@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.54

package/dist/adapters/http/controllers/entities/user-authenticator/module.mjs

@@ -0,0 +1,154 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { useRequestIdentity } from "../../../request/helpers/identity.mjs";
+import { buildActorContext } from "../../../request/helpers/actor.mjs";
+import "../../../request/index.mjs";
+import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
+import { isSelfToken } from "../../../../../utils/self-id.mjs";
+import "../../../../../utils/index.mjs";
+import "../../../middleware/index.mjs";
+import { IdentityType } from "@authup/core-kit";
+import { BadRequestError } from "@authup/errors";
+import { useRequestQuery } from "@routup/basic/query";
+import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DTags } from "@routup/decorators";
+//#region src/adapters/http/controllers/entities/user-authenticator/module.ts
+function _ts_decorate(decorators, target, key, desc) {
+	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+	return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(k, v) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+function _ts_param(paramIndex, decorator) {
+	return function(target, key) {
+		decorator(target, key, paramIndex);
+	};
+}
+var UserAuthenticatorController = class {
+	service;
+	constructor(ctx) {
+		this.service = ctx.service;
+	}
+	/**
+	* `@me` / `@self` resolve to the calling user identity.
+	*/ resolveUserId(id, event) {
+		if (isSelfToken(id)) {
+			const identity = useRequestIdentity(event);
+			if (identity && identity.type === IdentityType.USER) return identity.id;
+			throw new BadRequestError("The @me/@self token can only be used by a user identity.");
+		}
+		return id;
+	}
+	async getMany(id, event) {
+		const actor = buildActorContext(event);
+		const userId = this.resolveUserId(id, event);
+		const { data, meta } = await this.service.getMany(useRequestQuery(event), actor, { userId });
+		return {
+			data,
+			meta
+		};
+	}
+	async enroll(id, data, event) {
+		const actor = buildActorContext(event);
+		const userId = this.resolveUserId(id, event);
+		const result = await this.service.enroll({
+			...data,
+			userId
+		}, actor);
+		event.response.status = 201;
+		return result;
+	}
+	async getOne(id, deviceId, event) {
+		const actor = buildActorContext(event);
+		const userId = this.resolveUserId(id, event);
+		return this.service.getOne(deviceId, actor, { userId });
+	}
+	async confirm(id, deviceId, data, event) {
+		const actor = buildActorContext(event);
+		const userId = this.resolveUserId(id, event);
+		if (!data || typeof data.code !== "string" || !data.code) throw new BadRequestError("A code must be provided.");
+		return this.service.confirm(deviceId, data.code, actor, { userId });
+	}
+	async drop(id, deviceId, event) {
+		const actor = buildActorContext(event);
+		const userId = this.resolveUserId(id, event);
+		const entity = await this.service.delete(deviceId, actor, { userId });
+		event.response.status = 202;
+		return entity;
+	}
+};
+_ts_decorate([
+	DGet("", [ForceLoggedInMiddleware]),
+	_ts_param(0, DPath("id")),
+	_ts_param(1, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [String, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], UserAuthenticatorController.prototype, "getMany", null);
+_ts_decorate([
+	DPost("", [ForceLoggedInMiddleware]),
+	_ts_param(0, DPath("id")),
+	_ts_param(1, DBody()),
+	_ts_param(2, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [
+		String,
+		typeof UserAuthenticatorCreatePayload === "undefined" ? Object : UserAuthenticatorCreatePayload,
+		typeof IAppEvent === "undefined" ? Object : IAppEvent
+	]),
+	_ts_metadata("design:returntype", Promise)
+], UserAuthenticatorController.prototype, "enroll", null);
+_ts_decorate([
+	DGet("/:deviceId", [ForceLoggedInMiddleware]),
+	_ts_param(0, DPath("id")),
+	_ts_param(1, DPath("deviceId")),
+	_ts_param(2, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [
+		String,
+		String,
+		typeof IAppEvent === "undefined" ? Object : IAppEvent
+	]),
+	_ts_metadata("design:returntype", Promise)
+], UserAuthenticatorController.prototype, "getOne", null);
+_ts_decorate([
+	DPost("/:deviceId/confirm", [ForceLoggedInMiddleware]),
+	_ts_param(0, DPath("id")),
+	_ts_param(1, DPath("deviceId")),
+	_ts_param(2, DBody()),
+	_ts_param(3, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [
+		String,
+		String,
+		typeof UserAuthenticatorConfirmPayload === "undefined" ? Object : UserAuthenticatorConfirmPayload,
+		typeof IAppEvent === "undefined" ? Object : IAppEvent
+	]),
+	_ts_metadata("design:returntype", Promise)
+], UserAuthenticatorController.prototype, "confirm", null);
+_ts_decorate([
+	DDelete("/:deviceId", [ForceLoggedInMiddleware]),
+	_ts_param(0, DPath("id")),
+	_ts_param(1, DPath("deviceId")),
+	_ts_param(2, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [
+		String,
+		String,
+		typeof IAppEvent === "undefined" ? Object : IAppEvent
+	]),
+	_ts_metadata("design:returntype", Promise)
+], UserAuthenticatorController.prototype, "drop", null);
+UserAuthenticatorController = _ts_decorate([
+	DTags("userAuthenticator"),
+	DController("/users/:id/authenticators"),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof UserAuthenticatorControllerContext === "undefined" ? Object : UserAuthenticatorControllerContext])
+], UserAuthenticatorController);
+//#endregion
+export { UserAuthenticatorController };
+
+//# sourceMappingURL=module.mjs.map

package/dist/adapters/http/controllers/entities/user-authenticator/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["DBody","DContext","DController","DDelete","DGet","DPath","DPost","DTags","IdentityType","BadRequestError","useRequestQuery","isSelfToken","ForceLoggedInMiddleware","buildActorContext","useRequestIdentity","UserAuthenticatorController","service","ctx","resolveUserId","id","event","identity","type","USER","getMany","actor","userId","data","meta","enroll","result","response","status","getOne","deviceId","confirm","code","drop","entity","delete"],"sources":["../../../../../../src/adapters/http/controllers/entities/user-authenticator/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DBody,\n    DContext,\n    DController,\n    DDelete,\n    DGet,\n    DPath,\n    DPost,\n    DTags,\n} from '@routup/decorators';\nimport { IdentityType } from '@authup/core-kit';\nimport type { UserAuthenticator } from '@authup/core-kit';\nimport { BadRequestError } from '@authup/errors';\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type {\n    EntityCollectionResponse,\n    UserAuthenticatorConfirmPayload,\n    UserAuthenticatorCreatePayload,\n    UserAuthenticatorEnrollResponse,\n} from '@authup/core-http-kit';\nimport { isSelfToken } from '../../../../../utils/index.ts';\nimport type { IUserAuthenticatorService } from '../../../../../core/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { buildActorContext, useRequestIdentity } from '../../../request/index.ts';\n\nexport type UserAuthenticatorControllerContext = {\n    service: IUserAuthenticatorService,\n};\n\n@DTags('userAuthenticator')\n@DController('/users/:id/authenticators')\nexport class UserAuthenticatorController {\n    protected service: IUserAuthenticatorService;\n\n    constructor(ctx: UserAuthenticatorControllerContext) {\n        this.service = ctx.service;\n    }\n\n    /**\n     * `@me` / `@self` resolve to the calling user identity.\n     */\n    protected resolveUserId(id: string, event: IAppEvent): string {\n        if (isSelfToken(id)) {\n            const identity = useRequestIdentity(event);\n            if (identity && identity.type === IdentityType.USER) {\n                return identity.id;\n            }\n\n            // A non-user identity (client) has no authenticator\n            // namespace — fail loud instead of letting the literal token\n            // fall through and silently match zero rows.\n            throw new BadRequestError('The @me/@self token can only be used by a user identity.');\n        }\n\n        return id;\n    }\n\n    @DGet('', [ForceLoggedInMiddleware])\n    async getMany(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ): Promise<EntityCollectionResponse<UserAuthenticator>> {\n        const actor = buildActorContext(event);\n        const userId = this.resolveUserId(id, event);\n\n        const { data, meta } = await this.service.getMany(useRequestQuery(event), actor, { userId });\n\n        return {\n            data,\n            meta,\n        };\n    }\n\n    @DPost('', [ForceLoggedInMiddleware])\n    async enroll(\n        @DPath('id') id: string,\n        @DBody() data: UserAuthenticatorCreatePayload,\n        @DContext() event: IAppEvent,\n    ): Promise<UserAuthenticatorEnrollResponse> {\n        const actor = buildActorContext(event);\n        const userId = this.resolveUserId(id, event);\n\n        // route wins silently over body\n        const result = await this.service.enroll({ ...data, userId }, actor);\n\n        event.response.status = 201;\n        return result;\n    }\n\n    @DGet('/:deviceId', [ForceLoggedInMiddleware])\n    async getOne(\n        @DPath('id') id: string,\n        @DPath('deviceId') deviceId: string,\n        @DContext() event: IAppEvent,\n    ): Promise<UserAuthenticator> {\n        const actor = buildActorContext(event);\n        const userId = this.resolveUserId(id, event);\n\n        return this.service.getOne(deviceId, actor, { userId });\n    }\n\n    @DPost('/:deviceId/confirm', [ForceLoggedInMiddleware])\n    async confirm(\n        @DPath('id') id: string,\n        @DPath('deviceId') deviceId: string,\n        @DBody() data: UserAuthenticatorConfirmPayload,\n        @DContext() event: IAppEvent,\n    ): Promise<UserAuthenticator> {\n        const actor = buildActorContext(event);\n        const userId = this.resolveUserId(id, event);\n\n        if (!data || typeof data.code !== 'string' || !data.code) {\n            throw new BadRequestError('A code must be provided.');\n        }\n\n        return this.service.confirm(deviceId, data.code, actor, { userId });\n    }\n\n    @DDelete('/:deviceId', [ForceLoggedInMiddleware])\n    async drop(\n        @DPath('id') id: string,\n        @DPath('deviceId') deviceId: string,\n        @DContext() event: IAppEvent,\n    ): Promise<UserAuthenticator> {\n        const actor = buildActorContext(event);\n        const userId = this.resolveUserId(id, event);\n\n        const entity = await this.service.delete(deviceId, actor, { userId });\n\n        event.response.status = 202;\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCA,IAAae,8BAAb,MAAaA;CACCC;CAEV,YAAYC,KAAyC;EACjD,KAAKD,UAAUC,IAAID;CACvB;;;IAKA,cAAwBG,IAAYC,OAA0B;EAC1D,IAAIT,YAAYQ,EAAAA,GAAK;GACjB,MAAME,WAAWP,mBAAmBM,KAAAA;GACpC,IAAIC,YAAYA,SAASC,SAASd,aAAae,MAC3C,OAAOF,SAASF;GAMpB,MAAM,IAAIV,gBAAgB,0DAAA;EAC9B;EAEA,OAAOU;CACX;CAEA,MACMK,QACF,IACA,OACoD;EACpD,MAAMC,QAAQZ,kBAAkBO,KAAAA;EAChC,MAAMM,SAAS,KAAKR,cAAcC,IAAIC,KAAAA;EAEtC,MAAM,EAAEO,MAAMC,SAAS,MAAM,KAAKZ,QAAQQ,QAAQd,gBAAgBU,KAAAA,GAAQK,OAAO,EAAEC,OAAO,CAAA;EAE1F,OAAO;GACHC;GACAC;EACJ;CACJ;CAEA,MACMC,OACF,IACA,MACA,OACwC;EACxC,MAAMJ,QAAQZ,kBAAkBO,KAAAA;EAChC,MAAMM,SAAS,KAAKR,cAAcC,IAAIC,KAAAA;EAGtC,MAAMU,SAAS,MAAM,KAAKd,QAAQa,OAAO;GAAE,GAAGF;GAAMD;EAAO,GAAGD,KAAAA;EAE9DL,MAAMW,SAASC,SAAS;EACxB,OAAOF;CACX;CAEA,MACMG,OACF,IACA,UACA,OAC0B;EAC1B,MAAMR,QAAQZ,kBAAkBO,KAAAA;EAChC,MAAMM,SAAS,KAAKR,cAAcC,IAAIC,KAAAA;EAEtC,OAAO,KAAKJ,QAAQiB,OAAOC,UAAUT,OAAO,EAAEC,OAAO,CAAA;CACzD;CAEA,MACMS,QACF,IACA,UACA,MACA,OAC0B;EAC1B,MAAMV,QAAQZ,kBAAkBO,KAAAA;EAChC,MAAMM,SAAS,KAAKR,cAAcC,IAAIC,KAAAA;EAEtC,IAAI,CAACO,QAAQ,OAAOA,KAAKS,SAAS,YAAY,CAACT,KAAKS,MAChD,MAAM,IAAI3B,gBAAgB,0BAAA;EAG9B,OAAO,KAAKO,QAAQmB,QAAQD,UAAUP,KAAKS,MAAMX,OAAO,EAAEC,OAAO,CAAA;CACrE;CAEA,MACMW,KACF,IACA,UACA,OAC0B;EAC1B,MAAMZ,QAAQZ,kBAAkBO,KAAAA;EAChC,MAAMM,SAAS,KAAKR,cAAcC,IAAIC,KAAAA;EAEtC,MAAMkB,SAAS,MAAM,KAAKtB,QAAQuB,OAAOL,UAAUT,OAAO,EAAEC,OAAO,CAAA;EAEnEN,MAAMW,SAASC,SAAS;EACxB,OAAOM;CACX;AACJ;;WA3Ee1B,uBAAAA,CAAAA;;;;;;;;YAgBCA,uBAAAA,CAAAA;;;;;;;;;;;;;qBAgBSA,uBAAAA,CAAAA;;;;;;;;;;;;;8BAYSA,uBAAAA,CAAAA;;;;;;;;;;;;;;;wBAiBNA,uBAAAA,CAAAA"}

package/dist/adapters/http/controllers/entities/user-permission/utils/validation.mjs

@@ -10,9 +10,9 @@ import { z } from "zod";
 var UserPermissionRequestValidator = class extends Container {
 	initialize() {
 		super.initialize();
-		this.mount("user_id", { group: RequestHandlerOperation.CREATE }, createValidator(z.uuid()));
-		this.mount("permission_id", { group: RequestHandlerOperation.CREATE }, createValidator(z.uuid()));
-		this.mount("policy_id", { optional: true }, createValidator(z.uuid().nullable()));
+		this.mount("userId", { group: RequestHandlerOperation.CREATE }, createValidator(z.uuid()));
+		this.mount("permissionId", { group: RequestHandlerOperation.CREATE }, createValidator(z.uuid()));
+		this.mount("policyId", { optional: true }, createValidator(z.uuid().nullable()));
 	}
 };
 //#endregion

package/dist/adapters/http/controllers/entities/user-permission/utils/validation.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"validation.mjs","names":["createValidator","Container","z","RequestHandlerOperation","UserPermissionRequestValidator","initialize","mount","group","CREATE","uuid","optional","nullable"],"sources":["../../../../../../../src/adapters/http/controllers/entities/user-permission/utils/validation.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createValidator } from '@validup/zod';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport type { UserPermissionEntity } from '../../../../../database/domains/index.ts';\nimport { RequestHandlerOperation } from '../../../../request/index.ts';\n\nexport class UserPermissionRequestValidator extends Container<\n    UserPermissionEntity\n> {\n    protected initialize() {\n        super.initialize();\n\n        this.mount(\n            'user_id',\n            { group: RequestHandlerOperation.CREATE },\n            createValidator(z.uuid()),\n        );\n\n        this.mount(\n            'permission_id',\n            { group: RequestHandlerOperation.CREATE },\n            createValidator(z.uuid()),\n        );\n\n        this.mount(\n            'policy_id',\n            { optional: true },\n            createValidator(z.uuid().nullable()),\n        );\n    }\n}\n"],"mappings":";;;;;;;;;AAaA,IAAaI,iCAAb,cAAoDH,UAAAA;CAGtCI,aAAa;EACnB,MAAMA,WAAAA;EAEN,KAAKC,MACD,WACA,EAAEC,OAAOJ,wBAAwBK,OAAO,GACxCR,gBAAgBE,EAAEO,KAAI,CAAA,CAAA;EAG1B,KAAKH,MACD,iBACA,EAAEC,OAAOJ,wBAAwBK,OAAO,GACxCR,gBAAgBE,EAAEO,KAAI,CAAA,CAAA;EAG1B,KAAKH,MACD,aACA,EAAEI,UAAU,KAAK,GACjBV,gBAAgBE,EAAEO,KAAI,CAAA,CAAGE,SAAQ,CAAA,CAAA;CAEzC;AACJ"}
+{"version":3,"file":"validation.mjs","names":["createValidator","Container","z","RequestHandlerOperation","UserPermissionRequestValidator","initialize","mount","group","CREATE","uuid","optional","nullable"],"sources":["../../../../../../../src/adapters/http/controllers/entities/user-permission/utils/validation.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createValidator } from '@validup/zod';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport type { UserPermissionEntity } from '../../../../../database/domains/index.ts';\nimport { RequestHandlerOperation } from '../../../../request/index.ts';\n\nexport class UserPermissionRequestValidator extends Container<\n    UserPermissionEntity\n> {\n    protected initialize() {\n        super.initialize();\n\n        this.mount(\n            'userId',\n            { group: RequestHandlerOperation.CREATE },\n            createValidator(z.uuid()),\n        );\n\n        this.mount(\n            'permissionId',\n            { group: RequestHandlerOperation.CREATE },\n            createValidator(z.uuid()),\n        );\n\n        this.mount(\n            'policyId',\n            { optional: true },\n            createValidator(z.uuid().nullable()),\n        );\n    }\n}\n"],"mappings":";;;;;;;;;AAaA,IAAaI,iCAAb,cAAoDH,UAAAA;CAGtCI,aAAa;EACnB,MAAMA,WAAAA;EAEN,KAAKC,MACD,UACA,EAAEC,OAAOJ,wBAAwBK,OAAO,GACxCR,gBAAgBE,EAAEO,KAAI,CAAA,CAAA;EAG1B,KAAKH,MACD,gBACA,EAAEC,OAAOJ,wBAAwBK,OAAO,GACxCR,gBAAgBE,EAAEO,KAAI,CAAA,CAAA;EAG1B,KAAKH,MACD,YACA,EAAEI,UAAU,KAAK,GACjBV,gBAAgBE,EAAEO,KAAI,CAAA,CAAGE,SAAQ,CAAA,CAAA;CAEzC;AACJ"}

package/dist/adapters/http/controllers/entities/user-role/utils/validation.mjs

@@ -10,8 +10,8 @@ import { z } from "zod";
 var UserRoleRequestValidator = class extends Container {
 	initialize() {
 		super.initialize();
-		this.mount("user_id", { group: RequestHandlerOperation.CREATE }, createValidator(z.uuid()));
-		this.mount("role_id", { group: RequestHandlerOperation.CREATE }, createValidator(z.uuid()));
+		this.mount("userId", { group: RequestHandlerOperation.CREATE }, createValidator(z.uuid()));
+		this.mount("roleId", { group: RequestHandlerOperation.CREATE }, createValidator(z.uuid()));
 	}
 };
 //#endregion

package/dist/adapters/http/controllers/entities/user-role/utils/validation.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"validation.mjs","names":["createValidator","Container","z","RequestHandlerOperation","UserRoleRequestValidator","initialize","mount","group","CREATE","uuid"],"sources":["../../../../../../../src/adapters/http/controllers/entities/user-role/utils/validation.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createValidator } from '@validup/zod';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport type { UserRoleEntity } from '../../../../../database/domains/index.ts';\n\nimport { RequestHandlerOperation } from '../../../../request/index.ts';\n\nexport class UserRoleRequestValidator extends Container<\n    UserRoleEntity\n> {\n    protected initialize() {\n        super.initialize();\n\n        this.mount(\n            'user_id',\n            { group: RequestHandlerOperation.CREATE },\n            createValidator(z.uuid()),\n        );\n\n        this.mount(\n            'role_id',\n            { group: RequestHandlerOperation.CREATE },\n            createValidator(z.uuid()),\n        );\n    }\n}\n"],"mappings":";;;;;;;;;AAcA,IAAaI,2BAAb,cAA8CH,UAAAA;CAGhCI,aAAa;EACnB,MAAMA,WAAAA;EAEN,KAAKC,MACD,WACA,EAAEC,OAAOJ,wBAAwBK,OAAO,GACxCR,gBAAgBE,EAAEO,KAAI,CAAA,CAAA;EAG1B,KAAKH,MACD,WACA,EAAEC,OAAOJ,wBAAwBK,OAAO,GACxCR,gBAAgBE,EAAEO,KAAI,CAAA,CAAA;CAE9B;AACJ"}
+{"version":3,"file":"validation.mjs","names":["createValidator","Container","z","RequestHandlerOperation","UserRoleRequestValidator","initialize","mount","group","CREATE","uuid"],"sources":["../../../../../../../src/adapters/http/controllers/entities/user-role/utils/validation.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createValidator } from '@validup/zod';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport type { UserRoleEntity } from '../../../../../database/domains/index.ts';\n\nimport { RequestHandlerOperation } from '../../../../request/index.ts';\n\nexport class UserRoleRequestValidator extends Container<\n    UserRoleEntity\n> {\n    protected initialize() {\n        super.initialize();\n\n        this.mount(\n            'userId',\n            { group: RequestHandlerOperation.CREATE },\n            createValidator(z.uuid()),\n        );\n\n        this.mount(\n            'roleId',\n            { group: RequestHandlerOperation.CREATE },\n            createValidator(z.uuid()),\n        );\n    }\n}\n"],"mappings":";;;;;;;;;AAcA,IAAaI,2BAAb,cAA8CH,UAAAA;CAGhCI,aAAa;EACnB,MAAMA,WAAAA;EAEN,KAAKC,MACD,UACA,EAAEC,OAAOJ,wBAAwBK,OAAO,GACxCR,gBAAgBE,EAAEO,KAAI,CAAA,CAAA;EAG1B,KAAKH,MACD,UACA,EAAEC,OAAOJ,wBAAwBK,OAAO,GACxCR,gBAAgBE,EAAEO,KAAI,CAAA,CAAA;CAE9B;AACJ"}

package/dist/adapters/http/controllers/index.mjs

@@ -8,11 +8,15 @@ import { ClientRoleRequestValidator } from "./entities/client-role/utils/validat
 import { ClientRoleController } from "./entities/client-role/module.mjs";
 import { ClientScopeController } from "./entities/client-scope/module.mjs";
 import { ClientScopeRequestValidator } from "./entities/client-scope/utils/validator.mjs";
+import { ConsentController } from "./entities/consent/module.mjs";
+import { EventController } from "./entities/event/module.mjs";
 import { IdentityProviderController } from "./entities/identity-provider/module.mjs";
 import { IdentityProviderRoleMappingController } from "./entities/identity-provide-role/module.mjs";
+import { KeyController } from "./entities/key/module.mjs";
 import { PermissionController } from "./entities/permission/module.mjs";
 import { PermissionPolicyController } from "./entities/permission-policy/module.mjs";
 import { ActivateController } from "./workflows/activate/module.mjs";
+import { AuthenticatorChallengeController } from "./workflows/authenticator-challenge/module.mjs";
 import { AuthorizeController } from "./workflows/authorize/module.mjs";
 import { getJwkRouteHandler, getJwksRouteHandler } from "./workflows/jwks/handlers/read.mjs";
 import { JwkController } from "./workflows/jwks/module.mjs";
@@ -25,11 +29,6 @@ import { StatusController } from "./workflows/status/module.mjs";
 import { TokenController } from "./workflows/token/module.mjs";
 import "./workflows/index.mjs";
 import { RealmController } from "./entities/realm/module.mjs";
-import { RobotController } from "./entities/robot/module.mjs";
-import { RobotPermissionController } from "./entities/robot-permission/module.mjs";
-import { RobotPermissionRequestValidator } from "./entities/robot-permission/utils/validation.mjs";
-import { RobotRoleController } from "./entities/robot-role/module.mjs";
-import { RobotRoleRequestValidator } from "./entities/robot-role/utils/validation.mjs";
 import { RoleController } from "./entities/role/module.mjs";
 import { RoleAttributeController } from "./entities/role-attribute/module.mjs";
 import { RoleAttributeRequestValidator } from "./entities/role-attribute/utils/validation.mjs";
@@ -40,12 +39,14 @@ import { PolicyAttributesValidator } from "./entities/policy/utils/attributes-va
 import { PolicyValidator } from "./entities/policy/utils/validation.mjs";
 import { ScopeController } from "./entities/scope/module.mjs";
 import { SessionController } from "./entities/session/module.mjs";
+import { TrustAnchorController } from "./entities/trust-anchor/module.mjs";
 import { UserController } from "./entities/user/module.mjs";
 import { UserAttributeController } from "./entities/user-attribute/module.mjs";
 import { UserAttributeRequestValidator } from "./entities/user-attribute/utils/validation.mjs";
+import { UserAuthenticatorController } from "./entities/user-authenticator/module.mjs";
 import { UserPermissionController } from "./entities/user-permission/module.mjs";
 import { UserPermissionRequestValidator } from "./entities/user-permission/utils/validation.mjs";
 import { UserRoleController } from "./entities/user-role/module.mjs";
 import { UserRoleRequestValidator } from "./entities/user-role/utils/validation.mjs";
 import "./entities/index.mjs";
-export { ActivateController, AuthorizeController, ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, IdentityProviderController, IdentityProviderRoleMappingController, JwkController, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RegisterController, RobotController, RobotPermissionController, RobotPermissionRequestValidator, RobotRoleController, RobotRoleRequestValidator, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, StatusController, TokenController, UserAttributeController, UserAttributeRequestValidator, UserController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator, getJwkRouteHandler, getJwksRouteHandler };
+export { ActivateController, AuthenticatorChallengeController, AuthorizeController, ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ConsentController, EventController, IdentityProviderController, IdentityProviderRoleMappingController, JwkController, KeyController, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RegisterController, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, StatusController, TokenController, TrustAnchorController, UserAttributeController, UserAttributeRequestValidator, UserAuthenticatorController, UserController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator, getJwkRouteHandler, getJwksRouteHandler };

package/dist/adapters/http/controllers/workflows/authenticator-challenge/index.d.ts

@@ -0,0 +1,2 @@
+export * from './module.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/controllers/workflows/authenticator-challenge/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/authenticator-challenge/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC"}

package/dist/adapters/http/controllers/workflows/authenticator-challenge/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { AuthenticatorChallengeController } from "./module.mjs";
+export { AuthenticatorChallengeController };

package/dist/adapters/http/controllers/workflows/authenticator-challenge/module.d.ts

@@ -0,0 +1,46 @@
+import type { IAppEvent } from 'routup';
+import type { UserAuthenticatorChallengeResponse, UserAuthenticatorChallengeSendPayload, UserAuthenticatorChallengeVerifyPayload, UserAuthenticatorChallengeVerifyResponse } from '@authup/core-http-kit';
+import type { IOAuth2MfaLoginService, ISessionManager, IUserAuthenticatorService } from '../../../../../core/index.ts';
+import type { RequestIdentity, RequestMfaLoginTicket } from '../../../request/index.ts';
+export type AuthenticatorChallengeControllerContext = {
+    service: IUserAuthenticatorService;
+    sessionManager: ISessionManager;
+    mfaLoginService?: IOAuth2MfaLoginService;
+};
+type ChallengeActor = {
+    identity: RequestIdentity;
+    ticket: RequestMfaLoginTicket | null;
+};
+/**
+ * Login-time challenge surface, scoped to the CURRENT bearer identity.
+ * GET reports whether (and how) the caller must present a second factor;
+ * POST verifies a factor and stamps mfa_at onto the backing session so
+ * the /authorize backstop passes.
+ *
+ * Besides a regular access bearer, these routes accept the "MFA-pending"
+ * login ticket (kind: mfa_token, issue #3242) the password grant issues
+ * for factor kinds that cannot ride the single grant POST (email /
+ * WebAuthn). A ticket-authenticated verify additionally completes the
+ * login: the response carries the full token grant for the now-MFA'd
+ * pending session.
+ */
+export declare class AuthenticatorChallengeController {
+    protected service: IUserAuthenticatorService;
+    protected sessionManager: ISessionManager;
+    protected mfaLoginService?: IOAuth2MfaLoginService;
+    constructor(ctx: AuthenticatorChallengeControllerContext);
+    /**
+     * Resolve the acting subject: the regular request identity (access
+     * bearer — the middleware never sets it for a ticket) or the stashed
+     * MFA-pending ticket. Anything else is unauthorized — the previous
+     * ForceLoggedInMiddleware contract, widened by exactly one bearer kind.
+     */
+    protected resolveActor(event: IAppEvent): ChallengeActor;
+    status(event: IAppEvent): Promise<UserAuthenticatorChallengeResponse>;
+    send(data: UserAuthenticatorChallengeSendPayload, event: IAppEvent): Promise<{
+        success: true;
+    }>;
+    verify(data: UserAuthenticatorChallengeVerifyPayload, event: IAppEvent): Promise<UserAuthenticatorChallengeVerifyResponse>;
+}
+export {};
+//# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/controllers/workflows/authenticator-challenge/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/authenticator-challenge/module.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EACR,kCAAkC,EAClC,qCAAqC,EACrC,uCAAuC,EACvC,wCAAwC,EAC3C,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,sBAAsB,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACvH,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAQxF,MAAM,MAAM,uCAAuC,GAAG;IAClD,OAAO,EAAE,yBAAyB,CAAC;IACnC,cAAc,EAAE,eAAe,CAAC;IAChC,eAAe,CAAC,EAAE,sBAAsB,CAAC;CAC5C,CAAC;AAEF,KAAK,cAAc,GAAG;IAClB,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,EAAE,qBAAqB,GAAG,IAAI,CAAC;CACxC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,qBAEa,gCAAgC;IACzC,SAAS,CAAC,OAAO,EAAE,yBAAyB,CAAC;IAE7C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,eAAe,CAAC,EAAE,sBAAsB,CAAC;gBAEvC,GAAG,EAAE,uCAAuC;IAMxD;;;;;OAKG;IACH,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,SAAS,GAAI,cAAc;IAenD,MAAM,CACI,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,kCAAkC,CAAC;IAcxC,IAAI,CACG,IAAI,EAAE,qCAAqC,EACxC,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAqBvB,MAAM,CACC,IAAI,EAAE,uCAAuC,EAC1C,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wCAAwC,CAAC;CAsEvD"}

package/dist/adapters/http/controllers/workflows/authenticator-challenge/module.mjs

@@ -0,0 +1,132 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { useRequestIdentity } from "../../../request/helpers/identity.mjs";
+import { useRequestLocale } from "../../../request/helpers/locale.mjs";
+import { useRequestMfaLoginTicket } from "../../../request/helpers/mfa-login-ticket.mjs";
+import { useRequestSessionId } from "../../../request/helpers/session-id.mjs";
+import "../../../request/index.mjs";
+import { IdentityType, UserAuthenticatorKind } from "@authup/core-kit";
+import { BadRequestError, EntityCredentialsInvalidError, UnauthorizedError } from "@authup/errors";
+import { getRequestHeader, getRequestIP } from "routup";
+import { DBody, DContext, DController, DGet, DPost, DTags } from "@routup/decorators";
+//#region src/adapters/http/controllers/workflows/authenticator-challenge/module.ts
+function _ts_decorate(decorators, target, key, desc) {
+	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+	return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(k, v) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+function _ts_param(paramIndex, decorator) {
+	return function(target, key) {
+		decorator(target, key, paramIndex);
+	};
+}
+var AuthenticatorChallengeController = class {
+	service;
+	sessionManager;
+	mfaLoginService;
+	constructor(ctx) {
+		this.service = ctx.service;
+		this.sessionManager = ctx.sessionManager;
+		this.mfaLoginService = ctx.mfaLoginService;
+	}
+	/**
+	* Resolve the acting subject: the regular request identity (access
+	* bearer — the middleware never sets it for a ticket) or the stashed
+	* MFA-pending ticket. Anything else is unauthorized — the previous
+	* ForceLoggedInMiddleware contract, widened by exactly one bearer kind.
+	*/ resolveActor(event) {
+		const identity = useRequestIdentity(event);
+		if (identity) return {
+			identity,
+			ticket: null
+		};
+		const ticket = useRequestMfaLoginTicket(event);
+		if (ticket) return {
+			identity: ticket.identity,
+			ticket
+		};
+		throw new UnauthorizedError();
+	}
+	async status(event) {
+		const { identity } = this.resolveActor(event);
+		if (identity.type !== IdentityType.USER) return {
+			required: false,
+			enrollmentRequired: false,
+			kinds: []
+		};
+		return this.service.challenge(identity.id);
+	}
+	async send(data, event) {
+		const { identity } = this.resolveActor(event);
+		if (identity.type !== IdentityType.USER) throw new BadRequestError("Only user identities can request a challenge.");
+		if (!data || !Object.values(UserAuthenticatorKind).includes(data.kind)) throw new BadRequestError("A kind must be provided.");
+		await this.service.sendChallenge(identity.id, data.kind, { locale: useRequestLocale(event) });
+		return { success: true };
+	}
+	async verify(data, event) {
+		const { identity, ticket } = this.resolveActor(event);
+		if (identity.type !== IdentityType.USER) throw new BadRequestError("Only user identities can complete a challenge.");
+		if (!data || typeof data.response !== "string" || !data.response || !Object.values(UserAuthenticatorKind).includes(data.kind)) throw new BadRequestError("A kind and response must be provided.");
+		const sessionId = ticket ? ticket.payload.session_id : useRequestSessionId(event);
+		const session = sessionId ? await this.sessionManager.findOneById(sessionId) : null;
+		if (ticket && !session) throw new UnauthorizedError();
+		if (!await this.service.verify(identity.id, {
+			kind: data.kind,
+			response: data.response
+		}, {
+			ipAddress: getRequestIP(event, { trustProxy: true }) ?? null,
+			userAgent: getRequestHeader(event, "user-agent") ?? null,
+			clientId: identity.clientId,
+			...session ? { onVerified: async () => {
+				await this.sessionManager.markMfaVerified(session);
+			} } : {}
+		})) throw new EntityCredentialsInvalidError();
+		if (ticket && session && this.mfaLoginService) return {
+			verified: true,
+			token: await this.mfaLoginService.complete({
+				session,
+				ticket: ticket.payload,
+				userName: identity.data.name
+			})
+		};
+		return { verified: true };
+	}
+};
+_ts_decorate([
+	DGet(""),
+	_ts_param(0, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], AuthenticatorChallengeController.prototype, "status", null);
+_ts_decorate([
+	DPost("/send"),
+	_ts_param(0, DBody()),
+	_ts_param(1, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof UserAuthenticatorChallengeSendPayload === "undefined" ? Object : UserAuthenticatorChallengeSendPayload, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], AuthenticatorChallengeController.prototype, "send", null);
+_ts_decorate([
+	DPost(""),
+	_ts_param(0, DBody()),
+	_ts_param(1, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof UserAuthenticatorChallengeVerifyPayload === "undefined" ? Object : UserAuthenticatorChallengeVerifyPayload, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], AuthenticatorChallengeController.prototype, "verify", null);
+AuthenticatorChallengeController = _ts_decorate([
+	DTags("userAuthenticator"),
+	DController("/authenticators/challenge"),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof AuthenticatorChallengeControllerContext === "undefined" ? Object : AuthenticatorChallengeControllerContext])
+], AuthenticatorChallengeController);
+//#endregion
+export { AuthenticatorChallengeController };
+
+//# sourceMappingURL=module.mjs.map

package/dist/adapters/http/controllers/workflows/authenticator-challenge/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["DBody","DContext","DController","DGet","DPost","DTags","IdentityType","UserAuthenticatorKind","BadRequestError","EntityCredentialsInvalidError","UnauthorizedError","getRequestHeader","getRequestIP","useRequestIdentity","useRequestLocale","useRequestMfaLoginTicket","useRequestSessionId","AuthenticatorChallengeController","service","sessionManager","mfaLoginService","ctx","resolveActor","event","identity","ticket","status","type","USER","required","enrollmentRequired","kinds","challenge","id","send","data","Object","values","includes","kind","sendChallenge","locale","success","verify","response","sessionId","payload","session_id","session","findOneById","verified","ipAddress","trustProxy","userAgent","clientId","onVerified","markMfaVerified","token","complete","userName","name"],"sources":["../../../../../../src/adapters/http/controllers/workflows/authenticator-challenge/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DBody,\n    DContext,\n    DController,\n    DGet,\n    DPost,\n    DTags,\n} from '@routup/decorators';\nimport { IdentityType, UserAuthenticatorKind } from '@authup/core-kit';\nimport { BadRequestError, EntityCredentialsInvalidError, UnauthorizedError } from '@authup/errors';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type {\n    UserAuthenticatorChallengeResponse,\n    UserAuthenticatorChallengeSendPayload,\n    UserAuthenticatorChallengeVerifyPayload,\n    UserAuthenticatorChallengeVerifyResponse,\n} from '@authup/core-http-kit';\nimport type { IOAuth2MfaLoginService, ISessionManager, IUserAuthenticatorService } from '../../../../../core/index.ts';\nimport type { RequestIdentity, RequestMfaLoginTicket } from '../../../request/index.ts';\nimport {\n    useRequestIdentity,\n    useRequestLocale,\n    useRequestMfaLoginTicket,\n    useRequestSessionId,\n} from '../../../request/index.ts';\n\nexport type AuthenticatorChallengeControllerContext = {\n    service: IUserAuthenticatorService,\n    sessionManager: ISessionManager,\n    mfaLoginService?: IOAuth2MfaLoginService,\n};\n\ntype ChallengeActor = {\n    identity: RequestIdentity,\n    ticket: RequestMfaLoginTicket | null,\n};\n\n/**\n * Login-time challenge surface, scoped to the CURRENT bearer identity.\n * GET reports whether (and how) the caller must present a second factor;\n * POST verifies a factor and stamps mfa_at onto the backing session so\n * the /authorize backstop passes.\n *\n * Besides a regular access bearer, these routes accept the \"MFA-pending\"\n * login ticket (kind: mfa_token, issue #3242) the password grant issues\n * for factor kinds that cannot ride the single grant POST (email /\n * WebAuthn). A ticket-authenticated verify additionally completes the\n * login: the response carries the full token grant for the now-MFA'd\n * pending session.\n */\n@DTags('userAuthenticator')\n@DController('/authenticators/challenge')\nexport class AuthenticatorChallengeController {\n    protected service: IUserAuthenticatorService;\n\n    protected sessionManager: ISessionManager;\n\n    protected mfaLoginService?: IOAuth2MfaLoginService;\n\n    constructor(ctx: AuthenticatorChallengeControllerContext) {\n        this.service = ctx.service;\n        this.sessionManager = ctx.sessionManager;\n        this.mfaLoginService = ctx.mfaLoginService;\n    }\n\n    /**\n     * Resolve the acting subject: the regular request identity (access\n     * bearer — the middleware never sets it for a ticket) or the stashed\n     * MFA-pending ticket. Anything else is unauthorized — the previous\n     * ForceLoggedInMiddleware contract, widened by exactly one bearer kind.\n     */\n    protected resolveActor(event: IAppEvent) : ChallengeActor {\n        const identity = useRequestIdentity(event);\n        if (identity) {\n            return { identity, ticket: null };\n        }\n\n        const ticket = useRequestMfaLoginTicket(event);\n        if (ticket) {\n            return { identity: ticket.identity, ticket };\n        }\n\n        throw new UnauthorizedError();\n    }\n\n    @DGet('')\n    async status(\n        @DContext() event: IAppEvent,\n    ): Promise<UserAuthenticatorChallengeResponse> {\n        const { identity } = this.resolveActor(event);\n        if (identity.type !== IdentityType.USER) {\n            return {\n                required: false,\n                enrollmentRequired: false,\n                kinds: [],\n            };\n        }\n\n        return this.service.challenge(identity.id);\n    }\n\n    @DPost('/send')\n    async send(\n        @DBody() data: UserAuthenticatorChallengeSendPayload,\n        @DContext() event: IAppEvent,\n    ): Promise<{ success: true }> {\n        const { identity } = this.resolveActor(event);\n        if (identity.type !== IdentityType.USER) {\n            throw new BadRequestError('Only user identities can request a challenge.');\n        }\n\n        if (\n            !data ||\n            !Object.values(UserAuthenticatorKind).includes(data.kind as UserAuthenticatorKind)\n        ) {\n            throw new BadRequestError('A kind must be provided.');\n        }\n\n        await this.service.sendChallenge(identity.id, data.kind, { locale: useRequestLocale(event) });\n\n        // uniform 200 regardless of whether a code was actually mailed —\n        // no enrollment-status oracle for the caller.\n        return { success: true };\n    }\n\n    @DPost('')\n    async verify(\n        @DBody() data: UserAuthenticatorChallengeVerifyPayload,\n        @DContext() event: IAppEvent,\n    ): Promise<UserAuthenticatorChallengeVerifyResponse> {\n        const { identity, ticket } = this.resolveActor(event);\n        if (identity.type !== IdentityType.USER) {\n            throw new BadRequestError('Only user identities can complete a challenge.');\n        }\n\n        if (\n            !data ||\n            typeof data.response !== 'string' ||\n            !data.response ||\n            !Object.values(UserAuthenticatorKind).includes(data.kind as UserAuthenticatorKind)\n        ) {\n            throw new BadRequestError('A kind and response must be provided.');\n        }\n\n        // Bind the proof to the backing session — the /authorize backstop\n        // reads session.mfa_at. The session id is server-derived (stashed\n        // by the authorization middleware / carried by the verified ticket),\n        // never client input. The stamp runs INSIDE the verify unit of work\n        // (before the code consumption persists), so a stamp failure never\n        // burns a single-use code.\n        const sessionId = ticket ?\n            ticket.payload.session_id :\n            useRequestSessionId(event);\n        const session = sessionId ?\n            await this.sessionManager.findOneById(sessionId) :\n            null;\n\n        // a ticket references exactly one pending session — without it\n        // (swept / expired mid-flight) the login can not complete.\n        if (ticket && !session) {\n            throw new UnauthorizedError();\n        }\n\n        const verified = await this.service.verify(\n            identity.id,\n            {\n                kind: data.kind,\n                response: data.response,\n            },\n            {\n                ipAddress: getRequestIP(event, { trustProxy: true }) ?? null,\n                userAgent: getRequestHeader(event, 'user-agent') ?? null,\n                clientId: identity.clientId,\n                ...(session ? {\n                    onVerified: async () => {\n                        await this.sessionManager.markMfaVerified(session);\n                    },\n                } : {}),\n            },\n        );\n        if (!verified) {\n            throw new EntityCredentialsInvalidError();\n        }\n\n        // Ticket flow: the factor is verified and mfa_at stamped — complete\n        // the login by minting the full grant for the pending session and\n        // consuming the ticket (single use).\n        if (ticket && session && this.mfaLoginService) {\n            const token = await this.mfaLoginService.complete({\n                session,\n                ticket: ticket.payload,\n                userName: identity.data.name,\n            });\n\n            return { verified: true, token };\n        }\n\n        return { verified: true };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AA4DA,IAAaiB,mCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA8C;EACtD,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,kBAAkBC,IAAID;CAC/B;;;;;;IAQA,aAAuBG,OAAmC;EACtD,MAAMC,WAAWX,mBAAmBU,KAAAA;EACpC,IAAIC,UACA,OAAO;GAAEA;GAAUC,QAAQ;EAAK;EAGpC,MAAMA,SAASV,yBAAyBQ,KAAAA;EACxC,IAAIE,QACA,OAAO;GAAED,UAAUC,OAAOD;GAAUC;EAAO;EAG/C,MAAM,IAAIf,kBAAAA;CACd;CAEA,MACMgB,OACF,OAC2C;EAC3C,MAAM,EAAEF,aAAa,KAAKF,aAAaC,KAAAA;EACvC,IAAIC,SAASG,SAASrB,aAAasB,MAC/B,OAAO;GACHC,UAAU;GACVC,oBAAoB;GACpBC,OAAO,CAAA;EACX;EAGJ,OAAO,KAAKb,QAAQc,UAAUR,SAASS,EAAE;CAC7C;CAEA,MACMC,KACF,MACA,OAC0B;EAC1B,MAAM,EAAEV,aAAa,KAAKF,aAAaC,KAAAA;EACvC,IAAIC,SAASG,SAASrB,aAAasB,MAC/B,MAAM,IAAIpB,gBAAgB,+CAAA;EAG9B,IACI,CAAC2B,QACD,CAACC,OAAOC,OAAO9B,qBAAAA,CAAAA,CAAuB+B,SAASH,KAAKI,IAAI,GAExD,MAAM,IAAI/B,gBAAgB,0BAAA;EAG9B,MAAM,KAAKU,QAAQsB,cAAchB,SAASS,IAAIE,KAAKI,MAAM,EAAEE,QAAQ3B,iBAAiBS,KAAAA,EAAO,CAAA;EAI3F,OAAO,EAAEmB,SAAS,KAAK;CAC3B;CAEA,MACMC,OACF,MACA,OACiD;EACjD,MAAM,EAAEnB,UAAUC,WAAW,KAAKH,aAAaC,KAAAA;EAC/C,IAAIC,SAASG,SAASrB,aAAasB,MAC/B,MAAM,IAAIpB,gBAAgB,gDAAA;EAG9B,IACI,CAAC2B,QACD,OAAOA,KAAKS,aAAa,YACzB,CAACT,KAAKS,YACN,CAACR,OAAOC,OAAO9B,qBAAAA,CAAAA,CAAuB+B,SAASH,KAAKI,IAAI,GAExD,MAAM,IAAI/B,gBAAgB,uCAAA;EAS9B,MAAMqC,YAAYpB,SACdA,OAAOqB,QAAQC,aACf/B,oBAAoBO,KAAAA;EACxB,MAAMyB,UAAUH,YACZ,MAAM,KAAK1B,eAAe8B,YAAYJ,SAAAA,IACtC;EAIJ,IAAIpB,UAAU,CAACuB,SACX,MAAM,IAAItC,kBAAAA;EAoBd,IAAI,CAACwC,MAjBkB,KAAKhC,QAAQyB,OAChCnB,SAASS,IACT;GACIM,MAAMJ,KAAKI;GACXK,UAAUT,KAAKS;EACnB,GACA;GACIO,WAAWvC,aAAaW,OAAO,EAAE6B,YAAY,KAAK,CAAA,KAAM;GACxDC,WAAW1C,iBAAiBY,OAAO,YAAA,KAAiB;GACpD+B,UAAU9B,SAAS8B;GACnB,GAAIN,UAAU,EACVO,YAAY,YAAA;IACR,MAAM,KAAKpC,eAAeqC,gBAAgBR,OAAAA;GAC9C,EACJ,IAAI,CAAC;EACT,CAAA,GAGA,MAAM,IAAIvC,8BAAAA;EAMd,IAAIgB,UAAUuB,WAAW,KAAK5B,iBAO1B,OAAO;GAAE8B,UAAU;GAAMO,OAAAA,MANL,KAAKrC,gBAAgBsC,SAAS;IAC9CV;IACAvB,QAAQA,OAAOqB;IACfa,UAAUnC,SAASW,KAAKyB;GAC5B,CAAA;EAE+B;EAGnC,OAAO,EAAEV,UAAU,KAAK;CAC5B;AACJ"}

package/dist/adapters/http/controllers/workflows/authorize/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/module.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAQxC,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAGlE,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AACvF,OAAO,KAAK,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAMzF,qBACa,mBAAmB;IAI5B,SAAS,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAE9C,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,oBAAoB,EAAG,uCAAuC,CAAC;IAEzE,SAAS,CAAC,UAAU,EAAE,oBAAoB,CAAC;gBAI/B,GAAG,EAAE,0BAA0B;IAkBrC,OAAO,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAgB/D,KAAK,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;CA+E7D"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/module.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAUxC,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAGlE,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AACvF,OAAO,KAAK,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAMzF,qBACa,mBAAmB;IAI5B,SAAS,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAE9C,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,oBAAoB,EAAG,uCAAuC,CAAC;IAEzE,SAAS,CAAC,UAAU,EAAE,oBAAoB,CAAC;gBAI/B,GAAG,EAAE,0BAA0B;IAyBrC,OAAO,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAmC/D,KAAK,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;CA8F7D"}

package/dist/adapters/http/controllers/workflows/authorize/module.mjs

@@ -13,7 +13,9 @@ import { renderUIPage } from "../../../ui/render.mjs";
 import "../../../ui/index.mjs";
 import { HTTPOAuth2Authorizer } from "../../../adapters/oauth2/authorization/module.mjs";
 import "../../../adapters/index.mjs";
+import { OAuth2AccessDeniedError, OAuth2ErrorCode, isOAuth2AccessDeniedError } from "@authup/specs";
 import { URL } from "node:url";
+import { useRequestQuery } from "@routup/basic/query";
 import { DContext, DController, DGet, DPost } from "@routup/decorators";
 //#region src/adapters/http/controllers/workflows/authorize/module.ts
 function _ts_decorate(decorators, target, key, desc) {
@@ -43,15 +45,32 @@ var AuthorizeController = class {
 			codeRequestVerifier: this.codeRequestVerifier,
 			codeIssuer: ctx.codeIssuer,
 			sessionManager: ctx.sessionManager,
-			promptLoginMaxAge: ctx.options.promptLoginMaxAge
+			eventService: ctx.eventService,
+			metrics: ctx.metrics,
+			promptLoginMaxAge: ctx.options.promptLoginMaxAge,
+			mfaFreshnessMaxAge: ctx.options.mfaFreshnessMaxAge,
+			mfaChallengeProvider: ctx.mfaChallengeProvider,
+			accessPolicyEvaluator: ctx.accessPolicyEvaluator,
+			consentService: ctx.consentService,
+			logger: ctx.logger
 		});
 	}
 	async confirm(event) {
-		const result = await this.authorizer.authorizeWithRequest(event);
-		const url = new URL(result.redirectUri);
-		if (result.state) url.searchParams.set("state", result.state);
-		if (result.authorizationCode) url.searchParams.set("code", result.authorizationCode);
-		return { url: url.href };
+		try {
+			const result = await this.authorizer.authorizeWithRequest(event);
+			const url = new URL(result.redirectUri);
+			if (result.state) url.searchParams.set("state", result.state);
+			if (result.authorizationCode) url.searchParams.set("code", result.authorizationCode);
+			return { url: url.href };
+		} catch (e) {
+			if (isOAuth2AccessDeniedError(e) && e.redirectUri) {
+				const url = new URL(e.redirectUri);
+				url.searchParams.set("error", OAuth2ErrorCode.ACCESS_DENIED);
+				if (e.state) url.searchParams.set("state", e.state);
+				return { url: url.href };
+			}
+			throw e;
+		}
 	}
 	async serve(event) {
 		let codeRequest;
@@ -67,16 +86,16 @@ var AuthorizeController = class {
 			client = {
 				id: result.client.id,
 				name: result.client.name,
-				display_name: result.client.display_name,
-				built_in: result.client.built_in,
-				created_at: result.client.created_at
+				displayName: result.client.displayName,
+				builtIn: result.client.builtIn,
+				createdAt: result.client.createdAt
 			};
 			scopes = result.scopes;
 			redirectUriVerified = result.redirectUriVerified;
 			if (result.client.realm) realm = {
 				id: result.client.realm.id,
 				name: result.client.realm.name,
-				display_name: result.client.realm.display_name
+				displayName: result.client.realm.displayName
 			};
 			codeRequest = result.data;
 		} catch (e) {
@@ -86,6 +105,15 @@ var AuthorizeController = class {
 				message: normalized.message
 			};
 		}
+		if (!error) {
+			if (useRequestQuery(event).error === OAuth2ErrorCode.ACCESS_DENIED) {
+				const normalized = sanitizeError(OAuth2AccessDeniedError.forClient());
+				error = {
+					...normalized,
+					message: normalized.message
+				};
+			}
+		}
 		const requestURL = new URL(event.request.url);
 		return renderUIPage(event, {
 			url: "/authorize",