@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.54

package/dist/adapters/http/controllers/workflows/token/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2GrantTypeError","OAuth2RequestError","OAuth2TokenGrant","DContext","DController","DGet","DPost","DTags","buildPermissionKey","toOAuth2Error","OAuth2OpenIDClaimsBuilder","HTTPClientCredentialsGrant","HTTPOAuth2AuthorizeGrant","HTTPOAuth2RefreshTokenGrant","HTTPPasswordGrant","HTTPRobotCredentialsGrant","guessOauth2GrantTypeByRequest","extractTokenFromRequest","TokenController","refreshTokenIssuer","accessTokenIssuer","tokenVerifier","tokenRevoker","identityResolver","identityPermissionProvider","tokenGrants","ctx","AUTHORIZATION_CODE","codeVerifier","clientAuthenticator","oauth2ClientAuthenticator","openIdTokenIssuer","keyRepository","sessionManager","realmRepository","CLIENT_CREDENTIALS","authenticator","ROBOT_CREDENTIALS","robotAuthenticator","PASSWORD","userAuthenticator","REFRESH_TOKEN","tokenRepository","sessionTokenRepository","logger","options","gracePeriod","tokenRefreshGracePeriod","getIntrospect","event","postIntrospect","token","payload","verify","skipActiveCheck","sub","sub_kind","identityInvalid","permissions","getFor","id","type","clientId","client_id","realmId","realm_id","identity","resolve","claimsBuilder","claims","fromIdentity","active","jti","isInactive","Object","values","reduce","acc","binding","key","permission","name","e","revokeToken","revoke","response","status","createToken","grantType","unsupported","grant","runWithRequest"],"sources":["../../../../../../src/adapters/http/controllers/workflows/token/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenIntrospectionResponse, OAuth2TokenPermission } from '@authup/specs';\nimport { OAuth2GrantTypeError, OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPost,\n    DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport { buildPermissionKey } from '@authup/access';\nimport { toOAuth2Error } from '../../../../../core/oauth2/helpers/index.ts';\nimport type { TokenControllerContext } from './types.ts';\nimport type {\n    IIdentityPermissionProvider,\n    IIdentityResolver,\n    IOAuth2TokenIssuer,\n    IOAuth2TokenRevoker,\n    IOAuth2TokenVerifier,\n} from '../../../../../core/index.ts';\nimport { OAuth2OpenIDClaimsBuilder } from '../../../../../core/index.ts';\nimport type { IHTTPOAuth2Grant } from '../../../adapters/index.ts';\nimport {\n    HTTPClientCredentialsGrant,\n    HTTPOAuth2AuthorizeGrant,\n    HTTPOAuth2RefreshTokenGrant,\n    HTTPPasswordGrant,\n    HTTPRobotCredentialsGrant,\n    guessOauth2GrantTypeByRequest,\n} from '../../../adapters/index.ts';\nimport { extractTokenFromRequest } from './utils/index.ts';\n\n@DTags('auth')\n@DController('/token')\nexport class TokenController {\n    protected refreshTokenIssuer: IOAuth2TokenIssuer;\n\n    protected accessTokenIssuer: IOAuth2TokenIssuer;\n\n    protected tokenVerifier: IOAuth2TokenVerifier;\n\n    protected tokenRevoker: IOAuth2TokenRevoker;\n\n    protected identityResolver : IIdentityResolver;\n\n    protected identityPermissionProvider : IIdentityPermissionProvider;\n\n    protected tokenGrants : Record<`${OAuth2TokenGrant}`, IHTTPOAuth2Grant>;\n\n    // -------------------------------------------\n\n    constructor(ctx: TokenControllerContext) {\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n        this.accessTokenIssuer = ctx.accessTokenIssuer;\n        this.tokenVerifier = ctx.tokenVerifier;\n        this.tokenRevoker = ctx.tokenRevoker;\n        this.identityResolver = ctx.identityResolver;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n\n        this.tokenGrants = {\n            [OAuth2TokenGrant.AUTHORIZATION_CODE]: new HTTPOAuth2AuthorizeGrant({\n                codeVerifier: ctx.codeVerifier,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                openIdTokenIssuer: ctx.openIdTokenIssuer,\n                keyRepository: ctx.keyRepository,\n                sessionManager: ctx.sessionManager,\n                realmRepository: ctx.realmRepository,\n            }),\n            [OAuth2TokenGrant.CLIENT_CREDENTIALS]: new HTTPClientCredentialsGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                authenticator: ctx.clientAuthenticator,\n                sessionManager: ctx.sessionManager,\n            }),\n            [OAuth2TokenGrant.ROBOT_CREDENTIALS]: new HTTPRobotCredentialsGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                authenticator: ctx.robotAuthenticator,\n                sessionManager: ctx.sessionManager,\n            }),\n            [OAuth2TokenGrant.PASSWORD]: new HTTPPasswordGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                authenticator: ctx.userAuthenticator,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                sessionManager: ctx.sessionManager,\n                realmRepository: ctx.realmRepository,\n            }),\n            [OAuth2TokenGrant.REFRESH_TOKEN]: new HTTPOAuth2RefreshTokenGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                tokenVerifier: ctx.tokenVerifier,\n                tokenRepository: ctx.tokenRepository,\n                sessionTokenRepository: ctx.sessionTokenRepository,\n                sessionManager: ctx.sessionManager,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                realmRepository: ctx.realmRepository,\n                logger: ctx.logger,\n                options: { gracePeriod: ctx.tokenRefreshGracePeriod },\n            }),\n        };\n    }\n\n    // -------------------------------------------\n\n    @DGet('/introspect', [])\n    async getIntrospect(@DContext() event: IAppEvent): Promise<OAuth2TokenIntrospectionResponse> {\n        return this.postIntrospect(event);\n    }\n\n    @DPost('/introspect', [])\n    async postIntrospect(\n        @DContext() event: IAppEvent,\n    ): Promise<OAuth2TokenIntrospectionResponse> {\n        try {\n            const token = await extractTokenFromRequest(event);\n            const payload = await this.tokenVerifier.verify(token, { skipActiveCheck: true });\n            if (!payload.sub || !payload.sub_kind) {\n                throw OAuth2RequestError.identityInvalid();\n            }\n\n            // todo: only receive client specific permissions\n            const permissions = await this.identityPermissionProvider.getFor({\n                id: payload.sub,\n                type: payload.sub_kind,\n                clientId: payload.client_id,\n                realmId: payload.realm_id,\n            });\n\n            const identity = await this.identityResolver.resolve(payload.sub_kind, payload.sub);\n            if (!identity) {\n                // todo: differentiate between client, robot & user\n                throw OAuth2RequestError.identityInvalid();\n            }\n\n            const claimsBuilder = new OAuth2OpenIDClaimsBuilder();\n            const claims = claimsBuilder.fromIdentity(identity);\n\n            let active : boolean;\n            if (payload.jti) {\n                const isInactive = await this.tokenVerifier.isInactive(payload.jti);\n                active = !isInactive;\n            } else {\n                active = false;\n            }\n\n            return {\n                active,\n                // todo: permissions property should be removed.\n                permissions: Object.values(\n                    permissions.reduce((acc, binding) => {\n                        const key = buildPermissionKey(binding.permission);\n                        if (!acc[key]) {\n                            acc[key] = {\n                                name: binding.permission.name,\n                                client_id: binding.permission.client_id,\n                                realm_id: binding.permission.realm_id,\n                            } as OAuth2TokenPermission;\n                        }\n                        return acc;\n                    }, {} as Record<string, OAuth2TokenPermission>),\n                ),\n                ...payload,\n                ...claims,\n            };\n        } catch (e) {\n            throw toOAuth2Error(e);\n        }\n    }\n\n    // ----------------------------------------------------------\n\n    @DPost('/revoke', [])\n    async revokeToken(\n        @DContext() event: IAppEvent,\n    ): Promise<null> {\n        try {\n            const token = await extractTokenFromRequest(event);\n\n            const payload = await this.tokenVerifier.verify(token);\n\n            await this.tokenRevoker.revoke(payload);\n\n            event.response.status = 202;\n            return null;\n        } catch (e) {\n            throw toOAuth2Error(e);\n        }\n    }\n\n    // ----------------------------------------------------------\n\n    @DPost('', [])\n    async createToken(@DContext() event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const grantType = await guessOauth2GrantTypeByRequest(event);\n        if (!grantType) {\n            throw OAuth2GrantTypeError.unsupported();\n        }\n\n        const grant = this.tokenGrants[grantType];\n        if (!grant) {\n            throw OAuth2GrantTypeError.unsupported();\n        }\n\n        return grant.runWithRequest(event);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAKC,SAAA,aAAA,YAAA,QAAA,KAAA,MAAA;;;;;;;;;;;;;;AAoCD,IAAakB,kBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAA6B;EACrC,KAAKP,qBAAqBO,IAAIP;EAC9B,KAAKC,oBAAoBM,IAAIN;EAC7B,KAAKC,gBAAgBK,IAAIL;EACzB,KAAKC,eAAeI,IAAIJ;EACxB,KAAKC,mBAAmBG,IAAIH;EAC5B,KAAKC,6BAA6BE,IAAIF;EAEtC,KAAKC,cAAc;IACdvB,iBAAiByB,qBAAqB,IAAIf,yBAAyB;IAChEgB,cAAcF,IAAIE;IAClBC,qBAAqBH,IAAII;IACzBV,mBAAmBM,IAAIN;IACvBD,oBAAoBO,IAAIP;IACxBY,mBAAmBL,IAAIK;IACvBC,eAAeN,IAAIM;IACnBC,gBAAgBP,IAAIO;IACpBC,iBAAiBR,IAAIQ;GACzB,CAAA;IACChC,iBAAiBiC,qBAAqB,IAAIxB,2BAA2B;IAClES,mBAAmBM,IAAIN;IACvBgB,eAAeV,IAAIG;IACnBI,gBAAgBP,IAAIO;GACxB,CAAA;IACC/B,iBAAiBmC,oBAAoB,IAAItB,0BAA0B;IAChEK,mBAAmBM,IAAIN;IACvBgB,eAAeV,IAAIY;IACnBL,gBAAgBP,IAAIO;GACxB,CAAA;IACC/B,iBAAiBqC,WAAW,IAAIzB,kBAAkB;IAC/CM,mBAAmBM,IAAIN;IACvBD,oBAAoBO,IAAIP;IACxBiB,eAAeV,IAAIc;IACnBX,qBAAqBH,IAAII;IACzBG,gBAAgBP,IAAIO;IACpBC,iBAAiBR,IAAIQ;GACzB,CAAA;IACChC,iBAAiBuC,gBAAgB,IAAI5B,4BAA4B;IAC9DO,mBAAmBM,IAAIN;IACvBD,oBAAoBO,IAAIP;IACxBE,eAAeK,IAAIL;IACnBqB,iBAAiBhB,IAAIgB;IACrBC,wBAAwBjB,IAAIiB;IAC5BV,gBAAgBP,IAAIO;IACpBJ,qBAAqBH,IAAII;IACzBI,iBAAiBR,IAAIQ;IACrBU,QAAQlB,IAAIkB;IACZC,SAAS,EAAEC,aAAapB,IAAIqB,wBAAwB;GACxD,CAAA;EACJ;CACJ;CAIA,MACMC,cAAc,OAAyE;EACzF,OAAO,KAAKE,eAAeD,KAAAA;CAC/B;CAEA,MACMC,eACF,OACyC;EACzC,IAAI;GACA,MAAMC,QAAQ,MAAMlC,wBAAwBgC,KAAAA;GAC5C,MAAMG,UAAU,MAAM,KAAK/B,cAAcgC,OAAOF,OAAO,EAAEG,iBAAiB,KAAK,CAAA;GAC/E,IAAI,CAACF,QAAQG,OAAO,CAACH,QAAQI,UACzB,MAAMvD,mBAAmBwD,gBAAe;GAI5C,MAAMC,cAAc,MAAM,KAAKlC,2BAA2BmC,OAAO;IAC7DC,IAAIR,QAAQG;IACZM,MAAMT,QAAQI;IACdM,UAAUV,QAAQW;IAClBC,SAASZ,QAAQa;GACrB,CAAA;GAEA,MAAMC,WAAW,MAAM,KAAK3C,iBAAiB4C,QAAQf,QAAQI,UAAUJ,QAAQG,GAAG;GAClF,IAAI,CAACW,UAED,MAAMjE,mBAAmBwD,gBAAe;GAI5C,MAAMY,SAASD,IADW1D,0BACX0D,CAAAA,CAAcE,aAAaJ,QAAAA;GAE1C,IAAIK;GACJ,IAAInB,QAAQoB,KAERD,SAAS,CAACE,MADe,KAAKpD,cAAcoD,WAAWrB,QAAQoB,GAAG;QAGlED,SAAS;GAGb,OAAO;IACHA;IAEAb,aAAagB,OAAOC,OAChBjB,YAAYkB,QAAQC,KAAKC,YAAAA;KACrB,MAAMC,MAAMvE,mBAAmBsE,QAAQE,UAAU;KACjD,IAAI,CAACH,IAAIE,MACLF,IAAIE,OAAO;MACPE,MAAMH,QAAQE,WAAWC;MACzBlB,WAAWe,QAAQE,WAAWjB;MAC9BE,UAAUa,QAAQE,WAAWf;KACjC;KAEJ,OAAOY;IACX,GAAG,CAAC,CAAA,CAAA;IAER,GAAGzB;IACH,GAAGiB;GACP;EACJ,SAASa,GAAG;GACR,MAAMzE,cAAcyE,CAAAA;EACxB;CACJ;CAIA,MACMC,YACF,OACa;EACb,IAAI;GACA,MAAMhC,QAAQ,MAAMlC,wBAAwBgC,KAAAA;GAE5C,MAAMG,UAAU,MAAM,KAAK/B,cAAcgC,OAAOF,KAAAA;GAEhD,MAAM,KAAK7B,aAAa8D,OAAOhC,OAAAA;GAE/BH,MAAMoC,SAASC,SAAS;GACxB,OAAO;EACX,SAASJ,GAAG;GACR,MAAMzE,cAAcyE,CAAAA;EACxB;CACJ;CAIA,MACMK,YAAY,OAAiE;EAC/E,MAAMC,YAAY,MAAMxE,8BAA8BiC,KAAAA;EACtD,IAAI,CAACuC,WACD,MAAMxF,qBAAqByF,YAAW;EAG1C,MAAMC,QAAQ,KAAKjE,YAAY+D;EAC/B,IAAI,CAACE,OACD,MAAM1F,qBAAqByF,YAAW;EAG1C,OAAOC,MAAMC,eAAe1C,KAAAA;CAChC;AACJ"}
+{"version":3,"file":"module.mjs","names":["OAuth2GrantTypeError","OAuth2RequestError","OAuth2TokenGrant","DContext","DController","DGet","DPost","DTags","buildPermissionKey","toOAuth2Error","OAuth2OpenIDClaimsBuilder","HTTPClientCredentialsGrant","HTTPOAuth2AuthorizeGrant","HTTPOAuth2RefreshTokenGrant","HTTPPasswordGrant","guessOauth2GrantTypeByRequest","extractTokenFromRequest","TokenController","refreshTokenIssuer","accessTokenIssuer","tokenVerifier","tokenRevoker","identityResolver","identityPermissionProvider","metrics","tokenGrants","ctx","AUTHORIZATION_CODE","codeVerifier","clientAuthenticator","oauth2ClientAuthenticator","openIdTokenIssuer","keyStore","sessionManager","realmRepository","accessPolicyEvaluator","certificateSource","CLIENT_CREDENTIALS","PASSWORD","authenticator","userAuthenticator","eventService","loginThrottleService","userAuthenticatorService","mfaLoginService","logger","REFRESH_TOKEN","tokenRepository","sessionTokenRepository","options","gracePeriod","tokenRefreshGracePeriod","getIntrospect","event","postIntrospect","token","payload","verify","skipActiveCheck","sub","sub_kind","identityInvalid","permissions","getFor","id","type","clientId","client_id","realmId","realm_id","identity","resolve","claimsBuilder","claims","fromIdentity","active","jti","isInactive","Object","values","reduce","acc","binding","key","permission","name","e","revokeToken","ignoreExpiry","revoke","response","status","createToken","grantType","unsupported","grant","runWithRequest","recordTokenGrant"],"sources":["../../../../../../src/adapters/http/controllers/workflows/token/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenIntrospectionResponse, OAuth2TokenPermission } from '@authup/specs';\nimport { OAuth2GrantTypeError, OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPost,\n    DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport { buildPermissionKey } from '@authup/access';\nimport { toOAuth2Error } from '../../../../../core/oauth2/helpers/index.ts';\nimport type { TokenControllerContext } from './types.ts';\nimport type {\n    IAuthFlowMetrics,\n    IIdentityPermissionProvider,\n    IIdentityResolver,\n    IOAuth2TokenIssuer,\n    IOAuth2TokenRevoker,\n    IOAuth2TokenVerifier,\n} from '../../../../../core/index.ts';\nimport { OAuth2OpenIDClaimsBuilder } from '../../../../../core/index.ts';\nimport type { IHTTPOAuth2Grant } from '../../../adapters/index.ts';\nimport {\n    HTTPClientCredentialsGrant,\n    HTTPOAuth2AuthorizeGrant,\n    HTTPOAuth2RefreshTokenGrant,\n    HTTPPasswordGrant,\n    guessOauth2GrantTypeByRequest,\n} from '../../../adapters/index.ts';\nimport { extractTokenFromRequest } from './utils/index.ts';\n\n@DTags('auth')\n@DController('/token')\nexport class TokenController {\n    protected refreshTokenIssuer: IOAuth2TokenIssuer;\n\n    protected accessTokenIssuer: IOAuth2TokenIssuer;\n\n    protected tokenVerifier: IOAuth2TokenVerifier;\n\n    protected tokenRevoker: IOAuth2TokenRevoker;\n\n    protected identityResolver : IIdentityResolver;\n\n    protected identityPermissionProvider : IIdentityPermissionProvider;\n\n    protected metrics? : IAuthFlowMetrics;\n\n    protected tokenGrants : Record<`${OAuth2TokenGrant}`, IHTTPOAuth2Grant>;\n\n    // -------------------------------------------\n\n    constructor(ctx: TokenControllerContext) {\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n        this.accessTokenIssuer = ctx.accessTokenIssuer;\n        this.tokenVerifier = ctx.tokenVerifier;\n        this.tokenRevoker = ctx.tokenRevoker;\n        this.identityResolver = ctx.identityResolver;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n        this.metrics = ctx.metrics;\n\n        this.tokenGrants = {\n            [OAuth2TokenGrant.AUTHORIZATION_CODE]: new HTTPOAuth2AuthorizeGrant({\n                codeVerifier: ctx.codeVerifier,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                openIdTokenIssuer: ctx.openIdTokenIssuer,\n                keyStore: ctx.keyStore,\n                sessionManager: ctx.sessionManager,\n                realmRepository: ctx.realmRepository,\n                accessPolicyEvaluator: ctx.accessPolicyEvaluator,\n                certificateSource: ctx.certificateSource,\n            }),\n            [OAuth2TokenGrant.CLIENT_CREDENTIALS]: new HTTPClientCredentialsGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                sessionManager: ctx.sessionManager,\n                certificateSource: ctx.certificateSource,\n            }),\n            [OAuth2TokenGrant.PASSWORD]: new HTTPPasswordGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                authenticator: ctx.userAuthenticator,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                sessionManager: ctx.sessionManager,\n                realmRepository: ctx.realmRepository,\n                eventService: ctx.eventService,\n                metrics: ctx.metrics,\n                loginThrottleService: ctx.loginThrottleService,\n                userAuthenticatorService: ctx.userAuthenticatorService,\n                mfaLoginService: ctx.mfaLoginService,\n                logger: ctx.logger,\n                certificateSource: ctx.certificateSource,\n            }),\n            [OAuth2TokenGrant.REFRESH_TOKEN]: new HTTPOAuth2RefreshTokenGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                tokenVerifier: ctx.tokenVerifier,\n                tokenRepository: ctx.tokenRepository,\n                sessionTokenRepository: ctx.sessionTokenRepository,\n                sessionManager: ctx.sessionManager,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                realmRepository: ctx.realmRepository,\n                eventService: ctx.eventService,\n                metrics: ctx.metrics,\n                logger: ctx.logger,\n                options: { gracePeriod: ctx.tokenRefreshGracePeriod },\n                certificateSource: ctx.certificateSource,\n            }),\n        };\n    }\n\n    // -------------------------------------------\n\n    @DGet('/introspect', [])\n    async getIntrospect(@DContext() event: IAppEvent): Promise<OAuth2TokenIntrospectionResponse> {\n        return this.postIntrospect(event);\n    }\n\n    @DPost('/introspect', [])\n    async postIntrospect(\n        @DContext() event: IAppEvent,\n    ): Promise<OAuth2TokenIntrospectionResponse> {\n        try {\n            const token = await extractTokenFromRequest(event);\n            const payload = await this.tokenVerifier.verify(token, { skipActiveCheck: true });\n            if (!payload.sub || !payload.sub_kind) {\n                throw OAuth2RequestError.identityInvalid();\n            }\n\n            // todo: only receive client specific permissions\n            const permissions = await this.identityPermissionProvider.getFor({\n                id: payload.sub,\n                type: payload.sub_kind,\n                clientId: payload.client_id,\n                realmId: payload.realm_id,\n            });\n\n            const identity = await this.identityResolver.resolve(payload.sub_kind, payload.sub);\n            if (!identity) {\n                // todo: differentiate between client & user\n                throw OAuth2RequestError.identityInvalid();\n            }\n\n            const claimsBuilder = new OAuth2OpenIDClaimsBuilder();\n            const claims = claimsBuilder.fromIdentity(identity);\n\n            let active : boolean;\n            if (payload.jti) {\n                const isInactive = await this.tokenVerifier.isInactive(payload.jti);\n                active = !isInactive;\n            } else {\n                active = false;\n            }\n\n            return {\n                active,\n                // todo: permissions property should be removed.\n                permissions: Object.values(\n                    permissions.reduce((acc, binding) => {\n                        const key = buildPermissionKey(binding.permission);\n                        if (!acc[key]) {\n                            acc[key] = {\n                                name: binding.permission.name,\n                                client_id: binding.permission.clientId,\n                                realm_id: binding.permission.realmId,\n                            } as OAuth2TokenPermission;\n                        }\n                        return acc;\n                    }, {} as Record<string, OAuth2TokenPermission>),\n                ),\n                ...payload,\n                ...claims,\n            };\n        } catch (e) {\n            throw toOAuth2Error(e);\n        }\n    }\n\n    // ----------------------------------------------------------\n\n    @DPost('/revoke', [])\n    async revokeToken(\n        @DContext() event: IAppEvent,\n    ): Promise<null> {\n        try {\n            const token = await extractTokenFromRequest(event);\n\n            // RFC 7009 §2.2: revoking an invalid token — here one that is expired\n            // or already inactive — MUST still succeed. The client cannot act on\n            // an error, and the token's invalidation (the point of the request)\n            // is already achieved. Signature + kind still anchor the token, so a\n            // forged/garbage token is rejected; `ignoreExpiry` additionally keeps\n            // this exp-bypass out of the shared claims cache (see\n            // OAuth2TokenVerifier). Without this, revoking a stale refresh token\n            // threw `expired_token`, so the caller's revoke-then-clear-cookie\n            // flow aborted, the durable row was never soft-revoked, and the stale\n            // refresh cookie survived into the next login.\n            const payload = await this.tokenVerifier.verify(token, {\n                ignoreExpiry: true,\n                skipActiveCheck: true,\n            });\n\n            await this.tokenRevoker.revoke(payload);\n\n            event.response.status = 202;\n            return null;\n        } catch (e) {\n            throw toOAuth2Error(e);\n        }\n    }\n\n    // ----------------------------------------------------------\n\n    @DPost('', [])\n    async createToken(@DContext() event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const grantType = await guessOauth2GrantTypeByRequest(event);\n        if (!grantType) {\n            throw OAuth2GrantTypeError.unsupported();\n        }\n\n        const grant = this.tokenGrants[grantType];\n        if (!grant) {\n            throw OAuth2GrantTypeError.unsupported();\n        }\n\n        const response = await grant.runWithRequest(event);\n\n        this.metrics?.recordTokenGrant(grantType);\n\n        return response;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAKC,SAAA,aAAA,YAAA,QAAA,KAAA,MAAA;;;;;;;;;;;;;;AAoCD,IAAaiB,kBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAA6B;EACrC,KAAKR,qBAAqBQ,IAAIR;EAC9B,KAAKC,oBAAoBO,IAAIP;EAC7B,KAAKC,gBAAgBM,IAAIN;EACzB,KAAKC,eAAeK,IAAIL;EACxB,KAAKC,mBAAmBI,IAAIJ;EAC5B,KAAKC,6BAA6BG,IAAIH;EACtC,KAAKC,UAAUE,IAAIF;EAEnB,KAAKC,cAAc;IACdvB,iBAAiByB,qBAAqB,IAAIf,yBAAyB;IAChEgB,cAAcF,IAAIE;IAClBC,qBAAqBH,IAAII;IACzBX,mBAAmBO,IAAIP;IACvBD,oBAAoBQ,IAAIR;IACxBa,mBAAmBL,IAAIK;IACvBC,UAAUN,IAAIM;IACdC,gBAAgBP,IAAIO;IACpBC,iBAAiBR,IAAIQ;IACrBC,uBAAuBT,IAAIS;IAC3BC,mBAAmBV,IAAIU;GAC3B,CAAA;IACClC,iBAAiBmC,qBAAqB,IAAI1B,2BAA2B;IAClEQ,mBAAmBO,IAAIP;IACvBU,qBAAqBH,IAAII;IACzBG,gBAAgBP,IAAIO;IACpBG,mBAAmBV,IAAIU;GAC3B,CAAA;IACClC,iBAAiBoC,WAAW,IAAIxB,kBAAkB;IAC/CK,mBAAmBO,IAAIP;IACvBD,oBAAoBQ,IAAIR;IACxBqB,eAAeb,IAAIc;IACnBX,qBAAqBH,IAAII;IACzBG,gBAAgBP,IAAIO;IACpBC,iBAAiBR,IAAIQ;IACrBO,cAAcf,IAAIe;IAClBjB,SAASE,IAAIF;IACbkB,sBAAsBhB,IAAIgB;IAC1BC,0BAA0BjB,IAAIiB;IAC9BC,iBAAiBlB,IAAIkB;IACrBC,QAAQnB,IAAImB;IACZT,mBAAmBV,IAAIU;GAC3B,CAAA;IACClC,iBAAiB4C,gBAAgB,IAAIjC,4BAA4B;IAC9DM,mBAAmBO,IAAIP;IACvBD,oBAAoBQ,IAAIR;IACxBE,eAAeM,IAAIN;IACnB2B,iBAAiBrB,IAAIqB;IACrBC,wBAAwBtB,IAAIsB;IAC5Bf,gBAAgBP,IAAIO;IACpBJ,qBAAqBH,IAAII;IACzBI,iBAAiBR,IAAIQ;IACrBO,cAAcf,IAAIe;IAClBjB,SAASE,IAAIF;IACbqB,QAAQnB,IAAImB;IACZI,SAAS,EAAEC,aAAaxB,IAAIyB,wBAAwB;IACpDf,mBAAmBV,IAAIU;GAC3B,CAAA;EACJ;CACJ;CAIA,MACMgB,cAAc,OAAyE;EACzF,OAAO,KAAKE,eAAeD,KAAAA;CAC/B;CAEA,MACMC,eACF,OACyC;EACzC,IAAI;GACA,MAAMC,QAAQ,MAAMvC,wBAAwBqC,KAAAA;GAC5C,MAAMG,UAAU,MAAM,KAAKpC,cAAcqC,OAAOF,OAAO,EAAEG,iBAAiB,KAAK,CAAA;GAC/E,IAAI,CAACF,QAAQG,OAAO,CAACH,QAAQI,UACzB,MAAM3D,mBAAmB4D,gBAAe;GAI5C,MAAMC,cAAc,MAAM,KAAKvC,2BAA2BwC,OAAO;IAC7DC,IAAIR,QAAQG;IACZM,MAAMT,QAAQI;IACdM,UAAUV,QAAQW;IAClBC,SAASZ,QAAQa;GACrB,CAAA;GAEA,MAAMC,WAAW,MAAM,KAAKhD,iBAAiBiD,QAAQf,QAAQI,UAAUJ,QAAQG,GAAG;GAClF,IAAI,CAACW,UAED,MAAMrE,mBAAmB4D,gBAAe;GAI5C,MAAMY,SAASD,IADW9D,0BACX8D,CAAAA,CAAcE,aAAaJ,QAAAA;GAE1C,IAAIK;GACJ,IAAInB,QAAQoB,KAERD,SAAS,CAACE,MADe,KAAKzD,cAAcyD,WAAWrB,QAAQoB,GAAG;QAGlED,SAAS;GAGb,OAAO;IACHA;IAEAb,aAAagB,OAAOC,OAChBjB,YAAYkB,QAAQC,KAAKC,YAAAA;KACrB,MAAMC,MAAM3E,mBAAmB0E,QAAQE,UAAU;KACjD,IAAI,CAACH,IAAIE,MACLF,IAAIE,OAAO;MACPE,MAAMH,QAAQE,WAAWC;MACzBlB,WAAWe,QAAQE,WAAWlB;MAC9BG,UAAUa,QAAQE,WAAWhB;KACjC;KAEJ,OAAOa;IACX,GAAG,CAAC,CAAA,CAAA;IAER,GAAGzB;IACH,GAAGiB;GACP;EACJ,SAASa,GAAG;GACR,MAAM7E,cAAc6E,CAAAA;EACxB;CACJ;CAIA,MACMC,YACF,OACa;EACb,IAAI;GACA,MAAMhC,QAAQ,MAAMvC,wBAAwBqC,KAAAA;GAY5C,MAAMG,UAAU,MAAM,KAAKpC,cAAcqC,OAAOF,OAAO;IACnDiC,cAAc;IACd9B,iBAAiB;GACrB,CAAA;GAEA,MAAM,KAAKrC,aAAaoE,OAAOjC,OAAAA;GAE/BH,MAAMqC,SAASC,SAAS;GACxB,OAAO;EACX,SAASL,GAAG;GACR,MAAM7E,cAAc6E,CAAAA;EACxB;CACJ;CAIA,MACMM,YAAY,OAAiE;EAC/E,MAAMC,YAAY,MAAM9E,8BAA8BsC,KAAAA;EACtD,IAAI,CAACwC,WACD,MAAM7F,qBAAqB8F,YAAW;EAG1C,MAAMC,QAAQ,KAAKtE,YAAYoE;EAC/B,IAAI,CAACE,OACD,MAAM/F,qBAAqB8F,YAAW;EAG1C,MAAMJ,WAAW,MAAMK,MAAMC,eAAe3C,KAAAA;EAE5C,KAAK7B,SAASyE,iBAAiBJ,SAAAA;EAE/B,OAAOH;CACX;AACJ"}

package/dist/adapters/http/controllers/workflows/token/types.d.ts

@@ -1,25 +1,31 @@
-import type { Client, Robot, User } from '@authup/core-kit';
+import type { User } from '@authup/core-kit';
 import type { Logger } from '@authup/server-kit';
-import type { ICredentialsAuthenticator, IIdentityPermissionProvider, IIdentityResolver, IOAuth2AuthorizationCodeVerifier, IOAuth2KeyRepository, IOAuth2OpenIDTokenIssuer, IOAuth2TokenIssuer, IOAuth2TokenRepository, IOAuth2TokenRevoker, IOAuth2TokenVerifier, IRealmRepository, ISessionManager, ISessionTokenRepository, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';
+import type { IAuthFlowMetrics, ICredentialsAuthenticator, IEventService, IIdentityPermissionProvider, IIdentityResolver, IKeyStore, ILoginThrottleService, IOAuth2AccessPolicyEvaluator, IOAuth2AuthorizationCodeVerifier, IOAuth2MfaLoginService, IOAuth2OpenIDTokenIssuer, IOAuth2TokenIssuer, IOAuth2TokenRepository, IOAuth2TokenRevoker, IOAuth2TokenVerifier, IRealmRepository, ISessionManager, ISessionTokenRepository, IUserAuthenticatorService, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';
+import type { CertificateSource } from '../../../request/index.ts';
 export type TokenControllerContext = {
     codeVerifier: IOAuth2AuthorizationCodeVerifier;
     accessTokenIssuer: IOAuth2TokenIssuer;
     refreshTokenIssuer: IOAuth2TokenIssuer;
     openIdTokenIssuer: IOAuth2OpenIDTokenIssuer;
-    keyRepository: IOAuth2KeyRepository;
+    keyStore: IKeyStore;
     tokenVerifier: IOAuth2TokenVerifier;
     tokenRevoker: IOAuth2TokenRevoker;
     tokenRepository: IOAuth2TokenRepository;
     sessionTokenRepository: ISessionTokenRepository;
+    eventService?: IEventService;
+    metrics?: IAuthFlowMetrics;
+    loginThrottleService?: ILoginThrottleService;
+    userAuthenticatorService?: IUserAuthenticatorService;
+    mfaLoginService?: IOAuth2MfaLoginService;
+    accessPolicyEvaluator?: IOAuth2AccessPolicyEvaluator;
     tokenRefreshGracePeriod?: number;
     logger?: Logger;
     sessionManager: ISessionManager;
     identityResolver: IIdentityResolver;
     identityPermissionProvider: IIdentityPermissionProvider;
-    clientAuthenticator: ICredentialsAuthenticator<Client>;
-    robotAuthenticator: ICredentialsAuthenticator<Robot>;
     userAuthenticator: ICredentialsAuthenticator<User>;
     oauth2ClientAuthenticator: OAuth2ClientAuthenticator;
     realmRepository: IRealmRepository;
+    certificateSource: CertificateSource;
 };
 //# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/controllers/workflows/token/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/token/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EACR,yBAAyB,EACzB,2BAA2B,EAC3B,iBAAiB,EACjB,gCAAgC,EAChC,oBAAoB,EACpB,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,uBAAuB,EACvB,yBAAyB,EAC5B,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,sBAAsB,GAAG;IACjC,YAAY,EAAE,gCAAgC,CAAC;IAE/C,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,iBAAiB,EAAE,wBAAwB,CAAC;IAC5C,aAAa,EAAE,oBAAoB,CAAC;IACpC,aAAa,EAAE,oBAAoB,CAAC;IACpC,YAAY,EAAE,mBAAmB,CAAC;IAClC,eAAe,EAAE,sBAAsB,CAAC;IACxC,sBAAsB,EAAE,uBAAuB,CAAC;IAEhD,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,cAAc,EAAE,eAAe,CAAC;IAEhC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,0BAA0B,EAAE,2BAA2B,CAAC;IAExD,mBAAmB,EAAE,yBAAyB,CAAC,MAAM,CAAC,CAAA;IACtD,kBAAkB,EAAE,yBAAyB,CAAC,KAAK,CAAC,CAAA;IACpD,iBAAiB,EAAE,yBAAyB,CAAC,IAAI,CAAC,CAAA;IAElD,yBAAyB,EAAE,yBAAyB,CAAA;IAEpD,eAAe,EAAE,gBAAgB,CAAA;CACpC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/token/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EACR,gBAAgB,EAChB,yBAAyB,EACzB,aAAa,EACb,2BAA2B,EAC3B,iBAAiB,EACjB,SAAS,EACT,qBAAqB,EACrB,4BAA4B,EAC5B,gCAAgC,EAChC,sBAAsB,EACtB,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,uBAAuB,EACvB,yBAAyB,EACzB,yBAAyB,EAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,MAAM,MAAM,sBAAsB,GAAG;IACjC,YAAY,EAAE,gCAAgC,CAAC;IAE/C,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,iBAAiB,EAAE,wBAAwB,CAAC;IAC5C,QAAQ,EAAE,SAAS,CAAC;IACpB,aAAa,EAAE,oBAAoB,CAAC;IACpC,YAAY,EAAE,mBAAmB,CAAC;IAClC,eAAe,EAAE,sBAAsB,CAAC;IACxC,sBAAsB,EAAE,uBAAuB,CAAC;IAEhD,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAC7C,wBAAwB,CAAC,EAAE,yBAAyB,CAAC;IACrD,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,qBAAqB,CAAC,EAAE,4BAA4B,CAAC;IAErD,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,cAAc,EAAE,eAAe,CAAC;IAEhC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,0BAA0B,EAAE,2BAA2B,CAAC;IAExD,iBAAiB,EAAE,yBAAyB,CAAC,IAAI,CAAC,CAAA;IAElD,yBAAyB,EAAE,yBAAyB,CAAA;IAEpD,eAAe,EAAE,gBAAgB,CAAC;IAClC,iBAAiB,EAAE,iBAAiB,CAAC;CACxC,CAAC"}

package/dist/adapters/http/index.mjs

@@ -1,19 +1,22 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { RequestHandlerOperation } from "./request/constants.mjs";
+import { CERTIFICATE_SOURCES, RequestHandlerOperation } from "./request/constants.mjs";
+import { extractClientCertificateEvidence } from "./request/client-certificate.mjs";
 import { setRequestPermissionEvaluator, useRequestPermissionEvaluator } from "./request/permission/helper.mjs";
 import { RequestIdentity, setRequestIdentity, useRequestIdentity, useRequestIdentityOrFail } from "./request/helpers/identity.mjs";
 import { buildActorContext } from "./request/helpers/actor.mjs";
 import { getBodyRealmID } from "./request/helpers/body-realm-id.mjs";
 import { LOCALE_COOKIE, useRequestLocale } from "./request/helpers/locale.mjs";
 import { readFromLocations } from "./request/helpers/locations.mjs";
+import { setRequestMfaLoginTicket, useRequestMfaLoginTicket } from "./request/helpers/mfa-login-ticket.mjs";
 import { getRequestParamID, getRequestStringParam, getRequestStringParamOrFail, useRequestParamID } from "./request/helpers/param-id.mjs";
 import { applyRouteRealmIDToBody, getRequestRealmID, setRequestRealmID } from "./request/helpers/realm-id.mjs";
 import { sanitizeRelativeRedirect } from "./request/helpers/redirect.mjs";
 import { setRequestScopes, useRequestScopes } from "./request/helpers/scopes.mjs";
 import { setRequestSessionId, useRequestSessionId } from "./request/helpers/session-id.mjs";
 import { setRequestToken, useRequestToken } from "./request/helpers/token.mjs";
+import { createRequestEventContextMiddleware, runWithRequestEventContext, useRequestEventContext } from "./request/event-context.mjs";
 import { RequestPermissionEvaluator } from "./request/permission/module.mjs";
 import "./request/index.mjs";
 import { AuthorizationMiddleware } from "./middleware/built-in/authorization/module.mjs";
@@ -27,12 +30,13 @@ import { registerBasicMiddleware } from "./middleware/built-in/basic.mjs";
 import { registerCorsMiddleware } from "./middleware/built-in/cors.mjs";
 import { registerErrorMiddleware } from "./middleware/built-in/error.mjs";
 import { createLoggerMiddleware, redactSensitiveURLParams } from "./middleware/built-in/logger.mjs";
-import { registerPrometheusMiddleware } from "./middleware/built-in/prometheus.mjs";
+import { createRouteTemplateNormalizePath, registerPrometheusMiddleware } from "./middleware/built-in/prometheus.mjs";
 import { registerRateLimitMiddleware } from "./middleware/built-in/rate-limit.mjs";
 import { createSwaggerMiddleware } from "./middleware/built-in/swagger.mjs";
 import { UI_HTTP_CLIENT_FACTORY_STORE_KEY, registerUIHttpClientMiddleware } from "./middleware/built-in/ui-http-client.mjs";
 import "./middleware/index.mjs";
 import { HTTPOAuth2Authorizer } from "./adapters/oauth2/authorization/module.mjs";
+import { extractOAuth2ClientCertificateEvidence } from "./adapters/oauth2/grant-types/utils/certificate.mjs";
 import { extractClientCredentialsFromRequest, readStringField } from "./adapters/oauth2/grant-types/utils/credentials.mjs";
 import { guessOauth2GrantTypeByRequest } from "./adapters/oauth2/grant-types/utils/guess.mjs";
 import { readRealmHint } from "./adapters/oauth2/grant-types/utils/realm.mjs";
@@ -41,7 +45,6 @@ import { HTTPClientCredentialsGrant } from "./adapters/oauth2/grant-types/client
 import { HTTPOAuth2IdentityGrantType } from "./adapters/oauth2/grant-types/identity.mjs";
 import { HTTPPasswordGrant } from "./adapters/oauth2/grant-types/password.mjs";
 import { HTTPOAuth2RefreshTokenGrant } from "./adapters/oauth2/grant-types/refresh_token.mjs";
-import { HTTPRobotCredentialsGrant } from "./adapters/oauth2/grant-types/robot-credentials.mjs";
 import "./adapters/index.mjs";
 import { ClientController } from "./controllers/entities/client/module.mjs";
 import { ClientPermissionController } from "./controllers/entities/client-permission/module.mjs";
@@ -50,11 +53,15 @@ import { ClientRoleRequestValidator } from "./controllers/entities/client-role/u
 import { ClientRoleController } from "./controllers/entities/client-role/module.mjs";
 import { ClientScopeController } from "./controllers/entities/client-scope/module.mjs";
 import { ClientScopeRequestValidator } from "./controllers/entities/client-scope/utils/validator.mjs";
+import { ConsentController } from "./controllers/entities/consent/module.mjs";
+import { EventController } from "./controllers/entities/event/module.mjs";
 import { IdentityProviderController } from "./controllers/entities/identity-provider/module.mjs";
 import { IdentityProviderRoleMappingController } from "./controllers/entities/identity-provide-role/module.mjs";
+import { KeyController } from "./controllers/entities/key/module.mjs";
 import { PermissionController } from "./controllers/entities/permission/module.mjs";
 import { PermissionPolicyController } from "./controllers/entities/permission-policy/module.mjs";
 import { ActivateController } from "./controllers/workflows/activate/module.mjs";
+import { AuthenticatorChallengeController } from "./controllers/workflows/authenticator-challenge/module.mjs";
 import { AuthorizeController } from "./controllers/workflows/authorize/module.mjs";
 import { getJwkRouteHandler, getJwksRouteHandler } from "./controllers/workflows/jwks/handlers/read.mjs";
 import { JwkController } from "./controllers/workflows/jwks/module.mjs";
@@ -66,11 +73,6 @@ import { RegisterController } from "./controllers/workflows/register/module.mjs"
 import { StatusController } from "./controllers/workflows/status/module.mjs";
 import { TokenController } from "./controllers/workflows/token/module.mjs";
 import { RealmController } from "./controllers/entities/realm/module.mjs";
-import { RobotController } from "./controllers/entities/robot/module.mjs";
-import { RobotPermissionController } from "./controllers/entities/robot-permission/module.mjs";
-import { RobotPermissionRequestValidator } from "./controllers/entities/robot-permission/utils/validation.mjs";
-import { RobotRoleController } from "./controllers/entities/robot-role/module.mjs";
-import { RobotRoleRequestValidator } from "./controllers/entities/robot-role/utils/validation.mjs";
 import { RoleController } from "./controllers/entities/role/module.mjs";
 import { RoleAttributeController } from "./controllers/entities/role-attribute/module.mjs";
 import { RoleAttributeRequestValidator } from "./controllers/entities/role-attribute/utils/validation.mjs";
@@ -81,12 +83,14 @@ import { PolicyAttributesValidator } from "./controllers/entities/policy/utils/a
 import { PolicyValidator } from "./controllers/entities/policy/utils/validation.mjs";
 import { ScopeController } from "./controllers/entities/scope/module.mjs";
 import { SessionController } from "./controllers/entities/session/module.mjs";
+import { TrustAnchorController } from "./controllers/entities/trust-anchor/module.mjs";
 import { UserController } from "./controllers/entities/user/module.mjs";
 import { UserAttributeController } from "./controllers/entities/user-attribute/module.mjs";
 import { UserAttributeRequestValidator } from "./controllers/entities/user-attribute/utils/validation.mjs";
+import { UserAuthenticatorController } from "./controllers/entities/user-authenticator/module.mjs";
 import { UserPermissionController } from "./controllers/entities/user-permission/module.mjs";
 import { UserPermissionRequestValidator } from "./controllers/entities/user-permission/utils/validation.mjs";
 import { UserRoleController } from "./controllers/entities/user-role/module.mjs";
 import { UserRoleRequestValidator } from "./controllers/entities/user-role/utils/validation.mjs";
 import "./controllers/index.mjs";
-export { ActivateController, AuthorizationMiddleware, AuthorizeController, ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, IdentityProviderController, IdentityProviderRoleMappingController, JwkController, LOCALE_COOKIE, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RealmResolverMiddleware, RegisterController, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, RobotController, RobotPermissionController, RobotPermissionRequestValidator, RobotRoleController, RobotRoleRequestValidator, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, StatusController, TokenController, UI_HTTP_CLIENT_FACTORY_STORE_KEY, UserAttributeController, UserAttributeRequestValidator, UserController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator, VITE_SERVER_STORE_KEY, applyRouteRealmIDToBody, buildActorContext, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createSwaggerMiddleware, extractClientCredentialsFromRequest, getBodyRealmID, getJwkRouteHandler, getJwksRouteHandler, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, guessOauth2GrantTypeByRequest, readFromLocations, readRealmHint, readStringField, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerUIHttpClientMiddleware, sanitizeRelativeRedirect, setRequestIdentity, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestSessionId, useRequestToken };
+export { ActivateController, AuthenticatorChallengeController, AuthorizationMiddleware, AuthorizeController, CERTIFICATE_SOURCES, ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ConsentController, EventController, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, IdentityProviderController, IdentityProviderRoleMappingController, JwkController, KeyController, LOCALE_COOKIE, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RealmResolverMiddleware, RegisterController, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, StatusController, TokenController, TrustAnchorController, UI_HTTP_CLIENT_FACTORY_STORE_KEY, UserAttributeController, UserAttributeRequestValidator, UserAuthenticatorController, UserController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator, VITE_SERVER_STORE_KEY, applyRouteRealmIDToBody, buildActorContext, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createRequestEventContextMiddleware, createRouteTemplateNormalizePath, createSwaggerMiddleware, extractClientCertificateEvidence, extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, getBodyRealmID, getJwkRouteHandler, getJwksRouteHandler, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, guessOauth2GrantTypeByRequest, readFromLocations, readRealmHint, readStringField, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerUIHttpClientMiddleware, runWithRequestEventContext, sanitizeRelativeRedirect, setRequestIdentity, setRequestMfaLoginTicket, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestEventContext, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestMfaLoginTicket, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestSessionId, useRequestToken };

package/dist/adapters/http/middleware/built-in/assets.mjs

@@ -3,10 +3,10 @@ import "node:url";
 import.meta.url;
 import { PACKAGE_PATH, UI_DIST_PATH, UI_SOURCE_PATH } from "../../../../path.mjs";
 import path from "node:path";
-import { CodeTransformation, isCodeTransformation } from "typeorm-extension";
 import { defineCoreHandler } from "routup";
+import { CodeTransformation, isCodeTransformation } from "typeorm-extension";
 import { fromNodeMiddleware } from "routup/node";
-import { load } from "locter";
+import { read } from "locter";
 import { createHandler } from "@routup/assets";
 //#region src/adapters/http/middleware/built-in/assets.ts
 const VITE_SERVER_STORE_KEY = Symbol("ViteServer");
@@ -22,7 +22,7 @@ async function registerAssetsMiddleware(router) {
 		}));
 		return;
 	}
-	const server = await (await load("vite")).createServer({
+	const server = await (await read("vite")).createServer({
 		root: UI_SOURCE_PATH,
 		base: "/public/",
 		logLevel: "error",

package/dist/adapters/http/middleware/built-in/assets.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"assets.mjs","names":["load","CodeTransformation","isCodeTransformation","createHandler","path","defineCoreHandler","fromNodeMiddleware","PACKAGE_PATH","UI_DIST_PATH","UI_SOURCE_PATH","VITE_SERVER_STORE_KEY","Symbol","registerAssetsMiddleware","router","JUST_IN_TIME","use","posix","join","fallthrough","scan","vite","server","createServer","root","base","logLevel","middlewareMode","watch","usePolling","interval","appType","middlewares","event","store","next"],"sources":["../../../../../src/adapters/http/middleware/built-in/assets.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { load } from 'locter';\nimport { CodeTransformation, isCodeTransformation } from 'typeorm-extension';\nimport { createHandler } from '@routup/assets';\nimport path from 'node:path';\nimport type { App } from 'routup';\nimport { defineCoreHandler } from 'routup';\nimport { fromNodeMiddleware } from 'routup/node';\nimport type * as Vite from 'vite';\nimport type { ViteDevServer } from 'vite';\nimport { PACKAGE_PATH, UI_DIST_PATH, UI_SOURCE_PATH } from '../../../../path.ts';\n\nexport const VITE_SERVER_STORE_KEY = Symbol('ViteServer');\n\nexport async function registerAssetsMiddleware(router: App) {\n    if (!isCodeTransformation(CodeTransformation.JUST_IN_TIME)) {\n        router.use('public', createHandler(\n            path.posix.join(PACKAGE_PATH, 'public'),\n            {\n                fallthrough: true,\n                scan: false,\n            },\n        ));\n\n        router.use('public', createHandler(\n            path.posix.join(UI_DIST_PATH, 'client'),\n            {\n                fallthrough: false,\n                scan: false,\n            },\n        ));\n        return;\n    }\n\n    const vite = await load('vite') as typeof Vite;\n\n    const server: ViteDevServer = await vite.createServer({\n        root: UI_SOURCE_PATH,\n        base: '/public/',\n        logLevel: 'error',\n        server: {\n            middlewareMode: true,\n            watch: {\n                usePolling: true,\n                interval: 100,\n            },\n        },\n        appType: 'custom',\n    });\n\n    router.use('public', fromNodeMiddleware(server.middlewares));\n    router.use(defineCoreHandler((event) => {\n        event.store[VITE_SERVER_STORE_KEY] = server;\n        return event.next();\n    }));\n}\n"],"mappings":";;;;;;;;;;;AAkBA,MAAaU,wBAAwBC,OAAO,YAAA;AAE5C,eAAsBC,yBAAyBC,QAAW;CACtD,IAAI,CAACX,qBAAqBD,mBAAmBa,YAAY,GAAG;EACxDD,OAAOE,IAAI,UAAUZ,cACjBC,KAAKY,MAAMC,KAAKV,cAAc,QAAA,GAC9B;GACIW,aAAa;GACbC,MAAM;EACV,CAAA,CAAA;EAGJN,OAAOE,IAAI,UAAUZ,cACjBC,KAAKY,MAAMC,KAAKT,cAAc,QAAA,GAC9B;GACIU,aAAa;GACbC,MAAM;EACV,CAAA,CAAA;EAEJ;CACJ;CAIA,MAAME,SAAwB,OAAMD,MAFjBpB,KAAK,MAAA,EAAA,CAEiBsB,aAAa;EAClDC,MAAMd;EACNe,MAAM;EACNC,UAAU;EACVJ,QAAQ;GACJK,gBAAgB;GAChBC,OAAO;IACHC,YAAY;IACZC,UAAU;GACd;EACJ;EACAC,SAAS;CACb,CAAA;CAEAjB,OAAOE,IAAI,UAAUT,mBAAmBe,OAAOU,WAAW,CAAA;CAC1DlB,OAAOE,IAAIV,mBAAmB2B,UAAAA;EAC1BA,MAAMC,MAAMvB,yBAAyBW;EACrC,OAAOW,MAAME,KAAI;CACrB,CAAA,CAAA;AACJ"}
+{"version":3,"file":"assets.mjs","names":["read","CodeTransformation","isCodeTransformation","createHandler","path","defineCoreHandler","fromNodeMiddleware","PACKAGE_PATH","UI_DIST_PATH","UI_SOURCE_PATH","VITE_SERVER_STORE_KEY","Symbol","registerAssetsMiddleware","router","JUST_IN_TIME","use","posix","join","fallthrough","scan","vite","server","createServer","root","base","logLevel","middlewareMode","watch","usePolling","interval","appType","middlewares","event","store","next"],"sources":["../../../../../src/adapters/http/middleware/built-in/assets.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { read } from 'locter';\nimport { CodeTransformation, isCodeTransformation } from 'typeorm-extension';\nimport { createHandler } from '@routup/assets';\nimport path from 'node:path';\nimport type { App } from 'routup';\nimport { defineCoreHandler } from 'routup';\nimport { fromNodeMiddleware } from 'routup/node';\nimport type * as Vite from 'vite';\nimport type { ViteDevServer } from 'vite';\nimport { PACKAGE_PATH, UI_DIST_PATH, UI_SOURCE_PATH } from '../../../../path.ts';\n\nexport const VITE_SERVER_STORE_KEY = Symbol('ViteServer');\n\nexport async function registerAssetsMiddleware(router: App) {\n    if (!isCodeTransformation(CodeTransformation.JUST_IN_TIME)) {\n        router.use('public', createHandler(\n            path.posix.join(PACKAGE_PATH, 'public'),\n            {\n                fallthrough: true,\n                scan: false,\n            },\n        ));\n\n        router.use('public', createHandler(\n            path.posix.join(UI_DIST_PATH, 'client'),\n            {\n                fallthrough: false,\n                scan: false,\n            },\n        ));\n        return;\n    }\n\n    const vite = await read('vite') as typeof Vite;\n\n    const server: ViteDevServer = await vite.createServer({\n        root: UI_SOURCE_PATH,\n        base: '/public/',\n        logLevel: 'error',\n        server: {\n            middlewareMode: true,\n            watch: {\n                usePolling: true,\n                interval: 100,\n            },\n        },\n        appType: 'custom',\n    });\n\n    router.use('public', fromNodeMiddleware(server.middlewares));\n    router.use(defineCoreHandler((event) => {\n        event.store[VITE_SERVER_STORE_KEY] = server;\n        return event.next();\n    }));\n}\n"],"mappings":";;;;;;;;;;;AAkBA,MAAaU,wBAAwBC,OAAO,YAAA;AAE5C,eAAsBC,yBAAyBC,QAAW;CACtD,IAAI,CAACX,qBAAqBD,mBAAmBa,YAAY,GAAG;EACxDD,OAAOE,IAAI,UAAUZ,cACjBC,KAAKY,MAAMC,KAAKV,cAAc,QAAA,GAC9B;GACIW,aAAa;GACbC,MAAM;EACV,CAAA,CAAA;EAGJN,OAAOE,IAAI,UAAUZ,cACjBC,KAAKY,MAAMC,KAAKT,cAAc,QAAA,GAC9B;GACIU,aAAa;GACbC,MAAM;EACV,CAAA,CAAA;EAEJ;CACJ;CAIA,MAAME,SAAwB,OAAMD,MAFjBpB,KAAK,MAAA,EAAA,CAEiBsB,aAAa;EAClDC,MAAMd;EACNe,MAAM;EACNC,UAAU;EACVJ,QAAQ;GACJK,gBAAgB;GAChBC,OAAO;IACHC,YAAY;IACZC,UAAU;GACd;EACJ;EACAC,SAAS;CACb,CAAA;CAEAjB,OAAOE,IAAI,UAAUT,mBAAmBe,OAAOU,WAAW,CAAA;CAC1DlB,OAAOE,IAAIV,mBAAmB2B,UAAAA;EAC1BA,MAAMC,MAAMvB,yBAAyBW;EACrC,OAAOW,MAAME,KAAI;CACrB,CAAA,CAAA;AACJ"}

package/dist/adapters/http/middleware/built-in/authorization/module.d.ts

@@ -1,5 +1,6 @@
 import type { IPermissionEvaluator } from '@authup/access';
-import type { Client, Robot, User } from '@authup/core-kit';
+import type { Client, User } from '@authup/core-kit';
+import type { OAuth2TokenPayload } from '@authup/specs';
 import type { IAppEvent } from 'routup';
 import { type BasicAuthorizationHeader, type BearerAuthorizationHeader } from 'hapic';
 import type { ICredentialsAuthenticator, IIdentityResolver, IOAuth2TokenVerifier, ISessionManager } from '../../../../../core/index.ts';
@@ -11,7 +12,6 @@ export declare class AuthorizationMiddleware {
     protected identityResolver: IIdentityResolver;
     protected sessionManager: ISessionManager;
     protected clientAuthenticator: ICredentialsAuthenticator<Client>;
-    protected robotAuthenticator: ICredentialsAuthenticator<Robot>;
     protected userAuthenticator: ICredentialsAuthenticator<User>;
     constructor(ctx: HTTPAuthorizationMiddlewareContext);
     run(event: IAppEvent): Promise<void>;
@@ -19,6 +19,18 @@ export declare class AuthorizationMiddleware {
      * @throws JWTError
      */
     protected verifyBearerAuthorizationHeader(event: IAppEvent, header: BearerAuthorizationHeader): Promise<void>;
+    protected verifyCertificateBinding(event: IAppEvent, payload: OAuth2TokenPayload): Promise<void>;
+    /**
+     * An "MFA-pending" login ticket (issue #3242). Verified with the same
+     * rigor as an access token (session existence + subject match), but
+     * stashed on a DEDICATED request slot — the main identity / scope /
+     * session slots stay empty, so every identity-gated route rejects a
+     * ticket bearer (default-deny); only the challenge routes opt in via
+     * useRequestMfaLoginTicket.
+     *
+     * @throws JWTError
+     */
+    protected verifyMfaLoginTicket(event: IAppEvent, payload: OAuth2TokenPayload): Promise<void>;
     protected verifyBasicAuthorizationHeader(event: IAppEvent, header: BasicAuthorizationHeader): Promise<void>;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/middleware/built-in/authorization/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/middleware/built-in/authorization/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAE3D,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAO5D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAEH,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAEjC,MAAM,OAAO,CAAC;AAOf,OAAO,KAAK,EACR,yBAAyB,EACzB,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EAClB,MAAM,8BAA8B,CAAC;AAStC,OAAO,KAAK,EAAE,kCAAkC,EAAE,kCAAkC,EAAE,MAAM,YAAY,CAAC;AAEzG,qBAAa,uBAAuB;IAChC,SAAS,CAAC,OAAO,EAAE,kCAAkC,CAAC;IAItD,SAAS,CAAC,mBAAmB,EAAE,oBAAoB,CAAC;IAEpD,SAAS,CAAC,mBAAmB,EAAE,oBAAoB,CAAC;IAIpD,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,cAAc,EAAG,eAAe,CAAC;IAI3C,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAElE,SAAS,CAAC,kBAAkB,EAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;IAEhE,SAAS,CAAC,iBAAiB,EAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;gBAIlD,GAAG,EAAE,kCAAkC;IAsB7C,GAAG,CAAC,KAAK,EAAE,SAAS;IA2B1B;;OAEG;cACa,+BAA+B,CAC3C,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,yBAAyB;cA0DrB,8BAA8B,CAC1C,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,wBAAwB;CA+CvC"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/middleware/built-in/authorization/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAE3D,OAAO,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAMrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAOxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAEH,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAEjC,MAAM,OAAO,CAAC;AAOf,OAAO,KAAK,EACR,yBAAyB,EACzB,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EAClB,MAAM,8BAA8B,CAAC;AAYtC,OAAO,KAAK,EAAE,kCAAkC,EAAE,kCAAkC,EAAE,MAAM,YAAY,CAAC;AAEzG,qBAAa,uBAAuB;IAChC,SAAS,CAAC,OAAO,EAAE,kCAAkC,CAAC;IAItD,SAAS,CAAC,mBAAmB,EAAE,oBAAoB,CAAC;IAEpD,SAAS,CAAC,mBAAmB,EAAE,oBAAoB,CAAC;IAIpD,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,cAAc,EAAG,eAAe,CAAC;IAI3C,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAElE,SAAS,CAAC,iBAAiB,EAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;gBAIlD,GAAG,EAAE,kCAAkC;IAqB7C,GAAG,CAAC,KAAK,EAAE,SAAS;IA2B1B;;OAEG;cACa,+BAA+B,CAC3C,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,yBAAyB;cAgErB,wBAAwB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAyBtG;;;;;;;;;OASG;cACa,oBAAoB,CAChC,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,kBAAkB;cAsDf,8BAA8B,CAC1C,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,wBAAwB;CA+BvC"}

package/dist/adapters/http/middleware/built-in/authorization/module.mjs

@@ -2,12 +2,14 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { ClientAuthenticator } from "../../../../../core/authentication/entities/client/module.mjs";
-import { RobotAuthenticator } from "../../../../../core/authentication/entities/robot/module.mjs";
 import { UserAuthenticator } from "../../../../../core/authentication/entities/user/module.mjs";
+import { assertClientCertificateEvidenceValidForBinding } from "../../../../../core/client-certificate/module.mjs";
 import { PolicyEngine as PolicyEngine$1 } from "../../../../../core/security/policy/engine.mjs";
 import "../../../../../core/index.mjs";
+import { extractClientCertificateEvidence } from "../../../request/client-certificate.mjs";
 import { setRequestPermissionEvaluator } from "../../../request/permission/helper.mjs";
-import { setRequestIdentity } from "../../../request/helpers/identity.mjs";
+import { RequestIdentity, setRequestIdentity } from "../../../request/helpers/identity.mjs";
+import { setRequestMfaLoginTicket } from "../../../request/helpers/mfa-login-ticket.mjs";
 import { setRequestScopes } from "../../../request/helpers/scopes.mjs";
 import { setRequestSessionId } from "../../../request/helpers/session-id.mjs";
 import { setRequestToken } from "../../../request/helpers/token.mjs";
@@ -16,7 +18,7 @@ import "../../../request/index.mjs";
 import { IdentityType, ScopeName } from "@authup/core-kit";
 import { PermissionEvaluator } from "@authup/access";
 import { AuthHeaderError } from "@authup/errors";
-import { JWTError, OAuth2TokenKind, deserializeOAuth2Scope } from "@authup/specs";
+import { JWTError, OAuth2SubKind, OAuth2TokenKind, deserializeOAuth2Scope } from "@authup/specs";
 import { AuthorizationHeaderType, parseAuthorizationHeader } from "hapic";
 //#region src/adapters/http/middleware/built-in/authorization/module.ts
 var AuthorizationMiddleware = class {
@@ -26,14 +28,12 @@ var AuthorizationMiddleware = class {
 	identityResolver;
 	sessionManager;
 	clientAuthenticator;
-	robotAuthenticator;
 	userAuthenticator;
 	constructor(ctx) {
 		this.options = ctx.options || {};
 		this.identityResolver = ctx.identityResolver;
 		this.sessionManager = ctx.sessionManager;
 		this.clientAuthenticator = new ClientAuthenticator(ctx.identityResolver);
-		this.robotAuthenticator = new RobotAuthenticator(ctx.identityResolver);
 		this.userAuthenticator = new UserAuthenticator(ctx.identityResolver);
 		this.oauth2TokenVerifier = ctx.oauth2TokenVerifier;
 		this.permissionEvaluator = new PermissionEvaluator({
@@ -62,6 +62,11 @@ var AuthorizationMiddleware = class {
 	* @throws JWTError
 	*/ async verifyBearerAuthorizationHeader(event, header) {
 		const payload = await this.oauth2TokenVerifier.verify(header.token);
+		await this.verifyCertificateBinding(event, payload);
+		if (payload.kind === OAuth2TokenKind.MFA) {
+			await this.verifyMfaLoginTicket(event, payload);
+			return;
+		}
 		if (payload.kind !== OAuth2TokenKind.ACCESS) throw JWTError.payloadPropertyInvalid("kind");
 		if (!payload.realm_id) throw JWTError.payloadPropertyInvalid("realm_id");
 		setRequestToken(event, header.token);
@@ -81,6 +86,48 @@ var AuthorizationMiddleware = class {
 		const identity = await this.identityResolver.resolve(payload.sub_kind, payload.sub);
 		if (identity) setRequestIdentity(event, identity);
 	}
+	async verifyCertificateBinding(event, payload) {
+		if (!payload.cnf) return;
+		const expectedThumbprint = payload.cnf["x5t#S256"];
+		if (typeof expectedThumbprint !== "string" || expectedThumbprint.length === 0) throw JWTError.invalid();
+		try {
+			const evidence = await extractClientCertificateEvidence(event, this.options.certificateSource ?? "disabled");
+			if (!evidence || evidence.thumbprint !== expectedThumbprint) throw JWTError.invalid();
+			assertClientCertificateEvidenceValidForBinding(evidence);
+		} catch {
+			throw JWTError.invalid();
+		}
+	}
+	/**
+	* An "MFA-pending" login ticket (issue #3242). Verified with the same
+	* rigor as an access token (session existence + subject match), but
+	* stashed on a DEDICATED request slot — the main identity / scope /
+	* session slots stay empty, so every identity-gated route rejects a
+	* ticket bearer (default-deny); only the challenge routes opt in via
+	* useRequestMfaLoginTicket.
+	*
+	* @throws JWTError
+	*/ async verifyMfaLoginTicket(event, payload) {
+		if (payload.sub_kind !== OAuth2SubKind.USER) throw JWTError.payloadPropertyInvalid("sub_kind");
+		if (!payload.sub) throw JWTError.payloadPropertyInvalid("sub");
+		if (!payload.realm_id) throw JWTError.payloadPropertyInvalid("realm_id");
+		if (!payload.session_id) throw JWTError.payloadPropertyInvalid("session_id");
+		const session = await this.sessionManager.findOneById(payload.session_id);
+		if (!session) throw JWTError.expired();
+		try {
+			await this.sessionManager.verify(session);
+		} catch {
+			throw JWTError.expired();
+		}
+		if (session.sub !== payload.sub || session.subKind !== IdentityType.USER) throw JWTError.expired();
+		await this.sessionManager.ping(session);
+		const identity = await this.identityResolver.resolve(payload.sub_kind, payload.sub);
+		if (!identity) throw JWTError.expired();
+		setRequestMfaLoginTicket(event, {
+			identity: new RequestIdentity(identity),
+			payload
+		});
+	}
 	async verifyBasicAuthorizationHeader(event, header) {
 		if (this.options.clientAuthBasic) {
 			const authenticator = await this.clientAuthenticator.safeAuthenticate(header.username, header.password);
@@ -100,17 +147,6 @@ var AuthorizationMiddleware = class {
 					type: IdentityType.USER,
 					data: authenticated.data
 				});
-				return;
-			}
-		}
-		if (this.options.robotAuthBasic) {
-			const authenticated = await this.robotAuthenticator.safeAuthenticate(header.username, header.password);
-			if (authenticated.success) {
-				setRequestScopes(event, [ScopeName.GLOBAL]);
-				setRequestIdentity(event, {
-					type: IdentityType.ROBOT,
-					data: authenticated.data
-				});
 			}
 		}
 	}

package/dist/adapters/http/middleware/built-in/authorization/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["PermissionEvaluator","IdentityType","ScopeName","AuthHeaderError","JWTError","OAuth2TokenKind","deserializeOAuth2Scope","AuthorizationHeaderType","parseAuthorizationHeader","ClientAuthenticator","PolicyEngine","RobotAuthenticator","UserAuthenticator","RequestPermissionEvaluator","setRequestIdentity","setRequestPermissionEvaluator","setRequestScopes","setRequestSessionId","setRequestToken","AuthorizationMiddleware","options","oauth2TokenVerifier","permissionEvaluator","identityResolver","sessionManager","clientAuthenticator","robotAuthenticator","userAuthenticator","ctx","provider","permissionProvider","policyEngine","identityPermissionProvider","realmId","clientId","run","event","requestAccessContext","headerValue","headers","get","header","type","BEARER","verifyBearerAuthorizationHeader","BASIC","verifyBasicAuthorizationHeader","unsupportedType","payload","verify","token","kind","ACCESS","payloadPropertyInvalid","realm_id","scope","session_id","session","findOneById","expired","ping","sub_kind","sub","identity","resolve","clientAuthBasic","authenticator","safeAuthenticate","username","password","success","GLOBAL","CLIENT","data","userAuthBasic","authenticated","USER","robotAuthBasic","ROBOT"],"sources":["../../../../../../src/adapters/http/middleware/built-in/authorization/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IPermissionEvaluator } from '@authup/access';\nimport { PermissionEvaluator } from '@authup/access';\nimport type { Client, Robot, User } from '@authup/core-kit';\nimport {\n    IdentityType,\n    ScopeName,\n} from '@authup/core-kit';\nimport { AuthHeaderError } from '@authup/errors';\nimport { JWTError, OAuth2TokenKind, deserializeOAuth2Scope } from '@authup/specs';\nimport type { IAppEvent } from 'routup';\nimport {\n    AuthorizationHeaderType,\n    type BasicAuthorizationHeader,\n    type BearerAuthorizationHeader,\n    parseAuthorizationHeader,\n} from 'hapic';\nimport {\n    ClientAuthenticator,\n    PolicyEngine,\n    RobotAuthenticator,\n    UserAuthenticator, \n} from '../../../../../core/index.ts';\nimport type {\n    ICredentialsAuthenticator, \n    IIdentityResolver,\n    IOAuth2TokenVerifier, \n    ISessionManager,\n} from '../../../../../core/index.ts';\nimport {\n    RequestPermissionEvaluator,\n    setRequestIdentity,\n    setRequestPermissionEvaluator,\n    setRequestScopes,\n    setRequestSessionId,\n    setRequestToken,\n} from '../../../request/index.ts';\nimport type { HTTPAuthorizationMiddlewareContext, HTTPAuthorizationMiddlewareOptions } from './types.ts';\n\nexport class AuthorizationMiddleware {\n    protected options: HTTPAuthorizationMiddlewareOptions;\n\n    // --------------------------------------\n\n    protected oauth2TokenVerifier: IOAuth2TokenVerifier;\n\n    protected permissionEvaluator: IPermissionEvaluator;\n\n    // --------------------------------------\n\n    protected identityResolver: IIdentityResolver;\n\n    protected sessionManager : ISessionManager;\n\n    // --------------------------------------\n\n    protected clientAuthenticator : ICredentialsAuthenticator<Client>;\n\n    protected robotAuthenticator : ICredentialsAuthenticator<Robot>;\n\n    protected userAuthenticator : ICredentialsAuthenticator<User>;\n\n    // --------------------------------------\n\n    constructor(ctx: HTTPAuthorizationMiddlewareContext) {\n        this.options = ctx.options || {};\n\n        this.identityResolver = ctx.identityResolver;\n        this.sessionManager = ctx.sessionManager;\n\n        this.clientAuthenticator = new ClientAuthenticator(ctx.identityResolver);\n        this.robotAuthenticator = new RobotAuthenticator(ctx.identityResolver);\n        this.userAuthenticator = new UserAuthenticator(ctx.identityResolver);\n\n        this.oauth2TokenVerifier = ctx.oauth2TokenVerifier;\n\n        this.permissionEvaluator = new PermissionEvaluator({\n            provider: ctx.permissionProvider,\n            policyEngine: new PolicyEngine(ctx.identityPermissionProvider),\n            realmId: null,\n            clientId: null,\n        });\n    }\n\n    // --------------------------------------\n\n    async run(event: IAppEvent) {\n        const requestAccessContext = new RequestPermissionEvaluator(\n            event,\n            this.permissionEvaluator,\n        );\n        setRequestPermissionEvaluator(event, requestAccessContext);\n\n        const headerValue = event.headers.get('authorization');\n        if (!headerValue) {\n            return;\n        }\n\n        const header = parseAuthorizationHeader(headerValue);\n\n        if (header.type === AuthorizationHeaderType.BEARER) {\n            await this.verifyBearerAuthorizationHeader(event, header);\n            return;\n        }\n\n        if (header.type === AuthorizationHeaderType.BASIC) {\n            await this.verifyBasicAuthorizationHeader(event, header);\n            return;\n        }\n\n        throw AuthHeaderError.unsupportedType(header.type);\n    }\n\n    /**\n     * @throws JWTError\n     */\n    protected async verifyBearerAuthorizationHeader(\n        event: IAppEvent,\n        header: BearerAuthorizationHeader,\n    ) {\n        const payload = await this.oauth2TokenVerifier.verify(header.token);\n        if (payload.kind !== OAuth2TokenKind.ACCESS) {\n            throw JWTError.payloadPropertyInvalid('kind');\n        }\n\n        if (!payload.realm_id) {\n            throw JWTError.payloadPropertyInvalid('realm_id');\n        }\n\n        setRequestToken(event, header.token);\n\n        if (payload.scope) {\n            setRequestScopes(event, deserializeOAuth2Scope(payload.scope));\n        }\n\n        // -------------------------------------------------------\n\n        if (!payload.session_id) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        const session = await this.sessionManager.findOneById(payload.session_id);\n        if (!session) {\n            throw JWTError.expired();\n        }\n\n        try {\n            await this.sessionManager.verify(session);\n        } catch {\n            throw JWTError.expired();\n        }\n\n        await this.sessionManager.ping(session);\n\n        setRequestSessionId(event, payload.session_id);\n\n        // -------------------------------------------------------\n\n        if (!payload.sub_kind) {\n            throw JWTError.payloadPropertyInvalid('sub_kind');\n        }\n\n        if (!payload.sub) {\n            throw JWTError.payloadPropertyInvalid('sub');\n        }\n\n        const identity = await this.identityResolver.resolve(\n            payload.sub_kind,\n            payload.sub,\n        );\n\n        if (identity) {\n            setRequestIdentity(event, identity);\n        }\n    }\n\n    protected async verifyBasicAuthorizationHeader(\n        event: IAppEvent,\n        header: BasicAuthorizationHeader,\n    ) {\n        if (this.options.clientAuthBasic) {\n            const authenticator = await this.clientAuthenticator.safeAuthenticate(\n                header.username,\n                header.password,\n            );\n            if (authenticator.success) {\n                setRequestScopes(event, [ScopeName.GLOBAL]);\n                setRequestIdentity(event, {\n                    type: IdentityType.CLIENT,\n                    data: authenticator.data,\n                });\n            }\n        }\n\n        if (this.options.userAuthBasic) {\n            const authenticated = await this.userAuthenticator.safeAuthenticate(\n                header.username,\n                header.password,\n            );\n\n            if (authenticated.success) {\n                setRequestScopes(event, [ScopeName.GLOBAL]);\n                setRequestIdentity(event, {\n                    type: IdentityType.USER,\n                    data: authenticated.data,\n                });\n\n                return;\n            }\n        }\n\n        if (this.options.robotAuthBasic) {\n            const authenticated = await this.robotAuthenticator.safeAuthenticate(\n                header.username,\n                header.password,\n            );\n            if (authenticated.success) {\n                setRequestScopes(event, [ScopeName.GLOBAL]);\n                setRequestIdentity(event, {\n                    type: IdentityType.ROBOT,\n                    data: authenticated.data,\n                });\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AA6CA,IAAamB,0BAAb,MAAaA;CACCC;CAIAC;CAEAC;CAIAC;CAEAC;CAIAC;CAEAC;CAEAC;CAIV,YAAYC,KAAyC;EACjD,KAAKR,UAAUQ,IAAIR,WAAW,CAAC;EAE/B,KAAKG,mBAAmBK,IAAIL;EAC5B,KAAKC,iBAAiBI,IAAIJ;EAE1B,KAAKC,sBAAsB,IAAIhB,oBAAoBmB,IAAIL,gBAAgB;EACvE,KAAKG,qBAAqB,IAAIf,mBAAmBiB,IAAIL,gBAAgB;EACrE,KAAKI,oBAAoB,IAAIf,kBAAkBgB,IAAIL,gBAAgB;EAEnE,KAAKF,sBAAsBO,IAAIP;EAE/B,KAAKC,sBAAsB,IAAItB,oBAAoB;GAC/C6B,UAAUD,IAAIE;GACdC,cAAc,IAAIrB,eAAakB,IAAII,0BAA0B;GAC7DC,SAAS;GACTC,UAAU;EACd,CAAA;CACJ;CAIA,MAAMC,IAAIC,OAAkB;EAKxBrB,8BAA8BqB,OAAOC,IAJJxB,2BAC7BuB,OACA,KAAKd,mBAE4Be,CAAAA;EAErC,MAAMC,cAAcF,MAAMG,QAAQC,IAAI,eAAA;EACtC,IAAI,CAACF,aACD;EAGJ,MAAMG,SAASjC,yBAAyB8B,WAAAA;EAExC,IAAIG,OAAOC,SAASnC,wBAAwBoC,QAAQ;GAChD,MAAM,KAAKC,gCAAgCR,OAAOK,MAAAA;GAClD;EACJ;EAEA,IAAIA,OAAOC,SAASnC,wBAAwBsC,OAAO;GAC/C,MAAM,KAAKC,+BAA+BV,OAAOK,MAAAA;GACjD;EACJ;EAEA,MAAMtC,gBAAgB4C,gBAAgBN,OAAOC,IAAI;CACrD;;;IAKA,MAAgBE,gCACZR,OACAK,QACF;EACE,MAAMO,UAAU,MAAM,KAAK3B,oBAAoB4B,OAAOR,OAAOS,KAAK;EAClE,IAAIF,QAAQG,SAAS9C,gBAAgB+C,QACjC,MAAMhD,SAASiD,uBAAuB,MAAA;EAG1C,IAAI,CAACL,QAAQM,UACT,MAAMlD,SAASiD,uBAAuB,UAAA;EAG1CnC,gBAAgBkB,OAAOK,OAAOS,KAAK;EAEnC,IAAIF,QAAQO,OACRvC,iBAAiBoB,OAAO9B,uBAAuB0C,QAAQO,KAAK,CAAA;EAKhE,IAAI,CAACP,QAAQQ,YACT,MAAMpD,SAASiD,uBAAuB,YAAA;EAG1C,MAAMI,UAAU,MAAM,KAAKjC,eAAekC,YAAYV,QAAQQ,UAAU;EACxE,IAAI,CAACC,SACD,MAAMrD,SAASuD,QAAO;EAG1B,IAAI;GACA,MAAM,KAAKnC,eAAeyB,OAAOQ,OAAAA;EACrC,QAAQ;GACJ,MAAMrD,SAASuD,QAAO;EAC1B;EAEA,MAAM,KAAKnC,eAAeoC,KAAKH,OAAAA;EAE/BxC,oBAAoBmB,OAAOY,QAAQQ,UAAU;EAI7C,IAAI,CAACR,QAAQa,UACT,MAAMzD,SAASiD,uBAAuB,UAAA;EAG1C,IAAI,CAACL,QAAQc,KACT,MAAM1D,SAASiD,uBAAuB,KAAA;EAG1C,MAAMU,WAAW,MAAM,KAAKxC,iBAAiByC,QACzChB,QAAQa,UACRb,QAAQc,GAAG;EAGf,IAAIC,UACAjD,mBAAmBsB,OAAO2B,QAAAA;CAElC;CAEA,MAAgBjB,+BACZV,OACAK,QACF;EACE,IAAI,KAAKrB,QAAQ6C,iBAAiB;GAC9B,MAAMC,gBAAgB,MAAM,KAAKzC,oBAAoB0C,iBACjD1B,OAAO2B,UACP3B,OAAO4B,QAAQ;GAEnB,IAAIH,cAAcI,SAAS;IACvBtD,iBAAiBoB,OAAO,CAAClC,UAAUqE,MAAAA,CAAO;IAC1CzD,mBAAmBsB,OAAO;KACtBM,MAAMzC,aAAauE;KACnBC,MAAMP,cAAcO;IACxB,CAAA;GACJ;EACJ;EAEA,IAAI,KAAKrD,QAAQsD,eAAe;GAC5B,MAAMC,gBAAgB,MAAM,KAAKhD,kBAAkBwC,iBAC/C1B,OAAO2B,UACP3B,OAAO4B,QAAQ;GAGnB,IAAIM,cAAcL,SAAS;IACvBtD,iBAAiBoB,OAAO,CAAClC,UAAUqE,MAAAA,CAAO;IAC1CzD,mBAAmBsB,OAAO;KACtBM,MAAMzC,aAAa2E;KACnBH,MAAME,cAAcF;IACxB,CAAA;IAEA;GACJ;EACJ;EAEA,IAAI,KAAKrD,QAAQyD,gBAAgB;GAC7B,MAAMF,gBAAgB,MAAM,KAAKjD,mBAAmByC,iBAChD1B,OAAO2B,UACP3B,OAAO4B,QAAQ;GAEnB,IAAIM,cAAcL,SAAS;IACvBtD,iBAAiBoB,OAAO,CAAClC,UAAUqE,MAAAA,CAAO;IAC1CzD,mBAAmBsB,OAAO;KACtBM,MAAMzC,aAAa6E;KACnBL,MAAME,cAAcF;IACxB,CAAA;GACJ;EACJ;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["PermissionEvaluator","IdentityType","ScopeName","AuthHeaderError","JWTError","OAuth2SubKind","OAuth2TokenKind","deserializeOAuth2Scope","AuthorizationHeaderType","parseAuthorizationHeader","ClientAuthenticator","PolicyEngine","UserAuthenticator","assertClientCertificateEvidenceValidForBinding","RequestIdentity","RequestPermissionEvaluator","extractClientCertificateEvidence","setRequestIdentity","setRequestMfaLoginTicket","setRequestPermissionEvaluator","setRequestScopes","setRequestSessionId","setRequestToken","AuthorizationMiddleware","options","oauth2TokenVerifier","permissionEvaluator","identityResolver","sessionManager","clientAuthenticator","userAuthenticator","ctx","provider","permissionProvider","policyEngine","identityPermissionProvider","realmId","clientId","run","event","requestAccessContext","headerValue","headers","get","header","type","BEARER","verifyBearerAuthorizationHeader","BASIC","verifyBasicAuthorizationHeader","unsupportedType","payload","verify","token","verifyCertificateBinding","kind","MFA","verifyMfaLoginTicket","ACCESS","payloadPropertyInvalid","realm_id","scope","session_id","session","findOneById","expired","ping","sub_kind","sub","identity","resolve","cnf","expectedThumbprint","length","invalid","evidence","certificateSource","thumbprint","USER","subKind","clientAuthBasic","authenticator","safeAuthenticate","username","password","success","GLOBAL","CLIENT","data","userAuthBasic","authenticated"],"sources":["../../../../../../src/adapters/http/middleware/built-in/authorization/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IPermissionEvaluator } from '@authup/access';\nimport { PermissionEvaluator } from '@authup/access';\nimport type { Client, User } from '@authup/core-kit';\nimport {\n    IdentityType,\n    ScopeName,\n} from '@authup/core-kit';\nimport { AuthHeaderError } from '@authup/errors';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport {\n    JWTError,\n    OAuth2SubKind,\n    OAuth2TokenKind,\n    deserializeOAuth2Scope,\n} from '@authup/specs';\nimport type { IAppEvent } from 'routup';\nimport {\n    AuthorizationHeaderType,\n    type BasicAuthorizationHeader,\n    type BearerAuthorizationHeader,\n    parseAuthorizationHeader,\n} from 'hapic';\nimport {\n    ClientAuthenticator,\n    PolicyEngine,\n    UserAuthenticator,\n    assertClientCertificateEvidenceValidForBinding,\n} from '../../../../../core/index.ts';\nimport type {\n    ICredentialsAuthenticator,\n    IIdentityResolver,\n    IOAuth2TokenVerifier,\n    ISessionManager,\n} from '../../../../../core/index.ts';\nimport {\n    RequestIdentity,\n    RequestPermissionEvaluator,\n    extractClientCertificateEvidence,\n    setRequestIdentity,\n    setRequestMfaLoginTicket,\n    setRequestPermissionEvaluator,\n    setRequestScopes,\n    setRequestSessionId,\n    setRequestToken,\n} from '../../../request/index.ts';\nimport type { HTTPAuthorizationMiddlewareContext, HTTPAuthorizationMiddlewareOptions } from './types.ts';\n\nexport class AuthorizationMiddleware {\n    protected options: HTTPAuthorizationMiddlewareOptions;\n\n    // --------------------------------------\n\n    protected oauth2TokenVerifier: IOAuth2TokenVerifier;\n\n    protected permissionEvaluator: IPermissionEvaluator;\n\n    // --------------------------------------\n\n    protected identityResolver: IIdentityResolver;\n\n    protected sessionManager : ISessionManager;\n\n    // --------------------------------------\n\n    protected clientAuthenticator : ICredentialsAuthenticator<Client>;\n\n    protected userAuthenticator : ICredentialsAuthenticator<User>;\n\n    // --------------------------------------\n\n    constructor(ctx: HTTPAuthorizationMiddlewareContext) {\n        this.options = ctx.options || {};\n\n        this.identityResolver = ctx.identityResolver;\n        this.sessionManager = ctx.sessionManager;\n\n        this.clientAuthenticator = new ClientAuthenticator(ctx.identityResolver);\n        this.userAuthenticator = new UserAuthenticator(ctx.identityResolver);\n\n        this.oauth2TokenVerifier = ctx.oauth2TokenVerifier;\n\n        this.permissionEvaluator = new PermissionEvaluator({\n            provider: ctx.permissionProvider,\n            policyEngine: new PolicyEngine(ctx.identityPermissionProvider),\n            realmId: null,\n            clientId: null,\n        });\n    }\n\n    // --------------------------------------\n\n    async run(event: IAppEvent) {\n        const requestAccessContext = new RequestPermissionEvaluator(\n            event,\n            this.permissionEvaluator,\n        );\n        setRequestPermissionEvaluator(event, requestAccessContext);\n\n        const headerValue = event.headers.get('authorization');\n        if (!headerValue) {\n            return;\n        }\n\n        const header = parseAuthorizationHeader(headerValue);\n\n        if (header.type === AuthorizationHeaderType.BEARER) {\n            await this.verifyBearerAuthorizationHeader(event, header);\n            return;\n        }\n\n        if (header.type === AuthorizationHeaderType.BASIC) {\n            await this.verifyBasicAuthorizationHeader(event, header);\n            return;\n        }\n\n        throw AuthHeaderError.unsupportedType(header.type);\n    }\n\n    /**\n     * @throws JWTError\n     */\n    protected async verifyBearerAuthorizationHeader(\n        event: IAppEvent,\n        header: BearerAuthorizationHeader,\n    ) {\n        const payload = await this.oauth2TokenVerifier.verify(header.token);\n        await this.verifyCertificateBinding(event, payload);\n        if (payload.kind === OAuth2TokenKind.MFA) {\n            await this.verifyMfaLoginTicket(event, payload);\n            return;\n        }\n\n        if (payload.kind !== OAuth2TokenKind.ACCESS) {\n            throw JWTError.payloadPropertyInvalid('kind');\n        }\n\n        if (!payload.realm_id) {\n            throw JWTError.payloadPropertyInvalid('realm_id');\n        }\n\n        setRequestToken(event, header.token);\n\n        if (payload.scope) {\n            setRequestScopes(event, deserializeOAuth2Scope(payload.scope));\n        }\n\n        // -------------------------------------------------------\n\n        if (!payload.session_id) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        const session = await this.sessionManager.findOneById(payload.session_id);\n        if (!session) {\n            throw JWTError.expired();\n        }\n\n        try {\n            await this.sessionManager.verify(session);\n        } catch {\n            throw JWTError.expired();\n        }\n\n        await this.sessionManager.ping(session);\n\n        setRequestSessionId(event, payload.session_id);\n\n        // -------------------------------------------------------\n\n        if (!payload.sub_kind) {\n            throw JWTError.payloadPropertyInvalid('sub_kind');\n        }\n\n        if (!payload.sub) {\n            throw JWTError.payloadPropertyInvalid('sub');\n        }\n\n        const identity = await this.identityResolver.resolve(\n            payload.sub_kind,\n            payload.sub,\n        );\n\n        if (identity) {\n            setRequestIdentity(event, identity);\n        }\n    }\n\n    protected async verifyCertificateBinding(event: IAppEvent, payload: OAuth2TokenPayload): Promise<void> {\n        if (!payload.cnf) {\n            return;\n        }\n\n        const expectedThumbprint = payload.cnf['x5t#S256'];\n        if (typeof expectedThumbprint !== 'string' || expectedThumbprint.length === 0) {\n            throw JWTError.invalid();\n        }\n\n        try {\n            const evidence = await extractClientCertificateEvidence(\n                event,\n                this.options.certificateSource ?? 'disabled',\n            );\n            if (!evidence || evidence.thumbprint !== expectedThumbprint) {\n                throw JWTError.invalid();\n            }\n\n            assertClientCertificateEvidenceValidForBinding(evidence);\n        } catch {\n            throw JWTError.invalid();\n        }\n    }\n\n    /**\n     * An \"MFA-pending\" login ticket (issue #3242). Verified with the same\n     * rigor as an access token (session existence + subject match), but\n     * stashed on a DEDICATED request slot — the main identity / scope /\n     * session slots stay empty, so every identity-gated route rejects a\n     * ticket bearer (default-deny); only the challenge routes opt in via\n     * useRequestMfaLoginTicket.\n     *\n     * @throws JWTError\n     */\n    protected async verifyMfaLoginTicket(\n        event: IAppEvent,\n        payload: OAuth2TokenPayload,\n    ) {\n        if (payload.sub_kind !== OAuth2SubKind.USER) {\n            throw JWTError.payloadPropertyInvalid('sub_kind');\n        }\n\n        if (!payload.sub) {\n            throw JWTError.payloadPropertyInvalid('sub');\n        }\n\n        if (!payload.realm_id) {\n            throw JWTError.payloadPropertyInvalid('realm_id');\n        }\n\n        if (!payload.session_id) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        const session = await this.sessionManager.findOneById(payload.session_id);\n        if (!session) {\n            throw JWTError.expired();\n        }\n\n        try {\n            await this.sessionManager.verify(session);\n        } catch {\n            throw JWTError.expired();\n        }\n\n        // defense in depth — the pending session must still belong to the\n        // ticket subject.\n        if (\n            session.sub !== payload.sub ||\n            session.subKind !== IdentityType.USER\n        ) {\n            throw JWTError.expired();\n        }\n\n        await this.sessionManager.ping(session);\n\n        const identity = await this.identityResolver.resolve(\n            payload.sub_kind,\n            payload.sub,\n        );\n        if (!identity) {\n            throw JWTError.expired();\n        }\n\n        setRequestMfaLoginTicket(event, {\n            identity: new RequestIdentity(identity),\n            payload,\n        });\n    }\n\n    protected async verifyBasicAuthorizationHeader(\n        event: IAppEvent,\n        header: BasicAuthorizationHeader,\n    ) {\n        if (this.options.clientAuthBasic) {\n            const authenticator = await this.clientAuthenticator.safeAuthenticate(\n                header.username,\n                header.password,\n            );\n            if (authenticator.success) {\n                setRequestScopes(event, [ScopeName.GLOBAL]);\n                setRequestIdentity(event, {\n                    type: IdentityType.CLIENT,\n                    data: authenticator.data,\n                });\n            }\n        }\n\n        if (this.options.userAuthBasic) {\n            const authenticated = await this.userAuthenticator.safeAuthenticate(\n                header.username,\n                header.password,\n            );\n\n            if (authenticated.success) {\n                setRequestScopes(event, [ScopeName.GLOBAL]);\n                setRequestIdentity(event, {\n                    type: IdentityType.USER,\n                    data: authenticated.data,\n                });\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAsDA,IAAauB,0BAAb,MAAaA;CACCC;CAIAC;CAEAC;CAIAC;CAEAC;CAIAC;CAEAC;CAIV,YAAYC,KAAyC;EACjD,KAAKP,UAAUO,IAAIP,WAAW,CAAC;EAE/B,KAAKG,mBAAmBI,IAAIJ;EAC5B,KAAKC,iBAAiBG,IAAIH;EAE1B,KAAKC,sBAAsB,IAAInB,oBAAoBqB,IAAIJ,gBAAgB;EACvE,KAAKG,oBAAoB,IAAIlB,kBAAkBmB,IAAIJ,gBAAgB;EAEnE,KAAKF,sBAAsBM,IAAIN;EAE/B,KAAKC,sBAAsB,IAAI1B,oBAAoB;GAC/CgC,UAAUD,IAAIE;GACdC,cAAc,IAAIvB,eAAaoB,IAAII,0BAA0B;GAC7DC,SAAS;GACTC,UAAU;EACd,CAAA;CACJ;CAIA,MAAMC,IAAIC,OAAkB;EAKxBpB,8BAA8BoB,OAAOC,IAJJzB,2BAC7BwB,OACA,KAAKb,mBAE4Bc,CAAAA;EAErC,MAAMC,cAAcF,MAAMG,QAAQC,IAAI,eAAA;EACtC,IAAI,CAACF,aACD;EAGJ,MAAMG,SAASnC,yBAAyBgC,WAAAA;EAExC,IAAIG,OAAOC,SAASrC,wBAAwBsC,QAAQ;GAChD,MAAM,KAAKC,gCAAgCR,OAAOK,MAAAA;GAClD;EACJ;EAEA,IAAIA,OAAOC,SAASrC,wBAAwBwC,OAAO;GAC/C,MAAM,KAAKC,+BAA+BV,OAAOK,MAAAA;GACjD;EACJ;EAEA,MAAMzC,gBAAgB+C,gBAAgBN,OAAOC,IAAI;CACrD;;;IAKA,MAAgBE,gCACZR,OACAK,QACF;EACE,MAAMO,UAAU,MAAM,KAAK1B,oBAAoB2B,OAAOR,OAAOS,KAAK;EAClE,MAAM,KAAKC,yBAAyBf,OAAOY,OAAAA;EAC3C,IAAIA,QAAQI,SAASjD,gBAAgBkD,KAAK;GACtC,MAAM,KAAKC,qBAAqBlB,OAAOY,OAAAA;GACvC;EACJ;EAEA,IAAIA,QAAQI,SAASjD,gBAAgBoD,QACjC,MAAMtD,SAASuD,uBAAuB,MAAA;EAG1C,IAAI,CAACR,QAAQS,UACT,MAAMxD,SAASuD,uBAAuB,UAAA;EAG1CrC,gBAAgBiB,OAAOK,OAAOS,KAAK;EAEnC,IAAIF,QAAQU,OACRzC,iBAAiBmB,OAAOhC,uBAAuB4C,QAAQU,KAAK,CAAA;EAKhE,IAAI,CAACV,QAAQW,YACT,MAAM1D,SAASuD,uBAAuB,YAAA;EAG1C,MAAMI,UAAU,MAAM,KAAKnC,eAAeoC,YAAYb,QAAQW,UAAU;EACxE,IAAI,CAACC,SACD,MAAM3D,SAAS6D,QAAO;EAG1B,IAAI;GACA,MAAM,KAAKrC,eAAewB,OAAOW,OAAAA;EACrC,QAAQ;GACJ,MAAM3D,SAAS6D,QAAO;EAC1B;EAEA,MAAM,KAAKrC,eAAesC,KAAKH,OAAAA;EAE/B1C,oBAAoBkB,OAAOY,QAAQW,UAAU;EAI7C,IAAI,CAACX,QAAQgB,UACT,MAAM/D,SAASuD,uBAAuB,UAAA;EAG1C,IAAI,CAACR,QAAQiB,KACT,MAAMhE,SAASuD,uBAAuB,KAAA;EAG1C,MAAMU,WAAW,MAAM,KAAK1C,iBAAiB2C,QACzCnB,QAAQgB,UACRhB,QAAQiB,GAAG;EAGf,IAAIC,UACApD,mBAAmBsB,OAAO8B,QAAAA;CAElC;CAEA,MAAgBf,yBAAyBf,OAAkBY,SAA4C;EACnG,IAAI,CAACA,QAAQoB,KACT;EAGJ,MAAMC,qBAAqBrB,QAAQoB,IAAI;EACvC,IAAI,OAAOC,uBAAuB,YAAYA,mBAAmBC,WAAW,GACxE,MAAMrE,SAASsE,QAAO;EAG1B,IAAI;GACA,MAAMC,WAAW,MAAM3D,iCACnBuB,OACA,KAAKf,QAAQoD,qBAAqB,UAAA;GAEtC,IAAI,CAACD,YAAYA,SAASE,eAAeL,oBACrC,MAAMpE,SAASsE,QAAO;GAG1B7D,+CAA+C8D,QAAAA;EACnD,QAAQ;GACJ,MAAMvE,SAASsE,QAAO;EAC1B;CACJ;;;;;;;;;;IAYA,MAAgBjB,qBACZlB,OACAY,SACF;EACE,IAAIA,QAAQgB,aAAa9D,cAAcyE,MACnC,MAAM1E,SAASuD,uBAAuB,UAAA;EAG1C,IAAI,CAACR,QAAQiB,KACT,MAAMhE,SAASuD,uBAAuB,KAAA;EAG1C,IAAI,CAACR,QAAQS,UACT,MAAMxD,SAASuD,uBAAuB,UAAA;EAG1C,IAAI,CAACR,QAAQW,YACT,MAAM1D,SAASuD,uBAAuB,YAAA;EAG1C,MAAMI,UAAU,MAAM,KAAKnC,eAAeoC,YAAYb,QAAQW,UAAU;EACxE,IAAI,CAACC,SACD,MAAM3D,SAAS6D,QAAO;EAG1B,IAAI;GACA,MAAM,KAAKrC,eAAewB,OAAOW,OAAAA;EACrC,QAAQ;GACJ,MAAM3D,SAAS6D,QAAO;EAC1B;EAIA,IACIF,QAAQK,QAAQjB,QAAQiB,OACxBL,QAAQgB,YAAY9E,aAAa6E,MAEjC,MAAM1E,SAAS6D,QAAO;EAG1B,MAAM,KAAKrC,eAAesC,KAAKH,OAAAA;EAE/B,MAAMM,WAAW,MAAM,KAAK1C,iBAAiB2C,QACzCnB,QAAQgB,UACRhB,QAAQiB,GAAG;EAEf,IAAI,CAACC,UACD,MAAMjE,SAAS6D,QAAO;EAG1B/C,yBAAyBqB,OAAO;GAC5B8B,UAAU,IAAIvD,gBAAgBuD,QAAAA;GAC9BlB;EACJ,CAAA;CACJ;CAEA,MAAgBF,+BACZV,OACAK,QACF;EACE,IAAI,KAAKpB,QAAQwD,iBAAiB;GAC9B,MAAMC,gBAAgB,MAAM,KAAKpD,oBAAoBqD,iBACjDtC,OAAOuC,UACPvC,OAAOwC,QAAQ;GAEnB,IAAIH,cAAcI,SAAS;IACvBjE,iBAAiBmB,OAAO,CAACrC,UAAUoF,MAAAA,CAAO;IAC1CrE,mBAAmBsB,OAAO;KACtBM,MAAM5C,aAAasF;KACnBC,MAAMP,cAAcO;IACxB,CAAA;GACJ;EACJ;EAEA,IAAI,KAAKhE,QAAQiE,eAAe;GAC5B,MAAMC,gBAAgB,MAAM,KAAK5D,kBAAkBoD,iBAC/CtC,OAAOuC,UACPvC,OAAOwC,QAAQ;GAGnB,IAAIM,cAAcL,SAAS;IACvBjE,iBAAiBmB,OAAO,CAACrC,UAAUoF,MAAAA,CAAO;IAC1CrE,mBAAmBsB,OAAO;KACtBM,MAAM5C,aAAa6E;KACnBU,MAAME,cAAcF;IACxB,CAAA;GACJ;EACJ;CACJ;AACJ"}

package/dist/adapters/http/middleware/built-in/authorization/types.d.ts

@@ -1,9 +1,10 @@
 import type { IPermissionProvider } from '@authup/access';
 import type { IIdentityPermissionProvider, IIdentityResolver, IOAuth2TokenVerifier, ISessionManager } from '../../../../../core/index.ts';
+import type { CertificateSource } from '../../../request/index.ts';
 export type HTTPAuthorizationMiddlewareOptions = {
     clientAuthBasic?: boolean;
-    robotAuthBasic?: boolean;
     userAuthBasic?: boolean;
+    certificateSource?: CertificateSource;
 };
 export type HTTPAuthorizationMiddlewareContext = {
     identityResolver: IIdentityResolver;

package/dist/adapters/http/middleware/built-in/authorization/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/middleware/built-in/authorization/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAER,2BAA2B,EAC3B,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EAClB,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,kCAAkC,GAAG;IAC7C,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,kCAAkC,GAAG;IAC7C,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,0BAA0B,EAAE,2BAA2B,CAAC;IACxD,cAAc,EAAE,eAAe,CAAC;IAChC,mBAAmB,EAAE,oBAAoB,CAAC;IAC1C,kBAAkB,EAAE,mBAAmB,CAAC;IAExC,OAAO,CAAC,EAAE,kCAAkC,CAAA;CAC/C,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/middleware/built-in/authorization/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAER,2BAA2B,EAC3B,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EAClB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,MAAM,MAAM,kCAAkC,GAAG;IAC7C,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CACzC,CAAC;AAEF,MAAM,MAAM,kCAAkC,GAAG;IAC7C,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,0BAA0B,EAAE,2BAA2B,CAAC;IACxD,cAAc,EAAE,eAAe,CAAC;IAChC,mBAAmB,EAAE,oBAAoB,CAAC;IAC1C,kBAAkB,EAAE,mBAAmB,CAAC;IAExC,OAAO,CAAC,EAAE,kCAAkC,CAAA;CAC/C,CAAC"}

package/dist/adapters/http/middleware/built-in/index.mjs

@@ -15,8 +15,8 @@ import { registerBasicMiddleware } from "./basic.mjs";
 import { registerCorsMiddleware } from "./cors.mjs";
 import { registerErrorMiddleware } from "./error.mjs";
 import { createLoggerMiddleware, redactSensitiveURLParams } from "./logger.mjs";
-import { registerPrometheusMiddleware } from "./prometheus.mjs";
+import { createRouteTemplateNormalizePath, registerPrometheusMiddleware } from "./prometheus.mjs";
 import { registerRateLimitMiddleware } from "./rate-limit.mjs";
 import { createSwaggerMiddleware } from "./swagger.mjs";
 import { UI_HTTP_CLIENT_FACTORY_STORE_KEY, registerUIHttpClientMiddleware } from "./ui-http-client.mjs";
-export { AuthorizationMiddleware, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, RealmResolverMiddleware, UI_HTTP_CLIENT_FACTORY_STORE_KEY, VITE_SERVER_STORE_KEY, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createSwaggerMiddleware, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerUIHttpClientMiddleware };
+export { AuthorizationMiddleware, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, RealmResolverMiddleware, UI_HTTP_CLIENT_FACTORY_STORE_KEY, VITE_SERVER_STORE_KEY, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createRouteTemplateNormalizePath, createSwaggerMiddleware, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerUIHttpClientMiddleware };

package/dist/adapters/http/middleware/built-in/prometheus.d.ts

@@ -1,4 +1,15 @@
 import type { OptionsInput } from '@routup/prometheus';
-import type { App } from 'routup';
+import type { App, IAppEvent } from 'routup';
+/**
+ * The `path` label must stay bounded: labeling by the raw request path lets
+ * every probed id (`/users/<random-uuid>`, even on 401/404) mint a new
+ * prom-client time-series — unbounded registry growth. Requests are instead
+ * labeled by the registered route template (`/users/:id`), read from the
+ * router's own route table (child apps are flattened into the root with full
+ * patterns, and all routes are registered before `listen`, so a snapshot at
+ * first request is complete). Method-agnostic mounts (`/docs`, `/public`)
+ * label as `<mount>/**`; anything else collapses into one unmatched bucket.
+ */
+export declare function createRouteTemplateNormalizePath(router: App): (path: string, event: IAppEvent) => string;
 export declare function registerPrometheusMiddleware(router: App, input?: OptionsInput): void;
 //# sourceMappingURL=prometheus.d.ts.map

package/dist/adapters/http/middleware/built-in/prometheus.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prometheus.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/prometheus.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAElC,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,YAAY,QAqB7E"}
+{"version":3,"file":"prometheus.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/prometheus.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAmF7C;;;;;;;;;GASG;AACH,wBAAgB,gCAAgC,CAC5C,MAAM,EAAE,GAAG,GACZ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,KAAK,MAAM,CAsC5C;AAED,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,YAAY,QAsB7E"}