npm - @authup/server-core - Versions diffs - 1.0.0-beta.52 → 1.0.0-beta.53 - Mend

@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.53

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (742) hide show

package/dist/adapters/http/controllers/entities/identity-provider/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","base64URLDecode","isUUID","DBody","DContext","DController","DDelete","DGet","DPath","DPost","DPut","DTags","getRequestHeader","getRequestIP","sendRedirect","IdentityProviderAttributesValidator","IdentityProviderValidator","IdentityType","PermissionName","isOAuth2IdentityProvider","isOpenIDIdentityProvider","BadRequestError","EntityNotFoundError","resolveURL","useRequestQuery","readRequestBody","OAuth2RequestError","URL","OAuth2AuthorizationCodeRequestValidator","createIdentityProviderOAuth2Authenticator","applyRouteRealmIDToBody","getBodyRealmID","getRequestParamID","getRequestRealmID","useRequestIdentityOrFail","useRequestParamID","useRequestPermissionEvaluator","ForceLoggedInMiddleware","IdentityProviderController","options","repository","realmRepository","accountManager","codeRequestVerifier","codeRequestValidator","stateManager","codeIssuer","ctx","getProviders","event","data","meta","findMany","permissionEvaluator","preEvaluate","name","IDENTITY_PROVIDER_READ","datum","evaluate","ATTRIBUTES","REALM_MATCH","realm_id","getProvider","id","paramId","entity","findOneByIdOrName","editProvider","user","write","updateOnly","put","dropProvider","IDENTITY_PROVIDER_DELETE","findOneBy","entityId","remove","response","status","addProvider","authorizeOut","_id","resolve","authenticator","provider","baseURL","parameters","codeRequest","query","codeRequestDecoded","JSON","parse","malformed","codeRequestValidated","run","verify","client","state","saveAuthorizationState","buildRedirectURL","authorizeIn","Error","protocol","verifyAuthorizationState","code","clientId","client_id","authenticate","realm","authorizationCode","issue","response_type","redirect_uri","scope","type","USER","codeRequestKeys","Object","keys","url","codeRequestKey_","codeRequestKey","codeRequestValue","searchParams","set","String","href","group","body","realmId","where","IDENTITY_PROVIDER_UPDATE","UPDATE","IDENTITY_PROVIDER_CREATE","CREATE","validator","attributesValidator","attributes","validateJoinColumns","identity","checkUniqueness","undefined","merge","saveWithEA","create","findOneById","save","ip","trustProxy","userAgent","stateInvalid"],"sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/module.ts"],"sourcesContent":["/\n Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, base64URLDecode, isUUID } from '@authup/kit';\nimport {\n DBody,\n DContext,\n DController,\n DDelete,\n DGet,\n DPath,\n DPost,\n DPut,\n DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport {\n getRequestHeader,\n getRequestIP,\n sendRedirect,\n} from 'routup';\nimport type { IdentityProvider, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport {\n\n IdentityProviderAttributesValidator,\n IdentityProviderValidator,\n IdentityType,\n PermissionName,\n isOAuth2IdentityProvider,\n isOpenIDIdentityProvider,\n} from '@authup/core-kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport { resolveURL } from '../../../../../utils/index.ts';\nimport type { AuthorizeParameters } from '@hapic/oauth2';\nimport { useRequestQuery } from '@routup/basic/query';\nimport { readRequestBody } from '@routup/basic/body';\nimport { OAuth2RequestError } from '@authup/specs';\nimport type {\n EntityCollectionResponse,\n IdentityProviderCreatePayload,\n IdentityProviderSavePayload,\n IdentityProviderUpdatePayload,\n} from '@authup/core-http-kit';\nimport { URL } from 'node:url';\nimport type {\n IIdentityProviderAccountManager,\n IIdentityProviderRepository,\n IOAuth2AuthorizationCodeIssuer,\n IOAuth2AuthorizationCodeRequestVerifier,\n IOAuth2AuthorizationStateManager,\n IRealmRepository,\n OAuth2AuthorizationState,\n} from '../../../../../core/index.ts';\nimport {\n OAuth2AuthorizationCodeRequestValidator,\n createIdentityProviderOAuth2Authenticator,\n} from '../../../../../core/index.ts';\nimport {\n applyRouteRealmIDToBody,\n getBodyRealmID,\n getRequestParamID,\n getRequestRealmID,\n useRequestIdentityOrFail,\n useRequestParamID,\n useRequestPermissionEvaluator,\n} from '../../../request/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport type { IdentityProviderControllerContext, IdentityProviderControllerOptions } from './types.ts';\n\n@DTags('identity')\n@DController(['/identity-providers', '/realms/:realmId/identity-providers'])\nexport class IdentityProviderController {\n protected options: IdentityProviderControllerOptions;\n\n protected repository: IIdentityProviderRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected accountManager: IIdentityProviderAccountManager;\n\n protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n protected codeRequestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n protected stateManager : IOAuth2AuthorizationStateManager;\n\n protected codeIssuer : IOAuth2AuthorizationCodeIssuer;\n\n // ---------------------------------------------------------\n\n constructor(ctx: IdentityProviderControllerContext) {\n this.options = ctx.options;\n this.repository = ctx.repository;\n this.realmRepository = ctx.realmRepository;\n this.accountManager = ctx.accountManager;\n this.codeIssuer = ctx.codeIssuer;\n this.codeRequestVerifier = ctx.codeRequestVerifier;\n this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();\n this.stateManager = ctx.stateManager;\n }\n\n // ---------------------------------------------------------\n\n @DGet('', [])\n async getProviders(\n @DContext() event: IAppEvent,\n ): Promise<EntityCollectionResponse<IdentityProvider>> {\n const {\n data,\n meta,\n } = await this.repository.findMany(useRequestQuery(event));\n\n try {\n const permissionEvaluator = useRequestPermissionEvaluator(event);\n await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_READ });\n\n for (const datum of data) {\n try {\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_READ,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: datum, [BuiltInPolicyType.REALM_MATCH]: datum.realm_id ?? null }),\n });\n } catch {\n // do nothing\n }\n }\n } catch {\n // do nothing\n }\n\n return {\n data,\n meta,\n };\n }\n\n @DGet('/:id', [])\n async getProvider(\n @DPath('id') id: string,\n @DContext() event: IAppEvent,\n ): Promise<IdentityProvider> {\n const paramId = useRequestParamID(event, { isUUID: false });\n\n const entity = await this.repository.findOneByIdOrName(\n paramId,\n getRequestRealmID(event),\n );\n\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n try {\n const permissionEvaluator = useRequestPermissionEvaluator(event);\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_READ,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, [BuiltInPolicyType.REALM_MATCH]: entity.realm_id ?? null }),\n });\n } catch {\n // do nothing\n }\n\n return entity;\n }\n\n @DPost('/:id', [ForceLoggedInMiddleware])\n async editProvider(\n @DPath('id') id: string,\n @DBody() user: IdentityProviderUpdatePayload,\n @DContext() event: IAppEvent,\n ) : Promise<IdentityProvider> {\n return this.write(event, { updateOnly: true });\n }\n\n @DPut('/:id', [ForceLoggedInMiddleware])\n async put(\n @DPath('id') id: string,\n @DBody() user: IdentityProviderSavePayload,\n @DContext() event: IAppEvent,\n ) : Promise<IdentityProvider> {\n return this.write(event);\n }\n\n @DDelete('/:id', [ForceLoggedInMiddleware])\n async dropProvider(\n @DPath('id') id: string,\n @DContext() event: IAppEvent,\n ) : Promise<IdentityProvider> {\n const paramId = useRequestParamID(event);\n\n const permissionEvaluator = useRequestPermissionEvaluator(event);\n await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_DELETE });\n\n const entity = await this.repository.findOneBy({ id: paramId });\n\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_DELETE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, [BuiltInPolicyType.REALM_MATCH]: entity.realm_id ?? null }),\n });\n\n const { id: entityId } = entity;\n\n await this.repository.remove(entity);\n\n entity.id = entityId;\n\n event.response.status = 202;\n\n return entity;\n }\n\n @DPost('', [ForceLoggedInMiddleware])\n async addProvider(\n @DBody() user: IdentityProviderCreatePayload,\n @DContext() event: IAppEvent,\n ) : Promise<IdentityProvider> {\n return this.write(event);\n }\n\n // ---------------------------------------------------------\n\n @DGet('/:id/authorize-out', [])\n async authorizeOut(\n @DPath('id') _id: string,\n @DContext() event: IAppEvent,\n ) {\n const id = useRequestParamID(event);\n const entity = await this.resolve(id);\n\n if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) {\n throw new BadRequestError('Only an identity-provider based on the oauth protocol supports authorize redirect.');\n }\n\n const authenticator = createIdentityProviderOAuth2Authenticator({\n accountManager: this.accountManager,\n provider: entity,\n options: { baseURL: this.options.baseURL },\n });\n\n const parameters : AuthorizeParameters = {};\n\n let codeRequest: OAuth2AuthorizationCodeRequest \| undefined;\n const query = useRequestQuery(event);\n if (typeof query.codeRequest === 'string') {\n let codeRequestDecoded: OAuth2AuthorizationCodeRequest;\n\n try {\n codeRequestDecoded = JSON.parse(base64URLDecode(query.codeRequest));\n } catch {\n throw OAuth2RequestError.malformed('The code request is malformed and can not be parsed.');\n }\n\n const codeRequestValidated = await this.codeRequestValidator.run(codeRequestDecoded);\n const data = await this.codeRequestVerifier.verify(codeRequestValidated);\n\n if (\n data.client.realm_id &&\n entity.realm_id &&\n entity.realm_id !== data.client.realm_id\n ) {\n throw OAuth2RequestError.malformed('The provider and client realm do not match.');\n }\n\n codeRequest = data.data;\n }\n\n parameters.state = await this.saveAuthorizationState(event, codeRequest);\n\n return sendRedirect(event, authenticator.buildRedirectURL(parameters));\n }\n\n @DGet('/:id/authorize-in', [])\n async authorizeIn(\n @DPath('id') _id: string,\n @DContext() event: IAppEvent,\n ) {\n const id = useRequestParamID(event);\n\n const entity = await this.resolve(id);\n\n if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) {\n throw new Error(`The provider protocol ${entity.protocol} is not valid.`);\n }\n\n const data = await this.verifyAuthorizationState(event);\n if (\n entity.realm_id &&\n data.codeRequest &&\n data.codeRequest.realm_id &&\n data.codeRequest.realm_id !== entity.realm_id\n ) {\n throw OAuth2RequestError.malformed('The provider and client realm do not match.');\n }\n\n const { code } = useRequestQuery(event);\n\n const authenticator = createIdentityProviderOAuth2Authenticator({\n accountManager: this.accountManager,\n provider: entity,\n options: {\n baseURL: this.options.baseURL,\n clientId: data.codeRequest?.client_id,\n },\n });\n\n const user = await authenticator.authenticate(code);\n\n const realm = await this.realmRepository.resolve(entity.realm_id, true);\n\n const authorizationCode = await this.codeIssuer.issue(\n {\n response_type: 'code',\n client_id: data.codeRequest?.client_id,\n redirect_uri: data.codeRequest?.redirect_uri,\n scope: data.codeRequest?.scope,\n },\n {\n type: IdentityType.USER,\n data: {\n ...user,\n realm,\n },\n },\n );\n\n if (data.codeRequest) {\n const codeRequestKeys = Object.keys(data.codeRequest);\n\n const url = new URL(resolveURL(this.options.baseURL, 'authorize'));\n for (const codeRequestKey_ of codeRequestKeys) {\n const codeRequestKey = codeRequestKey_ as keyof OAuth2AuthorizationCodeRequest;\n const codeRequestValue = data.codeRequest[codeRequestKey];\n // Preserve meaningful falsy values (e.g. max_age=0, which OIDC\n // treats as prompt=login) — only skip absent ones.\n if (typeof codeRequestValue !== 'undefined' && codeRequestValue !== null) {\n url.searchParams.set(codeRequestKey, String(codeRequestValue));\n }\n }\n\n url.searchParams.set('code', authorizationCode.id);\n\n return sendRedirect(event, url.href);\n }\n\n const url = new URL(this.options.baseURL);\n url.searchParams.set('code', authorizationCode.id);\n\n return sendRedirect(event, url.href);\n }\n\n // ---------------------------------------------------------\n\n private async write(event: IAppEvent, options: {\n updateOnly?: boolean\n } = {}): Promise<IdentityProvider> {\n let group: string;\n const id = getRequestParamID(event, { isUUID: false });\n const body = await readRequestBody(event);\n applyRouteRealmIDToBody(event, body);\n const realmId = getRequestRealmID(event) ?? getBodyRealmID(body);\n\n let entity: IdentityProvider \| null \| undefined;\n if (id) {\n const where: Record<string, any> = {};\n if (isUUID(id)) {\n where.id = id;\n } else {\n where.name = id;\n }\n\n if (realmId) {\n where.realm_id = realmId;\n }\n\n entity = await this.repository.findOneBy(where);\n if (!entity && options.updateOnly) {\n throw new EntityNotFoundError();\n }\n } else if (options.updateOnly) {\n throw new EntityNotFoundError();\n }\n\n const permissionEvaluator = useRequestPermissionEvaluator(event);\n if (entity) {\n await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_UPDATE });\n\n group = ValidatorGroup.UPDATE;\n } else {\n await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_CREATE });\n\n group = ValidatorGroup.CREATE;\n }\n\n const validator = new IdentityProviderValidator();\n const data = await validator.run(body, { group });\n\n const attributesValidator = new IdentityProviderAttributesValidator();\n const attributes = await attributesValidator.run(body);\n\n await this.repository.validateJoinColumns(data);\n\n if (entity) {\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_UPDATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: {\n ...entity,\n ...data,\n },\n [BuiltInPolicyType.REALM_MATCH]: data.realm_id ?? entity.realm_id ?? null,\n }),\n });\n } else {\n if (!data.realm_id) {\n const identity = useRequestIdentityOrFail(event);\n data.realm_id = identity.realmId;\n }\n\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_CREATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: data, [BuiltInPolicyType.REALM_MATCH]: data.realm_id ?? null }),\n });\n }\n\n await this.repository.checkUniqueness(data, entity \|\| undefined);\n\n if (entity) {\n entity = this.repository.merge(entity, data);\n await this.repository.saveWithEA(entity, attributes);\n\n event.response.status = 202;\n\n return entity;\n }\n\n entity = this.repository.create(data);\n await this.repository.saveWithEA(entity, attributes);\n\n event.response.status = 201;\n\n return entity;\n }\n\n // ---------------------------------------------------------\n\n private async resolve(id: string) {\n const entity = await this.repository.findOneById(id);\n\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n // ---------------------------------------------------------\n\n private async saveAuthorizationState(\n event: IAppEvent,\n codeRequest?: OAuth2AuthorizationCodeRequest,\n ) : Promise<string> {\n return this.stateManager.save({\n codeRequest,\n ip: getRequestIP(event, { trustProxy: true }) ?? '',\n userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n });\n }\n\n private async verifyAuthorizationState(event: IAppEvent): Promise<OAuth2AuthorizationState> {\n const query = useRequestQuery(event);\n if (typeof query.state !== 'string') {\n throw OAuth2RequestError.stateInvalid();\n }\n\n return this.stateManager.verify(query.state, {\n ip: getRequestIP(event, { trustProxy: true }) ?? '',\n userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n });\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4EA,IAAawC,6BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAwC;EAChD,KAAKR,UAAUQ,IAAIR;EACnB,KAAKC,aAAaO,IAAIP;EACtB,KAAKC,kBAAkBM,IAAIN;EAC3B,KAAKC,iBAAiBK,IAAIL;EAC1B,KAAKI,aAAaC,IAAID;EACtB,KAAKH,sBAAsBI,IAAIJ;EAC/B,KAAKC,uBAAuB,IAAIhB,wCAAAA;EAChC,KAAKiB,eAAeE,IAAIF;CAC5B;CAIA,MACMG,aACF,OACmD;EACnD,MAAM,EACFE,MACAC,SACA,MAAM,KAAKX,WAAWY,SAAS5B,gBAAgByB,KAAAA,CAAAA;EAEnD,IAAI;GACA,MAAMI,sBAAsBjB,8BAA8Ba,KAAAA;GAC1D,MAAMI,oBAAoBC,YAAY,EAAEC,MAAMrC,eAAesC,uBAAuB,CAAA;GAEpF,KAAK,MAAMC,SAASP,MAChB,IAAI;IACA,MAAMG,oBAAoBK,SAAS;KAC/BH,MAAMrC,eAAesC;KACrBN,MAAMnD,iBAAiB;OAAGD,kBAAkB6D,aAAaF;OAAQ3D,kBAAkB8D,cAAcH,MAAMI,YAAY;KAAK,CAAA;IAC5H,CAAA;GACJ,QAAQ,CAER;EAER,QAAQ,CAER;EAEA,OAAO;GACHX;GACAC;EACJ;CACJ;CAEA,MACMW,YACF,IACA,OACyB;EACzB,MAAME,UAAU7B,kBAAkBc,OAAO,EAAE/C,QAAQ,MAAM,CAAA;EAEzD,MAAM+D,SAAS,MAAM,KAAKzB,WAAW0B,kBACjCF,SACA/B,kBAAkBgB,KAAAA,CAAAA;EAGtB,IAAI,CAACgB,QACD,MAAM,IAAI3C,oBAAAA;EAGd,IAAI;GAEA,MAD4Bc,8BAA8Ba,KACpDI,CAAAA,CAAoBK,SAAS;IAC/BH,MAAMrC,eAAesC;IACrBN,MAAMnD,iBAAiB;MAAGD,kBAAkB6D,aAAaM;MAASnE,kBAAkB8D,cAAcK,OAAOJ,YAAY;IAAK,CAAA;GAC9H,CAAA;EACJ,QAAQ,CAER;EAEA,OAAOI;CACX;CAEA,MACME,aACF,IACA,MACA,OAC0B;EAC1B,OAAO,KAAKE,MAAMpB,OAAO,EAAEqB,YAAY,KAAK,CAAA;CAChD;CAEA,MACMC,IACF,IACA,MACA,OAC0B;EAC1B,OAAO,KAAKF,MAAMpB,KAAAA;CACtB;CAEA,MACMuB,aACF,IACA,OAC0B;EAC1B,MAAMR,UAAU7B,kBAAkBc,KAAAA;EAElC,MAAMI,sBAAsBjB,8BAA8Ba,KAAAA;EAC1D,MAAMI,oBAAoBC,YAAY,EAAEC,MAAMrC,eAAeuD,yBAAyB,CAAA;EAEtF,MAAMR,SAAS,MAAM,KAAKzB,WAAWkC,UAAU,EAAEX,IAAIC,QAAQ,CAAA;EAE7D,IAAI,CAACC,QACD,MAAM,IAAI3C,oBAAAA;EAGd,MAAM+B,oBAAoBK,SAAS;GAC/BH,MAAMrC,eAAeuD;GACrBvB,MAAMnD,iBAAiB;KAAGD,kBAAkB6D,aAAaM;KAASnE,kBAAkB8D,cAAcK,OAAOJ,YAAY;GAAK,CAAA;EAC9H,CAAA;EAEA,MAAM,EAAEE,IAAIY,aAAaV;EAEzB,MAAM,KAAKzB,WAAWoC,OAAOX,MAAAA;EAE7BA,OAAOF,KAAKY;EAEZ1B,MAAM4B,SAASC,SAAS;EAExB,OAAOb;CACX;CAEA,MACMc,YACF,MACA,OAC0B;EAC1B,OAAO,KAAKV,MAAMpB,KAAAA;CACtB;CAIA,MACM+B,aACF,KACA,OACF;EACE,MAAMjB,KAAK5B,kBAAkBc,KAAAA;EAC7B,MAAMgB,SAAS,MAAM,KAAKiB,QAAQnB,EAAAA;EAElC,IAAI,CAAC5C,yBAAyB8C,MAAAA,KAAW,CAAC7C,yBAAyB6C,MAAAA,GAC/D,MAAM,IAAI5C,gBAAgB,oFAAA;EAG9B,MAAM8D,gBAAgBtD,0CAA0C;GAC5Da,gBAAgB,KAAKA;GACrB0C,UAAUnB;GACV1B,SAAS,EAAE8C,SAAS,KAAK9C,QAAQ8C,QAAQ;EAC7C,CAAA;EAEA,MAAMC,aAAmC,CAAC;EAE1C,IAAIC;EACJ,MAAMC,QAAQhE,gBAAgByB,KAAAA;EAC9B,IAAI,OAAOuC,MAAMD,gBAAgB,UAAU;GACvC,IAAIE;GAEJ,IAAI;IACAA,qBAAqBC,KAAKC,MAAM1F,gBAAgBuF,MAAMD,WAAW,CAAA;GACrE,QAAQ;IACJ,MAAM7D,mBAAmBkE,UAAU,sDAAA;GACvC;GAEA,MAAMC,uBAAuB,MAAM,KAAKjD,qBAAqBkD,IAAIL,kBAAAA;GACjE,MAAMvC,OAAO,MAAM,KAAKP,oBAAoBoD,OAAOF,oBAAAA;GAEnD,IACI3C,KAAK8C,OAAOnC,YACZI,OAAOJ,YACPI,OAAOJ,aAAaX,KAAK8C,OAAOnC,UAEhC,MAAMnC,mBAAmBkE,UAAU,6CAAA;GAGvCL,cAAcrC,KAAKA;EACvB;EAEAoC,WAAWW,QAAQ,MAAM,KAAKC,uBAAuBjD,OAAOsC,WAAAA;EAE5D,OAAOzE,aAAamC,OAAOkC,cAAcgB,iBAAiBb,UAAAA,CAAAA;CAC9D;CAEA,MACMc,YACF,KACA,OACF;EACE,MAAMrC,KAAK5B,kBAAkBc,KAAAA;EAE7B,MAAMgB,SAAS,MAAM,KAAKiB,QAAQnB,EAAAA;EAElC,IAAI,CAAC5C,yBAAyB8C,MAAAA,KAAW,CAAC7C,yBAAyB6C,MAAAA,GAC/D,MAAM,IAAIoC,MAAM,yBAAyBpC,OAAOqC,SAAS,eAAe;EAG5E,MAAMpD,OAAO,MAAM,KAAKqD,yBAAyBtD,KAAAA;EACjD,IACIgB,OAAOJ,YACPX,KAAKqC,eACLrC,KAAKqC,YAAY1B,YACjBX,KAAKqC,YAAY1B,aAAaI,OAAOJ,UAErC,MAAMnC,mBAAmBkE,UAAU,6CAAA;EAGvC,MAAM,EAAEY,SAAShF,gBAAgByB,KAAAA;EAWjC,MAAMmB,OAAO,MATSvC,0CAA0C;GAC5Da,gBAAgB,KAAKA;GACrB0C,UAAUnB;GACV1B,SAAS;IACL8C,SAAS,KAAK9C,QAAQ8C;IACtBoB,UAAUvD,KAAKqC,aAAamB;GAChC;EACJ,CAEmBvB,CAAAA,CAAcwB,aAAaH,IAAAA;EAE9C,MAAMI,QAAQ,MAAM,KAAKnE,gBAAgByC,QAAQjB,OAAOJ,UAAU,IAAA;EAElE,MAAMgD,oBAAoB,MAAM,KAAK/D,WAAWgE,MAC5C;GACIC,eAAe;GACfL,WAAWxD,KAAKqC,aAAamB;GAC7BM,cAAc9D,KAAKqC,aAAayB;GAChCC,OAAO/D,KAAKqC,aAAa0B;EAC7B,GACA;GACIC,MAAMjG,aAAakG;GACnBjE,MAAM;IACF,GAAGkB;IACHwC;GACJ;EACJ,CAAA;EAGJ,IAAI1D,KAAKqC,aAAa;GAClB,MAAM6B,kBAAkBC,OAAOC,KAAKpE,KAAKqC,WAAW;GAEpD,MAAMgC,MAAM,IAAI5F,IAAIJ,WAAW,KAAKgB,QAAQ8C,SAAS,WAAA,CAAA;GACrD,KAAK,MAAMmC,mBAAmBJ,iBAAiB;IAC3C,MAAMK,iBAAiBD;IACvB,MAAME,mBAAmBxE,KAAKqC,YAAYkC;IAG1C,IAAI,OAAOC,qBAAqB,eAAeA,qBAAqB,MAChEH,IAAII,aAAaC,IAAIH,gBAAgBI,OAAOH,gBAAAA,CAAAA;GAEpD;GAEAH,IAAII,aAAaC,IAAI,QAAQf,kBAAkB9C,EAAE;GAEjD,OAAOjD,aAAamC,OAAOsE,IAAIO,IAAI;EACvC;EAEA,MAAMP,MAAM,IAAI5F,IAAI,KAAKY,QAAQ8C,OAAO;EACxCkC,IAAII,aAAaC,IAAI,QAAQf,kBAAkB9C,EAAE;EAEjD,OAAOjD,aAAamC,OAAOsE,IAAIO,IAAI;CACvC;CAIA,MAAczD,MAAMpB,OAAkBV,UAElC,CAAC,GAA8B;EAC/B,IAAIwF;EACJ,MAAMhE,KAAK/B,kBAAkBiB,OAAO,EAAE/C,QAAQ,MAAM,CAAA;EACpD,MAAM8H,OAAO,MAAMvG,gBAAgBwB,KAAAA;EACnCnB,wBAAwBmB,OAAO+E,IAAAA;EAC/B,MAAMC,UAAUhG,kBAAkBgB,KAAAA,KAAUlB,eAAeiG,IAAAA;EAE3D,IAAI/D;EACJ,IAAIF,IAAI;GACJ,MAAMmE,QAA6B,CAAC;GACpC,IAAIhI,OAAO6D,EAAAA,GACPmE,MAAMnE,KAAKA;QAEXmE,MAAM3E,OAAOQ;GAGjB,IAAIkE,SACAC,MAAMrE,WAAWoE;GAGrBhE,SAAS,MAAM,KAAKzB,WAAWkC,UAAUwD,KAAAA;GACzC,IAAI,CAACjE,UAAU1B,QAAQ+B,YACnB,MAAM,IAAIhD,oBAAAA;EAElB,OAAO,IAAIiB,QAAQ+B,YACf,MAAM,IAAIhD,oBAAAA;EAGd,MAAM+B,sBAAsBjB,8BAA8Ba,KAAAA;EAC1D,IAAIgB,QAAQ;GACR,MAAMZ,oBAAoBC,YAAY,EAAEC,MAAMrC,eAAeiH,yBAAyB,CAAA;GAEtFJ,QAAQ/H,eAAeoI;EAC3B,OAAO;GACH,MAAM/E,oBAAoBC,YAAY,EAAEC,MAAMrC,eAAemH,yBAAyB,CAAA;GAEtFN,QAAQ/H,eAAesI;EAC3B;EAGA,MAAMpF,OAAO,MAAMqF,IADGvH,0BACHuH,CAAAA,CAAUzC,IAAIkC,MAAM,EAAED,MAAM,CAAA;EAG/C,MAAMU,aAAa,MAAMD,IADOzH,oCACPyH,CAAAA,CAAoB1C,IAAIkC,IAAAA;EAEjD,MAAM,KAAKxF,WAAWkG,oBAAoBxF,IAAAA;EAE1C,IAAIe,QACA,MAAMZ,oBAAoBK,SAAS;GAC/BH,MAAMrC,eAAeiH;GACrBjF,MAAMnD,iBAAiB;KAClBD,kBAAkB6D,aAAa;KAC5B,GAAGM;KACH,GAAGf;IACP;KACCpD,kBAAkB8D,cAAcV,KAAKW,YAAYI,OAAOJ,YAAY;GACzE,CAAA;EACJ,CAAA;OACG;GACH,IAAI,CAACX,KAAKW,UAENX,KAAKW,WADY3B,yBAAyBe,KAC1B0F,CAAAA,CAASV;GAG7B,MAAM5E,oBAAoBK,SAAS;IAC/BH,MAAMrC,eAAemH;IACrBnF,MAAMnD,iBAAiB;MAAGD,kBAAkB6D,aAAaT;MAAOpD,kBAAkB8D,cAAcV,KAAKW,YAAY;IAAK,CAAA;GAC1H,CAAA;EACJ;EAEA,MAAM,KAAKrB,WAAWoG,gBAAgB1F,MAAMe,UAAU4E,KAAAA,CAAAA;EAEtD,IAAI5E,QAAQ;GACRA,SAAS,KAAKzB,WAAWsG,MAAM7E,QAAQf,IAAAA;GACvC,MAAM,KAAKV,WAAWuG,WAAW9E,QAAQwE,UAAAA;GAEzCxF,MAAM4B,SAASC,SAAS;GAExB,OAAOb;EACX;EAEAA,SAAS,KAAKzB,WAAWwG,OAAO9F,IAAAA;EAChC,MAAM,KAAKV,WAAWuG,WAAW9E,QAAQwE,UAAAA;EAEzCxF,MAAM4B,SAASC,SAAS;EAExB,OAAOb;CACX;CAIA,MAAciB,QAAQnB,IAAY;EAC9B,MAAME,SAAS,MAAM,KAAKzB,WAAWyG,YAAYlF,EAAAA;EAEjD,IAAI,CAACE,QACD,MAAM,IAAI3C,oBAAAA;EAGd,OAAO2C;CACX;CAIA,MAAciC,uBACVjD,OACAsC,aACgB;EAChB,OAAO,KAAK1C,aAAaqG,KAAK;GAC1B3D;GACA4D,IAAItI,aAAaoC,OAAO,EAAEmG,YAAY,KAAK,CAAA,KAAM;GACjDC,WAAWzI,iBAAiBqC,OAAO,YAAA,KAAiB4F,KAAAA;EACxD,CAAA;CACJ;CAEA,MAActC,yBAAyBtD,OAAqD;EACxF,MAAMuC,QAAQhE,gBAAgByB,KAAAA;EAC9B,IAAI,OAAOuC,MAAMS,UAAU,UACvB,MAAMvE,mBAAmB4H,aAAY;EAGzC,OAAO,KAAKzG,aAAakD,OAAOP,MAAMS,OAAO;GACzCkD,IAAItI,aAAaoC,OAAO,EAAEmG,YAAY,KAAK,CAAA,KAAM;GACjDC,WAAWzI,iBAAiBqC,OAAO,YAAA,KAAiB4F,KAAAA;EACxD,CAAA;CACJ;AACJ;;;;;;;;;;;;;;;;;gBA9ToBxG,uBAAAA,CAAAA;;;;;;;;;;;;;eASDA,uBAAAA,CAAAA;;;;;;;;;;;;;kBASGA,uBAAAA,CAAAA;;;;;;;;YAgCNA,uBAAAA,CAAAA;;;;;;;;;;;;;;;;;;;;;;;;;cAjJF,uBAAuB,qCAAA,CAAA"}
1	+ {"version":3,"file":"module.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","base64URLDecode","isUUID","DBody","DContext","DController","DDelete","DGet","DPath","DPost","DPut","DTags","getRequestHeader","getRequestIP","sendRedirect","IdentityProviderAttributesValidator","IdentityProviderValidator","IdentityType","PermissionName","SessionAuthMethod","isOAuth2IdentityProvider","isOpenIDIdentityProvider","BadRequestError","EntityNotFoundError","resolveURL","useRequestQuery","readRequestBody","OAuth2ErrorCode","OAuth2RequestError","URL","OAuth2AuthorizationCodeRequestValidator","createIdentityProviderOAuth2Authenticator","toIdentityPolicyData","applyRouteRealmIDToBody","getBodyRealmID","getRequestParamID","getRequestRealmID","useRequestIdentityOrFail","useRequestParamID","useRequestPermissionEvaluator","ForceLoggedInMiddleware","IdentityProviderController","options","repository","realmRepository","clientRepository","accountManager","codeRequestVerifier","codeRequestValidator","stateManager","codeIssuer","accessPolicyEvaluator","ctx","getProviders","event","data","meta","findMany","permissionEvaluator","preEvaluate","name","IDENTITY_PROVIDER_READ","datum","evaluate","ATTRIBUTES","REALM_MATCH","realm_id","getProvider","id","paramId","entity","findOneByIdOrName","editProvider","user","write","updateOnly","put","dropProvider","IDENTITY_PROVIDER_DELETE","findOneBy","entityId","remove","response","status","addProvider","authorizeOut","_id","resolve","authenticator","provider","baseURL","parameters","codeRequest","query","codeRequestDecoded","JSON","parse","malformed","codeRequestValidated","run","verify","client","state","saveAuthorizationState","buildRedirectURL","authorizeIn","Error","protocol","verifyAuthorizationState","code","clientId","client_id","authenticate","realm","access_policy_id","allowed","subject","type","USER","url","buildHostedAuthorizeURL","searchParams","set","ACCESS_DENIED","href","authorizationCode","issue","response_type","redirect_uri","scope","authMethod","EXTERNAL","group","body","realmId","where","IDENTITY_PROVIDER_UPDATE","UPDATE","IDENTITY_PROVIDER_CREATE","CREATE","validator","attributesValidator","attributes","validateJoinColumns","identity","checkUniqueness","undefined","merge","saveWithEA","create","codeRequestKeys","Object","keys","codeRequestKey_","codeRequestKey","codeRequestValue","String","findOneById","save","ip","trustProxy","userAgent","stateInvalid"],"sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/module.ts"],"sourcesContent":["/\n Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, base64URLDecode, isUUID } from '@authup/kit';\nimport {\n DBody,\n DContext,\n DController,\n DDelete,\n DGet,\n DPath,\n DPost,\n DPut,\n DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport {\n getRequestHeader,\n getRequestIP,\n sendRedirect,\n} from 'routup';\nimport type { IdentityProvider, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport {\n\n IdentityProviderAttributesValidator,\n IdentityProviderValidator,\n IdentityType,\n PermissionName,\n SessionAuthMethod,\n isOAuth2IdentityProvider,\n isOpenIDIdentityProvider,\n} from '@authup/core-kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport { resolveURL } from '../../../../../utils/index.ts';\nimport type { AuthorizeParameters } from '@hapic/oauth2';\nimport { useRequestQuery } from '@routup/basic/query';\nimport { readRequestBody } from '@routup/basic/body';\nimport { OAuth2ErrorCode, OAuth2RequestError } from '@authup/specs';\nimport type {\n EntityCollectionResponse,\n IdentityProviderCreatePayload,\n IdentityProviderSavePayload,\n IdentityProviderUpdatePayload,\n} from '@authup/core-http-kit';\nimport { URL } from 'node:url';\nimport type {\n IIdentityProviderAccountManager,\n IIdentityProviderRepository,\n IOAuth2AccessPolicyEvaluator,\n IOAuth2AuthorizationCodeIssuer,\n IOAuth2AuthorizationCodeRequestVerifier,\n IOAuth2AuthorizationStateManager,\n IOAuth2ClientRepository,\n IRealmRepository,\n OAuth2AuthorizationState,\n} from '../../../../../core/index.ts';\nimport {\n OAuth2AuthorizationCodeRequestValidator,\n createIdentityProviderOAuth2Authenticator,\n toIdentityPolicyData,\n} from '../../../../../core/index.ts';\nimport {\n applyRouteRealmIDToBody,\n getBodyRealmID,\n getRequestParamID,\n getRequestRealmID,\n useRequestIdentityOrFail,\n useRequestParamID,\n useRequestPermissionEvaluator,\n} from '../../../request/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport type { IdentityProviderControllerContext, IdentityProviderControllerOptions } from './types.ts';\n\n@DTags('identity')\n@DController(['/identity-providers', '/realms/:realmId/identity-providers'])\nexport class IdentityProviderController {\n protected options: IdentityProviderControllerOptions;\n\n protected repository: IIdentityProviderRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected clientRepository: IOAuth2ClientRepository;\n\n protected accountManager: IIdentityProviderAccountManager;\n\n protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n protected codeRequestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n protected stateManager : IOAuth2AuthorizationStateManager;\n\n protected codeIssuer : IOAuth2AuthorizationCodeIssuer;\n\n protected accessPolicyEvaluator? : IOAuth2AccessPolicyEvaluator;\n\n // ---------------------------------------------------------\n\n constructor(ctx: IdentityProviderControllerContext) {\n this.options = ctx.options;\n this.repository = ctx.repository;\n this.realmRepository = ctx.realmRepository;\n this.clientRepository = ctx.clientRepository;\n this.accountManager = ctx.accountManager;\n this.codeIssuer = ctx.codeIssuer;\n this.codeRequestVerifier = ctx.codeRequestVerifier;\n this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();\n this.stateManager = ctx.stateManager;\n this.accessPolicyEvaluator = ctx.accessPolicyEvaluator;\n }\n\n // ---------------------------------------------------------\n\n @DGet('', [])\n async getProviders(\n @DContext() event: IAppEvent,\n ): Promise<EntityCollectionResponse<IdentityProvider>> {\n const {\n data,\n meta,\n } = await this.repository.findMany(useRequestQuery(event));\n\n try {\n const permissionEvaluator = useRequestPermissionEvaluator(event);\n await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_READ });\n\n for (const datum of data) {\n try {\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_READ,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: datum, [BuiltInPolicyType.REALM_MATCH]: datum.realm_id ?? null }),\n });\n } catch {\n // do nothing\n }\n }\n } catch {\n // do nothing\n }\n\n return {\n data,\n meta,\n };\n }\n\n @DGet('/:id', [])\n async getProvider(\n @DPath('id') id: string,\n @DContext() event: IAppEvent,\n ): Promise<IdentityProvider> {\n const paramId = useRequestParamID(event, { isUUID: false });\n\n const entity = await this.repository.findOneByIdOrName(\n paramId,\n getRequestRealmID(event),\n );\n\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n try {\n const permissionEvaluator = useRequestPermissionEvaluator(event);\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_READ,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, [BuiltInPolicyType.REALM_MATCH]: entity.realm_id ?? null }),\n });\n } catch {\n // do nothing\n }\n\n return entity;\n }\n\n @DPost('/:id', [ForceLoggedInMiddleware])\n async editProvider(\n @DPath('id') id: string,\n @DBody() user: IdentityProviderUpdatePayload,\n @DContext() event: IAppEvent,\n ) : Promise<IdentityProvider> {\n return this.write(event, { updateOnly: true });\n }\n\n @DPut('/:id', [ForceLoggedInMiddleware])\n async put(\n @DPath('id') id: string,\n @DBody() user: IdentityProviderSavePayload,\n @DContext() event: IAppEvent,\n ) : Promise<IdentityProvider> {\n return this.write(event);\n }\n\n @DDelete('/:id', [ForceLoggedInMiddleware])\n async dropProvider(\n @DPath('id') id: string,\n @DContext() event: IAppEvent,\n ) : Promise<IdentityProvider> {\n const paramId = useRequestParamID(event);\n\n const permissionEvaluator = useRequestPermissionEvaluator(event);\n await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_DELETE });\n\n const entity = await this.repository.findOneBy({ id: paramId });\n\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_DELETE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, [BuiltInPolicyType.REALM_MATCH]: entity.realm_id ?? null }),\n });\n\n const { id: entityId } = entity;\n\n await this.repository.remove(entity);\n\n entity.id = entityId;\n\n event.response.status = 202;\n\n return entity;\n }\n\n @DPost('', [ForceLoggedInMiddleware])\n async addProvider(\n @DBody() user: IdentityProviderCreatePayload,\n @DContext() event: IAppEvent,\n ) : Promise<IdentityProvider> {\n return this.write(event);\n }\n\n // ---------------------------------------------------------\n\n @DGet('/:id/authorize-out', [])\n async authorizeOut(\n @DPath('id') _id: string,\n @DContext() event: IAppEvent,\n ) {\n const id = useRequestParamID(event);\n const entity = await this.resolve(id);\n\n if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) {\n throw new BadRequestError('Only an identity-provider based on the oauth protocol supports authorize redirect.');\n }\n\n const authenticator = createIdentityProviderOAuth2Authenticator({\n accountManager: this.accountManager,\n provider: entity,\n options: { baseURL: this.options.baseURL },\n });\n\n const parameters : AuthorizeParameters = {};\n\n let codeRequest: OAuth2AuthorizationCodeRequest \| undefined;\n const query = useRequestQuery(event);\n if (typeof query.codeRequest === 'string') {\n let codeRequestDecoded: OAuth2AuthorizationCodeRequest;\n\n try {\n codeRequestDecoded = JSON.parse(base64URLDecode(query.codeRequest));\n } catch {\n throw OAuth2RequestError.malformed('The code request is malformed and can not be parsed.');\n }\n\n const codeRequestValidated = await this.codeRequestValidator.run(codeRequestDecoded);\n const data = await this.codeRequestVerifier.verify(codeRequestValidated);\n\n if (\n data.client.realm_id &&\n entity.realm_id &&\n entity.realm_id !== data.client.realm_id\n ) {\n throw OAuth2RequestError.malformed('The provider and client realm do not match.');\n }\n\n codeRequest = data.data;\n }\n\n parameters.state = await this.saveAuthorizationState(event, codeRequest);\n\n return sendRedirect(event, authenticator.buildRedirectURL(parameters));\n }\n\n @DGet('/:id/authorize-in', [])\n async authorizeIn(\n @DPath('id') _id: string,\n @DContext() event: IAppEvent,\n ) {\n const id = useRequestParamID(event);\n\n const entity = await this.resolve(id);\n\n if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) {\n throw new Error(`The provider protocol ${entity.protocol} is not valid.`);\n }\n\n const data = await this.verifyAuthorizationState(event);\n if (\n entity.realm_id &&\n data.codeRequest &&\n data.codeRequest.realm_id &&\n data.codeRequest.realm_id !== entity.realm_id\n ) {\n throw OAuth2RequestError.malformed('The provider and client realm do not match.');\n }\n\n const { code } = useRequestQuery(event);\n\n const authenticator = createIdentityProviderOAuth2Authenticator({\n accountManager: this.accountManager,\n provider: entity,\n options: {\n baseURL: this.options.baseURL,\n clientId: data.codeRequest?.client_id,\n },\n });\n\n const user = await authenticator.authenticate(code);\n\n const realm = await this.realmRepository.resolve(entity.realm_id, true);\n\n // Application access policy (plan 052), federated leg: the callback\n // never redirects to the RP directly — a denial bounces back to the\n // hosted authorize page with error=access_denied, so no\n // redirectUriVerified threading through the state blob is needed.\n // A policy id with no wired evaluator denies (fail closed); a\n // since-deleted client is skipped (the /token backstop still covers it).\n if (data.codeRequest?.client_id) {\n const client = await this.clientRepository.findOneByIdOrName(\n data.codeRequest.client_id,\n data.codeRequest.realm_id,\n );\n\n if (client?.access_policy_id) {\n let allowed = false;\n\n const subject = toIdentityPolicyData({\n type: IdentityType.USER,\n data: {\n ...user,\n realm,\n },\n });\n if (this.accessPolicyEvaluator && subject) {\n allowed = await this.accessPolicyEvaluator.evaluate(\n client.access_policy_id,\n subject,\n );\n }\n\n if (!allowed) {\n const url = this.buildHostedAuthorizeURL(data.codeRequest);\n url.searchParams.set('error', OAuth2ErrorCode.ACCESS_DENIED);\n\n return sendRedirect(event, url.href);\n }\n }\n }\n\n const authorizationCode = await this.codeIssuer.issue(\n {\n response_type: 'code',\n client_id: data.codeRequest?.client_id,\n redirect_uri: data.codeRequest?.redirect_uri,\n scope: data.codeRequest?.scope,\n },\n {\n type: IdentityType.USER,\n data: {\n ...user,\n realm,\n },\n },\n { authMethod: SessionAuthMethod.EXTERNAL },\n );\n\n if (data.codeRequest) {\n const url = this.buildHostedAuthorizeURL(data.codeRequest);\n url.searchParams.set('code', authorizationCode.id);\n\n return sendRedirect(event, url.href);\n }\n\n const url = new URL(this.options.baseURL);\n url.searchParams.set('code', authorizationCode.id);\n\n return sendRedirect(event, url.href);\n }\n\n // ---------------------------------------------------------\n\n private async write(event: IAppEvent, options: {\n updateOnly?: boolean\n } = {}): Promise<IdentityProvider> {\n let group: string;\n const id = getRequestParamID(event, { isUUID: false });\n const body = await readRequestBody(event);\n applyRouteRealmIDToBody(event, body);\n const realmId = getRequestRealmID(event) ?? getBodyRealmID(body);\n\n let entity: IdentityProvider \| null \| undefined;\n if (id) {\n const where: Record<string, any> = {};\n if (isUUID(id)) {\n where.id = id;\n } else {\n where.name = id;\n }\n\n if (realmId) {\n where.realm_id = realmId;\n }\n\n entity = await this.repository.findOneBy(where);\n if (!entity && options.updateOnly) {\n throw new EntityNotFoundError();\n }\n } else if (options.updateOnly) {\n throw new EntityNotFoundError();\n }\n\n const permissionEvaluator = useRequestPermissionEvaluator(event);\n if (entity) {\n await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_UPDATE });\n\n group = ValidatorGroup.UPDATE;\n } else {\n await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_CREATE });\n\n group = ValidatorGroup.CREATE;\n }\n\n const validator = new IdentityProviderValidator();\n const data = await validator.run(body, { group });\n\n const attributesValidator = new IdentityProviderAttributesValidator();\n const attributes = await attributesValidator.run(body);\n\n await this.repository.validateJoinColumns(data);\n\n if (entity) {\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_UPDATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: {\n ...entity,\n ...data,\n },\n [BuiltInPolicyType.REALM_MATCH]: data.realm_id ?? entity.realm_id ?? null,\n }),\n });\n } else {\n if (!data.realm_id) {\n const identity = useRequestIdentityOrFail(event);\n data.realm_id = identity.realmId;\n }\n\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_CREATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: data, [BuiltInPolicyType.REALM_MATCH]: data.realm_id ?? null }),\n });\n }\n\n await this.repository.checkUniqueness(data, entity \|\| undefined);\n\n if (entity) {\n entity = this.repository.merge(entity, data);\n await this.repository.saveWithEA(entity, attributes);\n\n event.response.status = 202;\n\n return entity;\n }\n\n entity = this.repository.create(data);\n await this.repository.saveWithEA(entity, attributes);\n\n event.response.status = 201;\n\n return entity;\n }\n\n // ---------------------------------------------------------\n\n private buildHostedAuthorizeURL(codeRequest: OAuth2AuthorizationCodeRequest): URL {\n const url = new URL(resolveURL(this.options.baseURL, 'authorize'));\n\n const codeRequestKeys = Object.keys(codeRequest);\n for (const codeRequestKey_ of codeRequestKeys) {\n const codeRequestKey = codeRequestKey_ as keyof OAuth2AuthorizationCodeRequest;\n const codeRequestValue = codeRequest[codeRequestKey];\n // Preserve meaningful falsy values (e.g. max_age=0, which OIDC\n // treats as prompt=login) — only skip absent ones.\n if (typeof codeRequestValue !== 'undefined' && codeRequestValue !== null) {\n url.searchParams.set(codeRequestKey, String(codeRequestValue));\n }\n }\n\n return url;\n }\n\n // ---------------------------------------------------------\n\n private async resolve(id: string) {\n const entity = await this.repository.findOneById(id);\n\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n // ---------------------------------------------------------\n\n private async saveAuthorizationState(\n event: IAppEvent,\n codeRequest?: OAuth2AuthorizationCodeRequest,\n ) : Promise<string> {\n return this.stateManager.save({\n codeRequest,\n ip: getRequestIP(event, { trustProxy: true }) ?? '',\n userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n });\n }\n\n private async verifyAuthorizationState(event: IAppEvent): Promise<OAuth2AuthorizationState> {\n const query = useRequestQuery(event);\n if (typeof query.state !== 'string') {\n throw OAuth2RequestError.stateInvalid();\n }\n\n return this.stateManager.verify(query.state, {\n ip: getRequestIP(event, { trustProxy: true }) ?? '',\n userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n });\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgFA,IAAa2C,6BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAwC;EAChD,KAAKV,UAAUU,IAAIV;EACnB,KAAKC,aAAaS,IAAIT;EACtB,KAAKC,kBAAkBQ,IAAIR;EAC3B,KAAKC,mBAAmBO,IAAIP;EAC5B,KAAKC,iBAAiBM,IAAIN;EAC1B,KAAKI,aAAaE,IAAIF;EACtB,KAAKH,sBAAsBK,IAAIL;EAC/B,KAAKC,uBAAuB,IAAIlB,wCAAAA;EAChC,KAAKmB,eAAeG,IAAIH;EACxB,KAAKE,wBAAwBC,IAAID;CACrC;CAIA,MACME,aACF,OACmD;EACnD,MAAM,EACFE,MACAC,SACA,MAAM,KAAKb,WAAWc,SAAShC,gBAAgB6B,KAAAA,CAAAA;EAEnD,IAAI;GACA,MAAMI,sBAAsBnB,8BAA8Be,KAAAA;GAC1D,MAAMI,oBAAoBC,YAAY,EAAEC,MAAM1C,eAAe2C,uBAAuB,CAAA;GAEpF,KAAK,MAAMC,SAASP,MAChB,IAAI;IACA,MAAMG,oBAAoBK,SAAS;KAC/BH,MAAM1C,eAAe2C;KACrBN,MAAMxD,iBAAiB;OAAGD,kBAAkBkE,aAAaF;OAAQhE,kBAAkBmE,cAAcH,MAAMI,YAAY;KAAK,CAAA;IAC5H,CAAA;GACJ,QAAQ,CAER;EAER,QAAQ,CAER;EAEA,OAAO;GACHX;GACAC;EACJ;CACJ;CAEA,MACMW,YACF,IACA,OACyB;EACzB,MAAME,UAAU/B,kBAAkBgB,OAAO,EAAEpD,QAAQ,MAAM,CAAA;EAEzD,MAAMoE,SAAS,MAAM,KAAK3B,WAAW4B,kBACjCF,SACAjC,kBAAkBkB,KAAAA,CAAAA;EAGtB,IAAI,CAACgB,QACD,MAAM,IAAI/C,oBAAAA;EAGd,IAAI;GAEA,MAD4BgB,8BAA8Be,KACpDI,CAAAA,CAAoBK,SAAS;IAC/BH,MAAM1C,eAAe2C;IACrBN,MAAMxD,iBAAiB;MAAGD,kBAAkBkE,aAAaM;MAASxE,kBAAkBmE,cAAcK,OAAOJ,YAAY;IAAK,CAAA;GAC9H,CAAA;EACJ,QAAQ,CAER;EAEA,OAAOI;CACX;CAEA,MACME,aACF,IACA,MACA,OAC0B;EAC1B,OAAO,KAAKE,MAAMpB,OAAO,EAAEqB,YAAY,KAAK,CAAA;CAChD;CAEA,MACMC,IACF,IACA,MACA,OAC0B;EAC1B,OAAO,KAAKF,MAAMpB,KAAAA;CACtB;CAEA,MACMuB,aACF,IACA,OAC0B;EAC1B,MAAMR,UAAU/B,kBAAkBgB,KAAAA;EAElC,MAAMI,sBAAsBnB,8BAA8Be,KAAAA;EAC1D,MAAMI,oBAAoBC,YAAY,EAAEC,MAAM1C,eAAe4D,yBAAyB,CAAA;EAEtF,MAAMR,SAAS,MAAM,KAAK3B,WAAWoC,UAAU,EAAEX,IAAIC,QAAQ,CAAA;EAE7D,IAAI,CAACC,QACD,MAAM,IAAI/C,oBAAAA;EAGd,MAAMmC,oBAAoBK,SAAS;GAC/BH,MAAM1C,eAAe4D;GACrBvB,MAAMxD,iBAAiB;KAAGD,kBAAkBkE,aAAaM;KAASxE,kBAAkBmE,cAAcK,OAAOJ,YAAY;GAAK,CAAA;EAC9H,CAAA;EAEA,MAAM,EAAEE,IAAIY,aAAaV;EAEzB,MAAM,KAAK3B,WAAWsC,OAAOX,MAAAA;EAE7BA,OAAOF,KAAKY;EAEZ1B,MAAM4B,SAASC,SAAS;EAExB,OAAOb;CACX;CAEA,MACMc,YACF,MACA,OAC0B;EAC1B,OAAO,KAAKV,MAAMpB,KAAAA;CACtB;CAIA,MACM+B,aACF,KACA,OACF;EACE,MAAMjB,KAAK9B,kBAAkBgB,KAAAA;EAC7B,MAAMgB,SAAS,MAAM,KAAKiB,QAAQnB,EAAAA;EAElC,IAAI,CAAChD,yBAAyBkD,MAAAA,KAAW,CAACjD,yBAAyBiD,MAAAA,GAC/D,MAAM,IAAIhD,gBAAgB,oFAAA;EAG9B,MAAMkE,gBAAgBzD,0CAA0C;GAC5De,gBAAgB,KAAKA;GACrB2C,UAAUnB;GACV5B,SAAS,EAAEgD,SAAS,KAAKhD,QAAQgD,QAAQ;EAC7C,CAAA;EAEA,MAAMC,aAAmC,CAAC;EAE1C,IAAIC;EACJ,MAAMC,QAAQpE,gBAAgB6B,KAAAA;EAC9B,IAAI,OAAOuC,MAAMD,gBAAgB,UAAU;GACvC,IAAIE;GAEJ,IAAI;IACAA,qBAAqBC,KAAKC,MAAM/F,gBAAgB4F,MAAMD,WAAW,CAAA;GACrE,QAAQ;IACJ,MAAMhE,mBAAmBqE,UAAU,sDAAA;GACvC;GAEA,MAAMC,uBAAuB,MAAM,KAAKlD,qBAAqBmD,IAAIL,kBAAAA;GACjE,MAAMvC,OAAO,MAAM,KAAKR,oBAAoBqD,OAAOF,oBAAAA;GAEnD,IACI3C,KAAK8C,OAAOnC,YACZI,OAAOJ,YACPI,OAAOJ,aAAaX,KAAK8C,OAAOnC,UAEhC,MAAMtC,mBAAmBqE,UAAU,6CAAA;GAGvCL,cAAcrC,KAAKA;EACvB;EAEAoC,WAAWW,QAAQ,MAAM,KAAKC,uBAAuBjD,OAAOsC,WAAAA;EAE5D,OAAO9E,aAAawC,OAAOkC,cAAcgB,iBAAiBb,UAAAA,CAAAA;CAC9D;CAEA,MACMc,YACF,KACA,OACF;EACE,MAAMrC,KAAK9B,kBAAkBgB,KAAAA;EAE7B,MAAMgB,SAAS,MAAM,KAAKiB,QAAQnB,EAAAA;EAElC,IAAI,CAAChD,yBAAyBkD,MAAAA,KAAW,CAACjD,yBAAyBiD,MAAAA,GAC/D,MAAM,IAAIoC,MAAM,yBAAyBpC,OAAOqC,SAAS,eAAe;EAG5E,MAAMpD,OAAO,MAAM,KAAKqD,yBAAyBtD,KAAAA;EACjD,IACIgB,OAAOJ,YACPX,KAAKqC,eACLrC,KAAKqC,YAAY1B,YACjBX,KAAKqC,YAAY1B,aAAaI,OAAOJ,UAErC,MAAMtC,mBAAmBqE,UAAU,6CAAA;EAGvC,MAAM,EAAEY,SAASpF,gBAAgB6B,KAAAA;EAWjC,MAAMmB,OAAO,MATS1C,0CAA0C;GAC5De,gBAAgB,KAAKA;GACrB2C,UAAUnB;GACV5B,SAAS;IACLgD,SAAS,KAAKhD,QAAQgD;IACtBoB,UAAUvD,KAAKqC,aAAamB;GAChC;EACJ,CAEmBvB,CAAAA,CAAcwB,aAAaH,IAAAA;EAE9C,MAAMI,QAAQ,MAAM,KAAKrE,gBAAgB2C,QAAQjB,OAAOJ,UAAU,IAAA;EAQlE,IAAIX,KAAKqC,aAAamB,WAAW;GAC7B,MAAMV,SAAS,MAAM,KAAKxD,iBAAiB0B,kBACvChB,KAAKqC,YAAYmB,WACjBxD,KAAKqC,YAAY1B,QAAQ;GAG7B,IAAImC,QAAQa,kBAAkB;IAC1B,IAAIC,UAAU;IAEd,MAAMC,UAAUpF,qBAAqB;KACjCqF,MAAMpG,aAAaqG;KACnB/D,MAAM;MACF,GAAGkB;MACHwC;KACJ;IACJ,CAAA;IACA,IAAI,KAAK9D,yBAAyBiE,SAC9BD,UAAU,MAAM,KAAKhE,sBAAsBY,SACvCsC,OAAOa,kBACPE,OAAAA;IAIR,IAAI,CAACD,SAAS;KACV,MAAMI,MAAM,KAAKC,wBAAwBjE,KAAKqC,WAAW;KACzD2B,IAAIE,aAAaC,IAAI,SAAS/F,gBAAgBgG,aAAa;KAE3D,OAAO7G,aAAawC,OAAOiE,IAAIK,IAAI;IACvC;GACJ;EACJ;EAEA,MAAMC,oBAAoB,MAAM,KAAK3E,WAAW4E,MAC5C;GACIC,eAAe;GACfhB,WAAWxD,KAAKqC,aAAamB;GAC7BiB,cAAczE,KAAKqC,aAAaoC;GAChCC,OAAO1E,KAAKqC,aAAaqC;EAC7B,GACA;GACIZ,MAAMpG,aAAaqG;GACnB/D,MAAM;IACF,GAAGkB;IACHwC;GACJ;EACJ,GACA,EAAEiB,YAAY/G,kBAAkBgH,SAAS,CAAA;EAG7C,IAAI5E,KAAKqC,aAAa;GAClB,MAAM2B,MAAM,KAAKC,wBAAwBjE,KAAKqC,WAAW;GACzD2B,IAAIE,aAAaC,IAAI,QAAQG,kBAAkBzD,EAAE;GAEjD,OAAOtD,aAAawC,OAAOiE,IAAIK,IAAI;EACvC;EAEA,MAAML,MAAM,IAAI1F,IAAI,KAAKa,QAAQgD,OAAO;EACxC6B,IAAIE,aAAaC,IAAI,QAAQG,kBAAkBzD,EAAE;EAEjD,OAAOtD,aAAawC,OAAOiE,IAAIK,IAAI;CACvC;CAIA,MAAclD,MAAMpB,OAAkBZ,UAElC,CAAC,GAA8B;EAC/B,IAAI0F;EACJ,MAAMhE,KAAKjC,kBAAkBmB,OAAO,EAAEpD,QAAQ,MAAM,CAAA;EACpD,MAAMmI,OAAO,MAAM3G,gBAAgB4B,KAAAA;EACnCrB,wBAAwBqB,OAAO+E,IAAAA;EAC/B,MAAMC,UAAUlG,kBAAkBkB,KAAAA,KAAUpB,eAAemG,IAAAA;EAE3D,IAAI/D;EACJ,IAAIF,IAAI;GACJ,MAAMmE,QAA6B,CAAC;GACpC,IAAIrI,OAAOkE,EAAAA,GACPmE,MAAMnE,KAAKA;QAEXmE,MAAM3E,OAAOQ;GAGjB,IAAIkE,SACAC,MAAMrE,WAAWoE;GAGrBhE,SAAS,MAAM,KAAK3B,WAAWoC,UAAUwD,KAAAA;GACzC,IAAI,CAACjE,UAAU5B,QAAQiC,YACnB,MAAM,IAAIpD,oBAAAA;EAElB,OAAO,IAAImB,QAAQiC,YACf,MAAM,IAAIpD,oBAAAA;EAGd,MAAMmC,sBAAsBnB,8BAA8Be,KAAAA;EAC1D,IAAIgB,QAAQ;GACR,MAAMZ,oBAAoBC,YAAY,EAAEC,MAAM1C,eAAesH,yBAAyB,CAAA;GAEtFJ,QAAQpI,eAAeyI;EAC3B,OAAO;GACH,MAAM/E,oBAAoBC,YAAY,EAAEC,MAAM1C,eAAewH,yBAAyB,CAAA;GAEtFN,QAAQpI,eAAe2I;EAC3B;EAGA,MAAMpF,OAAO,MAAMqF,IADG5H,0BACH4H,CAAAA,CAAUzC,IAAIkC,MAAM,EAAED,MAAM,CAAA;EAG/C,MAAMU,aAAa,MAAMD,IADO9H,oCACP8H,CAAAA,CAAoB1C,IAAIkC,IAAAA;EAEjD,MAAM,KAAK1F,WAAWoG,oBAAoBxF,IAAAA;EAE1C,IAAIe,QACA,MAAMZ,oBAAoBK,SAAS;GAC/BH,MAAM1C,eAAesH;GACrBjF,MAAMxD,iBAAiB;KAClBD,kBAAkBkE,aAAa;KAC5B,GAAGM;KACH,GAAGf;IACP;KACCzD,kBAAkBmE,cAAcV,KAAKW,YAAYI,OAAOJ,YAAY;GACzE,CAAA;EACJ,CAAA;OACG;GACH,IAAI,CAACX,KAAKW,UAENX,KAAKW,WADY7B,yBAAyBiB,KAC1B0F,CAAAA,CAASV;GAG7B,MAAM5E,oBAAoBK,SAAS;IAC/BH,MAAM1C,eAAewH;IACrBnF,MAAMxD,iBAAiB;MAAGD,kBAAkBkE,aAAaT;MAAOzD,kBAAkBmE,cAAcV,KAAKW,YAAY;IAAK,CAAA;GAC1H,CAAA;EACJ;EAEA,MAAM,KAAKvB,WAAWsG,gBAAgB1F,MAAMe,UAAU4E,KAAAA,CAAAA;EAEtD,IAAI5E,QAAQ;GACRA,SAAS,KAAK3B,WAAWwG,MAAM7E,QAAQf,IAAAA;GACvC,MAAM,KAAKZ,WAAWyG,WAAW9E,QAAQwE,UAAAA;GAEzCxF,MAAM4B,SAASC,SAAS;GAExB,OAAOb;EACX;EAEAA,SAAS,KAAK3B,WAAW0G,OAAO9F,IAAAA;EAChC,MAAM,KAAKZ,WAAWyG,WAAW9E,QAAQwE,UAAAA;EAEzCxF,MAAM4B,SAASC,SAAS;EAExB,OAAOb;CACX;CAIQkD,wBAAwB5B,aAAkD;EAC9E,MAAM2B,MAAM,IAAI1F,IAAIL,WAAW,KAAKkB,QAAQgD,SAAS,WAAA,CAAA;EAErD,MAAM4D,kBAAkBC,OAAOC,KAAK5D,WAAAA;EACpC,KAAK,MAAM6D,mBAAmBH,iBAAiB;GAC3C,MAAMI,iBAAiBD;GACvB,MAAME,mBAAmB/D,YAAY8D;GAGrC,IAAI,OAAOC,qBAAqB,eAAeA,qBAAqB,MAChEpC,IAAIE,aAAaC,IAAIgC,gBAAgBE,OAAOD,gBAAAA,CAAAA;EAEpD;EAEA,OAAOpC;CACX;CAIA,MAAchC,QAAQnB,IAAY;EAC9B,MAAME,SAAS,MAAM,KAAK3B,WAAWkH,YAAYzF,EAAAA;EAEjD,IAAI,CAACE,QACD,MAAM,IAAI/C,oBAAAA;EAGd,OAAO+C;CACX;CAIA,MAAciC,uBACVjD,OACAsC,aACgB;EAChB,OAAO,KAAK3C,aAAa6G,KAAK;GAC1BlE;GACAmE,IAAIlJ,aAAayC,OAAO,EAAE0G,YAAY,KAAK,CAAA,KAAM;GACjDC,WAAWrJ,iBAAiB0C,OAAO,YAAA,KAAiB4F,KAAAA;EACxD,CAAA;CACJ;CAEA,MAActC,yBAAyBtD,OAAqD;EACxF,MAAMuC,QAAQpE,gBAAgB6B,KAAAA;EAC9B,IAAI,OAAOuC,MAAMS,UAAU,UACvB,MAAM1E,mBAAmBsI,aAAY;EAGzC,OAAO,KAAKjH,aAAamD,OAAOP,MAAMS,OAAO;GACzCyD,IAAIlJ,aAAayC,OAAO,EAAE0G,YAAY,KAAK,CAAA,KAAM;GACjDC,WAAWrJ,iBAAiB0C,OAAO,YAAA,KAAiB4F,KAAAA;EACxD,CAAA;CACJ;AACJ;;;;;;;;;;;;;;;;;gBA5WoB1G,uBAAAA,CAAAA;;;;;;;;;;;;;eASDA,uBAAAA,CAAAA;;;;;;;;;;;;;kBASGA,uBAAAA,CAAAA;;;;;;;;YAgCNA,uBAAAA,CAAAA;;;;;;;;;;;;;;;;;;;;;;;;;cAvJF,uBAAuB,qCAAA,CAAA"}

package/dist/adapters/http/controllers/entities/identity-provider/types.d.ts CHANGED Viewed

@@ -1,4 +1,4 @@
-import type { IIdentityProviderAccountManager, IIdentityProviderRepository, IOAuth2AuthorizationCodeIssuer, IOAuth2AuthorizationCodeRequestVerifier, IOAuth2AuthorizationStateManager, IRealmRepository } from '../../../../../core/index.ts';
+import type { IIdentityProviderAccountManager, IIdentityProviderRepository, IOAuth2AccessPolicyEvaluator, IOAuth2AuthorizationCodeIssuer, IOAuth2AuthorizationCodeRequestVerifier, IOAuth2AuthorizationStateManager, IOAuth2ClientRepository, IRealmRepository } from '../../../../../core/index.ts';
 export type IdentityProviderControllerOptions = {
     baseURL: string;
 };
@@ -6,9 +6,11 @@ export type IdentityProviderControllerContext = {
     options: IdentityProviderControllerOptions;
     repository: IIdentityProviderRepository;
     realmRepository: IRealmRepository;
+    clientRepository: IOAuth2ClientRepository;
     accountManager: IIdentityProviderAccountManager;
     codeIssuer: IOAuth2AuthorizationCodeIssuer;
     codeRequestVerifier: IOAuth2AuthorizationCodeRequestVerifier;
     stateManager: IOAuth2AuthorizationStateManager;
+    accessPolicyEvaluator?: IOAuth2AccessPolicyEvaluator;
 };
 //# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/controllers/entities/identity-provider/types.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,+BAA+B,EAC/B,2BAA2B,EAC3B,8BAA8B,EAC9B,uCAAuC,EACvC,gCAAgC,EAChC,gBAAgB,EACnB,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,iCAAiC,GAAG;IAC5C,OAAO,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,iCAAiC,GAAG;IAC5C,OAAO,EAAE,iCAAiC,CAAC;IAE3C,UAAU,EAAE,2BAA2B,CAAC;IACxC,eAAe,EAAE,gBAAgB,CAAC;~~IAElC~~,cAAc,EAAE,+BAA+B,CAAC;IAChD,UAAU,EAAE,8BAA8B,CAAC;IAC3C,mBAAmB,EAAE,uCAAuC,CAAC;IAC7D,YAAY,EAAE,gCAAgC,CAAC;~~CAClD~~,CAAC"}
1	+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,+BAA+B,EAC/B,2BAA2B,EAC3B,4BAA4B,EAC5B,8BAA8B,EAC9B,uCAAuC,EACvC,gCAAgC,EAChC,uBAAuB,EACvB,gBAAgB,EACnB,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,iCAAiC,GAAG;IAC5C,OAAO,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,iCAAiC,GAAG;IAC5C,OAAO,EAAE,iCAAiC,CAAC;IAE3C,UAAU,EAAE,2BAA2B,CAAC;IACxC,eAAe,EAAE,gBAAgB,CAAC;IAClC,gBAAgB,EAAE,uBAAuB,CAAC;IAE1C,cAAc,EAAE,+BAA+B,CAAC;IAChD,UAAU,EAAE,8BAA8B,CAAC;IAC3C,mBAAmB,EAAE,uCAAuC,CAAC;IAC7D,YAAY,EAAE,gCAAgC,CAAC;IAE/C,qBAAqB,CAAC,EAAE,4BAA4B,CAAC;CACxD,CAAC"}

package/dist/adapters/http/controllers/entities/index.d.ts CHANGED Viewed

@@ -2,8 +2,11 @@ export * from './client/index.ts';
 export * from './client-permission/index.ts';
 export * from './client-role/index.ts';
 export * from './client-scope/index.ts';
+export * from './consent/index.ts';
+export * from './event/index.ts';
 export * from './identity-provider/index.ts';
 export * from './identity-provide-role/index.ts';
+export * from './key/index.ts';
 export * from './permission/index.ts';
 export * from './permission-policy/index.ts';
 export * from './realm/index.ts';
@@ -16,8 +19,10 @@ export * from './role-permission/index.ts';
 export * from './policy/index.ts';
 export * from './scope/index.ts';
 export * from './session/index.ts';
+export * from './trust-anchor/index.ts';
 export * from './user/index.ts';
 export * from './user-attribute/index.ts';
+export * from './user-authenticator/index.ts';
 export * from './user-permission/index.ts';
 export * from './user-role/index.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/controllers/entities/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/controllers/entities/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,kCAAkC,CAAC;AACjD,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,uBAAuB,CAAC;AACtC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/controllers/entities/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,kCAAkC,CAAC;AACjD,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,uBAAuB,CAAC;AACtC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,yBAAyB,CAAC;AACxC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC"}

package/dist/adapters/http/controllers/entities/index.mjs CHANGED Viewed

@@ -12,10 +12,16 @@ import "./client-role/index.mjs";
 import { ClientScopeController } from "./client-scope/module.mjs";
 import { ClientScopeRequestValidator } from "./client-scope/utils/validator.mjs";
 import "./client-scope/index.mjs";
+import { ConsentController } from "./consent/module.mjs";
+import "./consent/index.mjs";
+import { EventController } from "./event/module.mjs";
+import "./event/index.mjs";
 import { IdentityProviderController } from "./identity-provider/module.mjs";
 import "./identity-provider/index.mjs";
 import { IdentityProviderRoleMappingController } from "./identity-provide-role/module.mjs";
 import "./identity-provide-role/index.mjs";
+import { KeyController } from "./key/module.mjs";
+import "./key/index.mjs";
 import { PermissionController } from "./permission/module.mjs";
 import "./permission/index.mjs";
 import { PermissionPolicyController } from "./permission-policy/module.mjs";
@@ -46,15 +52,19 @@ import { ScopeController } from "./scope/module.mjs";
 import "./scope/index.mjs";
 import { SessionController } from "./session/module.mjs";
 import "./session/index.mjs";
+import { TrustAnchorController } from "./trust-anchor/module.mjs";
+import "./trust-anchor/index.mjs";
 import { UserController } from "./user/module.mjs";
 import "./user/index.mjs";
 import { UserAttributeController } from "./user-attribute/module.mjs";
 import { UserAttributeRequestValidator } from "./user-attribute/utils/validation.mjs";
 import "./user-attribute/index.mjs";
+import { UserAuthenticatorController } from "./user-authenticator/module.mjs";
+import "./user-authenticator/index.mjs";
 import { UserPermissionController } from "./user-permission/module.mjs";
 import { UserPermissionRequestValidator } from "./user-permission/utils/validation.mjs";
 import "./user-permission/index.mjs";
 import { UserRoleController } from "./user-role/module.mjs";
 import { UserRoleRequestValidator } from "./user-role/utils/validation.mjs";
 import "./user-role/index.mjs";
-export { ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, IdentityProviderController, IdentityProviderRoleMappingController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RobotController, RobotPermissionController, RobotPermissionRequestValidator, RobotRoleController, RobotRoleRequestValidator, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, UserAttributeController, UserAttributeRequestValidator, UserController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator };
+export { ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ConsentController, EventController, IdentityProviderController, IdentityProviderRoleMappingController, KeyController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RobotController, RobotPermissionController, RobotPermissionRequestValidator, RobotRoleController, RobotRoleRequestValidator, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, TrustAnchorController, UserAttributeController, UserAttributeRequestValidator, UserAuthenticatorController, UserController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator };

package/dist/adapters/http/controllers/entities/key/index.d.ts ADDED Viewed

	@@ -0,0 +1,2 @@
1	+ export * from './module.ts';
2	+ //# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/controllers/entities/key/index.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/key/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC"}

package/dist/adapters/http/controllers/entities/key/index.mjs ADDED Viewed

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { KeyController } from "./module.mjs";
+export { KeyController };

package/dist/adapters/http/controllers/entities/key/module.d.ts ADDED Viewed

@@ -0,0 +1,17 @@
+import type { IAppEvent } from 'routup';
+import type { EntityCollectionResponse, KeyCreatePayload, KeyUpdatePayload } from '@authup/core-http-kit';
+import type { Key } from '@authup/core-kit';
+import type { IKeyService } from '../../../../../core/index.ts';
+export type KeyControllerContext = {
+    service: IKeyService;
+};
+export declare class KeyController {
+    protected service: IKeyService;
+    constructor(ctx: KeyControllerContext);
+    getMany(event: IAppEvent): Promise<EntityCollectionResponse<Key>>;
+    getOne(id: string, event: IAppEvent): Promise<Key>;
+    add(data: KeyCreatePayload, event: IAppEvent): Promise<Key>;
+    edit(id: string, data: KeyUpdatePayload, event: IAppEvent): Promise<Key>;
+    drop(id: string, event: IAppEvent): Promise<Key>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/controllers/entities/key/module.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/key/module.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EACR,wBAAwB,EACxB,gBAAgB,EAChB,gBAAgB,EACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAQhE,MAAM,MAAM,oBAAoB,GAAG;IAC/B,OAAO,EAAE,WAAW,CAAC;CACxB,CAAC;AAEF,qBAEa,aAAa;IACtB,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC;gBAEnB,GAAG,EAAE,oBAAoB;IAK/B,OAAO,CACG,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAqBnC,MAAM,CACK,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,GAAG,CAAC;IAOT,GAAG,CACI,IAAI,EAAE,gBAAgB,EACnB,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,GAAG,CAAC;IAWT,IAAI,CACO,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,gBAAgB,EACnB,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,GAAG,CAAC;IAOT,IAAI,CACO,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,GAAG,CAAC;CAYlB"}

package/dist/adapters/http/controllers/entities/key/module.mjs ADDED Viewed

@@ -0,0 +1,122 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { buildActorContext } from "../../../request/helpers/actor.mjs";
+import { applyRouteRealmIDToBody, getRequestRealmID } from "../../../request/helpers/realm-id.mjs";
+import "../../../request/index.mjs";
+import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
+import "../../../middleware/index.mjs";
+import { useRequestQuery } from "@routup/basic/query";
+import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DTags } from "@routup/decorators";
+//#region src/adapters/http/controllers/entities/key/module.ts
+function _ts_decorate(decorators, target, key, desc) {
+	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+	return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(k, v) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+function _ts_param(paramIndex, decorator) {
+	return function(target, key) {
+		decorator(target, key, paramIndex);
+	};
+}
+var KeyController = class {
+	service;
+	constructor(ctx) {
+		this.service = ctx.service;
+	}
+	async getMany(event) {
+		const actor = buildActorContext(event);
+		const query = useRequestQuery(event);
+		const realmId = getRequestRealmID(event);
+		if (realmId) query.filter = {
+			...query.filter && typeof query.filter === "object" ? query.filter : {},
+			realm_id: realmId
+		};
+		const { data, meta } = await this.service.getMany(query, actor);
+		return {
+			data,
+			meta
+		};
+	}
+	async getOne(id, event) {
+		const actor = buildActorContext(event);
+		return this.service.getOne(id, actor, getRequestRealmID(event));
+	}
+	async add(data, event) {
+		applyRouteRealmIDToBody(event, data);
+		const actor = buildActorContext(event);
+		const entity = await this.service.create(data, actor);
+		event.response.status = 201;
+		return entity;
+	}
+	async edit(id, data, event) {
+		const actor = buildActorContext(event);
+		return this.service.update(id, data, actor, getRequestRealmID(event));
+	}
+	async drop(id, event) {
+		const actor = buildActorContext(event);
+		const query = useRequestQuery(event);
+		const force = query.force === "true" || query.force === "1";
+		const entity = await this.service.delete(id, actor, { force });
+		event.response.status = 202;
+		return entity;
+	}
+};
+_ts_decorate([
+	DGet("", [ForceLoggedInMiddleware]),
+	_ts_param(0, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], KeyController.prototype, "getMany", null);
+_ts_decorate([
+	DGet("/:id", [ForceLoggedInMiddleware]),
+	_ts_param(0, DPath("id")),
+	_ts_param(1, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [String, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], KeyController.prototype, "getOne", null);
+_ts_decorate([
+	DPost("", [ForceLoggedInMiddleware]),
+	_ts_param(0, DBody()),
+	_ts_param(1, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof KeyCreatePayload === "undefined" ? Object : KeyCreatePayload, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], KeyController.prototype, "add", null);
+_ts_decorate([
+	DPost("/:id", [ForceLoggedInMiddleware]),
+	_ts_param(0, DPath("id")),
+	_ts_param(1, DBody()),
+	_ts_param(2, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [
+		String,
+		typeof KeyUpdatePayload === "undefined" ? Object : KeyUpdatePayload,
+		typeof IAppEvent === "undefined" ? Object : IAppEvent
+	]),
+	_ts_metadata("design:returntype", Promise)
+], KeyController.prototype, "edit", null);
+_ts_decorate([
+	DDelete("/:id", [ForceLoggedInMiddleware]),
+	_ts_param(0, DPath("id")),
+	_ts_param(1, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [String, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], KeyController.prototype, "drop", null);
+KeyController = _ts_decorate([
+	DTags("key"),
+	DController(["/keys", "/realms/:realmId/keys"]),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof KeyControllerContext === "undefined" ? Object : KeyControllerContext])
+], KeyController);
+//#endregion
+export { KeyController };
+//# sourceMappingURL=module.mjs.map

package/dist/adapters/http/controllers/entities/key/module.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"module.mjs","names":["DBody","DContext","DController","DDelete","DGet","DPath","DPost","DTags","useRequestQuery","ForceLoggedInMiddleware","applyRouteRealmIDToBody","buildActorContext","getRequestRealmID","KeyController","service","ctx","getMany","event","actor","query","realmId","filter","realm_id","data","meta","getOne","id","add","entity","create","response","status","edit","update","drop","force","delete"],"sources":["../../../../../../src/adapters/http/controllers/entities/key/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n DBody,\n DContext,\n DController,\n DDelete,\n DGet,\n DPath,\n DPost,\n DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type {\n EntityCollectionResponse,\n KeyCreatePayload,\n KeyUpdatePayload,\n} from '@authup/core-http-kit';\nimport type { Key } from '@authup/core-kit';\nimport type { IKeyService } from '../../../../../core/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport {\n applyRouteRealmIDToBody,\n buildActorContext,\n getRequestRealmID,\n} from '../../../request/index.ts';\n\nexport type KeyControllerContext = {\n service: IKeyService,\n};\n\n@DTags('key')\n@DController(['/keys', '/realms/:realmId/keys'])\nexport class KeyController {\n protected service: IKeyService;\n\n constructor(ctx: KeyControllerContext) {\n this.service = ctx.service;\n }\n\n @DGet('', [ForceLoggedInMiddleware])\n async getMany(\n @DContext() event: IAppEvent,\n ): Promise<EntityCollectionResponse<Key>> {\n const actor = buildActorContext(event);\n\n const query = useRequestQuery(event);\n const realmId = getRequestRealmID(event);\n if (realmId) {\n query.filter = {\n ...(query.filter && typeof query.filter === 'object' ? query.filter : {}),\n realm_id: realmId,\n };\n }\n\n const { data, meta } = await this.service.getMany(query, actor);\n\n return {\n data,\n meta,\n };\n }\n\n @DGet('/:id', [ForceLoggedInMiddleware])\n async getOne(\n @DPath('id') id: string,\n @DContext() event: IAppEvent,\n ): Promise<Key> {\n const actor = buildActorContext(event);\n\n return this.service.getOne(id, actor, getRequestRealmID(event));\n }\n\n @DPost('', [ForceLoggedInMiddleware])\n async add(\n @DBody() data: KeyCreatePayload,\n @DContext() event: IAppEvent,\n ): Promise<Key> {\n applyRouteRealmIDToBody(event, data);\n const actor = buildActorContext(event);\n const entity = await this.service.create(data, actor);\n\n event.response.status = 201;\n\n return entity;\n }\n\n @DPost('/:id', [ForceLoggedInMiddleware])\n async edit(\n @DPath('id') id: string,\n @DBody() data: KeyUpdatePayload,\n @DContext() event: IAppEvent,\n ): Promise<Key> {\n const actor = buildActorContext(event);\n\n return this.service.update(id, data, actor, getRequestRealmID(event));\n }\n\n @DDelete('/:id', [ForceLoggedInMiddleware])\n async drop(\n @DPath('id') id: string,\n @DContext() event: IAppEvent,\n ): Promise<Key> {\n const actor = buildActorContext(event);\n\n const query = useRequestQuery(event);\n const force = query.force === 'true' || query.force === '1';\n\n const entity = await this.service.delete(id, actor, { force });\n\n event.response.status = 202;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAuCA,IAAaa,gBAAb,MAAaA;CACCC;CAEV,YAAYC,KAA2B;EACnC,KAAKD,UAAUC,IAAID;CACvB;CAEA,MACME,QACF,OACsC;EACtC,MAAME,QAAQP,kBAAkBM,KAAAA;EAEhC,MAAME,QAAQX,gBAAgBS,KAAAA;EAC9B,MAAMG,UAAUR,kBAAkBK,KAAAA;EAClC,IAAIG,SACAD,MAAME,SAAS;GACX,GAAIF,MAAME,UAAU,OAAOF,MAAME,WAAW,WAAWF,MAAME,SAAS,CAAC;GACvEC,UAAUF;EACd;EAGJ,MAAM,EAAEG,MAAMC,SAAS,MAAM,KAAKV,QAAQE,QAAQG,OAAOD,KAAAA;EAEzD,OAAO;GACHK;GACAC;EACJ;CACJ;CAEA,MACMC,OACF,IACA,OACY;EACZ,MAAMP,QAAQP,kBAAkBM,KAAAA;EAEhC,OAAO,KAAKH,QAAQW,OAAOC,IAAIR,OAAON,kBAAkBK,KAAAA,CAAAA;CAC5D;CAEA,MACMU,IACF,MACA,OACY;EACZjB,wBAAwBO,OAAOM,IAAAA;EAC/B,MAAML,QAAQP,kBAAkBM,KAAAA;EAChC,MAAMW,SAAS,MAAM,KAAKd,QAAQe,OAAON,MAAML,KAAAA;EAE/CD,MAAMa,SAASC,SAAS;EAExB,OAAOH;CACX;CAEA,MACMI,KACF,IACA,MACA,OACY;EACZ,MAAMd,QAAQP,kBAAkBM,KAAAA;EAEhC,OAAO,KAAKH,QAAQmB,OAAOP,IAAIH,MAAML,OAAON,kBAAkBK,KAAAA,CAAAA;CAClE;CAEA,MACMiB,KACF,IACA,OACY;EACZ,MAAMhB,QAAQP,kBAAkBM,KAAAA;EAEhC,MAAME,QAAQX,gBAAgBS,KAAAA;EAC9B,MAAMkB,QAAQhB,MAAMgB,UAAU,UAAUhB,MAAMgB,UAAU;EAExD,MAAMP,SAAS,MAAM,KAAKd,QAAQsB,OAAOV,IAAIR,OAAO,EAAEiB,MAAM,CAAA;EAE5DlB,MAAMa,SAASC,SAAS;EAExB,OAAOH;CACX;AACJ;;WA1EenB,uBAAAA,CAAAA;;;;;;;eAuBIA,uBAAAA,CAAAA;;;;;;;;YAUHA,uBAAAA,CAAAA;;;;;;;;gBAcIA,uBAAAA,CAAAA;;;;;;;;;;;;;kBAWEA,uBAAAA,CAAAA;;;;;;;;;cAlER,SAAS,uBAAA,CAAA"}

package/dist/adapters/http/controllers/entities/policy/utils/validation.mjs CHANGED Viewed

@@ -6,10 +6,10 @@ import "../../../../request/index.mjs";
 import { PolicyAttributesValidator } from "./attributes-validator.mjs";
 import { isPolicyNameValid } from "@authup/core-kit";
 import { BuiltInPolicyType } from "@authup/access";
+import { isObject } from "smob";
 import { Container } from "validup";
 import { createValidator } from "@validup/zod";
 import { z } from "zod";
-import { isObject } from "smob";
 //#region src/adapters/http/controllers/entities/policy/utils/validation.ts
 var PolicyValidator = class extends Container {
 	initialize() {

package/dist/adapters/http/controllers/entities/realm/module.d.ts CHANGED Viewed

@@ -7,6 +7,8 @@ import type { IRealmService } from '../../../../../core/index.ts';
 import type { KeyEntity } from '../../../../database/domains/index.ts';
 export type RealmControllerOptions = {
     baseURL: string;
+    mtlsBaseURL?: string | null;
+    clientCertificatesEnabled?: boolean;
 };
 export type RealmControllerContext = {
     options: RealmControllerOptions;

package/dist/adapters/http/controllers/entities/realm/module.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/realm/module.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAE9E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,KAAK,EACR,wBAAwB,EACxB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAC;AAMvE,MAAM,MAAM,sBAAsB,GAAG;IACjC,OAAO,EAAE,MAAM,~~CAAA~~;~~CAClB~~,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACjC,OAAO,EAAE,sBAAsB,CAAC;IAChC,OAAO,EAAE,aAAa,CAAC;IACvB,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;CACxC,CAAC;AAEF,qBAEa,eAAe;IACxB,SAAS,CAAC,OAAO,EAAE,sBAAsB,CAAC;IAE1C,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC;IAEjC,SAAS,CAAC,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;gBAEnC,GAAG,EAAE,sBAAsB;IAOjC,OAAO,CACG,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAarC,GAAG,CACI,IAAI,EAAE,kBAAkB,EACrB,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,KAAK,CAAC;IAUZ,GAAG,CAAc,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAK5C,sBAAsB,CACX,EAAE,EAAE,MAAM,GACxB,OAAO,CAAC,sBAAsB,CAAC;~~IA+D5B~~,QAAQ,CAAc,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,gBAAgB,EAAE,CAAA;KAAE,CAAC;IAMxE,OAAO,CACI,EAAE,EAAE,MAAM,EACP,KAAK,EAAE,MAAM,GAC9B,OAAO,CAAC,gBAAgB,CAAC;IAMtB,IAAI,CACO,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,kBAAkB,EACrB,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,KAAK,CAAC;IAcZ,GAAG,CACQ,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,gBAAgB,EACnB,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,KAAK,CAAC;IAgBZ,IAAI,CACO,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,KAAK,CAAC;CAQrB"}
1	+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/realm/module.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAE9E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,KAAK,EACR,wBAAwB,EACxB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAC;AAMvE,MAAM,MAAM,sBAAsB,GAAG;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,yBAAyB,CAAC,EAAE,OAAO,CAAC;CACvC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACjC,OAAO,EAAE,sBAAsB,CAAC;IAChC,OAAO,EAAE,aAAa,CAAC;IACvB,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;CACxC,CAAC;AAEF,qBAEa,eAAe;IACxB,SAAS,CAAC,OAAO,EAAE,sBAAsB,CAAC;IAE1C,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC;IAEjC,SAAS,CAAC,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;gBAEnC,GAAG,EAAE,sBAAsB;IAOjC,OAAO,CACG,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAarC,GAAG,CACI,IAAI,EAAE,kBAAkB,EACrB,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,KAAK,CAAC;IAUZ,GAAG,CAAc,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAK5C,sBAAsB,CACX,EAAE,EAAE,MAAM,GACxB,OAAO,CAAC,sBAAsB,CAAC;IA0F5B,QAAQ,CAAc,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,gBAAgB,EAAE,CAAA;KAAE,CAAC;IAMxE,OAAO,CACI,EAAE,EAAE,MAAM,EACP,KAAK,EAAE,MAAM,GAC9B,OAAO,CAAC,gBAAgB,CAAC;IAMtB,IAAI,CACO,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,kBAAkB,EACrB,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,KAAK,CAAC;IAcZ,GAAG,CACQ,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,gBAAgB,EACnB,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,KAAK,CAAC;IAgBZ,IAAI,CACO,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,KAAK,CAAC;CAQrB"}

package/dist/adapters/http/controllers/entities/realm/module.mjs CHANGED Viewed

@@ -9,7 +9,7 @@ import "../../../../../utils/index.mjs";
 import "../../../middleware/index.mjs";
 import { getJwkRouteHandler, getJwksRouteHandler } from "../../workflows/jwks/handlers/read.mjs";
 import "../../workflows/index.mjs";
-import { OAuth2AuthorizationPrompt, OAuth2AuthorizationResponseType } from "@authup/specs";
+import { OAuth2AuthenticationContextClass, OAuth2AuthorizationPrompt, OAuth2AuthorizationResponseType } from "@authup/specs";
 import { useRequestQuery } from "@routup/basic/query";
 import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DPut, DTags } from "@routup/decorators";
 //#region src/adapters/http/controllers/entities/realm/module.ts
@@ -55,6 +55,7 @@ var RealmController = class {
 	async getOpenIdConfiguration(id) {
 		const entity = await this.service.getOne(id);
 		const { baseURL } = this.options;
+		const { mtlsBaseURL, clientCertificatesEnabled = false } = this.options;
 		return {
 			issuer: resolveURL(baseURL, `realms/${entity.name}`).replace(/\/+$/, ""),
 			authorization_endpoint: resolveURL(baseURL, "authorize"),
@@ -67,6 +68,7 @@ var RealmController = class {
 				OAuth2AuthorizationPrompt.CONSENT,
 				OAuth2AuthorizationPrompt.SELECT_ACCOUNT
 			],
+			acr_values_supported: [OAuth2AuthenticationContextClass.PASSWORD, OAuth2AuthenticationContextClass.MFA],
 			subject_types_supported: ["public"],
 			id_token_signing_alg_values_supported: [
 				"HS256",
@@ -78,6 +80,19 @@ var RealmController = class {
 				"none"
 			],
 			token_endpoint: resolveURL(baseURL, "token"),
+			token_endpoint_auth_methods_supported: [
+				"none",
+				"client_secret_basic",
+				"client_secret_post",
+				...clientCertificatesEnabled ? ["tls_client_auth"] : []
+			],
+			...clientCertificatesEnabled ? { tls_client_certificate_bound_access_tokens: true } : {},
+			...mtlsBaseURL ? { mtls_endpoint_aliases: {
+				token_endpoint: resolveURL(mtlsBaseURL, "token"),
+				introspection_endpoint: resolveURL(mtlsBaseURL, "token/introspect"),
+				revocation_endpoint: resolveURL(mtlsBaseURL, "token/revoke"),
+				userinfo_endpoint: resolveURL(mtlsBaseURL, "users/@me")
+			} } : {},
 			introspection_endpoint: resolveURL(baseURL, "token/introspect"),
 			revocation_endpoint: resolveURL(baseURL, "token/revoke"),
 			service_documentation: "https://authup.org/",

package/dist/adapters/http/controllers/entities/realm/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["DBody","DContext","DController","DDelete","DGet","DPath","DPost","DPut","DTags","OAuth2AuthorizationPrompt","OAuth2AuthorizationResponseType","useRequestQuery","getJwkRouteHandler","getJwksRouteHandler","ForceLoggedInMiddleware","buildActorContext","resolveURL","RealmController","options","service","keyRepository","ctx","getMany","event","data","meta","add","actor","entity","create","response","status","get","id","getOne","getOpenIdConfiguration","baseURL","issuer","name","replace","authorization_endpoint","end_session_endpoint","jwks_uri","response_types_supported","CODE","prompt_values_supported","NONE","LOGIN","CONSENT","SELECT_ACCOUNT","subject_types_supported","id_token_signing_alg_values_supported","token_endpoint","introspection_endpoint","revocation_endpoint","service_documentation","userinfo_endpoint","getCerts","getCert","keyId","edit","update","put","created","save","undefined","drop","delete"],"sources":["../../../../../../src/adapters/http/controllers/entities/realm/module.ts"],"sourcesContent":["/\n Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n DBody,\n DContext,\n DController,\n DDelete,\n DGet,\n DPath,\n DPost,\n DPut,\n DTags,\n} from '@routup/decorators';\nimport type { OAuth2JsonWebKey, OpenIDProviderMetadata } from '@authup/specs';\nimport { OAuth2AuthorizationPrompt, OAuth2AuthorizationResponseType } from '@authup/specs';\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { Repository } from 'typeorm';\nimport type {\n EntityCollectionResponse,\n RealmCreatePayload,\n RealmSavePayload,\n RealmUpdatePayload,\n} from '@authup/core-http-kit';\nimport type { Realm } from '@authup/core-kit';\nimport type { IRealmService } from '../../../../../core/index.ts';\nimport type { KeyEntity } from '../../../../database/domains/index.ts';\nimport { getJwkRouteHandler, getJwksRouteHandler } from '../../workflows/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { buildActorContext } from '../../../request/index.ts';\nimport { resolveURL } from '../../../../../utils/index.ts';\n\nexport type RealmControllerOptions = {\n baseURL: string\n};\n\nexport type RealmControllerContext = {\n options: RealmControllerOptions,\n service: IRealmService,\n keyRepository: Repository<KeyEntity>,\n};\n\n@DTags('realm')\n@DController('/realms')\nexport class RealmController {\n protected options: RealmControllerOptions;\n\n protected service: IRealmService;\n\n protected keyRepository: Repository<KeyEntity>;\n\n constructor(ctx: RealmControllerContext) {\n this.options = ctx.options;\n this.service = ctx.service;\n this.keyRepository = ctx.keyRepository;\n }\n\n @DGet('', [])\n async getMany(\n @DContext() event: IAppEvent,\n ): Promise<EntityCollectionResponse<Realm>> {\n const {\n data,\n meta,\n } = await this.service.getMany(useRequestQuery(event));\n\n return {\n data,\n meta,\n };\n }\n\n @DPost('', [ForceLoggedInMiddleware])\n async add(\n @DBody() data: RealmCreatePayload,\n @DContext() event: IAppEvent,\n ) : Promise<Realm> {\n const actor = buildActorContext(event);\n const entity = await this.service.create(data, actor);\n\n event.response.status = 201;\n\n return entity;\n }\n\n @DGet('/:id', [])\n async get(@DPath('id') id: string): Promise<Realm> {\n return this.service.getOne(id);\n }\n\n @DGet('/:id/.well-known/openid-configuration', [])\n async getOpenIdConfiguration(\n @DPath('id') id: string,\n ): Promise<OpenIDProviderMetadata> {\n const entity = await this.service.getOne(id);\n\n const { baseURL } = this.options;\n\n return {\n issuer: resolveURL(baseURL, `realms/${entity.name}`).replace(/\\/+$/, ''),\n\n authorization_endpoint: resolveURL(baseURL, 'authorize'),\n\n end_session_endpoint: resolveURL(baseURL, 'logout'),\n\n jwks_uri: resolveURL(baseURL, `realms/${entity.name}/jwks`),\n\n // OAuth 2.1 posture: the authorization endpoint issues codes\n // only — implicit/hybrid response types were dropped (plan 042).\n response_types_supported: [\n OAuth2AuthorizationResponseType.CODE,\n ],\n\n // `none` (silent authentication) is handled by the hosted SSR\n // authorize page (the kit `Authorize.vue`): it either completes a\n // built_in client's auto-consent silently or redirects the OIDC\n // error (login_required / consent_required / interaction_required)\n // to a verified redirect_uri — zero UI. The server GET cannot do\n // this server-side (auth is header-only; a top-level navigation\n // carries no bearer), so the SSR page owns it (plan 042 item 10).\n prompt_values_supported: [\n OAuth2AuthorizationPrompt.NONE,\n OAuth2AuthorizationPrompt.LOGIN,\n OAuth2AuthorizationPrompt.CONSENT,\n OAuth2AuthorizationPrompt.SELECT_ACCOUNT,\n ],\n\n subject_types_supported: [\n 'public',\n ],\n\n id_token_signing_alg_values_supported: [\n 'HS256',\n 'HS384',\n 'HS512',\n 'RS256',\n 'RS384',\n 'RS512',\n 'none',\n ],\n\n token_endpoint: resolveURL(baseURL, 'token'),\n\n introspection_endpoint: resolveURL(baseURL, 'token/introspect'),\n\n revocation_endpoint: resolveURL(baseURL, 'token/revoke'),\n\n // -----------------------------------------------------------\n\n service_documentation: 'https://authup.org/',\n\n userinfo_endpoint: resolveURL(baseURL, 'users/@me'),\n };\n }\n\n @DGet('/:id/jwks', [])\n async getCerts(@DPath('id') id: string): Promise<{ keys: OAuth2JsonWebKey[] }> {\n const entity = await this.service.getOne(id);\n return getJwksRouteHandler(this.keyRepository, entity.id);\n }\n\n @DGet('/:id/jwks/:keyId', [])\n async getCert(\n @DPath('id') id: string,\n @DPath('keyId') keyId: string,\n ): Promise<OAuth2JsonWebKey> {\n const entity = await this.service.getOne(id);\n return getJwkRouteHandler(this.keyRepository, keyId, entity.id);\n }\n\n @DPost('/:id', [ForceLoggedInMiddleware])\n async edit(\n @DPath('id') id: string,\n @DBody() data: RealmUpdatePayload,\n @DContext() event: IAppEvent,\n ) : Promise<Realm> {\n const actor = buildActorContext(event);\n const entity = await this.service.update(\n id,\n data,\n actor,\n );\n\n event.response.status = 202;\n\n return entity;\n }\n\n @DPut('/:id', [ForceLoggedInMiddleware])\n async put(\n @DPath('id') id: string,\n @DBody() data: RealmSavePayload,\n @DContext() event: IAppEvent,\n ) : Promise<Realm> {\n const actor = buildActorContext(event);\n const {\n entity,\n created,\n } = await this.service.save(\n id \|\| undefined,\n data,\n actor,\n );\n\n event.response.status = created ? 201 : 202;\n return entity;\n }\n\n @DDelete('/:id', [ForceLoggedInMiddleware])\n async drop(\n @DPath('id') id: string,\n @DContext() event: IAppEvent,\n ) : Promise<Realm> {\n const actor = buildActorContext(event);\n const entity = await this.service.delete(id, actor);\n\n event.response.status = 202;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiDA,IAAaiB,kBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA6B;EACrC,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,UAAUE,IAAIF;EACnB,KAAKC,gBAAgBC,IAAID;CAC7B;CAEA,MACME,QACF,OACwC;EACxC,MAAM,EACFE,MACAC,SACA,MAAM,KAAKN,QAAQG,QAAQX,gBAAgBY,KAAAA,CAAAA;EAE/C,OAAO;GACHC;GACAC;EACJ;CACJ;CAEA,MACMC,IACF,MACA,OACe;EACf,MAAMC,QAAQZ,kBAAkBQ,KAAAA;EAChC,MAAMK,SAAS,MAAM,KAAKT,QAAQU,OAAOL,MAAMG,KAAAA;EAE/CJ,MAAMO,SAASC,SAAS;EAExB,OAAOH;CACX;CAEA,MACMI,IAAI,IAAyC;EAC/C,OAAO,KAAKb,QAAQe,OAAOD,EAAAA;CAC/B;CAEA,MACME,uBACF,IAC+B;EAC/B,MAAMP,SAAS,MAAM,KAAKT,QAAQe,OAAOD,EAAAA;EAEzC,MAAM,EAAEG,YAAY,KAAKlB;EAEzB,OAAO;GACHmB,QAAQrB,WAAWoB,SAAS,UAAUR,OAAOU,MAAM,CAAA,CAAEC,QAAQ,QAAQ,EAAA;GAErEC,wBAAwBxB,WAAWoB,SAAS,WAAA;GAE5CK,sBAAsBzB,WAAWoB,SAAS,QAAA;GAE1CM,UAAU1B,WAAWoB,SAAS,UAAUR,OAAOU,KAAK,MAAM;GAI1DK,0BAA0B,CACtBjC,gCAAgCkC,IAAAA;GAUpCC,yBAAyB;IACrBpC,0BAA0BqC;IAC1BrC,0BAA0BsC;IAC1BtC,0BAA0BuC;IAC1BvC,0BAA0BwC;;GAG9BC,yBAAyB,CACrB,QAAA;GAGJC,uCAAuC;IACnC;IACA;IACA;IACA;IACA;IACA;IACA;;GAGJC,gBAAgBpC,WAAWoB,SAAS,OAAA;GAEpCiB,wBAAwBrC,WAAWoB,SAAS,kBAAA;GAE5CkB,qBAAqBtC,WAAWoB,SAAS,cAAA;GAIzCmB,uBAAuB;GAEvBC,mBAAmBxC,WAAWoB,SAAS,WAAA;EAC3C;CACJ;CAEA,MACMqB,SAAS,IAAgE;EAC3E,MAAM7B,SAAS,MAAM,KAAKT,QAAQe,OAAOD,EAAAA;EACzC,OAAOpB,oBAAoB,KAAKO,eAAeQ,OAAOK,EAAE;CAC5D;CAEA,MACMyB,QACF,IACA,OACyB;EACzB,MAAM9B,SAAS,MAAM,KAAKT,QAAQe,OAAOD,EAAAA;EACzC,OAAOrB,mBAAmB,KAAKQ,eAAeuC,OAAO/B,OAAOK,EAAE;CAClE;CAEA,MACM2B,KACF,IACA,MACA,OACe;EACf,MAAMjC,QAAQZ,kBAAkBQ,KAAAA;EAChC,MAAMK,SAAS,MAAM,KAAKT,QAAQ0C,OAC9B5B,IACAT,MACAG,KAAAA;EAGJJ,MAAMO,SAASC,SAAS;EAExB,OAAOH;CACX;CAEA,MACMkC,IACF,IACA,MACA,OACe;EACf,MAAMnC,QAAQZ,kBAAkBQ,KAAAA;EAChC,MAAM,EACFK,QACAmC,YACA,MAAM,KAAK5C,QAAQ6C,KACnB/B,MAAMgC,KAAAA,GACNzC,MACAG,KAAAA;EAGJJ,MAAMO,SAASC,SAASgC,UAAU,MAAM;EACxC,OAAOnC;CACX;CAEA,MACMsC,KACF,IACA,OACe;EACf,MAAMvC,QAAQZ,kBAAkBQ,KAAAA;EAChC,MAAMK,SAAS,MAAM,KAAKT,QAAQgD,OAAOlC,IAAIN,KAAAA;EAE7CJ,MAAMO,SAASC,SAAS;EAExB,OAAOH;CACX;AACJ;;;;;;;;;YApJgBd,uBAAAA,CAAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBAkGIA,uBAAAA,CAAAA;;;;;;;;;;;;;eAkBDA,uBAAAA,CAAAA;;;;;;;;;;;;;kBAoBGA,uBAAAA,CAAAA"}
1	+ {"version":3,"file":"module.mjs","names":["DBody","DContext","DController","DDelete","DGet","DPath","DPost","DPut","DTags","OAuth2AuthenticationContextClass","OAuth2AuthorizationPrompt","OAuth2AuthorizationResponseType","useRequestQuery","getJwkRouteHandler","getJwksRouteHandler","ForceLoggedInMiddleware","buildActorContext","resolveURL","RealmController","options","service","keyRepository","ctx","getMany","event","data","meta","add","actor","entity","create","response","status","get","id","getOne","getOpenIdConfiguration","baseURL","mtlsBaseURL","clientCertificatesEnabled","issuer","name","replace","authorization_endpoint","end_session_endpoint","jwks_uri","response_types_supported","CODE","prompt_values_supported","NONE","LOGIN","CONSENT","SELECT_ACCOUNT","acr_values_supported","PASSWORD","MFA","subject_types_supported","id_token_signing_alg_values_supported","token_endpoint","token_endpoint_auth_methods_supported","tls_client_certificate_bound_access_tokens","mtls_endpoint_aliases","introspection_endpoint","revocation_endpoint","userinfo_endpoint","service_documentation","getCerts","getCert","keyId","edit","update","put","created","save","undefined","drop","delete"],"sources":["../../../../../../src/adapters/http/controllers/entities/realm/module.ts"],"sourcesContent":["/\n Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n DBody,\n DContext,\n DController,\n DDelete,\n DGet,\n DPath,\n DPost,\n DPut,\n DTags,\n} from '@routup/decorators';\nimport type { OAuth2JsonWebKey, OpenIDProviderMetadata } from '@authup/specs';\nimport { OAuth2AuthenticationContextClass, OAuth2AuthorizationPrompt, OAuth2AuthorizationResponseType } from '@authup/specs';\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { Repository } from 'typeorm';\nimport type {\n EntityCollectionResponse,\n RealmCreatePayload,\n RealmSavePayload,\n RealmUpdatePayload,\n} from '@authup/core-http-kit';\nimport type { Realm } from '@authup/core-kit';\nimport type { IRealmService } from '../../../../../core/index.ts';\nimport type { KeyEntity } from '../../../../database/domains/index.ts';\nimport { getJwkRouteHandler, getJwksRouteHandler } from '../../workflows/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { buildActorContext } from '../../../request/index.ts';\nimport { resolveURL } from '../../../../../utils/index.ts';\n\nexport type RealmControllerOptions = {\n baseURL: string,\n mtlsBaseURL?: string \| null,\n clientCertificatesEnabled?: boolean,\n};\n\nexport type RealmControllerContext = {\n options: RealmControllerOptions,\n service: IRealmService,\n keyRepository: Repository<KeyEntity>,\n};\n\n@DTags('realm')\n@DController('/realms')\nexport class RealmController {\n protected options: RealmControllerOptions;\n\n protected service: IRealmService;\n\n protected keyRepository: Repository<KeyEntity>;\n\n constructor(ctx: RealmControllerContext) {\n this.options = ctx.options;\n this.service = ctx.service;\n this.keyRepository = ctx.keyRepository;\n }\n\n @DGet('', [])\n async getMany(\n @DContext() event: IAppEvent,\n ): Promise<EntityCollectionResponse<Realm>> {\n const {\n data,\n meta,\n } = await this.service.getMany(useRequestQuery(event));\n\n return {\n data,\n meta,\n };\n }\n\n @DPost('', [ForceLoggedInMiddleware])\n async add(\n @DBody() data: RealmCreatePayload,\n @DContext() event: IAppEvent,\n ) : Promise<Realm> {\n const actor = buildActorContext(event);\n const entity = await this.service.create(data, actor);\n\n event.response.status = 201;\n\n return entity;\n }\n\n @DGet('/:id', [])\n async get(@DPath('id') id: string): Promise<Realm> {\n return this.service.getOne(id);\n }\n\n @DGet('/:id/.well-known/openid-configuration', [])\n async getOpenIdConfiguration(\n @DPath('id') id: string,\n ): Promise<OpenIDProviderMetadata> {\n const entity = await this.service.getOne(id);\n\n const { baseURL } = this.options;\n const { mtlsBaseURL, clientCertificatesEnabled = false } = this.options;\n\n return {\n issuer: resolveURL(baseURL, `realms/${entity.name}`).replace(/\\/+$/, ''),\n\n authorization_endpoint: resolveURL(baseURL, 'authorize'),\n\n end_session_endpoint: resolveURL(baseURL, 'logout'),\n\n jwks_uri: resolveURL(baseURL, `realms/${entity.name}/jwks`),\n\n // OAuth 2.1 posture: the authorization endpoint issues codes\n // only — implicit/hybrid response types were dropped (plan 042).\n response_types_supported: [\n OAuth2AuthorizationResponseType.CODE,\n ],\n\n // `none` (silent authentication) is handled by the hosted SSR\n // authorize page (the kit `Authorize.vue`): it either completes a\n // built_in client's auto-consent silently or redirects the OIDC\n // error (login_required / consent_required / interaction_required)\n // to a verified redirect_uri — zero UI. The server GET cannot do\n // this server-side (auth is header-only; a top-level navigation\n // carries no bearer), so the SSR page owns it (plan 042 item 10).\n prompt_values_supported: [\n OAuth2AuthorizationPrompt.NONE,\n OAuth2AuthorizationPrompt.LOGIN,\n OAuth2AuthorizationPrompt.CONSENT,\n OAuth2AuthorizationPrompt.SELECT_ACCOUNT,\n ],\n\n // two coarse levels only (urn-style — OIDC reserves the bare\n // \"0\"); `urn:authup:mfa` in `acr_values` acts as a step-up\n // trigger (plan 050).\n acr_values_supported: [\n OAuth2AuthenticationContextClass.PASSWORD,\n OAuth2AuthenticationContextClass.MFA,\n ],\n\n subject_types_supported: [\n 'public',\n ],\n\n id_token_signing_alg_values_supported: [\n 'HS256',\n 'HS384',\n 'HS512',\n 'RS256',\n 'RS384',\n 'RS512',\n 'none',\n ],\n\n token_endpoint: resolveURL(baseURL, 'token'),\n\n token_endpoint_auth_methods_supported: [\n 'none',\n 'client_secret_basic',\n 'client_secret_post',\n ...(clientCertificatesEnabled ? ['tls_client_auth'] : []),\n ],\n\n ...(clientCertificatesEnabled ? { tls_client_certificate_bound_access_tokens: true } : {}),\n\n ...(mtlsBaseURL ? {\n mtls_endpoint_aliases: {\n token_endpoint: resolveURL(mtlsBaseURL, 'token'),\n introspection_endpoint: resolveURL(mtlsBaseURL, 'token/introspect'),\n revocation_endpoint: resolveURL(mtlsBaseURL, 'token/revoke'),\n userinfo_endpoint: resolveURL(mtlsBaseURL, 'users/@me'),\n },\n } : {}),\n\n introspection_endpoint: resolveURL(baseURL, 'token/introspect'),\n\n revocation_endpoint: resolveURL(baseURL, 'token/revoke'),\n\n // -----------------------------------------------------------\n\n service_documentation: 'https://authup.org/',\n\n userinfo_endpoint: resolveURL(baseURL, 'users/@me'),\n };\n }\n\n @DGet('/:id/jwks', [])\n async getCerts(@DPath('id') id: string): Promise<{ keys: OAuth2JsonWebKey[] }> {\n const entity = await this.service.getOne(id);\n return getJwksRouteHandler(this.keyRepository, entity.id);\n }\n\n @DGet('/:id/jwks/:keyId', [])\n async getCert(\n @DPath('id') id: string,\n @DPath('keyId') keyId: string,\n ): Promise<OAuth2JsonWebKey> {\n const entity = await this.service.getOne(id);\n return getJwkRouteHandler(this.keyRepository, keyId, entity.id);\n }\n\n @DPost('/:id', [ForceLoggedInMiddleware])\n async edit(\n @DPath('id') id: string,\n @DBody() data: RealmUpdatePayload,\n @DContext() event: IAppEvent,\n ) : Promise<Realm> {\n const actor = buildActorContext(event);\n const entity = await this.service.update(\n id,\n data,\n actor,\n );\n\n event.response.status = 202;\n\n return entity;\n }\n\n @DPut('/:id', [ForceLoggedInMiddleware])\n async put(\n @DPath('id') id: string,\n @DBody() data: RealmSavePayload,\n @DContext() event: IAppEvent,\n ) : Promise<Realm> {\n const actor = buildActorContext(event);\n const {\n entity,\n created,\n } = await this.service.save(\n id \|\| undefined,\n data,\n actor,\n );\n\n event.response.status = created ? 201 : 202;\n return entity;\n }\n\n @DDelete('/:id', [ForceLoggedInMiddleware])\n async drop(\n @DPath('id') id: string,\n @DContext() event: IAppEvent,\n ) : Promise<Realm> {\n const actor = buildActorContext(event);\n const entity = await this.service.delete(id, actor);\n\n event.response.status = 202;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,IAAakB,kBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA6B;EACrC,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,UAAUE,IAAIF;EACnB,KAAKC,gBAAgBC,IAAID;CAC7B;CAEA,MACME,QACF,OACwC;EACxC,MAAM,EACFE,MACAC,SACA,MAAM,KAAKN,QAAQG,QAAQX,gBAAgBY,KAAAA,CAAAA;EAE/C,OAAO;GACHC;GACAC;EACJ;CACJ;CAEA,MACMC,IACF,MACA,OACe;EACf,MAAMC,QAAQZ,kBAAkBQ,KAAAA;EAChC,MAAMK,SAAS,MAAM,KAAKT,QAAQU,OAAOL,MAAMG,KAAAA;EAE/CJ,MAAMO,SAASC,SAAS;EAExB,OAAOH;CACX;CAEA,MACMI,IAAI,IAAyC;EAC/C,OAAO,KAAKb,QAAQe,OAAOD,EAAAA;CAC/B;CAEA,MACME,uBACF,IAC+B;EAC/B,MAAMP,SAAS,MAAM,KAAKT,QAAQe,OAAOD,EAAAA;EAEzC,MAAM,EAAEG,YAAY,KAAKlB;EACzB,MAAM,EAAEmB,aAAaC,4BAA4B,UAAU,KAAKpB;EAEhE,OAAO;GACHqB,QAAQvB,WAAWoB,SAAS,UAAUR,OAAOY,MAAM,CAAA,CAAEC,QAAQ,QAAQ,EAAA;GAErEC,wBAAwB1B,WAAWoB,SAAS,WAAA;GAE5CO,sBAAsB3B,WAAWoB,SAAS,QAAA;GAE1CQ,UAAU5B,WAAWoB,SAAS,UAAUR,OAAOY,KAAK,MAAM;GAI1DK,0BAA0B,CACtBnC,gCAAgCoC,IAAAA;GAUpCC,yBAAyB;IACrBtC,0BAA0BuC;IAC1BvC,0BAA0BwC;IAC1BxC,0BAA0ByC;IAC1BzC,0BAA0B0C;;GAM9BC,sBAAsB,CAClB5C,iCAAiC6C,UACjC7C,iCAAiC8C,GAAAA;GAGrCC,yBAAyB,CACrB,QAAA;GAGJC,uCAAuC;IACnC;IACA;IACA;IACA;IACA;IACA;IACA;;GAGJC,gBAAgBzC,WAAWoB,SAAS,OAAA;GAEpCsB,uCAAuC;IACnC;IACA;IACA;OACIpB,4BAA4B,CAAC,iBAAA,IAAqB,CAAA;;GAG1D,GAAIA,4BAA4B,EAAEqB,4CAA4C,KAAK,IAAI,CAAC;GAExF,GAAItB,cAAc,EACduB,uBAAuB;IACnBH,gBAAgBzC,WAAWqB,aAAa,OAAA;IACxCwB,wBAAwB7C,WAAWqB,aAAa,kBAAA;IAChDyB,qBAAqB9C,WAAWqB,aAAa,cAAA;IAC7C0B,mBAAmB/C,WAAWqB,aAAa,WAAA;GAC/C,EACJ,IAAI,CAAC;GAELwB,wBAAwB7C,WAAWoB,SAAS,kBAAA;GAE5C0B,qBAAqB9C,WAAWoB,SAAS,cAAA;GAIzC4B,uBAAuB;GAEvBD,mBAAmB/C,WAAWoB,SAAS,WAAA;EAC3C;CACJ;CAEA,MACM6B,SAAS,IAAgE;EAC3E,MAAMrC,SAAS,MAAM,KAAKT,QAAQe,OAAOD,EAAAA;EACzC,OAAOpB,oBAAoB,KAAKO,eAAeQ,OAAOK,EAAE;CAC5D;CAEA,MACMiC,QACF,IACA,OACyB;EACzB,MAAMtC,SAAS,MAAM,KAAKT,QAAQe,OAAOD,EAAAA;EACzC,OAAOrB,mBAAmB,KAAKQ,eAAe+C,OAAOvC,OAAOK,EAAE;CAClE;CAEA,MACMmC,KACF,IACA,MACA,OACe;EACf,MAAMzC,QAAQZ,kBAAkBQ,KAAAA;EAChC,MAAMK,SAAS,MAAM,KAAKT,QAAQkD,OAC9BpC,IACAT,MACAG,KAAAA;EAGJJ,MAAMO,SAASC,SAAS;EAExB,OAAOH;CACX;CAEA,MACM0C,IACF,IACA,MACA,OACe;EACf,MAAM3C,QAAQZ,kBAAkBQ,KAAAA;EAChC,MAAM,EACFK,QACA2C,YACA,MAAM,KAAKpD,QAAQqD,KACnBvC,MAAMwC,KAAAA,GACNjD,MACAG,KAAAA;EAGJJ,MAAMO,SAASC,SAASwC,UAAU,MAAM;EACxC,OAAO3C;CACX;CAEA,MACM8C,KACF,IACA,OACe;EACf,MAAM/C,QAAQZ,kBAAkBQ,KAAAA;EAChC,MAAMK,SAAS,MAAM,KAAKT,QAAQwD,OAAO1C,IAAIN,KAAAA;EAE7CJ,MAAMO,SAASC,SAAS;EAExB,OAAOH;CACX;AACJ;;;;;;;;;YA/KgBd,uBAAAA,CAAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA6HIA,uBAAAA,CAAAA;;;;;;;;;;;;;eAkBDA,uBAAAA,CAAAA;;;;;;;;;;;;;kBAoBGA,uBAAAA,CAAAA"}

package/dist/adapters/http/controllers/entities/trust-anchor/index.d.ts ADDED Viewed

	@@ -0,0 +1,2 @@
1	+ export * from './module.ts';
2	+ //# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/controllers/entities/trust-anchor/index.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/trust-anchor/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC"}

package/dist/adapters/http/controllers/entities/trust-anchor/index.mjs ADDED Viewed

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { TrustAnchorController } from "./module.mjs";
+export { TrustAnchorController };

package/dist/adapters/http/controllers/entities/trust-anchor/module.d.ts ADDED Viewed

@@ -0,0 +1,17 @@
+import type { EntityCollectionResponse, TrustAnchorCreatePayload, TrustAnchorUpdatePayload } from '@authup/core-http-kit';
+import type { TrustAnchor } from '@authup/core-kit';
+import type { IAppEvent } from 'routup';
+import type { ITrustAnchorService } from '../../../../../core/index.ts';
+export type TrustAnchorControllerContext = {
+    service: ITrustAnchorService;
+};
+export declare class TrustAnchorController {
+    protected service: ITrustAnchorService;
+    constructor(ctx: TrustAnchorControllerContext);
+    getMany(event: IAppEvent): Promise<EntityCollectionResponse<TrustAnchor>>;
+    getOne(id: string, event: IAppEvent): Promise<TrustAnchor>;
+    add(data: TrustAnchorCreatePayload, event: IAppEvent): Promise<TrustAnchor>;
+    edit(id: string, data: TrustAnchorUpdatePayload, event: IAppEvent): Promise<TrustAnchor>;
+    drop(id: string, event: IAppEvent): Promise<TrustAnchor>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/controllers/entities/trust-anchor/module.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/trust-anchor/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,wBAAwB,EACxB,wBAAwB,EACxB,wBAAwB,EAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAYpD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAQxE,MAAM,MAAM,4BAA4B,GAAG;IACvC,OAAO,EAAE,mBAAmB,CAAC;CAChC,CAAC;AAEF,qBAEa,qBAAqB;IAC9B,SAAS,CAAC,OAAO,EAAE,mBAAmB,CAAC;gBAE3B,GAAG,EAAE,4BAA4B;IAKvC,OAAO,CACG,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,WAAW,CAAC,CAAC;IAqB3C,MAAM,CACK,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,WAAW,CAAC;IAOjB,GAAG,CACI,IAAI,EAAE,wBAAwB,EAC3B,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,WAAW,CAAC;IAWjB,IAAI,CACO,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,wBAAwB,EAC3B,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,WAAW,CAAC;IAOjB,IAAI,CACO,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,WAAW,CAAC;CAQ1B"}