidence = await extractOAuth2ClientCertificateEvidence(event, this.certificateSource);\n\n        const client = clientId ?\n            await this.clientAuthenticator.authenticate(\n                clientId,\n                clientSecret,\n                realm.id,\n                certificateEvidence,\n            ) :\n            undefined;\n\n        const confirmation = client ?\n            this.clientAuthenticator.resolveTokenBinding(client, certificateEvidence) :\n            undefined;\n\n        if (client) {\n            assertClientGrantAllowed(client, OAuth2TokenGrant.PASSWORD);\n        }\n\n        const ipAddress = getRequestIP(event, { trustProxy: true }) ?? undefined;\n        const userAgent = getRequestHeader(event, 'user-agent') ?? undefined;\n\n        // canonical identifier form (layer 3) — the throttle key and the\n        // loginFailed actor_name must match what canonically stored rows carry.\n        const identifier = username.trim().toLowerCase();\n\n        await this.loginThrottleService?.assertNotThrottled({\n            identifier,\n            ipAddress,\n            realmId: realm.id,\n        });\n\n        let user : User;\n        try {\n            user = await this.authenticator.authenticate(username, password, realm.id);\n        } catch (e) {\n            if (isEntityCredentialsInvalidError(e) || isEntityInactiveError(e)) {\n                await this.eventService?.record({\n                    scope: EventScope.OAUTH2,\n                    name: EventName.LOGIN_FAILED,\n                    actorType: null,\n                    actorId: null,\n                    actorName: identifier,\n                    clientId: client?.id ?? null,\n                    realmId: realm.id,\n                    requestIpAddress: ipAddress ?? null,\n                    requestUserAgent: userAgent ?? null,\n                    requestPath: event.path,\n                    requestMethod: event.method,\n                    data: { error_code: e.code },\n                });\n                this.metrics?.recordLogin('failure');\n            }\n\n            throw e;\n        }\n\n        const mfaVerifiedAt = await this.verifySecondFactor(user, body, {\n            ipAddress,\n            userAgent,\n            clientId: client?.id ?? null,\n            confirmation,\n        });\n\n        return this.runWith(\n            {\n                user, \n                client, \n                mfaVerifiedAt, \n            },\n            {\n                confirmation,\n                ipAddress,\n                userAgent,\n            },\n        );\n    }\n\n    /**\n     * MFA gate on the direct password grant: a user holding a confirmed\n     * device must send a valid `otp` form parameter (TOTP or recovery\n     * code, classified by shape) — otherwise `mfa_required`. Users\n     * without a device pass through (they could never enroll otherwise).\n     */\n    protected async verifySecondFactor(\n        user: User,\n        body: Record<string, any>,\n        ctx: {\n            ipAddress?: string, \n            userAgent?: string, \n            clientId: string | null,\n            confirmation?: OAuth2TokenConfirmation,\n        },\n    ): Promise<string | undefined> {\n        if (!this.userAuthenticatorService) {\n            return undefined;\n        }\n\n        // requirement flags + kinds only — no webauthn material on the token path.\n        const status = await this.userAuthenticatorService.challenge(user.id, { issueMaterial: false });\n        if (!status.required) {\n            return undefined;\n        }\n\n        const otp = readStringField(body, 'otp');\n        if (!otp) {\n            // carry the challengeable kinds so a client (the hosted login form)\n            // can tell whether a single-POST factor (totp/recovery) is on offer\n            // or the user must complete an interactive challenge (email/webauthn).\n            // For the interactive kinds an \"MFA-pending\" ticket (issue #3242)\n            // rides along: a restricted mfa_token-kind bearer accepted ONLY by\n            // the challenge routes, backed by a short-lived pending session\n            // (mfa_at: null) — never a usable access/refresh pair.\n            const ticket = await this.issueMfaTicket(user, status.kinds, ctx);\n\n            throw new OAuth2MfaRequiredError({\n                message: 'Complete a second-factor challenge to continue.',\n                data: {\n                    kinds: status.kinds,\n                    ...(ticket ? {\n                        mfa_token: ticket.token,\n                        mfa_token_expires_in: ticket.expiresIn,\n                    } : {}),\n                },\n            });\n        }\n\n        const verified = await this.userAuthenticatorService.verify(\n            user.id,\n            {\n                kind: guessUserAuthenticatorKindByResponse(otp),\n                response: otp,\n            },\n            {\n                ipAddress: ctx.ipAddress ?? null,\n                userAgent: ctx.userAgent ?? null,\n                clientId: ctx.clientId,\n            },\n        );\n        if (!verified) {\n            throw new OAuth2MfaRequiredError({\n                message: 'The provided second factor is not valid.',\n                data: { kinds: status.kinds },\n            });\n        }\n\n        return new Date().toISOString();\n    }\n\n    /**\n     * Issue the MFA-pending ticket for factor kinds that cannot complete\n     * inside the single grant POST (email needs a server-sent code,\n     * WebAuthn an interactive ceremony). TOTP/recovery-only users keep\n     * the inline `otp` fast-path and get no ticket — a pending session\n     * per plain code entry would be pure churn.\n     */\n    protected async issueMfaTicket(\n        user: User,\n        kinds: `${UserAuthenticatorKind}`[],\n        ctx: {\n            ipAddress?: string,\n            userAgent?: string,\n            clientId: string | null,\n            confirmation?: OAuth2TokenConfirmation,\n        },\n    ) : Promise<{ token: string, expiresIn: number } | null> {\n        if (!this.mfaLoginService) {\n            return null;\n        }\n\n        const interactive = kinds.includes(UserAuthenticatorKind.EMAIL) ||\n            kinds.includes(UserAuthenticatorKind.WEBAUTHN);\n        if (!interactive) {\n            return null;\n        }\n\n        try {\n            return await this.mfaLoginService.issueTicket(\n                {\n                    user,\n                    clientId: ctx.clientId,\n                    confirmation: ctx.confirmation,\n                },\n                {\n                    ipAddress: ctx.ipAddress,\n                    userAgent: ctx.userAgent,\n                },\n            );\n        } catch (e) {\n            // degrade to a ticket-less mfa_required rather than letting a\n            // transient issuance failure (pending-session write, cache,\n            // signer) escape as a raw 500 from a controlled response path —\n            // an otp-capable device can still complete, and the credential\n            // retry re-attempts the ticket.\n            this.logger?.warn('Issuing the MFA-pending login ticket failed.', { error: e });\n\n            return null;\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAsCA,IAAakB,oBAAb,cAAuCP,kBAAAA;CACzBQ;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAMA,GAAAA;EAEN,KAAKR,gBAAgBQ,IAAIR;EACzB,KAAKC,sBAAsBO,IAAIP;EAC/B,KAAKC,kBAAkBM,IAAIN;EAC3B,KAAKC,uBAAuBK,IAAIL;EAChC,KAAKC,2BAA2BI,IAAIJ;EACpC,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,SAASE,IAAIF;EAClB,KAAKC,oBAAoBC,IAAID,qBAAqB;CACtD;CAEA,MAAME,eAAeC,OAAqD;EACtE,MAAMC,OAAO,MAAMtB,gBAAgBqB,KAAAA;EAEnC,MAAME,WAAWd,gBAAgBa,MAAM,UAAA;EACvC,MAAME,WAAWf,gBAAgBa,MAAM,UAAA;EACvC,IAAI,CAACC,YAAY,CAACC,UACd,MAAM1B,mBAAmB2B,UAAU,yCAAA;EAGvC,MAAM,EAAEC,UAAUC,iBAAiB,MAAMrB,oCAAoCe,KAAAA;EAE7E,MAAMO,QAAQ,MAAM,KAAKf,gBAAgBgB,QAAQrB,cAAcc,IAAAA,GAAO,IAAA;EACtE,MAAMQ,sBAAsB,MAAMvB,uCAAuCc,OAAO,KAAKH,iBAAiB;EAEtG,MAAMa,SAASL,WACX,MAAM,KAAKd,oBAAoBoB,aAC3BN,UACAC,cACAC,MAAMK,IACNH,mBAAAA,IAEJI,KAAAA;EAEJ,MAAMC,eAAeJ,SACjB,KAAKnB,oBAAoBwB,oBAAoBL,QAAQD,mBAAAA,IACrDI,KAAAA;EAEJ,IAAIH,QACA3B,yBAAyB2B,QAAQhC,iBAAiBsC,QAAQ;EAG9D,MAAMC,YAAYpC,aAAamB,OAAO,EAAEkB,YAAY,KAAK,CAAA,KAAML,KAAAA;EAC/D,MAAMM,YAAYvC,iBAAiBoB,OAAO,YAAA,KAAiBa,KAAAA;EAI3D,MAAMO,aAAalB,SAASmB,KAAI,CAAA,CAAGC,YAAW;EAE9C,MAAM,KAAK7B,sBAAsB8B,mBAAmB;GAChDH;GACAH;GACAO,SAASjB,MAAMK;EACnB,CAAA;EAEA,IAAIa;EACJ,IAAI;GACAA,OAAO,MAAM,KAAKnC,cAAcqB,aAAaT,UAAUC,UAAUI,MAAMK,EAAE;EAC7E,SAASc,GAAG;GACR,IAAIpD,gCAAgCoD,CAAAA,KAAMnD,sBAAsBmD,CAAAA,GAAI;IAChE,MAAM,KAAKC,cAAcC,OAAO;KAC5BC,OAAOzD,WAAW0D;KAClBC,MAAM5D,UAAU6D;KAChBC,WAAW;KACXC,SAAS;KACTC,WAAWf;KACXf,UAAUK,QAAQE,MAAM;KACxBY,SAASjB,MAAMK;KACfwB,kBAAkBnB,aAAa;KAC/BoB,kBAAkBlB,aAAa;KAC/BmB,aAAatC,MAAMuC;KACnBC,eAAexC,MAAMyC;KACrBC,MAAM,EAAEC,YAAYjB,EAAEkB,KAAK;IAC/B,CAAA;IACA,KAAKC,SAASC,YAAY,SAAA;GAC9B;GAEA,MAAMpB;EACV;EAEA,MAAMqB,gBAAgB,MAAM,KAAKC,mBAAmBvB,MAAMxB,MAAM;GAC5DgB;GACAE;GACAd,UAAUK,QAAQE,MAAM;GACxBE;EACJ,CAAA;EAEA,OAAO,KAAKmC,QACR;GACIxB;GACAf;GACAqC;EACJ,GACA;GACIjC;GACAG;GACAE;EACJ,CAAA;CAER;;;;;;IAQA,MAAgB6B,mBACZvB,MACAxB,MACAH,KAM2B;EAC3B,IAAI,CAAC,KAAKJ,0BACN;EAIJ,MAAMwD,SAAS,MAAM,KAAKxD,yBAAyByD,UAAU1B,KAAKb,IAAI,EAAEwC,eAAe,MAAM,CAAA;EAC7F,IAAI,CAACF,OAAOG,UACR;EAGJ,MAAMC,MAAMlE,gBAAgBa,MAAM,KAAA;EAClC,IAAI,CAACqD,KAAK;GAQN,MAAMC,SAAS,MAAM,KAAKC,eAAe/B,MAAMyB,OAAOO,OAAO3D,GAAAA;GAE7D,MAAM,IAAItB,uBAAuB;IAC7BkF,SAAS;IACThB,MAAM;KACFe,OAAOP,OAAOO;KACd,GAAIF,SAAS;MACTI,WAAWJ,OAAOK;MAClBC,sBAAsBN,OAAOO;KACjC,IAAI,CAAC;IACT;GACJ,CAAA;EACJ;EAcA,IAAI,CAACC,MAZkB,KAAKrE,yBAAyBsE,OACjDvC,KAAKb,IACL;GACIqD,MAAMjF,qCAAqCsE,GAAAA;GAC3CY,UAAUZ;EACd,GACA;GACIrC,WAAWnB,IAAImB,aAAa;GAC5BE,WAAWrB,IAAIqB,aAAa;GAC5Bd,UAAUP,IAAIO;EAClB,CAAA,GAGA,MAAM,IAAI7B,uBAAuB;GAC7BkF,SAAS;GACThB,MAAM,EAAEe,OAAOP,OAAOO,MAAM;EAChC,CAAA;EAGJ,wBAAO,IAAIU,KAAAA,EAAAA,CAAOC,YAAW;CACjC;;;;;;;IASA,MAAgBZ,eACZ/B,MACAgC,OACA3D,KAMqD;EACrD,IAAI,CAAC,KAAKH,iBACN,OAAO;EAKX,IAAI,EAFgB8D,MAAMa,SAASjG,sBAAsBkG,KAAK,KAC1Dd,MAAMa,SAASjG,sBAAsBmG,QAAQ,IAE7C,OAAO;EAGX,IAAI;GACA,OAAO,MAAM,KAAK7E,gBAAgB8E,YAC9B;IACIhD;IACApB,UAAUP,IAAIO;IACdS,cAAchB,IAAIgB;GACtB,GACA;IACIG,WAAWnB,IAAImB;IACfE,WAAWrB,IAAIqB;GACnB,CAAA;EAER,SAASO,GAAG;GAMR,KAAK9B,QAAQ8E,KAAK,gDAAgD,EAAEC,OAAOjD,EAAE,CAAA;GAE7E,OAAO;EACX;CACJ;AACJ"}

package/dist/adapters/http/adapters/oauth2/grant-types/refresh_token.d.ts

@@ -3,10 +3,12 @@ import type { IAppEvent } from 'routup';
 import { OAuth2RefreshTokenGrant } from '../../../../../core/index.ts';
 import type { IOAuth2TokenVerifier, IRealmRepository, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';
 import type { HTTPOAuth2RefreshTokenGrantContext, IHTTPOAuth2Grant } from './types.ts';
+import type { CertificateSource } from '../../../request/index.ts';
 export declare class HTTPOAuth2RefreshTokenGrant extends OAuth2RefreshTokenGrant implements IHTTPOAuth2Grant {
     protected clientAuthenticator: OAuth2ClientAuthenticator;
     protected refreshTokenVerifier: IOAuth2TokenVerifier;
     protected realmRepository: IRealmRepository;
+    protected certificateSource: CertificateSource;
     constructor(ctx: HTTPOAuth2RefreshTokenGrantContext);
     runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse>;
 }

package/dist/adapters/http/adapters/oauth2/grant-types/refresh_token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refresh_token.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/refresh_token.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAG9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,EAAE,uBAAuB,EAA4B,MAAM,8BAA8B,CAAC;AACjG,OAAO,KAAK,EACR,oBAAoB,EACpB,gBAAgB,EAChB,yBAAyB,EAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,kCAAkC,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAGvF,qBAAa,2BAA4B,SAAQ,uBAAwB,YAAW,gBAAgB;IAChG,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;IAE1D,SAAS,CAAC,oBAAoB,EAAG,oBAAoB,CAAC;IAEtD,SAAS,CAAC,eAAe,EAAG,gBAAgB,CAAC;gBAEjC,GAAG,EAAE,kCAAkC;IAQ7C,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;CA2E5E"}
+{"version":3,"file":"refresh_token.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/refresh_token.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAA2B,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAGvF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,EAAE,uBAAuB,EAA4B,MAAM,8BAA8B,CAAC;AACjG,OAAO,KAAK,EACR,oBAAoB,EACpB,gBAAgB,EAChB,yBAAyB,EAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,kCAAkC,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACvF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAOnE,qBAAa,2BAA4B,SAAQ,uBAAwB,YAAW,gBAAgB;IAChG,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;IAE1D,SAAS,CAAC,oBAAoB,EAAG,oBAAoB,CAAC;IAEtD,SAAS,CAAC,eAAe,EAAG,gBAAgB,CAAC;IAE7C,SAAS,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;gBAEnC,GAAG,EAAE,kCAAkC;IAS7C,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAqG5E"}

package/dist/adapters/http/adapters/oauth2/grant-types/refresh_token.mjs

@@ -4,9 +4,11 @@ import.meta.url;
 import { assertClientGrantAllowed } from "../../../../../core/oauth2/client/grant-type.mjs";
 import { OAuth2RefreshTokenGrant } from "../../../../../core/oauth2/grant-types/refresh-token.mjs";
 import "../../../../../core/index.mjs";
+import { extractOAuth2ClientCertificateEvidence } from "./utils/certificate.mjs";
 import { extractClientCredentialsFromRequest } from "./utils/credentials.mjs";
 import { readRealmHint } from "./utils/realm.mjs";
 import "./utils/index.mjs";
+import { isClientPublic } from "@authup/core-kit";
 import { OAuth2GrantError, OAuth2RequestError, OAuth2TokenGrant } from "@authup/specs";
 import { getRequestHeader, getRequestIP } from "routup";
 import { readRequestBody } from "@routup/basic/body";
@@ -15,27 +17,38 @@ var HTTPOAuth2RefreshTokenGrant = class extends OAuth2RefreshTokenGrant {
 	clientAuthenticator;
 	refreshTokenVerifier;
 	realmRepository;
+	certificateSource;
 	constructor(ctx) {
 		super(ctx);
 		this.clientAuthenticator = ctx.clientAuthenticator;
 		this.refreshTokenVerifier = ctx.tokenVerifier;
 		this.realmRepository = ctx.realmRepository;
+		this.certificateSource = ctx.certificateSource ?? "disabled";
 	}
 	async runWithRequest(event) {
 		const body = await readRequestBody(event);
 		const refreshToken = body?.refresh_token;
 		if (typeof refreshToken !== "string" || refreshToken.length === 0) throw OAuth2RequestError.malformed();
 		const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);
+		const certificateEvidence = await extractOAuth2ClientCertificateEvidence(event, this.certificateSource);
 		const payload = await this.refreshTokenVerifier.verify(refreshToken, { skipActiveCheck: true });
 		let client;
 		if (clientId) {
 			const realm = await this.realmRepository.resolve(readRealmHint(body), true);
-			client = await this.clientAuthenticator.authenticate(clientId, clientSecret, realm.id);
+			client = await this.clientAuthenticator.authenticate(clientId, clientSecret, realm.id, certificateEvidence);
 			if (payload.client_id && payload.client_id !== client.id) throw OAuth2GrantError.invalid();
-		} else if (payload.client_id) client = await this.clientAuthenticator.authenticate(payload.client_id);
+		} else if (payload.client_id) client = await this.clientAuthenticator.authenticate(payload.client_id, void 0, void 0, certificateEvidence);
 		if (client) assertClientGrantAllowed(client, OAuth2TokenGrant.REFRESH_TOKEN);
-		if (client && !client.is_confidential && payload.realm_id && payload.realm_id !== client.realm_id) throw OAuth2GrantError.invalid();
+		let confirmation;
+		if (payload.cnf) {
+			const expectedThumbprint = payload.cnf["x5t#S256"];
+			if (typeof expectedThumbprint !== "string" || expectedThumbprint.length === 0) throw OAuth2GrantError.invalid();
+			confirmation = this.clientAuthenticator.validateCertificateEvidenceForBinding(certificateEvidence);
+			if (confirmation["x5t#S256"] !== expectedThumbprint) throw OAuth2GrantError.invalid();
+		} else if (client) confirmation = this.clientAuthenticator.resolveTokenBinding(client, certificateEvidence);
+		if (client && isClientPublic(client) && payload.realm_id && payload.realm_id !== client.realm_id) throw OAuth2GrantError.invalid();
 		return this.runWith(payload, {
+			confirmation,
 			ipAddress: getRequestIP(event, { trustProxy: true }) ?? void 0,
 			userAgent: getRequestHeader(event, "user-agent") ?? void 0
 		});

package/dist/adapters/http/adapters/oauth2/grant-types/refresh_token.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"refresh_token.mjs","names":["OAuth2GrantError","OAuth2RequestError","OAuth2TokenGrant","readRequestBody","getRequestHeader","getRequestIP","OAuth2RefreshTokenGrant","assertClientGrantAllowed","extractClientCredentialsFromRequest","readRealmHint","HTTPOAuth2RefreshTokenGrant","clientAuthenticator","refreshTokenVerifier","realmRepository","ctx","tokenVerifier","runWithRequest","event","body","refreshToken","refresh_token","length","malformed","clientId","clientSecret","payload","verify","skipActiveCheck","client","realm","resolve","authenticate","id","client_id","invalid","REFRESH_TOKEN","is_confidential","realm_id","runWith","ipAddress","trustProxy","undefined","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/refresh_token.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Client } from '@authup/core-kit';\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2GrantError, OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport { OAuth2RefreshTokenGrant, assertClientGrantAllowed } from '../../../../../core/index.ts';\nimport type {\n    IOAuth2TokenVerifier,\n    IRealmRepository,\n    OAuth2ClientAuthenticator,\n} from '../../../../../core/index.ts';\nimport type { HTTPOAuth2RefreshTokenGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport { extractClientCredentialsFromRequest, readRealmHint } from './utils/index.ts';\n\nexport class HTTPOAuth2RefreshTokenGrant extends OAuth2RefreshTokenGrant implements IHTTPOAuth2Grant {\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    protected refreshTokenVerifier : IOAuth2TokenVerifier;\n\n    protected realmRepository : IRealmRepository;\n\n    constructor(ctx: HTTPOAuth2RefreshTokenGrantContext) {\n        super(ctx);\n\n        this.clientAuthenticator = ctx.clientAuthenticator;\n        this.refreshTokenVerifier = ctx.tokenVerifier;\n        this.realmRepository = ctx.realmRepository;\n    }\n\n    async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const body = await readRequestBody(event);\n        const refreshToken = body?.refresh_token;\n        if (typeof refreshToken !== 'string' || refreshToken.length === 0) {\n            throw OAuth2RequestError.malformed();\n        }\n\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n\n        // RFC 6749 §6: verify the refresh token first to learn its bound\n        // client (if any), then enforce binding. Authenticate the requesting\n        // client when credentials are present, or when the token requires\n        // a client binding.\n        //\n        // skipActiveCheck: the durable auth_session_tokens row (not the cache\n        // blocklist) is the refresh-token authority, so a replayed/consumed\n        // token must reach runWith() to trigger family revocation instead of\n        // being rejected here with JWT_INACTIVE.\n        const payload = await this.refreshTokenVerifier.verify(refreshToken, { skipActiveCheck: true });\n\n        let client: Client | undefined;\n\n        if (clientId) {\n            // A client authenticated itself. Resolve by the presented\n            // id/secret (name resolution scoped by the realm hint — resolved\n            // lazily so a bare refresh skips the SELECT) and enforce the\n            // token↔client binding.\n            const realm = await this.realmRepository.resolve(readRealmHint(body), true);\n\n            client = await this.clientAuthenticator.authenticate(\n                clientId,\n                clientSecret,\n                realm.id,\n            );\n\n            if (payload.client_id && payload.client_id !== client.id) {\n                throw OAuth2GrantError.invalid();\n            }\n        } else if (payload.client_id) {\n            // No client credentials were presented, but the token is bound to\n            // a client. RFC 6749 §10.4: a public client cannot authenticate\n            // (no secret) and is not required to — the bound identity is read\n            // from the signed token (client_id is server-minted, so trusted)\n            // and refresh-token rotation/replay detection is the abuse control.\n            // A confidential client MUST still authenticate: authenticate()\n            // with no secret throws invalid_client for it, so a confidential-\n            // bound token presented without credentials is rejected here.\n            client = await this.clientAuthenticator.authenticate(payload.client_id);\n        }\n\n        if (client) {\n            assertClientGrantAllowed(client, OAuth2TokenGrant.REFRESH_TOKEN);\n        }\n\n        // Realm parity for PUBLIC clients only: a public client may not refresh\n        // a token whose realm differs from the (bound) client's own realm.\n        // Kills cross-realm refresh tokens minted for a public `web` client\n        // before the authorize-side realm gate existed. Confidential clients\n        // are exempt — the client secret already proves identity, and the\n        // documented cross-realm password grant (UUID-identified user against a\n        // master-realm client) depends on that exemption.\n        if (\n            client &&\n            !client.is_confidential &&\n            payload.realm_id &&\n            payload.realm_id !== client.realm_id\n        ) {\n            throw OAuth2GrantError.invalid();\n        }\n\n        return this.runWith(payload, {\n            ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AAsBA,IAAaU,8BAAb,cAAiDJ,wBAAAA;CACnCK;CAEAC;CAEAC;CAEV,YAAYC,KAAyC;EACjD,MAAMA,GAAAA;EAEN,KAAKH,sBAAsBG,IAAIH;EAC/B,KAAKC,uBAAuBE,IAAIC;EAChC,KAAKF,kBAAkBC,IAAID;CAC/B;CAEA,MAAMG,eAAeC,OAAqD;EACtE,MAAMC,OAAO,MAAMf,gBAAgBc,KAAAA;EACnC,MAAME,eAAeD,MAAME;EAC3B,IAAI,OAAOD,iBAAiB,YAAYA,aAAaE,WAAW,GAC5D,MAAMpB,mBAAmBqB,UAAS;EAGtC,MAAM,EAAEC,UAAUC,iBAAiB,MAAMhB,oCAAoCS,KAAAA;EAW7E,MAAMQ,UAAU,MAAM,KAAKb,qBAAqBc,OAAOP,cAAc,EAAEQ,iBAAiB,KAAK,CAAA;EAE7F,IAAIC;EAEJ,IAAIL,UAAU;GAKV,MAAMM,QAAQ,MAAM,KAAKhB,gBAAgBiB,QAAQrB,cAAcS,IAAAA,GAAO,IAAA;GAEtEU,SAAS,MAAM,KAAKjB,oBAAoBoB,aACpCR,UACAC,cACAK,MAAMG,EAAE;GAGZ,IAAIP,QAAQQ,aAAaR,QAAQQ,cAAcL,OAAOI,IAClD,MAAMhC,iBAAiBkC,QAAO;EAEtC,OAAO,IAAIT,QAAQQ,WASfL,SAAS,MAAM,KAAKjB,oBAAoBoB,aAAaN,QAAQQ,SAAS;EAG1E,IAAIL,QACArB,yBAAyBqB,QAAQ1B,iBAAiBiC,aAAa;EAUnE,IACIP,UACA,CAACA,OAAOQ,mBACRX,QAAQY,YACRZ,QAAQY,aAAaT,OAAOS,UAE5B,MAAMrC,iBAAiBkC,QAAO;EAGlC,OAAO,KAAKI,QAAQb,SAAS;GACzBc,WAAWlC,aAAaY,OAAO,EAAEuB,YAAY,KAAK,CAAA,KAAMC,KAAAA;GACxDC,WAAWtC,iBAAiBa,OAAO,YAAA,KAAiBwB,KAAAA;EACxD,CAAA;CACJ;AACJ"}
+{"version":3,"file":"refresh_token.mjs","names":["isClientPublic","OAuth2GrantError","OAuth2RequestError","OAuth2TokenGrant","readRequestBody","getRequestHeader","getRequestIP","OAuth2RefreshTokenGrant","assertClientGrantAllowed","extractClientCredentialsFromRequest","extractOAuth2ClientCertificateEvidence","readRealmHint","HTTPOAuth2RefreshTokenGrant","clientAuthenticator","refreshTokenVerifier","realmRepository","certificateSource","ctx","tokenVerifier","runWithRequest","event","body","refreshToken","refresh_token","length","malformed","clientId","clientSecret","certificateEvidence","payload","verify","skipActiveCheck","client","realm","resolve","authenticate","id","client_id","invalid","undefined","REFRESH_TOKEN","confirmation","cnf","expectedThumbprint","validateCertificateEvidenceForBinding","resolveTokenBinding","realm_id","runWith","ipAddress","trustProxy","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/refresh_token.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { type Client, isClientPublic } from '@authup/core-kit';\nimport type { OAuth2TokenConfirmation, OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2GrantError, OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport { OAuth2RefreshTokenGrant, assertClientGrantAllowed } from '../../../../../core/index.ts';\nimport type {\n    IOAuth2TokenVerifier,\n    IRealmRepository,\n    OAuth2ClientAuthenticator,\n} from '../../../../../core/index.ts';\nimport type { HTTPOAuth2RefreshTokenGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport type { CertificateSource } from '../../../request/index.ts';\nimport {\n    extractClientCredentialsFromRequest,\n    extractOAuth2ClientCertificateEvidence,\n    readRealmHint,\n} from './utils/index.ts';\n\nexport class HTTPOAuth2RefreshTokenGrant extends OAuth2RefreshTokenGrant implements IHTTPOAuth2Grant {\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    protected refreshTokenVerifier : IOAuth2TokenVerifier;\n\n    protected realmRepository : IRealmRepository;\n\n    protected certificateSource: CertificateSource;\n\n    constructor(ctx: HTTPOAuth2RefreshTokenGrantContext) {\n        super(ctx);\n\n        this.clientAuthenticator = ctx.clientAuthenticator;\n        this.refreshTokenVerifier = ctx.tokenVerifier;\n        this.realmRepository = ctx.realmRepository;\n        this.certificateSource = ctx.certificateSource ?? 'disabled';\n    }\n\n    async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const body = await readRequestBody(event);\n        const refreshToken = body?.refresh_token;\n        if (typeof refreshToken !== 'string' || refreshToken.length === 0) {\n            throw OAuth2RequestError.malformed();\n        }\n\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n        const certificateEvidence = await extractOAuth2ClientCertificateEvidence(event, this.certificateSource);\n\n        // RFC 6749 §6: verify the refresh token first to learn its bound\n        // client (if any), then enforce binding. Authenticate the requesting\n        // client when credentials are present, or when the token requires\n        // a client binding.\n        //\n        // skipActiveCheck: the durable auth_session_tokens row (not the cache\n        // blocklist) is the refresh-token authority, so a replayed/consumed\n        // token must reach runWith() to trigger family revocation instead of\n        // being rejected here with JWT_INACTIVE.\n        const payload = await this.refreshTokenVerifier.verify(refreshToken, { skipActiveCheck: true });\n\n        let client: Client | undefined;\n\n        if (clientId) {\n            // A client authenticated itself. Resolve by the presented\n            // id/secret (name resolution scoped by the realm hint — resolved\n            // lazily so a bare refresh skips the SELECT) and enforce the\n            // token↔client binding.\n            const realm = await this.realmRepository.resolve(readRealmHint(body), true);\n\n            client = await this.clientAuthenticator.authenticate(\n                clientId,\n                clientSecret,\n                realm.id,\n                certificateEvidence,\n            );\n\n            if (payload.client_id && payload.client_id !== client.id) {\n                throw OAuth2GrantError.invalid();\n            }\n        } else if (payload.client_id) {\n            // No client credentials were presented, but the token is bound to\n            // a client. RFC 6749 §10.4: a public client cannot authenticate\n            // (no secret) and is not required to — the bound identity is read\n            // from the signed token (client_id is server-minted, so trusted)\n            // and refresh-token rotation/replay detection is the abuse control.\n            // A client with an authentication method MUST still authenticate.\n            // Supplying the server-minted client id lets TLS clients prove\n            // themselves with the request certificate, while a secret client\n            // still fails because its secret is absent.\n            client = await this.clientAuthenticator.authenticate(\n                payload.client_id,\n                undefined,\n                undefined,\n                certificateEvidence,\n            );\n        }\n\n        if (client) {\n            assertClientGrantAllowed(client, OAuth2TokenGrant.REFRESH_TOKEN);\n        }\n\n        let confirmation: OAuth2TokenConfirmation | undefined;\n        if (payload.cnf) {\n            const expectedThumbprint = payload.cnf['x5t#S256'];\n            if (typeof expectedThumbprint !== 'string' || expectedThumbprint.length === 0) {\n                throw OAuth2GrantError.invalid();\n            }\n\n            confirmation = this.clientAuthenticator.validateCertificateEvidenceForBinding(\n                certificateEvidence,\n            );\n            if (confirmation['x5t#S256'] !== expectedThumbprint) {\n                throw OAuth2GrantError.invalid();\n            }\n        } else if (client) {\n            confirmation = this.clientAuthenticator.resolveTokenBinding(client, certificateEvidence);\n        }\n\n        // Realm parity for PUBLIC clients only: a public client may not refresh\n        // a token whose realm differs from the (bound) client's own realm.\n        // Kills cross-realm refresh tokens minted for a public `web` client\n        // before the authorize-side realm gate existed. Authenticated clients\n        // are exempt — the configured secret/certificate proves identity, and the\n        // documented cross-realm password grant (UUID-identified user against a\n        // master-realm client) depends on that exemption.\n        if (\n            client &&\n            isClientPublic(client) &&\n            payload.realm_id &&\n            payload.realm_id !== client.realm_id\n        ) {\n            throw OAuth2GrantError.invalid();\n        }\n\n        return this.runWith(payload, {\n            confirmation,\n            ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;AA2BA,IAAaY,8BAAb,cAAiDL,wBAAAA;CACnCM;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAyC;EACjD,MAAMA,GAAAA;EAEN,KAAKJ,sBAAsBI,IAAIJ;EAC/B,KAAKC,uBAAuBG,IAAIC;EAChC,KAAKH,kBAAkBE,IAAIF;EAC3B,KAAKC,oBAAoBC,IAAID,qBAAqB;CACtD;CAEA,MAAMG,eAAeC,OAAqD;EACtE,MAAMC,OAAO,MAAMjB,gBAAgBgB,KAAAA;EACnC,MAAME,eAAeD,MAAME;EAC3B,IAAI,OAAOD,iBAAiB,YAAYA,aAAaE,WAAW,GAC5D,MAAMtB,mBAAmBuB,UAAS;EAGtC,MAAM,EAAEC,UAAUC,iBAAiB,MAAMlB,oCAAoCW,KAAAA;EAC7E,MAAMQ,sBAAsB,MAAMlB,uCAAuCU,OAAO,KAAKJ,iBAAiB;EAWtG,MAAMa,UAAU,MAAM,KAAKf,qBAAqBgB,OAAOR,cAAc,EAAES,iBAAiB,KAAK,CAAA;EAE7F,IAAIC;EAEJ,IAAIN,UAAU;GAKV,MAAMO,QAAQ,MAAM,KAAKlB,gBAAgBmB,QAAQvB,cAAcU,IAAAA,GAAO,IAAA;GAEtEW,SAAS,MAAM,KAAKnB,oBAAoBsB,aACpCT,UACAC,cACAM,MAAMG,IACNR,mBAAAA;GAGJ,IAAIC,QAAQQ,aAAaR,QAAQQ,cAAcL,OAAOI,IAClD,MAAMnC,iBAAiBqC,QAAO;EAEtC,OAAO,IAAIT,QAAQQ,WAUfL,SAAS,MAAM,KAAKnB,oBAAoBsB,aACpCN,QAAQQ,WACRE,KAAAA,GACAA,KAAAA,GACAX,mBAAAA;EAIR,IAAII,QACAxB,yBAAyBwB,QAAQ7B,iBAAiBqC,aAAa;EAGnE,IAAIC;EACJ,IAAIZ,QAAQa,KAAK;GACb,MAAMC,qBAAqBd,QAAQa,IAAI;GACvC,IAAI,OAAOC,uBAAuB,YAAYA,mBAAmBnB,WAAW,GACxE,MAAMvB,iBAAiBqC,QAAO;GAGlCG,eAAe,KAAK5B,oBAAoB+B,sCACpChB,mBAAAA;GAEJ,IAAIa,aAAa,gBAAgBE,oBAC7B,MAAM1C,iBAAiBqC,QAAO;EAEtC,OAAO,IAAIN,QACPS,eAAe,KAAK5B,oBAAoBgC,oBAAoBb,QAAQJ,mBAAAA;EAUxE,IACII,UACAhC,eAAegC,MAAAA,KACfH,QAAQiB,YACRjB,QAAQiB,aAAad,OAAOc,UAE5B,MAAM7C,iBAAiBqC,QAAO;EAGlC,OAAO,KAAKS,QAAQlB,SAAS;GACzBY;GACAO,WAAW1C,aAAac,OAAO,EAAE6B,YAAY,KAAK,CAAA,KAAMV,KAAAA;GACxDW,WAAW7C,iBAAiBe,OAAO,YAAA,KAAiBmB,KAAAA;EACxD,CAAA;CACJ;AACJ"}