@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.54

package/dist/core/oauth2/authorization/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2AuthorizationPrompt","OAuth2AuthorizationResponseType","OAuth2GrantError","OAuth2LoginRequiredError","OAuth2RequestError","OAuth2ResponseTypeError","DEFAULT_PROMPT_LOGIN_MAX_AGE","OAuth2Authorization","codeIssuer","sessionManager","promptLoginMaxAge","ctx","authorize","data","identity","options","responseTypes","response_type","Array","isArray","split","responseType","CODE","unsupported","includes","redirect_uri","redirectUriMismatch","output","redirectUri","state","identityInvalid","realm_id","realmMismatch","nowSeconds","Math","floor","Date","now","authTime","sessionId","session","findOneById","created_at","getTime","prompts","prompt","LOGIN","reauthenticationRequired","max_age","maxAge","Number","isFinite","codeEntity","issue","authorizationCode","id"],"sources":["../../../../src/core/oauth2/authorization/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Identity, OAuth2AuthorizationCode, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport {\n    OAuth2AuthorizationPrompt,\n    OAuth2AuthorizationResponseType,\n    OAuth2GrantError,\n    OAuth2LoginRequiredError,\n    OAuth2RequestError,\n    OAuth2ResponseTypeError,\n} from '@authup/specs';\nimport type { IOAuth2AuthorizationCodeIssuer } from './code/index.ts';\nimport type {\n    OAuth2AuthorizationManagerContext,\n    OAuth2AuthorizationOptions,\n    OAuth2AuthorizationResult,\n} from './types.ts';\nimport type { ISessionManager } from '../../authentication/index.ts';\n\nconst DEFAULT_PROMPT_LOGIN_MAX_AGE = 60;\n\nexport class OAuth2Authorization {\n    protected codeIssuer : IOAuth2AuthorizationCodeIssuer;\n\n    protected sessionManager : ISessionManager;\n\n    protected promptLoginMaxAge : number;\n\n    constructor(ctx: OAuth2AuthorizationManagerContext) {\n        this.codeIssuer = ctx.codeIssuer;\n        this.sessionManager = ctx.sessionManager;\n        this.promptLoginMaxAge = ctx.promptLoginMaxAge ?? DEFAULT_PROMPT_LOGIN_MAX_AGE;\n    }\n\n    /**\n     * Authorize with validated codeRequest.\n     *\n     * @param data\n     * @param identity\n     * @param options\n     */\n    async authorize(\n        data: OAuth2AuthorizationCodeRequest,\n        identity: Identity,\n        options: OAuth2AuthorizationOptions = {},\n    ) : Promise<OAuth2AuthorizationResult> {\n        // OAuth 2.1 posture: only the authorization-code response type is\n        // supported — implicit/hybrid (token, id_token, none) were dropped\n        // (plan 042 item 3). Defense in depth behind the request validator.\n        let responseTypes : string[] = [];\n        if (data.response_type) {\n            responseTypes = Array.isArray(data.response_type) ?\n                data.response_type :\n                data.response_type.split(' ');\n        }\n\n        for (const responseType of responseTypes) {\n            if (responseType !== OAuth2AuthorizationResponseType.CODE) {\n                throw OAuth2ResponseTypeError.unsupported();\n            }\n        }\n\n        if (!responseTypes.includes(OAuth2AuthorizationResponseType.CODE)) {\n            throw OAuth2ResponseTypeError.unsupported();\n        }\n\n        if (!data.redirect_uri) {\n            throw OAuth2GrantError.redirectUriMismatch();\n        }\n\n        const output : OAuth2AuthorizationResult = {\n            redirectUri: data.redirect_uri,\n            ...(data.state ? { state: data.state } : {}),\n        };\n\n        if (!identity) {\n            throw OAuth2RequestError.identityInvalid();\n        }\n\n        // Realm binding: the code-request verifier stamped data.realm_id with the\n        // resolved client's realm. The authenticated identity must belong to that\n        // same realm — otherwise a lingering session for realm A could silently\n        // mint a code/token for realm B's client (confused deputy). The error body\n        // deliberately carries no identity data (no realm-enumeration oracle).\n        // The comparison reads the scalar realm_id column, NOT the realm\n        // relation — the relation may simply not be loaded on the resolved\n        // identity. An identity without a realm_id fails closed the same way —\n        // clean login_required, never a TypeError.\n        if (\n            data.realm_id &&\n            identity.data.realm_id !== data.realm_id\n        ) {\n            throw OAuth2LoginRequiredError.realmMismatch();\n        }\n\n        // Authentication time = the backing session's creation instant (NOT\n        // refreshed_at — a token refresh must not reset it). Session-less flows\n        // (e.g. HTTP Basic authorize) present live credentials on this request,\n        // so the authentication time is \"now\".\n        const nowSeconds = Math.floor(Date.now() / 1000);\n        let authTime = nowSeconds;\n        if (options.sessionId) {\n            const session = await this.sessionManager.findOneById(options.sessionId);\n            if (session && session.created_at) {\n                authTime = Math.floor(new Date(session.created_at).getTime() / 1000);\n            }\n        }\n\n        // OIDC §3.1.2.1 prompt=login / max_age freshness (enforced only when\n        // requested — a plain authorize never throws here). The hosted page\n        // renders the login form for prompt=login; this is the server backstop.\n        const prompts = data.prompt ? data.prompt.split(' ') : [];\n        if (\n            prompts.includes(OAuth2AuthorizationPrompt.LOGIN) &&\n            nowSeconds - authTime > this.promptLoginMaxAge\n        ) {\n            throw OAuth2LoginRequiredError.reauthenticationRequired();\n        }\n\n        if (\n            typeof data.max_age !== 'undefined' &&\n            data.max_age !== null\n        ) {\n            const maxAge = Number(data.max_age);\n            if (\n                Number.isFinite(maxAge) &&\n                nowSeconds - authTime > maxAge\n            ) {\n                throw OAuth2LoginRequiredError.reauthenticationRequired();\n            }\n        }\n\n        // The id_token is NOT minted here — the /token exchange mints it after\n        // resolving the real backing session, so its `sid` is authoritative\n        // (plan 042 item 6). The code carries the authentication instant.\n        const codeEntity : OAuth2AuthorizationCode = await this.codeIssuer.issue(\n            data,\n            identity,\n            { sessionId: options.sessionId, authTime },\n        );\n\n        output.authorizationCode = codeEntity.id;\n\n        return output;\n    }\n}\n"],"mappings":";;;;;AAwBA,MAAMM,+BAA+B;AAErC,IAAaC,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAAwC;EAChD,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,oBAAoBC,IAAID,qBAAqBJ;CACtD;;;;;;;IASA,MAAMM,UACFC,MACAC,UACAC,UAAsC,CAAC,GACJ;EAInC,IAAIC,gBAA2B,CAAA;EAC/B,IAAIH,KAAKI,eACLD,gBAAgBE,MAAMC,QAAQN,KAAKI,aAAa,IAC5CJ,KAAKI,gBACLJ,KAAKI,cAAcG,MAAM,GAAA;EAGjC,KAAK,MAAMC,gBAAgBL,eACvB,IAAIK,iBAAiBpB,gCAAgCqB,MACjD,MAAMjB,wBAAwBkB,YAAW;EAIjD,IAAI,CAACP,cAAcQ,SAASvB,gCAAgCqB,IAAI,GAC5D,MAAMjB,wBAAwBkB,YAAW;EAG7C,IAAI,CAACV,KAAKY,cACN,MAAMvB,iBAAiBwB,oBAAmB;EAG9C,MAAMC,SAAqC;GACvCC,aAAaf,KAAKY;GAClB,GAAIZ,KAAKgB,QAAQ,EAAEA,OAAOhB,KAAKgB,MAAM,IAAI,CAAC;EAC9C;EAEA,IAAI,CAACf,UACD,MAAMV,mBAAmB0B,gBAAe;EAY5C,IACIjB,KAAKkB,YACLjB,SAASD,KAAKkB,aAAalB,KAAKkB,UAEhC,MAAM5B,yBAAyB6B,cAAa;EAOhD,MAAMC,aAAaC,KAAKC,MAAMC,KAAKC,IAAG,IAAK,GAAA;EAC3C,IAAIC,WAAWL;EACf,IAAIlB,QAAQwB,WAAW;GACnB,MAAMC,UAAU,MAAM,KAAK/B,eAAegC,YAAY1B,QAAQwB,SAAS;GACvE,IAAIC,WAAWA,QAAQE,YACnBJ,WAAWJ,KAAKC,MAAM,IAAIC,KAAKI,QAAQE,UAAU,CAAA,CAAEC,QAAO,IAAK,GAAA;EAEvE;EAMA,KADgB9B,KAAKgC,SAAShC,KAAKgC,OAAOzB,MAAM,GAAA,IAAO,CAAA,EAAA,CAE3CI,SAASxB,0BAA0B8C,KAAK,KAChDb,aAAaK,WAAW,KAAK5B,mBAE7B,MAAMP,yBAAyB4C,yBAAwB;EAG3D,IACI,OAAOlC,KAAKmC,YAAY,eACxBnC,KAAKmC,YAAY,MACnB;GACE,MAAMC,SAASC,OAAOrC,KAAKmC,OAAO;GAClC,IACIE,OAAOC,SAASF,MAAAA,KAChBhB,aAAaK,WAAWW,QAExB,MAAM9C,yBAAyB4C,yBAAwB;EAE/D;EAWApB,OAAO2B,qBAAoBF,MANwB,KAAK5C,WAAW6C,MAC/DxC,MACAC,UACA;GAAEyB,WAAWxB,QAAQwB;GAAWD;EAAS,CAAA,EAAA,CAGPiB;EAEtC,OAAO5B;CACX;AACJ"}
+{"version":3,"file":"module.mjs","names":["EventName","EventRefType","EventScope","IdentityType","hasInstanceof","OAUTH2_ACCESS_DENIED_ERROR_INSTANCE","OAUTH2_LOGIN_REQUIRED_ERROR_INSTANCE","OAUTH2_MFA_REQUIRED_ERROR_INSTANCE","OAuth2AccessDeniedError","OAuth2AuthenticationContextClass","OAuth2AuthorizationPrompt","OAuth2AuthorizationResponseType","OAuth2GrantError","OAuth2LoginRequiredError","OAuth2MfaRequiredError","OAuth2RequestError","OAuth2ResponseTypeError","toIdentityPolicyData","DEFAULT_PROMPT_LOGIN_MAX_AGE","DEFAULT_MFA_FRESHNESS_MAX_AGE","OAuth2Authorization","codeIssuer","sessionManager","eventService","metrics","promptLoginMaxAge","mfaFreshnessMaxAge","mfaChallengeProvider","accessPolicyEvaluator","ctx","authorize","data","identity","options","result","authorizeInner","record","scope","OAUTH2","name","AUTHORIZE","refType","CLIENT","refId","client","id","client_id","clientId","actorType","type","actorId","actorName","realmId","realm_id","reason","builtIn","recordAuthorize","e","AUTHORIZE_FAILED","responseTypes","response_type","Array","isArray","split","responseType","CODE","unsupported","includes","redirect_uri","redirectUriMismatch","output","redirectUri","state","identityInvalid","realmMismatch","nowSeconds","Math","floor","Date","now","authTime","session","sessionId","findOneById","createdAt","getTime","USER","challenge","issueMaterial","required","mfaAt","challengeRequired","enrollmentRequired","acr_values","acrValues","MFA","mfaAtSeconds","stepUpRequired","prompts","prompt","LOGIN","reauthenticationRequired","max_age","maxAge","Number","isFinite","accessPolicyId","allowed","subject","evaluate","forClient","redirectUriVerified","undefined","codeEntity","issue","authMethod","authorizationCode"],"sources":["../../../../src/core/oauth2/authorization/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Identity, \n    OAuth2AuthorizationCode, \n    OAuth2AuthorizationCodeRequest, \n    Session,\n} from '@authup/core-kit';\nimport {\n    EventName, \n    EventRefType, \n    EventScope, \n    IdentityType,\n} from '@authup/core-kit';\nimport { hasInstanceof } from '@authup/errors';\nimport {\n    OAUTH2_ACCESS_DENIED_ERROR_INSTANCE,\n    OAUTH2_LOGIN_REQUIRED_ERROR_INSTANCE,\n    OAUTH2_MFA_REQUIRED_ERROR_INSTANCE,\n    OAuth2AccessDeniedError,\n    OAuth2AuthenticationContextClass,\n    OAuth2AuthorizationPrompt,\n    OAuth2AuthorizationResponseType,\n    OAuth2GrantError,\n    OAuth2LoginRequiredError,\n    OAuth2MfaRequiredError,\n    OAuth2RequestError,\n    OAuth2ResponseTypeError,\n} from '@authup/specs';\nimport type { IOAuth2AuthorizationCodeIssuer } from './code/index.ts';\nimport type { IOAuth2AccessPolicyEvaluator } from '../access-policy/index.ts';\nimport { toIdentityPolicyData } from '../../identity/permission/identity-policy-data.ts';\nimport type {\n    OAuth2AuthorizationManagerContext,\n    OAuth2AuthorizationOptions,\n    OAuth2AuthorizationResult,\n} from './types.ts';\nimport type { ISessionManager } from '../../authentication/index.ts';\nimport type { IEventService, IUserAuthenticatorChallengeProvider } from '../../entities/index.ts';\nimport type { IAuthFlowMetrics } from '../../metrics/index.ts';\n\nconst DEFAULT_PROMPT_LOGIN_MAX_AGE = 60;\n\n// Deliberately 60 (not 0, deviating from the plan-050 sketch): the hosted\n// challenge round-trip (stamp mfa_at → retry POST /authorize) takes seconds,\n// so a 0-window step-up could never be satisfied and would loop the ladder.\nconst DEFAULT_MFA_FRESHNESS_MAX_AGE = 60;\n\nexport class OAuth2Authorization {\n    protected codeIssuer : IOAuth2AuthorizationCodeIssuer;\n\n    protected sessionManager : ISessionManager;\n\n    protected eventService? : IEventService;\n\n    protected metrics? : IAuthFlowMetrics;\n\n    protected promptLoginMaxAge : number;\n\n    protected mfaFreshnessMaxAge : number;\n\n    protected mfaChallengeProvider? : IUserAuthenticatorChallengeProvider;\n\n    protected accessPolicyEvaluator? : IOAuth2AccessPolicyEvaluator;\n\n    constructor(ctx: OAuth2AuthorizationManagerContext) {\n        this.codeIssuer = ctx.codeIssuer;\n        this.sessionManager = ctx.sessionManager;\n        this.eventService = ctx.eventService;\n        this.metrics = ctx.metrics;\n        this.accessPolicyEvaluator = ctx.accessPolicyEvaluator;\n        this.promptLoginMaxAge = ctx.promptLoginMaxAge ?? DEFAULT_PROMPT_LOGIN_MAX_AGE;\n        this.mfaFreshnessMaxAge = ctx.mfaFreshnessMaxAge ?? DEFAULT_MFA_FRESHNESS_MAX_AGE;\n        this.mfaChallengeProvider = ctx.mfaChallengeProvider;\n    }\n\n    /**\n     * Authorize with validated codeRequest.\n     *\n     * @param data\n     * @param identity\n     * @param options\n     */\n    async authorize(\n        data: OAuth2AuthorizationCodeRequest,\n        identity: Identity,\n        options: OAuth2AuthorizationOptions = {},\n    ) : Promise<OAuth2AuthorizationResult> {\n        try {\n            const result = await this.authorizeInner(data, identity, options);\n\n            await this.eventService?.record({\n                scope: EventScope.OAUTH2,\n                name: EventName.AUTHORIZE,\n                refType: EventRefType.CLIENT,\n                refId: options.client?.id ?? data.client_id ?? null,\n                clientId: options.client?.id ?? data.client_id ?? null,\n                actorType: identity.type,\n                actorId: identity.data.id,\n                actorName: identity.data.name,\n                realmId: data.realm_id ?? null,\n                data: {\n                    reason: options.client?.builtIn ? 'autoConsent' : 'consent',\n                    ...(data.scope ? { scope: data.scope } : {}),\n                },\n            });\n            this.metrics?.recordAuthorize('issued');\n\n            return result;\n        } catch (e) {\n            if (hasInstanceof(e, OAUTH2_ACCESS_DENIED_ERROR_INSTANCE)) {\n                await this.eventService?.record({\n                    scope: EventScope.OAUTH2,\n                    name: EventName.AUTHORIZE_FAILED,\n                    refType: EventRefType.CLIENT,\n                    refId: options.client?.id ?? data.client_id ?? null,\n                    clientId: options.client?.id ?? data.client_id ?? null,\n                    actorType: identity.type,\n                    actorId: identity.data.id,\n                    actorName: identity.data.name,\n                    realmId: data.realm_id ?? null,\n                    data: { reason: 'accessPolicy' },\n                });\n                this.metrics?.recordAuthorize('denied');\n            } else if (hasInstanceof(e, OAUTH2_LOGIN_REQUIRED_ERROR_INSTANCE)) {\n                this.metrics?.recordAuthorize('login_required');\n            } else if (hasInstanceof(e, OAUTH2_MFA_REQUIRED_ERROR_INSTANCE)) {\n                this.metrics?.recordAuthorize('mfa_required');\n            } else {\n                this.metrics?.recordAuthorize('error');\n            }\n\n            throw e;\n        }\n    }\n\n    protected async authorizeInner(\n        data: OAuth2AuthorizationCodeRequest,\n        identity: Identity,\n        options: OAuth2AuthorizationOptions = {},\n    ) : Promise<OAuth2AuthorizationResult> {\n        // OAuth 2.1 posture: only the authorization-code response type is\n        // supported — implicit/hybrid (token, id_token, none) were dropped\n        // (plan 042 item 3). Defense in depth behind the request validator.\n        let responseTypes : string[] = [];\n        if (data.response_type) {\n            responseTypes = Array.isArray(data.response_type) ?\n                data.response_type :\n                data.response_type.split(' ');\n        }\n\n        for (const responseType of responseTypes) {\n            if (responseType !== OAuth2AuthorizationResponseType.CODE) {\n                throw OAuth2ResponseTypeError.unsupported();\n            }\n        }\n\n        if (!responseTypes.includes(OAuth2AuthorizationResponseType.CODE)) {\n            throw OAuth2ResponseTypeError.unsupported();\n        }\n\n        if (!data.redirect_uri) {\n            throw OAuth2GrantError.redirectUriMismatch();\n        }\n\n        const output : OAuth2AuthorizationResult = {\n            redirectUri: data.redirect_uri,\n            ...(data.state ? { state: data.state } : {}),\n        };\n\n        if (!identity) {\n            throw OAuth2RequestError.identityInvalid();\n        }\n\n        // Realm binding: the code-request verifier stamped data.realm_id with the\n        // resolved client's realm. The authenticated identity must belong to that\n        // same realm — otherwise a lingering session for realm A could silently\n        // mint a code/token for realm B's client (confused deputy). The error body\n        // deliberately carries no identity data (no realm-enumeration oracle).\n        // The comparison reads the scalar realmId column, NOT the realm\n        // relation — the relation may simply not be loaded on the resolved\n        // identity. An identity without a realmId fails closed the same way —\n        // clean login_required, never a TypeError.\n        if (\n            data.realm_id &&\n            identity.data.realmId !== data.realm_id\n        ) {\n            throw OAuth2LoginRequiredError.realmMismatch();\n        }\n\n        // Authentication time = the backing session's creation instant (NOT\n        // refreshed_at — a token refresh must not reset it). Session-less flows\n        // (e.g. HTTP Basic authorize) present live credentials on this request,\n        // so the authentication time is \"now\".\n        const nowSeconds = Math.floor(Date.now() / 1000);\n        let authTime = nowSeconds;\n        let session : Session | null = null;\n        if (options.sessionId) {\n            session = await this.sessionManager.findOneById(options.sessionId);\n            if (session && session.createdAt) {\n                authTime = Math.floor(new Date(session.createdAt).getTime() / 1000);\n            }\n        }\n\n        // MFA backstop (plan 049) — the authoritative server-side gate; the\n        // hosted UI's challenge step is convenience. The proof is session-bound\n        // (mfa_at — stamped by the challenge endpoint or the password grant's\n        // otp param), so a session-less flow (HTTP Basic) cannot carry one and\n        // fails closed while the user holds a confirmed device. A user without\n        // a device under mfaRequired is routed to inline enrollment.\n        if (this.mfaChallengeProvider && identity.type === IdentityType.USER) {\n            // requirement flags only — the interactive challenge material (the\n            // webauthn nonce) is issued by the status endpoint, not this backstop.\n            const challenge = await this.mfaChallengeProvider.challenge(\n                identity.data.id,\n                { issueMaterial: false },\n            );\n            if (challenge.required && !session?.mfaAt) {\n                throw OAuth2MfaRequiredError.challengeRequired();\n            }\n\n            if (challenge.enrollmentRequired) {\n                throw OAuth2MfaRequiredError.enrollmentRequired();\n            }\n\n            // Step-up (plan 050 stage 3): a requested `acr_values` containing\n            // urn:authup:mfa is a TRIGGER (Auth0/Keycloak stance) — the proof\n            // must additionally be FRESH (mfaFreshnessMaxAge window, mirroring\n            // promptLoginMaxAge's absorb-the-round-trip semantics). Enforced\n            // only while the user actually holds a factor — per OIDC Core\n            // §5.5.1.1 acr is voluntary, so an unsatisfiable request degrades\n            // to the achieved acr instead of bricking the RP.\n            if (challenge.required && data.acr_values) {\n                const acrValues = data.acr_values.split(' ');\n                if (acrValues.includes(OAuth2AuthenticationContextClass.MFA)) {\n                    const mfaAtSeconds = session?.mfaAt ?\n                        Math.floor(new Date(session.mfaAt).getTime() / 1000) :\n                        null;\n                    if (mfaAtSeconds === null || nowSeconds - mfaAtSeconds > this.mfaFreshnessMaxAge) {\n                        throw OAuth2MfaRequiredError.stepUpRequired();\n                    }\n                }\n            }\n        }\n\n        // OIDC §3.1.2.1 prompt=login / max_age freshness (enforced only when\n        // requested — a plain authorize never throws here). The hosted page\n        // renders the login form for prompt=login; this is the server backstop.\n        const prompts = data.prompt ? data.prompt.split(' ') : [];\n        if (\n            prompts.includes(OAuth2AuthorizationPrompt.LOGIN) &&\n            nowSeconds - authTime > this.promptLoginMaxAge\n        ) {\n            throw OAuth2LoginRequiredError.reauthenticationRequired();\n        }\n\n        if (\n            typeof data.max_age !== 'undefined' &&\n            data.max_age !== null\n        ) {\n            const maxAge = Number(data.max_age);\n            if (\n                Number.isFinite(maxAge) &&\n                nowSeconds - authTime > maxAge\n            ) {\n                throw OAuth2LoginRequiredError.reauthenticationRequired();\n            }\n        }\n\n        // Application access policy (plan 052) — the last gate before\n        // issuance: a denial is only revealed to a fully-authenticated\n        // (incl. second-factor) identity. A client carrying a policy id with\n        // no wired evaluator denies too (never silently allow a configured\n        // gate). The redirect target rides the error only when the\n        // redirect_uri was pattern-verified (RFC 6749 §4.1.2.1).\n        if (options.client?.accessPolicyId) {\n            let allowed = false;\n\n            const subject = toIdentityPolicyData(identity);\n            if (this.accessPolicyEvaluator && subject) {\n                allowed = await this.accessPolicyEvaluator.evaluate(\n                    options.client.accessPolicyId,\n                    subject,\n                );\n            }\n\n            if (!allowed) {\n                throw OAuth2AccessDeniedError.forClient(\n                    options.redirectUriVerified && data.redirect_uri ?\n                        { redirectUri: data.redirect_uri, state: data.state ?? null } :\n                        undefined,\n                );\n            }\n        }\n\n        // The id_token is NOT minted here — the /token exchange mints it after\n        // resolving the real backing session, so its `sid` is authoritative\n        // (plan 042 item 6). The code carries the authentication instant.\n        const codeEntity : OAuth2AuthorizationCode = await this.codeIssuer.issue(\n            data,\n            identity,\n            {\n                sessionId: options.sessionId,\n                authTime,\n                authMethod: session?.authMethod ?? null,\n            },\n        );\n\n        output.authorizationCode = codeEntity.id;\n\n        return output;\n    }\n}\n"],"mappings":";;;;;;;;AA8CA,MAAMkB,+BAA+B;AAKrC,MAAMC,gCAAgC;AAEtC,IAAaC,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAwC;EAChD,KAAKR,aAAaQ,IAAIR;EACtB,KAAKC,iBAAiBO,IAAIP;EAC1B,KAAKC,eAAeM,IAAIN;EACxB,KAAKC,UAAUK,IAAIL;EACnB,KAAKI,wBAAwBC,IAAID;EACjC,KAAKH,oBAAoBI,IAAIJ,qBAAqBP;EAClD,KAAKQ,qBAAqBG,IAAIH,sBAAsBP;EACpD,KAAKQ,uBAAuBE,IAAIF;CACpC;;;;;;;IASA,MAAMG,UACFC,MACAC,UACAC,UAAsC,CAAC,GACJ;EACnC,IAAI;GACA,MAAMC,SAAS,MAAM,KAAKC,eAAeJ,MAAMC,UAAUC,OAAAA;GAEzD,MAAM,KAAKV,cAAca,OAAO;IAC5BC,OAAOnC,WAAWoC;IAClBC,MAAMvC,UAAUwC;IAChBC,SAASxC,aAAayC;IACtBC,OAAOV,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;IAC/CC,UAAUd,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;IAClDE,WAAWhB,SAASiB;IACpBC,SAASlB,SAASD,KAAKc;IACvBM,WAAWnB,SAASD,KAAKQ;IACzBa,SAASrB,KAAKsB,YAAY;IAC1BtB,MAAM;KACFuB,QAAQrB,QAAQW,QAAQW,UAAU,gBAAgB;KAClD,GAAIxB,KAAKM,QAAQ,EAAEA,OAAON,KAAKM,MAAM,IAAI,CAAC;IAC9C;GACJ,CAAA;GACA,KAAKb,SAASgC,gBAAgB,QAAA;GAE9B,OAAOtB;EACX,SAASuB,GAAG;GACR,IAAIrD,cAAcqD,GAAGpD,mCAAAA,GAAsC;IACvD,MAAM,KAAKkB,cAAca,OAAO;KAC5BC,OAAOnC,WAAWoC;KAClBC,MAAMvC,UAAU0D;KAChBjB,SAASxC,aAAayC;KACtBC,OAAOV,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;KAC/CC,UAAUd,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;KAClDE,WAAWhB,SAASiB;KACpBC,SAASlB,SAASD,KAAKc;KACvBM,WAAWnB,SAASD,KAAKQ;KACzBa,SAASrB,KAAKsB,YAAY;KAC1BtB,MAAM,EAAEuB,QAAQ,eAAe;IACnC,CAAA;IACA,KAAK9B,SAASgC,gBAAgB,QAAA;GAClC,OAAO,IAAIpD,cAAcqD,GAAGnD,oCAAAA,GACxB,KAAKkB,SAASgC,gBAAgB,gBAAA;QAC3B,IAAIpD,cAAcqD,GAAGlD,kCAAAA,GACxB,KAAKiB,SAASgC,gBAAgB,cAAA;QAE9B,KAAKhC,SAASgC,gBAAgB,OAAA;GAGlC,MAAMC;EACV;CACJ;CAEA,MAAgBtB,eACZJ,MACAC,UACAC,UAAsC,CAAC,GACJ;EAInC,IAAI0B,gBAA2B,CAAA;EAC/B,IAAI5B,KAAK6B,eACLD,gBAAgBE,MAAMC,QAAQ/B,KAAK6B,aAAa,IAC5C7B,KAAK6B,gBACL7B,KAAK6B,cAAcG,MAAM,GAAA;EAGjC,KAAK,MAAMC,gBAAgBL,eACvB,IAAIK,iBAAiBrD,gCAAgCsD,MACjD,MAAMjD,wBAAwBkD,YAAW;EAIjD,IAAI,CAACP,cAAcQ,SAASxD,gCAAgCsD,IAAI,GAC5D,MAAMjD,wBAAwBkD,YAAW;EAG7C,IAAI,CAACnC,KAAKqC,cACN,MAAMxD,iBAAiByD,oBAAmB;EAG9C,MAAMC,SAAqC;GACvCC,aAAaxC,KAAKqC;GAClB,GAAIrC,KAAKyC,QAAQ,EAAEA,OAAOzC,KAAKyC,MAAM,IAAI,CAAC;EAC9C;EAEA,IAAI,CAACxC,UACD,MAAMjB,mBAAmB0D,gBAAe;EAY5C,IACI1C,KAAKsB,YACLrB,SAASD,KAAKqB,YAAYrB,KAAKsB,UAE/B,MAAMxC,yBAAyB6D,cAAa;EAOhD,MAAMC,aAAaC,KAAKC,MAAMC,KAAKC,IAAG,IAAK,GAAA;EAC3C,IAAIC,WAAWL;EACf,IAAIM,UAA2B;EAC/B,IAAIhD,QAAQiD,WAAW;GACnBD,UAAU,MAAM,KAAK3D,eAAe6D,YAAYlD,QAAQiD,SAAS;GACjE,IAAID,WAAWA,QAAQG,WACnBJ,WAAWJ,KAAKC,MAAM,IAAIC,KAAKG,QAAQG,SAAS,CAAA,CAAEC,QAAO,IAAK,GAAA;EAEtE;EAQA,IAAI,KAAK1D,wBAAwBK,SAASiB,SAAS9C,aAAamF,MAAM;GAGlE,MAAMC,YAAY,MAAM,KAAK5D,qBAAqB4D,UAC9CvD,SAASD,KAAKc,IACd,EAAE2C,eAAe,MAAM,CAAA;GAE3B,IAAID,UAAUE,YAAY,CAACR,SAASS,OAChC,MAAM5E,uBAAuB6E,kBAAiB;GAGlD,IAAIJ,UAAUK,oBACV,MAAM9E,uBAAuB8E,mBAAkB;GAUnD,IAAIL,UAAUE,YAAY1D,KAAK8D;QACT9D,KAAK8D,WAAW9B,MAAM,GACpC+B,CAAAA,CAAU3B,SAAS1D,iCAAiCsF,GAAG,GAAG;KAC1D,MAAMC,eAAef,SAASS,QAC1Bd,KAAKC,MAAM,IAAIC,KAAKG,QAAQS,KAAK,CAAA,CAAEL,QAAO,IAAK,GAAA,IAC/C;KACJ,IAAIW,iBAAiB,QAAQrB,aAAaqB,eAAe,KAAKtE,oBAC1D,MAAMZ,uBAAuBmF,eAAc;IAEnD;;EAER;EAMA,KADgBlE,KAAKoE,SAASpE,KAAKoE,OAAOpC,MAAM,GAAA,IAAO,CAAA,EAAA,CAE3CI,SAASzD,0BAA0B0F,KAAK,KAChDzB,aAAaK,WAAW,KAAKvD,mBAE7B,MAAMZ,yBAAyBwF,yBAAwB;EAG3D,IACI,OAAOtE,KAAKuE,YAAY,eACxBvE,KAAKuE,YAAY,MACnB;GACE,MAAMC,SAASC,OAAOzE,KAAKuE,OAAO;GAClC,IACIE,OAAOC,SAASF,MAAAA,KAChB5B,aAAaK,WAAWuB,QAExB,MAAM1F,yBAAyBwF,yBAAwB;EAE/D;EAQA,IAAIpE,QAAQW,QAAQ8D,gBAAgB;GAChC,IAAIC,UAAU;GAEd,MAAMC,UAAU3F,qBAAqBe,QAAAA;GACrC,IAAI,KAAKJ,yBAAyBgF,SAC9BD,UAAU,MAAM,KAAK/E,sBAAsBiF,SACvC5E,QAAQW,OAAO8D,gBACfE,OAAAA;GAIR,IAAI,CAACD,SACD,MAAMnG,wBAAwBsG,UAC1B7E,QAAQ8E,uBAAuBhF,KAAKqC,eAChC;IAAEG,aAAaxC,KAAKqC;IAAcI,OAAOzC,KAAKyC,SAAS;GAAK,IAC5DwC,KAAAA,CAAAA;EAGhB;EAeA1C,OAAO8C,qBAAoBH,MAVwB,KAAK5F,WAAW6F,MAC/DnF,MACAC,UACA;GACIkD,WAAWjD,QAAQiD;GACnBF;GACAmC,YAAYlC,SAASkC,cAAc;EACvC,CAAA,EAAA,CAGkCtE;EAEtC,OAAOyB;CACX;AACJ"}

package/dist/core/oauth2/authorization/types.d.ts

@@ -1,13 +1,38 @@
+import type { Client } from '@authup/core-kit';
 import type { IOAuth2AuthorizationCodeIssuer } from './code/index.ts';
+import type { IOAuth2AccessPolicyEvaluator } from '../access-policy/index.ts';
 import type { ISessionManager } from '../../authentication/index.ts';
+import type { IEventService, IUserAuthenticatorChallengeProvider } from '../../entities/index.ts';
+import type { IAuthFlowMetrics } from '../../metrics/index.ts';
 export type OAuth2AuthorizationManagerContext = {
     codeIssuer: IOAuth2AuthorizationCodeIssuer;
     sessionManager: ISessionManager;
+    eventService?: IEventService;
+    metrics?: IAuthFlowMetrics;
+    /**
+     * Application access policy gate (plan 052): evaluates a client's
+     * access_policy_id against the authenticated identity before a code is
+     * issued. Absent = feature inert — but a client carrying a policy id
+     * with no wired evaluator still denies (fail closed).
+     */
+    accessPolicyEvaluator?: IOAuth2AccessPolicyEvaluator;
     /**
      * Max age (seconds) of the authentication a `prompt=login` request accepts
      * before forcing re-auth (config `promptLoginMaxAge`). Default 60.
      */
     promptLoginMaxAge?: number;
+    /**
+     * Max age (seconds) of the session's mfa_at an `acr_values=urn:authup:mfa`
+     * step-up request accepts before forcing a fresh challenge
+     * (config `mfaFreshnessMaxAge`). Default 60.
+     */
+    mfaFreshnessMaxAge?: number;
+    /**
+     * MFA backstop (plan 049): decides whether the authenticated user must
+     * hold a session-bound second-factor proof (mfa_at) before a code is
+     * issued. Absent = MFA disabled.
+     */
+    mfaChallengeProvider?: IUserAuthenticatorChallengeProvider;
 };
 export type OAuth2AuthorizationResult = {
     authorizationCode?: string;
@@ -21,5 +46,16 @@ export type OAuth2AuthorizationOptions = {
      * instead of creating a second one.
      */
     sessionId?: string | null;
+    /**
+     * The verified client entity (from the code-request verifier) — consumed by
+     * the audit record to distinguish built_in auto-consent from manual consent.
+     */
+    client?: Client;
+    /**
+     * Whether the request's redirect_uri was pattern-verified by the
+     * code-request verifier. Gates whether a denial may be answered with an
+     * error redirect (RFC 6749 §4.1.2.1) instead of an interactive error.
+     */
+    redirectUriVerified?: boolean;
 };
 //# sourceMappingURL=types.d.ts.map

package/dist/core/oauth2/authorization/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/authorization/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAErE,MAAM,MAAM,iCAAiC,GAAG;IAC5C,UAAU,EAAE,8BAA8B,CAAC;IAC3C,cAAc,EAAE,eAAe,CAAC;IAChC;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC7B,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACpC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;CACjB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACrC;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/authorization/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,mCAAmC,EAAE,MAAM,yBAAyB,CAAC;AAClG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,MAAM,MAAM,iCAAiC,GAAG;IAC5C,UAAU,EAAE,8BAA8B,CAAC;IAC3C,cAAc,EAAE,eAAe,CAAC;IAChC,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,4BAA4B,CAAC;IACrD;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,mCAAmC,CAAC;CAC9D,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACpC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;CACjB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACrC;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE1B;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;CACjC,CAAC"}

package/dist/core/oauth2/client/authenticator.d.ts

@@ -1,17 +1,26 @@
-import type { Client } from '@authup/core-kit';
+import { type Client } from '@authup/core-kit';
+import type { OAuth2TokenConfirmation } from '@authup/specs';
 import { ClientCredentialsService } from '../../authentication/credential/index.ts';
+import type { ClientCertificateEvidence, IClientCertificateValidator } from '../../client-certificate/index.ts';
 import type { IIdentityResolver } from '../../identity/index.ts';
+export type OAuth2ClientAuthenticatorContext = {
+    identityResolver: IIdentityResolver;
+    certificateValidator: IClientCertificateValidator;
+};
 /**
- * Authenticates a client at the OAuth2 token endpoint. Confidential clients
- * MUST present a valid client_secret (RFC 6749 §3.2.1, §4.1.3, §4.3.2, §6);
- * public clients identify via client_id only.
+ * Authenticates a client at the OAuth2 token endpoint according to its
+ * exclusive method: public id only, shared secret, or trusted TLS evidence.
  *
- * Used by authorization_code, refresh_token, and password grants.
+ * Used by every standard client-resolving grant.
  */
 export declare class OAuth2ClientAuthenticator {
     protected identityResolver: IIdentityResolver;
     protected credentialsService: ClientCredentialsService;
-    constructor(identityResolver: IIdentityResolver);
-    authenticate(clientId: string | undefined, clientSecret?: string, realmId?: string): Promise<Client>;
+    protected certificateValidator?: IClientCertificateValidator;
+    constructor(ctx: IIdentityResolver | OAuth2ClientAuthenticatorContext);
+    authenticate(clientId: string | undefined, clientSecret?: string, realmId?: string, certificateEvidence?: ClientCertificateEvidence): Promise<Client>;
+    resolve(clientId: string, realmId?: string): Promise<Client>;
+    resolveTokenBinding(client: Pick<Client, 'tokenBindingMethod'>, certificateEvidence?: ClientCertificateEvidence): OAuth2TokenConfirmation | undefined;
+    validateCertificateEvidenceForBinding(certificateEvidence?: ClientCertificateEvidence): OAuth2TokenConfirmation;
 }
 //# sourceMappingURL=authenticator.d.ts.map

package/dist/core/oauth2/client/authenticator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authenticator.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/client/authenticator.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAG/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjE;;;;;;GAMG;AACH,qBAAa,yBAAyB;IAClC,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;gBAE3C,gBAAgB,EAAE,iBAAiB;IAKzC,YAAY,CACd,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,YAAY,CAAC,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC;CA2BrB"}
+{"version":3,"file":"authenticator.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/client/authenticator.ts"],"names":[],"mappings":"AAOA,OAAO,EACH,KAAK,MAAM,EAId,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAG7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,KAAK,EACR,yBAAyB,EACzB,2BAA2B,EAC9B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,MAAM,MAAM,gCAAgC,GAAG;IAC3C,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,oBAAoB,EAAE,2BAA2B,CAAC;CACrD,CAAC;AAEF;;;;;GAKG;AACH,qBAAa,yBAAyB;IAClC,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IAEvD,SAAS,CAAC,oBAAoB,CAAC,EAAE,2BAA2B,CAAC;gBAEjD,GAAG,EAAE,iBAAiB,GAAG,gCAAgC;IAY/D,YAAY,CACd,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,YAAY,CAAC,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE,MAAM,EAChB,mBAAmB,CAAC,EAAE,yBAAyB,GAChD,OAAO,CAAC,MAAM,CAAC;IAsDZ,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAalE,mBAAmB,CACf,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,oBAAoB,CAAC,EAC1C,mBAAmB,CAAC,EAAE,yBAAyB,GAChD,uBAAuB,GAAG,SAAS;IAYtC,qCAAqC,CACjC,mBAAmB,CAAC,EAAE,yBAAyB,GAChD,uBAAuB;CAa7B"}

package/dist/core/oauth2/client/authenticator.mjs

@@ -3,33 +3,70 @@ import "node:url";
 import.meta.url;
 import { ClientCredentialsService } from "../../authentication/credential/entities/client/module.mjs";
 import "../../authentication/credential/index.mjs";
-import { IdentityType } from "@authup/core-kit";
+import { ClientAuthMethod, ClientTokenBindingMethod, IdentityType } from "@authup/core-kit";
+import { isValidationError } from "@authup/errors";
 import { OAuth2ClientError } from "@authup/specs";
 //#region src/core/oauth2/client/authenticator.ts
 /**
-* Authenticates a client at the OAuth2 token endpoint. Confidential clients
-* MUST present a valid client_secret (RFC 6749 §3.2.1, §4.1.3, §4.3.2, §6);
-* public clients identify via client_id only.
+* Authenticates a client at the OAuth2 token endpoint according to its
+* exclusive method: public id only, shared secret, or trusted TLS evidence.
 *
-* Used by authorization_code, refresh_token, and password grants.
+* Used by every standard client-resolving grant.
 */ var OAuth2ClientAuthenticator = class {
 	identityResolver;
 	credentialsService;
-	constructor(identityResolver) {
-		this.identityResolver = identityResolver;
+	certificateValidator;
+	constructor(ctx) {
+		if ("identityResolver" in ctx) {
+			this.identityResolver = ctx.identityResolver;
+			this.certificateValidator = ctx.certificateValidator;
+		} else this.identityResolver = ctx;
 		this.credentialsService = new ClientCredentialsService();
 	}
-	async authenticate(clientId, clientSecret, realmId) {
+	async authenticate(clientId, clientSecret, realmId, certificateEvidence) {
 		if (!clientId) throw OAuth2ClientError.invalid();
+		const client = await this.resolve(clientId, realmId);
+		switch (client.authMethod) {
+			case ClientAuthMethod.NONE:
+				if (typeof clientSecret === "string") throw OAuth2ClientError.invalid();
+				break;
+			case ClientAuthMethod.SECRET:
+				if (!clientSecret) throw OAuth2ClientError.invalid();
+				if (!await this.credentialsService.verify(clientSecret, client)) throw OAuth2ClientError.invalid();
+				break;
+			case ClientAuthMethod.TLS:
+				if (typeof clientSecret === "string" || !certificateEvidence || !this.certificateValidator) throw OAuth2ClientError.invalid();
+				try {
+					await this.certificateValidator.validateForAuthentication(client, certificateEvidence);
+				} catch (e) {
+					if (isValidationError(e)) throw OAuth2ClientError.invalid();
+					throw e;
+				}
+				break;
+			default: throw OAuth2ClientError.invalid();
+		}
+		return client;
+	}
+	async resolve(clientId, realmId) {
 		const identity = await this.identityResolver.resolve(IdentityType.CLIENT, clientId, realmId);
 		if (!identity || identity.type !== IdentityType.CLIENT) throw OAuth2ClientError.invalid();
 		if (!identity.data.active) throw OAuth2ClientError.inactive();
-		if (identity.data.is_confidential) {
-			if (!clientSecret) throw OAuth2ClientError.invalid();
-			if (!await this.credentialsService.verify(clientSecret, identity.data)) throw OAuth2ClientError.invalid();
-		}
 		return identity.data;
 	}
+	resolveTokenBinding(client, certificateEvidence) {
+		if (client.tokenBindingMethod === ClientTokenBindingMethod.NONE) return;
+		if (client.tokenBindingMethod !== ClientTokenBindingMethod.TLS) throw OAuth2ClientError.invalid();
+		return this.validateCertificateEvidenceForBinding(certificateEvidence);
+	}
+	validateCertificateEvidenceForBinding(certificateEvidence) {
+		if (!certificateEvidence || !this.certificateValidator) throw OAuth2ClientError.invalid();
+		try {
+			this.certificateValidator.validateForBinding(certificateEvidence);
+		} catch {
+			throw OAuth2ClientError.invalid();
+		}
+		return { "x5t#S256": certificateEvidence.thumbprint };
+	}
 };
 //#endregion
 export { OAuth2ClientAuthenticator };

package/dist/core/oauth2/client/authenticator.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"authenticator.mjs","names":["IdentityType","OAuth2ClientError","ClientCredentialsService","OAuth2ClientAuthenticator","identityResolver","credentialsService","authenticate","clientId","clientSecret","realmId","invalid","identity","resolve","CLIENT","type","data","active","inactive","is_confidential","verified","verify"],"sources":["../../../../src/core/oauth2/client/authenticator.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Client } from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { OAuth2ClientError } from '@authup/specs';\nimport { ClientCredentialsService } from '../../authentication/credential/index.ts';\nimport type { IIdentityResolver } from '../../identity/index.ts';\n\n/**\n * Authenticates a client at the OAuth2 token endpoint. Confidential clients\n * MUST present a valid client_secret (RFC 6749 §3.2.1, §4.1.3, §4.3.2, §6);\n * public clients identify via client_id only.\n *\n * Used by authorization_code, refresh_token, and password grants.\n */\nexport class OAuth2ClientAuthenticator {\n    protected identityResolver: IIdentityResolver;\n\n    protected credentialsService: ClientCredentialsService;\n\n    constructor(identityResolver: IIdentityResolver) {\n        this.identityResolver = identityResolver;\n        this.credentialsService = new ClientCredentialsService();\n    }\n\n    async authenticate(\n        clientId: string | undefined,\n        clientSecret?: string,\n        realmId?: string,\n    ): Promise<Client> {\n        if (!clientId) {\n            throw OAuth2ClientError.invalid();\n        }\n\n        const identity = await this.identityResolver.resolve(IdentityType.CLIENT, clientId, realmId);\n        if (!identity || identity.type !== IdentityType.CLIENT) {\n            throw OAuth2ClientError.invalid();\n        }\n\n        if (!identity.data.active) {\n            throw OAuth2ClientError.inactive();\n        }\n\n        if (identity.data.is_confidential) {\n            if (!clientSecret) {\n                throw OAuth2ClientError.invalid();\n            }\n\n            const verified = await this.credentialsService.verify(clientSecret, identity.data);\n            if (!verified) {\n                throw OAuth2ClientError.invalid();\n            }\n        }\n\n        return identity.data;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;GAoBA,IAAaG,4BAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,kBAAqC;EAC7C,KAAKA,mBAAmBA;EACxB,KAAKC,qBAAqB,IAAIH,yBAAAA;CAClC;CAEA,MAAMI,aACFC,UACAC,cACAC,SACe;EACf,IAAI,CAACF,UACD,MAAMN,kBAAkBS,QAAO;EAGnC,MAAMC,WAAW,MAAM,KAAKP,iBAAiBQ,QAAQZ,aAAaa,QAAQN,UAAUE,OAAAA;EACpF,IAAI,CAACE,YAAYA,SAASG,SAASd,aAAaa,QAC5C,MAAMZ,kBAAkBS,QAAO;EAGnC,IAAI,CAACC,SAASI,KAAKC,QACf,MAAMf,kBAAkBgB,SAAQ;EAGpC,IAAIN,SAASI,KAAKG,iBAAiB;GAC/B,IAAI,CAACV,cACD,MAAMP,kBAAkBS,QAAO;GAInC,IAAI,CAACS,MADkB,KAAKd,mBAAmBe,OAAOZ,cAAcG,SAASI,IAAI,GAE7E,MAAMd,kBAAkBS,QAAO;EAEvC;EAEA,OAAOC,SAASI;CACpB;AACJ"}
+{"version":3,"file":"authenticator.mjs","names":["ClientAuthMethod","ClientTokenBindingMethod","IdentityType","OAuth2ClientError","isValidationError","ClientCredentialsService","OAuth2ClientAuthenticator","identityResolver","credentialsService","certificateValidator","ctx","authenticate","clientId","clientSecret","realmId","certificateEvidence","invalid","client","resolve","authMethod","NONE","SECRET","verified","verify","TLS","validateForAuthentication","e","identity","CLIENT","type","data","active","inactive","resolveTokenBinding","tokenBindingMethod","undefined","validateCertificateEvidenceForBinding","validateForBinding","thumbprint"],"sources":["../../../../src/core/oauth2/client/authenticator.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    type Client,\n    ClientAuthMethod,\n    ClientTokenBindingMethod,\n    IdentityType,\n} from '@authup/core-kit';\nimport type { OAuth2TokenConfirmation } from '@authup/specs';\nimport { OAuth2ClientError } from '@authup/specs';\nimport { isValidationError } from '@authup/errors';\nimport { ClientCredentialsService } from '../../authentication/credential/index.ts';\nimport type {\n    ClientCertificateEvidence,\n    IClientCertificateValidator,\n} from '../../client-certificate/index.ts';\nimport type { IIdentityResolver } from '../../identity/index.ts';\n\nexport type OAuth2ClientAuthenticatorContext = {\n    identityResolver: IIdentityResolver,\n    certificateValidator: IClientCertificateValidator,\n};\n\n/**\n * Authenticates a client at the OAuth2 token endpoint according to its\n * exclusive method: public id only, shared secret, or trusted TLS evidence.\n *\n * Used by every standard client-resolving grant.\n */\nexport class OAuth2ClientAuthenticator {\n    protected identityResolver: IIdentityResolver;\n\n    protected credentialsService: ClientCredentialsService;\n\n    protected certificateValidator?: IClientCertificateValidator;\n\n    constructor(ctx: IIdentityResolver | OAuth2ClientAuthenticatorContext) {\n        if ('identityResolver' in ctx) {\n            this.identityResolver = ctx.identityResolver;\n            this.certificateValidator = ctx.certificateValidator;\n        } else {\n            // Kept as a compatibility seam for focused secret/public-client\n            // unit tests. Production wiring always supplies the validator.\n            this.identityResolver = ctx;\n        }\n        this.credentialsService = new ClientCredentialsService();\n    }\n\n    async authenticate(\n        clientId: string | undefined,\n        clientSecret?: string,\n        realmId?: string,\n        certificateEvidence?: ClientCertificateEvidence,\n    ): Promise<Client> {\n        if (!clientId) {\n            throw OAuth2ClientError.invalid();\n        }\n\n        const client = await this.resolve(clientId, realmId);\n\n        switch (client.authMethod) {\n            case ClientAuthMethod.NONE:\n                if (typeof clientSecret === 'string') {\n                    throw OAuth2ClientError.invalid();\n                }\n                break;\n            case ClientAuthMethod.SECRET: {\n                if (!clientSecret) {\n                    throw OAuth2ClientError.invalid();\n                }\n\n                const verified = await this.credentialsService.verify(clientSecret, client);\n                if (!verified) {\n                    throw OAuth2ClientError.invalid();\n                }\n                break;\n            }\n            case ClientAuthMethod.TLS:\n                if (\n                    typeof clientSecret === 'string' ||\n                    !certificateEvidence ||\n                    !this.certificateValidator\n                ) {\n                    throw OAuth2ClientError.invalid();\n                }\n\n                try {\n                    await this.certificateValidator.validateForAuthentication(client, certificateEvidence);\n                } catch (e) {\n                    // A validation failure deliberately reveals neither the\n                    // certificate identity nor which realm anchor failed. An\n                    // infrastructure fault (e.g. the trust-anchor store being\n                    // unreachable) must NOT masquerade as a bad certificate —\n                    // let it surface as a server error instead.\n                    if (isValidationError(e)) {\n                        throw OAuth2ClientError.invalid();\n                    }\n                    throw e;\n                }\n                break;\n            default:\n                throw OAuth2ClientError.invalid();\n        }\n\n        return client;\n    }\n\n    async resolve(clientId: string, realmId?: string): Promise<Client> {\n        const identity = await this.identityResolver.resolve(IdentityType.CLIENT, clientId, realmId);\n        if (!identity || identity.type !== IdentityType.CLIENT) {\n            throw OAuth2ClientError.invalid();\n        }\n\n        if (!identity.data.active) {\n            throw OAuth2ClientError.inactive();\n        }\n\n        return identity.data;\n    }\n\n    resolveTokenBinding(\n        client: Pick<Client, 'tokenBindingMethod'>,\n        certificateEvidence?: ClientCertificateEvidence,\n    ): OAuth2TokenConfirmation | undefined {\n        if (client.tokenBindingMethod === ClientTokenBindingMethod.NONE) {\n            return undefined;\n        }\n\n        if (client.tokenBindingMethod !== ClientTokenBindingMethod.TLS) {\n            throw OAuth2ClientError.invalid();\n        }\n\n        return this.validateCertificateEvidenceForBinding(certificateEvidence);\n    }\n\n    validateCertificateEvidenceForBinding(\n        certificateEvidence?: ClientCertificateEvidence,\n    ): OAuth2TokenConfirmation {\n        if (!certificateEvidence || !this.certificateValidator) {\n            throw OAuth2ClientError.invalid();\n        }\n\n        try {\n            this.certificateValidator.validateForBinding(certificateEvidence);\n        } catch {\n            throw OAuth2ClientError.invalid();\n        }\n\n        return { 'x5t#S256': certificateEvidence.thumbprint };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;GAkCA,IAAaM,4BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA2D;EACnE,IAAI,sBAAsBA,KAAK;GAC3B,KAAKH,mBAAmBG,IAAIH;GAC5B,KAAKE,uBAAuBC,IAAID;EACpC,OAGI,KAAKF,mBAAmBG;EAE5B,KAAKF,qBAAqB,IAAIH,yBAAAA;CAClC;CAEA,MAAMM,aACFC,UACAC,cACAC,SACAC,qBACe;EACf,IAAI,CAACH,UACD,MAAMT,kBAAkBa,QAAO;EAGnC,MAAMC,SAAS,MAAM,KAAKC,QAAQN,UAAUE,OAAAA;EAE5C,QAAQG,OAAOE,YAAf;GACI,KAAKnB,iBAAiBoB;IAClB,IAAI,OAAOP,iBAAiB,UACxB,MAAMV,kBAAkBa,QAAO;IAEnC;GACJ,KAAKhB,iBAAiBqB;IAClB,IAAI,CAACR,cACD,MAAMV,kBAAkBa,QAAO;IAInC,IAAI,CAACM,MADkB,KAAKd,mBAAmBe,OAAOV,cAAcI,MAAAA,GAEhE,MAAMd,kBAAkBa,QAAO;IAEnC;GAEJ,KAAKhB,iBAAiBwB;IAClB,IACI,OAAOX,iBAAiB,YACxB,CAACE,uBACD,CAAC,KAAKN,sBAEN,MAAMN,kBAAkBa,QAAO;IAGnC,IAAI;KACA,MAAM,KAAKP,qBAAqBgB,0BAA0BR,QAAQF,mBAAAA;IACtE,SAASW,GAAG;KAMR,IAAItB,kBAAkBsB,CAAAA,GAClB,MAAMvB,kBAAkBa,QAAO;KAEnC,MAAMU;IACV;IACA;GACJ,SACI,MAAMvB,kBAAkBa,QAAO;EACvC;EAEA,OAAOC;CACX;CAEA,MAAMC,QAAQN,UAAkBE,SAAmC;EAC/D,MAAMa,WAAW,MAAM,KAAKpB,iBAAiBW,QAAQhB,aAAa0B,QAAQhB,UAAUE,OAAAA;EACpF,IAAI,CAACa,YAAYA,SAASE,SAAS3B,aAAa0B,QAC5C,MAAMzB,kBAAkBa,QAAO;EAGnC,IAAI,CAACW,SAASG,KAAKC,QACf,MAAM5B,kBAAkB6B,SAAQ;EAGpC,OAAOL,SAASG;CACpB;CAEAG,oBACIhB,QACAF,qBACmC;EACnC,IAAIE,OAAOiB,uBAAuBjC,yBAAyBmB,MACvD;EAGJ,IAAIH,OAAOiB,uBAAuBjC,yBAAyBuB,KACvD,MAAMrB,kBAAkBa,QAAO;EAGnC,OAAO,KAAKoB,sCAAsCrB,mBAAAA;CACtD;CAEAqB,sCACIrB,qBACuB;EACvB,IAAI,CAACA,uBAAuB,CAAC,KAAKN,sBAC9B,MAAMN,kBAAkBa,QAAO;EAGnC,IAAI;GACA,KAAKP,qBAAqB4B,mBAAmBtB,mBAAAA;EACjD,QAAQ;GACJ,MAAMZ,kBAAkBa,QAAO;EACnC;EAEA,OAAO,EAAE,YAAYD,oBAAoBuB,WAAW;CACxD;AACJ"}

package/dist/core/oauth2/client/grant-type.d.ts

@@ -5,5 +5,5 @@ import type { Client } from '@authup/core-kit';
  * enforcement is opt-in per client; unknown values in the list are
  * inert — they can only narrow, never widen.
  */
-export declare function assertClientGrantAllowed(client: Pick<Client, 'grant_types'>, grantType: string): void;
+export declare function assertClientGrantAllowed(client: Pick<Client, 'grantTypes'>, grantType: string): void;
 //# sourceMappingURL=grant-type.d.ts.map

package/dist/core/oauth2/client/grant-type.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-type.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/client/grant-type.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAG/C;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CASrG"}
+{"version":3,"file":"grant-type.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/client/grant-type.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAG/C;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CASpG"}

package/dist/core/oauth2/client/grant-type.mjs

@@ -9,8 +9,8 @@ import { OAuth2ClientUnauthorizedError } from "@authup/specs";
 * enforcement is opt-in per client; unknown values in the list are
 * inert — they can only narrow, never widen.
 */ function assertClientGrantAllowed(client, grantType) {
-	if (!client.grant_types) return;
-	if (!client.grant_types.split(/[\s,]+/).includes(grantType)) throw OAuth2ClientUnauthorizedError.grantType(grantType);
+	if (!client.grantTypes) return;
+	if (!client.grantTypes.split(/[\s,]+/).includes(grantType)) throw OAuth2ClientUnauthorizedError.grantType(grantType);
 }
 //#endregion
 export { assertClientGrantAllowed };

package/dist/core/oauth2/client/grant-type.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"grant-type.mjs","names":["OAuth2ClientUnauthorizedError","assertClientGrantAllowed","client","grantType","grant_types","allowed","split","includes"],"sources":["../../../../src/core/oauth2/client/grant-type.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Client } from '@authup/core-kit';\nimport { OAuth2ClientUnauthorizedError } from '@authup/specs';\n\n/**\n * Enforce the client's grant_types allowlist (RFC 6749 §5.2\n * unauthorized_client). A null/empty column means allow-all, so\n * enforcement is opt-in per client; unknown values in the list are\n * inert — they can only narrow, never widen.\n */\nexport function assertClientGrantAllowed(client: Pick<Client, 'grant_types'>, grantType: string): void {\n    if (!client.grant_types) {\n        return;\n    }\n\n    const allowed = client.grant_types.split(/[\\s,]+/);\n    if (!allowed.includes(grantType)) {\n        throw OAuth2ClientUnauthorizedError.grantType(grantType);\n    }\n}\n"],"mappings":";;;;;;;;;;GAgBA,SAAgBC,yBAAyBC,QAAqCC,WAAiB;CAC3F,IAAI,CAACD,OAAOE,aACR;CAIJ,IAAI,CADYF,OAAOE,YAAYE,MAAM,QACpCD,CAAAA,CAAQE,SAASJ,SAAAA,GAClB,MAAMH,8BAA8BG,UAAUA,SAAAA;AAEtD"}
+{"version":3,"file":"grant-type.mjs","names":["OAuth2ClientUnauthorizedError","assertClientGrantAllowed","client","grantType","grantTypes","allowed","split","includes"],"sources":["../../../../src/core/oauth2/client/grant-type.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Client } from '@authup/core-kit';\nimport { OAuth2ClientUnauthorizedError } from '@authup/specs';\n\n/**\n * Enforce the client's grant_types allowlist (RFC 6749 §5.2\n * unauthorized_client). A null/empty column means allow-all, so\n * enforcement is opt-in per client; unknown values in the list are\n * inert — they can only narrow, never widen.\n */\nexport function assertClientGrantAllowed(client: Pick<Client, 'grantTypes'>, grantType: string): void {\n    if (!client.grantTypes) {\n        return;\n    }\n\n    const allowed = client.grantTypes.split(/[\\s,]+/);\n    if (!allowed.includes(grantType)) {\n        throw OAuth2ClientUnauthorizedError.grantType(grantType);\n    }\n}\n"],"mappings":";;;;;;;;;;GAgBA,SAAgBC,yBAAyBC,QAAoCC,WAAiB;CAC1F,IAAI,CAACD,OAAOE,YACR;CAIJ,IAAI,CADYF,OAAOE,WAAWE,MAAM,QACnCD,CAAAA,CAAQE,SAASJ,SAAAA,GAClB,MAAMH,8BAA8BG,UAAUA,SAAAA;AAEtD"}

package/dist/core/oauth2/end-session/service.d.ts

@@ -1,5 +1,5 @@
 import type { OAuth2TokenPayload } from '@authup/specs';
-import type { IRealmRepository } from '../../entities/index.ts';
+import type { IEventService, IRealmRepository } from '../../entities/index.ts';
 import type { ISessionManager } from '../../authentication/index.ts';
 import type { IOAuth2ClientRepository } from '../client/index.ts';
 import type { IOAuth2TokenVerifier } from '../token/index.ts';
@@ -9,6 +9,7 @@ export declare class OAuth2EndSessionService implements IOAuth2EndSessionService
     protected sessionManager: ISessionManager;
     protected clientRepository: IOAuth2ClientRepository;
     protected realmRepository: IRealmRepository;
+    protected eventService?: IEventService;
     protected hintGracePeriod: number;
     constructor(ctx: OAuth2EndSessionServiceContext);
     verify(data: OAuth2EndSessionRequest): Promise<OAuth2EndSessionResult>;

package/dist/core/oauth2/end-session/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/end-session/service.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,KAAK,EACR,wBAAwB,EACxB,uBAAuB,EACvB,sBAAsB,EACtB,8BAA8B,EACjC,MAAM,YAAY,CAAC;AAEpB,qBAAa,uBAAwB,YAAW,wBAAwB;IACpE,SAAS,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAE9C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;IAEpD,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,eAAe,EAAE,MAAM,CAAC;gBAEtB,GAAG,EAAE,8BAA8B;IAQzC,MAAM,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IA+GtE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAe/E;;;;;OAKG;IACH,SAAS,CAAC,uBAAuB,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO;IAcvE;;;;OAIG;IACH,SAAS,CAAC,yBAAyB,CAC/B,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACrC,SAAS,EAAE,MAAM,GAClB,OAAO;CAkBb"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/end-session/service.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,KAAK,EACR,wBAAwB,EACxB,uBAAuB,EACvB,sBAAsB,EACtB,8BAA8B,EACjC,MAAM,YAAY,CAAC;AAEpB,qBAAa,uBAAwB,YAAW,wBAAwB;IACpE,SAAS,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAE9C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;IAEpD,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;IAEvC,SAAS,CAAC,eAAe,EAAE,MAAM,CAAC;gBAEtB,GAAG,EAAE,8BAA8B;IASzC,MAAM,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IA+GtE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA2B/E;;;;;OAKG;IACH,SAAS,CAAC,uBAAuB,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO;IAcvE;;;;OAIG;IACH,SAAS,CAAC,yBAAyB,CAC/B,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACrC,SAAS,EAAE,MAAM,GAClB,OAAO;CAkBb"}

package/dist/core/oauth2/end-session/service.mjs

@@ -2,6 +2,7 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { isSimpleMatch, isUUID } from "@authup/kit";
+import { EventName, EventRefType, EventScope } from "@authup/core-kit";
 import { OAuth2TokenKind } from "@authup/specs";
 //#region src/core/oauth2/end-session/service.ts
 var OAuth2EndSessionService = class {
@@ -9,12 +10,14 @@ var OAuth2EndSessionService = class {
 	sessionManager;
 	clientRepository;
 	realmRepository;
+	eventService;
 	hintGracePeriod;
 	constructor(ctx) {
 		this.tokenVerifier = ctx.tokenVerifier;
 		this.sessionManager = ctx.sessionManager;
 		this.clientRepository = ctx.clientRepository;
 		this.realmRepository = ctx.realmRepository;
+		this.eventService = ctx.eventService;
 		this.hintGracePeriod = ctx.hintGracePeriod ?? 0;
 	}
 	async verify(data) {
@@ -61,7 +64,7 @@ var OAuth2EndSessionService = class {
 		let redirectUri;
 		if (client) {
 			clientName = client.name;
-			if (data.post_logout_redirect_uri && this.isValidPostLogoutRedirect(client.post_logout_redirect_uri, data.post_logout_redirect_uri)) redirectUri = data.post_logout_redirect_uri;
+			if (data.post_logout_redirect_uri && this.isValidPostLogoutRedirect(client.postLogoutRedirectUri, data.post_logout_redirect_uri)) redirectUri = data.post_logout_redirect_uri;
 		}
 		return {
 			hintVerified,
@@ -81,8 +84,18 @@ var OAuth2EndSessionService = class {
 	async revoke(sessionId, sub, subKind) {
 		const session = await this.sessionManager.findOneById(sessionId);
 		if (!session) return false;
-		if (session.sub !== sub || session.sub_kind !== subKind) return false;
+		if (session.sub !== sub || session.subKind !== subKind) return false;
 		await this.sessionManager.revoke(sessionId);
+		await this.eventService?.record({
+			scope: EventScope.OAUTH2,
+			name: EventName.LOGOUT,
+			refType: EventRefType.SESSION,
+			refId: sessionId,
+			actorType: session.subKind,
+			actorId: session.sub,
+			realmId: session.realmId,
+			data: { revokedSessionId: sessionId }
+		});
 		return true;
 	}
 	/**

package/dist/core/oauth2/end-session/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["isSimpleMatch","isUUID","OAuth2TokenKind","OAuth2EndSessionService","tokenVerifier","sessionManager","clientRepository","realmRepository","hintGracePeriod","ctx","verify","data","hintVerified","sub","subKind","sessionId","hintRealmId","audiences","id_token_hint","payload","ignoreExpiry","skipActiveCheck","kind","ID_TOKEN","isWithinHintGraceWindow","sub_kind","sid","session_id","undefined","realm_id","aud","Array","isArray","filter","entry","clientId","client_id","length","client","realmKey","realm_name","realm","resolve","findOneByIdOrName","id","expected","includes","clientName","redirectUri","name","post_logout_redirect_uri","isValidPostLogoutRedirect","state","revoke","session","findOneById","exp","nowSeconds","Math","floor","Date","now","registered","candidate","parsed","URL","protocol","split"],"sources":["../../../../src/core/oauth2/end-session/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isSimpleMatch, isUUID } from '@authup/kit';\nimport type { Client } from '@authup/core-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IRealmRepository } from '../../entities/index.ts';\nimport type { ISessionManager } from '../../authentication/index.ts';\nimport type { IOAuth2ClientRepository } from '../client/index.ts';\nimport type { IOAuth2TokenVerifier } from '../token/index.ts';\nimport type {\n    IOAuth2EndSessionService,\n    OAuth2EndSessionRequest,\n    OAuth2EndSessionResult,\n    OAuth2EndSessionServiceContext,\n} from './types.ts';\n\nexport class OAuth2EndSessionService implements IOAuth2EndSessionService {\n    protected tokenVerifier: IOAuth2TokenVerifier;\n\n    protected sessionManager: ISessionManager;\n\n    protected clientRepository: IOAuth2ClientRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected hintGracePeriod: number;\n\n    constructor(ctx: OAuth2EndSessionServiceContext) {\n        this.tokenVerifier = ctx.tokenVerifier;\n        this.sessionManager = ctx.sessionManager;\n        this.clientRepository = ctx.clientRepository;\n        this.realmRepository = ctx.realmRepository;\n        this.hintGracePeriod = ctx.hintGracePeriod ?? 0;\n    }\n\n    async verify(data: OAuth2EndSessionRequest): Promise<OAuth2EndSessionResult> {\n        let hintVerified = false;\n        let sub: string | undefined;\n        let subKind: string | undefined;\n        let sessionId: string | undefined;\n        let hintRealmId: string | undefined;\n        let audiences: string[] = [];\n\n        if (data.id_token_hint) {\n            try {\n                // Signature + kind are the anchors; exp is skipped (a logout hint\n                // is routinely expired) and the cache blocklist is irrelevant.\n                const payload = await this.tokenVerifier.verify(data.id_token_hint, {\n                    ignoreExpiry: true,\n                    skipActiveCheck: true,\n                });\n\n                // MUST be an id_token — access/refresh tokens also carry\n                // session_id, so accepting them would let a leaked access token\n                // act as a logout weapon.\n                if (payload.kind === OAuth2TokenKind.ID_TOKEN && this.isWithinHintGraceWindow(payload)) {\n                    hintVerified = true;\n                    sub = payload.sub;\n                    subKind = payload.sub_kind;\n                    sessionId = payload.sid ?? payload.session_id ?? undefined;\n                    hintRealmId = payload.realm_id ?? undefined;\n                    // aud may be a single string or an array (JWT spec).\n                    const { aud } = payload;\n                    if (Array.isArray(aud)) {\n                        audiences = aud.filter((entry): entry is string => typeof entry === 'string');\n                    } else if (typeof aud === 'string') {\n                        audiences = [aud];\n                    }\n                }\n            } catch {\n                // forged / unverifiable hint → stays unverified (no revoke)\n            }\n        }\n\n        // Resolve a single client for the aud cross-check and redirect\n        // validation: the request's client_id, else the hint's sole audience\n        // (ambiguous for a multi-aud hint).\n        const clientId = data.client_id ?? (audiences.length === 1 ? audiences[0] : undefined);\n\n        let client: Client | null = null;\n        if (clientId) {\n            // Scope a name-identified client to the request's realm hint; a\n            // VERIFIED hint's own realm claim serves as fallback (claims from an\n            // unverified hint are never trusted). No master fallback here\n            // (unlike /token): a bogus hint must NOT silently resolve a\n            // same-named client in master → null realm.\n            const realmKey = data.realm_id ?? data.realm_name ?? (hintVerified ? hintRealmId : undefined);\n            const realm = await this.realmRepository.resolve(realmKey, false);\n\n            // Fail closed instead of dropping the realm predicate: a supplied\n            // realm key that does not resolve never degrades to an unscoped\n            // lookup, and a NAME-form client_id without any realm key is\n            // ambiguous (every realm has a built-in `web` client — same rule as\n            // the /authorize verifier). A UUID is globally unique and needs no\n            // scope; the sole-aud-derived clientId is always a UUID.\n            if (realm) {\n                client = await this.clientRepository.findOneByIdOrName(clientId, realm.id);\n            } else if (!realmKey && isUUID(clientId)) {\n                client = await this.clientRepository.findOneByIdOrName(clientId);\n            }\n        }\n\n        // aud/client_id cross-check: when the request supplies a client_id on a\n        // verified hint, it MUST denote one of the hint's audiences. The aud is\n        // the client UUID, so a name-form client_id is compared via its resolved\n        // client's id. Fail closed: an aud-less hint, or a name that did not\n        // resolve, counts as unverified.\n        if (hintVerified && data.client_id) {\n            const expected = isUUID(data.client_id) ? data.client_id : client?.id;\n            if (audiences.length === 0 || !expected || !audiences.includes(expected)) {\n                hintVerified = false;\n                sub = undefined;\n                subKind = undefined;\n                sessionId = undefined;\n            }\n        }\n\n        let clientName: string | undefined;\n        let redirectUri: string | undefined;\n\n        // Redirect validation is independent of hint verification — the\n        // click-gated confirm page (unverified hint / hint-less request) still\n        // honors a registered post-logout redirect.\n        if (client) {\n            clientName = client.name;\n            if (\n                data.post_logout_redirect_uri &&\n                this.isValidPostLogoutRedirect(client.post_logout_redirect_uri, data.post_logout_redirect_uri)\n            ) {\n                redirectUri = data.post_logout_redirect_uri;\n            }\n        }\n\n        return {\n            hintVerified,\n            ...(hintVerified ? {\n                sub,\n                subKind,\n                sessionId,\n            } : {}),\n            ...(clientId ? { clientId } : {}),\n            ...(clientName ? { clientName } : {}),\n            ...(redirectUri ? { redirectUri, ...(data.state ? { state: data.state } : {}) } : {}),\n        };\n    }\n\n    async revoke(sessionId: string, sub: string, subKind: string): Promise<boolean> {\n        const session = await this.sessionManager.findOneById(sessionId);\n        if (!session) {\n            return false;\n        }\n\n        // Never revoke a session that does not belong to the hint's subject.\n        if (session.sub !== sub || session.sub_kind !== subKind) {\n            return false;\n        }\n\n        await this.sessionManager.revoke(sessionId);\n        return true;\n    }\n\n    /**\n     * With a positive `hintGracePeriod`, an expired hint is honored only within\n     * the window past `exp` — beyond it a leaked id_token stops being a\n     * replayable remote logout (the hint counts as unverified; the click-gated\n     * confirm page still works). 0 keeps spec/Keycloak parity: any expired hint.\n     */\n    protected isWithinHintGraceWindow(payload: OAuth2TokenPayload): boolean {\n        if (this.hintGracePeriod <= 0) {\n            return true;\n        }\n\n        // a bounded window without an exp claim to judge against fails closed\n        if (typeof payload.exp !== 'number') {\n            return false;\n        }\n\n        const nowSeconds = Math.floor(Date.now() / 1000);\n        return nowSeconds - payload.exp <= this.hintGracePeriod;\n    }\n\n    /**\n     * A post-logout redirect is honored only when it is an absolute http(s) URL\n     * that matches a registered client redirect pattern (defense against open\n     * redirects to attacker-controlled URLs).\n     */\n    protected isValidPostLogoutRedirect(\n        registered: string | null | undefined,\n        candidate: string,\n    ): boolean {\n        let parsed: URL;\n        try {\n            parsed = new URL(candidate);\n        } catch {\n            return false;\n        }\n\n        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {\n            return false;\n        }\n\n        if (!registered) {\n            return false;\n        }\n\n        return isSimpleMatch(candidate, registered.split(','));\n    }\n}\n"],"mappings":";;;;;;AAsBA,IAAaG,0BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,KAAKL,gBAAgBK,IAAIL;EACzB,KAAKC,iBAAiBI,IAAIJ;EAC1B,KAAKC,mBAAmBG,IAAIH;EAC5B,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,kBAAkBC,IAAID,mBAAmB;CAClD;CAEA,MAAME,OAAOC,MAAgE;EACzE,IAAIC,eAAe;EACnB,IAAIC;EACJ,IAAIC;EACJ,IAAIC;EACJ,IAAIC;EACJ,IAAIC,YAAsB,CAAA;EAE1B,IAAIN,KAAKO,eACL,IAAI;GAGA,MAAMC,UAAU,MAAM,KAAKf,cAAcM,OAAOC,KAAKO,eAAe;IAChEE,cAAc;IACdC,iBAAiB;GACrB,CAAA;GAKA,IAAIF,QAAQG,SAASpB,gBAAgBqB,YAAY,KAAKC,wBAAwBL,OAAAA,GAAU;IACpFP,eAAe;IACfC,MAAMM,QAAQN;IACdC,UAAUK,QAAQM;IAClBV,YAAYI,QAAQO,OAAOP,QAAQQ,cAAcC,KAAAA;IACjDZ,cAAcG,QAAQU,YAAYD,KAAAA;IAElC,MAAM,EAAEE,QAAQX;IAChB,IAAIY,MAAMC,QAAQF,GAAAA,GACdb,YAAYa,IAAIG,QAAQC,UAA2B,OAAOA,UAAU,QAAA;SACjE,IAAI,OAAOJ,QAAQ,UACtBb,YAAY,CAACa,GAAAA;GAErB;EACJ,QAAQ,CAER;EAMJ,MAAMK,WAAWxB,KAAKyB,cAAcnB,UAAUoB,WAAW,IAAIpB,UAAU,KAAKW,KAAAA;EAE5E,IAAIU,SAAwB;EAC5B,IAAIH,UAAU;GAMV,MAAMI,WAAW5B,KAAKkB,YAAYlB,KAAK6B,eAAe5B,eAAeI,cAAcY,KAAAA;GACnF,MAAMa,QAAQ,MAAM,KAAKlC,gBAAgBmC,QAAQH,UAAU,KAAA;GAQ3D,IAAIE,OACAH,SAAS,MAAM,KAAKhC,iBAAiBqC,kBAAkBR,UAAUM,MAAMG,EAAE;QACtE,IAAI,CAACL,YAAYtC,OAAOkC,QAAAA,GAC3BG,SAAS,MAAM,KAAKhC,iBAAiBqC,kBAAkBR,QAAAA;EAE/D;EAOA,IAAIvB,gBAAgBD,KAAKyB,WAAW;GAChC,MAAMS,WAAW5C,OAAOU,KAAKyB,SAAS,IAAIzB,KAAKyB,YAAYE,QAAQM;GACnE,IAAI3B,UAAUoB,WAAW,KAAK,CAACQ,YAAY,CAAC5B,UAAU6B,SAASD,QAAAA,GAAW;IACtEjC,eAAe;IACfC,MAAMe,KAAAA;IACNd,UAAUc,KAAAA;IACVb,YAAYa,KAAAA;GAChB;EACJ;EAEA,IAAImB;EACJ,IAAIC;EAKJ,IAAIV,QAAQ;GACRS,aAAaT,OAAOW;GACpB,IACItC,KAAKuC,4BACL,KAAKC,0BAA0Bb,OAAOY,0BAA0BvC,KAAKuC,wBAAwB,GAE7FF,cAAcrC,KAAKuC;EAE3B;EAEA,OAAO;GACHtC;GACA,GAAIA,eAAe;IACfC;IACAC;IACAC;GACJ,IAAI,CAAC;GACL,GAAIoB,WAAW,EAAEA,SAAS,IAAI,CAAC;GAC/B,GAAIY,aAAa,EAAEA,WAAW,IAAI,CAAC;GACnC,GAAIC,cAAc;IAAEA;IAAa,GAAIrC,KAAKyC,QAAQ,EAAEA,OAAOzC,KAAKyC,MAAM,IAAI,CAAC;GAAG,IAAI,CAAC;EACvF;CACJ;CAEA,MAAMC,OAAOtC,WAAmBF,KAAaC,SAAmC;EAC5E,MAAMwC,UAAU,MAAM,KAAKjD,eAAekD,YAAYxC,SAAAA;EACtD,IAAI,CAACuC,SACD,OAAO;EAIX,IAAIA,QAAQzC,QAAQA,OAAOyC,QAAQ7B,aAAaX,SAC5C,OAAO;EAGX,MAAM,KAAKT,eAAegD,OAAOtC,SAAAA;EACjC,OAAO;CACX;;;;;;IAQA,wBAAkCI,SAAsC;EACpE,IAAI,KAAKX,mBAAmB,GACxB,OAAO;EAIX,IAAI,OAAOW,QAAQqC,QAAQ,UACvB,OAAO;EAIX,OADmBE,KAAKC,MAAMC,KAAKC,IAAG,IAAK,GACpCJ,IAAatC,QAAQqC,OAAO,KAAKhD;CAC5C;;;;;IAOA,0BACIsD,YACAC,WACO;EACP,IAAIC;EACJ,IAAI;GACAA,SAAS,IAAIC,IAAIF,SAAAA;EACrB,QAAQ;GACJ,OAAO;EACX;EAEA,IAAIC,OAAOE,aAAa,WAAWF,OAAOE,aAAa,UACnD,OAAO;EAGX,IAAI,CAACJ,YACD,OAAO;EAGX,OAAO9D,cAAc+D,WAAWD,WAAWK,MAAM,GAAA,CAAA;CACrD;AACJ"}
+{"version":3,"file":"service.mjs","names":["isSimpleMatch","isUUID","EventName","EventRefType","EventScope","OAuth2TokenKind","OAuth2EndSessionService","tokenVerifier","sessionManager","clientRepository","realmRepository","eventService","hintGracePeriod","ctx","verify","data","hintVerified","sub","subKind","sessionId","hintRealmId","audiences","id_token_hint","payload","ignoreExpiry","skipActiveCheck","kind","ID_TOKEN","isWithinHintGraceWindow","sub_kind","sid","session_id","undefined","realm_id","aud","Array","isArray","filter","entry","clientId","client_id","length","client","realmKey","realm_name","realm","resolve","findOneByIdOrName","id","expected","includes","clientName","redirectUri","name","post_logout_redirect_uri","isValidPostLogoutRedirect","postLogoutRedirectUri","state","revoke","session","findOneById","record","scope","OAUTH2","LOGOUT","refType","SESSION","refId","actorType","actorId","realmId","revokedSessionId","exp","nowSeconds","Math","floor","Date","now","registered","candidate","parsed","URL","protocol","split"],"sources":["../../../../src/core/oauth2/end-session/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isSimpleMatch, isUUID } from '@authup/kit';\nimport type { Client, IdentityType } from '@authup/core-kit';\nimport { EventName, EventRefType, EventScope } from '@authup/core-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IEventService, IRealmRepository } from '../../entities/index.ts';\nimport type { ISessionManager } from '../../authentication/index.ts';\nimport type { IOAuth2ClientRepository } from '../client/index.ts';\nimport type { IOAuth2TokenVerifier } from '../token/index.ts';\nimport type {\n    IOAuth2EndSessionService,\n    OAuth2EndSessionRequest,\n    OAuth2EndSessionResult,\n    OAuth2EndSessionServiceContext,\n} from './types.ts';\n\nexport class OAuth2EndSessionService implements IOAuth2EndSessionService {\n    protected tokenVerifier: IOAuth2TokenVerifier;\n\n    protected sessionManager: ISessionManager;\n\n    protected clientRepository: IOAuth2ClientRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected eventService?: IEventService;\n\n    protected hintGracePeriod: number;\n\n    constructor(ctx: OAuth2EndSessionServiceContext) {\n        this.tokenVerifier = ctx.tokenVerifier;\n        this.sessionManager = ctx.sessionManager;\n        this.clientRepository = ctx.clientRepository;\n        this.realmRepository = ctx.realmRepository;\n        this.eventService = ctx.eventService;\n        this.hintGracePeriod = ctx.hintGracePeriod ?? 0;\n    }\n\n    async verify(data: OAuth2EndSessionRequest): Promise<OAuth2EndSessionResult> {\n        let hintVerified = false;\n        let sub: string | undefined;\n        let subKind: string | undefined;\n        let sessionId: string | undefined;\n        let hintRealmId: string | undefined;\n        let audiences: string[] = [];\n\n        if (data.id_token_hint) {\n            try {\n                // Signature + kind are the anchors; exp is skipped (a logout hint\n                // is routinely expired) and the cache blocklist is irrelevant.\n                const payload = await this.tokenVerifier.verify(data.id_token_hint, {\n                    ignoreExpiry: true,\n                    skipActiveCheck: true,\n                });\n\n                // MUST be an id_token — access/refresh tokens also carry\n                // session_id, so accepting them would let a leaked access token\n                // act as a logout weapon.\n                if (payload.kind === OAuth2TokenKind.ID_TOKEN && this.isWithinHintGraceWindow(payload)) {\n                    hintVerified = true;\n                    sub = payload.sub;\n                    subKind = payload.sub_kind;\n                    sessionId = payload.sid ?? payload.session_id ?? undefined;\n                    hintRealmId = payload.realm_id ?? undefined;\n                    // aud may be a single string or an array (JWT spec).\n                    const { aud } = payload;\n                    if (Array.isArray(aud)) {\n                        audiences = aud.filter((entry): entry is string => typeof entry === 'string');\n                    } else if (typeof aud === 'string') {\n                        audiences = [aud];\n                    }\n                }\n            } catch {\n                // forged / unverifiable hint → stays unverified (no revoke)\n            }\n        }\n\n        // Resolve a single client for the aud cross-check and redirect\n        // validation: the request's client_id, else the hint's sole audience\n        // (ambiguous for a multi-aud hint).\n        const clientId = data.client_id ?? (audiences.length === 1 ? audiences[0] : undefined);\n\n        let client: Client | null = null;\n        if (clientId) {\n            // Scope a name-identified client to the request's realm hint; a\n            // VERIFIED hint's own realm claim serves as fallback (claims from an\n            // unverified hint are never trusted). No master fallback here\n            // (unlike /token): a bogus hint must NOT silently resolve a\n            // same-named client in master → null realm.\n            const realmKey = data.realm_id ?? data.realm_name ?? (hintVerified ? hintRealmId : undefined);\n            const realm = await this.realmRepository.resolve(realmKey, false);\n\n            // Fail closed instead of dropping the realm predicate: a supplied\n            // realm key that does not resolve never degrades to an unscoped\n            // lookup, and a NAME-form client_id without any realm key is\n            // ambiguous (every realm has a built-in `web` client — same rule as\n            // the /authorize verifier). A UUID is globally unique and needs no\n            // scope; the sole-aud-derived clientId is always a UUID.\n            if (realm) {\n                client = await this.clientRepository.findOneByIdOrName(clientId, realm.id);\n            } else if (!realmKey && isUUID(clientId)) {\n                client = await this.clientRepository.findOneByIdOrName(clientId);\n            }\n        }\n\n        // aud/client_id cross-check: when the request supplies a client_id on a\n        // verified hint, it MUST denote one of the hint's audiences. The aud is\n        // the client UUID, so a name-form client_id is compared via its resolved\n        // client's id. Fail closed: an aud-less hint, or a name that did not\n        // resolve, counts as unverified.\n        if (hintVerified && data.client_id) {\n            const expected = isUUID(data.client_id) ? data.client_id : client?.id;\n            if (audiences.length === 0 || !expected || !audiences.includes(expected)) {\n                hintVerified = false;\n                sub = undefined;\n                subKind = undefined;\n                sessionId = undefined;\n            }\n        }\n\n        let clientName: string | undefined;\n        let redirectUri: string | undefined;\n\n        // Redirect validation is independent of hint verification — the\n        // click-gated confirm page (unverified hint / hint-less request) still\n        // honors a registered post-logout redirect.\n        if (client) {\n            clientName = client.name;\n            if (\n                data.post_logout_redirect_uri &&\n                this.isValidPostLogoutRedirect(client.postLogoutRedirectUri, data.post_logout_redirect_uri)\n            ) {\n                redirectUri = data.post_logout_redirect_uri;\n            }\n        }\n\n        return {\n            hintVerified,\n            ...(hintVerified ? {\n                sub,\n                subKind,\n                sessionId,\n            } : {}),\n            ...(clientId ? { clientId } : {}),\n            ...(clientName ? { clientName } : {}),\n            ...(redirectUri ? { redirectUri, ...(data.state ? { state: data.state } : {}) } : {}),\n        };\n    }\n\n    async revoke(sessionId: string, sub: string, subKind: string): Promise<boolean> {\n        const session = await this.sessionManager.findOneById(sessionId);\n        if (!session) {\n            return false;\n        }\n\n        // Never revoke a session that does not belong to the hint's subject.\n        if (session.sub !== sub || session.subKind !== subKind) {\n            return false;\n        }\n\n        await this.sessionManager.revoke(sessionId);\n\n        await this.eventService?.record({\n            scope: EventScope.OAUTH2,\n            name: EventName.LOGOUT,\n            refType: EventRefType.SESSION,\n            refId: sessionId,\n            actorType: session.subKind as `${IdentityType}`,\n            actorId: session.sub,\n            realmId: session.realmId,\n            data: { revokedSessionId: sessionId },\n        });\n\n        return true;\n    }\n\n    /**\n     * With a positive `hintGracePeriod`, an expired hint is honored only within\n     * the window past `exp` — beyond it a leaked id_token stops being a\n     * replayable remote logout (the hint counts as unverified; the click-gated\n     * confirm page still works). 0 keeps spec/Keycloak parity: any expired hint.\n     */\n    protected isWithinHintGraceWindow(payload: OAuth2TokenPayload): boolean {\n        if (this.hintGracePeriod <= 0) {\n            return true;\n        }\n\n        // a bounded window without an exp claim to judge against fails closed\n        if (typeof payload.exp !== 'number') {\n            return false;\n        }\n\n        const nowSeconds = Math.floor(Date.now() / 1000);\n        return nowSeconds - payload.exp <= this.hintGracePeriod;\n    }\n\n    /**\n     * A post-logout redirect is honored only when it is an absolute http(s) URL\n     * that matches a registered client redirect pattern (defense against open\n     * redirects to attacker-controlled URLs).\n     */\n    protected isValidPostLogoutRedirect(\n        registered: string | null | undefined,\n        candidate: string,\n    ): boolean {\n        let parsed: URL;\n        try {\n            parsed = new URL(candidate);\n        } catch {\n            return false;\n        }\n\n        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {\n            return false;\n        }\n\n        if (!registered) {\n            return false;\n        }\n\n        return isSimpleMatch(candidate, registered.split(','));\n    }\n}\n"],"mappings":";;;;;;;AAuBA,IAAaM,0BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,KAAKN,gBAAgBM,IAAIN;EACzB,KAAKC,iBAAiBK,IAAIL;EAC1B,KAAKC,mBAAmBI,IAAIJ;EAC5B,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,eAAeE,IAAIF;EACxB,KAAKC,kBAAkBC,IAAID,mBAAmB;CAClD;CAEA,MAAME,OAAOC,MAAgE;EACzE,IAAIC,eAAe;EACnB,IAAIC;EACJ,IAAIC;EACJ,IAAIC;EACJ,IAAIC;EACJ,IAAIC,YAAsB,CAAA;EAE1B,IAAIN,KAAKO,eACL,IAAI;GAGA,MAAMC,UAAU,MAAM,KAAKhB,cAAcO,OAAOC,KAAKO,eAAe;IAChEE,cAAc;IACdC,iBAAiB;GACrB,CAAA;GAKA,IAAIF,QAAQG,SAASrB,gBAAgBsB,YAAY,KAAKC,wBAAwBL,OAAAA,GAAU;IACpFP,eAAe;IACfC,MAAMM,QAAQN;IACdC,UAAUK,QAAQM;IAClBV,YAAYI,QAAQO,OAAOP,QAAQQ,cAAcC,KAAAA;IACjDZ,cAAcG,QAAQU,YAAYD,KAAAA;IAElC,MAAM,EAAEE,QAAQX;IAChB,IAAIY,MAAMC,QAAQF,GAAAA,GACdb,YAAYa,IAAIG,QAAQC,UAA2B,OAAOA,UAAU,QAAA;SACjE,IAAI,OAAOJ,QAAQ,UACtBb,YAAY,CAACa,GAAAA;GAErB;EACJ,QAAQ,CAER;EAMJ,MAAMK,WAAWxB,KAAKyB,cAAcnB,UAAUoB,WAAW,IAAIpB,UAAU,KAAKW,KAAAA;EAE5E,IAAIU,SAAwB;EAC5B,IAAIH,UAAU;GAMV,MAAMI,WAAW5B,KAAKkB,YAAYlB,KAAK6B,eAAe5B,eAAeI,cAAcY,KAAAA;GACnF,MAAMa,QAAQ,MAAM,KAAKnC,gBAAgBoC,QAAQH,UAAU,KAAA;GAQ3D,IAAIE,OACAH,SAAS,MAAM,KAAKjC,iBAAiBsC,kBAAkBR,UAAUM,MAAMG,EAAE;QACtE,IAAI,CAACL,YAAY1C,OAAOsC,QAAAA,GAC3BG,SAAS,MAAM,KAAKjC,iBAAiBsC,kBAAkBR,QAAAA;EAE/D;EAOA,IAAIvB,gBAAgBD,KAAKyB,WAAW;GAChC,MAAMS,WAAWhD,OAAOc,KAAKyB,SAAS,IAAIzB,KAAKyB,YAAYE,QAAQM;GACnE,IAAI3B,UAAUoB,WAAW,KAAK,CAACQ,YAAY,CAAC5B,UAAU6B,SAASD,QAAAA,GAAW;IACtEjC,eAAe;IACfC,MAAMe,KAAAA;IACNd,UAAUc,KAAAA;IACVb,YAAYa,KAAAA;GAChB;EACJ;EAEA,IAAImB;EACJ,IAAIC;EAKJ,IAAIV,QAAQ;GACRS,aAAaT,OAAOW;GACpB,IACItC,KAAKuC,4BACL,KAAKC,0BAA0Bb,OAAOc,uBAAuBzC,KAAKuC,wBAAwB,GAE1FF,cAAcrC,KAAKuC;EAE3B;EAEA,OAAO;GACHtC;GACA,GAAIA,eAAe;IACfC;IACAC;IACAC;GACJ,IAAI,CAAC;GACL,GAAIoB,WAAW,EAAEA,SAAS,IAAI,CAAC;GAC/B,GAAIY,aAAa,EAAEA,WAAW,IAAI,CAAC;GACnC,GAAIC,cAAc;IAAEA;IAAa,GAAIrC,KAAK0C,QAAQ,EAAEA,OAAO1C,KAAK0C,MAAM,IAAI,CAAC;GAAG,IAAI,CAAC;EACvF;CACJ;CAEA,MAAMC,OAAOvC,WAAmBF,KAAaC,SAAmC;EAC5E,MAAMyC,UAAU,MAAM,KAAKnD,eAAeoD,YAAYzC,SAAAA;EACtD,IAAI,CAACwC,SACD,OAAO;EAIX,IAAIA,QAAQ1C,QAAQA,OAAO0C,QAAQzC,YAAYA,SAC3C,OAAO;EAGX,MAAM,KAAKV,eAAekD,OAAOvC,SAAAA;EAEjC,MAAM,KAAKR,cAAckD,OAAO;GAC5BC,OAAO1D,WAAW2D;GAClBV,MAAMnD,UAAU8D;GAChBC,SAAS9D,aAAa+D;GACtBC,OAAOhD;GACPiD,WAAWT,QAAQzC;GACnBmD,SAASV,QAAQ1C;GACjBqD,SAASX,QAAQW;GACjBvD,MAAM,EAAEwD,kBAAkBpD,UAAU;EACxC,CAAA;EAEA,OAAO;CACX;;;;;;IAQA,wBAAkCI,SAAsC;EACpE,IAAI,KAAKX,mBAAmB,GACxB,OAAO;EAIX,IAAI,OAAOW,QAAQiD,QAAQ,UACvB,OAAO;EAIX,OADmBE,KAAKC,MAAMC,KAAKC,IAAG,IAAK,GACpCJ,IAAalD,QAAQiD,OAAO,KAAK5D;CAC5C;;;;;IAOA,0BACIkE,YACAC,WACO;EACP,IAAIC;EACJ,IAAI;GACAA,SAAS,IAAIC,IAAIF,SAAAA;EACrB,QAAQ;GACJ,OAAO;EACX;EAEA,IAAIC,OAAOE,aAAa,WAAWF,OAAOE,aAAa,UACnD,OAAO;EAGX,IAAI,CAACJ,YACD,OAAO;EAGX,OAAO9E,cAAc+E,WAAWD,WAAWK,MAAM,GAAA,CAAA;CACrD;AACJ"}

package/dist/core/oauth2/end-session/types.d.ts

@@ -1,4 +1,4 @@
-import type { IRealmRepository } from '../../entities/index.ts';
+import type { IEventService, IRealmRepository } from '../../entities/index.ts';
 import type { ISessionManager } from '../../authentication/index.ts';
 import type { IOAuth2ClientRepository } from '../client/index.ts';
 import type { IOAuth2TokenVerifier } from '../token/index.ts';
@@ -33,6 +33,7 @@ export type OAuth2EndSessionServiceContext = {
     sessionManager: ISessionManager;
     clientRepository: IOAuth2ClientRepository;
     realmRepository: IRealmRepository;
+    eventService?: IEventService;
     /**
      * Seconds past its `exp` an (expired) id_token_hint is still accepted for
      * a server-side revoke (config `endSessionHintGracePeriod`).

package/dist/core/oauth2/end-session/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/end-session/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAE9D,MAAM,MAAM,uBAAuB,GAAG;IAClC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACjC;;;OAGG;IACH,YAAY,EAAE,OAAO,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IACzC,aAAa,EAAE,oBAAoB,CAAC;IACpC,cAAc,EAAE,eAAe,CAAC;IAChC,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,eAAe,EAAE,gBAAgB,CAAC;IAClC;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,MAAM,WAAW,wBAAwB;IACrC;;;OAGG;IACH,MAAM,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAEvE;;;OAGG;IACH,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7E"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/end-session/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAE9D,MAAM,MAAM,uBAAuB,GAAG;IAClC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACjC;;;OAGG;IACH,YAAY,EAAE,OAAO,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IACzC,aAAa,EAAE,oBAAoB,CAAC;IACpC,cAAc,EAAE,eAAe,CAAC;IAChC,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,eAAe,EAAE,gBAAgB,CAAC;IAClC,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,MAAM,WAAW,wBAAwB;IACrC;;;OAGG;IACH,MAAM,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAEvE;;;OAGG;IACH,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7E"}

package/dist/core/oauth2/grant-types/authorize.d.ts

@@ -1,13 +1,13 @@
 import type { OAuth2TokenGrantResponse } from '@authup/specs';
 import type { OAuth2AuthorizationCode, Session } from '@authup/core-kit';
-import type { IOAuth2KeyRepository } from '../key/index.ts';
+import type { IKeyStore } from '../../key/index.ts';
 import type { IOAuth2OpenIDTokenIssuer, IOAuth2TokenIssuer } from '../token/index.ts';
 import { OAuth2BaseGrant } from './base.ts';
 import type { IOAuth2Grant, OAuth2AuthorizeGrantContext, OAuth2GrantRunWIthOptions } from './types.ts';
 export declare class OAuth2AuthorizeGrant extends OAuth2BaseGrant<OAuth2AuthorizationCode> implements IOAuth2Grant {
     protected refreshTokenIssuer: IOAuth2TokenIssuer;
     protected openIdTokenIssuer: IOAuth2OpenIDTokenIssuer;
-    protected keyRepository: IOAuth2KeyRepository;
+    protected keyStore: IKeyStore;
     constructor(ctx: OAuth2AuthorizeGrantContext);
     runWith(authorizationCode: OAuth2AuthorizationCode, options?: OAuth2GrantRunWIthOptions): Promise<OAuth2TokenGrantResponse>;
     /**

package/dist/core/oauth2/grant-types/authorize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/grant-types/authorize.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAsB,MAAM,eAAe,CAAC;AAElF,OAAO,KAAK,EAAE,uBAAuB,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAGzE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACtF,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,YAAY,EAAE,2BAA2B,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAIvG,qBAAa,oBAAqB,SAAQ,eAAe,CAAC,uBAAuB,CAAE,YAAW,YAAY;IACtG,SAAS,CAAC,kBAAkB,EAAG,kBAAkB,CAAC;IAElD,SAAS,CAAC,iBAAiB,EAAG,wBAAwB,CAAC;IAEvD,SAAS,CAAC,aAAa,EAAG,oBAAoB,CAAC;gBAEnC,GAAG,EAAE,2BAA2B;IAWtC,OAAO,CACT,iBAAiB,EAAE,uBAAuB,EAC1C,OAAO,GAAE,yBAA8B,GACvC,OAAO,CAAC,wBAAwB,CAAC;IA6DrC;;;;;;;;;;;;OAYG;cACa,cAAc,CAC1B,iBAAiB,EAAE,uBAAuB,EAC1C,OAAO,EAAE,yBAAyB,GAClC,OAAO,CAAC,OAAO,CAAC;CAwBvB"}
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/grant-types/authorize.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAsB,MAAM,eAAe,CAAC;AAElF,OAAO,KAAK,EAAE,uBAAuB,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAGzE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,KAAK,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACtF,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,YAAY,EAAE,2BAA2B,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAIvG,qBAAa,oBAAqB,SAAQ,eAAe,CAAC,uBAAuB,CAAE,YAAW,YAAY;IACtG,SAAS,CAAC,kBAAkB,EAAG,kBAAkB,CAAC;IAElD,SAAS,CAAC,iBAAiB,EAAG,wBAAwB,CAAC;IAEvD,SAAS,CAAC,QAAQ,EAAG,SAAS,CAAC;gBAEnB,GAAG,EAAE,2BAA2B;IAWtC,OAAO,CACT,iBAAiB,EAAE,uBAAuB,EAC1C,OAAO,GAAE,yBAA8B,GACvC,OAAO,CAAC,wBAAwB,CAAC;IAmErC;;;;;;;;;;;;OAYG;cACa,cAAc,CAC1B,iBAAiB,EAAE,uBAAuB,EAC1C,OAAO,EAAE,yBAAyB,GAClC,OAAO,CAAC,OAAO,CAAC;CAyBvB"}