@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.53

package/dist/adapters/http/adapters/oauth2/grant-types/types.d.ts

@@ -1,11 +1,15 @@
-import type { Client, Robot, User } from '@authup/core-kit';
+import type { Robot, User } from '@authup/core-kit';
+import type { Logger } from '@authup/server-kit';
 import type { OAuth2TokenGrantResponse } from '@authup/specs';
 import type { IAppEvent } from 'routup';
-import type { BaseGrantContext, ICredentialsAuthenticator, IOAuth2AuthorizationCodeVerifier, IRealmRepository, OAuth2AuthorizeGrantContext, OAuth2ClientAuthenticator, OAuth2PasswordGrantContext, OAuth2RefreshTokenGrantContext } from '../../../../../core/index.ts';
+import type { BaseGrantContext, ICredentialsAuthenticator, ILoginThrottleService, IOAuth2AccessPolicyEvaluator, IOAuth2AuthorizationCodeVerifier, IOAuth2MfaLoginService, IRealmRepository, IUserAuthenticatorService, OAuth2AuthorizeGrantContext, OAuth2ClientAuthenticator, OAuth2PasswordGrantContext, OAuth2RefreshTokenGrantContext } from '../../../../../core/index.ts';
+import type { CertificateSource } from '../../../request/index.ts';
 export type HTTPOAuth2AuthorizeGrantContext = OAuth2AuthorizeGrantContext & {
     codeVerifier: IOAuth2AuthorizationCodeVerifier;
     clientAuthenticator: OAuth2ClientAuthenticator;
     realmRepository: IRealmRepository;
+    accessPolicyEvaluator?: IOAuth2AccessPolicyEvaluator;
+    certificateSource: CertificateSource;
 };
 export interface IHTTPOAuth2Grant {
     runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse>;
@@ -14,13 +18,20 @@ export type HTTPOAuth2PasswordGrantContext = OAuth2PasswordGrantContext & {
     authenticator: ICredentialsAuthenticator<User>;
     clientAuthenticator: OAuth2ClientAuthenticator;
     realmRepository: IRealmRepository;
+    loginThrottleService?: ILoginThrottleService;
+    userAuthenticatorService?: IUserAuthenticatorService;
+    mfaLoginService?: IOAuth2MfaLoginService;
+    logger?: Logger;
+    certificateSource: CertificateSource;
 };
 export type HTTPOAuth2RefreshTokenGrantContext = OAuth2RefreshTokenGrantContext & {
     clientAuthenticator: OAuth2ClientAuthenticator;
     realmRepository: IRealmRepository;
+    certificateSource: CertificateSource;
 };
 export type HTTPOAuth2ClientCredentialsGrantContext = BaseGrantContext & {
-    authenticator: ICredentialsAuthenticator<Client>;
+    clientAuthenticator: OAuth2ClientAuthenticator;
+    certificateSource: CertificateSource;
 };
 export type HTTPOAuth2RobotCredentialsGrantContext = BaseGrantContext & {
     authenticator: ICredentialsAuthenticator<Robot>;

package/dist/adapters/http/adapters/oauth2/grant-types/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EACR,gBAAgB,EAChB,yBAAyB,EACzB,gCAAgC,EAChC,gBAAgB,EAChB,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,8BAA8B,EACjC,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,+BAA+B,GAAG,2BAA2B,GAAG;IACxE,YAAY,EAAE,gCAAgC,CAAC;IAC/C,mBAAmB,EAAE,yBAAyB,CAAC;IAC/C,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC7B,cAAc,CAAC,KAAK,EAAE,SAAS,GAAI,OAAO,CAAC,wBAAwB,CAAC,CAAA;CACvE;AAED,MAAM,MAAM,8BAA8B,GAAG,0BAA0B,GAAG;IACtE,aAAa,EAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAChD,mBAAmB,EAAE,yBAAyB,CAAC;IAC/C,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,kCAAkC,GAAG,8BAA8B,GAAG;IAC9E,mBAAmB,EAAE,yBAAyB,CAAC;IAC/C,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,uCAAuC,GAAG,gBAAgB,GAAG;IACrE,aAAa,EAAG,yBAAyB,CAAC,MAAM,CAAC,CAAA;CACpD,CAAC;AAEF,MAAM,MAAM,sCAAsC,GAAG,gBAAgB,GAAG;IACpE,aAAa,EAAG,yBAAyB,CAAC,KAAK,CAAC,CAAA;CACnD,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EACR,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,EACrB,4BAA4B,EAC5B,gCAAgC,EAChC,sBAAsB,EACtB,gBAAgB,EAChB,yBAAyB,EACzB,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,8BAA8B,EACjC,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,MAAM,MAAM,+BAA+B,GAAG,2BAA2B,GAAG;IACxE,YAAY,EAAE,gCAAgC,CAAC;IAC/C,mBAAmB,EAAE,yBAAyB,CAAC;IAC/C,eAAe,EAAE,gBAAgB,CAAC;IAClC,qBAAqB,CAAC,EAAE,4BAA4B,CAAC;IACrD,iBAAiB,EAAE,iBAAiB,CAAC;CACxC,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC7B,cAAc,CAAC,KAAK,EAAE,SAAS,GAAI,OAAO,CAAC,wBAAwB,CAAC,CAAA;CACvE;AAED,MAAM,MAAM,8BAA8B,GAAG,0BAA0B,GAAG;IACtE,aAAa,EAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAChD,mBAAmB,EAAE,yBAAyB,CAAC;IAC/C,eAAe,EAAE,gBAAgB,CAAC;IAClC,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAC7C,wBAAwB,CAAC,EAAE,yBAAyB,CAAC;IACrD,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,iBAAiB,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,kCAAkC,GAAG,8BAA8B,GAAG;IAC9E,mBAAmB,EAAE,yBAAyB,CAAC;IAC/C,eAAe,EAAE,gBAAgB,CAAC;IAClC,iBAAiB,EAAE,iBAAiB,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,uCAAuC,GAAG,gBAAgB,GAAG;IACrE,mBAAmB,EAAE,yBAAyB,CAAC;IAC/C,iBAAiB,EAAE,iBAAiB,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,sCAAsC,GAAG,gBAAgB,GAAG;IACpE,aAAa,EAAG,yBAAyB,CAAC,KAAK,CAAC,CAAA;CACnD,CAAC"}

package/dist/adapters/http/adapters/oauth2/grant-types/utils/certificate.d.ts

@@ -0,0 +1,5 @@
+import type { IAppEvent } from 'routup';
+import type { ClientCertificateEvidence } from '../../../../../../core/index.ts';
+import { type CertificateSource } from '../../../../request/index.ts';
+export declare function extractOAuth2ClientCertificateEvidence(event: IAppEvent, source: CertificateSource): Promise<ClientCertificateEvidence | undefined>;
+//# sourceMappingURL=certificate.d.ts.map

package/dist/adapters/http/adapters/oauth2/grant-types/utils/certificate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"certificate.d.ts","sourceRoot":"","sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/certificate.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AACjF,OAAO,EACH,KAAK,iBAAiB,EAEzB,MAAM,8BAA8B,CAAC;AAEtC,wBAAsB,sCAAsC,CACxD,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,iBAAiB,GAC1B,OAAO,CAAC,yBAAyB,GAAG,SAAS,CAAC,CAMhD"}

package/dist/adapters/http/adapters/oauth2/grant-types/utils/certificate.mjs

@@ -0,0 +1,18 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { extractClientCertificateEvidence } from "../../../../request/client-certificate.mjs";
+import "../../../../request/index.mjs";
+import { OAuth2ClientError } from "@authup/specs";
+//#region src/adapters/http/adapters/oauth2/grant-types/utils/certificate.ts
+async function extractOAuth2ClientCertificateEvidence(event, source) {
+	try {
+		return await extractClientCertificateEvidence(event, source);
+	} catch {
+		throw OAuth2ClientError.invalid();
+	}
+}
+//#endregion
+export { extractOAuth2ClientCertificateEvidence };
+
+//# sourceMappingURL=certificate.mjs.map

package/dist/adapters/http/adapters/oauth2/grant-types/utils/certificate.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"certificate.mjs","names":["OAuth2ClientError","extractClientCertificateEvidence","extractOAuth2ClientCertificateEvidence","event","source","invalid"],"sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/certificate.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { OAuth2ClientError } from '@authup/specs';\nimport type { IAppEvent } from 'routup';\nimport type { ClientCertificateEvidence } from '../../../../../../core/index.ts';\nimport {\n    type CertificateSource,\n    extractClientCertificateEvidence,\n} from '../../../../request/index.ts';\n\nexport async function extractOAuth2ClientCertificateEvidence(\n    event: IAppEvent,\n    source: CertificateSource,\n): Promise<ClientCertificateEvidence | undefined> {\n    try {\n        return await extractClientCertificateEvidence(event, source);\n    } catch {\n        throw OAuth2ClientError.invalid();\n    }\n}\n"],"mappings":";;;;;;;AAeA,eAAsBE,uCAClBC,OACAC,QAAyB;CAEzB,IAAI;EACA,OAAO,MAAMH,iCAAiCE,OAAOC,MAAAA;CACzD,QAAQ;EACJ,MAAMJ,kBAAkBK,QAAO;CACnC;AACJ"}

package/dist/adapters/http/adapters/oauth2/grant-types/utils/credentials.mjs

@@ -2,8 +2,8 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { OAuth2RequestError } from "@authup/specs";
-import { AuthorizationHeaderType, parseAuthorizationHeader } from "hapic";
 import { readRequestBody } from "@routup/basic/body";
+import { AuthorizationHeaderType, parseAuthorizationHeader } from "hapic";
 //#region src/adapters/http/adapters/oauth2/grant-types/utils/credentials.ts
 /**
 * Extract client credentials from an OAuth2 token endpoint request.

package/dist/adapters/http/adapters/oauth2/grant-types/utils/guess.mjs

@@ -2,9 +2,9 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { OAuth2TokenGrant } from "@authup/specs";
-import { AuthorizationHeaderType, parseAuthorizationHeader } from "hapic";
 import { readRequestBody } from "@routup/basic/body";
 import { useRequestQuery } from "@routup/basic/query";
+import { AuthorizationHeaderType, parseAuthorizationHeader } from "hapic";
 //#region src/adapters/http/adapters/oauth2/grant-types/utils/guess.ts
 async function guessOauth2GrantTypeByRequest(event) {
 	const body = await readRequestBody(event);

package/dist/adapters/http/adapters/oauth2/grant-types/utils/index.d.ts

@@ -1,3 +1,4 @@
+export * from './certificate.ts';
 export * from './credentials.ts';
 export * from './guess.ts';
 export * from './realm.ts';

package/dist/adapters/http/adapters/oauth2/grant-types/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/index.ts"],"names":[],"mappings":"AAOA,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/index.ts"],"names":[],"mappings":"AAOA,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC"}

package/dist/adapters/http/adapters/oauth2/grant-types/utils/index.mjs

@@ -1,7 +1,8 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { extractOAuth2ClientCertificateEvidence } from "./certificate.mjs";
 import { extractClientCredentialsFromRequest, readStringField } from "./credentials.mjs";
 import { guessOauth2GrantTypeByRequest } from "./guess.mjs";
 import { readRealmHint } from "./realm.mjs";
-export { extractClientCredentialsFromRequest, guessOauth2GrantTypeByRequest, readRealmHint, readStringField };
+export { extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, guessOauth2GrantTypeByRequest, readRealmHint, readStringField };

package/dist/adapters/http/adapters/oauth2/index.mjs

@@ -3,6 +3,7 @@ import "node:url";
 import.meta.url;
 import { HTTPOAuth2Authorizer } from "./authorization/module.mjs";
 import "./authorization/index.mjs";
+import { extractOAuth2ClientCertificateEvidence } from "./grant-types/utils/certificate.mjs";
 import { extractClientCredentialsFromRequest, readStringField } from "./grant-types/utils/credentials.mjs";
 import { guessOauth2GrantTypeByRequest } from "./grant-types/utils/guess.mjs";
 import { readRealmHint } from "./grant-types/utils/realm.mjs";
@@ -13,4 +14,4 @@ import { HTTPPasswordGrant } from "./grant-types/password.mjs";
 import { HTTPOAuth2RefreshTokenGrant } from "./grant-types/refresh_token.mjs";
 import { HTTPRobotCredentialsGrant } from "./grant-types/robot-credentials.mjs";
 import "./grant-types/index.mjs";
-export { HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, extractClientCredentialsFromRequest, guessOauth2GrantTypeByRequest, readRealmHint, readStringField };
+export { HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, guessOauth2GrantTypeByRequest, readRealmHint, readStringField };

package/dist/adapters/http/controllers/entities/consent/index.d.ts

@@ -0,0 +1,2 @@
+export * from './module.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/controllers/entities/consent/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/consent/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC"}

package/dist/adapters/http/controllers/entities/consent/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { ConsentController } from "./module.mjs";
+export { ConsentController };

package/dist/adapters/http/controllers/entities/consent/module.d.ts

@@ -0,0 +1,15 @@
+import type { Consent } from '@authup/core-kit';
+import type { IAppEvent } from 'routup';
+import type { EntityCollectionResponse } from '@authup/core-http-kit';
+import type { IConsentService } from '../../../../../core/index.ts';
+export type ConsentControllerContext = {
+    service: IConsentService;
+};
+export declare class ConsentController {
+    protected service: IConsentService;
+    constructor(ctx: ConsentControllerContext);
+    getMany(event: IAppEvent): Promise<EntityCollectionResponse<Consent>>;
+    getOne(id: string, event: IAppEvent): Promise<Consent>;
+    drop(id: string, event: IAppEvent): Promise<Consent>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/controllers/entities/consent/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/consent/module.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAIpE,MAAM,MAAM,wBAAwB,GAAG;IACnC,OAAO,EAAE,eAAe,CAAC;CAC5B,CAAC;AAEF,qBAEa,iBAAiB;IAC1B,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC;gBAEvB,GAAG,EAAE,wBAAwB;IAKnC,OAAO,CACG,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAcvC,MAAM,CACK,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,OAAO,CAAC;IAOb,IAAI,CACO,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,OAAO,CAAC;CAQtB"}

package/dist/adapters/http/controllers/entities/consent/module.mjs

@@ -0,0 +1,82 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { buildActorContext } from "../../../request/helpers/actor.mjs";
+import { getRequestRealmID } from "../../../request/helpers/realm-id.mjs";
+import "../../../request/index.mjs";
+import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
+import "../../../middleware/index.mjs";
+import { useRequestQuery } from "@routup/basic/query";
+import { DContext, DController, DDelete, DGet, DPath, DTags } from "@routup/decorators";
+//#region src/adapters/http/controllers/entities/consent/module.ts
+function _ts_decorate(decorators, target, key, desc) {
+	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+	return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(k, v) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+function _ts_param(paramIndex, decorator) {
+	return function(target, key) {
+		decorator(target, key, paramIndex);
+	};
+}
+var ConsentController = class {
+	service;
+	constructor(ctx) {
+		this.service = ctx.service;
+	}
+	async getMany(event) {
+		const actor = buildActorContext(event);
+		const { data, meta } = await this.service.getMany(useRequestQuery(event), actor, { realmId: getRequestRealmID(event) });
+		return {
+			data,
+			meta
+		};
+	}
+	async getOne(id, event) {
+		const actor = buildActorContext(event);
+		return this.service.getOne(id, actor, { realmId: getRequestRealmID(event) });
+	}
+	async drop(id, event) {
+		const actor = buildActorContext(event);
+		const entity = await this.service.delete(id, actor, { realmId: getRequestRealmID(event) });
+		event.response.status = 202;
+		return entity;
+	}
+};
+_ts_decorate([
+	DGet("", [ForceLoggedInMiddleware]),
+	_ts_param(0, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], ConsentController.prototype, "getMany", null);
+_ts_decorate([
+	DGet("/:id", [ForceLoggedInMiddleware]),
+	_ts_param(0, DPath("id")),
+	_ts_param(1, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [String, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], ConsentController.prototype, "getOne", null);
+_ts_decorate([
+	DDelete("/:id", [ForceLoggedInMiddleware]),
+	_ts_param(0, DPath("id")),
+	_ts_param(1, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [String, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], ConsentController.prototype, "drop", null);
+ConsentController = _ts_decorate([
+	DTags("consent"),
+	DController(["/consents", "/realms/:realmId/consents"]),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof ConsentControllerContext === "undefined" ? Object : ConsentControllerContext])
+], ConsentController);
+//#endregion
+export { ConsentController };
+
+//# sourceMappingURL=module.mjs.map

package/dist/adapters/http/controllers/entities/consent/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["DContext","DController","DDelete","DGet","DPath","DTags","useRequestQuery","ForceLoggedInMiddleware","buildActorContext","getRequestRealmID","ConsentController","service","ctx","getMany","event","actor","data","meta","realmId","getOne","id","drop","entity","delete","response","status"],"sources":["../../../../../../src/adapters/http/controllers/entities/consent/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DContext,\n    DController,\n    DDelete,\n    DGet,\n    DPath,\n    DTags,\n} from '@routup/decorators';\nimport type { Consent } from '@authup/core-kit';\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { EntityCollectionResponse } from '@authup/core-http-kit';\nimport type { IConsentService } from '../../../../../core/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { buildActorContext, getRequestRealmID } from '../../../request/index.ts';\n\nexport type ConsentControllerContext = {\n    service: IConsentService,\n};\n\n@DTags('consent')\n@DController(['/consents', '/realms/:realmId/consents'])\nexport class ConsentController {\n    protected service: IConsentService;\n\n    constructor(ctx: ConsentControllerContext) {\n        this.service = ctx.service;\n    }\n\n    @DGet('', [ForceLoggedInMiddleware])\n    async getMany(\n        @DContext() event: IAppEvent,\n    ): Promise<EntityCollectionResponse<Consent>> {\n        const actor = buildActorContext(event);\n        const {\n            data,\n            meta,\n        } = await this.service.getMany(useRequestQuery(event), actor, { realmId: getRequestRealmID(event) });\n\n        return {\n            data,\n            meta,\n        };\n    }\n\n    @DGet('/:id', [ForceLoggedInMiddleware])\n    async getOne(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ): Promise<Consent> {\n        const actor = buildActorContext(event);\n\n        return this.service.getOne(id, actor, { realmId: getRequestRealmID(event) });\n    }\n\n    @DDelete('/:id', [ForceLoggedInMiddleware])\n    async drop(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ): Promise<Consent> {\n        const actor = buildActorContext(event);\n\n        const entity = await this.service.delete(id, actor, { realmId: getRequestRealmID(event) });\n\n        event.response.status = 202;\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,IAAaU,oBAAb,MAAaA;CACCC;CAEV,YAAYC,KAA+B;EACvC,KAAKD,UAAUC,IAAID;CACvB;CAEA,MACME,QACF,OAC0C;EAC1C,MAAME,QAAQP,kBAAkBM,KAAAA;EAChC,MAAM,EACFE,MACAC,SACA,MAAM,KAAKN,QAAQE,QAAQP,gBAAgBQ,KAAAA,GAAQC,OAAO,EAAEG,SAAST,kBAAkBK,KAAAA,EAAO,CAAA;EAElG,OAAO;GACHE;GACAC;EACJ;CACJ;CAEA,MACME,OACF,IACA,OACgB;EAChB,MAAMJ,QAAQP,kBAAkBM,KAAAA;EAEhC,OAAO,KAAKH,QAAQQ,OAAOC,IAAIL,OAAO,EAAEG,SAAST,kBAAkBK,KAAAA,EAAO,CAAA;CAC9E;CAEA,MACMO,KACF,IACA,OACgB;EAChB,MAAMN,QAAQP,kBAAkBM,KAAAA;EAEhC,MAAMQ,SAAS,MAAM,KAAKX,QAAQY,OAAOH,IAAIL,OAAO,EAAEG,SAAST,kBAAkBK,KAAAA,EAAO,CAAA;EAExFA,MAAMU,SAASC,SAAS;EACxB,OAAOH;CACX;AACJ;;WAtCef,uBAAAA,CAAAA;;;;;;;eAgBIA,uBAAAA,CAAAA;;;;;;;;kBAUGA,uBAAAA,CAAAA;;;;;;;;;cAlCR,aAAa,2BAAA,CAAA"}

package/dist/adapters/http/controllers/entities/event/index.d.ts

@@ -0,0 +1,2 @@
+export * from './module.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/controllers/entities/event/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/event/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC"}

package/dist/adapters/http/controllers/entities/event/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { EventController } from "./module.mjs";
+export { EventController };

package/dist/adapters/http/controllers/entities/event/module.d.ts

@@ -0,0 +1,14 @@
+import type { Event } from '@authup/core-kit';
+import type { IAppEvent } from 'routup';
+import type { EntityCollectionResponse } from '@authup/core-http-kit';
+import type { IEventService } from '../../../../../core/index.ts';
+export type EventControllerContext = {
+    service: IEventService;
+};
+export declare class EventController {
+    protected service: IEventService;
+    constructor(ctx: EventControllerContext);
+    getMany(event: IAppEvent): Promise<EntityCollectionResponse<Event>>;
+    getOne(id: string, event: IAppEvent): Promise<Event>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/controllers/entities/event/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/event/module.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAIlE,MAAM,MAAM,sBAAsB,GAAG;IACjC,OAAO,EAAE,aAAa,CAAC;CAC1B,CAAC;AAIF,qBAEa,eAAe;IACxB,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC;gBAErB,GAAG,EAAE,sBAAsB;IAKjC,OAAO,CACG,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAkBrC,MAAM,CACK,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,KAAK,CAAC;CAKpB"}

package/dist/adapters/http/controllers/entities/event/module.mjs

@@ -0,0 +1,68 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { buildActorContext } from "../../../request/helpers/actor.mjs";
+import { getRequestRealmID } from "../../../request/helpers/realm-id.mjs";
+import "../../../request/index.mjs";
+import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
+import "../../../middleware/index.mjs";
+import { useRequestQuery } from "@routup/basic/query";
+import { DContext, DController, DGet, DPath, DTags } from "@routup/decorators";
+//#region src/adapters/http/controllers/entities/event/module.ts
+function _ts_decorate(decorators, target, key, desc) {
+	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+	return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(k, v) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+function _ts_param(paramIndex, decorator) {
+	return function(target, key) {
+		decorator(target, key, paramIndex);
+	};
+}
+var EventController = class {
+	service;
+	constructor(ctx) {
+		this.service = ctx.service;
+	}
+	async getMany(event) {
+		const actor = buildActorContext(event);
+		const { data, meta } = await this.service.getMany(useRequestQuery(event), actor, { realmId: getRequestRealmID(event) });
+		return {
+			data,
+			meta
+		};
+	}
+	async getOne(id, event) {
+		const actor = buildActorContext(event);
+		return this.service.getOne(id, actor, { realmId: getRequestRealmID(event) });
+	}
+};
+_ts_decorate([
+	DGet("", [ForceLoggedInMiddleware]),
+	_ts_param(0, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], EventController.prototype, "getMany", null);
+_ts_decorate([
+	DGet("/:id", [ForceLoggedInMiddleware]),
+	_ts_param(0, DPath("id")),
+	_ts_param(1, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [String, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], EventController.prototype, "getOne", null);
+EventController = _ts_decorate([
+	DTags("event"),
+	DController(["/events", "/realms/:realmId/events"]),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof EventControllerContext === "undefined" ? Object : EventControllerContext])
+], EventController);
+//#endregion
+export { EventController };
+
+//# sourceMappingURL=module.mjs.map

package/dist/adapters/http/controllers/entities/event/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["DContext","DController","DGet","DPath","DTags","useRequestQuery","ForceLoggedInMiddleware","buildActorContext","getRequestRealmID","EventController","service","ctx","getMany","event","actor","data","meta","realmId","getOne","id"],"sources":["../../../../../../src/adapters/http/controllers/entities/event/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPath,\n    DTags,\n} from '@routup/decorators';\nimport type { Event } from '@authup/core-kit';\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { EntityCollectionResponse } from '@authup/core-http-kit';\nimport type { IEventService } from '../../../../../core/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { buildActorContext, getRequestRealmID } from '../../../request/index.ts';\n\nexport type EventControllerContext = {\n    service: IEventService,\n};\n\n// Read-only surface — the log is append-only: writes happen internally via\n// IEventService.record(), pruning is the retention sweep's job.\n@DTags('event')\n@DController(['/events', '/realms/:realmId/events'])\nexport class EventController {\n    protected service: IEventService;\n\n    constructor(ctx: EventControllerContext) {\n        this.service = ctx.service;\n    }\n\n    @DGet('', [ForceLoggedInMiddleware])\n    async getMany(\n        @DContext() event: IAppEvent,\n    ): Promise<EntityCollectionResponse<Event>> {\n        const actor = buildActorContext(event);\n        const {\n            data,\n            meta,\n        } = await this.service.getMany(\n            useRequestQuery(event),\n            actor,\n            { realmId: getRequestRealmID(event) },\n        );\n\n        return {\n            data,\n            meta,\n        };\n    }\n\n    @DGet('/:id', [ForceLoggedInMiddleware])\n    async getOne(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ): Promise<Event> {\n        const actor = buildActorContext(event);\n\n        return this.service.getOne(id, actor, { realmId: getRequestRealmID(event) });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,IAAaS,kBAAb,MAAaA;CACCC;CAEV,YAAYC,KAA6B;EACrC,KAAKD,UAAUC,IAAID;CACvB;CAEA,MACME,QACF,OACwC;EACxC,MAAME,QAAQP,kBAAkBM,KAAAA;EAChC,MAAM,EACFE,MACAC,SACA,MAAM,KAAKN,QAAQE,QACnBP,gBAAgBQ,KAAAA,GAChBC,OACA,EAAEG,SAAST,kBAAkBK,KAAAA,EAAO,CAAA;EAGxC,OAAO;GACHE;GACAC;EACJ;CACJ;CAEA,MACME,OACF,IACA,OACc;EACd,MAAMJ,QAAQP,kBAAkBM,KAAAA;EAEhC,OAAO,KAAKH,QAAQQ,OAAOC,IAAIL,OAAO,EAAEG,SAAST,kBAAkBK,KAAAA,EAAO,CAAA;CAC9E;AACJ;;WA7BeP,uBAAAA,CAAAA;;;;;;;eAoBIA,uBAAAA,CAAAA;;;;;;;;;cA5BL,WAAW,yBAAA,CAAA"}

package/dist/adapters/http/controllers/entities/identity-provider/module.d.ts

@@ -1,18 +1,20 @@
 import type { IAppEvent } from 'routup';
 import type { IdentityProvider } from '@authup/core-kit';
 import type { EntityCollectionResponse, IdentityProviderCreatePayload, IdentityProviderSavePayload, IdentityProviderUpdatePayload } from '@authup/core-http-kit';
-import type { IIdentityProviderAccountManager, IIdentityProviderRepository, IOAuth2AuthorizationCodeIssuer, IOAuth2AuthorizationCodeRequestVerifier, IOAuth2AuthorizationStateManager, IRealmRepository } from '../../../../../core/index.ts';
+import type { IIdentityProviderAccountManager, IIdentityProviderRepository, IOAuth2AccessPolicyEvaluator, IOAuth2AuthorizationCodeIssuer, IOAuth2AuthorizationCodeRequestVerifier, IOAuth2AuthorizationStateManager, IOAuth2ClientRepository, IRealmRepository } from '../../../../../core/index.ts';
 import { OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';
 import type { IdentityProviderControllerContext, IdentityProviderControllerOptions } from './types.ts';
 export declare class IdentityProviderController {
     protected options: IdentityProviderControllerOptions;
     protected repository: IIdentityProviderRepository;
     protected realmRepository: IRealmRepository;
+    protected clientRepository: IOAuth2ClientRepository;
     protected accountManager: IIdentityProviderAccountManager;
     protected codeRequestVerifier: IOAuth2AuthorizationCodeRequestVerifier;
     protected codeRequestValidator: OAuth2AuthorizationCodeRequestValidator;
     protected stateManager: IOAuth2AuthorizationStateManager;
     protected codeIssuer: IOAuth2AuthorizationCodeIssuer;
+    protected accessPolicyEvaluator?: IOAuth2AccessPolicyEvaluator;
     constructor(ctx: IdentityProviderControllerContext);
     getProviders(event: IAppEvent): Promise<EntityCollectionResponse<IdentityProvider>>;
     getProvider(id: string, event: IAppEvent): Promise<IdentityProvider>;
@@ -23,6 +25,7 @@ export declare class IdentityProviderController {
     authorizeOut(_id: string, event: IAppEvent): Promise<Response>;
     authorizeIn(_id: string, event: IAppEvent): Promise<Response>;
     private write;
+    private buildHostedAuthorizeURL;
     private resolve;
     private saveAuthorizationState;
     private verifyAuthorizationState;

package/dist/adapters/http/controllers/entities/identity-provider/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/module.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAMxC,OAAO,KAAK,EAAE,gBAAgB,EAAkC,MAAM,kBAAkB,CAAC;AAgBzF,OAAO,KAAK,EACR,wBAAwB,EACxB,6BAA6B,EAC7B,2BAA2B,EAC3B,6BAA6B,EAChC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EACR,+BAA+B,EAC/B,2BAA2B,EAC3B,8BAA8B,EAC9B,uCAAuC,EACvC,gCAAgC,EAChC,gBAAgB,EAEnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACH,uCAAuC,EAE1C,MAAM,8BAA8B,CAAC;AAWtC,OAAO,KAAK,EAAE,iCAAiC,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAEvG,qBAEa,0BAA0B;IACnC,SAAS,CAAC,OAAO,EAAE,iCAAiC,CAAC;IAErD,SAAS,CAAC,UAAU,EAAE,2BAA2B,CAAC;IAElD,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,cAAc,EAAE,+BAA+B,CAAC;IAE1D,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,oBAAoB,EAAG,uCAAuC,CAAC;IAEzE,SAAS,CAAC,YAAY,EAAG,gCAAgC,CAAC;IAE1D,SAAS,CAAC,UAAU,EAAG,8BAA8B,CAAC;gBAI1C,GAAG,EAAE,iCAAiC;IAc5C,YAAY,CACF,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;IA+BhD,WAAW,CACA,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,gBAAgB,CAAC;IA0BtB,YAAY,CACD,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,6BAA6B,EAChC,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,gBAAgB,CAAC;IAKvB,GAAG,CACQ,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,2BAA2B,EAC9B,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,gBAAgB,CAAC;IAKvB,YAAY,CACD,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,gBAAgB,CAAC;IA6BvB,WAAW,CACJ,IAAI,EAAE,6BAA6B,EAChC,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,gBAAgB,CAAC;IAOvB,YAAY,CACD,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS;IAgD1B,WAAW,CACA,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS;YA8ElB,KAAK;YA6FL,OAAO;YAYP,sBAAsB;YAWtB,wBAAwB;CAWzC"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/module.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAMxC,OAAO,KAAK,EAAE,gBAAgB,EAAkC,MAAM,kBAAkB,CAAC;AAiBzF,OAAO,KAAK,EACR,wBAAwB,EACxB,6BAA6B,EAC7B,2BAA2B,EAC3B,6BAA6B,EAChC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EACR,+BAA+B,EAC/B,2BAA2B,EAC3B,4BAA4B,EAC5B,8BAA8B,EAC9B,uCAAuC,EACvC,gCAAgC,EAChC,uBAAuB,EACvB,gBAAgB,EAEnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACH,uCAAuC,EAG1C,MAAM,8BAA8B,CAAC;AAWtC,OAAO,KAAK,EAAE,iCAAiC,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAEvG,qBAEa,0BAA0B;IACnC,SAAS,CAAC,OAAO,EAAE,iCAAiC,CAAC;IAErD,SAAS,CAAC,UAAU,EAAE,2BAA2B,CAAC;IAElD,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;IAEpD,SAAS,CAAC,cAAc,EAAE,+BAA+B,CAAC;IAE1D,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,oBAAoB,EAAG,uCAAuC,CAAC;IAEzE,SAAS,CAAC,YAAY,EAAG,gCAAgC,CAAC;IAE1D,SAAS,CAAC,UAAU,EAAG,8BAA8B,CAAC;IAEtD,SAAS,CAAC,qBAAqB,CAAC,EAAG,4BAA4B,CAAC;gBAIpD,GAAG,EAAE,iCAAiC;IAgB5C,YAAY,CACF,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;IA+BhD,WAAW,CACA,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,gBAAgB,CAAC;IA0BtB,YAAY,CACD,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,6BAA6B,EAChC,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,gBAAgB,CAAC;IAKvB,GAAG,CACQ,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,2BAA2B,EAC9B,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,gBAAgB,CAAC;IAKvB,YAAY,CACD,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,gBAAgB,CAAC;IA6BvB,WAAW,CACJ,IAAI,EAAE,6BAA6B,EAChC,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,gBAAgB,CAAC;IAOvB,YAAY,CACD,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS;IAgD1B,WAAW,CACA,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS;YAyGlB,KAAK;IA6FnB,OAAO,CAAC,uBAAuB;YAmBjB,OAAO;YAYP,sBAAsB;YAWtB,wBAAwB;CAWzC"}

package/dist/adapters/http/controllers/entities/identity-provider/module.mjs

@@ -2,6 +2,7 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { OAuth2AuthorizationCodeRequestValidator } from "../../../../../core/oauth2/authorization/code-request/validator.mjs";
+import { toIdentityPolicyData } from "../../../../../core/identity/permission/identity-policy-data.mjs";
 import { createIdentityProviderOAuth2Authenticator } from "../../../../../core/identity/provider/authentication/factory.mjs";
 import "../../../../../core/index.mjs";
 import { useRequestPermissionEvaluator } from "../../../request/permission/helper.mjs";
@@ -15,10 +16,10 @@ import { resolveURL } from "../../../../../utils/url.mjs";
 import "../../../../../utils/index.mjs";
 import "../../../middleware/index.mjs";
 import { ValidatorGroup, base64URLDecode, isUUID } from "@authup/kit";
-import { IdentityProviderAttributesValidator, IdentityProviderValidator, IdentityType, PermissionName, isOAuth2IdentityProvider, isOpenIDIdentityProvider } from "@authup/core-kit";
+import { IdentityProviderAttributesValidator, IdentityProviderValidator, IdentityType, PermissionName, SessionAuthMethod, isOAuth2IdentityProvider, isOpenIDIdentityProvider } from "@authup/core-kit";
 import { BuiltInPolicyType, definePolicyData } from "@authup/access";
 import { BadRequestError, EntityNotFoundError } from "@authup/errors";
-import { OAuth2RequestError } from "@authup/specs";
+import { OAuth2ErrorCode, OAuth2RequestError } from "@authup/specs";
 import { URL } from "node:url";
 import { getRequestHeader, getRequestIP, sendRedirect } from "routup";
 import { readRequestBody } from "@routup/basic/body";
@@ -43,20 +44,24 @@ var IdentityProviderController = class {
 	options;
 	repository;
 	realmRepository;
+	clientRepository;
 	accountManager;
 	codeRequestVerifier;
 	codeRequestValidator;
 	stateManager;
 	codeIssuer;
+	accessPolicyEvaluator;
 	constructor(ctx) {
 		this.options = ctx.options;
 		this.repository = ctx.repository;
 		this.realmRepository = ctx.realmRepository;
+		this.clientRepository = ctx.clientRepository;
 		this.accountManager = ctx.accountManager;
 		this.codeIssuer = ctx.codeIssuer;
 		this.codeRequestVerifier = ctx.codeRequestVerifier;
 		this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();
 		this.stateManager = ctx.stateManager;
+		this.accessPolicyEvaluator = ctx.accessPolicyEvaluator;
 	}
 	async getProviders(event) {
 		const { data, meta } = await this.repository.findMany(useRequestQuery(event));
@@ -164,6 +169,25 @@ var IdentityProviderController = class {
 			}
 		}).authenticate(code);
 		const realm = await this.realmRepository.resolve(entity.realm_id, true);
+		if (data.codeRequest?.client_id) {
+			const client = await this.clientRepository.findOneByIdOrName(data.codeRequest.client_id, data.codeRequest.realm_id);
+			if (client?.access_policy_id) {
+				let allowed = false;
+				const subject = toIdentityPolicyData({
+					type: IdentityType.USER,
+					data: {
+						...user,
+						realm
+					}
+				});
+				if (this.accessPolicyEvaluator && subject) allowed = await this.accessPolicyEvaluator.evaluate(client.access_policy_id, subject);
+				if (!allowed) {
+					const url = this.buildHostedAuthorizeURL(data.codeRequest);
+					url.searchParams.set("error", OAuth2ErrorCode.ACCESS_DENIED);
+					return sendRedirect(event, url.href);
+				}
+			}
+		}
 		const authorizationCode = await this.codeIssuer.issue({
 			response_type: "code",
 			client_id: data.codeRequest?.client_id,
@@ -175,15 +199,9 @@ var IdentityProviderController = class {
 				...user,
 				realm
 			}
-		});
+		}, { authMethod: SessionAuthMethod.EXTERNAL });
 		if (data.codeRequest) {
-			const codeRequestKeys = Object.keys(data.codeRequest);
-			const url = new URL(resolveURL(this.options.baseURL, "authorize"));
-			for (const codeRequestKey_ of codeRequestKeys) {
-				const codeRequestKey = codeRequestKey_;
-				const codeRequestValue = data.codeRequest[codeRequestKey];
-				if (typeof codeRequestValue !== "undefined" && codeRequestValue !== null) url.searchParams.set(codeRequestKey, String(codeRequestValue));
-			}
+			const url = this.buildHostedAuthorizeURL(data.codeRequest);
 			url.searchParams.set("code", authorizationCode.id);
 			return sendRedirect(event, url.href);
 		}
@@ -249,6 +267,16 @@ var IdentityProviderController = class {
 		event.response.status = 201;
 		return entity;
 	}
+	buildHostedAuthorizeURL(codeRequest) {
+		const url = new URL(resolveURL(this.options.baseURL, "authorize"));
+		const codeRequestKeys = Object.keys(codeRequest);
+		for (const codeRequestKey_ of codeRequestKeys) {
+			const codeRequestKey = codeRequestKey_;
+			const codeRequestValue = codeRequest[codeRequestKey];
+			if (typeof codeRequestValue !== "undefined" && codeRequestValue !== null) url.searchParams.set(codeRequestKey, String(codeRequestValue));
+		}
+		return url;
+	}
 	async resolve(id) {
 		const entity = await this.repository.findOneById(id);
 		if (!entity) throw new EntityNotFoundError();