@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.54

package/dist/core/oauth2/access-policy/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/access-policy/module.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAc,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAC/D,OAAO,KAAK,EACR,4BAA4B,EAC5B,2BAA2B,EAC3B,kCAAkC,EACrC,MAAM,YAAY,CAAC;AAEpB,qBAAa,2BAA4B,YAAW,4BAA4B;IAC5E,SAAS,CAAC,cAAc,EAAG,2BAA2B,CAAC;IAEvD,SAAS,CAAC,MAAM,EAAG,YAAY,CAAC;IAEhC,SAAS,CAAC,MAAM,CAAC,EAAG,MAAM,CAAC;gBAEf,GAAG,EAAE,kCAAkC;IAM7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC;CAoBlF"}

package/dist/core/oauth2/access-policy/module.mjs

@@ -0,0 +1,32 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { PolicyEngine as PolicyEngine$1 } from "../../security/policy/engine.mjs";
+import { BuiltInPolicyType, PolicyData, definePolicyEvaluationContext } from "@authup/access";
+//#region src/core/oauth2/access-policy/module.ts
+var OAuth2AccessPolicyEvaluator = class {
+	policyProvider;
+	engine;
+	logger;
+	constructor(ctx) {
+		this.policyProvider = ctx.policyProvider;
+		this.engine = new PolicyEngine$1(ctx.identityPermissionProvider);
+		this.logger = ctx.logger;
+	}
+	async evaluate(policyId, subject) {
+		let tree;
+		try {
+			tree = await this.policyProvider.findDescendantsTreeById(policyId);
+		} catch (e) {
+			this.logger?.warn(`Loading the access policy ${policyId} failed.`, { error: e });
+			return false;
+		}
+		if (!tree) return false;
+		const ctx = definePolicyEvaluationContext({ data: new PolicyData({ [BuiltInPolicyType.IDENTITY]: subject }) });
+		return (await this.engine.evaluate(tree, ctx)).success;
+	}
+};
+//#endregion
+export { OAuth2AccessPolicyEvaluator };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/access-policy/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["BuiltInPolicyType","PolicyData","definePolicyEvaluationContext","PolicyEngine","OAuth2AccessPolicyEvaluator","policyProvider","engine","logger","ctx","identityPermissionProvider","evaluate","policyId","subject","tree","findDescendantsTreeById","e","warn","error","data","IDENTITY","result","success"],"sources":["../../../../src/core/oauth2/access-policy/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    BuiltInPolicyType,\n    PolicyData,\n    definePolicyEvaluationContext,\n} from '@authup/access';\nimport type { BasePolicy, IdentityPolicyData } from '@authup/access';\nimport type { Logger } from '@authup/server-kit';\nimport { PolicyEngine } from '../../security/policy/engine.ts';\nimport type {\n    IOAuth2AccessPolicyEvaluator,\n    IOAuth2AccessPolicyProvider,\n    OAuth2AccessPolicyEvaluatorContext,\n} from './types.ts';\n\nexport class OAuth2AccessPolicyEvaluator implements IOAuth2AccessPolicyEvaluator {\n    protected policyProvider : IOAuth2AccessPolicyProvider;\n\n    protected engine : PolicyEngine;\n\n    protected logger? : Logger;\n\n    constructor(ctx: OAuth2AccessPolicyEvaluatorContext) {\n        this.policyProvider = ctx.policyProvider;\n        this.engine = new PolicyEngine(ctx.identityPermissionProvider);\n        this.logger = ctx.logger;\n    }\n\n    async evaluate(policyId: string, subject: IdentityPolicyData): Promise<boolean> {\n        let tree : BasePolicy | null;\n\n        try {\n            tree = await this.policyProvider.findDescendantsTreeById(policyId);\n        } catch (e) {\n            this.logger?.warn(`Loading the access policy ${policyId} failed.`, { error: e });\n            return false;\n        }\n\n        if (!tree) {\n            return false;\n        }\n\n        const ctx = definePolicyEvaluationContext({ data: new PolicyData({ [BuiltInPolicyType.IDENTITY]: subject }) });\n\n        const result = await this.engine.evaluate(tree, ctx);\n\n        return result.success;\n    }\n}\n"],"mappings":";;;;;;AAqBA,IAAaI,8BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAAyC;EACjD,KAAKH,iBAAiBG,IAAIH;EAC1B,KAAKC,SAAS,IAAIH,eAAaK,IAAIC,0BAA0B;EAC7D,KAAKF,SAASC,IAAID;CACtB;CAEA,MAAMG,SAASC,UAAkBC,SAA+C;EAC5E,IAAIC;EAEJ,IAAI;GACAA,OAAO,MAAM,KAAKR,eAAeS,wBAAwBH,QAAAA;EAC7D,SAASI,GAAG;GACR,KAAKR,QAAQS,KAAK,6BAA6BL,SAAS,WAAW,EAAEM,OAAOF,EAAE,CAAA;GAC9E,OAAO;EACX;EAEA,IAAI,CAACF,MACD,OAAO;EAGX,MAAML,MAAMN,8BAA8B,EAAEgB,MAAM,IAAIjB,WAAW,GAAGD,kBAAkBmB,WAAWP,QAAQ,CAAA,EAAG,CAAA;EAI5G,QAAOQ,MAFc,KAAKd,OAAOI,SAASG,MAAML,GAAAA,EAAAA,CAElCa;CAClB;AACJ"}

package/dist/core/oauth2/access-policy/types.d.ts

@@ -0,0 +1,19 @@
+import type { BasePolicy, IdentityPolicyData } from '@authup/access';
+import type { Logger } from '@authup/server-kit';
+import type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';
+export interface IOAuth2AccessPolicyEvaluator {
+    /**
+     * true = access permitted. A present-but-unresolvable policy id,
+     * a load failure, or an evaluation failure all yield false (fail closed).
+     */
+    evaluate(policyId: string, subject: IdentityPolicyData): Promise<boolean>;
+}
+export interface IOAuth2AccessPolicyProvider {
+    findDescendantsTreeById(id: string): Promise<BasePolicy | null>;
+}
+export type OAuth2AccessPolicyEvaluatorContext = {
+    policyProvider: IOAuth2AccessPolicyProvider;
+    identityPermissionProvider: IIdentityPermissionProvider;
+    logger?: Logger;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/core/oauth2/access-policy/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/access-policy/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAEtF,MAAM,WAAW,4BAA4B;IACzC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7E;AAED,MAAM,WAAW,2BAA2B;IACxC,uBAAuB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;CACnE;AAED,MAAM,MAAM,kCAAkC,GAAG;IAC7C,cAAc,EAAE,2BAA2B,CAAC;IAC5C,0BAA0B,EAAE,2BAA2B,CAAC;IACxD,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC"}

package/dist/core/oauth2/authorization/code/issuer/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code/issuer/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,uBAAuB,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAE1G,OAAO,KAAK,EAAE,kCAAkC,EAAgC,MAAM,wBAAwB,CAAC;AAC/G,OAAO,KAAK,EAAE,8BAA8B,EAAE,oCAAoC,EAAE,MAAM,YAAY,CAAC;AAEvG,qBAAa,6BAA8B,YAAW,8BAA8B;IAChF,SAAS,CAAC,UAAU,EAAE,kCAAkC,CAAC;IAEzD,SAAS,CAAC,OAAO,EAAE,oCAAoC,CAAC;gBAGpD,UAAU,EAAE,kCAAkC,EAC9C,OAAO,GAAE,oCAAyC;IAMhD,KAAK,CACP,KAAK,EAAE,8BAA8B,EACrC,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,oCAAyC,GAClD,OAAO,CAAC,uBAAuB,CAAC;CA+BvC"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code/issuer/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,uBAAuB,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAE1G,OAAO,KAAK,EAAE,kCAAkC,EAAgC,MAAM,wBAAwB,CAAC;AAC/G,OAAO,KAAK,EAAE,8BAA8B,EAAE,oCAAoC,EAAE,MAAM,YAAY,CAAC;AAEvG,qBAAa,6BAA8B,YAAW,8BAA8B;IAChF,SAAS,CAAC,UAAU,EAAE,kCAAkC,CAAC;IAEzD,SAAS,CAAC,OAAO,EAAE,oCAAoC,CAAC;gBAGpD,UAAU,EAAE,kCAAkC,EAC9C,OAAO,GAAE,oCAAyC;IAMhD,KAAK,CACP,KAAK,EAAE,8BAA8B,EACrC,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,oCAAyC,GAClD,OAAO,CAAC,uBAAuB,CAAC;CAiCvC"}

package/dist/core/oauth2/authorization/code/issuer/module.mjs

@@ -20,7 +20,9 @@ var OAuth2AuthorizationCodeIssuer = class {
 			nonce: input.nonce,
 			code_challenge: input.code_challenge,
 			code_challenge_method: input.code_challenge_method,
+			acr_values: input.acr_values ?? null,
 			auth_time: options.authTime ?? Math.floor(Date.now() / 1e3),
+			auth_method: options.authMethod ?? null,
 			realm_id: realm.id,
 			realm_name: realm.name,
 			sub: identity.data.id,

package/dist/core/oauth2/authorization/code/issuer/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2RequestError","OAuth2AuthorizationCodeIssuer","repository","options","issue","input","identity","realm","data","identityInvalid","entity","redirect_uri","client_id","scope","nonce","code_challenge","code_challenge_method","auth_time","authTime","Math","floor","Date","now","realm_id","id","realm_name","name","sub","sub_kind","type","sessionId","session_id","save","maxAge"],"sources":["../../../../../../src/core/oauth2/authorization/code/issuer/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Identity, OAuth2AuthorizationCode, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport { OAuth2RequestError } from '@authup/specs';\nimport type { IOAuth2AuthorizationCodeRepository, OAuth2AuthorizationCodeInput } from '../repository/index.ts';\nimport type { IOAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeIssuerOptions } from './types.ts';\n\nexport class OAuth2AuthorizationCodeIssuer implements IOAuth2AuthorizationCodeIssuer {\n    protected repository: IOAuth2AuthorizationCodeRepository;\n\n    protected options: OAuth2AuthorizationCodeIssuerOptions;\n\n    constructor(\n        repository: IOAuth2AuthorizationCodeRepository,\n        options: OAuth2AuthorizationCodeIssuerOptions = {},\n    ) {\n        this.repository = repository;\n        this.options = options;\n    }\n\n    async issue(\n        input: OAuth2AuthorizationCodeRequest,\n        identity: Identity,\n        options: OAuth2AuthorizationCodeIssuerOptions = {},\n    ) : Promise<OAuth2AuthorizationCode> {\n        // The code carries the identity's realm id + name. A dangling realm\n        // relation (realm row deleted without cascade) must fail closed as a\n        // clean OAuth2 error — never a TypeError → 500.\n        const { realm } = identity.data;\n        if (!realm) {\n            throw OAuth2RequestError.identityInvalid();\n        }\n\n        const entity: OAuth2AuthorizationCodeInput = {\n            redirect_uri: input.redirect_uri,\n            client_id: input.client_id,\n            scope: input.scope,\n            nonce: input.nonce,\n            code_challenge: input.code_challenge,\n            code_challenge_method: input.code_challenge_method,\n\n            auth_time: options.authTime ?? Math.floor(Date.now() / 1000),\n\n            realm_id: realm.id,\n            realm_name: realm.name,\n            sub: identity.data.id,\n            sub_kind: identity.type,\n        };\n\n        if (options.sessionId) {\n            entity.session_id = options.sessionId;\n        }\n\n        return this.repository.save(entity, { maxAge: options.maxAge ?? this.options.maxAge });\n    }\n}\n"],"mappings":";;;;;AAYA,IAAaC,gCAAb,MAAaA;CACCC;CAEAC;CAEV,YACID,YACAC,UAAgD,CAAC,GACnD;EACE,KAAKD,aAAaA;EAClB,KAAKC,UAAUA;CACnB;CAEA,MAAMC,MACFC,OACAC,UACAH,UAAgD,CAAC,GAChB;EAIjC,MAAM,EAAEI,UAAUD,SAASE;EAC3B,IAAI,CAACD,OACD,MAAMP,mBAAmBS,gBAAe;EAG5C,MAAMC,SAAuC;GACzCC,cAAcN,MAAMM;GACpBC,WAAWP,MAAMO;GACjBC,OAAOR,MAAMQ;GACbC,OAAOT,MAAMS;GACbC,gBAAgBV,MAAMU;GACtBC,uBAAuBX,MAAMW;GAE7BC,WAAWd,QAAQe,YAAYC,KAAKC,MAAMC,KAAKC,IAAG,IAAK,GAAA;GAEvDC,UAAUhB,MAAMiB;GAChBC,YAAYlB,MAAMmB;GAClBC,KAAKrB,SAASE,KAAKgB;GACnBI,UAAUtB,SAASuB;EACvB;EAEA,IAAI1B,QAAQ2B,WACRpB,OAAOqB,aAAa5B,QAAQ2B;EAGhC,OAAO,KAAK5B,WAAW8B,KAAKtB,QAAQ,EAAEuB,QAAQ9B,QAAQ8B,UAAU,KAAK9B,QAAQ8B,OAAO,CAAA;CACxF;AACJ"}
+{"version":3,"file":"module.mjs","names":["OAuth2RequestError","OAuth2AuthorizationCodeIssuer","repository","options","issue","input","identity","realm","data","identityInvalid","entity","redirect_uri","client_id","scope","nonce","code_challenge","code_challenge_method","acr_values","auth_time","authTime","Math","floor","Date","now","auth_method","authMethod","realm_id","id","realm_name","name","sub","sub_kind","type","sessionId","session_id","save","maxAge"],"sources":["../../../../../../src/core/oauth2/authorization/code/issuer/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Identity, OAuth2AuthorizationCode, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport { OAuth2RequestError } from '@authup/specs';\nimport type { IOAuth2AuthorizationCodeRepository, OAuth2AuthorizationCodeInput } from '../repository/index.ts';\nimport type { IOAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeIssuerOptions } from './types.ts';\n\nexport class OAuth2AuthorizationCodeIssuer implements IOAuth2AuthorizationCodeIssuer {\n    protected repository: IOAuth2AuthorizationCodeRepository;\n\n    protected options: OAuth2AuthorizationCodeIssuerOptions;\n\n    constructor(\n        repository: IOAuth2AuthorizationCodeRepository,\n        options: OAuth2AuthorizationCodeIssuerOptions = {},\n    ) {\n        this.repository = repository;\n        this.options = options;\n    }\n\n    async issue(\n        input: OAuth2AuthorizationCodeRequest,\n        identity: Identity,\n        options: OAuth2AuthorizationCodeIssuerOptions = {},\n    ) : Promise<OAuth2AuthorizationCode> {\n        // The code carries the identity's realm id + name. A dangling realm\n        // relation (realm row deleted without cascade) must fail closed as a\n        // clean OAuth2 error — never a TypeError → 500.\n        const { realm } = identity.data;\n        if (!realm) {\n            throw OAuth2RequestError.identityInvalid();\n        }\n\n        const entity: OAuth2AuthorizationCodeInput = {\n            redirect_uri: input.redirect_uri,\n            client_id: input.client_id,\n            scope: input.scope,\n            nonce: input.nonce,\n            code_challenge: input.code_challenge,\n            code_challenge_method: input.code_challenge_method,\n            acr_values: input.acr_values ?? null,\n\n            auth_time: options.authTime ?? Math.floor(Date.now() / 1000),\n            auth_method: options.authMethod ?? null,\n\n            realm_id: realm.id,\n            realm_name: realm.name,\n            sub: identity.data.id,\n            sub_kind: identity.type,\n        };\n\n        if (options.sessionId) {\n            entity.session_id = options.sessionId;\n        }\n\n        return this.repository.save(entity, { maxAge: options.maxAge ?? this.options.maxAge });\n    }\n}\n"],"mappings":";;;;;AAYA,IAAaC,gCAAb,MAAaA;CACCC;CAEAC;CAEV,YACID,YACAC,UAAgD,CAAC,GACnD;EACE,KAAKD,aAAaA;EAClB,KAAKC,UAAUA;CACnB;CAEA,MAAMC,MACFC,OACAC,UACAH,UAAgD,CAAC,GAChB;EAIjC,MAAM,EAAEI,UAAUD,SAASE;EAC3B,IAAI,CAACD,OACD,MAAMP,mBAAmBS,gBAAe;EAG5C,MAAMC,SAAuC;GACzCC,cAAcN,MAAMM;GACpBC,WAAWP,MAAMO;GACjBC,OAAOR,MAAMQ;GACbC,OAAOT,MAAMS;GACbC,gBAAgBV,MAAMU;GACtBC,uBAAuBX,MAAMW;GAC7BC,YAAYZ,MAAMY,cAAc;GAEhCC,WAAWf,QAAQgB,YAAYC,KAAKC,MAAMC,KAAKC,IAAG,IAAK,GAAA;GACvDC,aAAarB,QAAQsB,cAAc;GAEnCC,UAAUnB,MAAMoB;GAChBC,YAAYrB,MAAMsB;GAClBC,KAAKxB,SAASE,KAAKmB;GACnBI,UAAUzB,SAAS0B;EACvB;EAEA,IAAI7B,QAAQ8B,WACRvB,OAAOwB,aAAa/B,QAAQ8B;EAGhC,OAAO,KAAK/B,WAAWiC,KAAKzB,QAAQ,EAAE0B,QAAQjC,QAAQiC,UAAU,KAAKjC,QAAQiC,OAAO,CAAA;CACxF;AACJ"}

package/dist/core/oauth2/authorization/code/issuer/types.d.ts

@@ -1,4 +1,4 @@
-import type { Identity, OAuth2AuthorizationCode, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';
+import type { Identity, OAuth2AuthorizationCode, OAuth2AuthorizationCodeRequest, SessionAuthMethod } from '@authup/core-kit';
 export type OAuth2AuthorizationCodeIssuerOptions = {
     /**
      * Max duration in seconds
@@ -15,6 +15,11 @@ export type OAuth2AuthorizationCodeIssuerOptions = {
      * Defaults to the issuance instant (session-less flows authenticate now).
      */
     authTime?: number;
+    /**
+     * How the subject authenticated (SessionAuthMethod) — persisted on the
+     * code so a session created at the /token exchange inherits it.
+     */
+    authMethod?: `${SessionAuthMethod}` | null;
 };
 export interface IOAuth2AuthorizationCodeIssuer {
     issue(input: OAuth2AuthorizationCodeRequest, identity: Identity, options?: OAuth2AuthorizationCodeIssuerOptions): Promise<OAuth2AuthorizationCode>;

package/dist/core/oauth2/authorization/code/issuer/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code/issuer/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,uBAAuB,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAE1G,MAAM,MAAM,oCAAoC,GAAG;IAC/C;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,WAAW,8BAA8B;IAC3C,KAAK,CACD,KAAK,EAAE,8BAA8B,EACrC,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE,oCAAoC,GAC9C,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACxC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code/issuer/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,QAAQ,EACR,uBAAuB,EACvB,8BAA8B,EAC9B,iBAAiB,EACpB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,MAAM,oCAAoC,GAAG;IAC/C;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,UAAU,CAAC,EAAE,GAAG,iBAAiB,EAAE,GAAG,IAAI,CAAC;CAC9C,CAAC;AAEF,MAAM,WAAW,8BAA8B;IAC3C,KAAK,CACD,KAAK,EAAE,8BAA8B,EACrC,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE,oCAAoC,GAC9C,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACxC"}

package/dist/core/oauth2/authorization/code/verifier/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2AuthorizationCodeChallengeMethod","OAuth2GrantError","buildOAuth2CodeChallenge","OAuth2AuthorizationCodeVerifier","repository","verify","code","options","entity","popOneById","invalid","client_id","clientId","realmId","realm_id","redirect_uri","redirectUri","redirectUriMismatch","clientIsPublic","code_challenge","codeVerifier","code_challenge_method","SHA_256","codeVerifierHash"],"sources":["../../../../../../src/core/oauth2/authorization/code/verifier/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2AuthorizationCode } from '@authup/core-kit';\nimport { OAuth2AuthorizationCodeChallengeMethod, OAuth2GrantError } from '@authup/specs';\nimport { buildOAuth2CodeChallenge } from '../../helpers.ts';\n\nimport type { IOAuth2AuthorizationCodeRepository } from '../repository/index.ts';\nimport type { IOAuth2AuthorizationCodeVerifier, IOAuth2AuthorizationCodeVerifyOptions } from './types.ts';\n\nexport class OAuth2AuthorizationCodeVerifier implements IOAuth2AuthorizationCodeVerifier {\n    protected repository : IOAuth2AuthorizationCodeRepository;\n\n    constructor(repository: IOAuth2AuthorizationCodeRepository) {\n        this.repository = repository;\n    }\n\n    async verify(code: string, options: IOAuth2AuthorizationCodeVerifyOptions) : Promise<OAuth2AuthorizationCode> {\n        const entity = await this.repository.popOneById(code);\n        if (!entity) {\n            throw OAuth2GrantError.invalid();\n        }\n\n        // RFC 6749 §4.1.3: if the client was issued a client_id, verify the\n        // authorization code was issued to the authenticated client. Always\n        // require a clientId to be supplied so a malformed token request can't\n        // bypass the binding by omitting it.\n        if (entity.client_id) {\n            if (!options.clientId || options.clientId !== entity.client_id) {\n                throw OAuth2GrantError.invalid();\n            }\n        }\n\n        // Realm binding (defense in depth): the code's realm (the authorizing\n        // identity's realm) must match the authenticated client's realm. Blocks\n        // redeeming a realm-A identity's code against a realm-B client — covers\n        // codes minted outside OAuth2Authorization.authorize() (identity-provider\n        // callback) and any in-flight codes issued before the authorize-side gate.\n        if (options.realmId && entity.realm_id && entity.realm_id !== options.realmId) {\n            throw OAuth2GrantError.invalid();\n        }\n\n        if (entity.redirect_uri) {\n            if (!options.redirectUri || entity.redirect_uri !== options.redirectUri) {\n                throw OAuth2GrantError.redirectUriMismatch();\n            }\n        }\n\n        // Public clients MUST use PKCE (RFC 7636). Defense in depth in case\n        // the authorize-side check was bypassed or the client's\n        // is_confidential flag changed between authorize and token.\n        if (options.clientIsPublic && !entity.code_challenge) {\n            throw OAuth2GrantError.invalid('PKCE is required for public clients.');\n        }\n\n        if (entity.code_challenge) {\n            if (!options.codeVerifier) {\n                throw OAuth2GrantError.invalid('Code verifier invalid.');\n            }\n\n            // RFC 7636 §4.3: code_challenge_method defaults to \"plain\" when\n            // absent. Only treat the challenge as S256 when the client\n            // explicitly sent code_challenge_method=S256.\n            if (entity.code_challenge_method === OAuth2AuthorizationCodeChallengeMethod.SHA_256) {\n                const codeVerifierHash = await buildOAuth2CodeChallenge(options.codeVerifier);\n                if (codeVerifierHash !== entity.code_challenge) {\n                    throw OAuth2GrantError.invalid('PKCE code_verifier mismatch.');\n                }\n            } else if (options.codeVerifier !== entity.code_challenge) {\n                throw OAuth2GrantError.invalid('PKCE code_verifier mismatch.');\n            }\n        }\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;AAcA,IAAaG,kCAAb,MAAaA;CACCC;CAEV,YAAYA,YAAgD;EACxD,KAAKA,aAAaA;CACtB;CAEA,MAAMC,OAAOC,MAAcC,SAAmF;EAC1G,MAAMC,SAAS,MAAM,KAAKJ,WAAWK,WAAWH,IAAAA;EAChD,IAAI,CAACE,QACD,MAAMP,iBAAiBS,QAAO;EAOlC,IAAIF,OAAOG;OACH,CAACJ,QAAQK,YAAYL,QAAQK,aAAaJ,OAAOG,WACjD,MAAMV,iBAAiBS,QAAO;EAAA;EAStC,IAAIH,QAAQM,WAAWL,OAAOM,YAAYN,OAAOM,aAAaP,QAAQM,SAClE,MAAMZ,iBAAiBS,QAAO;EAGlC,IAAIF,OAAOO;OACH,CAACR,QAAQS,eAAeR,OAAOO,iBAAiBR,QAAQS,aACxD,MAAMf,iBAAiBgB,oBAAmB;EAAA;EAOlD,IAAIV,QAAQW,kBAAkB,CAACV,OAAOW,gBAClC,MAAMlB,iBAAiBS,QAAQ,sCAAA;EAGnC,IAAIF,OAAOW,gBAAgB;GACvB,IAAI,CAACZ,QAAQa,cACT,MAAMnB,iBAAiBS,QAAQ,wBAAA;GAMnC,IAAIF,OAAOa,0BAA0BrB,uCAAuCsB;QAEpEC,MAD2BrB,yBAAyBK,QAAQa,YAAY,MACnDZ,OAAOW,gBAC5B,MAAMlB,iBAAiBS,QAAQ,8BAAA;GAAA,OAEhC,IAAIH,QAAQa,iBAAiBZ,OAAOW,gBACvC,MAAMlB,iBAAiBS,QAAQ,8BAAA;EAEvC;EAEA,OAAOF;CACX;AACJ"}
+{"version":3,"file":"module.mjs","names":["OAuth2AuthorizationCodeChallengeMethod","OAuth2GrantError","buildOAuth2CodeChallenge","OAuth2AuthorizationCodeVerifier","repository","verify","code","options","entity","popOneById","invalid","client_id","clientId","realmId","realm_id","redirect_uri","redirectUri","redirectUriMismatch","clientIsPublic","code_challenge","codeVerifier","code_challenge_method","SHA_256","codeVerifierHash"],"sources":["../../../../../../src/core/oauth2/authorization/code/verifier/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2AuthorizationCode } from '@authup/core-kit';\nimport { OAuth2AuthorizationCodeChallengeMethod, OAuth2GrantError } from '@authup/specs';\nimport { buildOAuth2CodeChallenge } from '../../helpers.ts';\n\nimport type { IOAuth2AuthorizationCodeRepository } from '../repository/index.ts';\nimport type { IOAuth2AuthorizationCodeVerifier, IOAuth2AuthorizationCodeVerifyOptions } from './types.ts';\n\nexport class OAuth2AuthorizationCodeVerifier implements IOAuth2AuthorizationCodeVerifier {\n    protected repository : IOAuth2AuthorizationCodeRepository;\n\n    constructor(repository: IOAuth2AuthorizationCodeRepository) {\n        this.repository = repository;\n    }\n\n    async verify(code: string, options: IOAuth2AuthorizationCodeVerifyOptions) : Promise<OAuth2AuthorizationCode> {\n        const entity = await this.repository.popOneById(code);\n        if (!entity) {\n            throw OAuth2GrantError.invalid();\n        }\n\n        // RFC 6749 §4.1.3: if the client was issued a client_id, verify the\n        // authorization code was issued to the authenticated client. Always\n        // require a clientId to be supplied so a malformed token request can't\n        // bypass the binding by omitting it.\n        if (entity.client_id) {\n            if (!options.clientId || options.clientId !== entity.client_id) {\n                throw OAuth2GrantError.invalid();\n            }\n        }\n\n        // Realm binding (defense in depth): the code's realm (the authorizing\n        // identity's realm) must match the authenticated client's realm. Blocks\n        // redeeming a realm-A identity's code against a realm-B client — covers\n        // codes minted outside OAuth2Authorization.authorize() (identity-provider\n        // callback) and any in-flight codes issued before the authorize-side gate.\n        if (options.realmId && entity.realm_id && entity.realm_id !== options.realmId) {\n            throw OAuth2GrantError.invalid();\n        }\n\n        if (entity.redirect_uri) {\n            if (!options.redirectUri || entity.redirect_uri !== options.redirectUri) {\n                throw OAuth2GrantError.redirectUriMismatch();\n            }\n        }\n\n        // Public clients MUST use PKCE (RFC 7636). Defense in depth in case\n        // the authorize-side check was bypassed or the client's\n        // auth_method changed between authorize and token.\n        if (options.clientIsPublic && !entity.code_challenge) {\n            throw OAuth2GrantError.invalid('PKCE is required for public clients.');\n        }\n\n        if (entity.code_challenge) {\n            if (!options.codeVerifier) {\n                throw OAuth2GrantError.invalid('Code verifier invalid.');\n            }\n\n            // RFC 7636 §4.3: code_challenge_method defaults to \"plain\" when\n            // absent. Only treat the challenge as S256 when the client\n            // explicitly sent code_challenge_method=S256.\n            if (entity.code_challenge_method === OAuth2AuthorizationCodeChallengeMethod.SHA_256) {\n                const codeVerifierHash = await buildOAuth2CodeChallenge(options.codeVerifier);\n                if (codeVerifierHash !== entity.code_challenge) {\n                    throw OAuth2GrantError.invalid('PKCE code_verifier mismatch.');\n                }\n            } else if (options.codeVerifier !== entity.code_challenge) {\n                throw OAuth2GrantError.invalid('PKCE code_verifier mismatch.');\n            }\n        }\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;AAcA,IAAaG,kCAAb,MAAaA;CACCC;CAEV,YAAYA,YAAgD;EACxD,KAAKA,aAAaA;CACtB;CAEA,MAAMC,OAAOC,MAAcC,SAAmF;EAC1G,MAAMC,SAAS,MAAM,KAAKJ,WAAWK,WAAWH,IAAAA;EAChD,IAAI,CAACE,QACD,MAAMP,iBAAiBS,QAAO;EAOlC,IAAIF,OAAOG;OACH,CAACJ,QAAQK,YAAYL,QAAQK,aAAaJ,OAAOG,WACjD,MAAMV,iBAAiBS,QAAO;EAAA;EAStC,IAAIH,QAAQM,WAAWL,OAAOM,YAAYN,OAAOM,aAAaP,QAAQM,SAClE,MAAMZ,iBAAiBS,QAAO;EAGlC,IAAIF,OAAOO;OACH,CAACR,QAAQS,eAAeR,OAAOO,iBAAiBR,QAAQS,aACxD,MAAMf,iBAAiBgB,oBAAmB;EAAA;EAOlD,IAAIV,QAAQW,kBAAkB,CAACV,OAAOW,gBAClC,MAAMlB,iBAAiBS,QAAQ,sCAAA;EAGnC,IAAIF,OAAOW,gBAAgB;GACvB,IAAI,CAACZ,QAAQa,cACT,MAAMnB,iBAAiBS,QAAQ,wBAAA;GAMnC,IAAIF,OAAOa,0BAA0BrB,uCAAuCsB;QAEpEC,MAD2BrB,yBAAyBK,QAAQa,YAAY,MACnDZ,OAAOW,gBAC5B,MAAMlB,iBAAiBS,QAAQ,8BAAA;GAAA,OAEhC,IAAIH,QAAQa,iBAAiBZ,OAAOW,gBACvC,MAAMlB,iBAAiBS,QAAQ,8BAAA;EAEvC;EAEA,OAAOF;CACX;AACJ"}

package/dist/core/oauth2/authorization/code-request/validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/authorization/code-request/validator.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAUvE,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAGpC,qBAAa,uCAAwC,SAAQ,SAAS,CAAC,8BAA8B,CAAC;IAClG,SAAS,CAAC,UAAU;CAsIvB"}
+{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/authorization/code-request/validator.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAUvE,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAGpC,qBAAa,uCAAwC,SAAQ,SAAS,CAAC,8BAA8B,CAAC;IAClG,SAAS,CAAC,UAAU;CA6IvB"}

package/dist/core/oauth2/authorization/code-request/validator.mjs

@@ -42,6 +42,7 @@ var OAuth2AuthorizationCodeRequestValidator = class extends Container {
 		})));
 		this.mount("max_age", { optional: true }, createValidator(z.preprocess((value) => typeof value === "string" && value.trim() === "" ? void 0 : value, z.coerce.number().int().min(0).nullable().optional())));
 		this.mount("login_hint", { optional: true }, createValidator(z.string().trim().toLowerCase().min(1).max(256).nullable()));
+		this.mount("acr_values", { optional: true }, createValidator(z.string().trim().min(1).max(256).nullable()));
 		this.mount("realm_id", { optional: true }, createValidator(z.string().nonempty()));
 		this.mount("client_id", createValidator(z.string().nonempty()));
 	}

package/dist/core/oauth2/authorization/code-request/validator.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"validator.mjs","names":["OAuth2AuthorizationCodeChallengeMethod","OAuth2AuthorizationPrompt","OAuth2AuthorizationResponseType","OAuth2RequestError","OAuth2ResponseTypeError","createValidator","Container","z","OAuth2AuthorizationCodeRequestValidator","initialize","mount","string","nonempty","check","ctx","responseTypes","value","split","filter","Boolean","invalid","length","CODE","error","unsupported","issues","push","input","code","message","NEVER","url","min","max","optional","nullable","enum","values","includes","NONE","malformed","preprocess","trim","undefined","coerce","number","int","toLowerCase"],"sources":["../../../../../src/core/oauth2/authorization/code-request/validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport {\n    OAuth2AuthorizationCodeChallengeMethod,\n    OAuth2AuthorizationPrompt,\n    OAuth2AuthorizationResponseType,\n    OAuth2RequestError,\n    OAuth2ResponseTypeError,\n} from '@authup/specs';\n\nimport { createValidator } from '@validup/zod';\nimport { Container } from 'validup';\nimport { z } from 'zod';\n\nexport class OAuth2AuthorizationCodeRequestValidator extends Container<OAuth2AuthorizationCodeRequest> {\n    protected initialize() {\n        super.initialize();\n\n        this.mount(\n            'response_type',\n            createValidator(\n                z\n                    .string()\n                    .nonempty()\n                    .check((ctx) => {\n                        // OAuth 2.1 posture: the authorization endpoint issues\n                        // codes only — the implicit/hybrid response types\n                        // (token, id_token, none) are not supported.\n                        const responseTypes = ctx.value.split(' ').filter(Boolean);\n\n                        const invalid = responseTypes.length !== 1 ||\n                            responseTypes[0] !== OAuth2AuthorizationResponseType.CODE;\n\n                        if (invalid) {\n                            const error = OAuth2ResponseTypeError.unsupported();\n                            ctx.issues.push({\n                                input: ctx.value,\n                                code: 'custom',\n                                message: error.message,\n                            });\n                        }\n\n                        return z.NEVER;\n                    }),\n            ),\n        );\n\n        this.mount(\n            'redirect_uri',\n            createValidator(z.string().url()),\n        );\n\n        this.mount(\n            'scope',\n            createValidator(z.string().min(3).max(512)),\n        );\n\n        this.mount(\n            'state',\n            { optional: true },\n            createValidator(z.string().min(5).max(2048).nullable()),\n        );\n\n        this.mount(\n            'code_challenge',\n            { optional: true },\n            createValidator(z.string().min(1).max(256).nullable()),\n        );\n\n        this.mount(\n            'code_challenge_method',\n            { optional: true },\n            createValidator(z.enum(OAuth2AuthorizationCodeChallengeMethod).nullable()),\n        );\n\n        this.mount(\n            'nonce',\n            { optional: true },\n            createValidator(z.string().min(1).max(512).nullable()),\n        );\n\n        this.mount(\n            'prompt',\n            { optional: true },\n            createValidator(\n                z\n                    .string()\n                    .min(1)\n                    .max(128)\n                    .nullable()\n                    .check((ctx) => {\n                        if (!ctx.value) {\n                            return z.NEVER;\n                        }\n\n                        // Unknown tokens are ignored (forward-compat). Only the\n                        // OIDC §3.1.2.1 rule \"none must not be combined\" is enforced.\n                        const values = ctx.value.split(' ').filter(Boolean);\n                        if (\n                            values.includes(OAuth2AuthorizationPrompt.NONE) &&\n                            values.length > 1\n                        ) {\n                            const error = OAuth2RequestError.malformed(\n                                'prompt=none must not be combined with other prompt values.',\n                            );\n                            ctx.issues.push({\n                                input: ctx.value,\n                                code: 'custom',\n                                message: error.message,\n                            });\n                        }\n\n                        return z.NEVER;\n                    }),\n            ),\n        );\n\n        this.mount(\n            'max_age',\n            { optional: true },\n            createValidator(\n                z.preprocess(\n                    // An empty / blank max_age (e.g. a stray `?max_age=` from an\n                    // RP template) is absent, not `max_age=0` — without this\n                    // z.coerce.number('') === 0 would silently force\n                    // re-authentication on every request for that RP.\n                    (value) => (typeof value === 'string' && value.trim() === '' ? undefined : value),\n                    z.coerce.number().int().min(0).nullable().optional(),\n                ),\n            ),\n        );\n\n        this.mount(\n            'login_hint',\n            { optional: true },\n            createValidator(z.string().trim().toLowerCase().min(1).max(256).nullable()),\n        );\n\n        this.mount(\n            'realm_id',\n            { optional: true },\n            createValidator(z.string().nonempty()),\n        );\n\n        this.mount(\n            'client_id',\n            createValidator(z.string().nonempty()),\n        );\n    }\n}\n"],"mappings":";;;;;;;;AAoBA,IAAaQ,0CAAb,cAA6DF,UAAAA;CAC/CG,aAAa;EACnB,MAAMA,WAAAA;EAEN,KAAKC,MACD,iBACAL,gBACIE,EACKI,OAAM,CAAA,CACNC,SAAQ,CAAA,CACRC,OAAOC,QAAAA;GAIJ,MAAMC,gBAAgBD,IAAIE,MAAMC,MAAM,GAAA,CAAA,CAAKC,OAAOC,OAAAA;GAKlD,IAHgBJ,cAAcM,WAAW,KACrCN,cAAc,OAAOb,gCAAgCoB,MAE5C;IACT,MAAMC,QAAQnB,wBAAwBoB,YAAW;IACjDV,IAAIW,OAAOC,KAAK;KACZC,OAAOb,IAAIE;KACXY,MAAM;KACNC,SAASN,MAAMM;IACnB,CAAA;GACJ;GAEA,OAAOtB,EAAEuB;EACb,CAAA,CAAA,CAAA;EAIZ,KAAKpB,MACD,gBACAL,gBAAgBE,EAAEI,OAAM,CAAA,CAAGoB,IAAG,CAAA,CAAA;EAGlC,KAAKrB,MACD,SACAL,gBAAgBE,EAAEI,OAAM,CAAA,CAAGqB,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA,CAAA;EAG1C,KAAKvB,MACD,SACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAEI,OAAM,CAAA,CAAGqB,IAAI,CAAA,CAAA,CAAGC,IAAI,IAAA,CAAA,CAAME,SAAQ,CAAA,CAAA;EAGxD,KAAKzB,MACD,kBACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAEI,OAAM,CAAA,CAAGqB,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA,CAAKE,SAAQ,CAAA,CAAA;EAGvD,KAAKzB,MACD,yBACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAE6B,KAAKpC,sCAAAA,CAAAA,CAAwCmC,SAAQ,CAAA,CAAA;EAG3E,KAAKzB,MACD,SACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAEI,OAAM,CAAA,CAAGqB,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA,CAAKE,SAAQ,CAAA,CAAA;EAGvD,KAAKzB,MACD,UACA,EAAEwB,UAAU,KAAK,GACjB7B,gBACIE,EACKI,OAAM,CAAA,CACNqB,IAAI,CAAA,CAAA,CACJC,IAAI,GAAA,CAAA,CACJE,SAAQ,CAAA,CACRtB,OAAOC,QAAAA;GACJ,IAAI,CAACA,IAAIE,OACL,OAAOT,EAAEuB;GAKb,MAAMO,SAASvB,IAAIE,MAAMC,MAAM,GAAA,CAAA,CAAKC,OAAOC,OAAAA;GAC3C,IACIkB,OAAOC,SAASrC,0BAA0BsC,IAAI,KAC9CF,OAAOhB,SAAS,GAClB;IACE,MAAME,QAAQpB,mBAAmBqC,UAC7B,4DAAA;IAEJ1B,IAAIW,OAAOC,KAAK;KACZC,OAAOb,IAAIE;KACXY,MAAM;KACNC,SAASN,MAAMM;IACnB,CAAA;GACJ;GAEA,OAAOtB,EAAEuB;EACb,CAAA,CAAA,CAAA;EAIZ,KAAKpB,MACD,WACA,EAAEwB,UAAU,KAAK,GACjB7B,gBACIE,EAAEkC,YAKGzB,UAAW,OAAOA,UAAU,YAAYA,MAAM0B,KAAI,MAAO,KAAKC,KAAAA,IAAY3B,OAC3ET,EAAEqC,OAAOC,OAAM,CAAA,CAAGC,IAAG,CAAA,CAAGd,IAAI,CAAA,CAAA,CAAGG,SAAQ,CAAA,CAAGD,SAAQ,CAAA,CAAA,CAAA;EAK9D,KAAKxB,MACD,cACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAEI,OAAM,CAAA,CAAG+B,KAAI,CAAA,CAAGK,YAAW,CAAA,CAAGf,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA,CAAKE,SAAQ,CAAA,CAAA;EAG5E,KAAKzB,MACD,YACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAEI,OAAM,CAAA,CAAGC,SAAQ,CAAA,CAAA;EAGvC,KAAKF,MACD,aACAL,gBAAgBE,EAAEI,OAAM,CAAA,CAAGC,SAAQ,CAAA,CAAA;CAE3C;AACJ"}
+{"version":3,"file":"validator.mjs","names":["OAuth2AuthorizationCodeChallengeMethod","OAuth2AuthorizationPrompt","OAuth2AuthorizationResponseType","OAuth2RequestError","OAuth2ResponseTypeError","createValidator","Container","z","OAuth2AuthorizationCodeRequestValidator","initialize","mount","string","nonempty","check","ctx","responseTypes","value","split","filter","Boolean","invalid","length","CODE","error","unsupported","issues","push","input","code","message","NEVER","url","min","max","optional","nullable","enum","values","includes","NONE","malformed","preprocess","trim","undefined","coerce","number","int","toLowerCase"],"sources":["../../../../../src/core/oauth2/authorization/code-request/validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport {\n    OAuth2AuthorizationCodeChallengeMethod,\n    OAuth2AuthorizationPrompt,\n    OAuth2AuthorizationResponseType,\n    OAuth2RequestError,\n    OAuth2ResponseTypeError,\n} from '@authup/specs';\n\nimport { createValidator } from '@validup/zod';\nimport { Container } from 'validup';\nimport { z } from 'zod';\n\nexport class OAuth2AuthorizationCodeRequestValidator extends Container<OAuth2AuthorizationCodeRequest> {\n    protected initialize() {\n        super.initialize();\n\n        this.mount(\n            'response_type',\n            createValidator(\n                z\n                    .string()\n                    .nonempty()\n                    .check((ctx) => {\n                        // OAuth 2.1 posture: the authorization endpoint issues\n                        // codes only — the implicit/hybrid response types\n                        // (token, id_token, none) are not supported.\n                        const responseTypes = ctx.value.split(' ').filter(Boolean);\n\n                        const invalid = responseTypes.length !== 1 ||\n                            responseTypes[0] !== OAuth2AuthorizationResponseType.CODE;\n\n                        if (invalid) {\n                            const error = OAuth2ResponseTypeError.unsupported();\n                            ctx.issues.push({\n                                input: ctx.value,\n                                code: 'custom',\n                                message: error.message,\n                            });\n                        }\n\n                        return z.NEVER;\n                    }),\n            ),\n        );\n\n        this.mount(\n            'redirect_uri',\n            createValidator(z.string().url()),\n        );\n\n        this.mount(\n            'scope',\n            createValidator(z.string().min(3).max(512)),\n        );\n\n        this.mount(\n            'state',\n            { optional: true },\n            createValidator(z.string().min(5).max(2048).nullable()),\n        );\n\n        this.mount(\n            'code_challenge',\n            { optional: true },\n            createValidator(z.string().min(1).max(256).nullable()),\n        );\n\n        this.mount(\n            'code_challenge_method',\n            { optional: true },\n            createValidator(z.enum(OAuth2AuthorizationCodeChallengeMethod).nullable()),\n        );\n\n        this.mount(\n            'nonce',\n            { optional: true },\n            createValidator(z.string().min(1).max(512).nullable()),\n        );\n\n        this.mount(\n            'prompt',\n            { optional: true },\n            createValidator(\n                z\n                    .string()\n                    .min(1)\n                    .max(128)\n                    .nullable()\n                    .check((ctx) => {\n                        if (!ctx.value) {\n                            return z.NEVER;\n                        }\n\n                        // Unknown tokens are ignored (forward-compat). Only the\n                        // OIDC §3.1.2.1 rule \"none must not be combined\" is enforced.\n                        const values = ctx.value.split(' ').filter(Boolean);\n                        if (\n                            values.includes(OAuth2AuthorizationPrompt.NONE) &&\n                            values.length > 1\n                        ) {\n                            const error = OAuth2RequestError.malformed(\n                                'prompt=none must not be combined with other prompt values.',\n                            );\n                            ctx.issues.push({\n                                input: ctx.value,\n                                code: 'custom',\n                                message: error.message,\n                            });\n                        }\n\n                        return z.NEVER;\n                    }),\n            ),\n        );\n\n        this.mount(\n            'max_age',\n            { optional: true },\n            createValidator(\n                z.preprocess(\n                    // An empty / blank max_age (e.g. a stray `?max_age=` from an\n                    // RP template) is absent, not `max_age=0` — without this\n                    // z.coerce.number('') === 0 would silently force\n                    // re-authentication on every request for that RP.\n                    (value) => (typeof value === 'string' && value.trim() === '' ? undefined : value),\n                    z.coerce.number().int().min(0).nullable().optional(),\n                ),\n            ),\n        );\n\n        this.mount(\n            'login_hint',\n            { optional: true },\n            createValidator(z.string().trim().toLowerCase().min(1).max(256).nullable()),\n        );\n\n        // case-sensitive (urn values) — no toLowerCase, unlike login_hint\n        this.mount(\n            'acr_values',\n            { optional: true },\n            createValidator(z.string().trim().min(1).max(256).nullable()),\n        );\n\n        this.mount(\n            'realm_id',\n            { optional: true },\n            createValidator(z.string().nonempty()),\n        );\n\n        this.mount(\n            'client_id',\n            createValidator(z.string().nonempty()),\n        );\n    }\n}\n"],"mappings":";;;;;;;;AAoBA,IAAaQ,0CAAb,cAA6DF,UAAAA;CAC/CG,aAAa;EACnB,MAAMA,WAAAA;EAEN,KAAKC,MACD,iBACAL,gBACIE,EACKI,OAAM,CAAA,CACNC,SAAQ,CAAA,CACRC,OAAOC,QAAAA;GAIJ,MAAMC,gBAAgBD,IAAIE,MAAMC,MAAM,GAAA,CAAA,CAAKC,OAAOC,OAAAA;GAKlD,IAHgBJ,cAAcM,WAAW,KACrCN,cAAc,OAAOb,gCAAgCoB,MAE5C;IACT,MAAMC,QAAQnB,wBAAwBoB,YAAW;IACjDV,IAAIW,OAAOC,KAAK;KACZC,OAAOb,IAAIE;KACXY,MAAM;KACNC,SAASN,MAAMM;IACnB,CAAA;GACJ;GAEA,OAAOtB,EAAEuB;EACb,CAAA,CAAA,CAAA;EAIZ,KAAKpB,MACD,gBACAL,gBAAgBE,EAAEI,OAAM,CAAA,CAAGoB,IAAG,CAAA,CAAA;EAGlC,KAAKrB,MACD,SACAL,gBAAgBE,EAAEI,OAAM,CAAA,CAAGqB,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA,CAAA;EAG1C,KAAKvB,MACD,SACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAEI,OAAM,CAAA,CAAGqB,IAAI,CAAA,CAAA,CAAGC,IAAI,IAAA,CAAA,CAAME,SAAQ,CAAA,CAAA;EAGxD,KAAKzB,MACD,kBACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAEI,OAAM,CAAA,CAAGqB,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA,CAAKE,SAAQ,CAAA,CAAA;EAGvD,KAAKzB,MACD,yBACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAE6B,KAAKpC,sCAAAA,CAAAA,CAAwCmC,SAAQ,CAAA,CAAA;EAG3E,KAAKzB,MACD,SACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAEI,OAAM,CAAA,CAAGqB,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA,CAAKE,SAAQ,CAAA,CAAA;EAGvD,KAAKzB,MACD,UACA,EAAEwB,UAAU,KAAK,GACjB7B,gBACIE,EACKI,OAAM,CAAA,CACNqB,IAAI,CAAA,CAAA,CACJC,IAAI,GAAA,CAAA,CACJE,SAAQ,CAAA,CACRtB,OAAOC,QAAAA;GACJ,IAAI,CAACA,IAAIE,OACL,OAAOT,EAAEuB;GAKb,MAAMO,SAASvB,IAAIE,MAAMC,MAAM,GAAA,CAAA,CAAKC,OAAOC,OAAAA;GAC3C,IACIkB,OAAOC,SAASrC,0BAA0BsC,IAAI,KAC9CF,OAAOhB,SAAS,GAClB;IACE,MAAME,QAAQpB,mBAAmBqC,UAC7B,4DAAA;IAEJ1B,IAAIW,OAAOC,KAAK;KACZC,OAAOb,IAAIE;KACXY,MAAM;KACNC,SAASN,MAAMM;IACnB,CAAA;GACJ;GAEA,OAAOtB,EAAEuB;EACb,CAAA,CAAA,CAAA;EAIZ,KAAKpB,MACD,WACA,EAAEwB,UAAU,KAAK,GACjB7B,gBACIE,EAAEkC,YAKGzB,UAAW,OAAOA,UAAU,YAAYA,MAAM0B,KAAI,MAAO,KAAKC,KAAAA,IAAY3B,OAC3ET,EAAEqC,OAAOC,OAAM,CAAA,CAAGC,IAAG,CAAA,CAAGd,IAAI,CAAA,CAAA,CAAGG,SAAQ,CAAA,CAAGD,SAAQ,CAAA,CAAA,CAAA;EAK9D,KAAKxB,MACD,cACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAEI,OAAM,CAAA,CAAG+B,KAAI,CAAA,CAAGK,YAAW,CAAA,CAAGf,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA,CAAKE,SAAQ,CAAA,CAAA;EAI5E,KAAKzB,MACD,cACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAEI,OAAM,CAAA,CAAG+B,KAAI,CAAA,CAAGV,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA,CAAKE,SAAQ,CAAA,CAAA;EAG9D,KAAKzB,MACD,YACA,EAAEwB,UAAU,KAAK,GACjB7B,gBAAgBE,EAAEI,OAAM,CAAA,CAAGC,SAAQ,CAAA,CAAA;EAGvC,KAAKF,MACD,aACAL,gBAAgBE,EAAEI,OAAM,CAAA,CAAGC,SAAQ,CAAA,CAAA;CAE3C;AACJ"}

package/dist/core/oauth2/authorization/code-request/verifier/module.mjs

@@ -4,7 +4,7 @@ import.meta.url;
 import { assertClientGrantAllowed } from "../../../client/grant-type.mjs";
 import "../../../client/index.mjs";
 import { isSimpleMatch, isUUID } from "@authup/kit";
-import { ScopeName } from "@authup/core-kit";
+import { ScopeName, isClientPublic } from "@authup/core-kit";
 import { OAuth2ClientError, OAuth2GrantError, OAuth2RequestError, OAuth2ScopeError, OAuth2TokenGrant, hasOAuth2Scopes } from "@authup/specs";
 //#region src/core/oauth2/authorization/code-request/verifier/module.ts
 var OAuth2AuthorizationCodeRequestVerifier = class {
@@ -24,11 +24,11 @@ var OAuth2AuthorizationCodeRequestVerifier = class {
 		if (!client) throw OAuth2ClientError.invalid();
 		if (!client.active) throw OAuth2ClientError.inactive();
 		assertClientGrantAllowed(client, OAuth2TokenGrant.AUTHORIZATION_CODE);
-		if (!client.redirect_uri) throw OAuth2GrantError.redirectUriMismatch();
-		if (!client.is_confidential && !data.code_challenge) throw OAuth2RequestError.malformed("PKCE code_challenge is required for public clients.");
-		if (!client.is_confidential && !data.state) throw OAuth2RequestError.malformed("state is required for public clients in the code flow.");
+		if (!client.redirectUri) throw OAuth2GrantError.redirectUriMismatch();
+		if (isClientPublic(client) && !data.code_challenge) throw OAuth2RequestError.malformed("PKCE code_challenge is required for public clients.");
+		if (isClientPublic(client) && !data.state) throw OAuth2RequestError.malformed("state is required for public clients in the code flow.");
 		data.client_id = client.id;
-		data.realm_id = client.realm_id;
+		data.realm_id = client.realmId;
 		const scopes = await this.scopeRepository.findByClientId(client.id);
 		const scopeNames = scopes.map((scope) => scope.name);
 		if (data.scope) {
@@ -36,7 +36,7 @@ var OAuth2AuthorizationCodeRequestVerifier = class {
 		} else data.scope = scopeNames.join(" ");
 		const redirectUriVerified = !!data.redirect_uri;
 		if (data.redirect_uri) {
-			const redirectUris = client.redirect_uri.split(",");
+			const redirectUris = client.redirectUri.split(",");
 			if (!isSimpleMatch(data.redirect_uri, redirectUris)) throw OAuth2GrantError.redirectUriMismatch();
 		}
 		return {

package/dist/core/oauth2/authorization/code-request/verifier/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["ScopeName","isSimpleMatch","isUUID","OAuth2ClientError","OAuth2GrantError","OAuth2RequestError","OAuth2ScopeError","OAuth2TokenGrant","hasOAuth2Scopes","assertClientGrantAllowed","OAuth2AuthorizationCodeRequestVerifier","clientRepository","scopeRepository","ctx","verify","data","client_id","invalid","realm_id","malformed","client","findOneByIdOrName","active","inactive","AUTHORIZATION_CODE","redirect_uri","redirectUriMismatch","is_confidential","code_challenge","state","id","scopes","findByClientId","scopeNames","map","scope","name","GLOBAL","insufficient","join","redirectUriVerified","redirectUris","split"],"sources":["../../../../../../src/core/oauth2/authorization/code-request/verifier/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport { isSimpleMatch, isUUID } from '@authup/kit';\nimport {\n    OAuth2ClientError,\n    OAuth2GrantError,\n    OAuth2RequestError,\n    OAuth2ScopeError,\n    OAuth2TokenGrant,\n    hasOAuth2Scopes,\n} from '@authup/specs';\nimport type { IOAuth2ClientRepository } from '../../../client/index.ts';\nimport { assertClientGrantAllowed } from '../../../client/index.ts';\nimport type { IOAuth2ScopeRepository } from '../../../scope/index.ts';\nimport type {\n    IOAuth2AuthorizationCodeRequestVerifier,\n    OAuth2AuthorizationCodeRequestVerificationResult,\n    OAuth2AuthorizationCodeRequestVerifierContext,\n} from './types.ts';\n\nexport class OAuth2AuthorizationCodeRequestVerifier implements IOAuth2AuthorizationCodeRequestVerifier {\n    protected clientRepository: IOAuth2ClientRepository;\n\n    protected scopeRepository: IOAuth2ScopeRepository;\n\n    constructor(ctx: OAuth2AuthorizationCodeRequestVerifierContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.scopeRepository = ctx.scopeRepository;\n    }\n\n    /**\n     * Verify validated authorization code request.\n     * @param data\n     */\n    async verify(\n        data: OAuth2AuthorizationCodeRequest,\n    ) : Promise<OAuth2AuthorizationCodeRequestVerificationResult> {\n        if (!data.client_id) {\n            throw OAuth2ClientError.invalid();\n        }\n\n        // A name-identified client needs a realm hint to resolve deterministically\n        // — every realm has a built-in `web` client, so `client_id=web` without a\n        // realm would bind to an arbitrary realm's client (and, post realm-gate,\n        // produce a confusing mismatch against a random realm). Require the hint.\n        if (!isUUID(data.client_id) && !data.realm_id) {\n            throw OAuth2RequestError.malformed('A realm is required to resolve a client by name.');\n        }\n\n        const client = await this.clientRepository.findOneByIdOrName(data.client_id, data.realm_id);\n        if (!client) {\n            throw OAuth2ClientError.invalid();\n        }\n\n        if (!client.active) {\n            throw OAuth2ClientError.inactive();\n        }\n\n        // A non-null grant_types allowlist must cover the code flow — an RP\n        // misconfiguration fails at the front door, not at code redemption.\n        assertClientGrantAllowed(client, OAuth2TokenGrant.AUTHORIZATION_CODE);\n\n        // OAuth 2.1 posture: a client with no registered redirect_uri pattern\n        // can never be matched — reject outright instead of trusting whatever\n        // redirect_uri the request carries (the server would otherwise issue a\n        // code to an attacker-supplied URI).\n        if (!client.redirect_uri) {\n            throw OAuth2GrantError.redirectUriMismatch();\n        }\n\n        // Public clients MUST use PKCE (RFC 7636 §4.4.1, OAuth 2.1). Without\n        // PKCE a public client's code flow has no second factor — anyone who\n        // intercepts the redirect can redeem the code at /token. The code flow\n        // is the only supported response type, so this holds unconditionally.\n        if (!client.is_confidential && !data.code_challenge) {\n            throw OAuth2RequestError.malformed('PKCE code_challenge is required for public clients.');\n        }\n\n        // Public clients SHOULD include state to bind the redirect to the\n        // initiating session and prevent CSRF (RFC 6749 §10.12). Confidential\n        // clients are exempt because the /token exchange already authenticates\n        // them via client_secret.\n        if (!client.is_confidential && !data.state) {\n            throw OAuth2RequestError.malformed('state is required for public clients in the code flow.');\n        }\n\n        data.client_id = client.id;\n        data.realm_id = client.realm_id;\n\n        const scopes = await this.scopeRepository.findByClientId(client.id);\n        const scopeNames = scopes.map((scope) => scope.name);\n        if (data.scope) {\n            if (\n                !hasOAuth2Scopes(scopeNames, data.scope) &&\n                !hasOAuth2Scopes(data.scope, ScopeName.GLOBAL)\n            ) {\n                throw OAuth2ScopeError.insufficient();\n            }\n        } else {\n            data.scope = scopeNames.join(' ');\n        }\n\n        // Verified only when the request's redirect_uri matched a registered\n        // pattern (pattern-less clients were rejected above). A request without\n        // a redirect_uri (e.g. the GET page render) stays unverified so\n        // consumers never auto-redirect without a match.\n        const redirectUriVerified = !!data.redirect_uri;\n        if (data.redirect_uri) {\n            const redirectUris = client.redirect_uri.split(',');\n\n            if (!isSimpleMatch(data.redirect_uri, redirectUris)) {\n                throw OAuth2GrantError.redirectUriMismatch();\n            }\n        }\n\n        return {\n            data,\n            client,\n            scopes,\n            redirectUriVerified,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;AA2BA,IAAaU,yCAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAoD;EAC5D,KAAKF,mBAAmBE,IAAIF;EAC5B,KAAKC,kBAAkBC,IAAID;CAC/B;;;;IAMA,MAAME,OACFC,MAC0D;EAC1D,IAAI,CAACA,KAAKC,WACN,MAAMb,kBAAkBc,QAAO;EAOnC,IAAI,CAACf,OAAOa,KAAKC,SAAS,KAAK,CAACD,KAAKG,UACjC,MAAMb,mBAAmBc,UAAU,kDAAA;EAGvC,MAAMC,SAAS,MAAM,KAAKT,iBAAiBU,kBAAkBN,KAAKC,WAAWD,KAAKG,QAAQ;EAC1F,IAAI,CAACE,QACD,MAAMjB,kBAAkBc,QAAO;EAGnC,IAAI,CAACG,OAAOE,QACR,MAAMnB,kBAAkBoB,SAAQ;EAKpCd,yBAAyBW,QAAQb,iBAAiBiB,kBAAkB;EAMpE,IAAI,CAACJ,OAAOK,cACR,MAAMrB,iBAAiBsB,oBAAmB;EAO9C,IAAI,CAACN,OAAOO,mBAAmB,CAACZ,KAAKa,gBACjC,MAAMvB,mBAAmBc,UAAU,qDAAA;EAOvC,IAAI,CAACC,OAAOO,mBAAmB,CAACZ,KAAKc,OACjC,MAAMxB,mBAAmBc,UAAU,wDAAA;EAGvCJ,KAAKC,YAAYI,OAAOU;EACxBf,KAAKG,WAAWE,OAAOF;EAEvB,MAAMa,SAAS,MAAM,KAAKnB,gBAAgBoB,eAAeZ,OAAOU,EAAE;EAClE,MAAMG,aAAaF,OAAOG,KAAKC,UAAUA,MAAMC,IAAI;EACnD,IAAIrB,KAAKoB;OAED,CAAC3B,gBAAgByB,YAAYlB,KAAKoB,KAAK,KACvC,CAAC3B,gBAAgBO,KAAKoB,OAAOnC,UAAUqC,MAAM,GAE7C,MAAM/B,iBAAiBgC,aAAY;EAAA,OAGvCvB,KAAKoB,QAAQF,WAAWM,KAAK,GAAA;EAOjC,MAAMC,sBAAsB,CAAC,CAACzB,KAAKU;EACnC,IAAIV,KAAKU,cAAc;GACnB,MAAMgB,eAAerB,OAAOK,aAAaiB,MAAM,GAAA;GAE/C,IAAI,CAACzC,cAAcc,KAAKU,cAAcgB,YAAAA,GAClC,MAAMrC,iBAAiBsB,oBAAmB;EAElD;EAEA,OAAO;GACHX;GACAK;GACAW;GACAS;EACJ;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["ScopeName","isClientPublic","isSimpleMatch","isUUID","OAuth2ClientError","OAuth2GrantError","OAuth2RequestError","OAuth2ScopeError","OAuth2TokenGrant","hasOAuth2Scopes","assertClientGrantAllowed","OAuth2AuthorizationCodeRequestVerifier","clientRepository","scopeRepository","ctx","verify","data","client_id","invalid","realm_id","malformed","client","findOneByIdOrName","active","inactive","AUTHORIZATION_CODE","redirectUri","redirectUriMismatch","code_challenge","state","id","realmId","scopes","findByClientId","scopeNames","map","scope","name","GLOBAL","insufficient","join","redirectUriVerified","redirect_uri","redirectUris","split"],"sources":["../../../../../../src/core/oauth2/authorization/code-request/verifier/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport { ScopeName, isClientPublic } from '@authup/core-kit';\nimport { isSimpleMatch, isUUID } from '@authup/kit';\nimport {\n    OAuth2ClientError,\n    OAuth2GrantError,\n    OAuth2RequestError,\n    OAuth2ScopeError,\n    OAuth2TokenGrant,\n    hasOAuth2Scopes,\n} from '@authup/specs';\nimport type { IOAuth2ClientRepository } from '../../../client/index.ts';\nimport { assertClientGrantAllowed } from '../../../client/index.ts';\nimport type { IOAuth2ScopeRepository } from '../../../scope/index.ts';\nimport type {\n    IOAuth2AuthorizationCodeRequestVerifier,\n    OAuth2AuthorizationCodeRequestVerificationResult,\n    OAuth2AuthorizationCodeRequestVerifierContext,\n} from './types.ts';\n\nexport class OAuth2AuthorizationCodeRequestVerifier implements IOAuth2AuthorizationCodeRequestVerifier {\n    protected clientRepository: IOAuth2ClientRepository;\n\n    protected scopeRepository: IOAuth2ScopeRepository;\n\n    constructor(ctx: OAuth2AuthorizationCodeRequestVerifierContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.scopeRepository = ctx.scopeRepository;\n    }\n\n    /**\n     * Verify validated authorization code request.\n     * @param data\n     */\n    async verify(\n        data: OAuth2AuthorizationCodeRequest,\n    ) : Promise<OAuth2AuthorizationCodeRequestVerificationResult> {\n        if (!data.client_id) {\n            throw OAuth2ClientError.invalid();\n        }\n\n        // A name-identified client needs a realm hint to resolve deterministically\n        // — every realm has a built-in `web` client, so `client_id=web` without a\n        // realm would bind to an arbitrary realm's client (and, post realm-gate,\n        // produce a confusing mismatch against a random realm). Require the hint.\n        if (!isUUID(data.client_id) && !data.realm_id) {\n            throw OAuth2RequestError.malformed('A realm is required to resolve a client by name.');\n        }\n\n        const client = await this.clientRepository.findOneByIdOrName(data.client_id, data.realm_id);\n        if (!client) {\n            throw OAuth2ClientError.invalid();\n        }\n\n        if (!client.active) {\n            throw OAuth2ClientError.inactive();\n        }\n\n        // A non-null grant_types allowlist must cover the code flow — an RP\n        // misconfiguration fails at the front door, not at code redemption.\n        assertClientGrantAllowed(client, OAuth2TokenGrant.AUTHORIZATION_CODE);\n\n        // OAuth 2.1 posture: a client with no registered redirect_uri pattern\n        // can never be matched — reject outright instead of trusting whatever\n        // redirect_uri the request carries (the server would otherwise issue a\n        // code to an attacker-supplied URI).\n        if (!client.redirectUri) {\n            throw OAuth2GrantError.redirectUriMismatch();\n        }\n\n        // Public clients MUST use PKCE (RFC 7636 §4.4.1, OAuth 2.1). Without\n        // PKCE a public client's code flow has no second factor — anyone who\n        // intercepts the redirect can redeem the code at /token. The code flow\n        // is the only supported response type, so this holds unconditionally.\n        if (isClientPublic(client) && !data.code_challenge) {\n            throw OAuth2RequestError.malformed('PKCE code_challenge is required for public clients.');\n        }\n\n        // Public clients SHOULD include state to bind the redirect to the\n        // initiating session and prevent CSRF (RFC 6749 §10.12). Confidential\n        // clients are exempt because the /token exchange already authenticates\n        // them via client_secret.\n        if (isClientPublic(client) && !data.state) {\n            throw OAuth2RequestError.malformed('state is required for public clients in the code flow.');\n        }\n\n        data.client_id = client.id;\n        data.realm_id = client.realmId;\n\n        const scopes = await this.scopeRepository.findByClientId(client.id);\n        const scopeNames = scopes.map((scope) => scope.name);\n        if (data.scope) {\n            if (\n                !hasOAuth2Scopes(scopeNames, data.scope) &&\n                !hasOAuth2Scopes(data.scope, ScopeName.GLOBAL)\n            ) {\n                throw OAuth2ScopeError.insufficient();\n            }\n        } else {\n            data.scope = scopeNames.join(' ');\n        }\n\n        // Verified only when the request's redirect_uri matched a registered\n        // pattern (pattern-less clients were rejected above). A request without\n        // a redirect_uri (e.g. the GET page render) stays unverified so\n        // consumers never auto-redirect without a match.\n        const redirectUriVerified = !!data.redirect_uri;\n        if (data.redirect_uri) {\n            const redirectUris = client.redirectUri.split(',');\n\n            if (!isSimpleMatch(data.redirect_uri, redirectUris)) {\n                throw OAuth2GrantError.redirectUriMismatch();\n            }\n        }\n\n        return {\n            data,\n            client,\n            scopes,\n            redirectUriVerified,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;AA2BA,IAAaW,yCAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAoD;EAC5D,KAAKF,mBAAmBE,IAAIF;EAC5B,KAAKC,kBAAkBC,IAAID;CAC/B;;;;IAMA,MAAME,OACFC,MAC0D;EAC1D,IAAI,CAACA,KAAKC,WACN,MAAMb,kBAAkBc,QAAO;EAOnC,IAAI,CAACf,OAAOa,KAAKC,SAAS,KAAK,CAACD,KAAKG,UACjC,MAAMb,mBAAmBc,UAAU,kDAAA;EAGvC,MAAMC,SAAS,MAAM,KAAKT,iBAAiBU,kBAAkBN,KAAKC,WAAWD,KAAKG,QAAQ;EAC1F,IAAI,CAACE,QACD,MAAMjB,kBAAkBc,QAAO;EAGnC,IAAI,CAACG,OAAOE,QACR,MAAMnB,kBAAkBoB,SAAQ;EAKpCd,yBAAyBW,QAAQb,iBAAiBiB,kBAAkB;EAMpE,IAAI,CAACJ,OAAOK,aACR,MAAMrB,iBAAiBsB,oBAAmB;EAO9C,IAAI1B,eAAeoB,MAAAA,KAAW,CAACL,KAAKY,gBAChC,MAAMtB,mBAAmBc,UAAU,qDAAA;EAOvC,IAAInB,eAAeoB,MAAAA,KAAW,CAACL,KAAKa,OAChC,MAAMvB,mBAAmBc,UAAU,wDAAA;EAGvCJ,KAAKC,YAAYI,OAAOS;EACxBd,KAAKG,WAAWE,OAAOU;EAEvB,MAAMC,SAAS,MAAM,KAAKnB,gBAAgBoB,eAAeZ,OAAOS,EAAE;EAClE,MAAMI,aAAaF,OAAOG,KAAKC,UAAUA,MAAMC,IAAI;EACnD,IAAIrB,KAAKoB;OAED,CAAC3B,gBAAgByB,YAAYlB,KAAKoB,KAAK,KACvC,CAAC3B,gBAAgBO,KAAKoB,OAAOpC,UAAUsC,MAAM,GAE7C,MAAM/B,iBAAiBgC,aAAY;EAAA,OAGvCvB,KAAKoB,QAAQF,WAAWM,KAAK,GAAA;EAOjC,MAAMC,sBAAsB,CAAC,CAACzB,KAAK0B;EACnC,IAAI1B,KAAK0B,cAAc;GACnB,MAAMC,eAAetB,OAAOK,YAAYkB,MAAM,GAAA;GAE9C,IAAI,CAAC1C,cAAcc,KAAK0B,cAAcC,YAAAA,GAClC,MAAMtC,iBAAiBsB,oBAAmB;EAElD;EAEA,OAAO;GACHX;GACAK;GACAW;GACAS;EACJ;CACJ;AACJ"}

package/dist/core/oauth2/authorization/helpers.d.ts

@@ -1,4 +1,13 @@
-import type { JWTAlgorithm } from '@authup/specs';
+import type { JWTAlgorithm, OAuth2TokenPayload } from '@authup/specs';
+import type { Session } from '@authup/core-kit';
+/**
+ * Derive the OIDC `amr` / `acr` claims from the backing session's
+ * authMethod + mfaAt (plan 050). Pre-column sessions (null authMethod)
+ * yield no claims — authup cannot retroactively know how an old session
+ * authenticated. M2M methods yield none either (amr/acr are user-flow
+ * claims; those grants mint no id_token).
+ */
+export declare function deriveAmrAcr(session: Pick<Session, 'authMethod' | 'mfaAt'> | null): Pick<OAuth2TokenPayload, 'amr' | 'acr'>;
 export declare function generateOAuth2CodeVerifier(): string;
 export declare function base64URLEncode(arrayBuffer: ArrayBuffer): string;
 export declare function buildOAuth2TokenHash(value: string, alg?: `${JWTAlgorithm}` | null): Promise<string>;

package/dist/core/oauth2/authorization/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/authorization/helpers.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAIlD,wBAAgB,0BAA0B,WAazC;AAED,wBAAgB,eAAe,CAAC,WAAW,EAAE,WAAW,UAWvD;AAWD,wBAAsB,oBAAoB,CACtC,KAAK,EAAE,MAAM,EACb,GAAG,CAAC,EAAE,GAAG,YAAY,EAAE,GAAG,IAAI,GAC9B,OAAO,CAAC,MAAM,CAAC,CAkBlB;AAED,wBAAsB,wBAAwB,CAAC,YAAY,EAAE,MAAM,mBAMlE"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/authorization/helpers.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAMtE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAIhD;;;;;;GAMG;AACH,wBAAgB,YAAY,CACxB,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,GAAG,IAAI,GACtD,IAAI,CAAC,kBAAkB,EAAE,KAAK,GAAG,KAAK,CAAC,CAiCzC;AAED,wBAAgB,0BAA0B,WAazC;AAED,wBAAgB,eAAe,CAAC,WAAW,EAAE,WAAW,UAWvD;AAWD,wBAAsB,oBAAoB,CACtC,KAAK,EAAE,MAAM,EACb,GAAG,CAAC,EAAE,GAAG,YAAY,EAAE,GAAG,IAAI,GAC9B,OAAO,CAAC,MAAM,CAAC,CAkBlB;AAED,wBAAsB,wBAAwB,CAAC,YAAY,EAAE,MAAM,mBAMlE"}

package/dist/core/oauth2/authorization/helpers.mjs

@@ -1,9 +1,35 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { JWTError } from "@authup/specs";
+import { SessionAuthMethod } from "@authup/core-kit";
+import { JWTError, OAuth2AuthenticationContextClass, OAuth2AuthenticationMethodReference } from "@authup/specs";
 import { subtle } from "uncrypto";
 //#region src/core/oauth2/authorization/helpers.ts
+/**
+* Derive the OIDC `amr` / `acr` claims from the backing session's
+* authMethod + mfaAt (plan 050). Pre-column sessions (null authMethod)
+* yield no claims — authup cannot retroactively know how an old session
+* authenticated. M2M methods yield none either (amr/acr are user-flow
+* claims; those grants mint no id_token).
+*/ function deriveAmrAcr(session) {
+	if (!session || !session.authMethod) return {};
+	const amr = [];
+	switch (session.authMethod) {
+		case SessionAuthMethod.PASSWORD:
+		case SessionAuthMethod.LDAP:
+			amr.push(OAuth2AuthenticationMethodReference.PASSWORD);
+			break;
+		case SessionAuthMethod.EXTERNAL:
+			amr.push(OAuth2AuthenticationMethodReference.EXTERNAL);
+			break;
+		default: return {};
+	}
+	if (session.mfaAt) amr.push(OAuth2AuthenticationMethodReference.OTP);
+	return {
+		amr,
+		acr: session.mfaAt ? OAuth2AuthenticationContextClass.MFA : OAuth2AuthenticationContextClass.PASSWORD
+	};
+}
 function generateOAuth2CodeVerifier() {
 	const length = 64;
 	const charset = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
@@ -42,6 +68,6 @@ async function buildOAuth2CodeChallenge(codeVerifier) {
 	return base64URLEncode(await subtle.digest("SHA-256", data));
 }
 //#endregion
-export { base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, generateOAuth2CodeVerifier };
+export { base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, deriveAmrAcr, generateOAuth2CodeVerifier };
 
 //# sourceMappingURL=helpers.mjs.map

package/dist/core/oauth2/authorization/helpers.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.mjs","names":["JWTError","subtle","generateOAuth2CodeVerifier","length","charset","codeVerifier","randomValues","Uint8Array","crypto","getRandomValues","i","base64URLEncode","arrayBuffer","charCode","Array","from","btoa","String","fromCharCode","apply","replace","TOKEN_HASH_DIGESTS","name","halfLength","buildOAuth2TokenHash","value","alg","digest","slice","headerPropertyInvalid","encoder","TextEncoder","data","encode","hashBuffer","halfHash","buildOAuth2CodeChallenge"],"sources":["../../../../src/core/oauth2/authorization/helpers.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { JWTAlgorithm } from '@authup/specs';\nimport { JWTError } from '@authup/specs';\nimport { subtle } from 'uncrypto';\n\nexport function generateOAuth2CodeVerifier() {\n    const length = 64;\n    const charset = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';\n\n    let codeVerifier = '';\n    const randomValues = new Uint8Array(length);\n    crypto.getRandomValues(randomValues);\n\n    for (let i = 0; i < length; i++) {\n        codeVerifier += charset[randomValues[i] % charset.length];\n    }\n\n    return codeVerifier;\n}\n\nexport function base64URLEncode(arrayBuffer: ArrayBuffer) {\n    // Convert the ArrayBuffer to string using Uint8 array.\n    // btoa takes chars from 0-255 and base64 encodes.\n    // Then convert the base64 encoded to base64url encoded.\n    // (replace + with -, replace / with _, trim trailing =)\n    const charCode = Array.from(new Uint8Array(arrayBuffer));\n\n    return btoa(String.fromCharCode.apply(null, charCode))\n        .replace(/\\+/g, '-')\n        .replace(/\\//g, '_')\n        .replace(/=+$/, '');\n}\n\n// OIDC Core §3.1.3.6: at_hash / c_hash use the hash algorithm of the id_token's\n// JWS alg (…S256 → SHA-256, …S384 → SHA-384, …S512 → SHA-512) and keep the LEFT\n// HALF of the digest — so the half-length follows the digest (16/24/32 bytes).\nconst TOKEN_HASH_DIGESTS : Record<string, { name: string, halfLength: number }> = {\n    256: { name: 'SHA-256', halfLength: 16 },\n    384: { name: 'SHA-384', halfLength: 24 },\n    512: { name: 'SHA-512', halfLength: 32 },\n};\n\nexport async function buildOAuth2TokenHash(\n    value: string,\n    alg?: `${JWTAlgorithm}` | null,\n) : Promise<string> {\n    // A key row without a persisted alg (nullable legacy column) signs with\n    // the signer's *256 default (RS256/ES256/HS256) — derive the matching\n    // SHA-256 digest. An unrecognized alg still fails loud — silently\n    // defaulting there would mint a hash no conforming verifier accepts.\n    const digest = alg ?\n        TOKEN_HASH_DIGESTS[alg.slice(-3)] :\n        TOKEN_HASH_DIGESTS['256'];\n    if (!digest) {\n        throw JWTError.headerPropertyInvalid('alg');\n    }\n\n    const encoder = new TextEncoder();\n    const data = encoder.encode(value);\n    const hashBuffer = await subtle.digest(digest.name, data);\n    const halfHash = hashBuffer.slice(0, digest.halfLength);\n\n    return base64URLEncode(halfHash);\n}\n\nexport async function buildOAuth2CodeChallenge(codeVerifier: string) {\n    const encoder = new TextEncoder();\n    const data = encoder.encode(codeVerifier);\n    const arrayBuffer = await subtle.digest('SHA-256', data);\n\n    return base64URLEncode(arrayBuffer);\n}\n"],"mappings":";;;;;;AAWA,SAAgBE,6BAAAA;CACZ,MAAMC,SAAS;CACf,MAAMC,UAAU;CAEhB,IAAIC,eAAe;CACnB,MAAMC,eAAe,IAAIC,WAAWJ,MAAAA;CACpCK,OAAOC,gBAAgBH,YAAAA;CAEvB,KAAK,IAAII,IAAI,GAAGA,IAAIP,QAAQO,KACxBL,gBAAgBD,QAAQE,aAAaI,KAAKN;CAG9C,OAAOC;AACX;AAEA,SAAgBM,gBAAgBC,aAAwB;CAKpD,MAAMC,WAAWC,MAAMC,KAAK,IAAIR,WAAWK,WAAAA,CAAAA;CAE3C,OAAOI,KAAKC,OAAOC,aAAaC,MAAM,MAAMN,QAAAA,CAAAA,CAAAA,CACvCO,QAAQ,OAAO,GAAA,CAAA,CACfA,QAAQ,OAAO,GAAA,CAAA,CACfA,QAAQ,OAAO,EAAA;AACxB;AAKA,MAAMC,qBAA4E;CAC9E,KAAK;EAAEC,MAAM;EAAWC,YAAY;CAAG;CACvC,KAAK;EAAED,MAAM;EAAWC,YAAY;CAAG;CACvC,KAAK;EAAED,MAAM;EAAWC,YAAY;CAAG;AAC3C;AAEA,eAAsBC,qBAClBC,OACAC,KAA8B;CAM9B,MAAMC,SAASD,MACXL,mBAAmBK,IAAIE,MAAM,EAAC,KAC9BP,mBAAmB;CACvB,IAAI,CAACM,QACD,MAAM3B,SAAS6B,sBAAsB,KAAA;CAIzC,MAAMG,OAAOF,IADOC,YACPD,CAAAA,CAAQG,OAAOR,KAAAA;CAI5B,OAAOd,iBAFUuB,MADQjC,OAAO0B,OAAOA,OAAOL,MAAMU,IAAAA,EAAAA,CACxBJ,MAAM,GAAGD,OAAOJ,UAErBY,CAAAA;AAC3B;AAEA,eAAsBC,yBAAyB/B,cAAoB;CAE/D,MAAM2B,OAAOF,IADOC,YACPD,CAAAA,CAAQG,OAAO5B,YAAAA;CAG5B,OAAOM,gBAAgBC,MAFGX,OAAO0B,OAAO,WAAWK,IAAAA,CAE5BpB;AAC3B"}
+{"version":3,"file":"helpers.mjs","names":["JWTError","OAuth2AuthenticationContextClass","OAuth2AuthenticationMethodReference","SessionAuthMethod","subtle","deriveAmrAcr","session","authMethod","amr","PASSWORD","LDAP","push","EXTERNAL","mfaAt","OTP","acr","MFA","generateOAuth2CodeVerifier","length","charset","codeVerifier","randomValues","Uint8Array","crypto","getRandomValues","i","base64URLEncode","arrayBuffer","charCode","Array","from","btoa","String","fromCharCode","apply","replace","TOKEN_HASH_DIGESTS","name","halfLength","buildOAuth2TokenHash","value","alg","digest","slice","headerPropertyInvalid","encoder","TextEncoder","data","encode","hashBuffer","halfHash","buildOAuth2CodeChallenge"],"sources":["../../../../src/core/oauth2/authorization/helpers.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { JWTAlgorithm, OAuth2TokenPayload } from '@authup/specs';\nimport {\n    JWTError,\n    OAuth2AuthenticationContextClass,\n    OAuth2AuthenticationMethodReference,\n} from '@authup/specs';\nimport type { Session } from '@authup/core-kit';\nimport { SessionAuthMethod } from '@authup/core-kit';\nimport { subtle } from 'uncrypto';\n\n/**\n * Derive the OIDC `amr` / `acr` claims from the backing session's\n * authMethod + mfaAt (plan 050). Pre-column sessions (null authMethod)\n * yield no claims — authup cannot retroactively know how an old session\n * authenticated. M2M methods yield none either (amr/acr are user-flow\n * claims; those grants mint no id_token).\n */\nexport function deriveAmrAcr(\n    session: Pick<Session, 'authMethod' | 'mfaAt'> | null,\n): Pick<OAuth2TokenPayload, 'amr' | 'acr'> {\n    if (!session || !session.authMethod) {\n        return {};\n    }\n\n    const amr : string[] = [];\n    switch (session.authMethod) {\n        case SessionAuthMethod.PASSWORD:\n        case SessionAuthMethod.LDAP: {\n            // LDAP is still a password factor for amr — the finer\n            // distinction lives in the authup-local authMethod.\n            amr.push(OAuth2AuthenticationMethodReference.PASSWORD);\n            break;\n        }\n        case SessionAuthMethod.EXTERNAL: {\n            amr.push(OAuth2AuthenticationMethodReference.EXTERNAL);\n            break;\n        }\n        default: {\n            return {};\n        }\n    }\n\n    if (session.mfaAt) {\n        amr.push(OAuth2AuthenticationMethodReference.OTP);\n    }\n\n    return {\n        amr,\n        acr: session.mfaAt ?\n            OAuth2AuthenticationContextClass.MFA :\n            OAuth2AuthenticationContextClass.PASSWORD,\n    };\n}\n\nexport function generateOAuth2CodeVerifier() {\n    const length = 64;\n    const charset = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';\n\n    let codeVerifier = '';\n    const randomValues = new Uint8Array(length);\n    crypto.getRandomValues(randomValues);\n\n    for (let i = 0; i < length; i++) {\n        codeVerifier += charset[randomValues[i] % charset.length];\n    }\n\n    return codeVerifier;\n}\n\nexport function base64URLEncode(arrayBuffer: ArrayBuffer) {\n    // Convert the ArrayBuffer to string using Uint8 array.\n    // btoa takes chars from 0-255 and base64 encodes.\n    // Then convert the base64 encoded to base64url encoded.\n    // (replace + with -, replace / with _, trim trailing =)\n    const charCode = Array.from(new Uint8Array(arrayBuffer));\n\n    return btoa(String.fromCharCode.apply(null, charCode))\n        .replace(/\\+/g, '-')\n        .replace(/\\//g, '_')\n        .replace(/=+$/, '');\n}\n\n// OIDC Core §3.1.3.6: at_hash / c_hash use the hash algorithm of the id_token's\n// JWS alg (…S256 → SHA-256, …S384 → SHA-384, …S512 → SHA-512) and keep the LEFT\n// HALF of the digest — so the half-length follows the digest (16/24/32 bytes).\nconst TOKEN_HASH_DIGESTS : Record<string, { name: string, halfLength: number }> = {\n    256: { name: 'SHA-256', halfLength: 16 },\n    384: { name: 'SHA-384', halfLength: 24 },\n    512: { name: 'SHA-512', halfLength: 32 },\n};\n\nexport async function buildOAuth2TokenHash(\n    value: string,\n    alg?: `${JWTAlgorithm}` | null,\n) : Promise<string> {\n    // A key row without a persisted alg (nullable legacy column) signs with\n    // the signer's *256 default (RS256/ES256/HS256) — derive the matching\n    // SHA-256 digest. An unrecognized alg still fails loud — silently\n    // defaulting there would mint a hash no conforming verifier accepts.\n    const digest = alg ?\n        TOKEN_HASH_DIGESTS[alg.slice(-3)] :\n        TOKEN_HASH_DIGESTS['256'];\n    if (!digest) {\n        throw JWTError.headerPropertyInvalid('alg');\n    }\n\n    const encoder = new TextEncoder();\n    const data = encoder.encode(value);\n    const hashBuffer = await subtle.digest(digest.name, data);\n    const halfHash = hashBuffer.slice(0, digest.halfLength);\n\n    return base64URLEncode(halfHash);\n}\n\nexport async function buildOAuth2CodeChallenge(codeVerifier: string) {\n    const encoder = new TextEncoder();\n    const data = encoder.encode(codeVerifier);\n    const arrayBuffer = await subtle.digest('SHA-256', data);\n\n    return base64URLEncode(arrayBuffer);\n}\n"],"mappings":";;;;;;;;;;;;;GAwBA,SAAgBK,aACZC,SAAqD;CAErD,IAAI,CAACA,WAAW,CAACA,QAAQC,YACrB,OAAO,CAAC;CAGZ,MAAMC,MAAiB,CAAA;CACvB,QAAQF,QAAQC,YAAhB;EACI,KAAKJ,kBAAkBM;EACvB,KAAKN,kBAAkBO;GAGnBF,IAAIG,KAAKT,oCAAoCO,QAAQ;GACrD;EAEJ,KAAKN,kBAAkBS;GACnBJ,IAAIG,KAAKT,oCAAoCU,QAAQ;GACrD;EAEJ,SACI,OAAO,CAAC;CAEhB;CAEA,IAAIN,QAAQO,OACRL,IAAIG,KAAKT,oCAAoCY,GAAG;CAGpD,OAAO;EACHN;EACAO,KAAKT,QAAQO,QACTZ,iCAAiCe,MACjCf,iCAAiCQ;CACzC;AACJ;AAEA,SAAgBQ,6BAAAA;CACZ,MAAMC,SAAS;CACf,MAAMC,UAAU;CAEhB,IAAIC,eAAe;CACnB,MAAMC,eAAe,IAAIC,WAAWJ,MAAAA;CACpCK,OAAOC,gBAAgBH,YAAAA;CAEvB,KAAK,IAAII,IAAI,GAAGA,IAAIP,QAAQO,KACxBL,gBAAgBD,QAAQE,aAAaI,KAAKN;CAG9C,OAAOC;AACX;AAEA,SAAgBM,gBAAgBC,aAAwB;CAKpD,MAAMC,WAAWC,MAAMC,KAAK,IAAIR,WAAWK,WAAAA,CAAAA;CAE3C,OAAOI,KAAKC,OAAOC,aAAaC,MAAM,MAAMN,QAAAA,CAAAA,CAAAA,CACvCO,QAAQ,OAAO,GAAA,CAAA,CACfA,QAAQ,OAAO,GAAA,CAAA,CACfA,QAAQ,OAAO,EAAA;AACxB;AAKA,MAAMC,qBAA4E;CAC9E,KAAK;EAAEC,MAAM;EAAWC,YAAY;CAAG;CACvC,KAAK;EAAED,MAAM;EAAWC,YAAY;CAAG;CACvC,KAAK;EAAED,MAAM;EAAWC,YAAY;CAAG;AAC3C;AAEA,eAAsBC,qBAClBC,OACAC,KAA8B;CAM9B,MAAMC,SAASD,MACXL,mBAAmBK,IAAIE,MAAM,EAAC,KAC9BP,mBAAmB;CACvB,IAAI,CAACM,QACD,MAAM1C,SAAS4C,sBAAsB,KAAA;CAIzC,MAAMG,OAAOF,IADOC,YACPD,CAAAA,CAAQG,OAAOR,KAAAA;CAI5B,OAAOd,iBAFUuB,MADQ7C,OAAOsC,OAAOA,OAAOL,MAAMU,IAAAA,EAAAA,CACxBJ,MAAM,GAAGD,OAAOJ,UAErBY,CAAAA;AAC3B;AAEA,eAAsBC,yBAAyB/B,cAAoB;CAE/D,MAAM2B,OAAOF,IADOC,YACPD,CAAAA,CAAQG,OAAO5B,YAAAA;CAG5B,OAAOM,gBAAgBC,MAFGvB,OAAOsC,OAAO,WAAWK,IAAAA,CAE5BpB;AAC3B"}

package/dist/core/oauth2/authorization/index.mjs

@@ -2,7 +2,7 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { OAuth2AuthorizationCodeIssuer } from "./code/issuer/module.mjs";
-import { base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, generateOAuth2CodeVerifier } from "./helpers.mjs";
+import { base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, deriveAmrAcr, generateOAuth2CodeVerifier } from "./helpers.mjs";
 import { OAuth2AuthorizationCodeVerifier } from "./code/verifier/module.mjs";
 import "./code/index.mjs";
 import { OAuth2AuthorizationCodeRequestVerifier } from "./code-request/verifier/module.mjs";
@@ -11,4 +11,4 @@ import "./code-request/index.mjs";
 import { OAuth2AuthorizationStateManager } from "./state/module.mjs";
 import "./state/index.mjs";
 import { OAuth2Authorization } from "./module.mjs";
-export { OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, generateOAuth2CodeVerifier };
+export { OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, deriveAmrAcr, generateOAuth2CodeVerifier };

package/dist/core/oauth2/authorization/module.d.ts

@@ -1,11 +1,19 @@
 import type { Identity, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';
 import type { IOAuth2AuthorizationCodeIssuer } from './code/index.ts';
+import type { IOAuth2AccessPolicyEvaluator } from '../access-policy/index.ts';
 import type { OAuth2AuthorizationManagerContext, OAuth2AuthorizationOptions, OAuth2AuthorizationResult } from './types.ts';
 import type { ISessionManager } from '../../authentication/index.ts';
+import type { IEventService, IUserAuthenticatorChallengeProvider } from '../../entities/index.ts';
+import type { IAuthFlowMetrics } from '../../metrics/index.ts';
 export declare class OAuth2Authorization {
     protected codeIssuer: IOAuth2AuthorizationCodeIssuer;
     protected sessionManager: ISessionManager;
+    protected eventService?: IEventService;
+    protected metrics?: IAuthFlowMetrics;
     protected promptLoginMaxAge: number;
+    protected mfaFreshnessMaxAge: number;
+    protected mfaChallengeProvider?: IUserAuthenticatorChallengeProvider;
+    protected accessPolicyEvaluator?: IOAuth2AccessPolicyEvaluator;
     constructor(ctx: OAuth2AuthorizationManagerContext);
     /**
      * Authorize with validated codeRequest.
@@ -15,5 +23,6 @@ export declare class OAuth2Authorization {
      * @param options
      */
     authorize(data: OAuth2AuthorizationCodeRequest, identity: Identity, options?: OAuth2AuthorizationOptions): Promise<OAuth2AuthorizationResult>;
+    protected authorizeInner(data: OAuth2AuthorizationCodeRequest, identity: Identity, options?: OAuth2AuthorizationOptions): Promise<OAuth2AuthorizationResult>;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/core/oauth2/authorization/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/authorization/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAA2B,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAS1G,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,KAAK,EACR,iCAAiC,EACjC,0BAA0B,EAC1B,yBAAyB,EAC5B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAIrE,qBAAa,mBAAmB;IAC5B,SAAS,CAAC,UAAU,EAAG,8BAA8B,CAAC;IAEtD,SAAS,CAAC,cAAc,EAAG,eAAe,CAAC;IAE3C,SAAS,CAAC,iBAAiB,EAAG,MAAM,CAAC;gBAEzB,GAAG,EAAE,iCAAiC;IAMlD;;;;;;OAMG;IACG,SAAS,CACX,IAAI,EAAE,8BAA8B,EACpC,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,0BAA+B,GACxC,OAAO,CAAC,yBAAyB,CAAC;CAoGzC"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/authorization/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,QAAQ,EAER,8BAA8B,EAEjC,MAAM,kBAAkB,CAAC;AAsB1B,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAE9E,OAAO,KAAK,EACR,iCAAiC,EACjC,0BAA0B,EAC1B,yBAAyB,EAC5B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,mCAAmC,EAAE,MAAM,yBAAyB,CAAC;AAClG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAS/D,qBAAa,mBAAmB;IAC5B,SAAS,CAAC,UAAU,EAAG,8BAA8B,CAAC;IAEtD,SAAS,CAAC,cAAc,EAAG,eAAe,CAAC;IAE3C,SAAS,CAAC,YAAY,CAAC,EAAG,aAAa,CAAC;IAExC,SAAS,CAAC,OAAO,CAAC,EAAG,gBAAgB,CAAC;IAEtC,SAAS,CAAC,iBAAiB,EAAG,MAAM,CAAC;IAErC,SAAS,CAAC,kBAAkB,EAAG,MAAM,CAAC;IAEtC,SAAS,CAAC,oBAAoB,CAAC,EAAG,mCAAmC,CAAC;IAEtE,SAAS,CAAC,qBAAqB,CAAC,EAAG,4BAA4B,CAAC;gBAEpD,GAAG,EAAE,iCAAiC;IAWlD;;;;;;OAMG;IACG,SAAS,CACX,IAAI,EAAE,8BAA8B,EACpC,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,0BAA+B,GACxC,OAAO,CAAC,yBAAyB,CAAC;cAiDtB,cAAc,CAC1B,IAAI,EAAE,8BAA8B,EACpC,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,0BAA+B,GACxC,OAAO,CAAC,yBAAyB,CAAC;CA4KzC"}

package/dist/core/oauth2/authorization/module.mjs

@@ -1,17 +1,31 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { OAuth2AuthorizationPrompt, OAuth2AuthorizationResponseType, OAuth2GrantError, OAuth2LoginRequiredError, OAuth2RequestError, OAuth2ResponseTypeError } from "@authup/specs";
+import { toIdentityPolicyData } from "../../identity/permission/identity-policy-data.mjs";
+import { EventName, EventRefType, EventScope, IdentityType } from "@authup/core-kit";
+import { hasInstanceof } from "@authup/errors";
+import { OAUTH2_ACCESS_DENIED_ERROR_INSTANCE, OAUTH2_LOGIN_REQUIRED_ERROR_INSTANCE, OAUTH2_MFA_REQUIRED_ERROR_INSTANCE, OAuth2AccessDeniedError, OAuth2AuthenticationContextClass, OAuth2AuthorizationPrompt, OAuth2AuthorizationResponseType, OAuth2GrantError, OAuth2LoginRequiredError, OAuth2MfaRequiredError, OAuth2RequestError, OAuth2ResponseTypeError } from "@authup/specs";
 //#region src/core/oauth2/authorization/module.ts
 const DEFAULT_PROMPT_LOGIN_MAX_AGE = 60;
+const DEFAULT_MFA_FRESHNESS_MAX_AGE = 60;
 var OAuth2Authorization = class {
 	codeIssuer;
 	sessionManager;
+	eventService;
+	metrics;
 	promptLoginMaxAge;
+	mfaFreshnessMaxAge;
+	mfaChallengeProvider;
+	accessPolicyEvaluator;
 	constructor(ctx) {
 		this.codeIssuer = ctx.codeIssuer;
 		this.sessionManager = ctx.sessionManager;
+		this.eventService = ctx.eventService;
+		this.metrics = ctx.metrics;
+		this.accessPolicyEvaluator = ctx.accessPolicyEvaluator;
 		this.promptLoginMaxAge = ctx.promptLoginMaxAge ?? DEFAULT_PROMPT_LOGIN_MAX_AGE;
+		this.mfaFreshnessMaxAge = ctx.mfaFreshnessMaxAge ?? DEFAULT_MFA_FRESHNESS_MAX_AGE;
+		this.mfaChallengeProvider = ctx.mfaChallengeProvider;
 	}
 	/**
 	* Authorize with validated codeRequest.
@@ -20,6 +34,47 @@ var OAuth2Authorization = class {
 	* @param identity
 	* @param options
 	*/ async authorize(data, identity, options = {}) {
+		try {
+			const result = await this.authorizeInner(data, identity, options);
+			await this.eventService?.record({
+				scope: EventScope.OAUTH2,
+				name: EventName.AUTHORIZE,
+				refType: EventRefType.CLIENT,
+				refId: options.client?.id ?? data.client_id ?? null,
+				clientId: options.client?.id ?? data.client_id ?? null,
+				actorType: identity.type,
+				actorId: identity.data.id,
+				actorName: identity.data.name,
+				realmId: data.realm_id ?? null,
+				data: {
+					reason: options.client?.builtIn ? "autoConsent" : "consent",
+					...data.scope ? { scope: data.scope } : {}
+				}
+			});
+			this.metrics?.recordAuthorize("issued");
+			return result;
+		} catch (e) {
+			if (hasInstanceof(e, OAUTH2_ACCESS_DENIED_ERROR_INSTANCE)) {
+				await this.eventService?.record({
+					scope: EventScope.OAUTH2,
+					name: EventName.AUTHORIZE_FAILED,
+					refType: EventRefType.CLIENT,
+					refId: options.client?.id ?? data.client_id ?? null,
+					clientId: options.client?.id ?? data.client_id ?? null,
+					actorType: identity.type,
+					actorId: identity.data.id,
+					actorName: identity.data.name,
+					realmId: data.realm_id ?? null,
+					data: { reason: "accessPolicy" }
+				});
+				this.metrics?.recordAuthorize("denied");
+			} else if (hasInstanceof(e, OAUTH2_LOGIN_REQUIRED_ERROR_INSTANCE)) this.metrics?.recordAuthorize("login_required");
+			else if (hasInstanceof(e, OAUTH2_MFA_REQUIRED_ERROR_INSTANCE)) this.metrics?.recordAuthorize("mfa_required");
+			else this.metrics?.recordAuthorize("error");
+			throw e;
+		}
+	}
+	async authorizeInner(data, identity, options = {}) {
 		let responseTypes = [];
 		if (data.response_type) responseTypes = Array.isArray(data.response_type) ? data.response_type : data.response_type.split(" ");
 		for (const responseType of responseTypes) if (responseType !== OAuth2AuthorizationResponseType.CODE) throw OAuth2ResponseTypeError.unsupported();
@@ -30,21 +85,43 @@ var OAuth2Authorization = class {
 			...data.state ? { state: data.state } : {}
 		};
 		if (!identity) throw OAuth2RequestError.identityInvalid();
-		if (data.realm_id && identity.data.realm_id !== data.realm_id) throw OAuth2LoginRequiredError.realmMismatch();
+		if (data.realm_id && identity.data.realmId !== data.realm_id) throw OAuth2LoginRequiredError.realmMismatch();
 		const nowSeconds = Math.floor(Date.now() / 1e3);
 		let authTime = nowSeconds;
+		let session = null;
 		if (options.sessionId) {
-			const session = await this.sessionManager.findOneById(options.sessionId);
-			if (session && session.created_at) authTime = Math.floor(new Date(session.created_at).getTime() / 1e3);
+			session = await this.sessionManager.findOneById(options.sessionId);
+			if (session && session.createdAt) authTime = Math.floor(new Date(session.createdAt).getTime() / 1e3);
+		}
+		if (this.mfaChallengeProvider && identity.type === IdentityType.USER) {
+			const challenge = await this.mfaChallengeProvider.challenge(identity.data.id, { issueMaterial: false });
+			if (challenge.required && !session?.mfaAt) throw OAuth2MfaRequiredError.challengeRequired();
+			if (challenge.enrollmentRequired) throw OAuth2MfaRequiredError.enrollmentRequired();
+			if (challenge.required && data.acr_values) {
+				if (data.acr_values.split(" ").includes(OAuth2AuthenticationContextClass.MFA)) {
+					const mfaAtSeconds = session?.mfaAt ? Math.floor(new Date(session.mfaAt).getTime() / 1e3) : null;
+					if (mfaAtSeconds === null || nowSeconds - mfaAtSeconds > this.mfaFreshnessMaxAge) throw OAuth2MfaRequiredError.stepUpRequired();
+				}
+			}
 		}
 		if ((data.prompt ? data.prompt.split(" ") : []).includes(OAuth2AuthorizationPrompt.LOGIN) && nowSeconds - authTime > this.promptLoginMaxAge) throw OAuth2LoginRequiredError.reauthenticationRequired();
 		if (typeof data.max_age !== "undefined" && data.max_age !== null) {
 			const maxAge = Number(data.max_age);
 			if (Number.isFinite(maxAge) && nowSeconds - authTime > maxAge) throw OAuth2LoginRequiredError.reauthenticationRequired();
 		}
+		if (options.client?.accessPolicyId) {
+			let allowed = false;
+			const subject = toIdentityPolicyData(identity);
+			if (this.accessPolicyEvaluator && subject) allowed = await this.accessPolicyEvaluator.evaluate(options.client.accessPolicyId, subject);
+			if (!allowed) throw OAuth2AccessDeniedError.forClient(options.redirectUriVerified && data.redirect_uri ? {
+				redirectUri: data.redirect_uri,
+				state: data.state ?? null
+			} : void 0);
+		}
 		output.authorizationCode = (await this.codeIssuer.issue(data, identity, {
 			sessionId: options.sessionId,
-			authTime
+			authTime,
+			authMethod: session?.authMethod ?? null
 		})).id;
 		return output;
 	}