@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.54

package/dist/core/oauth2/grant-types/refresh-token.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"refresh-token.mjs","names":["JWTError","OAuth2GrantError","buildOAuth2BearerTokenResponse","OAuth2BaseGrant","OAuth2RefreshTokenGrant","refreshTokenIssuer","tokenVerifier","tokenRepository","sessionTokenRepository","logger","gracePeriod","ctx","accessTokenIssuer","sessionManager","options","runWith","input","payload","verify","skipActiveCheck","jti","payloadPropertyInvalid","session_id","row","findOneById","kind","invalid","revoked_at","now","Date","nowISO","toISOString","consumed","markRefreshConsumed","withinGrace","isWithinGraceWindow","revokeFamily","setInactive","exp","session","userAgent","user_agent","ipAddress","ip_address","refresh","refreshToken","refreshTokenPayload","issue","remote_address","buildExp","parent_id","accessToken","accessTokenPayload","refresh_token_id","current","consumed_at","getTime","chainAdvanced","hasConsumedChild","sessionId","at","warn","rows","revokeBySessionId","Promise","allSettled","map","id","Math","floor","expires_at","revoke"],"sources":["../../../../src/core/oauth2/grant-types/refresh-token.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { JWTError, OAuth2GrantError } from '@authup/specs';\nimport type { Logger } from '@authup/server-kit';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { ISessionTokenRepository } from '../session-token/index.ts';\nimport type { IOAuth2TokenIssuer, IOAuth2TokenRepository, IOAuth2TokenVerifier } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport type { IOAuth2Grant, OAuth2GrantRunWIthOptions, OAuth2RefreshTokenGrantContext } from './types.ts';\n\nexport class OAuth2RefreshTokenGrant extends OAuth2BaseGrant<string | OAuth2TokenPayload> implements IOAuth2Grant {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    protected tokenVerifier : IOAuth2TokenVerifier;\n\n    protected tokenRepository : IOAuth2TokenRepository;\n\n    protected sessionTokenRepository : ISessionTokenRepository;\n\n    protected logger? : Logger;\n\n    protected gracePeriod : number;\n\n    constructor(ctx: OAuth2RefreshTokenGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n        this.tokenVerifier = ctx.tokenVerifier;\n        this.tokenRepository = ctx.tokenRepository;\n        this.sessionTokenRepository = ctx.sessionTokenRepository;\n        this.logger = ctx.logger;\n        this.gracePeriod = ctx.options?.gracePeriod ?? 0;\n    }\n\n    async runWith(\n        input: string | OAuth2TokenPayload,\n        options: OAuth2GrantRunWIthOptions = {},\n    ) : Promise<OAuth2TokenGrantResponse> {\n        let payload : OAuth2TokenPayload;\n        if (typeof input === 'string') {\n            // The auth_session_tokens row — not the cache blocklist — is the\n            // authority for refresh-token validity, so skip the active check.\n            payload = await this.tokenVerifier.verify(input, { skipActiveCheck: true });\n        } else {\n            payload = input;\n        }\n\n        if (!payload.jti) {\n            throw JWTError.payloadPropertyInvalid('jti');\n        }\n        if (!payload.session_id) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        const row = await this.sessionTokenRepository.findOneById(payload.jti);\n        if (!row || row.kind !== 'refresh') {\n            // Row missing = expired-and-swept or a pre-rotation legacy token\n            // (hard cutover). Either way the client must re-authenticate.\n            throw OAuth2GrantError.invalid('refresh token is unknown');\n        }\n        if (row.revoked_at) {\n            throw OAuth2GrantError.invalid('refresh token has been revoked');\n        }\n        if (row.session_id !== payload.session_id) {\n            // The row is written with the token's own session_id and jti is\n            // globally unique, so a mismatch means corruption / jti reuse — fail\n            // closed rather than refresh or revoke against the wrong session.\n            throw OAuth2GrantError.invalid('refresh token session mismatch');\n        }\n\n        const now = new Date();\n        const nowISO = now.toISOString();\n\n        const consumed = await this.sessionTokenRepository.markRefreshConsumed(payload.jti, nowISO);\n        if (!consumed) {\n            // Lost the atomic consume — either a replay of an already-rotated\n            // token, or a benign concurrent-refresh race the grace window\n            // absorbs.\n            const withinGrace = await this.isWithinGraceWindow(payload.jti, now);\n            if (!withinGrace) {\n                await this.revokeFamily(row.session_id, payload.jti, nowISO);\n                throw OAuth2GrantError.invalid('refresh token replay detected; session revoked');\n            }\n        }\n\n        // Blocklist the presented refresh token in the cache so introspection\n        // reports it inactive. Deliberately NOT a DB revoke — that would set\n        // revoked_at and break the grace window.\n        await this.tokenRepository.setInactive(payload.jti, payload.exp);\n\n        const session = await this.sessionManager.findOneById(payload.session_id);\n        if (!session) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        await this.sessionManager.verify(session);\n\n        if (options.userAgent) {\n            session.user_agent = options.userAgent;\n        }\n        if (options.ipAddress) {\n            session.ip_address = options.ipAddress;\n        }\n        await this.sessionManager.refresh(session);\n\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue({\n            ...payload,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            exp: this.refreshTokenIssuer.buildExp(),\n            parent_id: payload.jti,\n        });\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({\n            ...payload,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            exp: this.accessTokenIssuer.buildExp(),\n            refresh_token_id: refreshTokenPayload.jti,\n        });\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        });\n    }\n\n    /**\n     * The grace window (opt-in via `tokenRefreshGracePeriod`) absorbs benign\n     * concurrent / multi-tab refreshes of the SAME still-current token. It is\n     * scoped to the chain tip: a token whose descendant has already been\n     * consumed is a stale ancestor (a real replay), never a grace re-use.\n     */\n    protected async isWithinGraceWindow(jti: string, now: Date) : Promise<boolean> {\n        if (this.gracePeriod <= 0) {\n            return false;\n        }\n\n        const current = await this.sessionTokenRepository.findOneById(jti);\n        if (\n            !current ||\n            current.revoked_at !== null ||\n            current.consumed_at === null ||\n            (now.getTime() - new Date(current.consumed_at).getTime()) > this.gracePeriod * 1_000\n        ) {\n            return false;\n        }\n\n        // Grace applies ONLY to the most-recent consumed token: a consumed\n        // descendant proves the rotation advanced past this one (stale replay).\n        const chainAdvanced = await this.sessionTokenRepository.hasConsumedChild(jti);\n        return !chainAdvanced;\n    }\n\n    /**\n     * RFC 6819 §5.2.2.3 reaction strategy — revoke the whole token family\n     * (the auth_sessions row) on replay: soft-revoke every session-token row,\n     * blocklist their jtis in the cache, and delete the session so its access\n     * tokens stop verifying on authup's own API.\n     */\n    protected async revokeFamily(sessionId: string, jti: string, at: string) : Promise<void> {\n        this.logger?.warn('OAuth2 refresh token replay detected; revoking session', {\n            session_id: sessionId,\n            jti,\n        });\n\n        // Blocklisting is best-effort (cache) — settle all of them so one cache\n        // failure cannot skip the rest or, worse, abort the session delete\n        // below (the load-bearing part of the revocation). Pin each TTL to the\n        // token's real expiry (unix seconds) so a long-lived refresh token\n        // cannot resurface as active via introspection after the fallback 1h.\n        const rows = await this.sessionTokenRepository.revokeBySessionId(sessionId, at);\n        await Promise.allSettled(rows.map((row) => this.tokenRepository.setInactive(\n            row.id,\n            Math.floor(new Date(row.expires_at).getTime() / 1_000),\n        )));\n\n        await this.sessionManager.revoke(sessionId);\n    }\n}\n"],"mappings":";;;;;;;AAgBA,IAAaI,0BAAb,cAA6CD,gBAAAA;CAC/BE;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;EACxB,CAAA;EAEA,KAAKR,qBAAqBM,IAAIN;EAC9B,KAAKC,gBAAgBK,IAAIL;EACzB,KAAKC,kBAAkBI,IAAIJ;EAC3B,KAAKC,yBAAyBG,IAAIH;EAClC,KAAKC,SAASE,IAAIF;EAClB,KAAKC,cAAcC,IAAIG,SAASJ,eAAe;CACnD;CAEA,MAAMK,QACFC,OACAF,UAAqC,CAAC,GACJ;EAClC,IAAIG;EACJ,IAAI,OAAOD,UAAU,UAGjBC,UAAU,MAAM,KAAKX,cAAcY,OAAOF,OAAO,EAAEG,iBAAiB,KAAK,CAAA;OAEzEF,UAAUD;EAGd,IAAI,CAACC,QAAQG,KACT,MAAMpB,SAASqB,uBAAuB,KAAA;EAE1C,IAAI,CAACJ,QAAQK,YACT,MAAMtB,SAASqB,uBAAuB,YAAA;EAG1C,MAAME,MAAM,MAAM,KAAKf,uBAAuBgB,YAAYP,QAAQG,GAAG;EACrE,IAAI,CAACG,OAAOA,IAAIE,SAAS,WAGrB,MAAMxB,iBAAiByB,QAAQ,0BAAA;EAEnC,IAAIH,IAAII,YACJ,MAAM1B,iBAAiByB,QAAQ,gCAAA;EAEnC,IAAIH,IAAID,eAAeL,QAAQK,YAI3B,MAAMrB,iBAAiByB,QAAQ,gCAAA;EAGnC,MAAME,sBAAM,IAAIC,KAAAA;EAChB,MAAMC,SAASF,IAAIG,YAAW;EAG9B,IAAI,CAACC,MADkB,KAAKxB,uBAAuByB,oBAAoBhB,QAAQG,KAAKU,MAAAA;OAM5E,CAACI,MADqB,KAAKC,oBAAoBlB,QAAQG,KAAKQ,GAAAA,GAC9C;IACd,MAAM,KAAKQ,aAAab,IAAID,YAAYL,QAAQG,KAAKU,MAAAA;IACrD,MAAM7B,iBAAiByB,QAAQ,gDAAA;GACnC;;EAMJ,MAAM,KAAKnB,gBAAgB8B,YAAYpB,QAAQG,KAAKH,QAAQqB,GAAG;EAE/D,MAAMC,UAAU,MAAM,KAAK1B,eAAeW,YAAYP,QAAQK,UAAU;EACxE,IAAI,CAACiB,SACD,MAAMvC,SAASqB,uBAAuB,YAAA;EAG1C,MAAM,KAAKR,eAAeK,OAAOqB,OAAAA;EAEjC,IAAIzB,QAAQ0B,WACRD,QAAQE,aAAa3B,QAAQ0B;EAEjC,IAAI1B,QAAQ4B,WACRH,QAAQI,aAAa7B,QAAQ4B;EAEjC,MAAM,KAAK7B,eAAe+B,QAAQL,OAAAA;EAElC,MAAM,CAACM,cAAcC,uBAAuB,MAAM,KAAKzC,mBAAmB0C,MAAM;GAC5E,GAAG9B;GACHwB,YAAYF,QAAQE;GACpBO,gBAAgBT,QAAQI;GACxBL,KAAK,KAAKjC,mBAAmB4C,SAAQ;GACrCC,WAAWjC,QAAQG;EACvB,CAAA;EAEA,MAAM,CAAC+B,aAAaC,sBAAsB,MAAM,KAAKxC,kBAAkBmC,MAAM;GACzE,GAAG9B;GACHwB,YAAYF,QAAQE;GACpBO,gBAAgBT,QAAQI;GACxBL,KAAK,KAAK1B,kBAAkBqC,SAAQ;GACpCI,kBAAkBP,oBAAoB1B;EAC1C,CAAA;EAEA,OAAOlB,+BAA+B;GAClCiD;GACAC;GACAP;GACAC;EACJ,CAAA;CACJ;;;;;;IAQA,MAAgBX,oBAAoBf,KAAaQ,KAA8B;EAC3E,IAAI,KAAKlB,eAAe,GACpB,OAAO;EAGX,MAAM4C,UAAU,MAAM,KAAK9C,uBAAuBgB,YAAYJ,GAAAA;EAC9D,IACI,CAACkC,WACDA,QAAQ3B,eAAe,QACvB2B,QAAQC,gBAAgB,QACxB,IAAKC,QAAO,IAAK,IAAI3B,KAAKyB,QAAQC,WAAW,CAAA,CAAEC,QAAO,IAAM,KAAK9C,cAAc,KAE/E,OAAO;EAMX,OAAO,CAAC+C,MADoB,KAAKjD,uBAAuBkD,iBAAiBtC,GAAAA;CAE7E;;;;;;IAQA,MAAgBgB,aAAauB,WAAmBvC,KAAawC,IAA4B;EACrF,KAAKnD,QAAQoD,KAAK,0DAA0D;GACxEvC,YAAYqC;GACZvC;EACJ,CAAA;EAOA,MAAM0C,OAAO,MAAM,KAAKtD,uBAAuBuD,kBAAkBJ,WAAWC,EAAAA;EAC5E,MAAMI,QAAQC,WAAWH,KAAKI,KAAK3C,QAAQ,KAAKhB,gBAAgB8B,YAC5Dd,IAAI4C,IACJC,KAAKC,MAAM,IAAIxC,KAAKN,IAAI+C,UAAU,CAAA,CAAEd,QAAO,IAAK,GAAA,CAAA,CAAA,CAAA;EAGpD,MAAM,KAAK3C,eAAe0D,OAAOZ,SAAAA;CACrC;AACJ"}
+{"version":3,"file":"refresh-token.mjs","names":["JWTError","OAuth2GrantError","OAuth2TokenKind","EventName","EventRefType","EventScope","buildOAuth2BearerTokenResponse","OAuth2BaseGrant","OAuth2RefreshTokenGrant","refreshTokenIssuer","tokenVerifier","tokenRepository","sessionTokenRepository","eventService","metrics","logger","gracePeriod","ctx","accessTokenIssuer","sessionManager","options","runWith","input","payload","verify","skipActiveCheck","jti","payloadPropertyInvalid","session_id","kind","REFRESH","invalid","row","findOneById","revokedAt","sessionId","now","Date","nowISO","toISOString","consumed","markRefreshConsumed","withinGrace","isWithinGraceWindow","revokeFamily","setInactive","exp","session","userAgent","ipAddress","refresh","refreshToken","refreshTokenPayload","issue","confirmation","cnf","user_agent","remote_address","buildExp","parent_id","accessToken","accessTokenPayload","refresh_token_id","current","consumedAt","getTime","chainAdvanced","hasConsumedChild","at","warn","record","scope","OAUTH2","name","REFRESH_REPLAY_DETECTED","refType","SESSION","refId","data","recordRefreshReplay","rows","revokeBySessionId","Promise","allSettled","map","id","Math","floor","expiresAt","revoke"],"sources":["../../../../src/core/oauth2/grant-types/refresh-token.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { JWTError, OAuth2GrantError, OAuth2TokenKind } from '@authup/specs';\nimport { EventName, EventRefType, EventScope } from '@authup/core-kit';\nimport type { Logger } from '@authup/server-kit';\nimport type { IEventService } from '../../entities/index.ts';\nimport type { IAuthFlowMetrics } from '../../metrics/index.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { ISessionTokenRepository } from '../session-token/index.ts';\nimport type { IOAuth2TokenIssuer, IOAuth2TokenRepository, IOAuth2TokenVerifier } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport type { IOAuth2Grant, OAuth2GrantRunWIthOptions, OAuth2RefreshTokenGrantContext } from './types.ts';\n\nexport class OAuth2RefreshTokenGrant extends OAuth2BaseGrant<string | OAuth2TokenPayload> implements IOAuth2Grant {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    protected tokenVerifier : IOAuth2TokenVerifier;\n\n    protected tokenRepository : IOAuth2TokenRepository;\n\n    protected sessionTokenRepository : ISessionTokenRepository;\n\n    protected eventService? : IEventService;\n\n    protected metrics? : IAuthFlowMetrics;\n\n    protected logger? : Logger;\n\n    protected gracePeriod : number;\n\n    constructor(ctx: OAuth2RefreshTokenGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n        this.tokenVerifier = ctx.tokenVerifier;\n        this.tokenRepository = ctx.tokenRepository;\n        this.sessionTokenRepository = ctx.sessionTokenRepository;\n        this.eventService = ctx.eventService;\n        this.metrics = ctx.metrics;\n        this.logger = ctx.logger;\n        this.gracePeriod = ctx.options?.gracePeriod ?? 0;\n    }\n\n    async runWith(\n        input: string | OAuth2TokenPayload,\n        options: OAuth2GrantRunWIthOptions = {},\n    ) : Promise<OAuth2TokenGrantResponse> {\n        let payload : OAuth2TokenPayload;\n        if (typeof input === 'string') {\n            // The auth_session_tokens row — not the cache blocklist — is the\n            // authority for refresh-token validity, so skip the active check.\n            payload = await this.tokenVerifier.verify(input, { skipActiveCheck: true });\n        } else {\n            payload = input;\n        }\n\n        if (!payload.jti) {\n            throw JWTError.payloadPropertyInvalid('jti');\n        }\n        if (!payload.session_id) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        // Explicit kind guard (defense in depth). Authup signs access tokens\n        // and the MFA-pending login ticket with the same keys; only a refresh\n        // token may be exchanged here. The ticket is also rejected implicitly\n        // (it writes no auth_session_tokens row), but do not rely on that\n        // second-order fact alone.\n        if (payload.kind && payload.kind !== OAuth2TokenKind.REFRESH) {\n            throw OAuth2GrantError.invalid('unexpected token kind');\n        }\n\n        const row = await this.sessionTokenRepository.findOneById(payload.jti);\n        if (!row || row.kind !== 'refresh') {\n            // Row missing = expired-and-swept or a pre-rotation legacy token\n            // (hard cutover). Either way the client must re-authenticate.\n            throw OAuth2GrantError.invalid('refresh token is unknown');\n        }\n        if (row.revokedAt) {\n            throw OAuth2GrantError.invalid('refresh token has been revoked');\n        }\n        if (row.sessionId !== payload.session_id) {\n            // The row is written with the token's own session_id and jti is\n            // globally unique, so a mismatch means corruption / jti reuse — fail\n            // closed rather than refresh or revoke against the wrong session.\n            throw OAuth2GrantError.invalid('refresh token session mismatch');\n        }\n\n        const now = new Date();\n        const nowISO = now.toISOString();\n\n        const consumed = await this.sessionTokenRepository.markRefreshConsumed(payload.jti, nowISO);\n        if (!consumed) {\n            // Lost the atomic consume — either a replay of an already-rotated\n            // token, or a benign concurrent-refresh race the grace window\n            // absorbs.\n            const withinGrace = await this.isWithinGraceWindow(payload.jti, now);\n            if (!withinGrace) {\n                await this.revokeFamily(row.sessionId, payload.jti, nowISO);\n                throw OAuth2GrantError.invalid('refresh token replay detected; session revoked');\n            }\n        }\n\n        // Blocklist the presented refresh token in the cache so introspection\n        // reports it inactive. Deliberately NOT a DB revoke — that would set\n        // revoked_at and break the grace window.\n        await this.tokenRepository.setInactive(payload.jti, payload.exp);\n\n        const session = await this.sessionManager.findOneById(payload.session_id);\n        if (!session) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        await this.sessionManager.verify(session);\n\n        if (options.userAgent) {\n            session.userAgent = options.userAgent;\n        }\n        if (options.ipAddress) {\n            session.ipAddress = options.ipAddress;\n        }\n        await this.sessionManager.refresh(session);\n\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue({\n            ...payload,\n            ...(options.confirmation ? { cnf: options.confirmation } : {}),\n            user_agent: session.userAgent,\n            remote_address: session.ipAddress,\n            exp: this.refreshTokenIssuer.buildExp(),\n            parent_id: payload.jti,\n        });\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({\n            ...payload,\n            ...(options.confirmation ? { cnf: options.confirmation } : {}),\n            user_agent: session.userAgent,\n            remote_address: session.ipAddress,\n            exp: this.accessTokenIssuer.buildExp(),\n            refresh_token_id: refreshTokenPayload.jti,\n        });\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        });\n    }\n\n    /**\n     * The grace window (opt-in via `tokenRefreshGracePeriod`) absorbs benign\n     * concurrent / multi-tab refreshes of the SAME still-current token. It is\n     * scoped to the chain tip: a token whose descendant has already been\n     * consumed is a stale ancestor (a real replay), never a grace re-use.\n     */\n    protected async isWithinGraceWindow(jti: string, now: Date) : Promise<boolean> {\n        if (this.gracePeriod <= 0) {\n            return false;\n        }\n\n        const current = await this.sessionTokenRepository.findOneById(jti);\n        if (\n            !current ||\n            current.revokedAt !== null ||\n            current.consumedAt === null ||\n            (now.getTime() - new Date(current.consumedAt).getTime()) > this.gracePeriod * 1_000\n        ) {\n            return false;\n        }\n\n        // Grace applies ONLY to the most-recent consumed token: a consumed\n        // descendant proves the rotation advanced past this one (stale replay).\n        const chainAdvanced = await this.sessionTokenRepository.hasConsumedChild(jti);\n        return !chainAdvanced;\n    }\n\n    /**\n     * RFC 6819 §5.2.2.3 reaction strategy — revoke the whole token family\n     * (the auth_sessions row) on replay: soft-revoke every session-token row,\n     * blocklist their jtis in the cache, and delete the session so its access\n     * tokens stop verifying on authup's own API.\n     */\n    protected async revokeFamily(sessionId: string, jti: string, at: string) : Promise<void> {\n        this.logger?.warn('OAuth2 refresh token replay detected; revoking session', {\n            sessionId,\n            jti,\n        });\n\n        await this.eventService?.record({\n            scope: EventScope.OAUTH2,\n            name: EventName.REFRESH_REPLAY_DETECTED,\n            refType: EventRefType.SESSION,\n            refId: sessionId,\n            data: { jti },\n        });\n        this.metrics?.recordRefreshReplay();\n\n        // Blocklisting is best-effort (cache) — settle all of them so one cache\n        // failure cannot skip the rest or, worse, abort the session delete\n        // below (the load-bearing part of the revocation). Pin each TTL to the\n        // token's real expiry (unix seconds) so a long-lived refresh token\n        // cannot resurface as active via introspection after the fallback 1h.\n        const rows = await this.sessionTokenRepository.revokeBySessionId(sessionId, at);\n        await Promise.allSettled(rows.map((row) => this.tokenRepository.setInactive(\n            row.id,\n            Math.floor(new Date(row.expiresAt).getTime() / 1_000),\n        )));\n\n        await this.sessionManager.revoke(sessionId);\n    }\n}\n"],"mappings":";;;;;;;;AAmBA,IAAaQ,0BAAb,cAA6CD,gBAAAA;CAC/BE;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;EACxB,CAAA;EAEA,KAAKV,qBAAqBQ,IAAIR;EAC9B,KAAKC,gBAAgBO,IAAIP;EACzB,KAAKC,kBAAkBM,IAAIN;EAC3B,KAAKC,yBAAyBK,IAAIL;EAClC,KAAKC,eAAeI,IAAIJ;EACxB,KAAKC,UAAUG,IAAIH;EACnB,KAAKC,SAASE,IAAIF;EAClB,KAAKC,cAAcC,IAAIG,SAASJ,eAAe;CACnD;CAEA,MAAMK,QACFC,OACAF,UAAqC,CAAC,GACJ;EAClC,IAAIG;EACJ,IAAI,OAAOD,UAAU,UAGjBC,UAAU,MAAM,KAAKb,cAAcc,OAAOF,OAAO,EAAEG,iBAAiB,KAAK,CAAA;OAEzEF,UAAUD;EAGd,IAAI,CAACC,QAAQG,KACT,MAAM1B,SAAS2B,uBAAuB,KAAA;EAE1C,IAAI,CAACJ,QAAQK,YACT,MAAM5B,SAAS2B,uBAAuB,YAAA;EAQ1C,IAAIJ,QAAQM,QAAQN,QAAQM,SAAS3B,gBAAgB4B,SACjD,MAAM7B,iBAAiB8B,QAAQ,uBAAA;EAGnC,MAAMC,MAAM,MAAM,KAAKpB,uBAAuBqB,YAAYV,QAAQG,GAAG;EACrE,IAAI,CAACM,OAAOA,IAAIH,SAAS,WAGrB,MAAM5B,iBAAiB8B,QAAQ,0BAAA;EAEnC,IAAIC,IAAIE,WACJ,MAAMjC,iBAAiB8B,QAAQ,gCAAA;EAEnC,IAAIC,IAAIG,cAAcZ,QAAQK,YAI1B,MAAM3B,iBAAiB8B,QAAQ,gCAAA;EAGnC,MAAMK,sBAAM,IAAIC,KAAAA;EAChB,MAAMC,SAASF,IAAIG,YAAW;EAG9B,IAAI,CAACC,MADkB,KAAK5B,uBAAuB6B,oBAAoBlB,QAAQG,KAAKY,MAAAA;OAM5E,CAACI,MADqB,KAAKC,oBAAoBpB,QAAQG,KAAKU,GAAAA,GAC9C;IACd,MAAM,KAAKQ,aAAaZ,IAAIG,WAAWZ,QAAQG,KAAKY,MAAAA;IACpD,MAAMrC,iBAAiB8B,QAAQ,gDAAA;GACnC;;EAMJ,MAAM,KAAKpB,gBAAgBkC,YAAYtB,QAAQG,KAAKH,QAAQuB,GAAG;EAE/D,MAAMC,UAAU,MAAM,KAAK5B,eAAec,YAAYV,QAAQK,UAAU;EACxE,IAAI,CAACmB,SACD,MAAM/C,SAAS2B,uBAAuB,YAAA;EAG1C,MAAM,KAAKR,eAAeK,OAAOuB,OAAAA;EAEjC,IAAI3B,QAAQ4B,WACRD,QAAQC,YAAY5B,QAAQ4B;EAEhC,IAAI5B,QAAQ6B,WACRF,QAAQE,YAAY7B,QAAQ6B;EAEhC,MAAM,KAAK9B,eAAe+B,QAAQH,OAAAA;EAElC,MAAM,CAACI,cAAcC,uBAAuB,MAAM,KAAK3C,mBAAmB4C,MAAM;GAC5E,GAAG9B;GACH,GAAIH,QAAQkC,eAAe,EAAEC,KAAKnC,QAAQkC,aAAa,IAAI,CAAC;GAC5DE,YAAYT,QAAQC;GACpBS,gBAAgBV,QAAQE;GACxBH,KAAK,KAAKrC,mBAAmBiD,SAAQ;GACrCC,WAAWpC,QAAQG;EACvB,CAAA;EAEA,MAAM,CAACkC,aAAaC,sBAAsB,MAAM,KAAK3C,kBAAkBmC,MAAM;GACzE,GAAG9B;GACH,GAAIH,QAAQkC,eAAe,EAAEC,KAAKnC,QAAQkC,aAAa,IAAI,CAAC;GAC5DE,YAAYT,QAAQC;GACpBS,gBAAgBV,QAAQE;GACxBH,KAAK,KAAK5B,kBAAkBwC,SAAQ;GACpCI,kBAAkBV,oBAAoB1B;EAC1C,CAAA;EAEA,OAAOpB,+BAA+B;GAClCsD;GACAC;GACAV;GACAC;EACJ,CAAA;CACJ;;;;;;IAQA,MAAgBT,oBAAoBjB,KAAaU,KAA8B;EAC3E,IAAI,KAAKpB,eAAe,GACpB,OAAO;EAGX,MAAM+C,UAAU,MAAM,KAAKnD,uBAAuBqB,YAAYP,GAAAA;EAC9D,IACI,CAACqC,WACDA,QAAQ7B,cAAc,QACtB6B,QAAQC,eAAe,QACvB,IAAKC,QAAO,IAAK,IAAI5B,KAAK0B,QAAQC,UAAU,CAAA,CAAEC,QAAO,IAAM,KAAKjD,cAAc,KAE9E,OAAO;EAMX,OAAO,CAACkD,MADoB,KAAKtD,uBAAuBuD,iBAAiBzC,GAAAA;CAE7E;;;;;;IAQA,MAAgBkB,aAAaT,WAAmBT,KAAa0C,IAA4B;EACrF,KAAKrD,QAAQsD,KAAK,0DAA0D;GACxElC;GACAT;EACJ,CAAA;EAEA,MAAM,KAAKb,cAAcyD,OAAO;GAC5BC,OAAOlE,WAAWmE;GAClBC,MAAMtE,UAAUuE;GAChBC,SAASvE,aAAawE;GACtBC,OAAO1C;GACP2C,MAAM,EAAEpD,IAAI;EAChB,CAAA;EACA,KAAKZ,SAASiE,oBAAAA;EAOd,MAAMC,OAAO,MAAM,KAAKpE,uBAAuBqE,kBAAkB9C,WAAWiC,EAAAA;EAC5E,MAAMc,QAAQC,WAAWH,KAAKI,KAAKpD,QAAQ,KAAKrB,gBAAgBkC,YAC5Db,IAAIqD,IACJC,KAAKC,MAAM,IAAIlD,KAAKL,IAAIwD,SAAS,CAAA,CAAEvB,QAAO,IAAK,GAAA,CAAA,CAAA,CAAA;EAGnD,MAAM,KAAK9C,eAAesE,OAAOtD,SAAAA;CACrC;AACJ"}

package/dist/core/oauth2/grant-types/types.d.ts

@@ -1,8 +1,10 @@
 import type { ObjectLiteral } from '@authup/kit';
-import type { OAuth2TokenGrantResponse } from '@authup/specs';
+import type { OAuth2TokenConfirmation, OAuth2TokenGrantResponse } from '@authup/specs';
 import type { Logger } from '@authup/server-kit';
 import type { ISessionManager } from '../../authentication/index.ts';
-import type { IOAuth2KeyRepository } from '../key/index.ts';
+import type { IEventService } from '../../entities/index.ts';
+import type { IAuthFlowMetrics } from '../../metrics/index.ts';
+import type { IKeyStore } from '../../key/index.ts';
 import type { ISessionTokenRepository } from '../session-token/index.ts';
 import type { IOAuth2OpenIDTokenIssuer, IOAuth2TokenIssuer, IOAuth2TokenRepository, IOAuth2TokenVerifier } from '../token/index.ts';
 export type BaseGrantContext = {
@@ -16,13 +18,15 @@ export type OAuth2AuthorizeGrantContext = BaseGrantContext & {
      * The realm's signing key determines the id_token's JWS alg — and with it
      * the at_hash digest (OIDC Core §3.1.3.6).
      */
-    keyRepository: IOAuth2KeyRepository;
+    keyStore: IKeyStore;
 };
 export type OAuth2IdentityGrantContext = BaseGrantContext & {
     refreshTokenIssuer: IOAuth2TokenIssuer;
 };
 export type OAuth2PasswordGrantContext = BaseGrantContext & {
     refreshTokenIssuer: IOAuth2TokenIssuer;
+    eventService?: IEventService;
+    metrics?: IAuthFlowMetrics;
 };
 export type OAuth2RefreshTokenGrantOptions = {
     /**
@@ -37,12 +41,15 @@ export type OAuth2RefreshTokenGrantContext = BaseGrantContext & {
     tokenVerifier: IOAuth2TokenVerifier;
     tokenRepository: IOAuth2TokenRepository;
     sessionTokenRepository: ISessionTokenRepository;
+    eventService?: IEventService;
+    metrics?: IAuthFlowMetrics;
     logger?: Logger;
     options?: OAuth2RefreshTokenGrantOptions;
 };
 export type OAuth2GrantRunWIthOptions = {
     userAgent?: string;
     ipAddress?: string;
+    confirmation?: OAuth2TokenConfirmation;
 };
 export interface IOAuth2Grant<T = ObjectLiteral> {
     runWith(data: T, base?: OAuth2GrantRunWIthOptions): Promise<OAuth2TokenGrantResponse>;

package/dist/core/oauth2/grant-types/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/grant-types/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,KAAK,EACR,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,EACvB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,gBAAgB,GAAG;IAC3B,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,cAAc,EAAE,eAAe,CAAA;CAClC,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG,gBAAgB,GAAG;IACzD,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,iBAAiB,EAAE,wBAAwB,CAAC;IAC5C;;;OAGG;IACH,aAAa,EAAE,oBAAoB,CAAC;CACvC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,gBAAgB,GAAG;IACxD,kBAAkB,EAAE,kBAAkB,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,gBAAgB,GAAG;IACxD,kBAAkB,EAAE,kBAAkB,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IACzC;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG,gBAAgB,GAAG;IAC5D,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,aAAa,EAAE,oBAAoB,CAAC;IACpC,eAAe,EAAE,sBAAsB,CAAC;IACxC,sBAAsB,EAAE,uBAAuB,CAAC;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,8BAA8B,CAAC;CAC5C,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,aAAa;IAC3C,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,yBAAyB,GAAI,OAAO,CAAC,wBAAwB,CAAC,CAAC;CAC1F"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/grant-types/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AACvF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,KAAK,EACR,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,EACvB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,gBAAgB,GAAG;IAC3B,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,cAAc,EAAE,eAAe,CAAA;CAClC,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG,gBAAgB,GAAG;IACzD,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,iBAAiB,EAAE,wBAAwB,CAAC;IAC5C;;;OAGG;IACH,QAAQ,EAAE,SAAS,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,gBAAgB,GAAG;IACxD,kBAAkB,EAAE,kBAAkB,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,gBAAgB,GAAG;IACxD,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,OAAO,CAAC,EAAE,gBAAgB,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IACzC;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG,gBAAgB,GAAG;IAC5D,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,aAAa,EAAE,oBAAoB,CAAC;IACpC,eAAe,EAAE,sBAAsB,CAAC;IACxC,sBAAsB,EAAE,uBAAuB,CAAC;IAChD,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,8BAA8B,CAAC;CAC5C,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,uBAAuB,CAAC;CAC1C,CAAC;AAEF,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,aAAa;IAC3C,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,yBAAyB,GAAI,OAAO,CAAC,wBAAwB,CAAC,CAAC;CAC1F"}

package/dist/core/oauth2/index.d.ts

@@ -1,8 +1,9 @@
+export * from './access-policy/index.ts';
 export * from './authorization/index.ts';
 export * from './client/index.ts';
 export * from './end-session/index.ts';
 export * from './grant-types/index.ts';
-export * from './key/index.ts';
+export * from './mfa-login/index.ts';
 export * from './openid/index.ts';
 export * from './response/index.ts';
 export * from './scope/index.ts';

package/dist/core/oauth2/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/oauth2/index.ts"],"names":[],"mappings":"AAOA,cAAc,0BAA0B,CAAC;AACzC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,wBAAwB,CAAC;AACvC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/oauth2/index.ts"],"names":[],"mappings":"AAOA,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC"}

package/dist/core/oauth2/index.mjs

@@ -1,8 +1,10 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { OAuth2AccessPolicyEvaluator } from "./access-policy/module.mjs";
+import "./access-policy/index.mjs";
 import { OAuth2AuthorizationCodeIssuer } from "./authorization/code/issuer/module.mjs";
-import { base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, generateOAuth2CodeVerifier } from "./authorization/helpers.mjs";
+import { base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, deriveAmrAcr, generateOAuth2CodeVerifier } from "./authorization/helpers.mjs";
 import { OAuth2AuthorizationCodeVerifier } from "./authorization/code/verifier/module.mjs";
 import { OAuth2ClientAuthenticator } from "./client/authenticator.mjs";
 import { assertClientGrantAllowed } from "./client/grant-type.mjs";
@@ -21,17 +23,19 @@ import { ClientCredentialsGrant } from "./grant-types/client-credentials.mjs";
 import { IdentityGrantType } from "./grant-types/identity.mjs";
 import { PasswordGrantType } from "./grant-types/password.mjs";
 import { OAuth2RefreshTokenGrant } from "./grant-types/refresh-token.mjs";
-import { RobotCredentialsGrant } from "./grant-types/robot-credentials.mjs";
 import "./grant-types/index.mjs";
+import { OAuth2MfaLoginService } from "./mfa-login/module.mjs";
+import "./mfa-login/index.mjs";
 import { OAuth2OpenIDClaimsBuilder } from "./openid/claims.mjs";
 import "./openid/index.mjs";
 import { OAuth2ScopeAttributesResolver } from "./scope/resolver.mjs";
 import "./scope/index.mjs";
 import { OAuth2AccessTokenIssuer } from "./token/issuer/access/module.mjs";
+import { OAuth2MfaTokenIssuer } from "./token/issuer/mfa/module.mjs";
 import { OAuth2OpenIDTokenIssuer } from "./token/issuer/open-id/module.mjs";
 import { OAuth2RefreshTokenIssuer } from "./token/issuer/refresh/module.mjs";
 import { OAuth2TokenRevoker } from "./token/revoker/module.mjs";
 import { OAuth2TokenSigner } from "./token/signer/module.mjs";
 import { OAuth2TokenVerifier } from "./token/verifier/module.mjs";
 import "./token/index.mjs";
-export { ClientCredentialsGrant, IdentityGrantType, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2ClientAuthenticator, OAuth2EndSessionRequestValidator, OAuth2EndSessionService, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PasswordGrantType, RobotCredentialsGrant, assertClientGrantAllowed, base64URLEncode, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, generateOAuth2CodeVerifier };
+export { ClientCredentialsGrant, IdentityGrantType, OAuth2AccessPolicyEvaluator, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2ClientAuthenticator, OAuth2EndSessionRequestValidator, OAuth2EndSessionService, OAuth2MfaLoginService, OAuth2MfaTokenIssuer, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PasswordGrantType, assertClientGrantAllowed, base64URLEncode, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, deriveAmrAcr, generateOAuth2CodeVerifier };

package/dist/core/oauth2/mfa-login/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/mfa-login/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/mfa-login/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/oauth2/mfa-login/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { OAuth2MfaLoginService } from "./module.mjs";
+export { OAuth2MfaLoginService };

package/dist/core/oauth2/mfa-login/module.d.ts

@@ -0,0 +1,19 @@
+import type { OAuth2TokenGrantResponse } from '@authup/specs';
+import type { IEventService } from '../../entities/index.ts';
+import type { IAuthFlowMetrics } from '../../metrics/index.ts';
+import type { ISessionManager } from '../../authentication/index.ts';
+import type { IOAuth2TokenIssuer, IOAuth2TokenRepository } from '../token/index.ts';
+import type { IOAuth2MfaLoginService, OAuth2MfaLoginCompleteInput, OAuth2MfaLoginServiceContext, OAuth2MfaLoginTicket, OAuth2MfaLoginTicketIssueInput, OAuth2MfaLoginTicketIssueOptions } from './types.ts';
+export declare class OAuth2MfaLoginService implements IOAuth2MfaLoginService {
+    protected sessionManager: ISessionManager;
+    protected ticketIssuer: IOAuth2TokenIssuer;
+    protected accessTokenIssuer: IOAuth2TokenIssuer;
+    protected refreshTokenIssuer: IOAuth2TokenIssuer;
+    protected tokenRepository: IOAuth2TokenRepository;
+    protected eventService?: IEventService;
+    protected metrics?: IAuthFlowMetrics;
+    constructor(ctx: OAuth2MfaLoginServiceContext);
+    issueTicket(input: OAuth2MfaLoginTicketIssueInput, options?: OAuth2MfaLoginTicketIssueOptions): Promise<OAuth2MfaLoginTicket>;
+    complete(input: OAuth2MfaLoginCompleteInput): Promise<OAuth2TokenGrantResponse>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/oauth2/mfa-login/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/mfa-login/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAsB,MAAM,eAAe,CAAC;AAUlF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAGrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AACpF,OAAO,KAAK,EACR,sBAAsB,EACtB,2BAA2B,EAC3B,4BAA4B,EAC5B,oBAAoB,EACpB,8BAA8B,EAC9B,gCAAgC,EACnC,MAAM,YAAY,CAAC;AAEpB,qBAAa,qBAAsB,YAAW,sBAAsB;IAChE,SAAS,CAAC,cAAc,EAAG,eAAe,CAAC;IAE3C,SAAS,CAAC,YAAY,EAAG,kBAAkB,CAAC;IAE5C,SAAS,CAAC,iBAAiB,EAAG,kBAAkB,CAAC;IAEjD,SAAS,CAAC,kBAAkB,EAAG,kBAAkB,CAAC;IAElD,SAAS,CAAC,eAAe,EAAG,sBAAsB,CAAC;IAEnD,SAAS,CAAC,YAAY,CAAC,EAAG,aAAa,CAAC;IAExC,SAAS,CAAC,OAAO,CAAC,EAAG,gBAAgB,CAAC;gBAE1B,GAAG,EAAE,4BAA4B;IAUvC,WAAW,CACb,KAAK,EAAE,8BAA8B,EACrC,OAAO,GAAE,gCAAqC,GAC9C,OAAO,CAAC,oBAAoB,CAAC;IA8C3B,QAAQ,CAAC,KAAK,EAAE,2BAA2B,GAAI,OAAO,CAAC,wBAAwB,CAAC;CAmEzF"}

package/dist/core/oauth2/mfa-login/module.mjs

@@ -0,0 +1,109 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { deriveAmrAcr } from "../authorization/helpers.mjs";
+import { buildOAuth2BearerTokenResponse } from "../response/bearer.mjs";
+import { EventName, EventRefType, EventScope, IdentityType, ScopeName, SessionAuthMethod } from "@authup/core-kit";
+import { OAuth2GrantError, OAuth2SubKind, OAuth2TokenGrant } from "@authup/specs";
+//#region src/core/oauth2/mfa-login/module.ts
+var OAuth2MfaLoginService = class {
+	sessionManager;
+	ticketIssuer;
+	accessTokenIssuer;
+	refreshTokenIssuer;
+	tokenRepository;
+	eventService;
+	metrics;
+	constructor(ctx) {
+		this.sessionManager = ctx.sessionManager;
+		this.ticketIssuer = ctx.ticketIssuer;
+		this.accessTokenIssuer = ctx.accessTokenIssuer;
+		this.refreshTokenIssuer = ctx.refreshTokenIssuer;
+		this.tokenRepository = ctx.tokenRepository;
+		this.eventService = ctx.eventService;
+		this.metrics = ctx.metrics;
+	}
+	async issueTicket(input, options = {}) {
+		const { user } = input;
+		const clientId = input.clientId ?? void 0;
+		const expiresAt = this.ticketIssuer.buildExp();
+		const session = await this.sessionManager.create({
+			userAgent: options.userAgent,
+			ipAddress: options.ipAddress,
+			realmId: user.realmId,
+			clientId,
+			sub: user.id,
+			subKind: IdentityType.USER,
+			mfaAt: null,
+			authMethod: SessionAuthMethod.PASSWORD,
+			expiresAt: (/* @__PURE__ */ new Date(expiresAt * 1e3)).toISOString()
+		});
+		const [token, payload] = await this.ticketIssuer.issue({
+			client_id: clientId,
+			session_id: session.id,
+			user_agent: session.userAgent,
+			remote_address: session.ipAddress,
+			sub: user.id,
+			sub_kind: OAuth2SubKind.USER,
+			realm_id: user.realmId,
+			realm_name: user.realm?.name,
+			...input.confirmation ? { cnf: input.confirmation } : {},
+			exp: expiresAt
+		});
+		return {
+			token,
+			expiresIn: payload.exp ? payload.exp - Math.floor(Date.now() / 1e3) : 0
+		};
+	}
+	async complete(input) {
+		const { ticket } = input;
+		const session = await this.sessionManager.refresh(input.session);
+		const amrAcr = deriveAmrAcr(session);
+		if (ticket.jti) {
+			if (!await this.tokenRepository.claimInactive(ticket.jti, ticket.exp)) throw OAuth2GrantError.invalid("mfa login ticket has already been used");
+		}
+		const issuePayload = {
+			client_id: session.clientId ?? void 0,
+			session_id: session.id,
+			user_agent: session.userAgent,
+			remote_address: session.ipAddress,
+			scope: ScopeName.GLOBAL,
+			sub: session.sub,
+			sub_kind: OAuth2SubKind.USER,
+			realm_id: session.realmId,
+			realm_name: ticket.realm_name,
+			...ticket.cnf ? { cnf: ticket.cnf } : {},
+			...amrAcr
+		};
+		const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);
+		const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);
+		await this.eventService?.record({
+			scope: EventScope.OAUTH2,
+			name: EventName.LOGIN,
+			refType: EventRefType.SESSION,
+			refId: session.id,
+			clientId: session.clientId ?? null,
+			actorType: IdentityType.USER,
+			actorId: session.sub,
+			actorName: input.userName ?? null,
+			realmId: session.realmId,
+			requestIpAddress: session.ipAddress ?? null,
+			requestUserAgent: session.userAgent ?? null,
+			data: {
+				grantType: OAuth2TokenGrant.PASSWORD,
+				sessionId: session.id
+			}
+		});
+		this.metrics?.recordLogin("success");
+		return buildOAuth2BearerTokenResponse({
+			accessToken,
+			accessTokenPayload,
+			refreshToken,
+			refreshTokenPayload
+		});
+	}
+};
+//#endregion
+export { OAuth2MfaLoginService };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/mfa-login/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["OAuth2GrantError","OAuth2SubKind","OAuth2TokenGrant","EventName","EventRefType","EventScope","IdentityType","ScopeName","SessionAuthMethod","deriveAmrAcr","buildOAuth2BearerTokenResponse","OAuth2MfaLoginService","sessionManager","ticketIssuer","accessTokenIssuer","refreshTokenIssuer","tokenRepository","eventService","metrics","ctx","issueTicket","input","options","user","clientId","undefined","expiresAt","buildExp","session","create","userAgent","ipAddress","realmId","sub","id","subKind","USER","mfaAt","authMethod","PASSWORD","Date","toISOString","token","payload","issue","client_id","session_id","user_agent","remote_address","sub_kind","realm_id","realm_name","realm","name","confirmation","cnf","exp","expiresIn","Math","floor","now","complete","ticket","refresh","amrAcr","jti","claimed","claimInactive","invalid","issuePayload","scope","GLOBAL","accessToken","accessTokenPayload","refreshToken","refreshTokenPayload","record","OAUTH2","LOGIN","refType","SESSION","refId","actorType","actorId","actorName","userName","requestIpAddress","requestUserAgent","data","grantType","sessionId","recordLogin"],"sources":["../../../../src/core/oauth2/mfa-login/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2GrantError, OAuth2SubKind, OAuth2TokenGrant } from '@authup/specs';\nimport {\n    EventName,\n    EventRefType,\n    EventScope,\n    IdentityType,\n    ScopeName,\n    SessionAuthMethod,\n} from '@authup/core-kit';\nimport type { IEventService } from '../../entities/index.ts';\nimport type { IAuthFlowMetrics } from '../../metrics/index.ts';\nimport type { ISessionManager } from '../../authentication/index.ts';\nimport { deriveAmrAcr } from '../authorization/helpers.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { IOAuth2TokenIssuer, IOAuth2TokenRepository } from '../token/index.ts';\nimport type {\n    IOAuth2MfaLoginService,\n    OAuth2MfaLoginCompleteInput,\n    OAuth2MfaLoginServiceContext,\n    OAuth2MfaLoginTicket,\n    OAuth2MfaLoginTicketIssueInput,\n    OAuth2MfaLoginTicketIssueOptions,\n} from './types.ts';\n\nexport class OAuth2MfaLoginService implements IOAuth2MfaLoginService {\n    protected sessionManager : ISessionManager;\n\n    protected ticketIssuer : IOAuth2TokenIssuer;\n\n    protected accessTokenIssuer : IOAuth2TokenIssuer;\n\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    protected tokenRepository : IOAuth2TokenRepository;\n\n    protected eventService? : IEventService;\n\n    protected metrics? : IAuthFlowMetrics;\n\n    constructor(ctx: OAuth2MfaLoginServiceContext) {\n        this.sessionManager = ctx.sessionManager;\n        this.ticketIssuer = ctx.ticketIssuer;\n        this.accessTokenIssuer = ctx.accessTokenIssuer;\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n        this.tokenRepository = ctx.tokenRepository;\n        this.eventService = ctx.eventService;\n        this.metrics = ctx.metrics;\n    }\n\n    async issueTicket(\n        input: OAuth2MfaLoginTicketIssueInput,\n        options: OAuth2MfaLoginTicketIssueOptions = {},\n    ) : Promise<OAuth2MfaLoginTicket> {\n        const { user } = input;\n        const clientId = input.clientId ?? undefined;\n\n        // One expiration instant for BOTH artifacts — the pending session\n        // lives exactly as long as the ticket (an abandoned login\n        // self-expires and is swept with the regular session sweep;\n        // completion extends it to the full lifetime). Computed once so\n        // the two cannot drift.\n        const expiresAt = this.ticketIssuer.buildExp();\n\n        const session = await this.sessionManager.create({\n            userAgent: options.userAgent,\n            ipAddress: options.ipAddress,\n            realmId: user.realmId,\n            clientId,\n            sub: user.id,\n            subKind: IdentityType.USER,\n            mfaAt: null,\n            authMethod: SessionAuthMethod.PASSWORD,\n            expiresAt: new Date(expiresAt * 1000).toISOString(),\n        });\n\n        // No scope, no role claims — the ticket is not a bearer; it only\n        // unlocks the challenge routes (which opt in by kind).\n        const [token, payload] = await this.ticketIssuer.issue({\n            client_id: clientId,\n            session_id: session.id,\n            user_agent: session.userAgent,\n            remote_address: session.ipAddress,\n            sub: user.id,\n            sub_kind: OAuth2SubKind.USER,\n            realm_id: user.realmId,\n            realm_name: user.realm?.name,\n            ...(input.confirmation ? { cnf: input.confirmation } : {}),\n            exp: expiresAt,\n        });\n\n        return {\n            token,\n            expiresIn: payload.exp ?\n                payload.exp - Math.floor(Date.now() / 1000) :\n                0,\n        };\n    }\n\n    async complete(input: OAuth2MfaLoginCompleteInput) : Promise<OAuth2TokenGrantResponse> {\n        const { ticket } = input;\n\n        // Extend the ticket-scoped pending session to the regular session\n        // lifetime — the login is complete now.\n        const session = await this.sessionManager.refresh(input.session);\n\n        // mfaAt was stamped inside the verify unit of work, so the claims\n        // advertise the completed factor (amr +otp, acr urn:authup:mfa).\n        const amrAcr = deriveAmrAcr(session);\n\n        // Single use: atomically claim the ticket BEFORE minting so two\n        // concurrent completions (a mixed-kind user presenting two distinct\n        // fresh factors) cannot both issue a token pair — `claimInactive` is a\n        // set-if-absent write, so exactly one racer wins. The trade-off vs.\n        // claiming after minting is that a mint failure burns the ticket — the\n        // safer bias for a single-use login credential (the user re-authenticates).\n        if (ticket.jti) {\n            const claimed = await this.tokenRepository.claimInactive(ticket.jti, ticket.exp);\n            if (!claimed) {\n                throw OAuth2GrantError.invalid('mfa login ticket has already been used');\n            }\n        }\n\n        const issuePayload : Partial<OAuth2TokenPayload> = {\n            client_id: session.clientId ?? undefined,\n            session_id: session.id,\n            user_agent: session.userAgent,\n            remote_address: session.ipAddress,\n            scope: ScopeName.GLOBAL,\n            sub: session.sub,\n            sub_kind: OAuth2SubKind.USER,\n            realm_id: session.realmId,\n            realm_name: ticket.realm_name,\n            ...(ticket.cnf ? { cnf: ticket.cnf } : {}),\n            ...amrAcr,\n        };\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);\n\n        await this.eventService?.record({\n            scope: EventScope.OAUTH2,\n            name: EventName.LOGIN,\n            refType: EventRefType.SESSION,\n            refId: session.id,\n            clientId: session.clientId ?? null,\n            actorType: IdentityType.USER,\n            actorId: session.sub,\n            actorName: input.userName ?? null,\n            realmId: session.realmId,\n            requestIpAddress: session.ipAddress ?? null,\n            requestUserAgent: session.userAgent ?? null,\n            data: {\n                grantType: OAuth2TokenGrant.PASSWORD,\n                sessionId: session.id,\n            },\n        });\n        this.metrics?.recordLogin('success');\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;;;;AAgCA,IAAaW,wBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAmC;EAC3C,KAAKP,iBAAiBO,IAAIP;EAC1B,KAAKC,eAAeM,IAAIN;EACxB,KAAKC,oBAAoBK,IAAIL;EAC7B,KAAKC,qBAAqBI,IAAIJ;EAC9B,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,eAAeE,IAAIF;EACxB,KAAKC,UAAUC,IAAID;CACvB;CAEA,MAAME,YACFC,OACAC,UAA4C,CAAC,GACf;EAC9B,MAAM,EAAEC,SAASF;EACjB,MAAMG,WAAWH,MAAMG,YAAYC,KAAAA;EAOnC,MAAMC,YAAY,KAAKb,aAAac,SAAQ;EAE5C,MAAMC,UAAU,MAAM,KAAKhB,eAAeiB,OAAO;GAC7CC,WAAWR,QAAQQ;GACnBC,WAAWT,QAAQS;GACnBC,SAAST,KAAKS;GACdR;GACAS,KAAKV,KAAKW;GACVC,SAAS7B,aAAa8B;GACtBC,OAAO;GACPC,YAAY9B,kBAAkB+B;GAC9Bb,4BAAW,IAAIc,KAAKd,YAAY,GAAA,EAAA,CAAMe,YAAW;EACrD,CAAA;EAIA,MAAM,CAACC,OAAOC,WAAW,MAAM,KAAK9B,aAAa+B,MAAM;GACnDC,WAAWrB;GACXsB,YAAYlB,QAAQM;GACpBa,YAAYnB,QAAQE;GACpBkB,gBAAgBpB,QAAQG;GACxBE,KAAKV,KAAKW;GACVe,UAAUhD,cAAcmC;GACxBc,UAAU3B,KAAKS;GACfmB,YAAY5B,KAAK6B,OAAOC;GACxB,GAAIhC,MAAMiC,eAAe,EAAEC,KAAKlC,MAAMiC,aAAa,IAAI,CAAC;GACxDE,KAAK9B;EACT,CAAA;EAEA,OAAO;GACHgB;GACAe,WAAWd,QAAQa,MACfb,QAAQa,MAAME,KAAKC,MAAMnB,KAAKoB,IAAG,IAAK,GAAA,IACtC;EACR;CACJ;CAEA,MAAMC,SAASxC,OAAwE;EACnF,MAAM,EAAEyC,WAAWzC;EAInB,MAAMO,UAAU,MAAM,KAAKhB,eAAemD,QAAQ1C,MAAMO,OAAO;EAI/D,MAAMoC,SAASvD,aAAamB,OAAAA;EAQ5B,IAAIkC,OAAOG;OAEH,CAACC,MADiB,KAAKlD,gBAAgBmD,cAAcL,OAAOG,KAAKH,OAAON,GAAG,GAE3E,MAAMxD,iBAAiBoE,QAAQ,wCAAA;EAAA;EAIvC,MAAMC,eAA6C;GAC/CxB,WAAWjB,QAAQJ,YAAYC,KAAAA;GAC/BqB,YAAYlB,QAAQM;GACpBa,YAAYnB,QAAQE;GACpBkB,gBAAgBpB,QAAQG;GACxBuC,OAAO/D,UAAUgE;GACjBtC,KAAKL,QAAQK;GACbgB,UAAUhD,cAAcmC;GACxBc,UAAUtB,QAAQI;GAClBmB,YAAYW,OAAOX;GACnB,GAAIW,OAAOP,MAAM,EAAEA,KAAKO,OAAOP,IAAI,IAAI,CAAC;GACxC,GAAGS;EACP;EAEA,MAAM,CAACQ,aAAaC,sBAAsB,MAAM,KAAK3D,kBAAkB8B,MAAMyB,YAAAA;EAC7E,MAAM,CAACK,cAAcC,uBAAuB,MAAM,KAAK5D,mBAAmB6B,MAAMyB,YAAAA;EAEhF,MAAM,KAAKpD,cAAc2D,OAAO;GAC5BN,OAAOjE,WAAWwE;GAClBxB,MAAMlD,UAAU2E;GAChBC,SAAS3E,aAAa4E;GACtBC,OAAOrD,QAAQM;GACfV,UAAUI,QAAQJ,YAAY;GAC9B0D,WAAW5E,aAAa8B;GACxB+C,SAASvD,QAAQK;GACjBmD,WAAW/D,MAAMgE,YAAY;GAC7BrD,SAASJ,QAAQI;GACjBsD,kBAAkB1D,QAAQG,aAAa;GACvCwD,kBAAkB3D,QAAQE,aAAa;GACvC0D,MAAM;IACFC,WAAWvF,iBAAiBqC;IAC5BmD,WAAW9D,QAAQM;GACvB;EACJ,CAAA;EACA,KAAKhB,SAASyE,YAAY,SAAA;EAE1B,OAAOjF,+BAA+B;GAClC8D;GACAC;GACAC;GACAC;EACJ,CAAA;CACJ;AACJ"}

package/dist/core/oauth2/mfa-login/types.d.ts

@@ -0,0 +1,64 @@
+import type { Session, User } from '@authup/core-kit';
+import type { OAuth2TokenConfirmation, OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';
+import type { IEventService } from '../../entities/index.ts';
+import type { IAuthFlowMetrics } from '../../metrics/index.ts';
+import type { ISessionManager } from '../../authentication/index.ts';
+import type { IOAuth2TokenIssuer, IOAuth2TokenRepository } from '../token/index.ts';
+export type OAuth2MfaLoginTicketIssueInput = {
+    user: User;
+    clientId?: string | null;
+    confirmation?: OAuth2TokenConfirmation;
+};
+export type OAuth2MfaLoginTicketIssueOptions = {
+    ipAddress?: string;
+    userAgent?: string;
+};
+export type OAuth2MfaLoginTicket = {
+    token: string;
+    expiresIn: number;
+};
+export type OAuth2MfaLoginCompleteInput = {
+    /**
+     * The pending session the ticket references — already mfa-stamped by
+     * the challenge verify (markMfaVerified runs in the verify unit of
+     * work, before completion).
+     */
+    session: Session;
+    /**
+     * The verified mfa_token payload the caller authenticated with.
+     */
+    ticket: OAuth2TokenPayload;
+    /**
+     * Actor name for the LOGIN security event.
+     */
+    userName?: string;
+};
+/**
+ * The "MFA-pending" login-ticket seam (issue #3242): the password grant
+ * issues a restricted ticket (kind: mfa_token) instead of failing closed
+ * when the second factor cannot ride the single POST (email / WebAuthn),
+ * and a successful interactive challenge completes the login by minting
+ * the full token pair for the now-MFA'd pending session.
+ */
+export interface IOAuth2MfaLoginService {
+    /**
+     * Create the pending session (mfaAt: null, ticket-scoped lifetime)
+     * and mint the mfa_token bound to it.
+     */
+    issueTicket(input: OAuth2MfaLoginTicketIssueInput, options?: OAuth2MfaLoginTicketIssueOptions): Promise<OAuth2MfaLoginTicket>;
+    /**
+     * Mint the full grant for the completed session, extend it to the
+     * regular session lifetime, and consume the ticket (single use).
+     */
+    complete(input: OAuth2MfaLoginCompleteInput): Promise<OAuth2TokenGrantResponse>;
+}
+export type OAuth2MfaLoginServiceContext = {
+    sessionManager: ISessionManager;
+    ticketIssuer: IOAuth2TokenIssuer;
+    accessTokenIssuer: IOAuth2TokenIssuer;
+    refreshTokenIssuer: IOAuth2TokenIssuer;
+    tokenRepository: IOAuth2TokenRepository;
+    eventService?: IEventService;
+    metrics?: IAuthFlowMetrics;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/core/oauth2/mfa-login/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/mfa-login/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EACR,uBAAuB,EACvB,wBAAwB,EACxB,kBAAkB,EACrB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAEpF,MAAM,MAAM,8BAA8B,GAAG;IACzC,IAAI,EAAE,IAAI,CAAC;IACX,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,YAAY,CAAC,EAAE,uBAAuB,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,gCAAgC,GAAG;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACtC;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;OAEG;IACH,MAAM,EAAE,kBAAkB,CAAC;IAC3B;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACnC;;;OAGG;IACH,WAAW,CACP,KAAK,EAAE,8BAA8B,EACrC,OAAO,CAAC,EAAE,gCAAgC,GAC3C,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEjC;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;CACnF;AAED,MAAM,MAAM,4BAA4B,GAAG;IACvC,cAAc,EAAE,eAAe,CAAC;IAChC,YAAY,EAAE,kBAAkB,CAAC;IACjC,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,eAAe,EAAE,sBAAsB,CAAC;IACxC,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,OAAO,CAAC,EAAE,gBAAgB,CAAC;CAC9B,CAAC"}

package/dist/core/oauth2/mfa-login/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/oauth2/openid/claims.d.ts

@@ -1,4 +1,4 @@
-import type { Client, Identity, Robot, User } from '@authup/core-kit';
+import type { Client, Identity, User } from '@authup/core-kit';
 import type { OpenIDTokenPayload } from '@authup/specs';
 import type { ObjectLiteral } from 'validup';
 type AttributeMapTuple<T> = {
@@ -7,7 +7,6 @@ type AttributeMapTuple<T> = {
 type AttributeMap<T extends Record<string, any>> = Record<keyof OpenIDTokenPayload, keyof T | AttributeMapTuple<T>>;
 export declare class OAuth2OpenIDClaimsBuilder {
     protected clientMap: AttributeMap<Client>;
-    protected robotMap: AttributeMap<Robot>;
     protected userMap: AttributeMap<User>;
     /**
      * Build OpenID Claims form Oauth2 Identity.
@@ -16,7 +15,6 @@ export declare class OAuth2OpenIDClaimsBuilder {
      */
     fromIdentity(identity: Identity): OpenIDTokenPayload;
     fromClient(input: Client): OpenIDTokenPayload;
-    fromRobot(input: Robot): OpenIDTokenPayload;
     fromUser(input: User): OpenIDTokenPayload;
     protected extract<T extends ObjectLiteral = ObjectLiteral>(attributeMap: AttributeMap<T>, attributes: T): OpenIDTokenPayload;
 }

package/dist/core/oauth2/openid/claims.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claims.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/openid/claims.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,MAAM,EACN,QAAQ,EACR,KAAK,EACL,IAAI,EACP,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C,KAAK,iBAAiB,CAAC,CAAC,IAAI;KACvB,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,GAAG,CAAC;CAC/C,CAAC,MAAM,CAAC,CAAC,CAAC;AAEX,KAAK,YAAY,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,MAAM,CACrD,MAAM,kBAAkB,EAC5B,MAAM,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAC7B,CAAC;AAEF,qBAAa,yBAAyB;IAClC,SAAS,CAAC,SAAS,EAAG,YAAY,CAAC,MAAM,CAAC,CAcxC;IAEF,SAAS,CAAC,QAAQ,EAAG,YAAY,CAAC,KAAK,CAAC,CActC;IAEF,SAAS,CAAC,OAAO,EAAG,YAAY,CAAC,IAAI,CAAC,CAmBpC;IAEF;;;;OAIG;IACH,YAAY,CAAC,QAAQ,EAAE,QAAQ,GAAI,kBAAkB;IAYrD,UAAU,CAAC,KAAK,EAAE,MAAM,GAAI,kBAAkB;IAI9C,SAAS,CAAC,KAAK,EAAE,KAAK,GAAG,kBAAkB;IAI3C,QAAQ,CAAC,KAAK,EAAE,IAAI,GAAI,kBAAkB;IAI1C,SAAS,CAAC,OAAO,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa,EACrD,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,EAC7B,UAAU,EAAE,CAAC,GACb,kBAAkB;CAqBzB"}
+{"version":3,"file":"claims.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/openid/claims.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,MAAM,EACN,QAAQ,EACR,IAAI,EACP,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C,KAAK,iBAAiB,CAAC,CAAC,IAAI;KACvB,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,GAAG,CAAC;CAC/C,CAAC,MAAM,CAAC,CAAC,CAAC;AAEX,KAAK,YAAY,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,MAAM,CACrD,MAAM,kBAAkB,EAC5B,MAAM,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAC7B,CAAC;AAEF,qBAAa,yBAAyB;IAClC,SAAS,CAAC,SAAS,EAAG,YAAY,CAAC,MAAM,CAAC,CAcxC;IAEF,SAAS,CAAC,OAAO,EAAG,YAAY,CAAC,IAAI,CAAC,CAmBpC;IAEF;;;;OAIG;IACH,YAAY,CAAC,QAAQ,EAAE,QAAQ,GAAI,kBAAkB;IAQrD,UAAU,CAAC,KAAK,EAAE,MAAM,GAAI,kBAAkB;IAI9C,QAAQ,CAAC,KAAK,EAAE,IAAI,GAAI,kBAAkB;IAI1C,SAAS,CAAC,OAAO,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa,EACrD,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,EAC7B,UAAU,EAAE,CAAC,GACb,kBAAkB;CAqBzB"}

package/dist/core/oauth2/openid/claims.mjs

@@ -9,27 +9,18 @@ var OAuth2OpenIDClaimsBuilder = class {
 		name: "name",
 		nickname: "name",
 		preferred_username: "name",
-		updated_at: ["updated_at", (value) => {
-			if (typeof value === "string") return Math.floor(new Date(value).getTime() / 1e3);
-			return value;
-		}]
-	};
-	robotMap = {
-		name: "name",
-		nickname: "name",
-		preferred_username: "name",
-		updated_at: ["updated_at", (value) => {
+		updated_at: ["updatedAt", (value) => {
 			if (typeof value === "string") return Math.floor(new Date(value).getTime() / 1e3);
 			return value;
 		}]
 	};
 	userMap = {
 		name: "name",
-		family_name: "last_name",
-		given_name: "first_name",
-		nickname: "display_name",
-		preferred_username: "display_name",
-		updated_at: ["updated_at", (value) => {
+		family_name: "lastName",
+		given_name: "firstName",
+		nickname: "displayName",
+		preferred_username: "displayName",
+		updated_at: ["updatedAt", (value) => {
 			if (typeof value === "string") return Math.floor(new Date(value).getTime() / 1e3);
 			return value;
 		}],
@@ -42,15 +33,11 @@ var OAuth2OpenIDClaimsBuilder = class {
 	* @param identity
 	*/ fromIdentity(identity) {
 		if (identity.type === OAuth2SubKind.CLIENT) return this.fromClient(identity.data);
-		if (identity.type === OAuth2SubKind.ROBOT) return this.fromRobot(identity.data);
 		return this.fromUser(identity.data);
 	}
 	fromClient(input) {
 		return this.extract(this.clientMap, input);
 	}
-	fromRobot(input) {
-		return this.extract(this.robotMap, input);
-	}
 	fromUser(input) {
 		return this.extract(this.userMap, input);
 	}

package/dist/core/oauth2/openid/claims.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"claims.mjs","names":["hasOwnProperty","OAuth2SubKind","OAuth2OpenIDClaimsBuilder","clientMap","name","nickname","preferred_username","updated_at","value","Math","floor","Date","getTime","robotMap","userMap","family_name","given_name","email","email_verified","fromIdentity","identity","type","CLIENT","fromClient","data","ROBOT","fromRobot","fromUser","input","extract","attributeMap","attributes","result","keys","Object","key_","attribute","key","transformer"],"sources":["../../../../src/core/oauth2/openid/claims.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Client, \n    Identity, \n    Robot, \n    User,\n} from '@authup/core-kit';\nimport { hasOwnProperty } from '@authup/kit';\nimport type { OpenIDTokenPayload } from '@authup/specs';\nimport { OAuth2SubKind } from '@authup/specs';\nimport type { ObjectLiteral } from 'validup';\n\ntype AttributeMapTuple<T> = {\n    [K in keyof T]: [K, (value: unknown) => any]\n}[keyof T];\n\ntype AttributeMap<T extends Record<string, any>> = Record<\n    keyof OpenIDTokenPayload,\nkeyof T | AttributeMapTuple<T>\n>;\n\nexport class OAuth2OpenIDClaimsBuilder {\n    protected clientMap : AttributeMap<Client> = {\n        name: 'name',\n        nickname: 'name',\n        preferred_username: 'name',\n        updated_at: [\n            'updated_at',\n            (value: unknown) => {\n                if (typeof value === 'string') {\n                    return Math.floor(new Date(value).getTime() / 1000);\n                }\n\n                return value;\n            },\n        ],\n    };\n\n    protected robotMap : AttributeMap<Robot> = {\n        name: 'name',\n        nickname: 'name',\n        preferred_username: 'name',\n        updated_at: [\n            'updated_at',\n            (value: unknown) => {\n                if (typeof value === 'string') {\n                    return Math.floor(new Date(value).getTime() / 1000);\n                }\n\n                return value;\n            },\n        ],\n    };\n\n    protected userMap : AttributeMap<User> = {\n        name: 'name',\n        family_name: 'last_name',\n        given_name: 'first_name',\n        nickname: 'display_name',\n        preferred_username: 'display_name',\n        updated_at: [\n            'updated_at',\n            (value: unknown) => {\n                if (typeof value === 'string') {\n                    return Math.floor(new Date(value).getTime() / 1000);\n                }\n\n                return value;\n            },\n        ],\n\n        email: 'email',\n        email_verified: 'active',\n    };\n\n    /**\n     * Build OpenID Claims form Oauth2 Identity.\n     *\n     * @param identity\n     */\n    fromIdentity(identity: Identity) : OpenIDTokenPayload {\n        if (identity.type === OAuth2SubKind.CLIENT) {\n            return this.fromClient(identity.data);\n        }\n\n        if (identity.type === OAuth2SubKind.ROBOT) {\n            return this.fromRobot(identity.data);\n        }\n\n        return this.fromUser(identity.data);\n    }\n\n    fromClient(input: Client) : OpenIDTokenPayload {\n        return this.extract(this.clientMap, input);\n    }\n\n    fromRobot(input: Robot): OpenIDTokenPayload {\n        return this.extract(this.robotMap, input);\n    }\n\n    fromUser(input: User) : OpenIDTokenPayload {\n        return this.extract(this.userMap, input);\n    }\n\n    protected extract<T extends ObjectLiteral = ObjectLiteral>(\n        attributeMap: AttributeMap<T>,\n        attributes: T,\n    ) : OpenIDTokenPayload {\n        const result = {} as OpenIDTokenPayload;\n\n        const keys = Object.keys(attributeMap);\n        for (const key_ of keys) {\n            const attribute = attributeMap[key_];\n            if (typeof attribute === 'string') {\n                if (hasOwnProperty(attributes, attribute)) {\n                    result[key_] = attributes[attribute];\n                }\n            } else {\n                const [key, transformer] = attribute as AttributeMapTuple<T>;\n\n                if (hasOwnProperty(attributes, key)) {\n                    result[key_] = transformer(attributes[key]);\n                }\n            }\n        }\n\n        return result;\n    }\n}\n"],"mappings":";;;;;;AA2BA,IAAaE,4BAAb,MAAaA;CACCC,YAAmC;EACzCC,MAAM;EACNC,UAAU;EACVC,oBAAoB;EACpBC,YAAY,CACR,eACCC,UAAAA;GACG,IAAI,OAAOA,UAAU,UACjB,OAAOC,KAAKC,MAAM,IAAIC,KAAKH,KAAAA,CAAAA,CAAOI,QAAO,IAAK,GAAA;GAGlD,OAAOJ;EACX,CAAA;CAER;CAEUK,WAAiC;EACvCT,MAAM;EACNC,UAAU;EACVC,oBAAoB;EACpBC,YAAY,CACR,eACCC,UAAAA;GACG,IAAI,OAAOA,UAAU,UACjB,OAAOC,KAAKC,MAAM,IAAIC,KAAKH,KAAAA,CAAAA,CAAOI,QAAO,IAAK,GAAA;GAGlD,OAAOJ;EACX,CAAA;CAER;CAEUM,UAA+B;EACrCV,MAAM;EACNW,aAAa;EACbC,YAAY;EACZX,UAAU;EACVC,oBAAoB;EACpBC,YAAY,CACR,eACCC,UAAAA;GACG,IAAI,OAAOA,UAAU,UACjB,OAAOC,KAAKC,MAAM,IAAIC,KAAKH,KAAAA,CAAAA,CAAOI,QAAO,IAAK,GAAA;GAGlD,OAAOJ;EACX,CAAA;EAGJS,OAAO;EACPC,gBAAgB;CACpB;;;;;IAOAC,aAAaC,UAAyC;EAClD,IAAIA,SAASC,SAASpB,cAAcqB,QAChC,OAAO,KAAKC,WAAWH,SAASI,IAAI;EAGxC,IAAIJ,SAASC,SAASpB,cAAcwB,OAChC,OAAO,KAAKC,UAAUN,SAASI,IAAI;EAGvC,OAAO,KAAKG,SAASP,SAASI,IAAI;CACtC;CAEAD,WAAWK,OAAoC;EAC3C,OAAO,KAAKC,QAAQ,KAAK1B,WAAWyB,KAAAA;CACxC;CAEAF,UAAUE,OAAkC;EACxC,OAAO,KAAKC,QAAQ,KAAKhB,UAAUe,KAAAA;CACvC;CAEAD,SAASC,OAAkC;EACvC,OAAO,KAAKC,QAAQ,KAAKf,SAASc,KAAAA;CACtC;CAEUC,QACNC,cACAC,YACmB;EACnB,MAAMC,SAAS,CAAC;EAEhB,MAAMC,OAAOC,OAAOD,KAAKH,YAAAA;EACzB,KAAK,MAAMK,QAAQF,MAAM;GACrB,MAAMG,YAAYN,aAAaK;GAC/B,IAAI,OAAOC,cAAc;QACjBpC,eAAe+B,YAAYK,SAAAA,GAC3BJ,OAAOG,QAAQJ,WAAWK;GAAAA,OAE3B;IACH,MAAM,CAACC,KAAKC,eAAeF;IAE3B,IAAIpC,eAAe+B,YAAYM,GAAAA,GAC3BL,OAAOG,QAAQG,YAAYP,WAAWM,IAAI;GAElD;EACJ;EAEA,OAAOL;CACX;AACJ"}
+{"version":3,"file":"claims.mjs","names":["hasOwnProperty","OAuth2SubKind","OAuth2OpenIDClaimsBuilder","clientMap","name","nickname","preferred_username","updated_at","value","Math","floor","Date","getTime","userMap","family_name","given_name","email","email_verified","fromIdentity","identity","type","CLIENT","fromClient","data","fromUser","input","extract","attributeMap","attributes","result","keys","Object","key_","attribute","key","transformer"],"sources":["../../../../src/core/oauth2/openid/claims.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Client, \n    Identity, \n    User,\n} from '@authup/core-kit';\nimport { hasOwnProperty } from '@authup/kit';\nimport type { OpenIDTokenPayload } from '@authup/specs';\nimport { OAuth2SubKind } from '@authup/specs';\nimport type { ObjectLiteral } from 'validup';\n\ntype AttributeMapTuple<T> = {\n    [K in keyof T]: [K, (value: unknown) => any]\n}[keyof T];\n\ntype AttributeMap<T extends Record<string, any>> = Record<\n    keyof OpenIDTokenPayload,\nkeyof T | AttributeMapTuple<T>\n>;\n\nexport class OAuth2OpenIDClaimsBuilder {\n    protected clientMap : AttributeMap<Client> = {\n        name: 'name',\n        nickname: 'name',\n        preferred_username: 'name',\n        updated_at: [\n            'updatedAt',\n            (value: unknown) => {\n                if (typeof value === 'string') {\n                    return Math.floor(new Date(value).getTime() / 1000);\n                }\n\n                return value;\n            },\n        ],\n    };\n\n    protected userMap : AttributeMap<User> = {\n        name: 'name',\n        family_name: 'lastName',\n        given_name: 'firstName',\n        nickname: 'displayName',\n        preferred_username: 'displayName',\n        updated_at: [\n            'updatedAt',\n            (value: unknown) => {\n                if (typeof value === 'string') {\n                    return Math.floor(new Date(value).getTime() / 1000);\n                }\n\n                return value;\n            },\n        ],\n\n        email: 'email',\n        email_verified: 'active',\n    };\n\n    /**\n     * Build OpenID Claims form Oauth2 Identity.\n     *\n     * @param identity\n     */\n    fromIdentity(identity: Identity) : OpenIDTokenPayload {\n        if (identity.type === OAuth2SubKind.CLIENT) {\n            return this.fromClient(identity.data);\n        }\n\n        return this.fromUser(identity.data);\n    }\n\n    fromClient(input: Client) : OpenIDTokenPayload {\n        return this.extract(this.clientMap, input);\n    }\n\n    fromUser(input: User) : OpenIDTokenPayload {\n        return this.extract(this.userMap, input);\n    }\n\n    protected extract<T extends ObjectLiteral = ObjectLiteral>(\n        attributeMap: AttributeMap<T>,\n        attributes: T,\n    ) : OpenIDTokenPayload {\n        const result = {} as OpenIDTokenPayload;\n\n        const keys = Object.keys(attributeMap);\n        for (const key_ of keys) {\n            const attribute = attributeMap[key_];\n            if (typeof attribute === 'string') {\n                if (hasOwnProperty(attributes, attribute)) {\n                    result[key_] = attributes[attribute];\n                }\n            } else {\n                const [key, transformer] = attribute as AttributeMapTuple<T>;\n\n                if (hasOwnProperty(attributes, key)) {\n                    result[key_] = transformer(attributes[key]);\n                }\n            }\n        }\n\n        return result;\n    }\n}\n"],"mappings":";;;;;;AA0BA,IAAaE,4BAAb,MAAaA;CACCC,YAAmC;EACzCC,MAAM;EACNC,UAAU;EACVC,oBAAoB;EACpBC,YAAY,CACR,cACCC,UAAAA;GACG,IAAI,OAAOA,UAAU,UACjB,OAAOC,KAAKC,MAAM,IAAIC,KAAKH,KAAAA,CAAAA,CAAOI,QAAO,IAAK,GAAA;GAGlD,OAAOJ;EACX,CAAA;CAER;CAEUK,UAA+B;EACrCT,MAAM;EACNU,aAAa;EACbC,YAAY;EACZV,UAAU;EACVC,oBAAoB;EACpBC,YAAY,CACR,cACCC,UAAAA;GACG,IAAI,OAAOA,UAAU,UACjB,OAAOC,KAAKC,MAAM,IAAIC,KAAKH,KAAAA,CAAAA,CAAOI,QAAO,IAAK,GAAA;GAGlD,OAAOJ;EACX,CAAA;EAGJQ,OAAO;EACPC,gBAAgB;CACpB;;;;;IAOAC,aAAaC,UAAyC;EAClD,IAAIA,SAASC,SAASnB,cAAcoB,QAChC,OAAO,KAAKC,WAAWH,SAASI,IAAI;EAGxC,OAAO,KAAKC,SAASL,SAASI,IAAI;CACtC;CAEAD,WAAWG,OAAoC;EAC3C,OAAO,KAAKC,QAAQ,KAAKvB,WAAWsB,KAAAA;CACxC;CAEAD,SAASC,OAAkC;EACvC,OAAO,KAAKC,QAAQ,KAAKb,SAASY,KAAAA;CACtC;CAEUC,QACNC,cACAC,YACmB;EACnB,MAAMC,SAAS,CAAC;EAEhB,MAAMC,OAAOC,OAAOD,KAAKH,YAAAA;EACzB,KAAK,MAAMK,QAAQF,MAAM;GACrB,MAAMG,YAAYN,aAAaK;GAC/B,IAAI,OAAOC,cAAc;QACjBjC,eAAe4B,YAAYK,SAAAA,GAC3BJ,OAAOG,QAAQJ,WAAWK;GAAAA,OAE3B;IACH,MAAM,CAACC,KAAKC,eAAeF;IAE3B,IAAIjC,eAAe4B,YAAYM,GAAAA,GAC3BL,OAAOG,QAAQG,YAAYP,WAAWM,IAAI;GAElD;EACJ;EAEA,OAAOL;CACX;AACJ"}

package/dist/core/oauth2/scope/resolver.d.ts

@@ -1,4 +1,4 @@
-import type { Client, Robot, User } from '@authup/core-kit';
+import type { Client, User } from '@authup/core-kit';
 import { OAuth2SubKind } from '@authup/specs';
 import type { ObjectLiteral } from 'validup';
 type ScopeFields<T extends ObjectLiteral = ObjectLiteral> = {
@@ -6,7 +6,6 @@ type ScopeFields<T extends ObjectLiteral = ObjectLiteral> = {
 };
 export declare class OAuth2ScopeAttributesResolver {
     protected clientAttributes: ScopeFields<Client>;
-    protected robotAttributes: ScopeFields<Robot>;
     protected userAttributes: ScopeFields<User>;
     /**
      * Resolve attributes for sub kind.
@@ -16,7 +15,6 @@ export declare class OAuth2ScopeAttributesResolver {
      */
     resolveFor(type: OAuth2SubKind, scope: string | string[]): string[];
     resolveForClient(scope: string | string[]): string[];
-    resolveForRobot(scope: string | string[]): string[];
     resolveForUser(scope: string | string[]): string[];
 }
 export {};

package/dist/core/oauth2/scope/resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/scope/resolver.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAG5D,OAAO,EAAE,aAAa,EAAqB,MAAM,eAAe,CAAC;AAEjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C,KAAK,WAAW,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa,IAAI;IACxD,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAA;CACtC,CAAC;AAEF,qBAAa,6BAA6B;IACtC,SAAS,CAAC,gBAAgB,EAAG,WAAW,CAAC,MAAM,CAAC,CAG9C;IAEF,SAAS,CAAC,eAAe,EAAG,WAAW,CAAC,KAAK,CAAC,CAG5C;IAEF,SAAS,CAAC,cAAc,EAAG,WAAW,CAAC,IAAI,CAAC,CAI1C;IAEF;;;;;OAKG;IACH,UAAU,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE;IAYxD,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAI,MAAM,EAAE;IAkBrD,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAI,MAAM,EAAE;IAkBpD,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAI,MAAM,EAAE;CAiBtD"}
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/scope/resolver.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAGrD,OAAO,EAAE,aAAa,EAAqB,MAAM,eAAe,CAAC;AAEjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C,KAAK,WAAW,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa,IAAI;IACxD,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAA;CACtC,CAAC;AAEF,qBAAa,6BAA6B;IACtC,SAAS,CAAC,gBAAgB,EAAG,WAAW,CAAC,MAAM,CAAC,CAG9C;IAEF,SAAS,CAAC,cAAc,EAAG,WAAW,CAAC,IAAI,CAAC,CAI1C;IAEF;;;;;OAKG;IACH,UAAU,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE;IAQxD,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAI,MAAM,EAAE;IAkBrD,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAI,MAAM,EAAE;CAiBtD"}