npm - @authup/server-core - Versions diffs - 1.0.0-beta.53 → 1.0.0-beta.54 - Mend

@authup/server-core 1.0.0-beta.53 → 1.0.0-beta.54

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1152) hide show

package/dist/adapters/database/migrations/postgres/1784460916000-RemoveRobots.mjs ADDED Viewed

@@ -0,0 +1,167 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/adapters/database/migrations/postgres/1784460916000-RemoveRobots.ts
+/**
+* Drops the robot entity: auth_robots, auth_robot_roles,
+* auth_robot_permissions, auth_sessions.robot_id and the dangling robot
+* FKs on the legacy auth_refresh_tokens / auth_authorization_codes
+* tables. Robots are superseded by clients (client_credentials grant);
+* robot rows and their role/permission bindings are NOT migrated onto
+* clients — recreate machine identities as clients by hand.
+*
+* down() recreates the pre-removal schema shape, constraint names
+* included, so the older migrations' down() paths keep working.
+*/ var RemoveRobots1784460916000 = class {
+	name = "RemoveRobots1784460916000";
+	async up(queryRunner) {
+		await queryRunner.query(`
+            ALTER TABLE "auth_sessions" DROP CONSTRAINT "FK_46b30e5d8e5d5de58d454f53f8c"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_sessions" DROP COLUMN "robot_id"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_refresh_tokens" DROP CONSTRAINT "FK_6be38b6dbd4ce86ca3d17494ca9"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_authorization_codes" DROP CONSTRAINT "FK_32619f36922f433e27affc169e4"
+        `);
+		await queryRunner.query(`
+            DROP TABLE "auth_robot_permissions"
+        `);
+		await queryRunner.query(`
+            DROP TABLE "auth_robot_roles"
+        `);
+		await queryRunner.query(`
+            DROP TABLE "auth_robots"
+        `);
+	}
+	async down(queryRunner) {
+		await queryRunner.query(`
+            CREATE TABLE "auth_robots" (
+                "id" uuid NOT NULL DEFAULT uuid_generate_v4(),
+                "secret" character varying(256) NOT NULL,
+                "name" character varying(128) NOT NULL,
+                "description" text,
+                "active" boolean NOT NULL DEFAULT true,
+                "created_at" TIMESTAMP NOT NULL DEFAULT now(),
+                "updated_at" TIMESTAMP NOT NULL DEFAULT now(),
+                "user_id" uuid,
+                "realm_id" uuid NOT NULL,
+                "display_name" character varying(256),
+                "client_id" uuid,
+                CONSTRAINT "UQ_f89cc2abf1d7e284a7d6cd59c12" UNIQUE ("name", "realm_id"),
+                CONSTRAINT "PK_0417c432636b2b07e36aedd9804" PRIMARY KEY ("id")
+            )
+        `);
+		await queryRunner.query(`
+            CREATE INDEX "IDX_9c99802f3f360718344180c3f6" ON "auth_robots" ("realm_id")
+        `);
+		await queryRunner.query(`
+            CREATE INDEX "IDX_91942a5962da3b91175eeaa2db" ON "auth_robots" ("client_id")
+        `);
+		await queryRunner.query(`
+            CREATE TABLE "auth_robot_roles" (
+                "id" uuid NOT NULL DEFAULT uuid_generate_v4(),
+                "role_id" uuid NOT NULL,
+                "role_realm_id" uuid,
+                "robot_id" character varying NOT NULL,
+                "robot_realm_id" uuid,
+                "created_at" TIMESTAMP NOT NULL DEFAULT now(),
+                "updated_at" TIMESTAMP NOT NULL DEFAULT now(),
+                "client_id" uuid,
+                CONSTRAINT "PK_6d175a60a9ac83747b28fa8bc6f" PRIMARY KEY ("id")
+            )
+        `);
+		await queryRunner.query(`
+            CREATE UNIQUE INDEX "IDX_515b3dc84ba9bec42bd0e92cbd" ON "auth_robot_roles" ("role_id", "robot_id")
+        `);
+		await queryRunner.query(`
+            CREATE TABLE "auth_robot_permissions" (
+                "id" uuid NOT NULL DEFAULT uuid_generate_v4(),
+                "robot_id" uuid NOT NULL,
+                "robot_realm_id" uuid,
+                "permission_id" uuid NOT NULL,
+                "permission_realm_id" uuid,
+                "created_at" TIMESTAMP NOT NULL DEFAULT now(),
+                "updated_at" TIMESTAMP NOT NULL DEFAULT now(),
+                "policy_id" uuid,
+                "realm_scope" character varying(50) NOT NULL DEFAULT 'own',
+                CONSTRAINT "PK_df48d512c182954136955472327" PRIMARY KEY ("id")
+            )
+        `);
+		await queryRunner.query(`
+            CREATE UNIQUE INDEX "IDX_0c2284272043ed8aba6689306b" ON "auth_robot_permissions" ("permission_id", "robot_id")
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_robots"
+            ADD CONSTRAINT "FK_b6d73e3026e15c0af6c41ef8139" FOREIGN KEY ("user_id") REFERENCES "auth_users"("id") ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_robots"
+            ADD CONSTRAINT "FK_9c99802f3f360718344180c3f68" FOREIGN KEY ("realm_id") REFERENCES "auth_realms"("id") ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_robots"
+            ADD CONSTRAINT "FK_91942a5962da3b91175eeaa2db1" FOREIGN KEY ("client_id") REFERENCES "auth_realms"("id") ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_robot_roles"
+            ADD CONSTRAINT "FK_2256b04cbdb1e16e5144e14750b" FOREIGN KEY ("role_id") REFERENCES "auth_roles"("id") ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_robot_roles"
+            ADD CONSTRAINT "FK_28146c7babddcad18116dabfa9e" FOREIGN KEY ("role_realm_id") REFERENCES "auth_realms"("id") ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_robot_roles"
+            ADD CONSTRAINT "FK_a4904e9c921294c80f75a0c3e02" FOREIGN KEY ("client_id") REFERENCES "auth_robots"("id") ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_robot_roles"
+            ADD CONSTRAINT "FK_21994ec834c710276cce38c779d" FOREIGN KEY ("robot_realm_id") REFERENCES "auth_realms"("id") ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_robot_permissions"
+            ADD CONSTRAINT "FK_5af2884572a617e2532410f8221" FOREIGN KEY ("robot_id") REFERENCES "auth_robots"("id") ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_robot_permissions"
+            ADD CONSTRAINT "FK_d52ab826ee04e008624df74cdc8" FOREIGN KEY ("robot_realm_id") REFERENCES "auth_realms"("id") ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_robot_permissions"
+            ADD CONSTRAINT "FK_b29fe901137f6944ecaf98fcb5a" FOREIGN KEY ("permission_id") REFERENCES "auth_permissions"("id") ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_robot_permissions"
+            ADD CONSTRAINT "FK_1cacb8af1791a5303d30cbf8590" FOREIGN KEY ("permission_realm_id") REFERENCES "auth_realms"("id") ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_robot_permissions"
+            ADD CONSTRAINT "FK_0786e0bee54b581c62d79a8cec7" FOREIGN KEY ("policy_id") REFERENCES "auth_policies"("id") ON DELETE
+            SET NULL ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_sessions"
+            ADD "robot_id" uuid
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_sessions"
+            ADD CONSTRAINT "FK_46b30e5d8e5d5de58d454f53f8c" FOREIGN KEY ("robot_id") REFERENCES "auth_robots"("id") ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_refresh_tokens"
+            ADD CONSTRAINT "FK_6be38b6dbd4ce86ca3d17494ca9" FOREIGN KEY ("robot_id") REFERENCES "auth_robots"("id") ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_authorization_codes"
+            ADD CONSTRAINT "FK_32619f36922f433e27affc169e4" FOREIGN KEY ("robot_id") REFERENCES "auth_robots"("id") ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+	}
+};
+//#endregion
+export { RemoveRobots1784460916000 };
+//# sourceMappingURL=1784460916000-RemoveRobots.mjs.map

package/dist/adapters/database/migrations/postgres/1784460916000-RemoveRobots.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"1784460916000-RemoveRobots.mjs","names":["RemoveRobots1784460916000","name","up","queryRunner","query","down"],"sources":["../../../../../src/adapters/database/migrations/postgres/1784460916000-RemoveRobots.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { MigrationInterface, QueryRunner } from 'typeorm';\n\n/**\n * Drops the robot entity: auth_robots, auth_robot_roles,\n * auth_robot_permissions, auth_sessions.robot_id and the dangling robot\n * FKs on the legacy auth_refresh_tokens / auth_authorization_codes\n * tables. Robots are superseded by clients (client_credentials grant);\n * robot rows and their role/permission bindings are NOT migrated onto\n * clients — recreate machine identities as clients by hand.\n *\n * down() recreates the pre-removal schema shape, constraint names\n * included, so the older migrations' down() paths keep working.\n */\nexport class RemoveRobots1784460916000 implements MigrationInterface {\n name = 'RemoveRobots1784460916000';\n\n public async up(queryRunner: QueryRunner): Promise<void> {\n await queryRunner.query(`\n ALTER TABLE \"auth_sessions\" DROP CONSTRAINT \"FK_46b30e5d8e5d5de58d454f53f8c\"\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_sessions\" DROP COLUMN \"robot_id\"\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_refresh_tokens\" DROP CONSTRAINT \"FK_6be38b6dbd4ce86ca3d17494ca9\"\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_authorization_codes\" DROP CONSTRAINT \"FK_32619f36922f433e27affc169e4\"\n `);\n await queryRunner.query(`\n DROP TABLE \"auth_robot_permissions\"\n `);\n await queryRunner.query(`\n DROP TABLE \"auth_robot_roles\"\n `);\n await queryRunner.query(`\n DROP TABLE \"auth_robots\"\n `);\n }\n\n public async down(queryRunner: QueryRunner): Promise<void> {\n await queryRunner.query(`\n CREATE TABLE \"auth_robots\" (\n \"id\" uuid NOT NULL DEFAULT uuid_generate_v4(),\n \"secret\" character varying(256) NOT NULL,\n \"name\" character varying(128) NOT NULL,\n \"description\" text,\n \"active\" boolean NOT NULL DEFAULT true,\n \"created_at\" TIMESTAMP NOT NULL DEFAULT now(),\n \"updated_at\" TIMESTAMP NOT NULL DEFAULT now(),\n \"user_id\" uuid,\n \"realm_id\" uuid NOT NULL,\n \"display_name\" character varying(256),\n \"client_id\" uuid,\n CONSTRAINT \"UQ_f89cc2abf1d7e284a7d6cd59c12\" UNIQUE (\"name\", \"realm_id\"),\n CONSTRAINT \"PK_0417c432636b2b07e36aedd9804\" PRIMARY KEY (\"id\")\n )\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_9c99802f3f360718344180c3f6\" ON \"auth_robots\" (\"realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_91942a5962da3b91175eeaa2db\" ON \"auth_robots\" (\"client_id\")\n `);\n await queryRunner.query(`\n CREATE TABLE \"auth_robot_roles\" (\n \"id\" uuid NOT NULL DEFAULT uuid_generate_v4(),\n \"role_id\" uuid NOT NULL,\n \"role_realm_id\" uuid,\n \"robot_id\" character varying NOT NULL,\n \"robot_realm_id\" uuid,\n \"created_at\" TIMESTAMP NOT NULL DEFAULT now(),\n \"updated_at\" TIMESTAMP NOT NULL DEFAULT now(),\n \"client_id\" uuid,\n CONSTRAINT \"PK_6d175a60a9ac83747b28fa8bc6f\" PRIMARY KEY (\"id\")\n )\n `);\n await queryRunner.query(`\n CREATE UNIQUE INDEX \"IDX_515b3dc84ba9bec42bd0e92cbd\" ON \"auth_robot_roles\" (\"role_id\", \"robot_id\")\n `);\n await queryRunner.query(`\n CREATE TABLE \"auth_robot_permissions\" (\n \"id\" uuid NOT NULL DEFAULT uuid_generate_v4(),\n \"robot_id\" uuid NOT NULL,\n \"robot_realm_id\" uuid,\n \"permission_id\" uuid NOT NULL,\n \"permission_realm_id\" uuid,\n \"created_at\" TIMESTAMP NOT NULL DEFAULT now(),\n \"updated_at\" TIMESTAMP NOT NULL DEFAULT now(),\n \"policy_id\" uuid,\n \"realm_scope\" character varying(50) NOT NULL DEFAULT 'own',\n CONSTRAINT \"PK_df48d512c182954136955472327\" PRIMARY KEY (\"id\")\n )\n `);\n await queryRunner.query(`\n CREATE UNIQUE INDEX \"IDX_0c2284272043ed8aba6689306b\" ON \"auth_robot_permissions\" (\"permission_id\", \"robot_id\")\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_robots\"\n ADD CONSTRAINT \"FK_b6d73e3026e15c0af6c41ef8139\" FOREIGN KEY (\"user_id\") REFERENCES \"auth_users\"(\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_robots\"\n ADD CONSTRAINT \"FK_9c99802f3f360718344180c3f68\" FOREIGN KEY (\"realm_id\") REFERENCES \"auth_realms\"(\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_robots\"\n ADD CONSTRAINT \"FK_91942a5962da3b91175eeaa2db1\" FOREIGN KEY (\"client_id\") REFERENCES \"auth_realms\"(\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_robot_roles\"\n ADD CONSTRAINT \"FK_2256b04cbdb1e16e5144e14750b\" FOREIGN KEY (\"role_id\") REFERENCES \"auth_roles\"(\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_robot_roles\"\n ADD CONSTRAINT \"FK_28146c7babddcad18116dabfa9e\" FOREIGN KEY (\"role_realm_id\") REFERENCES \"auth_realms\"(\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_robot_roles\"\n ADD CONSTRAINT \"FK_a4904e9c921294c80f75a0c3e02\" FOREIGN KEY (\"client_id\") REFERENCES \"auth_robots\"(\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_robot_roles\"\n ADD CONSTRAINT \"FK_21994ec834c710276cce38c779d\" FOREIGN KEY (\"robot_realm_id\") REFERENCES \"auth_realms\"(\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_robot_permissions\"\n ADD CONSTRAINT \"FK_5af2884572a617e2532410f8221\" FOREIGN KEY (\"robot_id\") REFERENCES \"auth_robots\"(\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_robot_permissions\"\n ADD CONSTRAINT \"FK_d52ab826ee04e008624df74cdc8\" FOREIGN KEY (\"robot_realm_id\") REFERENCES \"auth_realms\"(\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_robot_permissions\"\n ADD CONSTRAINT \"FK_b29fe901137f6944ecaf98fcb5a\" FOREIGN KEY (\"permission_id\") REFERENCES \"auth_permissions\"(\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_robot_permissions\"\n ADD CONSTRAINT \"FK_1cacb8af1791a5303d30cbf8590\" FOREIGN KEY (\"permission_realm_id\") REFERENCES \"auth_realms\"(\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_robot_permissions\"\n ADD CONSTRAINT \"FK_0786e0bee54b581c62d79a8cec7\" FOREIGN KEY (\"policy_id\") REFERENCES \"auth_policies\"(\"id\") ON DELETE\n SET NULL ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_sessions\"\n ADD \"robot_id\" uuid\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_sessions\"\n ADD CONSTRAINT \"FK_46b30e5d8e5d5de58d454f53f8c\" FOREIGN KEY (\"robot_id\") REFERENCES \"auth_robots\"(\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_refresh_tokens\"\n ADD CONSTRAINT \"FK_6be38b6dbd4ce86ca3d17494ca9\" FOREIGN KEY (\"robot_id\") REFERENCES \"auth_robots\"(\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_authorization_codes\"\n ADD CONSTRAINT \"FK_32619f36922f433e27affc169e4\" FOREIGN KEY (\"robot_id\") REFERENCES \"auth_robots\"(\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n }\n}\n"],"mappings":";;;;;;;;;;;;;;GAoBA,IAAaA,4BAAb,MAAaA;CACTC,OAAO;CAEP,MAAaC,GAAGC,aAAyC;EACrD,MAAMA,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;CACL;CAEA,MAAaC,KAAKF,aAAyC;EACvD,MAAMA,YAAYC,MAAM;;;;;;;;;;;;;;;;SAgBvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;;;;;;;;;;;SAYvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;;;;;;;;;;;;SAavB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;;SAIvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;CACL;AACJ"}

package/dist/adapters/http/adapters/index.mjs CHANGED Viewed

@@ -11,6 +11,5 @@ import { HTTPClientCredentialsGrant } from "./oauth2/grant-types/client-credenti
 import { HTTPOAuth2IdentityGrantType } from "./oauth2/grant-types/identity.mjs";
 import { HTTPPasswordGrant } from "./oauth2/grant-types/password.mjs";
 import { HTTPOAuth2RefreshTokenGrant } from "./oauth2/grant-types/refresh_token.mjs";
-import { HTTPRobotCredentialsGrant } from "./oauth2/grant-types/robot-credentials.mjs";
 import "./oauth2/index.mjs";
-export { HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, guessOauth2GrantTypeByRequest, readRealmHint, readStringField };
+export { HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, guessOauth2GrantTypeByRequest, readRealmHint, readStringField };

package/dist/adapters/http/adapters/oauth2/authorization/module.mjs CHANGED Viewed

@@ -30,10 +30,10 @@ var HTTPOAuth2Authorizer = class extends OAuth2Authorization {
 			client,
 			redirectUriVerified
 		});
-		if (this.consentService && client && !client.built_in) try {
+		if (this.consentService && client && !client.builtIn) try {
 			await this.consentService.record({
 				clientId: client.id,
-				realmId: client.realm_id,
+				realmId: client.realmId,
 				owner: {
 					sub: identity.raw.data.id,
 					subKind: identity.raw.type

package/dist/adapters/http/adapters/oauth2/authorization/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["OAuth2Authorization","OAuth2AuthorizationCodeRequestValidator","readFromLocations","useRequestIdentityOrFail","useRequestSessionId","HTTPOAuth2Authorizer","codeRequestVerifier","requestValidator","consentService","logger","ctx","authorizeWithRequest","event","codeRequestValidated","validateWithRequest","data","client","redirectUriVerified","verify","identity","result","authorize","raw","sessionId","~~built_in~~","record","clientId","id","realmId","~~realm_id","~~owner","sub","subKind","type","scope","e","warn","error","run"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/authorization/module.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { IAppEvent } from 'routup';\nimport type { Logger } from '@authup/server-kit';\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport type { IConsentService, IOAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationResult } from '../../../../../core/index.ts';\nimport { OAuth2Authorization, OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';\nimport { readFromLocations, useRequestIdentityOrFail, useRequestSessionId } from '../../../request/index.ts';\nimport type { HTTPOAuth2AuthorizationManagerContext } from './types.ts';\n\nexport class HTTPOAuth2Authorizer extends OAuth2Authorization {\n protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n protected requestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n protected consentService? : IConsentService;\n\n protected logger? : Logger;\n\n constructor(ctx: HTTPOAuth2AuthorizationManagerContext) {\n super(ctx);\n\n this.codeRequestVerifier = ctx.codeRequestVerifier;\n this.consentService = ctx.consentService;\n this.logger = ctx.logger;\n\n this.requestValidator = new OAuth2AuthorizationCodeRequestValidator();\n }\n\n async authorizeWithRequest(event: IAppEvent) : Promise<OAuth2AuthorizationResult> {\n const codeRequestValidated = await this.validateWithRequest(event);\n\n const {\n data,\n client,\n redirectUriVerified,\n } = await this.codeRequestVerifier.verify(codeRequestValidated);\n\n const identity = useRequestIdentityOrFail(event);\n\n const result = await this.authorize(data, identity.raw, {\n sessionId: useRequestSessionId(event),\n client,\n redirectUriVerified,\n });\n\n // Persisted per-scope consent (plan 055): recorded only after a\n // successful approval — an access-policy denial throws inside\n // authorize() above, so a denied identity never writes a row.\n // built_in clients keep zero rows (locked); insert-missing makes\n // re-recording idempotent (union/keep).\n if (this.consentService && client && !client.~~built_in~~) {\n try {\n await this.consentService.record({\n clientId: client.id,\n realmId: client.~~realm_id~~,\n owner: {\n sub: identity.raw.data.id,\n subKind: identity.raw.type,\n },\n scope: data.scope ?? null,\n });\n } catch (e) {\n // never fail an issued code over a consent-write failure\n this.logger?.warn('Recording the OAuth2 consent grant failed.', {\n clientId: client.id,\n error: e,\n });\n }\n }\n\n return result;\n }\n\n /\n Validate authorization request.\n \n @throws OAuth2Error\n */\n async validateWithRequest(\n event: IAppEvent,\n ) : Promise<OAuth2AuthorizationCodeRequest> {\n const data = await readFromLocations(event, ['body', 'query']);\n return this.requestValidator.run(data);\n }\n}\n"],"mappings":";;;;;;;;;;;AAeA,IAAaK,uBAAb,cAA0CL,oBAAAA;CAC5BM;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA4C;EACpD,MAAMA,GAAAA;EAEN,KAAKJ,sBAAsBI,IAAIJ;EAC/B,KAAKE,iBAAiBE,IAAIF;EAC1B,KAAKC,SAASC,IAAID;EAElB,KAAKF,mBAAmB,IAAIN,wCAAAA;CAChC;CAEA,MAAMU,qBAAqBC,OAAuD;EAC9E,MAAMC,uBAAuB,MAAM,KAAKC,oBAAoBF,KAAAA;EAE5D,MAAM,EACFG,MACAC,QACAC,wBACA,MAAM,KAAKX,oBAAoBY,OAAOL,oBAAAA;EAE1C,MAAMM,WAAWhB,yBAAyBS,KAAAA;EAE1C,MAAMQ,SAAS,MAAM,KAAKC,UAAUN,MAAMI,SAASG,KAAK;GACpDC,WAAWnB,oBAAoBQ,KAAAA;GAC/BI;GACAC;EACJ,CAAA;EAOA,IAAI,KAAKT,kBAAkBQ,UAAU,CAACA,OAAOQ,~~UACzC~~,IAAI;GACA,MAAM,KAAKhB,eAAeiB,OAAO;IAC7BC,UAAUV,OAAOW;IACjBC,SAASZ,~~OAAOa~~;IAChBC,OAAO;KACHC,~~KAAKZ~~,SAASG,IAAIP,KAAKY;~~KACvBK~~,~~SAASb~~,SAASG,~~IAAIW~~;IAC1B;IACAC,~~OAAOnB~~,~~KAAKmB~~,SAAS;GACzB,CAAA;EACJ,SAASC,GAAG;GAER,~~KAAK1B~~,~~QAAQ2B~~,KAAK,8CAA8C;~~IAC5DV~~,UAAUV,OAAOW;~~IACjBU~~,OAAOF;GACX,CAAA;EACJ;EAGJ,~~OAAOf~~;CACX;;;;;IAOA,MAAMN,oBACFF,OACwC;EACxC,MAAMG,OAAO,MAAMb,kBAAkBU,OAAO,CAAC,QAAQ,OAAA,CAAQ;EAC7D,OAAO,KAAKL,~~iBAAiB+B~~,~~IAAIvB~~,IAAAA;CACrC;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["OAuth2Authorization","OAuth2AuthorizationCodeRequestValidator","readFromLocations","useRequestIdentityOrFail","useRequestSessionId","HTTPOAuth2Authorizer","codeRequestVerifier","requestValidator","consentService","logger","ctx","authorizeWithRequest","event","codeRequestValidated","validateWithRequest","data","client","redirectUriVerified","verify","identity","result","authorize","raw","sessionId","builtIn","record","clientId","id","realmId","owner","sub","subKind","type","scope","e","warn","error","run"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/authorization/module.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { IAppEvent } from 'routup';\nimport type { Logger } from '@authup/server-kit';\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport type { IConsentService, IOAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationResult } from '../../../../../core/index.ts';\nimport { OAuth2Authorization, OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';\nimport { readFromLocations, useRequestIdentityOrFail, useRequestSessionId } from '../../../request/index.ts';\nimport type { HTTPOAuth2AuthorizationManagerContext } from './types.ts';\n\nexport class HTTPOAuth2Authorizer extends OAuth2Authorization {\n protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n protected requestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n protected consentService? : IConsentService;\n\n protected logger? : Logger;\n\n constructor(ctx: HTTPOAuth2AuthorizationManagerContext) {\n super(ctx);\n\n this.codeRequestVerifier = ctx.codeRequestVerifier;\n this.consentService = ctx.consentService;\n this.logger = ctx.logger;\n\n this.requestValidator = new OAuth2AuthorizationCodeRequestValidator();\n }\n\n async authorizeWithRequest(event: IAppEvent) : Promise<OAuth2AuthorizationResult> {\n const codeRequestValidated = await this.validateWithRequest(event);\n\n const {\n data,\n client,\n redirectUriVerified,\n } = await this.codeRequestVerifier.verify(codeRequestValidated);\n\n const identity = useRequestIdentityOrFail(event);\n\n const result = await this.authorize(data, identity.raw, {\n sessionId: useRequestSessionId(event),\n client,\n redirectUriVerified,\n });\n\n // Persisted per-scope consent (plan 055): recorded only after a\n // successful approval — an access-policy denial throws inside\n // authorize() above, so a denied identity never writes a row.\n // built_in clients keep zero rows (locked); insert-missing makes\n // re-recording idempotent (union/keep).\n if (this.consentService && client && !client.builtIn) {\n try {\n await this.consentService.record({\n clientId: client.id,\n realmId: client.realmId,\n owner: {\n sub: identity.raw.data.id,\n subKind: identity.raw.type,\n },\n scope: data.scope ?? null,\n });\n } catch (e) {\n // never fail an issued code over a consent-write failure\n this.logger?.warn('Recording the OAuth2 consent grant failed.', {\n clientId: client.id,\n error: e,\n });\n }\n }\n\n return result;\n }\n\n /\n Validate authorization request.\n \n @throws OAuth2Error\n */\n async validateWithRequest(\n event: IAppEvent,\n ) : Promise<OAuth2AuthorizationCodeRequest> {\n const data = await readFromLocations(event, ['body', 'query']);\n return this.requestValidator.run(data);\n }\n}\n"],"mappings":";;;;;;;;;;;AAeA,IAAaK,uBAAb,cAA0CL,oBAAAA;CAC5BM;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA4C;EACpD,MAAMA,GAAAA;EAEN,KAAKJ,sBAAsBI,IAAIJ;EAC/B,KAAKE,iBAAiBE,IAAIF;EAC1B,KAAKC,SAASC,IAAID;EAElB,KAAKF,mBAAmB,IAAIN,wCAAAA;CAChC;CAEA,MAAMU,qBAAqBC,OAAuD;EAC9E,MAAMC,uBAAuB,MAAM,KAAKC,oBAAoBF,KAAAA;EAE5D,MAAM,EACFG,MACAC,QACAC,wBACA,MAAM,KAAKX,oBAAoBY,OAAOL,oBAAAA;EAE1C,MAAMM,WAAWhB,yBAAyBS,KAAAA;EAE1C,MAAMQ,SAAS,MAAM,KAAKC,UAAUN,MAAMI,SAASG,KAAK;GACpDC,WAAWnB,oBAAoBQ,KAAAA;GAC/BI;GACAC;EACJ,CAAA;EAOA,IAAI,KAAKT,kBAAkBQ,UAAU,CAACA,OAAOQ,SACzC,IAAI;GACA,MAAM,KAAKhB,eAAeiB,OAAO;IAC7BC,UAAUV,OAAOW;IACjBC,SAASZ,OAAOY;IAChBC,OAAO;KACHC,KAAKX,SAASG,IAAIP,KAAKY;KACvBI,SAASZ,SAASG,IAAIU;IAC1B;IACAC,OAAOlB,KAAKkB,SAAS;GACzB,CAAA;EACJ,SAASC,GAAG;GAER,KAAKzB,QAAQ0B,KAAK,8CAA8C;IAC5DT,UAAUV,OAAOW;IACjBS,OAAOF;GACX,CAAA;EACJ;EAGJ,OAAOd;CACX;;;;;IAOA,MAAMN,oBACFF,OACwC;EACxC,MAAMG,OAAO,MAAMb,kBAAkBU,OAAO,CAAC,QAAQ,OAAA,CAAQ;EAC7D,OAAO,KAAKL,iBAAiB8B,IAAItB,IAAAA;CACrC;AACJ"}

package/dist/adapters/http/adapters/oauth2/grant-types/authorize.mjs CHANGED Viewed

@@ -46,11 +46,11 @@ var HTTPOAuth2AuthorizeGrant = class extends OAuth2AuthorizeGrant {
 			codeVerifier,
 			clientId: client.id,
 			clientIsPublic: isClientPublic(client),
-			realmId: client.realm_id
+			realmId: client.realmId
 		});
-		if (client.access_policy_id) {
+		if (client.accessPolicyId) {
 			let allowed = false;
-			if (this.accessPolicyEvaluator) allowed = await this.accessPolicyEvaluator.evaluate(client.access_policy_id, {
+			if (this.accessPolicyEvaluator) allowed = await this.accessPolicyEvaluator.evaluate(client.accessPolicyId, {
 				type: entity.sub_kind,
 				id: entity.sub,
 				realmId: entity.realm_id ?? null,

package/dist/adapters/http/adapters/oauth2/grant-types/authorize.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"authorize.mjs","names":["isClientPublic","OAuth2GrantError","OAuth2RequestError","OAuth2TokenGrant","readRequestBody","useRequestQuery","getRequestHeader","getRequestIP","OAuth2AuthorizeGrant","assertClientGrantAllowed","extractClientCredentialsFromRequest","extractOAuth2ClientCertificateEvidence","readRealmHint","HTTPOAuth2AuthorizeGrant","codeVerifier","clientAuthenticator","realmRepository","accessPolicyEvaluator","certificateSource","ctx","runWithRequest","event","body","query","code","pickStringParam","redirectUri","malformed","clientId","clientSecret","realm","resolve","certificateEvidence","client","authenticate","id","confirmation","resolveTokenBinding","AUTHORIZATION_CODE","entity","verify","clientIsPublic","realmId","~~realm_id~~","~~access_policy_id","~~allowed","evaluate","type","sub_kind","sub","realmName","realm_name","client_id","invalid","runWith","ipAddress","trustProxy","undefined","userAgent","key","value","length"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/authorize.ts"],"sourcesContent":["/\n Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { isClientPublic } from '@authup/core-kit';\nimport { OAuth2GrantError, OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport { OAuth2AuthorizeGrant, assertClientGrantAllowed } from '../../../../../core/index.ts';\nimport type {\n IOAuth2AccessPolicyEvaluator,\n IOAuth2AuthorizationCodeVerifier,\n IRealmRepository,\n OAuth2ClientAuthenticator,\n} from '../../../../../core/index.ts';\nimport type { HTTPOAuth2AuthorizeGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport type { CertificateSource } from '../../../request/index.ts';\nimport {\n extractClientCredentialsFromRequest,\n extractOAuth2ClientCertificateEvidence,\n readRealmHint,\n} from './utils/index.ts';\n\nexport class HTTPOAuth2AuthorizeGrant extends OAuth2AuthorizeGrant implements IHTTPOAuth2Grant {\n protected codeVerifier : IOAuth2AuthorizationCodeVerifier;\n\n protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n protected realmRepository : IRealmRepository;\n\n protected accessPolicyEvaluator? : IOAuth2AccessPolicyEvaluator;\n\n protected certificateSource: CertificateSource;\n\n constructor(ctx: HTTPOAuth2AuthorizeGrantContext) {\n super(ctx);\n\n this.codeVerifier = ctx.codeVerifier;\n this.clientAuthenticator = ctx.clientAuthenticator;\n this.realmRepository = ctx.realmRepository;\n this.accessPolicyEvaluator = ctx.accessPolicyEvaluator;\n this.certificateSource = ctx.certificateSource ?? 'disabled';\n }\n\n async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n const body = await readRequestBody(event);\n const query = useRequestQuery(event);\n\n const code = this.pickStringParam(body, query, 'code');\n const redirectUri = this.pickStringParam(body, query, 'redirect_uri');\n const codeVerifier = this.pickStringParam(body, query, 'code_verifier');\n if (!code) {\n throw OAuth2RequestError.malformed();\n }\n\n const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n const realm = await this.realmRepository.resolve(readRealmHint(body, query), true);\n const certificateEvidence = await extractOAuth2ClientCertificateEvidence(event, this.certificateSource);\n\n const client = await this.clientAuthenticator.authenticate(\n clientId,\n clientSecret,\n realm.id,\n certificateEvidence,\n );\n const confirmation = this.clientAuthenticator.resolveTokenBinding(client, certificateEvidence);\n\n assertClientGrantAllowed(client, OAuth2TokenGrant.AUTHORIZATION_CODE);\n\n const entity = await this.codeVerifier.verify(code, {\n redirectUri,\n codeVerifier,\n clientId: client.id,\n clientIsPublic: isClientPublic(client),\n realmId: client.~~realm_id~~,\n });\n\n // Application access policy (plan 052), /token backstop: a code\n // minted before the policy was attached (or outside authorize())\n // must not redeem. The subject is built from the code-blob scalars —\n // no DB identity load; attribute-rich policies are enforced at the\n // issuance legs. Denial = invalid_grant, never access_denied here.\n if (client.~~access_policy_id~~) {\n let allowed = false;\n if (this.accessPolicyEvaluator) {\n allowed = await this.accessPolicyEvaluator.evaluate(client.~~access_policy_id~~, {\n type: entity.sub_kind,\n id: entity.sub,\n realmId: entity.realm_id ?? null,\n realmName: entity.realm_name ?? null,\n clientId: entity.client_id ?? null,\n });\n }\n\n if (!allowed) {\n throw OAuth2GrantError.invalid();\n }\n }\n\n return this.runWith(entity, {\n confirmation,\n ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n });\n }\n\n protected pickStringParam(\n body: Record<string, any> \| undefined,\n query: Record<string, any> \| undefined,\n key: string,\n ): string \| undefined {\n const value = body?.[key] ?? query?.[key];\n return typeof value === 'string' && value.length > 0 ? value : undefined;\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA6BA,IAAaa,2BAAb,cAA8CL,qBAAAA;CAChCM;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAsC;EAC9C,MAAMA,GAAAA;EAEN,KAAKL,eAAeK,IAAIL;EACxB,KAAKC,sBAAsBI,IAAIJ;EAC/B,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,wBAAwBE,IAAIF;EACjC,KAAKC,oBAAoBC,IAAID,qBAAqB;CACtD;CAEA,MAAME,eAAeC,OAAqD;EACtE,MAAMC,OAAO,MAAMlB,gBAAgBiB,KAAAA;EACnC,MAAME,QAAQlB,gBAAgBgB,KAAAA;EAE9B,MAAMG,OAAO,KAAKC,gBAAgBH,MAAMC,OAAO,MAAA;EAC/C,MAAMG,cAAc,KAAKD,gBAAgBH,MAAMC,OAAO,cAAA;EACtD,MAAMT,eAAe,KAAKW,gBAAgBH,MAAMC,OAAO,eAAA;EACvD,IAAI,CAACC,MACD,MAAMtB,mBAAmByB,UAAS;EAGtC,MAAM,EAAEC,UAAUC,iBAAiB,MAAMnB,oCAAoCW,KAAAA;EAC7E,MAAMS,QAAQ,MAAM,KAAKd,gBAAgBe,QAAQnB,cAAcU,MAAMC,KAAAA,GAAQ,IAAA;EAC7E,MAAMS,sBAAsB,MAAMrB,uCAAuCU,OAAO,KAAKH,iBAAiB;EAEtG,MAAMe,SAAS,MAAM,KAAKlB,oBAAoBmB,aAC1CN,UACAC,cACAC,MAAMK,IACNH,mBAAAA;EAEJ,MAAMI,eAAe,KAAKrB,oBAAoBsB,oBAAoBJ,QAAQD,mBAAAA;EAE1EvB,yBAAyBwB,QAAQ9B,iBAAiBmC,kBAAkB;EAEpE,MAAMC,SAAS,MAAM,KAAKzB,aAAa0B,OAAOhB,MAAM;GAChDE;GACAZ;GACAc,UAAUK,OAAOE;GACjBM,gBAAgBzC,eAAeiC,MAAAA;GAC/BS,SAAST,~~OAAOU~~;EACpB,CAAA;EAOA,~~IAAIV~~,~~OAAOW~~,~~kBAAkB~~;~~GACzB~~,IAAIC,UAAU;GACd,IAAI,~~KAAK5B~~,~~uBACL4B~~,UAAU,MAAM,~~KAAK5B~~,~~sBAAsB6B~~,~~SAASb~~,~~OAAOW~~,~~kBAAkB~~;~~IACzEG~~,~~MAAMR~~,~~OAAOS~~;~~IACbb~~,IAAII,~~OAAOU~~;~~IACXP~~,SAASH,~~OAAOI~~,YAAY;~~IAC5BO~~,WAAWX,OAAOY,cAAc;IAChCvB,UAAUW,OAAOa,aAAa;GAClC,CAAA;GAGJ,IAAI,~~CAACP~~,SACD,~~MAAM5C~~,iBAAiBoD,QAAO;EAEtC;EAEA,OAAO,KAAKC,QAAQf,QAAQ;GACxBH;GACAmB,WAAWhD,aAAac,OAAO,EAAEmC,YAAY,KAAK,CAAA,KAAMC,KAAAA;GACxDC,WAAWpD,iBAAiBe,OAAO,YAAA,KAAiBoC,KAAAA;EACxD,CAAA;CACJ;CAEUhC,gBACNH,MACAC,OACAoC,KACkB;EAClB,MAAMC,QAAQtC,OAAOqC,QAAQpC,QAAQoC;EACrC,OAAO,OAAOC,UAAU,YAAYA,MAAMC,SAAS,IAAID,QAAQH,KAAAA;CACnE;AACJ"}
1	+ {"version":3,"file":"authorize.mjs","names":["isClientPublic","OAuth2GrantError","OAuth2RequestError","OAuth2TokenGrant","readRequestBody","useRequestQuery","getRequestHeader","getRequestIP","OAuth2AuthorizeGrant","assertClientGrantAllowed","extractClientCredentialsFromRequest","extractOAuth2ClientCertificateEvidence","readRealmHint","HTTPOAuth2AuthorizeGrant","codeVerifier","clientAuthenticator","realmRepository","accessPolicyEvaluator","certificateSource","ctx","runWithRequest","event","body","query","code","pickStringParam","redirectUri","malformed","clientId","clientSecret","realm","resolve","certificateEvidence","client","authenticate","id","confirmation","resolveTokenBinding","AUTHORIZATION_CODE","entity","verify","clientIsPublic","realmId","accessPolicyId","allowed","evaluate","type","sub_kind","sub","realm_id","realmName","realm_name","client_id","invalid","runWith","ipAddress","trustProxy","undefined","userAgent","key","value","length"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/authorize.ts"],"sourcesContent":["/\n Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { isClientPublic } from '@authup/core-kit';\nimport { OAuth2GrantError, OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport { OAuth2AuthorizeGrant, assertClientGrantAllowed } from '../../../../../core/index.ts';\nimport type {\n IOAuth2AccessPolicyEvaluator,\n IOAuth2AuthorizationCodeVerifier,\n IRealmRepository,\n OAuth2ClientAuthenticator,\n} from '../../../../../core/index.ts';\nimport type { HTTPOAuth2AuthorizeGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport type { CertificateSource } from '../../../request/index.ts';\nimport {\n extractClientCredentialsFromRequest,\n extractOAuth2ClientCertificateEvidence,\n readRealmHint,\n} from './utils/index.ts';\n\nexport class HTTPOAuth2AuthorizeGrant extends OAuth2AuthorizeGrant implements IHTTPOAuth2Grant {\n protected codeVerifier : IOAuth2AuthorizationCodeVerifier;\n\n protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n protected realmRepository : IRealmRepository;\n\n protected accessPolicyEvaluator? : IOAuth2AccessPolicyEvaluator;\n\n protected certificateSource: CertificateSource;\n\n constructor(ctx: HTTPOAuth2AuthorizeGrantContext) {\n super(ctx);\n\n this.codeVerifier = ctx.codeVerifier;\n this.clientAuthenticator = ctx.clientAuthenticator;\n this.realmRepository = ctx.realmRepository;\n this.accessPolicyEvaluator = ctx.accessPolicyEvaluator;\n this.certificateSource = ctx.certificateSource ?? 'disabled';\n }\n\n async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n const body = await readRequestBody(event);\n const query = useRequestQuery(event);\n\n const code = this.pickStringParam(body, query, 'code');\n const redirectUri = this.pickStringParam(body, query, 'redirect_uri');\n const codeVerifier = this.pickStringParam(body, query, 'code_verifier');\n if (!code) {\n throw OAuth2RequestError.malformed();\n }\n\n const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n const realm = await this.realmRepository.resolve(readRealmHint(body, query), true);\n const certificateEvidence = await extractOAuth2ClientCertificateEvidence(event, this.certificateSource);\n\n const client = await this.clientAuthenticator.authenticate(\n clientId,\n clientSecret,\n realm.id,\n certificateEvidence,\n );\n const confirmation = this.clientAuthenticator.resolveTokenBinding(client, certificateEvidence);\n\n assertClientGrantAllowed(client, OAuth2TokenGrant.AUTHORIZATION_CODE);\n\n const entity = await this.codeVerifier.verify(code, {\n redirectUri,\n codeVerifier,\n clientId: client.id,\n clientIsPublic: isClientPublic(client),\n realmId: client.realmId,\n });\n\n // Application access policy (plan 052), /token backstop: a code\n // minted before the policy was attached (or outside authorize())\n // must not redeem. The subject is built from the code-blob scalars —\n // no DB identity load; attribute-rich policies are enforced at the\n // issuance legs. Denial = invalid_grant, never access_denied here.\n if (client.accessPolicyId) {\n let allowed = false;\n if (this.accessPolicyEvaluator) {\n allowed = await this.accessPolicyEvaluator.evaluate(client.accessPolicyId, {\n type: entity.sub_kind,\n id: entity.sub,\n realmId: entity.realm_id ?? null,\n realmName: entity.realm_name ?? null,\n clientId: entity.client_id ?? null,\n });\n }\n\n if (!allowed) {\n throw OAuth2GrantError.invalid();\n }\n }\n\n return this.runWith(entity, {\n confirmation,\n ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n });\n }\n\n protected pickStringParam(\n body: Record<string, any> \| undefined,\n query: Record<string, any> \| undefined,\n key: string,\n ): string \| undefined {\n const value = body?.[key] ?? query?.[key];\n return typeof value === 'string' && value.length > 0 ? value : undefined;\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA6BA,IAAaa,2BAAb,cAA8CL,qBAAAA;CAChCM;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAsC;EAC9C,MAAMA,GAAAA;EAEN,KAAKL,eAAeK,IAAIL;EACxB,KAAKC,sBAAsBI,IAAIJ;EAC/B,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,wBAAwBE,IAAIF;EACjC,KAAKC,oBAAoBC,IAAID,qBAAqB;CACtD;CAEA,MAAME,eAAeC,OAAqD;EACtE,MAAMC,OAAO,MAAMlB,gBAAgBiB,KAAAA;EACnC,MAAME,QAAQlB,gBAAgBgB,KAAAA;EAE9B,MAAMG,OAAO,KAAKC,gBAAgBH,MAAMC,OAAO,MAAA;EAC/C,MAAMG,cAAc,KAAKD,gBAAgBH,MAAMC,OAAO,cAAA;EACtD,MAAMT,eAAe,KAAKW,gBAAgBH,MAAMC,OAAO,eAAA;EACvD,IAAI,CAACC,MACD,MAAMtB,mBAAmByB,UAAS;EAGtC,MAAM,EAAEC,UAAUC,iBAAiB,MAAMnB,oCAAoCW,KAAAA;EAC7E,MAAMS,QAAQ,MAAM,KAAKd,gBAAgBe,QAAQnB,cAAcU,MAAMC,KAAAA,GAAQ,IAAA;EAC7E,MAAMS,sBAAsB,MAAMrB,uCAAuCU,OAAO,KAAKH,iBAAiB;EAEtG,MAAMe,SAAS,MAAM,KAAKlB,oBAAoBmB,aAC1CN,UACAC,cACAC,MAAMK,IACNH,mBAAAA;EAEJ,MAAMI,eAAe,KAAKrB,oBAAoBsB,oBAAoBJ,QAAQD,mBAAAA;EAE1EvB,yBAAyBwB,QAAQ9B,iBAAiBmC,kBAAkB;EAEpE,MAAMC,SAAS,MAAM,KAAKzB,aAAa0B,OAAOhB,MAAM;GAChDE;GACAZ;GACAc,UAAUK,OAAOE;GACjBM,gBAAgBzC,eAAeiC,MAAAA;GAC/BS,SAAST,OAAOS;EACpB,CAAA;EAOA,IAAIT,OAAOU,gBAAgB;GACvB,IAAIC,UAAU;GACd,IAAI,KAAK3B,uBACL2B,UAAU,MAAM,KAAK3B,sBAAsB4B,SAASZ,OAAOU,gBAAgB;IACvEG,MAAMP,OAAOQ;IACbZ,IAAII,OAAOS;IACXN,SAASH,OAAOU,YAAY;IAC5BC,WAAWX,OAAOY,cAAc;IAChCvB,UAAUW,OAAOa,aAAa;GAClC,CAAA;GAGJ,IAAI,CAACR,SACD,MAAM3C,iBAAiBoD,QAAO;EAEtC;EAEA,OAAO,KAAKC,QAAQf,QAAQ;GACxBH;GACAmB,WAAWhD,aAAac,OAAO,EAAEmC,YAAY,KAAK,CAAA,KAAMC,KAAAA;GACxDC,WAAWpD,iBAAiBe,OAAO,YAAA,KAAiBoC,KAAAA;EACxD,CAAA;CACJ;CAEUhC,gBACNH,MACAC,OACAoC,KACkB;EAClB,MAAMC,QAAQtC,OAAOqC,QAAQpC,QAAQoC;EACrC,OAAO,OAAOC,UAAU,YAAYA,MAAMC,SAAS,IAAID,QAAQH,KAAAA;CACnE;AACJ"}

package/dist/adapters/http/adapters/oauth2/grant-types/client-credentials.mjs CHANGED Viewed

@@ -26,7 +26,7 @@ var HTTPClientCredentialsGrant = class extends ClientCredentialsGrant {
 		if (!clientId) throw OAuth2ClientError.invalid();
 		const certificateEvidence = await extractOAuth2ClientCertificateEvidence(event, this.certificateSource);
 		const client = await this.clientAuthenticator.authenticate(clientId, clientSecret, realmId, certificateEvidence);
-		if (client.auth_method === ClientAuthMethod.NONE) throw OAuth2ClientError.invalid();
+		if (client.authMethod === ClientAuthMethod.NONE) throw OAuth2ClientError.invalid();
 		const confirmation = this.clientAuthenticator.resolveTokenBinding(client, certificateEvidence);
 		assertClientGrantAllowed(client, OAuth2TokenGrant.CLIENT_CREDENTIALS);
 		return this.runWith(client, {

package/dist/adapters/http/adapters/oauth2/grant-types/client-credentials.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"client-credentials.mjs","names":["OAuth2ClientError","OAuth2TokenGrant","readRequestBody","ClientAuthMethod","getRequestHeader","getRequestIP","ClientCredentialsGrant","assertClientGrantAllowed","extractClientCredentialsFromRequest","extractOAuth2ClientCertificateEvidence","HTTPClientCredentialsGrant","clientAuthenticator","certificateSource","ctx","runWithRequest","event","clientId","clientSecret","body","realmId","realm_id","invalid","certificateEvidence","client","authenticate","~~auth_method~~","NONE","confirmation","resolveTokenBinding","CLIENT_CREDENTIALS","runWith","ipAddress","trustProxy","undefined","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/client-credentials.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2ClientError, OAuth2TokenGrant } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport { ClientAuthMethod } from '@authup/core-kit';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type { OAuth2ClientAuthenticator } from '../../../../../core/index.ts';\nimport { ClientCredentialsGrant, assertClientGrantAllowed } from '../../../../../core/index.ts';\nimport type { HTTPOAuth2ClientCredentialsGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport type { CertificateSource } from '../../../request/index.ts';\nimport {\n extractClientCredentialsFromRequest,\n extractOAuth2ClientCertificateEvidence,\n} from './utils/index.ts';\n\nexport class HTTPClientCredentialsGrant extends ClientCredentialsGrant implements IHTTPOAuth2Grant {\n protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n protected certificateSource: CertificateSource;\n\n constructor(ctx: HTTPOAuth2ClientCredentialsGrantContext) {\n super(ctx);\n\n this.clientAuthenticator = ctx.clientAuthenticator;\n this.certificateSource = ctx.certificateSource ?? 'disabled';\n }\n\n async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n const body = await readRequestBody(event);\n const realmId = body?.realm_id;\n\n if (!clientId) {\n throw OAuth2ClientError.invalid();\n }\n\n const certificateEvidence = await extractOAuth2ClientCertificateEvidence(event, this.certificateSource);\n const client = await this.clientAuthenticator.authenticate(\n clientId,\n clientSecret,\n realmId,\n certificateEvidence,\n );\n if (client.~~auth_method~~ === ClientAuthMethod.NONE) {\n throw OAuth2ClientError.invalid();\n }\n const confirmation = this.clientAuthenticator.resolveTokenBinding(client, certificateEvidence);\n\n assertClientGrantAllowed(client, OAuth2TokenGrant.CLIENT_CREDENTIALS);\n\n return this.runWith(client, {\n confirmation,\n ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n });\n }\n}\n"],"mappings":";;;;;;;;;;;;;;AAsBA,IAAaU,6BAAb,cAAgDJ,uBAAAA;CAClCK;CAEAC;CAEV,YAAYC,KAA8C;EACtD,MAAMA,GAAAA;EAEN,KAAKF,sBAAsBE,IAAIF;EAC/B,KAAKC,oBAAoBC,IAAID,qBAAqB;CACtD;CAEA,MAAME,eAAeC,OAAqD;EACtE,MAAM,EAAEC,UAAUC,iBAAiB,MAAMT,oCAAoCO,KAAAA;EAE7E,MAAMI,WAAUD,MADGhB,gBAAgBa,KAAAA,EAAAA,EACbK;EAEtB,IAAI,CAACJ,UACD,MAAMhB,kBAAkBqB,QAAO;EAGnC,MAAMC,sBAAsB,MAAMb,uCAAuCM,OAAO,KAAKH,iBAAiB;EACtG,MAAMW,SAAS,MAAM,KAAKZ,oBAAoBa,aAC1CR,UACAC,cACAE,SACAG,mBAAAA;EAEJ,IAAIC,OAAOE,~~gBAAgBtB~~,iBAAiBuB,~~MACxC~~,MAAM1B,kBAAkBqB,QAAO;EAEnC,MAAMM,eAAe,KAAKhB,oBAAoBiB,oBAAoBL,QAAQD,mBAAAA;EAE1Ef,yBAAyBgB,QAAQtB,iBAAiB4B,kBAAkB;EAEpE,OAAO,KAAKC,QAAQP,QAAQ;GACxBI;GACAI,WAAW1B,aAAaU,OAAO,EAAEiB,YAAY,KAAK,CAAA,KAAMC,KAAAA;GACxDC,WAAW9B,iBAAiBW,OAAO,YAAA,KAAiBkB,KAAAA;EACxD,CAAA;CACJ;AACJ"}
1	+ {"version":3,"file":"client-credentials.mjs","names":["OAuth2ClientError","OAuth2TokenGrant","readRequestBody","ClientAuthMethod","getRequestHeader","getRequestIP","ClientCredentialsGrant","assertClientGrantAllowed","extractClientCredentialsFromRequest","extractOAuth2ClientCertificateEvidence","HTTPClientCredentialsGrant","clientAuthenticator","certificateSource","ctx","runWithRequest","event","clientId","clientSecret","body","realmId","realm_id","invalid","certificateEvidence","client","authenticate","authMethod","NONE","confirmation","resolveTokenBinding","CLIENT_CREDENTIALS","runWith","ipAddress","trustProxy","undefined","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/client-credentials.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2ClientError, OAuth2TokenGrant } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport { ClientAuthMethod } from '@authup/core-kit';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type { OAuth2ClientAuthenticator } from '../../../../../core/index.ts';\nimport { ClientCredentialsGrant, assertClientGrantAllowed } from '../../../../../core/index.ts';\nimport type { HTTPOAuth2ClientCredentialsGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport type { CertificateSource } from '../../../request/index.ts';\nimport {\n extractClientCredentialsFromRequest,\n extractOAuth2ClientCertificateEvidence,\n} from './utils/index.ts';\n\nexport class HTTPClientCredentialsGrant extends ClientCredentialsGrant implements IHTTPOAuth2Grant {\n protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n protected certificateSource: CertificateSource;\n\n constructor(ctx: HTTPOAuth2ClientCredentialsGrantContext) {\n super(ctx);\n\n this.clientAuthenticator = ctx.clientAuthenticator;\n this.certificateSource = ctx.certificateSource ?? 'disabled';\n }\n\n async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n const body = await readRequestBody(event);\n const realmId = body?.realm_id;\n\n if (!clientId) {\n throw OAuth2ClientError.invalid();\n }\n\n const certificateEvidence = await extractOAuth2ClientCertificateEvidence(event, this.certificateSource);\n const client = await this.clientAuthenticator.authenticate(\n clientId,\n clientSecret,\n realmId,\n certificateEvidence,\n );\n if (client.authMethod === ClientAuthMethod.NONE) {\n throw OAuth2ClientError.invalid();\n }\n const confirmation = this.clientAuthenticator.resolveTokenBinding(client, certificateEvidence);\n\n assertClientGrantAllowed(client, OAuth2TokenGrant.CLIENT_CREDENTIALS);\n\n return this.runWith(client, {\n confirmation,\n ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n });\n }\n}\n"],"mappings":";;;;;;;;;;;;;;AAsBA,IAAaU,6BAAb,cAAgDJ,uBAAAA;CAClCK;CAEAC;CAEV,YAAYC,KAA8C;EACtD,MAAMA,GAAAA;EAEN,KAAKF,sBAAsBE,IAAIF;EAC/B,KAAKC,oBAAoBC,IAAID,qBAAqB;CACtD;CAEA,MAAME,eAAeC,OAAqD;EACtE,MAAM,EAAEC,UAAUC,iBAAiB,MAAMT,oCAAoCO,KAAAA;EAE7E,MAAMI,WAAUD,MADGhB,gBAAgBa,KAAAA,EAAAA,EACbK;EAEtB,IAAI,CAACJ,UACD,MAAMhB,kBAAkBqB,QAAO;EAGnC,MAAMC,sBAAsB,MAAMb,uCAAuCM,OAAO,KAAKH,iBAAiB;EACtG,MAAMW,SAAS,MAAM,KAAKZ,oBAAoBa,aAC1CR,UACAC,cACAE,SACAG,mBAAAA;EAEJ,IAAIC,OAAOE,eAAetB,iBAAiBuB,MACvC,MAAM1B,kBAAkBqB,QAAO;EAEnC,MAAMM,eAAe,KAAKhB,oBAAoBiB,oBAAoBL,QAAQD,mBAAAA;EAE1Ef,yBAAyBgB,QAAQtB,iBAAiB4B,kBAAkB;EAEpE,OAAO,KAAKC,QAAQP,QAAQ;GACxBI;GACAI,WAAW1B,aAAaU,OAAO,EAAEiB,YAAY,KAAK,CAAA,KAAMC,KAAAA;GACxDC,WAAW9B,iBAAiBW,OAAO,YAAA,KAAiBkB,KAAAA;EACxD,CAAA;CACJ;AACJ"}

package/dist/adapters/http/adapters/oauth2/grant-types/index.d.ts CHANGED Viewed

@@ -4,6 +4,5 @@ export * from './client-credentials.ts';
 export * from './identity.ts';
 export * from './password.ts';
 export * from './refresh_token.ts';
-export * from './robot-credentials.ts';
 export * from './types.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/adapters/oauth2/grant-types/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/index.ts"],"names":[],"mappings":"AAOA,cAAc,kBAAkB,CAAC;AAEjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;~~AACnC~~,cAAc,~~wBAAwB,CAAC;AAEvC,cAAc,~~YAAY,CAAC"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/index.ts"],"names":[],"mappings":"AAOA,cAAc,kBAAkB,CAAC;AAEjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AAEnC,cAAc,YAAY,CAAC"}

package/dist/adapters/http/adapters/oauth2/grant-types/index.mjs CHANGED Viewed

@@ -11,5 +11,4 @@ import { HTTPClientCredentialsGrant } from "./client-credentials.mjs";
 import { HTTPOAuth2IdentityGrantType } from "./identity.mjs";
 import { HTTPPasswordGrant } from "./password.mjs";
 import { HTTPOAuth2RefreshTokenGrant } from "./refresh_token.mjs";
-import { HTTPRobotCredentialsGrant } from "./robot-credentials.mjs";
-export { HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, guessOauth2GrantTypeByRequest, readRealmHint, readStringField };
+export { HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, guessOauth2GrantTypeByRequest, readRealmHint, readStringField };

package/dist/adapters/http/adapters/oauth2/grant-types/password.mjs CHANGED Viewed

@@ -71,7 +71,7 @@ var HTTPPasswordGrant = class extends PasswordGrantType {
 					requestUserAgent: userAgent ?? null,
 					requestPath: event.path,
 					requestMethod: event.method,
-					data: { error_code: e.code }
+					data: { errorCode: e.code }
 				});
 				this.metrics?.recordLogin("failure");
 			}

package/dist/adapters/http/adapters/oauth2/grant-types/password.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"password.mjs","names":["EventName","EventScope","UserAuthenticatorKind","isEntityCredentialsInvalidError","isEntityInactiveError","OAuth2MfaRequiredError","OAuth2RequestError","OAuth2TokenGrant","readRequestBody","getRequestHeader","getRequestIP","PasswordGrantType","assertClientGrantAllowed","guessUserAuthenticatorKindByResponse","extractClientCredentialsFromRequest","extractOAuth2ClientCertificateEvidence","readRealmHint","readStringField","HTTPPasswordGrant","authenticator","clientAuthenticator","realmRepository","loginThrottleService","userAuthenticatorService","mfaLoginService","logger","certificateSource","ctx","runWithRequest","event","body","username","password","malformed","clientId","clientSecret","realm","resolve","certificateEvidence","client","authenticate","id","undefined","confirmation","resolveTokenBinding","PASSWORD","ipAddress","trustProxy","userAgent","identifier","trim","toLowerCase","assertNotThrottled","realmId","user","e","eventService","record","scope","OAUTH2","name","LOGIN_FAILED","actorType","actorId","actorName","requestIpAddress","requestUserAgent","requestPath","path","requestMethod","method","data","error_code","code","metrics","recordLogin","mfaVerifiedAt","verifySecondFactor","runWith","status","challenge","issueMaterial","required","otp","ticket","issueMfaTicket","kinds","message","mfa_token","token","mfa_token_expires_in","expiresIn","verified","verify","kind","response","Date","toISOString","interactive","includes","EMAIL","WEBAUTHN","issueTicket","warn","error"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/password.ts"],"sourcesContent":["/\n Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { User } from '@authup/core-kit';\nimport { EventName, EventScope, UserAuthenticatorKind } from '@authup/core-kit';\nimport type { Logger } from '@authup/server-kit';\nimport { isEntityCredentialsInvalidError, isEntityInactiveError } from '@authup/errors';\nimport type { OAuth2TokenConfirmation, OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2MfaRequiredError, OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type {\n ICredentialsAuthenticator,\n ILoginThrottleService,\n IOAuth2MfaLoginService,\n IRealmRepository,\n IUserAuthenticatorService,\n OAuth2ClientAuthenticator,\n} from '../../../../../core/index.ts';\nimport {\n PasswordGrantType,\n assertClientGrantAllowed,\n guessUserAuthenticatorKindByResponse,\n} from '../../../../../core/index.ts';\nimport type { HTTPOAuth2PasswordGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport type { CertificateSource } from '../../../request/index.ts';\nimport {\n extractClientCredentialsFromRequest,\n extractOAuth2ClientCertificateEvidence,\n readRealmHint,\n readStringField,\n} from './utils/index.ts';\n\nexport class HTTPPasswordGrant extends PasswordGrantType implements IHTTPOAuth2Grant {\n protected authenticator : ICredentialsAuthenticator<User>;\n\n protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n protected realmRepository : IRealmRepository;\n\n protected loginThrottleService? : ILoginThrottleService;\n\n protected userAuthenticatorService? : IUserAuthenticatorService;\n\n protected mfaLoginService? : IOAuth2MfaLoginService;\n\n protected logger? : Logger;\n\n protected certificateSource: CertificateSource;\n\n constructor(ctx: HTTPOAuth2PasswordGrantContext) {\n super(ctx);\n\n this.authenticator = ctx.authenticator;\n this.clientAuthenticator = ctx.clientAuthenticator;\n this.realmRepository = ctx.realmRepository;\n this.loginThrottleService = ctx.loginThrottleService;\n this.userAuthenticatorService = ctx.userAuthenticatorService;\n this.mfaLoginService = ctx.mfaLoginService;\n this.logger = ctx.logger;\n this.certificateSource = ctx.certificateSource ?? 'disabled';\n }\n\n async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n const body = await readRequestBody(event);\n\n const username = readStringField(body, 'username');\n const password = readStringField(body, 'password');\n if (!username \|\| !password) {\n throw OAuth2RequestError.malformed('username and password must be provided.');\n }\n\n const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n\n const realm = await this.realmRepository.resolve(readRealmHint(body), true);\n const certificateEvidence = await extractOAuth2ClientCertificateEvidence(event, this.certificateSource);\n\n const client = clientId ?\n await this.clientAuthenticator.authenticate(\n clientId,\n clientSecret,\n realm.id,\n certificateEvidence,\n ) :\n undefined;\n\n const confirmation = client ?\n this.clientAuthenticator.resolveTokenBinding(client, certificateEvidence) :\n undefined;\n\n if (client) {\n assertClientGrantAllowed(client, OAuth2TokenGrant.PASSWORD);\n }\n\n const ipAddress = getRequestIP(event, { trustProxy: true }) ?? undefined;\n const userAgent = getRequestHeader(event, 'user-agent') ?? undefined;\n\n // canonical identifier form (layer 3) — the throttle key and the\n // loginFailed actor_name must match what canonically stored rows carry.\n const identifier = username.trim().toLowerCase();\n\n await this.loginThrottleService?.assertNotThrottled({\n identifier,\n ipAddress,\n realmId: realm.id,\n });\n\n let user : User;\n try {\n user = await this.authenticator.authenticate(username, password, realm.id);\n } catch (e) {\n if (isEntityCredentialsInvalidError(e) \|\| isEntityInactiveError(e)) {\n await this.eventService?.record({\n scope: EventScope.OAUTH2,\n name: EventName.LOGIN_FAILED,\n actorType: null,\n actorId: null,\n actorName: identifier,\n clientId: client?.id ?? null,\n realmId: realm.id,\n requestIpAddress: ipAddress ?? null,\n requestUserAgent: userAgent ?? null,\n requestPath: event.path,\n requestMethod: event.method,\n data: { error_code: e.code },\n });\n this.metrics?.recordLogin('failure');\n }\n\n throw e;\n }\n\n const mfaVerifiedAt = await this.verifySecondFactor(user, body, {\n ipAddress,\n userAgent,\n clientId: client?.id ?? null,\n confirmation,\n });\n\n return this.runWith(\n {\n user, \n client, \n mfaVerifiedAt, \n },\n {\n confirmation,\n ipAddress,\n userAgent,\n },\n );\n }\n\n /\n MFA gate on the direct password grant: a user holding a confirmed\n * device must send a valid `otp` form parameter (TOTP or recovery\n * code, classified by shape) — otherwise `mfa_required`. Users\n * without a device pass through (they could never enroll otherwise).\n /\n protected async verifySecondFactor(\n user: User,\n body: Record<string, any>,\n ctx: {\n ipAddress?: string, \n userAgent?: string, \n clientId: string \| null,\n confirmation?: OAuth2TokenConfirmation,\n },\n ): Promise<string \| undefined> {\n if (!this.userAuthenticatorService) {\n return undefined;\n }\n\n // requirement flags + kinds only — no webauthn material on the token path.\n const status = await this.userAuthenticatorService.challenge(user.id, { issueMaterial: false });\n if (!status.required) {\n return undefined;\n }\n\n const otp = readStringField(body, 'otp');\n if (!otp) {\n // carry the challengeable kinds so a client (the hosted login form)\n // can tell whether a single-POST factor (totp/recovery) is on offer\n // or the user must complete an interactive challenge (email/webauthn).\n // For the interactive kinds an \"MFA-pending\" ticket (issue #3242)\n // rides along: a restricted mfa_token-kind bearer accepted ONLY by\n // the challenge routes, backed by a short-lived pending session\n // (mfa_at: null) — never a usable access/refresh pair.\n const ticket = await this.issueMfaTicket(user, status.kinds, ctx);\n\n throw new OAuth2MfaRequiredError({\n message: 'Complete a second-factor challenge to continue.',\n data: {\n kinds: status.kinds,\n ...(ticket ? {\n mfa_token: ticket.token,\n mfa_token_expires_in: ticket.expiresIn,\n } : {}),\n },\n });\n }\n\n const verified = await this.userAuthenticatorService.verify(\n user.id,\n {\n kind: guessUserAuthenticatorKindByResponse(otp),\n response: otp,\n },\n {\n ipAddress: ctx.ipAddress ?? null,\n userAgent: ctx.userAgent ?? null,\n clientId: ctx.clientId,\n },\n );\n if (!verified) {\n throw new OAuth2MfaRequiredError({\n message: 'The provided second factor is not valid.',\n data: { kinds: status.kinds },\n });\n }\n\n return new Date().toISOString();\n }\n\n /\n Issue the MFA-pending ticket for factor kinds that cannot complete\n * inside the single grant POST (email needs a server-sent code,\n * WebAuthn an interactive ceremony). TOTP/recovery-only users keep\n * the inline `otp` fast-path and get no ticket — a pending session\n * per plain code entry would be pure churn.\n */\n protected async issueMfaTicket(\n user: User,\n kinds: `${UserAuthenticatorKind}`[],\n ctx: {\n ipAddress?: string,\n userAgent?: string,\n clientId: string \| null,\n confirmation?: OAuth2TokenConfirmation,\n },\n ) : Promise<{ token: string, expiresIn: number } \| null> {\n if (!this.mfaLoginService) {\n return null;\n }\n\n const interactive = kinds.includes(UserAuthenticatorKind.EMAIL) \|\|\n kinds.includes(UserAuthenticatorKind.WEBAUTHN);\n if (!interactive) {\n return null;\n }\n\n try {\n return await this.mfaLoginService.issueTicket(\n {\n user,\n clientId: ctx.clientId,\n confirmation: ctx.confirmation,\n },\n {\n ipAddress: ctx.ipAddress,\n userAgent: ctx.userAgent,\n },\n );\n } catch (e) {\n // degrade to a ticket-less mfa_required rather than letting a\n // transient issuance failure (pending-session write, cache,\n // signer) escape as a raw 500 from a controlled response path —\n // an otp-capable device can still complete, and the credential\n // retry re-attempts the ticket.\n this.logger?.warn('Issuing the MFA-pending login ticket failed.', { error: e });\n\n return null;\n }\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAsCA,IAAakB,oBAAb,cAAuCP,kBAAAA;CACzBQ;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAMA,GAAAA;EAEN,KAAKR,gBAAgBQ,IAAIR;EACzB,KAAKC,sBAAsBO,IAAIP;EAC/B,KAAKC,kBAAkBM,IAAIN;EAC3B,KAAKC,uBAAuBK,IAAIL;EAChC,KAAKC,2BAA2BI,IAAIJ;EACpC,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,SAASE,IAAIF;EAClB,KAAKC,oBAAoBC,IAAID,qBAAqB;CACtD;CAEA,MAAME,eAAeC,OAAqD;EACtE,MAAMC,OAAO,MAAMtB,gBAAgBqB,KAAAA;EAEnC,MAAME,WAAWd,gBAAgBa,MAAM,UAAA;EACvC,MAAME,WAAWf,gBAAgBa,MAAM,UAAA;EACvC,IAAI,CAACC,YAAY,CAACC,UACd,MAAM1B,mBAAmB2B,UAAU,yCAAA;EAGvC,MAAM,EAAEC,UAAUC,iBAAiB,MAAMrB,oCAAoCe,KAAAA;EAE7E,MAAMO,QAAQ,MAAM,KAAKf,gBAAgBgB,QAAQrB,cAAcc,IAAAA,GAAO,IAAA;EACtE,MAAMQ,sBAAsB,MAAMvB,uCAAuCc,OAAO,KAAKH,iBAAiB;EAEtG,MAAMa,SAASL,WACX,MAAM,KAAKd,oBAAoBoB,aAC3BN,UACAC,cACAC,MAAMK,IACNH,mBAAAA,IAEJI,KAAAA;EAEJ,MAAMC,eAAeJ,SACjB,KAAKnB,oBAAoBwB,oBAAoBL,QAAQD,mBAAAA,IACrDI,KAAAA;EAEJ,IAAIH,QACA3B,yBAAyB2B,QAAQhC,iBAAiBsC,QAAQ;EAG9D,MAAMC,YAAYpC,aAAamB,OAAO,EAAEkB,YAAY,KAAK,CAAA,KAAML,KAAAA;EAC/D,MAAMM,YAAYvC,iBAAiBoB,OAAO,YAAA,KAAiBa,KAAAA;EAI3D,MAAMO,aAAalB,SAASmB,KAAI,CAAA,CAAGC,YAAW;EAE9C,MAAM,KAAK7B,sBAAsB8B,mBAAmB;GAChDH;GACAH;GACAO,SAASjB,MAAMK;EACnB,CAAA;EAEA,IAAIa;EACJ,IAAI;GACAA,OAAO,MAAM,KAAKnC,cAAcqB,aAAaT,UAAUC,UAAUI,MAAMK,EAAE;EAC7E,SAASc,GAAG;GACR,IAAIpD,gCAAgCoD,CAAAA,KAAMnD,sBAAsBmD,CAAAA,GAAI;IAChE,MAAM,KAAKC,cAAcC,OAAO;KAC5BC,OAAOzD,WAAW0D;KAClBC,MAAM5D,UAAU6D;KAChBC,WAAW;KACXC,SAAS;KACTC,WAAWf;KACXf,UAAUK,QAAQE,MAAM;KACxBY,SAASjB,MAAMK;KACfwB,kBAAkBnB,aAAa;KAC/BoB,kBAAkBlB,aAAa;KAC/BmB,aAAatC,MAAMuC;KACnBC,eAAexC,MAAMyC;KACrBC,MAAM,EAAEC,YAAYjB,EAAEkB,KAAK;IAC/B,CAAA;IACA,KAAKC,SAASC,YAAY,SAAA;GAC9B;GAEA,MAAMpB;EACV;EAEA,MAAMqB,gBAAgB,MAAM,KAAKC,mBAAmBvB,MAAMxB,MAAM;GAC5DgB;GACAE;GACAd,UAAUK,QAAQE,MAAM;GACxBE;EACJ,CAAA;EAEA,OAAO,KAAKmC,QACR;GACIxB;GACAf;GACAqC;EACJ,GACA;GACIjC;GACAG;GACAE;EACJ,CAAA;CAER;;;;;;IAQA,MAAgB6B,mBACZvB,MACAxB,MACAH,KAM2B;EAC3B,IAAI,CAAC,KAAKJ,0BACN;EAIJ,MAAMwD,SAAS,MAAM,KAAKxD,yBAAyByD,UAAU1B,KAAKb,IAAI,EAAEwC,eAAe,MAAM,CAAA;EAC7F,IAAI,CAACF,OAAOG,UACR;EAGJ,MAAMC,MAAMlE,gBAAgBa,MAAM,KAAA;EAClC,IAAI,CAACqD,KAAK;GAQN,MAAMC,SAAS,MAAM,KAAKC,eAAe/B,MAAMyB,OAAOO,OAAO3D,GAAAA;GAE7D,MAAM,IAAItB,uBAAuB;IAC7BkF,SAAS;IACThB,MAAM;KACFe,OAAOP,OAAOO;KACd,GAAIF,SAAS;MACTI,WAAWJ,OAAOK;MAClBC,sBAAsBN,OAAOO;KACjC,IAAI,CAAC;IACT;GACJ,CAAA;EACJ;EAcA,IAAI,CAACC,MAZkB,KAAKrE,yBAAyBsE,OACjDvC,KAAKb,IACL;GACIqD,MAAMjF,qCAAqCsE,GAAAA;GAC3CY,UAAUZ;EACd,GACA;GACIrC,WAAWnB,IAAImB,aAAa;GAC5BE,WAAWrB,IAAIqB,aAAa;GAC5Bd,UAAUP,IAAIO;EAClB,CAAA,GAGA,MAAM,IAAI7B,uBAAuB;GAC7BkF,SAAS;GACThB,MAAM,EAAEe,OAAOP,OAAOO,MAAM;EAChC,CAAA;EAGJ,wBAAO,IAAIU,KAAAA,EAAAA,CAAOC,YAAW;CACjC;;;;;;;IASA,MAAgBZ,eACZ/B,MACAgC,OACA3D,KAMqD;EACrD,IAAI,CAAC,KAAKH,iBACN,OAAO;EAKX,IAAI,EAFgB8D,MAAMa,SAASjG,sBAAsBkG,KAAK,KAC1Dd,MAAMa,SAASjG,sBAAsBmG,QAAQ,IAE7C,OAAO;EAGX,IAAI;GACA,OAAO,MAAM,KAAK7E,gBAAgB8E,YAC9B;IACIhD;IACApB,UAAUP,IAAIO;IACdS,cAAchB,IAAIgB;GACtB,GACA;IACIG,WAAWnB,IAAImB;IACfE,WAAWrB,IAAIqB;GACnB,CAAA;EAER,SAASO,GAAG;GAMR,KAAK9B,QAAQ8E,KAAK,gDAAgD,EAAEC,OAAOjD,EAAE,CAAA;GAE7E,OAAO;EACX;CACJ;AACJ"}
1	+ {"version":3,"file":"password.mjs","names":["EventName","EventScope","UserAuthenticatorKind","isEntityCredentialsInvalidError","isEntityInactiveError","OAuth2MfaRequiredError","OAuth2RequestError","OAuth2TokenGrant","readRequestBody","getRequestHeader","getRequestIP","PasswordGrantType","assertClientGrantAllowed","guessUserAuthenticatorKindByResponse","extractClientCredentialsFromRequest","extractOAuth2ClientCertificateEvidence","readRealmHint","readStringField","HTTPPasswordGrant","authenticator","clientAuthenticator","realmRepository","loginThrottleService","userAuthenticatorService","mfaLoginService","logger","certificateSource","ctx","runWithRequest","event","body","username","password","malformed","clientId","clientSecret","realm","resolve","certificateEvidence","client","authenticate","id","undefined","confirmation","resolveTokenBinding","PASSWORD","ipAddress","trustProxy","userAgent","identifier","trim","toLowerCase","assertNotThrottled","realmId","user","e","eventService","record","scope","OAUTH2","name","LOGIN_FAILED","actorType","actorId","actorName","requestIpAddress","requestUserAgent","requestPath","path","requestMethod","method","data","errorCode","code","metrics","recordLogin","mfaVerifiedAt","verifySecondFactor","runWith","status","challenge","issueMaterial","required","otp","ticket","issueMfaTicket","kinds","message","mfa_token","token","mfa_token_expires_in","expiresIn","verified","verify","kind","response","Date","toISOString","interactive","includes","EMAIL","WEBAUTHN","issueTicket","warn","error"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/password.ts"],"sourcesContent":["/\n Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { User } from '@authup/core-kit';\nimport { EventName, EventScope, UserAuthenticatorKind } from '@authup/core-kit';\nimport type { Logger } from '@authup/server-kit';\nimport { isEntityCredentialsInvalidError, isEntityInactiveError } from '@authup/errors';\nimport type { OAuth2TokenConfirmation, OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2MfaRequiredError, OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type {\n ICredentialsAuthenticator,\n ILoginThrottleService,\n IOAuth2MfaLoginService,\n IRealmRepository,\n IUserAuthenticatorService,\n OAuth2ClientAuthenticator,\n} from '../../../../../core/index.ts';\nimport {\n PasswordGrantType,\n assertClientGrantAllowed,\n guessUserAuthenticatorKindByResponse,\n} from '../../../../../core/index.ts';\nimport type { HTTPOAuth2PasswordGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport type { CertificateSource } from '../../../request/index.ts';\nimport {\n extractClientCredentialsFromRequest,\n extractOAuth2ClientCertificateEvidence,\n readRealmHint,\n readStringField,\n} from './utils/index.ts';\n\nexport class HTTPPasswordGrant extends PasswordGrantType implements IHTTPOAuth2Grant {\n protected authenticator : ICredentialsAuthenticator<User>;\n\n protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n protected realmRepository : IRealmRepository;\n\n protected loginThrottleService? : ILoginThrottleService;\n\n protected userAuthenticatorService? : IUserAuthenticatorService;\n\n protected mfaLoginService? : IOAuth2MfaLoginService;\n\n protected logger? : Logger;\n\n protected certificateSource: CertificateSource;\n\n constructor(ctx: HTTPOAuth2PasswordGrantContext) {\n super(ctx);\n\n this.authenticator = ctx.authenticator;\n this.clientAuthenticator = ctx.clientAuthenticator;\n this.realmRepository = ctx.realmRepository;\n this.loginThrottleService = ctx.loginThrottleService;\n this.userAuthenticatorService = ctx.userAuthenticatorService;\n this.mfaLoginService = ctx.mfaLoginService;\n this.logger = ctx.logger;\n this.certificateSource = ctx.certificateSource ?? 'disabled';\n }\n\n async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n const body = await readRequestBody(event);\n\n const username = readStringField(body, 'username');\n const password = readStringField(body, 'password');\n if (!username \|\| !password) {\n throw OAuth2RequestError.malformed('username and password must be provided.');\n }\n\n const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n\n const realm = await this.realmRepository.resolve(readRealmHint(body), true);\n const certificateEvidence = await extractOAuth2ClientCertificateEvidence(event, this.certificateSource);\n\n const client = clientId ?\n await this.clientAuthenticator.authenticate(\n clientId,\n clientSecret,\n realm.id,\n certificateEvidence,\n ) :\n undefined;\n\n const confirmation = client ?\n this.clientAuthenticator.resolveTokenBinding(client, certificateEvidence) :\n undefined;\n\n if (client) {\n assertClientGrantAllowed(client, OAuth2TokenGrant.PASSWORD);\n }\n\n const ipAddress = getRequestIP(event, { trustProxy: true }) ?? undefined;\n const userAgent = getRequestHeader(event, 'user-agent') ?? undefined;\n\n // canonical identifier form (layer 3) — the throttle key and the\n // loginFailed actorName must match what canonically stored rows carry.\n const identifier = username.trim().toLowerCase();\n\n await this.loginThrottleService?.assertNotThrottled({\n identifier,\n ipAddress,\n realmId: realm.id,\n });\n\n let user : User;\n try {\n user = await this.authenticator.authenticate(username, password, realm.id);\n } catch (e) {\n if (isEntityCredentialsInvalidError(e) \|\| isEntityInactiveError(e)) {\n await this.eventService?.record({\n scope: EventScope.OAUTH2,\n name: EventName.LOGIN_FAILED,\n actorType: null,\n actorId: null,\n actorName: identifier,\n clientId: client?.id ?? null,\n realmId: realm.id,\n requestIpAddress: ipAddress ?? null,\n requestUserAgent: userAgent ?? null,\n requestPath: event.path,\n requestMethod: event.method,\n data: { errorCode: e.code },\n });\n this.metrics?.recordLogin('failure');\n }\n\n throw e;\n }\n\n const mfaVerifiedAt = await this.verifySecondFactor(user, body, {\n ipAddress,\n userAgent,\n clientId: client?.id ?? null,\n confirmation,\n });\n\n return this.runWith(\n {\n user, \n client, \n mfaVerifiedAt, \n },\n {\n confirmation,\n ipAddress,\n userAgent,\n },\n );\n }\n\n /\n MFA gate on the direct password grant: a user holding a confirmed\n * device must send a valid `otp` form parameter (TOTP or recovery\n * code, classified by shape) — otherwise `mfa_required`. Users\n * without a device pass through (they could never enroll otherwise).\n /\n protected async verifySecondFactor(\n user: User,\n body: Record<string, any>,\n ctx: {\n ipAddress?: string, \n userAgent?: string, \n clientId: string \| null,\n confirmation?: OAuth2TokenConfirmation,\n },\n ): Promise<string \| undefined> {\n if (!this.userAuthenticatorService) {\n return undefined;\n }\n\n // requirement flags + kinds only — no webauthn material on the token path.\n const status = await this.userAuthenticatorService.challenge(user.id, { issueMaterial: false });\n if (!status.required) {\n return undefined;\n }\n\n const otp = readStringField(body, 'otp');\n if (!otp) {\n // carry the challengeable kinds so a client (the hosted login form)\n // can tell whether a single-POST factor (totp/recovery) is on offer\n // or the user must complete an interactive challenge (email/webauthn).\n // For the interactive kinds an \"MFA-pending\" ticket (issue #3242)\n // rides along: a restricted mfa_token-kind bearer accepted ONLY by\n // the challenge routes, backed by a short-lived pending session\n // (mfa_at: null) — never a usable access/refresh pair.\n const ticket = await this.issueMfaTicket(user, status.kinds, ctx);\n\n throw new OAuth2MfaRequiredError({\n message: 'Complete a second-factor challenge to continue.',\n data: {\n kinds: status.kinds,\n ...(ticket ? {\n mfa_token: ticket.token,\n mfa_token_expires_in: ticket.expiresIn,\n } : {}),\n },\n });\n }\n\n const verified = await this.userAuthenticatorService.verify(\n user.id,\n {\n kind: guessUserAuthenticatorKindByResponse(otp),\n response: otp,\n },\n {\n ipAddress: ctx.ipAddress ?? null,\n userAgent: ctx.userAgent ?? null,\n clientId: ctx.clientId,\n },\n );\n if (!verified) {\n throw new OAuth2MfaRequiredError({\n message: 'The provided second factor is not valid.',\n data: { kinds: status.kinds },\n });\n }\n\n return new Date().toISOString();\n }\n\n /\n Issue the MFA-pending ticket for factor kinds that cannot complete\n * inside the single grant POST (email needs a server-sent code,\n * WebAuthn an interactive ceremony). TOTP/recovery-only users keep\n * the inline `otp` fast-path and get no ticket — a pending session\n * per plain code entry would be pure churn.\n */\n protected async issueMfaTicket(\n user: User,\n kinds: `${UserAuthenticatorKind}`[],\n ctx: {\n ipAddress?: string,\n userAgent?: string,\n clientId: string \| null,\n confirmation?: OAuth2TokenConfirmation,\n },\n ) : Promise<{ token: string, expiresIn: number } \| null> {\n if (!this.mfaLoginService) {\n return null;\n }\n\n const interactive = kinds.includes(UserAuthenticatorKind.EMAIL) \|\|\n kinds.includes(UserAuthenticatorKind.WEBAUTHN);\n if (!interactive) {\n return null;\n }\n\n try {\n return await this.mfaLoginService.issueTicket(\n {\n user,\n clientId: ctx.clientId,\n confirmation: ctx.confirmation,\n },\n {\n ipAddress: ctx.ipAddress,\n userAgent: ctx.userAgent,\n },\n );\n } catch (e) {\n // degrade to a ticket-less mfa_required rather than letting a\n // transient issuance failure (pending-session write, cache,\n // signer) escape as a raw 500 from a controlled response path —\n // an otp-capable device can still complete, and the credential\n // retry re-attempts the ticket.\n this.logger?.warn('Issuing the MFA-pending login ticket failed.', { error: e });\n\n return null;\n }\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAsCA,IAAakB,oBAAb,cAAuCP,kBAAAA;CACzBQ;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAMA,GAAAA;EAEN,KAAKR,gBAAgBQ,IAAIR;EACzB,KAAKC,sBAAsBO,IAAIP;EAC/B,KAAKC,kBAAkBM,IAAIN;EAC3B,KAAKC,uBAAuBK,IAAIL;EAChC,KAAKC,2BAA2BI,IAAIJ;EACpC,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,SAASE,IAAIF;EAClB,KAAKC,oBAAoBC,IAAID,qBAAqB;CACtD;CAEA,MAAME,eAAeC,OAAqD;EACtE,MAAMC,OAAO,MAAMtB,gBAAgBqB,KAAAA;EAEnC,MAAME,WAAWd,gBAAgBa,MAAM,UAAA;EACvC,MAAME,WAAWf,gBAAgBa,MAAM,UAAA;EACvC,IAAI,CAACC,YAAY,CAACC,UACd,MAAM1B,mBAAmB2B,UAAU,yCAAA;EAGvC,MAAM,EAAEC,UAAUC,iBAAiB,MAAMrB,oCAAoCe,KAAAA;EAE7E,MAAMO,QAAQ,MAAM,KAAKf,gBAAgBgB,QAAQrB,cAAcc,IAAAA,GAAO,IAAA;EACtE,MAAMQ,sBAAsB,MAAMvB,uCAAuCc,OAAO,KAAKH,iBAAiB;EAEtG,MAAMa,SAASL,WACX,MAAM,KAAKd,oBAAoBoB,aAC3BN,UACAC,cACAC,MAAMK,IACNH,mBAAAA,IAEJI,KAAAA;EAEJ,MAAMC,eAAeJ,SACjB,KAAKnB,oBAAoBwB,oBAAoBL,QAAQD,mBAAAA,IACrDI,KAAAA;EAEJ,IAAIH,QACA3B,yBAAyB2B,QAAQhC,iBAAiBsC,QAAQ;EAG9D,MAAMC,YAAYpC,aAAamB,OAAO,EAAEkB,YAAY,KAAK,CAAA,KAAML,KAAAA;EAC/D,MAAMM,YAAYvC,iBAAiBoB,OAAO,YAAA,KAAiBa,KAAAA;EAI3D,MAAMO,aAAalB,SAASmB,KAAI,CAAA,CAAGC,YAAW;EAE9C,MAAM,KAAK7B,sBAAsB8B,mBAAmB;GAChDH;GACAH;GACAO,SAASjB,MAAMK;EACnB,CAAA;EAEA,IAAIa;EACJ,IAAI;GACAA,OAAO,MAAM,KAAKnC,cAAcqB,aAAaT,UAAUC,UAAUI,MAAMK,EAAE;EAC7E,SAASc,GAAG;GACR,IAAIpD,gCAAgCoD,CAAAA,KAAMnD,sBAAsBmD,CAAAA,GAAI;IAChE,MAAM,KAAKC,cAAcC,OAAO;KAC5BC,OAAOzD,WAAW0D;KAClBC,MAAM5D,UAAU6D;KAChBC,WAAW;KACXC,SAAS;KACTC,WAAWf;KACXf,UAAUK,QAAQE,MAAM;KACxBY,SAASjB,MAAMK;KACfwB,kBAAkBnB,aAAa;KAC/BoB,kBAAkBlB,aAAa;KAC/BmB,aAAatC,MAAMuC;KACnBC,eAAexC,MAAMyC;KACrBC,MAAM,EAAEC,WAAWjB,EAAEkB,KAAK;IAC9B,CAAA;IACA,KAAKC,SAASC,YAAY,SAAA;GAC9B;GAEA,MAAMpB;EACV;EAEA,MAAMqB,gBAAgB,MAAM,KAAKC,mBAAmBvB,MAAMxB,MAAM;GAC5DgB;GACAE;GACAd,UAAUK,QAAQE,MAAM;GACxBE;EACJ,CAAA;EAEA,OAAO,KAAKmC,QACR;GACIxB;GACAf;GACAqC;EACJ,GACA;GACIjC;GACAG;GACAE;EACJ,CAAA;CAER;;;;;;IAQA,MAAgB6B,mBACZvB,MACAxB,MACAH,KAM2B;EAC3B,IAAI,CAAC,KAAKJ,0BACN;EAIJ,MAAMwD,SAAS,MAAM,KAAKxD,yBAAyByD,UAAU1B,KAAKb,IAAI,EAAEwC,eAAe,MAAM,CAAA;EAC7F,IAAI,CAACF,OAAOG,UACR;EAGJ,MAAMC,MAAMlE,gBAAgBa,MAAM,KAAA;EAClC,IAAI,CAACqD,KAAK;GAQN,MAAMC,SAAS,MAAM,KAAKC,eAAe/B,MAAMyB,OAAOO,OAAO3D,GAAAA;GAE7D,MAAM,IAAItB,uBAAuB;IAC7BkF,SAAS;IACThB,MAAM;KACFe,OAAOP,OAAOO;KACd,GAAIF,SAAS;MACTI,WAAWJ,OAAOK;MAClBC,sBAAsBN,OAAOO;KACjC,IAAI,CAAC;IACT;GACJ,CAAA;EACJ;EAcA,IAAI,CAACC,MAZkB,KAAKrE,yBAAyBsE,OACjDvC,KAAKb,IACL;GACIqD,MAAMjF,qCAAqCsE,GAAAA;GAC3CY,UAAUZ;EACd,GACA;GACIrC,WAAWnB,IAAImB,aAAa;GAC5BE,WAAWrB,IAAIqB,aAAa;GAC5Bd,UAAUP,IAAIO;EAClB,CAAA,GAGA,MAAM,IAAI7B,uBAAuB;GAC7BkF,SAAS;GACThB,MAAM,EAAEe,OAAOP,OAAOO,MAAM;EAChC,CAAA;EAGJ,wBAAO,IAAIU,KAAAA,EAAAA,CAAOC,YAAW;CACjC;;;;;;;IASA,MAAgBZ,eACZ/B,MACAgC,OACA3D,KAMqD;EACrD,IAAI,CAAC,KAAKH,iBACN,OAAO;EAKX,IAAI,EAFgB8D,MAAMa,SAASjG,sBAAsBkG,KAAK,KAC1Dd,MAAMa,SAASjG,sBAAsBmG,QAAQ,IAE7C,OAAO;EAGX,IAAI;GACA,OAAO,MAAM,KAAK7E,gBAAgB8E,YAC9B;IACIhD;IACApB,UAAUP,IAAIO;IACdS,cAAchB,IAAIgB;GACtB,GACA;IACIG,WAAWnB,IAAImB;IACfE,WAAWrB,IAAIqB;GACnB,CAAA;EAER,SAASO,GAAG;GAMR,KAAK9B,QAAQ8E,KAAK,gDAAgD,EAAEC,OAAOjD,EAAE,CAAA;GAE7E,OAAO;EACX;CACJ;AACJ"}

package/dist/adapters/http/adapters/oauth2/grant-types/refresh_token.mjs CHANGED Viewed

@@ -46,7 +46,7 @@ var HTTPOAuth2RefreshTokenGrant = class extends OAuth2RefreshTokenGrant {
 			confirmation = this.clientAuthenticator.validateCertificateEvidenceForBinding(certificateEvidence);
 			if (confirmation["x5t#S256"] !== expectedThumbprint) throw OAuth2GrantError.invalid();
 		} else if (client) confirmation = this.clientAuthenticator.resolveTokenBinding(client, certificateEvidence);
-		if (client && isClientPublic(client) && payload.realm_id && payload.realm_id !== client.realm_id) throw OAuth2GrantError.invalid();
+		if (client && isClientPublic(client) && payload.realm_id && payload.realm_id !== client.realmId) throw OAuth2GrantError.invalid();
 		return this.runWith(payload, {
 			confirmation,
 			ipAddress: getRequestIP(event, { trustProxy: true }) ?? void 0,

package/dist/adapters/http/adapters/oauth2/grant-types/refresh_token.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"refresh_token.mjs","names":["isClientPublic","OAuth2GrantError","OAuth2RequestError","OAuth2TokenGrant","readRequestBody","getRequestHeader","getRequestIP","OAuth2RefreshTokenGrant","assertClientGrantAllowed","extractClientCredentialsFromRequest","extractOAuth2ClientCertificateEvidence","readRealmHint","HTTPOAuth2RefreshTokenGrant","clientAuthenticator","refreshTokenVerifier","realmRepository","certificateSource","ctx","tokenVerifier","runWithRequest","event","body","refreshToken","refresh_token","length","malformed","clientId","clientSecret","certificateEvidence","payload","verify","skipActiveCheck","client","realm","resolve","authenticate","id","client_id","invalid","undefined","REFRESH_TOKEN","confirmation","cnf","expectedThumbprint","validateCertificateEvidenceForBinding","resolveTokenBinding","realm_id","runWith","ipAddress","trustProxy","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/refresh_token.ts"],"sourcesContent":["/\n Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { type Client, isClientPublic } from '@authup/core-kit';\nimport type { OAuth2TokenConfirmation, OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2GrantError, OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport { OAuth2RefreshTokenGrant, assertClientGrantAllowed } from '../../../../../core/index.ts';\nimport type {\n IOAuth2TokenVerifier,\n IRealmRepository,\n OAuth2ClientAuthenticator,\n} from '../../../../../core/index.ts';\nimport type { HTTPOAuth2RefreshTokenGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport type { CertificateSource } from '../../../request/index.ts';\nimport {\n extractClientCredentialsFromRequest,\n extractOAuth2ClientCertificateEvidence,\n readRealmHint,\n} from './utils/index.ts';\n\nexport class HTTPOAuth2RefreshTokenGrant extends OAuth2RefreshTokenGrant implements IHTTPOAuth2Grant {\n protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n protected refreshTokenVerifier : IOAuth2TokenVerifier;\n\n protected realmRepository : IRealmRepository;\n\n protected certificateSource: CertificateSource;\n\n constructor(ctx: HTTPOAuth2RefreshTokenGrantContext) {\n super(ctx);\n\n this.clientAuthenticator = ctx.clientAuthenticator;\n this.refreshTokenVerifier = ctx.tokenVerifier;\n this.realmRepository = ctx.realmRepository;\n this.certificateSource = ctx.certificateSource ?? 'disabled';\n }\n\n async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n const body = await readRequestBody(event);\n const refreshToken = body?.refresh_token;\n if (typeof refreshToken !== 'string' \|\| refreshToken.length === 0) {\n throw OAuth2RequestError.malformed();\n }\n\n const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n const certificateEvidence = await extractOAuth2ClientCertificateEvidence(event, this.certificateSource);\n\n // RFC 6749 §6: verify the refresh token first to learn its bound\n // client (if any), then enforce binding. Authenticate the requesting\n // client when credentials are present, or when the token requires\n // a client binding.\n //\n // skipActiveCheck: the durable auth_session_tokens row (not the cache\n // blocklist) is the refresh-token authority, so a replayed/consumed\n // token must reach runWith() to trigger family revocation instead of\n // being rejected here with JWT_INACTIVE.\n const payload = await this.refreshTokenVerifier.verify(refreshToken, { skipActiveCheck: true });\n\n let client: Client \| undefined;\n\n if (clientId) {\n // A client authenticated itself. Resolve by the presented\n // id/secret (name resolution scoped by the realm hint — resolved\n // lazily so a bare refresh skips the SELECT) and enforce the\n // token↔client binding.\n const realm = await this.realmRepository.resolve(readRealmHint(body), true);\n\n client = await this.clientAuthenticator.authenticate(\n clientId,\n clientSecret,\n realm.id,\n certificateEvidence,\n );\n\n if (payload.client_id && payload.client_id !== client.id) {\n throw OAuth2GrantError.invalid();\n }\n } else if (payload.client_id) {\n // No client credentials were presented, but the token is bound to\n // a client. RFC 6749 §10.4: a public client cannot authenticate\n // (no secret) and is not required to — the bound identity is read\n // from the signed token (client_id is server-minted, so trusted)\n // and refresh-token rotation/replay detection is the abuse control.\n // A client with an authentication method MUST still authenticate.\n // Supplying the server-minted client id lets TLS clients prove\n // themselves with the request certificate, while a secret client\n // still fails because its secret is absent.\n client = await this.clientAuthenticator.authenticate(\n payload.client_id,\n undefined,\n undefined,\n certificateEvidence,\n );\n }\n\n if (client) {\n assertClientGrantAllowed(client, OAuth2TokenGrant.REFRESH_TOKEN);\n }\n\n let confirmation: OAuth2TokenConfirmation \| undefined;\n if (payload.cnf) {\n const expectedThumbprint = payload.cnf['x5t#S256'];\n if (typeof expectedThumbprint !== 'string' \|\| expectedThumbprint.length === 0) {\n throw OAuth2GrantError.invalid();\n }\n\n confirmation = this.clientAuthenticator.validateCertificateEvidenceForBinding(\n certificateEvidence,\n );\n if (confirmation['x5t#S256'] !== expectedThumbprint) {\n throw OAuth2GrantError.invalid();\n }\n } else if (client) {\n confirmation = this.clientAuthenticator.resolveTokenBinding(client, certificateEvidence);\n }\n\n // Realm parity for PUBLIC clients only: a public client may not refresh\n // a token whose realm differs from the (bound) client's own realm.\n // Kills cross-realm refresh tokens minted for a public `web` client\n // before the authorize-side realm gate existed. Authenticated clients\n // are exempt — the configured secret/certificate proves identity, and the\n // documented cross-realm password grant (UUID-identified user against a\n // master-realm client) depends on that exemption.\n if (\n client &&\n isClientPublic(client) &&\n payload.realm_id &&\n payload.realm_id !== client.~~realm_id~~\n ) {\n throw OAuth2GrantError.invalid();\n }\n\n return this.runWith(payload, {\n confirmation,\n ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n });\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;AA2BA,IAAaY,8BAAb,cAAiDL,wBAAAA;CACnCM;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAyC;EACjD,MAAMA,GAAAA;EAEN,KAAKJ,sBAAsBI,IAAIJ;EAC/B,KAAKC,uBAAuBG,IAAIC;EAChC,KAAKH,kBAAkBE,IAAIF;EAC3B,KAAKC,oBAAoBC,IAAID,qBAAqB;CACtD;CAEA,MAAMG,eAAeC,OAAqD;EACtE,MAAMC,OAAO,MAAMjB,gBAAgBgB,KAAAA;EACnC,MAAME,eAAeD,MAAME;EAC3B,IAAI,OAAOD,iBAAiB,YAAYA,aAAaE,WAAW,GAC5D,MAAMtB,mBAAmBuB,UAAS;EAGtC,MAAM,EAAEC,UAAUC,iBAAiB,MAAMlB,oCAAoCW,KAAAA;EAC7E,MAAMQ,sBAAsB,MAAMlB,uCAAuCU,OAAO,KAAKJ,iBAAiB;EAWtG,MAAMa,UAAU,MAAM,KAAKf,qBAAqBgB,OAAOR,cAAc,EAAES,iBAAiB,KAAK,CAAA;EAE7F,IAAIC;EAEJ,IAAIN,UAAU;GAKV,MAAMO,QAAQ,MAAM,KAAKlB,gBAAgBmB,QAAQvB,cAAcU,IAAAA,GAAO,IAAA;GAEtEW,SAAS,MAAM,KAAKnB,oBAAoBsB,aACpCT,UACAC,cACAM,MAAMG,IACNR,mBAAAA;GAGJ,IAAIC,QAAQQ,aAAaR,QAAQQ,cAAcL,OAAOI,IAClD,MAAMnC,iBAAiBqC,QAAO;EAEtC,OAAO,IAAIT,QAAQQ,WAUfL,SAAS,MAAM,KAAKnB,oBAAoBsB,aACpCN,QAAQQ,WACRE,KAAAA,GACAA,KAAAA,GACAX,mBAAAA;EAIR,IAAII,QACAxB,yBAAyBwB,QAAQ7B,iBAAiBqC,aAAa;EAGnE,IAAIC;EACJ,IAAIZ,QAAQa,KAAK;GACb,MAAMC,qBAAqBd,QAAQa,IAAI;GACvC,IAAI,OAAOC,uBAAuB,YAAYA,mBAAmBnB,WAAW,GACxE,MAAMvB,iBAAiBqC,QAAO;GAGlCG,eAAe,KAAK5B,oBAAoB+B,sCACpChB,mBAAAA;GAEJ,IAAIa,aAAa,gBAAgBE,oBAC7B,MAAM1C,iBAAiBqC,QAAO;EAEtC,OAAO,IAAIN,QACPS,eAAe,KAAK5B,oBAAoBgC,oBAAoBb,QAAQJ,mBAAAA;EAUxE,IACII,UACAhC,eAAegC,MAAAA,KACfH,QAAQiB,YACRjB,QAAQiB,aAAad,~~OAAOc~~,~~UAE5B~~,~~MAAM7C~~,iBAAiBqC,QAAO;EAGlC,OAAO,~~KAAKS~~,~~QAAQlB~~,SAAS;GACzBY;~~GACAO~~,~~WAAW1C~~,aAAac,OAAO,~~EAAE6B~~,YAAY,KAAK,CAAA,~~KAAMV~~,KAAAA;~~GACxDW~~,~~WAAW7C~~,iBAAiBe,OAAO,YAAA,KAAiBmB,KAAAA;EACxD,CAAA;CACJ;AACJ"}
1	+ {"version":3,"file":"refresh_token.mjs","names":["isClientPublic","OAuth2GrantError","OAuth2RequestError","OAuth2TokenGrant","readRequestBody","getRequestHeader","getRequestIP","OAuth2RefreshTokenGrant","assertClientGrantAllowed","extractClientCredentialsFromRequest","extractOAuth2ClientCertificateEvidence","readRealmHint","HTTPOAuth2RefreshTokenGrant","clientAuthenticator","refreshTokenVerifier","realmRepository","certificateSource","ctx","tokenVerifier","runWithRequest","event","body","refreshToken","refresh_token","length","malformed","clientId","clientSecret","certificateEvidence","payload","verify","skipActiveCheck","client","realm","resolve","authenticate","id","client_id","invalid","undefined","REFRESH_TOKEN","confirmation","cnf","expectedThumbprint","validateCertificateEvidenceForBinding","resolveTokenBinding","realm_id","realmId","runWith","ipAddress","trustProxy","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/refresh_token.ts"],"sourcesContent":["/\n Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { type Client, isClientPublic } from '@authup/core-kit';\nimport type { OAuth2TokenConfirmation, OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2GrantError, OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport { OAuth2RefreshTokenGrant, assertClientGrantAllowed } from '../../../../../core/index.ts';\nimport type {\n IOAuth2TokenVerifier,\n IRealmRepository,\n OAuth2ClientAuthenticator,\n} from '../../../../../core/index.ts';\nimport type { HTTPOAuth2RefreshTokenGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport type { CertificateSource } from '../../../request/index.ts';\nimport {\n extractClientCredentialsFromRequest,\n extractOAuth2ClientCertificateEvidence,\n readRealmHint,\n} from './utils/index.ts';\n\nexport class HTTPOAuth2RefreshTokenGrant extends OAuth2RefreshTokenGrant implements IHTTPOAuth2Grant {\n protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n protected refreshTokenVerifier : IOAuth2TokenVerifier;\n\n protected realmRepository : IRealmRepository;\n\n protected certificateSource: CertificateSource;\n\n constructor(ctx: HTTPOAuth2RefreshTokenGrantContext) {\n super(ctx);\n\n this.clientAuthenticator = ctx.clientAuthenticator;\n this.refreshTokenVerifier = ctx.tokenVerifier;\n this.realmRepository = ctx.realmRepository;\n this.certificateSource = ctx.certificateSource ?? 'disabled';\n }\n\n async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n const body = await readRequestBody(event);\n const refreshToken = body?.refresh_token;\n if (typeof refreshToken !== 'string' \|\| refreshToken.length === 0) {\n throw OAuth2RequestError.malformed();\n }\n\n const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n const certificateEvidence = await extractOAuth2ClientCertificateEvidence(event, this.certificateSource);\n\n // RFC 6749 §6: verify the refresh token first to learn its bound\n // client (if any), then enforce binding. Authenticate the requesting\n // client when credentials are present, or when the token requires\n // a client binding.\n //\n // skipActiveCheck: the durable auth_session_tokens row (not the cache\n // blocklist) is the refresh-token authority, so a replayed/consumed\n // token must reach runWith() to trigger family revocation instead of\n // being rejected here with JWT_INACTIVE.\n const payload = await this.refreshTokenVerifier.verify(refreshToken, { skipActiveCheck: true });\n\n let client: Client \| undefined;\n\n if (clientId) {\n // A client authenticated itself. Resolve by the presented\n // id/secret (name resolution scoped by the realm hint — resolved\n // lazily so a bare refresh skips the SELECT) and enforce the\n // token↔client binding.\n const realm = await this.realmRepository.resolve(readRealmHint(body), true);\n\n client = await this.clientAuthenticator.authenticate(\n clientId,\n clientSecret,\n realm.id,\n certificateEvidence,\n );\n\n if (payload.client_id && payload.client_id !== client.id) {\n throw OAuth2GrantError.invalid();\n }\n } else if (payload.client_id) {\n // No client credentials were presented, but the token is bound to\n // a client. RFC 6749 §10.4: a public client cannot authenticate\n // (no secret) and is not required to — the bound identity is read\n // from the signed token (client_id is server-minted, so trusted)\n // and refresh-token rotation/replay detection is the abuse control.\n // A client with an authentication method MUST still authenticate.\n // Supplying the server-minted client id lets TLS clients prove\n // themselves with the request certificate, while a secret client\n // still fails because its secret is absent.\n client = await this.clientAuthenticator.authenticate(\n payload.client_id,\n undefined,\n undefined,\n certificateEvidence,\n );\n }\n\n if (client) {\n assertClientGrantAllowed(client, OAuth2TokenGrant.REFRESH_TOKEN);\n }\n\n let confirmation: OAuth2TokenConfirmation \| undefined;\n if (payload.cnf) {\n const expectedThumbprint = payload.cnf['x5t#S256'];\n if (typeof expectedThumbprint !== 'string' \|\| expectedThumbprint.length === 0) {\n throw OAuth2GrantError.invalid();\n }\n\n confirmation = this.clientAuthenticator.validateCertificateEvidenceForBinding(\n certificateEvidence,\n );\n if (confirmation['x5t#S256'] !== expectedThumbprint) {\n throw OAuth2GrantError.invalid();\n }\n } else if (client) {\n confirmation = this.clientAuthenticator.resolveTokenBinding(client, certificateEvidence);\n }\n\n // Realm parity for PUBLIC clients only: a public client may not refresh\n // a token whose realm differs from the (bound) client's own realm.\n // Kills cross-realm refresh tokens minted for a public `web` client\n // before the authorize-side realm gate existed. Authenticated clients\n // are exempt — the configured secret/certificate proves identity, and the\n // documented cross-realm password grant (UUID-identified user against a\n // master-realm client) depends on that exemption.\n if (\n client &&\n isClientPublic(client) &&\n payload.realm_id &&\n payload.realm_id !== client.realmId\n ) {\n throw OAuth2GrantError.invalid();\n }\n\n return this.runWith(payload, {\n confirmation,\n ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n });\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;AA2BA,IAAaY,8BAAb,cAAiDL,wBAAAA;CACnCM;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAyC;EACjD,MAAMA,GAAAA;EAEN,KAAKJ,sBAAsBI,IAAIJ;EAC/B,KAAKC,uBAAuBG,IAAIC;EAChC,KAAKH,kBAAkBE,IAAIF;EAC3B,KAAKC,oBAAoBC,IAAID,qBAAqB;CACtD;CAEA,MAAMG,eAAeC,OAAqD;EACtE,MAAMC,OAAO,MAAMjB,gBAAgBgB,KAAAA;EACnC,MAAME,eAAeD,MAAME;EAC3B,IAAI,OAAOD,iBAAiB,YAAYA,aAAaE,WAAW,GAC5D,MAAMtB,mBAAmBuB,UAAS;EAGtC,MAAM,EAAEC,UAAUC,iBAAiB,MAAMlB,oCAAoCW,KAAAA;EAC7E,MAAMQ,sBAAsB,MAAMlB,uCAAuCU,OAAO,KAAKJ,iBAAiB;EAWtG,MAAMa,UAAU,MAAM,KAAKf,qBAAqBgB,OAAOR,cAAc,EAAES,iBAAiB,KAAK,CAAA;EAE7F,IAAIC;EAEJ,IAAIN,UAAU;GAKV,MAAMO,QAAQ,MAAM,KAAKlB,gBAAgBmB,QAAQvB,cAAcU,IAAAA,GAAO,IAAA;GAEtEW,SAAS,MAAM,KAAKnB,oBAAoBsB,aACpCT,UACAC,cACAM,MAAMG,IACNR,mBAAAA;GAGJ,IAAIC,QAAQQ,aAAaR,QAAQQ,cAAcL,OAAOI,IAClD,MAAMnC,iBAAiBqC,QAAO;EAEtC,OAAO,IAAIT,QAAQQ,WAUfL,SAAS,MAAM,KAAKnB,oBAAoBsB,aACpCN,QAAQQ,WACRE,KAAAA,GACAA,KAAAA,GACAX,mBAAAA;EAIR,IAAII,QACAxB,yBAAyBwB,QAAQ7B,iBAAiBqC,aAAa;EAGnE,IAAIC;EACJ,IAAIZ,QAAQa,KAAK;GACb,MAAMC,qBAAqBd,QAAQa,IAAI;GACvC,IAAI,OAAOC,uBAAuB,YAAYA,mBAAmBnB,WAAW,GACxE,MAAMvB,iBAAiBqC,QAAO;GAGlCG,eAAe,KAAK5B,oBAAoB+B,sCACpChB,mBAAAA;GAEJ,IAAIa,aAAa,gBAAgBE,oBAC7B,MAAM1C,iBAAiBqC,QAAO;EAEtC,OAAO,IAAIN,QACPS,eAAe,KAAK5B,oBAAoBgC,oBAAoBb,QAAQJ,mBAAAA;EAUxE,IACII,UACAhC,eAAegC,MAAAA,KACfH,QAAQiB,YACRjB,QAAQiB,aAAad,OAAOe,SAE5B,MAAM9C,iBAAiBqC,QAAO;EAGlC,OAAO,KAAKU,QAAQnB,SAAS;GACzBY;GACAQ,WAAW3C,aAAac,OAAO,EAAE8B,YAAY,KAAK,CAAA,KAAMX,KAAAA;GACxDY,WAAW9C,iBAAiBe,OAAO,YAAA,KAAiBmB,KAAAA;EACxD,CAAA;CACJ;AACJ"}

package/dist/adapters/http/adapters/oauth2/grant-types/types.d.ts CHANGED Viewed

@@ -1,4 +1,4 @@
-import type { Robot, User } from '@authup/core-kit';
+import type { User } from '@authup/core-kit';
 import type { Logger } from '@authup/server-kit';
 import type { OAuth2TokenGrantResponse } from '@authup/specs';
 import type { IAppEvent } from 'routup';
@@ -33,7 +33,4 @@ export type HTTPOAuth2ClientCredentialsGrantContext = BaseGrantContext & {
     clientAuthenticator: OAuth2ClientAuthenticator;
     certificateSource: CertificateSource;
 };
-export type HTTPOAuth2RobotCredentialsGrantContext = BaseGrantContext & {
-    authenticator: ICredentialsAuthenticator<Robot>;
-};
 //# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/adapters/oauth2/grant-types/types.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,~~KAAK,EAAE,~~IAAI,EAAE,MAAM,kBAAkB,CAAC;~~AACpD~~,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EACR,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,EACrB,4BAA4B,EAC5B,gCAAgC,EAChC,sBAAsB,EACtB,gBAAgB,EAChB,yBAAyB,EACzB,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,8BAA8B,EACjC,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,MAAM,MAAM,+BAA+B,GAAG,2BAA2B,GAAG;IACxE,YAAY,EAAE,gCAAgC,CAAC;IAC/C,mBAAmB,EAAE,yBAAyB,CAAC;IAC/C,eAAe,EAAE,gBAAgB,CAAC;IAClC,qBAAqB,CAAC,EAAE,4BAA4B,CAAC;IACrD,iBAAiB,EAAE,iBAAiB,CAAC;CACxC,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC7B,cAAc,CAAC,KAAK,EAAE,SAAS,GAAI,OAAO,CAAC,wBAAwB,CAAC,CAAA;CACvE;AAED,MAAM,MAAM,8BAA8B,GAAG,0BAA0B,GAAG;IACtE,aAAa,EAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAChD,mBAAmB,EAAE,yBAAyB,CAAC;IAC/C,eAAe,EAAE,gBAAgB,CAAC;IAClC,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAC7C,wBAAwB,CAAC,EAAE,yBAAyB,CAAC;IACrD,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,iBAAiB,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,kCAAkC,GAAG,8BAA8B,GAAG;IAC9E,mBAAmB,EAAE,yBAAyB,CAAC;IAC/C,eAAe,EAAE,gBAAgB,CAAC;IAClC,iBAAiB,EAAE,iBAAiB,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,uCAAuC,GAAG,gBAAgB,GAAG;IACrE,mBAAmB,EAAE,yBAAyB,CAAC;IAC/C,iBAAiB,EAAE,iBAAiB,CAAC;CACxC,CAAC~~;AAEF,MAAM,MAAM,sCAAsC,GAAG,gBAAgB,GAAG;IACpE,aAAa,EAAG,yBAAyB,CAAC,KAAK,CAAC,CAAA;CACnD,CAAC~~"}
1	+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EACR,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,EACrB,4BAA4B,EAC5B,gCAAgC,EAChC,sBAAsB,EACtB,gBAAgB,EAChB,yBAAyB,EACzB,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,8BAA8B,EACjC,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,MAAM,MAAM,+BAA+B,GAAG,2BAA2B,GAAG;IACxE,YAAY,EAAE,gCAAgC,CAAC;IAC/C,mBAAmB,EAAE,yBAAyB,CAAC;IAC/C,eAAe,EAAE,gBAAgB,CAAC;IAClC,qBAAqB,CAAC,EAAE,4BAA4B,CAAC;IACrD,iBAAiB,EAAE,iBAAiB,CAAC;CACxC,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC7B,cAAc,CAAC,KAAK,EAAE,SAAS,GAAI,OAAO,CAAC,wBAAwB,CAAC,CAAA;CACvE;AAED,MAAM,MAAM,8BAA8B,GAAG,0BAA0B,GAAG;IACtE,aAAa,EAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAChD,mBAAmB,EAAE,yBAAyB,CAAC;IAC/C,eAAe,EAAE,gBAAgB,CAAC;IAClC,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAC7C,wBAAwB,CAAC,EAAE,yBAAyB,CAAC;IACrD,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,iBAAiB,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,kCAAkC,GAAG,8BAA8B,GAAG;IAC9E,mBAAmB,EAAE,yBAAyB,CAAC;IAC/C,eAAe,EAAE,gBAAgB,CAAC;IAClC,iBAAiB,EAAE,iBAAiB,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,uCAAuC,GAAG,gBAAgB,GAAG;IACrE,mBAAmB,EAAE,yBAAyB,CAAC;IAC/C,iBAAiB,EAAE,iBAAiB,CAAC;CACxC,CAAC"}

package/dist/adapters/http/adapters/oauth2/grant-types/utils/guess.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"guess.d.ts","sourceRoot":"","sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/guess.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAIjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,wBAAsB,6BAA6B,CAC/C,KAAK,EAAE,SAAS,GAChB,OAAO,CAAC,GAAG,gBAAgB,EAAE,GAAG,SAAS,CAAC,~~CAkE7C~~"}
1	+ {"version":3,"file":"guess.d.ts","sourceRoot":"","sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/guess.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAIjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,wBAAsB,6BAA6B,CAC/C,KAAK,EAAE,SAAS,GAChB,OAAO,CAAC,GAAG,gBAAgB,EAAE,GAAG,SAAS,CAAC,CAyD7C"}

package/dist/adapters/http/adapters/oauth2/grant-types/utils/guess.mjs CHANGED Viewed

@@ -15,9 +15,6 @@ async function guessOauth2GrantTypeByRequest(event) {
 	const username = pick("username");
 	const password = pick("password");
 	if (username && password) return OAuth2TokenGrant.PASSWORD;
-	const robotId = pick("id");
-	const robotSecret = pick("secret");
-	if (robotId && robotSecret) return OAuth2TokenGrant.ROBOT_CREDENTIALS;
 	if (pick("refresh_token")) return OAuth2TokenGrant.REFRESH_TOKEN;
 	if (pick("code")) return OAuth2TokenGrant.AUTHORIZATION_CODE;
 	let clientId = pick("client_id");

package/dist/adapters/http/adapters/oauth2/grant-types/utils/guess.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"guess.mjs","names":["OAuth2TokenGrant","readRequestBody","useRequestQuery","AuthorizationHeaderType","parseAuthorizationHeader","guessOauth2GrantTypeByRequest","event","body","query","pick","key","grantType","validGrantTypes","Object","values","includes","username","password","PASSWORD","~~robotId","robotSecret","ROBOT_CREDENTIALS","~~refreshToken","REFRESH_TOKEN","code","AUTHORIZATION_CODE","clientId","clientSecret","headerValue","headers","get","header","type","BASIC","CLIENT_CREDENTIALS","undefined"],"sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/guess.ts"],"sourcesContent":["/\n Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { OAuth2TokenGrant } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport { useRequestQuery } from '@routup/basic/query';\nimport { AuthorizationHeaderType, parseAuthorizationHeader } from 'hapic';\nimport type { IAppEvent } from 'routup';\n\nexport async function guessOauth2GrantTypeByRequest(\n event: IAppEvent,\n) : Promise<`${OAuth2TokenGrant}` \| undefined> {\n const body = await readRequestBody(event);\n const query = useRequestQuery(event);\n\n const pick = (key: string): any => body?.[key] ?? query?.[key];\n\n const grantType = pick('grant_type');\n\n const validGrantTypes = Object.values(OAuth2TokenGrant);\n if (validGrantTypes.includes(grantType)) {\n return grantType;\n }\n\n const username = pick('username');\n const password = pick('password');\n\n if (username && password) {\n return OAuth2TokenGrant.PASSWORD;\n }\n\n // ------------------------------------------------------------------\n\n const robotId = pick('id');\n const robotSecret = pick('secret');\n\n if (robotId && robotSecret) {\n return OAuth2TokenGrant.ROBOT_CREDENTIALS;\n }\n\n // ------------------------------------------------------------------\n\n const refreshToken = pick('refresh_token');\n if (refreshToken) {\n return OAuth2TokenGrant.REFRESH_TOKEN;\n }\n\n // ------------------------------------------------------------------\n\n const code = pick('code');\n if (code) {\n return OAuth2TokenGrant.AUTHORIZATION_CODE;\n }\n\n // ------------------------------------------------------------------\n\n let clientId = pick('client_id');\n let clientSecret = pick('client_secret');\n\n if (!clientId && !clientSecret) {\n const headerValue = event.headers.get('authorization');\n\n if (headerValue) {\n const header = parseAuthorizationHeader(headerValue);\n\n if (header.type === AuthorizationHeaderType.BASIC) {\n clientId = header.username;\n clientSecret = header.password;\n }\n }\n }\n\n if (clientId && clientSecret) {\n return OAuth2TokenGrant.CLIENT_CREDENTIALS;\n }\n\n return undefined;\n}\n"],"mappings":";;;;;;;;AAaA,eAAsBK,8BAClBC,OAAgB;CAEhB,MAAMC,OAAO,MAAMN,gBAAgBK,KAAAA;CACnC,MAAME,QAAQN,gBAAgBI,KAAAA;CAE9B,MAAMG,QAAQC,QAAqBH,OAAOG,QAAQF,QAAQE;CAE1D,MAAMC,YAAYF,KAAK,YAAA;CAGvB,IADwBI,OAAOC,OAAOd,gBAClCY,CAAAA,CAAgBG,SAASJ,SAAAA,GACzB,OAAOA;CAGX,MAAMK,WAAWP,KAAK,UAAA;CACtB,MAAMQ,WAAWR,KAAK,UAAA;CAEtB,IAAIO,YAAYC,UACZ,OAAOjB,iBAAiBkB;~~CAK5B,MAAMC,UAAUV,KAAK,IAAA;CACrB,MAAMW,cAAcX,KAAK,QAAA;CAEzB,IAAIU,WAAWC,aACX,OAAOpB,iBAAiBqB;~~CAM5B,~~IADqBZ~~,KAAK,~~eACtBa~~,GACA,~~OAAOtB~~,~~iBAAiBuB~~;CAM5B,~~IADad~~,KAAK,~~MACde~~,GACA,~~OAAOxB~~,~~iBAAiByB~~;CAK5B,IAAIC,~~WAAWjB~~,KAAK,WAAA;CACpB,~~IAAIkB~~,~~eAAelB~~,KAAK,eAAA;CAExB,IAAI,~~CAACiB~~,YAAY,CAACC,cAAc;EAC5B,MAAMC,~~cAActB~~,~~MAAMuB~~,QAAQC,IAAI,eAAA;EAEtC,IAAIF,aAAa;GACb,MAAMG,~~SAAS3B~~,~~yBAAyBwB~~,WAAAA;GAExC,IAAIG,OAAOC,~~SAAS7B~~,~~wBAAwB8B~~,OAAO;IAC/CP,WAAWK,~~OAAOf~~;~~IAClBW~~,eAAeI,~~OAAOd~~;GAC1B;EACJ;CACJ;CAEA,~~IAAIS~~,YAAYC,cACZ,~~OAAO3B~~,~~iBAAiBkC~~;AAIhC"}
1	+ {"version":3,"file":"guess.mjs","names":["OAuth2TokenGrant","readRequestBody","useRequestQuery","AuthorizationHeaderType","parseAuthorizationHeader","guessOauth2GrantTypeByRequest","event","body","query","pick","key","grantType","validGrantTypes","Object","values","includes","username","password","PASSWORD","refreshToken","REFRESH_TOKEN","code","AUTHORIZATION_CODE","clientId","clientSecret","headerValue","headers","get","header","type","BASIC","CLIENT_CREDENTIALS","undefined"],"sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/guess.ts"],"sourcesContent":["/\n Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { OAuth2TokenGrant } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport { useRequestQuery } from '@routup/basic/query';\nimport { AuthorizationHeaderType, parseAuthorizationHeader } from 'hapic';\nimport type { IAppEvent } from 'routup';\n\nexport async function guessOauth2GrantTypeByRequest(\n event: IAppEvent,\n) : Promise<`${OAuth2TokenGrant}` \| undefined> {\n const body = await readRequestBody(event);\n const query = useRequestQuery(event);\n\n const pick = (key: string): any => body?.[key] ?? query?.[key];\n\n const grantType = pick('grant_type');\n\n const validGrantTypes = Object.values(OAuth2TokenGrant);\n if (validGrantTypes.includes(grantType)) {\n return grantType;\n }\n\n const username = pick('username');\n const password = pick('password');\n\n if (username && password) {\n return OAuth2TokenGrant.PASSWORD;\n }\n\n // ------------------------------------------------------------------\n\n const refreshToken = pick('refresh_token');\n if (refreshToken) {\n return OAuth2TokenGrant.REFRESH_TOKEN;\n }\n\n // ------------------------------------------------------------------\n\n const code = pick('code');\n if (code) {\n return OAuth2TokenGrant.AUTHORIZATION_CODE;\n }\n\n // ------------------------------------------------------------------\n\n let clientId = pick('client_id');\n let clientSecret = pick('client_secret');\n\n if (!clientId && !clientSecret) {\n const headerValue = event.headers.get('authorization');\n\n if (headerValue) {\n const header = parseAuthorizationHeader(headerValue);\n\n if (header.type === AuthorizationHeaderType.BASIC) {\n clientId = header.username;\n clientSecret = header.password;\n }\n }\n }\n\n if (clientId && clientSecret) {\n return OAuth2TokenGrant.CLIENT_CREDENTIALS;\n }\n\n return undefined;\n}\n"],"mappings":";;;;;;;;AAaA,eAAsBK,8BAClBC,OAAgB;CAEhB,MAAMC,OAAO,MAAMN,gBAAgBK,KAAAA;CACnC,MAAME,QAAQN,gBAAgBI,KAAAA;CAE9B,MAAMG,QAAQC,QAAqBH,OAAOG,QAAQF,QAAQE;CAE1D,MAAMC,YAAYF,KAAK,YAAA;CAGvB,IADwBI,OAAOC,OAAOd,gBAClCY,CAAAA,CAAgBG,SAASJ,SAAAA,GACzB,OAAOA;CAGX,MAAMK,WAAWP,KAAK,UAAA;CACtB,MAAMQ,WAAWR,KAAK,UAAA;CAEtB,IAAIO,YAAYC,UACZ,OAAOjB,iBAAiBkB;CAM5B,IADqBT,KAAK,eACtBU,GACA,OAAOnB,iBAAiBoB;CAM5B,IADaX,KAAK,MACdY,GACA,OAAOrB,iBAAiBsB;CAK5B,IAAIC,WAAWd,KAAK,WAAA;CACpB,IAAIe,eAAef,KAAK,eAAA;CAExB,IAAI,CAACc,YAAY,CAACC,cAAc;EAC5B,MAAMC,cAAcnB,MAAMoB,QAAQC,IAAI,eAAA;EAEtC,IAAIF,aAAa;GACb,MAAMG,SAASxB,yBAAyBqB,WAAAA;GAExC,IAAIG,OAAOC,SAAS1B,wBAAwB2B,OAAO;IAC/CP,WAAWK,OAAOZ;IAClBQ,eAAeI,OAAOX;GAC1B;EACJ;CACJ;CAEA,IAAIM,YAAYC,cACZ,OAAOxB,iBAAiB+B;AAIhC"}

package/dist/adapters/http/adapters/oauth2/index.mjs CHANGED Viewed

@@ -12,6 +12,5 @@ import { HTTPClientCredentialsGrant } from "./grant-types/client-credentials.mjs
 import { HTTPOAuth2IdentityGrantType } from "./grant-types/identity.mjs";
 import { HTTPPasswordGrant } from "./grant-types/password.mjs";
 import { HTTPOAuth2RefreshTokenGrant } from "./grant-types/refresh_token.mjs";
-import { HTTPRobotCredentialsGrant } from "./grant-types/robot-credentials.mjs";
 import "./grant-types/index.mjs";
-export { HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, guessOauth2GrantTypeByRequest, readRealmHint, readStringField };
+export { HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, guessOauth2GrantTypeByRequest, readRealmHint, readStringField };