npm - @authup/server-core - Versions diffs - 1.0.0-beta.53 → 1.0.0-beta.54 - Mend

@authup/server-core 1.0.0-beta.53 → 1.0.0-beta.54

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1152) hide show

package/dist/adapters/http/controllers/workflows/token/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["OAuth2GrantTypeError","OAuth2RequestError","OAuth2TokenGrant","DContext","DController","DGet","DPost","DTags","buildPermissionKey","toOAuth2Error","OAuth2OpenIDClaimsBuilder","HTTPClientCredentialsGrant","HTTPOAuth2AuthorizeGrant","HTTPOAuth2RefreshTokenGrant","HTTPPasswordGrant","HTTPRobotCredentialsGrant","guessOauth2GrantTypeByRequest","extractTokenFromRequest","TokenController","refreshTokenIssuer","accessTokenIssuer","tokenVerifier","tokenRevoker","identityResolver","identityPermissionProvider","metrics","tokenGrants","ctx","AUTHORIZATION_CODE","codeVerifier","clientAuthenticator","oauth2ClientAuthenticator","openIdTokenIssuer","keyStore","sessionManager","realmRepository","accessPolicyEvaluator","certificateSource","CLIENT_CREDENTIALS","ROBOT_CREDENTIALS","authenticator","robotAuthenticator","PASSWORD","userAuthenticator","eventService","loginThrottleService","userAuthenticatorService","mfaLoginService","logger","REFRESH_TOKEN","tokenRepository","sessionTokenRepository","options","gracePeriod","tokenRefreshGracePeriod","getIntrospect","event","postIntrospect","token","payload","verify","skipActiveCheck","sub","sub_kind","identityInvalid","permissions","getFor","id","type","clientId","client_id","realmId","realm_id","identity","resolve","claimsBuilder","claims","fromIdentity","active","jti","isInactive","Object","values","reduce","acc","binding","key","permission","name","e","revokeToken","ignoreExpiry","revoke","response","status","createToken","grantType","unsupported","grant","runWithRequest","recordTokenGrant"],"sources":["../../../../../../src/adapters/http/controllers/workflows/token/module.ts"],"sourcesContent":["/\n Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenIntrospectionResponse, OAuth2TokenPermission } from '@authup/specs';\nimport { OAuth2GrantTypeError, OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport {\n DContext,\n DController,\n DGet,\n DPost,\n DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport { buildPermissionKey } from '@authup/access';\nimport { toOAuth2Error } from '../../../../../core/oauth2/helpers/index.ts';\nimport type { TokenControllerContext } from './types.ts';\nimport type {\n IAuthFlowMetrics,\n IIdentityPermissionProvider,\n IIdentityResolver,\n IOAuth2TokenIssuer,\n IOAuth2TokenRevoker,\n IOAuth2TokenVerifier,\n} from '../../../../../core/index.ts';\nimport { OAuth2OpenIDClaimsBuilder } from '../../../../../core/index.ts';\nimport type { IHTTPOAuth2Grant } from '../../../adapters/index.ts';\nimport {\n HTTPClientCredentialsGrant,\n HTTPOAuth2AuthorizeGrant,\n HTTPOAuth2RefreshTokenGrant,\n HTTPPasswordGrant,\n HTTPRobotCredentialsGrant,\n guessOauth2GrantTypeByRequest,\n} from '../../../adapters/index.ts';\nimport { extractTokenFromRequest } from './utils/index.ts';\n\n@DTags('auth')\n@DController('/token')\nexport class TokenController {\n protected refreshTokenIssuer: IOAuth2TokenIssuer;\n\n protected accessTokenIssuer: IOAuth2TokenIssuer;\n\n protected tokenVerifier: IOAuth2TokenVerifier;\n\n protected tokenRevoker: IOAuth2TokenRevoker;\n\n protected identityResolver : IIdentityResolver;\n\n protected identityPermissionProvider : IIdentityPermissionProvider;\n\n protected metrics? : IAuthFlowMetrics;\n\n protected tokenGrants : Record<`${OAuth2TokenGrant}`, IHTTPOAuth2Grant>;\n\n // -------------------------------------------\n\n constructor(ctx: TokenControllerContext) {\n this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n this.accessTokenIssuer = ctx.accessTokenIssuer;\n this.tokenVerifier = ctx.tokenVerifier;\n this.tokenRevoker = ctx.tokenRevoker;\n this.identityResolver = ctx.identityResolver;\n this.identityPermissionProvider = ctx.identityPermissionProvider;\n this.metrics = ctx.metrics;\n\n this.tokenGrants = {\n [OAuth2TokenGrant.AUTHORIZATION_CODE]: new HTTPOAuth2AuthorizeGrant({\n codeVerifier: ctx.codeVerifier,\n clientAuthenticator: ctx.oauth2ClientAuthenticator,\n accessTokenIssuer: ctx.accessTokenIssuer,\n refreshTokenIssuer: ctx.refreshTokenIssuer,\n openIdTokenIssuer: ctx.openIdTokenIssuer,\n keyStore: ctx.keyStore,\n sessionManager: ctx.sessionManager,\n realmRepository: ctx.realmRepository,\n accessPolicyEvaluator: ctx.accessPolicyEvaluator,\n certificateSource: ctx.certificateSource,\n }),\n [OAuth2TokenGrant.CLIENT_CREDENTIALS]: new HTTPClientCredentialsGrant({\n accessTokenIssuer: ctx.accessTokenIssuer,\n clientAuthenticator: ctx.oauth2ClientAuthenticator,\n sessionManager: ctx.sessionManager,\n certificateSource: ctx.certificateSource,\n }),\n [OAuth2TokenGrant.ROBOT_CREDENTIALS]: new HTTPRobotCredentialsGrant({\n accessTokenIssuer: ctx.accessTokenIssuer,\n authenticator: ctx.robotAuthenticator,\n sessionManager: ctx.sessionManager,\n }),\n [OAuth2TokenGrant.PASSWORD]: new HTTPPasswordGrant({\n accessTokenIssuer: ctx.accessTokenIssuer,\n refreshTokenIssuer: ctx.refreshTokenIssuer,\n authenticator: ctx.userAuthenticator,\n clientAuthenticator: ctx.oauth2ClientAuthenticator,\n sessionManager: ctx.sessionManager,\n realmRepository: ctx.realmRepository,\n eventService: ctx.eventService,\n metrics: ctx.metrics,\n loginThrottleService: ctx.loginThrottleService,\n userAuthenticatorService: ctx.userAuthenticatorService,\n mfaLoginService: ctx.mfaLoginService,\n logger: ctx.logger,\n certificateSource: ctx.certificateSource,\n }),\n [OAuth2TokenGrant.REFRESH_TOKEN]: new HTTPOAuth2RefreshTokenGrant({\n accessTokenIssuer: ctx.accessTokenIssuer,\n refreshTokenIssuer: ctx.refreshTokenIssuer,\n tokenVerifier: ctx.tokenVerifier,\n tokenRepository: ctx.tokenRepository,\n sessionTokenRepository: ctx.sessionTokenRepository,\n sessionManager: ctx.sessionManager,\n clientAuthenticator: ctx.oauth2ClientAuthenticator,\n realmRepository: ctx.realmRepository,\n eventService: ctx.eventService,\n metrics: ctx.metrics,\n logger: ctx.logger,\n options: { gracePeriod: ctx.tokenRefreshGracePeriod },\n certificateSource: ctx.certificateSource,\n }),\n };\n }\n\n // -------------------------------------------\n\n @DGet('/introspect', [])\n async getIntrospect(@DContext() event: IAppEvent): Promise<OAuth2TokenIntrospectionResponse> {\n return this.postIntrospect(event);\n }\n\n @DPost('/introspect', [])\n async postIntrospect(\n @DContext() event: IAppEvent,\n ): Promise<OAuth2TokenIntrospectionResponse> {\n try {\n const token = await extractTokenFromRequest(event);\n const payload = await this.tokenVerifier.verify(token, { skipActiveCheck: true });\n if (!payload.sub \|\| !payload.sub_kind) {\n throw OAuth2RequestError.identityInvalid();\n }\n\n // todo: only receive client specific permissions\n const permissions = await this.identityPermissionProvider.getFor({\n id: payload.sub,\n type: payload.sub_kind,\n clientId: payload.client_id,\n realmId: payload.realm_id,\n });\n\n const identity = await this.identityResolver.resolve(payload.sub_kind, payload.sub);\n if (!identity) {\n // todo: differentiate between client, robot & user\n throw OAuth2RequestError.identityInvalid();\n }\n\n const claimsBuilder = new OAuth2OpenIDClaimsBuilder();\n const claims = claimsBuilder.fromIdentity(identity);\n\n let active : boolean;\n if (payload.jti) {\n const isInactive = await this.tokenVerifier.isInactive(payload.jti);\n active = !isInactive;\n } else {\n active = false;\n }\n\n return {\n active,\n // todo: permissions property should be removed.\n permissions: Object.values(\n permissions.reduce((acc, binding) => {\n const key = buildPermissionKey(binding.permission);\n if (!acc[key]) {\n acc[key] = {\n name: binding.permission.name,\n client_id: binding.permission.client_id,\n realm_id: binding.permission.realm_id,\n } as OAuth2TokenPermission;\n }\n return acc;\n }, {} as Record<string, OAuth2TokenPermission>),\n ),\n ...payload,\n ...claims,\n };\n } catch (e) {\n throw toOAuth2Error(e);\n }\n }\n\n // ----------------------------------------------------------\n\n @DPost('/revoke', [])\n async revokeToken(\n @DContext() event: IAppEvent,\n ): Promise<null> {\n try {\n const token = await extractTokenFromRequest(event);\n\n // RFC 7009 §2.2: revoking an invalid token — here one that is expired\n // or already inactive — MUST still succeed. The client cannot act on\n // an error, and the token's invalidation (the point of the request)\n // is already achieved. Signature + kind still anchor the token, so a\n // forged/garbage token is rejected; `ignoreExpiry` additionally keeps\n // this exp-bypass out of the shared claims cache (see\n // OAuth2TokenVerifier). Without this, revoking a stale refresh token\n // threw `expired_token`, so the caller's revoke-then-clear-cookie\n // flow aborted, the durable row was never soft-revoked, and the stale\n // refresh cookie survived into the next login.\n const payload = await this.tokenVerifier.verify(token, {\n ignoreExpiry: true,\n skipActiveCheck: true,\n });\n\n await this.tokenRevoker.revoke(payload);\n\n event.response.status = 202;\n return null;\n } catch (e) {\n throw toOAuth2Error(e);\n }\n }\n\n // ----------------------------------------------------------\n\n @DPost('', [])\n async createToken(@DContext() event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n const grantType = await guessOauth2GrantTypeByRequest(event);\n if (!grantType) {\n throw OAuth2GrantTypeError.unsupported();\n }\n\n const grant = this.tokenGrants[grantType];\n if (!grant) {\n throw OAuth2GrantTypeError.unsupported();\n }\n\n const response = await grant.runWithRequest(event);\n\n this.metrics?.recordTokenGrant(grantType);\n\n return response;\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAKC,SAAA,aAAA,YAAA,QAAA,KAAA,MAAA;;;;;;;;;;;;;;AAqCD,IAAakB,kBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAA6B;EACrC,KAAKR,qBAAqBQ,IAAIR;EAC9B,KAAKC,oBAAoBO,IAAIP;EAC7B,KAAKC,gBAAgBM,IAAIN;EACzB,KAAKC,eAAeK,IAAIL;EACxB,KAAKC,mBAAmBI,IAAIJ;EAC5B,KAAKC,6BAA6BG,IAAIH;EACtC,KAAKC,UAAUE,IAAIF;EAEnB,KAAKC,cAAc;IACdxB,iBAAiB0B,qBAAqB,IAAIhB,yBAAyB;IAChEiB,cAAcF,IAAIE;IAClBC,qBAAqBH,IAAII;IACzBX,mBAAmBO,IAAIP;IACvBD,oBAAoBQ,IAAIR;IACxBa,mBAAmBL,IAAIK;IACvBC,UAAUN,IAAIM;IACdC,gBAAgBP,IAAIO;IACpBC,iBAAiBR,IAAIQ;IACrBC,uBAAuBT,IAAIS;IAC3BC,mBAAmBV,IAAIU;GAC3B,CAAA;IACCnC,iBAAiBoC,qBAAqB,IAAI3B,2BAA2B;IAClES,mBAAmBO,IAAIP;IACvBU,qBAAqBH,IAAII;IACzBG,gBAAgBP,IAAIO;IACpBG,mBAAmBV,IAAIU;GAC3B,CAAA;IACCnC,iBAAiBqC,oBAAoB,IAAIxB,0BAA0B;IAChEK,mBAAmBO,IAAIP;IACvBoB,eAAeb,IAAIc;IACnBP,gBAAgBP,IAAIO;GACxB,CAAA;IACChC,iBAAiBwC,WAAW,IAAI5B,kBAAkB;IAC/CM,mBAAmBO,IAAIP;IACvBD,oBAAoBQ,IAAIR;IACxBqB,eAAeb,IAAIgB;IACnBb,qBAAqBH,IAAII;IACzBG,gBAAgBP,IAAIO;IACpBC,iBAAiBR,IAAIQ;IACrBS,cAAcjB,IAAIiB;IAClBnB,SAASE,IAAIF;IACboB,sBAAsBlB,IAAIkB;IAC1BC,0BAA0BnB,IAAImB;IAC9BC,iBAAiBpB,IAAIoB;IACrBC,QAAQrB,IAAIqB;IACZX,mBAAmBV,IAAIU;GAC3B,CAAA;IACCnC,iBAAiB+C,gBAAgB,IAAIpC,4BAA4B;IAC9DO,mBAAmBO,IAAIP;IACvBD,oBAAoBQ,IAAIR;IACxBE,eAAeM,IAAIN;IACnB6B,iBAAiBvB,IAAIuB;IACrBC,wBAAwBxB,IAAIwB;IAC5BjB,gBAAgBP,IAAIO;IACpBJ,qBAAqBH,IAAII;IACzBI,iBAAiBR,IAAIQ;IACrBS,cAAcjB,IAAIiB;IAClBnB,SAASE,IAAIF;IACbuB,QAAQrB,IAAIqB;IACZI,SAAS,EAAEC,aAAa1B,IAAI2B,wBAAwB;IACpDjB,mBAAmBV,IAAIU;GAC3B,CAAA;EACJ;CACJ;CAIA,MACMkB,cAAc,OAAyE;EACzF,OAAO,KAAKE,eAAeD,KAAAA;CAC/B;CAEA,MACMC,eACF,OACyC;EACzC,IAAI;GACA,MAAMC,QAAQ,MAAMzC,wBAAwBuC,KAAAA;GAC5C,MAAMG,UAAU,MAAM,KAAKtC,cAAcuC,OAAOF,OAAO,EAAEG,iBAAiB,KAAK,CAAA;GAC/E,IAAI,CAACF,QAAQG,OAAO,CAACH,QAAQI,UACzB,MAAM9D,mBAAmB+D,gBAAe;GAI5C,MAAMC,cAAc,MAAM,KAAKzC,2BAA2B0C,OAAO;IAC7DC,IAAIR,QAAQG;IACZM,MAAMT,QAAQI;IACdM,UAAUV,QAAQW;IAClBC,SAASZ,QAAQa;GACrB,CAAA;GAEA,MAAMC,WAAW,MAAM,KAAKlD,iBAAiBmD,QAAQf,QAAQI,UAAUJ,QAAQG,GAAG;GAClF,IAAI,CAACW,UAED,MAAMxE,mBAAmB+D,gBAAe;GAI5C,MAAMY,SAASD,IADWjE,0BACXiE,CAAAA,CAAcE,aAAaJ,QAAAA;GAE1C,IAAIK;GACJ,IAAInB,QAAQoB,KAERD,SAAS,CAACE,MADe,KAAK3D,cAAc2D,WAAWrB,QAAQoB,GAAG;QAGlED,SAAS;GAGb,OAAO;IACHA;IAEAb,aAAagB,OAAOC,OAChBjB,YAAYkB,QAAQC,KAAKC,YAAAA;KACrB,MAAMC,MAAM9E,mBAAmB6E,QAAQE,UAAU;KACjD,IAAI,CAACH,IAAIE,MACLF,IAAIE,OAAO;MACPE,MAAMH,QAAQE,WAAWC;MACzBlB,WAAWe,QAAQE,WAAWjB;MAC9BE,UAAUa,QAAQE,WAAWf;KACjC;KAEJ,OAAOY;IACX,GAAG,CAAC,CAAA,CAAA;IAER,GAAGzB;IACH,GAAGiB;GACP;EACJ,SAASa,GAAG;GACR,MAAMhF,cAAcgF,CAAAA;EACxB;CACJ;CAIA,MACMC,YACF,OACa;EACb,IAAI;GACA,MAAMhC,QAAQ,MAAMzC,wBAAwBuC,KAAAA;GAY5C,MAAMG,UAAU,MAAM,KAAKtC,cAAcuC,OAAOF,OAAO;IACnDiC,cAAc;IACd9B,iBAAiB;GACrB,CAAA;GAEA,MAAM,KAAKvC,aAAasE,OAAOjC,OAAAA;GAE/BH,MAAMqC,SAASC,SAAS;GACxB,OAAO;EACX,SAASL,GAAG;GACR,MAAMhF,cAAcgF,CAAAA;EACxB;CACJ;CAIA,MACMM,YAAY,OAAiE;EAC/E,MAAMC,YAAY,MAAMhF,8BAA8BwC,KAAAA;EACtD,IAAI,CAACwC,WACD,MAAMhG,qBAAqBiG,YAAW;EAG1C,MAAMC,QAAQ,KAAKxE,YAAYsE;EAC/B,IAAI,CAACE,OACD,MAAMlG,qBAAqBiG,YAAW;EAG1C,MAAMJ,WAAW,MAAMK,MAAMC,eAAe3C,KAAAA;EAE5C,KAAK/B,SAAS2E,iBAAiBJ,SAAAA;EAE/B,OAAOH;CACX;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["OAuth2GrantTypeError","OAuth2RequestError","OAuth2TokenGrant","DContext","DController","DGet","DPost","DTags","buildPermissionKey","toOAuth2Error","OAuth2OpenIDClaimsBuilder","HTTPClientCredentialsGrant","HTTPOAuth2AuthorizeGrant","HTTPOAuth2RefreshTokenGrant","HTTPPasswordGrant","guessOauth2GrantTypeByRequest","extractTokenFromRequest","TokenController","refreshTokenIssuer","accessTokenIssuer","tokenVerifier","tokenRevoker","identityResolver","identityPermissionProvider","metrics","tokenGrants","ctx","AUTHORIZATION_CODE","codeVerifier","clientAuthenticator","oauth2ClientAuthenticator","openIdTokenIssuer","keyStore","sessionManager","realmRepository","accessPolicyEvaluator","certificateSource","CLIENT_CREDENTIALS","PASSWORD","authenticator","userAuthenticator","eventService","loginThrottleService","userAuthenticatorService","mfaLoginService","logger","REFRESH_TOKEN","tokenRepository","sessionTokenRepository","options","gracePeriod","tokenRefreshGracePeriod","getIntrospect","event","postIntrospect","token","payload","verify","skipActiveCheck","sub","sub_kind","identityInvalid","permissions","getFor","id","type","clientId","client_id","realmId","realm_id","identity","resolve","claimsBuilder","claims","fromIdentity","active","jti","isInactive","Object","values","reduce","acc","binding","key","permission","name","e","revokeToken","ignoreExpiry","revoke","response","status","createToken","grantType","unsupported","grant","runWithRequest","recordTokenGrant"],"sources":["../../../../../../src/adapters/http/controllers/workflows/token/module.ts"],"sourcesContent":["/\n Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenIntrospectionResponse, OAuth2TokenPermission } from '@authup/specs';\nimport { OAuth2GrantTypeError, OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport {\n DContext,\n DController,\n DGet,\n DPost,\n DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport { buildPermissionKey } from '@authup/access';\nimport { toOAuth2Error } from '../../../../../core/oauth2/helpers/index.ts';\nimport type { TokenControllerContext } from './types.ts';\nimport type {\n IAuthFlowMetrics,\n IIdentityPermissionProvider,\n IIdentityResolver,\n IOAuth2TokenIssuer,\n IOAuth2TokenRevoker,\n IOAuth2TokenVerifier,\n} from '../../../../../core/index.ts';\nimport { OAuth2OpenIDClaimsBuilder } from '../../../../../core/index.ts';\nimport type { IHTTPOAuth2Grant } from '../../../adapters/index.ts';\nimport {\n HTTPClientCredentialsGrant,\n HTTPOAuth2AuthorizeGrant,\n HTTPOAuth2RefreshTokenGrant,\n HTTPPasswordGrant,\n guessOauth2GrantTypeByRequest,\n} from '../../../adapters/index.ts';\nimport { extractTokenFromRequest } from './utils/index.ts';\n\n@DTags('auth')\n@DController('/token')\nexport class TokenController {\n protected refreshTokenIssuer: IOAuth2TokenIssuer;\n\n protected accessTokenIssuer: IOAuth2TokenIssuer;\n\n protected tokenVerifier: IOAuth2TokenVerifier;\n\n protected tokenRevoker: IOAuth2TokenRevoker;\n\n protected identityResolver : IIdentityResolver;\n\n protected identityPermissionProvider : IIdentityPermissionProvider;\n\n protected metrics? : IAuthFlowMetrics;\n\n protected tokenGrants : Record<`${OAuth2TokenGrant}`, IHTTPOAuth2Grant>;\n\n // -------------------------------------------\n\n constructor(ctx: TokenControllerContext) {\n this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n this.accessTokenIssuer = ctx.accessTokenIssuer;\n this.tokenVerifier = ctx.tokenVerifier;\n this.tokenRevoker = ctx.tokenRevoker;\n this.identityResolver = ctx.identityResolver;\n this.identityPermissionProvider = ctx.identityPermissionProvider;\n this.metrics = ctx.metrics;\n\n this.tokenGrants = {\n [OAuth2TokenGrant.AUTHORIZATION_CODE]: new HTTPOAuth2AuthorizeGrant({\n codeVerifier: ctx.codeVerifier,\n clientAuthenticator: ctx.oauth2ClientAuthenticator,\n accessTokenIssuer: ctx.accessTokenIssuer,\n refreshTokenIssuer: ctx.refreshTokenIssuer,\n openIdTokenIssuer: ctx.openIdTokenIssuer,\n keyStore: ctx.keyStore,\n sessionManager: ctx.sessionManager,\n realmRepository: ctx.realmRepository,\n accessPolicyEvaluator: ctx.accessPolicyEvaluator,\n certificateSource: ctx.certificateSource,\n }),\n [OAuth2TokenGrant.CLIENT_CREDENTIALS]: new HTTPClientCredentialsGrant({\n accessTokenIssuer: ctx.accessTokenIssuer,\n clientAuthenticator: ctx.oauth2ClientAuthenticator,\n sessionManager: ctx.sessionManager,\n certificateSource: ctx.certificateSource,\n }),\n [OAuth2TokenGrant.PASSWORD]: new HTTPPasswordGrant({\n accessTokenIssuer: ctx.accessTokenIssuer,\n refreshTokenIssuer: ctx.refreshTokenIssuer,\n authenticator: ctx.userAuthenticator,\n clientAuthenticator: ctx.oauth2ClientAuthenticator,\n sessionManager: ctx.sessionManager,\n realmRepository: ctx.realmRepository,\n eventService: ctx.eventService,\n metrics: ctx.metrics,\n loginThrottleService: ctx.loginThrottleService,\n userAuthenticatorService: ctx.userAuthenticatorService,\n mfaLoginService: ctx.mfaLoginService,\n logger: ctx.logger,\n certificateSource: ctx.certificateSource,\n }),\n [OAuth2TokenGrant.REFRESH_TOKEN]: new HTTPOAuth2RefreshTokenGrant({\n accessTokenIssuer: ctx.accessTokenIssuer,\n refreshTokenIssuer: ctx.refreshTokenIssuer,\n tokenVerifier: ctx.tokenVerifier,\n tokenRepository: ctx.tokenRepository,\n sessionTokenRepository: ctx.sessionTokenRepository,\n sessionManager: ctx.sessionManager,\n clientAuthenticator: ctx.oauth2ClientAuthenticator,\n realmRepository: ctx.realmRepository,\n eventService: ctx.eventService,\n metrics: ctx.metrics,\n logger: ctx.logger,\n options: { gracePeriod: ctx.tokenRefreshGracePeriod },\n certificateSource: ctx.certificateSource,\n }),\n };\n }\n\n // -------------------------------------------\n\n @DGet('/introspect', [])\n async getIntrospect(@DContext() event: IAppEvent): Promise<OAuth2TokenIntrospectionResponse> {\n return this.postIntrospect(event);\n }\n\n @DPost('/introspect', [])\n async postIntrospect(\n @DContext() event: IAppEvent,\n ): Promise<OAuth2TokenIntrospectionResponse> {\n try {\n const token = await extractTokenFromRequest(event);\n const payload = await this.tokenVerifier.verify(token, { skipActiveCheck: true });\n if (!payload.sub \|\| !payload.sub_kind) {\n throw OAuth2RequestError.identityInvalid();\n }\n\n // todo: only receive client specific permissions\n const permissions = await this.identityPermissionProvider.getFor({\n id: payload.sub,\n type: payload.sub_kind,\n clientId: payload.client_id,\n realmId: payload.realm_id,\n });\n\n const identity = await this.identityResolver.resolve(payload.sub_kind, payload.sub);\n if (!identity) {\n // todo: differentiate between client & user\n throw OAuth2RequestError.identityInvalid();\n }\n\n const claimsBuilder = new OAuth2OpenIDClaimsBuilder();\n const claims = claimsBuilder.fromIdentity(identity);\n\n let active : boolean;\n if (payload.jti) {\n const isInactive = await this.tokenVerifier.isInactive(payload.jti);\n active = !isInactive;\n } else {\n active = false;\n }\n\n return {\n active,\n // todo: permissions property should be removed.\n permissions: Object.values(\n permissions.reduce((acc, binding) => {\n const key = buildPermissionKey(binding.permission);\n if (!acc[key]) {\n acc[key] = {\n name: binding.permission.name,\n client_id: binding.permission.clientId,\n realm_id: binding.permission.realmId,\n } as OAuth2TokenPermission;\n }\n return acc;\n }, {} as Record<string, OAuth2TokenPermission>),\n ),\n ...payload,\n ...claims,\n };\n } catch (e) {\n throw toOAuth2Error(e);\n }\n }\n\n // ----------------------------------------------------------\n\n @DPost('/revoke', [])\n async revokeToken(\n @DContext() event: IAppEvent,\n ): Promise<null> {\n try {\n const token = await extractTokenFromRequest(event);\n\n // RFC 7009 §2.2: revoking an invalid token — here one that is expired\n // or already inactive — MUST still succeed. The client cannot act on\n // an error, and the token's invalidation (the point of the request)\n // is already achieved. Signature + kind still anchor the token, so a\n // forged/garbage token is rejected; `ignoreExpiry` additionally keeps\n // this exp-bypass out of the shared claims cache (see\n // OAuth2TokenVerifier). Without this, revoking a stale refresh token\n // threw `expired_token`, so the caller's revoke-then-clear-cookie\n // flow aborted, the durable row was never soft-revoked, and the stale\n // refresh cookie survived into the next login.\n const payload = await this.tokenVerifier.verify(token, {\n ignoreExpiry: true,\n skipActiveCheck: true,\n });\n\n await this.tokenRevoker.revoke(payload);\n\n event.response.status = 202;\n return null;\n } catch (e) {\n throw toOAuth2Error(e);\n }\n }\n\n // ----------------------------------------------------------\n\n @DPost('', [])\n async createToken(@DContext() event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n const grantType = await guessOauth2GrantTypeByRequest(event);\n if (!grantType) {\n throw OAuth2GrantTypeError.unsupported();\n }\n\n const grant = this.tokenGrants[grantType];\n if (!grant) {\n throw OAuth2GrantTypeError.unsupported();\n }\n\n const response = await grant.runWithRequest(event);\n\n this.metrics?.recordTokenGrant(grantType);\n\n return response;\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAKC,SAAA,aAAA,YAAA,QAAA,KAAA,MAAA;;;;;;;;;;;;;;AAoCD,IAAaiB,kBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAA6B;EACrC,KAAKR,qBAAqBQ,IAAIR;EAC9B,KAAKC,oBAAoBO,IAAIP;EAC7B,KAAKC,gBAAgBM,IAAIN;EACzB,KAAKC,eAAeK,IAAIL;EACxB,KAAKC,mBAAmBI,IAAIJ;EAC5B,KAAKC,6BAA6BG,IAAIH;EACtC,KAAKC,UAAUE,IAAIF;EAEnB,KAAKC,cAAc;IACdvB,iBAAiByB,qBAAqB,IAAIf,yBAAyB;IAChEgB,cAAcF,IAAIE;IAClBC,qBAAqBH,IAAII;IACzBX,mBAAmBO,IAAIP;IACvBD,oBAAoBQ,IAAIR;IACxBa,mBAAmBL,IAAIK;IACvBC,UAAUN,IAAIM;IACdC,gBAAgBP,IAAIO;IACpBC,iBAAiBR,IAAIQ;IACrBC,uBAAuBT,IAAIS;IAC3BC,mBAAmBV,IAAIU;GAC3B,CAAA;IACClC,iBAAiBmC,qBAAqB,IAAI1B,2BAA2B;IAClEQ,mBAAmBO,IAAIP;IACvBU,qBAAqBH,IAAII;IACzBG,gBAAgBP,IAAIO;IACpBG,mBAAmBV,IAAIU;GAC3B,CAAA;IACClC,iBAAiBoC,WAAW,IAAIxB,kBAAkB;IAC/CK,mBAAmBO,IAAIP;IACvBD,oBAAoBQ,IAAIR;IACxBqB,eAAeb,IAAIc;IACnBX,qBAAqBH,IAAII;IACzBG,gBAAgBP,IAAIO;IACpBC,iBAAiBR,IAAIQ;IACrBO,cAAcf,IAAIe;IAClBjB,SAASE,IAAIF;IACbkB,sBAAsBhB,IAAIgB;IAC1BC,0BAA0BjB,IAAIiB;IAC9BC,iBAAiBlB,IAAIkB;IACrBC,QAAQnB,IAAImB;IACZT,mBAAmBV,IAAIU;GAC3B,CAAA;IACClC,iBAAiB4C,gBAAgB,IAAIjC,4BAA4B;IAC9DM,mBAAmBO,IAAIP;IACvBD,oBAAoBQ,IAAIR;IACxBE,eAAeM,IAAIN;IACnB2B,iBAAiBrB,IAAIqB;IACrBC,wBAAwBtB,IAAIsB;IAC5Bf,gBAAgBP,IAAIO;IACpBJ,qBAAqBH,IAAII;IACzBI,iBAAiBR,IAAIQ;IACrBO,cAAcf,IAAIe;IAClBjB,SAASE,IAAIF;IACbqB,QAAQnB,IAAImB;IACZI,SAAS,EAAEC,aAAaxB,IAAIyB,wBAAwB;IACpDf,mBAAmBV,IAAIU;GAC3B,CAAA;EACJ;CACJ;CAIA,MACMgB,cAAc,OAAyE;EACzF,OAAO,KAAKE,eAAeD,KAAAA;CAC/B;CAEA,MACMC,eACF,OACyC;EACzC,IAAI;GACA,MAAMC,QAAQ,MAAMvC,wBAAwBqC,KAAAA;GAC5C,MAAMG,UAAU,MAAM,KAAKpC,cAAcqC,OAAOF,OAAO,EAAEG,iBAAiB,KAAK,CAAA;GAC/E,IAAI,CAACF,QAAQG,OAAO,CAACH,QAAQI,UACzB,MAAM3D,mBAAmB4D,gBAAe;GAI5C,MAAMC,cAAc,MAAM,KAAKvC,2BAA2BwC,OAAO;IAC7DC,IAAIR,QAAQG;IACZM,MAAMT,QAAQI;IACdM,UAAUV,QAAQW;IAClBC,SAASZ,QAAQa;GACrB,CAAA;GAEA,MAAMC,WAAW,MAAM,KAAKhD,iBAAiBiD,QAAQf,QAAQI,UAAUJ,QAAQG,GAAG;GAClF,IAAI,CAACW,UAED,MAAMrE,mBAAmB4D,gBAAe;GAI5C,MAAMY,SAASD,IADW9D,0BACX8D,CAAAA,CAAcE,aAAaJ,QAAAA;GAE1C,IAAIK;GACJ,IAAInB,QAAQoB,KAERD,SAAS,CAACE,MADe,KAAKzD,cAAcyD,WAAWrB,QAAQoB,GAAG;QAGlED,SAAS;GAGb,OAAO;IACHA;IAEAb,aAAagB,OAAOC,OAChBjB,YAAYkB,QAAQC,KAAKC,YAAAA;KACrB,MAAMC,MAAM3E,mBAAmB0E,QAAQE,UAAU;KACjD,IAAI,CAACH,IAAIE,MACLF,IAAIE,OAAO;MACPE,MAAMH,QAAQE,WAAWC;MACzBlB,WAAWe,QAAQE,WAAWlB;MAC9BG,UAAUa,QAAQE,WAAWhB;KACjC;KAEJ,OAAOa;IACX,GAAG,CAAC,CAAA,CAAA;IAER,GAAGzB;IACH,GAAGiB;GACP;EACJ,SAASa,GAAG;GACR,MAAM7E,cAAc6E,CAAAA;EACxB;CACJ;CAIA,MACMC,YACF,OACa;EACb,IAAI;GACA,MAAMhC,QAAQ,MAAMvC,wBAAwBqC,KAAAA;GAY5C,MAAMG,UAAU,MAAM,KAAKpC,cAAcqC,OAAOF,OAAO;IACnDiC,cAAc;IACd9B,iBAAiB;GACrB,CAAA;GAEA,MAAM,KAAKrC,aAAaoE,OAAOjC,OAAAA;GAE/BH,MAAMqC,SAASC,SAAS;GACxB,OAAO;EACX,SAASL,GAAG;GACR,MAAM7E,cAAc6E,CAAAA;EACxB;CACJ;CAIA,MACMM,YAAY,OAAiE;EAC/E,MAAMC,YAAY,MAAM9E,8BAA8BsC,KAAAA;EACtD,IAAI,CAACwC,WACD,MAAM7F,qBAAqB8F,YAAW;EAG1C,MAAMC,QAAQ,KAAKtE,YAAYoE;EAC/B,IAAI,CAACE,OACD,MAAM/F,qBAAqB8F,YAAW;EAG1C,MAAMJ,WAAW,MAAMK,MAAMC,eAAe3C,KAAAA;EAE5C,KAAK7B,SAASyE,iBAAiBJ,SAAAA;EAE/B,OAAOH;CACX;AACJ"}

package/dist/adapters/http/controllers/workflows/token/types.d.ts CHANGED Viewed

@@ -1,4 +1,4 @@
-import type { Robot, User } from '@authup/core-kit';
+import type { User } from '@authup/core-kit';
 import type { Logger } from '@authup/server-kit';
 import type { IAuthFlowMetrics, ICredentialsAuthenticator, IEventService, IIdentityPermissionProvider, IIdentityResolver, IKeyStore, ILoginThrottleService, IOAuth2AccessPolicyEvaluator, IOAuth2AuthorizationCodeVerifier, IOAuth2MfaLoginService, IOAuth2OpenIDTokenIssuer, IOAuth2TokenIssuer, IOAuth2TokenRepository, IOAuth2TokenRevoker, IOAuth2TokenVerifier, IRealmRepository, ISessionManager, ISessionTokenRepository, IUserAuthenticatorService, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';
 import type { CertificateSource } from '../../../request/index.ts';
@@ -23,7 +23,6 @@ export type TokenControllerContext = {
     sessionManager: ISessionManager;
     identityResolver: IIdentityResolver;
     identityPermissionProvider: IIdentityPermissionProvider;
-    robotAuthenticator: ICredentialsAuthenticator<Robot>;
     userAuthenticator: ICredentialsAuthenticator<User>;
     oauth2ClientAuthenticator: OAuth2ClientAuthenticator;
     realmRepository: IRealmRepository;

package/dist/adapters/http/controllers/workflows/token/types.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/token/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,~~KAAK,EAAE,~~IAAI,EAAE,MAAM,kBAAkB,CAAC;~~AACpD~~,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EACR,gBAAgB,EAChB,yBAAyB,EACzB,aAAa,EACb,2BAA2B,EAC3B,iBAAiB,EACjB,SAAS,EACT,qBAAqB,EACrB,4BAA4B,EAC5B,gCAAgC,EAChC,sBAAsB,EACtB,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,uBAAuB,EACvB,yBAAyB,EACzB,yBAAyB,EAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,MAAM,MAAM,sBAAsB,GAAG;IACjC,YAAY,EAAE,gCAAgC,CAAC;IAE/C,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,iBAAiB,EAAE,wBAAwB,CAAC;IAC5C,QAAQ,EAAE,SAAS,CAAC;IACpB,aAAa,EAAE,oBAAoB,CAAC;IACpC,YAAY,EAAE,mBAAmB,CAAC;IAClC,eAAe,EAAE,sBAAsB,CAAC;IACxC,sBAAsB,EAAE,uBAAuB,CAAC;IAEhD,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAC7C,wBAAwB,CAAC,EAAE,yBAAyB,CAAC;IACrD,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,qBAAqB,CAAC,EAAE,4BAA4B,CAAC;IAErD,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,cAAc,EAAE,eAAe,CAAC;IAEhC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,0BAA0B,EAAE,2BAA2B,CAAC;IAExD,~~kBAAkB,EAAE,yBAAyB,CAAC,KAAK,CAAC,CAAA;IACpD,~~iBAAiB,EAAE,yBAAyB,CAAC,IAAI,CAAC,CAAA;IAElD,yBAAyB,EAAE,yBAAyB,CAAA;IAEpD,eAAe,EAAE,gBAAgB,CAAC;IAClC,iBAAiB,EAAE,iBAAiB,CAAC;CACxC,CAAC"}
1	+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/token/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EACR,gBAAgB,EAChB,yBAAyB,EACzB,aAAa,EACb,2BAA2B,EAC3B,iBAAiB,EACjB,SAAS,EACT,qBAAqB,EACrB,4BAA4B,EAC5B,gCAAgC,EAChC,sBAAsB,EACtB,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,uBAAuB,EACvB,yBAAyB,EACzB,yBAAyB,EAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,MAAM,MAAM,sBAAsB,GAAG;IACjC,YAAY,EAAE,gCAAgC,CAAC;IAE/C,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,iBAAiB,EAAE,wBAAwB,CAAC;IAC5C,QAAQ,EAAE,SAAS,CAAC;IACpB,aAAa,EAAE,oBAAoB,CAAC;IACpC,YAAY,EAAE,mBAAmB,CAAC;IAClC,eAAe,EAAE,sBAAsB,CAAC;IACxC,sBAAsB,EAAE,uBAAuB,CAAC;IAEhD,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAC7C,wBAAwB,CAAC,EAAE,yBAAyB,CAAC;IACrD,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,qBAAqB,CAAC,EAAE,4BAA4B,CAAC;IAErD,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,cAAc,EAAE,eAAe,CAAC;IAEhC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,0BAA0B,EAAE,2BAA2B,CAAC;IAExD,iBAAiB,EAAE,yBAAyB,CAAC,IAAI,CAAC,CAAA;IAElD,yBAAyB,EAAE,yBAAyB,CAAA;IAEpD,eAAe,EAAE,gBAAgB,CAAC;IAClC,iBAAiB,EAAE,iBAAiB,CAAC;CACxC,CAAC"}

package/dist/adapters/http/index.mjs CHANGED Viewed

@@ -45,7 +45,6 @@ import { HTTPClientCredentialsGrant } from "./adapters/oauth2/grant-types/client
 import { HTTPOAuth2IdentityGrantType } from "./adapters/oauth2/grant-types/identity.mjs";
 import { HTTPPasswordGrant } from "./adapters/oauth2/grant-types/password.mjs";
 import { HTTPOAuth2RefreshTokenGrant } from "./adapters/oauth2/grant-types/refresh_token.mjs";
-import { HTTPRobotCredentialsGrant } from "./adapters/oauth2/grant-types/robot-credentials.mjs";
 import "./adapters/index.mjs";
 import { ClientController } from "./controllers/entities/client/module.mjs";
 import { ClientPermissionController } from "./controllers/entities/client-permission/module.mjs";
@@ -74,11 +73,6 @@ import { RegisterController } from "./controllers/workflows/register/module.mjs"
 import { StatusController } from "./controllers/workflows/status/module.mjs";
 import { TokenController } from "./controllers/workflows/token/module.mjs";
 import { RealmController } from "./controllers/entities/realm/module.mjs";
-import { RobotController } from "./controllers/entities/robot/module.mjs";
-import { RobotPermissionController } from "./controllers/entities/robot-permission/module.mjs";
-import { RobotPermissionRequestValidator } from "./controllers/entities/robot-permission/utils/validation.mjs";
-import { RobotRoleController } from "./controllers/entities/robot-role/module.mjs";
-import { RobotRoleRequestValidator } from "./controllers/entities/robot-role/utils/validation.mjs";
 import { RoleController } from "./controllers/entities/role/module.mjs";
 import { RoleAttributeController } from "./controllers/entities/role-attribute/module.mjs";
 import { RoleAttributeRequestValidator } from "./controllers/entities/role-attribute/utils/validation.mjs";
@@ -99,4 +93,4 @@ import { UserPermissionRequestValidator } from "./controllers/entities/user-perm
 import { UserRoleController } from "./controllers/entities/user-role/module.mjs";
 import { UserRoleRequestValidator } from "./controllers/entities/user-role/utils/validation.mjs";
 import "./controllers/index.mjs";
-export { ActivateController, AuthenticatorChallengeController, AuthorizationMiddleware, AuthorizeController, CERTIFICATE_SOURCES, ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ConsentController, EventController, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, IdentityProviderController, IdentityProviderRoleMappingController, JwkController, KeyController, LOCALE_COOKIE, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RealmResolverMiddleware, RegisterController, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, RobotController, RobotPermissionController, RobotPermissionRequestValidator, RobotRoleController, RobotRoleRequestValidator, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, StatusController, TokenController, TrustAnchorController, UI_HTTP_CLIENT_FACTORY_STORE_KEY, UserAttributeController, UserAttributeRequestValidator, UserAuthenticatorController, UserController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator, VITE_SERVER_STORE_KEY, applyRouteRealmIDToBody, buildActorContext, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createRequestEventContextMiddleware, createRouteTemplateNormalizePath, createSwaggerMiddleware, extractClientCertificateEvidence, extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, getBodyRealmID, getJwkRouteHandler, getJwksRouteHandler, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, guessOauth2GrantTypeByRequest, readFromLocations, readRealmHint, readStringField, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerUIHttpClientMiddleware, runWithRequestEventContext, sanitizeRelativeRedirect, setRequestIdentity, setRequestMfaLoginTicket, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestEventContext, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestMfaLoginTicket, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestSessionId, useRequestToken };
+export { ActivateController, AuthenticatorChallengeController, AuthorizationMiddleware, AuthorizeController, CERTIFICATE_SOURCES, ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ConsentController, EventController, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, IdentityProviderController, IdentityProviderRoleMappingController, JwkController, KeyController, LOCALE_COOKIE, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RealmResolverMiddleware, RegisterController, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, StatusController, TokenController, TrustAnchorController, UI_HTTP_CLIENT_FACTORY_STORE_KEY, UserAttributeController, UserAttributeRequestValidator, UserAuthenticatorController, UserController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator, VITE_SERVER_STORE_KEY, applyRouteRealmIDToBody, buildActorContext, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createRequestEventContextMiddleware, createRouteTemplateNormalizePath, createSwaggerMiddleware, extractClientCertificateEvidence, extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, getBodyRealmID, getJwkRouteHandler, getJwksRouteHandler, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, guessOauth2GrantTypeByRequest, readFromLocations, readRealmHint, readStringField, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerUIHttpClientMiddleware, runWithRequestEventContext, sanitizeRelativeRedirect, setRequestIdentity, setRequestMfaLoginTicket, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestEventContext, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestMfaLoginTicket, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestSessionId, useRequestToken };

package/dist/adapters/http/middleware/built-in/assets.mjs CHANGED Viewed

@@ -6,7 +6,7 @@ import path from "node:path";
 import { defineCoreHandler } from "routup";
 import { CodeTransformation, isCodeTransformation } from "typeorm-extension";
 import { fromNodeMiddleware } from "routup/node";
-import { load } from "locter";
+import { read } from "locter";
 import { createHandler } from "@routup/assets";
 //#region src/adapters/http/middleware/built-in/assets.ts
 const VITE_SERVER_STORE_KEY = Symbol("ViteServer");
@@ -22,7 +22,7 @@ async function registerAssetsMiddleware(router) {
 		}));
 		return;
 	}
-	const server = await (await load("vite")).createServer({
+	const server = await (await read("vite")).createServer({
 		root: UI_SOURCE_PATH,
 		base: "/public/",
 		logLevel: "error",

package/dist/adapters/http/middleware/built-in/assets.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"assets.mjs","names":["~~load~~","CodeTransformation","isCodeTransformation","createHandler","path","defineCoreHandler","fromNodeMiddleware","PACKAGE_PATH","UI_DIST_PATH","UI_SOURCE_PATH","VITE_SERVER_STORE_KEY","Symbol","registerAssetsMiddleware","router","JUST_IN_TIME","use","posix","join","fallthrough","scan","vite","server","createServer","root","base","logLevel","middlewareMode","watch","usePolling","interval","appType","middlewares","event","store","next"],"sources":["../../../../../src/adapters/http/middleware/built-in/assets.ts"],"sourcesContent":["/\n Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { ~~load~~ } from 'locter';\nimport { CodeTransformation, isCodeTransformation } from 'typeorm-extension';\nimport { createHandler } from '@routup/assets';\nimport path from 'node:path';\nimport type { App } from 'routup';\nimport { defineCoreHandler } from 'routup';\nimport { fromNodeMiddleware } from 'routup/node';\nimport type as Vite from 'vite';\nimport type { ViteDevServer } from 'vite';\nimport { PACKAGE_PATH, UI_DIST_PATH, UI_SOURCE_PATH } from '../../../../path.ts';\n\nexport const VITE_SERVER_STORE_KEY = Symbol('ViteServer');\n\nexport async function registerAssetsMiddleware(router: App) {\n if (!isCodeTransformation(CodeTransformation.JUST_IN_TIME)) {\n router.use('public', createHandler(\n path.posix.join(PACKAGE_PATH, 'public'),\n {\n fallthrough: true,\n scan: false,\n },\n ));\n\n router.use('public', createHandler(\n path.posix.join(UI_DIST_PATH, 'client'),\n {\n fallthrough: false,\n scan: false,\n },\n ));\n return;\n }\n\n const vite = await ~~load~~('vite') as typeof Vite;\n\n const server: ViteDevServer = await vite.createServer({\n root: UI_SOURCE_PATH,\n base: '/public/',\n logLevel: 'error',\n server: {\n middlewareMode: true,\n watch: {\n usePolling: true,\n interval: 100,\n },\n },\n appType: 'custom',\n });\n\n router.use('public', fromNodeMiddleware(server.middlewares));\n router.use(defineCoreHandler((event) => {\n event.store[VITE_SERVER_STORE_KEY] = server;\n return event.next();\n }));\n}\n"],"mappings":";;;;;;;;;;;AAkBA,MAAaU,wBAAwBC,OAAO,YAAA;AAE5C,eAAsBC,yBAAyBC,QAAW;CACtD,IAAI,CAACX,qBAAqBD,mBAAmBa,YAAY,GAAG;EACxDD,OAAOE,IAAI,UAAUZ,cACjBC,KAAKY,MAAMC,KAAKV,cAAc,QAAA,GAC9B;GACIW,aAAa;GACbC,MAAM;EACV,CAAA,CAAA;EAGJN,OAAOE,IAAI,UAAUZ,cACjBC,KAAKY,MAAMC,KAAKT,cAAc,QAAA,GAC9B;GACIU,aAAa;GACbC,MAAM;EACV,CAAA,CAAA;EAEJ;CACJ;CAIA,MAAME,SAAwB,OAAMD,MAFjBpB,KAAK,MAAA,EAAA,CAEiBsB,aAAa;EAClDC,MAAMd;EACNe,MAAM;EACNC,UAAU;EACVJ,QAAQ;GACJK,gBAAgB;GAChBC,OAAO;IACHC,YAAY;IACZC,UAAU;GACd;EACJ;EACAC,SAAS;CACb,CAAA;CAEAjB,OAAOE,IAAI,UAAUT,mBAAmBe,OAAOU,WAAW,CAAA;CAC1DlB,OAAOE,IAAIV,mBAAmB2B,UAAAA;EAC1BA,MAAMC,MAAMvB,yBAAyBW;EACrC,OAAOW,MAAME,KAAI;CACrB,CAAA,CAAA;AACJ"}
1	+ {"version":3,"file":"assets.mjs","names":["read","CodeTransformation","isCodeTransformation","createHandler","path","defineCoreHandler","fromNodeMiddleware","PACKAGE_PATH","UI_DIST_PATH","UI_SOURCE_PATH","VITE_SERVER_STORE_KEY","Symbol","registerAssetsMiddleware","router","JUST_IN_TIME","use","posix","join","fallthrough","scan","vite","server","createServer","root","base","logLevel","middlewareMode","watch","usePolling","interval","appType","middlewares","event","store","next"],"sources":["../../../../../src/adapters/http/middleware/built-in/assets.ts"],"sourcesContent":["/\n Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { read } from 'locter';\nimport { CodeTransformation, isCodeTransformation } from 'typeorm-extension';\nimport { createHandler } from '@routup/assets';\nimport path from 'node:path';\nimport type { App } from 'routup';\nimport { defineCoreHandler } from 'routup';\nimport { fromNodeMiddleware } from 'routup/node';\nimport type as Vite from 'vite';\nimport type { ViteDevServer } from 'vite';\nimport { PACKAGE_PATH, UI_DIST_PATH, UI_SOURCE_PATH } from '../../../../path.ts';\n\nexport const VITE_SERVER_STORE_KEY = Symbol('ViteServer');\n\nexport async function registerAssetsMiddleware(router: App) {\n if (!isCodeTransformation(CodeTransformation.JUST_IN_TIME)) {\n router.use('public', createHandler(\n path.posix.join(PACKAGE_PATH, 'public'),\n {\n fallthrough: true,\n scan: false,\n },\n ));\n\n router.use('public', createHandler(\n path.posix.join(UI_DIST_PATH, 'client'),\n {\n fallthrough: false,\n scan: false,\n },\n ));\n return;\n }\n\n const vite = await read('vite') as typeof Vite;\n\n const server: ViteDevServer = await vite.createServer({\n root: UI_SOURCE_PATH,\n base: '/public/',\n logLevel: 'error',\n server: {\n middlewareMode: true,\n watch: {\n usePolling: true,\n interval: 100,\n },\n },\n appType: 'custom',\n });\n\n router.use('public', fromNodeMiddleware(server.middlewares));\n router.use(defineCoreHandler((event) => {\n event.store[VITE_SERVER_STORE_KEY] = server;\n return event.next();\n }));\n}\n"],"mappings":";;;;;;;;;;;AAkBA,MAAaU,wBAAwBC,OAAO,YAAA;AAE5C,eAAsBC,yBAAyBC,QAAW;CACtD,IAAI,CAACX,qBAAqBD,mBAAmBa,YAAY,GAAG;EACxDD,OAAOE,IAAI,UAAUZ,cACjBC,KAAKY,MAAMC,KAAKV,cAAc,QAAA,GAC9B;GACIW,aAAa;GACbC,MAAM;EACV,CAAA,CAAA;EAGJN,OAAOE,IAAI,UAAUZ,cACjBC,KAAKY,MAAMC,KAAKT,cAAc,QAAA,GAC9B;GACIU,aAAa;GACbC,MAAM;EACV,CAAA,CAAA;EAEJ;CACJ;CAIA,MAAME,SAAwB,OAAMD,MAFjBpB,KAAK,MAAA,EAAA,CAEiBsB,aAAa;EAClDC,MAAMd;EACNe,MAAM;EACNC,UAAU;EACVJ,QAAQ;GACJK,gBAAgB;GAChBC,OAAO;IACHC,YAAY;IACZC,UAAU;GACd;EACJ;EACAC,SAAS;CACb,CAAA;CAEAjB,OAAOE,IAAI,UAAUT,mBAAmBe,OAAOU,WAAW,CAAA;CAC1DlB,OAAOE,IAAIV,mBAAmB2B,UAAAA;EAC1BA,MAAMC,MAAMvB,yBAAyBW;EACrC,OAAOW,MAAME,KAAI;CACrB,CAAA,CAAA;AACJ"}

package/dist/adapters/http/middleware/built-in/authorization/module.d.ts CHANGED Viewed

@@ -1,5 +1,5 @@
 import type { IPermissionEvaluator } from '@authup/access';
-import type { Client, Robot, User } from '@authup/core-kit';
+import type { Client, User } from '@authup/core-kit';
 import type { OAuth2TokenPayload } from '@authup/specs';
 import type { IAppEvent } from 'routup';
 import { type BasicAuthorizationHeader, type BearerAuthorizationHeader } from 'hapic';
@@ -12,7 +12,6 @@ export declare class AuthorizationMiddleware {
     protected identityResolver: IIdentityResolver;
     protected sessionManager: ISessionManager;
     protected clientAuthenticator: ICredentialsAuthenticator<Client>;
-    protected robotAuthenticator: ICredentialsAuthenticator<Robot>;
     protected userAuthenticator: ICredentialsAuthenticator<User>;
     constructor(ctx: HTTPAuthorizationMiddlewareContext);
     run(event: IAppEvent): Promise<void>;

package/dist/adapters/http/middleware/built-in/authorization/module.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/middleware/built-in/authorization/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAE3D,OAAO,KAAK,EAAE,MAAM,EAAE,~~KAAK,EAAE,~~IAAI,EAAE,MAAM,kBAAkB,CAAC;~~AAM5D~~,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAOxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAEH,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAEjC,MAAM,OAAO,CAAC;~~AAQf~~,OAAO,KAAK,EACR,yBAAyB,EACzB,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EAClB,MAAM,8BAA8B,CAAC;AAYtC,OAAO,KAAK,EAAE,kCAAkC,EAAE,kCAAkC,EAAE,MAAM,YAAY,CAAC;AAEzG,qBAAa,uBAAuB;IAChC,SAAS,CAAC,OAAO,EAAE,kCAAkC,CAAC;IAItD,SAAS,CAAC,mBAAmB,EAAE,oBAAoB,CAAC;IAEpD,SAAS,CAAC,mBAAmB,EAAE,oBAAoB,CAAC;IAIpD,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,cAAc,EAAG,eAAe,CAAC;IAI3C,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAElE,SAAS,CAAC,~~kBAAkB,EAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;IAEhE,SAAS,CAAC,~~iBAAiB,EAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;gBAIlD,GAAG,EAAE,kCAAkC;~~IAsB7C~~,GAAG,CAAC,KAAK,EAAE,SAAS;IA2B1B;;OAEG;cACa,+BAA+B,CAC3C,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,yBAAyB;cAgErB,wBAAwB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAyBtG;;;;;;;;;OASG;cACa,oBAAoB,CAChC,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,kBAAkB;cAsDf,8BAA8B,CAC1C,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,wBAAwB;CA+~~CvC~~"}
1	+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/middleware/built-in/authorization/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAE3D,OAAO,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAMrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAOxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAEH,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAEjC,MAAM,OAAO,CAAC;AAOf,OAAO,KAAK,EACR,yBAAyB,EACzB,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EAClB,MAAM,8BAA8B,CAAC;AAYtC,OAAO,KAAK,EAAE,kCAAkC,EAAE,kCAAkC,EAAE,MAAM,YAAY,CAAC;AAEzG,qBAAa,uBAAuB;IAChC,SAAS,CAAC,OAAO,EAAE,kCAAkC,CAAC;IAItD,SAAS,CAAC,mBAAmB,EAAE,oBAAoB,CAAC;IAEpD,SAAS,CAAC,mBAAmB,EAAE,oBAAoB,CAAC;IAIpD,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,cAAc,EAAG,eAAe,CAAC;IAI3C,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAElE,SAAS,CAAC,iBAAiB,EAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;gBAIlD,GAAG,EAAE,kCAAkC;IAqB7C,GAAG,CAAC,KAAK,EAAE,SAAS;IA2B1B;;OAEG;cACa,+BAA+B,CAC3C,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,yBAAyB;cAgErB,wBAAwB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAyBtG;;;;;;;;;OASG;cACa,oBAAoB,CAChC,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,kBAAkB;cAsDf,8BAA8B,CAC1C,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,wBAAwB;CA+BvC"}

package/dist/adapters/http/middleware/built-in/authorization/module.mjs CHANGED Viewed

@@ -2,7 +2,6 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { ClientAuthenticator } from "../../../../../core/authentication/entities/client/module.mjs";
-import { RobotAuthenticator } from "../../../../../core/authentication/entities/robot/module.mjs";
 import { UserAuthenticator } from "../../../../../core/authentication/entities/user/module.mjs";
 import { assertClientCertificateEvidenceValidForBinding } from "../../../../../core/client-certificate/module.mjs";
 import { PolicyEngine as PolicyEngine$1 } from "../../../../../core/security/policy/engine.mjs";
@@ -29,14 +28,12 @@ var AuthorizationMiddleware = class {
 	identityResolver;
 	sessionManager;
 	clientAuthenticator;
-	robotAuthenticator;
 	userAuthenticator;
 	constructor(ctx) {
 		this.options = ctx.options || {};
 		this.identityResolver = ctx.identityResolver;
 		this.sessionManager = ctx.sessionManager;
 		this.clientAuthenticator = new ClientAuthenticator(ctx.identityResolver);
-		this.robotAuthenticator = new RobotAuthenticator(ctx.identityResolver);
 		this.userAuthenticator = new UserAuthenticator(ctx.identityResolver);
 		this.oauth2TokenVerifier = ctx.oauth2TokenVerifier;
 		this.permissionEvaluator = new PermissionEvaluator({
@@ -122,7 +119,7 @@ var AuthorizationMiddleware = class {
 		} catch {
 			throw JWTError.expired();
 		}
-		if (session.sub !== payload.sub || session.sub_kind !== IdentityType.USER) throw JWTError.expired();
+		if (session.sub !== payload.sub || session.subKind !== IdentityType.USER) throw JWTError.expired();
 		await this.sessionManager.ping(session);
 		const identity = await this.identityResolver.resolve(payload.sub_kind, payload.sub);
 		if (!identity) throw JWTError.expired();
@@ -150,17 +147,6 @@ var AuthorizationMiddleware = class {
 					type: IdentityType.USER,
 					data: authenticated.data
 				});
-				return;
-			}
-		}
-		if (this.options.robotAuthBasic) {
-			const authenticated = await this.robotAuthenticator.safeAuthenticate(header.username, header.password);
-			if (authenticated.success) {
-				setRequestScopes(event, [ScopeName.GLOBAL]);
-				setRequestIdentity(event, {
-					type: IdentityType.ROBOT,
-					data: authenticated.data
-				});
 			}
 		}
 	}

package/dist/adapters/http/middleware/built-in/authorization/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["PermissionEvaluator","IdentityType","ScopeName","AuthHeaderError","JWTError","OAuth2SubKind","OAuth2TokenKind","deserializeOAuth2Scope","AuthorizationHeaderType","parseAuthorizationHeader","ClientAuthenticator","PolicyEngine","RobotAuthenticator","UserAuthenticator","assertClientCertificateEvidenceValidForBinding","RequestIdentity","RequestPermissionEvaluator","extractClientCertificateEvidence","setRequestIdentity","setRequestMfaLoginTicket","setRequestPermissionEvaluator","setRequestScopes","setRequestSessionId","setRequestToken","AuthorizationMiddleware","options","oauth2TokenVerifier","permissionEvaluator","identityResolver","sessionManager","clientAuthenticator","robotAuthenticator","userAuthenticator","ctx","provider","permissionProvider","policyEngine","identityPermissionProvider","realmId","clientId","run","event","requestAccessContext","headerValue","headers","get","header","type","BEARER","verifyBearerAuthorizationHeader","BASIC","verifyBasicAuthorizationHeader","unsupportedType","payload","verify","token","verifyCertificateBinding","kind","MFA","verifyMfaLoginTicket","ACCESS","payloadPropertyInvalid","realm_id","scope","session_id","session","findOneById","expired","ping","sub_kind","sub","identity","resolve","cnf","expectedThumbprint","length","invalid","evidence","certificateSource","thumbprint","USER","clientAuthBasic","authenticator","safeAuthenticate","username","password","success","GLOBAL","CLIENT","data","userAuthBasic","authenticated","robotAuthBasic","ROBOT"],"sources":["../../../../../../src/adapters/http/middleware/built-in/authorization/module.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { IPermissionEvaluator } from '@authup/access';\nimport { PermissionEvaluator } from '@authup/access';\nimport type { Client, Robot, User } from '@authup/core-kit';\nimport {\n IdentityType,\n ScopeName,\n} from '@authup/core-kit';\nimport { AuthHeaderError } from '@authup/errors';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport {\n JWTError,\n OAuth2SubKind,\n OAuth2TokenKind,\n deserializeOAuth2Scope,\n} from '@authup/specs';\nimport type { IAppEvent } from 'routup';\nimport {\n AuthorizationHeaderType,\n type BasicAuthorizationHeader,\n type BearerAuthorizationHeader,\n parseAuthorizationHeader,\n} from 'hapic';\nimport {\n ClientAuthenticator,\n PolicyEngine,\n RobotAuthenticator,\n UserAuthenticator,\n assertClientCertificateEvidenceValidForBinding,\n} from '../../../../../core/index.ts';\nimport type {\n ICredentialsAuthenticator,\n IIdentityResolver,\n IOAuth2TokenVerifier,\n ISessionManager,\n} from '../../../../../core/index.ts';\nimport {\n RequestIdentity,\n RequestPermissionEvaluator,\n extractClientCertificateEvidence,\n setRequestIdentity,\n setRequestMfaLoginTicket,\n setRequestPermissionEvaluator,\n setRequestScopes,\n setRequestSessionId,\n setRequestToken,\n} from '../../../request/index.ts';\nimport type { HTTPAuthorizationMiddlewareContext, HTTPAuthorizationMiddlewareOptions } from './types.ts';\n\nexport class AuthorizationMiddleware {\n protected options: HTTPAuthorizationMiddlewareOptions;\n\n // --------------------------------------\n\n protected oauth2TokenVerifier: IOAuth2TokenVerifier;\n\n protected permissionEvaluator: IPermissionEvaluator;\n\n // --------------------------------------\n\n protected identityResolver: IIdentityResolver;\n\n protected sessionManager : ISessionManager;\n\n // --------------------------------------\n\n protected clientAuthenticator : ICredentialsAuthenticator<Client>;\n\n protected robotAuthenticator : ICredentialsAuthenticator<Robot>;\n\n protected userAuthenticator : ICredentialsAuthenticator<User>;\n\n // --------------------------------------\n\n constructor(ctx: HTTPAuthorizationMiddlewareContext) {\n this.options = ctx.options \|\| {};\n\n this.identityResolver = ctx.identityResolver;\n this.sessionManager = ctx.sessionManager;\n\n this.clientAuthenticator = new ClientAuthenticator(ctx.identityResolver);\n this.robotAuthenticator = new RobotAuthenticator(ctx.identityResolver);\n this.userAuthenticator = new UserAuthenticator(ctx.identityResolver);\n\n this.oauth2TokenVerifier = ctx.oauth2TokenVerifier;\n\n this.permissionEvaluator = new PermissionEvaluator({\n provider: ctx.permissionProvider,\n policyEngine: new PolicyEngine(ctx.identityPermissionProvider),\n realmId: null,\n clientId: null,\n });\n }\n\n // --------------------------------------\n\n async run(event: IAppEvent) {\n const requestAccessContext = new RequestPermissionEvaluator(\n event,\n this.permissionEvaluator,\n );\n setRequestPermissionEvaluator(event, requestAccessContext);\n\n const headerValue = event.headers.get('authorization');\n if (!headerValue) {\n return;\n }\n\n const header = parseAuthorizationHeader(headerValue);\n\n if (header.type === AuthorizationHeaderType.BEARER) {\n await this.verifyBearerAuthorizationHeader(event, header);\n return;\n }\n\n if (header.type === AuthorizationHeaderType.BASIC) {\n await this.verifyBasicAuthorizationHeader(event, header);\n return;\n }\n\n throw AuthHeaderError.unsupportedType(header.type);\n }\n\n /\n @throws JWTError\n /\n protected async verifyBearerAuthorizationHeader(\n event: IAppEvent,\n header: BearerAuthorizationHeader,\n ) {\n const payload = await this.oauth2TokenVerifier.verify(header.token);\n await this.verifyCertificateBinding(event, payload);\n if (payload.kind === OAuth2TokenKind.MFA) {\n await this.verifyMfaLoginTicket(event, payload);\n return;\n }\n\n if (payload.kind !== OAuth2TokenKind.ACCESS) {\n throw JWTError.payloadPropertyInvalid('kind');\n }\n\n if (!payload.realm_id) {\n throw JWTError.payloadPropertyInvalid('realm_id');\n }\n\n setRequestToken(event, header.token);\n\n if (payload.scope) {\n setRequestScopes(event, deserializeOAuth2Scope(payload.scope));\n }\n\n // -------------------------------------------------------\n\n if (!payload.session_id) {\n throw JWTError.payloadPropertyInvalid('session_id');\n }\n\n const session = await this.sessionManager.findOneById(payload.session_id);\n if (!session) {\n throw JWTError.expired();\n }\n\n try {\n await this.sessionManager.verify(session);\n } catch {\n throw JWTError.expired();\n }\n\n await this.sessionManager.ping(session);\n\n setRequestSessionId(event, payload.session_id);\n\n // -------------------------------------------------------\n\n if (!payload.sub_kind) {\n throw JWTError.payloadPropertyInvalid('sub_kind');\n }\n\n if (!payload.sub) {\n throw JWTError.payloadPropertyInvalid('sub');\n }\n\n const identity = await this.identityResolver.resolve(\n payload.sub_kind,\n payload.sub,\n );\n\n if (identity) {\n setRequestIdentity(event, identity);\n }\n }\n\n protected async verifyCertificateBinding(event: IAppEvent, payload: OAuth2TokenPayload): Promise<void> {\n if (!payload.cnf) {\n return;\n }\n\n const expectedThumbprint = payload.cnf['x5t#S256'];\n if (typeof expectedThumbprint !== 'string' \|\| expectedThumbprint.length === 0) {\n throw JWTError.invalid();\n }\n\n try {\n const evidence = await extractClientCertificateEvidence(\n event,\n this.options.certificateSource ?? 'disabled',\n );\n if (!evidence \|\| evidence.thumbprint !== expectedThumbprint) {\n throw JWTError.invalid();\n }\n\n assertClientCertificateEvidenceValidForBinding(evidence);\n } catch {\n throw JWTError.invalid();\n }\n }\n\n /\n An \"MFA-pending\" login ticket (issue #3242). Verified with the same\n * rigor as an access token (session existence + subject match), but\n * stashed on a DEDICATED request slot — the main identity / scope /\n * session slots stay empty, so every identity-gated route rejects a\n * ticket bearer (default-deny); only the challenge routes opt in via\n * useRequestMfaLoginTicket.\n \n @throws JWTError\n */\n protected async verifyMfaLoginTicket(\n event: IAppEvent,\n payload: OAuth2TokenPayload,\n ) {\n if (payload.sub_kind !== OAuth2SubKind.USER) {\n throw JWTError.payloadPropertyInvalid('sub_kind');\n }\n\n if (!payload.sub) {\n throw JWTError.payloadPropertyInvalid('sub');\n }\n\n if (!payload.realm_id) {\n throw JWTError.payloadPropertyInvalid('realm_id');\n }\n\n if (!payload.session_id) {\n throw JWTError.payloadPropertyInvalid('session_id');\n }\n\n const session = await this.sessionManager.findOneById(payload.session_id);\n if (!session) {\n throw JWTError.expired();\n }\n\n try {\n await this.sessionManager.verify(session);\n } catch {\n throw JWTError.expired();\n }\n\n // defense in depth — the pending session must still belong to the\n // ticket subject.\n if (\n session.sub !== payload.sub \|\|\n session.sub_kind !== IdentityType.USER\n ) {\n throw JWTError.expired();\n }\n\n await this.sessionManager.ping(session);\n\n const identity = await this.identityResolver.resolve(\n payload.sub_kind,\n payload.sub,\n );\n if (!identity) {\n throw JWTError.expired();\n }\n\n setRequestMfaLoginTicket(event, {\n identity: new RequestIdentity(identity),\n payload,\n });\n }\n\n protected async verifyBasicAuthorizationHeader(\n event: IAppEvent,\n header: BasicAuthorizationHeader,\n ) {\n if (this.options.clientAuthBasic) {\n const authenticator = await this.clientAuthenticator.safeAuthenticate(\n header.username,\n header.password,\n );\n if (authenticator.success) {\n setRequestScopes(event, [ScopeName.GLOBAL]);\n setRequestIdentity(event, {\n type: IdentityType.CLIENT,\n data: authenticator.data,\n });\n }\n }\n\n if (this.options.userAuthBasic) {\n const authenticated = await this.userAuthenticator.safeAuthenticate(\n header.username,\n header.password,\n );\n\n if (authenticated.success) {\n setRequestScopes(event, [ScopeName.GLOBAL]);\n setRequestIdentity(event, {\n type: IdentityType.USER,\n data: authenticated.data,\n });\n\n return;\n }\n }\n\n if (this.options.robotAuthBasic) {\n const authenticated = await this.robotAuthenticator.safeAuthenticate(\n header.username,\n header.password,\n );\n if (authenticated.success) {\n setRequestScopes(event, [ScopeName.GLOBAL]);\n setRequestIdentity(event, {\n type: IdentityType.ROBOT,\n data: authenticated.data,\n });\n }\n }\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAuDA,IAAawB,0BAAb,MAAaA;CACCC;CAIAC;CAEAC;CAIAC;CAEAC;CAIAC;CAEAC;CAEAC;CAIV,YAAYC,KAAyC;EACjD,KAAKR,UAAUQ,IAAIR,WAAW,CAAC;EAE/B,KAAKG,mBAAmBK,IAAIL;EAC5B,KAAKC,iBAAiBI,IAAIJ;EAE1B,KAAKC,sBAAsB,IAAIpB,oBAAoBuB,IAAIL,gBAAgB;EACvE,KAAKG,qBAAqB,IAAInB,mBAAmBqB,IAAIL,gBAAgB;EACrE,KAAKI,oBAAoB,IAAInB,kBAAkBoB,IAAIL,gBAAgB;EAEnE,KAAKF,sBAAsBO,IAAIP;EAE/B,KAAKC,sBAAsB,IAAI3B,oBAAoB;GAC/CkC,UAAUD,IAAIE;GACdC,cAAc,IAAIzB,eAAasB,IAAII,0BAA0B;GAC7DC,SAAS;GACTC,UAAU;EACd,CAAA;CACJ;CAIA,MAAMC,IAAIC,OAAkB;EAKxBrB,8BAA8BqB,OAAOC,IAJJ1B,2BAC7ByB,OACA,KAAKd,mBAE4Be,CAAAA;EAErC,MAAMC,cAAcF,MAAMG,QAAQC,IAAI,eAAA;EACtC,IAAI,CAACF,aACD;EAGJ,MAAMG,SAASrC,yBAAyBkC,WAAAA;EAExC,IAAIG,OAAOC,SAASvC,wBAAwBwC,QAAQ;GAChD,MAAM,KAAKC,gCAAgCR,OAAOK,MAAAA;GAClD;EACJ;EAEA,IAAIA,OAAOC,SAASvC,wBAAwB0C,OAAO;GAC/C,MAAM,KAAKC,+BAA+BV,OAAOK,MAAAA;GACjD;EACJ;EAEA,MAAM3C,gBAAgBiD,gBAAgBN,OAAOC,IAAI;CACrD;;;IAKA,MAAgBE,gCACZR,OACAK,QACF;EACE,MAAMO,UAAU,MAAM,KAAK3B,oBAAoB4B,OAAOR,OAAOS,KAAK;EAClE,MAAM,KAAKC,yBAAyBf,OAAOY,OAAAA;EAC3C,IAAIA,QAAQI,SAASnD,gBAAgBoD,KAAK;GACtC,MAAM,KAAKC,qBAAqBlB,OAAOY,OAAAA;GACvC;EACJ;EAEA,IAAIA,QAAQI,SAASnD,gBAAgBsD,QACjC,MAAMxD,SAASyD,uBAAuB,MAAA;EAG1C,IAAI,CAACR,QAAQS,UACT,MAAM1D,SAASyD,uBAAuB,UAAA;EAG1CtC,gBAAgBkB,OAAOK,OAAOS,KAAK;EAEnC,IAAIF,QAAQU,OACR1C,iBAAiBoB,OAAOlC,uBAAuB8C,QAAQU,KAAK,CAAA;EAKhE,IAAI,CAACV,QAAQW,YACT,MAAM5D,SAASyD,uBAAuB,YAAA;EAG1C,MAAMI,UAAU,MAAM,KAAKpC,eAAeqC,YAAYb,QAAQW,UAAU;EACxE,IAAI,CAACC,SACD,MAAM7D,SAAS+D,QAAO;EAG1B,IAAI;GACA,MAAM,KAAKtC,eAAeyB,OAAOW,OAAAA;EACrC,QAAQ;GACJ,MAAM7D,SAAS+D,QAAO;EAC1B;EAEA,MAAM,KAAKtC,eAAeuC,KAAKH,OAAAA;EAE/B3C,oBAAoBmB,OAAOY,QAAQW,UAAU;EAI7C,IAAI,CAACX,QAAQgB,UACT,MAAMjE,SAASyD,uBAAuB,UAAA;EAG1C,IAAI,CAACR,QAAQiB,KACT,MAAMlE,SAASyD,uBAAuB,KAAA;EAG1C,MAAMU,WAAW,MAAM,KAAK3C,iBAAiB4C,QACzCnB,QAAQgB,UACRhB,QAAQiB,GAAG;EAGf,IAAIC,UACArD,mBAAmBuB,OAAO8B,QAAAA;CAElC;CAEA,MAAgBf,yBAAyBf,OAAkBY,SAA4C;EACnG,IAAI,CAACA,QAAQoB,KACT;EAGJ,MAAMC,qBAAqBrB,QAAQoB,IAAI;EACvC,IAAI,OAAOC,uBAAuB,YAAYA,mBAAmBC,WAAW,GACxE,MAAMvE,SAASwE,QAAO;EAG1B,IAAI;GACA,MAAMC,WAAW,MAAM5D,iCACnBwB,OACA,KAAKhB,QAAQqD,qBAAqB,UAAA;GAEtC,IAAI,CAACD,YAAYA,SAASE,eAAeL,oBACrC,MAAMtE,SAASwE,QAAO;GAG1B9D,+CAA+C+D,QAAAA;EACnD,QAAQ;GACJ,MAAMzE,SAASwE,QAAO;EAC1B;CACJ;;;;;;;;;;IAYA,MAAgBjB,qBACZlB,OACAY,SACF;EACE,IAAIA,QAAQgB,aAAahE,cAAc2E,MACnC,MAAM5E,SAASyD,uBAAuB,UAAA;EAG1C,IAAI,CAACR,QAAQiB,KACT,MAAMlE,SAASyD,uBAAuB,KAAA;EAG1C,IAAI,CAACR,QAAQS,UACT,MAAM1D,SAASyD,uBAAuB,UAAA;EAG1C,IAAI,CAACR,QAAQW,YACT,MAAM5D,SAASyD,uBAAuB,YAAA;EAG1C,MAAMI,UAAU,MAAM,KAAKpC,eAAeqC,YAAYb,QAAQW,UAAU;EACxE,IAAI,CAACC,SACD,MAAM7D,SAAS+D,QAAO;EAG1B,IAAI;GACA,MAAM,KAAKtC,eAAeyB,OAAOW,OAAAA;EACrC,QAAQ;GACJ,MAAM7D,SAAS+D,QAAO;EAC1B;EAIA,IACIF,QAAQK,QAAQjB,QAAQiB,OACxBL,QAAQI,aAAapE,aAAa+E,MAElC,MAAM5E,SAAS+D,QAAO;EAG1B,MAAM,KAAKtC,eAAeuC,KAAKH,OAAAA;EAE/B,MAAMM,WAAW,MAAM,KAAK3C,iBAAiB4C,QACzCnB,QAAQgB,UACRhB,QAAQiB,GAAG;EAEf,IAAI,CAACC,UACD,MAAMnE,SAAS+D,QAAO;EAG1BhD,yBAAyBsB,OAAO;GAC5B8B,UAAU,IAAIxD,gBAAgBwD,QAAAA;GAC9BlB;EACJ,CAAA;CACJ;CAEA,MAAgBF,+BACZV,OACAK,QACF;EACE,IAAI,KAAKrB,QAAQwD,iBAAiB;GAC9B,MAAMC,gBAAgB,MAAM,KAAKpD,oBAAoBqD,iBACjDrC,OAAOsC,UACPtC,OAAOuC,QAAQ;GAEnB,IAAIH,cAAcI,SAAS;IACvBjE,iBAAiBoB,OAAO,CAACvC,UAAUqF,MAAAA,CAAO;IAC1CrE,mBAAmBuB,OAAO;KACtBM,MAAM9C,aAAauF;KACnBC,MAAMP,cAAcO;IACxB,CAAA;GACJ;EACJ;EAEA,IAAI,KAAKhE,QAAQiE,eAAe;GAC5B,MAAMC,gBAAgB,MAAM,KAAK3D,kBAAkBmD,iBAC/CrC,OAAOsC,UACPtC,OAAOuC,QAAQ;GAGnB,IAAIM,cAAcL,SAAS;IACvBjE,iBAAiBoB,OAAO,CAACvC,UAAUqF,MAAAA,CAAO;IAC1CrE,mBAAmBuB,OAAO;KACtBM,MAAM9C,aAAa+E;KACnBS,MAAME,cAAcF;IACxB,CAAA;IAEA;GACJ;EACJ;EAEA,IAAI,KAAKhE,QAAQmE,gBAAgB;GAC7B,MAAMD,gBAAgB,MAAM,KAAK5D,mBAAmBoD,iBAChDrC,OAAOsC,UACPtC,OAAOuC,QAAQ;GAEnB,IAAIM,cAAcL,SAAS;IACvBjE,iBAAiBoB,OAAO,CAACvC,UAAUqF,MAAAA,CAAO;IAC1CrE,mBAAmBuB,OAAO;KACtBM,MAAM9C,aAAa4F;KACnBJ,MAAME,cAAcF;IACxB,CAAA;GACJ;EACJ;CACJ;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["PermissionEvaluator","IdentityType","ScopeName","AuthHeaderError","JWTError","OAuth2SubKind","OAuth2TokenKind","deserializeOAuth2Scope","AuthorizationHeaderType","parseAuthorizationHeader","ClientAuthenticator","PolicyEngine","UserAuthenticator","assertClientCertificateEvidenceValidForBinding","RequestIdentity","RequestPermissionEvaluator","extractClientCertificateEvidence","setRequestIdentity","setRequestMfaLoginTicket","setRequestPermissionEvaluator","setRequestScopes","setRequestSessionId","setRequestToken","AuthorizationMiddleware","options","oauth2TokenVerifier","permissionEvaluator","identityResolver","sessionManager","clientAuthenticator","userAuthenticator","ctx","provider","permissionProvider","policyEngine","identityPermissionProvider","realmId","clientId","run","event","requestAccessContext","headerValue","headers","get","header","type","BEARER","verifyBearerAuthorizationHeader","BASIC","verifyBasicAuthorizationHeader","unsupportedType","payload","verify","token","verifyCertificateBinding","kind","MFA","verifyMfaLoginTicket","ACCESS","payloadPropertyInvalid","realm_id","scope","session_id","session","findOneById","expired","ping","sub_kind","sub","identity","resolve","cnf","expectedThumbprint","length","invalid","evidence","certificateSource","thumbprint","USER","subKind","clientAuthBasic","authenticator","safeAuthenticate","username","password","success","GLOBAL","CLIENT","data","userAuthBasic","authenticated"],"sources":["../../../../../../src/adapters/http/middleware/built-in/authorization/module.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { IPermissionEvaluator } from '@authup/access';\nimport { PermissionEvaluator } from '@authup/access';\nimport type { Client, User } from '@authup/core-kit';\nimport {\n IdentityType,\n ScopeName,\n} from '@authup/core-kit';\nimport { AuthHeaderError } from '@authup/errors';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport {\n JWTError,\n OAuth2SubKind,\n OAuth2TokenKind,\n deserializeOAuth2Scope,\n} from '@authup/specs';\nimport type { IAppEvent } from 'routup';\nimport {\n AuthorizationHeaderType,\n type BasicAuthorizationHeader,\n type BearerAuthorizationHeader,\n parseAuthorizationHeader,\n} from 'hapic';\nimport {\n ClientAuthenticator,\n PolicyEngine,\n UserAuthenticator,\n assertClientCertificateEvidenceValidForBinding,\n} from '../../../../../core/index.ts';\nimport type {\n ICredentialsAuthenticator,\n IIdentityResolver,\n IOAuth2TokenVerifier,\n ISessionManager,\n} from '../../../../../core/index.ts';\nimport {\n RequestIdentity,\n RequestPermissionEvaluator,\n extractClientCertificateEvidence,\n setRequestIdentity,\n setRequestMfaLoginTicket,\n setRequestPermissionEvaluator,\n setRequestScopes,\n setRequestSessionId,\n setRequestToken,\n} from '../../../request/index.ts';\nimport type { HTTPAuthorizationMiddlewareContext, HTTPAuthorizationMiddlewareOptions } from './types.ts';\n\nexport class AuthorizationMiddleware {\n protected options: HTTPAuthorizationMiddlewareOptions;\n\n // --------------------------------------\n\n protected oauth2TokenVerifier: IOAuth2TokenVerifier;\n\n protected permissionEvaluator: IPermissionEvaluator;\n\n // --------------------------------------\n\n protected identityResolver: IIdentityResolver;\n\n protected sessionManager : ISessionManager;\n\n // --------------------------------------\n\n protected clientAuthenticator : ICredentialsAuthenticator<Client>;\n\n protected userAuthenticator : ICredentialsAuthenticator<User>;\n\n // --------------------------------------\n\n constructor(ctx: HTTPAuthorizationMiddlewareContext) {\n this.options = ctx.options \|\| {};\n\n this.identityResolver = ctx.identityResolver;\n this.sessionManager = ctx.sessionManager;\n\n this.clientAuthenticator = new ClientAuthenticator(ctx.identityResolver);\n this.userAuthenticator = new UserAuthenticator(ctx.identityResolver);\n\n this.oauth2TokenVerifier = ctx.oauth2TokenVerifier;\n\n this.permissionEvaluator = new PermissionEvaluator({\n provider: ctx.permissionProvider,\n policyEngine: new PolicyEngine(ctx.identityPermissionProvider),\n realmId: null,\n clientId: null,\n });\n }\n\n // --------------------------------------\n\n async run(event: IAppEvent) {\n const requestAccessContext = new RequestPermissionEvaluator(\n event,\n this.permissionEvaluator,\n );\n setRequestPermissionEvaluator(event, requestAccessContext);\n\n const headerValue = event.headers.get('authorization');\n if (!headerValue) {\n return;\n }\n\n const header = parseAuthorizationHeader(headerValue);\n\n if (header.type === AuthorizationHeaderType.BEARER) {\n await this.verifyBearerAuthorizationHeader(event, header);\n return;\n }\n\n if (header.type === AuthorizationHeaderType.BASIC) {\n await this.verifyBasicAuthorizationHeader(event, header);\n return;\n }\n\n throw AuthHeaderError.unsupportedType(header.type);\n }\n\n /\n @throws JWTError\n /\n protected async verifyBearerAuthorizationHeader(\n event: IAppEvent,\n header: BearerAuthorizationHeader,\n ) {\n const payload = await this.oauth2TokenVerifier.verify(header.token);\n await this.verifyCertificateBinding(event, payload);\n if (payload.kind === OAuth2TokenKind.MFA) {\n await this.verifyMfaLoginTicket(event, payload);\n return;\n }\n\n if (payload.kind !== OAuth2TokenKind.ACCESS) {\n throw JWTError.payloadPropertyInvalid('kind');\n }\n\n if (!payload.realm_id) {\n throw JWTError.payloadPropertyInvalid('realm_id');\n }\n\n setRequestToken(event, header.token);\n\n if (payload.scope) {\n setRequestScopes(event, deserializeOAuth2Scope(payload.scope));\n }\n\n // -------------------------------------------------------\n\n if (!payload.session_id) {\n throw JWTError.payloadPropertyInvalid('session_id');\n }\n\n const session = await this.sessionManager.findOneById(payload.session_id);\n if (!session) {\n throw JWTError.expired();\n }\n\n try {\n await this.sessionManager.verify(session);\n } catch {\n throw JWTError.expired();\n }\n\n await this.sessionManager.ping(session);\n\n setRequestSessionId(event, payload.session_id);\n\n // -------------------------------------------------------\n\n if (!payload.sub_kind) {\n throw JWTError.payloadPropertyInvalid('sub_kind');\n }\n\n if (!payload.sub) {\n throw JWTError.payloadPropertyInvalid('sub');\n }\n\n const identity = await this.identityResolver.resolve(\n payload.sub_kind,\n payload.sub,\n );\n\n if (identity) {\n setRequestIdentity(event, identity);\n }\n }\n\n protected async verifyCertificateBinding(event: IAppEvent, payload: OAuth2TokenPayload): Promise<void> {\n if (!payload.cnf) {\n return;\n }\n\n const expectedThumbprint = payload.cnf['x5t#S256'];\n if (typeof expectedThumbprint !== 'string' \|\| expectedThumbprint.length === 0) {\n throw JWTError.invalid();\n }\n\n try {\n const evidence = await extractClientCertificateEvidence(\n event,\n this.options.certificateSource ?? 'disabled',\n );\n if (!evidence \|\| evidence.thumbprint !== expectedThumbprint) {\n throw JWTError.invalid();\n }\n\n assertClientCertificateEvidenceValidForBinding(evidence);\n } catch {\n throw JWTError.invalid();\n }\n }\n\n /\n An \"MFA-pending\" login ticket (issue #3242). Verified with the same\n * rigor as an access token (session existence + subject match), but\n * stashed on a DEDICATED request slot — the main identity / scope /\n * session slots stay empty, so every identity-gated route rejects a\n * ticket bearer (default-deny); only the challenge routes opt in via\n * useRequestMfaLoginTicket.\n \n @throws JWTError\n */\n protected async verifyMfaLoginTicket(\n event: IAppEvent,\n payload: OAuth2TokenPayload,\n ) {\n if (payload.sub_kind !== OAuth2SubKind.USER) {\n throw JWTError.payloadPropertyInvalid('sub_kind');\n }\n\n if (!payload.sub) {\n throw JWTError.payloadPropertyInvalid('sub');\n }\n\n if (!payload.realm_id) {\n throw JWTError.payloadPropertyInvalid('realm_id');\n }\n\n if (!payload.session_id) {\n throw JWTError.payloadPropertyInvalid('session_id');\n }\n\n const session = await this.sessionManager.findOneById(payload.session_id);\n if (!session) {\n throw JWTError.expired();\n }\n\n try {\n await this.sessionManager.verify(session);\n } catch {\n throw JWTError.expired();\n }\n\n // defense in depth — the pending session must still belong to the\n // ticket subject.\n if (\n session.sub !== payload.sub \|\|\n session.subKind !== IdentityType.USER\n ) {\n throw JWTError.expired();\n }\n\n await this.sessionManager.ping(session);\n\n const identity = await this.identityResolver.resolve(\n payload.sub_kind,\n payload.sub,\n );\n if (!identity) {\n throw JWTError.expired();\n }\n\n setRequestMfaLoginTicket(event, {\n identity: new RequestIdentity(identity),\n payload,\n });\n }\n\n protected async verifyBasicAuthorizationHeader(\n event: IAppEvent,\n header: BasicAuthorizationHeader,\n ) {\n if (this.options.clientAuthBasic) {\n const authenticator = await this.clientAuthenticator.safeAuthenticate(\n header.username,\n header.password,\n );\n if (authenticator.success) {\n setRequestScopes(event, [ScopeName.GLOBAL]);\n setRequestIdentity(event, {\n type: IdentityType.CLIENT,\n data: authenticator.data,\n });\n }\n }\n\n if (this.options.userAuthBasic) {\n const authenticated = await this.userAuthenticator.safeAuthenticate(\n header.username,\n header.password,\n );\n\n if (authenticated.success) {\n setRequestScopes(event, [ScopeName.GLOBAL]);\n setRequestIdentity(event, {\n type: IdentityType.USER,\n data: authenticated.data,\n });\n }\n }\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAsDA,IAAauB,0BAAb,MAAaA;CACCC;CAIAC;CAEAC;CAIAC;CAEAC;CAIAC;CAEAC;CAIV,YAAYC,KAAyC;EACjD,KAAKP,UAAUO,IAAIP,WAAW,CAAC;EAE/B,KAAKG,mBAAmBI,IAAIJ;EAC5B,KAAKC,iBAAiBG,IAAIH;EAE1B,KAAKC,sBAAsB,IAAInB,oBAAoBqB,IAAIJ,gBAAgB;EACvE,KAAKG,oBAAoB,IAAIlB,kBAAkBmB,IAAIJ,gBAAgB;EAEnE,KAAKF,sBAAsBM,IAAIN;EAE/B,KAAKC,sBAAsB,IAAI1B,oBAAoB;GAC/CgC,UAAUD,IAAIE;GACdC,cAAc,IAAIvB,eAAaoB,IAAII,0BAA0B;GAC7DC,SAAS;GACTC,UAAU;EACd,CAAA;CACJ;CAIA,MAAMC,IAAIC,OAAkB;EAKxBpB,8BAA8BoB,OAAOC,IAJJzB,2BAC7BwB,OACA,KAAKb,mBAE4Bc,CAAAA;EAErC,MAAMC,cAAcF,MAAMG,QAAQC,IAAI,eAAA;EACtC,IAAI,CAACF,aACD;EAGJ,MAAMG,SAASnC,yBAAyBgC,WAAAA;EAExC,IAAIG,OAAOC,SAASrC,wBAAwBsC,QAAQ;GAChD,MAAM,KAAKC,gCAAgCR,OAAOK,MAAAA;GAClD;EACJ;EAEA,IAAIA,OAAOC,SAASrC,wBAAwBwC,OAAO;GAC/C,MAAM,KAAKC,+BAA+BV,OAAOK,MAAAA;GACjD;EACJ;EAEA,MAAMzC,gBAAgB+C,gBAAgBN,OAAOC,IAAI;CACrD;;;IAKA,MAAgBE,gCACZR,OACAK,QACF;EACE,MAAMO,UAAU,MAAM,KAAK1B,oBAAoB2B,OAAOR,OAAOS,KAAK;EAClE,MAAM,KAAKC,yBAAyBf,OAAOY,OAAAA;EAC3C,IAAIA,QAAQI,SAASjD,gBAAgBkD,KAAK;GACtC,MAAM,KAAKC,qBAAqBlB,OAAOY,OAAAA;GACvC;EACJ;EAEA,IAAIA,QAAQI,SAASjD,gBAAgBoD,QACjC,MAAMtD,SAASuD,uBAAuB,MAAA;EAG1C,IAAI,CAACR,QAAQS,UACT,MAAMxD,SAASuD,uBAAuB,UAAA;EAG1CrC,gBAAgBiB,OAAOK,OAAOS,KAAK;EAEnC,IAAIF,QAAQU,OACRzC,iBAAiBmB,OAAOhC,uBAAuB4C,QAAQU,KAAK,CAAA;EAKhE,IAAI,CAACV,QAAQW,YACT,MAAM1D,SAASuD,uBAAuB,YAAA;EAG1C,MAAMI,UAAU,MAAM,KAAKnC,eAAeoC,YAAYb,QAAQW,UAAU;EACxE,IAAI,CAACC,SACD,MAAM3D,SAAS6D,QAAO;EAG1B,IAAI;GACA,MAAM,KAAKrC,eAAewB,OAAOW,OAAAA;EACrC,QAAQ;GACJ,MAAM3D,SAAS6D,QAAO;EAC1B;EAEA,MAAM,KAAKrC,eAAesC,KAAKH,OAAAA;EAE/B1C,oBAAoBkB,OAAOY,QAAQW,UAAU;EAI7C,IAAI,CAACX,QAAQgB,UACT,MAAM/D,SAASuD,uBAAuB,UAAA;EAG1C,IAAI,CAACR,QAAQiB,KACT,MAAMhE,SAASuD,uBAAuB,KAAA;EAG1C,MAAMU,WAAW,MAAM,KAAK1C,iBAAiB2C,QACzCnB,QAAQgB,UACRhB,QAAQiB,GAAG;EAGf,IAAIC,UACApD,mBAAmBsB,OAAO8B,QAAAA;CAElC;CAEA,MAAgBf,yBAAyBf,OAAkBY,SAA4C;EACnG,IAAI,CAACA,QAAQoB,KACT;EAGJ,MAAMC,qBAAqBrB,QAAQoB,IAAI;EACvC,IAAI,OAAOC,uBAAuB,YAAYA,mBAAmBC,WAAW,GACxE,MAAMrE,SAASsE,QAAO;EAG1B,IAAI;GACA,MAAMC,WAAW,MAAM3D,iCACnBuB,OACA,KAAKf,QAAQoD,qBAAqB,UAAA;GAEtC,IAAI,CAACD,YAAYA,SAASE,eAAeL,oBACrC,MAAMpE,SAASsE,QAAO;GAG1B7D,+CAA+C8D,QAAAA;EACnD,QAAQ;GACJ,MAAMvE,SAASsE,QAAO;EAC1B;CACJ;;;;;;;;;;IAYA,MAAgBjB,qBACZlB,OACAY,SACF;EACE,IAAIA,QAAQgB,aAAa9D,cAAcyE,MACnC,MAAM1E,SAASuD,uBAAuB,UAAA;EAG1C,IAAI,CAACR,QAAQiB,KACT,MAAMhE,SAASuD,uBAAuB,KAAA;EAG1C,IAAI,CAACR,QAAQS,UACT,MAAMxD,SAASuD,uBAAuB,UAAA;EAG1C,IAAI,CAACR,QAAQW,YACT,MAAM1D,SAASuD,uBAAuB,YAAA;EAG1C,MAAMI,UAAU,MAAM,KAAKnC,eAAeoC,YAAYb,QAAQW,UAAU;EACxE,IAAI,CAACC,SACD,MAAM3D,SAAS6D,QAAO;EAG1B,IAAI;GACA,MAAM,KAAKrC,eAAewB,OAAOW,OAAAA;EACrC,QAAQ;GACJ,MAAM3D,SAAS6D,QAAO;EAC1B;EAIA,IACIF,QAAQK,QAAQjB,QAAQiB,OACxBL,QAAQgB,YAAY9E,aAAa6E,MAEjC,MAAM1E,SAAS6D,QAAO;EAG1B,MAAM,KAAKrC,eAAesC,KAAKH,OAAAA;EAE/B,MAAMM,WAAW,MAAM,KAAK1C,iBAAiB2C,QACzCnB,QAAQgB,UACRhB,QAAQiB,GAAG;EAEf,IAAI,CAACC,UACD,MAAMjE,SAAS6D,QAAO;EAG1B/C,yBAAyBqB,OAAO;GAC5B8B,UAAU,IAAIvD,gBAAgBuD,QAAAA;GAC9BlB;EACJ,CAAA;CACJ;CAEA,MAAgBF,+BACZV,OACAK,QACF;EACE,IAAI,KAAKpB,QAAQwD,iBAAiB;GAC9B,MAAMC,gBAAgB,MAAM,KAAKpD,oBAAoBqD,iBACjDtC,OAAOuC,UACPvC,OAAOwC,QAAQ;GAEnB,IAAIH,cAAcI,SAAS;IACvBjE,iBAAiBmB,OAAO,CAACrC,UAAUoF,MAAAA,CAAO;IAC1CrE,mBAAmBsB,OAAO;KACtBM,MAAM5C,aAAasF;KACnBC,MAAMP,cAAcO;IACxB,CAAA;GACJ;EACJ;EAEA,IAAI,KAAKhE,QAAQiE,eAAe;GAC5B,MAAMC,gBAAgB,MAAM,KAAK5D,kBAAkBoD,iBAC/CtC,OAAOuC,UACPvC,OAAOwC,QAAQ;GAGnB,IAAIM,cAAcL,SAAS;IACvBjE,iBAAiBmB,OAAO,CAACrC,UAAUoF,MAAAA,CAAO;IAC1CrE,mBAAmBsB,OAAO;KACtBM,MAAM5C,aAAa6E;KACnBU,MAAME,cAAcF;IACxB,CAAA;GACJ;EACJ;CACJ;AACJ"}

package/dist/adapters/http/middleware/built-in/authorization/types.d.ts CHANGED Viewed

@@ -3,7 +3,6 @@ import type { IIdentityPermissionProvider, IIdentityResolver, IOAuth2TokenVerifi
 import type { CertificateSource } from '../../../request/index.ts';
 export type HTTPAuthorizationMiddlewareOptions = {
     clientAuthBasic?: boolean;
-    robotAuthBasic?: boolean;
     userAuthBasic?: boolean;
     certificateSource?: CertificateSource;
 };

package/dist/adapters/http/middleware/built-in/authorization/types.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/middleware/built-in/authorization/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAER,2BAA2B,EAC3B,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EAClB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,MAAM,MAAM,kCAAkC,GAAG;IAC7C,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,~~cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,~~aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CACzC,CAAC;AAEF,MAAM,MAAM,kCAAkC,GAAG;IAC7C,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,0BAA0B,EAAE,2BAA2B,CAAC;IACxD,cAAc,EAAE,eAAe,CAAC;IAChC,mBAAmB,EAAE,oBAAoB,CAAC;IAC1C,kBAAkB,EAAE,mBAAmB,CAAC;IAExC,OAAO,CAAC,EAAE,kCAAkC,CAAA;CAC/C,CAAC"}
1	+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/middleware/built-in/authorization/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAER,2BAA2B,EAC3B,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EAClB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,MAAM,MAAM,kCAAkC,GAAG;IAC7C,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CACzC,CAAC;AAEF,MAAM,MAAM,kCAAkC,GAAG;IAC7C,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,0BAA0B,EAAE,2BAA2B,CAAC;IACxD,cAAc,EAAE,eAAe,CAAC;IAChC,mBAAmB,EAAE,oBAAoB,CAAC;IAC1C,kBAAkB,EAAE,mBAAmB,CAAC;IAExC,OAAO,CAAC,EAAE,kCAAkC,CAAA;CAC/C,CAAC"}

package/dist/adapters/http/middleware/built-in/rate-limit.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/rate-limit.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAIlC,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,YAAY,~~QAyB5E~~"}
1	+ {"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/rate-limit.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAIlC,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,YAAY,QAwB5E"}

package/dist/adapters/http/middleware/built-in/rate-limit.mjs CHANGED Viewed

@@ -12,7 +12,6 @@ function registerRateLimitMiddleware(router, input) {
 			const identity = useRequestIdentity(event);
 			if (!identity) return 1200;
 			switch (identity.type) {
-				case "robot":
 				case "client": return 60 * 5e3;
 				default: return 6e3;
 			}

package/dist/adapters/http/middleware/built-in/rate-limit.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"rate-limit.mjs","names":["rateLimit","merge","useRequestIdentity","registerRateLimitMiddleware","router","input","options","max","event","identity","type","windowMs","use"],"sources":["../../../../../src/adapters/http/middleware/built-in/rate-limit.ts"],"sourcesContent":["/\n Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { OptionsInput } from '@routup/rate-limit';\nimport { rateLimit } from '@routup/rate-limit';\nimport type { App } from 'routup';\nimport { merge } from 'smob';\nimport { useRequestIdentity } from '../../request/index.ts';\n\nexport function registerRateLimitMiddleware(router: App, input?: OptionsInput) {\n let options : OptionsInput = {\n max(event) {\n const identity = useRequestIdentity(event);\n if (!identity) {\n return 60 20; // 20 req. p. sec\n }\n\n switch (identity.type) {\n case '~~robot':\n case '~~client': {\n return 60 * 5_000; // 1000 req p. sec\n }\n case 'user':\n default: {\n return 60 * 100; // 100 req p. sec\n }\n }\n },\n windowMs: 60 * 1000, // 60 sec\n };\n\n options = merge(input \|\| {}, options);\n\n router.use(rateLimit(options));\n}\n"],"mappings":";;;;;;;;AAaA,SAAgBG,4BAA4BC,QAAaC,OAAoB;CACzE,IAAIC,UAAyB;EACzBC,IAAIC,OAAK;GACL,MAAMC,WAAWP,mBAAmBM,KAAAA;GACpC,IAAI,CAACC,UACD,OAAO;GAGX,QAAQA,SAASC,MAAjB;IACI,KAAK~~;IACL~~,~~KAAK,~~UACD,OAAO,KAAK;IAGhB,SACI,OAAO;GAEf;EACJ;EACAC,UAAU,KAAK;CACnB;CAEAL,UAAUL,MAAMI,SAAS,CAAC,GAAGC,OAAAA;CAE7BF,OAAOQ,IAAIZ,UAAUM,OAAAA,CAAAA;AACzB"}
1	+ {"version":3,"file":"rate-limit.mjs","names":["rateLimit","merge","useRequestIdentity","registerRateLimitMiddleware","router","input","options","max","event","identity","type","windowMs","use"],"sources":["../../../../../src/adapters/http/middleware/built-in/rate-limit.ts"],"sourcesContent":["/\n Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { OptionsInput } from '@routup/rate-limit';\nimport { rateLimit } from '@routup/rate-limit';\nimport type { App } from 'routup';\nimport { merge } from 'smob';\nimport { useRequestIdentity } from '../../request/index.ts';\n\nexport function registerRateLimitMiddleware(router: App, input?: OptionsInput) {\n let options : OptionsInput = {\n max(event) {\n const identity = useRequestIdentity(event);\n if (!identity) {\n return 60 20; // 20 req. p. sec\n }\n\n switch (identity.type) {\n case 'client': {\n return 60 * 5_000; // 1000 req p. sec\n }\n case 'user':\n default: {\n return 60 * 100; // 100 req p. sec\n }\n }\n },\n windowMs: 60 * 1000, // 60 sec\n };\n\n options = merge(input \|\| {}, options);\n\n router.use(rateLimit(options));\n}\n"],"mappings":";;;;;;;;AAaA,SAAgBG,4BAA4BC,QAAaC,OAAoB;CACzE,IAAIC,UAAyB;EACzBC,IAAIC,OAAK;GACL,MAAMC,WAAWP,mBAAmBM,KAAAA;GACpC,IAAI,CAACC,UACD,OAAO;GAGX,QAAQA,SAASC,MAAjB;IACI,KAAK,UACD,OAAO,KAAK;IAGhB,SACI,OAAO;GAEf;EACJ;EACAC,UAAU,KAAK;CACnB;CAEAL,UAAUL,MAAMI,SAAS,CAAC,GAAGC,OAAAA;CAE7BF,OAAOQ,IAAIZ,UAAUM,OAAAA,CAAAA;AACzB"}

package/dist/adapters/http/request/client-certificate.d.ts CHANGED Viewed

@@ -1,3 +1,4 @@
+import '../../../core/client-certificate/reflect.ts';
 import type { IAppEvent } from 'routup';
 import type { ClientCertificateEvidence } from '../../../core/index.ts';
 import type { CertificateSource } from './types.ts';

package/dist/adapters/http/request/client-certificate.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"client-certificate.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/request/client-certificate.ts"],"names":[],"mappings":"~~AAUA~~,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAKxE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAMpD,wBAAsB,gCAAgC,CAClD,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,iBAAiB,GAC1B,OAAO,CAAC,yBAAyB,GAAG,SAAS,CAAC,CAqBhD"}
1	+ {"version":3,"file":"client-certificate.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/request/client-certificate.ts"],"names":[],"mappings":"AAOA,OAAO,6CAA6C,CAAC;AAIrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAKxE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAMpD,wBAAsB,gCAAgC,CAClD,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,iBAAiB,GAC1B,OAAO,CAAC,yBAAyB,GAAG,SAAS,CAAC,CAqBhD"}

package/dist/adapters/http/request/client-certificate.mjs CHANGED Viewed

@@ -1,6 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import "../../../core/client-certificate/reflect.mjs";
 import { buildClientCertificateThumbprint, parseClientCertificateChain } from "../../../core/client-certificate/module.mjs";
 import "../../../core/index.mjs";
 import { base64ToArrayBuffer } from "@authup/kit";

package/dist/adapters/http/request/client-certificate.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"client-certificate.mjs","names":["X509Certificate","BadRequestError","base64ToArrayBuffer","buildClientCertificateThumbprint","parseClientCertificateChain","MAX_CERTIFICATE_HEADER_LENGTH","MAX_CERTIFICATE_CHAIN_LENGTH","STRUCTURED_BINARY_PATTERN","extractClientCertificateEvidence","event","source","undefined","result","extractStandardEvidence","extractForwardedEvidence","thumbprint","certificate","leafHeader","headers","get","chainHeader","certificateHeaderError","assertHeaderLength","parseStructuredCertificate","chain","parseStructuredCertificateList","value","pem","includes","decodeURIComponent","replace","certificates","length","items","split","map","item","trim","some","match","exec","raw","byteLength","toString"],"sources":["../../../../src/adapters/http/request/client-certificate.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { X509Certificate } from '@peculiar/x509';\nimport { BadRequestError } from '@authup/errors';\nimport { base64ToArrayBuffer } from '@authup/kit';\nimport type { IAppEvent } from 'routup';\nimport type { ClientCertificateEvidence } from '../../../core/index.ts';\nimport {\n buildClientCertificateThumbprint,\n parseClientCertificateChain,\n} from '../../../core/index.ts';\nimport type { CertificateSource } from './types.ts';\n\nconst MAX_CERTIFICATE_HEADER_LENGTH = 128 1024;\nconst MAX_CERTIFICATE_CHAIN_LENGTH = 10;\nconst STRUCTURED_BINARY_PATTERN = /^:([A-Za-z0-9+/]*={0,2}):$/;\n\nexport async function extractClientCertificateEvidence(\n event: IAppEvent,\n source: CertificateSource,\n): Promise<ClientCertificateEvidence \| undefined> {\n if (source === 'disabled') {\n return undefined;\n }\n\n let result: Omit<ClientCertificateEvidence, 'thumbprint'> \| undefined;\n if (source === 'standard') {\n result = extractStandardEvidence(event);\n } else if (source === 'forwarded') {\n result = extractForwardedEvidence(event);\n } else {\n throw new BadRequestError('The client certificate source is not configured correctly.');\n }\n if (!result) {\n return undefined;\n }\n\n return {\n ...result,\n thumbprint: await buildClientCertificateThumbprint(result.certificate),\n };\n}\n\nfunction extractStandardEvidence(\n event: IAppEvent,\n): Omit<ClientCertificateEvidence, 'thumbprint'> \| undefined {\n const leafHeader = event.headers.get('client-cert');\n const chainHeader = event.headers.get('client-cert-chain');\n\n if (!leafHeader) {\n if (chainHeader) {\n throw certificateHeaderError();\n }\n return undefined;\n }\n\n assertHeaderLength(leafHeader);\n const certificate = parseStructuredCertificate(leafHeader);\n const chain = chainHeader ? parseStructuredCertificateList(chainHeader) : [];\n\n return { certificate, chain };\n}\n\nfunction extractForwardedEvidence(\n event: IAppEvent,\n): Omit<ClientCertificateEvidence, 'thumbprint'> \| undefined {\n const value = event.headers.get('x-forwarded-tls-client-cert');\n if (!value) {\n return undefined;\n }\n\n assertHeaderLength(value);\n\n let pem: string;\n try {\n // Native raw PEM is useful in tests and a few proxy integrations. The\n // NGINX/Traefik contract is escaped PEM: query-style `+` represents a\n // space, while literal base64 plus signs arrive as `%2B`.\n pem = value.includes('-----BEGIN CERTIFICATE-----') ?\n value :\n decodeURIComponent(value.replace(/\\+/g, '%20'));\n } catch {\n throw certificateHeaderError();\n }\n\n let certificates: X509Certificate[];\n try {\n certificates = parseClientCertificateChain(pem);\n } catch {\n throw certificateHeaderError();\n }\n\n if (certificates.length !== 1 \|\| !certificates[0]) {\n throw certificateHeaderError();\n }\n\n return {\n certificate: certificates[0],\n chain: [],\n };\n}\n\nfunction parseStructuredCertificateList(value: string): X509Certificate[] {\n assertHeaderLength(value);\n const items = value.split(',').map((item) => item.trim());\n if (items.length > MAX_CERTIFICATE_CHAIN_LENGTH \|\| items.some((item) => item.length === 0)) {\n throw certificateHeaderError();\n }\n\n return items.map(parseStructuredCertificate);\n}\n\nfunction parseStructuredCertificate(value: string): X509Certificate {\n const match = STRUCTURED_BINARY_PATTERN.exec(value.trim());\n if (!match?.[1]) {\n throw certificateHeaderError();\n }\n\n try {\n const raw = base64ToArrayBuffer(match[1]);\n if (raw.byteLength === 0) {\n throw certificateHeaderError();\n }\n\n const certificate = new X509Certificate(raw);\n if (\n certificate.toString('base64').replace(/=+$/, '') !==\n match[1].replace(/=+$/, '')\n ) {\n throw certificateHeaderError();\n }\n\n return certificate;\n } catch {\n throw certificateHeaderError();\n }\n}\n\nfunction assertHeaderLength(value: string): void {\n if (value.length > MAX_CERTIFICATE_HEADER_LENGTH) {\n throw certificateHeaderError();\n }\n}\n\nfunction certificateHeaderError(): BadRequestError {\n return new BadRequestError('The forwarded client certificate header is malformed.');\n}\n"],"mappings":"~~;;;;;;;;;AAkBA~~,MAAMK,gCAAgC,MAAM;AAC5C,MAAMC,+BAA+B;AACrC,MAAMC,4BAA4B;AAElC,eAAsBC,iCAClBC,OACAC,QAAyB;CAEzB,IAAIA,WAAW,YACX;CAGJ,IAAIE;CACJ,IAAIF,WAAW,YACXE,SAASC,wBAAwBJ,KAAAA;MAC9B,IAAIC,WAAW,aAClBE,SAASE,yBAAyBL,KAAAA;MAElC,MAAM,IAAIR,gBAAgB,4DAAA;CAE9B,IAAI,CAACW,QACD;CAGJ,OAAO;EACH,GAAGA;EACHG,YAAY,MAAMZ,iCAAiCS,OAAOI,WAAW;CACzE;AACJ;AAEA,SAASH,wBACLJ,OAAgB;CAEhB,MAAMQ,aAAaR,MAAMS,QAAQC,IAAI,aAAA;CACrC,MAAMC,cAAcX,MAAMS,QAAQC,IAAI,mBAAA;CAEtC,IAAI,CAACF,YAAY;EACb,IAAIG,aACA,MAAMC,uBAAAA;EAEV;CACJ;CAEAC,mBAAmBL,UAAAA;CAInB,OAAO;EAAED,aAHWO,2BAA2BN,UAGtCD;EAAaQ,OAFRJ,cAAcK,+BAA+BL,WAAAA,IAAe,CAAA;CAE9C;AAChC;AAEA,SAASN,yBACLL,OAAgB;CAEhB,MAAMiB,QAAQjB,MAAMS,QAAQC,IAAI,6BAAA;CAChC,IAAI,CAACO,OACD;CAGJJ,mBAAmBI,KAAAA;CAEnB,IAAIC;CACJ,IAAI;EAIAA,MAAMD,MAAME,SAAS,6BAAA,IACjBF,QACAG,mBAAmBH,MAAMI,QAAQ,OAAO,KAAA,CAAA;CAChD,QAAQ;EACJ,MAAMT,uBAAAA;CACV;CAEA,IAAIU;CACJ,IAAI;EACAA,eAAe3B,4BAA4BuB,GAAAA;CAC/C,QAAQ;EACJ,MAAMN,uBAAAA;CACV;CAEA,IAAIU,aAAaC,WAAW,KAAK,CAACD,aAAa,IAC3C,MAAMV,uBAAAA;CAGV,OAAO;EACHL,aAAae,aAAa;EAC1BP,OAAO,CAAA;CACX;AACJ;AAEA,SAASC,+BAA+BC,OAAa;CACjDJ,mBAAmBI,KAAAA;CACnB,MAAMO,QAAQP,MAAMQ,MAAM,GAAA,CAAA,CAAKC,KAAKC,SAASA,KAAKC,KAAI,CAAA;CACtD,IAAIJ,MAAMD,SAAS1B,gCAAgC2B,MAAMK,MAAMF,SAASA,KAAKJ,WAAW,CAAA,GACpF,MAAMX,uBAAAA;CAGV,OAAOY,MAAME,IAAIZ,0BAAAA;AACrB;AAEA,SAASA,2BAA2BG,OAAa;CAC7C,MAAMa,QAAQhC,0BAA0BiC,KAAKd,MAAMW,KAAI,CAAA;CACvD,IAAI,CAACE,QAAQ,IACT,MAAMlB,uBAAAA;CAGV,IAAI;EACA,MAAMoB,MAAMvC,oBAAoBqC,MAAM,EAAE;EACxC,IAAIE,IAAIC,eAAe,GACnB,MAAMrB,uBAAAA;EAGV,MAAML,cAAc,IAAIhB,gBAAgByC,GAAAA;EACxC,IACIzB,YAAY2B,SAAS,QAAA,CAAA,CAAUb,QAAQ,OAAO,EAAA,MAC9CS,MAAM,EAAE,CAACT,QAAQ,OAAO,EAAA,GAExB,MAAMT,uBAAAA;EAGV,OAAOL;CACX,QAAQ;EACJ,MAAMK,uBAAAA;CACV;AACJ;AAEA,SAASC,mBAAmBI,OAAa;CACrC,IAAIA,MAAMM,SAAS3B,+BACf,MAAMgB,uBAAAA;AAEd;AAEA,SAASA,yBAAAA;CACL,OAAO,IAAIpB,gBAAgB,uDAAA;AAC/B"}
1	+ {"version":3,"file":"client-certificate.mjs","names":["X509Certificate","BadRequestError","base64ToArrayBuffer","buildClientCertificateThumbprint","parseClientCertificateChain","MAX_CERTIFICATE_HEADER_LENGTH","MAX_CERTIFICATE_CHAIN_LENGTH","STRUCTURED_BINARY_PATTERN","extractClientCertificateEvidence","event","source","undefined","result","extractStandardEvidence","extractForwardedEvidence","thumbprint","certificate","leafHeader","headers","get","chainHeader","certificateHeaderError","assertHeaderLength","parseStructuredCertificate","chain","parseStructuredCertificateList","value","pem","includes","decodeURIComponent","replace","certificates","length","items","split","map","item","trim","some","match","exec","raw","byteLength","toString"],"sources":["../../../../src/adapters/http/request/client-certificate.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport '../../../core/client-certificate/reflect.ts';\nimport { X509Certificate } from '@peculiar/x509';\nimport { BadRequestError } from '@authup/errors';\nimport { base64ToArrayBuffer } from '@authup/kit';\nimport type { IAppEvent } from 'routup';\nimport type { ClientCertificateEvidence } from '../../../core/index.ts';\nimport {\n buildClientCertificateThumbprint,\n parseClientCertificateChain,\n} from '../../../core/index.ts';\nimport type { CertificateSource } from './types.ts';\n\nconst MAX_CERTIFICATE_HEADER_LENGTH = 128 1024;\nconst MAX_CERTIFICATE_CHAIN_LENGTH = 10;\nconst STRUCTURED_BINARY_PATTERN = /^:([A-Za-z0-9+/]*={0,2}):$/;\n\nexport async function extractClientCertificateEvidence(\n event: IAppEvent,\n source: CertificateSource,\n): Promise<ClientCertificateEvidence \| undefined> {\n if (source === 'disabled') {\n return undefined;\n }\n\n let result: Omit<ClientCertificateEvidence, 'thumbprint'> \| undefined;\n if (source === 'standard') {\n result = extractStandardEvidence(event);\n } else if (source === 'forwarded') {\n result = extractForwardedEvidence(event);\n } else {\n throw new BadRequestError('The client certificate source is not configured correctly.');\n }\n if (!result) {\n return undefined;\n }\n\n return {\n ...result,\n thumbprint: await buildClientCertificateThumbprint(result.certificate),\n };\n}\n\nfunction extractStandardEvidence(\n event: IAppEvent,\n): Omit<ClientCertificateEvidence, 'thumbprint'> \| undefined {\n const leafHeader = event.headers.get('client-cert');\n const chainHeader = event.headers.get('client-cert-chain');\n\n if (!leafHeader) {\n if (chainHeader) {\n throw certificateHeaderError();\n }\n return undefined;\n }\n\n assertHeaderLength(leafHeader);\n const certificate = parseStructuredCertificate(leafHeader);\n const chain = chainHeader ? parseStructuredCertificateList(chainHeader) : [];\n\n return { certificate, chain };\n}\n\nfunction extractForwardedEvidence(\n event: IAppEvent,\n): Omit<ClientCertificateEvidence, 'thumbprint'> \| undefined {\n const value = event.headers.get('x-forwarded-tls-client-cert');\n if (!value) {\n return undefined;\n }\n\n assertHeaderLength(value);\n\n let pem: string;\n try {\n // Native raw PEM is useful in tests and a few proxy integrations. The\n // NGINX/Traefik contract is escaped PEM: query-style `+` represents a\n // space, while literal base64 plus signs arrive as `%2B`.\n pem = value.includes('-----BEGIN CERTIFICATE-----') ?\n value :\n decodeURIComponent(value.replace(/\\+/g, '%20'));\n } catch {\n throw certificateHeaderError();\n }\n\n let certificates: X509Certificate[];\n try {\n certificates = parseClientCertificateChain(pem);\n } catch {\n throw certificateHeaderError();\n }\n\n if (certificates.length !== 1 \|\| !certificates[0]) {\n throw certificateHeaderError();\n }\n\n return {\n certificate: certificates[0],\n chain: [],\n };\n}\n\nfunction parseStructuredCertificateList(value: string): X509Certificate[] {\n assertHeaderLength(value);\n const items = value.split(',').map((item) => item.trim());\n if (items.length > MAX_CERTIFICATE_CHAIN_LENGTH \|\| items.some((item) => item.length === 0)) {\n throw certificateHeaderError();\n }\n\n return items.map(parseStructuredCertificate);\n}\n\nfunction parseStructuredCertificate(value: string): X509Certificate {\n const match = STRUCTURED_BINARY_PATTERN.exec(value.trim());\n if (!match?.[1]) {\n throw certificateHeaderError();\n }\n\n try {\n const raw = base64ToArrayBuffer(match[1]);\n if (raw.byteLength === 0) {\n throw certificateHeaderError();\n }\n\n const certificate = new X509Certificate(raw);\n if (\n certificate.toString('base64').replace(/=+$/, '') !==\n match[1].replace(/=+$/, '')\n ) {\n throw certificateHeaderError();\n }\n\n return certificate;\n } catch {\n throw certificateHeaderError();\n }\n}\n\nfunction assertHeaderLength(value: string): void {\n if (value.length > MAX_CERTIFICATE_HEADER_LENGTH) {\n throw certificateHeaderError();\n }\n}\n\nfunction certificateHeaderError(): BadRequestError {\n return new BadRequestError('The forwarded client certificate header is malformed.');\n}\n"],"mappings":";;;;;;;;;;AAmBA,MAAMK,gCAAgC,MAAM;AAC5C,MAAMC,+BAA+B;AACrC,MAAMC,4BAA4B;AAElC,eAAsBC,iCAClBC,OACAC,QAAyB;CAEzB,IAAIA,WAAW,YACX;CAGJ,IAAIE;CACJ,IAAIF,WAAW,YACXE,SAASC,wBAAwBJ,KAAAA;MAC9B,IAAIC,WAAW,aAClBE,SAASE,yBAAyBL,KAAAA;MAElC,MAAM,IAAIR,gBAAgB,4DAAA;CAE9B,IAAI,CAACW,QACD;CAGJ,OAAO;EACH,GAAGA;EACHG,YAAY,MAAMZ,iCAAiCS,OAAOI,WAAW;CACzE;AACJ;AAEA,SAASH,wBACLJ,OAAgB;CAEhB,MAAMQ,aAAaR,MAAMS,QAAQC,IAAI,aAAA;CACrC,MAAMC,cAAcX,MAAMS,QAAQC,IAAI,mBAAA;CAEtC,IAAI,CAACF,YAAY;EACb,IAAIG,aACA,MAAMC,uBAAAA;EAEV;CACJ;CAEAC,mBAAmBL,UAAAA;CAInB,OAAO;EAAED,aAHWO,2BAA2BN,UAGtCD;EAAaQ,OAFRJ,cAAcK,+BAA+BL,WAAAA,IAAe,CAAA;CAE9C;AAChC;AAEA,SAASN,yBACLL,OAAgB;CAEhB,MAAMiB,QAAQjB,MAAMS,QAAQC,IAAI,6BAAA;CAChC,IAAI,CAACO,OACD;CAGJJ,mBAAmBI,KAAAA;CAEnB,IAAIC;CACJ,IAAI;EAIAA,MAAMD,MAAME,SAAS,6BAAA,IACjBF,QACAG,mBAAmBH,MAAMI,QAAQ,OAAO,KAAA,CAAA;CAChD,QAAQ;EACJ,MAAMT,uBAAAA;CACV;CAEA,IAAIU;CACJ,IAAI;EACAA,eAAe3B,4BAA4BuB,GAAAA;CAC/C,QAAQ;EACJ,MAAMN,uBAAAA;CACV;CAEA,IAAIU,aAAaC,WAAW,KAAK,CAACD,aAAa,IAC3C,MAAMV,uBAAAA;CAGV,OAAO;EACHL,aAAae,aAAa;EAC1BP,OAAO,CAAA;CACX;AACJ;AAEA,SAASC,+BAA+BC,OAAa;CACjDJ,mBAAmBI,KAAAA;CACnB,MAAMO,QAAQP,MAAMQ,MAAM,GAAA,CAAA,CAAKC,KAAKC,SAASA,KAAKC,KAAI,CAAA;CACtD,IAAIJ,MAAMD,SAAS1B,gCAAgC2B,MAAMK,MAAMF,SAASA,KAAKJ,WAAW,CAAA,GACpF,MAAMX,uBAAAA;CAGV,OAAOY,MAAME,IAAIZ,0BAAAA;AACrB;AAEA,SAASA,2BAA2BG,OAAa;CAC7C,MAAMa,QAAQhC,0BAA0BiC,KAAKd,MAAMW,KAAI,CAAA;CACvD,IAAI,CAACE,QAAQ,IACT,MAAMlB,uBAAAA;CAGV,IAAI;EACA,MAAMoB,MAAMvC,oBAAoBqC,MAAM,EAAE;EACxC,IAAIE,IAAIC,eAAe,GACnB,MAAMrB,uBAAAA;EAGV,MAAML,cAAc,IAAIhB,gBAAgByC,GAAAA;EACxC,IACIzB,YAAY2B,SAAS,QAAA,CAAA,CAAUb,QAAQ,OAAO,EAAA,MAC9CS,MAAM,EAAE,CAACT,QAAQ,OAAO,EAAA,GAExB,MAAMT,uBAAAA;EAGV,OAAOL;CACX,QAAQ;EACJ,MAAMK,uBAAAA;CACV;AACJ;AAEA,SAASC,mBAAmBI,OAAa;CACrC,IAAIA,MAAMM,SAAS3B,+BACf,MAAMgB,uBAAAA;AAEd;AAEA,SAASA,yBAAAA;CACL,OAAO,IAAIpB,gBAAgB,uDAAA;AAC/B"}

package/dist/adapters/http/request/helpers/body-realm-id.mjs CHANGED Viewed

@@ -4,7 +4,7 @@ import.meta.url;
 import { isUUID } from "@authup/kit";
 //#region src/adapters/http/request/helpers/body-realm-id.ts
 function getBodyRealmID(body) {
-	const realmId = body?.realm_id;
+	const realmId = body?.realmId;
 	if (typeof realmId !== "string") return;
 	if (!isUUID(realmId)) return;
 	return realmId;

package/dist/adapters/http/request/helpers/body-realm-id.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"body-realm-id.mjs","names":["isUUID","getBodyRealmID","body","realmId","~~realm_id","~~undefined"],"sources":["../../../../../src/adapters/http/request/helpers/body-realm-id.ts"],"sourcesContent":["/\n Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isUUID } from '@authup/kit';\n\nexport function getBodyRealmID(body: Record<string, any> \| undefined) : string \| undefined {\n const realmId = body?.~~realm_id~~;\n if (typeof realmId !== 'string') {\n return undefined;\n }\n\n if (!isUUID(realmId)) {\n return undefined;\n }\n\n return realmId;\n}\n"],"mappings":";;;;;AASA,SAAgBC,eAAeC,MAAqC;CAChE,MAAMC,UAAUD,~~MAAME~~;CACtB,IAAI,~~OAAOD~~,YAAY,UACnB;CAGJ,IAAI,CAACH,OAAOG,OAAAA,GACR;CAGJ,OAAOA;AACX"}
1	+ {"version":3,"file":"body-realm-id.mjs","names":["isUUID","getBodyRealmID","body","realmId","undefined"],"sources":["../../../../../src/adapters/http/request/helpers/body-realm-id.ts"],"sourcesContent":["/\n Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isUUID } from '@authup/kit';\n\nexport function getBodyRealmID(body: Record<string, any> \| undefined) : string \| undefined {\n const realmId = body?.realmId;\n if (typeof realmId !== 'string') {\n return undefined;\n }\n\n if (!isUUID(realmId)) {\n return undefined;\n }\n\n return realmId;\n}\n"],"mappings":";;;;;AASA,SAAgBC,eAAeC,MAAqC;CAChE,MAAMC,UAAUD,MAAMC;CACtB,IAAI,OAAOA,YAAY,UACnB;CAGJ,IAAI,CAACH,OAAOG,OAAAA,GACR;CAGJ,OAAOA;AACX"}

package/dist/adapters/http/request/helpers/identity.d.ts CHANGED Viewed

@@ -4,8 +4,8 @@ export declare class RequestIdentity {
     readonly raw: Identity;
     constructor(identity: Identity);
     get clientId(): any;
-    get data(): import("@authup/core-kit").Client | import("@authup/core-kit").Robot | import("@authup/core-kit").User;
-    get type(): "user" | "client" | "robot";
+    get data(): import("@authup/core-kit").Client | import("@authup/core-kit").User;
+    get type(): "user" | "client";
     get id(): string;
     get realmId(): string;
     get realmName(): string;

package/dist/adapters/http/request/helpers/identity.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/helpers/identity.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAGjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAIxC,qBAAa,eAAe;IACxB,SAAgB,GAAG,EAAG,QAAQ,CAAC;gBAEnB,QAAQ,EAAE,QAAQ;IAI9B,IAAI,QAAQ,QAOX;IAED,IAAI,IAAI,~~2GAEP~~;IAED,IAAI,IAAI,~~gCAEP~~;IAED,IAAI,EAAE,WAEL;IAED,IAAI,OAAO,WAEV;IAED,IAAI,SAAS,WAEZ;CACJ;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,GAAI,eAAe,GAAG,SAAS,CAEjF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,GAAG,eAAe,GAAI,IAAI,CAU7F;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,SAAS,GAAI,eAAe,CAO3E"}
1	+ {"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/helpers/identity.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAGjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAIxC,qBAAa,eAAe;IACxB,SAAgB,GAAG,EAAG,QAAQ,CAAC;gBAEnB,QAAQ,EAAE,QAAQ;IAI9B,IAAI,QAAQ,QAOX;IAED,IAAI,IAAI,wEAEP;IAED,IAAI,IAAI,sBAEP;IAED,IAAI,EAAE,WAEL;IAED,IAAI,OAAO,WAEV;IAED,IAAI,SAAS,WAEZ;CACJ;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,GAAI,eAAe,GAAG,SAAS,CAEjF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,GAAG,eAAe,GAAI,IAAI,CAU7F;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,SAAS,GAAI,eAAe,CAO3E"}

package/dist/adapters/http/request/helpers/identity.mjs CHANGED Viewed

@@ -13,7 +13,7 @@ var RequestIdentity = class {
 	get clientId() {
 		const { raw } = this;
 		if (raw.type === IdentityType.CLIENT) return raw.data.id;
-		return raw.data.client_id || null;
+		return raw.data.clientId || null;
 	}
 	get data() {
 		return this.raw.data;
@@ -25,7 +25,7 @@ var RequestIdentity = class {
 		return this.raw.data.id;
 	}
 	get realmId() {
-		return this.raw.data.realm_id || this.raw.data.realm?.id;
+		return this.raw.data.realmId || this.raw.data.realm?.id;
 	}
 	get realmName() {
 		return this.raw.data.realm?.name;

package/dist/adapters/http/request/helpers/identity.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"identity.mjs","names":["IdentityType","UnauthorizedError","sym","Symbol","RequestIdentity","raw","identity","clientId","type","CLIENT","data","id","~~client_id","~~realmId","~~realm_id","~~realm","realmName","name","useRequestIdentity","event","store","setRequestIdentity","input","useRequestIdentityOrFail"],"sources":["../../../../../src/adapters/http/request/helpers/identity.ts"],"sourcesContent":["/\n Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Identity } from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { UnauthorizedError } from '@authup/errors';\nimport type { IAppEvent } from 'routup';\n\nconst sym = Symbol('RIdentity');\n\nexport class RequestIdentity {\n public readonly raw : Identity;\n\n constructor(identity: Identity) {\n this.raw = identity;\n }\n\n get clientId() {\n const { raw } = this;\n if (raw.type === IdentityType.CLIENT) {\n return raw.data.id;\n }\n\n return raw.data.~~client_id~~ \|\| null;\n }\n\n get data() {\n return this.raw.data;\n }\n\n get type() {\n return this.raw.type;\n }\n\n get id() {\n return this.raw.data.id;\n }\n\n get realmId() {\n return this.raw.data.~~realm_id~~ \|\| this.raw.data.realm?.id;\n }\n\n get realmName() {\n return this.raw.data.realm?.name;\n }\n}\n\nexport function useRequestIdentity(event: IAppEvent) : RequestIdentity \| undefined {\n return event.store[sym] as RequestIdentity \| undefined;\n}\n\nexport function setRequestIdentity(event: IAppEvent, input: Identity \| RequestIdentity) : void {\n let data : RequestIdentity;\n\n if (input instanceof RequestIdentity) {\n data = input;\n } else {\n data = new RequestIdentity(input);\n }\n\n event.store[sym] = data;\n}\n\nexport function useRequestIdentityOrFail(event: IAppEvent) : RequestIdentity {\n const identity = useRequestIdentity(event);\n if (!identity) {\n throw new UnauthorizedError();\n }\n\n return identity;\n}\n"],"mappings":";;;;;;AAYA,MAAME,MAAMC,OAAO,WAAA;AAEnB,IAAaC,kBAAb,MAAaA;CACOC;CAEhB,YAAYC,UAAoB;EAC5B,KAAKD,MAAMC;CACf;CAEA,IAAIC,WAAW;EACX,MAAM,EAAEF,QAAQ;EAChB,IAAIA,IAAIG,SAASR,aAAaS,QAC1B,OAAOJ,IAAIK,KAAKC;EAGpB,OAAON,IAAIK,~~KAAKE~~,~~aAAa~~;~~CACjC~~;CAEA,~~IAAIF~~,OAAO;EACP,OAAO,KAAKL,IAAIK;CACpB;CAEA,IAAIF,OAAO;EACP,OAAO,KAAKH,IAAIG;CACpB;CAEA,IAAIG,KAAK;EACL,OAAO,KAAKN,IAAIK,KAAKC;CACzB;CAEA,~~IAAIE~~,UAAU;EACV,OAAO,~~KAAKR~~,IAAIK,~~KAAKI~~,~~YAAY~~,~~KAAKT~~,IAAIK,~~KAAKK~~,~~OAAOJ~~;~~CAC1D~~;CAEA,~~IAAIK~~,YAAY;EACZ,OAAO,~~KAAKX~~,IAAIK,~~KAAKK~~,OAAOE;CAChC;AACJ;AAEA,SAAgBC,mBAAmBC,OAAgB;CAC/C,OAAOA,MAAMC,~~MAAMlB~~;AACvB;AAEA,~~SAAgBmB~~,mBAAmBF,OAAkBG,OAAiC;CAClF,~~IAAIZ~~;CAEJ,~~IAAIY~~,~~iBAAiBlB~~,iBACjBM,~~OAAOY~~;~~MAEPZ~~,OAAO,IAAIN,~~gBAAgBkB~~,KAAAA;CAG/BH,MAAMC,~~MAAMlB~~,OAAOQ;AACvB;AAEA,~~SAAgBa~~,yBAAyBJ,OAAgB;CACrD,~~MAAMb~~,~~WAAWY~~,mBAAmBC,KAAAA;CACpC,IAAI,~~CAACb~~,UACD,MAAM,IAAIL,kBAAAA;CAGd,OAAOK;AACX"}
1	+ {"version":3,"file":"identity.mjs","names":["IdentityType","UnauthorizedError","sym","Symbol","RequestIdentity","raw","identity","clientId","type","CLIENT","data","id","realmId","realm","realmName","name","useRequestIdentity","event","store","setRequestIdentity","input","useRequestIdentityOrFail"],"sources":["../../../../../src/adapters/http/request/helpers/identity.ts"],"sourcesContent":["/\n Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Identity } from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { UnauthorizedError } from '@authup/errors';\nimport type { IAppEvent } from 'routup';\n\nconst sym = Symbol('RIdentity');\n\nexport class RequestIdentity {\n public readonly raw : Identity;\n\n constructor(identity: Identity) {\n this.raw = identity;\n }\n\n get clientId() {\n const { raw } = this;\n if (raw.type === IdentityType.CLIENT) {\n return raw.data.id;\n }\n\n return raw.data.clientId \|\| null;\n }\n\n get data() {\n return this.raw.data;\n }\n\n get type() {\n return this.raw.type;\n }\n\n get id() {\n return this.raw.data.id;\n }\n\n get realmId() {\n return this.raw.data.realmId \|\| this.raw.data.realm?.id;\n }\n\n get realmName() {\n return this.raw.data.realm?.name;\n }\n}\n\nexport function useRequestIdentity(event: IAppEvent) : RequestIdentity \| undefined {\n return event.store[sym] as RequestIdentity \| undefined;\n}\n\nexport function setRequestIdentity(event: IAppEvent, input: Identity \| RequestIdentity) : void {\n let data : RequestIdentity;\n\n if (input instanceof RequestIdentity) {\n data = input;\n } else {\n data = new RequestIdentity(input);\n }\n\n event.store[sym] = data;\n}\n\nexport function useRequestIdentityOrFail(event: IAppEvent) : RequestIdentity {\n const identity = useRequestIdentity(event);\n if (!identity) {\n throw new UnauthorizedError();\n }\n\n return identity;\n}\n"],"mappings":";;;;;;AAYA,MAAME,MAAMC,OAAO,WAAA;AAEnB,IAAaC,kBAAb,MAAaA;CACOC;CAEhB,YAAYC,UAAoB;EAC5B,KAAKD,MAAMC;CACf;CAEA,IAAIC,WAAW;EACX,MAAM,EAAEF,QAAQ;EAChB,IAAIA,IAAIG,SAASR,aAAaS,QAC1B,OAAOJ,IAAIK,KAAKC;EAGpB,OAAON,IAAIK,KAAKH,YAAY;CAChC;CAEA,IAAIG,OAAO;EACP,OAAO,KAAKL,IAAIK;CACpB;CAEA,IAAIF,OAAO;EACP,OAAO,KAAKH,IAAIG;CACpB;CAEA,IAAIG,KAAK;EACL,OAAO,KAAKN,IAAIK,KAAKC;CACzB;CAEA,IAAIC,UAAU;EACV,OAAO,KAAKP,IAAIK,KAAKE,WAAW,KAAKP,IAAIK,KAAKG,OAAOF;CACzD;CAEA,IAAIG,YAAY;EACZ,OAAO,KAAKT,IAAIK,KAAKG,OAAOE;CAChC;AACJ;AAEA,SAAgBC,mBAAmBC,OAAgB;CAC/C,OAAOA,MAAMC,MAAMhB;AACvB;AAEA,SAAgBiB,mBAAmBF,OAAkBG,OAAiC;CAClF,IAAIV;CAEJ,IAAIU,iBAAiBhB,iBACjBM,OAAOU;MAEPV,OAAO,IAAIN,gBAAgBgB,KAAAA;CAG/BH,MAAMC,MAAMhB,OAAOQ;AACvB;AAEA,SAAgBW,yBAAyBJ,OAAgB;CACrD,MAAMX,WAAWU,mBAAmBC,KAAAA;CACpC,IAAI,CAACX,UACD,MAAM,IAAIL,kBAAAA;CAGd,OAAOK;AACX"}

package/dist/adapters/http/request/helpers/realm-id.mjs CHANGED Viewed

@@ -14,7 +14,7 @@ function getRequestRealmID(event) {
 }
 function applyRouteRealmIDToBody(event, data) {
 	const routeRealmId = getRequestRealmID(event);
-	if (routeRealmId) data.realm_id = routeRealmId;
+	if (routeRealmId) data.realmId = routeRealmId;
 }
 //#endregion
 export { applyRouteRealmIDToBody, getRequestRealmID, setRequestRealmID };

package/dist/adapters/http/request/helpers/realm-id.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"realm-id.mjs","names":["getRequestStringParam","sym","Symbol","setRequestRealmID","event","id","store","getRequestRealmID","stored","applyRouteRealmIDToBody","data","routeRealmId","~~realm_id~~"],"sources":["../../../../../src/adapters/http/request/helpers/realm-id.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IAppEvent } from 'routup';\nimport { getRequestStringParam } from './param-id.ts';\n\nconst sym = Symbol('RRealmID');\n\nexport function setRequestRealmID(event: IAppEvent, id: string): void {\n event.store[sym] = id;\n}\n\nexport function getRequestRealmID(event: IAppEvent): string \| undefined {\n const stored = event.store[sym] as string \| undefined;\n if (stored) {\n return stored;\n }\n return getRequestStringParam(event, 'realmId');\n}\n\nexport function applyRouteRealmIDToBody(event: IAppEvent, data: Record<string, any>): void {\n const routeRealmId = getRequestRealmID(event);\n if (routeRealmId) {\n data.~~realm_id~~ = routeRealmId;\n }\n}\n"],"mappings":";;;;;AAUA,MAAMC,MAAMC,OAAO,UAAA;AAEnB,SAAgBC,kBAAkBC,OAAkBC,IAAU;CAC1DD,MAAME,MAAML,OAAOI;AACvB;AAEA,SAAgBE,kBAAkBH,OAAgB;CAC9C,MAAMI,SAASJ,MAAME,MAAML;CAC3B,IAAIO,QACA,OAAOA;CAEX,OAAOR,sBAAsBI,OAAO,SAAA;AACxC;AAEA,SAAgBK,wBAAwBL,OAAkBM,MAAyB;CAC/E,MAAMC,eAAeJ,kBAAkBH,KAAAA;CACvC,IAAIO,cACAD,KAAKE,~~WAAWD~~;~~AAExB~~"}
1	+ {"version":3,"file":"realm-id.mjs","names":["getRequestStringParam","sym","Symbol","setRequestRealmID","event","id","store","getRequestRealmID","stored","applyRouteRealmIDToBody","data","routeRealmId","realmId"],"sources":["../../../../../src/adapters/http/request/helpers/realm-id.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IAppEvent } from 'routup';\nimport { getRequestStringParam } from './param-id.ts';\n\nconst sym = Symbol('RRealmID');\n\nexport function setRequestRealmID(event: IAppEvent, id: string): void {\n event.store[sym] = id;\n}\n\nexport function getRequestRealmID(event: IAppEvent): string \| undefined {\n const stored = event.store[sym] as string \| undefined;\n if (stored) {\n return stored;\n }\n return getRequestStringParam(event, 'realmId');\n}\n\nexport function applyRouteRealmIDToBody(event: IAppEvent, data: Record<string, any>): void {\n const routeRealmId = getRequestRealmID(event);\n if (routeRealmId) {\n data.realmId = routeRealmId;\n }\n}\n"],"mappings":";;;;;AAUA,MAAMC,MAAMC,OAAO,UAAA;AAEnB,SAAgBC,kBAAkBC,OAAkBC,IAAU;CAC1DD,MAAME,MAAML,OAAOI;AACvB;AAEA,SAAgBE,kBAAkBH,OAAgB;CAC9C,MAAMI,SAASJ,MAAME,MAAML;CAC3B,IAAIO,QACA,OAAOA;CAEX,OAAOR,sBAAsBI,OAAO,SAAA;AACxC;AAEA,SAAgBK,wBAAwBL,OAAkBM,MAAyB;CAC/E,MAAMC,eAAeJ,kBAAkBH,KAAAA;CACvC,IAAIO,cACAD,KAAKE,UAAUD;AAEvB"}

package/dist/adapters/http/request/permission/module.d.ts CHANGED Viewed

@@ -1,4 +1,4 @@
-import type { IPermissionEvaluator, PermissionEvaluationContext } from '@authup/access';
+import type { IPermissionEvaluator, PermissionCompileContext, PermissionCompileResult, PermissionEvaluationContext } from '@authup/access';
 import type { IAppEvent } from 'routup';
 export declare class RequestPermissionEvaluator implements IPermissionEvaluator {
     protected event: IAppEvent;
@@ -8,6 +8,7 @@ export declare class RequestPermissionEvaluator implements IPermissionEvaluator
     preEvaluate(ctx: PermissionEvaluationContext): Promise<void>;
     preEvaluateOneOf(ctx: PermissionEvaluationContext): Promise<void>;
     evaluateOneOf(ctx: PermissionEvaluationContext): Promise<void>;
-    protected extendContext(ctx: PermissionEvaluationContext): PermissionEvaluationContext;
+    compile(ctx: PermissionCompileContext): Promise<PermissionCompileResult>;
+    protected extendContext<T extends PermissionEvaluationContext | PermissionCompileContext>(ctx: T): T;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/request/permission/module.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/permission/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACR,oBAAoB,EACpB,2BAA2B,EAC9B,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGxC,qBAAa,0BAA2B,YAAW,oBAAoB;IACnE,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC;IAE3B,SAAS,CAAC,SAAS,EAAE,oBAAoB,CAAC;gBAE9B,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,oBAAoB;IAOvD,QAAQ,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAI1D,WAAW,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAM7D,gBAAgB,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAIlE,aAAa,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;~~IAMrE~~,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,~~2BAA2B~~;~~CAiB3D~~"}
1	+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/permission/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACR,oBAAoB,EACpB,wBAAwB,EACxB,uBAAuB,EACvB,2BAA2B,EAC9B,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGxC,qBAAa,0BAA2B,YAAW,oBAAoB;IACnE,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC;IAE3B,SAAS,CAAC,SAAS,EAAE,oBAAoB,CAAC;gBAE9B,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,oBAAoB;IAOvD,QAAQ,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAI1D,WAAW,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAM7D,gBAAgB,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAIlE,aAAa,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAM/D,OAAO,CAAC,GAAG,EAAE,wBAAwB,GAAI,OAAO,CAAC,uBAAuB,CAAC;IAM/E,SAAS,CAAC,aAAa,CAAC,CAAC,SAAS,2BAA2B,GAAG,wBAAwB,EAAE,GAAG,EAAE,CAAC,GAAI,CAAC;CAiBxG"}

package/dist/adapters/http/request/permission/module.mjs CHANGED Viewed

@@ -26,6 +26,9 @@ var RequestPermissionEvaluator = class {
 	async evaluateOneOf(ctx) {
 		return this.evaluator.evaluateOneOf(this.extendContext(ctx));
 	}
+	async compile(ctx) {
+		return this.evaluator.compile(this.extendContext(ctx));
+	}
 	extendContext(ctx) {
 		const scopes = useRequestScopes(this.event);
 		const identity = useRequestIdentity(this.event);