@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.54

package/dist/components/oauth2-cleaner/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/components/oauth2-cleaner/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAG1C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,UAAU,GAAI,SAAS,CA0B/E"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/components/oauth2-cleaner/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAG1C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,wBAAgB,4BAA4B,CACxC,UAAU,EAAE,UAAU,EACtB,MAAM,CAAC,EAAE,MAAM,GACf,SAAS,CAkCZ"}

package/dist/components/oauth2-cleaner/module.mjs

@@ -7,14 +7,19 @@ import "../../adapters/database/domains/index.mjs";
 import { LessThan } from "typeorm";
 import cron from "node-cron";
 //#region src/components/oauth2-cleaner/module.ts
-function createOAuth2CleanerComponent(dataSource) {
+function createOAuth2CleanerComponent(dataSource, logger) {
 	return { async start() {
 		const sessionRepository = dataSource.getRepository(SessionEntity);
 		const sessionTokenRepository = dataSource.getRepository(SessionTokenEntity);
 		const execute = async () => {
-			const isoDate = (/* @__PURE__ */ new Date()).toISOString();
-			await sessionTokenRepository.delete({ expires_at: LessThan(isoDate) });
-			await sessionRepository.delete({ expires_at: LessThan(isoDate) });
+			try {
+				const isoDate = (/* @__PURE__ */ new Date()).toISOString();
+				await sessionTokenRepository.delete({ expiresAt: LessThan(isoDate) });
+				await sessionRepository.delete({ expiresAt: LessThan(isoDate) });
+			} catch (e) {
+				logger?.warn("Sweeping expired sessions failed.");
+				logger?.warn(e);
+			}
 		};
 		await execute();
 		cron.schedule("* * * * *", async () => {

package/dist/components/oauth2-cleaner/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["cron","LessThan","SessionEntity","SessionTokenEntity","createOAuth2CleanerComponent","dataSource","start","sessionRepository","getRepository","sessionTokenRepository","execute","isoDate","Date","toISOString","delete","expires_at","schedule"],"sources":["../../../src/components/oauth2-cleaner/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport cron from 'node-cron';\nimport type { DataSource } from 'typeorm';\nimport { LessThan } from 'typeorm';\nimport { SessionEntity, SessionTokenEntity } from '../../adapters/database/domains/index.ts';\nimport type { Component } from '../types.ts';\n\nexport function createOAuth2CleanerComponent(dataSource: DataSource) : Component {\n    return {\n        async start() {\n            const sessionRepository = dataSource.getRepository(SessionEntity);\n            const sessionTokenRepository = dataSource.getRepository(SessionTokenEntity);\n\n            const execute = async () => {\n                const isoDate = new Date().toISOString();\n\n                // Sweep expired session-token rows first: the auth_session_tokens\n                // volume dominates (one row per access token, ~15min TTL) and a\n                // deleted session cascade-drops its remaining rows anyway.\n                await sessionTokenRepository\n                    .delete({ expires_at: LessThan(isoDate) });\n\n                await sessionRepository\n                    .delete({ expires_at: LessThan(isoDate) });\n            };\n\n            await execute();\n\n            cron.schedule('* * * * *', async () => {\n                await execute();\n            });\n        },\n    };\n}\n"],"mappings":";;;;;;;;;AAaA,SAAgBI,6BAA6BC,YAAsB;CAC/D,OAAO,EACH,MAAMC,QAAAA;EACF,MAAMC,oBAAoBF,WAAWG,cAAcN,aAAAA;EACnD,MAAMO,yBAAyBJ,WAAWG,cAAcL,kBAAAA;EAExD,MAAMO,UAAU,YAAA;GACZ,MAAMC,2BAAU,IAAIC,KAAAA,EAAAA,CAAOC,YAAW;GAKtC,MAAMJ,uBACDK,OAAO,EAAEC,YAAYd,SAASU,OAAAA,EAAS,CAAA;GAE5C,MAAMJ,kBACDO,OAAO,EAAEC,YAAYd,SAASU,OAAAA,EAAS,CAAA;EAChD;EAEA,MAAMD,QAAAA;EAENV,KAAKgB,SAAS,aAAa,YAAA;GACvB,MAAMN,QAAAA;EACV,CAAA;CACJ,EACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["cron","LessThan","SessionEntity","SessionTokenEntity","createOAuth2CleanerComponent","dataSource","logger","start","sessionRepository","getRepository","sessionTokenRepository","execute","isoDate","Date","toISOString","delete","expiresAt","e","warn","schedule"],"sources":["../../../src/components/oauth2-cleaner/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport cron from 'node-cron';\nimport type { Logger } from '@authup/server-kit';\nimport type { DataSource } from 'typeorm';\nimport { LessThan } from 'typeorm';\nimport { SessionEntity, SessionTokenEntity } from '../../adapters/database/domains/index.ts';\nimport type { Component } from '../types.ts';\n\nexport function createOAuth2CleanerComponent(\n    dataSource: DataSource,\n    logger?: Logger,\n) : Component {\n    return {\n        async start() {\n            const sessionRepository = dataSource.getRepository(SessionEntity);\n            const sessionTokenRepository = dataSource.getRepository(SessionTokenEntity);\n\n            // A failed sweep must never take the process down (start() is\n            // fire-and-forget → an uncaught rejection is fatal on modern\n            // node); the next tick simply retries.\n            const execute = async () => {\n                try {\n                    const isoDate = new Date().toISOString();\n\n                    // Sweep expired session-token rows first: the auth_session_tokens\n                    // volume dominates (one row per access token, ~15min TTL) and a\n                    // deleted session cascade-drops its remaining rows anyway.\n                    await sessionTokenRepository\n                        .delete({ expiresAt: LessThan(isoDate) });\n\n                    await sessionRepository\n                        .delete({ expiresAt: LessThan(isoDate) });\n                } catch (e) {\n                    logger?.warn('Sweeping expired sessions failed.');\n                    logger?.warn(e);\n                }\n            };\n\n            await execute();\n\n            cron.schedule('* * * * *', async () => {\n                await execute();\n            });\n        },\n    };\n}\n"],"mappings":";;;;;;;;;AAcA,SAAgBI,6BACZC,YACAC,QAAe;CAEf,OAAO,EACH,MAAMC,QAAAA;EACF,MAAMC,oBAAoBH,WAAWI,cAAcP,aAAAA;EACnD,MAAMQ,yBAAyBL,WAAWI,cAAcN,kBAAAA;EAKxD,MAAMQ,UAAU,YAAA;GACZ,IAAI;IACA,MAAMC,2BAAU,IAAIC,KAAAA,EAAAA,CAAOC,YAAW;IAKtC,MAAMJ,uBACDK,OAAO,EAAEC,WAAWf,SAASW,OAAAA,EAAS,CAAA;IAE3C,MAAMJ,kBACDO,OAAO,EAAEC,WAAWf,SAASW,OAAAA,EAAS,CAAA;GAC/C,SAASK,GAAG;IACRX,QAAQY,KAAK,mCAAA;IACbZ,QAAQY,KAAKD,CAAAA;GACjB;EACJ;EAEA,MAAMN,QAAAA;EAENX,KAAKmB,SAAS,aAAa,YAAA;GACvB,MAAMR,QAAAA;EACV,CAAA;CACJ,EACJ;AACJ"}

package/dist/core/authentication/credential/entities/client/module.d.ts

@@ -1,8 +1,8 @@
-import type { Client } from '@authup/core-kit';
+import { type Client } from '@authup/core-kit';
 import type { ICredentialService } from '../../types.ts';
 export declare class ClientCredentialsService implements ICredentialService<Client> {
     verify(input: string, entity: Client): Promise<boolean>;
-    protect(input: string, entity: Pick<Client, 'secret_hashed'>): Promise<string>;
+    protect(input: string, entity: Pick<Client, 'secretHashed'>): Promise<string>;
     generateSecret(): string;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/core/authentication/credential/entities/client/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/authentication/credential/entities/client/module.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEzD,qBAAa,wBAAyB,YAAW,kBAAkB,CAAC,MAAM,CAAC;IACjE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAcvD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IAYpF,cAAc;CAGjB"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/authentication/credential/entities/client/module.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,KAAK,MAAM,EAAoB,MAAM,kBAAkB,CAAC;AACjE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEzD,qBAAa,wBAAyB,YAAW,kBAAkB,CAAC,MAAM,CAAC;IACjE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAcvD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IAYnF,cAAc;CAGjB"}

package/dist/core/authentication/credential/entities/client/module.mjs

@@ -2,16 +2,17 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { createNanoID, isBCryptHash } from "@authup/kit";
+import { ClientAuthMethod } from "@authup/core-kit";
 import { compare, hash } from "@authup/server-kit";
 //#region src/core/authentication/credential/entities/client/module.ts
 var ClientCredentialsService = class {
 	async verify(input, entity) {
-		if (!entity.secret || !entity.is_confidential) return false;
-		if (entity.secret_hashed) return compare(input, entity.secret);
+		if (!entity.secret || entity.authMethod !== ClientAuthMethod.SECRET) return false;
+		if (entity.secretHashed) return compare(input, entity.secret);
 		return input === entity.secret;
 	}
 	async protect(input, entity) {
-		if (entity.secret_hashed) return isBCryptHash(input) ? input : hash(input);
+		if (entity.secretHashed) return isBCryptHash(input) ? input : hash(input);
 		return input;
 	}
 	generateSecret() {

package/dist/core/authentication/credential/entities/client/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["createNanoID","isBCryptHash","compare","hash","ClientCredentialsService","verify","input","entity","secret","is_confidential","secret_hashed","protect","generateSecret"],"sources":["../../../../../../src/core/authentication/credential/entities/client/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { createNanoID, isBCryptHash } from '@authup/kit';\nimport { compare, hash } from '@authup/server-kit';\nimport type { Client } from '@authup/core-kit';\nimport type { ICredentialService } from '../../types.ts';\n\nexport class ClientCredentialsService implements ICredentialService<Client> {\n    async verify(input: string, entity: Client): Promise<boolean> {\n        if (!entity.secret || !entity.is_confidential) {\n            return false;\n        }\n\n        if (entity.secret_hashed) {\n            return compare(input, entity.secret);\n        }\n\n        // todo: secret encrypted missing (decrypt)\n\n        return input === entity.secret;\n    }\n\n    async protect(input: string, entity: Pick<Client, 'secret_hashed'>): Promise<string> {\n        if (entity.secret_hashed) {\n            return isBCryptHash(input) ?\n                input :\n                hash(input);\n        }\n\n        // todo: secret encrypted missing (encrypt)\n\n        return input;\n    }\n\n    generateSecret() {\n        return createNanoID(64);\n    }\n}\n"],"mappings":";;;;;;AAYA,IAAaI,2BAAb,MAAaA;CACT,MAAMC,OAAOC,OAAeC,QAAkC;EAC1D,IAAI,CAACA,OAAOC,UAAU,CAACD,OAAOE,iBAC1B,OAAO;EAGX,IAAIF,OAAOG,eACP,OAAOR,QAAQI,OAAOC,OAAOC,MAAM;EAKvC,OAAOF,UAAUC,OAAOC;CAC5B;CAEA,MAAMG,QAAQL,OAAeC,QAAwD;EACjF,IAAIA,OAAOG,eACP,OAAOT,aAAaK,KAAAA,IAChBA,QACAH,KAAKG,KAAAA;EAKb,OAAOA;CACX;CAEAM,iBAAiB;EACb,OAAOZ,aAAa,EAAA;CACxB;AACJ"}
+{"version":3,"file":"module.mjs","names":["createNanoID","isBCryptHash","compare","hash","ClientAuthMethod","ClientCredentialsService","verify","input","entity","secret","authMethod","SECRET","secretHashed","protect","generateSecret"],"sources":["../../../../../../src/core/authentication/credential/entities/client/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { createNanoID, isBCryptHash } from '@authup/kit';\nimport { compare, hash } from '@authup/server-kit';\nimport { type Client, ClientAuthMethod } from '@authup/core-kit';\nimport type { ICredentialService } from '../../types.ts';\n\nexport class ClientCredentialsService implements ICredentialService<Client> {\n    async verify(input: string, entity: Client): Promise<boolean> {\n        if (!entity.secret || entity.authMethod !== ClientAuthMethod.SECRET) {\n            return false;\n        }\n\n        if (entity.secretHashed) {\n            return compare(input, entity.secret);\n        }\n\n        // todo: secret encrypted missing (decrypt)\n\n        return input === entity.secret;\n    }\n\n    async protect(input: string, entity: Pick<Client, 'secretHashed'>): Promise<string> {\n        if (entity.secretHashed) {\n            return isBCryptHash(input) ?\n                input :\n                hash(input);\n        }\n\n        // todo: secret encrypted missing (encrypt)\n\n        return input;\n    }\n\n    generateSecret() {\n        return createNanoID(64);\n    }\n}\n"],"mappings":";;;;;;;AAYA,IAAaK,2BAAb,MAAaA;CACT,MAAMC,OAAOC,OAAeC,QAAkC;EAC1D,IAAI,CAACA,OAAOC,UAAUD,OAAOE,eAAeN,iBAAiBO,QACzD,OAAO;EAGX,IAAIH,OAAOI,cACP,OAAOV,QAAQK,OAAOC,OAAOC,MAAM;EAKvC,OAAOF,UAAUC,OAAOC;CAC5B;CAEA,MAAMI,QAAQN,OAAeC,QAAuD;EAChF,IAAIA,OAAOI,cACP,OAAOX,aAAaM,KAAAA,IAChBA,QACAJ,KAAKI,KAAAA;EAKb,OAAOA;CACX;CAEAO,iBAAiB;EACb,OAAOd,aAAa,EAAA;CACxB;AACJ"}

package/dist/core/authentication/credential/entities/index.d.ts

@@ -1,4 +1,3 @@
 export * from './client/index.ts';
-export * from './robot/index.ts';
 export * from './user/index.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/authentication/credential/entities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/authentication/credential/entities/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/authentication/credential/entities/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC"}

package/dist/core/authentication/credential/entities/index.mjs

@@ -3,8 +3,6 @@ import "node:url";
 import.meta.url;
 import { ClientCredentialsService } from "./client/module.mjs";
 import "./client/index.mjs";
-import { RobotCredentialsService } from "./robot/module.mjs";
-import "./robot/index.mjs";
 import { UserCredentialsService } from "./user/module.mjs";
 import "./user/index.mjs";
-export { ClientCredentialsService, RobotCredentialsService, UserCredentialsService };
+export { ClientCredentialsService, UserCredentialsService };

package/dist/core/authentication/credential/index.mjs

@@ -2,7 +2,6 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { ClientCredentialsService } from "./entities/client/module.mjs";
-import { RobotCredentialsService } from "./entities/robot/module.mjs";
 import { UserCredentialsService } from "./entities/user/module.mjs";
 import "./entities/index.mjs";
-export { ClientCredentialsService, RobotCredentialsService, UserCredentialsService };
+export { ClientCredentialsService, UserCredentialsService };

package/dist/core/authentication/entities/client/module.mjs

@@ -4,7 +4,7 @@ import.meta.url;
 import { ClientCredentialsService } from "../../credential/entities/client/module.mjs";
 import "../../credential/index.mjs";
 import { BaseCredentialsAuthenticator } from "../../base.mjs";
-import { IdentityType } from "@authup/core-kit";
+import { ClientAuthMethod, IdentityType } from "@authup/core-kit";
 import { EntityCredentialsInvalidError, EntityInactiveError } from "@authup/errors";
 import { OAuth2ClientError } from "@authup/specs";
 //#region src/core/authentication/entities/client/module.ts
@@ -20,7 +20,7 @@ var ClientAuthenticator = class extends BaseCredentialsAuthenticator {
 		const identity = await this.identityResolver.resolve(IdentityType.CLIENT, key, realmId);
 		if (!identity || identity.type !== IdentityType.CLIENT) throw new EntityCredentialsInvalidError({ entity: "client" });
 		if (!identity.data.active) throw new EntityInactiveError({ entity: "client" });
-		if (identity.data.is_confidential) {
+		if (identity.data.authMethod === ClientAuthMethod.SECRET) {
 			if (!await this.credentialsService.verify(secret, identity.data)) throw new EntityCredentialsInvalidError({ entity: "client" });
 		} else throw OAuth2ClientError.invalid();
 		return identity.data;

package/dist/core/authentication/entities/client/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["IdentityType","EntityCredentialsInvalidError","EntityInactiveError","OAuth2ClientError","ClientCredentialsService","BaseCredentialsAuthenticator","ClientAuthenticator","identityResolver","credentialsService","authenticate","key","secret","realmId","identity","resolve","CLIENT","type","entity","data","active","is_confidential","verified","verify","invalid"],"sources":["../../../../../src/core/authentication/entities/client/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Client } from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { EntityCredentialsInvalidError, EntityInactiveError } from '@authup/errors';\nimport { OAuth2ClientError } from '@authup/specs';\nimport type { IIdentityResolver } from '../../../identity/index.ts';\nimport { ClientCredentialsService } from '../../credential/index.ts';\nimport { BaseCredentialsAuthenticator } from '../../base.ts';\n\nexport class ClientAuthenticator extends BaseCredentialsAuthenticator<Client> {\n    protected identityResolver : IIdentityResolver;\n\n    protected credentialsService : ClientCredentialsService;\n\n    constructor(identityResolver: IIdentityResolver) {\n        super();\n\n        this.identityResolver = identityResolver;\n        this.credentialsService = new ClientCredentialsService();\n    }\n\n    async authenticate(key: string, secret: string, realmId?: string): Promise<Client> {\n        const identity = await this.identityResolver.resolve(IdentityType.CLIENT, key, realmId);\n        if (!identity || identity.type !== IdentityType.CLIENT) {\n            throw new EntityCredentialsInvalidError({ entity: 'client' });\n        }\n\n        if (!identity.data.active) {\n            throw new EntityInactiveError({ entity: 'client' });\n        }\n\n        if (identity.data.is_confidential) {\n            const verified = await this.credentialsService.verify(secret, identity.data);\n            if (!verified) {\n                throw new EntityCredentialsInvalidError({ entity: 'client' });\n            }\n        } else {\n            throw OAuth2ClientError.invalid();\n        }\n\n        return identity.data;\n    }\n}\n"],"mappings":";;;;;;;;;;AAeA,IAAaM,sBAAb,cAAyCD,6BAAAA;CAC3BE;CAEAC;CAEV,YAAYD,kBAAqC;EAC7C,MAAK;EAEL,KAAKA,mBAAmBA;EACxB,KAAKC,qBAAqB,IAAIJ,yBAAAA;CAClC;CAEA,MAAMK,aAAaC,KAAaC,QAAgBC,SAAmC;EAC/E,MAAMC,WAAW,MAAM,KAAKN,iBAAiBO,QAAQd,aAAae,QAAQL,KAAKE,OAAAA;EAC/E,IAAI,CAACC,YAAYA,SAASG,SAAShB,aAAae,QAC5C,MAAM,IAAId,8BAA8B,EAAEgB,QAAQ,SAAS,CAAA;EAG/D,IAAI,CAACJ,SAASK,KAAKC,QACf,MAAM,IAAIjB,oBAAoB,EAAEe,QAAQ,SAAS,CAAA;EAGrD,IAAIJ,SAASK,KAAKE;OAEV,CAACC,MADkB,KAAKb,mBAAmBc,OAAOX,QAAQE,SAASK,IAAI,GAEvE,MAAM,IAAIjB,8BAA8B,EAAEgB,QAAQ,SAAS,CAAA;EAAA,OAG/D,MAAMd,kBAAkBoB,QAAO;EAGnC,OAAOV,SAASK;CACpB;AACJ"}
+{"version":3,"file":"module.mjs","names":["ClientAuthMethod","IdentityType","EntityCredentialsInvalidError","EntityInactiveError","OAuth2ClientError","ClientCredentialsService","BaseCredentialsAuthenticator","ClientAuthenticator","identityResolver","credentialsService","authenticate","key","secret","realmId","identity","resolve","CLIENT","type","entity","data","active","authMethod","SECRET","verified","verify","invalid"],"sources":["../../../../../src/core/authentication/entities/client/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Client } from '@authup/core-kit';\nimport { ClientAuthMethod, IdentityType } from '@authup/core-kit';\nimport { EntityCredentialsInvalidError, EntityInactiveError } from '@authup/errors';\nimport { OAuth2ClientError } from '@authup/specs';\nimport type { IIdentityResolver } from '../../../identity/index.ts';\nimport { ClientCredentialsService } from '../../credential/index.ts';\nimport { BaseCredentialsAuthenticator } from '../../base.ts';\n\nexport class ClientAuthenticator extends BaseCredentialsAuthenticator<Client> {\n    protected identityResolver : IIdentityResolver;\n\n    protected credentialsService : ClientCredentialsService;\n\n    constructor(identityResolver: IIdentityResolver) {\n        super();\n\n        this.identityResolver = identityResolver;\n        this.credentialsService = new ClientCredentialsService();\n    }\n\n    async authenticate(key: string, secret: string, realmId?: string): Promise<Client> {\n        const identity = await this.identityResolver.resolve(IdentityType.CLIENT, key, realmId);\n        if (!identity || identity.type !== IdentityType.CLIENT) {\n            throw new EntityCredentialsInvalidError({ entity: 'client' });\n        }\n\n        if (!identity.data.active) {\n            throw new EntityInactiveError({ entity: 'client' });\n        }\n\n        if (identity.data.authMethod === ClientAuthMethod.SECRET) {\n            const verified = await this.credentialsService.verify(secret, identity.data);\n            if (!verified) {\n                throw new EntityCredentialsInvalidError({ entity: 'client' });\n            }\n        } else {\n            throw OAuth2ClientError.invalid();\n        }\n\n        return identity.data;\n    }\n}\n"],"mappings":";;;;;;;;;;AAeA,IAAaO,sBAAb,cAAyCD,6BAAAA;CAC3BE;CAEAC;CAEV,YAAYD,kBAAqC;EAC7C,MAAK;EAEL,KAAKA,mBAAmBA;EACxB,KAAKC,qBAAqB,IAAIJ,yBAAAA;CAClC;CAEA,MAAMK,aAAaC,KAAaC,QAAgBC,SAAmC;EAC/E,MAAMC,WAAW,MAAM,KAAKN,iBAAiBO,QAAQd,aAAae,QAAQL,KAAKE,OAAAA;EAC/E,IAAI,CAACC,YAAYA,SAASG,SAAShB,aAAae,QAC5C,MAAM,IAAId,8BAA8B,EAAEgB,QAAQ,SAAS,CAAA;EAG/D,IAAI,CAACJ,SAASK,KAAKC,QACf,MAAM,IAAIjB,oBAAoB,EAAEe,QAAQ,SAAS,CAAA;EAGrD,IAAIJ,SAASK,KAAKE,eAAerB,iBAAiBsB;OAE1C,CAACC,MADkB,KAAKd,mBAAmBe,OAAOZ,QAAQE,SAASK,IAAI,GAEvE,MAAM,IAAIjB,8BAA8B,EAAEgB,QAAQ,SAAS,CAAA;EAAA,OAG/D,MAAMd,kBAAkBqB,QAAO;EAGnC,OAAOX,SAASK;CACpB;AACJ"}

package/dist/core/authentication/entities/index.d.ts

@@ -1,4 +1,3 @@
 export * from './client/index.ts';
-export * from './robot/index.ts';
 export * from './user/index.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/authentication/entities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/entities/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/entities/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC"}

package/dist/core/authentication/entities/index.mjs

@@ -3,8 +3,6 @@ import "node:url";
 import.meta.url;
 import { ClientAuthenticator } from "./client/module.mjs";
 import "./client/index.mjs";
-import { RobotAuthenticator } from "./robot/module.mjs";
-import "./robot/index.mjs";
 import { UserAuthenticator } from "./user/module.mjs";
 import "./user/index.mjs";
-export { ClientAuthenticator, RobotAuthenticator, UserAuthenticator };
+export { ClientAuthenticator, UserAuthenticator };

package/dist/core/authentication/index.d.ts

@@ -1,5 +1,6 @@
 export * from './credential/index.ts';
 export * from './entities/index.ts';
+export * from './login-throttle/index.ts';
 export * from './base.ts';
 export * from './module.ts';
 export * from './session/index.ts';

package/dist/core/authentication/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/authentication/index.ts"],"names":[],"mappings":"AAOA,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,WAAW,CAAC;AAC1B,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/authentication/index.ts"],"names":[],"mappings":"AAOA,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,WAAW,CAAC;AAC1B,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,YAAY,CAAC"}

package/dist/core/authentication/index.mjs

@@ -2,16 +2,16 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { ClientCredentialsService } from "./credential/entities/client/module.mjs";
-import { RobotCredentialsService } from "./credential/entities/robot/module.mjs";
 import { UserCredentialsService } from "./credential/entities/user/module.mjs";
 import "./credential/index.mjs";
 import { BaseCredentialsAuthenticator } from "./base.mjs";
 import { ClientAuthenticator } from "./entities/client/module.mjs";
-import { RobotAuthenticator } from "./entities/robot/module.mjs";
 import { UserAuthenticator } from "./entities/user/module.mjs";
 import "./entities/index.mjs";
+import { LoginThrottleService } from "./login-throttle/service.mjs";
+import "./login-throttle/index.mjs";
 import { CredentialsAuthenticator } from "./module.mjs";
 import { SessionManager } from "./session/module.mjs";
 import { SESSION_FILTER_KEYS } from "./session/types.mjs";
 import "./session/index.mjs";
-export { BaseCredentialsAuthenticator, ClientAuthenticator, ClientCredentialsService, CredentialsAuthenticator, RobotAuthenticator, RobotCredentialsService, SESSION_FILTER_KEYS, SessionManager, UserAuthenticator, UserCredentialsService };
+export { BaseCredentialsAuthenticator, ClientAuthenticator, ClientCredentialsService, CredentialsAuthenticator, LoginThrottleService, SESSION_FILTER_KEYS, SessionManager, UserAuthenticator, UserCredentialsService };

package/dist/core/authentication/login-throttle/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/login-throttle/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}

package/dist/core/authentication/login-throttle/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { LoginThrottleService } from "./service.mjs";
+export { LoginThrottleService };

package/dist/core/authentication/login-throttle/service.d.ts

@@ -0,0 +1,13 @@
+import type { IEventRepository } from '../../entities/index.ts';
+import type { ILoginThrottleService, LoginThrottleServiceContext, LoginThrottleServiceOptions } from './types.ts';
+export declare class LoginThrottleService implements ILoginThrottleService {
+    protected repository: IEventRepository;
+    protected options: LoginThrottleServiceOptions;
+    constructor(ctx: LoginThrottleServiceContext);
+    assertNotThrottled(ctx: {
+        identifier: string;
+        ipAddress?: string;
+        realmId?: string | null;
+    }): Promise<void>;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/core/authentication/login-throttle/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/login-throttle/service.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAKlH,qBAAa,oBAAqB,YAAW,qBAAqB;IAC9D,SAAS,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEvC,SAAS,CAAC,OAAO,EAAE,2BAA2B,CAAC;gBAEnC,GAAG,EAAE,2BAA2B;IAKtC,kBAAkB,CACpB,GAAG,EAAE;QACD,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAC1B,GACF,OAAO,CAAC,IAAI,CAAC;CA4BnB"}

package/dist/core/authentication/login-throttle/service.mjs

@@ -0,0 +1,33 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { EventName } from "@authup/core-kit";
+import { LoginThrottledError } from "@authup/errors";
+//#region src/core/authentication/login-throttle/service.ts
+const DEFAULT_THRESHOLD = 5;
+const DEFAULT_WINDOW_SECONDS = 900;
+var LoginThrottleService = class {
+	repository;
+	options;
+	constructor(ctx) {
+		this.repository = ctx.repository;
+		this.options = ctx.options ?? {};
+	}
+	async assertNotThrottled(ctx) {
+		if (!this.options.enabled) return;
+		if (!ctx.ipAddress) return;
+		const threshold = this.options.threshold ?? DEFAULT_THRESHOLD;
+		const windowSeconds = this.options.windowSeconds ?? DEFAULT_WINDOW_SECONDS;
+		if (await this.repository.countRecent({
+			name: EventName.LOGIN_FAILED,
+			actorName: ctx.identifier,
+			requestIpAddress: ctx.ipAddress,
+			realmId: ctx.realmId,
+			since: (/* @__PURE__ */ new Date(Date.now() - windowSeconds * 1e3)).toISOString()
+		}) >= threshold) throw new LoginThrottledError({ retryAfter: windowSeconds });
+	}
+};
+//#endregion
+export { LoginThrottleService };
+
+//# sourceMappingURL=service.mjs.map

package/dist/core/authentication/login-throttle/service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.mjs","names":["EventName","LoginThrottledError","DEFAULT_THRESHOLD","DEFAULT_WINDOW_SECONDS","LoginThrottleService","repository","options","ctx","assertNotThrottled","enabled","ipAddress","threshold","windowSeconds","count","countRecent","name","LOGIN_FAILED","actorName","identifier","requestIpAddress","realmId","since","Date","now","toISOString","retryAfter"],"sources":["../../../../src/core/authentication/login-throttle/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { EventName } from '@authup/core-kit';\nimport { LoginThrottledError } from '@authup/errors';\nimport type { IEventRepository } from '../../entities/index.ts';\nimport type { ILoginThrottleService, LoginThrottleServiceContext, LoginThrottleServiceOptions } from './types.ts';\n\nconst DEFAULT_THRESHOLD = 5;\nconst DEFAULT_WINDOW_SECONDS = 900;\n\nexport class LoginThrottleService implements ILoginThrottleService {\n    protected repository: IEventRepository;\n\n    protected options: LoginThrottleServiceOptions;\n\n    constructor(ctx: LoginThrottleServiceContext) {\n        this.repository = ctx.repository;\n        this.options = ctx.options ?? {};\n    }\n\n    async assertNotThrottled(\n        ctx: {\n            identifier: string, \n            ipAddress?: string, \n            realmId?: string | null \n        },\n    ): Promise<void> {\n        if (!this.options.enabled) {\n            return;\n        }\n\n        // The (identifier, ip) pair is the account-lockout-DoS mitigation: an\n        // attacker on one IP can never lock the victim's other IPs. Without a\n        // derivable IP the pair does not exist, so the throttle fails open\n        // instead of degrading to a lockable per-identifier key.\n        if (!ctx.ipAddress) {\n            return;\n        }\n\n        const threshold = this.options.threshold ?? DEFAULT_THRESHOLD;\n        const windowSeconds = this.options.windowSeconds ?? DEFAULT_WINDOW_SECONDS;\n\n        const count = await this.repository.countRecent({\n            name: EventName.LOGIN_FAILED,\n            actorName: ctx.identifier,\n            requestIpAddress: ctx.ipAddress,\n            realmId: ctx.realmId,\n            since: new Date(Date.now() - (windowSeconds * 1_000)).toISOString(),\n        });\n\n        if (count >= threshold) {\n            throw new LoginThrottledError({ retryAfter: windowSeconds });\n        }\n    }\n}\n"],"mappings":";;;;;;AAYA,MAAME,oBAAoB;AAC1B,MAAMC,yBAAyB;AAE/B,IAAaC,uBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAkC;EAC1C,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,UAAUC,IAAID,WAAW,CAAC;CACnC;CAEA,MAAME,mBACFD,KAKa;EACb,IAAI,CAAC,KAAKD,QAAQG,SACd;EAOJ,IAAI,CAACF,IAAIG,WACL;EAGJ,MAAMC,YAAY,KAAKL,QAAQK,aAAaT;EAC5C,MAAMU,gBAAgB,KAAKN,QAAQM,iBAAiBT;EAUpD,IAAIU,MARgB,KAAKR,WAAWS,YAAY;GAC5CC,MAAMf,UAAUgB;GAChBC,WAAWV,IAAIW;GACfC,kBAAkBZ,IAAIG;GACtBU,SAASb,IAAIa;GACbC,wBAAO,IAAIC,KAAKA,KAAKC,IAAG,IAAMX,gBAAgB,GAAA,EAAA,CAAQY,YAAW;EACrE,CAAA,KAEab,WACT,MAAM,IAAIV,oBAAoB,EAAEwB,YAAYb,cAAc,CAAA;CAElE;AACJ"}

package/dist/core/authentication/login-throttle/types.d.ts

@@ -0,0 +1,34 @@
+import type { IEventRepository } from '../../entities/index.ts';
+export type LoginThrottleServiceOptions = {
+    /**
+     * config.loginAttemptThrottleEnabled — default off.
+     */
+    enabled?: boolean;
+    /**
+     * config.loginAttemptThreshold — failed attempts per (identifier, ip) pair
+     * before the throttle trips. Default 5.
+     */
+    threshold?: number;
+    /**
+     * config.loginAttemptWindow — sliding window (seconds) the attempts are
+     * counted over. The window is also the lock: a success simply stops adding
+     * rows and the window slides past. Default 900.
+     */
+    windowSeconds?: number;
+};
+export type LoginThrottleServiceContext = {
+    repository: IEventRepository;
+    options?: LoginThrottleServiceOptions;
+};
+export interface ILoginThrottleService {
+    /**
+     * Throw LoginThrottledError when recent LOGIN_FAILED audit events for the
+     * (identifier, ip) pair hit the threshold.
+     */
+    assertNotThrottled(ctx: {
+        identifier: string;
+        ipAddress?: string;
+        realmId?: string | null;
+    }): Promise<void>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/authentication/login-throttle/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/login-throttle/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAEhE,MAAM,MAAM,2BAA2B,GAAG;IACtC;;OAEG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACtC,UAAU,EAAE,gBAAgB,CAAC;IAC7B,OAAO,CAAC,EAAE,2BAA2B,CAAC;CACzC,CAAC;AAEF,MAAM,WAAW,qBAAqB;IAClC;;;OAGG;IACH,kBAAkB,CAAC,GAAG,EAAE;QACpB,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAC1B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrB"}

package/dist/core/authentication/session/module.d.ts

@@ -12,6 +12,7 @@ export declare class SessionManager implements ISessionManager {
     create(input: Partial<Session>): Promise<Session>;
     ping(session: Session): Promise<Session>;
     refresh(session: Session): Promise<Session>;
+    markMfaVerified(session: Session): Promise<Session>;
     /**
      * Verify session on token inspection/verification.
      *

package/dist/core/authentication/session/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/session/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAGhD,OAAO,KAAK,EACR,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACxB,MAAM,YAAY,CAAC;AAEpB,qBAAa,cAAe,YAAW,eAAe;IAClD,SAAS,CAAC,OAAO,EAAE,qBAAqB,CAAC;IAEzC,SAAS,CAAC,UAAU,EAAE,kBAAkB,CAAC;gBAI7B,GAAG,EAAE,qBAAqB;IAOtC;;;;OAIG;IACG,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IA2BjD,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBxC,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAcjD;;;;;OAKG;IACG,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAMhD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMjC,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;CAShD"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/session/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAGhD,OAAO,KAAK,EACR,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACxB,MAAM,YAAY,CAAC;AAEpB,qBAAa,cAAe,YAAW,eAAe;IAClD,SAAS,CAAC,OAAO,EAAE,qBAAqB,CAAC;IAEzC,SAAS,CAAC,UAAU,EAAE,kBAAkB,CAAC;gBAI7B,GAAG,EAAE,qBAAqB;IAOtC;;;;OAIG;IACG,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAuBjD,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBxC,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAc3C,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAQzD;;;;;OAKG;IACG,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAMhD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMjC,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;CAShD"}

package/dist/core/authentication/session/module.mjs

@@ -16,34 +16,35 @@ var SessionManager = class {
 	*
 	* @param input
 	*/ async create(input) {
-		input.ip_address = input.ip_address || "127.0.0.1";
-		input.user_agent = input.user_agent || "system";
-		input.expires_at = input.expires_at || new Date(Date.now() + this.options.maxAge * 1e3).toISOString();
-		switch (input.sub_kind) {
+		input.ipAddress = input.ipAddress || "127.0.0.1";
+		input.userAgent = input.userAgent || "system";
+		input.expiresAt = input.expiresAt || new Date(Date.now() + this.options.maxAge * 1e3).toISOString();
+		switch (input.subKind) {
 			case IdentityType.CLIENT:
-				input.client_id = input.sub;
-				break;
-			case IdentityType.ROBOT:
-				input.robot_id = input.sub;
+				input.clientId = input.sub;
 				break;
 			case IdentityType.USER:
-				input.user_id = input.sub;
+				input.userId = input.sub;
 				break;
 		}
 		return this.repository.save(input);
 	}
 	async ping(session) {
-		if (session.seen_at) {
-			if (new Date(session.seen_at).getTime() + 5 * 1e3 > Date.now()) return session;
+		if (session.seenAt) {
+			if (new Date(session.seenAt).getTime() + 5 * 1e3 > Date.now()) return session;
 		}
-		session.seen_at = (/* @__PURE__ */ new Date()).toISOString();
+		session.seenAt = (/* @__PURE__ */ new Date()).toISOString();
 		return this.repository.save(session);
 	}
 	async refresh(session) {
 		const now = (/* @__PURE__ */ new Date()).toISOString();
-		session.refreshed_at = now;
-		session.seen_at = now;
-		session.expires_at = new Date(Date.now() + this.options.maxAge * 1e3).toISOString();
+		session.refreshedAt = now;
+		session.seenAt = now;
+		session.expiresAt = new Date(Date.now() + this.options.maxAge * 1e3).toISOString();
+		return this.repository.save(session);
+	}
+	async markMfaVerified(session) {
+		session.mfaAt = (/* @__PURE__ */ new Date()).toISOString();
 		return this.repository.save(session);
 	}
 	/**
@@ -58,7 +59,7 @@ var SessionManager = class {
 		await this.repository.removeById(id);
 	}
 	async verify(session) {
-		const ms = new Date(session.expires_at).getTime();
+		const ms = new Date(session.expiresAt).getTime();
 		if (Date.now() > ms) {
 			await this.repository.remove(session);
 			throw JWTError.expired();

package/dist/core/authentication/session/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["IdentityType","JWTError","SessionManager","options","repository","ctx","create","input","ip_address","user_agent","expires_at","Date","now","maxAge","toISOString","sub_kind","CLIENT","client_id","sub","ROBOT","robot_id","USER","user_id","save","ping","session","seen_at","seenAt","getTime","threshold","refresh","refreshed_at","findOneById","id","revoke","removeById","verify","ms","remove","expired"],"sources":["../../../../src/core/authentication/session/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Session } from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { JWTError } from '@authup/specs';\nimport type {\n    ISessionManager, \n    ISessionRepository, \n    SessionManagerContext, \n    SessionManagerOptions,\n} from './types.ts';\n\nexport class SessionManager implements ISessionManager {\n    protected options: SessionManagerOptions;\n\n    protected repository: ISessionRepository;\n\n    // -----------------------------------------------------\n\n    constructor(ctx: SessionManagerContext) {\n        this.options = ctx.options;\n        this.repository = ctx.repository;\n    }\n\n    // -----------------------------------------------------\n\n    /**\n     * Create/Update session\n     *\n     * @param input\n     */\n    async create(input: Partial<Session>): Promise<Session> {\n        input.ip_address = input.ip_address || '127.0.0.1';\n        input.user_agent = input.user_agent || 'system';\n        input.expires_at = input.expires_at || new Date(\n            Date.now() + (this.options.maxAge * 1_000),\n        ).toISOString();\n\n        switch (input.sub_kind) {\n            case IdentityType.CLIENT: {\n                input.client_id = input.sub;\n                break;\n            }\n            case IdentityType.ROBOT: {\n                input.robot_id = input.sub;\n                break;\n            }\n            case IdentityType.USER: {\n                input.user_id = input.sub;\n                break;\n            }\n        }\n\n        return this.repository.save(input);\n    }\n\n    // -----------------------------------------------------\n\n    async ping(session: Session): Promise<Session> {\n        if (session.seen_at) {\n            const seenAt = new Date(session.seen_at).getTime();\n            const threshold = seenAt + (5 * 1_000);\n\n            if (threshold > Date.now()) {\n                return session;\n            }\n        }\n\n        session.seen_at = new Date().toISOString();\n\n        return this.repository.save(session);\n    }\n\n    // -----------------------------------------------------\n\n    async refresh(session: Session): Promise<Session> {\n        const now = new Date().toISOString();\n        session.refreshed_at = now;\n        session.seen_at = now;\n\n        session.expires_at = new Date(\n            Date.now() + (this.options.maxAge * 1_000),\n        ).toISOString();\n\n        return this.repository.save(session);\n    }\n\n    // -----------------------------------------------------\n\n    /**\n     * Verify session on token inspection/verification.\n     *\n     * @param id\n     * @throws JWTError\n     */\n    async findOneById(id: string): Promise<Session | null> {\n        return this.repository.findOneById(id);\n    }\n\n    // -----------------------------------------------------\n\n    async revoke(id: string): Promise<void> {\n        await this.repository.removeById(id);\n    }\n\n    // -----------------------------------------------------\n\n    async verify(session: Session): Promise<void> {\n        const ms = new Date(session.expires_at).getTime();\n        if (Date.now() > ms) {\n            await this.repository.remove(session);\n\n            // todo: better error\n            throw JWTError.expired();\n        }\n    }\n}\n"],"mappings":";;;;;;AAiBA,IAAaE,iBAAb,MAAaA;CACCC;CAEAC;CAIV,YAAYC,KAA4B;EACpC,KAAKF,UAAUE,IAAIF;EACnB,KAAKC,aAAaC,IAAID;CAC1B;;;;;IASA,MAAME,OAAOC,OAA2C;EACpDA,MAAMC,aAAaD,MAAMC,cAAc;EACvCD,MAAME,aAAaF,MAAME,cAAc;EACvCF,MAAMG,aAAaH,MAAMG,cAAc,IAAIC,KACvCA,KAAKC,IAAG,IAAM,KAAKT,QAAQU,SAAS,GAAA,CAAA,CACtCC,YAAW;EAEb,QAAQP,MAAMQ,UAAd;GACI,KAAKf,aAAagB;IACdT,MAAMU,YAAYV,MAAMW;IACxB;GAEJ,KAAKlB,aAAamB;IACdZ,MAAMa,WAAWb,MAAMW;IACvB;GAEJ,KAAKlB,aAAaqB;IACdd,MAAMe,UAAUf,MAAMW;IACtB;EAER;EAEA,OAAO,KAAKd,WAAWmB,KAAKhB,KAAAA;CAChC;CAIA,MAAMiB,KAAKC,SAAoC;EAC3C,IAAIA,QAAQC;OACO,IAAIf,KAAKc,QAAQC,OAAO,CAAA,CAAEE,QACvBD,IAAU,IAAI,MAEhBhB,KAAKC,IAAG,GACpB,OAAOa;EAAAA;EAIfA,QAAQC,2BAAU,IAAIf,KAAAA,EAAAA,CAAOG,YAAW;EAExC,OAAO,KAAKV,WAAWmB,KAAKE,OAAAA;CAChC;CAIA,MAAMK,QAAQL,SAAoC;EAC9C,MAAMb,uBAAM,IAAID,KAAAA,EAAAA,CAAOG,YAAW;EAClCW,QAAQM,eAAenB;EACvBa,QAAQC,UAAUd;EAElBa,QAAQf,aAAa,IAAIC,KACrBA,KAAKC,IAAG,IAAM,KAAKT,QAAQU,SAAS,GAAA,CAAA,CACtCC,YAAW;EAEb,OAAO,KAAKV,WAAWmB,KAAKE,OAAAA;CAChC;;;;;;IAUA,MAAMO,YAAYC,IAAqC;EACnD,OAAO,KAAK7B,WAAW4B,YAAYC,EAAAA;CACvC;CAIA,MAAMC,OAAOD,IAA2B;EACpC,MAAM,KAAK7B,WAAW+B,WAAWF,EAAAA;CACrC;CAIA,MAAMG,OAAOX,SAAiC;EAC1C,MAAMY,KAAK,IAAI1B,KAAKc,QAAQf,UAAU,CAAA,CAAEkB,QAAO;EAC/C,IAAIjB,KAAKC,IAAG,IAAKyB,IAAI;GACjB,MAAM,KAAKjC,WAAWkC,OAAOb,OAAAA;GAG7B,MAAMxB,SAASsC,QAAO;EAC1B;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["IdentityType","JWTError","SessionManager","options","repository","ctx","create","input","ipAddress","userAgent","expiresAt","Date","now","maxAge","toISOString","subKind","CLIENT","clientId","sub","USER","userId","save","ping","session","seenAt","getTime","threshold","refresh","refreshedAt","markMfaVerified","mfaAt","findOneById","id","revoke","removeById","verify","ms","remove","expired"],"sources":["../../../../src/core/authentication/session/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Session } from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { JWTError } from '@authup/specs';\nimport type {\n    ISessionManager, \n    ISessionRepository, \n    SessionManagerContext, \n    SessionManagerOptions,\n} from './types.ts';\n\nexport class SessionManager implements ISessionManager {\n    protected options: SessionManagerOptions;\n\n    protected repository: ISessionRepository;\n\n    // -----------------------------------------------------\n\n    constructor(ctx: SessionManagerContext) {\n        this.options = ctx.options;\n        this.repository = ctx.repository;\n    }\n\n    // -----------------------------------------------------\n\n    /**\n     * Create/Update session\n     *\n     * @param input\n     */\n    async create(input: Partial<Session>): Promise<Session> {\n        input.ipAddress = input.ipAddress || '127.0.0.1';\n        input.userAgent = input.userAgent || 'system';\n        input.expiresAt = input.expiresAt || new Date(\n            Date.now() + (this.options.maxAge * 1_000),\n        ).toISOString();\n\n        switch (input.subKind) {\n            case IdentityType.CLIENT: {\n                input.clientId = input.sub;\n                break;\n            }\n            case IdentityType.USER: {\n                input.userId = input.sub;\n                break;\n            }\n        }\n\n        return this.repository.save(input);\n    }\n\n    // -----------------------------------------------------\n\n    async ping(session: Session): Promise<Session> {\n        if (session.seenAt) {\n            const seenAt = new Date(session.seenAt).getTime();\n            const threshold = seenAt + (5 * 1_000);\n\n            if (threshold > Date.now()) {\n                return session;\n            }\n        }\n\n        session.seenAt = new Date().toISOString();\n\n        return this.repository.save(session);\n    }\n\n    // -----------------------------------------------------\n\n    async refresh(session: Session): Promise<Session> {\n        const now = new Date().toISOString();\n        session.refreshedAt = now;\n        session.seenAt = now;\n\n        session.expiresAt = new Date(\n            Date.now() + (this.options.maxAge * 1_000),\n        ).toISOString();\n\n        return this.repository.save(session);\n    }\n\n    // -----------------------------------------------------\n\n    async markMfaVerified(session: Session): Promise<Session> {\n        session.mfaAt = new Date().toISOString();\n\n        return this.repository.save(session);\n    }\n\n    // -----------------------------------------------------\n\n    /**\n     * Verify session on token inspection/verification.\n     *\n     * @param id\n     * @throws JWTError\n     */\n    async findOneById(id: string): Promise<Session | null> {\n        return this.repository.findOneById(id);\n    }\n\n    // -----------------------------------------------------\n\n    async revoke(id: string): Promise<void> {\n        await this.repository.removeById(id);\n    }\n\n    // -----------------------------------------------------\n\n    async verify(session: Session): Promise<void> {\n        const ms = new Date(session.expiresAt).getTime();\n        if (Date.now() > ms) {\n            await this.repository.remove(session);\n\n            // todo: better error\n            throw JWTError.expired();\n        }\n    }\n}\n"],"mappings":";;;;;;AAiBA,IAAaE,iBAAb,MAAaA;CACCC;CAEAC;CAIV,YAAYC,KAA4B;EACpC,KAAKF,UAAUE,IAAIF;EACnB,KAAKC,aAAaC,IAAID;CAC1B;;;;;IASA,MAAME,OAAOC,OAA2C;EACpDA,MAAMC,YAAYD,MAAMC,aAAa;EACrCD,MAAME,YAAYF,MAAME,aAAa;EACrCF,MAAMG,YAAYH,MAAMG,aAAa,IAAIC,KACrCA,KAAKC,IAAG,IAAM,KAAKT,QAAQU,SAAS,GAAA,CAAA,CACtCC,YAAW;EAEb,QAAQP,MAAMQ,SAAd;GACI,KAAKf,aAAagB;IACdT,MAAMU,WAAWV,MAAMW;IACvB;GAEJ,KAAKlB,aAAamB;IACdZ,MAAMa,SAASb,MAAMW;IACrB;EAER;EAEA,OAAO,KAAKd,WAAWiB,KAAKd,KAAAA;CAChC;CAIA,MAAMe,KAAKC,SAAoC;EAC3C,IAAIA,QAAQC;OACO,IAAIb,KAAKY,QAAQC,MAAM,CAAA,CAAEC,QACtBD,IAAU,IAAI,MAEhBb,KAAKC,IAAG,GACpB,OAAOW;EAAAA;EAIfA,QAAQC,0BAAS,IAAIb,KAAAA,EAAAA,CAAOG,YAAW;EAEvC,OAAO,KAAKV,WAAWiB,KAAKE,OAAAA;CAChC;CAIA,MAAMI,QAAQJ,SAAoC;EAC9C,MAAMX,uBAAM,IAAID,KAAAA,EAAAA,CAAOG,YAAW;EAClCS,QAAQK,cAAchB;EACtBW,QAAQC,SAASZ;EAEjBW,QAAQb,YAAY,IAAIC,KACpBA,KAAKC,IAAG,IAAM,KAAKT,QAAQU,SAAS,GAAA,CAAA,CACtCC,YAAW;EAEb,OAAO,KAAKV,WAAWiB,KAAKE,OAAAA;CAChC;CAIA,MAAMM,gBAAgBN,SAAoC;EACtDA,QAAQO,yBAAQ,IAAInB,KAAAA,EAAAA,CAAOG,YAAW;EAEtC,OAAO,KAAKV,WAAWiB,KAAKE,OAAAA;CAChC;;;;;;IAUA,MAAMQ,YAAYC,IAAqC;EACnD,OAAO,KAAK5B,WAAW2B,YAAYC,EAAAA;CACvC;CAIA,MAAMC,OAAOD,IAA2B;EACpC,MAAM,KAAK5B,WAAW8B,WAAWF,EAAAA;CACrC;CAIA,MAAMG,OAAOZ,SAAiC;EAC1C,MAAMa,KAAK,IAAIzB,KAAKY,QAAQb,SAAS,CAAA,CAAEe,QAAO;EAC9C,IAAId,KAAKC,IAAG,IAAKwB,IAAI;GACjB,MAAM,KAAKhC,WAAWiC,OAAOd,OAAAA;GAG7B,MAAMtB,SAASqC,QAAO;EAC1B;CACJ;AACJ"}

package/dist/core/authentication/session/types.d.ts

@@ -1,4 +1,5 @@
 import type { Session } from '@authup/core-kit';
+import type { IQuery } from '@rapiq/core';
 import type { EntityRepositoryFindManyResult } from '@authup/server-kit';
 export type SessionOwner = {
     sub: string;
@@ -9,7 +10,7 @@ export type SessionOwner = {
  * repository's rapiq `filters.allowed` and the service's "is this a targeted
  * bulk revoke?" discriminator, so the two can never drift.
  */
-export declare const SESSION_FILTER_KEYS: readonly ["id", "sub", "sub_kind", "user_id", "client_id", "robot_id", "realm_id"];
+export declare const SESSION_FILTER_KEYS: readonly ["id", "sub", "subKind", "userId", "clientId", "realmId"];
 export type SessionFindManyOptions = {
     /**
      * Force the result to a single subject (self-service). Applied as a
@@ -19,7 +20,7 @@ export type SessionFindManyOptions = {
 };
 export interface ISessionRepository {
     findOneById(id: string): Promise<Session | null> | null;
-    findMany(query: Record<string, any>, options?: SessionFindManyOptions): Promise<EntityRepositoryFindManyResult<Session>>;
+    findMany(query: IQuery, options?: SessionFindManyOptions): Promise<EntityRepositoryFindManyResult<Session>>;
     findAllByOwner(owner: SessionOwner): Promise<Session[]>;
     /**
      * Load EVERY session matching a rapiq query filter — **unbounded** (no
@@ -27,7 +28,7 @@ export interface ISessionRepository {
      * the admin "force-logout" path; per-session authorization is enforced by
      * the caller (`SessionService`).
      */
-    findAllByQuery(query: Record<string, any>): Promise<Session[]>;
+    findAllByQuery(query: IQuery): Promise<Session[]>;
     save(session: Partial<Session>): Promise<Session>;
     removeById(id: string): Promise<void>;
     remove(session: Session): Promise<void>;
@@ -50,17 +51,23 @@ export interface ISessionManager {
      */
     create(session: Partial<Session>): Promise<Session>;
     /**
-     * Updates seen_at with current time.
+     * Updates seenAt with current time.
      *
      * @param session
      */
     ping(session: Session): Promise<Session>;
     /**
-     * Updates refreshed_at, seen_at with current time.
+     * Updates refreshedAt, seenAt with current time.
      *
      * @param session
      */
     refresh(session: Session): Promise<Session>;
+    /**
+     * Stamp a successful second-factor challenge (mfaAt) onto the session.
+     *
+     * @param session
+     */
+    markMfaVerified(session: Session): Promise<Session>;
     /**
      * Check if session exists and is valid.
      *

package/dist/core/authentication/session/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/session/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAEzE,MAAM,MAAM,YAAY,GAAG;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,oFAQtB,CAAC;AAEX,MAAM,MAAM,sBAAsB,GAAG;IACjC;;;OAGG;IACH,KAAK,CAAC,EAAE,YAAY,CAAC;CACxB,CAAC;AAEF,MAAM,WAAW,kBAAkB;IAC/B,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAExD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC,CAAC;IAEzH,cAAc,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAExD;;;;;OAKG;IACH,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAE/D,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAElD,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtC,MAAM,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5C;AAED,MAAM,MAAM,qBAAqB,GAAG;IAChC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;CACjB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAChC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,UAAU,EAAE,kBAAkB,CAAC;CAClC,CAAC;AAEF,MAAM,WAAW,eAAe;IAC5B;;;;OAIG;IACH,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpD;;;;OAIG;IACH,IAAI,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1C;;;;OAIG;IACH,OAAO,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE7C;;;;;OAKG;IACH,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAExC;;;;OAIG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAEjD;;;;;OAKG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/session/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAEzE,MAAM,MAAM,YAAY,GAAG;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,oEAOtB,CAAC;AAEX,MAAM,MAAM,sBAAsB,GAAG;IACjC;;;OAGG;IACH,KAAK,CAAC,EAAE,YAAY,CAAC;CACxB,CAAC;AAEF,MAAM,WAAW,kBAAkB;IAC/B,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAExD,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC,CAAC;IAE5G,cAAc,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAExD;;;;;OAKG;IACH,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAElD,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAElD,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtC,MAAM,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5C;AAED,MAAM,MAAM,qBAAqB,GAAG;IAChC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;CACjB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAChC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,UAAU,EAAE,kBAAkB,CAAC;CAClC,CAAC;AAEF,MAAM,WAAW,eAAe;IAC5B;;;;OAIG;IACH,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpD;;;;OAIG;IACH,IAAI,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1C;;;;OAIG;IACH,OAAO,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE7C;;;;OAIG;IACH,eAAe,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAErD;;;;;OAKG;IACH,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAExC;;;;OAIG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAEjD;;;;;OAKG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC"}

package/dist/core/authentication/session/types.mjs

@@ -9,11 +9,10 @@ import.meta.url;
 */ const SESSION_FILTER_KEYS = [
 	"id",
 	"sub",
-	"sub_kind",
-	"user_id",
-	"client_id",
-	"robot_id",
-	"realm_id"
+	"subKind",
+	"userId",
+	"clientId",
+	"realmId"
 ];
 //#endregion
 export { SESSION_FILTER_KEYS };

package/dist/core/authentication/session/types.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.mjs","names":["SESSION_FILTER_KEYS"],"sources":["../../../../src/core/authentication/session/types.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Session } from '@authup/core-kit';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\n\nexport type SessionOwner = {\n    sub: string,\n    subKind: string,\n};\n\n/**\n * Filter keys a session query (list + bulk revoke) may target. Shared by the\n * repository's rapiq `filters.allowed` and the service's \"is this a targeted\n * bulk revoke?\" discriminator, so the two can never drift.\n */\nexport const SESSION_FILTER_KEYS = [\n    'id',\n    'sub',\n    'sub_kind',\n    'user_id',\n    'client_id',\n    'robot_id',\n    'realm_id',\n] as const;\n\nexport type SessionFindManyOptions = {\n    /**\n     * Force the result to a single subject (self-service). Applied as a\n     * mandatory WHERE that a rapiq query filter cannot override.\n     */\n    owner?: SessionOwner,\n};\n\nexport interface ISessionRepository {\n    findOneById(id: string): Promise<Session | null> | null;\n\n    findMany(query: Record<string, any>, options?: SessionFindManyOptions): Promise<EntityRepositoryFindManyResult<Session>>;\n\n    findAllByOwner(owner: SessionOwner): Promise<Session[]>;\n\n    /**\n     * Load EVERY session matching a rapiq query filter — **unbounded** (no\n     * pagination cap), because a bulk revoke must reach every match. Used by\n     * the admin \"force-logout\" path; per-session authorization is enforced by\n     * the caller (`SessionService`).\n     */\n    findAllByQuery(query: Record<string, any>): Promise<Session[]>;\n\n    save(session: Partial<Session>): Promise<Session>;\n\n    removeById(id: string): Promise<void>;\n\n    remove(session: Session) : Promise<void>;\n}\n\nexport type SessionManagerOptions = {\n    /**\n     * Max age in seconds (sec).\n     */\n    maxAge: number\n};\n\nexport type SessionManagerContext = {\n    options: SessionManagerOptions,\n    repository: ISessionRepository,\n};\n\nexport interface ISessionManager {\n    /**\n     * Create new session.\n     *\n     * @param session\n     */\n    create(session: Partial<Session>): Promise<Session>;\n\n    /**\n     * Updates seen_at with current time.\n     *\n     * @param session\n     */\n    ping(session: Session) : Promise<Session>;\n\n    /**\n     * Updates refreshed_at, seen_at with current time.\n     *\n     * @param session\n     */\n    refresh(session: Session) : Promise<Session>;\n\n    /**\n     * Check if session exists and is valid.\n     *\n     * @throws JWTError\n     * @param session\n     */\n    verify(session: Session): Promise<void>;\n\n    /**\n     * Find session by id.\n     *\n     * @param id\n     */\n    findOneById(id: string): Promise<Session | null>;\n\n    /**\n     * Revoke (delete) a session by id, forcing re-authentication. Idempotent —\n     * a no-op when the session does not exist.\n     *\n     * @param id\n     */\n    revoke(id: string): Promise<void>;\n}\n"],"mappings":";;;;;;;;GAoBA,MAAaA,sBAAsB;CAC/B;CACA;CACA;CACA;CACA;CACA;CACA"}
+{"version":3,"file":"types.mjs","names":["SESSION_FILTER_KEYS"],"sources":["../../../../src/core/authentication/session/types.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Session } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\n\nexport type SessionOwner = {\n    sub: string,\n    subKind: string,\n};\n\n/**\n * Filter keys a session query (list + bulk revoke) may target. Shared by the\n * repository's rapiq `filters.allowed` and the service's \"is this a targeted\n * bulk revoke?\" discriminator, so the two can never drift.\n */\nexport const SESSION_FILTER_KEYS = [\n    'id',\n    'sub',\n    'subKind',\n    'userId',\n    'clientId',\n    'realmId',\n] as const;\n\nexport type SessionFindManyOptions = {\n    /**\n     * Force the result to a single subject (self-service). Applied as a\n     * mandatory WHERE that a rapiq query filter cannot override.\n     */\n    owner?: SessionOwner,\n};\n\nexport interface ISessionRepository {\n    findOneById(id: string): Promise<Session | null> | null;\n\n    findMany(query: IQuery, options?: SessionFindManyOptions): Promise<EntityRepositoryFindManyResult<Session>>;\n\n    findAllByOwner(owner: SessionOwner): Promise<Session[]>;\n\n    /**\n     * Load EVERY session matching a rapiq query filter — **unbounded** (no\n     * pagination cap), because a bulk revoke must reach every match. Used by\n     * the admin \"force-logout\" path; per-session authorization is enforced by\n     * the caller (`SessionService`).\n     */\n    findAllByQuery(query: IQuery): Promise<Session[]>;\n\n    save(session: Partial<Session>): Promise<Session>;\n\n    removeById(id: string): Promise<void>;\n\n    remove(session: Session) : Promise<void>;\n}\n\nexport type SessionManagerOptions = {\n    /**\n     * Max age in seconds (sec).\n     */\n    maxAge: number\n};\n\nexport type SessionManagerContext = {\n    options: SessionManagerOptions,\n    repository: ISessionRepository,\n};\n\nexport interface ISessionManager {\n    /**\n     * Create new session.\n     *\n     * @param session\n     */\n    create(session: Partial<Session>): Promise<Session>;\n\n    /**\n     * Updates seenAt with current time.\n     *\n     * @param session\n     */\n    ping(session: Session) : Promise<Session>;\n\n    /**\n     * Updates refreshedAt, seenAt with current time.\n     *\n     * @param session\n     */\n    refresh(session: Session) : Promise<Session>;\n\n    /**\n     * Stamp a successful second-factor challenge (mfaAt) onto the session.\n     *\n     * @param session\n     */\n    markMfaVerified(session: Session) : Promise<Session>;\n\n    /**\n     * Check if session exists and is valid.\n     *\n     * @throws JWTError\n     * @param session\n     */\n    verify(session: Session): Promise<void>;\n\n    /**\n     * Find session by id.\n     *\n     * @param id\n     */\n    findOneById(id: string): Promise<Session | null>;\n\n    /**\n     * Revoke (delete) a session by id, forcing re-authentication. Idempotent —\n     * a no-op when the session does not exist.\n     *\n     * @param id\n     */\n    revoke(id: string): Promise<void>;\n}\n"],"mappings":";;;;;;;;GAqBA,MAAaA,sBAAsB;CAC/B;CACA;CACA;CACA;CACA;CACA"}

package/dist/core/client-certificate/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/client-certificate/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/client-certificate/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { ClientCertificateValidator, assertClientCertificateEvidenceValidForBinding, buildClientCertificateThumbprint, parseClientCertificateChain } from "./module.mjs";
+export { ClientCertificateValidator, assertClientCertificateEvidenceValidForBinding, buildClientCertificateThumbprint, parseClientCertificateChain };

package/dist/core/client-certificate/module.d.ts

@@ -0,0 +1,19 @@
+import './reflect.ts';
+import { X509Certificate } from '@peculiar/x509';
+import type { Client } from '@authup/core-kit';
+import type { ClientCertificateEvidence, ClientCertificateValidatorContext, IClientCertificateValidator } from './types.ts';
+/**
+ * Validates client certificates without performing network I/O. AIA, CRL,
+ * and OCSP retrieval are deliberately outside the external-PKI first slice.
+ */
+export declare class ClientCertificateValidator implements IClientCertificateValidator {
+    protected trustAnchorRepository: ClientCertificateValidatorContext['trustAnchorRepository'];
+    protected crypto?: Crypto;
+    constructor(ctx: ClientCertificateValidatorContext);
+    validateForBinding(evidence: ClientCertificateEvidence): void;
+    validateForAuthentication(client: Pick<Client, 'id' | 'realmId'>, evidence: ClientCertificateEvidence): Promise<void>;
+}
+export declare function assertClientCertificateEvidenceValidForBinding(evidence: ClientCertificateEvidence): void;
+export declare function parseClientCertificateChain(pem: string): X509Certificate[];
+export declare function buildClientCertificateThumbprint(certificate: X509Certificate, crypto?: Crypto): Promise<string>;
+//# sourceMappingURL=module.d.ts.map

package/dist/core/client-certificate/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/core/client-certificate/module.ts"],"names":[],"mappings":"AAOA,OAAO,cAAc,CAAC;AACtB,OAAO,EAUH,eAAe,EAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,kBAAkB,CAAC;AAO5D,OAAO,KAAK,EACR,yBAAyB,EACzB,iCAAiC,EACjC,2BAA2B,EAC9B,MAAM,YAAY,CAAC;AAuCpB;;;GAGG;AACH,qBAAa,0BAA2B,YAAW,2BAA2B;IAC1E,SAAS,CAAC,qBAAqB,EAAE,iCAAiC,CAAC,uBAAuB,CAAC,CAAC;IAE5F,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,iCAAiC;IAKlD,kBAAkB,CAAC,QAAQ,EAAE,yBAAyB,GAAG,IAAI;IAIvD,yBAAyB,CAC3B,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,SAAS,CAAC,EACtC,QAAQ,EAAE,yBAAyB,GACpC,OAAO,CAAC,IAAI,CAAC;CA0CnB;AAED,wBAAgB,8CAA8C,CAC1D,QAAQ,EAAE,yBAAyB,GACpC,IAAI,CAON;AAED,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,EAAE,CAW1E;AAED,wBAAsB,gCAAgC,CAClD,WAAW,EAAE,eAAe,EAC5B,MAAM,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAMjB"}