@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.54

package/dist/core/oauth2/grant-types/authorize.mjs

@@ -1,16 +1,16 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { buildOAuth2TokenHash } from "../authorization/helpers.mjs";
+import { buildOAuth2TokenHash, deriveAmrAcr } from "../authorization/helpers.mjs";
 import { OAuth2BaseGrant } from "./base.mjs";
 import { buildOAuth2BearerTokenResponse } from "../response/bearer.mjs";
 import { ScopeName } from "@authup/core-kit";
-import { JWKError, hasOAuth2Scopes } from "@authup/specs";
+import { JWKUse, hasOAuth2Scopes } from "@authup/specs";
 //#region src/core/oauth2/grant-types/authorize.ts
 var OAuth2AuthorizeGrant = class extends OAuth2BaseGrant {
 	refreshTokenIssuer;
 	openIdTokenIssuer;
-	keyRepository;
+	keyStore;
 	constructor(ctx) {
 		super({
 			accessTokenIssuer: ctx.accessTokenIssuer,
@@ -18,10 +18,11 @@ var OAuth2AuthorizeGrant = class extends OAuth2BaseGrant {
 		});
 		this.refreshTokenIssuer = ctx.refreshTokenIssuer;
 		this.openIdTokenIssuer = ctx.openIdTokenIssuer;
-		this.keyRepository = ctx.keyRepository;
+		this.keyStore = ctx.keyStore;
 	}
 	async runWith(authorizationCode, options = {}) {
 		const session = await this.resolveSession(authorizationCode, options);
+		const amrAcr = deriveAmrAcr(session);
 		const issuePayload = {
 			user_agent: options.userAgent,
 			remote_address: options.ipAddress,
@@ -31,7 +32,9 @@ var OAuth2AuthorizeGrant = class extends OAuth2BaseGrant {
 			realm_id: authorizationCode.realm_id,
 			realm_name: authorizationCode.realm_name,
 			scope: authorizationCode.scope || void 0,
-			client_id: authorizationCode.client_id || void 0
+			client_id: authorizationCode.client_id || void 0,
+			...options.confirmation ? { cnf: options.confirmation } : {},
+			...amrAcr
 		};
 		const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);
 		const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);
@@ -42,8 +45,7 @@ var OAuth2AuthorizeGrant = class extends OAuth2BaseGrant {
 			refreshTokenPayload
 		};
 		if (authorizationCode.scope && hasOAuth2Scopes(authorizationCode.scope, ScopeName.OPEN_ID)) {
-			const key = await this.keyRepository.findByRealmId(authorizationCode.realm_id);
-			if (!key) throw JWKError.notFoundForRealm(authorizationCode.realm_id, authorizationCode.realm_name);
+			const key = await this.keyStore.resolveOrCreate(authorizationCode.realm_id, JWKUse.SIGNATURE);
 			const [idToken] = await this.openIdTokenIssuer.issue({
 				sub: authorizationCode.sub || void 0,
 				sub_kind: authorizationCode.sub_kind,
@@ -53,8 +55,9 @@ var OAuth2AuthorizeGrant = class extends OAuth2BaseGrant {
 				client_id: authorizationCode.client_id || void 0,
 				...authorizationCode.nonce ? { nonce: authorizationCode.nonce } : {},
 				...typeof authorizationCode.auth_time === "number" ? { auth_time: authorizationCode.auth_time } : {},
+				...amrAcr,
 				sid: session.id,
-				at_hash: await buildOAuth2TokenHash(accessToken, key.signature_algorithm)
+				at_hash: await buildOAuth2TokenHash(accessToken, key.signatureAlgorithm)
 			});
 			buildContext.idToken = idToken;
 		}
@@ -75,18 +78,19 @@ var OAuth2AuthorizeGrant = class extends OAuth2BaseGrant {
 	*/ async resolveSession(authorizationCode, options) {
 		if (authorizationCode.session_id) {
 			const existing = await this.sessionManager.findOneById(authorizationCode.session_id);
-			if (existing && existing.sub === authorizationCode.sub && existing.sub_kind === authorizationCode.sub_kind && existing.realm_id === authorizationCode.realm_id) {
-				existing.client_id = authorizationCode.client_id || null;
+			if (existing && existing.sub === authorizationCode.sub && existing.subKind === authorizationCode.sub_kind && existing.realmId === authorizationCode.realm_id) {
+				existing.clientId = authorizationCode.client_id || null;
 				return this.sessionManager.refresh(existing);
 			}
 		}
 		return this.sessionManager.create({
-			user_agent: options.userAgent,
-			ip_address: options.ipAddress,
-			realm_id: authorizationCode.realm_id,
-			client_id: authorizationCode.client_id,
-			sub_kind: authorizationCode.sub_kind,
-			sub: authorizationCode.sub
+			userAgent: options.userAgent,
+			ipAddress: options.ipAddress,
+			realmId: authorizationCode.realm_id,
+			clientId: authorizationCode.client_id,
+			subKind: authorizationCode.sub_kind,
+			sub: authorizationCode.sub,
+			authMethod: authorizationCode.auth_method ?? null
 		});
 	}
 };

package/dist/core/oauth2/grant-types/authorize.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.mjs","names":["JWKError","hasOAuth2Scopes","ScopeName","buildOAuth2TokenHash","OAuth2BaseGrant","buildOAuth2BearerTokenResponse","OAuth2AuthorizeGrant","refreshTokenIssuer","openIdTokenIssuer","keyRepository","ctx","accessTokenIssuer","sessionManager","runWith","authorizationCode","options","session","resolveSession","issuePayload","user_agent","userAgent","remote_address","ipAddress","session_id","id","sub","undefined","sub_kind","realm_id","realm_name","scope","client_id","accessToken","accessTokenPayload","issue","refreshToken","refreshTokenPayload","buildContext","OPEN_ID","key","findByRealmId","notFoundForRealm","idToken","nonce","auth_time","sid","at_hash","signature_algorithm","existing","findOneById","refresh","create","ip_address"],"sources":["../../../../src/core/oauth2/grant-types/authorize.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { JWKError, hasOAuth2Scopes } from '@authup/specs';\nimport type { OAuth2AuthorizationCode, Session } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport { buildOAuth2TokenHash } from '../authorization/helpers.ts';\nimport type { IOAuth2KeyRepository } from '../key/index.ts';\nimport type { IOAuth2OpenIDTokenIssuer, IOAuth2TokenIssuer } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport type { IOAuth2Grant, OAuth2AuthorizeGrantContext, OAuth2GrantRunWIthOptions } from './types.ts';\nimport type { OAuth2BearerResponseBuildContext } from '../response/index.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\n\nexport class OAuth2AuthorizeGrant extends OAuth2BaseGrant<OAuth2AuthorizationCode> implements IOAuth2Grant {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    protected openIdTokenIssuer : IOAuth2OpenIDTokenIssuer;\n\n    protected keyRepository : IOAuth2KeyRepository;\n\n    constructor(ctx: OAuth2AuthorizeGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n        this.openIdTokenIssuer = ctx.openIdTokenIssuer;\n        this.keyRepository = ctx.keyRepository;\n    }\n\n    async runWith(\n        authorizationCode: OAuth2AuthorizationCode,\n        options: OAuth2GrantRunWIthOptions = {},\n    ) : Promise<OAuth2TokenGrantResponse> {\n        const session = await this.resolveSession(authorizationCode, options);\n\n        const issuePayload : Partial<OAuth2TokenPayload> = {\n            user_agent: options.userAgent,\n            remote_address: options.ipAddress,\n            session_id: session.id,\n            sub: authorizationCode.sub || undefined,\n            sub_kind: authorizationCode.sub_kind,\n            realm_id: authorizationCode.realm_id,\n            realm_name: authorizationCode.realm_name,\n            scope: authorizationCode.scope || undefined,\n            client_id: authorizationCode.client_id || undefined,\n        };\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);\n\n        const buildContext : OAuth2BearerResponseBuildContext = {\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        };\n\n        // The id_token is minted HERE — after resolveSession — so its `sid`\n        // references the real backing session for the reuse branch, the\n        // fallback branch, and session-less (federated IdP) codes alike.\n        // `auth_time` is the authentication instant captured on the code.\n        if (\n            authorizationCode.scope &&\n            hasOAuth2Scopes(authorizationCode.scope, ScopeName.OPEN_ID)\n        ) {\n            // The at_hash digest follows the id_token's JWS alg (OIDC Core\n            // §3.1.3.6) — the alg of the realm key the openid issuer signs\n            // with. The access token above was signed with the same key, so a\n            // missing key would already have thrown; this guard fails closed.\n            const key = await this.keyRepository.findByRealmId(authorizationCode.realm_id);\n            if (!key) {\n                throw JWKError.notFoundForRealm(authorizationCode.realm_id, authorizationCode.realm_name);\n            }\n\n            const [idToken] = await this.openIdTokenIssuer.issue({\n                sub: authorizationCode.sub || undefined,\n                sub_kind: authorizationCode.sub_kind,\n                realm_id: authorizationCode.realm_id,\n                realm_name: authorizationCode.realm_name,\n                scope: authorizationCode.scope || undefined,\n                client_id: authorizationCode.client_id || undefined,\n                ...(authorizationCode.nonce ? { nonce: authorizationCode.nonce } : {}),\n                ...(typeof authorizationCode.auth_time === 'number' ? { auth_time: authorizationCode.auth_time } : {}),\n                sid: session.id,\n                at_hash: await buildOAuth2TokenHash(accessToken, key.signature_algorithm),\n            });\n\n            buildContext.idToken = idToken;\n        }\n\n        return buildOAuth2BearerTokenResponse(buildContext);\n    }\n\n    /**\n     * Reuse the bearer's session when the authorization code was issued from an\n     * (interactive) `/authorize` request that carried one — otherwise the\n     * interactive login would create a second session (the abandoned bearer\n     * session that authenticated `POST /authorize`, plus this one).\n     *\n     * The reuse is gated on the session still existing and belonging to the\n     * same subject/realm as the code (defense in depth — the id is\n     * server-derived from the authenticated bearer, never client input). Any\n     * mismatch, or a session-less authorize flow (external IdP, non-interactive\n     * clients), falls back to creating a fresh session — preserving prior\n     * behavior.\n     */\n    protected async resolveSession(\n        authorizationCode: OAuth2AuthorizationCode,\n        options: OAuth2GrantRunWIthOptions,\n    ) : Promise<Session> {\n        if (authorizationCode.session_id) {\n            const existing = await this.sessionManager.findOneById(authorizationCode.session_id);\n            if (\n                existing &&\n                existing.sub === authorizationCode.sub &&\n                existing.sub_kind === authorizationCode.sub_kind &&\n                existing.realm_id === authorizationCode.realm_id\n            ) {\n                existing.client_id = authorizationCode.client_id || null;\n\n                return this.sessionManager.refresh(existing);\n            }\n        }\n\n        return this.sessionManager.create({\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: authorizationCode.realm_id,\n            client_id: authorizationCode.client_id,\n            sub_kind: authorizationCode.sub_kind,\n            sub: authorizationCode.sub,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;AAmBA,IAAaM,uBAAb,cAA0CF,gBAAAA;CAC5BG;CAEAC;CAEAC;CAEV,YAAYC,KAAkC;EAC1C,MAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;EACxB,CAAA;EAEA,KAAKL,qBAAqBG,IAAIH;EAC9B,KAAKC,oBAAoBE,IAAIF;EAC7B,KAAKC,gBAAgBC,IAAID;CAC7B;CAEA,MAAMI,QACFC,mBACAC,UAAqC,CAAC,GACJ;EAClC,MAAMC,UAAU,MAAM,KAAKC,eAAeH,mBAAmBC,OAAAA;EAE7D,MAAMG,eAA6C;GAC/CC,YAAYJ,QAAQK;GACpBC,gBAAgBN,QAAQO;GACxBC,YAAYP,QAAQQ;GACpBC,KAAKX,kBAAkBW,OAAOC,KAAAA;GAC9BC,UAAUb,kBAAkBa;GAC5BC,UAAUd,kBAAkBc;GAC5BC,YAAYf,kBAAkBe;GAC9BC,OAAOhB,kBAAkBgB,SAASJ,KAAAA;GAClCK,WAAWjB,kBAAkBiB,aAAaL,KAAAA;EAC9C;EAEA,MAAM,CAACM,aAAaC,sBAAsB,MAAM,KAAKtB,kBAAkBuB,MAAMhB,YAAAA;EAC7E,MAAM,CAACiB,cAAcC,uBAAuB,MAAM,KAAK7B,mBAAmB2B,MAAMhB,YAAAA;EAEhF,MAAMmB,eAAkD;GACpDL;GACAC;GACAE;GACAC;EACJ;EAMA,IACItB,kBAAkBgB,SAClB7B,gBAAgBa,kBAAkBgB,OAAO5B,UAAUoC,OAAO,GAC5D;GAKE,MAAMC,MAAM,MAAM,KAAK9B,cAAc+B,cAAc1B,kBAAkBc,QAAQ;GAC7E,IAAI,CAACW,KACD,MAAMvC,SAASyC,iBAAiB3B,kBAAkBc,UAAUd,kBAAkBe,UAAU;GAG5F,MAAM,CAACa,WAAW,MAAM,KAAKlC,kBAAkB0B,MAAM;IACjDT,KAAKX,kBAAkBW,OAAOC,KAAAA;IAC9BC,UAAUb,kBAAkBa;IAC5BC,UAAUd,kBAAkBc;IAC5BC,YAAYf,kBAAkBe;IAC9BC,OAAOhB,kBAAkBgB,SAASJ,KAAAA;IAClCK,WAAWjB,kBAAkBiB,aAAaL,KAAAA;IAC1C,GAAIZ,kBAAkB6B,QAAQ,EAAEA,OAAO7B,kBAAkB6B,MAAM,IAAI,CAAC;IACpE,GAAI,OAAO7B,kBAAkB8B,cAAc,WAAW,EAAEA,WAAW9B,kBAAkB8B,UAAU,IAAI,CAAC;IACpGC,KAAK7B,QAAQQ;IACbsB,SAAS,MAAM3C,qBAAqB6B,aAAaO,IAAIQ,mBAAmB;GAC5E,CAAA;GAEAV,aAAaK,UAAUA;EAC3B;EAEA,OAAOrC,+BAA+BgC,YAAAA;CAC1C;;;;;;;;;;;;;IAeA,MAAgBpB,eACZH,mBACAC,SACiB;EACjB,IAAID,kBAAkBS,YAAY;GAC9B,MAAMyB,WAAW,MAAM,KAAKpC,eAAeqC,YAAYnC,kBAAkBS,UAAU;GACnF,IACIyB,YACAA,SAASvB,QAAQX,kBAAkBW,OACnCuB,SAASrB,aAAab,kBAAkBa,YACxCqB,SAASpB,aAAad,kBAAkBc,UAC1C;IACEoB,SAASjB,YAAYjB,kBAAkBiB,aAAa;IAEpD,OAAO,KAAKnB,eAAesC,QAAQF,QAAAA;GACvC;EACJ;EAEA,OAAO,KAAKpC,eAAeuC,OAAO;GAC9BhC,YAAYJ,QAAQK;GACpBgC,YAAYrC,QAAQO;GACpBM,UAAUd,kBAAkBc;GAC5BG,WAAWjB,kBAAkBiB;GAC7BJ,UAAUb,kBAAkBa;GAC5BF,KAAKX,kBAAkBW;EAC3B,CAAA;CACJ;AACJ"}
+{"version":3,"file":"authorize.mjs","names":["JWKUse","hasOAuth2Scopes","ScopeName","buildOAuth2TokenHash","deriveAmrAcr","OAuth2BaseGrant","buildOAuth2BearerTokenResponse","OAuth2AuthorizeGrant","refreshTokenIssuer","openIdTokenIssuer","keyStore","ctx","accessTokenIssuer","sessionManager","runWith","authorizationCode","options","session","resolveSession","amrAcr","issuePayload","user_agent","userAgent","remote_address","ipAddress","session_id","id","sub","undefined","sub_kind","realm_id","realm_name","scope","client_id","confirmation","cnf","accessToken","accessTokenPayload","issue","refreshToken","refreshTokenPayload","buildContext","OPEN_ID","key","resolveOrCreate","SIGNATURE","idToken","nonce","auth_time","sid","at_hash","signatureAlgorithm","existing","findOneById","subKind","realmId","clientId","refresh","create","authMethod","auth_method"],"sources":["../../../../src/core/oauth2/grant-types/authorize.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { JWKUse, hasOAuth2Scopes } from '@authup/specs';\nimport type { OAuth2AuthorizationCode, Session } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport { buildOAuth2TokenHash, deriveAmrAcr } from '../authorization/helpers.ts';\nimport type { IKeyStore } from '../../key/index.ts';\nimport type { IOAuth2OpenIDTokenIssuer, IOAuth2TokenIssuer } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport type { IOAuth2Grant, OAuth2AuthorizeGrantContext, OAuth2GrantRunWIthOptions } from './types.ts';\nimport type { OAuth2BearerResponseBuildContext } from '../response/index.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\n\nexport class OAuth2AuthorizeGrant extends OAuth2BaseGrant<OAuth2AuthorizationCode> implements IOAuth2Grant {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    protected openIdTokenIssuer : IOAuth2OpenIDTokenIssuer;\n\n    protected keyStore : IKeyStore;\n\n    constructor(ctx: OAuth2AuthorizeGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n        this.openIdTokenIssuer = ctx.openIdTokenIssuer;\n        this.keyStore = ctx.keyStore;\n    }\n\n    async runWith(\n        authorizationCode: OAuth2AuthorizationCode,\n        options: OAuth2GrantRunWIthOptions = {},\n    ) : Promise<OAuth2TokenGrantResponse> {\n        const session = await this.resolveSession(authorizationCode, options);\n\n        // amr/acr derive from the RESOLVED session (authMethod + mfaAt) —\n        // deliberately on every token kind, not only the id_token, so\n        // resource servers can read the method without parsing an id_token.\n        const amrAcr = deriveAmrAcr(session);\n\n        const issuePayload : Partial<OAuth2TokenPayload> = {\n            user_agent: options.userAgent,\n            remote_address: options.ipAddress,\n            session_id: session.id,\n            sub: authorizationCode.sub || undefined,\n            sub_kind: authorizationCode.sub_kind,\n            realm_id: authorizationCode.realm_id,\n            realm_name: authorizationCode.realm_name,\n            scope: authorizationCode.scope || undefined,\n            client_id: authorizationCode.client_id || undefined,\n            ...(options.confirmation ? { cnf: options.confirmation } : {}),\n            ...amrAcr,\n        };\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);\n\n        const buildContext : OAuth2BearerResponseBuildContext = {\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        };\n\n        // The id_token is minted HERE — after resolveSession — so its `sid`\n        // references the real backing session for the reuse branch, the\n        // fallback branch, and session-less (federated IdP) codes alike.\n        // `auth_time` is the authentication instant captured on the code.\n        if (\n            authorizationCode.scope &&\n            hasOAuth2Scopes(authorizationCode.scope, ScopeName.OPEN_ID)\n        ) {\n            // The at_hash digest follows the id_token's JWS alg (OIDC Core\n            // §3.1.3.6) — the alg of the realm key the openid issuer signs\n            // with. The access token above was signed with the same key, so a\n            // missing key would already have thrown; this resolves the same\n            // active key.\n            const key = await this.keyStore.resolveOrCreate(authorizationCode.realm_id, JWKUse.SIGNATURE);\n\n            const [idToken] = await this.openIdTokenIssuer.issue({\n                sub: authorizationCode.sub || undefined,\n                sub_kind: authorizationCode.sub_kind,\n                realm_id: authorizationCode.realm_id,\n                realm_name: authorizationCode.realm_name,\n                scope: authorizationCode.scope || undefined,\n                client_id: authorizationCode.client_id || undefined,\n                ...(authorizationCode.nonce ? { nonce: authorizationCode.nonce } : {}),\n                ...(typeof authorizationCode.auth_time === 'number' ? { auth_time: authorizationCode.auth_time } : {}),\n                ...amrAcr,\n                sid: session.id,\n                at_hash: await buildOAuth2TokenHash(accessToken, key.signatureAlgorithm),\n            });\n\n            buildContext.idToken = idToken;\n        }\n\n        return buildOAuth2BearerTokenResponse(buildContext);\n    }\n\n    /**\n     * Reuse the bearer's session when the authorization code was issued from an\n     * (interactive) `/authorize` request that carried one — otherwise the\n     * interactive login would create a second session (the abandoned bearer\n     * session that authenticated `POST /authorize`, plus this one).\n     *\n     * The reuse is gated on the session still existing and belonging to the\n     * same subject/realm as the code (defense in depth — the id is\n     * server-derived from the authenticated bearer, never client input). Any\n     * mismatch, or a session-less authorize flow (external IdP, non-interactive\n     * clients), falls back to creating a fresh session — preserving prior\n     * behavior.\n     */\n    protected async resolveSession(\n        authorizationCode: OAuth2AuthorizationCode,\n        options: OAuth2GrantRunWIthOptions,\n    ) : Promise<Session> {\n        if (authorizationCode.session_id) {\n            const existing = await this.sessionManager.findOneById(authorizationCode.session_id);\n            if (\n                existing &&\n                existing.sub === authorizationCode.sub &&\n                existing.subKind === authorizationCode.sub_kind &&\n                existing.realmId === authorizationCode.realm_id\n            ) {\n                existing.clientId = authorizationCode.client_id || null;\n\n                return this.sessionManager.refresh(existing);\n            }\n        }\n\n        return this.sessionManager.create({\n            userAgent: options.userAgent,\n            ipAddress: options.ipAddress,\n            realmId: authorizationCode.realm_id,\n            clientId: authorizationCode.client_id,\n            subKind: authorizationCode.sub_kind,\n            sub: authorizationCode.sub,\n            authMethod: authorizationCode.auth_method ?? null,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;AAmBA,IAAaO,uBAAb,cAA0CF,gBAAAA;CAC5BG;CAEAC;CAEAC;CAEV,YAAYC,KAAkC;EAC1C,MAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;EACxB,CAAA;EAEA,KAAKL,qBAAqBG,IAAIH;EAC9B,KAAKC,oBAAoBE,IAAIF;EAC7B,KAAKC,WAAWC,IAAID;CACxB;CAEA,MAAMI,QACFC,mBACAC,UAAqC,CAAC,GACJ;EAClC,MAAMC,UAAU,MAAM,KAAKC,eAAeH,mBAAmBC,OAAAA;EAK7D,MAAMG,SAASf,aAAaa,OAAAA;EAE5B,MAAMG,eAA6C;GAC/CC,YAAYL,QAAQM;GACpBC,gBAAgBP,QAAQQ;GACxBC,YAAYR,QAAQS;GACpBC,KAAKZ,kBAAkBY,OAAOC,KAAAA;GAC9BC,UAAUd,kBAAkBc;GAC5BC,UAAUf,kBAAkBe;GAC5BC,YAAYhB,kBAAkBgB;GAC9BC,OAAOjB,kBAAkBiB,SAASJ,KAAAA;GAClCK,WAAWlB,kBAAkBkB,aAAaL,KAAAA;GAC1C,GAAIZ,QAAQkB,eAAe,EAAEC,KAAKnB,QAAQkB,aAAa,IAAI,CAAC;GAC5D,GAAGf;EACP;EAEA,MAAM,CAACiB,aAAaC,sBAAsB,MAAM,KAAKzB,kBAAkB0B,MAAMlB,YAAAA;EAC7E,MAAM,CAACmB,cAAcC,uBAAuB,MAAM,KAAKhC,mBAAmB8B,MAAMlB,YAAAA;EAEhF,MAAMqB,eAAkD;GACpDL;GACAC;GACAE;GACAC;EACJ;EAMA,IACIzB,kBAAkBiB,SAClB/B,gBAAgBc,kBAAkBiB,OAAO9B,UAAUwC,OAAO,GAC5D;GAME,MAAMC,MAAM,MAAM,KAAKjC,SAASkC,gBAAgB7B,kBAAkBe,UAAU9B,OAAO6C,SAAS;GAE5F,MAAM,CAACC,WAAW,MAAM,KAAKrC,kBAAkB6B,MAAM;IACjDX,KAAKZ,kBAAkBY,OAAOC,KAAAA;IAC9BC,UAAUd,kBAAkBc;IAC5BC,UAAUf,kBAAkBe;IAC5BC,YAAYhB,kBAAkBgB;IAC9BC,OAAOjB,kBAAkBiB,SAASJ,KAAAA;IAClCK,WAAWlB,kBAAkBkB,aAAaL,KAAAA;IAC1C,GAAIb,kBAAkBgC,QAAQ,EAAEA,OAAOhC,kBAAkBgC,MAAM,IAAI,CAAC;IACpE,GAAI,OAAOhC,kBAAkBiC,cAAc,WAAW,EAAEA,WAAWjC,kBAAkBiC,UAAU,IAAI,CAAC;IACpG,GAAG7B;IACH8B,KAAKhC,QAAQS;IACbwB,SAAS,MAAM/C,qBAAqBiC,aAAaO,IAAIQ,kBAAkB;GAC3E,CAAA;GAEAV,aAAaK,UAAUA;EAC3B;EAEA,OAAOxC,+BAA+BmC,YAAAA;CAC1C;;;;;;;;;;;;;IAeA,MAAgBvB,eACZH,mBACAC,SACiB;EACjB,IAAID,kBAAkBU,YAAY;GAC9B,MAAM2B,WAAW,MAAM,KAAKvC,eAAewC,YAAYtC,kBAAkBU,UAAU;GACnF,IACI2B,YACAA,SAASzB,QAAQZ,kBAAkBY,OACnCyB,SAASE,YAAYvC,kBAAkBc,YACvCuB,SAASG,YAAYxC,kBAAkBe,UACzC;IACEsB,SAASI,WAAWzC,kBAAkBkB,aAAa;IAEnD,OAAO,KAAKpB,eAAe4C,QAAQL,QAAAA;GACvC;EACJ;EAEA,OAAO,KAAKvC,eAAe6C,OAAO;GAC9BpC,WAAWN,QAAQM;GACnBE,WAAWR,QAAQQ;GACnB+B,SAASxC,kBAAkBe;GAC3B0B,UAAUzC,kBAAkBkB;GAC5BqB,SAASvC,kBAAkBc;GAC3BF,KAAKZ,kBAAkBY;GACvBgC,YAAY5C,kBAAkB6C,eAAe;EACjD,CAAA;CACJ;AACJ"}

package/dist/core/oauth2/grant-types/client-credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-credentials.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/grant-types/client-credentials.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAE9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAK/C,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAE5D,qBAAa,sBAAuB,SAAQ,eAAe,CAAC,MAAM,CAAC;IACzD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,yBAA8B,GAAI,OAAO,CAAC,wBAAwB,CAAC;CA0B5G"}
+{"version":3,"file":"client-credentials.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/grant-types/client-credentials.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAE9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAM/C,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAE5D,qBAAa,sBAAuB,SAAQ,eAAe,CAAC,MAAM,CAAC;IACzD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,yBAA8B,GAAI,OAAO,CAAC,wBAAwB,CAAC;CA4B5G"}

package/dist/core/oauth2/grant-types/client-credentials.mjs

@@ -3,28 +3,30 @@ import "node:url";
 import.meta.url;
 import { OAuth2BaseGrant } from "./base.mjs";
 import { buildOAuth2BearerTokenResponse } from "../response/bearer.mjs";
-import { IdentityType, ScopeName } from "@authup/core-kit";
+import { IdentityType, ScopeName, SessionAuthMethod } from "@authup/core-kit";
 import { OAuth2SubKind } from "@authup/specs";
 //#region src/core/oauth2/grant-types/client-credentials.ts
 var ClientCredentialsGrant = class extends OAuth2BaseGrant {
 	async runWith(input, options = {}) {
 		const session = await this.sessionManager.create({
-			user_agent: options.userAgent,
-			ip_address: options.ipAddress,
-			realm_id: input.realm_id,
+			userAgent: options.userAgent,
+			ipAddress: options.ipAddress,
+			realmId: input.realmId,
 			sub: input.id,
-			sub_kind: IdentityType.CLIENT
+			subKind: IdentityType.CLIENT,
+			authMethod: SessionAuthMethod.CLIENT
 		});
 		const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({
-			user_agent: session.user_agent,
-			remote_address: session.ip_address,
+			user_agent: session.userAgent,
+			remote_address: session.ipAddress,
 			session_id: session.id,
 			scope: ScopeName.GLOBAL,
 			sub: input.id,
 			sub_kind: OAuth2SubKind.CLIENT,
 			realm_id: input.realm.id,
 			realm_name: input.realm.name,
-			client_id: input.id
+			client_id: input.id,
+			...options.confirmation ? { cnf: options.confirmation } : {}
 		});
 		return buildOAuth2BearerTokenResponse({
 			accessToken,

package/dist/core/oauth2/grant-types/client-credentials.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"client-credentials.mjs","names":["OAuth2SubKind","IdentityType","ScopeName","OAuth2BaseGrant","buildOAuth2BearerTokenResponse","ClientCredentialsGrant","runWith","input","options","session","sessionManager","create","user_agent","userAgent","ip_address","ipAddress","realm_id","sub","id","sub_kind","CLIENT","accessToken","accessTokenPayload","accessTokenIssuer","issue","remote_address","session_id","scope","GLOBAL","realm","realm_name","name","client_id"],"sources":["../../../../src/core/oauth2/grant-types/client-credentials.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2SubKind } from '@authup/specs';\nimport type { Client } from '@authup/core-kit';\nimport {\n    IdentityType,\n    ScopeName,\n} from '@authup/core-kit';\nimport { OAuth2BaseGrant } from './base.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { OAuth2GrantRunWIthOptions } from './types.ts';\n\nexport class ClientCredentialsGrant extends OAuth2BaseGrant<Client> {\n    async runWith(input: Client, options: OAuth2GrantRunWIthOptions = {}) : Promise<OAuth2TokenGrantResponse> {\n        const session = await this.sessionManager.create({\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: input.realm_id,\n            sub: input.id,\n            sub_kind: IdentityType.CLIENT,\n        });\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            session_id: session.id,\n            scope: ScopeName.GLOBAL,\n            sub: input.id,\n            sub_kind: OAuth2SubKind.CLIENT,\n            realm_id: input.realm.id,\n            realm_name: input.realm.name,\n            client_id: input.id,\n        });\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;;;;AAkBA,IAAaK,yBAAb,cAA4CF,gBAAAA;CACxC,MAAMG,QAAQC,OAAeC,UAAqC,CAAC,GAAuC;EACtG,MAAMC,UAAU,MAAM,KAAKC,eAAeC,OAAO;GAC7CC,YAAYJ,QAAQK;GACpBC,YAAYN,QAAQO;GACpBC,UAAUT,MAAMS;GAChBC,KAAKV,MAAMW;GACXC,UAAUlB,aAAamB;EAC3B,CAAA;EAEA,MAAM,CAACC,aAAaC,sBAAsB,MAAM,KAAKC,kBAAkBC,MAAM;GACzEZ,YAAYH,QAAQG;GACpBa,gBAAgBhB,QAAQK;GACxBY,YAAYjB,QAAQS;GACpBS,OAAOzB,UAAU0B;GACjBX,KAAKV,MAAMW;GACXC,UAAUnB,cAAcoB;GACxBJ,UAAUT,MAAMsB,MAAMX;GACtBY,YAAYvB,MAAMsB,MAAME;GACxBC,WAAWzB,MAAMW;EACrB,CAAA;EAEA,OAAOd,+BAA+B;GAClCiB;GACAC;EACJ,CAAA;CACJ;AACJ"}
+{"version":3,"file":"client-credentials.mjs","names":["OAuth2SubKind","IdentityType","ScopeName","SessionAuthMethod","OAuth2BaseGrant","buildOAuth2BearerTokenResponse","ClientCredentialsGrant","runWith","input","options","session","sessionManager","create","userAgent","ipAddress","realmId","sub","id","subKind","CLIENT","authMethod","accessToken","accessTokenPayload","accessTokenIssuer","issue","user_agent","remote_address","session_id","scope","GLOBAL","sub_kind","realm_id","realm","realm_name","name","client_id","confirmation","cnf"],"sources":["../../../../src/core/oauth2/grant-types/client-credentials.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2SubKind } from '@authup/specs';\nimport type { Client } from '@authup/core-kit';\nimport {\n    IdentityType,\n    ScopeName, \n    SessionAuthMethod,\n} from '@authup/core-kit';\nimport { OAuth2BaseGrant } from './base.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { OAuth2GrantRunWIthOptions } from './types.ts';\n\nexport class ClientCredentialsGrant extends OAuth2BaseGrant<Client> {\n    async runWith(input: Client, options: OAuth2GrantRunWIthOptions = {}) : Promise<OAuth2TokenGrantResponse> {\n        const session = await this.sessionManager.create({\n            userAgent: options.userAgent,\n            ipAddress: options.ipAddress,\n            realmId: input.realmId,\n            sub: input.id,\n            subKind: IdentityType.CLIENT,\n            authMethod: SessionAuthMethod.CLIENT,\n        });\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({\n            user_agent: session.userAgent,\n            remote_address: session.ipAddress,\n            session_id: session.id,\n            scope: ScopeName.GLOBAL,\n            sub: input.id,\n            sub_kind: OAuth2SubKind.CLIENT,\n            realm_id: input.realm.id,\n            realm_name: input.realm.name,\n            client_id: input.id,\n            ...(options.confirmation ? { cnf: options.confirmation } : {}),\n        });\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;;;;AAmBA,IAAaM,yBAAb,cAA4CF,gBAAAA;CACxC,MAAMG,QAAQC,OAAeC,UAAqC,CAAC,GAAuC;EACtG,MAAMC,UAAU,MAAM,KAAKC,eAAeC,OAAO;GAC7CC,WAAWJ,QAAQI;GACnBC,WAAWL,QAAQK;GACnBC,SAASP,MAAMO;GACfC,KAAKR,MAAMS;GACXC,SAASjB,aAAakB;GACtBC,YAAYjB,kBAAkBgB;EAClC,CAAA;EAEA,MAAM,CAACE,aAAaC,sBAAsB,MAAM,KAAKC,kBAAkBC,MAAM;GACzEC,YAAYf,QAAQG;GACpBa,gBAAgBhB,QAAQI;GACxBa,YAAYjB,QAAQO;GACpBW,OAAO1B,UAAU2B;GACjBb,KAAKR,MAAMS;GACXa,UAAU9B,cAAcmB;GACxBY,UAAUvB,MAAMwB,MAAMf;GACtBgB,YAAYzB,MAAMwB,MAAME;GACxBC,WAAW3B,MAAMS;GACjB,GAAIR,QAAQ2B,eAAe,EAAEC,KAAK5B,QAAQ2B,aAAa,IAAI,CAAC;EAChE,CAAA;EAEA,OAAO/B,+BAA+B;GAClCgB;GACAC;EACJ,CAAA;CACJ;AACJ"}

package/dist/core/oauth2/grant-types/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/grant-types/identity.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAsB,MAAM,eAAe,CAAC;AAClF,OAAO,KAAK,EAAE,QAAQ,EAAW,MAAM,kBAAkB,CAAC;AAE1D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C,OAAO,KAAK,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAExF,qBAAa,iBAAkB,SAAQ,eAAe,CAAC,QAAQ,CAAC;IAC5D,SAAS,CAAC,kBAAkB,EAAG,kBAAkB,CAAC;gBAEtC,GAAG,EAAE,0BAA0B;IASrC,OAAO,CACT,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,yBAA8B,GACxC,OAAO,CAAC,wBAAwB,CAAC;CAgCvC"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/grant-types/identity.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAsB,MAAM,eAAe,CAAC;AAClF,OAAO,KAAK,EAAE,QAAQ,EAAW,MAAM,kBAAkB,CAAC;AAE1D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAG5C,OAAO,KAAK,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAExF,qBAAa,iBAAkB,SAAQ,eAAe,CAAC,QAAQ,CAAC;IAC5D,SAAS,CAAC,kBAAkB,EAAG,kBAAkB,CAAC;gBAEtC,GAAG,EAAE,0BAA0B;IASrC,OAAO,CACT,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,yBAA8B,GACxC,OAAO,CAAC,wBAAwB,CAAC;CA0CvC"}

package/dist/core/oauth2/grant-types/identity.mjs

@@ -1,9 +1,10 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { deriveAmrAcr } from "../authorization/helpers.mjs";
 import { OAuth2BaseGrant } from "./base.mjs";
 import { buildOAuth2BearerTokenResponse } from "../response/bearer.mjs";
-import { ScopeName } from "@authup/core-kit";
+import { ScopeName, SessionAuthMethod } from "@authup/core-kit";
 //#region src/core/oauth2/grant-types/identity.ts
 var IdentityGrantType = class extends OAuth2BaseGrant {
 	refreshTokenIssuer;
@@ -16,22 +17,28 @@ var IdentityGrantType = class extends OAuth2BaseGrant {
 	}
 	async runWith(identity, options = {}) {
 		const session = {
-			user_agent: options.userAgent,
-			ip_address: options.ipAddress,
-			realm_id: identity.data.realm_id,
+			userAgent: options.userAgent,
+			ipAddress: options.ipAddress,
+			realmId: identity.data.realmId,
 			sub: identity.data.id,
-			sub_kind: identity.type
+			subKind: identity.type,
+			authMethod: SessionAuthMethod.EXTERNAL
 		};
 		const { id: sessionId } = await this.sessionManager.create(session);
+		const amrAcr = deriveAmrAcr({
+			authMethod: session.authMethod ?? null,
+			mfaAt: session.mfaAt ?? null
+		});
 		const issuePayload = {
 			session_id: sessionId,
-			user_agent: session.user_agent,
-			remote_address: session.ip_address,
+			user_agent: session.userAgent,
+			remote_address: session.ipAddress,
 			scope: ScopeName.GLOBAL,
-			realm_id: identity.data.realm_id,
+			realm_id: identity.data.realmId,
 			realm_name: identity.data.realm?.name,
 			sub: identity.data.id,
-			sub_kind: identity.type
+			sub_kind: identity.type,
+			...amrAcr
 		};
 		const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);
 		const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);

package/dist/core/oauth2/grant-types/identity.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"identity.mjs","names":["ScopeName","OAuth2BaseGrant","buildOAuth2BearerTokenResponse","IdentityGrantType","refreshTokenIssuer","ctx","accessTokenIssuer","sessionManager","runWith","identity","options","session","user_agent","userAgent","ip_address","ipAddress","realm_id","data","sub","id","sub_kind","type","sessionId","create","issuePayload","session_id","remote_address","scope","GLOBAL","realm_name","realm","name","accessToken","accessTokenPayload","issue","refreshToken","refreshTokenPayload"],"sources":["../../../../src/core/oauth2/grant-types/identity.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport type { Identity, Session } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport type { IOAuth2TokenIssuer } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { OAuth2GrantRunWIthOptions, OAuth2IdentityGrantContext } from './types.ts';\n\nexport class IdentityGrantType extends OAuth2BaseGrant<Identity> {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    constructor(ctx: OAuth2IdentityGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n    }\n\n    async runWith(\n        identity: Identity,\n        options: OAuth2GrantRunWIthOptions = {},\n    ): Promise<OAuth2TokenGrantResponse> {\n        const session : Partial<Session> = {\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: identity.data.realm_id,\n            sub: identity.data.id,\n            sub_kind: identity.type,\n        };\n\n        const { id: sessionId } = await this.sessionManager.create(session);\n\n        const issuePayload : Partial<OAuth2TokenPayload> = {\n            session_id: sessionId,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            scope: ScopeName.GLOBAL,\n            realm_id: identity.data.realm_id,\n            realm_name: identity.data.realm?.name,\n            sub: identity.data.id,\n            sub_kind: identity.type,\n        };\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;;;AAeA,IAAaG,oBAAb,cAAuCF,gBAAAA;CACzBG;CAEV,YAAYC,KAAiC;EACzC,MAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;EACxB,CAAA;EAEA,KAAKH,qBAAqBC,IAAID;CAClC;CAEA,MAAMI,QACFC,UACAC,UAAqC,CAAC,GACL;EACjC,MAAMC,UAA6B;GAC/BC,YAAYF,QAAQG;GACpBC,YAAYJ,QAAQK;GACpBC,UAAUP,SAASQ,KAAKD;GACxBE,KAAKT,SAASQ,KAAKE;GACnBC,UAAUX,SAASY;EACvB;EAEA,MAAM,EAAEF,IAAIG,cAAc,MAAM,KAAKf,eAAegB,OAAOZ,OAAAA;EAE3D,MAAMa,eAA6C;GAC/CC,YAAYH;GACZV,YAAYD,QAAQC;GACpBc,gBAAgBf,QAAQG;GACxBa,OAAO3B,UAAU4B;GACjBZ,UAAUP,SAASQ,KAAKD;GACxBa,YAAYpB,SAASQ,KAAKa,OAAOC;GACjCb,KAAKT,SAASQ,KAAKE;GACnBC,UAAUX,SAASY;EACvB;EAEA,MAAM,CAACW,aAAaC,sBAAsB,MAAM,KAAK3B,kBAAkB4B,MAAMV,YAAAA;EAC7E,MAAM,CAACW,cAAcC,uBAAuB,MAAM,KAAKhC,mBAAmB8B,MAAMV,YAAAA;EAEhF,OAAOtB,+BAA+B;GAClC8B;GACAC;GACAE;GACAC;EACJ,CAAA;CACJ;AACJ"}
+{"version":3,"file":"identity.mjs","names":["ScopeName","SessionAuthMethod","OAuth2BaseGrant","deriveAmrAcr","buildOAuth2BearerTokenResponse","IdentityGrantType","refreshTokenIssuer","ctx","accessTokenIssuer","sessionManager","runWith","identity","options","session","userAgent","ipAddress","realmId","data","sub","id","subKind","type","authMethod","EXTERNAL","sessionId","create","amrAcr","mfaAt","issuePayload","session_id","user_agent","remote_address","scope","GLOBAL","realm_id","realm_name","realm","name","sub_kind","accessToken","accessTokenPayload","issue","refreshToken","refreshTokenPayload"],"sources":["../../../../src/core/oauth2/grant-types/identity.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport type { Identity, Session } from '@authup/core-kit';\nimport { ScopeName, SessionAuthMethod } from '@authup/core-kit';\nimport type { IOAuth2TokenIssuer } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport { deriveAmrAcr } from '../authorization/helpers.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { OAuth2GrantRunWIthOptions, OAuth2IdentityGrantContext } from './types.ts';\n\nexport class IdentityGrantType extends OAuth2BaseGrant<Identity> {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    constructor(ctx: OAuth2IdentityGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n    }\n\n    async runWith(\n        identity: Identity,\n        options: OAuth2GrantRunWIthOptions = {},\n    ): Promise<OAuth2TokenGrantResponse> {\n        const session : Partial<Session> = {\n            userAgent: options.userAgent,\n            ipAddress: options.ipAddress,\n            realmId: identity.data.realmId,\n            sub: identity.data.id,\n            subKind: identity.type,\n            authMethod: SessionAuthMethod.EXTERNAL,\n        };\n\n        const { id: sessionId } = await this.sessionManager.create(session);\n\n        // amr/acr derive from the session's authMethod + mfaAt — deliberately\n        // on every token kind, so a direct identity grant's tokens advertise the\n        // (external) method the same way the authorization_code exchange does.\n        const amrAcr = deriveAmrAcr({\n            authMethod: session.authMethod ?? null,\n            mfaAt: session.mfaAt ?? null,\n        });\n\n        const issuePayload : Partial<OAuth2TokenPayload> = {\n            session_id: sessionId,\n            user_agent: session.userAgent,\n            remote_address: session.ipAddress,\n            scope: ScopeName.GLOBAL,\n            realm_id: identity.data.realmId,\n            realm_name: identity.data.realm?.name,\n            sub: identity.data.id,\n            sub_kind: identity.type,\n            ...amrAcr,\n        };\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;;;;AAgBA,IAAaK,oBAAb,cAAuCH,gBAAAA;CACzBI;CAEV,YAAYC,KAAiC;EACzC,MAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;EACxB,CAAA;EAEA,KAAKH,qBAAqBC,IAAID;CAClC;CAEA,MAAMI,QACFC,UACAC,UAAqC,CAAC,GACL;EACjC,MAAMC,UAA6B;GAC/BC,WAAWF,QAAQE;GACnBC,WAAWH,QAAQG;GACnBC,SAASL,SAASM,KAAKD;GACvBE,KAAKP,SAASM,KAAKE;GACnBC,SAAST,SAASU;GAClBC,YAAYrB,kBAAkBsB;EAClC;EAEA,MAAM,EAAEJ,IAAIK,cAAc,MAAM,KAAKf,eAAegB,OAAOZ,OAAAA;EAK3D,MAAMa,SAASvB,aAAa;GACxBmB,YAAYT,QAAQS,cAAc;GAClCK,OAAOd,QAAQc,SAAS;EAC5B,CAAA;EAEA,MAAMC,eAA6C;GAC/CC,YAAYL;GACZM,YAAYjB,QAAQC;GACpBiB,gBAAgBlB,QAAQE;GACxBiB,OAAOhC,UAAUiC;GACjBC,UAAUvB,SAASM,KAAKD;GACxBmB,YAAYxB,SAASM,KAAKmB,OAAOC;GACjCnB,KAAKP,SAASM,KAAKE;GACnBmB,UAAU3B,SAASU;GACnB,GAAGK;EACP;EAEA,MAAM,CAACa,aAAaC,sBAAsB,MAAM,KAAKhC,kBAAkBiC,MAAMb,YAAAA;EAC7E,MAAM,CAACc,cAAcC,uBAAuB,MAAM,KAAKrC,mBAAmBmC,MAAMb,YAAAA;EAEhF,OAAOxB,+BAA+B;GAClCmC;GACAC;GACAE;GACAC;EACJ,CAAA;CACJ;AACJ"}

package/dist/core/oauth2/grant-types/index.d.ts

@@ -3,6 +3,5 @@ export * from './client-credentials.ts';
 export * from './identity.ts';
 export * from './password.ts';
 export * from './refresh-token.ts';
-export * from './robot-credentials.ts';
 export * from './types.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/grant-types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/grant-types/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/grant-types/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,YAAY,CAAC"}

package/dist/core/oauth2/grant-types/index.mjs

@@ -6,5 +6,4 @@ import { ClientCredentialsGrant } from "./client-credentials.mjs";
 import { IdentityGrantType } from "./identity.mjs";
 import { PasswordGrantType } from "./password.mjs";
 import { OAuth2RefreshTokenGrant } from "./refresh-token.mjs";
-import { RobotCredentialsGrant } from "./robot-credentials.mjs";
-export { ClientCredentialsGrant, IdentityGrantType, OAuth2AuthorizeGrant, OAuth2RefreshTokenGrant, PasswordGrantType, RobotCredentialsGrant };
+export { ClientCredentialsGrant, IdentityGrantType, OAuth2AuthorizeGrant, OAuth2RefreshTokenGrant, PasswordGrantType };

package/dist/core/oauth2/grant-types/password.d.ts

@@ -1,14 +1,23 @@
 import type { OAuth2TokenGrantResponse } from '@authup/specs';
 import type { Client, User } from '@authup/core-kit';
+import type { IEventService } from '../../entities/index.ts';
+import type { IAuthFlowMetrics } from '../../metrics/index.ts';
 import type { IOAuth2TokenIssuer } from '../token/index.ts';
 import { OAuth2BaseGrant } from './base.ts';
 import type { OAuth2GrantRunWIthOptions, OAuth2PasswordGrantContext } from './types.ts';
 export type OAuth2PasswordGrantInput = {
     user: User;
     client?: Client;
+    /**
+     * Instant the user passed a second-factor challenge alongside the
+     * grant (the `otp` parameter) — stamped onto the session as mfaAt.
+     */
+    mfaVerifiedAt?: string;
 };
 export declare class PasswordGrantType extends OAuth2BaseGrant<OAuth2PasswordGrantInput> {
     protected refreshTokenIssuer: IOAuth2TokenIssuer;
+    protected eventService?: IEventService;
+    protected metrics?: IAuthFlowMetrics;
     constructor(ctx: OAuth2PasswordGrantContext);
     runWith(input: OAuth2PasswordGrantInput, options?: OAuth2GrantRunWIthOptions): Promise<OAuth2TokenGrantResponse>;
 }

package/dist/core/oauth2/grant-types/password.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/grant-types/password.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAsB,MAAM,eAAe,CAAC;AAElF,OAAO,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAMrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAExF,MAAM,MAAM,wBAAwB,GAAG;IACnC,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,qBAAa,iBAAkB,SAAQ,eAAe,CAAC,wBAAwB,CAAC;IAC5E,SAAS,CAAC,kBAAkB,EAAG,kBAAkB,CAAC;gBAEtC,GAAG,EAAE,0BAA0B;IASrC,OAAO,CAAC,KAAK,EAAE,wBAAwB,EAAE,OAAO,GAAE,yBAA8B,GAAI,OAAO,CAAC,wBAAwB,CAAC;CAmC9H"}
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/grant-types/password.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAsB,MAAM,eAAe,CAAC;AAElF,OAAO,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AASrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG/D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAExF,MAAM,MAAM,wBAAwB,GAAG;IACnC,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,qBAAa,iBAAkB,SAAQ,eAAe,CAAC,wBAAwB,CAAC;IAC5E,SAAS,CAAC,kBAAkB,EAAG,kBAAkB,CAAC;IAElD,SAAS,CAAC,YAAY,CAAC,EAAG,aAAa,CAAC;IAExC,SAAS,CAAC,OAAO,CAAC,EAAG,gBAAgB,CAAC;gBAE1B,GAAG,EAAE,0BAA0B;IAWrC,OAAO,CAAC,KAAK,EAAE,wBAAwB,EAAE,OAAO,GAAE,yBAA8B,GAAI,OAAO,CAAC,wBAAwB,CAAC;CA+D9H"}

package/dist/core/oauth2/grant-types/password.mjs

@@ -1,44 +1,72 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { deriveAmrAcr } from "../authorization/helpers.mjs";
 import { OAuth2BaseGrant } from "./base.mjs";
 import { buildOAuth2BearerTokenResponse } from "../response/bearer.mjs";
-import { IdentityType, ScopeName } from "@authup/core-kit";
-import { OAuth2SubKind } from "@authup/specs";
+import { EventName, EventRefType, EventScope, IdentityType, ScopeName, SessionAuthMethod } from "@authup/core-kit";
+import { OAuth2SubKind, OAuth2TokenGrant } from "@authup/specs";
 //#region src/core/oauth2/grant-types/password.ts
 var PasswordGrantType = class extends OAuth2BaseGrant {
 	refreshTokenIssuer;
+	eventService;
+	metrics;
 	constructor(ctx) {
 		super({
 			accessTokenIssuer: ctx.accessTokenIssuer,
 			sessionManager: ctx.sessionManager
 		});
 		this.refreshTokenIssuer = ctx.refreshTokenIssuer;
+		this.eventService = ctx.eventService;
+		this.metrics = ctx.metrics;
 	}
 	async runWith(input, options = {}) {
 		const { user, client } = input;
 		const clientId = client?.id;
 		const session = await this.sessionManager.create({
-			user_agent: options.userAgent,
-			ip_address: options.ipAddress,
-			realm_id: user.realm_id,
-			client_id: clientId,
+			userAgent: options.userAgent,
+			ipAddress: options.ipAddress,
+			realmId: user.realmId,
+			clientId,
 			sub: user.id,
-			sub_kind: IdentityType.USER
+			subKind: IdentityType.USER,
+			mfaAt: input.mfaVerifiedAt ?? null,
+			authMethod: SessionAuthMethod.PASSWORD
 		});
+		const amrAcr = deriveAmrAcr(session);
 		const issuePayload = {
 			client_id: clientId,
 			session_id: session.id,
-			user_agent: session.user_agent,
-			remote_address: session.ip_address,
+			user_agent: session.userAgent,
+			remote_address: session.ipAddress,
 			scope: ScopeName.GLOBAL,
 			sub: user.id,
 			sub_kind: OAuth2SubKind.USER,
-			realm_id: user.realm_id,
-			realm_name: user.realm?.name
+			realm_id: user.realmId,
+			realm_name: user.realm?.name,
+			...options.confirmation ? { cnf: options.confirmation } : {},
+			...amrAcr
 		};
 		const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);
 		const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);
+		await this.eventService?.record({
+			scope: EventScope.OAUTH2,
+			name: EventName.LOGIN,
+			refType: EventRefType.SESSION,
+			refId: session.id,
+			clientId: clientId ?? null,
+			actorType: IdentityType.USER,
+			actorId: user.id,
+			actorName: user.name,
+			realmId: user.realmId,
+			requestIpAddress: options.ipAddress ?? null,
+			requestUserAgent: options.userAgent ?? null,
+			data: {
+				grantType: OAuth2TokenGrant.PASSWORD,
+				sessionId: session.id
+			}
+		});
+		this.metrics?.recordLogin("success");
 		return buildOAuth2BearerTokenResponse({
 			accessToken,
 			accessTokenPayload,

package/dist/core/oauth2/grant-types/password.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"password.mjs","names":["OAuth2SubKind","IdentityType","ScopeName","buildOAuth2BearerTokenResponse","OAuth2BaseGrant","PasswordGrantType","refreshTokenIssuer","ctx","accessTokenIssuer","sessionManager","runWith","input","options","user","client","clientId","id","session","create","user_agent","userAgent","ip_address","ipAddress","realm_id","client_id","sub","sub_kind","USER","issuePayload","session_id","remote_address","scope","GLOBAL","realm_name","realm","name","accessToken","accessTokenPayload","issue","refreshToken","refreshTokenPayload"],"sources":["../../../../src/core/oauth2/grant-types/password.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2SubKind } from '@authup/specs';\nimport type { Client, User } from '@authup/core-kit';\nimport {\n    IdentityType,\n    ScopeName,\n} from '@authup/core-kit';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { IOAuth2TokenIssuer } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport type { OAuth2GrantRunWIthOptions, OAuth2PasswordGrantContext } from './types.ts';\n\nexport type OAuth2PasswordGrantInput = {\n    user: User,\n    client?: Client,\n};\n\nexport class PasswordGrantType extends OAuth2BaseGrant<OAuth2PasswordGrantInput> {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    constructor(ctx: OAuth2PasswordGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n    }\n\n    async runWith(input: OAuth2PasswordGrantInput, options: OAuth2GrantRunWIthOptions = {}) : Promise<OAuth2TokenGrantResponse> {\n        const { user, client } = input;\n        const clientId = client?.id;\n\n        const session = await this.sessionManager.create({\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: user.realm_id,\n            client_id: clientId,\n            sub: user.id,\n            sub_kind: IdentityType.USER,\n        });\n\n        const issuePayload : Partial<OAuth2TokenPayload> = {\n            client_id: clientId,\n            session_id: session.id,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            scope: ScopeName.GLOBAL,\n            sub: user.id,\n            sub_kind: OAuth2SubKind.USER,\n            realm_id: user.realm_id,\n            realm_name: user.realm?.name,\n        };\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;;;;AAwBA,IAAaK,oBAAb,cAAuCD,gBAAAA;CACzBE;CAEV,YAAYC,KAAiC;EACzC,MAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;EACxB,CAAA;EAEA,KAAKH,qBAAqBC,IAAID;CAClC;CAEA,MAAMI,QAAQC,OAAiCC,UAAqC,CAAC,GAAuC;EACxH,MAAM,EAAEC,MAAMC,WAAWH;EACzB,MAAMI,WAAWD,QAAQE;EAEzB,MAAMC,UAAU,MAAM,KAAKR,eAAeS,OAAO;GAC7CC,YAAYP,QAAQQ;GACpBC,YAAYT,QAAQU;GACpBC,UAAUV,KAAKU;GACfC,WAAWT;GACXU,KAAKZ,KAAKG;GACVU,UAAUzB,aAAa0B;EAC3B,CAAA;EAEA,MAAMC,eAA6C;GAC/CJ,WAAWT;GACXc,YAAYZ,QAAQD;GACpBG,YAAYF,QAAQE;GACpBW,gBAAgBb,QAAQI;GACxBU,OAAO7B,UAAU8B;GACjBP,KAAKZ,KAAKG;GACVU,UAAU1B,cAAc2B;GACxBJ,UAAUV,KAAKU;GACfU,YAAYpB,KAAKqB,OAAOC;EAC5B;EAEA,MAAM,CAACC,aAAaC,sBAAsB,MAAM,KAAK7B,kBAAkB8B,MAAMV,YAAAA;EAC7E,MAAM,CAACW,cAAcC,uBAAuB,MAAM,KAAKlC,mBAAmBgC,MAAMV,YAAAA;EAEhF,OAAOzB,+BAA+B;GAClCiC;GACAC;GACAE;GACAC;EACJ,CAAA;CACJ;AACJ"}
+{"version":3,"file":"password.mjs","names":["OAuth2SubKind","OAuth2TokenGrant","EventName","EventRefType","EventScope","IdentityType","ScopeName","SessionAuthMethod","deriveAmrAcr","buildOAuth2BearerTokenResponse","OAuth2BaseGrant","PasswordGrantType","refreshTokenIssuer","eventService","metrics","ctx","accessTokenIssuer","sessionManager","runWith","input","options","user","client","clientId","id","session","create","userAgent","ipAddress","realmId","sub","subKind","USER","mfaAt","mfaVerifiedAt","authMethod","PASSWORD","amrAcr","issuePayload","client_id","session_id","user_agent","remote_address","scope","GLOBAL","sub_kind","realm_id","realm_name","realm","name","confirmation","cnf","accessToken","accessTokenPayload","issue","refreshToken","refreshTokenPayload","record","OAUTH2","LOGIN","refType","SESSION","refId","actorType","actorId","actorName","requestIpAddress","requestUserAgent","data","grantType","sessionId","recordLogin"],"sources":["../../../../src/core/oauth2/grant-types/password.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2SubKind, OAuth2TokenGrant } from '@authup/specs';\nimport type { Client, User } from '@authup/core-kit';\nimport {\n    EventName,\n    EventRefType,\n    EventScope,\n    IdentityType,\n    ScopeName,\n    SessionAuthMethod,\n} from '@authup/core-kit';\nimport type { IEventService } from '../../entities/index.ts';\nimport type { IAuthFlowMetrics } from '../../metrics/index.ts';\nimport { deriveAmrAcr } from '../authorization/helpers.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { IOAuth2TokenIssuer } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport type { OAuth2GrantRunWIthOptions, OAuth2PasswordGrantContext } from './types.ts';\n\nexport type OAuth2PasswordGrantInput = {\n    user: User,\n    client?: Client,\n    /**\n     * Instant the user passed a second-factor challenge alongside the\n     * grant (the `otp` parameter) — stamped onto the session as mfaAt.\n     */\n    mfaVerifiedAt?: string,\n};\n\nexport class PasswordGrantType extends OAuth2BaseGrant<OAuth2PasswordGrantInput> {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    protected eventService? : IEventService;\n\n    protected metrics? : IAuthFlowMetrics;\n\n    constructor(ctx: OAuth2PasswordGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n        this.eventService = ctx.eventService;\n        this.metrics = ctx.metrics;\n    }\n\n    async runWith(input: OAuth2PasswordGrantInput, options: OAuth2GrantRunWIthOptions = {}) : Promise<OAuth2TokenGrantResponse> {\n        const { user, client } = input;\n        const clientId = client?.id;\n\n        const session = await this.sessionManager.create({\n            userAgent: options.userAgent,\n            ipAddress: options.ipAddress,\n            realmId: user.realmId,\n            clientId,\n            sub: user.id,\n            subKind: IdentityType.USER,\n            mfaAt: input.mfaVerifiedAt ?? null,\n            authMethod: SessionAuthMethod.PASSWORD,\n        });\n\n        // amr/acr derive from the session's authMethod + mfaAt — deliberately\n        // on every token kind, so a direct password grant's tokens advertise the\n        // method the same way the authorization_code exchange does.\n        const amrAcr = deriveAmrAcr(session);\n\n        const issuePayload : Partial<OAuth2TokenPayload> = {\n            client_id: clientId,\n            session_id: session.id,\n            user_agent: session.userAgent,\n            remote_address: session.ipAddress,\n            scope: ScopeName.GLOBAL,\n            sub: user.id,\n            sub_kind: OAuth2SubKind.USER,\n            realm_id: user.realmId,\n            realm_name: user.realm?.name,\n            ...(options.confirmation ? { cnf: options.confirmation } : {}),\n            ...amrAcr,\n        };\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);\n\n        await this.eventService?.record({\n            scope: EventScope.OAUTH2,\n            name: EventName.LOGIN,\n            refType: EventRefType.SESSION,\n            refId: session.id,\n            clientId: clientId ?? null,\n            actorType: IdentityType.USER,\n            actorId: user.id,\n            actorName: user.name,\n            realmId: user.realmId,\n            requestIpAddress: options.ipAddress ?? null,\n            requestUserAgent: options.userAgent ?? null,\n            data: {\n                grantType: OAuth2TokenGrant.PASSWORD,\n                sessionId: session.id,\n            },\n        });\n        this.metrics?.recordLogin('success');\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;AAoCA,IAAaW,oBAAb,cAAuCD,gBAAAA;CACzBE;CAEAC;CAEAC;CAEV,YAAYC,KAAiC;EACzC,MAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;EACxB,CAAA;EAEA,KAAKL,qBAAqBG,IAAIH;EAC9B,KAAKC,eAAeE,IAAIF;EACxB,KAAKC,UAAUC,IAAID;CACvB;CAEA,MAAMI,QAAQC,OAAiCC,UAAqC,CAAC,GAAuC;EACxH,MAAM,EAAEC,MAAMC,WAAWH;EACzB,MAAMI,WAAWD,QAAQE;EAEzB,MAAMC,UAAU,MAAM,KAAKR,eAAeS,OAAO;GAC7CC,WAAWP,QAAQO;GACnBC,WAAWR,QAAQQ;GACnBC,SAASR,KAAKQ;GACdN;GACAO,KAAKT,KAAKG;GACVO,SAAS1B,aAAa2B;GACtBC,OAAOd,MAAMe,iBAAiB;GAC9BC,YAAY5B,kBAAkB6B;EAClC,CAAA;EAKA,MAAMC,SAAS7B,aAAaiB,OAAAA;EAE5B,MAAMa,eAA6C;GAC/CC,WAAWhB;GACXiB,YAAYf,QAAQD;GACpBiB,YAAYhB,QAAQE;GACpBe,gBAAgBjB,QAAQG;GACxBe,OAAOrC,UAAUsC;GACjBd,KAAKT,KAAKG;GACVqB,UAAU7C,cAAcgC;GACxBc,UAAUzB,KAAKQ;GACfkB,YAAY1B,KAAK2B,OAAOC;GACxB,GAAI7B,QAAQ8B,eAAe,EAAEC,KAAK/B,QAAQ8B,aAAa,IAAI,CAAC;GAC5D,GAAGb;EACP;EAEA,MAAM,CAACe,aAAaC,sBAAsB,MAAM,KAAKrC,kBAAkBsC,MAAMhB,YAAAA;EAC7E,MAAM,CAACiB,cAAcC,uBAAuB,MAAM,KAAK5C,mBAAmB0C,MAAMhB,YAAAA;EAEhF,MAAM,KAAKzB,cAAc4C,OAAO;GAC5Bd,OAAOvC,WAAWsD;GAClBT,MAAM/C,UAAUyD;GAChBC,SAASzD,aAAa0D;GACtBC,OAAOrC,QAAQD;GACfD,UAAUA,YAAY;GACtBwC,WAAW1D,aAAa2B;GACxBgC,SAAS3C,KAAKG;GACdyC,WAAW5C,KAAK4B;GAChBpB,SAASR,KAAKQ;GACdqC,kBAAkB9C,QAAQQ,aAAa;GACvCuC,kBAAkB/C,QAAQO,aAAa;GACvCyC,MAAM;IACFC,WAAWpE,iBAAiBmC;IAC5BkC,WAAW7C,QAAQD;GACvB;EACJ,CAAA;EACA,KAAKV,SAASyD,YAAY,SAAA;EAE1B,OAAO9D,+BAA+B;GAClC2C;GACAC;GACAE;GACAC;EACJ,CAAA;CACJ;AACJ"}

package/dist/core/oauth2/grant-types/refresh-token.d.ts

@@ -1,5 +1,7 @@
 import type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';
 import type { Logger } from '@authup/server-kit';
+import type { IEventService } from '../../entities/index.ts';
+import type { IAuthFlowMetrics } from '../../metrics/index.ts';
 import type { ISessionTokenRepository } from '../session-token/index.ts';
 import type { IOAuth2TokenIssuer, IOAuth2TokenRepository, IOAuth2TokenVerifier } from '../token/index.ts';
 import { OAuth2BaseGrant } from './base.ts';
@@ -9,6 +11,8 @@ export declare class OAuth2RefreshTokenGrant extends OAuth2BaseGrant<string | OA
     protected tokenVerifier: IOAuth2TokenVerifier;
     protected tokenRepository: IOAuth2TokenRepository;
     protected sessionTokenRepository: ISessionTokenRepository;
+    protected eventService?: IEventService;
+    protected metrics?: IAuthFlowMetrics;
     protected logger?: Logger;
     protected gracePeriod: number;
     constructor(ctx: OAuth2RefreshTokenGrantContext);

package/dist/core/oauth2/grant-types/refresh-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refresh-token.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/grant-types/refresh-token.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAElF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC1G,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,YAAY,EAAE,yBAAyB,EAAE,8BAA8B,EAAE,MAAM,YAAY,CAAC;AAE1G,qBAAa,uBAAwB,SAAQ,eAAe,CAAC,MAAM,GAAG,kBAAkB,CAAE,YAAW,YAAY;IAC7G,SAAS,CAAC,kBAAkB,EAAG,kBAAkB,CAAC;IAElD,SAAS,CAAC,aAAa,EAAG,oBAAoB,CAAC;IAE/C,SAAS,CAAC,eAAe,EAAG,sBAAsB,CAAC;IAEnD,SAAS,CAAC,sBAAsB,EAAG,uBAAuB,CAAC;IAE3D,SAAS,CAAC,MAAM,CAAC,EAAG,MAAM,CAAC;IAE3B,SAAS,CAAC,WAAW,EAAG,MAAM,CAAC;gBAEnB,GAAG,EAAE,8BAA8B;IAczC,OAAO,CACT,KAAK,EAAE,MAAM,GAAG,kBAAkB,EAClC,OAAO,GAAE,yBAA8B,GACvC,OAAO,CAAC,wBAAwB,CAAC;IA4FrC;;;;;OAKG;cACa,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAI,OAAO,CAAC,OAAO,CAAC;IAqB9E;;;;;OAKG;cACa,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAI,OAAO,CAAC,IAAI,CAAC;CAmB3F"}
+{"version":3,"file":"refresh-token.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/grant-types/refresh-token.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAGlF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC1G,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,YAAY,EAAE,yBAAyB,EAAE,8BAA8B,EAAE,MAAM,YAAY,CAAC;AAE1G,qBAAa,uBAAwB,SAAQ,eAAe,CAAC,MAAM,GAAG,kBAAkB,CAAE,YAAW,YAAY;IAC7G,SAAS,CAAC,kBAAkB,EAAG,kBAAkB,CAAC;IAElD,SAAS,CAAC,aAAa,EAAG,oBAAoB,CAAC;IAE/C,SAAS,CAAC,eAAe,EAAG,sBAAsB,CAAC;IAEnD,SAAS,CAAC,sBAAsB,EAAG,uBAAuB,CAAC;IAE3D,SAAS,CAAC,YAAY,CAAC,EAAG,aAAa,CAAC;IAExC,SAAS,CAAC,OAAO,CAAC,EAAG,gBAAgB,CAAC;IAEtC,SAAS,CAAC,MAAM,CAAC,EAAG,MAAM,CAAC;IAE3B,SAAS,CAAC,WAAW,EAAG,MAAM,CAAC;gBAEnB,GAAG,EAAE,8BAA8B;IAgBzC,OAAO,CACT,KAAK,EAAE,MAAM,GAAG,kBAAkB,EAClC,OAAO,GAAE,yBAA8B,GACvC,OAAO,CAAC,wBAAwB,CAAC;IAuGrC;;;;;OAKG;cACa,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAI,OAAO,CAAC,OAAO,CAAC;IAqB9E;;;;;OAKG;cACa,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAI,OAAO,CAAC,IAAI,CAAC;CA4B3F"}

package/dist/core/oauth2/grant-types/refresh-token.mjs

@@ -3,13 +3,16 @@ import "node:url";
 import.meta.url;
 import { OAuth2BaseGrant } from "./base.mjs";
 import { buildOAuth2BearerTokenResponse } from "../response/bearer.mjs";
-import { JWTError, OAuth2GrantError } from "@authup/specs";
+import { EventName, EventRefType, EventScope } from "@authup/core-kit";
+import { JWTError, OAuth2GrantError, OAuth2TokenKind } from "@authup/specs";
 //#region src/core/oauth2/grant-types/refresh-token.ts
 var OAuth2RefreshTokenGrant = class extends OAuth2BaseGrant {
 	refreshTokenIssuer;
 	tokenVerifier;
 	tokenRepository;
 	sessionTokenRepository;
+	eventService;
+	metrics;
 	logger;
 	gracePeriod;
 	constructor(ctx) {
@@ -21,6 +24,8 @@ var OAuth2RefreshTokenGrant = class extends OAuth2BaseGrant {
 		this.tokenVerifier = ctx.tokenVerifier;
 		this.tokenRepository = ctx.tokenRepository;
 		this.sessionTokenRepository = ctx.sessionTokenRepository;
+		this.eventService = ctx.eventService;
+		this.metrics = ctx.metrics;
 		this.logger = ctx.logger;
 		this.gracePeriod = ctx.options?.gracePeriod ?? 0;
 	}
@@ -30,15 +35,16 @@ var OAuth2RefreshTokenGrant = class extends OAuth2BaseGrant {
 		else payload = input;
 		if (!payload.jti) throw JWTError.payloadPropertyInvalid("jti");
 		if (!payload.session_id) throw JWTError.payloadPropertyInvalid("session_id");
+		if (payload.kind && payload.kind !== OAuth2TokenKind.REFRESH) throw OAuth2GrantError.invalid("unexpected token kind");
 		const row = await this.sessionTokenRepository.findOneById(payload.jti);
 		if (!row || row.kind !== "refresh") throw OAuth2GrantError.invalid("refresh token is unknown");
-		if (row.revoked_at) throw OAuth2GrantError.invalid("refresh token has been revoked");
-		if (row.session_id !== payload.session_id) throw OAuth2GrantError.invalid("refresh token session mismatch");
+		if (row.revokedAt) throw OAuth2GrantError.invalid("refresh token has been revoked");
+		if (row.sessionId !== payload.session_id) throw OAuth2GrantError.invalid("refresh token session mismatch");
 		const now = /* @__PURE__ */ new Date();
 		const nowISO = now.toISOString();
 		if (!await this.sessionTokenRepository.markRefreshConsumed(payload.jti, nowISO)) {
 			if (!await this.isWithinGraceWindow(payload.jti, now)) {
-				await this.revokeFamily(row.session_id, payload.jti, nowISO);
+				await this.revokeFamily(row.sessionId, payload.jti, nowISO);
 				throw OAuth2GrantError.invalid("refresh token replay detected; session revoked");
 			}
 		}
@@ -46,20 +52,22 @@ var OAuth2RefreshTokenGrant = class extends OAuth2BaseGrant {
 		const session = await this.sessionManager.findOneById(payload.session_id);
 		if (!session) throw JWTError.payloadPropertyInvalid("session_id");
 		await this.sessionManager.verify(session);
-		if (options.userAgent) session.user_agent = options.userAgent;
-		if (options.ipAddress) session.ip_address = options.ipAddress;
+		if (options.userAgent) session.userAgent = options.userAgent;
+		if (options.ipAddress) session.ipAddress = options.ipAddress;
 		await this.sessionManager.refresh(session);
 		const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue({
 			...payload,
-			user_agent: session.user_agent,
-			remote_address: session.ip_address,
+			...options.confirmation ? { cnf: options.confirmation } : {},
+			user_agent: session.userAgent,
+			remote_address: session.ipAddress,
 			exp: this.refreshTokenIssuer.buildExp(),
 			parent_id: payload.jti
 		});
 		const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({
 			...payload,
-			user_agent: session.user_agent,
-			remote_address: session.ip_address,
+			...options.confirmation ? { cnf: options.confirmation } : {},
+			user_agent: session.userAgent,
+			remote_address: session.ipAddress,
 			exp: this.accessTokenIssuer.buildExp(),
 			refresh_token_id: refreshTokenPayload.jti
 		});
@@ -78,7 +86,7 @@ var OAuth2RefreshTokenGrant = class extends OAuth2BaseGrant {
 	*/ async isWithinGraceWindow(jti, now) {
 		if (this.gracePeriod <= 0) return false;
 		const current = await this.sessionTokenRepository.findOneById(jti);
-		if (!current || current.revoked_at !== null || current.consumed_at === null || now.getTime() - new Date(current.consumed_at).getTime() > this.gracePeriod * 1e3) return false;
+		if (!current || current.revokedAt !== null || current.consumedAt === null || now.getTime() - new Date(current.consumedAt).getTime() > this.gracePeriod * 1e3) return false;
 		return !await this.sessionTokenRepository.hasConsumedChild(jti);
 	}
 	/**
@@ -88,11 +96,19 @@ var OAuth2RefreshTokenGrant = class extends OAuth2BaseGrant {
 	* tokens stop verifying on authup's own API.
 	*/ async revokeFamily(sessionId, jti, at) {
 		this.logger?.warn("OAuth2 refresh token replay detected; revoking session", {
-			session_id: sessionId,
+			sessionId,
 			jti
 		});
+		await this.eventService?.record({
+			scope: EventScope.OAUTH2,
+			name: EventName.REFRESH_REPLAY_DETECTED,
+			refType: EventRefType.SESSION,
+			refId: sessionId,
+			data: { jti }
+		});
+		this.metrics?.recordRefreshReplay();
 		const rows = await this.sessionTokenRepository.revokeBySessionId(sessionId, at);
-		await Promise.allSettled(rows.map((row) => this.tokenRepository.setInactive(row.id, Math.floor(new Date(row.expires_at).getTime() / 1e3))));
+		await Promise.allSettled(rows.map((row) => this.tokenRepository.setInactive(row.id, Math.floor(new Date(row.expiresAt).getTime() / 1e3))));
 		await this.sessionManager.revoke(sessionId);
 	}
 };