@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.53

package/dist/adapters/http/controllers/entities/trust-anchor/module.mjs

@@ -0,0 +1,120 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { buildActorContext } from "../../../request/helpers/actor.mjs";
+import { applyRouteRealmIDToBody, getRequestRealmID } from "../../../request/helpers/realm-id.mjs";
+import "../../../request/index.mjs";
+import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
+import "../../../middleware/index.mjs";
+import { useRequestQuery } from "@routup/basic/query";
+import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DTags } from "@routup/decorators";
+//#region src/adapters/http/controllers/entities/trust-anchor/module.ts
+function _ts_decorate(decorators, target, key, desc) {
+	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+	return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(k, v) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+function _ts_param(paramIndex, decorator) {
+	return function(target, key) {
+		decorator(target, key, paramIndex);
+	};
+}
+var TrustAnchorController = class {
+	service;
+	constructor(ctx) {
+		this.service = ctx.service;
+	}
+	async getMany(event) {
+		const actor = buildActorContext(event);
+		const query = useRequestQuery(event);
+		const realmId = getRequestRealmID(event);
+		if (realmId) query.filter = {
+			...query.filter && typeof query.filter === "object" ? query.filter : {},
+			realm_id: realmId
+		};
+		const { data, meta } = await this.service.getMany(query, actor);
+		return {
+			data,
+			meta
+		};
+	}
+	async getOne(id, event) {
+		const actor = buildActorContext(event);
+		return this.service.getOne(id, actor, getRequestRealmID(event));
+	}
+	async add(data, event) {
+		applyRouteRealmIDToBody(event, data);
+		const actor = buildActorContext(event);
+		const entity = await this.service.create(data, actor);
+		event.response.status = 201;
+		return entity;
+	}
+	async edit(id, data, event) {
+		const actor = buildActorContext(event);
+		return this.service.update(id, data, actor, getRequestRealmID(event));
+	}
+	async drop(id, event) {
+		const actor = buildActorContext(event);
+		const entity = await this.service.delete(id, actor);
+		event.response.status = 202;
+		return entity;
+	}
+};
+_ts_decorate([
+	DGet("", [ForceLoggedInMiddleware]),
+	_ts_param(0, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], TrustAnchorController.prototype, "getMany", null);
+_ts_decorate([
+	DGet("/:id", [ForceLoggedInMiddleware]),
+	_ts_param(0, DPath("id")),
+	_ts_param(1, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [String, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], TrustAnchorController.prototype, "getOne", null);
+_ts_decorate([
+	DPost("", [ForceLoggedInMiddleware]),
+	_ts_param(0, DBody()),
+	_ts_param(1, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof TrustAnchorCreatePayload === "undefined" ? Object : TrustAnchorCreatePayload, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], TrustAnchorController.prototype, "add", null);
+_ts_decorate([
+	DPost("/:id", [ForceLoggedInMiddleware]),
+	_ts_param(0, DPath("id")),
+	_ts_param(1, DBody()),
+	_ts_param(2, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [
+		String,
+		typeof TrustAnchorUpdatePayload === "undefined" ? Object : TrustAnchorUpdatePayload,
+		typeof IAppEvent === "undefined" ? Object : IAppEvent
+	]),
+	_ts_metadata("design:returntype", Promise)
+], TrustAnchorController.prototype, "edit", null);
+_ts_decorate([
+	DDelete("/:id", [ForceLoggedInMiddleware]),
+	_ts_param(0, DPath("id")),
+	_ts_param(1, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [String, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], TrustAnchorController.prototype, "drop", null);
+TrustAnchorController = _ts_decorate([
+	DTags("trust-anchor"),
+	DController(["/trust-anchors", "/realms/:realmId/trust-anchors"]),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof TrustAnchorControllerContext === "undefined" ? Object : TrustAnchorControllerContext])
+], TrustAnchorController);
+//#endregion
+export { TrustAnchorController };
+
+//# sourceMappingURL=module.mjs.map

package/dist/adapters/http/controllers/entities/trust-anchor/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["useRequestQuery","DBody","DContext","DController","DDelete","DGet","DPath","DPost","DTags","ForceLoggedInMiddleware","applyRouteRealmIDToBody","buildActorContext","getRequestRealmID","TrustAnchorController","service","ctx","getMany","event","actor","query","realmId","filter","realm_id","data","meta","getOne","id","add","entity","create","response","status","edit","update","drop","delete"],"sources":["../../../../../../src/adapters/http/controllers/entities/trust-anchor/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    EntityCollectionResponse,\n    TrustAnchorCreatePayload,\n    TrustAnchorUpdatePayload,\n} from '@authup/core-http-kit';\nimport type { TrustAnchor } from '@authup/core-kit';\nimport { useRequestQuery } from '@routup/basic/query';\nimport {\n    DBody,\n    DContext,\n    DController,\n    DDelete,\n    DGet,\n    DPath,\n    DPost,\n    DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport type { ITrustAnchorService } from '../../../../../core/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport {\n    applyRouteRealmIDToBody,\n    buildActorContext,\n    getRequestRealmID,\n} from '../../../request/index.ts';\n\nexport type TrustAnchorControllerContext = {\n    service: ITrustAnchorService,\n};\n\n@DTags('trust-anchor')\n@DController(['/trust-anchors', '/realms/:realmId/trust-anchors'])\nexport class TrustAnchorController {\n    protected service: ITrustAnchorService;\n\n    constructor(ctx: TrustAnchorControllerContext) {\n        this.service = ctx.service;\n    }\n\n    @DGet('', [ForceLoggedInMiddleware])\n    async getMany(\n        @DContext() event: IAppEvent,\n    ): Promise<EntityCollectionResponse<TrustAnchor>> {\n        const actor = buildActorContext(event);\n\n        const query = useRequestQuery(event);\n        const realmId = getRequestRealmID(event);\n        if (realmId) {\n            query.filter = {\n                ...(query.filter && typeof query.filter === 'object' ? query.filter : {}),\n                realm_id: realmId,\n            };\n        }\n\n        const { data, meta } = await this.service.getMany(query, actor);\n\n        return {\n            data,\n            meta,\n        };\n    }\n\n    @DGet('/:id', [ForceLoggedInMiddleware])\n    async getOne(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ): Promise<TrustAnchor> {\n        const actor = buildActorContext(event);\n\n        return this.service.getOne(id, actor, getRequestRealmID(event));\n    }\n\n    @DPost('', [ForceLoggedInMiddleware])\n    async add(\n        @DBody() data: TrustAnchorCreatePayload,\n        @DContext() event: IAppEvent,\n    ): Promise<TrustAnchor> {\n        applyRouteRealmIDToBody(event, data);\n        const actor = buildActorContext(event);\n        const entity = await this.service.create(data, actor);\n\n        event.response.status = 201;\n\n        return entity;\n    }\n\n    @DPost('/:id', [ForceLoggedInMiddleware])\n    async edit(\n        @DPath('id') id: string,\n        @DBody() data: TrustAnchorUpdatePayload,\n        @DContext() event: IAppEvent,\n    ): Promise<TrustAnchor> {\n        const actor = buildActorContext(event);\n\n        return this.service.update(id, data, actor, getRequestRealmID(event));\n    }\n\n    @DDelete('/:id', [ForceLoggedInMiddleware])\n    async drop(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ): Promise<TrustAnchor> {\n        const actor = buildActorContext(event);\n        const entity = await this.service.delete(id, actor);\n\n        event.response.status = 202;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;AAKC,SAAA,aAAA,YAAA,QAAA,KAAA,MAAA;;;;;;;;;;;;;;AAkCD,IAAaa,wBAAb,MAAaA;CACCC;CAEV,YAAYC,KAAmC;EAC3C,KAAKD,UAAUC,IAAID;CACvB;CAEA,MACME,QACF,OAC8C;EAC9C,MAAME,QAAQP,kBAAkBM,KAAAA;EAEhC,MAAME,QAAQnB,gBAAgBiB,KAAAA;EAC9B,MAAMG,UAAUR,kBAAkBK,KAAAA;EAClC,IAAIG,SACAD,MAAME,SAAS;GACX,GAAIF,MAAME,UAAU,OAAOF,MAAME,WAAW,WAAWF,MAAME,SAAS,CAAC;GACvEC,UAAUF;EACd;EAGJ,MAAM,EAAEG,MAAMC,SAAS,MAAM,KAAKV,QAAQE,QAAQG,OAAOD,KAAAA;EAEzD,OAAO;GACHK;GACAC;EACJ;CACJ;CAEA,MACMC,OACF,IACA,OACoB;EACpB,MAAMP,QAAQP,kBAAkBM,KAAAA;EAEhC,OAAO,KAAKH,QAAQW,OAAOC,IAAIR,OAAON,kBAAkBK,KAAAA,CAAAA;CAC5D;CAEA,MACMU,IACF,MACA,OACoB;EACpBjB,wBAAwBO,OAAOM,IAAAA;EAC/B,MAAML,QAAQP,kBAAkBM,KAAAA;EAChC,MAAMW,SAAS,MAAM,KAAKd,QAAQe,OAAON,MAAML,KAAAA;EAE/CD,MAAMa,SAASC,SAAS;EAExB,OAAOH;CACX;CAEA,MACMI,KACF,IACA,MACA,OACoB;EACpB,MAAMd,QAAQP,kBAAkBM,KAAAA;EAEhC,OAAO,KAAKH,QAAQmB,OAAOP,IAAIH,MAAML,OAAON,kBAAkBK,KAAAA,CAAAA;CAClE;CAEA,MACMiB,KACF,IACA,OACoB;EACpB,MAAMhB,QAAQP,kBAAkBM,KAAAA;EAChC,MAAMW,SAAS,MAAM,KAAKd,QAAQqB,OAAOT,IAAIR,KAAAA;EAE7CD,MAAMa,SAASC,SAAS;EAExB,OAAOH;CACX;AACJ;;WAtEenB,uBAAAA,CAAAA;;;;;;;eAuBIA,uBAAAA,CAAAA;;;;;;;;YAUHA,uBAAAA,CAAAA;;;;;;;;gBAcIA,uBAAAA,CAAAA;;;;;;;;;;;;;kBAWEA,uBAAAA,CAAAA;;;;;;;;;cAlER,kBAAkB,gCAAA,CAAA"}

package/dist/adapters/http/controllers/entities/user-authenticator/index.d.ts

@@ -0,0 +1,2 @@
+export * from './module.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/controllers/entities/user-authenticator/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/user-authenticator/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC"}

package/dist/adapters/http/controllers/entities/user-authenticator/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { UserAuthenticatorController } from "./module.mjs";
+export { UserAuthenticatorController };

package/dist/adapters/http/controllers/entities/user-authenticator/module.d.ts

@@ -0,0 +1,21 @@
+import type { UserAuthenticator } from '@authup/core-kit';
+import type { IAppEvent } from 'routup';
+import type { EntityCollectionResponse, UserAuthenticatorConfirmPayload, UserAuthenticatorCreatePayload, UserAuthenticatorEnrollResponse } from '@authup/core-http-kit';
+import type { IUserAuthenticatorService } from '../../../../../core/index.ts';
+export type UserAuthenticatorControllerContext = {
+    service: IUserAuthenticatorService;
+};
+export declare class UserAuthenticatorController {
+    protected service: IUserAuthenticatorService;
+    constructor(ctx: UserAuthenticatorControllerContext);
+    /**
+     * `@me` / `@self` resolve to the calling user identity.
+     */
+    protected resolveUserId(id: string, event: IAppEvent): string;
+    getMany(id: string, event: IAppEvent): Promise<EntityCollectionResponse<UserAuthenticator>>;
+    enroll(id: string, data: UserAuthenticatorCreatePayload, event: IAppEvent): Promise<UserAuthenticatorEnrollResponse>;
+    getOne(id: string, deviceId: string, event: IAppEvent): Promise<UserAuthenticator>;
+    confirm(id: string, deviceId: string, data: UserAuthenticatorConfirmPayload, event: IAppEvent): Promise<UserAuthenticator>;
+    drop(id: string, deviceId: string, event: IAppEvent): Promise<UserAuthenticator>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/controllers/entities/user-authenticator/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/user-authenticator/module.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EACR,wBAAwB,EACxB,+BAA+B,EAC/B,8BAA8B,EAC9B,+BAA+B,EAClC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAI9E,MAAM,MAAM,kCAAkC,GAAG;IAC7C,OAAO,EAAE,yBAAyB,CAAC;CACtC,CAAC;AAEF,qBAEa,2BAA2B;IACpC,SAAS,CAAC,OAAO,EAAE,yBAAyB,CAAC;gBAEjC,GAAG,EAAE,kCAAkC;IAInD;;OAEG;IACH,SAAS,CAAC,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,MAAM;IAiBvD,OAAO,CACI,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,CAAC;IAajD,MAAM,CACK,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,8BAA8B,EACjC,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,+BAA+B,CAAC;IAYrC,MAAM,CACK,EAAE,EAAE,MAAM,EACJ,QAAQ,EAAE,MAAM,EACvB,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,iBAAiB,CAAC;IAQvB,OAAO,CACI,EAAE,EAAE,MAAM,EACJ,QAAQ,EAAE,MAAM,EAC1B,IAAI,EAAE,+BAA+B,EAClC,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,iBAAiB,CAAC;IAYvB,IAAI,CACO,EAAE,EAAE,MAAM,EACJ,QAAQ,EAAE,MAAM,EACvB,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,iBAAiB,CAAC;CAShC"}

package/dist/adapters/http/controllers/entities/user-authenticator/module.mjs

@@ -0,0 +1,154 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { useRequestIdentity } from "../../../request/helpers/identity.mjs";
+import { buildActorContext } from "../../../request/helpers/actor.mjs";
+import "../../../request/index.mjs";
+import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
+import { isSelfToken } from "../../../../../utils/self-id.mjs";
+import "../../../../../utils/index.mjs";
+import "../../../middleware/index.mjs";
+import { IdentityType } from "@authup/core-kit";
+import { BadRequestError } from "@authup/errors";
+import { useRequestQuery } from "@routup/basic/query";
+import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DTags } from "@routup/decorators";
+//#region src/adapters/http/controllers/entities/user-authenticator/module.ts
+function _ts_decorate(decorators, target, key, desc) {
+	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+	return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(k, v) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+function _ts_param(paramIndex, decorator) {
+	return function(target, key) {
+		decorator(target, key, paramIndex);
+	};
+}
+var UserAuthenticatorController = class {
+	service;
+	constructor(ctx) {
+		this.service = ctx.service;
+	}
+	/**
+	* `@me` / `@self` resolve to the calling user identity.
+	*/ resolveUserId(id, event) {
+		if (isSelfToken(id)) {
+			const identity = useRequestIdentity(event);
+			if (identity && identity.type === IdentityType.USER) return identity.id;
+			throw new BadRequestError("The @me/@self token can only be used by a user identity.");
+		}
+		return id;
+	}
+	async getMany(id, event) {
+		const actor = buildActorContext(event);
+		const userId = this.resolveUserId(id, event);
+		const { data, meta } = await this.service.getMany(useRequestQuery(event), actor, { userId });
+		return {
+			data,
+			meta
+		};
+	}
+	async enroll(id, data, event) {
+		const actor = buildActorContext(event);
+		const userId = this.resolveUserId(id, event);
+		const result = await this.service.enroll({
+			...data,
+			user_id: userId
+		}, actor);
+		event.response.status = 201;
+		return result;
+	}
+	async getOne(id, deviceId, event) {
+		const actor = buildActorContext(event);
+		const userId = this.resolveUserId(id, event);
+		return this.service.getOne(deviceId, actor, { userId });
+	}
+	async confirm(id, deviceId, data, event) {
+		const actor = buildActorContext(event);
+		const userId = this.resolveUserId(id, event);
+		if (!data || typeof data.code !== "string" || !data.code) throw new BadRequestError("A code must be provided.");
+		return this.service.confirm(deviceId, data.code, actor, { userId });
+	}
+	async drop(id, deviceId, event) {
+		const actor = buildActorContext(event);
+		const userId = this.resolveUserId(id, event);
+		const entity = await this.service.delete(deviceId, actor, { userId });
+		event.response.status = 202;
+		return entity;
+	}
+};
+_ts_decorate([
+	DGet("", [ForceLoggedInMiddleware]),
+	_ts_param(0, DPath("id")),
+	_ts_param(1, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [String, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], UserAuthenticatorController.prototype, "getMany", null);
+_ts_decorate([
+	DPost("", [ForceLoggedInMiddleware]),
+	_ts_param(0, DPath("id")),
+	_ts_param(1, DBody()),
+	_ts_param(2, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [
+		String,
+		typeof UserAuthenticatorCreatePayload === "undefined" ? Object : UserAuthenticatorCreatePayload,
+		typeof IAppEvent === "undefined" ? Object : IAppEvent
+	]),
+	_ts_metadata("design:returntype", Promise)
+], UserAuthenticatorController.prototype, "enroll", null);
+_ts_decorate([
+	DGet("/:deviceId", [ForceLoggedInMiddleware]),
+	_ts_param(0, DPath("id")),
+	_ts_param(1, DPath("deviceId")),
+	_ts_param(2, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [
+		String,
+		String,
+		typeof IAppEvent === "undefined" ? Object : IAppEvent
+	]),
+	_ts_metadata("design:returntype", Promise)
+], UserAuthenticatorController.prototype, "getOne", null);
+_ts_decorate([
+	DPost("/:deviceId/confirm", [ForceLoggedInMiddleware]),
+	_ts_param(0, DPath("id")),
+	_ts_param(1, DPath("deviceId")),
+	_ts_param(2, DBody()),
+	_ts_param(3, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [
+		String,
+		String,
+		typeof UserAuthenticatorConfirmPayload === "undefined" ? Object : UserAuthenticatorConfirmPayload,
+		typeof IAppEvent === "undefined" ? Object : IAppEvent
+	]),
+	_ts_metadata("design:returntype", Promise)
+], UserAuthenticatorController.prototype, "confirm", null);
+_ts_decorate([
+	DDelete("/:deviceId", [ForceLoggedInMiddleware]),
+	_ts_param(0, DPath("id")),
+	_ts_param(1, DPath("deviceId")),
+	_ts_param(2, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [
+		String,
+		String,
+		typeof IAppEvent === "undefined" ? Object : IAppEvent
+	]),
+	_ts_metadata("design:returntype", Promise)
+], UserAuthenticatorController.prototype, "drop", null);
+UserAuthenticatorController = _ts_decorate([
+	DTags("userAuthenticator"),
+	DController("/users/:id/authenticators"),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof UserAuthenticatorControllerContext === "undefined" ? Object : UserAuthenticatorControllerContext])
+], UserAuthenticatorController);
+//#endregion
+export { UserAuthenticatorController };
+
+//# sourceMappingURL=module.mjs.map

package/dist/adapters/http/controllers/entities/user-authenticator/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["DBody","DContext","DController","DDelete","DGet","DPath","DPost","DTags","IdentityType","BadRequestError","useRequestQuery","isSelfToken","ForceLoggedInMiddleware","buildActorContext","useRequestIdentity","UserAuthenticatorController","service","ctx","resolveUserId","id","event","identity","type","USER","getMany","actor","userId","data","meta","enroll","result","user_id","response","status","getOne","deviceId","confirm","code","drop","entity","delete"],"sources":["../../../../../../src/adapters/http/controllers/entities/user-authenticator/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DBody,\n    DContext,\n    DController,\n    DDelete,\n    DGet,\n    DPath,\n    DPost,\n    DTags,\n} from '@routup/decorators';\nimport { IdentityType } from '@authup/core-kit';\nimport type { UserAuthenticator } from '@authup/core-kit';\nimport { BadRequestError } from '@authup/errors';\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type {\n    EntityCollectionResponse,\n    UserAuthenticatorConfirmPayload,\n    UserAuthenticatorCreatePayload,\n    UserAuthenticatorEnrollResponse,\n} from '@authup/core-http-kit';\nimport { isSelfToken } from '../../../../../utils/index.ts';\nimport type { IUserAuthenticatorService } from '../../../../../core/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { buildActorContext, useRequestIdentity } from '../../../request/index.ts';\n\nexport type UserAuthenticatorControllerContext = {\n    service: IUserAuthenticatorService,\n};\n\n@DTags('userAuthenticator')\n@DController('/users/:id/authenticators')\nexport class UserAuthenticatorController {\n    protected service: IUserAuthenticatorService;\n\n    constructor(ctx: UserAuthenticatorControllerContext) {\n        this.service = ctx.service;\n    }\n\n    /**\n     * `@me` / `@self` resolve to the calling user identity.\n     */\n    protected resolveUserId(id: string, event: IAppEvent): string {\n        if (isSelfToken(id)) {\n            const identity = useRequestIdentity(event);\n            if (identity && identity.type === IdentityType.USER) {\n                return identity.id;\n            }\n\n            // A non-user identity (client/robot) has no authenticator\n            // namespace — fail loud instead of letting the literal token\n            // fall through and silently match zero rows.\n            throw new BadRequestError('The @me/@self token can only be used by a user identity.');\n        }\n\n        return id;\n    }\n\n    @DGet('', [ForceLoggedInMiddleware])\n    async getMany(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ): Promise<EntityCollectionResponse<UserAuthenticator>> {\n        const actor = buildActorContext(event);\n        const userId = this.resolveUserId(id, event);\n\n        const { data, meta } = await this.service.getMany(useRequestQuery(event), actor, { userId });\n\n        return {\n            data,\n            meta,\n        };\n    }\n\n    @DPost('', [ForceLoggedInMiddleware])\n    async enroll(\n        @DPath('id') id: string,\n        @DBody() data: UserAuthenticatorCreatePayload,\n        @DContext() event: IAppEvent,\n    ): Promise<UserAuthenticatorEnrollResponse> {\n        const actor = buildActorContext(event);\n        const userId = this.resolveUserId(id, event);\n\n        // route wins silently over body\n        const result = await this.service.enroll({ ...data, user_id: userId }, actor);\n\n        event.response.status = 201;\n        return result;\n    }\n\n    @DGet('/:deviceId', [ForceLoggedInMiddleware])\n    async getOne(\n        @DPath('id') id: string,\n        @DPath('deviceId') deviceId: string,\n        @DContext() event: IAppEvent,\n    ): Promise<UserAuthenticator> {\n        const actor = buildActorContext(event);\n        const userId = this.resolveUserId(id, event);\n\n        return this.service.getOne(deviceId, actor, { userId });\n    }\n\n    @DPost('/:deviceId/confirm', [ForceLoggedInMiddleware])\n    async confirm(\n        @DPath('id') id: string,\n        @DPath('deviceId') deviceId: string,\n        @DBody() data: UserAuthenticatorConfirmPayload,\n        @DContext() event: IAppEvent,\n    ): Promise<UserAuthenticator> {\n        const actor = buildActorContext(event);\n        const userId = this.resolveUserId(id, event);\n\n        if (!data || typeof data.code !== 'string' || !data.code) {\n            throw new BadRequestError('A code must be provided.');\n        }\n\n        return this.service.confirm(deviceId, data.code, actor, { userId });\n    }\n\n    @DDelete('/:deviceId', [ForceLoggedInMiddleware])\n    async drop(\n        @DPath('id') id: string,\n        @DPath('deviceId') deviceId: string,\n        @DContext() event: IAppEvent,\n    ): Promise<UserAuthenticator> {\n        const actor = buildActorContext(event);\n        const userId = this.resolveUserId(id, event);\n\n        const entity = await this.service.delete(deviceId, actor, { userId });\n\n        event.response.status = 202;\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCA,IAAae,8BAAb,MAAaA;CACCC;CAEV,YAAYC,KAAyC;EACjD,KAAKD,UAAUC,IAAID;CACvB;;;IAKA,cAAwBG,IAAYC,OAA0B;EAC1D,IAAIT,YAAYQ,EAAAA,GAAK;GACjB,MAAME,WAAWP,mBAAmBM,KAAAA;GACpC,IAAIC,YAAYA,SAASC,SAASd,aAAae,MAC3C,OAAOF,SAASF;GAMpB,MAAM,IAAIV,gBAAgB,0DAAA;EAC9B;EAEA,OAAOU;CACX;CAEA,MACMK,QACF,IACA,OACoD;EACpD,MAAMC,QAAQZ,kBAAkBO,KAAAA;EAChC,MAAMM,SAAS,KAAKR,cAAcC,IAAIC,KAAAA;EAEtC,MAAM,EAAEO,MAAMC,SAAS,MAAM,KAAKZ,QAAQQ,QAAQd,gBAAgBU,KAAAA,GAAQK,OAAO,EAAEC,OAAO,CAAA;EAE1F,OAAO;GACHC;GACAC;EACJ;CACJ;CAEA,MACMC,OACF,IACA,MACA,OACwC;EACxC,MAAMJ,QAAQZ,kBAAkBO,KAAAA;EAChC,MAAMM,SAAS,KAAKR,cAAcC,IAAIC,KAAAA;EAGtC,MAAMU,SAAS,MAAM,KAAKd,QAAQa,OAAO;GAAE,GAAGF;GAAMI,SAASL;EAAO,GAAGD,KAAAA;EAEvEL,MAAMY,SAASC,SAAS;EACxB,OAAOH;CACX;CAEA,MACMI,OACF,IACA,UACA,OAC0B;EAC1B,MAAMT,QAAQZ,kBAAkBO,KAAAA;EAChC,MAAMM,SAAS,KAAKR,cAAcC,IAAIC,KAAAA;EAEtC,OAAO,KAAKJ,QAAQkB,OAAOC,UAAUV,OAAO,EAAEC,OAAO,CAAA;CACzD;CAEA,MACMU,QACF,IACA,UACA,MACA,OAC0B;EAC1B,MAAMX,QAAQZ,kBAAkBO,KAAAA;EAChC,MAAMM,SAAS,KAAKR,cAAcC,IAAIC,KAAAA;EAEtC,IAAI,CAACO,QAAQ,OAAOA,KAAKU,SAAS,YAAY,CAACV,KAAKU,MAChD,MAAM,IAAI5B,gBAAgB,0BAAA;EAG9B,OAAO,KAAKO,QAAQoB,QAAQD,UAAUR,KAAKU,MAAMZ,OAAO,EAAEC,OAAO,CAAA;CACrE;CAEA,MACMY,KACF,IACA,UACA,OAC0B;EAC1B,MAAMb,QAAQZ,kBAAkBO,KAAAA;EAChC,MAAMM,SAAS,KAAKR,cAAcC,IAAIC,KAAAA;EAEtC,MAAMmB,SAAS,MAAM,KAAKvB,QAAQwB,OAAOL,UAAUV,OAAO,EAAEC,OAAO,CAAA;EAEnEN,MAAMY,SAASC,SAAS;EACxB,OAAOM;CACX;AACJ;;WA3Ee3B,uBAAAA,CAAAA;;;;;;;;YAgBCA,uBAAAA,CAAAA;;;;;;;;;;;;;qBAgBSA,uBAAAA,CAAAA;;;;;;;;;;;;;8BAYSA,uBAAAA,CAAAA;;;;;;;;;;;;;;;wBAiBNA,uBAAAA,CAAAA"}

package/dist/adapters/http/controllers/index.mjs

@@ -8,11 +8,15 @@ import { ClientRoleRequestValidator } from "./entities/client-role/utils/validat
 import { ClientRoleController } from "./entities/client-role/module.mjs";
 import { ClientScopeController } from "./entities/client-scope/module.mjs";
 import { ClientScopeRequestValidator } from "./entities/client-scope/utils/validator.mjs";
+import { ConsentController } from "./entities/consent/module.mjs";
+import { EventController } from "./entities/event/module.mjs";
 import { IdentityProviderController } from "./entities/identity-provider/module.mjs";
 import { IdentityProviderRoleMappingController } from "./entities/identity-provide-role/module.mjs";
+import { KeyController } from "./entities/key/module.mjs";
 import { PermissionController } from "./entities/permission/module.mjs";
 import { PermissionPolicyController } from "./entities/permission-policy/module.mjs";
 import { ActivateController } from "./workflows/activate/module.mjs";
+import { AuthenticatorChallengeController } from "./workflows/authenticator-challenge/module.mjs";
 import { AuthorizeController } from "./workflows/authorize/module.mjs";
 import { getJwkRouteHandler, getJwksRouteHandler } from "./workflows/jwks/handlers/read.mjs";
 import { JwkController } from "./workflows/jwks/module.mjs";
@@ -40,12 +44,14 @@ import { PolicyAttributesValidator } from "./entities/policy/utils/attributes-va
 import { PolicyValidator } from "./entities/policy/utils/validation.mjs";
 import { ScopeController } from "./entities/scope/module.mjs";
 import { SessionController } from "./entities/session/module.mjs";
+import { TrustAnchorController } from "./entities/trust-anchor/module.mjs";
 import { UserController } from "./entities/user/module.mjs";
 import { UserAttributeController } from "./entities/user-attribute/module.mjs";
 import { UserAttributeRequestValidator } from "./entities/user-attribute/utils/validation.mjs";
+import { UserAuthenticatorController } from "./entities/user-authenticator/module.mjs";
 import { UserPermissionController } from "./entities/user-permission/module.mjs";
 import { UserPermissionRequestValidator } from "./entities/user-permission/utils/validation.mjs";
 import { UserRoleController } from "./entities/user-role/module.mjs";
 import { UserRoleRequestValidator } from "./entities/user-role/utils/validation.mjs";
 import "./entities/index.mjs";
-export { ActivateController, AuthorizeController, ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, IdentityProviderController, IdentityProviderRoleMappingController, JwkController, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RegisterController, RobotController, RobotPermissionController, RobotPermissionRequestValidator, RobotRoleController, RobotRoleRequestValidator, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, StatusController, TokenController, UserAttributeController, UserAttributeRequestValidator, UserController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator, getJwkRouteHandler, getJwksRouteHandler };
+export { ActivateController, AuthenticatorChallengeController, AuthorizeController, ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ConsentController, EventController, IdentityProviderController, IdentityProviderRoleMappingController, JwkController, KeyController, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RegisterController, RobotController, RobotPermissionController, RobotPermissionRequestValidator, RobotRoleController, RobotRoleRequestValidator, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, StatusController, TokenController, TrustAnchorController, UserAttributeController, UserAttributeRequestValidator, UserAuthenticatorController, UserController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator, getJwkRouteHandler, getJwksRouteHandler };

package/dist/adapters/http/controllers/workflows/authenticator-challenge/index.d.ts

@@ -0,0 +1,2 @@
+export * from './module.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/controllers/workflows/authenticator-challenge/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/authenticator-challenge/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC"}

package/dist/adapters/http/controllers/workflows/authenticator-challenge/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { AuthenticatorChallengeController } from "./module.mjs";
+export { AuthenticatorChallengeController };

package/dist/adapters/http/controllers/workflows/authenticator-challenge/module.d.ts

@@ -0,0 +1,46 @@
+import type { IAppEvent } from 'routup';
+import type { UserAuthenticatorChallengeResponse, UserAuthenticatorChallengeSendPayload, UserAuthenticatorChallengeVerifyPayload, UserAuthenticatorChallengeVerifyResponse } from '@authup/core-http-kit';
+import type { IOAuth2MfaLoginService, ISessionManager, IUserAuthenticatorService } from '../../../../../core/index.ts';
+import type { RequestIdentity, RequestMfaLoginTicket } from '../../../request/index.ts';
+export type AuthenticatorChallengeControllerContext = {
+    service: IUserAuthenticatorService;
+    sessionManager: ISessionManager;
+    mfaLoginService?: IOAuth2MfaLoginService;
+};
+type ChallengeActor = {
+    identity: RequestIdentity;
+    ticket: RequestMfaLoginTicket | null;
+};
+/**
+ * Login-time challenge surface, scoped to the CURRENT bearer identity.
+ * GET reports whether (and how) the caller must present a second factor;
+ * POST verifies a factor and stamps mfa_at onto the backing session so
+ * the /authorize backstop passes.
+ *
+ * Besides a regular access bearer, these routes accept the "MFA-pending"
+ * login ticket (kind: mfa_token, issue #3242) the password grant issues
+ * for factor kinds that cannot ride the single grant POST (email /
+ * WebAuthn). A ticket-authenticated verify additionally completes the
+ * login: the response carries the full token grant for the now-MFA'd
+ * pending session.
+ */
+export declare class AuthenticatorChallengeController {
+    protected service: IUserAuthenticatorService;
+    protected sessionManager: ISessionManager;
+    protected mfaLoginService?: IOAuth2MfaLoginService;
+    constructor(ctx: AuthenticatorChallengeControllerContext);
+    /**
+     * Resolve the acting subject: the regular request identity (access
+     * bearer — the middleware never sets it for a ticket) or the stashed
+     * MFA-pending ticket. Anything else is unauthorized — the previous
+     * ForceLoggedInMiddleware contract, widened by exactly one bearer kind.
+     */
+    protected resolveActor(event: IAppEvent): ChallengeActor;
+    status(event: IAppEvent): Promise<UserAuthenticatorChallengeResponse>;
+    send(data: UserAuthenticatorChallengeSendPayload, event: IAppEvent): Promise<{
+        success: true;
+    }>;
+    verify(data: UserAuthenticatorChallengeVerifyPayload, event: IAppEvent): Promise<UserAuthenticatorChallengeVerifyResponse>;
+}
+export {};
+//# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/controllers/workflows/authenticator-challenge/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/authenticator-challenge/module.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EACR,kCAAkC,EAClC,qCAAqC,EACrC,uCAAuC,EACvC,wCAAwC,EAC3C,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,sBAAsB,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACvH,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAQxF,MAAM,MAAM,uCAAuC,GAAG;IAClD,OAAO,EAAE,yBAAyB,CAAC;IACnC,cAAc,EAAE,eAAe,CAAC;IAChC,eAAe,CAAC,EAAE,sBAAsB,CAAC;CAC5C,CAAC;AAEF,KAAK,cAAc,GAAG;IAClB,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,EAAE,qBAAqB,GAAG,IAAI,CAAC;CACxC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,qBAEa,gCAAgC;IACzC,SAAS,CAAC,OAAO,EAAE,yBAAyB,CAAC;IAE7C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,eAAe,CAAC,EAAE,sBAAsB,CAAC;gBAEvC,GAAG,EAAE,uCAAuC;IAMxD;;;;;OAKG;IACH,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,SAAS,GAAI,cAAc;IAenD,MAAM,CACI,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,kCAAkC,CAAC;IAcxC,IAAI,CACG,IAAI,EAAE,qCAAqC,EACxC,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAqBvB,MAAM,CACC,IAAI,EAAE,uCAAuC,EAC1C,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wCAAwC,CAAC;CAsEvD"}

package/dist/adapters/http/controllers/workflows/authenticator-challenge/module.mjs

@@ -0,0 +1,132 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { useRequestIdentity } from "../../../request/helpers/identity.mjs";
+import { useRequestLocale } from "../../../request/helpers/locale.mjs";
+import { useRequestMfaLoginTicket } from "../../../request/helpers/mfa-login-ticket.mjs";
+import { useRequestSessionId } from "../../../request/helpers/session-id.mjs";
+import "../../../request/index.mjs";
+import { IdentityType, UserAuthenticatorKind } from "@authup/core-kit";
+import { BadRequestError, EntityCredentialsInvalidError, UnauthorizedError } from "@authup/errors";
+import { getRequestHeader, getRequestIP } from "routup";
+import { DBody, DContext, DController, DGet, DPost, DTags } from "@routup/decorators";
+//#region src/adapters/http/controllers/workflows/authenticator-challenge/module.ts
+function _ts_decorate(decorators, target, key, desc) {
+	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+	return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(k, v) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+function _ts_param(paramIndex, decorator) {
+	return function(target, key) {
+		decorator(target, key, paramIndex);
+	};
+}
+var AuthenticatorChallengeController = class {
+	service;
+	sessionManager;
+	mfaLoginService;
+	constructor(ctx) {
+		this.service = ctx.service;
+		this.sessionManager = ctx.sessionManager;
+		this.mfaLoginService = ctx.mfaLoginService;
+	}
+	/**
+	* Resolve the acting subject: the regular request identity (access
+	* bearer — the middleware never sets it for a ticket) or the stashed
+	* MFA-pending ticket. Anything else is unauthorized — the previous
+	* ForceLoggedInMiddleware contract, widened by exactly one bearer kind.
+	*/ resolveActor(event) {
+		const identity = useRequestIdentity(event);
+		if (identity) return {
+			identity,
+			ticket: null
+		};
+		const ticket = useRequestMfaLoginTicket(event);
+		if (ticket) return {
+			identity: ticket.identity,
+			ticket
+		};
+		throw new UnauthorizedError();
+	}
+	async status(event) {
+		const { identity } = this.resolveActor(event);
+		if (identity.type !== IdentityType.USER) return {
+			required: false,
+			enrollmentRequired: false,
+			kinds: []
+		};
+		return this.service.challenge(identity.id);
+	}
+	async send(data, event) {
+		const { identity } = this.resolveActor(event);
+		if (identity.type !== IdentityType.USER) throw new BadRequestError("Only user identities can request a challenge.");
+		if (!data || !Object.values(UserAuthenticatorKind).includes(data.kind)) throw new BadRequestError("A kind must be provided.");
+		await this.service.sendChallenge(identity.id, data.kind, { locale: useRequestLocale(event) });
+		return { success: true };
+	}
+	async verify(data, event) {
+		const { identity, ticket } = this.resolveActor(event);
+		if (identity.type !== IdentityType.USER) throw new BadRequestError("Only user identities can complete a challenge.");
+		if (!data || typeof data.response !== "string" || !data.response || !Object.values(UserAuthenticatorKind).includes(data.kind)) throw new BadRequestError("A kind and response must be provided.");
+		const sessionId = ticket ? ticket.payload.session_id : useRequestSessionId(event);
+		const session = sessionId ? await this.sessionManager.findOneById(sessionId) : null;
+		if (ticket && !session) throw new UnauthorizedError();
+		if (!await this.service.verify(identity.id, {
+			kind: data.kind,
+			response: data.response
+		}, {
+			ipAddress: getRequestIP(event, { trustProxy: true }) ?? null,
+			userAgent: getRequestHeader(event, "user-agent") ?? null,
+			clientId: identity.clientId,
+			...session ? { onVerified: async () => {
+				await this.sessionManager.markMfaVerified(session);
+			} } : {}
+		})) throw new EntityCredentialsInvalidError();
+		if (ticket && session && this.mfaLoginService) return {
+			verified: true,
+			token: await this.mfaLoginService.complete({
+				session,
+				ticket: ticket.payload,
+				userName: identity.data.name
+			})
+		};
+		return { verified: true };
+	}
+};
+_ts_decorate([
+	DGet(""),
+	_ts_param(0, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], AuthenticatorChallengeController.prototype, "status", null);
+_ts_decorate([
+	DPost("/send"),
+	_ts_param(0, DBody()),
+	_ts_param(1, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof UserAuthenticatorChallengeSendPayload === "undefined" ? Object : UserAuthenticatorChallengeSendPayload, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], AuthenticatorChallengeController.prototype, "send", null);
+_ts_decorate([
+	DPost(""),
+	_ts_param(0, DBody()),
+	_ts_param(1, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof UserAuthenticatorChallengeVerifyPayload === "undefined" ? Object : UserAuthenticatorChallengeVerifyPayload, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], AuthenticatorChallengeController.prototype, "verify", null);
+AuthenticatorChallengeController = _ts_decorate([
+	DTags("userAuthenticator"),
+	DController("/authenticators/challenge"),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof AuthenticatorChallengeControllerContext === "undefined" ? Object : AuthenticatorChallengeControllerContext])
+], AuthenticatorChallengeController);
+//#endregion
+export { AuthenticatorChallengeController };
+
+//# sourceMappingURL=module.mjs.map

package/dist/adapters/http/controllers/workflows/authenticator-challenge/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["DBody","DContext","DController","DGet","DPost","DTags","IdentityType","UserAuthenticatorKind","BadRequestError","EntityCredentialsInvalidError","UnauthorizedError","getRequestHeader","getRequestIP","useRequestIdentity","useRequestLocale","useRequestMfaLoginTicket","useRequestSessionId","AuthenticatorChallengeController","service","sessionManager","mfaLoginService","ctx","resolveActor","event","identity","ticket","status","type","USER","required","enrollmentRequired","kinds","challenge","id","send","data","Object","values","includes","kind","sendChallenge","locale","success","verify","response","sessionId","payload","session_id","session","findOneById","verified","ipAddress","trustProxy","userAgent","clientId","onVerified","markMfaVerified","token","complete","userName","name"],"sources":["../../../../../../src/adapters/http/controllers/workflows/authenticator-challenge/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DBody,\n    DContext,\n    DController,\n    DGet,\n    DPost,\n    DTags,\n} from '@routup/decorators';\nimport { IdentityType, UserAuthenticatorKind } from '@authup/core-kit';\nimport { BadRequestError, EntityCredentialsInvalidError, UnauthorizedError } from '@authup/errors';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type {\n    UserAuthenticatorChallengeResponse,\n    UserAuthenticatorChallengeSendPayload,\n    UserAuthenticatorChallengeVerifyPayload,\n    UserAuthenticatorChallengeVerifyResponse,\n} from '@authup/core-http-kit';\nimport type { IOAuth2MfaLoginService, ISessionManager, IUserAuthenticatorService } from '../../../../../core/index.ts';\nimport type { RequestIdentity, RequestMfaLoginTicket } from '../../../request/index.ts';\nimport {\n    useRequestIdentity,\n    useRequestLocale,\n    useRequestMfaLoginTicket,\n    useRequestSessionId,\n} from '../../../request/index.ts';\n\nexport type AuthenticatorChallengeControllerContext = {\n    service: IUserAuthenticatorService,\n    sessionManager: ISessionManager,\n    mfaLoginService?: IOAuth2MfaLoginService,\n};\n\ntype ChallengeActor = {\n    identity: RequestIdentity,\n    ticket: RequestMfaLoginTicket | null,\n};\n\n/**\n * Login-time challenge surface, scoped to the CURRENT bearer identity.\n * GET reports whether (and how) the caller must present a second factor;\n * POST verifies a factor and stamps mfa_at onto the backing session so\n * the /authorize backstop passes.\n *\n * Besides a regular access bearer, these routes accept the \"MFA-pending\"\n * login ticket (kind: mfa_token, issue #3242) the password grant issues\n * for factor kinds that cannot ride the single grant POST (email /\n * WebAuthn). A ticket-authenticated verify additionally completes the\n * login: the response carries the full token grant for the now-MFA'd\n * pending session.\n */\n@DTags('userAuthenticator')\n@DController('/authenticators/challenge')\nexport class AuthenticatorChallengeController {\n    protected service: IUserAuthenticatorService;\n\n    protected sessionManager: ISessionManager;\n\n    protected mfaLoginService?: IOAuth2MfaLoginService;\n\n    constructor(ctx: AuthenticatorChallengeControllerContext) {\n        this.service = ctx.service;\n        this.sessionManager = ctx.sessionManager;\n        this.mfaLoginService = ctx.mfaLoginService;\n    }\n\n    /**\n     * Resolve the acting subject: the regular request identity (access\n     * bearer — the middleware never sets it for a ticket) or the stashed\n     * MFA-pending ticket. Anything else is unauthorized — the previous\n     * ForceLoggedInMiddleware contract, widened by exactly one bearer kind.\n     */\n    protected resolveActor(event: IAppEvent) : ChallengeActor {\n        const identity = useRequestIdentity(event);\n        if (identity) {\n            return { identity, ticket: null };\n        }\n\n        const ticket = useRequestMfaLoginTicket(event);\n        if (ticket) {\n            return { identity: ticket.identity, ticket };\n        }\n\n        throw new UnauthorizedError();\n    }\n\n    @DGet('')\n    async status(\n        @DContext() event: IAppEvent,\n    ): Promise<UserAuthenticatorChallengeResponse> {\n        const { identity } = this.resolveActor(event);\n        if (identity.type !== IdentityType.USER) {\n            return {\n                required: false,\n                enrollmentRequired: false,\n                kinds: [],\n            };\n        }\n\n        return this.service.challenge(identity.id);\n    }\n\n    @DPost('/send')\n    async send(\n        @DBody() data: UserAuthenticatorChallengeSendPayload,\n        @DContext() event: IAppEvent,\n    ): Promise<{ success: true }> {\n        const { identity } = this.resolveActor(event);\n        if (identity.type !== IdentityType.USER) {\n            throw new BadRequestError('Only user identities can request a challenge.');\n        }\n\n        if (\n            !data ||\n            !Object.values(UserAuthenticatorKind).includes(data.kind as UserAuthenticatorKind)\n        ) {\n            throw new BadRequestError('A kind must be provided.');\n        }\n\n        await this.service.sendChallenge(identity.id, data.kind, { locale: useRequestLocale(event) });\n\n        // uniform 200 regardless of whether a code was actually mailed —\n        // no enrollment-status oracle for the caller.\n        return { success: true };\n    }\n\n    @DPost('')\n    async verify(\n        @DBody() data: UserAuthenticatorChallengeVerifyPayload,\n        @DContext() event: IAppEvent,\n    ): Promise<UserAuthenticatorChallengeVerifyResponse> {\n        const { identity, ticket } = this.resolveActor(event);\n        if (identity.type !== IdentityType.USER) {\n            throw new BadRequestError('Only user identities can complete a challenge.');\n        }\n\n        if (\n            !data ||\n            typeof data.response !== 'string' ||\n            !data.response ||\n            !Object.values(UserAuthenticatorKind).includes(data.kind as UserAuthenticatorKind)\n        ) {\n            throw new BadRequestError('A kind and response must be provided.');\n        }\n\n        // Bind the proof to the backing session — the /authorize backstop\n        // reads session.mfa_at. The session id is server-derived (stashed\n        // by the authorization middleware / carried by the verified ticket),\n        // never client input. The stamp runs INSIDE the verify unit of work\n        // (before the code consumption persists), so a stamp failure never\n        // burns a single-use code.\n        const sessionId = ticket ?\n            ticket.payload.session_id :\n            useRequestSessionId(event);\n        const session = sessionId ?\n            await this.sessionManager.findOneById(sessionId) :\n            null;\n\n        // a ticket references exactly one pending session — without it\n        // (swept / expired mid-flight) the login can not complete.\n        if (ticket && !session) {\n            throw new UnauthorizedError();\n        }\n\n        const verified = await this.service.verify(\n            identity.id,\n            {\n                kind: data.kind,\n                response: data.response,\n            },\n            {\n                ipAddress: getRequestIP(event, { trustProxy: true }) ?? null,\n                userAgent: getRequestHeader(event, 'user-agent') ?? null,\n                clientId: identity.clientId,\n                ...(session ? {\n                    onVerified: async () => {\n                        await this.sessionManager.markMfaVerified(session);\n                    },\n                } : {}),\n            },\n        );\n        if (!verified) {\n            throw new EntityCredentialsInvalidError();\n        }\n\n        // Ticket flow: the factor is verified and mfa_at stamped — complete\n        // the login by minting the full grant for the pending session and\n        // consuming the ticket (single use).\n        if (ticket && session && this.mfaLoginService) {\n            const token = await this.mfaLoginService.complete({\n                session,\n                ticket: ticket.payload,\n                userName: identity.data.name,\n            });\n\n            return { verified: true, token };\n        }\n\n        return { verified: true };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AA4DA,IAAaiB,mCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA8C;EACtD,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,kBAAkBC,IAAID;CAC/B;;;;;;IAQA,aAAuBG,OAAmC;EACtD,MAAMC,WAAWX,mBAAmBU,KAAAA;EACpC,IAAIC,UACA,OAAO;GAAEA;GAAUC,QAAQ;EAAK;EAGpC,MAAMA,SAASV,yBAAyBQ,KAAAA;EACxC,IAAIE,QACA,OAAO;GAAED,UAAUC,OAAOD;GAAUC;EAAO;EAG/C,MAAM,IAAIf,kBAAAA;CACd;CAEA,MACMgB,OACF,OAC2C;EAC3C,MAAM,EAAEF,aAAa,KAAKF,aAAaC,KAAAA;EACvC,IAAIC,SAASG,SAASrB,aAAasB,MAC/B,OAAO;GACHC,UAAU;GACVC,oBAAoB;GACpBC,OAAO,CAAA;EACX;EAGJ,OAAO,KAAKb,QAAQc,UAAUR,SAASS,EAAE;CAC7C;CAEA,MACMC,KACF,MACA,OAC0B;EAC1B,MAAM,EAAEV,aAAa,KAAKF,aAAaC,KAAAA;EACvC,IAAIC,SAASG,SAASrB,aAAasB,MAC/B,MAAM,IAAIpB,gBAAgB,+CAAA;EAG9B,IACI,CAAC2B,QACD,CAACC,OAAOC,OAAO9B,qBAAAA,CAAAA,CAAuB+B,SAASH,KAAKI,IAAI,GAExD,MAAM,IAAI/B,gBAAgB,0BAAA;EAG9B,MAAM,KAAKU,QAAQsB,cAAchB,SAASS,IAAIE,KAAKI,MAAM,EAAEE,QAAQ3B,iBAAiBS,KAAAA,EAAO,CAAA;EAI3F,OAAO,EAAEmB,SAAS,KAAK;CAC3B;CAEA,MACMC,OACF,MACA,OACiD;EACjD,MAAM,EAAEnB,UAAUC,WAAW,KAAKH,aAAaC,KAAAA;EAC/C,IAAIC,SAASG,SAASrB,aAAasB,MAC/B,MAAM,IAAIpB,gBAAgB,gDAAA;EAG9B,IACI,CAAC2B,QACD,OAAOA,KAAKS,aAAa,YACzB,CAACT,KAAKS,YACN,CAACR,OAAOC,OAAO9B,qBAAAA,CAAAA,CAAuB+B,SAASH,KAAKI,IAAI,GAExD,MAAM,IAAI/B,gBAAgB,uCAAA;EAS9B,MAAMqC,YAAYpB,SACdA,OAAOqB,QAAQC,aACf/B,oBAAoBO,KAAAA;EACxB,MAAMyB,UAAUH,YACZ,MAAM,KAAK1B,eAAe8B,YAAYJ,SAAAA,IACtC;EAIJ,IAAIpB,UAAU,CAACuB,SACX,MAAM,IAAItC,kBAAAA;EAoBd,IAAI,CAACwC,MAjBkB,KAAKhC,QAAQyB,OAChCnB,SAASS,IACT;GACIM,MAAMJ,KAAKI;GACXK,UAAUT,KAAKS;EACnB,GACA;GACIO,WAAWvC,aAAaW,OAAO,EAAE6B,YAAY,KAAK,CAAA,KAAM;GACxDC,WAAW1C,iBAAiBY,OAAO,YAAA,KAAiB;GACpD+B,UAAU9B,SAAS8B;GACnB,GAAIN,UAAU,EACVO,YAAY,YAAA;IACR,MAAM,KAAKpC,eAAeqC,gBAAgBR,OAAAA;GAC9C,EACJ,IAAI,CAAC;EACT,CAAA,GAGA,MAAM,IAAIvC,8BAAAA;EAMd,IAAIgB,UAAUuB,WAAW,KAAK5B,iBAO1B,OAAO;GAAE8B,UAAU;GAAMO,OAAAA,MANL,KAAKrC,gBAAgBsC,SAAS;IAC9CV;IACAvB,QAAQA,OAAOqB;IACfa,UAAUnC,SAASW,KAAKyB;GAC5B,CAAA;EAE+B;EAGnC,OAAO,EAAEV,UAAU,KAAK;CAC5B;AACJ"}

package/dist/adapters/http/controllers/workflows/authorize/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/module.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAQxC,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAGlE,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AACvF,OAAO,KAAK,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAMzF,qBACa,mBAAmB;IAI5B,SAAS,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAE9C,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,oBAAoB,EAAG,uCAAuC,CAAC;IAEzE,SAAS,CAAC,UAAU,EAAE,oBAAoB,CAAC;gBAI/B,GAAG,EAAE,0BAA0B;IAkBrC,OAAO,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAgB/D,KAAK,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;CA+E7D"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/module.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAUxC,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAGlE,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AACvF,OAAO,KAAK,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAMzF,qBACa,mBAAmB;IAI5B,SAAS,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAE9C,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,oBAAoB,EAAG,uCAAuC,CAAC;IAEzE,SAAS,CAAC,UAAU,EAAE,oBAAoB,CAAC;gBAI/B,GAAG,EAAE,0BAA0B;IAyBrC,OAAO,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAmC/D,KAAK,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;CA8F7D"}