@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.54

package/dist/adapters/http/controllers/workflows/authorize/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["DContext","DController","DGet","DPost","URL","ForceUserLoggedInMiddleware","HTTPOAuth2Authorizer","renderUIPage","readFromLocations","OAuth2AuthorizationCodeRequestValidator","sanitizeError","AuthorizeController","options","codeRequestVerifier","codeRequestValidator","authorizer","ctx","codeIssuer","sessionManager","promptLoginMaxAge","confirm","event","result","authorizeWithRequest","url","redirectUri","state","searchParams","set","authorizationCode","href","serve","codeRequest","client","scopes","realm","redirectUriVerified","error","merged","data","run","verify","id","name","display_name","built_in","created_at","e","normalized","message","requestURL","request","payload","config","baseURL","features","requestPath","pathname","search"],"sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPost,\n} from '@routup/decorators';\nimport { URL } from 'node:url';\n\nimport type { IAppEvent } from 'routup';\nimport type {\n    Client,\n    OAuth2AuthorizationCodeRequest,\n    Realm,\n    Scope,\n} from '@authup/core-kit';\nimport { ForceUserLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { HTTPOAuth2Authorizer } from '../../../adapters/index.ts';\nimport { renderUIPage } from '../../../ui/index.ts';\nimport { readFromLocations } from '../../../request/index.ts';\nimport type { IOAuth2AuthorizationCodeRequestVerifier } from '../../../../../core/index.ts';\nimport { OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';\nimport type { AuthorizeControllerContext, AuthorizeControllerOptions } from './types.ts';\nimport { sanitizeError } from '../../../../../utils/index.ts';\n\ntype RealmSummary = Pick<Realm, 'id' | 'name' | 'display_name'>;\ntype ClientSummary = Pick<Client, 'id' | 'name' | 'display_name' | 'built_in' | 'created_at'>;\n\n@DController('/authorize')\nexport class AuthorizeController {\n    // todo: maybe /realms/<realm>/protocol/openid-connect/authorize\n    // todo: maybe /realms/<realm>/[...]/authorize\n\n    protected options: AuthorizeControllerOptions;\n\n    protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n    protected codeRequestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n    protected authorizer: HTTPOAuth2Authorizer;\n\n    // ---------------------------------------------------------\n\n    constructor(ctx: AuthorizeControllerContext) {\n        this.options = ctx.options;\n\n        this.codeRequestVerifier = ctx.codeRequestVerifier;\n\n        this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();\n\n        this.authorizer = new HTTPOAuth2Authorizer({\n            codeRequestVerifier: this.codeRequestVerifier,\n            codeIssuer: ctx.codeIssuer,\n            sessionManager: ctx.sessionManager,\n            promptLoginMaxAge: ctx.options.promptLoginMaxAge,\n        });\n    }\n\n    // ---------------------------------------------------------\n\n    @DPost('', [ForceUserLoggedInMiddleware])\n    async confirm(@DContext() event: IAppEvent): Promise<{ url: string }> {\n        const result = await this.authorizer.authorizeWithRequest(event);\n\n        const url = new URL(result.redirectUri);\n        if (result.state) {\n            url.searchParams.set('state', result.state);\n        }\n\n        if (result.authorizationCode) {\n            url.searchParams.set('code', result.authorizationCode);\n        }\n\n        return { url: url.href };\n    }\n\n    @DGet('', [])\n    async serve(@DContext() event: IAppEvent): Promise<string> {\n        let codeRequest : OAuth2AuthorizationCodeRequest | undefined;\n\n        let client : ClientSummary | undefined;\n        let scopes : Scope[] | undefined;\n\n        // Target realm summary (the client's realm) — the UI names it in the\n        // realm-mismatch notice. codeRequest.realm_id is only the id.\n        let realm : RealmSummary | undefined;\n\n        // Whether the request redirect_uri matched a registered client pattern —\n        // the UI must not offer an automatic \"return to application\" redirect to\n        // an unverified (pattern-less-client) redirect_uri.\n        let redirectUriVerified = false;\n\n        let error : Error | undefined;\n\n        try {\n            const merged = await readFromLocations(event, ['body', 'query']);\n            const data = await this.codeRequestValidator.run(merged);\n\n            const result = await this.codeRequestVerifier.verify(data);\n\n            // Trim the client to a deliberate DTO before it reaches the\n            // anonymous SSR hydration payload — never disclose redirect_uri\n            // patterns (the trusted-origin set), grant_types, internal\n            // base/root URLs, is_confidential, or the secret storage flags to an\n            // unauthenticated visitor. (ClientEntity.secret is additionally\n            // select:false, so the secret is never loaded — but the DTO must not\n            // rely on that alone: a future entity/query change could unset it.)\n            client = {\n                id: result.client.id,\n                name: result.client.name,\n                display_name: result.client.display_name,\n                built_in: result.client.built_in,\n                created_at: result.client.created_at,\n            };\n            scopes = result.scopes;\n            redirectUriVerified = result.redirectUriVerified;\n\n            if (result.client.realm) {\n                realm = {\n                    id: result.client.realm.id,\n                    name: result.client.realm.name,\n                    display_name: result.client.realm.display_name,\n                };\n            }\n\n            codeRequest = result.data;\n        } catch (e) {\n            const normalized = sanitizeError(e);\n            error = {\n                ...normalized,\n                message: normalized.message,\n            };\n        }\n\n        // Path + query of the original request — the SSR page uses it as\n        // the same-origin `redirect` parameter on register / password links\n        // so those pages can lead back into this authorize request.\n        const requestURL = new URL(event.request.url);\n\n        return renderUIPage(event, {\n            url: '/authorize',\n            payload: {\n                config: { baseURL: this.options.baseURL },\n                data: {\n                    codeRequest,\n                    error,\n                    client,\n                    scopes,\n                    realm,\n                    redirectUriVerified,\n                    features: this.options.features,\n                    requestPath: `${requestURL.pathname}${requestURL.search}`,\n                },\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmCA,IAAaW,sBAAb,MAAaA;CAICC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAiC;EACzC,KAAKJ,UAAUI,IAAIJ;EAEnB,KAAKC,sBAAsBG,IAAIH;EAE/B,KAAKC,uBAAuB,IAAIL,wCAAAA;EAEhC,KAAKM,aAAa,IAAIT,qBAAqB;GACvCO,qBAAqB,KAAKA;GAC1BI,YAAYD,IAAIC;GAChBC,gBAAgBF,IAAIE;GACpBC,mBAAmBH,IAAIJ,QAAQO;EACnC,CAAA;CACJ;CAIA,MACMC,QAAQ,OAAwD;EAClE,MAAME,SAAS,MAAM,KAAKP,WAAWQ,qBAAqBF,KAAAA;EAE1D,MAAMG,MAAM,IAAIpB,IAAIkB,OAAOG,WAAW;EACtC,IAAIH,OAAOI,OACPF,IAAIG,aAAaC,IAAI,SAASN,OAAOI,KAAK;EAG9C,IAAIJ,OAAOO,mBACPL,IAAIG,aAAaC,IAAI,QAAQN,OAAOO,iBAAiB;EAGzD,OAAO,EAAEL,KAAKA,IAAIM,KAAK;CAC3B;CAEA,MACMC,MAAM,OAA+C;EACvD,IAAIC;EAEJ,IAAIC;EACJ,IAAIC;EAIJ,IAAIC;EAKJ,IAAIC,sBAAsB;EAE1B,IAAIC;EAEJ,IAAI;GACA,MAAMC,SAAS,MAAM9B,kBAAkBa,OAAO,CAAC,QAAQ,OAAA,CAAQ;GAC/D,MAAMkB,OAAO,MAAM,KAAKzB,qBAAqB0B,IAAIF,MAAAA;GAEjD,MAAMhB,SAAS,MAAM,KAAKT,oBAAoB4B,OAAOF,IAAAA;GASrDN,SAAS;IACLS,IAAIpB,OAAOW,OAAOS;IAClBC,MAAMrB,OAAOW,OAAOU;IACpBC,cAActB,OAAOW,OAAOW;IAC5BC,UAAUvB,OAAOW,OAAOY;IACxBC,YAAYxB,OAAOW,OAAOa;GAC9B;GACAZ,SAASZ,OAAOY;GAChBE,sBAAsBd,OAAOc;GAE7B,IAAId,OAAOW,OAAOE,OACdA,QAAQ;IACJO,IAAIpB,OAAOW,OAAOE,MAAMO;IACxBC,MAAMrB,OAAOW,OAAOE,MAAMQ;IAC1BC,cAActB,OAAOW,OAAOE,MAAMS;GACtC;GAGJZ,cAAcV,OAAOiB;EACzB,SAASQ,GAAG;GACR,MAAMC,aAAatC,cAAcqC,CAAAA;GACjCV,QAAQ;IACJ,GAAGW;IACHC,SAASD,WAAWC;GACxB;EACJ;EAKA,MAAMC,aAAa,IAAI9C,IAAIiB,MAAM8B,QAAQ3B,GAAG;EAE5C,OAAOjB,aAAac,OAAO;GACvBG,KAAK;GACL4B,SAAS;IACLC,QAAQ,EAAEC,SAAS,KAAK1C,QAAQ0C,QAAQ;IACxCf,MAAM;KACFP;KACAK;KACAJ;KACAC;KACAC;KACAC;KACAmB,UAAU,KAAK3C,QAAQ2C;KACvBC,aAAa,GAAGN,WAAWO,WAAWP,WAAWQ;IACrD;GACJ;EACJ,CAAA;CACJ;AACJ;;YAhGgBrD,2BAAAA,CAAAA"}
+{"version":3,"file":"module.mjs","names":["DContext","DController","DGet","DPost","URL","useRequestQuery","OAuth2AccessDeniedError","OAuth2ErrorCode","isOAuth2AccessDeniedError","ForceUserLoggedInMiddleware","HTTPOAuth2Authorizer","renderUIPage","readFromLocations","OAuth2AuthorizationCodeRequestValidator","sanitizeError","AuthorizeController","options","codeRequestVerifier","codeRequestValidator","authorizer","ctx","codeIssuer","sessionManager","eventService","metrics","promptLoginMaxAge","mfaFreshnessMaxAge","mfaChallengeProvider","accessPolicyEvaluator","consentService","logger","confirm","event","result","authorizeWithRequest","url","redirectUri","state","searchParams","set","authorizationCode","href","e","ACCESS_DENIED","serve","codeRequest","client","scopes","realm","redirectUriVerified","error","merged","data","run","verify","id","name","displayName","builtIn","createdAt","normalized","message","query","forClient","requestURL","request","payload","config","baseURL","features","requestPath","pathname","search"],"sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPost,\n} from '@routup/decorators';\nimport { URL } from 'node:url';\n\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type {\n    Client,\n    OAuth2AuthorizationCodeRequest,\n    Realm,\n    Scope,\n} from '@authup/core-kit';\nimport { OAuth2AccessDeniedError, OAuth2ErrorCode, isOAuth2AccessDeniedError } from '@authup/specs';\nimport { ForceUserLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { HTTPOAuth2Authorizer } from '../../../adapters/index.ts';\nimport { renderUIPage } from '../../../ui/index.ts';\nimport { readFromLocations } from '../../../request/index.ts';\nimport type { IOAuth2AuthorizationCodeRequestVerifier } from '../../../../../core/index.ts';\nimport { OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';\nimport type { AuthorizeControllerContext, AuthorizeControllerOptions } from './types.ts';\nimport { sanitizeError } from '../../../../../utils/index.ts';\n\ntype RealmSummary = Pick<Realm, 'id' | 'name' | 'displayName'>;\ntype ClientSummary = Pick<Client, 'id' | 'name' | 'displayName' | 'builtIn' | 'createdAt'>;\n\n@DController('/authorize')\nexport class AuthorizeController {\n    // todo: maybe /realms/<realm>/protocol/openid-connect/authorize\n    // todo: maybe /realms/<realm>/[...]/authorize\n\n    protected options: AuthorizeControllerOptions;\n\n    protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n    protected codeRequestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n    protected authorizer: HTTPOAuth2Authorizer;\n\n    // ---------------------------------------------------------\n\n    constructor(ctx: AuthorizeControllerContext) {\n        this.options = ctx.options;\n\n        this.codeRequestVerifier = ctx.codeRequestVerifier;\n\n        this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();\n\n        this.authorizer = new HTTPOAuth2Authorizer({\n            codeRequestVerifier: this.codeRequestVerifier,\n            codeIssuer: ctx.codeIssuer,\n            sessionManager: ctx.sessionManager,\n            eventService: ctx.eventService,\n            metrics: ctx.metrics,\n            promptLoginMaxAge: ctx.options.promptLoginMaxAge,\n            mfaFreshnessMaxAge: ctx.options.mfaFreshnessMaxAge,\n            mfaChallengeProvider: ctx.mfaChallengeProvider,\n            accessPolicyEvaluator: ctx.accessPolicyEvaluator,\n            consentService: ctx.consentService,\n            logger: ctx.logger,\n        });\n    }\n\n    // ---------------------------------------------------------\n\n    @DPost('', [ForceUserLoggedInMiddleware])\n    async confirm(@DContext() event: IAppEvent): Promise<{ url: string }> {\n        try {\n            const result = await this.authorizer.authorizeWithRequest(event);\n\n            const url = new URL(result.redirectUri);\n            if (result.state) {\n                url.searchParams.set('state', result.state);\n            }\n\n            if (result.authorizationCode) {\n                url.searchParams.set('code', result.authorizationCode);\n            }\n\n            return { url: url.href };\n        } catch (e) {\n            // Access-policy denial (plan 052): with a pattern-verified\n            // redirect_uri the denial is answered as an error redirect\n            // (RFC 6749 §4.1.2.1) — the kit navigates the returned url like\n            // any success. Unverified → rethrow → 400 body → interactive\n            // denial card.\n            if (isOAuth2AccessDeniedError(e) && e.redirectUri) {\n                const url = new URL(e.redirectUri);\n                url.searchParams.set('error', OAuth2ErrorCode.ACCESS_DENIED);\n                if (e.state) {\n                    url.searchParams.set('state', e.state);\n                }\n\n                return { url: url.href };\n            }\n\n            throw e;\n        }\n    }\n\n    @DGet('', [])\n    async serve(@DContext() event: IAppEvent): Promise<string> {\n        let codeRequest : OAuth2AuthorizationCodeRequest | undefined;\n\n        let client : ClientSummary | undefined;\n        let scopes : Scope[] | undefined;\n\n        // Target realm summary (the client's realm) — the UI names it in the\n        // realm-mismatch notice. codeRequest.realm_id is only the id.\n        let realm : RealmSummary | undefined;\n\n        // Whether the request redirect_uri matched a registered client pattern —\n        // the UI must not offer an automatic \"return to application\" redirect to\n        // an unverified (pattern-less-client) redirect_uri.\n        let redirectUriVerified = false;\n\n        let error : Error | undefined;\n\n        try {\n            const merged = await readFromLocations(event, ['body', 'query']);\n            const data = await this.codeRequestValidator.run(merged);\n\n            const result = await this.codeRequestVerifier.verify(data);\n\n            // Trim the client to a deliberate DTO before it reaches the\n            // anonymous SSR hydration payload — never disclose redirect_uri\n            // patterns (the trusted-origin set), grant_types, internal\n            // base/root URLs, auth methods, or the secret storage flags to an\n            // unauthenticated visitor. (ClientEntity.secret is additionally\n            // select:false, so the secret is never loaded — but the DTO must not\n            // rely on that alone: a future entity/query change could unset it.)\n            client = {\n                id: result.client.id,\n                name: result.client.name,\n                displayName: result.client.displayName,\n                builtIn: result.client.builtIn,\n                createdAt: result.client.createdAt,\n            };\n            scopes = result.scopes;\n            redirectUriVerified = result.redirectUriVerified;\n\n            if (result.client.realm) {\n                realm = {\n                    id: result.client.realm.id,\n                    name: result.client.realm.name,\n                    displayName: result.client.realm.displayName,\n                };\n            }\n\n            codeRequest = result.data;\n        } catch (e) {\n            const normalized = sanitizeError(e);\n            error = {\n                ...normalized,\n                message: normalized.message,\n            };\n        }\n\n        // A recognized `error` query param (the federated-IdP callback\n        // redirects back here with error=access_denied on a policy denial)\n        // is mapped onto the hydration payload's error — neutral message,\n        // never attacker-controlled text.\n        if (!error) {\n            const query = useRequestQuery(event);\n            if (query.error === OAuth2ErrorCode.ACCESS_DENIED) {\n                const normalized = sanitizeError(OAuth2AccessDeniedError.forClient());\n                error = {\n                    ...normalized,\n                    message: normalized.message,\n                };\n            }\n        }\n\n        // Path + query of the original request — the SSR page uses it as\n        // the same-origin `redirect` parameter on register / password links\n        // so those pages can lead back into this authorize request.\n        const requestURL = new URL(event.request.url);\n\n        return renderUIPage(event, {\n            url: '/authorize',\n            payload: {\n                config: { baseURL: this.options.baseURL },\n                data: {\n                    codeRequest,\n                    error,\n                    client,\n                    scopes,\n                    realm,\n                    redirectUriVerified,\n                    features: this.options.features,\n                    requestPath: `${requestURL.pathname}${requestURL.search}`,\n                },\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,IAAae,sBAAb,MAAaA;CAICC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAiC;EACzC,KAAKJ,UAAUI,IAAIJ;EAEnB,KAAKC,sBAAsBG,IAAIH;EAE/B,KAAKC,uBAAuB,IAAIL,wCAAAA;EAEhC,KAAKM,aAAa,IAAIT,qBAAqB;GACvCO,qBAAqB,KAAKA;GAC1BI,YAAYD,IAAIC;GAChBC,gBAAgBF,IAAIE;GACpBC,cAAcH,IAAIG;GAClBC,SAASJ,IAAII;GACbC,mBAAmBL,IAAIJ,QAAQS;GAC/BC,oBAAoBN,IAAIJ,QAAQU;GAChCC,sBAAsBP,IAAIO;GAC1BC,uBAAuBR,IAAIQ;GAC3BC,gBAAgBT,IAAIS;GACpBC,QAAQV,IAAIU;EAChB,CAAA;CACJ;CAIA,MACMC,QAAQ,OAAwD;EAClE,IAAI;GACA,MAAME,SAAS,MAAM,KAAKd,WAAWe,qBAAqBF,KAAAA;GAE1D,MAAMG,MAAM,IAAI/B,IAAI6B,OAAOG,WAAW;GACtC,IAAIH,OAAOI,OACPF,IAAIG,aAAaC,IAAI,SAASN,OAAOI,KAAK;GAG9C,IAAIJ,OAAOO,mBACPL,IAAIG,aAAaC,IAAI,QAAQN,OAAOO,iBAAiB;GAGzD,OAAO,EAAEL,KAAKA,IAAIM,KAAK;EAC3B,SAASC,GAAG;GAMR,IAAIlC,0BAA0BkC,CAAAA,KAAMA,EAAEN,aAAa;IAC/C,MAAMD,MAAM,IAAI/B,IAAIsC,EAAEN,WAAW;IACjCD,IAAIG,aAAaC,IAAI,SAAShC,gBAAgBoC,aAAa;IAC3D,IAAID,EAAEL,OACFF,IAAIG,aAAaC,IAAI,SAASG,EAAEL,KAAK;IAGzC,OAAO,EAAEF,KAAKA,IAAIM,KAAK;GAC3B;GAEA,MAAMC;EACV;CACJ;CAEA,MACME,MAAM,OAA+C;EACvD,IAAIC;EAEJ,IAAIC;EACJ,IAAIC;EAIJ,IAAIC;EAKJ,IAAIC,sBAAsB;EAE1B,IAAIC;EAEJ,IAAI;GACA,MAAMC,SAAS,MAAMvC,kBAAkBoB,OAAO,CAAC,QAAQ,OAAA,CAAQ;GAC/D,MAAMoB,OAAO,MAAM,KAAKlC,qBAAqBmC,IAAIF,MAAAA;GAEjD,MAAMlB,SAAS,MAAM,KAAKhB,oBAAoBqC,OAAOF,IAAAA;GASrDN,SAAS;IACLS,IAAItB,OAAOa,OAAOS;IAClBC,MAAMvB,OAAOa,OAAOU;IACpBC,aAAaxB,OAAOa,OAAOW;IAC3BC,SAASzB,OAAOa,OAAOY;IACvBC,WAAW1B,OAAOa,OAAOa;GAC7B;GACAZ,SAASd,OAAOc;GAChBE,sBAAsBhB,OAAOgB;GAE7B,IAAIhB,OAAOa,OAAOE,OACdA,QAAQ;IACJO,IAAItB,OAAOa,OAAOE,MAAMO;IACxBC,MAAMvB,OAAOa,OAAOE,MAAMQ;IAC1BC,aAAaxB,OAAOa,OAAOE,MAAMS;GACrC;GAGJZ,cAAcZ,OAAOmB;EACzB,SAASV,GAAG;GACR,MAAMkB,aAAa9C,cAAc4B,CAAAA;GACjCQ,QAAQ;IACJ,GAAGU;IACHC,SAASD,WAAWC;GACxB;EACJ;EAMA,IAAI,CAACX;OACa7C,gBAAgB2B,KAC1B8B,CAAAA,CAAMZ,UAAU3C,gBAAgBoC,eAAe;IAC/C,MAAMiB,aAAa9C,cAAcR,wBAAwByD,UAAS,CAAA;IAClEb,QAAQ;KACJ,GAAGU;KACHC,SAASD,WAAWC;IACxB;GACJ;;EAMJ,MAAMG,aAAa,IAAI5D,IAAI4B,MAAMiC,QAAQ9B,GAAG;EAE5C,OAAOxB,aAAaqB,OAAO;GACvBG,KAAK;GACL+B,SAAS;IACLC,QAAQ,EAAEC,SAAS,KAAKpD,QAAQoD,QAAQ;IACxChB,MAAM;KACFP;KACAK;KACAJ;KACAC;KACAC;KACAC;KACAoB,UAAU,KAAKrD,QAAQqD;KACvBC,aAAa,GAAGN,WAAWO,WAAWP,WAAWQ;IACrD;GACJ;EACJ,CAAA;CACJ;AACJ;;YAlIgB/D,2BAAAA,CAAAA"}

package/dist/adapters/http/controllers/workflows/authorize/types.d.ts

@@ -1,5 +1,6 @@
 import type { StatusResponseFeatures } from '@authup/core-http-kit';
-import type { IOAuth2AuthorizationCodeIssuer, IOAuth2AuthorizationCodeRequestVerifier, ISessionManager } from '../../../../../core/index.ts';
+import type { Logger } from '@authup/server-kit';
+import type { IAuthFlowMetrics, IConsentService, IEventService, IOAuth2AccessPolicyEvaluator, IOAuth2AuthorizationCodeIssuer, IOAuth2AuthorizationCodeRequestVerifier, ISessionManager, IUserAuthenticatorChallengeProvider } from '../../../../../core/index.ts';
 export type AuthorizeControllerOptions = {
     baseURL: string;
     features: StatusResponseFeatures;
@@ -8,11 +9,26 @@ export type AuthorizeControllerOptions = {
      * (config `promptLoginMaxAge`).
      */
     promptLoginMaxAge?: number;
+    /**
+     * Max age (seconds) of the session's mfa_at an acr_values step-up request
+     * accepts before forcing a fresh challenge (config `mfaFreshnessMaxAge`).
+     */
+    mfaFreshnessMaxAge?: number;
 };
 export type AuthorizeControllerContext = {
     options: AuthorizeControllerOptions;
     codeIssuer: IOAuth2AuthorizationCodeIssuer;
     codeRequestVerifier: IOAuth2AuthorizationCodeRequestVerifier;
     sessionManager: ISessionManager;
+    eventService?: IEventService;
+    metrics?: IAuthFlowMetrics;
+    mfaChallengeProvider?: IUserAuthenticatorChallengeProvider;
+    accessPolicyEvaluator?: IOAuth2AccessPolicyEvaluator;
+    /**
+     * Persisted per-scope consent (plan 055): records the approved scope
+     * tokens after a successful (non-built_in) POST /authorize approval.
+     */
+    consentService?: IConsentService;
+    logger?: Logger;
 };
 //# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/controllers/workflows/authorize/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,EACR,8BAA8B,EAC9B,uCAAuC,EACvC,eAAe,EAClB,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,0BAA0B,GAAG;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,sBAAsB,CAAC;IACjC;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACrC,OAAO,EAAE,0BAA0B,CAAC;IAEpC,UAAU,EAAE,8BAA8B,CAAC;IAC3C,mBAAmB,EAAE,uCAAuC,CAAC;IAE7D,cAAc,EAAE,eAAe,CAAA;CAClC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EACR,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,4BAA4B,EAC5B,8BAA8B,EAC9B,uCAAuC,EACvC,eAAe,EACf,mCAAmC,EACtC,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,0BAA0B,GAAG;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,sBAAsB,CAAC;IACjC;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACrC,OAAO,EAAE,0BAA0B,CAAC;IAEpC,UAAU,EAAE,8BAA8B,CAAC;IAC3C,mBAAmB,EAAE,uCAAuC,CAAC;IAE7D,cAAc,EAAE,eAAe,CAAC;IAEhC,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAE3B,oBAAoB,CAAC,EAAE,mCAAmC,CAAC;IAC3D,qBAAqB,CAAC,EAAE,4BAA4B,CAAC;IAErD;;;OAGG;IACH,cAAc,CAAC,EAAE,eAAe,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC"}

package/dist/adapters/http/controllers/workflows/index.d.ts

@@ -1,4 +1,5 @@
 export * from './activate/index.ts';
+export * from './authenticator-challenge/index.ts';
 export * from './authorize/index.ts';
 export * from './jwks/index.ts';
 export * from './logout/index.ts';

package/dist/adapters/http/controllers/workflows/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/controllers/workflows/index.ts"],"names":[],"mappings":"AAOA,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/controllers/workflows/index.ts"],"names":[],"mappings":"AAOA,cAAc,qBAAqB,CAAC;AACpC,cAAc,oCAAoC,CAAC;AACnD,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC"}

package/dist/adapters/http/controllers/workflows/index.mjs

@@ -3,6 +3,8 @@ import "node:url";
 import.meta.url;
 import { ActivateController } from "./activate/module.mjs";
 import "./activate/index.mjs";
+import { AuthenticatorChallengeController } from "./authenticator-challenge/module.mjs";
+import "./authenticator-challenge/index.mjs";
 import { AuthorizeController } from "./authorize/module.mjs";
 import "./authorize/index.mjs";
 import { getJwkRouteHandler, getJwksRouteHandler } from "./jwks/handlers/read.mjs";
@@ -22,4 +24,4 @@ import { StatusController } from "./status/module.mjs";
 import "./status/index.mjs";
 import { TokenController } from "./token/module.mjs";
 import "./token/index.mjs";
-export { ActivateController, AuthorizeController, JwkController, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, RegisterController, StatusController, TokenController, getJwkRouteHandler, getJwksRouteHandler };
+export { ActivateController, AuthenticatorChallengeController, AuthorizeController, JwkController, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, RegisterController, StatusController, TokenController, getJwkRouteHandler, getJwksRouteHandler };

package/dist/adapters/http/controllers/workflows/jwks/handlers/read.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../../../../../../src/adapters/http/controllers/workflows/jwks/handlers/read.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0CAA0C,CAAC;AAE1E,wBAAsB,mBAAmB,CACrC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EACjC,OAAO,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,IAAI,EAAE,gBAAgB,EAAE,CAAA;CAAE,CAAC,CA6BxC;AAED,wBAAsB,kBAAkB,CACpC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EACjC,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,gBAAgB,CAAC,CA+B5B"}
+{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../../../../../../src/adapters/http/controllers/workflows/jwks/handlers/read.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAgB,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0CAA0C,CAAC;AAG1E,wBAAsB,mBAAmB,CACrC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EACjC,OAAO,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,IAAI,EAAE,gBAAgB,EAAE,CAAA;CAAE,CAAC,CAwCxC;AAED,wBAAsB,kBAAkB,CACpC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EACjC,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,gBAAgB,CAAC,CAmC5B"}

package/dist/adapters/http/controllers/workflows/jwks/handlers/read.mjs

@@ -1,44 +1,58 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { buildCertificateJwkFields } from "../../../../../../core/key/certificate.mjs";
+import "../../../../../../core/index.mjs";
 import { In } from "typeorm";
+import { KeyStatus } from "@authup/core-kit";
 import { AsymmetricKey } from "@authup/server-kit";
-import { JWKError, JWKType } from "@authup/specs";
+import { JWKError, JWKType, JWKUse } from "@authup/specs";
 //#region src/adapters/http/controllers/workflows/jwks/handlers/read.ts
 async function getJwksRouteHandler(repository, realmId) {
 	const promises = (await repository.find({
 		where: {
 			type: In([JWKType.RSA, JWKType.EC]),
-			...realmId ? { realm_id: realmId } : {}
+			use: JWKUse.SIGNATURE,
+			status: In([KeyStatus.ACTIVE, KeyStatus.PASSIVE]),
+			...realmId ? { realmId } : {}
 		},
 		order: { priority: "DESC" }
-	})).filter((entity) => !!entity.encryption_key).map((entity) => AsymmetricKey.fromBase64({
+	})).filter((entity) => !!entity.encryptionKey && !!entity.signatureAlgorithm).map((entity) => AsymmetricKey.fromBase64({
 		format: "spki",
-		key: entity.encryption_key,
-		options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signature_algorithm)
-	}).then((container) => container.toJWK()).then((key) => ({
-		...key,
-		kid: entity.id,
-		alg: entity.signature_algorithm
-	})));
+		key: entity.encryptionKey,
+		options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signatureAlgorithm)
+	}).then((container) => container.toJWK()).then(async (key) => {
+		const certificateFields = await buildCertificateJwkFields(entity.certificate);
+		return {
+			...key,
+			kid: entity.id,
+			alg: entity.signatureAlgorithm,
+			...certificateFields
+		};
+	}));
 	return { keys: await Promise.all(promises) };
 }
 async function getJwkRouteHandler(repository, keyId, realmId) {
 	const entity = await repository.findOne({ where: {
 		type: In([JWKType.RSA, JWKType.EC]),
+		use: JWKUse.SIGNATURE,
+		status: In([KeyStatus.ACTIVE, KeyStatus.PASSIVE]),
 		id: keyId,
-		...realmId ? { realm_id: realmId } : {}
+		...realmId ? { realmId } : {}
 	} });
 	if (!entity) throw JWKError.notFound(keyId);
-	if (!entity.encryption_key) throw JWKError.encryptionKeyMissing();
+	if (!entity.encryptionKey || !entity.signatureAlgorithm) throw JWKError.encryptionKeyMissing();
+	const jsonWebKey = await (await AsymmetricKey.fromBase64({
+		format: "spki",
+		key: entity.encryptionKey,
+		options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signatureAlgorithm)
+	})).toJWK();
+	const certificateFields = await buildCertificateJwkFields(entity.certificate);
 	return {
-		...await (await AsymmetricKey.fromBase64({
-			format: "spki",
-			key: entity.encryption_key,
-			options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signature_algorithm)
-		})).toJWK(),
+		...jsonWebKey,
 		kid: entity.id,
-		alg: entity.signature_algorithm
+		alg: entity.signatureAlgorithm,
+		...certificateFields
 	};
 }
 //#endregion

package/dist/adapters/http/controllers/workflows/jwks/handlers/read.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"read.mjs","names":["AsymmetricKey","JWKError","JWKType","In","getJwksRouteHandler","repository","realmId","entities","find","where","type","RSA","EC","realm_id","order","priority","promises","filter","entity","encryption_key","map","fromBase64","format","key","options","buildImportOptionsForJWTAlgorithm","signature_algorithm","then","container","toJWK","kid","id","alg","keys","Promise","all","getJwkRouteHandler","keyId","findOne","notFound","encryptionKeyMissing","jsonWebKey"],"sources":["../../../../../../../src/adapters/http/controllers/workflows/jwks/handlers/read.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { AsymmetricKey } from '@authup/server-kit';\nimport type { OAuth2JsonWebKey } from '@authup/specs';\nimport { JWKError, JWKType } from '@authup/specs';\nimport type { Repository } from 'typeorm';\nimport { In } from 'typeorm';\nimport type { KeyEntity } from '../../../../../database/domains/index.ts';\n\nexport async function getJwksRouteHandler(\n    repository: Repository<KeyEntity>,\n    realmId?: string,\n) : Promise<{ keys: OAuth2JsonWebKey[] }> {\n    const entities = await repository.find({\n        where: {\n            type: In([JWKType.RSA, JWKType.EC]),\n            ...(realmId ? { realm_id: realmId } : {}),\n        },\n        order: { priority: 'DESC' },\n    });\n\n    const promises = entities\n        .filter((entity): entity is KeyEntity & { encryption_key: string } => !!entity.encryption_key)\n        .map(\n            (entity) => AsymmetricKey\n                .fromBase64({\n                    format: 'spki',\n                    key: entity.encryption_key,\n                    options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signature_algorithm),\n                })\n                .then((container) => container.toJWK())\n                .then((key) => ({\n                    ...key,\n                    kid: entity.id,\n                    alg: entity.signature_algorithm,\n                })),\n        );\n\n    const keys = await Promise.all(promises);\n\n    return { keys };\n}\n\nexport async function getJwkRouteHandler(\n    repository: Repository<KeyEntity>,\n    keyId: string,\n    realmId?: string,\n) : Promise<OAuth2JsonWebKey> {\n    const entity = await repository.findOne({\n        where: {\n            type: In([JWKType.RSA, JWKType.EC]),\n            id: keyId,\n            ...(realmId ? { realm_id: realmId } : {}),\n        },\n    });\n\n    if (!entity) {\n        throw JWKError.notFound(keyId);\n    }\n\n    if (!entity.encryption_key) {\n        throw JWKError.encryptionKeyMissing();\n    }\n\n    const container = await AsymmetricKey\n        .fromBase64({\n            format: 'spki',\n            key: entity.encryption_key,\n            options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signature_algorithm),\n        });\n\n    const jsonWebKey = await container.toJWK();\n\n    return {\n        ...jsonWebKey,\n        kid: entity.id,\n        alg: entity.signature_algorithm,\n    };\n}\n"],"mappings":";;;;;;;AAcA,eAAsBI,oBAClBC,YACAC,SAAgB;CAUhB,MAAMU,YAAWT,MARMF,WAAWG,KAAK;EACnCC,OAAO;GACHC,MAAMP,GAAG,CAACD,QAAQS,KAAKT,QAAQU,EAAAA,CAAG;GAClC,GAAIN,UAAU,EAAEO,UAAUP,QAAQ,IAAI,CAAC;EAC3C;EACAQ,OAAO,EAAEC,UAAU,OAAO;CAC9B,CAAA,EAAA,CAGKE,QAAQC,WAA6D,CAAC,CAACA,OAAOC,cAAc,CAAA,CAC5FC,KACIF,WAAWlB,cACPqB,WAAW;EACRC,QAAQ;EACRC,KAAKL,OAAOC;EACZK,SAASxB,cAAcyB,kCAAkCP,OAAOQ,mBAAmB;CACvF,CAAA,CAAA,CACCC,MAAMC,cAAcA,UAAUC,MAAK,CAAA,CAAA,CACnCF,MAAMJ,SAAS;EACZ,GAAGA;EACHO,KAAKZ,OAAOa;EACZC,KAAKd,OAAOQ;CAChB,EAAA,CAAA;CAKZ,OAAO,EAAEO,MAAAA,MAFUC,QAAQC,IAAInB,QAAAA,EAEjB;AAClB;AAEA,eAAsBoB,mBAClB/B,YACAgC,OACA/B,SAAgB;CAEhB,MAAMY,SAAS,MAAMb,WAAWiC,QAAQ,EACpC7B,OAAO;EACHC,MAAMP,GAAG,CAACD,QAAQS,KAAKT,QAAQU,EAAAA,CAAG;EAClCmB,IAAIM;EACJ,GAAI/B,UAAU,EAAEO,UAAUP,QAAQ,IAAI,CAAC;CAC3C,EACJ,CAAA;CAEA,IAAI,CAACY,QACD,MAAMjB,SAASsC,SAASF,KAAAA;CAG5B,IAAI,CAACnB,OAAOC,gBACR,MAAMlB,SAASuC,qBAAoB;CAYvC,OAAO;EACH,GAAGC,OAHkBb,MAPD5B,cACnBqB,WAAW;GACRC,QAAQ;GACRC,KAAKL,OAAOC;GACZK,SAASxB,cAAcyB,kCAAkCP,OAAOQ,mBAAmB;EACvF,CAAA,EAAA,CAE+BG,MAAK;EAIpCC,KAAKZ,OAAOa;EACZC,KAAKd,OAAOQ;CAChB;AACJ"}
+{"version":3,"file":"read.mjs","names":["KeyStatus","AsymmetricKey","JWKError","JWKType","JWKUse","In","buildCertificateJwkFields","getJwksRouteHandler","repository","realmId","entities","find","where","type","RSA","EC","use","SIGNATURE","status","ACTIVE","PASSIVE","order","priority","promises","filter","entity","encryptionKey","signatureAlgorithm","map","fromBase64","format","key","options","buildImportOptionsForJWTAlgorithm","then","container","toJWK","certificateFields","certificate","kid","id","alg","keys","Promise","all","getJwkRouteHandler","keyId","findOne","notFound","encryptionKeyMissing","jsonWebKey"],"sources":["../../../../../../../src/adapters/http/controllers/workflows/jwks/handlers/read.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { KeyStatus } from '@authup/core-kit';\nimport { AsymmetricKey } from '@authup/server-kit';\nimport type { JWTAlgorithm, OAuth2JsonWebKey } from '@authup/specs';\nimport { JWKError, JWKType, JWKUse } from '@authup/specs';\nimport type { Repository } from 'typeorm';\nimport { In } from 'typeorm';\nimport type { KeyEntity } from '../../../../../database/domains/index.ts';\nimport { buildCertificateJwkFields } from '../../../../../../core/index.ts';\n\nexport async function getJwksRouteHandler(\n    repository: Repository<KeyEntity>,\n    realmId?: string,\n) : Promise<{ keys: OAuth2JsonWebKey[] }> {\n    const entities = await repository.find({\n        where: {\n            type: In([JWKType.RSA, JWKType.EC]),\n            use: JWKUse.SIGNATURE,\n            // active + passive verify; disabled keys never publish.\n            status: In([KeyStatus.ACTIVE, KeyStatus.PASSIVE]),\n            ...(realmId ? { realmId } : {}),\n        },\n        order: { priority: 'DESC' },\n    });\n\n    const promises = entities\n        .filter(\n            (entity): entity is KeyEntity & { encryptionKey: string, signatureAlgorithm: `${JWTAlgorithm}` } => !!entity.encryptionKey &&\n                !!entity.signatureAlgorithm,\n        )\n        .map(\n            (entity) => AsymmetricKey\n                .fromBase64({\n                    format: 'spki',\n                    key: entity.encryptionKey,\n                    options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signatureAlgorithm),\n                })\n                .then((container) => container.toJWK())\n                .then(async (key) => {\n                    const certificateFields = await buildCertificateJwkFields(entity.certificate);\n\n                    return {\n                        ...key,\n                        kid: entity.id,\n                        alg: entity.signatureAlgorithm,\n                        ...certificateFields,\n                    };\n                }),\n        );\n\n    const keys = await Promise.all(promises);\n\n    return { keys };\n}\n\nexport async function getJwkRouteHandler(\n    repository: Repository<KeyEntity>,\n    keyId: string,\n    realmId?: string,\n) : Promise<OAuth2JsonWebKey> {\n    const entity = await repository.findOne({\n        where: {\n            type: In([JWKType.RSA, JWKType.EC]),\n            use: JWKUse.SIGNATURE,\n            status: In([KeyStatus.ACTIVE, KeyStatus.PASSIVE]),\n            id: keyId,\n            ...(realmId ? { realmId } : {}),\n        },\n    });\n\n    if (!entity) {\n        throw JWKError.notFound(keyId);\n    }\n\n    if (!entity.encryptionKey || !entity.signatureAlgorithm) {\n        throw JWKError.encryptionKeyMissing();\n    }\n\n    const container = await AsymmetricKey\n        .fromBase64({\n            format: 'spki',\n            key: entity.encryptionKey,\n            options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signatureAlgorithm),\n        });\n\n    const jsonWebKey = await container.toJWK();\n    const certificateFields = await buildCertificateJwkFields(entity.certificate);\n\n    return {\n        ...jsonWebKey,\n        kid: entity.id,\n        alg: entity.signatureAlgorithm,\n        ...certificateFields,\n    };\n}\n"],"mappings":";;;;;;;;;;AAgBA,eAAsBO,oBAClBC,YACAC,SAAgB;CAahB,MAAMc,YAAWb,MAXMF,WAAWG,KAAK;EACnCC,OAAO;GACHC,MAAMR,GAAG,CAACF,QAAQW,KAAKX,QAAQY,EAAAA,CAAG;GAClCC,KAAKZ,OAAOa;GAEZC,QAAQb,GAAG,CAACL,UAAUmB,QAAQnB,UAAUoB,OAAAA,CAAQ;GAChD,GAAIX,UAAU,EAAEA,QAAQ,IAAI,CAAC;EACjC;EACAY,OAAO,EAAEC,UAAU,OAAO;CAC9B,CAAA,EAAA,CAGKE,QACIC,WAAmG,CAAC,CAACA,OAAOC,iBACzG,CAAC,CAACD,OAAOE,kBAAkB,CAAA,CAElCC,KACIH,WAAWxB,cACP4B,WAAW;EACRC,QAAQ;EACRC,KAAKN,OAAOC;EACZM,SAAS/B,cAAcgC,kCAAkCR,OAAOE,kBAAkB;CACtF,CAAA,CAAA,CACCO,MAAMC,cAAcA,UAAUC,MAAK,CAAA,CAAA,CACnCF,KAAK,OAAOH,QAAAA;EACT,MAAMM,oBAAoB,MAAM/B,0BAA0BmB,OAAOa,WAAW;EAE5E,OAAO;GACH,GAAGP;GACHQ,KAAKd,OAAOe;GACZC,KAAKhB,OAAOE;GACZ,GAAGU;EACP;CACJ,CAAA,CAAA;CAKZ,OAAO,EAAEK,MAAAA,MAFUC,QAAQC,IAAIrB,QAAAA,EAEjB;AAClB;AAEA,eAAsBsB,mBAClBrC,YACAsC,OACArC,SAAgB;CAEhB,MAAMgB,SAAS,MAAMjB,WAAWuC,QAAQ,EACpCnC,OAAO;EACHC,MAAMR,GAAG,CAACF,QAAQW,KAAKX,QAAQY,EAAAA,CAAG;EAClCC,KAAKZ,OAAOa;EACZC,QAAQb,GAAG,CAACL,UAAUmB,QAAQnB,UAAUoB,OAAAA,CAAQ;EAChDoB,IAAIM;EACJ,GAAIrC,UAAU,EAAEA,QAAQ,IAAI,CAAC;CACjC,EACJ,CAAA;CAEA,IAAI,CAACgB,QACD,MAAMvB,SAAS8C,SAASF,KAAAA;CAG5B,IAAI,CAACrB,OAAOC,iBAAiB,CAACD,OAAOE,oBACjC,MAAMzB,SAAS+C,qBAAoB;CAUvC,MAAMC,aAAa,OAAMf,MAPDlC,cACnB4B,WAAW;EACRC,QAAQ;EACRC,KAAKN,OAAOC;EACZM,SAAS/B,cAAcgC,kCAAkCR,OAAOE,kBAAkB;CACtF,CAAA,EAAA,CAE+BS,MAAK;CACxC,MAAMC,oBAAoB,MAAM/B,0BAA0BmB,OAAOa,WAAW;CAE5E,OAAO;EACH,GAAGY;EACHX,KAAKd,OAAOe;EACZC,KAAKhB,OAAOE;EACZ,GAAGU;CACP;AACJ"}

package/dist/adapters/http/controllers/workflows/jwks/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/jwks/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAStD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAC;AAGvE,MAAM,MAAM,oBAAoB,GAAG;IAC/B,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAA;CACpC,CAAC;AAEF,qBACa,aAAa;IACtB,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;gBAEhC,GAAG,EAAE,oBAAoB;IAK/B,WAAW,CACD,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC;QAAE,IAAI,EAAE,gBAAgB,EAAE,CAAA;KAAE,CAAC;IAkClC,UAAU,CAAc,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;CA+BvE"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/jwks/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAgB,gBAAgB,EAAE,MAAM,eAAe,CAAC;AASpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAC;AAIvE,MAAM,MAAM,oBAAoB,GAAG;IAC/B,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAA;CACpC,CAAC;AAEF,qBACa,aAAa;IACtB,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;gBAEhC,GAAG,EAAE,oBAAoB;IAK/B,WAAW,CACD,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC;QAAE,IAAI,EAAE,gBAAgB,EAAE,CAAA;KAAE,CAAC;IA6ClC,UAAU,CAAc,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;CAmCvE"}

package/dist/adapters/http/controllers/workflows/jwks/module.mjs

@@ -1,11 +1,14 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { buildCertificateJwkFields } from "../../../../../core/key/certificate.mjs";
+import "../../../../../core/index.mjs";
 import { getRequestStringParam } from "../../../request/helpers/param-id.mjs";
 import "../../../request/index.mjs";
 import { In } from "typeorm";
+import { KeyStatus } from "@authup/core-kit";
 import { AsymmetricKey } from "@authup/server-kit";
-import { JWKError, JWKType } from "@authup/specs";
+import { JWKError, JWKType, JWKUse } from "@authup/specs";
 import { DContext, DController, DGet, DPath } from "@routup/decorators";
 //#region src/adapters/http/controllers/workflows/jwks/module.ts
 function _ts_decorate(decorators, target, key, desc) {
@@ -32,35 +35,46 @@ var JwkController = class {
 		const promises = (await this.repository.find({
 			where: {
 				type: In([JWKType.RSA, JWKType.EC]),
-				...realmId ? { realm_id: realmId } : {}
+				use: JWKUse.SIGNATURE,
+				status: In([KeyStatus.ACTIVE, KeyStatus.PASSIVE]),
+				...realmId ? { realmId } : {}
 			},
 			order: { priority: "DESC" }
-		})).filter((entity) => !!entity.encryption_key).map((entity) => AsymmetricKey.fromBase64({
+		})).filter((entity) => !!entity.encryptionKey && !!entity.signatureAlgorithm).map((entity) => AsymmetricKey.fromBase64({
 			format: "spki",
-			key: entity.encryption_key,
-			options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signature_algorithm)
-		}).then((container) => container.toJWK()).then((key) => ({
-			...key,
-			kid: entity.id,
-			alg: entity.signature_algorithm
-		})));
+			key: entity.encryptionKey,
+			options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signatureAlgorithm)
+		}).then((container) => container.toJWK()).then(async (key) => {
+			const certificateFields = await buildCertificateJwkFields(entity.certificate);
+			return {
+				...key,
+				kid: entity.id,
+				alg: entity.signatureAlgorithm,
+				...certificateFields
+			};
+		}));
 		return { keys: await Promise.all(promises) };
 	}
 	async getOneJwks(id) {
 		const entity = await this.repository.findOne({ where: {
 			type: In([JWKType.RSA, JWKType.EC]),
+			use: JWKUse.SIGNATURE,
+			status: In([KeyStatus.ACTIVE, KeyStatus.PASSIVE]),
 			id
 		} });
 		if (!entity) throw JWKError.notFound(id);
-		if (!entity.encryption_key) throw JWKError.encryptionKeyMissing();
+		if (!entity.encryptionKey || !entity.signatureAlgorithm) throw JWKError.encryptionKeyMissing();
+		const jsonWebKey = await (await AsymmetricKey.fromBase64({
+			format: "spki",
+			key: entity.encryptionKey,
+			options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signatureAlgorithm)
+		})).toJWK();
+		const certificateFields = await buildCertificateJwkFields(entity.certificate);
 		return {
-			...await (await AsymmetricKey.fromBase64({
-				format: "spki",
-				key: entity.encryption_key,
-				options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signature_algorithm)
-			})).toJWK(),
+			...jsonWebKey,
 			kid: entity.id,
-			alg: entity.signature_algorithm
+			alg: entity.signatureAlgorithm,
+			...certificateFields
 		};
 	}
 };

package/dist/adapters/http/controllers/workflows/jwks/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["JWKError","JWKType","AsymmetricKey","DContext","DController","DGet","DPath","In","getRequestStringParam","JwkController","repository","ctx","getManyJwks","event","realmId","entities","find","where","type","RSA","EC","realm_id","order","priority","promises","filter","entity","encryption_key","map","fromBase64","format","key","options","buildImportOptionsForJWTAlgorithm","signature_algorithm","then","container","toJWK","kid","id","alg","keys","Promise","all","getOneJwks","findOne","notFound","encryptionKeyMissing","jsonWebKey"],"sources":["../../../../../../src/adapters/http/controllers/workflows/jwks/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2JsonWebKey } from '@authup/specs';\nimport { JWKError, JWKType } from '@authup/specs';\nimport { AsymmetricKey } from '@authup/server-kit';\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPath,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport type { Repository } from 'typeorm';\nimport { In } from 'typeorm';\nimport type { KeyEntity } from '../../../../database/domains/index.ts';\nimport { getRequestStringParam } from '../../../request/index.ts';\n\nexport type JwkControllerContext = {\n    repository: Repository<KeyEntity>\n};\n\n@DController('')\nexport class JwkController {\n    protected repository: Repository<KeyEntity>;\n\n    constructor(ctx: JwkControllerContext) {\n        this.repository = ctx.repository;\n    }\n\n    @DGet('/jwks', [])\n    async getManyJwks(\n        @DContext() event: IAppEvent,\n    ): Promise<{ keys: OAuth2JsonWebKey[] }> {\n        const realmId = getRequestStringParam(event, 'realmId');\n\n        const entities = await this.repository.find({\n            where: {\n                type: In([JWKType.RSA, JWKType.EC]),\n                ...(realmId ? { realm_id: realmId } : {}),\n            },\n            order: { priority: 'DESC' },\n        });\n\n        const promises = entities\n            .filter((entity): entity is KeyEntity & { encryption_key: string } => !!entity.encryption_key)\n            .map(\n                (entity) => AsymmetricKey\n                    .fromBase64({\n                        format: 'spki',\n                        key: entity.encryption_key,\n                        options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signature_algorithm),\n                    })\n                    .then((container) => container.toJWK())\n                    .then((key) => ({\n                        ...key,\n                        kid: entity.id,\n                        alg: entity.signature_algorithm,\n                    })),\n            );\n\n        const keys = await Promise.all(promises);\n\n        return { keys };\n    }\n\n    @DGet('/jwks/:id', [])\n    async getOneJwks(@DPath('id') id: string): Promise<OAuth2JsonWebKey> {\n        const entity = await this.repository.findOne({\n            where: {\n                type: In([JWKType.RSA, JWKType.EC]),\n                id,\n            },\n        });\n\n        if (!entity) {\n            throw JWKError.notFound(id);\n        }\n\n        if (!entity.encryption_key) {\n            throw JWKError.encryptionKeyMissing();\n        }\n\n        const container = await AsymmetricKey\n            .fromBase64({\n                format: 'spki',\n                key: entity.encryption_key,\n                options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signature_algorithm),\n            });\n\n        const jsonWebKey = await container.toJWK();\n\n        return {\n            ...jsonWebKey,\n            kid: entity.id,\n            alg: entity.signature_algorithm,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;AAKC,SAAA,aAAA,YAAA,QAAA,KAAA,MAAA;;;;;;;;;;;;;;AAsBD,IAAaS,gBAAb,MAAaA;CACCC;CAEV,YAAYC,KAA2B;EACnC,KAAKD,aAAaC,IAAID;CAC1B;CAEA,MACME,YACF,OACqC;EACrC,MAAME,UAAUN,sBAAsBK,OAAO,SAAA;EAU7C,MAAMW,YAAWT,MARM,KAAKL,WAAWM,KAAK;GACxCC,OAAO;IACHC,MAAMX,GAAG,CAACN,QAAQkB,KAAKlB,QAAQmB,EAAAA,CAAG;IAClC,GAAIN,UAAU,EAAEO,UAAUP,QAAQ,IAAI,CAAC;GAC3C;GACAQ,OAAO,EAAEC,UAAU,OAAO;EAC9B,CAAA,EAAA,CAGKE,QAAQC,WAA6D,CAAC,CAACA,OAAOC,cAAc,CAAA,CAC5FC,KACIF,WAAWxB,cACP2B,WAAW;GACRC,QAAQ;GACRC,KAAKL,OAAOC;GACZK,SAAS9B,cAAc+B,kCAAkCP,OAAOQ,mBAAmB;EACvF,CAAA,CAAA,CACCC,MAAMC,cAAcA,UAAUC,MAAK,CAAA,CAAA,CACnCF,MAAMJ,SAAS;GACZ,GAAGA;GACHO,KAAKZ,OAAOa;GACZC,KAAKd,OAAOQ;EAChB,EAAA,CAAA;EAKZ,OAAO,EAAEO,MAAAA,MAFUC,QAAQC,IAAInB,QAAAA,EAEjB;CAClB;CAEA,MACMoB,WAAW,IAAoD;EACjE,MAAMlB,SAAS,MAAM,KAAKhB,WAAWmC,QAAQ,EACzC5B,OAAO;GACHC,MAAMX,GAAG,CAACN,QAAQkB,KAAKlB,QAAQmB,EAAAA,CAAG;GAClCmB;EACJ,EACJ,CAAA;EAEA,IAAI,CAACb,QACD,MAAM1B,SAAS8C,SAASP,EAAAA;EAG5B,IAAI,CAACb,OAAOC,gBACR,MAAM3B,SAAS+C,qBAAoB;EAYvC,OAAO;GACH,GAAGC,OAHkBZ,MAPDlC,cACnB2B,WAAW;IACRC,QAAQ;IACRC,KAAKL,OAAOC;IACZK,SAAS9B,cAAc+B,kCAAkCP,OAAOQ,mBAAmB;GACvF,CAAA,EAAA,CAE+BG,MAAK;GAIpCC,KAAKZ,OAAOa;GACZC,KAAKd,OAAOQ;EAChB;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["KeyStatus","JWKError","JWKType","JWKUse","AsymmetricKey","DContext","DController","DGet","DPath","In","buildCertificateJwkFields","getRequestStringParam","JwkController","repository","ctx","getManyJwks","event","realmId","entities","find","where","type","RSA","EC","use","SIGNATURE","status","ACTIVE","PASSIVE","order","priority","promises","filter","entity","encryptionKey","signatureAlgorithm","map","fromBase64","format","key","options","buildImportOptionsForJWTAlgorithm","then","container","toJWK","certificateFields","certificate","kid","id","alg","keys","Promise","all","getOneJwks","findOne","notFound","encryptionKeyMissing","jsonWebKey"],"sources":["../../../../../../src/adapters/http/controllers/workflows/jwks/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { KeyStatus } from '@authup/core-kit';\nimport type { JWTAlgorithm, OAuth2JsonWebKey } from '@authup/specs';\nimport { JWKError, JWKType, JWKUse } from '@authup/specs';\nimport { AsymmetricKey } from '@authup/server-kit';\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPath,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport type { Repository } from 'typeorm';\nimport { In } from 'typeorm';\nimport type { KeyEntity } from '../../../../database/domains/index.ts';\nimport { buildCertificateJwkFields } from '../../../../../core/index.ts';\nimport { getRequestStringParam } from '../../../request/index.ts';\n\nexport type JwkControllerContext = {\n    repository: Repository<KeyEntity>\n};\n\n@DController('')\nexport class JwkController {\n    protected repository: Repository<KeyEntity>;\n\n    constructor(ctx: JwkControllerContext) {\n        this.repository = ctx.repository;\n    }\n\n    @DGet('/jwks', [])\n    async getManyJwks(\n        @DContext() event: IAppEvent,\n    ): Promise<{ keys: OAuth2JsonWebKey[] }> {\n        const realmId = getRequestStringParam(event, 'realmId');\n\n        const entities = await this.repository.find({\n            where: {\n                type: In([JWKType.RSA, JWKType.EC]),\n                use: JWKUse.SIGNATURE,\n                // active + passive verify; disabled keys never publish.\n                status: In([KeyStatus.ACTIVE, KeyStatus.PASSIVE]),\n                ...(realmId ? { realmId } : {}),\n            },\n            order: { priority: 'DESC' },\n        });\n\n        const promises = entities\n            .filter(\n                (entity): entity is KeyEntity & { encryptionKey: string, signatureAlgorithm: `${JWTAlgorithm}` } => !!entity.encryptionKey &&\n                    !!entity.signatureAlgorithm,\n            )\n            .map(\n                (entity) => AsymmetricKey\n                    .fromBase64({\n                        format: 'spki',\n                        key: entity.encryptionKey,\n                        options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signatureAlgorithm),\n                    })\n                    .then((container) => container.toJWK())\n                    .then(async (key) => {\n                        const certificateFields = await buildCertificateJwkFields(entity.certificate);\n\n                        return {\n                            ...key,\n                            kid: entity.id,\n                            alg: entity.signatureAlgorithm,\n                            ...certificateFields,\n                        };\n                    }),\n            );\n\n        const keys = await Promise.all(promises);\n\n        return { keys };\n    }\n\n    @DGet('/jwks/:id', [])\n    async getOneJwks(@DPath('id') id: string): Promise<OAuth2JsonWebKey> {\n        const entity = await this.repository.findOne({\n            where: {\n                type: In([JWKType.RSA, JWKType.EC]),\n                use: JWKUse.SIGNATURE,\n                status: In([KeyStatus.ACTIVE, KeyStatus.PASSIVE]),\n                id,\n            },\n        });\n\n        if (!entity) {\n            throw JWKError.notFound(id);\n        }\n\n        if (!entity.encryptionKey || !entity.signatureAlgorithm) {\n            throw JWKError.encryptionKeyMissing();\n        }\n\n        const container = await AsymmetricKey\n            .fromBase64({\n                format: 'spki',\n                key: entity.encryptionKey,\n                options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signatureAlgorithm),\n            });\n\n        const jsonWebKey = await container.toJWK();\n        const certificateFields = await buildCertificateJwkFields(entity.certificate);\n\n        return {\n            ...jsonWebKey,\n            kid: entity.id,\n            alg: entity.signatureAlgorithm,\n            ...certificateFields,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,IAAaY,gBAAb,MAAaA;CACCC;CAEV,YAAYC,KAA2B;EACnC,KAAKD,aAAaC,IAAID;CAC1B;CAEA,MACME,YACF,OACqC;EACrC,MAAME,UAAUN,sBAAsBK,OAAO,SAAA;EAa7C,MAAMe,YAAWb,MAXM,KAAKL,WAAWM,KAAK;GACxCC,OAAO;IACHC,MAAMZ,GAAG,CAACP,QAAQoB,KAAKpB,QAAQqB,EAAAA,CAAG;IAClCC,KAAKrB,OAAOsB;IAEZC,QAAQjB,GAAG,CAACT,UAAU2B,QAAQ3B,UAAU4B,OAAAA,CAAQ;IAChD,GAAIX,UAAU,EAAEA,QAAQ,IAAI,CAAC;GACjC;GACAY,OAAO,EAAEC,UAAU,OAAO;EAC9B,CAAA,EAAA,CAGKE,QACIC,WAAmG,CAAC,CAACA,OAAOC,iBACzG,CAAC,CAACD,OAAOE,kBAAkB,CAAA,CAElCC,KACIH,WAAW7B,cACPiC,WAAW;GACRC,QAAQ;GACRC,KAAKN,OAAOC;GACZM,SAASpC,cAAcqC,kCAAkCR,OAAOE,kBAAkB;EACtF,CAAA,CAAA,CACCO,MAAMC,cAAcA,UAAUC,MAAK,CAAA,CAAA,CACnCF,KAAK,OAAOH,QAAAA;GACT,MAAMM,oBAAoB,MAAMnC,0BAA0BuB,OAAOa,WAAW;GAE5E,OAAO;IACH,GAAGP;IACHQ,KAAKd,OAAOe;IACZC,KAAKhB,OAAOE;IACZ,GAAGU;GACP;EACJ,CAAA,CAAA;EAKZ,OAAO,EAAEK,MAAAA,MAFUC,QAAQC,IAAIrB,QAAAA,EAEjB;CAClB;CAEA,MACMsB,WAAW,IAAoD;EACjE,MAAMpB,SAAS,MAAM,KAAKpB,WAAWyC,QAAQ,EACzClC,OAAO;GACHC,MAAMZ,GAAG,CAACP,QAAQoB,KAAKpB,QAAQqB,EAAAA,CAAG;GAClCC,KAAKrB,OAAOsB;GACZC,QAAQjB,GAAG,CAACT,UAAU2B,QAAQ3B,UAAU4B,OAAAA,CAAQ;GAChDoB;EACJ,EACJ,CAAA;EAEA,IAAI,CAACf,QACD,MAAMhC,SAASsD,SAASP,EAAAA;EAG5B,IAAI,CAACf,OAAOC,iBAAiB,CAACD,OAAOE,oBACjC,MAAMlC,SAASuD,qBAAoB;EAUvC,MAAMC,aAAa,OAAMd,MAPDvC,cACnBiC,WAAW;GACRC,QAAQ;GACRC,KAAKN,OAAOC;GACZM,SAASpC,cAAcqC,kCAAkCR,OAAOE,kBAAkB;EACtF,CAAA,EAAA,CAE+BS,MAAK;EACxC,MAAMC,oBAAoB,MAAMnC,0BAA0BuB,OAAOa,WAAW;EAE5E,OAAO;GACH,GAAGW;GACHV,KAAKd,OAAOe;GACZC,KAAKhB,OAAOE;GACZ,GAAGU;EACP;CACJ;AACJ"}

package/dist/adapters/http/controllers/workflows/status/module.mjs

@@ -3,7 +3,7 @@ import "node:url";
 import.meta.url;
 import { PACKAGE_PATH } from "../../../../../path.mjs";
 import path from "node:path";
-import { load } from "locter";
+import { read } from "locter";
 import { DController, DGet } from "@routup/decorators";
 //#region src/adapters/http/controllers/workflows/status/module.ts
 function _ts_decorate(decorators, target, key, desc) {
@@ -22,7 +22,7 @@ var StatusController = class {
 		this.options = ctx.options;
 	}
 	resolveVersion() {
-		if (!this.versionPromise) this.versionPromise = load(path.join(PACKAGE_PATH, "package.json")).then((pkgJson) => pkgJson.version);
+		if (!this.versionPromise) this.versionPromise = read(path.join(PACKAGE_PATH, "package.json")).then((pkgJson) => pkgJson.version);
 		return this.versionPromise;
 	}
 	async status() {

package/dist/adapters/http/controllers/workflows/status/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["DController","DGet","load","path","PACKAGE_PATH","StatusController","options","versionPromise","ctx","resolveVersion","join","then","pkgJson","version","status","date","Date","toISOString","features"],"sources":["../../../../../../src/adapters/http/controllers/workflows/status/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { StatusResponse, StatusResponseFeatures } from '@authup/core-http-kit';\nimport {\n    DController,\n    DGet,\n} from '@routup/decorators';\nimport { load } from 'locter';\nimport path from 'node:path';\nimport { PACKAGE_PATH } from '../../../../../path.ts';\n\nexport type StatusControllerOptions = {\n    features: StatusResponseFeatures,\n};\n\nexport type StatusControllerContext = {\n    options: StatusControllerOptions,\n};\n\n@DController('')\nexport class StatusController {\n    protected options: StatusControllerOptions;\n\n    // The version is constant for the process lifetime — read package.json\n    // once and memoize instead of on every GET /.\n    protected versionPromise: Promise<string> | undefined;\n\n    constructor(ctx: StatusControllerContext) {\n        this.options = ctx.options;\n    }\n\n    protected resolveVersion(): Promise<string> {\n        if (!this.versionPromise) {\n            this.versionPromise = load(path.join(PACKAGE_PATH, 'package.json'))\n                .then((pkgJson) => pkgJson.version);\n        }\n\n        return this.versionPromise;\n    }\n\n    @DGet('/', [])\n    async status(): Promise<StatusResponse> {\n        return {\n            version: await this.resolveVersion(),\n            date: new Date().toISOString(),\n            features: this.options.features,\n        };\n    }\n}\n"],"mappings":";;;;;;;;AAKC,SAAA,aAAA,YAAA,QAAA,KAAA,MAAA;;;;;;;;;AAoBD,IAAaK,mBAAb,MAAaA;CACCC;CAIAC;CAEV,YAAYC,KAA8B;EACtC,KAAKF,UAAUE,IAAIF;CACvB;CAEUG,iBAAkC;EACxC,IAAI,CAAC,KAAKF,gBACN,KAAKA,iBAAiBL,KAAKC,KAAKO,KAAKN,cAAc,cAAA,CAAA,CAAA,CAC9CO,MAAMC,YAAYA,QAAQC,OAAO;EAG1C,OAAO,KAAKN;CAChB;CAEA,MACMO,SAAkC;EACpC,OAAO;GACHD,SAAS,MAAM,KAAKJ,eAAc;GAClCM,uBAAM,IAAIC,KAAAA,EAAAA,CAAOC,YAAW;GAC5BC,UAAU,KAAKZ,QAAQY;EAC3B;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["DController","DGet","read","path","PACKAGE_PATH","StatusController","options","versionPromise","ctx","resolveVersion","join","then","pkgJson","version","status","date","Date","toISOString","features"],"sources":["../../../../../../src/adapters/http/controllers/workflows/status/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { StatusResponse, StatusResponseFeatures } from '@authup/core-http-kit';\nimport {\n    DController,\n    DGet,\n} from '@routup/decorators';\nimport { read } from 'locter';\nimport path from 'node:path';\nimport { PACKAGE_PATH } from '../../../../../path.ts';\n\nexport type StatusControllerOptions = {\n    features: StatusResponseFeatures,\n};\n\nexport type StatusControllerContext = {\n    options: StatusControllerOptions,\n};\n\n@DController('')\nexport class StatusController {\n    protected options: StatusControllerOptions;\n\n    // The version is constant for the process lifetime — read package.json\n    // once and memoize instead of on every GET /.\n    protected versionPromise: Promise<string> | undefined;\n\n    constructor(ctx: StatusControllerContext) {\n        this.options = ctx.options;\n    }\n\n    protected resolveVersion(): Promise<string> {\n        if (!this.versionPromise) {\n            this.versionPromise = read(path.join(PACKAGE_PATH, 'package.json'))\n                .then((pkgJson: { version: string }) => pkgJson.version);\n        }\n\n        return this.versionPromise;\n    }\n\n    @DGet('/', [])\n    async status(): Promise<StatusResponse> {\n        return {\n            version: await this.resolveVersion(),\n            date: new Date().toISOString(),\n            features: this.options.features,\n        };\n    }\n}\n"],"mappings":";;;;;;;;AAKC,SAAA,aAAA,YAAA,QAAA,KAAA,MAAA;;;;;;;;;AAoBD,IAAaK,mBAAb,MAAaA;CACCC;CAIAC;CAEV,YAAYC,KAA8B;EACtC,KAAKF,UAAUE,IAAIF;CACvB;CAEUG,iBAAkC;EACxC,IAAI,CAAC,KAAKF,gBACN,KAAKA,iBAAiBL,KAAKC,KAAKO,KAAKN,cAAc,cAAA,CAAA,CAAA,CAC9CO,MAAMC,YAAiCA,QAAQC,OAAO;EAG/D,OAAO,KAAKN;CAChB;CAEA,MACMO,SAAkC;EACpC,OAAO;GACHD,SAAS,MAAM,KAAKJ,eAAc;GAClCM,uBAAM,IAAIC,KAAAA,EAAAA,CAAOC,YAAW;GAC5BC,UAAU,KAAKZ,QAAQY;EAC3B;CACJ;AACJ"}

package/dist/adapters/http/controllers/workflows/token/module.d.ts

@@ -2,7 +2,7 @@ import type { OAuth2TokenGrantResponse, OAuth2TokenIntrospectionResponse } from
 import { OAuth2TokenGrant } from '@authup/specs';
 import type { IAppEvent } from 'routup';
 import type { TokenControllerContext } from './types.ts';
-import type { IIdentityPermissionProvider, IIdentityResolver, IOAuth2TokenIssuer, IOAuth2TokenRevoker, IOAuth2TokenVerifier } from '../../../../../core/index.ts';
+import type { IAuthFlowMetrics, IIdentityPermissionProvider, IIdentityResolver, IOAuth2TokenIssuer, IOAuth2TokenRevoker, IOAuth2TokenVerifier } from '../../../../../core/index.ts';
 import type { IHTTPOAuth2Grant } from '../../../adapters/index.ts';
 export declare class TokenController {
     protected refreshTokenIssuer: IOAuth2TokenIssuer;
@@ -11,6 +11,7 @@ export declare class TokenController {
     protected tokenRevoker: IOAuth2TokenRevoker;
     protected identityResolver: IIdentityResolver;
     protected identityPermissionProvider: IIdentityPermissionProvider;
+    protected metrics?: IAuthFlowMetrics;
     protected tokenGrants: Record<`${OAuth2TokenGrant}`, IHTTPOAuth2Grant>;
     constructor(ctx: TokenControllerContext);
     getIntrospect(event: IAppEvent): Promise<OAuth2TokenIntrospectionResponse>;

package/dist/adapters/http/controllers/workflows/token/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/token/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,gCAAgC,EAAyB,MAAM,eAAe,CAAC;AACvH,OAAO,EAA4C,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAQ3F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGxC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,KAAK,EACR,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACvB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAWnE,qBAEa,eAAe;IACxB,SAAS,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;IAEjD,SAAS,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;IAEhD,SAAS,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAE9C,SAAS,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAE5C,SAAS,CAAC,gBAAgB,EAAG,iBAAiB,CAAC;IAE/C,SAAS,CAAC,0BAA0B,EAAG,2BAA2B,CAAC;IAEnE,SAAS,CAAC,WAAW,EAAG,MAAM,CAAC,GAAG,gBAAgB,EAAE,EAAE,gBAAgB,CAAC,CAAC;gBAI5D,GAAG,EAAE,sBAAsB;IAuDjC,aAAa,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,gCAAgC,CAAC;IAKtF,cAAc,CACJ,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,gCAAgC,CAAC;IA4DtC,WAAW,CACD,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,IAAI,CAAC;IAkBV,WAAW,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAarF"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/token/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,gCAAgC,EAAyB,MAAM,eAAe,CAAC;AACvH,OAAO,EAA4C,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAQ3F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGxC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,KAAK,EACR,gBAAgB,EAChB,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACvB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAUnE,qBAEa,eAAe;IACxB,SAAS,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;IAEjD,SAAS,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;IAEhD,SAAS,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAE9C,SAAS,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAE5C,SAAS,CAAC,gBAAgB,EAAG,iBAAiB,CAAC;IAE/C,SAAS,CAAC,0BAA0B,EAAG,2BAA2B,CAAC;IAEnE,SAAS,CAAC,OAAO,CAAC,EAAG,gBAAgB,CAAC;IAEtC,SAAS,CAAC,WAAW,EAAG,MAAM,CAAC,GAAG,gBAAgB,EAAE,EAAE,gBAAgB,CAAC,CAAC;gBAI5D,GAAG,EAAE,sBAAsB;IAgEjC,aAAa,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,gCAAgC,CAAC;IAKtF,cAAc,CACJ,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,gCAAgC,CAAC;IA4DtC,WAAW,CACD,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,IAAI,CAAC;IA+BV,WAAW,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAiBrF"}

package/dist/adapters/http/controllers/workflows/token/module.mjs

@@ -8,7 +8,6 @@ import { HTTPOAuth2AuthorizeGrant } from "../../../adapters/oauth2/grant-types/a
 import { HTTPClientCredentialsGrant } from "../../../adapters/oauth2/grant-types/client-credentials.mjs";
 import { HTTPPasswordGrant } from "../../../adapters/oauth2/grant-types/password.mjs";
 import { HTTPOAuth2RefreshTokenGrant } from "../../../adapters/oauth2/grant-types/refresh_token.mjs";
-import { HTTPRobotCredentialsGrant } from "../../../adapters/oauth2/grant-types/robot-credentials.mjs";
 import "../../../adapters/index.mjs";
 import { toOAuth2Error } from "../../../../../core/oauth2/helpers/error.mjs";
 import "../../../../../core/oauth2/helpers/index.mjs";
@@ -39,6 +38,7 @@ var TokenController = class {
 	tokenRevoker;
 	identityResolver;
 	identityPermissionProvider;
+	metrics;
 	tokenGrants;
 	constructor(ctx) {
 		this.refreshTokenIssuer = ctx.refreshTokenIssuer;
@@ -47,6 +47,7 @@ var TokenController = class {
 		this.tokenRevoker = ctx.tokenRevoker;
 		this.identityResolver = ctx.identityResolver;
 		this.identityPermissionProvider = ctx.identityPermissionProvider;
+		this.metrics = ctx.metrics;
 		this.tokenGrants = {
 			[OAuth2TokenGrant.AUTHORIZATION_CODE]: new HTTPOAuth2AuthorizeGrant({
 				codeVerifier: ctx.codeVerifier,
@@ -54,19 +55,17 @@ var TokenController = class {
 				accessTokenIssuer: ctx.accessTokenIssuer,
 				refreshTokenIssuer: ctx.refreshTokenIssuer,
 				openIdTokenIssuer: ctx.openIdTokenIssuer,
-				keyRepository: ctx.keyRepository,
+				keyStore: ctx.keyStore,
 				sessionManager: ctx.sessionManager,
-				realmRepository: ctx.realmRepository
+				realmRepository: ctx.realmRepository,
+				accessPolicyEvaluator: ctx.accessPolicyEvaluator,
+				certificateSource: ctx.certificateSource
 			}),
 			[OAuth2TokenGrant.CLIENT_CREDENTIALS]: new HTTPClientCredentialsGrant({
 				accessTokenIssuer: ctx.accessTokenIssuer,
-				authenticator: ctx.clientAuthenticator,
-				sessionManager: ctx.sessionManager
-			}),
-			[OAuth2TokenGrant.ROBOT_CREDENTIALS]: new HTTPRobotCredentialsGrant({
-				accessTokenIssuer: ctx.accessTokenIssuer,
-				authenticator: ctx.robotAuthenticator,
-				sessionManager: ctx.sessionManager
+				clientAuthenticator: ctx.oauth2ClientAuthenticator,
+				sessionManager: ctx.sessionManager,
+				certificateSource: ctx.certificateSource
 			}),
 			[OAuth2TokenGrant.PASSWORD]: new HTTPPasswordGrant({
 				accessTokenIssuer: ctx.accessTokenIssuer,
@@ -74,7 +73,14 @@ var TokenController = class {
 				authenticator: ctx.userAuthenticator,
 				clientAuthenticator: ctx.oauth2ClientAuthenticator,
 				sessionManager: ctx.sessionManager,
-				realmRepository: ctx.realmRepository
+				realmRepository: ctx.realmRepository,
+				eventService: ctx.eventService,
+				metrics: ctx.metrics,
+				loginThrottleService: ctx.loginThrottleService,
+				userAuthenticatorService: ctx.userAuthenticatorService,
+				mfaLoginService: ctx.mfaLoginService,
+				logger: ctx.logger,
+				certificateSource: ctx.certificateSource
 			}),
 			[OAuth2TokenGrant.REFRESH_TOKEN]: new HTTPOAuth2RefreshTokenGrant({
 				accessTokenIssuer: ctx.accessTokenIssuer,
@@ -85,8 +91,11 @@ var TokenController = class {
 				sessionManager: ctx.sessionManager,
 				clientAuthenticator: ctx.oauth2ClientAuthenticator,
 				realmRepository: ctx.realmRepository,
+				eventService: ctx.eventService,
+				metrics: ctx.metrics,
 				logger: ctx.logger,
-				options: { gracePeriod: ctx.tokenRefreshGracePeriod }
+				options: { gracePeriod: ctx.tokenRefreshGracePeriod },
+				certificateSource: ctx.certificateSource
 			})
 		};
 	}
@@ -116,8 +125,8 @@ var TokenController = class {
 					const key = buildPermissionKey(binding.permission);
 					if (!acc[key]) acc[key] = {
 						name: binding.permission.name,
-						client_id: binding.permission.client_id,
-						realm_id: binding.permission.realm_id
+						client_id: binding.permission.clientId,
+						realm_id: binding.permission.realmId
 					};
 					return acc;
 				}, {})),
@@ -131,7 +140,10 @@ var TokenController = class {
 	async revokeToken(event) {
 		try {
 			const token = await extractTokenFromRequest(event);
-			const payload = await this.tokenVerifier.verify(token);
+			const payload = await this.tokenVerifier.verify(token, {
+				ignoreExpiry: true,
+				skipActiveCheck: true
+			});
 			await this.tokenRevoker.revoke(payload);
 			event.response.status = 202;
 			return null;
@@ -144,7 +156,9 @@ var TokenController = class {
 		if (!grantType) throw OAuth2GrantTypeError.unsupported();
 		const grant = this.tokenGrants[grantType];
 		if (!grant) throw OAuth2GrantTypeError.unsupported();
-		return grant.runWithRequest(event);
+		const response = await grant.runWithRequest(event);
+		this.metrics?.recordTokenGrant(grantType);
+		return response;
 	}
 };
 _ts_decorate([