@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.54

package/dist/app/modules/oauth2/constants.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"constants.mjs","names":["TypedToken","OAuth2InjectionToken","ClientRepository","ScopeRepository","AuthorizationCodeIssuer","AuthorizationCodeRepository","AuthorizationCodeVerifier","AuthorizationStateManager","AuthorizationCodeRequestVerifier","AuthorizationStateRepository","KeyRepository","AccessTokenIssuer","OpenIDTokenIssuer","RefreshTokenIssuer","TokenRepository","SessionTokenRepository","TokenRevoker","TokenSigner","TokenVerifier"],"sources":["../../../../src/app/modules/oauth2/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { TypedToken } from 'eldin';\nimport type {\n    IOAuth2AuthorizationCodeIssuer,\n    IOAuth2AuthorizationCodeRepository,\n    IOAuth2AuthorizationCodeRequestVerifier,\n    IOAuth2AuthorizationCodeVerifier,\n    IOAuth2AuthorizationStateManager,\n    IOAuth2AuthorizeStateRepository,\n    IOAuth2ClientRepository,\n    IOAuth2KeyRepository,\n    IOAuth2OpenIDTokenIssuer,\n    IOAuth2ScopeRepository,\n    IOAuth2TokenIssuer,\n    IOAuth2TokenRepository,\n    IOAuth2TokenRevoker,\n    IOAuth2TokenSigner,\n    IOAuth2TokenVerifier,\n    ISessionTokenRepository,\n} from '../../../core/index.ts';\n\nexport const OAuth2InjectionToken = {\n    ClientRepository: new TypedToken<IOAuth2ClientRepository>('ClientRepository'),\n    ScopeRepository: new TypedToken<IOAuth2ScopeRepository>('ScopeRepository'),\n\n    AuthorizationCodeIssuer: new TypedToken<IOAuth2AuthorizationCodeIssuer>('AuthorizationCodeIssuer'),\n    AuthorizationCodeRepository: new TypedToken<IOAuth2AuthorizationCodeRepository>('AuthorizationCodeRepository'),\n    AuthorizationCodeVerifier: new TypedToken<IOAuth2AuthorizationCodeVerifier>('AuthorizationCodeVerifier'),\n    AuthorizationStateManager: new TypedToken<IOAuth2AuthorizationStateManager>('AuthorizationStateManager'),\n    AuthorizationCodeRequestVerifier: new TypedToken<IOAuth2AuthorizationCodeRequestVerifier>('AuthorizationCodeRequestVerifier'),\n\n    AuthorizationStateRepository: new TypedToken<IOAuth2AuthorizeStateRepository>('AuthorizationStateRepository'),\n\n    KeyRepository: new TypedToken<IOAuth2KeyRepository>('KeyRepository'),\n\n    AccessTokenIssuer: new TypedToken<IOAuth2TokenIssuer>('AccessTokenIssuer'),\n    OpenIDTokenIssuer: new TypedToken<IOAuth2OpenIDTokenIssuer>('OpenIDTokenIssuer'),\n    RefreshTokenIssuer: new TypedToken<IOAuth2TokenIssuer>('RefreshTokenIssuer'),\n\n    TokenRepository: new TypedToken<IOAuth2TokenRepository>('TokenRepository'),\n    SessionTokenRepository: new TypedToken<ISessionTokenRepository>('SessionTokenRepository'),\n    TokenRevoker: new TypedToken<IOAuth2TokenRevoker>('TokenRevoker'),\n    TokenSigner: new TypedToken<IOAuth2TokenSigner>('TokenSigner'),\n    TokenVerifier: new TypedToken<IOAuth2TokenVerifier>('TokenVerifier'),\n} as const;\n"],"mappings":";;;;;AA2BA,MAAaC,uBAAuB;CAChCC,kBAAkB,IAAIF,WAAoC,kBAAA;CAC1DG,iBAAiB,IAAIH,WAAmC,iBAAA;CAExDI,yBAAyB,IAAIJ,WAA2C,yBAAA;CACxEK,6BAA6B,IAAIL,WAA+C,6BAAA;CAChFM,2BAA2B,IAAIN,WAA6C,2BAAA;CAC5EO,2BAA2B,IAAIP,WAA6C,2BAAA;CAC5EQ,kCAAkC,IAAIR,WAAoD,kCAAA;CAE1FS,8BAA8B,IAAIT,WAA4C,8BAAA;CAE9EU,eAAe,IAAIV,WAAiC,eAAA;CAEpDW,mBAAmB,IAAIX,WAA+B,mBAAA;CACtDY,mBAAmB,IAAIZ,WAAqC,mBAAA;CAC5Da,oBAAoB,IAAIb,WAA+B,oBAAA;CAEvDc,iBAAiB,IAAId,WAAmC,iBAAA;CACxDe,wBAAwB,IAAIf,WAAoC,wBAAA;CAChEgB,cAAc,IAAIhB,WAAgC,cAAA;CAClDiB,aAAa,IAAIjB,WAA+B,aAAA;CAChDkB,eAAe,IAAIlB,WAAiC,eAAA;AACxD"}
+{"version":3,"file":"constants.mjs","names":["TypedToken","OAuth2InjectionToken","ClientRepository","ScopeRepository","AuthorizationCodeIssuer","AuthorizationCodeRepository","AuthorizationCodeVerifier","AuthorizationStateManager","AuthorizationCodeRequestVerifier","AuthorizationStateRepository","KeyStore","AccessTokenIssuer","MfaTokenIssuer","OpenIDTokenIssuer","RefreshTokenIssuer","TokenRepository","SessionTokenRepository","ConsentRepository","TokenRevoker","TokenSigner","TokenVerifier"],"sources":["../../../../src/app/modules/oauth2/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { TypedToken } from 'eldin';\nimport type {\n    IConsentRepository,\n    IKeyRepository,\n    IKeyStore,\n    IOAuth2AuthorizationCodeIssuer,\n    IOAuth2AuthorizationCodeRepository,\n    IOAuth2AuthorizationCodeRequestVerifier,\n    IOAuth2AuthorizationCodeVerifier,\n    IOAuth2AuthorizationStateManager,\n    IOAuth2AuthorizeStateRepository,\n    IOAuth2ClientRepository,\n    IOAuth2OpenIDTokenIssuer,\n    IOAuth2ScopeRepository,\n    IOAuth2TokenIssuer,\n    IOAuth2TokenRepository,\n    IOAuth2TokenRevoker,\n    IOAuth2TokenSigner,\n    IOAuth2TokenVerifier,\n    ISessionTokenRepository,\n} from '../../../core/index.ts';\n\nexport const OAuth2InjectionToken = {\n    ClientRepository: new TypedToken<IOAuth2ClientRepository>('ClientRepository'),\n    ScopeRepository: new TypedToken<IOAuth2ScopeRepository>('ScopeRepository'),\n\n    AuthorizationCodeIssuer: new TypedToken<IOAuth2AuthorizationCodeIssuer>('AuthorizationCodeIssuer'),\n    AuthorizationCodeRepository: new TypedToken<IOAuth2AuthorizationCodeRepository>('AuthorizationCodeRepository'),\n    AuthorizationCodeVerifier: new TypedToken<IOAuth2AuthorizationCodeVerifier>('AuthorizationCodeVerifier'),\n    AuthorizationStateManager: new TypedToken<IOAuth2AuthorizationStateManager>('AuthorizationStateManager'),\n    AuthorizationCodeRequestVerifier: new TypedToken<IOAuth2AuthorizationCodeRequestVerifier>('AuthorizationCodeRequestVerifier'),\n\n    AuthorizationStateRepository: new TypedToken<IOAuth2AuthorizeStateRepository>('AuthorizationStateRepository'),\n\n    /**\n     * One adapter instance serving both key ports: the material-resolving\n     * store (signer / verifier / realm cipher) and the entity CRUD surface\n     * (key management API).\n     */\n    KeyStore: new TypedToken<IKeyStore & IKeyRepository>('KeyStore'),\n\n    AccessTokenIssuer: new TypedToken<IOAuth2TokenIssuer>('AccessTokenIssuer'),\n    MfaTokenIssuer: new TypedToken<IOAuth2TokenIssuer>('MfaTokenIssuer'),\n    OpenIDTokenIssuer: new TypedToken<IOAuth2OpenIDTokenIssuer>('OpenIDTokenIssuer'),\n    RefreshTokenIssuer: new TypedToken<IOAuth2TokenIssuer>('RefreshTokenIssuer'),\n\n    TokenRepository: new TypedToken<IOAuth2TokenRepository>('TokenRepository'),\n    SessionTokenRepository: new TypedToken<ISessionTokenRepository>('SessionTokenRepository'),\n    ConsentRepository: new TypedToken<IConsentRepository>('OAuth2ConsentRepository'),\n    TokenRevoker: new TypedToken<IOAuth2TokenRevoker>('TokenRevoker'),\n    TokenSigner: new TypedToken<IOAuth2TokenSigner>('TokenSigner'),\n    TokenVerifier: new TypedToken<IOAuth2TokenVerifier>('TokenVerifier'),\n} as const;\n"],"mappings":";;;;;AA6BA,MAAaC,uBAAuB;CAChCC,kBAAkB,IAAIF,WAAoC,kBAAA;CAC1DG,iBAAiB,IAAIH,WAAmC,iBAAA;CAExDI,yBAAyB,IAAIJ,WAA2C,yBAAA;CACxEK,6BAA6B,IAAIL,WAA+C,6BAAA;CAChFM,2BAA2B,IAAIN,WAA6C,2BAAA;CAC5EO,2BAA2B,IAAIP,WAA6C,2BAAA;CAC5EQ,kCAAkC,IAAIR,WAAoD,kCAAA;CAE1FS,8BAA8B,IAAIT,WAA4C,8BAAA;;;;;IAO9EU,UAAU,IAAIV,WAAuC,UAAA;CAErDW,mBAAmB,IAAIX,WAA+B,mBAAA;CACtDY,gBAAgB,IAAIZ,WAA+B,gBAAA;CACnDa,mBAAmB,IAAIb,WAAqC,mBAAA;CAC5Dc,oBAAoB,IAAId,WAA+B,oBAAA;CAEvDe,iBAAiB,IAAIf,WAAmC,iBAAA;CACxDgB,wBAAwB,IAAIhB,WAAoC,wBAAA;CAChEiB,mBAAmB,IAAIjB,WAA+B,yBAAA;CACtDkB,cAAc,IAAIlB,WAAgC,cAAA;CAClDmB,aAAa,IAAInB,WAA+B,aAAA;CAChDoB,eAAe,IAAIpB,WAAiC,eAAA;AACxD"}

package/dist/app/modules/oauth2/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/oauth2/module.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AA8BrC,qBAAa,YAAa,YAAW,OAAO;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;;IAO1B,KAAK,CAAC,SAAS,EAAE,UAAU,GAAI,OAAO,CAAC,IAAI,CAAC;CAmLrD"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/oauth2/module.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAiCrC,qBAAa,YAAa,YAAW,OAAO;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;;IAO1B,KAAK,CAAC,SAAS,EAAE,UAAU,GAAI,OAAO,CAAC,IAAI,CAAC;CA2NrD"}

package/dist/app/modules/oauth2/module.mjs

@@ -9,6 +9,7 @@ import { OAuth2AuthorizationCodeVerifier } from "../../../core/oauth2/authorizat
 import { OAuth2AuthorizationCodeRequestVerifier } from "../../../core/oauth2/authorization/code-request/verifier/module.mjs";
 import { OAuth2AuthorizationStateManager } from "../../../core/oauth2/authorization/state/module.mjs";
 import { OAuth2AccessTokenIssuer } from "../../../core/oauth2/token/issuer/access/module.mjs";
+import { OAuth2MfaTokenIssuer } from "../../../core/oauth2/token/issuer/mfa/module.mjs";
 import { OAuth2OpenIDTokenIssuer } from "../../../core/oauth2/token/issuer/open-id/module.mjs";
 import { OAuth2RefreshTokenIssuer } from "../../../core/oauth2/token/issuer/refresh/module.mjs";
 import { OAuth2TokenRevoker } from "../../../core/oauth2/token/revoker/module.mjs";
@@ -20,19 +21,24 @@ import { ModuleName } from "../constants.mjs";
 import { ConfigInjectionKey } from "../config/constants.mjs";
 import "../config/index.mjs";
 import "../cache/index.mjs";
+import { KeyRepositoryAdapter } from "../database/repositories/key/repository.mjs";
+import "../database/repositories/index.mjs";
 import { DatabaseInjectionKey } from "../database/constants.mjs";
+import { LoggerInjectionKey } from "../logger/constants.mjs";
+import "../logger/index.mjs";
 import "../database/index.mjs";
 import { OAuth2InjectionToken } from "./constants.mjs";
 import { OAuth2AuthorizationCodeRepository } from "./repositories/authorize/code/repository.mjs";
 import { OAuth2AuthorizationStateRepository } from "./repositories/authorize/state/repository.mjs";
 import { OAuth2ClientRepository } from "./repositories/client/repository.mjs";
+import { ConsentRepositoryAdapter } from "./repositories/consent/repository.mjs";
 import { OAuth2ScopeRepository } from "./repositories/scope/repository.mjs";
-import { OAuth2KeyRepository } from "./repositories/key/repository.mjs";
 import { SessionTokenRepositoryAdapter } from "./repositories/session-token/repository.mjs";
 import { OAuth2TokenRepository } from "./repositories/token/repository.mjs";
 import "./repositories/index.mjs";
 import { IdentityInjectionKey } from "../identity/constants.mjs";
 import "../identity/index.mjs";
+import { SymmetricCipher } from "@authup/server-kit";
 //#region src/app/modules/oauth2/module.ts
 var OAuth2Module = class {
 	name;
@@ -64,9 +70,16 @@ var OAuth2Module = class {
 			return new OAuth2TokenRepository(c.resolve(CacheInjectionKey));
 		} });
 		container.register(OAuth2InjectionToken.SessionTokenRepository, { useFactory: (c) => new SessionTokenRepositoryAdapter(c.resolve(DatabaseInjectionKey.DataSource)) });
-		container.register(OAuth2InjectionToken.KeyRepository, { useFactory: (c) => new OAuth2KeyRepository(c.resolve(DatabaseInjectionKey.DataSource)) });
+		container.register(OAuth2InjectionToken.ConsentRepository, { useFactory: (c) => new ConsentRepositoryAdapter(c.resolve(DatabaseInjectionKey.DataSource)) });
+		container.register(OAuth2InjectionToken.KeyStore, { useFactory: (c) => {
+			const config = c.resolve(ConfigInjectionKey);
+			let secretsCipher = null;
+			if (config.secretsEncryptionKey) secretsCipher = new SymmetricCipher(config.secretsEncryptionKey);
+			else if (config.env === "production") c.resolve(LoggerInjectionKey).warn("The realm key store persists key material unwrapped; set SECRETS_ENCRYPTION_KEY to wrap it at rest.");
+			return new KeyRepositoryAdapter(c.resolve(DatabaseInjectionKey.DataSource), { secretsCipher });
+		} });
 		container.register(OAuth2InjectionToken.TokenSigner, { useFactory: (c) => {
-			return new OAuth2TokenSigner(c.resolve(OAuth2InjectionToken.KeyRepository));
+			return new OAuth2TokenSigner(c.resolve(OAuth2InjectionToken.KeyStore));
 		} });
 		container.register(OAuth2InjectionToken.AuthorizationCodeIssuer, { useFactory: (c) => {
 			return new OAuth2AuthorizationCodeIssuer(c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository), { maxAge: config.tokenAccessMaxAge });
@@ -87,7 +100,7 @@ var OAuth2Module = class {
 			return new OAuth2TokenRevoker(c.resolve(OAuth2InjectionToken.TokenRepository), c.resolve(OAuth2InjectionToken.SessionTokenRepository));
 		} });
 		container.register(OAuth2InjectionToken.TokenVerifier, { useFactory: (c) => {
-			return new OAuth2TokenVerifier(c.resolve(OAuth2InjectionToken.KeyRepository), c.resolve(OAuth2InjectionToken.TokenRepository));
+			return new OAuth2TokenVerifier(c.resolve(OAuth2InjectionToken.KeyStore), c.resolve(OAuth2InjectionToken.TokenRepository));
 		} });
 		container.register(OAuth2InjectionToken.AccessTokenIssuer, { useFactory: (c) => {
 			const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);
@@ -99,6 +112,12 @@ var OAuth2Module = class {
 				issuer: config.publicUrl
 			}, identityRoleProvider, sessionTokenRepository);
 		} });
+		container.register(OAuth2InjectionToken.MfaTokenIssuer, { useFactory: (c) => {
+			return new OAuth2MfaTokenIssuer(c.resolve(OAuth2InjectionToken.TokenRepository), c.resolve(OAuth2InjectionToken.TokenSigner), {
+				maxAge: config.mfaTicketMaxAge,
+				issuer: config.publicUrl
+			});
+		} });
 		container.register(OAuth2InjectionToken.RefreshTokenIssuer, { useFactory: (c) => {
 			const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);
 			const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);

package/dist/app/modules/oauth2/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["CacheInjectionKey","ModuleName","OAuth2AuthorizationCodeRepository","OAuth2AuthorizationStateRepository","OAuth2ClientRepository","OAuth2KeyRepository","OAuth2ScopeRepository","OAuth2TokenRepository","SessionTokenRepositoryAdapter","OAuth2AccessTokenIssuer","OAuth2AuthorizationCodeIssuer","OAuth2AuthorizationCodeRequestVerifier","OAuth2AuthorizationCodeVerifier","OAuth2AuthorizationStateManager","OAuth2OpenIDTokenIssuer","OAuth2RefreshTokenIssuer","OAuth2TokenRevoker","OAuth2TokenSigner","OAuth2TokenVerifier","OAuth2InjectionToken","IdentityInjectionKey","ClientEntity","ClientScopeEntity","ConfigInjectionKey","DatabaseInjectionKey","OAuth2Module","name","dependencies","OAUTH2","DATABASE","CACHE","CONFIG","IDENTITY","setup","container","config","resolve","register","ClientRepository","useFactory","c","repository","ScopeRepository","AuthorizationCodeRepository","cache","AuthorizationStateRepository","TokenRepository","SessionTokenRepository","DataSource","KeyRepository","TokenSigner","keyRepository","AuthorizationCodeIssuer","codeRepository","maxAge","tokenAccessMaxAge","AuthorizationCodeVerifier","AuthorizationCodeRequestVerifier","clientRepository","clientScopeRepository","scopeRepository","AuthorizationStateManager","stateRepository","TokenRevoker","tokenRepository","sessionTokenRepository","TokenVerifier","AccessTokenIssuer","tokenSigner","identityRoleProvider","RoleProvider","issuer","publicUrl","RefreshTokenIssuer","tokenRefreshMaxAge","OpenIDTokenIssuer","signer","identityResolver","Resolver","options"],"sources":["../../../../src/app/modules/oauth2/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Repository } from 'typeorm';\nimport { CacheInjectionKey } from '../cache/index.ts';\nimport type { IContainer } from 'eldin';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\n\nimport {\n    OAuth2AuthorizationCodeRepository,\n    OAuth2AuthorizationStateRepository,\n    OAuth2ClientRepository,\n    OAuth2KeyRepository,\n    OAuth2ScopeRepository,\n    OAuth2TokenRepository,\n    SessionTokenRepositoryAdapter,\n} from './repositories/index.ts';\nimport {\n    OAuth2AccessTokenIssuer,\n    OAuth2AuthorizationCodeIssuer,\n    OAuth2AuthorizationCodeRequestVerifier,\n    OAuth2AuthorizationCodeVerifier,\n    OAuth2AuthorizationStateManager,\n    OAuth2OpenIDTokenIssuer,\n    OAuth2RefreshTokenIssuer,\n    OAuth2TokenRevoker,\n    OAuth2TokenSigner,\n    OAuth2TokenVerifier,\n} from '../../../core/index.ts';\nimport { OAuth2InjectionToken } from './constants.ts';\nimport { IdentityInjectionKey } from '../identity/index.ts';\nimport { ClientEntity, ClientScopeEntity } from '../../../adapters/database/domains/index.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\n\nexport class OAuth2Module implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    constructor() {\n        this.name = ModuleName.OAUTH2;\n        this.dependencies = [ModuleName.DATABASE, ModuleName.CACHE, ModuleName.CONFIG, ModuleName.IDENTITY];\n    }\n\n    async setup(container: IContainer) : Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        container.register(OAuth2InjectionToken.ClientRepository, {\n            useFactory: (c) => {\n                const repository = c.resolve<Repository<ClientEntity>>(ClientEntity);\n                return new OAuth2ClientRepository(repository);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.ScopeRepository, {\n            useFactory: (c) => {\n                const repository = c.resolve<Repository<ClientScopeEntity>>(ClientScopeEntity);\n                return new OAuth2ScopeRepository(repository);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationCodeRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2AuthorizationCodeRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationStateRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2AuthorizationStateRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.TokenRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2TokenRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.SessionTokenRepository, {\n            useFactory: (c) => new SessionTokenRepositoryAdapter(\n                c.resolve(DatabaseInjectionKey.DataSource),\n            ),\n        });\n\n        container.register(OAuth2InjectionToken.KeyRepository, {\n            // todo: cache use here\n            useFactory: (c) => new OAuth2KeyRepository(c.resolve(DatabaseInjectionKey.DataSource)),\n        });\n\n        container.register(OAuth2InjectionToken.TokenSigner, {\n            useFactory: (c) => {\n                const keyRepository = c.resolve(OAuth2InjectionToken.KeyRepository);\n                return new OAuth2TokenSigner(keyRepository);\n            },\n        });\n\n        // authorization code issuer\n        container.register(OAuth2InjectionToken.AuthorizationCodeIssuer, {\n            useFactory: (c) => {\n                const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);\n\n                return new OAuth2AuthorizationCodeIssuer(\n                    codeRepository,\n                    {\n                        // todo: own constant here\n                        maxAge: config.tokenAccessMaxAge,\n                    },\n                );\n            },\n        });\n        container.register(OAuth2InjectionToken.AuthorizationCodeVerifier, {\n            useFactory: (c) => {\n                const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);\n\n                return new OAuth2AuthorizationCodeVerifier(codeRepository);\n            },\n        });\n\n        // authorization code request verifier\n        container.register(OAuth2InjectionToken.AuthorizationCodeRequestVerifier, {\n            useFactory: (c) => {\n                const clientRepository = c.resolve(OAuth2InjectionToken.ClientRepository);\n                const clientScopeRepository = c.resolve(OAuth2InjectionToken.ScopeRepository);\n\n                return new OAuth2AuthorizationCodeRequestVerifier({\n                    clientRepository,\n                    scopeRepository: clientScopeRepository,\n                });\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationStateManager, {\n            useFactory: (c) => {\n                const stateRepository = c.resolve(OAuth2InjectionToken.AuthorizationStateRepository);\n\n                return new OAuth2AuthorizationStateManager(stateRepository);\n            },\n        });\n\n        // token revoker\n        container.register(OAuth2InjectionToken.TokenRevoker, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);\n                return new OAuth2TokenRevoker(tokenRepository, sessionTokenRepository);\n            },\n        });\n\n        // token verifier\n        container.register(OAuth2InjectionToken.TokenVerifier, {\n            useFactory: (c) => {\n                const keyRepository = c.resolve(OAuth2InjectionToken.KeyRepository);\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n\n                return new OAuth2TokenVerifier(keyRepository, tokenRepository);\n            },\n        });\n\n        // access token issuer\n        container.register(OAuth2InjectionToken.AccessTokenIssuer, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n                const identityRoleProvider = c.resolve(IdentityInjectionKey.RoleProvider);\n                const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);\n                return new OAuth2AccessTokenIssuer(\n                    tokenRepository,\n                    tokenSigner,\n                    {\n                        maxAge: config.tokenAccessMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                    identityRoleProvider,\n                    sessionTokenRepository,\n                );\n            },\n        });\n\n        // refresh token issuer\n        container.register(OAuth2InjectionToken.RefreshTokenIssuer, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n                const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);\n\n                return new OAuth2RefreshTokenIssuer(\n                    tokenRepository,\n                    tokenSigner,\n                    {\n                        maxAge: config.tokenRefreshMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                    sessionTokenRepository,\n                );\n            },\n        });\n\n        // open-id token issuer\n        container.register(OAuth2InjectionToken.OpenIDTokenIssuer, {\n            useFactory: (c) => {\n                const repository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const signer = c.resolve(OAuth2InjectionToken.TokenSigner);\n                const identityResolver = c.resolve(IdentityInjectionKey.Resolver);\n\n                return new OAuth2OpenIDTokenIssuer({\n                    repository,\n                    signer,\n\n                    identityResolver,\n\n                    options: {\n                        // todo: own constant here\n                        maxAge: config.tokenAccessMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                });\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,IAAayB,eAAb,MAAaA;CACAC;CAEAC;CAET,cAAc;EACV,KAAKD,OAAOzB,WAAW2B;EACvB,KAAKD,eAAe;GAAC1B,WAAW4B;GAAU5B,WAAW6B;GAAO7B,WAAW8B;GAAQ9B,WAAW+B;;CAC9F;CAEA,MAAMC,MAAMC,WAAuC;EAC/C,MAAMC,SAASD,UAAUE,QAAQb,kBAAAA;EAEjCW,UAAUG,SAASlB,qBAAqBmB,kBAAkB,EACtDC,aAAaC,MAAAA;GAET,OAAO,IAAIpC,uBADQoC,EAAEJ,QAAkCf,YACrBoB,CAAAA;EACtC,EACJ,CAAA;EAEAP,UAAUG,SAASlB,qBAAqBuB,iBAAiB,EACrDH,aAAaC,MAAAA;GAET,OAAO,IAAIlC,sBADQkC,EAAEJ,QAAuCd,iBAC3BmB,CAAAA;EACrC,EACJ,CAAA;EAEAP,UAAUG,SAASlB,qBAAqBwB,6BAA6B,EACjEJ,aAAaC,MAAAA;GAET,OAAO,IAAItC,kCADGsC,EAAEJ,QAAQpC,iBACqB4C,CAAAA;EACjD,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB0B,8BAA8B,EAClEN,aAAaC,MAAAA;GAET,OAAO,IAAIrC,mCADGqC,EAAEJ,QAAQpC,iBACsB4C,CAAAA;EAClD,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB2B,iBAAiB,EACrDP,aAAaC,MAAAA;GAET,OAAO,IAAIjC,sBADGiC,EAAEJ,QAAQpC,iBACS4C,CAAAA;EACrC,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB4B,wBAAwB,EAC5DR,aAAaC,MAAM,IAAIhC,8BACnBgC,EAAEJ,QAAQZ,qBAAqBwB,UAAU,CAAA,EAEjD,CAAA;EAEAd,UAAUG,SAASlB,qBAAqB8B,eAAe,EAEnDV,aAAaC,MAAM,IAAInC,oBAAoBmC,EAAEJ,QAAQZ,qBAAqBwB,UAAU,CAAA,EACxF,CAAA;EAEAd,UAAUG,SAASlB,qBAAqB+B,aAAa,EACjDX,aAAaC,MAAAA;GAET,OAAO,IAAIvB,kBADWuB,EAAEJ,QAAQjB,qBAAqB8B,aACxBE,CAAAA;EACjC,EACJ,CAAA;EAGAjB,UAAUG,SAASlB,qBAAqBiC,yBAAyB,EAC7Db,aAAaC,MAAAA;GAGT,OAAO,IAAI9B,8BAFY8B,EAAEJ,QAAQjB,qBAAqBwB,2BAGlDU,GACA,EAEIC,QAAQnB,OAAOoB,kBACnB,CAAA;EAER,EACJ,CAAA;EACArB,UAAUG,SAASlB,qBAAqBqC,2BAA2B,EAC/DjB,aAAaC,MAAAA;GAGT,OAAO,IAAI5B,gCAFY4B,EAAEJ,QAAQjB,qBAAqBwB,2BAEXU,CAAAA;EAC/C,EACJ,CAAA;EAGAnB,UAAUG,SAASlB,qBAAqBsC,kCAAkC,EACtElB,aAAaC,MAAAA;GAIT,OAAO,IAAI7B,uCAAuC;IAC9C+C,kBAJqBlB,EAAEJ,QAAQjB,qBAAqBmB,gBAIpDoB;IACAE,iBAJ0BpB,EAAEJ,QAAQjB,qBAAqBuB,eAIxCiB;GACrB,CAAA;EACJ,EACJ,CAAA;EAEAzB,UAAUG,SAASlB,qBAAqB0C,2BAA2B,EAC/DtB,aAAaC,MAAAA;GAGT,OAAO,IAAI3B,gCAFa2B,EAAEJ,QAAQjB,qBAAqB0B,4BAEZiB,CAAAA;EAC/C,EACJ,CAAA;EAGA5B,UAAUG,SAASlB,qBAAqB4C,cAAc,EAClDxB,aAAaC,MAAAA;GAGT,OAAO,IAAIxB,mBAFawB,EAAEJ,QAAQjB,qBAAqB2B,eAEzBkB,GADCxB,EAAEJ,QAAQjB,qBAAqB4B,sBACfkB,CAAAA;EACnD,EACJ,CAAA;EAGA/B,UAAUG,SAASlB,qBAAqB+C,eAAe,EACnD3B,aAAaC,MAAAA;GAIT,OAAO,IAAItB,oBAHWsB,EAAEJ,QAAQjB,qBAAqB8B,aAGtBE,GAFPX,EAAEJ,QAAQjB,qBAAqB2B,eAETkB,CAAAA;EAClD,EACJ,CAAA;EAGA9B,UAAUG,SAASlB,qBAAqBgD,mBAAmB,EACvD5B,aAAaC,MAAAA;GACT,MAAMwB,kBAAkBxB,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GACtE,MAAMsB,cAAc5B,EAAEJ,QAAQjB,qBAAqB+B,WAAW;GAC9D,MAAMmB,uBAAuB7B,EAAEJ,QAAQhB,qBAAqBkD,YAAY;GACxE,MAAML,yBAAyBzB,EAAEJ,QAAQjB,qBAAqB4B,sBAAsB;GACpF,OAAO,IAAItC,wBACPuD,iBACAI,aACA;IACId,QAAQnB,OAAOoB;IACfgB,QAAQpC,OAAOqC;GACnB,GACAH,sBACAJ,sBAAAA;EAER,EACJ,CAAA;EAGA/B,UAAUG,SAASlB,qBAAqBsD,oBAAoB,EACxDlC,aAAaC,MAAAA;GACT,MAAMwB,kBAAkBxB,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GACtE,MAAMsB,cAAc5B,EAAEJ,QAAQjB,qBAAqB+B,WAAW;GAC9D,MAAMe,yBAAyBzB,EAAEJ,QAAQjB,qBAAqB4B,sBAAsB;GAEpF,OAAO,IAAIhC,yBACPiD,iBACAI,aACA;IACId,QAAQnB,OAAOuC;IACfH,QAAQpC,OAAOqC;GACnB,GACAP,sBAAAA;EAER,EACJ,CAAA;EAGA/B,UAAUG,SAASlB,qBAAqBwD,mBAAmB,EACvDpC,aAAaC,MAAAA;GAKT,OAAO,IAAI1B,wBAAwB;IAC/B2B,YALeD,EAAEJ,QAAQjB,qBAAqB2B,eAK9CL;IACAmC,QALWpC,EAAEJ,QAAQjB,qBAAqB+B,WAK1C0B;IAEAC,kBANqBrC,EAAEJ,QAAQhB,qBAAqB0D,QAMpDD;IAEAE,SAAS;KAELzB,QAAQnB,OAAOoB;KACfgB,QAAQpC,OAAOqC;IACnB;GACJ,CAAA;EACJ,EACJ,CAAA;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["SymmetricCipher","CacheInjectionKey","ModuleName","LoggerInjectionKey","ConsentRepositoryAdapter","OAuth2AuthorizationCodeRepository","OAuth2AuthorizationStateRepository","OAuth2ClientRepository","OAuth2ScopeRepository","OAuth2TokenRepository","SessionTokenRepositoryAdapter","KeyRepositoryAdapter","OAuth2AccessTokenIssuer","OAuth2AuthorizationCodeIssuer","OAuth2AuthorizationCodeRequestVerifier","OAuth2AuthorizationCodeVerifier","OAuth2AuthorizationStateManager","OAuth2MfaTokenIssuer","OAuth2OpenIDTokenIssuer","OAuth2RefreshTokenIssuer","OAuth2TokenRevoker","OAuth2TokenSigner","OAuth2TokenVerifier","OAuth2InjectionToken","IdentityInjectionKey","ClientEntity","ClientScopeEntity","ConfigInjectionKey","DatabaseInjectionKey","OAuth2Module","name","dependencies","OAUTH2","DATABASE","CACHE","CONFIG","IDENTITY","setup","container","config","resolve","register","ClientRepository","useFactory","c","repository","ScopeRepository","AuthorizationCodeRepository","cache","AuthorizationStateRepository","TokenRepository","SessionTokenRepository","DataSource","ConsentRepository","KeyStore","secretsCipher","secretsEncryptionKey","env","logger","warn","TokenSigner","keyStore","AuthorizationCodeIssuer","codeRepository","maxAge","tokenAccessMaxAge","AuthorizationCodeVerifier","AuthorizationCodeRequestVerifier","clientRepository","clientScopeRepository","scopeRepository","AuthorizationStateManager","stateRepository","TokenRevoker","tokenRepository","sessionTokenRepository","TokenVerifier","AccessTokenIssuer","tokenSigner","identityRoleProvider","RoleProvider","issuer","publicUrl","MfaTokenIssuer","mfaTicketMaxAge","RefreshTokenIssuer","tokenRefreshMaxAge","OpenIDTokenIssuer","signer","identityResolver","Resolver","options"],"sources":["../../../../src/app/modules/oauth2/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { SymmetricCipher } from '@authup/server-kit';\nimport type { Repository } from 'typeorm';\nimport { CacheInjectionKey } from '../cache/index.ts';\nimport type { IContainer } from 'eldin';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport { LoggerInjectionKey } from '../logger/index.ts';\n\nimport {\n    ConsentRepositoryAdapter,\n    OAuth2AuthorizationCodeRepository,\n    OAuth2AuthorizationStateRepository,\n    OAuth2ClientRepository,\n    OAuth2ScopeRepository,\n    OAuth2TokenRepository,\n    SessionTokenRepositoryAdapter,\n} from './repositories/index.ts';\nimport { KeyRepositoryAdapter } from '../database/repositories/index.ts';\nimport {\n    OAuth2AccessTokenIssuer,\n    OAuth2AuthorizationCodeIssuer,\n    OAuth2AuthorizationCodeRequestVerifier,\n    OAuth2AuthorizationCodeVerifier,\n    OAuth2AuthorizationStateManager,\n    OAuth2MfaTokenIssuer,\n    OAuth2OpenIDTokenIssuer,\n    OAuth2RefreshTokenIssuer,\n    OAuth2TokenRevoker,\n    OAuth2TokenSigner,\n    OAuth2TokenVerifier,\n} from '../../../core/index.ts';\nimport { OAuth2InjectionToken } from './constants.ts';\nimport { IdentityInjectionKey } from '../identity/index.ts';\nimport { ClientEntity, ClientScopeEntity } from '../../../adapters/database/domains/index.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\n\nexport class OAuth2Module implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    constructor() {\n        this.name = ModuleName.OAUTH2;\n        this.dependencies = [ModuleName.DATABASE, ModuleName.CACHE, ModuleName.CONFIG, ModuleName.IDENTITY];\n    }\n\n    async setup(container: IContainer) : Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        container.register(OAuth2InjectionToken.ClientRepository, {\n            useFactory: (c) => {\n                const repository = c.resolve<Repository<ClientEntity>>(ClientEntity);\n                return new OAuth2ClientRepository(repository);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.ScopeRepository, {\n            useFactory: (c) => {\n                const repository = c.resolve<Repository<ClientScopeEntity>>(ClientScopeEntity);\n                return new OAuth2ScopeRepository(repository);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationCodeRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2AuthorizationCodeRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationStateRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2AuthorizationStateRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.TokenRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2TokenRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.SessionTokenRepository, {\n            useFactory: (c) => new SessionTokenRepositoryAdapter(\n                c.resolve(DatabaseInjectionKey.DataSource),\n            ),\n        });\n\n        container.register(OAuth2InjectionToken.ConsentRepository, {\n            useFactory: (c) => new ConsentRepositoryAdapter(\n                c.resolve(DatabaseInjectionKey.DataSource),\n            ),\n        });\n\n        container.register(OAuth2InjectionToken.KeyStore, {\n            // todo: cache use here\n            useFactory: (c) => {\n                const config = c.resolve(ConfigInjectionKey);\n\n                let secretsCipher : SymmetricCipher | null = null;\n                if (config.secretsEncryptionKey) {\n                    secretsCipher = new SymmetricCipher(config.secretsEncryptionKey);\n                } else if (config.env === 'production') {\n                    // parity posture without a KEK (Keycloak/authentik store key\n                    // material plaintext too) — but say so once, loudly.\n                    const logger = c.resolve(LoggerInjectionKey);\n                    logger.warn(\n                        'The realm key store persists key material unwrapped; ' +\n                        'set SECRETS_ENCRYPTION_KEY to wrap it at rest.',\n                    );\n                }\n\n                return new KeyRepositoryAdapter(c.resolve(DatabaseInjectionKey.DataSource), { secretsCipher });\n            },\n        });\n\n        container.register(OAuth2InjectionToken.TokenSigner, {\n            useFactory: (c) => {\n                const keyStore = c.resolve(OAuth2InjectionToken.KeyStore);\n                return new OAuth2TokenSigner(keyStore);\n            },\n        });\n\n        // authorization code issuer\n        container.register(OAuth2InjectionToken.AuthorizationCodeIssuer, {\n            useFactory: (c) => {\n                const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);\n\n                return new OAuth2AuthorizationCodeIssuer(\n                    codeRepository,\n                    {\n                        // todo: own constant here\n                        maxAge: config.tokenAccessMaxAge,\n                    },\n                );\n            },\n        });\n        container.register(OAuth2InjectionToken.AuthorizationCodeVerifier, {\n            useFactory: (c) => {\n                const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);\n\n                return new OAuth2AuthorizationCodeVerifier(codeRepository);\n            },\n        });\n\n        // authorization code request verifier\n        container.register(OAuth2InjectionToken.AuthorizationCodeRequestVerifier, {\n            useFactory: (c) => {\n                const clientRepository = c.resolve(OAuth2InjectionToken.ClientRepository);\n                const clientScopeRepository = c.resolve(OAuth2InjectionToken.ScopeRepository);\n\n                return new OAuth2AuthorizationCodeRequestVerifier({\n                    clientRepository,\n                    scopeRepository: clientScopeRepository,\n                });\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationStateManager, {\n            useFactory: (c) => {\n                const stateRepository = c.resolve(OAuth2InjectionToken.AuthorizationStateRepository);\n\n                return new OAuth2AuthorizationStateManager(stateRepository);\n            },\n        });\n\n        // token revoker\n        container.register(OAuth2InjectionToken.TokenRevoker, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);\n                return new OAuth2TokenRevoker(tokenRepository, sessionTokenRepository);\n            },\n        });\n\n        // token verifier\n        container.register(OAuth2InjectionToken.TokenVerifier, {\n            useFactory: (c) => {\n                const keyStore = c.resolve(OAuth2InjectionToken.KeyStore);\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n\n                return new OAuth2TokenVerifier(keyStore, tokenRepository);\n            },\n        });\n\n        // access token issuer\n        container.register(OAuth2InjectionToken.AccessTokenIssuer, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n                const identityRoleProvider = c.resolve(IdentityInjectionKey.RoleProvider);\n                const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);\n                return new OAuth2AccessTokenIssuer(\n                    tokenRepository,\n                    tokenSigner,\n                    {\n                        maxAge: config.tokenAccessMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                    identityRoleProvider,\n                    sessionTokenRepository,\n                );\n            },\n        });\n\n        // mfa login-ticket issuer\n        container.register(OAuth2InjectionToken.MfaTokenIssuer, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n\n                return new OAuth2MfaTokenIssuer(\n                    tokenRepository,\n                    tokenSigner,\n                    {\n                        maxAge: config.mfaTicketMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                );\n            },\n        });\n\n        // refresh token issuer\n        container.register(OAuth2InjectionToken.RefreshTokenIssuer, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n                const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);\n\n                return new OAuth2RefreshTokenIssuer(\n                    tokenRepository,\n                    tokenSigner,\n                    {\n                        maxAge: config.tokenRefreshMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                    sessionTokenRepository,\n                );\n            },\n        });\n\n        // open-id token issuer\n        container.register(OAuth2InjectionToken.OpenIDTokenIssuer, {\n            useFactory: (c) => {\n                const repository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const signer = c.resolve(OAuth2InjectionToken.TokenSigner);\n                const identityResolver = c.resolve(IdentityInjectionKey.Resolver);\n\n                return new OAuth2OpenIDTokenIssuer({\n                    repository,\n                    signer,\n\n                    identityResolver,\n\n                    options: {\n                        // todo: own constant here\n                        maxAge: config.tokenAccessMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                });\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4CA,IAAa6B,eAAb,MAAaA;CACAC;CAEAC;CAET,cAAc;EACV,KAAKD,OAAO5B,WAAW8B;EACvB,KAAKD,eAAe;GAAC7B,WAAW+B;GAAU/B,WAAWgC;GAAOhC,WAAWiC;GAAQjC,WAAWkC;;CAC9F;CAEA,MAAMC,MAAMC,WAAuC;EAC/C,MAAMC,SAASD,UAAUE,QAAQb,kBAAAA;EAEjCW,UAAUG,SAASlB,qBAAqBmB,kBAAkB,EACtDC,aAAaC,MAAAA;GAET,OAAO,IAAIrC,uBADQqC,EAAEJ,QAAkCf,YACrBoB,CAAAA;EACtC,EACJ,CAAA;EAEAP,UAAUG,SAASlB,qBAAqBuB,iBAAiB,EACrDH,aAAaC,MAAAA;GAET,OAAO,IAAIpC,sBADQoC,EAAEJ,QAAuCd,iBAC3BmB,CAAAA;EACrC,EACJ,CAAA;EAEAP,UAAUG,SAASlB,qBAAqBwB,6BAA6B,EACjEJ,aAAaC,MAAAA;GAET,OAAO,IAAIvC,kCADGuC,EAAEJ,QAAQvC,iBACqB+C,CAAAA;EACjD,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB0B,8BAA8B,EAClEN,aAAaC,MAAAA;GAET,OAAO,IAAItC,mCADGsC,EAAEJ,QAAQvC,iBACsB+C,CAAAA;EAClD,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB2B,iBAAiB,EACrDP,aAAaC,MAAAA;GAET,OAAO,IAAInC,sBADGmC,EAAEJ,QAAQvC,iBACS+C,CAAAA;EACrC,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB4B,wBAAwB,EAC5DR,aAAaC,MAAM,IAAIlC,8BACnBkC,EAAEJ,QAAQZ,qBAAqBwB,UAAU,CAAA,EAEjD,CAAA;EAEAd,UAAUG,SAASlB,qBAAqB8B,mBAAmB,EACvDV,aAAaC,MAAM,IAAIxC,yBACnBwC,EAAEJ,QAAQZ,qBAAqBwB,UAAU,CAAA,EAEjD,CAAA;EAEAd,UAAUG,SAASlB,qBAAqB+B,UAAU,EAE9CX,aAAaC,MAAAA;GACT,MAAML,SAASK,EAAEJ,QAAQb,kBAAAA;GAEzB,IAAI4B,gBAAyC;GAC7C,IAAIhB,OAAOiB,sBACPD,gBAAgB,IAAIvD,gBAAgBuC,OAAOiB,oBAAoB;QAC5D,IAAIjB,OAAOkB,QAAQ,cAItBC,EADiBlB,QAAQrC,kBACzBuD,CAAAA,CAAOC,KACH,qGACA;GAIR,OAAO,IAAIhD,qBAAqBiC,EAAEJ,QAAQZ,qBAAqBwB,UAAU,GAAG,EAAEG,cAAc,CAAA;EAChG,EACJ,CAAA;EAEAjB,UAAUG,SAASlB,qBAAqBqC,aAAa,EACjDjB,aAAaC,MAAAA;GAET,OAAO,IAAIvB,kBADMuB,EAAEJ,QAAQjB,qBAAqB+B,QACnBO,CAAAA;EACjC,EACJ,CAAA;EAGAvB,UAAUG,SAASlB,qBAAqBuC,yBAAyB,EAC7DnB,aAAaC,MAAAA;GAGT,OAAO,IAAI/B,8BAFY+B,EAAEJ,QAAQjB,qBAAqBwB,2BAGlDgB,GACA,EAEIC,QAAQzB,OAAO0B,kBACnB,CAAA;EAER,EACJ,CAAA;EACA3B,UAAUG,SAASlB,qBAAqB2C,2BAA2B,EAC/DvB,aAAaC,MAAAA;GAGT,OAAO,IAAI7B,gCAFY6B,EAAEJ,QAAQjB,qBAAqBwB,2BAEXgB,CAAAA;EAC/C,EACJ,CAAA;EAGAzB,UAAUG,SAASlB,qBAAqB4C,kCAAkC,EACtExB,aAAaC,MAAAA;GAIT,OAAO,IAAI9B,uCAAuC;IAC9CsD,kBAJqBxB,EAAEJ,QAAQjB,qBAAqBmB,gBAIpD0B;IACAE,iBAJ0B1B,EAAEJ,QAAQjB,qBAAqBuB,eAIxCuB;GACrB,CAAA;EACJ,EACJ,CAAA;EAEA/B,UAAUG,SAASlB,qBAAqBgD,2BAA2B,EAC/D5B,aAAaC,MAAAA;GAGT,OAAO,IAAI5B,gCAFa4B,EAAEJ,QAAQjB,qBAAqB0B,4BAEZuB,CAAAA;EAC/C,EACJ,CAAA;EAGAlC,UAAUG,SAASlB,qBAAqBkD,cAAc,EAClD9B,aAAaC,MAAAA;GAGT,OAAO,IAAIxB,mBAFawB,EAAEJ,QAAQjB,qBAAqB2B,eAEzBwB,GADC9B,EAAEJ,QAAQjB,qBAAqB4B,sBACfwB,CAAAA;EACnD,EACJ,CAAA;EAGArC,UAAUG,SAASlB,qBAAqBqD,eAAe,EACnDjC,aAAaC,MAAAA;GAIT,OAAO,IAAItB,oBAHMsB,EAAEJ,QAAQjB,qBAAqB+B,QAGjBO,GAFPjB,EAAEJ,QAAQjB,qBAAqB2B,eAEdwB,CAAAA;EAC7C,EACJ,CAAA;EAGApC,UAAUG,SAASlB,qBAAqBsD,mBAAmB,EACvDlC,aAAaC,MAAAA;GACT,MAAM8B,kBAAkB9B,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GACtE,MAAM4B,cAAclC,EAAEJ,QAAQjB,qBAAqBqC,WAAW;GAC9D,MAAMmB,uBAAuBnC,EAAEJ,QAAQhB,qBAAqBwD,YAAY;GACxE,MAAML,yBAAyB/B,EAAEJ,QAAQjB,qBAAqB4B,sBAAsB;GACpF,OAAO,IAAIvC,wBACP8D,iBACAI,aACA;IACId,QAAQzB,OAAO0B;IACfgB,QAAQ1C,OAAO2C;GACnB,GACAH,sBACAJ,sBAAAA;EAER,EACJ,CAAA;EAGArC,UAAUG,SAASlB,qBAAqB4D,gBAAgB,EACpDxC,aAAaC,MAAAA;GAIT,OAAO,IAAI3B,qBAHa2B,EAAEJ,QAAQjB,qBAAqB2B,eAInDwB,GAHgB9B,EAAEJ,QAAQjB,qBAAqBqC,WAI/CkB,GACA;IACId,QAAQzB,OAAO6C;IACfH,QAAQ1C,OAAO2C;GACnB,CAAA;EAER,EACJ,CAAA;EAGA5C,UAAUG,SAASlB,qBAAqB8D,oBAAoB,EACxD1C,aAAaC,MAAAA;GACT,MAAM8B,kBAAkB9B,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GACtE,MAAM4B,cAAclC,EAAEJ,QAAQjB,qBAAqBqC,WAAW;GAC9D,MAAMe,yBAAyB/B,EAAEJ,QAAQjB,qBAAqB4B,sBAAsB;GAEpF,OAAO,IAAIhC,yBACPuD,iBACAI,aACA;IACId,QAAQzB,OAAO+C;IACfL,QAAQ1C,OAAO2C;GACnB,GACAP,sBAAAA;EAER,EACJ,CAAA;EAGArC,UAAUG,SAASlB,qBAAqBgE,mBAAmB,EACvD5C,aAAaC,MAAAA;GAKT,OAAO,IAAI1B,wBAAwB;IAC/B2B,YALeD,EAAEJ,QAAQjB,qBAAqB2B,eAK9CL;IACA2C,QALW5C,EAAEJ,QAAQjB,qBAAqBqC,WAK1C4B;IAEAC,kBANqB7C,EAAEJ,QAAQhB,qBAAqBkE,QAMpDD;IAEAE,SAAS;KAEL3B,QAAQzB,OAAO0B;KACfgB,QAAQ1C,OAAO2C;IACnB;GACJ,CAAA;EACJ,EACJ,CAAA;CACJ;AACJ"}

package/dist/app/modules/oauth2/repositories/client/repository.mjs

@@ -13,7 +13,7 @@ var OAuth2ClientRepository = class {
 		if (isUUID(key)) query.where("client.id = :id", { id: key });
 		else {
 			query.where("client.name = :name", { name: key.trim().toLowerCase() });
-			if (realmKey) if (isUUID(realmKey)) query.andWhere("client.realm_id = :realmId", { realmId: realmKey });
+			if (realmKey) if (isUUID(realmKey)) query.andWhere("client.realmId = :realmId", { realmId: realmKey });
 			else query.andWhere("realm.name = :realmName", { realmName: realmKey.trim().toLowerCase() });
 		}
 		return query.getOne();

package/dist/app/modules/oauth2/repositories/client/repository.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"repository.mjs","names":["isUUID","OAuth2ClientRepository","repository","findOneByIdOrName","key","realmKey","query","createQueryBuilder","leftJoinAndSelect","where","id","name","trim","toLowerCase","andWhere","realmId","realmName","getOne"],"sources":["../../../../../../src/app/modules/oauth2/repositories/client/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Client } from '@authup/core-kit';\nimport { isUUID } from '@authup/kit';\nimport type { Repository } from 'typeorm';\nimport type { IOAuth2ClientRepository } from '../../../../../core/index.ts';\n\nexport class OAuth2ClientRepository implements IOAuth2ClientRepository {\n    private readonly repository: Repository<Client>;\n\n    constructor(\n        repository: Repository<Client>,\n    ) {\n        this.repository = repository;\n    }\n\n    async findOneByIdOrName(key: string, realmKey?: string): Promise<Client | null> {\n        const query = this.repository.createQueryBuilder('client')\n            .leftJoinAndSelect('client.realm', 'realm');\n\n        if (isUUID(key)) {\n            query.where('client.id = :id', { id: key });\n        } else {\n            query.where('client.name = :name', { name: key.trim().toLowerCase() });\n\n            if (realmKey) {\n                if (isUUID(realmKey)) {\n                    query.andWhere('client.realm_id = :realmId', { realmId: realmKey });\n                } else {\n                    query.andWhere('realm.name = :realmName', { realmName: realmKey.trim().toLowerCase() });\n                }\n            }\n        }\n\n        return query.getOne();\n    }\n}\n"],"mappings":";;;;;AAYA,IAAaC,yBAAb,MAAaA;CACQC;CAEjB,YACIA,YACF;EACE,KAAKA,aAAaA;CACtB;CAEA,MAAMC,kBAAkBC,KAAaC,UAA2C;EAC5E,MAAMC,QAAQ,KAAKJ,WAAWK,mBAAmB,QAAA,CAAA,CAC5CC,kBAAkB,gBAAgB,OAAA;EAEvC,IAAIR,OAAOI,GAAAA,GACPE,MAAMG,MAAM,mBAAmB,EAAEC,IAAIN,IAAI,CAAA;OACtC;GACHE,MAAMG,MAAM,uBAAuB,EAAEE,MAAMP,IAAIQ,KAAI,CAAA,CAAGC,YAAW,EAAG,CAAA;GAEpE,IAAIR,UACA,IAAIL,OAAOK,QAAAA,GACPC,MAAMQ,SAAS,8BAA8B,EAAEC,SAASV,SAAS,CAAA;QAEjEC,MAAMQ,SAAS,2BAA2B,EAAEE,WAAWX,SAASO,KAAI,CAAA,CAAGC,YAAW,EAAG,CAAA;EAGjG;EAEA,OAAOP,MAAMW,OAAM;CACvB;AACJ"}
+{"version":3,"file":"repository.mjs","names":["isUUID","OAuth2ClientRepository","repository","findOneByIdOrName","key","realmKey","query","createQueryBuilder","leftJoinAndSelect","where","id","name","trim","toLowerCase","andWhere","realmId","realmName","getOne"],"sources":["../../../../../../src/app/modules/oauth2/repositories/client/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Client } from '@authup/core-kit';\nimport { isUUID } from '@authup/kit';\nimport type { Repository } from 'typeorm';\nimport type { IOAuth2ClientRepository } from '../../../../../core/index.ts';\n\nexport class OAuth2ClientRepository implements IOAuth2ClientRepository {\n    private readonly repository: Repository<Client>;\n\n    constructor(\n        repository: Repository<Client>,\n    ) {\n        this.repository = repository;\n    }\n\n    async findOneByIdOrName(key: string, realmKey?: string): Promise<Client | null> {\n        const query = this.repository.createQueryBuilder('client')\n            .leftJoinAndSelect('client.realm', 'realm');\n\n        if (isUUID(key)) {\n            query.where('client.id = :id', { id: key });\n        } else {\n            query.where('client.name = :name', { name: key.trim().toLowerCase() });\n\n            if (realmKey) {\n                if (isUUID(realmKey)) {\n                    query.andWhere('client.realmId = :realmId', { realmId: realmKey });\n                } else {\n                    query.andWhere('realm.name = :realmName', { realmName: realmKey.trim().toLowerCase() });\n                }\n            }\n        }\n\n        return query.getOne();\n    }\n}\n"],"mappings":";;;;;AAYA,IAAaC,yBAAb,MAAaA;CACQC;CAEjB,YACIA,YACF;EACE,KAAKA,aAAaA;CACtB;CAEA,MAAMC,kBAAkBC,KAAaC,UAA2C;EAC5E,MAAMC,QAAQ,KAAKJ,WAAWK,mBAAmB,QAAA,CAAA,CAC5CC,kBAAkB,gBAAgB,OAAA;EAEvC,IAAIR,OAAOI,GAAAA,GACPE,MAAMG,MAAM,mBAAmB,EAAEC,IAAIN,IAAI,CAAA;OACtC;GACHE,MAAMG,MAAM,uBAAuB,EAAEE,MAAMP,IAAIQ,KAAI,CAAA,CAAGC,YAAW,EAAG,CAAA;GAEpE,IAAIR,UACA,IAAIL,OAAOK,QAAAA,GACPC,MAAMQ,SAAS,6BAA6B,EAAEC,SAASV,SAAS,CAAA;QAEhEC,MAAMQ,SAAS,2BAA2B,EAAEE,WAAWX,SAASO,KAAI,CAAA,CAAGC,YAAW,EAAG,CAAA;EAGjG;EAEA,OAAOP,MAAMW,OAAM;CACvB;AACJ"}

package/dist/app/modules/oauth2/repositories/consent/index.d.ts

@@ -0,0 +1,2 @@
+export * from './repository.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/app/modules/oauth2/repositories/consent/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/oauth2/repositories/consent/index.ts"],"names":[],"mappings":"AAOA,cAAc,iBAAiB,CAAC"}

package/dist/app/modules/oauth2/repositories/consent/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { ConsentRepositoryAdapter } from "./repository.mjs";
+export { ConsentRepositoryAdapter };

package/dist/app/modules/oauth2/repositories/consent/repository.d.ts

@@ -0,0 +1,21 @@
+import type { Consent } from '@authup/core-kit';
+import type { IQuery } from '@rapiq/core';
+import type { EntityRepositoryFindManyResult } from '@authup/server-kit';
+import type { DataSource, Repository } from 'typeorm';
+import { ConsentEntity } from '../../../../../adapters/database/domains/index.ts';
+import type { ConsentFindManyOptions, ConsentOwner, IConsentRepository } from '../../../../../core/index.ts';
+export declare class ConsentRepositoryAdapter implements IConsentRepository {
+    protected repository: Repository<ConsentEntity>;
+    constructor(dataSource: DataSource);
+    findMany(query: IQuery, options?: ConsentFindManyOptions): Promise<EntityRepositoryFindManyResult<Consent>>;
+    findOneById(id: string): Promise<Consent | null>;
+    findAllBySubjectClient(clientId: string, owner: ConsentOwner): Promise<Consent[]>;
+    insertMissing(input: {
+        clientId: string;
+        realmId: string;
+        owner: ConsentOwner;
+        scopes: string[];
+    }): Promise<void>;
+    remove(entity: Consent): Promise<void>;
+}
+//# sourceMappingURL=repository.d.ts.map

package/dist/app/modules/oauth2/repositories/consent/repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/oauth2/repositories/consent/repository.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAEzE,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAEtD,OAAO,EAAe,aAAa,EAAE,MAAM,mDAAmD,CAAC;AAE/F,OAAO,KAAK,EACR,sBAAsB,EACtB,YAAY,EACZ,kBAAkB,EACrB,MAAM,8BAA8B,CAAC;AAGtC,qBAAa,wBAAyB,YAAW,kBAAkB;IAC/D,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC;gBAEpC,UAAU,EAAE,UAAU;IAI5B,QAAQ,CACV,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,sBAA2B,GACrC,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC;IA+C7C,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAIhD,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAkBjF,aAAa,CAAC,KAAK,EAAE;QACvB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,YAAY,CAAC;QACpB,MAAM,EAAE,MAAM,EAAE,CAAA;KACnB,GAAG,OAAO,CAAC,IAAI,CAAC;IA8CX,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;CAG/C"}

package/dist/app/modules/oauth2/repositories/consent/repository.mjs

@@ -0,0 +1,92 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { CachePrefix } from "../../../../../adapters/database/domains/constants.mjs";
+import { ConsentEntity } from "../../../../../adapters/database/domains/consent/entity.mjs";
+import "../../../../../adapters/database/domains/index.mjs";
+import { applyQuery } from "../../../database/repositories/query.mjs";
+import { applyRealmScopeSelect } from "../../../database/repositories/helpers.mjs";
+import { isUniqueConstraintDatabaseError } from "../../../../../adapters/database/errors/driver.mjs";
+import "../../../../../adapters/database/errors/index.mjs";
+import { IdentityType } from "@authup/core-kit";
+import { buildRedisKeyPath } from "@authup/server-kit";
+//#region src/app/modules/oauth2/repositories/consent/repository.ts
+var ConsentRepositoryAdapter = class {
+	repository;
+	constructor(dataSource) {
+		this.repository = dataSource.getRepository(ConsentEntity);
+	}
+	async findMany(query, options = {}) {
+		const qb = this.repository.createQueryBuilder("consent");
+		const { pagination } = applyQuery(qb, query);
+		applyRealmScopeSelect(qb, "consent", ["sub", "subKind"]);
+		qb.leftJoin("consent.client", "client").addSelect([
+			"client.id",
+			"client.name",
+			"client.displayName",
+			"client.builtIn"
+		]);
+		if (options.owner) qb.andWhere("consent.sub = :ownerSub AND consent.subKind = :ownerSubKind", {
+			ownerSub: options.owner.sub,
+			ownerSubKind: options.owner.subKind
+		});
+		if (options.realmId) qb.andWhere("consent.realmId = :realmId", { realmId: options.realmId });
+		const [entities, total] = await qb.getManyAndCount();
+		return {
+			data: entities,
+			meta: {
+				total,
+				...pagination
+			}
+		};
+	}
+	async findOneById(id) {
+		return this.repository.findOneBy({ id });
+	}
+	async findAllBySubjectClient(clientId, owner) {
+		const qb = this.repository.createQueryBuilder("consent");
+		qb.where("consent.clientId = :clientId AND consent.sub = :sub AND consent.subKind = :subKind", {
+			clientId,
+			sub: owner.sub,
+			subKind: owner.subKind
+		});
+		qb.cache(buildRedisKeyPath({
+			prefix: CachePrefix.CONSENT_COVERING,
+			key: `${clientId}:${owner.subKind}:${owner.sub}`
+		}), 6e4);
+		return qb.getMany();
+	}
+	async insertMissing(input) {
+		const existing = await this.repository.createQueryBuilder("consent").where("consent.clientId = :clientId AND consent.sub = :sub AND consent.subKind = :subKind", {
+			clientId: input.clientId,
+			sub: input.owner.sub,
+			subKind: input.owner.subKind
+		}).getMany();
+		const existingTokens = new Set(existing.map((row) => row.scope));
+		const missing = input.scopes.filter((token) => !existingTokens.has(token));
+		const userId = input.owner.subKind === IdentityType.USER ? input.owner.sub : null;
+		for (const scope of missing) {
+			const entity = this.repository.create({
+				clientId: input.clientId,
+				realmId: input.realmId,
+				userId,
+				sub: input.owner.sub,
+				subKind: input.owner.subKind,
+				scope,
+				expiresAt: null
+			});
+			try {
+				await this.repository.save(entity);
+			} catch (e) {
+				if (!isUniqueConstraintDatabaseError(e)) throw e;
+			}
+		}
+	}
+	async remove(entity) {
+		await this.repository.remove(entity);
+	}
+};
+//#endregion
+export { ConsentRepositoryAdapter };
+
+//# sourceMappingURL=repository.mjs.map

package/dist/app/modules/oauth2/repositories/consent/repository.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.mjs","names":["IdentityType","buildRedisKeyPath","applyQuery","CachePrefix","ConsentEntity","isUniqueConstraintDatabaseError","applyRealmScopeSelect","ConsentRepositoryAdapter","repository","dataSource","getRepository","findMany","query","options","qb","createQueryBuilder","pagination","leftJoin","addSelect","owner","andWhere","ownerSub","sub","ownerSubKind","subKind","realmId","entities","total","getManyAndCount","data","meta","findOneById","id","findOneBy","findAllBySubjectClient","clientId","where","cache","prefix","CONSENT_COVERING","key","getMany","insertMissing","input","existing","existingTokens","Set","map","row","scope","missing","scopes","filter","token","has","userId","USER","entity","create","expiresAt","save","e","remove"],"sources":["../../../../../../src/app/modules/oauth2/repositories/consent/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Consent } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport { IdentityType  } from '@authup/core-kit';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { buildRedisKeyPath } from '@authup/server-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport { applyQuery } from '../../../database/repositories/query.ts';\nimport { CachePrefix, ConsentEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { isUniqueConstraintDatabaseError } from '../../../../../adapters/database/errors/index.ts';\nimport type {\n    ConsentFindManyOptions,\n    ConsentOwner,\n    IConsentRepository,\n} from '../../../../../core/index.ts';\nimport { applyRealmScopeSelect } from '../../../database/repositories/helpers.ts';\n\nexport class ConsentRepositoryAdapter implements IConsentRepository {\n    protected repository: Repository<ConsentEntity>;\n\n    constructor(dataSource: DataSource) {\n        this.repository = dataSource.getRepository(ConsentEntity);\n    }\n\n    async findMany(\n        query: IQuery,\n        options: ConsentFindManyOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<Consent>> {\n        const qb = this.repository.createQueryBuilder('consent');\n\n        const { pagination } = applyQuery(qb, query);\n\n        applyRealmScopeSelect(qb, 'consent', ['sub', 'subKind']);\n\n        // Always expose only a client SUMMARY (id / name / displayName /\n        // builtIn) — NEVER the full ClientEntity (redirectUri + post-logout\n        // patterns = the trusted-origin set, grantTypes, baseUrl/rootUrl,\n        // secret-storage flags, accessPolicyId). `client` is deliberately\n        // absent from relations.allowed so a raw ?include=client cannot force\n        // the full-column join; the self-service Applications tab still gets\n        // the display name from this fixed projection.\n        qb.leftJoin('consent.client', 'client')\n            .addSelect([\n                'client.id',\n                'client.name',\n                'client.displayName',\n                'client.builtIn',\n            ]);\n\n        if (options.owner) {\n            // mandatory constraint — not overridable by a rapiq filter\n            qb.andWhere('consent.sub = :ownerSub AND consent.subKind = :ownerSubKind', {\n                ownerSub: options.owner.sub,\n                ownerSubKind: options.owner.subKind,\n            });\n        }\n\n        if (options.realmId) {\n            // nested `/realms/:realmId/consents` mount — mandatory constraint,\n            // not overridable by a rapiq filter\n            qb.andWhere('consent.realmId = :realmId', { realmId: options.realmId });\n        }\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: entities,\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findOneById(id: string): Promise<Consent | null> {\n        return this.repository.findOneBy({ id });\n    }\n\n    async findAllBySubjectClient(clientId: string, owner: ConsentOwner): Promise<Consent[]> {\n        const qb = this.repository.createQueryBuilder('consent');\n        qb.where('consent.clientId = :clientId AND consent.sub = :sub AND consent.subKind = :subKind', {\n            clientId,\n            sub: owner.sub,\n            subKind: owner.subKind,\n        });\n        qb.cache(\n            buildRedisKeyPath({\n                prefix: CachePrefix.CONSENT_COVERING,\n                key: `${clientId}:${owner.subKind}:${owner.sub}`,\n            }),\n            60_000,\n        );\n\n        return qb.getMany();\n    }\n\n    async insertMissing(input: {\n        clientId: string,\n        realmId: string,\n        owner: ConsentOwner,\n        scopes: string[]\n    }): Promise<void> {\n        // uncached read — the diff must see the latest rows, and the covering\n        // cache entry must not be refreshed on the write path.\n        const existing = await this.repository.createQueryBuilder('consent')\n            .where('consent.clientId = :clientId AND consent.sub = :sub AND consent.subKind = :subKind', {\n                clientId: input.clientId,\n                sub: input.owner.sub,\n                subKind: input.owner.subKind,\n            })\n            .getMany();\n\n        const existingTokens = new Set(existing.map((row) => row.scope));\n        const missing = input.scopes.filter((token) => !existingTokens.has(token));\n\n        // save-per-row (never a raw qb insert): entity-manager saves fire the\n        // ConsentEntitySubscriber — covering-cache invalidation, realtime\n        // destinations and audit mirroring depend on it. A duplicate-key\n        // violation is the benign race outcome under the unique index.\n        // Set the userId FK only when the subject is a user, so a user\n        // deletion cascade-drops its consent rows; non-user subjects leave it\n        // null (the row is still cleaned up when its client/realm is deleted).\n        const userId = input.owner.subKind === IdentityType.USER ?\n            input.owner.sub :\n            null;\n\n        for (const scope of missing) {\n            const entity = this.repository.create({\n                clientId: input.clientId,\n                realmId: input.realmId,\n                userId,\n                sub: input.owner.sub,\n                subKind: input.owner.subKind,\n                scope,\n                expiresAt: null,\n            });\n\n            try {\n                await this.repository.save(entity);\n            } catch (e) {\n                if (!isUniqueConstraintDatabaseError(e)) {\n                    throw e;\n                }\n            }\n        }\n    }\n\n    async remove(entity: Consent): Promise<void> {\n        await this.repository.remove(entity as ConsentEntity);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AAuBA,IAAaO,2BAAb,MAAaA;CACCC;CAEV,YAAYC,YAAwB;EAChC,KAAKD,aAAaC,WAAWC,cAAcN,aAAAA;CAC/C;CAEA,MAAMO,SACFC,OACAC,UAAkC,CAAC,GACa;EAChD,MAAMC,KAAK,KAAKN,WAAWO,mBAAmB,SAAA;EAE9C,MAAM,EAAEC,eAAed,WAAWY,IAAIF,KAAAA;EAEtCN,sBAAsBQ,IAAI,WAAW,CAAC,OAAO,SAAA,CAAU;EASvDA,GAAGG,SAAS,kBAAkB,QAAA,CAAA,CACzBC,UAAU;GACP;GACA;GACA;GACA;GACH;EAEL,IAAIL,QAAQM,OAERL,GAAGM,SAAS,+DAA+D;GACvEC,UAAUR,QAAQM,MAAMG;GACxBC,cAAcV,QAAQM,MAAMK;EAChC,CAAA;EAGJ,IAAIX,QAAQY,SAGRX,GAAGM,SAAS,8BAA8B,EAAEK,SAASZ,QAAQY,QAAQ,CAAA;EAGzE,MAAM,CAACC,UAAUC,SAAS,MAAMb,GAAGc,gBAAe;EAElD,OAAO;GACHC,MAAMH;GACNI,MAAM;IACFH;IACA,GAAGX;GACP;EACJ;CACJ;CAEA,MAAMe,YAAYC,IAAqC;EACnD,OAAO,KAAKxB,WAAWyB,UAAU,EAAED,GAAG,CAAA;CAC1C;CAEA,MAAME,uBAAuBC,UAAkBhB,OAAyC;EACpF,MAAML,KAAK,KAAKN,WAAWO,mBAAmB,SAAA;EAC9CD,GAAGsB,MAAM,sFAAsF;GAC3FD;GACAb,KAAKH,MAAMG;GACXE,SAASL,MAAMK;EACnB,CAAA;EACAV,GAAGuB,MACCpC,kBAAkB;GACdqC,QAAQnC,YAAYoC;GACpBC,KAAK,GAAGL,SAAS,GAAGhB,MAAMK,QAAQ,GAAGL,MAAMG;EAC/C,CAAA,GACA,GAAA;EAGJ,OAAOR,GAAG2B,QAAO;CACrB;CAEA,MAAMC,cAAcC,OAKF;EAGd,MAAMC,WAAW,MAAM,KAAKpC,WAAWO,mBAAmB,SAAA,CAAA,CACrDqB,MAAM,sFAAsF;GACzFD,UAAUQ,MAAMR;GAChBb,KAAKqB,MAAMxB,MAAMG;GACjBE,SAASmB,MAAMxB,MAAMK;EACzB,CAAA,CAAA,CACCiB,QAAO;EAEZ,MAAMI,iBAAiB,IAAIC,IAAIF,SAASG,KAAKC,QAAQA,IAAIC,KAAK,CAAA;EAC9D,MAAMC,UAAUP,MAAMQ,OAAOC,QAAQC,UAAU,CAACR,eAAeS,IAAID,KAAAA,CAAAA;EASnE,MAAME,SAASZ,MAAMxB,MAAMK,YAAYxB,aAAawD,OAChDb,MAAMxB,MAAMG,MACZ;EAEJ,KAAK,MAAM2B,SAASC,SAAS;GACzB,MAAMO,SAAS,KAAKjD,WAAWkD,OAAO;IAClCvB,UAAUQ,MAAMR;IAChBV,SAASkB,MAAMlB;IACf8B;IACAjC,KAAKqB,MAAMxB,MAAMG;IACjBE,SAASmB,MAAMxB,MAAMK;IACrByB;IACAU,WAAW;GACf,CAAA;GAEA,IAAI;IACA,MAAM,KAAKnD,WAAWoD,KAAKH,MAAAA;GAC/B,SAASI,GAAG;IACR,IAAI,CAACxD,gCAAgCwD,CAAAA,GACjC,MAAMA;GAEd;EACJ;CACJ;CAEA,MAAMC,OAAOL,QAAgC;EACzC,MAAM,KAAKjD,WAAWsD,OAAOL,MAAAA;CACjC;AACJ"}

package/dist/app/modules/oauth2/repositories/index.d.ts

@@ -1,7 +1,7 @@
 export * from './authorize/index.ts';
 export * from './client/index.ts';
+export * from './consent/index.ts';
 export * from './scope/index.ts';
-export * from './key/index.ts';
 export * from './session-token/index.ts';
 export * from './token/index.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/app/modules/oauth2/repositories/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/oauth2/repositories/index.ts"],"names":[],"mappings":"AAOA,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/oauth2/repositories/index.ts"],"names":[],"mappings":"AAOA,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC"}

package/dist/app/modules/oauth2/repositories/index.mjs

@@ -6,11 +6,11 @@ import { OAuth2AuthorizationStateRepository } from "./authorize/state/repository
 import "./authorize/index.mjs";
 import { OAuth2ClientRepository } from "./client/repository.mjs";
 import "./client/index.mjs";
+import { ConsentRepositoryAdapter } from "./consent/repository.mjs";
+import "./consent/index.mjs";
 import { OAuth2ScopeRepository } from "./scope/repository.mjs";
-import { OAuth2KeyRepository } from "./key/repository.mjs";
-import "./key/index.mjs";
 import { SessionTokenRepositoryAdapter } from "./session-token/repository.mjs";
 import "./session-token/index.mjs";
 import { OAuth2TokenRepository } from "./token/repository.mjs";
 import "./token/index.mjs";
-export { OAuth2AuthorizationCodeRepository, OAuth2AuthorizationStateRepository, OAuth2ClientRepository, OAuth2KeyRepository, OAuth2ScopeRepository, OAuth2TokenRepository, SessionTokenRepositoryAdapter };
+export { ConsentRepositoryAdapter, OAuth2AuthorizationCodeRepository, OAuth2AuthorizationStateRepository, OAuth2ClientRepository, OAuth2ScopeRepository, OAuth2TokenRepository, SessionTokenRepositoryAdapter };

package/dist/app/modules/oauth2/repositories/scope/repository.mjs

@@ -9,7 +9,7 @@ var OAuth2ScopeRepository = class {
 	}
 	async findByClientId(clientId) {
 		return (await this.repository.find({
-			where: { client_id: clientId },
+			where: { clientId },
 			relations: { scope: true }
 		})).map((clientScope) => clientScope.scope);
 	}

package/dist/app/modules/oauth2/repositories/scope/repository.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"repository.mjs","names":["OAuth2ScopeRepository","repository","findByClientId","clientId","clientScopes","find","where","client_id","relations","scope","map","clientScope"],"sources":["../../../../../../src/app/modules/oauth2/repositories/scope/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ClientScope, Scope } from '@authup/core-kit';\nimport type { Repository } from 'typeorm';\nimport type { IOAuth2ScopeRepository } from '../../../../../core/index.ts';\n\nexport class OAuth2ScopeRepository implements IOAuth2ScopeRepository {\n    private readonly repository: Repository<ClientScope>;\n\n    constructor(\n        repository: Repository<ClientScope>,\n    ) {\n        this.repository = repository;\n    }\n\n    async findByClientId(clientId: string): Promise<Scope[]> {\n        const clientScopes = await this.repository.find({\n            where: { client_id: clientId },\n            relations: { scope: true },\n        });\n\n        return clientScopes.map((clientScope) => clientScope.scope);\n    }\n}\n"],"mappings":";;;;AAWA,IAAaA,wBAAb,MAAaA;CACQC;CAEjB,YACIA,YACF;EACE,KAAKA,aAAaA;CACtB;CAEA,MAAMC,eAAeC,UAAoC;EAMrD,QAAOC,MALoB,KAAKH,WAAWI,KAAK;GAC5CC,OAAO,EAAEC,WAAWJ,SAAS;GAC7BK,WAAW,EAAEC,OAAO,KAAK;EAC7B,CAAA,EAAA,CAEoBC,KAAKC,gBAAgBA,YAAYF,KAAK;CAC9D;AACJ"}
+{"version":3,"file":"repository.mjs","names":["OAuth2ScopeRepository","repository","findByClientId","clientId","clientScopes","find","where","relations","scope","map","clientScope"],"sources":["../../../../../../src/app/modules/oauth2/repositories/scope/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ClientScope, Scope } from '@authup/core-kit';\nimport type { Repository } from 'typeorm';\nimport type { IOAuth2ScopeRepository } from '../../../../../core/index.ts';\n\nexport class OAuth2ScopeRepository implements IOAuth2ScopeRepository {\n    private readonly repository: Repository<ClientScope>;\n\n    constructor(\n        repository: Repository<ClientScope>,\n    ) {\n        this.repository = repository;\n    }\n\n    async findByClientId(clientId: string): Promise<Scope[]> {\n        const clientScopes = await this.repository.find({\n            where: { clientId },\n            relations: { scope: true },\n        });\n\n        return clientScopes.map((clientScope) => clientScope.scope);\n    }\n}\n"],"mappings":";;;;AAWA,IAAaA,wBAAb,MAAaA;CACQC;CAEjB,YACIA,YACF;EACE,KAAKA,aAAaA;CACtB;CAEA,MAAMC,eAAeC,UAAoC;EAMrD,QAAOC,MALoB,KAAKH,WAAWI,KAAK;GAC5CC,OAAO,EAAEH,SAAS;GAClBI,WAAW,EAAEC,OAAO,KAAK;EAC7B,CAAA,EAAA,CAEoBC,KAAKC,gBAAgBA,YAAYF,KAAK;CAC9D;AACJ"}

package/dist/app/modules/oauth2/repositories/session-token/repository.mjs

@@ -13,48 +13,51 @@ var SessionTokenRepositoryAdapter = class {
 	async create(input) {
 		const entity = this.repository.create({
 			id: input.id,
-			session_id: input.session_id,
+			sessionId: input.sessionId,
 			kind: input.kind,
-			parent_id: input.parent_id ?? null,
-			refresh_token_id: input.refresh_token_id ?? null,
-			ip_address: input.ip_address,
-			user_agent: input.user_agent,
-			consumed_at: null,
-			revoked_at: null,
-			expires_at: input.expires_at
+			parentId: input.parentId ?? null,
+			refreshTokenId: input.refreshTokenId ?? null,
+			ipAddress: input.ipAddress,
+			userAgent: input.userAgent,
+			consumedAt: null,
+			revokedAt: null,
+			expiresAt: input.expiresAt
 		});
 		await this.repository.insert(entity);
-		entity.created_at = entity.created_at ?? (/* @__PURE__ */ new Date()).toISOString();
+		entity.createdAt = entity.createdAt ?? (/* @__PURE__ */ new Date()).toISOString();
 		return entity;
 	}
 	async findOneById(id) {
 		return this.repository.findOne({ where: { id } });
 	}
 	async findBySessionId(sessionId) {
-		return this.repository.find({ where: { session_id: sessionId } });
+		return this.repository.find({ where: { sessionId } });
 	}
 	async markRefreshConsumed(id, at) {
-		return ((await this.repository.createQueryBuilder().update(SessionTokenEntity).set({ consumed_at: at }).where("id = :id", { id }).andWhere("kind = :kind", { kind: "refresh" }).andWhere("consumed_at IS NULL").andWhere("revoked_at IS NULL").execute()).affected ?? 0) > 0;
+		return ((await this.repository.createQueryBuilder().update(SessionTokenEntity).set({ consumedAt: at }).where("id = :id", { id }).andWhere("kind = :kind", { kind: "refresh" }).andWhere("consumedAt IS NULL").andWhere("revokedAt IS NULL").execute()).affected ?? 0) > 0;
 	}
 	async hasConsumedChild(parentId) {
-		return await this.repository.createQueryBuilder().where("parent_id = :parentId", { parentId }).andWhere("consumed_at IS NOT NULL").getCount() > 0;
+		return await this.repository.createQueryBuilder("sessionToken").where("sessionToken.parentId = :parentId", { parentId }).andWhere("sessionToken.consumedAt IS NOT NULL").getCount() > 0;
 	}
 	async revokeById(id, at) {
-		await this.repository.createQueryBuilder().update(SessionTokenEntity).set({ revoked_at: at }).where("id = :id", { id }).andWhere("revoked_at IS NULL").execute();
+		await this.repository.createQueryBuilder().update(SessionTokenEntity).set({ revokedAt: at }).where("id = :id", { id }).andWhere("revokedAt IS NULL").execute();
 	}
 	async revokeBySessionId(sessionId, at) {
 		const refs = (await this.repository.find({
-			where: { session_id: sessionId },
-			select: ["id", "expires_at"]
+			where: { sessionId },
+			select: {
+				id: true,
+				expiresAt: true
+			}
 		})).map((row) => ({
 			id: row.id,
-			expires_at: row.expires_at
+			expiresAt: row.expiresAt
 		}));
-		if (refs.length > 0) await this.repository.createQueryBuilder().update(SessionTokenEntity).set({ revoked_at: at }).where({ id: In(refs.map((ref) => ref.id)) }).andWhere("revoked_at IS NULL").execute();
+		if (refs.length > 0) await this.repository.createQueryBuilder().update(SessionTokenEntity).set({ revokedAt: at }).where({ id: In(refs.map((ref) => ref.id)) }).andWhere("revokedAt IS NULL").execute();
 		return refs;
 	}
 	async deleteExpired(before) {
-		return (await this.repository.delete({ expires_at: LessThan(before) })).affected ?? 0;
+		return (await this.repository.delete({ expiresAt: LessThan(before) })).affected ?? 0;
 	}
 };
 //#endregion

package/dist/app/modules/oauth2/repositories/session-token/repository.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"repository.mjs","names":["In","LessThan","SessionTokenEntity","SessionTokenRepositoryAdapter","repository","dataSource","getRepository","create","input","entity","id","session_id","kind","parent_id","refresh_token_id","ip_address","user_agent","consumed_at","revoked_at","expires_at","insert","created_at","Date","toISOString","findOneById","findOne","where","findBySessionId","sessionId","find","markRefreshConsumed","at","result","createQueryBuilder","update","set","andWhere","execute","affected","hasConsumedChild","parentId","count","getCount","revokeById","revokeBySessionId","rows","select","refs","map","row","length","ref","deleteExpired","before","delete"],"sources":["../../../../../../src/app/modules/oauth2/repositories/session-token/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { SessionToken } from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport { In, LessThan } from 'typeorm';\nimport { SessionTokenEntity } from '../../../../../adapters/database/domains/index.ts';\nimport type {\n    ISessionTokenRepository,\n    SessionTokenCreateInput,\n    SessionTokenRef,\n} from '../../../../../core/index.ts';\n\nexport class SessionTokenRepositoryAdapter implements ISessionTokenRepository {\n    protected repository: Repository<SessionTokenEntity>;\n\n    constructor(dataSource: DataSource) {\n        this.repository = dataSource.getRepository(SessionTokenEntity);\n    }\n\n    async create(input: SessionTokenCreateInput): Promise<SessionToken> {\n        const entity = this.repository.create({\n            id: input.id,\n            session_id: input.session_id,\n            kind: input.kind,\n            parent_id: input.parent_id ?? null,\n            refresh_token_id: input.refresh_token_id ?? null,\n            ip_address: input.ip_address,\n            user_agent: input.user_agent,\n            consumed_at: null,\n            revoked_at: null,\n            expires_at: input.expires_at,\n        });\n\n        await this.repository.insert(entity);\n\n        // insert() does not hydrate @CreateDateColumn back onto the in-memory\n        // entity (the DB fills created_at via its DEFAULT). Stamp it so the\n        // returned object satisfies the SessionToken contract instead of\n        // carrying an undefined created_at.\n        entity.created_at = entity.created_at ?? new Date().toISOString();\n\n        return entity;\n    }\n\n    async findOneById(id: string): Promise<SessionToken | null> {\n        return this.repository.findOne({ where: { id } });\n    }\n\n    async findBySessionId(sessionId: string): Promise<SessionToken[]> {\n        return this.repository.find({ where: { session_id: sessionId } });\n    }\n\n    async markRefreshConsumed(id: string, at: string): Promise<boolean> {\n        const result = await this.repository.createQueryBuilder()\n            .update(SessionTokenEntity)\n            .set({ consumed_at: at })\n            .where('id = :id', { id })\n            .andWhere('kind = :kind', { kind: 'refresh' })\n            .andWhere('consumed_at IS NULL')\n            .andWhere('revoked_at IS NULL')\n            .execute();\n\n        return (result.affected ?? 0) > 0;\n    }\n\n    async hasConsumedChild(parentId: string): Promise<boolean> {\n        const count = await this.repository.createQueryBuilder()\n            .where('parent_id = :parentId', { parentId })\n            .andWhere('consumed_at IS NOT NULL')\n            .getCount();\n\n        return count > 0;\n    }\n\n    async revokeById(id: string, at: string): Promise<void> {\n        await this.repository.createQueryBuilder()\n            .update(SessionTokenEntity)\n            .set({ revoked_at: at })\n            .where('id = :id', { id })\n            .andWhere('revoked_at IS NULL')\n            .execute();\n    }\n\n    async revokeBySessionId(sessionId: string, at: string): Promise<SessionTokenRef[]> {\n        const rows = await this.repository.find({\n            where: { session_id: sessionId },\n            select: ['id', 'expires_at'],\n        });\n\n        const refs: SessionTokenRef[] = rows.map((row) => ({\n            id: row.id,\n            expires_at: row.expires_at,\n        }));\n        if (refs.length > 0) {\n            await this.repository.createQueryBuilder()\n                .update(SessionTokenEntity)\n                .set({ revoked_at: at })\n                .where({ id: In(refs.map((ref) => ref.id)) })\n                .andWhere('revoked_at IS NULL')\n                .execute();\n        }\n\n        return refs;\n    }\n\n    async deleteExpired(before: string): Promise<number> {\n        const result = await this.repository.delete({ expires_at: LessThan(before) });\n\n        return result.affected ?? 0;\n    }\n}\n"],"mappings":";;;;;;;AAiBA,IAAaG,gCAAb,MAAaA;CACCC;CAEV,YAAYC,YAAwB;EAChC,KAAKD,aAAaC,WAAWC,cAAcJ,kBAAAA;CAC/C;CAEA,MAAMK,OAAOC,OAAuD;EAChE,MAAMC,SAAS,KAAKL,WAAWG,OAAO;GAClCG,IAAIF,MAAME;GACVC,YAAYH,MAAMG;GAClBC,MAAMJ,MAAMI;GACZC,WAAWL,MAAMK,aAAa;GAC9BC,kBAAkBN,MAAMM,oBAAoB;GAC5CC,YAAYP,MAAMO;GAClBC,YAAYR,MAAMQ;GAClBC,aAAa;GACbC,YAAY;GACZC,YAAYX,MAAMW;EACtB,CAAA;EAEA,MAAM,KAAKf,WAAWgB,OAAOX,MAAAA;EAM7BA,OAAOY,aAAaZ,OAAOY,+BAAc,IAAIC,KAAAA,EAAAA,CAAOC,YAAW;EAE/D,OAAOd;CACX;CAEA,MAAMe,YAAYd,IAA0C;EACxD,OAAO,KAAKN,WAAWqB,QAAQ,EAAEC,OAAO,EAAEhB,GAAG,EAAE,CAAA;CACnD;CAEA,MAAMiB,gBAAgBC,WAA4C;EAC9D,OAAO,KAAKxB,WAAWyB,KAAK,EAAEH,OAAO,EAAEf,YAAYiB,UAAU,EAAE,CAAA;CACnE;CAEA,MAAME,oBAAoBpB,IAAYqB,IAA8B;EAUhE,SAAQC,MATa,KAAK5B,WAAW6B,mBAAkB,CAAA,CAClDC,OAAOhC,kBAAAA,CAAAA,CACPiC,IAAI,EAAElB,aAAac,GAAG,CAAA,CAAA,CACtBL,MAAM,YAAY,EAAEhB,GAAG,CAAA,CAAA,CACvB0B,SAAS,gBAAgB,EAAExB,MAAM,UAAU,CAAA,CAAA,CAC3CwB,SAAS,qBAAA,CAAA,CACTA,SAAS,oBAAA,CAAA,CACTC,QAAO,EAAA,CAEGC,YAAY,KAAK;CACpC;CAEA,MAAMC,iBAAiBC,UAAoC;EAMvD,OAAOC,MALa,KAAKrC,WAAW6B,mBAAkB,CAAA,CACjDP,MAAM,yBAAyB,EAAEc,SAAS,CAAA,CAAA,CAC1CJ,SAAS,yBAAA,CAAA,CACTM,SAAQ,IAEE;CACnB;CAEA,MAAMC,WAAWjC,IAAYqB,IAA2B;EACpD,MAAM,KAAK3B,WAAW6B,mBAAkB,CAAA,CACnCC,OAAOhC,kBAAAA,CAAAA,CACPiC,IAAI,EAAEjB,YAAYa,GAAG,CAAA,CAAA,CACrBL,MAAM,YAAY,EAAEhB,GAAG,CAAA,CAAA,CACvB0B,SAAS,oBAAA,CAAA,CACTC,QAAO;CAChB;CAEA,MAAMO,kBAAkBhB,WAAmBG,IAAwC;EAM/E,MAAMgB,QAA0BF,MALb,KAAKzC,WAAWyB,KAAK;GACpCH,OAAO,EAAEf,YAAYiB,UAAU;GAC/BkB,QAAQ,CAAC,MAAM,YAAA;EACnB,CAAA,EAAA,CAEqCE,KAAKC,SAAS;GAC/CvC,IAAIuC,IAAIvC;GACRS,YAAY8B,IAAI9B;EACpB,EAAA;EACA,IAAI4B,KAAKG,SAAS,GACd,MAAM,KAAK9C,WAAW6B,mBAAkB,CAAA,CACnCC,OAAOhC,kBAAAA,CAAAA,CACPiC,IAAI,EAAEjB,YAAYa,GAAG,CAAA,CAAA,CACrBL,MAAM,EAAEhB,IAAIV,GAAG+C,KAAKC,KAAKG,QAAQA,IAAIzC,EAAE,CAAA,EAAG,CAAA,CAAA,CAC1C0B,SAAS,oBAAA,CAAA,CACTC,QAAO;EAGhB,OAAOU;CACX;CAEA,MAAMK,cAAcC,QAAiC;EAGjD,QAAOrB,MAFc,KAAK5B,WAAWkD,OAAO,EAAEnC,YAAYlB,SAASoD,MAAAA,EAAQ,CAAA,EAAA,CAE7Df,YAAY;CAC9B;AACJ"}
+{"version":3,"file":"repository.mjs","names":["In","LessThan","SessionTokenEntity","SessionTokenRepositoryAdapter","repository","dataSource","getRepository","create","input","entity","id","sessionId","kind","parentId","refreshTokenId","ipAddress","userAgent","consumedAt","revokedAt","expiresAt","insert","createdAt","Date","toISOString","findOneById","findOne","where","findBySessionId","find","markRefreshConsumed","at","result","createQueryBuilder","update","set","andWhere","execute","affected","hasConsumedChild","count","getCount","revokeById","revokeBySessionId","rows","select","refs","map","row","length","ref","deleteExpired","before","delete"],"sources":["../../../../../../src/app/modules/oauth2/repositories/session-token/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { SessionToken } from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport { In, LessThan } from 'typeorm';\nimport { SessionTokenEntity } from '../../../../../adapters/database/domains/index.ts';\nimport type {\n    ISessionTokenRepository,\n    SessionTokenCreateInput,\n    SessionTokenRef,\n} from '../../../../../core/index.ts';\n\nexport class SessionTokenRepositoryAdapter implements ISessionTokenRepository {\n    protected repository: Repository<SessionTokenEntity>;\n\n    constructor(dataSource: DataSource) {\n        this.repository = dataSource.getRepository(SessionTokenEntity);\n    }\n\n    async create(input: SessionTokenCreateInput): Promise<SessionToken> {\n        const entity = this.repository.create({\n            id: input.id,\n            sessionId: input.sessionId,\n            kind: input.kind,\n            parentId: input.parentId ?? null,\n            refreshTokenId: input.refreshTokenId ?? null,\n            ipAddress: input.ipAddress,\n            userAgent: input.userAgent,\n            consumedAt: null,\n            revokedAt: null,\n            expiresAt: input.expiresAt,\n        });\n\n        await this.repository.insert(entity);\n\n        // insert() does not hydrate @CreateDateColumn back onto the in-memory\n        // entity (the DB fills created_at via its DEFAULT). Stamp it so the\n        // returned object satisfies the SessionToken contract instead of\n        // carrying an undefined createdAt.\n        entity.createdAt = entity.createdAt ?? new Date().toISOString();\n\n        return entity;\n    }\n\n    async findOneById(id: string): Promise<SessionToken | null> {\n        return this.repository.findOne({ where: { id } });\n    }\n\n    async findBySessionId(sessionId: string): Promise<SessionToken[]> {\n        return this.repository.find({ where: { sessionId } });\n    }\n\n    async markRefreshConsumed(id: string, at: string): Promise<boolean> {\n        const result = await this.repository.createQueryBuilder()\n            .update(SessionTokenEntity)\n            .set({ consumedAt: at })\n            .where('id = :id', { id })\n            .andWhere('kind = :kind', { kind: 'refresh' })\n            .andWhere('consumedAt IS NULL')\n            .andWhere('revokedAt IS NULL')\n            .execute();\n\n        return (result.affected ?? 0) > 0;\n    }\n\n    async hasConsumedChild(parentId: string): Promise<boolean> {\n        const count = await this.repository.createQueryBuilder('sessionToken')\n            .where('sessionToken.parentId = :parentId', { parentId })\n            .andWhere('sessionToken.consumedAt IS NOT NULL')\n            .getCount();\n\n        return count > 0;\n    }\n\n    async revokeById(id: string, at: string): Promise<void> {\n        await this.repository.createQueryBuilder()\n            .update(SessionTokenEntity)\n            .set({ revokedAt: at })\n            .where('id = :id', { id })\n            .andWhere('revokedAt IS NULL')\n            .execute();\n    }\n\n    async revokeBySessionId(sessionId: string, at: string): Promise<SessionTokenRef[]> {\n        const rows = await this.repository.find({\n            where: { sessionId },\n            select: { id: true, expiresAt: true },\n        });\n\n        const refs: SessionTokenRef[] = rows.map((row) => ({\n            id: row.id,\n            expiresAt: row.expiresAt,\n        }));\n        if (refs.length > 0) {\n            await this.repository.createQueryBuilder()\n                .update(SessionTokenEntity)\n                .set({ revokedAt: at })\n                .where({ id: In(refs.map((ref) => ref.id)) })\n                .andWhere('revokedAt IS NULL')\n                .execute();\n        }\n\n        return refs;\n    }\n\n    async deleteExpired(before: string): Promise<number> {\n        const result = await this.repository.delete({ expiresAt: LessThan(before) });\n\n        return result.affected ?? 0;\n    }\n}\n"],"mappings":";;;;;;;AAiBA,IAAaG,gCAAb,MAAaA;CACCC;CAEV,YAAYC,YAAwB;EAChC,KAAKD,aAAaC,WAAWC,cAAcJ,kBAAAA;CAC/C;CAEA,MAAMK,OAAOC,OAAuD;EAChE,MAAMC,SAAS,KAAKL,WAAWG,OAAO;GAClCG,IAAIF,MAAME;GACVC,WAAWH,MAAMG;GACjBC,MAAMJ,MAAMI;GACZC,UAAUL,MAAMK,YAAY;GAC5BC,gBAAgBN,MAAMM,kBAAkB;GACxCC,WAAWP,MAAMO;GACjBC,WAAWR,MAAMQ;GACjBC,YAAY;GACZC,WAAW;GACXC,WAAWX,MAAMW;EACrB,CAAA;EAEA,MAAM,KAAKf,WAAWgB,OAAOX,MAAAA;EAM7BA,OAAOY,YAAYZ,OAAOY,8BAAa,IAAIC,KAAAA,EAAAA,CAAOC,YAAW;EAE7D,OAAOd;CACX;CAEA,MAAMe,YAAYd,IAA0C;EACxD,OAAO,KAAKN,WAAWqB,QAAQ,EAAEC,OAAO,EAAEhB,GAAG,EAAE,CAAA;CACnD;CAEA,MAAMiB,gBAAgBhB,WAA4C;EAC9D,OAAO,KAAKP,WAAWwB,KAAK,EAAEF,OAAO,EAAEf,UAAU,EAAE,CAAA;CACvD;CAEA,MAAMkB,oBAAoBnB,IAAYoB,IAA8B;EAUhE,SAAQC,MATa,KAAK3B,WAAW4B,mBAAkB,CAAA,CAClDC,OAAO/B,kBAAAA,CAAAA,CACPgC,IAAI,EAAEjB,YAAYa,GAAG,CAAA,CAAA,CACrBJ,MAAM,YAAY,EAAEhB,GAAG,CAAA,CAAA,CACvByB,SAAS,gBAAgB,EAAEvB,MAAM,UAAU,CAAA,CAAA,CAC3CuB,SAAS,oBAAA,CAAA,CACTA,SAAS,mBAAA,CAAA,CACTC,QAAO,EAAA,CAEGC,YAAY,KAAK;CACpC;CAEA,MAAMC,iBAAiBzB,UAAoC;EAMvD,OAAO0B,MALa,KAAKnC,WAAW4B,mBAAmB,cAAA,CAAA,CAClDN,MAAM,qCAAqC,EAAEb,SAAS,CAAA,CAAA,CACtDsB,SAAS,qCAAA,CAAA,CACTK,SAAQ,IAEE;CACnB;CAEA,MAAMC,WAAW/B,IAAYoB,IAA2B;EACpD,MAAM,KAAK1B,WAAW4B,mBAAkB,CAAA,CACnCC,OAAO/B,kBAAAA,CAAAA,CACPgC,IAAI,EAAEhB,WAAWY,GAAG,CAAA,CAAA,CACpBJ,MAAM,YAAY,EAAEhB,GAAG,CAAA,CAAA,CACvByB,SAAS,mBAAA,CAAA,CACTC,QAAO;CAChB;CAEA,MAAMM,kBAAkB/B,WAAmBmB,IAAwC;EAM/E,MAAMe,QAA0BF,MALb,KAAKvC,WAAWwB,KAAK;GACpCF,OAAO,EAAEf,UAAU;GACnBiC,QAAQ;IAAElC,IAAI;IAAMS,WAAW;GAAK;EACxC,CAAA,EAAA,CAEqC2B,KAAKC,SAAS;GAC/CrC,IAAIqC,IAAIrC;GACRS,WAAW4B,IAAI5B;EACnB,EAAA;EACA,IAAI0B,KAAKG,SAAS,GACd,MAAM,KAAK5C,WAAW4B,mBAAkB,CAAA,CACnCC,OAAO/B,kBAAAA,CAAAA,CACPgC,IAAI,EAAEhB,WAAWY,GAAG,CAAA,CAAA,CACpBJ,MAAM,EAAEhB,IAAIV,GAAG6C,KAAKC,KAAKG,QAAQA,IAAIvC,EAAE,CAAA,EAAG,CAAA,CAAA,CAC1CyB,SAAS,mBAAA,CAAA,CACTC,QAAO;EAGhB,OAAOS;CACX;CAEA,MAAMK,cAAcC,QAAiC;EAGjD,QAAOpB,MAFc,KAAK3B,WAAWgD,OAAO,EAAEjC,WAAWlB,SAASkD,MAAAA,EAAQ,CAAA,EAAA,CAE5Dd,YAAY;CAC9B;AACJ"}

package/dist/app/modules/oauth2/repositories/token/repository.d.ts

@@ -12,6 +12,7 @@ export declare class OAuth2TokenRepository implements IOAuth2TokenRepository {
     saveWithSignature(data: OAuth2TokenPayload, signature: string): Promise<OAuth2TokenPayload>;
     isInactive(key: string): Promise<boolean>;
     setInactive(key: string, exp?: number): Promise<void>;
+    claimInactive(key: string, exp?: number): Promise<boolean>;
     /**
      * Transform timestamp in seconds to ttl in ms.
      *

package/dist/app/modules/oauth2/repositories/token/repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/oauth2/repositories/token/repository.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAG3E,qBAAa,qBAAsB,YAAW,sBAAsB;IAChE,SAAS,CAAC,KAAK,EAAG,MAAM,CAAC;gBAEb,KAAK,EAAE,MAAM;IAMnB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IASzE,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAW3D,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBrC,MAAM,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAehE,IAAI,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAQ9D,iBAAiB,CAAC,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAiB3F,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAWzC,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiB3D;;;;;OAKG;IACH,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM;CAUlC"}
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/oauth2/repositories/token/repository.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAG3E,qBAAa,qBAAsB,YAAW,sBAAsB;IAChE,SAAS,CAAC,KAAK,EAAG,MAAM,CAAC;gBAEb,KAAK,EAAE,MAAM;IAMnB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IASzE,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAW3D,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBrC,MAAM,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAehE,IAAI,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAQ9D,iBAAiB,CAAC,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAiB3F,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAWzC,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAerD,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAoBhE;;;;;OAKG;IACH,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM;CAUlC"}

package/dist/app/modules/oauth2/repositories/token/repository.mjs

@@ -67,6 +67,14 @@ var OAuth2TokenRepository = class {
 		});
 		await this.cache.set(cacheKey, true, { ttl });
 	}
+	async claimInactive(key, exp) {
+		const ttl = this.buildTTL(exp);
+		const cacheKey = buildCacheKey({
+			prefix: CacheOAuth2Prefix.TOKEN_INACTIVE,
+			key
+		});
+		return this.cache.add(cacheKey, true, { ttl });
+	}
 	/**
 	* Transform timestamp in seconds to ttl in ms.
 	*