@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.54

package/dist/adapters/http/adapters/oauth2/grant-types/refresh_token.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"refresh_token.mjs","names":["OAuth2GrantError","OAuth2RequestError","OAuth2TokenGrant","readRequestBody","getRequestHeader","getRequestIP","OAuth2RefreshTokenGrant","assertClientGrantAllowed","extractClientCredentialsFromRequest","readRealmHint","HTTPOAuth2RefreshTokenGrant","clientAuthenticator","refreshTokenVerifier","realmRepository","ctx","tokenVerifier","runWithRequest","event","body","refreshToken","refresh_token","length","malformed","clientId","clientSecret","payload","verify","skipActiveCheck","client","realm","resolve","authenticate","id","client_id","invalid","REFRESH_TOKEN","is_confidential","realm_id","runWith","ipAddress","trustProxy","undefined","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/refresh_token.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Client } from '@authup/core-kit';\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2GrantError, OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport { OAuth2RefreshTokenGrant, assertClientGrantAllowed } from '../../../../../core/index.ts';\nimport type {\n    IOAuth2TokenVerifier,\n    IRealmRepository,\n    OAuth2ClientAuthenticator,\n} from '../../../../../core/index.ts';\nimport type { HTTPOAuth2RefreshTokenGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport { extractClientCredentialsFromRequest, readRealmHint } from './utils/index.ts';\n\nexport class HTTPOAuth2RefreshTokenGrant extends OAuth2RefreshTokenGrant implements IHTTPOAuth2Grant {\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    protected refreshTokenVerifier : IOAuth2TokenVerifier;\n\n    protected realmRepository : IRealmRepository;\n\n    constructor(ctx: HTTPOAuth2RefreshTokenGrantContext) {\n        super(ctx);\n\n        this.clientAuthenticator = ctx.clientAuthenticator;\n        this.refreshTokenVerifier = ctx.tokenVerifier;\n        this.realmRepository = ctx.realmRepository;\n    }\n\n    async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const body = await readRequestBody(event);\n        const refreshToken = body?.refresh_token;\n        if (typeof refreshToken !== 'string' || refreshToken.length === 0) {\n            throw OAuth2RequestError.malformed();\n        }\n\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n\n        // RFC 6749 §6: verify the refresh token first to learn its bound\n        // client (if any), then enforce binding. Authenticate the requesting\n        // client when credentials are present, or when the token requires\n        // a client binding.\n        //\n        // skipActiveCheck: the durable auth_session_tokens row (not the cache\n        // blocklist) is the refresh-token authority, so a replayed/consumed\n        // token must reach runWith() to trigger family revocation instead of\n        // being rejected here with JWT_INACTIVE.\n        const payload = await this.refreshTokenVerifier.verify(refreshToken, { skipActiveCheck: true });\n\n        let client: Client | undefined;\n\n        if (clientId) {\n            // A client authenticated itself. Resolve by the presented\n            // id/secret (name resolution scoped by the realm hint — resolved\n            // lazily so a bare refresh skips the SELECT) and enforce the\n            // token↔client binding.\n            const realm = await this.realmRepository.resolve(readRealmHint(body), true);\n\n            client = await this.clientAuthenticator.authenticate(\n                clientId,\n                clientSecret,\n                realm.id,\n            );\n\n            if (payload.client_id && payload.client_id !== client.id) {\n                throw OAuth2GrantError.invalid();\n            }\n        } else if (payload.client_id) {\n            // No client credentials were presented, but the token is bound to\n            // a client. RFC 6749 §10.4: a public client cannot authenticate\n            // (no secret) and is not required to — the bound identity is read\n            // from the signed token (client_id is server-minted, so trusted)\n            // and refresh-token rotation/replay detection is the abuse control.\n            // A confidential client MUST still authenticate: authenticate()\n            // with no secret throws invalid_client for it, so a confidential-\n            // bound token presented without credentials is rejected here.\n            client = await this.clientAuthenticator.authenticate(payload.client_id);\n        }\n\n        if (client) {\n            assertClientGrantAllowed(client, OAuth2TokenGrant.REFRESH_TOKEN);\n        }\n\n        // Realm parity for PUBLIC clients only: a public client may not refresh\n        // a token whose realm differs from the (bound) client's own realm.\n        // Kills cross-realm refresh tokens minted for a public `web` client\n        // before the authorize-side realm gate existed. Confidential clients\n        // are exempt — the client secret already proves identity, and the\n        // documented cross-realm password grant (UUID-identified user against a\n        // master-realm client) depends on that exemption.\n        if (\n            client &&\n            !client.is_confidential &&\n            payload.realm_id &&\n            payload.realm_id !== client.realm_id\n        ) {\n            throw OAuth2GrantError.invalid();\n        }\n\n        return this.runWith(payload, {\n            ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AAsBA,IAAaU,8BAAb,cAAiDJ,wBAAAA;CACnCK;CAEAC;CAEAC;CAEV,YAAYC,KAAyC;EACjD,MAAMA,GAAAA;EAEN,KAAKH,sBAAsBG,IAAIH;EAC/B,KAAKC,uBAAuBE,IAAIC;EAChC,KAAKF,kBAAkBC,IAAID;CAC/B;CAEA,MAAMG,eAAeC,OAAqD;EACtE,MAAMC,OAAO,MAAMf,gBAAgBc,KAAAA;EACnC,MAAME,eAAeD,MAAME;EAC3B,IAAI,OAAOD,iBAAiB,YAAYA,aAAaE,WAAW,GAC5D,MAAMpB,mBAAmBqB,UAAS;EAGtC,MAAM,EAAEC,UAAUC,iBAAiB,MAAMhB,oCAAoCS,KAAAA;EAW7E,MAAMQ,UAAU,MAAM,KAAKb,qBAAqBc,OAAOP,cAAc,EAAEQ,iBAAiB,KAAK,CAAA;EAE7F,IAAIC;EAEJ,IAAIL,UAAU;GAKV,MAAMM,QAAQ,MAAM,KAAKhB,gBAAgBiB,QAAQrB,cAAcS,IAAAA,GAAO,IAAA;GAEtEU,SAAS,MAAM,KAAKjB,oBAAoBoB,aACpCR,UACAC,cACAK,MAAMG,EAAE;GAGZ,IAAIP,QAAQQ,aAAaR,QAAQQ,cAAcL,OAAOI,IAClD,MAAMhC,iBAAiBkC,QAAO;EAEtC,OAAO,IAAIT,QAAQQ,WASfL,SAAS,MAAM,KAAKjB,oBAAoBoB,aAAaN,QAAQQ,SAAS;EAG1E,IAAIL,QACArB,yBAAyBqB,QAAQ1B,iBAAiBiC,aAAa;EAUnE,IACIP,UACA,CAACA,OAAOQ,mBACRX,QAAQY,YACRZ,QAAQY,aAAaT,OAAOS,UAE5B,MAAMrC,iBAAiBkC,QAAO;EAGlC,OAAO,KAAKI,QAAQb,SAAS;GACzBc,WAAWlC,aAAaY,OAAO,EAAEuB,YAAY,KAAK,CAAA,KAAMC,KAAAA;GACxDC,WAAWtC,iBAAiBa,OAAO,YAAA,KAAiBwB,KAAAA;EACxD,CAAA;CACJ;AACJ"}
+{"version":3,"file":"refresh_token.mjs","names":["isClientPublic","OAuth2GrantError","OAuth2RequestError","OAuth2TokenGrant","readRequestBody","getRequestHeader","getRequestIP","OAuth2RefreshTokenGrant","assertClientGrantAllowed","extractClientCredentialsFromRequest","extractOAuth2ClientCertificateEvidence","readRealmHint","HTTPOAuth2RefreshTokenGrant","clientAuthenticator","refreshTokenVerifier","realmRepository","certificateSource","ctx","tokenVerifier","runWithRequest","event","body","refreshToken","refresh_token","length","malformed","clientId","clientSecret","certificateEvidence","payload","verify","skipActiveCheck","client","realm","resolve","authenticate","id","client_id","invalid","undefined","REFRESH_TOKEN","confirmation","cnf","expectedThumbprint","validateCertificateEvidenceForBinding","resolveTokenBinding","realm_id","realmId","runWith","ipAddress","trustProxy","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/refresh_token.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { type Client, isClientPublic } from '@authup/core-kit';\nimport type { OAuth2TokenConfirmation, OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2GrantError, OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport { OAuth2RefreshTokenGrant, assertClientGrantAllowed } from '../../../../../core/index.ts';\nimport type {\n    IOAuth2TokenVerifier,\n    IRealmRepository,\n    OAuth2ClientAuthenticator,\n} from '../../../../../core/index.ts';\nimport type { HTTPOAuth2RefreshTokenGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport type { CertificateSource } from '../../../request/index.ts';\nimport {\n    extractClientCredentialsFromRequest,\n    extractOAuth2ClientCertificateEvidence,\n    readRealmHint,\n} from './utils/index.ts';\n\nexport class HTTPOAuth2RefreshTokenGrant extends OAuth2RefreshTokenGrant implements IHTTPOAuth2Grant {\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    protected refreshTokenVerifier : IOAuth2TokenVerifier;\n\n    protected realmRepository : IRealmRepository;\n\n    protected certificateSource: CertificateSource;\n\n    constructor(ctx: HTTPOAuth2RefreshTokenGrantContext) {\n        super(ctx);\n\n        this.clientAuthenticator = ctx.clientAuthenticator;\n        this.refreshTokenVerifier = ctx.tokenVerifier;\n        this.realmRepository = ctx.realmRepository;\n        this.certificateSource = ctx.certificateSource ?? 'disabled';\n    }\n\n    async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const body = await readRequestBody(event);\n        const refreshToken = body?.refresh_token;\n        if (typeof refreshToken !== 'string' || refreshToken.length === 0) {\n            throw OAuth2RequestError.malformed();\n        }\n\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n        const certificateEvidence = await extractOAuth2ClientCertificateEvidence(event, this.certificateSource);\n\n        // RFC 6749 §6: verify the refresh token first to learn its bound\n        // client (if any), then enforce binding. Authenticate the requesting\n        // client when credentials are present, or when the token requires\n        // a client binding.\n        //\n        // skipActiveCheck: the durable auth_session_tokens row (not the cache\n        // blocklist) is the refresh-token authority, so a replayed/consumed\n        // token must reach runWith() to trigger family revocation instead of\n        // being rejected here with JWT_INACTIVE.\n        const payload = await this.refreshTokenVerifier.verify(refreshToken, { skipActiveCheck: true });\n\n        let client: Client | undefined;\n\n        if (clientId) {\n            // A client authenticated itself. Resolve by the presented\n            // id/secret (name resolution scoped by the realm hint — resolved\n            // lazily so a bare refresh skips the SELECT) and enforce the\n            // token↔client binding.\n            const realm = await this.realmRepository.resolve(readRealmHint(body), true);\n\n            client = await this.clientAuthenticator.authenticate(\n                clientId,\n                clientSecret,\n                realm.id,\n                certificateEvidence,\n            );\n\n            if (payload.client_id && payload.client_id !== client.id) {\n                throw OAuth2GrantError.invalid();\n            }\n        } else if (payload.client_id) {\n            // No client credentials were presented, but the token is bound to\n            // a client. RFC 6749 §10.4: a public client cannot authenticate\n            // (no secret) and is not required to — the bound identity is read\n            // from the signed token (client_id is server-minted, so trusted)\n            // and refresh-token rotation/replay detection is the abuse control.\n            // A client with an authentication method MUST still authenticate.\n            // Supplying the server-minted client id lets TLS clients prove\n            // themselves with the request certificate, while a secret client\n            // still fails because its secret is absent.\n            client = await this.clientAuthenticator.authenticate(\n                payload.client_id,\n                undefined,\n                undefined,\n                certificateEvidence,\n            );\n        }\n\n        if (client) {\n            assertClientGrantAllowed(client, OAuth2TokenGrant.REFRESH_TOKEN);\n        }\n\n        let confirmation: OAuth2TokenConfirmation | undefined;\n        if (payload.cnf) {\n            const expectedThumbprint = payload.cnf['x5t#S256'];\n            if (typeof expectedThumbprint !== 'string' || expectedThumbprint.length === 0) {\n                throw OAuth2GrantError.invalid();\n            }\n\n            confirmation = this.clientAuthenticator.validateCertificateEvidenceForBinding(\n                certificateEvidence,\n            );\n            if (confirmation['x5t#S256'] !== expectedThumbprint) {\n                throw OAuth2GrantError.invalid();\n            }\n        } else if (client) {\n            confirmation = this.clientAuthenticator.resolveTokenBinding(client, certificateEvidence);\n        }\n\n        // Realm parity for PUBLIC clients only: a public client may not refresh\n        // a token whose realm differs from the (bound) client's own realm.\n        // Kills cross-realm refresh tokens minted for a public `web` client\n        // before the authorize-side realm gate existed. Authenticated clients\n        // are exempt — the configured secret/certificate proves identity, and the\n        // documented cross-realm password grant (UUID-identified user against a\n        // master-realm client) depends on that exemption.\n        if (\n            client &&\n            isClientPublic(client) &&\n            payload.realm_id &&\n            payload.realm_id !== client.realmId\n        ) {\n            throw OAuth2GrantError.invalid();\n        }\n\n        return this.runWith(payload, {\n            confirmation,\n            ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;AA2BA,IAAaY,8BAAb,cAAiDL,wBAAAA;CACnCM;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAyC;EACjD,MAAMA,GAAAA;EAEN,KAAKJ,sBAAsBI,IAAIJ;EAC/B,KAAKC,uBAAuBG,IAAIC;EAChC,KAAKH,kBAAkBE,IAAIF;EAC3B,KAAKC,oBAAoBC,IAAID,qBAAqB;CACtD;CAEA,MAAMG,eAAeC,OAAqD;EACtE,MAAMC,OAAO,MAAMjB,gBAAgBgB,KAAAA;EACnC,MAAME,eAAeD,MAAME;EAC3B,IAAI,OAAOD,iBAAiB,YAAYA,aAAaE,WAAW,GAC5D,MAAMtB,mBAAmBuB,UAAS;EAGtC,MAAM,EAAEC,UAAUC,iBAAiB,MAAMlB,oCAAoCW,KAAAA;EAC7E,MAAMQ,sBAAsB,MAAMlB,uCAAuCU,OAAO,KAAKJ,iBAAiB;EAWtG,MAAMa,UAAU,MAAM,KAAKf,qBAAqBgB,OAAOR,cAAc,EAAES,iBAAiB,KAAK,CAAA;EAE7F,IAAIC;EAEJ,IAAIN,UAAU;GAKV,MAAMO,QAAQ,MAAM,KAAKlB,gBAAgBmB,QAAQvB,cAAcU,IAAAA,GAAO,IAAA;GAEtEW,SAAS,MAAM,KAAKnB,oBAAoBsB,aACpCT,UACAC,cACAM,MAAMG,IACNR,mBAAAA;GAGJ,IAAIC,QAAQQ,aAAaR,QAAQQ,cAAcL,OAAOI,IAClD,MAAMnC,iBAAiBqC,QAAO;EAEtC,OAAO,IAAIT,QAAQQ,WAUfL,SAAS,MAAM,KAAKnB,oBAAoBsB,aACpCN,QAAQQ,WACRE,KAAAA,GACAA,KAAAA,GACAX,mBAAAA;EAIR,IAAII,QACAxB,yBAAyBwB,QAAQ7B,iBAAiBqC,aAAa;EAGnE,IAAIC;EACJ,IAAIZ,QAAQa,KAAK;GACb,MAAMC,qBAAqBd,QAAQa,IAAI;GACvC,IAAI,OAAOC,uBAAuB,YAAYA,mBAAmBnB,WAAW,GACxE,MAAMvB,iBAAiBqC,QAAO;GAGlCG,eAAe,KAAK5B,oBAAoB+B,sCACpChB,mBAAAA;GAEJ,IAAIa,aAAa,gBAAgBE,oBAC7B,MAAM1C,iBAAiBqC,QAAO;EAEtC,OAAO,IAAIN,QACPS,eAAe,KAAK5B,oBAAoBgC,oBAAoBb,QAAQJ,mBAAAA;EAUxE,IACII,UACAhC,eAAegC,MAAAA,KACfH,QAAQiB,YACRjB,QAAQiB,aAAad,OAAOe,SAE5B,MAAM9C,iBAAiBqC,QAAO;EAGlC,OAAO,KAAKU,QAAQnB,SAAS;GACzBY;GACAQ,WAAW3C,aAAac,OAAO,EAAE8B,YAAY,KAAK,CAAA,KAAMX,KAAAA;GACxDY,WAAW9C,iBAAiBe,OAAO,YAAA,KAAiBmB,KAAAA;EACxD,CAAA;CACJ;AACJ"}

package/dist/adapters/http/adapters/oauth2/grant-types/types.d.ts

@@ -1,11 +1,15 @@
-import type { Client, Robot, User } from '@authup/core-kit';
+import type { User } from '@authup/core-kit';
+import type { Logger } from '@authup/server-kit';
 import type { OAuth2TokenGrantResponse } from '@authup/specs';
 import type { IAppEvent } from 'routup';
-import type { BaseGrantContext, ICredentialsAuthenticator, IOAuth2AuthorizationCodeVerifier, IRealmRepository, OAuth2AuthorizeGrantContext, OAuth2ClientAuthenticator, OAuth2PasswordGrantContext, OAuth2RefreshTokenGrantContext } from '../../../../../core/index.ts';
+import type { BaseGrantContext, ICredentialsAuthenticator, ILoginThrottleService, IOAuth2AccessPolicyEvaluator, IOAuth2AuthorizationCodeVerifier, IOAuth2MfaLoginService, IRealmRepository, IUserAuthenticatorService, OAuth2AuthorizeGrantContext, OAuth2ClientAuthenticator, OAuth2PasswordGrantContext, OAuth2RefreshTokenGrantContext } from '../../../../../core/index.ts';
+import type { CertificateSource } from '../../../request/index.ts';
 export type HTTPOAuth2AuthorizeGrantContext = OAuth2AuthorizeGrantContext & {
     codeVerifier: IOAuth2AuthorizationCodeVerifier;
     clientAuthenticator: OAuth2ClientAuthenticator;
     realmRepository: IRealmRepository;
+    accessPolicyEvaluator?: IOAuth2AccessPolicyEvaluator;
+    certificateSource: CertificateSource;
 };
 export interface IHTTPOAuth2Grant {
     runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse>;
@@ -14,15 +18,19 @@ export type HTTPOAuth2PasswordGrantContext = OAuth2PasswordGrantContext & {
     authenticator: ICredentialsAuthenticator<User>;
     clientAuthenticator: OAuth2ClientAuthenticator;
     realmRepository: IRealmRepository;
+    loginThrottleService?: ILoginThrottleService;
+    userAuthenticatorService?: IUserAuthenticatorService;
+    mfaLoginService?: IOAuth2MfaLoginService;
+    logger?: Logger;
+    certificateSource: CertificateSource;
 };
 export type HTTPOAuth2RefreshTokenGrantContext = OAuth2RefreshTokenGrantContext & {
     clientAuthenticator: OAuth2ClientAuthenticator;
     realmRepository: IRealmRepository;
+    certificateSource: CertificateSource;
 };
 export type HTTPOAuth2ClientCredentialsGrantContext = BaseGrantContext & {
-    authenticator: ICredentialsAuthenticator<Client>;
-};
-export type HTTPOAuth2RobotCredentialsGrantContext = BaseGrantContext & {
-    authenticator: ICredentialsAuthenticator<Robot>;
+    clientAuthenticator: OAuth2ClientAuthenticator;
+    certificateSource: CertificateSource;
 };
 //# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/adapters/oauth2/grant-types/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EACR,gBAAgB,EAChB,yBAAyB,EACzB,gCAAgC,EAChC,gBAAgB,EAChB,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,8BAA8B,EACjC,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,+BAA+B,GAAG,2BAA2B,GAAG;IACxE,YAAY,EAAE,gCAAgC,CAAC;IAC/C,mBAAmB,EAAE,yBAAyB,CAAC;IAC/C,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC7B,cAAc,CAAC,KAAK,EAAE,SAAS,GAAI,OAAO,CAAC,wBAAwB,CAAC,CAAA;CACvE;AAED,MAAM,MAAM,8BAA8B,GAAG,0BAA0B,GAAG;IACtE,aAAa,EAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAChD,mBAAmB,EAAE,yBAAyB,CAAC;IAC/C,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,kCAAkC,GAAG,8BAA8B,GAAG;IAC9E,mBAAmB,EAAE,yBAAyB,CAAC;IAC/C,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,uCAAuC,GAAG,gBAAgB,GAAG;IACrE,aAAa,EAAG,yBAAyB,CAAC,MAAM,CAAC,CAAA;CACpD,CAAC;AAEF,MAAM,MAAM,sCAAsC,GAAG,gBAAgB,GAAG;IACpE,aAAa,EAAG,yBAAyB,CAAC,KAAK,CAAC,CAAA;CACnD,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EACR,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,EACrB,4BAA4B,EAC5B,gCAAgC,EAChC,sBAAsB,EACtB,gBAAgB,EAChB,yBAAyB,EACzB,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,8BAA8B,EACjC,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,MAAM,MAAM,+BAA+B,GAAG,2BAA2B,GAAG;IACxE,YAAY,EAAE,gCAAgC,CAAC;IAC/C,mBAAmB,EAAE,yBAAyB,CAAC;IAC/C,eAAe,EAAE,gBAAgB,CAAC;IAClC,qBAAqB,CAAC,EAAE,4BAA4B,CAAC;IACrD,iBAAiB,EAAE,iBAAiB,CAAC;CACxC,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC7B,cAAc,CAAC,KAAK,EAAE,SAAS,GAAI,OAAO,CAAC,wBAAwB,CAAC,CAAA;CACvE;AAED,MAAM,MAAM,8BAA8B,GAAG,0BAA0B,GAAG;IACtE,aAAa,EAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAChD,mBAAmB,EAAE,yBAAyB,CAAC;IAC/C,eAAe,EAAE,gBAAgB,CAAC;IAClC,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAC7C,wBAAwB,CAAC,EAAE,yBAAyB,CAAC;IACrD,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,iBAAiB,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,kCAAkC,GAAG,8BAA8B,GAAG;IAC9E,mBAAmB,EAAE,yBAAyB,CAAC;IAC/C,eAAe,EAAE,gBAAgB,CAAC;IAClC,iBAAiB,EAAE,iBAAiB,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,uCAAuC,GAAG,gBAAgB,GAAG;IACrE,mBAAmB,EAAE,yBAAyB,CAAC;IAC/C,iBAAiB,EAAE,iBAAiB,CAAC;CACxC,CAAC"}

package/dist/adapters/http/adapters/oauth2/grant-types/utils/certificate.d.ts

@@ -0,0 +1,5 @@
+import type { IAppEvent } from 'routup';
+import type { ClientCertificateEvidence } from '../../../../../../core/index.ts';
+import { type CertificateSource } from '../../../../request/index.ts';
+export declare function extractOAuth2ClientCertificateEvidence(event: IAppEvent, source: CertificateSource): Promise<ClientCertificateEvidence | undefined>;
+//# sourceMappingURL=certificate.d.ts.map

package/dist/adapters/http/adapters/oauth2/grant-types/utils/certificate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"certificate.d.ts","sourceRoot":"","sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/certificate.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AACjF,OAAO,EACH,KAAK,iBAAiB,EAEzB,MAAM,8BAA8B,CAAC;AAEtC,wBAAsB,sCAAsC,CACxD,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,iBAAiB,GAC1B,OAAO,CAAC,yBAAyB,GAAG,SAAS,CAAC,CAMhD"}

package/dist/adapters/http/adapters/oauth2/grant-types/utils/certificate.mjs

@@ -0,0 +1,18 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { extractClientCertificateEvidence } from "../../../../request/client-certificate.mjs";
+import "../../../../request/index.mjs";
+import { OAuth2ClientError } from "@authup/specs";
+//#region src/adapters/http/adapters/oauth2/grant-types/utils/certificate.ts
+async function extractOAuth2ClientCertificateEvidence(event, source) {
+	try {
+		return await extractClientCertificateEvidence(event, source);
+	} catch {
+		throw OAuth2ClientError.invalid();
+	}
+}
+//#endregion
+export { extractOAuth2ClientCertificateEvidence };
+
+//# sourceMappingURL=certificate.mjs.map

package/dist/adapters/http/adapters/oauth2/grant-types/utils/certificate.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"certificate.mjs","names":["OAuth2ClientError","extractClientCertificateEvidence","extractOAuth2ClientCertificateEvidence","event","source","invalid"],"sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/certificate.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { OAuth2ClientError } from '@authup/specs';\nimport type { IAppEvent } from 'routup';\nimport type { ClientCertificateEvidence } from '../../../../../../core/index.ts';\nimport {\n    type CertificateSource,\n    extractClientCertificateEvidence,\n} from '../../../../request/index.ts';\n\nexport async function extractOAuth2ClientCertificateEvidence(\n    event: IAppEvent,\n    source: CertificateSource,\n): Promise<ClientCertificateEvidence | undefined> {\n    try {\n        return await extractClientCertificateEvidence(event, source);\n    } catch {\n        throw OAuth2ClientError.invalid();\n    }\n}\n"],"mappings":";;;;;;;AAeA,eAAsBE,uCAClBC,OACAC,QAAyB;CAEzB,IAAI;EACA,OAAO,MAAMH,iCAAiCE,OAAOC,MAAAA;CACzD,QAAQ;EACJ,MAAMJ,kBAAkBK,QAAO;CACnC;AACJ"}

package/dist/adapters/http/adapters/oauth2/grant-types/utils/credentials.mjs

@@ -2,8 +2,8 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { OAuth2RequestError } from "@authup/specs";
-import { AuthorizationHeaderType, parseAuthorizationHeader } from "hapic";
 import { readRequestBody } from "@routup/basic/body";
+import { AuthorizationHeaderType, parseAuthorizationHeader } from "hapic";
 //#region src/adapters/http/adapters/oauth2/grant-types/utils/credentials.ts
 /**
 * Extract client credentials from an OAuth2 token endpoint request.

package/dist/adapters/http/adapters/oauth2/grant-types/utils/guess.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guess.d.ts","sourceRoot":"","sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/guess.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAIjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,wBAAsB,6BAA6B,CAC/C,KAAK,EAAE,SAAS,GAChB,OAAO,CAAC,GAAG,gBAAgB,EAAE,GAAG,SAAS,CAAC,CAkE7C"}
+{"version":3,"file":"guess.d.ts","sourceRoot":"","sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/guess.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAIjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,wBAAsB,6BAA6B,CAC/C,KAAK,EAAE,SAAS,GAChB,OAAO,CAAC,GAAG,gBAAgB,EAAE,GAAG,SAAS,CAAC,CAyD7C"}

package/dist/adapters/http/adapters/oauth2/grant-types/utils/guess.mjs

@@ -2,9 +2,9 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { OAuth2TokenGrant } from "@authup/specs";
-import { AuthorizationHeaderType, parseAuthorizationHeader } from "hapic";
 import { readRequestBody } from "@routup/basic/body";
 import { useRequestQuery } from "@routup/basic/query";
+import { AuthorizationHeaderType, parseAuthorizationHeader } from "hapic";
 //#region src/adapters/http/adapters/oauth2/grant-types/utils/guess.ts
 async function guessOauth2GrantTypeByRequest(event) {
 	const body = await readRequestBody(event);
@@ -15,9 +15,6 @@ async function guessOauth2GrantTypeByRequest(event) {
 	const username = pick("username");
 	const password = pick("password");
 	if (username && password) return OAuth2TokenGrant.PASSWORD;
-	const robotId = pick("id");
-	const robotSecret = pick("secret");
-	if (robotId && robotSecret) return OAuth2TokenGrant.ROBOT_CREDENTIALS;
 	if (pick("refresh_token")) return OAuth2TokenGrant.REFRESH_TOKEN;
 	if (pick("code")) return OAuth2TokenGrant.AUTHORIZATION_CODE;
 	let clientId = pick("client_id");

package/dist/adapters/http/adapters/oauth2/grant-types/utils/guess.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"guess.mjs","names":["OAuth2TokenGrant","readRequestBody","useRequestQuery","AuthorizationHeaderType","parseAuthorizationHeader","guessOauth2GrantTypeByRequest","event","body","query","pick","key","grantType","validGrantTypes","Object","values","includes","username","password","PASSWORD","robotId","robotSecret","ROBOT_CREDENTIALS","refreshToken","REFRESH_TOKEN","code","AUTHORIZATION_CODE","clientId","clientSecret","headerValue","headers","get","header","type","BASIC","CLIENT_CREDENTIALS","undefined"],"sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/guess.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { OAuth2TokenGrant } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport { useRequestQuery } from '@routup/basic/query';\nimport { AuthorizationHeaderType, parseAuthorizationHeader } from 'hapic';\nimport type { IAppEvent } from 'routup';\n\nexport async function guessOauth2GrantTypeByRequest(\n    event: IAppEvent,\n) : Promise<`${OAuth2TokenGrant}` | undefined> {\n    const body = await readRequestBody(event);\n    const query = useRequestQuery(event);\n\n    const pick = (key: string): any => body?.[key] ?? query?.[key];\n\n    const grantType = pick('grant_type');\n\n    const validGrantTypes = Object.values(OAuth2TokenGrant);\n    if (validGrantTypes.includes(grantType)) {\n        return grantType;\n    }\n\n    const username = pick('username');\n    const password = pick('password');\n\n    if (username && password) {\n        return OAuth2TokenGrant.PASSWORD;\n    }\n\n    // ------------------------------------------------------------------\n\n    const robotId = pick('id');\n    const robotSecret = pick('secret');\n\n    if (robotId && robotSecret) {\n        return OAuth2TokenGrant.ROBOT_CREDENTIALS;\n    }\n\n    // ------------------------------------------------------------------\n\n    const refreshToken = pick('refresh_token');\n    if (refreshToken) {\n        return OAuth2TokenGrant.REFRESH_TOKEN;\n    }\n\n    // ------------------------------------------------------------------\n\n    const code = pick('code');\n    if (code) {\n        return OAuth2TokenGrant.AUTHORIZATION_CODE;\n    }\n\n    // ------------------------------------------------------------------\n\n    let clientId = pick('client_id');\n    let clientSecret = pick('client_secret');\n\n    if (!clientId && !clientSecret) {\n        const headerValue = event.headers.get('authorization');\n\n        if (headerValue) {\n            const header = parseAuthorizationHeader(headerValue);\n\n            if (header.type === AuthorizationHeaderType.BASIC) {\n                clientId = header.username;\n                clientSecret = header.password;\n            }\n        }\n    }\n\n    if (clientId && clientSecret) {\n        return OAuth2TokenGrant.CLIENT_CREDENTIALS;\n    }\n\n    return undefined;\n}\n"],"mappings":";;;;;;;;AAaA,eAAsBK,8BAClBC,OAAgB;CAEhB,MAAMC,OAAO,MAAMN,gBAAgBK,KAAAA;CACnC,MAAME,QAAQN,gBAAgBI,KAAAA;CAE9B,MAAMG,QAAQC,QAAqBH,OAAOG,QAAQF,QAAQE;CAE1D,MAAMC,YAAYF,KAAK,YAAA;CAGvB,IADwBI,OAAOC,OAAOd,gBAClCY,CAAAA,CAAgBG,SAASJ,SAAAA,GACzB,OAAOA;CAGX,MAAMK,WAAWP,KAAK,UAAA;CACtB,MAAMQ,WAAWR,KAAK,UAAA;CAEtB,IAAIO,YAAYC,UACZ,OAAOjB,iBAAiBkB;CAK5B,MAAMC,UAAUV,KAAK,IAAA;CACrB,MAAMW,cAAcX,KAAK,QAAA;CAEzB,IAAIU,WAAWC,aACX,OAAOpB,iBAAiBqB;CAM5B,IADqBZ,KAAK,eACtBa,GACA,OAAOtB,iBAAiBuB;CAM5B,IADad,KAAK,MACde,GACA,OAAOxB,iBAAiByB;CAK5B,IAAIC,WAAWjB,KAAK,WAAA;CACpB,IAAIkB,eAAelB,KAAK,eAAA;CAExB,IAAI,CAACiB,YAAY,CAACC,cAAc;EAC5B,MAAMC,cAActB,MAAMuB,QAAQC,IAAI,eAAA;EAEtC,IAAIF,aAAa;GACb,MAAMG,SAAS3B,yBAAyBwB,WAAAA;GAExC,IAAIG,OAAOC,SAAS7B,wBAAwB8B,OAAO;IAC/CP,WAAWK,OAAOf;IAClBW,eAAeI,OAAOd;GAC1B;EACJ;CACJ;CAEA,IAAIS,YAAYC,cACZ,OAAO3B,iBAAiBkC;AAIhC"}
+{"version":3,"file":"guess.mjs","names":["OAuth2TokenGrant","readRequestBody","useRequestQuery","AuthorizationHeaderType","parseAuthorizationHeader","guessOauth2GrantTypeByRequest","event","body","query","pick","key","grantType","validGrantTypes","Object","values","includes","username","password","PASSWORD","refreshToken","REFRESH_TOKEN","code","AUTHORIZATION_CODE","clientId","clientSecret","headerValue","headers","get","header","type","BASIC","CLIENT_CREDENTIALS","undefined"],"sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/guess.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { OAuth2TokenGrant } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport { useRequestQuery } from '@routup/basic/query';\nimport { AuthorizationHeaderType, parseAuthorizationHeader } from 'hapic';\nimport type { IAppEvent } from 'routup';\n\nexport async function guessOauth2GrantTypeByRequest(\n    event: IAppEvent,\n) : Promise<`${OAuth2TokenGrant}` | undefined> {\n    const body = await readRequestBody(event);\n    const query = useRequestQuery(event);\n\n    const pick = (key: string): any => body?.[key] ?? query?.[key];\n\n    const grantType = pick('grant_type');\n\n    const validGrantTypes = Object.values(OAuth2TokenGrant);\n    if (validGrantTypes.includes(grantType)) {\n        return grantType;\n    }\n\n    const username = pick('username');\n    const password = pick('password');\n\n    if (username && password) {\n        return OAuth2TokenGrant.PASSWORD;\n    }\n\n    // ------------------------------------------------------------------\n\n    const refreshToken = pick('refresh_token');\n    if (refreshToken) {\n        return OAuth2TokenGrant.REFRESH_TOKEN;\n    }\n\n    // ------------------------------------------------------------------\n\n    const code = pick('code');\n    if (code) {\n        return OAuth2TokenGrant.AUTHORIZATION_CODE;\n    }\n\n    // ------------------------------------------------------------------\n\n    let clientId = pick('client_id');\n    let clientSecret = pick('client_secret');\n\n    if (!clientId && !clientSecret) {\n        const headerValue = event.headers.get('authorization');\n\n        if (headerValue) {\n            const header = parseAuthorizationHeader(headerValue);\n\n            if (header.type === AuthorizationHeaderType.BASIC) {\n                clientId = header.username;\n                clientSecret = header.password;\n            }\n        }\n    }\n\n    if (clientId && clientSecret) {\n        return OAuth2TokenGrant.CLIENT_CREDENTIALS;\n    }\n\n    return undefined;\n}\n"],"mappings":";;;;;;;;AAaA,eAAsBK,8BAClBC,OAAgB;CAEhB,MAAMC,OAAO,MAAMN,gBAAgBK,KAAAA;CACnC,MAAME,QAAQN,gBAAgBI,KAAAA;CAE9B,MAAMG,QAAQC,QAAqBH,OAAOG,QAAQF,QAAQE;CAE1D,MAAMC,YAAYF,KAAK,YAAA;CAGvB,IADwBI,OAAOC,OAAOd,gBAClCY,CAAAA,CAAgBG,SAASJ,SAAAA,GACzB,OAAOA;CAGX,MAAMK,WAAWP,KAAK,UAAA;CACtB,MAAMQ,WAAWR,KAAK,UAAA;CAEtB,IAAIO,YAAYC,UACZ,OAAOjB,iBAAiBkB;CAM5B,IADqBT,KAAK,eACtBU,GACA,OAAOnB,iBAAiBoB;CAM5B,IADaX,KAAK,MACdY,GACA,OAAOrB,iBAAiBsB;CAK5B,IAAIC,WAAWd,KAAK,WAAA;CACpB,IAAIe,eAAef,KAAK,eAAA;CAExB,IAAI,CAACc,YAAY,CAACC,cAAc;EAC5B,MAAMC,cAAcnB,MAAMoB,QAAQC,IAAI,eAAA;EAEtC,IAAIF,aAAa;GACb,MAAMG,SAASxB,yBAAyBqB,WAAAA;GAExC,IAAIG,OAAOC,SAAS1B,wBAAwB2B,OAAO;IAC/CP,WAAWK,OAAOZ;IAClBQ,eAAeI,OAAOX;GAC1B;EACJ;CACJ;CAEA,IAAIM,YAAYC,cACZ,OAAOxB,iBAAiB+B;AAIhC"}

package/dist/adapters/http/adapters/oauth2/grant-types/utils/index.d.ts

@@ -1,3 +1,4 @@
+export * from './certificate.ts';
 export * from './credentials.ts';
 export * from './guess.ts';
 export * from './realm.ts';

package/dist/adapters/http/adapters/oauth2/grant-types/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/index.ts"],"names":[],"mappings":"AAOA,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/index.ts"],"names":[],"mappings":"AAOA,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC"}

package/dist/adapters/http/adapters/oauth2/grant-types/utils/index.mjs

@@ -1,7 +1,8 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { extractOAuth2ClientCertificateEvidence } from "./certificate.mjs";
 import { extractClientCredentialsFromRequest, readStringField } from "./credentials.mjs";
 import { guessOauth2GrantTypeByRequest } from "./guess.mjs";
 import { readRealmHint } from "./realm.mjs";
-export { extractClientCredentialsFromRequest, guessOauth2GrantTypeByRequest, readRealmHint, readStringField };
+export { extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, guessOauth2GrantTypeByRequest, readRealmHint, readStringField };

package/dist/adapters/http/adapters/oauth2/index.mjs

@@ -3,6 +3,7 @@ import "node:url";
 import.meta.url;
 import { HTTPOAuth2Authorizer } from "./authorization/module.mjs";
 import "./authorization/index.mjs";
+import { extractOAuth2ClientCertificateEvidence } from "./grant-types/utils/certificate.mjs";
 import { extractClientCredentialsFromRequest, readStringField } from "./grant-types/utils/credentials.mjs";
 import { guessOauth2GrantTypeByRequest } from "./grant-types/utils/guess.mjs";
 import { readRealmHint } from "./grant-types/utils/realm.mjs";
@@ -11,6 +12,5 @@ import { HTTPClientCredentialsGrant } from "./grant-types/client-credentials.mjs
 import { HTTPOAuth2IdentityGrantType } from "./grant-types/identity.mjs";
 import { HTTPPasswordGrant } from "./grant-types/password.mjs";
 import { HTTPOAuth2RefreshTokenGrant } from "./grant-types/refresh_token.mjs";
-import { HTTPRobotCredentialsGrant } from "./grant-types/robot-credentials.mjs";
 import "./grant-types/index.mjs";
-export { HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, extractClientCredentialsFromRequest, guessOauth2GrantTypeByRequest, readRealmHint, readStringField };
+export { HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, guessOauth2GrantTypeByRequest, readRealmHint, readStringField };

package/dist/adapters/http/controllers/entities/client-permission/utils/validation.mjs

@@ -10,9 +10,9 @@ import { z } from "zod";
 var ClientPermissionRequestValidator = class extends Container {
 	initialize() {
 		super.initialize();
-		this.mount("client_id", { group: RequestHandlerOperation.CREATE }, createValidator(z.uuid()));
-		this.mount("permission_id", { group: RequestHandlerOperation.CREATE }, createValidator(z.uuid()));
-		this.mount("policy_id", { optional: true }, createValidator(z.uuid().nullable()));
+		this.mount("clientId", { group: RequestHandlerOperation.CREATE }, createValidator(z.uuid()));
+		this.mount("permissionId", { group: RequestHandlerOperation.CREATE }, createValidator(z.uuid()));
+		this.mount("policyId", { optional: true }, createValidator(z.uuid().nullable()));
 	}
 };
 //#endregion

package/dist/adapters/http/controllers/entities/client-permission/utils/validation.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"validation.mjs","names":["createValidator","Container","z","RequestHandlerOperation","ClientPermissionRequestValidator","initialize","mount","group","CREATE","uuid","optional","nullable"],"sources":["../../../../../../../src/adapters/http/controllers/entities/client-permission/utils/validation.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createValidator } from '@validup/zod';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport type { ClientPermissionEntity } from '../../../../../database/domains/index.ts';\nimport { RequestHandlerOperation } from '../../../../request/index.ts';\n\nexport class ClientPermissionRequestValidator extends Container<\n    ClientPermissionEntity\n> {\n    protected initialize() {\n        super.initialize();\n\n        this.mount(\n            'client_id',\n            { group: RequestHandlerOperation.CREATE },\n            createValidator(z.uuid()),\n        );\n\n        this.mount(\n            'permission_id',\n            { group: RequestHandlerOperation.CREATE },\n            createValidator(z.uuid()),\n        );\n\n        this.mount(\n            'policy_id',\n            { optional: true },\n            createValidator(z.uuid().nullable()),\n        );\n    }\n}\n"],"mappings":";;;;;;;;;AAaA,IAAaI,mCAAb,cAAsDH,UAAAA;CAGxCI,aAAa;EACnB,MAAMA,WAAAA;EAEN,KAAKC,MACD,aACA,EAAEC,OAAOJ,wBAAwBK,OAAO,GACxCR,gBAAgBE,EAAEO,KAAI,CAAA,CAAA;EAG1B,KAAKH,MACD,iBACA,EAAEC,OAAOJ,wBAAwBK,OAAO,GACxCR,gBAAgBE,EAAEO,KAAI,CAAA,CAAA;EAG1B,KAAKH,MACD,aACA,EAAEI,UAAU,KAAK,GACjBV,gBAAgBE,EAAEO,KAAI,CAAA,CAAGE,SAAQ,CAAA,CAAA;CAEzC;AACJ"}
+{"version":3,"file":"validation.mjs","names":["createValidator","Container","z","RequestHandlerOperation","ClientPermissionRequestValidator","initialize","mount","group","CREATE","uuid","optional","nullable"],"sources":["../../../../../../../src/adapters/http/controllers/entities/client-permission/utils/validation.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createValidator } from '@validup/zod';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport type { ClientPermissionEntity } from '../../../../../database/domains/index.ts';\nimport { RequestHandlerOperation } from '../../../../request/index.ts';\n\nexport class ClientPermissionRequestValidator extends Container<\n    ClientPermissionEntity\n> {\n    protected initialize() {\n        super.initialize();\n\n        this.mount(\n            'clientId',\n            { group: RequestHandlerOperation.CREATE },\n            createValidator(z.uuid()),\n        );\n\n        this.mount(\n            'permissionId',\n            { group: RequestHandlerOperation.CREATE },\n            createValidator(z.uuid()),\n        );\n\n        this.mount(\n            'policyId',\n            { optional: true },\n            createValidator(z.uuid().nullable()),\n        );\n    }\n}\n"],"mappings":";;;;;;;;;AAaA,IAAaI,mCAAb,cAAsDH,UAAAA;CAGxCI,aAAa;EACnB,MAAMA,WAAAA;EAEN,KAAKC,MACD,YACA,EAAEC,OAAOJ,wBAAwBK,OAAO,GACxCR,gBAAgBE,EAAEO,KAAI,CAAA,CAAA;EAG1B,KAAKH,MACD,gBACA,EAAEC,OAAOJ,wBAAwBK,OAAO,GACxCR,gBAAgBE,EAAEO,KAAI,CAAA,CAAA;EAG1B,KAAKH,MACD,YACA,EAAEI,UAAU,KAAK,GACjBV,gBAAgBE,EAAEO,KAAI,CAAA,CAAGE,SAAQ,CAAA,CAAA;CAEzC;AACJ"}

package/dist/adapters/http/controllers/entities/client-role/utils/validation.mjs

@@ -10,8 +10,8 @@ import { z } from "zod";
 var ClientRoleRequestValidator = class extends Container {
 	initialize() {
 		super.initialize();
-		this.mount("client_id", { group: RequestHandlerOperation.CREATE }, createValidator(z.uuid()));
-		this.mount("role_id", { group: RequestHandlerOperation.CREATE }, createValidator(z.uuid()));
+		this.mount("clientId", { group: RequestHandlerOperation.CREATE }, createValidator(z.uuid()));
+		this.mount("roleId", { group: RequestHandlerOperation.CREATE }, createValidator(z.uuid()));
 	}
 };
 //#endregion

package/dist/adapters/http/controllers/entities/client-role/utils/validation.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"validation.mjs","names":["createValidator","Container","z","RequestHandlerOperation","ClientRoleRequestValidator","initialize","mount","group","CREATE","uuid"],"sources":["../../../../../../../src/adapters/http/controllers/entities/client-role/utils/validation.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createValidator } from '@validup/zod';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport type { ClientRole } from '@authup/core-kit';\nimport { RequestHandlerOperation } from '../../../../request/index.ts';\n\nexport class ClientRoleRequestValidator extends Container<\n    ClientRole\n> {\n    protected initialize() {\n        super.initialize();\n\n        this.mount(\n            'client_id',\n            { group: RequestHandlerOperation.CREATE },\n            createValidator(z.uuid()),\n        );\n\n        this.mount(\n            'role_id',\n            { group: RequestHandlerOperation.CREATE },\n            createValidator(z.uuid()),\n        );\n    }\n}\n"],"mappings":";;;;;;;;;AAaA,IAAaI,6BAAb,cAAgDH,UAAAA;CAGlCI,aAAa;EACnB,MAAMA,WAAAA;EAEN,KAAKC,MACD,aACA,EAAEC,OAAOJ,wBAAwBK,OAAO,GACxCR,gBAAgBE,EAAEO,KAAI,CAAA,CAAA;EAG1B,KAAKH,MACD,WACA,EAAEC,OAAOJ,wBAAwBK,OAAO,GACxCR,gBAAgBE,EAAEO,KAAI,CAAA,CAAA;CAE9B;AACJ"}
+{"version":3,"file":"validation.mjs","names":["createValidator","Container","z","RequestHandlerOperation","ClientRoleRequestValidator","initialize","mount","group","CREATE","uuid"],"sources":["../../../../../../../src/adapters/http/controllers/entities/client-role/utils/validation.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createValidator } from '@validup/zod';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport type { ClientRole } from '@authup/core-kit';\nimport { RequestHandlerOperation } from '../../../../request/index.ts';\n\nexport class ClientRoleRequestValidator extends Container<\n    ClientRole\n> {\n    protected initialize() {\n        super.initialize();\n\n        this.mount(\n            'clientId',\n            { group: RequestHandlerOperation.CREATE },\n            createValidator(z.uuid()),\n        );\n\n        this.mount(\n            'roleId',\n            { group: RequestHandlerOperation.CREATE },\n            createValidator(z.uuid()),\n        );\n    }\n}\n"],"mappings":";;;;;;;;;AAaA,IAAaI,6BAAb,cAAgDH,UAAAA;CAGlCI,aAAa;EACnB,MAAMA,WAAAA;EAEN,KAAKC,MACD,YACA,EAAEC,OAAOJ,wBAAwBK,OAAO,GACxCR,gBAAgBE,EAAEO,KAAI,CAAA,CAAA;EAG1B,KAAKH,MACD,UACA,EAAEC,OAAOJ,wBAAwBK,OAAO,GACxCR,gBAAgBE,EAAEO,KAAI,CAAA,CAAA;CAE9B;AACJ"}

package/dist/adapters/http/controllers/entities/client-scope/utils/validator.mjs

@@ -10,8 +10,8 @@ import { z } from "zod";
 var ClientScopeRequestValidator = class extends Container {
 	initialize() {
 		super.initialize();
-		this.mount("client_id", { group: RequestHandlerOperation.CREATE }, createValidator(z.uuid()));
-		this.mount("scope_id", { group: RequestHandlerOperation.CREATE }, createValidator(z.uuid()));
+		this.mount("clientId", { group: RequestHandlerOperation.CREATE }, createValidator(z.uuid()));
+		this.mount("scopeId", { group: RequestHandlerOperation.CREATE }, createValidator(z.uuid()));
 	}
 };
 //#endregion

package/dist/adapters/http/controllers/entities/client-scope/utils/validator.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"validator.mjs","names":["createValidator","Container","z","RequestHandlerOperation","ClientScopeRequestValidator","initialize","mount","group","CREATE","uuid"],"sources":["../../../../../../../src/adapters/http/controllers/entities/client-scope/utils/validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createValidator } from '@validup/zod';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport type { ClientScopeEntity } from '../../../../../database/domains/index.ts';\nimport { RequestHandlerOperation } from '../../../../request/index.ts';\n\nexport class ClientScopeRequestValidator extends Container<ClientScopeEntity> {\n    protected initialize() {\n        super.initialize();\n\n        this.mount(\n            'client_id',\n            { group: RequestHandlerOperation.CREATE },\n            createValidator(z.uuid()),\n        );\n\n        this.mount(\n            'scope_id',\n            { group: RequestHandlerOperation.CREATE },\n            createValidator(z.uuid()),\n        );\n    }\n}\n"],"mappings":";;;;;;;;;AAaA,IAAaI,8BAAb,cAAiDH,UAAAA;CACnCI,aAAa;EACnB,MAAMA,WAAAA;EAEN,KAAKC,MACD,aACA,EAAEC,OAAOJ,wBAAwBK,OAAO,GACxCR,gBAAgBE,EAAEO,KAAI,CAAA,CAAA;EAG1B,KAAKH,MACD,YACA,EAAEC,OAAOJ,wBAAwBK,OAAO,GACxCR,gBAAgBE,EAAEO,KAAI,CAAA,CAAA;CAE9B;AACJ"}
+{"version":3,"file":"validator.mjs","names":["createValidator","Container","z","RequestHandlerOperation","ClientScopeRequestValidator","initialize","mount","group","CREATE","uuid"],"sources":["../../../../../../../src/adapters/http/controllers/entities/client-scope/utils/validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createValidator } from '@validup/zod';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport type { ClientScopeEntity } from '../../../../../database/domains/index.ts';\nimport { RequestHandlerOperation } from '../../../../request/index.ts';\n\nexport class ClientScopeRequestValidator extends Container<ClientScopeEntity> {\n    protected initialize() {\n        super.initialize();\n\n        this.mount(\n            'clientId',\n            { group: RequestHandlerOperation.CREATE },\n            createValidator(z.uuid()),\n        );\n\n        this.mount(\n            'scopeId',\n            { group: RequestHandlerOperation.CREATE },\n            createValidator(z.uuid()),\n        );\n    }\n}\n"],"mappings":";;;;;;;;;AAaA,IAAaI,8BAAb,cAAiDH,UAAAA;CACnCI,aAAa;EACnB,MAAMA,WAAAA;EAEN,KAAKC,MACD,YACA,EAAEC,OAAOJ,wBAAwBK,OAAO,GACxCR,gBAAgBE,EAAEO,KAAI,CAAA,CAAA;EAG1B,KAAKH,MACD,WACA,EAAEC,OAAOJ,wBAAwBK,OAAO,GACxCR,gBAAgBE,EAAEO,KAAI,CAAA,CAAA;CAE9B;AACJ"}

package/dist/adapters/http/controllers/entities/consent/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/consent/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC"}

package/dist/adapters/http/controllers/entities/consent/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { ConsentController } from "./module.mjs";
+export { ConsentController };

package/dist/adapters/http/controllers/entities/consent/module.d.ts

@@ -0,0 +1,15 @@
+import type { Consent } from '@authup/core-kit';
+import type { IAppEvent } from 'routup';
+import type { EntityCollectionResponse } from '@authup/core-http-kit';
+import type { IConsentService } from '../../../../../core/index.ts';
+export type ConsentControllerContext = {
+    service: IConsentService;
+};
+export declare class ConsentController {
+    protected service: IConsentService;
+    constructor(ctx: ConsentControllerContext);
+    getMany(event: IAppEvent): Promise<EntityCollectionResponse<Consent>>;
+    getOne(id: string, event: IAppEvent): Promise<Consent>;
+    drop(id: string, event: IAppEvent): Promise<Consent>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/controllers/entities/consent/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/consent/module.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAIpE,MAAM,MAAM,wBAAwB,GAAG;IACnC,OAAO,EAAE,eAAe,CAAC;CAC5B,CAAC;AAEF,qBAEa,iBAAiB;IAC1B,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC;gBAEvB,GAAG,EAAE,wBAAwB;IAKnC,OAAO,CACG,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAcvC,MAAM,CACK,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,OAAO,CAAC;IAOb,IAAI,CACO,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,OAAO,CAAC;CAQtB"}

package/dist/adapters/http/controllers/entities/{robot-role → consent}/module.mjs

@@ -2,12 +2,13 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { buildActorContext } from "../../../request/helpers/actor.mjs";
+import { getRequestRealmID } from "../../../request/helpers/realm-id.mjs";
 import "../../../request/index.mjs";
 import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
 import "../../../middleware/index.mjs";
 import { useRequestQuery } from "@routup/basic/query";
-import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DTags } from "@routup/decorators";
-//#region src/adapters/http/controllers/entities/robot-role/module.ts
+import { DContext, DController, DDelete, DGet, DPath, DTags } from "@routup/decorators";
+//#region src/adapters/http/controllers/entities/consent/module.ts
 function _ts_decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
 	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -22,32 +23,26 @@ function _ts_param(paramIndex, decorator) {
 		decorator(target, key, paramIndex);
 	};
 }
-var RobotRoleController = class {
+var ConsentController = class {
 	service;
 	constructor(ctx) {
 		this.service = ctx.service;
 	}
 	async getMany(event) {
 		const actor = buildActorContext(event);
-		const { data, meta } = await this.service.getMany(useRequestQuery(event), actor);
+		const { data, meta } = await this.service.getMany(useRequestQuery(event), actor, { realmId: getRequestRealmID(event) });
 		return {
 			data,
 			meta
 		};
 	}
-	async add(data, event) {
-		const actor = buildActorContext(event);
-		const entity = await this.service.create(data, actor);
-		event.response.status = 201;
-		return entity;
-	}
 	async getOne(id, event) {
 		const actor = buildActorContext(event);
-		return await this.service.getOne(id, actor);
+		return this.service.getOne(id, actor, { realmId: getRequestRealmID(event) });
 	}
 	async drop(id, event) {
 		const actor = buildActorContext(event);
-		const entity = await this.service.delete(id, actor);
+		const entity = await this.service.delete(id, actor, { realmId: getRequestRealmID(event) });
 		event.response.status = 202;
 		return entity;
 	}
@@ -58,15 +53,7 @@ _ts_decorate([
 	_ts_metadata("design:type", Function),
 	_ts_metadata("design:paramtypes", [typeof IAppEvent === "undefined" ? Object : IAppEvent]),
 	_ts_metadata("design:returntype", Promise)
-], RobotRoleController.prototype, "getMany", null);
-_ts_decorate([
-	DPost("", [ForceLoggedInMiddleware]),
-	_ts_param(0, DBody()),
-	_ts_param(1, DContext()),
-	_ts_metadata("design:type", Function),
-	_ts_metadata("design:paramtypes", [typeof RobotRoleCreatePayload === "undefined" ? Object : RobotRoleCreatePayload, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
-	_ts_metadata("design:returntype", Promise)
-], RobotRoleController.prototype, "add", null);
+], ConsentController.prototype, "getMany", null);
 _ts_decorate([
 	DGet("/:id", [ForceLoggedInMiddleware]),
 	_ts_param(0, DPath("id")),
@@ -74,7 +61,7 @@ _ts_decorate([
 	_ts_metadata("design:type", Function),
 	_ts_metadata("design:paramtypes", [String, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
 	_ts_metadata("design:returntype", Promise)
-], RobotRoleController.prototype, "getOne", null);
+], ConsentController.prototype, "getOne", null);
 _ts_decorate([
 	DDelete("/:id", [ForceLoggedInMiddleware]),
 	_ts_param(0, DPath("id")),
@@ -82,14 +69,14 @@ _ts_decorate([
 	_ts_metadata("design:type", Function),
 	_ts_metadata("design:paramtypes", [String, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
 	_ts_metadata("design:returntype", Promise)
-], RobotRoleController.prototype, "drop", null);
-RobotRoleController = _ts_decorate([
-	DTags("robot"),
-	DController("/robot-roles"),
+], ConsentController.prototype, "drop", null);
+ConsentController = _ts_decorate([
+	DTags("consent"),
+	DController(["/consents", "/realms/:realmId/consents"]),
 	_ts_metadata("design:type", Function),
-	_ts_metadata("design:paramtypes", [typeof RobotRoleControllerContext === "undefined" ? Object : RobotRoleControllerContext])
-], RobotRoleController);
+	_ts_metadata("design:paramtypes", [typeof ConsentControllerContext === "undefined" ? Object : ConsentControllerContext])
+], ConsentController);
 //#endregion
-export { RobotRoleController };
+export { ConsentController };
 
 //# sourceMappingURL=module.mjs.map

package/dist/adapters/http/controllers/entities/consent/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["DContext","DController","DDelete","DGet","DPath","DTags","useRequestQuery","ForceLoggedInMiddleware","buildActorContext","getRequestRealmID","ConsentController","service","ctx","getMany","event","actor","data","meta","realmId","getOne","id","drop","entity","delete","response","status"],"sources":["../../../../../../src/adapters/http/controllers/entities/consent/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DContext,\n    DController,\n    DDelete,\n    DGet,\n    DPath,\n    DTags,\n} from '@routup/decorators';\nimport type { Consent } from '@authup/core-kit';\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { EntityCollectionResponse } from '@authup/core-http-kit';\nimport type { IConsentService } from '../../../../../core/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { buildActorContext, getRequestRealmID } from '../../../request/index.ts';\n\nexport type ConsentControllerContext = {\n    service: IConsentService,\n};\n\n@DTags('consent')\n@DController(['/consents', '/realms/:realmId/consents'])\nexport class ConsentController {\n    protected service: IConsentService;\n\n    constructor(ctx: ConsentControllerContext) {\n        this.service = ctx.service;\n    }\n\n    @DGet('', [ForceLoggedInMiddleware])\n    async getMany(\n        @DContext() event: IAppEvent,\n    ): Promise<EntityCollectionResponse<Consent>> {\n        const actor = buildActorContext(event);\n        const {\n            data,\n            meta,\n        } = await this.service.getMany(useRequestQuery(event), actor, { realmId: getRequestRealmID(event) });\n\n        return {\n            data,\n            meta,\n        };\n    }\n\n    @DGet('/:id', [ForceLoggedInMiddleware])\n    async getOne(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ): Promise<Consent> {\n        const actor = buildActorContext(event);\n\n        return this.service.getOne(id, actor, { realmId: getRequestRealmID(event) });\n    }\n\n    @DDelete('/:id', [ForceLoggedInMiddleware])\n    async drop(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ): Promise<Consent> {\n        const actor = buildActorContext(event);\n\n        const entity = await this.service.delete(id, actor, { realmId: getRequestRealmID(event) });\n\n        event.response.status = 202;\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,IAAaU,oBAAb,MAAaA;CACCC;CAEV,YAAYC,KAA+B;EACvC,KAAKD,UAAUC,IAAID;CACvB;CAEA,MACME,QACF,OAC0C;EAC1C,MAAME,QAAQP,kBAAkBM,KAAAA;EAChC,MAAM,EACFE,MACAC,SACA,MAAM,KAAKN,QAAQE,QAAQP,gBAAgBQ,KAAAA,GAAQC,OAAO,EAAEG,SAAST,kBAAkBK,KAAAA,EAAO,CAAA;EAElG,OAAO;GACHE;GACAC;EACJ;CACJ;CAEA,MACME,OACF,IACA,OACgB;EAChB,MAAMJ,QAAQP,kBAAkBM,KAAAA;EAEhC,OAAO,KAAKH,QAAQQ,OAAOC,IAAIL,OAAO,EAAEG,SAAST,kBAAkBK,KAAAA,EAAO,CAAA;CAC9E;CAEA,MACMO,KACF,IACA,OACgB;EAChB,MAAMN,QAAQP,kBAAkBM,KAAAA;EAEhC,MAAMQ,SAAS,MAAM,KAAKX,QAAQY,OAAOH,IAAIL,OAAO,EAAEG,SAAST,kBAAkBK,KAAAA,EAAO,CAAA;EAExFA,MAAMU,SAASC,SAAS;EACxB,OAAOH;CACX;AACJ;;WAtCef,uBAAAA,CAAAA;;;;;;;eAgBIA,uBAAAA,CAAAA;;;;;;;;kBAUGA,uBAAAA,CAAAA;;;;;;;;;cAlCR,aAAa,2BAAA,CAAA"}

package/dist/adapters/http/controllers/entities/event/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/event/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC"}

package/dist/adapters/http/controllers/entities/event/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { EventController } from "./module.mjs";
+export { EventController };

package/dist/adapters/http/controllers/entities/event/module.d.ts

@@ -0,0 +1,14 @@
+import type { Event } from '@authup/core-kit';
+import type { IAppEvent } from 'routup';
+import type { EntityCollectionResponse } from '@authup/core-http-kit';
+import type { IEventService } from '../../../../../core/index.ts';
+export type EventControllerContext = {
+    service: IEventService;
+};
+export declare class EventController {
+    protected service: IEventService;
+    constructor(ctx: EventControllerContext);
+    getMany(event: IAppEvent): Promise<EntityCollectionResponse<Event>>;
+    getOne(id: string, event: IAppEvent): Promise<Event>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/controllers/entities/event/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/event/module.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAIlE,MAAM,MAAM,sBAAsB,GAAG;IACjC,OAAO,EAAE,aAAa,CAAC;CAC1B,CAAC;AAIF,qBAEa,eAAe;IACxB,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC;gBAErB,GAAG,EAAE,sBAAsB;IAKjC,OAAO,CACG,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAkBrC,MAAM,CACK,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,KAAK,CAAC;CAKpB"}

package/dist/adapters/http/controllers/entities/event/module.mjs

@@ -0,0 +1,68 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { buildActorContext } from "../../../request/helpers/actor.mjs";
+import { getRequestRealmID } from "../../../request/helpers/realm-id.mjs";
+import "../../../request/index.mjs";
+import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
+import "../../../middleware/index.mjs";
+import { useRequestQuery } from "@routup/basic/query";
+import { DContext, DController, DGet, DPath, DTags } from "@routup/decorators";
+//#region src/adapters/http/controllers/entities/event/module.ts
+function _ts_decorate(decorators, target, key, desc) {
+	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+	return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(k, v) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+function _ts_param(paramIndex, decorator) {
+	return function(target, key) {
+		decorator(target, key, paramIndex);
+	};
+}
+var EventController = class {
+	service;
+	constructor(ctx) {
+		this.service = ctx.service;
+	}
+	async getMany(event) {
+		const actor = buildActorContext(event);
+		const { data, meta } = await this.service.getMany(useRequestQuery(event), actor, { realmId: getRequestRealmID(event) });
+		return {
+			data,
+			meta
+		};
+	}
+	async getOne(id, event) {
+		const actor = buildActorContext(event);
+		return this.service.getOne(id, actor, { realmId: getRequestRealmID(event) });
+	}
+};
+_ts_decorate([
+	DGet("", [ForceLoggedInMiddleware]),
+	_ts_param(0, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], EventController.prototype, "getMany", null);
+_ts_decorate([
+	DGet("/:id", [ForceLoggedInMiddleware]),
+	_ts_param(0, DPath("id")),
+	_ts_param(1, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [String, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], EventController.prototype, "getOne", null);
+EventController = _ts_decorate([
+	DTags("event"),
+	DController(["/events", "/realms/:realmId/events"]),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof EventControllerContext === "undefined" ? Object : EventControllerContext])
+], EventController);
+//#endregion
+export { EventController };
+
+//# sourceMappingURL=module.mjs.map

package/dist/adapters/http/controllers/entities/event/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["DContext","DController","DGet","DPath","DTags","useRequestQuery","ForceLoggedInMiddleware","buildActorContext","getRequestRealmID","EventController","service","ctx","getMany","event","actor","data","meta","realmId","getOne","id"],"sources":["../../../../../../src/adapters/http/controllers/entities/event/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPath,\n    DTags,\n} from '@routup/decorators';\nimport type { Event } from '@authup/core-kit';\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { EntityCollectionResponse } from '@authup/core-http-kit';\nimport type { IEventService } from '../../../../../core/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { buildActorContext, getRequestRealmID } from '../../../request/index.ts';\n\nexport type EventControllerContext = {\n    service: IEventService,\n};\n\n// Read-only surface — the log is append-only: writes happen internally via\n// IEventService.record(), pruning is the retention sweep's job.\n@DTags('event')\n@DController(['/events', '/realms/:realmId/events'])\nexport class EventController {\n    protected service: IEventService;\n\n    constructor(ctx: EventControllerContext) {\n        this.service = ctx.service;\n    }\n\n    @DGet('', [ForceLoggedInMiddleware])\n    async getMany(\n        @DContext() event: IAppEvent,\n    ): Promise<EntityCollectionResponse<Event>> {\n        const actor = buildActorContext(event);\n        const {\n            data,\n            meta,\n        } = await this.service.getMany(\n            useRequestQuery(event),\n            actor,\n            { realmId: getRequestRealmID(event) },\n        );\n\n        return {\n            data,\n            meta,\n        };\n    }\n\n    @DGet('/:id', [ForceLoggedInMiddleware])\n    async getOne(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ): Promise<Event> {\n        const actor = buildActorContext(event);\n\n        return this.service.getOne(id, actor, { realmId: getRequestRealmID(event) });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,IAAaS,kBAAb,MAAaA;CACCC;CAEV,YAAYC,KAA6B;EACrC,KAAKD,UAAUC,IAAID;CACvB;CAEA,MACME,QACF,OACwC;EACxC,MAAME,QAAQP,kBAAkBM,KAAAA;EAChC,MAAM,EACFE,MACAC,SACA,MAAM,KAAKN,QAAQE,QACnBP,gBAAgBQ,KAAAA,GAChBC,OACA,EAAEG,SAAST,kBAAkBK,KAAAA,EAAO,CAAA;EAGxC,OAAO;GACHE;GACAC;EACJ;CACJ;CAEA,MACME,OACF,IACA,OACc;EACd,MAAMJ,QAAQP,kBAAkBM,KAAAA;EAEhC,OAAO,KAAKH,QAAQQ,OAAOC,IAAIL,OAAO,EAAEG,SAAST,kBAAkBK,KAAAA,EAAO,CAAA;CAC9E;AACJ;;WA7BeP,uBAAAA,CAAAA;;;;;;;eAoBIA,uBAAAA,CAAAA;;;;;;;;;cA5BL,WAAW,yBAAA,CAAA"}

package/dist/adapters/http/controllers/entities/identity-provider/module.d.ts

@@ -1,18 +1,20 @@
 import type { IAppEvent } from 'routup';
 import type { IdentityProvider } from '@authup/core-kit';
 import type { EntityCollectionResponse, IdentityProviderCreatePayload, IdentityProviderSavePayload, IdentityProviderUpdatePayload } from '@authup/core-http-kit';
-import type { IIdentityProviderAccountManager, IIdentityProviderRepository, IOAuth2AuthorizationCodeIssuer, IOAuth2AuthorizationCodeRequestVerifier, IOAuth2AuthorizationStateManager, IRealmRepository } from '../../../../../core/index.ts';
+import type { IIdentityProviderAccountManager, IIdentityProviderRepository, IOAuth2AccessPolicyEvaluator, IOAuth2AuthorizationCodeIssuer, IOAuth2AuthorizationCodeRequestVerifier, IOAuth2AuthorizationStateManager, IOAuth2ClientRepository, IRealmRepository } from '../../../../../core/index.ts';
 import { OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';
 import type { IdentityProviderControllerContext, IdentityProviderControllerOptions } from './types.ts';
 export declare class IdentityProviderController {
     protected options: IdentityProviderControllerOptions;
     protected repository: IIdentityProviderRepository;
     protected realmRepository: IRealmRepository;
+    protected clientRepository: IOAuth2ClientRepository;
     protected accountManager: IIdentityProviderAccountManager;
     protected codeRequestVerifier: IOAuth2AuthorizationCodeRequestVerifier;
     protected codeRequestValidator: OAuth2AuthorizationCodeRequestValidator;
     protected stateManager: IOAuth2AuthorizationStateManager;
     protected codeIssuer: IOAuth2AuthorizationCodeIssuer;
+    protected accessPolicyEvaluator?: IOAuth2AccessPolicyEvaluator;
     constructor(ctx: IdentityProviderControllerContext);
     getProviders(event: IAppEvent): Promise<EntityCollectionResponse<IdentityProvider>>;
     getProvider(id: string, event: IAppEvent): Promise<IdentityProvider>;
@@ -23,6 +25,7 @@ export declare class IdentityProviderController {
     authorizeOut(_id: string, event: IAppEvent): Promise<Response>;
     authorizeIn(_id: string, event: IAppEvent): Promise<Response>;
     private write;
+    private buildHostedAuthorizeURL;
     private resolve;
     private saveAuthorizationState;
     private verifyAuthorizationState;