npm - @authup/server-core - Versions diffs - 1.0.0-beta.53 → 1.0.0-beta.54 - Mend

@authup/server-core 1.0.0-beta.53 → 1.0.0-beta.54

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1152) hide show

package/dist/core/oauth2/authorization/helpers.mjs CHANGED Viewed

@@ -7,14 +7,14 @@ import { subtle } from "uncrypto";
 //#region src/core/oauth2/authorization/helpers.ts
 /**
 * Derive the OIDC `amr` / `acr` claims from the backing session's
-* auth_method + mfa_at (plan 050). Pre-column sessions (null auth_method)
+* authMethod + mfaAt (plan 050). Pre-column sessions (null authMethod)
 * yield no claims — authup cannot retroactively know how an old session
 * authenticated. M2M methods yield none either (amr/acr are user-flow
 * claims; those grants mint no id_token).
 */ function deriveAmrAcr(session) {
-	if (!session || !session.auth_method) return {};
+	if (!session || !session.authMethod) return {};
 	const amr = [];
-	switch (session.auth_method) {
+	switch (session.authMethod) {
 		case SessionAuthMethod.PASSWORD:
 		case SessionAuthMethod.LDAP:
 			amr.push(OAuth2AuthenticationMethodReference.PASSWORD);
@@ -24,10 +24,10 @@ import { subtle } from "uncrypto";
 			break;
 		default: return {};
 	}
-	if (session.mfa_at) amr.push(OAuth2AuthenticationMethodReference.OTP);
+	if (session.mfaAt) amr.push(OAuth2AuthenticationMethodReference.OTP);
 	return {
 		amr,
-		acr: session.mfa_at ? OAuth2AuthenticationContextClass.MFA : OAuth2AuthenticationContextClass.PASSWORD
+		acr: session.mfaAt ? OAuth2AuthenticationContextClass.MFA : OAuth2AuthenticationContextClass.PASSWORD
 	};
 }
 function generateOAuth2CodeVerifier() {

package/dist/core/oauth2/authorization/helpers.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"helpers.mjs","names":["JWTError","OAuth2AuthenticationContextClass","OAuth2AuthenticationMethodReference","SessionAuthMethod","subtle","deriveAmrAcr","session","~~auth_method~~","amr","PASSWORD","LDAP","push","EXTERNAL","~~mfa_at~~","OTP","acr","MFA","generateOAuth2CodeVerifier","length","charset","codeVerifier","randomValues","Uint8Array","crypto","getRandomValues","i","base64URLEncode","arrayBuffer","charCode","Array","from","btoa","String","fromCharCode","apply","replace","TOKEN_HASH_DIGESTS","name","halfLength","buildOAuth2TokenHash","value","alg","digest","slice","headerPropertyInvalid","encoder","TextEncoder","data","encode","hashBuffer","halfHash","buildOAuth2CodeChallenge"],"sources":["../../../../src/core/oauth2/authorization/helpers.ts"],"sourcesContent":["/\n Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { JWTAlgorithm, OAuth2TokenPayload } from '@authup/specs';\nimport {\n JWTError,\n OAuth2AuthenticationContextClass,\n OAuth2AuthenticationMethodReference,\n} from '@authup/specs';\nimport type { Session } from '@authup/core-kit';\nimport { SessionAuthMethod } from '@authup/core-kit';\nimport { subtle } from 'uncrypto';\n\n/\n Derive the OIDC `amr` / `acr` claims from the backing session's\n * ~~auth_method~~ + ~~mfa_at~~ (plan 050). Pre-column sessions (null ~~auth_method~~)\n * yield no claims — authup cannot retroactively know how an old session\n * authenticated. M2M methods yield none either (amr/acr are user-flow\n * claims; those grants mint no id_token).\n /\nexport function deriveAmrAcr(\n session: Pick<Session, '~~auth_method~~' \| '~~mfa_at~~'> \| null,\n): Pick<OAuth2TokenPayload, 'amr' \| 'acr'> {\n if (!session \|\| !session.~~auth_method~~) {\n return {};\n }\n\n const amr : string[] = [];\n switch (session.~~auth_method~~) {\n case SessionAuthMethod.PASSWORD:\n case SessionAuthMethod.LDAP: {\n // LDAP is still a password factor for amr — the finer\n // distinction lives in the authup-local ~~auth_method~~.\n amr.push(OAuth2AuthenticationMethodReference.PASSWORD);\n break;\n }\n case SessionAuthMethod.EXTERNAL: {\n amr.push(OAuth2AuthenticationMethodReference.EXTERNAL);\n break;\n }\n default: {\n return {};\n }\n }\n\n if (session.~~mfa_at~~) {\n amr.push(OAuth2AuthenticationMethodReference.OTP);\n }\n\n return {\n amr,\n acr: session.~~mfa_at~~ ?\n OAuth2AuthenticationContextClass.MFA :\n OAuth2AuthenticationContextClass.PASSWORD,\n };\n}\n\nexport function generateOAuth2CodeVerifier() {\n const length = 64;\n const charset = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';\n\n let codeVerifier = '';\n const randomValues = new Uint8Array(length);\n crypto.getRandomValues(randomValues);\n\n for (let i = 0; i < length; i++) {\n codeVerifier += charset[randomValues[i] % charset.length];\n }\n\n return codeVerifier;\n}\n\nexport function base64URLEncode(arrayBuffer: ArrayBuffer) {\n // Convert the ArrayBuffer to string using Uint8 array.\n // btoa takes chars from 0-255 and base64 encodes.\n // Then convert the base64 encoded to base64url encoded.\n // (replace + with -, replace / with _, trim trailing =)\n const charCode = Array.from(new Uint8Array(arrayBuffer));\n\n return btoa(String.fromCharCode.apply(null, charCode))\n .replace(/\\+/g, '-')\n .replace(/\\//g, '_')\n .replace(/=+$/, '');\n}\n\n// OIDC Core §3.1.3.6: at_hash / c_hash use the hash algorithm of the id_token's\n// JWS alg (…S256 → SHA-256, …S384 → SHA-384, …S512 → SHA-512) and keep the LEFT\n// HALF of the digest — so the half-length follows the digest (16/24/32 bytes).\nconst TOKEN_HASH_DIGESTS : Record<string, { name: string, halfLength: number }> = {\n 256: { name: 'SHA-256', halfLength: 16 },\n 384: { name: 'SHA-384', halfLength: 24 },\n 512: { name: 'SHA-512', halfLength: 32 },\n};\n\nexport async function buildOAuth2TokenHash(\n value: string,\n alg?: `${JWTAlgorithm}` \| null,\n) : Promise<string> {\n // A key row without a persisted alg (nullable legacy column) signs with\n // the signer's 256 default (RS256/ES256/HS256) — derive the matching\n // SHA-256 digest. An unrecognized alg still fails loud — silently\n // defaulting there would mint a hash no conforming verifier accepts.\n const digest = alg ?\n TOKEN_HASH_DIGESTS[alg.slice(-3)] :\n TOKEN_HASH_DIGESTS['256'];\n if (!digest) {\n throw JWTError.headerPropertyInvalid('alg');\n }\n\n const encoder = new TextEncoder();\n const data = encoder.encode(value);\n const hashBuffer = await subtle.digest(digest.name, data);\n const halfHash = hashBuffer.slice(0, digest.halfLength);\n\n return base64URLEncode(halfHash);\n}\n\nexport async function buildOAuth2CodeChallenge(codeVerifier: string) {\n const encoder = new TextEncoder();\n const data = encoder.encode(codeVerifier);\n const arrayBuffer = await subtle.digest('SHA-256', data);\n\n return base64URLEncode(arrayBuffer);\n}\n"],"mappings":";;;;;;;;;;;;;GAwBA,SAAgBK,aACZC,~~SAAuD~~;~~CAEvD~~,IAAI,CAACA,WAAW,CAACA,QAAQC,~~aACrB~~,OAAO,CAAC;CAGZ,MAAMC,MAAiB,CAAA;CACvB,QAAQF,QAAQC,~~aAAhB~~;EACI,KAAKJ,kBAAkBM;EACvB,KAAKN,kBAAkBO;GAGnBF,IAAIG,KAAKT,oCAAoCO,QAAQ;GACrD;EAEJ,KAAKN,kBAAkBS;GACnBJ,IAAIG,KAAKT,oCAAoCU,QAAQ;GACrD;EAEJ,SACI,OAAO,CAAC;CAEhB;CAEA,IAAIN,QAAQO,~~QACRL~~,IAAIG,KAAKT,oCAAoCY,GAAG;CAGpD,OAAO;EACHN;EACAO,KAAKT,QAAQO,~~SACTZ~~,iCAAiCe,MACjCf,iCAAiCQ;CACzC;AACJ;AAEA,SAAgBQ,6BAAAA;CACZ,MAAMC,SAAS;CACf,MAAMC,UAAU;CAEhB,IAAIC,eAAe;CACnB,MAAMC,eAAe,IAAIC,WAAWJ,MAAAA;CACpCK,OAAOC,gBAAgBH,YAAAA;CAEvB,KAAK,IAAII,IAAI,GAAGA,IAAIP,QAAQO,KACxBL,gBAAgBD,QAAQE,aAAaI,KAAKN;CAG9C,OAAOC;AACX;AAEA,SAAgBM,gBAAgBC,aAAwB;CAKpD,MAAMC,WAAWC,MAAMC,KAAK,IAAIR,WAAWK,WAAAA,CAAAA;CAE3C,OAAOI,KAAKC,OAAOC,aAAaC,MAAM,MAAMN,QAAAA,CAAAA,CAAAA,CACvCO,QAAQ,OAAO,GAAA,CAAA,CACfA,QAAQ,OAAO,GAAA,CAAA,CACfA,QAAQ,OAAO,EAAA;AACxB;AAKA,MAAMC,qBAA4E;CAC9E,KAAK;EAAEC,MAAM;EAAWC,YAAY;CAAG;CACvC,KAAK;EAAED,MAAM;EAAWC,YAAY;CAAG;CACvC,KAAK;EAAED,MAAM;EAAWC,YAAY;CAAG;AAC3C;AAEA,eAAsBC,qBAClBC,OACAC,KAA8B;CAM9B,MAAMC,SAASD,MACXL,mBAAmBK,IAAIE,MAAM,EAAC,KAC9BP,mBAAmB;CACvB,IAAI,CAACM,QACD,MAAM1C,SAAS4C,sBAAsB,KAAA;CAIzC,MAAMG,OAAOF,IADOC,YACPD,CAAAA,CAAQG,OAAOR,KAAAA;CAI5B,OAAOd,iBAFUuB,MADQ7C,OAAOsC,OAAOA,OAAOL,MAAMU,IAAAA,EAAAA,CACxBJ,MAAM,GAAGD,OAAOJ,UAErBY,CAAAA;AAC3B;AAEA,eAAsBC,yBAAyB/B,cAAoB;CAE/D,MAAM2B,OAAOF,IADOC,YACPD,CAAAA,CAAQG,OAAO5B,YAAAA;CAG5B,OAAOM,gBAAgBC,MAFGvB,OAAOsC,OAAO,WAAWK,IAAAA,CAE5BpB;AAC3B"}
1	+ {"version":3,"file":"helpers.mjs","names":["JWTError","OAuth2AuthenticationContextClass","OAuth2AuthenticationMethodReference","SessionAuthMethod","subtle","deriveAmrAcr","session","authMethod","amr","PASSWORD","LDAP","push","EXTERNAL","mfaAt","OTP","acr","MFA","generateOAuth2CodeVerifier","length","charset","codeVerifier","randomValues","Uint8Array","crypto","getRandomValues","i","base64URLEncode","arrayBuffer","charCode","Array","from","btoa","String","fromCharCode","apply","replace","TOKEN_HASH_DIGESTS","name","halfLength","buildOAuth2TokenHash","value","alg","digest","slice","headerPropertyInvalid","encoder","TextEncoder","data","encode","hashBuffer","halfHash","buildOAuth2CodeChallenge"],"sources":["../../../../src/core/oauth2/authorization/helpers.ts"],"sourcesContent":["/\n Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { JWTAlgorithm, OAuth2TokenPayload } from '@authup/specs';\nimport {\n JWTError,\n OAuth2AuthenticationContextClass,\n OAuth2AuthenticationMethodReference,\n} from '@authup/specs';\nimport type { Session } from '@authup/core-kit';\nimport { SessionAuthMethod } from '@authup/core-kit';\nimport { subtle } from 'uncrypto';\n\n/\n Derive the OIDC `amr` / `acr` claims from the backing session's\n * authMethod + mfaAt (plan 050). Pre-column sessions (null authMethod)\n * yield no claims — authup cannot retroactively know how an old session\n * authenticated. M2M methods yield none either (amr/acr are user-flow\n * claims; those grants mint no id_token).\n /\nexport function deriveAmrAcr(\n session: Pick<Session, 'authMethod' \| 'mfaAt'> \| null,\n): Pick<OAuth2TokenPayload, 'amr' \| 'acr'> {\n if (!session \|\| !session.authMethod) {\n return {};\n }\n\n const amr : string[] = [];\n switch (session.authMethod) {\n case SessionAuthMethod.PASSWORD:\n case SessionAuthMethod.LDAP: {\n // LDAP is still a password factor for amr — the finer\n // distinction lives in the authup-local authMethod.\n amr.push(OAuth2AuthenticationMethodReference.PASSWORD);\n break;\n }\n case SessionAuthMethod.EXTERNAL: {\n amr.push(OAuth2AuthenticationMethodReference.EXTERNAL);\n break;\n }\n default: {\n return {};\n }\n }\n\n if (session.mfaAt) {\n amr.push(OAuth2AuthenticationMethodReference.OTP);\n }\n\n return {\n amr,\n acr: session.mfaAt ?\n OAuth2AuthenticationContextClass.MFA :\n OAuth2AuthenticationContextClass.PASSWORD,\n };\n}\n\nexport function generateOAuth2CodeVerifier() {\n const length = 64;\n const charset = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';\n\n let codeVerifier = '';\n const randomValues = new Uint8Array(length);\n crypto.getRandomValues(randomValues);\n\n for (let i = 0; i < length; i++) {\n codeVerifier += charset[randomValues[i] % charset.length];\n }\n\n return codeVerifier;\n}\n\nexport function base64URLEncode(arrayBuffer: ArrayBuffer) {\n // Convert the ArrayBuffer to string using Uint8 array.\n // btoa takes chars from 0-255 and base64 encodes.\n // Then convert the base64 encoded to base64url encoded.\n // (replace + with -, replace / with _, trim trailing =)\n const charCode = Array.from(new Uint8Array(arrayBuffer));\n\n return btoa(String.fromCharCode.apply(null, charCode))\n .replace(/\\+/g, '-')\n .replace(/\\//g, '_')\n .replace(/=+$/, '');\n}\n\n// OIDC Core §3.1.3.6: at_hash / c_hash use the hash algorithm of the id_token's\n// JWS alg (…S256 → SHA-256, …S384 → SHA-384, …S512 → SHA-512) and keep the LEFT\n// HALF of the digest — so the half-length follows the digest (16/24/32 bytes).\nconst TOKEN_HASH_DIGESTS : Record<string, { name: string, halfLength: number }> = {\n 256: { name: 'SHA-256', halfLength: 16 },\n 384: { name: 'SHA-384', halfLength: 24 },\n 512: { name: 'SHA-512', halfLength: 32 },\n};\n\nexport async function buildOAuth2TokenHash(\n value: string,\n alg?: `${JWTAlgorithm}` \| null,\n) : Promise<string> {\n // A key row without a persisted alg (nullable legacy column) signs with\n // the signer's 256 default (RS256/ES256/HS256) — derive the matching\n // SHA-256 digest. An unrecognized alg still fails loud — silently\n // defaulting there would mint a hash no conforming verifier accepts.\n const digest = alg ?\n TOKEN_HASH_DIGESTS[alg.slice(-3)] :\n TOKEN_HASH_DIGESTS['256'];\n if (!digest) {\n throw JWTError.headerPropertyInvalid('alg');\n }\n\n const encoder = new TextEncoder();\n const data = encoder.encode(value);\n const hashBuffer = await subtle.digest(digest.name, data);\n const halfHash = hashBuffer.slice(0, digest.halfLength);\n\n return base64URLEncode(halfHash);\n}\n\nexport async function buildOAuth2CodeChallenge(codeVerifier: string) {\n const encoder = new TextEncoder();\n const data = encoder.encode(codeVerifier);\n const arrayBuffer = await subtle.digest('SHA-256', data);\n\n return base64URLEncode(arrayBuffer);\n}\n"],"mappings":";;;;;;;;;;;;;GAwBA,SAAgBK,aACZC,SAAqD;CAErD,IAAI,CAACA,WAAW,CAACA,QAAQC,YACrB,OAAO,CAAC;CAGZ,MAAMC,MAAiB,CAAA;CACvB,QAAQF,QAAQC,YAAhB;EACI,KAAKJ,kBAAkBM;EACvB,KAAKN,kBAAkBO;GAGnBF,IAAIG,KAAKT,oCAAoCO,QAAQ;GACrD;EAEJ,KAAKN,kBAAkBS;GACnBJ,IAAIG,KAAKT,oCAAoCU,QAAQ;GACrD;EAEJ,SACI,OAAO,CAAC;CAEhB;CAEA,IAAIN,QAAQO,OACRL,IAAIG,KAAKT,oCAAoCY,GAAG;CAGpD,OAAO;EACHN;EACAO,KAAKT,QAAQO,QACTZ,iCAAiCe,MACjCf,iCAAiCQ;CACzC;AACJ;AAEA,SAAgBQ,6BAAAA;CACZ,MAAMC,SAAS;CACf,MAAMC,UAAU;CAEhB,IAAIC,eAAe;CACnB,MAAMC,eAAe,IAAIC,WAAWJ,MAAAA;CACpCK,OAAOC,gBAAgBH,YAAAA;CAEvB,KAAK,IAAII,IAAI,GAAGA,IAAIP,QAAQO,KACxBL,gBAAgBD,QAAQE,aAAaI,KAAKN;CAG9C,OAAOC;AACX;AAEA,SAAgBM,gBAAgBC,aAAwB;CAKpD,MAAMC,WAAWC,MAAMC,KAAK,IAAIR,WAAWK,WAAAA,CAAAA;CAE3C,OAAOI,KAAKC,OAAOC,aAAaC,MAAM,MAAMN,QAAAA,CAAAA,CAAAA,CACvCO,QAAQ,OAAO,GAAA,CAAA,CACfA,QAAQ,OAAO,GAAA,CAAA,CACfA,QAAQ,OAAO,EAAA;AACxB;AAKA,MAAMC,qBAA4E;CAC9E,KAAK;EAAEC,MAAM;EAAWC,YAAY;CAAG;CACvC,KAAK;EAAED,MAAM;EAAWC,YAAY;CAAG;CACvC,KAAK;EAAED,MAAM;EAAWC,YAAY;CAAG;AAC3C;AAEA,eAAsBC,qBAClBC,OACAC,KAA8B;CAM9B,MAAMC,SAASD,MACXL,mBAAmBK,IAAIE,MAAM,EAAC,KAC9BP,mBAAmB;CACvB,IAAI,CAACM,QACD,MAAM1C,SAAS4C,sBAAsB,KAAA;CAIzC,MAAMG,OAAOF,IADOC,YACPD,CAAAA,CAAQG,OAAOR,KAAAA;CAI5B,OAAOd,iBAFUuB,MADQ7C,OAAOsC,OAAOA,OAAOL,MAAMU,IAAAA,EAAAA,CACxBJ,MAAM,GAAGD,OAAOJ,UAErBY,CAAAA;AAC3B;AAEA,eAAsBC,yBAAyB/B,cAAoB;CAE/D,MAAM2B,OAAOF,IADOC,YACPD,CAAAA,CAAQG,OAAO5B,YAAAA;CAG5B,OAAOM,gBAAgBC,MAFGvB,OAAOsC,OAAO,WAAWK,IAAAA,CAE5BpB;AAC3B"}

package/dist/core/oauth2/authorization/module.mjs CHANGED Viewed

@@ -47,7 +47,7 @@ var OAuth2Authorization = class {
 				actorName: identity.data.name,
 				realmId: data.realm_id ?? null,
 				data: {
-					reason: options.client?.built_in ? "autoConsent" : "consent",
+					reason: options.client?.builtIn ? "autoConsent" : "consent",
 					...data.scope ? { scope: data.scope } : {}
 				}
 			});
@@ -85,21 +85,21 @@ var OAuth2Authorization = class {
 			...data.state ? { state: data.state } : {}
 		};
 		if (!identity) throw OAuth2RequestError.identityInvalid();
-		if (data.realm_id && identity.data.realm_id !== data.realm_id) throw OAuth2LoginRequiredError.realmMismatch();
+		if (data.realm_id && identity.data.realmId !== data.realm_id) throw OAuth2LoginRequiredError.realmMismatch();
 		const nowSeconds = Math.floor(Date.now() / 1e3);
 		let authTime = nowSeconds;
 		let session = null;
 		if (options.sessionId) {
 			session = await this.sessionManager.findOneById(options.sessionId);
-			if (session && session.created_at) authTime = Math.floor(new Date(session.created_at).getTime() / 1e3);
+			if (session && session.createdAt) authTime = Math.floor(new Date(session.createdAt).getTime() / 1e3);
 		}
 		if (this.mfaChallengeProvider && identity.type === IdentityType.USER) {
 			const challenge = await this.mfaChallengeProvider.challenge(identity.data.id, { issueMaterial: false });
-			if (challenge.required && !session?.mfa_at) throw OAuth2MfaRequiredError.challengeRequired();
+			if (challenge.required && !session?.mfaAt) throw OAuth2MfaRequiredError.challengeRequired();
 			if (challenge.enrollmentRequired) throw OAuth2MfaRequiredError.enrollmentRequired();
 			if (challenge.required && data.acr_values) {
 				if (data.acr_values.split(" ").includes(OAuth2AuthenticationContextClass.MFA)) {
-					const mfaAtSeconds = session?.mfa_at ? Math.floor(new Date(session.mfa_at).getTime() / 1e3) : null;
+					const mfaAtSeconds = session?.mfaAt ? Math.floor(new Date(session.mfaAt).getTime() / 1e3) : null;
 					if (mfaAtSeconds === null || nowSeconds - mfaAtSeconds > this.mfaFreshnessMaxAge) throw OAuth2MfaRequiredError.stepUpRequired();
 				}
 			}
@@ -109,10 +109,10 @@ var OAuth2Authorization = class {
 			const maxAge = Number(data.max_age);
 			if (Number.isFinite(maxAge) && nowSeconds - authTime > maxAge) throw OAuth2LoginRequiredError.reauthenticationRequired();
 		}
-		if (options.client?.access_policy_id) {
+		if (options.client?.accessPolicyId) {
 			let allowed = false;
 			const subject = toIdentityPolicyData(identity);
-			if (this.accessPolicyEvaluator && subject) allowed = await this.accessPolicyEvaluator.evaluate(options.client.access_policy_id, subject);
+			if (this.accessPolicyEvaluator && subject) allowed = await this.accessPolicyEvaluator.evaluate(options.client.accessPolicyId, subject);
 			if (!allowed) throw OAuth2AccessDeniedError.forClient(options.redirectUriVerified && data.redirect_uri ? {
 				redirectUri: data.redirect_uri,
 				state: data.state ?? null
@@ -121,7 +121,7 @@ var OAuth2Authorization = class {
 		output.authorizationCode = (await this.codeIssuer.issue(data, identity, {
 			sessionId: options.sessionId,
 			authTime,
-			authMethod: session?.auth_method ?? null
+			authMethod: session?.authMethod ?? null
 		})).id;
 		return output;
 	}

package/dist/core/oauth2/authorization/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["EventName","EventRefType","EventScope","IdentityType","hasInstanceof","OAUTH2_ACCESS_DENIED_ERROR_INSTANCE","OAUTH2_LOGIN_REQUIRED_ERROR_INSTANCE","OAUTH2_MFA_REQUIRED_ERROR_INSTANCE","OAuth2AccessDeniedError","OAuth2AuthenticationContextClass","OAuth2AuthorizationPrompt","OAuth2AuthorizationResponseType","OAuth2GrantError","OAuth2LoginRequiredError","OAuth2MfaRequiredError","OAuth2RequestError","OAuth2ResponseTypeError","toIdentityPolicyData","DEFAULT_PROMPT_LOGIN_MAX_AGE","DEFAULT_MFA_FRESHNESS_MAX_AGE","OAuth2Authorization","codeIssuer","sessionManager","eventService","metrics","promptLoginMaxAge","mfaFreshnessMaxAge","mfaChallengeProvider","accessPolicyEvaluator","ctx","authorize","data","identity","options","result","authorizeInner","record","scope","OAUTH2","name","AUTHORIZE","refType","CLIENT","refId","client","id","client_id","clientId","actorType","type","actorId","actorName","realmId","realm_id","reason","built_in","recordAuthorize","e","AUTHORIZE_FAILED","responseTypes","response_type","Array","isArray","split","responseType","CODE","unsupported","includes","redirect_uri","redirectUriMismatch","output","redirectUri","state","identityInvalid","realmMismatch","nowSeconds","Math","floor","Date","now","authTime","session","sessionId","findOneById","created_at","getTime","USER","challenge","issueMaterial","required","mfa_at","challengeRequired","enrollmentRequired","acr_values","acrValues","MFA","mfaAtSeconds","stepUpRequired","prompts","prompt","LOGIN","reauthenticationRequired","max_age","maxAge","Number","isFinite","access_policy_id","allowed","subject","evaluate","forClient","redirectUriVerified","undefined","codeEntity","issue","authMethod","auth_method","authorizationCode"],"sources":["../../../../src/core/oauth2/authorization/module.ts"],"sourcesContent":["/\n Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type {\n Identity, \n OAuth2AuthorizationCode, \n OAuth2AuthorizationCodeRequest, \n Session,\n} from '@authup/core-kit';\nimport {\n EventName, \n EventRefType, \n EventScope, \n IdentityType,\n} from '@authup/core-kit';\nimport { hasInstanceof } from '@authup/errors';\nimport {\n OAUTH2_ACCESS_DENIED_ERROR_INSTANCE,\n OAUTH2_LOGIN_REQUIRED_ERROR_INSTANCE,\n OAUTH2_MFA_REQUIRED_ERROR_INSTANCE,\n OAuth2AccessDeniedError,\n OAuth2AuthenticationContextClass,\n OAuth2AuthorizationPrompt,\n OAuth2AuthorizationResponseType,\n OAuth2GrantError,\n OAuth2LoginRequiredError,\n OAuth2MfaRequiredError,\n OAuth2RequestError,\n OAuth2ResponseTypeError,\n} from '@authup/specs';\nimport type { IOAuth2AuthorizationCodeIssuer } from './code/index.ts';\nimport type { IOAuth2AccessPolicyEvaluator } from '../access-policy/index.ts';\nimport { toIdentityPolicyData } from '../../identity/permission/identity-policy-data.ts';\nimport type {\n OAuth2AuthorizationManagerContext,\n OAuth2AuthorizationOptions,\n OAuth2AuthorizationResult,\n} from './types.ts';\nimport type { ISessionManager } from '../../authentication/index.ts';\nimport type { IEventService, IUserAuthenticatorChallengeProvider } from '../../entities/index.ts';\nimport type { IAuthFlowMetrics } from '../../metrics/index.ts';\n\nconst DEFAULT_PROMPT_LOGIN_MAX_AGE = 60;\n\n// Deliberately 60 (not 0, deviating from the plan-050 sketch): the hosted\n// challenge round-trip (stamp mfa_at → retry POST /authorize) takes seconds,\n// so a 0-window step-up could never be satisfied and would loop the ladder.\nconst DEFAULT_MFA_FRESHNESS_MAX_AGE = 60;\n\nexport class OAuth2Authorization {\n protected codeIssuer : IOAuth2AuthorizationCodeIssuer;\n\n protected sessionManager : ISessionManager;\n\n protected eventService? : IEventService;\n\n protected metrics? : IAuthFlowMetrics;\n\n protected promptLoginMaxAge : number;\n\n protected mfaFreshnessMaxAge : number;\n\n protected mfaChallengeProvider? : IUserAuthenticatorChallengeProvider;\n\n protected accessPolicyEvaluator? : IOAuth2AccessPolicyEvaluator;\n\n constructor(ctx: OAuth2AuthorizationManagerContext) {\n this.codeIssuer = ctx.codeIssuer;\n this.sessionManager = ctx.sessionManager;\n this.eventService = ctx.eventService;\n this.metrics = ctx.metrics;\n this.accessPolicyEvaluator = ctx.accessPolicyEvaluator;\n this.promptLoginMaxAge = ctx.promptLoginMaxAge ?? DEFAULT_PROMPT_LOGIN_MAX_AGE;\n this.mfaFreshnessMaxAge = ctx.mfaFreshnessMaxAge ?? DEFAULT_MFA_FRESHNESS_MAX_AGE;\n this.mfaChallengeProvider = ctx.mfaChallengeProvider;\n }\n\n /\n Authorize with validated codeRequest.\n \n @param data\n * @param identity\n * @param options\n */\n async authorize(\n data: OAuth2AuthorizationCodeRequest,\n identity: Identity,\n options: OAuth2AuthorizationOptions = {},\n ) : Promise<OAuth2AuthorizationResult> {\n try {\n const result = await this.authorizeInner(data, identity, options);\n\n await this.eventService?.record({\n scope: EventScope.OAUTH2,\n name: EventName.AUTHORIZE,\n refType: EventRefType.CLIENT,\n refId: options.client?.id ?? data.client_id ?? null,\n clientId: options.client?.id ?? data.client_id ?? null,\n actorType: identity.type,\n actorId: identity.data.id,\n actorName: identity.data.name,\n realmId: data.realm_id ?? null,\n data: {\n reason: options.client?.built_in ? 'autoConsent' : 'consent',\n ...(data.scope ? { scope: data.scope } : {}),\n },\n });\n this.metrics?.recordAuthorize('issued');\n\n return result;\n } catch (e) {\n if (hasInstanceof(e, OAUTH2_ACCESS_DENIED_ERROR_INSTANCE)) {\n await this.eventService?.record({\n scope: EventScope.OAUTH2,\n name: EventName.AUTHORIZE_FAILED,\n refType: EventRefType.CLIENT,\n refId: options.client?.id ?? data.client_id ?? null,\n clientId: options.client?.id ?? data.client_id ?? null,\n actorType: identity.type,\n actorId: identity.data.id,\n actorName: identity.data.name,\n realmId: data.realm_id ?? null,\n data: { reason: 'accessPolicy' },\n });\n this.metrics?.recordAuthorize('denied');\n } else if (hasInstanceof(e, OAUTH2_LOGIN_REQUIRED_ERROR_INSTANCE)) {\n this.metrics?.recordAuthorize('login_required');\n } else if (hasInstanceof(e, OAUTH2_MFA_REQUIRED_ERROR_INSTANCE)) {\n this.metrics?.recordAuthorize('mfa_required');\n } else {\n this.metrics?.recordAuthorize('error');\n }\n\n throw e;\n }\n }\n\n protected async authorizeInner(\n data: OAuth2AuthorizationCodeRequest,\n identity: Identity,\n options: OAuth2AuthorizationOptions = {},\n ) : Promise<OAuth2AuthorizationResult> {\n // OAuth 2.1 posture: only the authorization-code response type is\n // supported — implicit/hybrid (token, id_token, none) were dropped\n // (plan 042 item 3). Defense in depth behind the request validator.\n let responseTypes : string[] = [];\n if (data.response_type) {\n responseTypes = Array.isArray(data.response_type) ?\n data.response_type :\n data.response_type.split(' ');\n }\n\n for (const responseType of responseTypes) {\n if (responseType !== OAuth2AuthorizationResponseType.CODE) {\n throw OAuth2ResponseTypeError.unsupported();\n }\n }\n\n if (!responseTypes.includes(OAuth2AuthorizationResponseType.CODE)) {\n throw OAuth2ResponseTypeError.unsupported();\n }\n\n if (!data.redirect_uri) {\n throw OAuth2GrantError.redirectUriMismatch();\n }\n\n const output : OAuth2AuthorizationResult = {\n redirectUri: data.redirect_uri,\n ...(data.state ? { state: data.state } : {}),\n };\n\n if (!identity) {\n throw OAuth2RequestError.identityInvalid();\n }\n\n // Realm binding: the code-request verifier stamped data.realm_id with the\n // resolved client's realm. The authenticated identity must belong to that\n // same realm — otherwise a lingering session for realm A could silently\n // mint a code/token for realm B's client (confused deputy). The error body\n // deliberately carries no identity data (no realm-enumeration oracle).\n // The comparison reads the scalar realm_id column, NOT the realm\n // relation — the relation may simply not be loaded on the resolved\n // identity. An identity without a realm_id fails closed the same way —\n // clean login_required, never a TypeError.\n if (\n data.realm_id &&\n identity.data.realm_id !== data.realm_id\n ) {\n throw OAuth2LoginRequiredError.realmMismatch();\n }\n\n // Authentication time = the backing session's creation instant (NOT\n // refreshed_at — a token refresh must not reset it). Session-less flows\n // (e.g. HTTP Basic authorize) present live credentials on this request,\n // so the authentication time is \"now\".\n const nowSeconds = Math.floor(Date.now() / 1000);\n let authTime = nowSeconds;\n let session : Session \| null = null;\n if (options.sessionId) {\n session = await this.sessionManager.findOneById(options.sessionId);\n if (session && session.created_at) {\n authTime = Math.floor(new Date(session.created_at).getTime() / 1000);\n }\n }\n\n // MFA backstop (plan 049) — the authoritative server-side gate; the\n // hosted UI's challenge step is convenience. The proof is session-bound\n // (mfa_at — stamped by the challenge endpoint or the password grant's\n // otp param), so a session-less flow (HTTP Basic) cannot carry one and\n // fails closed while the user holds a confirmed device. A user without\n // a device under mfaRequired is routed to inline enrollment.\n if (this.mfaChallengeProvider && identity.type === IdentityType.USER) {\n // requirement flags only — the interactive challenge material (the\n // webauthn nonce) is issued by the status endpoint, not this backstop.\n const challenge = await this.mfaChallengeProvider.challenge(\n identity.data.id,\n { issueMaterial: false },\n );\n if (challenge.required && !session?.mfa_at) {\n throw OAuth2MfaRequiredError.challengeRequired();\n }\n\n if (challenge.enrollmentRequired) {\n throw OAuth2MfaRequiredError.enrollmentRequired();\n }\n\n // Step-up (plan 050 stage 3): a requested `acr_values` containing\n // urn:authup:mfa is a TRIGGER (Auth0/Keycloak stance) — the proof\n // must additionally be FRESH (mfaFreshnessMaxAge window, mirroring\n // promptLoginMaxAge's absorb-the-round-trip semantics). Enforced\n // only while the user actually holds a factor — per OIDC Core\n // §5.5.1.1 acr is voluntary, so an unsatisfiable request degrades\n // to the achieved acr instead of bricking the RP.\n if (challenge.required && data.acr_values) {\n const acrValues = data.acr_values.split(' ');\n if (acrValues.includes(OAuth2AuthenticationContextClass.MFA)) {\n const mfaAtSeconds = session?.mfa_at ?\n Math.floor(new Date(session.mfa_at).getTime() / 1000) :\n null;\n if (mfaAtSeconds === null \|\| nowSeconds - mfaAtSeconds > this.mfaFreshnessMaxAge) {\n throw OAuth2MfaRequiredError.stepUpRequired();\n }\n }\n }\n }\n\n // OIDC §3.1.2.1 prompt=login / max_age freshness (enforced only when\n // requested — a plain authorize never throws here). The hosted page\n // renders the login form for prompt=login; this is the server backstop.\n const prompts = data.prompt ? data.prompt.split(' ') : [];\n if (\n prompts.includes(OAuth2AuthorizationPrompt.LOGIN) &&\n nowSeconds - authTime > this.promptLoginMaxAge\n ) {\n throw OAuth2LoginRequiredError.reauthenticationRequired();\n }\n\n if (\n typeof data.max_age !== 'undefined' &&\n data.max_age !== null\n ) {\n const maxAge = Number(data.max_age);\n if (\n Number.isFinite(maxAge) &&\n nowSeconds - authTime > maxAge\n ) {\n throw OAuth2LoginRequiredError.reauthenticationRequired();\n }\n }\n\n // Application access policy (plan 052) — the last gate before\n // issuance: a denial is only revealed to a fully-authenticated\n // (incl. second-factor) identity. A client carrying a policy id with\n // no wired evaluator denies too (never silently allow a configured\n // gate). The redirect target rides the error only when the\n // redirect_uri was pattern-verified (RFC 6749 §4.1.2.1).\n if (options.client?.access_policy_id) {\n let allowed = false;\n\n const subject = toIdentityPolicyData(identity);\n if (this.accessPolicyEvaluator && subject) {\n allowed = await this.accessPolicyEvaluator.evaluate(\n options.client.access_policy_id,\n subject,\n );\n }\n\n if (!allowed) {\n throw OAuth2AccessDeniedError.forClient(\n options.redirectUriVerified && data.redirect_uri ?\n { redirectUri: data.redirect_uri, state: data.state ?? null } :\n undefined,\n );\n }\n }\n\n // The id_token is NOT minted here — the /token exchange mints it after\n // resolving the real backing session, so its `sid` is authoritative\n // (plan 042 item 6). The code carries the authentication instant.\n const codeEntity : OAuth2AuthorizationCode = await this.codeIssuer.issue(\n data,\n identity,\n {\n sessionId: options.sessionId,\n authTime,\n authMethod: session?.auth_method ?? null,\n },\n );\n\n output.authorizationCode = codeEntity.id;\n\n return output;\n }\n}\n"],"mappings":";;;;;;;;AA8CA,MAAMkB,+BAA+B;AAKrC,MAAMC,gCAAgC;AAEtC,IAAaC,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAwC;EAChD,KAAKR,aAAaQ,IAAIR;EACtB,KAAKC,iBAAiBO,IAAIP;EAC1B,KAAKC,eAAeM,IAAIN;EACxB,KAAKC,UAAUK,IAAIL;EACnB,KAAKI,wBAAwBC,IAAID;EACjC,KAAKH,oBAAoBI,IAAIJ,qBAAqBP;EAClD,KAAKQ,qBAAqBG,IAAIH,sBAAsBP;EACpD,KAAKQ,uBAAuBE,IAAIF;CACpC;;;;;;;IASA,MAAMG,UACFC,MACAC,UACAC,UAAsC,CAAC,GACJ;EACnC,IAAI;GACA,MAAMC,SAAS,MAAM,KAAKC,eAAeJ,MAAMC,UAAUC,OAAAA;GAEzD,MAAM,KAAKV,cAAca,OAAO;IAC5BC,OAAOnC,WAAWoC;IAClBC,MAAMvC,UAAUwC;IAChBC,SAASxC,aAAayC;IACtBC,OAAOV,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;IAC/CC,UAAUd,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;IAClDE,WAAWhB,SAASiB;IACpBC,SAASlB,SAASD,KAAKc;IACvBM,WAAWnB,SAASD,KAAKQ;IACzBa,SAASrB,KAAKsB,YAAY;IAC1BtB,MAAM;KACFuB,QAAQrB,QAAQW,QAAQW,WAAW,gBAAgB;KACnD,GAAIxB,KAAKM,QAAQ,EAAEA,OAAON,KAAKM,MAAM,IAAI,CAAC;IAC9C;GACJ,CAAA;GACA,KAAKb,SAASgC,gBAAgB,QAAA;GAE9B,OAAOtB;EACX,SAASuB,GAAG;GACR,IAAIrD,cAAcqD,GAAGpD,mCAAAA,GAAsC;IACvD,MAAM,KAAKkB,cAAca,OAAO;KAC5BC,OAAOnC,WAAWoC;KAClBC,MAAMvC,UAAU0D;KAChBjB,SAASxC,aAAayC;KACtBC,OAAOV,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;KAC/CC,UAAUd,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;KAClDE,WAAWhB,SAASiB;KACpBC,SAASlB,SAASD,KAAKc;KACvBM,WAAWnB,SAASD,KAAKQ;KACzBa,SAASrB,KAAKsB,YAAY;KAC1BtB,MAAM,EAAEuB,QAAQ,eAAe;IACnC,CAAA;IACA,KAAK9B,SAASgC,gBAAgB,QAAA;GAClC,OAAO,IAAIpD,cAAcqD,GAAGnD,oCAAAA,GACxB,KAAKkB,SAASgC,gBAAgB,gBAAA;QAC3B,IAAIpD,cAAcqD,GAAGlD,kCAAAA,GACxB,KAAKiB,SAASgC,gBAAgB,cAAA;QAE9B,KAAKhC,SAASgC,gBAAgB,OAAA;GAGlC,MAAMC;EACV;CACJ;CAEA,MAAgBtB,eACZJ,MACAC,UACAC,UAAsC,CAAC,GACJ;EAInC,IAAI0B,gBAA2B,CAAA;EAC/B,IAAI5B,KAAK6B,eACLD,gBAAgBE,MAAMC,QAAQ/B,KAAK6B,aAAa,IAC5C7B,KAAK6B,gBACL7B,KAAK6B,cAAcG,MAAM,GAAA;EAGjC,KAAK,MAAMC,gBAAgBL,eACvB,IAAIK,iBAAiBrD,gCAAgCsD,MACjD,MAAMjD,wBAAwBkD,YAAW;EAIjD,IAAI,CAACP,cAAcQ,SAASxD,gCAAgCsD,IAAI,GAC5D,MAAMjD,wBAAwBkD,YAAW;EAG7C,IAAI,CAACnC,KAAKqC,cACN,MAAMxD,iBAAiByD,oBAAmB;EAG9C,MAAMC,SAAqC;GACvCC,aAAaxC,KAAKqC;GAClB,GAAIrC,KAAKyC,QAAQ,EAAEA,OAAOzC,KAAKyC,MAAM,IAAI,CAAC;EAC9C;EAEA,IAAI,CAACxC,UACD,MAAMjB,mBAAmB0D,gBAAe;EAY5C,IACI1C,KAAKsB,YACLrB,SAASD,KAAKsB,aAAatB,KAAKsB,UAEhC,MAAMxC,yBAAyB6D,cAAa;EAOhD,MAAMC,aAAaC,KAAKC,MAAMC,KAAKC,IAAG,IAAK,GAAA;EAC3C,IAAIC,WAAWL;EACf,IAAIM,UAA2B;EAC/B,IAAIhD,QAAQiD,WAAW;GACnBD,UAAU,MAAM,KAAK3D,eAAe6D,YAAYlD,QAAQiD,SAAS;GACjE,IAAID,WAAWA,QAAQG,YACnBJ,WAAWJ,KAAKC,MAAM,IAAIC,KAAKG,QAAQG,UAAU,CAAA,CAAEC,QAAO,IAAK,GAAA;EAEvE;EAQA,IAAI,KAAK1D,wBAAwBK,SAASiB,SAAS9C,aAAamF,MAAM;GAGlE,MAAMC,YAAY,MAAM,KAAK5D,qBAAqB4D,UAC9CvD,SAASD,KAAKc,IACd,EAAE2C,eAAe,MAAM,CAAA;GAE3B,IAAID,UAAUE,YAAY,CAACR,SAASS,QAChC,MAAM5E,uBAAuB6E,kBAAiB;GAGlD,IAAIJ,UAAUK,oBACV,MAAM9E,uBAAuB8E,mBAAkB;GAUnD,IAAIL,UAAUE,YAAY1D,KAAK8D;QACT9D,KAAK8D,WAAW9B,MAAM,GACpC+B,CAAAA,CAAU3B,SAAS1D,iCAAiCsF,GAAG,GAAG;KAC1D,MAAMC,eAAef,SAASS,SAC1Bd,KAAKC,MAAM,IAAIC,KAAKG,QAAQS,MAAM,CAAA,CAAEL,QAAO,IAAK,GAAA,IAChD;KACJ,IAAIW,iBAAiB,QAAQrB,aAAaqB,eAAe,KAAKtE,oBAC1D,MAAMZ,uBAAuBmF,eAAc;IAEnD;;EAER;EAMA,KADgBlE,KAAKoE,SAASpE,KAAKoE,OAAOpC,MAAM,GAAA,IAAO,CAAA,EAAA,CAE3CI,SAASzD,0BAA0B0F,KAAK,KAChDzB,aAAaK,WAAW,KAAKvD,mBAE7B,MAAMZ,yBAAyBwF,yBAAwB;EAG3D,IACI,OAAOtE,KAAKuE,YAAY,eACxBvE,KAAKuE,YAAY,MACnB;GACE,MAAMC,SAASC,OAAOzE,KAAKuE,OAAO;GAClC,IACIE,OAAOC,SAASF,MAAAA,KAChB5B,aAAaK,WAAWuB,QAExB,MAAM1F,yBAAyBwF,yBAAwB;EAE/D;EAQA,IAAIpE,QAAQW,QAAQ8D,kBAAkB;GAClC,IAAIC,UAAU;GAEd,MAAMC,UAAU3F,qBAAqBe,QAAAA;GACrC,IAAI,KAAKJ,yBAAyBgF,SAC9BD,UAAU,MAAM,KAAK/E,sBAAsBiF,SACvC5E,QAAQW,OAAO8D,kBACfE,OAAAA;GAIR,IAAI,CAACD,SACD,MAAMnG,wBAAwBsG,UAC1B7E,QAAQ8E,uBAAuBhF,KAAKqC,eAChC;IAAEG,aAAaxC,KAAKqC;IAAcI,OAAOzC,KAAKyC,SAAS;GAAK,IAC5DwC,KAAAA,CAAAA;EAGhB;EAeA1C,OAAO+C,qBAAoBJ,MAVwB,KAAK5F,WAAW6F,MAC/DnF,MACAC,UACA;GACIkD,WAAWjD,QAAQiD;GACnBF;GACAmC,YAAYlC,SAASmC,eAAe;EACxC,CAAA,EAAA,CAGkCvE;EAEtC,OAAOyB;CACX;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["EventName","EventRefType","EventScope","IdentityType","hasInstanceof","OAUTH2_ACCESS_DENIED_ERROR_INSTANCE","OAUTH2_LOGIN_REQUIRED_ERROR_INSTANCE","OAUTH2_MFA_REQUIRED_ERROR_INSTANCE","OAuth2AccessDeniedError","OAuth2AuthenticationContextClass","OAuth2AuthorizationPrompt","OAuth2AuthorizationResponseType","OAuth2GrantError","OAuth2LoginRequiredError","OAuth2MfaRequiredError","OAuth2RequestError","OAuth2ResponseTypeError","toIdentityPolicyData","DEFAULT_PROMPT_LOGIN_MAX_AGE","DEFAULT_MFA_FRESHNESS_MAX_AGE","OAuth2Authorization","codeIssuer","sessionManager","eventService","metrics","promptLoginMaxAge","mfaFreshnessMaxAge","mfaChallengeProvider","accessPolicyEvaluator","ctx","authorize","data","identity","options","result","authorizeInner","record","scope","OAUTH2","name","AUTHORIZE","refType","CLIENT","refId","client","id","client_id","clientId","actorType","type","actorId","actorName","realmId","realm_id","reason","builtIn","recordAuthorize","e","AUTHORIZE_FAILED","responseTypes","response_type","Array","isArray","split","responseType","CODE","unsupported","includes","redirect_uri","redirectUriMismatch","output","redirectUri","state","identityInvalid","realmMismatch","nowSeconds","Math","floor","Date","now","authTime","session","sessionId","findOneById","createdAt","getTime","USER","challenge","issueMaterial","required","mfaAt","challengeRequired","enrollmentRequired","acr_values","acrValues","MFA","mfaAtSeconds","stepUpRequired","prompts","prompt","LOGIN","reauthenticationRequired","max_age","maxAge","Number","isFinite","accessPolicyId","allowed","subject","evaluate","forClient","redirectUriVerified","undefined","codeEntity","issue","authMethod","authorizationCode"],"sources":["../../../../src/core/oauth2/authorization/module.ts"],"sourcesContent":["/\n Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type {\n Identity, \n OAuth2AuthorizationCode, \n OAuth2AuthorizationCodeRequest, \n Session,\n} from '@authup/core-kit';\nimport {\n EventName, \n EventRefType, \n EventScope, \n IdentityType,\n} from '@authup/core-kit';\nimport { hasInstanceof } from '@authup/errors';\nimport {\n OAUTH2_ACCESS_DENIED_ERROR_INSTANCE,\n OAUTH2_LOGIN_REQUIRED_ERROR_INSTANCE,\n OAUTH2_MFA_REQUIRED_ERROR_INSTANCE,\n OAuth2AccessDeniedError,\n OAuth2AuthenticationContextClass,\n OAuth2AuthorizationPrompt,\n OAuth2AuthorizationResponseType,\n OAuth2GrantError,\n OAuth2LoginRequiredError,\n OAuth2MfaRequiredError,\n OAuth2RequestError,\n OAuth2ResponseTypeError,\n} from '@authup/specs';\nimport type { IOAuth2AuthorizationCodeIssuer } from './code/index.ts';\nimport type { IOAuth2AccessPolicyEvaluator } from '../access-policy/index.ts';\nimport { toIdentityPolicyData } from '../../identity/permission/identity-policy-data.ts';\nimport type {\n OAuth2AuthorizationManagerContext,\n OAuth2AuthorizationOptions,\n OAuth2AuthorizationResult,\n} from './types.ts';\nimport type { ISessionManager } from '../../authentication/index.ts';\nimport type { IEventService, IUserAuthenticatorChallengeProvider } from '../../entities/index.ts';\nimport type { IAuthFlowMetrics } from '../../metrics/index.ts';\n\nconst DEFAULT_PROMPT_LOGIN_MAX_AGE = 60;\n\n// Deliberately 60 (not 0, deviating from the plan-050 sketch): the hosted\n// challenge round-trip (stamp mfa_at → retry POST /authorize) takes seconds,\n// so a 0-window step-up could never be satisfied and would loop the ladder.\nconst DEFAULT_MFA_FRESHNESS_MAX_AGE = 60;\n\nexport class OAuth2Authorization {\n protected codeIssuer : IOAuth2AuthorizationCodeIssuer;\n\n protected sessionManager : ISessionManager;\n\n protected eventService? : IEventService;\n\n protected metrics? : IAuthFlowMetrics;\n\n protected promptLoginMaxAge : number;\n\n protected mfaFreshnessMaxAge : number;\n\n protected mfaChallengeProvider? : IUserAuthenticatorChallengeProvider;\n\n protected accessPolicyEvaluator? : IOAuth2AccessPolicyEvaluator;\n\n constructor(ctx: OAuth2AuthorizationManagerContext) {\n this.codeIssuer = ctx.codeIssuer;\n this.sessionManager = ctx.sessionManager;\n this.eventService = ctx.eventService;\n this.metrics = ctx.metrics;\n this.accessPolicyEvaluator = ctx.accessPolicyEvaluator;\n this.promptLoginMaxAge = ctx.promptLoginMaxAge ?? DEFAULT_PROMPT_LOGIN_MAX_AGE;\n this.mfaFreshnessMaxAge = ctx.mfaFreshnessMaxAge ?? DEFAULT_MFA_FRESHNESS_MAX_AGE;\n this.mfaChallengeProvider = ctx.mfaChallengeProvider;\n }\n\n /\n Authorize with validated codeRequest.\n \n @param data\n * @param identity\n * @param options\n */\n async authorize(\n data: OAuth2AuthorizationCodeRequest,\n identity: Identity,\n options: OAuth2AuthorizationOptions = {},\n ) : Promise<OAuth2AuthorizationResult> {\n try {\n const result = await this.authorizeInner(data, identity, options);\n\n await this.eventService?.record({\n scope: EventScope.OAUTH2,\n name: EventName.AUTHORIZE,\n refType: EventRefType.CLIENT,\n refId: options.client?.id ?? data.client_id ?? null,\n clientId: options.client?.id ?? data.client_id ?? null,\n actorType: identity.type,\n actorId: identity.data.id,\n actorName: identity.data.name,\n realmId: data.realm_id ?? null,\n data: {\n reason: options.client?.builtIn ? 'autoConsent' : 'consent',\n ...(data.scope ? { scope: data.scope } : {}),\n },\n });\n this.metrics?.recordAuthorize('issued');\n\n return result;\n } catch (e) {\n if (hasInstanceof(e, OAUTH2_ACCESS_DENIED_ERROR_INSTANCE)) {\n await this.eventService?.record({\n scope: EventScope.OAUTH2,\n name: EventName.AUTHORIZE_FAILED,\n refType: EventRefType.CLIENT,\n refId: options.client?.id ?? data.client_id ?? null,\n clientId: options.client?.id ?? data.client_id ?? null,\n actorType: identity.type,\n actorId: identity.data.id,\n actorName: identity.data.name,\n realmId: data.realm_id ?? null,\n data: { reason: 'accessPolicy' },\n });\n this.metrics?.recordAuthorize('denied');\n } else if (hasInstanceof(e, OAUTH2_LOGIN_REQUIRED_ERROR_INSTANCE)) {\n this.metrics?.recordAuthorize('login_required');\n } else if (hasInstanceof(e, OAUTH2_MFA_REQUIRED_ERROR_INSTANCE)) {\n this.metrics?.recordAuthorize('mfa_required');\n } else {\n this.metrics?.recordAuthorize('error');\n }\n\n throw e;\n }\n }\n\n protected async authorizeInner(\n data: OAuth2AuthorizationCodeRequest,\n identity: Identity,\n options: OAuth2AuthorizationOptions = {},\n ) : Promise<OAuth2AuthorizationResult> {\n // OAuth 2.1 posture: only the authorization-code response type is\n // supported — implicit/hybrid (token, id_token, none) were dropped\n // (plan 042 item 3). Defense in depth behind the request validator.\n let responseTypes : string[] = [];\n if (data.response_type) {\n responseTypes = Array.isArray(data.response_type) ?\n data.response_type :\n data.response_type.split(' ');\n }\n\n for (const responseType of responseTypes) {\n if (responseType !== OAuth2AuthorizationResponseType.CODE) {\n throw OAuth2ResponseTypeError.unsupported();\n }\n }\n\n if (!responseTypes.includes(OAuth2AuthorizationResponseType.CODE)) {\n throw OAuth2ResponseTypeError.unsupported();\n }\n\n if (!data.redirect_uri) {\n throw OAuth2GrantError.redirectUriMismatch();\n }\n\n const output : OAuth2AuthorizationResult = {\n redirectUri: data.redirect_uri,\n ...(data.state ? { state: data.state } : {}),\n };\n\n if (!identity) {\n throw OAuth2RequestError.identityInvalid();\n }\n\n // Realm binding: the code-request verifier stamped data.realm_id with the\n // resolved client's realm. The authenticated identity must belong to that\n // same realm — otherwise a lingering session for realm A could silently\n // mint a code/token for realm B's client (confused deputy). The error body\n // deliberately carries no identity data (no realm-enumeration oracle).\n // The comparison reads the scalar realmId column, NOT the realm\n // relation — the relation may simply not be loaded on the resolved\n // identity. An identity without a realmId fails closed the same way —\n // clean login_required, never a TypeError.\n if (\n data.realm_id &&\n identity.data.realmId !== data.realm_id\n ) {\n throw OAuth2LoginRequiredError.realmMismatch();\n }\n\n // Authentication time = the backing session's creation instant (NOT\n // refreshed_at — a token refresh must not reset it). Session-less flows\n // (e.g. HTTP Basic authorize) present live credentials on this request,\n // so the authentication time is \"now\".\n const nowSeconds = Math.floor(Date.now() / 1000);\n let authTime = nowSeconds;\n let session : Session \| null = null;\n if (options.sessionId) {\n session = await this.sessionManager.findOneById(options.sessionId);\n if (session && session.createdAt) {\n authTime = Math.floor(new Date(session.createdAt).getTime() / 1000);\n }\n }\n\n // MFA backstop (plan 049) — the authoritative server-side gate; the\n // hosted UI's challenge step is convenience. The proof is session-bound\n // (mfa_at — stamped by the challenge endpoint or the password grant's\n // otp param), so a session-less flow (HTTP Basic) cannot carry one and\n // fails closed while the user holds a confirmed device. A user without\n // a device under mfaRequired is routed to inline enrollment.\n if (this.mfaChallengeProvider && identity.type === IdentityType.USER) {\n // requirement flags only — the interactive challenge material (the\n // webauthn nonce) is issued by the status endpoint, not this backstop.\n const challenge = await this.mfaChallengeProvider.challenge(\n identity.data.id,\n { issueMaterial: false },\n );\n if (challenge.required && !session?.mfaAt) {\n throw OAuth2MfaRequiredError.challengeRequired();\n }\n\n if (challenge.enrollmentRequired) {\n throw OAuth2MfaRequiredError.enrollmentRequired();\n }\n\n // Step-up (plan 050 stage 3): a requested `acr_values` containing\n // urn:authup:mfa is a TRIGGER (Auth0/Keycloak stance) — the proof\n // must additionally be FRESH (mfaFreshnessMaxAge window, mirroring\n // promptLoginMaxAge's absorb-the-round-trip semantics). Enforced\n // only while the user actually holds a factor — per OIDC Core\n // §5.5.1.1 acr is voluntary, so an unsatisfiable request degrades\n // to the achieved acr instead of bricking the RP.\n if (challenge.required && data.acr_values) {\n const acrValues = data.acr_values.split(' ');\n if (acrValues.includes(OAuth2AuthenticationContextClass.MFA)) {\n const mfaAtSeconds = session?.mfaAt ?\n Math.floor(new Date(session.mfaAt).getTime() / 1000) :\n null;\n if (mfaAtSeconds === null \|\| nowSeconds - mfaAtSeconds > this.mfaFreshnessMaxAge) {\n throw OAuth2MfaRequiredError.stepUpRequired();\n }\n }\n }\n }\n\n // OIDC §3.1.2.1 prompt=login / max_age freshness (enforced only when\n // requested — a plain authorize never throws here). The hosted page\n // renders the login form for prompt=login; this is the server backstop.\n const prompts = data.prompt ? data.prompt.split(' ') : [];\n if (\n prompts.includes(OAuth2AuthorizationPrompt.LOGIN) &&\n nowSeconds - authTime > this.promptLoginMaxAge\n ) {\n throw OAuth2LoginRequiredError.reauthenticationRequired();\n }\n\n if (\n typeof data.max_age !== 'undefined' &&\n data.max_age !== null\n ) {\n const maxAge = Number(data.max_age);\n if (\n Number.isFinite(maxAge) &&\n nowSeconds - authTime > maxAge\n ) {\n throw OAuth2LoginRequiredError.reauthenticationRequired();\n }\n }\n\n // Application access policy (plan 052) — the last gate before\n // issuance: a denial is only revealed to a fully-authenticated\n // (incl. second-factor) identity. A client carrying a policy id with\n // no wired evaluator denies too (never silently allow a configured\n // gate). The redirect target rides the error only when the\n // redirect_uri was pattern-verified (RFC 6749 §4.1.2.1).\n if (options.client?.accessPolicyId) {\n let allowed = false;\n\n const subject = toIdentityPolicyData(identity);\n if (this.accessPolicyEvaluator && subject) {\n allowed = await this.accessPolicyEvaluator.evaluate(\n options.client.accessPolicyId,\n subject,\n );\n }\n\n if (!allowed) {\n throw OAuth2AccessDeniedError.forClient(\n options.redirectUriVerified && data.redirect_uri ?\n { redirectUri: data.redirect_uri, state: data.state ?? null } :\n undefined,\n );\n }\n }\n\n // The id_token is NOT minted here — the /token exchange mints it after\n // resolving the real backing session, so its `sid` is authoritative\n // (plan 042 item 6). The code carries the authentication instant.\n const codeEntity : OAuth2AuthorizationCode = await this.codeIssuer.issue(\n data,\n identity,\n {\n sessionId: options.sessionId,\n authTime,\n authMethod: session?.authMethod ?? null,\n },\n );\n\n output.authorizationCode = codeEntity.id;\n\n return output;\n }\n}\n"],"mappings":";;;;;;;;AA8CA,MAAMkB,+BAA+B;AAKrC,MAAMC,gCAAgC;AAEtC,IAAaC,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAwC;EAChD,KAAKR,aAAaQ,IAAIR;EACtB,KAAKC,iBAAiBO,IAAIP;EAC1B,KAAKC,eAAeM,IAAIN;EACxB,KAAKC,UAAUK,IAAIL;EACnB,KAAKI,wBAAwBC,IAAID;EACjC,KAAKH,oBAAoBI,IAAIJ,qBAAqBP;EAClD,KAAKQ,qBAAqBG,IAAIH,sBAAsBP;EACpD,KAAKQ,uBAAuBE,IAAIF;CACpC;;;;;;;IASA,MAAMG,UACFC,MACAC,UACAC,UAAsC,CAAC,GACJ;EACnC,IAAI;GACA,MAAMC,SAAS,MAAM,KAAKC,eAAeJ,MAAMC,UAAUC,OAAAA;GAEzD,MAAM,KAAKV,cAAca,OAAO;IAC5BC,OAAOnC,WAAWoC;IAClBC,MAAMvC,UAAUwC;IAChBC,SAASxC,aAAayC;IACtBC,OAAOV,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;IAC/CC,UAAUd,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;IAClDE,WAAWhB,SAASiB;IACpBC,SAASlB,SAASD,KAAKc;IACvBM,WAAWnB,SAASD,KAAKQ;IACzBa,SAASrB,KAAKsB,YAAY;IAC1BtB,MAAM;KACFuB,QAAQrB,QAAQW,QAAQW,UAAU,gBAAgB;KAClD,GAAIxB,KAAKM,QAAQ,EAAEA,OAAON,KAAKM,MAAM,IAAI,CAAC;IAC9C;GACJ,CAAA;GACA,KAAKb,SAASgC,gBAAgB,QAAA;GAE9B,OAAOtB;EACX,SAASuB,GAAG;GACR,IAAIrD,cAAcqD,GAAGpD,mCAAAA,GAAsC;IACvD,MAAM,KAAKkB,cAAca,OAAO;KAC5BC,OAAOnC,WAAWoC;KAClBC,MAAMvC,UAAU0D;KAChBjB,SAASxC,aAAayC;KACtBC,OAAOV,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;KAC/CC,UAAUd,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;KAClDE,WAAWhB,SAASiB;KACpBC,SAASlB,SAASD,KAAKc;KACvBM,WAAWnB,SAASD,KAAKQ;KACzBa,SAASrB,KAAKsB,YAAY;KAC1BtB,MAAM,EAAEuB,QAAQ,eAAe;IACnC,CAAA;IACA,KAAK9B,SAASgC,gBAAgB,QAAA;GAClC,OAAO,IAAIpD,cAAcqD,GAAGnD,oCAAAA,GACxB,KAAKkB,SAASgC,gBAAgB,gBAAA;QAC3B,IAAIpD,cAAcqD,GAAGlD,kCAAAA,GACxB,KAAKiB,SAASgC,gBAAgB,cAAA;QAE9B,KAAKhC,SAASgC,gBAAgB,OAAA;GAGlC,MAAMC;EACV;CACJ;CAEA,MAAgBtB,eACZJ,MACAC,UACAC,UAAsC,CAAC,GACJ;EAInC,IAAI0B,gBAA2B,CAAA;EAC/B,IAAI5B,KAAK6B,eACLD,gBAAgBE,MAAMC,QAAQ/B,KAAK6B,aAAa,IAC5C7B,KAAK6B,gBACL7B,KAAK6B,cAAcG,MAAM,GAAA;EAGjC,KAAK,MAAMC,gBAAgBL,eACvB,IAAIK,iBAAiBrD,gCAAgCsD,MACjD,MAAMjD,wBAAwBkD,YAAW;EAIjD,IAAI,CAACP,cAAcQ,SAASxD,gCAAgCsD,IAAI,GAC5D,MAAMjD,wBAAwBkD,YAAW;EAG7C,IAAI,CAACnC,KAAKqC,cACN,MAAMxD,iBAAiByD,oBAAmB;EAG9C,MAAMC,SAAqC;GACvCC,aAAaxC,KAAKqC;GAClB,GAAIrC,KAAKyC,QAAQ,EAAEA,OAAOzC,KAAKyC,MAAM,IAAI,CAAC;EAC9C;EAEA,IAAI,CAACxC,UACD,MAAMjB,mBAAmB0D,gBAAe;EAY5C,IACI1C,KAAKsB,YACLrB,SAASD,KAAKqB,YAAYrB,KAAKsB,UAE/B,MAAMxC,yBAAyB6D,cAAa;EAOhD,MAAMC,aAAaC,KAAKC,MAAMC,KAAKC,IAAG,IAAK,GAAA;EAC3C,IAAIC,WAAWL;EACf,IAAIM,UAA2B;EAC/B,IAAIhD,QAAQiD,WAAW;GACnBD,UAAU,MAAM,KAAK3D,eAAe6D,YAAYlD,QAAQiD,SAAS;GACjE,IAAID,WAAWA,QAAQG,WACnBJ,WAAWJ,KAAKC,MAAM,IAAIC,KAAKG,QAAQG,SAAS,CAAA,CAAEC,QAAO,IAAK,GAAA;EAEtE;EAQA,IAAI,KAAK1D,wBAAwBK,SAASiB,SAAS9C,aAAamF,MAAM;GAGlE,MAAMC,YAAY,MAAM,KAAK5D,qBAAqB4D,UAC9CvD,SAASD,KAAKc,IACd,EAAE2C,eAAe,MAAM,CAAA;GAE3B,IAAID,UAAUE,YAAY,CAACR,SAASS,OAChC,MAAM5E,uBAAuB6E,kBAAiB;GAGlD,IAAIJ,UAAUK,oBACV,MAAM9E,uBAAuB8E,mBAAkB;GAUnD,IAAIL,UAAUE,YAAY1D,KAAK8D;QACT9D,KAAK8D,WAAW9B,MAAM,GACpC+B,CAAAA,CAAU3B,SAAS1D,iCAAiCsF,GAAG,GAAG;KAC1D,MAAMC,eAAef,SAASS,QAC1Bd,KAAKC,MAAM,IAAIC,KAAKG,QAAQS,KAAK,CAAA,CAAEL,QAAO,IAAK,GAAA,IAC/C;KACJ,IAAIW,iBAAiB,QAAQrB,aAAaqB,eAAe,KAAKtE,oBAC1D,MAAMZ,uBAAuBmF,eAAc;IAEnD;;EAER;EAMA,KADgBlE,KAAKoE,SAASpE,KAAKoE,OAAOpC,MAAM,GAAA,IAAO,CAAA,EAAA,CAE3CI,SAASzD,0BAA0B0F,KAAK,KAChDzB,aAAaK,WAAW,KAAKvD,mBAE7B,MAAMZ,yBAAyBwF,yBAAwB;EAG3D,IACI,OAAOtE,KAAKuE,YAAY,eACxBvE,KAAKuE,YAAY,MACnB;GACE,MAAMC,SAASC,OAAOzE,KAAKuE,OAAO;GAClC,IACIE,OAAOC,SAASF,MAAAA,KAChB5B,aAAaK,WAAWuB,QAExB,MAAM1F,yBAAyBwF,yBAAwB;EAE/D;EAQA,IAAIpE,QAAQW,QAAQ8D,gBAAgB;GAChC,IAAIC,UAAU;GAEd,MAAMC,UAAU3F,qBAAqBe,QAAAA;GACrC,IAAI,KAAKJ,yBAAyBgF,SAC9BD,UAAU,MAAM,KAAK/E,sBAAsBiF,SACvC5E,QAAQW,OAAO8D,gBACfE,OAAAA;GAIR,IAAI,CAACD,SACD,MAAMnG,wBAAwBsG,UAC1B7E,QAAQ8E,uBAAuBhF,KAAKqC,eAChC;IAAEG,aAAaxC,KAAKqC;IAAcI,OAAOzC,KAAKyC,SAAS;GAAK,IAC5DwC,KAAAA,CAAAA;EAGhB;EAeA1C,OAAO8C,qBAAoBH,MAVwB,KAAK5F,WAAW6F,MAC/DnF,MACAC,UACA;GACIkD,WAAWjD,QAAQiD;GACnBF;GACAmC,YAAYlC,SAASkC,cAAc;EACvC,CAAA,EAAA,CAGkCtE;EAEtC,OAAOyB;CACX;AACJ"}

package/dist/core/oauth2/client/authenticator.d.ts CHANGED Viewed

@@ -20,7 +20,7 @@ export declare class OAuth2ClientAuthenticator {
     constructor(ctx: IIdentityResolver | OAuth2ClientAuthenticatorContext);
     authenticate(clientId: string | undefined, clientSecret?: string, realmId?: string, certificateEvidence?: ClientCertificateEvidence): Promise<Client>;
     resolve(clientId: string, realmId?: string): Promise<Client>;
-    resolveTokenBinding(client: Pick<Client, 'token_binding_method'>, certificateEvidence?: ClientCertificateEvidence): OAuth2TokenConfirmation | undefined;
+    resolveTokenBinding(client: Pick<Client, 'tokenBindingMethod'>, certificateEvidence?: ClientCertificateEvidence): OAuth2TokenConfirmation | undefined;
     validateCertificateEvidenceForBinding(certificateEvidence?: ClientCertificateEvidence): OAuth2TokenConfirmation;
 }
 //# sourceMappingURL=authenticator.d.ts.map

package/dist/core/oauth2/client/authenticator.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"authenticator.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/client/authenticator.ts"],"names":[],"mappings":"AAOA,OAAO,EACH,KAAK,MAAM,EAId,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAG7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,KAAK,EACR,yBAAyB,EACzB,2BAA2B,EAC9B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,MAAM,MAAM,gCAAgC,GAAG;IAC3C,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,oBAAoB,EAAE,2BAA2B,CAAC;CACrD,CAAC;AAEF;;;;;GAKG;AACH,qBAAa,yBAAyB;IAClC,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IAEvD,SAAS,CAAC,oBAAoB,CAAC,EAAE,2BAA2B,CAAC;gBAEjD,GAAG,EAAE,iBAAiB,GAAG,gCAAgC;IAY/D,YAAY,CACd,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,YAAY,CAAC,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE,MAAM,EAChB,mBAAmB,CAAC,EAAE,yBAAyB,GAChD,OAAO,CAAC,MAAM,CAAC;IAsDZ,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAalE,mBAAmB,CACf,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,~~sBAAsB~~,CAAC,~~EAC5C~~,mBAAmB,CAAC,EAAE,yBAAyB,GAChD,uBAAuB,GAAG,SAAS;IAYtC,qCAAqC,CACjC,mBAAmB,CAAC,EAAE,yBAAyB,GAChD,uBAAuB;CAa7B"}
1	+ {"version":3,"file":"authenticator.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/client/authenticator.ts"],"names":[],"mappings":"AAOA,OAAO,EACH,KAAK,MAAM,EAId,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAG7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,KAAK,EACR,yBAAyB,EACzB,2BAA2B,EAC9B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,MAAM,MAAM,gCAAgC,GAAG;IAC3C,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,oBAAoB,EAAE,2BAA2B,CAAC;CACrD,CAAC;AAEF;;;;;GAKG;AACH,qBAAa,yBAAyB;IAClC,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IAEvD,SAAS,CAAC,oBAAoB,CAAC,EAAE,2BAA2B,CAAC;gBAEjD,GAAG,EAAE,iBAAiB,GAAG,gCAAgC;IAY/D,YAAY,CACd,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,YAAY,CAAC,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE,MAAM,EAChB,mBAAmB,CAAC,EAAE,yBAAyB,GAChD,OAAO,CAAC,MAAM,CAAC;IAsDZ,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAalE,mBAAmB,CACf,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,oBAAoB,CAAC,EAC1C,mBAAmB,CAAC,EAAE,yBAAyB,GAChD,uBAAuB,GAAG,SAAS;IAYtC,qCAAqC,CACjC,mBAAmB,CAAC,EAAE,yBAAyB,GAChD,uBAAuB;CAa7B"}

package/dist/core/oauth2/client/authenticator.mjs CHANGED Viewed

@@ -26,7 +26,7 @@ import { OAuth2ClientError } from "@authup/specs";
 	async authenticate(clientId, clientSecret, realmId, certificateEvidence) {
 		if (!clientId) throw OAuth2ClientError.invalid();
 		const client = await this.resolve(clientId, realmId);
-		switch (client.auth_method) {
+		switch (client.authMethod) {
 			case ClientAuthMethod.NONE:
 				if (typeof clientSecret === "string") throw OAuth2ClientError.invalid();
 				break;
@@ -54,8 +54,8 @@ import { OAuth2ClientError } from "@authup/specs";
 		return identity.data;
 	}
 	resolveTokenBinding(client, certificateEvidence) {
-		if (client.token_binding_method === ClientTokenBindingMethod.NONE) return;
-		if (client.token_binding_method !== ClientTokenBindingMethod.TLS) throw OAuth2ClientError.invalid();
+		if (client.tokenBindingMethod === ClientTokenBindingMethod.NONE) return;
+		if (client.tokenBindingMethod !== ClientTokenBindingMethod.TLS) throw OAuth2ClientError.invalid();
 		return this.validateCertificateEvidenceForBinding(certificateEvidence);
 	}
 	validateCertificateEvidenceForBinding(certificateEvidence) {

package/dist/core/oauth2/client/authenticator.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"authenticator.mjs","names":["ClientAuthMethod","ClientTokenBindingMethod","IdentityType","OAuth2ClientError","isValidationError","ClientCredentialsService","OAuth2ClientAuthenticator","identityResolver","credentialsService","certificateValidator","ctx","authenticate","clientId","clientSecret","realmId","certificateEvidence","invalid","client","resolve","~~auth_method~~","NONE","SECRET","verified","verify","TLS","validateForAuthentication","e","identity","CLIENT","type","data","active","inactive","resolveTokenBinding","~~token_binding_method~~","undefined","validateCertificateEvidenceForBinding","validateForBinding","thumbprint"],"sources":["../../../../src/core/oauth2/client/authenticator.ts"],"sourcesContent":["/\n Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport {\n type Client,\n ClientAuthMethod,\n ClientTokenBindingMethod,\n IdentityType,\n} from '@authup/core-kit';\nimport type { OAuth2TokenConfirmation } from '@authup/specs';\nimport { OAuth2ClientError } from '@authup/specs';\nimport { isValidationError } from '@authup/errors';\nimport { ClientCredentialsService } from '../../authentication/credential/index.ts';\nimport type {\n ClientCertificateEvidence,\n IClientCertificateValidator,\n} from '../../client-certificate/index.ts';\nimport type { IIdentityResolver } from '../../identity/index.ts';\n\nexport type OAuth2ClientAuthenticatorContext = {\n identityResolver: IIdentityResolver,\n certificateValidator: IClientCertificateValidator,\n};\n\n/\n Authenticates a client at the OAuth2 token endpoint according to its\n * exclusive method: public id only, shared secret, or trusted TLS evidence.\n \n Used by every standard client-resolving grant.\n */\nexport class OAuth2ClientAuthenticator {\n protected identityResolver: IIdentityResolver;\n\n protected credentialsService: ClientCredentialsService;\n\n protected certificateValidator?: IClientCertificateValidator;\n\n constructor(ctx: IIdentityResolver \| OAuth2ClientAuthenticatorContext) {\n if ('identityResolver' in ctx) {\n this.identityResolver = ctx.identityResolver;\n this.certificateValidator = ctx.certificateValidator;\n } else {\n // Kept as a compatibility seam for focused secret/public-client\n // unit tests. Production wiring always supplies the validator.\n this.identityResolver = ctx;\n }\n this.credentialsService = new ClientCredentialsService();\n }\n\n async authenticate(\n clientId: string \| undefined,\n clientSecret?: string,\n realmId?: string,\n certificateEvidence?: ClientCertificateEvidence,\n ): Promise<Client> {\n if (!clientId) {\n throw OAuth2ClientError.invalid();\n }\n\n const client = await this.resolve(clientId, realmId);\n\n switch (client.~~auth_method~~) {\n case ClientAuthMethod.NONE:\n if (typeof clientSecret === 'string') {\n throw OAuth2ClientError.invalid();\n }\n break;\n case ClientAuthMethod.SECRET: {\n if (!clientSecret) {\n throw OAuth2ClientError.invalid();\n }\n\n const verified = await this.credentialsService.verify(clientSecret, client);\n if (!verified) {\n throw OAuth2ClientError.invalid();\n }\n break;\n }\n case ClientAuthMethod.TLS:\n if (\n typeof clientSecret === 'string' \|\|\n !certificateEvidence \|\|\n !this.certificateValidator\n ) {\n throw OAuth2ClientError.invalid();\n }\n\n try {\n await this.certificateValidator.validateForAuthentication(client, certificateEvidence);\n } catch (e) {\n // A validation failure deliberately reveals neither the\n // certificate identity nor which realm anchor failed. An\n // infrastructure fault (e.g. the trust-anchor store being\n // unreachable) must NOT masquerade as a bad certificate —\n // let it surface as a server error instead.\n if (isValidationError(e)) {\n throw OAuth2ClientError.invalid();\n }\n throw e;\n }\n break;\n default:\n throw OAuth2ClientError.invalid();\n }\n\n return client;\n }\n\n async resolve(clientId: string, realmId?: string): Promise<Client> {\n const identity = await this.identityResolver.resolve(IdentityType.CLIENT, clientId, realmId);\n if (!identity \|\| identity.type !== IdentityType.CLIENT) {\n throw OAuth2ClientError.invalid();\n }\n\n if (!identity.data.active) {\n throw OAuth2ClientError.inactive();\n }\n\n return identity.data;\n }\n\n resolveTokenBinding(\n client: Pick<Client, '~~token_binding_method~~'>,\n certificateEvidence?: ClientCertificateEvidence,\n ): OAuth2TokenConfirmation \| undefined {\n if (client.~~token_binding_method~~ === ClientTokenBindingMethod.NONE) {\n return undefined;\n }\n\n if (client.~~token_binding_method~~ !== ClientTokenBindingMethod.TLS) {\n throw OAuth2ClientError.invalid();\n }\n\n return this.validateCertificateEvidenceForBinding(certificateEvidence);\n }\n\n validateCertificateEvidenceForBinding(\n certificateEvidence?: ClientCertificateEvidence,\n ): OAuth2TokenConfirmation {\n if (!certificateEvidence \|\| !this.certificateValidator) {\n throw OAuth2ClientError.invalid();\n }\n\n try {\n this.certificateValidator.validateForBinding(certificateEvidence);\n } catch {\n throw OAuth2ClientError.invalid();\n }\n\n return { 'x5t#S256': certificateEvidence.thumbprint };\n }\n}\n"],"mappings":";;;;;;;;;;;;;;GAkCA,IAAaM,4BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA2D;EACnE,IAAI,sBAAsBA,KAAK;GAC3B,KAAKH,mBAAmBG,IAAIH;GAC5B,KAAKE,uBAAuBC,IAAID;EACpC,OAGI,KAAKF,mBAAmBG;EAE5B,KAAKF,qBAAqB,IAAIH,yBAAAA;CAClC;CAEA,MAAMM,aACFC,UACAC,cACAC,SACAC,qBACe;EACf,IAAI,CAACH,UACD,MAAMT,kBAAkBa,QAAO;EAGnC,MAAMC,SAAS,MAAM,KAAKC,QAAQN,UAAUE,OAAAA;EAE5C,QAAQG,OAAOE,~~aAAf~~;GACI,KAAKnB,iBAAiBoB;IAClB,IAAI,OAAOP,iBAAiB,UACxB,MAAMV,kBAAkBa,QAAO;IAEnC;GACJ,KAAKhB,iBAAiBqB;IAClB,IAAI,CAACR,cACD,MAAMV,kBAAkBa,QAAO;IAInC,IAAI,CAACM,MADkB,KAAKd,mBAAmBe,OAAOV,cAAcI,MAAAA,GAEhE,MAAMd,kBAAkBa,QAAO;IAEnC;GAEJ,KAAKhB,iBAAiBwB;IAClB,IACI,OAAOX,iBAAiB,YACxB,CAACE,uBACD,CAAC,KAAKN,sBAEN,MAAMN,kBAAkBa,QAAO;IAGnC,IAAI;KACA,MAAM,KAAKP,qBAAqBgB,0BAA0BR,QAAQF,mBAAAA;IACtE,SAASW,GAAG;KAMR,IAAItB,kBAAkBsB,CAAAA,GAClB,MAAMvB,kBAAkBa,QAAO;KAEnC,MAAMU;IACV;IACA;GACJ,SACI,MAAMvB,kBAAkBa,QAAO;EACvC;EAEA,OAAOC;CACX;CAEA,MAAMC,QAAQN,UAAkBE,SAAmC;EAC/D,MAAMa,WAAW,MAAM,KAAKpB,iBAAiBW,QAAQhB,aAAa0B,QAAQhB,UAAUE,OAAAA;EACpF,IAAI,CAACa,YAAYA,SAASE,SAAS3B,aAAa0B,QAC5C,MAAMzB,kBAAkBa,QAAO;EAGnC,IAAI,CAACW,SAASG,KAAKC,QACf,MAAM5B,kBAAkB6B,SAAQ;EAGpC,OAAOL,SAASG;CACpB;CAEAG,oBACIhB,QACAF,qBACmC;EACnC,IAAIE,OAAOiB,~~yBAAyBjC~~,yBAAyBmB,~~MACzD~~;EAGJ,IAAIH,OAAOiB,~~yBAAyBjC~~,yBAAyBuB,~~KACzD~~,MAAMrB,kBAAkBa,QAAO;EAGnC,OAAO,KAAKoB,sCAAsCrB,mBAAAA;CACtD;CAEAqB,sCACIrB,qBACuB;EACvB,IAAI,CAACA,uBAAuB,CAAC,KAAKN,sBAC9B,MAAMN,kBAAkBa,QAAO;EAGnC,IAAI;GACA,KAAKP,qBAAqB4B,mBAAmBtB,mBAAAA;EACjD,QAAQ;GACJ,MAAMZ,kBAAkBa,QAAO;EACnC;EAEA,OAAO,EAAE,YAAYD,oBAAoBuB,WAAW;CACxD;AACJ"}
1	+ {"version":3,"file":"authenticator.mjs","names":["ClientAuthMethod","ClientTokenBindingMethod","IdentityType","OAuth2ClientError","isValidationError","ClientCredentialsService","OAuth2ClientAuthenticator","identityResolver","credentialsService","certificateValidator","ctx","authenticate","clientId","clientSecret","realmId","certificateEvidence","invalid","client","resolve","authMethod","NONE","SECRET","verified","verify","TLS","validateForAuthentication","e","identity","CLIENT","type","data","active","inactive","resolveTokenBinding","tokenBindingMethod","undefined","validateCertificateEvidenceForBinding","validateForBinding","thumbprint"],"sources":["../../../../src/core/oauth2/client/authenticator.ts"],"sourcesContent":["/\n Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport {\n type Client,\n ClientAuthMethod,\n ClientTokenBindingMethod,\n IdentityType,\n} from '@authup/core-kit';\nimport type { OAuth2TokenConfirmation } from '@authup/specs';\nimport { OAuth2ClientError } from '@authup/specs';\nimport { isValidationError } from '@authup/errors';\nimport { ClientCredentialsService } from '../../authentication/credential/index.ts';\nimport type {\n ClientCertificateEvidence,\n IClientCertificateValidator,\n} from '../../client-certificate/index.ts';\nimport type { IIdentityResolver } from '../../identity/index.ts';\n\nexport type OAuth2ClientAuthenticatorContext = {\n identityResolver: IIdentityResolver,\n certificateValidator: IClientCertificateValidator,\n};\n\n/\n Authenticates a client at the OAuth2 token endpoint according to its\n * exclusive method: public id only, shared secret, or trusted TLS evidence.\n \n Used by every standard client-resolving grant.\n */\nexport class OAuth2ClientAuthenticator {\n protected identityResolver: IIdentityResolver;\n\n protected credentialsService: ClientCredentialsService;\n\n protected certificateValidator?: IClientCertificateValidator;\n\n constructor(ctx: IIdentityResolver \| OAuth2ClientAuthenticatorContext) {\n if ('identityResolver' in ctx) {\n this.identityResolver = ctx.identityResolver;\n this.certificateValidator = ctx.certificateValidator;\n } else {\n // Kept as a compatibility seam for focused secret/public-client\n // unit tests. Production wiring always supplies the validator.\n this.identityResolver = ctx;\n }\n this.credentialsService = new ClientCredentialsService();\n }\n\n async authenticate(\n clientId: string \| undefined,\n clientSecret?: string,\n realmId?: string,\n certificateEvidence?: ClientCertificateEvidence,\n ): Promise<Client> {\n if (!clientId) {\n throw OAuth2ClientError.invalid();\n }\n\n const client = await this.resolve(clientId, realmId);\n\n switch (client.authMethod) {\n case ClientAuthMethod.NONE:\n if (typeof clientSecret === 'string') {\n throw OAuth2ClientError.invalid();\n }\n break;\n case ClientAuthMethod.SECRET: {\n if (!clientSecret) {\n throw OAuth2ClientError.invalid();\n }\n\n const verified = await this.credentialsService.verify(clientSecret, client);\n if (!verified) {\n throw OAuth2ClientError.invalid();\n }\n break;\n }\n case ClientAuthMethod.TLS:\n if (\n typeof clientSecret === 'string' \|\|\n !certificateEvidence \|\|\n !this.certificateValidator\n ) {\n throw OAuth2ClientError.invalid();\n }\n\n try {\n await this.certificateValidator.validateForAuthentication(client, certificateEvidence);\n } catch (e) {\n // A validation failure deliberately reveals neither the\n // certificate identity nor which realm anchor failed. An\n // infrastructure fault (e.g. the trust-anchor store being\n // unreachable) must NOT masquerade as a bad certificate —\n // let it surface as a server error instead.\n if (isValidationError(e)) {\n throw OAuth2ClientError.invalid();\n }\n throw e;\n }\n break;\n default:\n throw OAuth2ClientError.invalid();\n }\n\n return client;\n }\n\n async resolve(clientId: string, realmId?: string): Promise<Client> {\n const identity = await this.identityResolver.resolve(IdentityType.CLIENT, clientId, realmId);\n if (!identity \|\| identity.type !== IdentityType.CLIENT) {\n throw OAuth2ClientError.invalid();\n }\n\n if (!identity.data.active) {\n throw OAuth2ClientError.inactive();\n }\n\n return identity.data;\n }\n\n resolveTokenBinding(\n client: Pick<Client, 'tokenBindingMethod'>,\n certificateEvidence?: ClientCertificateEvidence,\n ): OAuth2TokenConfirmation \| undefined {\n if (client.tokenBindingMethod === ClientTokenBindingMethod.NONE) {\n return undefined;\n }\n\n if (client.tokenBindingMethod !== ClientTokenBindingMethod.TLS) {\n throw OAuth2ClientError.invalid();\n }\n\n return this.validateCertificateEvidenceForBinding(certificateEvidence);\n }\n\n validateCertificateEvidenceForBinding(\n certificateEvidence?: ClientCertificateEvidence,\n ): OAuth2TokenConfirmation {\n if (!certificateEvidence \|\| !this.certificateValidator) {\n throw OAuth2ClientError.invalid();\n }\n\n try {\n this.certificateValidator.validateForBinding(certificateEvidence);\n } catch {\n throw OAuth2ClientError.invalid();\n }\n\n return { 'x5t#S256': certificateEvidence.thumbprint };\n }\n}\n"],"mappings":";;;;;;;;;;;;;;GAkCA,IAAaM,4BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA2D;EACnE,IAAI,sBAAsBA,KAAK;GAC3B,KAAKH,mBAAmBG,IAAIH;GAC5B,KAAKE,uBAAuBC,IAAID;EACpC,OAGI,KAAKF,mBAAmBG;EAE5B,KAAKF,qBAAqB,IAAIH,yBAAAA;CAClC;CAEA,MAAMM,aACFC,UACAC,cACAC,SACAC,qBACe;EACf,IAAI,CAACH,UACD,MAAMT,kBAAkBa,QAAO;EAGnC,MAAMC,SAAS,MAAM,KAAKC,QAAQN,UAAUE,OAAAA;EAE5C,QAAQG,OAAOE,YAAf;GACI,KAAKnB,iBAAiBoB;IAClB,IAAI,OAAOP,iBAAiB,UACxB,MAAMV,kBAAkBa,QAAO;IAEnC;GACJ,KAAKhB,iBAAiBqB;IAClB,IAAI,CAACR,cACD,MAAMV,kBAAkBa,QAAO;IAInC,IAAI,CAACM,MADkB,KAAKd,mBAAmBe,OAAOV,cAAcI,MAAAA,GAEhE,MAAMd,kBAAkBa,QAAO;IAEnC;GAEJ,KAAKhB,iBAAiBwB;IAClB,IACI,OAAOX,iBAAiB,YACxB,CAACE,uBACD,CAAC,KAAKN,sBAEN,MAAMN,kBAAkBa,QAAO;IAGnC,IAAI;KACA,MAAM,KAAKP,qBAAqBgB,0BAA0BR,QAAQF,mBAAAA;IACtE,SAASW,GAAG;KAMR,IAAItB,kBAAkBsB,CAAAA,GAClB,MAAMvB,kBAAkBa,QAAO;KAEnC,MAAMU;IACV;IACA;GACJ,SACI,MAAMvB,kBAAkBa,QAAO;EACvC;EAEA,OAAOC;CACX;CAEA,MAAMC,QAAQN,UAAkBE,SAAmC;EAC/D,MAAMa,WAAW,MAAM,KAAKpB,iBAAiBW,QAAQhB,aAAa0B,QAAQhB,UAAUE,OAAAA;EACpF,IAAI,CAACa,YAAYA,SAASE,SAAS3B,aAAa0B,QAC5C,MAAMzB,kBAAkBa,QAAO;EAGnC,IAAI,CAACW,SAASG,KAAKC,QACf,MAAM5B,kBAAkB6B,SAAQ;EAGpC,OAAOL,SAASG;CACpB;CAEAG,oBACIhB,QACAF,qBACmC;EACnC,IAAIE,OAAOiB,uBAAuBjC,yBAAyBmB,MACvD;EAGJ,IAAIH,OAAOiB,uBAAuBjC,yBAAyBuB,KACvD,MAAMrB,kBAAkBa,QAAO;EAGnC,OAAO,KAAKoB,sCAAsCrB,mBAAAA;CACtD;CAEAqB,sCACIrB,qBACuB;EACvB,IAAI,CAACA,uBAAuB,CAAC,KAAKN,sBAC9B,MAAMN,kBAAkBa,QAAO;EAGnC,IAAI;GACA,KAAKP,qBAAqB4B,mBAAmBtB,mBAAAA;EACjD,QAAQ;GACJ,MAAMZ,kBAAkBa,QAAO;EACnC;EAEA,OAAO,EAAE,YAAYD,oBAAoBuB,WAAW;CACxD;AACJ"}

package/dist/core/oauth2/client/grant-type.d.ts CHANGED Viewed

@@ -5,5 +5,5 @@ import type { Client } from '@authup/core-kit';
  * enforcement is opt-in per client; unknown values in the list are
  * inert — they can only narrow, never widen.
  */
-export declare function assertClientGrantAllowed(client: Pick<Client, 'grant_types'>, grantType: string): void;
+export declare function assertClientGrantAllowed(client: Pick<Client, 'grantTypes'>, grantType: string): void;
 //# sourceMappingURL=grant-type.d.ts.map

package/dist/core/oauth2/client/grant-type.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"grant-type.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/client/grant-type.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAG/C;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,~~aAAa~~,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,~~CASrG~~"}
1	+ {"version":3,"file":"grant-type.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/client/grant-type.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAG/C;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CASpG"}

package/dist/core/oauth2/client/grant-type.mjs CHANGED Viewed

@@ -9,8 +9,8 @@ import { OAuth2ClientUnauthorizedError } from "@authup/specs";
 * enforcement is opt-in per client; unknown values in the list are
 * inert — they can only narrow, never widen.
 */ function assertClientGrantAllowed(client, grantType) {
-	if (!client.grant_types) return;
-	if (!client.grant_types.split(/[\s,]+/).includes(grantType)) throw OAuth2ClientUnauthorizedError.grantType(grantType);
+	if (!client.grantTypes) return;
+	if (!client.grantTypes.split(/[\s,]+/).includes(grantType)) throw OAuth2ClientUnauthorizedError.grantType(grantType);
 }
 //#endregion
 export { assertClientGrantAllowed };

package/dist/core/oauth2/client/grant-type.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"grant-type.mjs","names":["OAuth2ClientUnauthorizedError","assertClientGrantAllowed","client","grantType","~~grant_types~~","allowed","split","includes"],"sources":["../../../../src/core/oauth2/client/grant-type.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { Client } from '@authup/core-kit';\nimport { OAuth2ClientUnauthorizedError } from '@authup/specs';\n\n/\n Enforce the client's grant_types allowlist (RFC 6749 §5.2\n * unauthorized_client). A null/empty column means allow-all, so\n * enforcement is opt-in per client; unknown values in the list are\n * inert — they can only narrow, never widen.\n */\nexport function assertClientGrantAllowed(client: Pick<Client, '~~grant_types~~'>, grantType: string): void {\n if (!client.~~grant_types~~) {\n return;\n }\n\n const allowed = client.~~grant_types~~.split(/[\\s,]+/);\n if (!allowed.includes(grantType)) {\n throw OAuth2ClientUnauthorizedError.grantType(grantType);\n }\n}\n"],"mappings":";;;;;;;;;;GAgBA,SAAgBC,yBAAyBC,~~QAAqCC~~,WAAiB;~~CAC3F~~,IAAI,CAACD,OAAOE,~~aACR~~;CAIJ,IAAI,CADYF,OAAOE,~~YAAYE~~,MAAM,~~QACpCD~~,CAAAA,CAAQE,SAASJ,SAAAA,GAClB,MAAMH,8BAA8BG,UAAUA,SAAAA;AAEtD"}
1	+ {"version":3,"file":"grant-type.mjs","names":["OAuth2ClientUnauthorizedError","assertClientGrantAllowed","client","grantType","grantTypes","allowed","split","includes"],"sources":["../../../../src/core/oauth2/client/grant-type.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { Client } from '@authup/core-kit';\nimport { OAuth2ClientUnauthorizedError } from '@authup/specs';\n\n/\n Enforce the client's grant_types allowlist (RFC 6749 §5.2\n * unauthorized_client). A null/empty column means allow-all, so\n * enforcement is opt-in per client; unknown values in the list are\n * inert — they can only narrow, never widen.\n */\nexport function assertClientGrantAllowed(client: Pick<Client, 'grantTypes'>, grantType: string): void {\n if (!client.grantTypes) {\n return;\n }\n\n const allowed = client.grantTypes.split(/[\\s,]+/);\n if (!allowed.includes(grantType)) {\n throw OAuth2ClientUnauthorizedError.grantType(grantType);\n }\n}\n"],"mappings":";;;;;;;;;;GAgBA,SAAgBC,yBAAyBC,QAAoCC,WAAiB;CAC1F,IAAI,CAACD,OAAOE,YACR;CAIJ,IAAI,CADYF,OAAOE,WAAWE,MAAM,QACnCD,CAAAA,CAAQE,SAASJ,SAAAA,GAClB,MAAMH,8BAA8BG,UAAUA,SAAAA;AAEtD"}

package/dist/core/oauth2/end-session/service.mjs CHANGED Viewed

@@ -64,7 +64,7 @@ var OAuth2EndSessionService = class {
 		let redirectUri;
 		if (client) {
 			clientName = client.name;
-			if (data.post_logout_redirect_uri && this.isValidPostLogoutRedirect(client.post_logout_redirect_uri, data.post_logout_redirect_uri)) redirectUri = data.post_logout_redirect_uri;
+			if (data.post_logout_redirect_uri && this.isValidPostLogoutRedirect(client.postLogoutRedirectUri, data.post_logout_redirect_uri)) redirectUri = data.post_logout_redirect_uri;
 		}
 		return {
 			hintVerified,
@@ -84,17 +84,17 @@ var OAuth2EndSessionService = class {
 	async revoke(sessionId, sub, subKind) {
 		const session = await this.sessionManager.findOneById(sessionId);
 		if (!session) return false;
-		if (session.sub !== sub || session.sub_kind !== subKind) return false;
+		if (session.sub !== sub || session.subKind !== subKind) return false;
 		await this.sessionManager.revoke(sessionId);
 		await this.eventService?.record({
 			scope: EventScope.OAUTH2,
 			name: EventName.LOGOUT,
 			refType: EventRefType.SESSION,
 			refId: sessionId,
-			actorType: session.sub_kind,
+			actorType: session.subKind,
 			actorId: session.sub,
-			realmId: session.realm_id,
-			data: { revoked_session_id: sessionId }
+			realmId: session.realmId,
+			data: { revokedSessionId: sessionId }
 		});
 		return true;
 	}

package/dist/core/oauth2/end-session/service.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.mjs","names":["isSimpleMatch","isUUID","EventName","EventRefType","EventScope","OAuth2TokenKind","OAuth2EndSessionService","tokenVerifier","sessionManager","clientRepository","realmRepository","eventService","hintGracePeriod","ctx","verify","data","hintVerified","sub","subKind","sessionId","hintRealmId","audiences","id_token_hint","payload","ignoreExpiry","skipActiveCheck","kind","ID_TOKEN","isWithinHintGraceWindow","sub_kind","sid","session_id","undefined","realm_id","aud","Array","isArray","filter","entry","clientId","client_id","length","client","realmKey","realm_name","realm","resolve","findOneByIdOrName","id","expected","includes","clientName","redirectUri","name","post_logout_redirect_uri","isValidPostLogoutRedirect","state","revoke","session","findOneById","record","scope","OAUTH2","LOGOUT","refType","SESSION","refId","actorType","actorId","realmId","revoked_session_id","exp","nowSeconds","Math","floor","Date","now","registered","candidate","parsed","URL","protocol","split"],"sources":["../../../../src/core/oauth2/end-session/service.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { isSimpleMatch, isUUID } from '@authup/kit';\nimport type { Client, IdentityType } from '@authup/core-kit';\nimport { EventName, EventRefType, EventScope } from '@authup/core-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IEventService, IRealmRepository } from '../../entities/index.ts';\nimport type { ISessionManager } from '../../authentication/index.ts';\nimport type { IOAuth2ClientRepository } from '../client/index.ts';\nimport type { IOAuth2TokenVerifier } from '../token/index.ts';\nimport type {\n IOAuth2EndSessionService,\n OAuth2EndSessionRequest,\n OAuth2EndSessionResult,\n OAuth2EndSessionServiceContext,\n} from './types.ts';\n\nexport class OAuth2EndSessionService implements IOAuth2EndSessionService {\n protected tokenVerifier: IOAuth2TokenVerifier;\n\n protected sessionManager: ISessionManager;\n\n protected clientRepository: IOAuth2ClientRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected eventService?: IEventService;\n\n protected hintGracePeriod: number;\n\n constructor(ctx: OAuth2EndSessionServiceContext) {\n this.tokenVerifier = ctx.tokenVerifier;\n this.sessionManager = ctx.sessionManager;\n this.clientRepository = ctx.clientRepository;\n this.realmRepository = ctx.realmRepository;\n this.eventService = ctx.eventService;\n this.hintGracePeriod = ctx.hintGracePeriod ?? 0;\n }\n\n async verify(data: OAuth2EndSessionRequest): Promise<OAuth2EndSessionResult> {\n let hintVerified = false;\n let sub: string \| undefined;\n let subKind: string \| undefined;\n let sessionId: string \| undefined;\n let hintRealmId: string \| undefined;\n let audiences: string[] = [];\n\n if (data.id_token_hint) {\n try {\n // Signature + kind are the anchors; exp is skipped (a logout hint\n // is routinely expired) and the cache blocklist is irrelevant.\n const payload = await this.tokenVerifier.verify(data.id_token_hint, {\n ignoreExpiry: true,\n skipActiveCheck: true,\n });\n\n // MUST be an id_token — access/refresh tokens also carry\n // session_id, so accepting them would let a leaked access token\n // act as a logout weapon.\n if (payload.kind === OAuth2TokenKind.ID_TOKEN && this.isWithinHintGraceWindow(payload)) {\n hintVerified = true;\n sub = payload.sub;\n subKind = payload.sub_kind;\n sessionId = payload.sid ?? payload.session_id ?? undefined;\n hintRealmId = payload.realm_id ?? undefined;\n // aud may be a single string or an array (JWT spec).\n const { aud } = payload;\n if (Array.isArray(aud)) {\n audiences = aud.filter((entry): entry is string => typeof entry === 'string');\n } else if (typeof aud === 'string') {\n audiences = [aud];\n }\n }\n } catch {\n // forged / unverifiable hint → stays unverified (no revoke)\n }\n }\n\n // Resolve a single client for the aud cross-check and redirect\n // validation: the request's client_id, else the hint's sole audience\n // (ambiguous for a multi-aud hint).\n const clientId = data.client_id ?? (audiences.length === 1 ? audiences[0] : undefined);\n\n let client: Client \| null = null;\n if (clientId) {\n // Scope a name-identified client to the request's realm hint; a\n // VERIFIED hint's own realm claim serves as fallback (claims from an\n // unverified hint are never trusted). No master fallback here\n // (unlike /token): a bogus hint must NOT silently resolve a\n // same-named client in master → null realm.\n const realmKey = data.realm_id ?? data.realm_name ?? (hintVerified ? hintRealmId : undefined);\n const realm = await this.realmRepository.resolve(realmKey, false);\n\n // Fail closed instead of dropping the realm predicate: a supplied\n // realm key that does not resolve never degrades to an unscoped\n // lookup, and a NAME-form client_id without any realm key is\n // ambiguous (every realm has a built-in `web` client — same rule as\n // the /authorize verifier). A UUID is globally unique and needs no\n // scope; the sole-aud-derived clientId is always a UUID.\n if (realm) {\n client = await this.clientRepository.findOneByIdOrName(clientId, realm.id);\n } else if (!realmKey && isUUID(clientId)) {\n client = await this.clientRepository.findOneByIdOrName(clientId);\n }\n }\n\n // aud/client_id cross-check: when the request supplies a client_id on a\n // verified hint, it MUST denote one of the hint's audiences. The aud is\n // the client UUID, so a name-form client_id is compared via its resolved\n // client's id. Fail closed: an aud-less hint, or a name that did not\n // resolve, counts as unverified.\n if (hintVerified && data.client_id) {\n const expected = isUUID(data.client_id) ? data.client_id : client?.id;\n if (audiences.length === 0 \|\| !expected \|\| !audiences.includes(expected)) {\n hintVerified = false;\n sub = undefined;\n subKind = undefined;\n sessionId = undefined;\n }\n }\n\n let clientName: string \| undefined;\n let redirectUri: string \| undefined;\n\n // Redirect validation is independent of hint verification — the\n // click-gated confirm page (unverified hint / hint-less request) still\n // honors a registered post-logout redirect.\n if (client) {\n clientName = client.name;\n if (\n data.post_logout_redirect_uri &&\n this.isValidPostLogoutRedirect(client.post_logout_redirect_uri, data.post_logout_redirect_uri)\n ) {\n redirectUri = data.post_logout_redirect_uri;\n }\n }\n\n return {\n hintVerified,\n ...(hintVerified ? {\n sub,\n subKind,\n sessionId,\n } : {}),\n ...(clientId ? { clientId } : {}),\n ...(clientName ? { clientName } : {}),\n ...(redirectUri ? { redirectUri, ...(data.state ? { state: data.state } : {}) } : {}),\n };\n }\n\n async revoke(sessionId: string, sub: string, subKind: string): Promise<boolean> {\n const session = await this.sessionManager.findOneById(sessionId);\n if (!session) {\n return false;\n }\n\n // Never revoke a session that does not belong to the hint's subject.\n if (session.sub !== sub \|\| session.sub_kind !== subKind) {\n return false;\n }\n\n await this.sessionManager.revoke(sessionId);\n\n await this.eventService?.record({\n scope: EventScope.OAUTH2,\n name: EventName.LOGOUT,\n refType: EventRefType.SESSION,\n refId: sessionId,\n actorType: session.sub_kind as `${IdentityType}`,\n actorId: session.sub,\n realmId: session.realm_id,\n data: { revoked_session_id: sessionId },\n });\n\n return true;\n }\n\n /\n With a positive `hintGracePeriod`, an expired hint is honored only within\n * the window past `exp` — beyond it a leaked id_token stops being a\n * replayable remote logout (the hint counts as unverified; the click-gated\n * confirm page still works). 0 keeps spec/Keycloak parity: any expired hint.\n /\n protected isWithinHintGraceWindow(payload: OAuth2TokenPayload): boolean {\n if (this.hintGracePeriod <= 0) {\n return true;\n }\n\n // a bounded window without an exp claim to judge against fails closed\n if (typeof payload.exp !== 'number') {\n return false;\n }\n\n const nowSeconds = Math.floor(Date.now() / 1000);\n return nowSeconds - payload.exp <= this.hintGracePeriod;\n }\n\n /\n A post-logout redirect is honored only when it is an absolute http(s) URL\n * that matches a registered client redirect pattern (defense against open\n * redirects to attacker-controlled URLs).\n */\n protected isValidPostLogoutRedirect(\n registered: string \| null \| undefined,\n candidate: string,\n ): boolean {\n let parsed: URL;\n try {\n parsed = new URL(candidate);\n } catch {\n return false;\n }\n\n if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {\n return false;\n }\n\n if (!registered) {\n return false;\n }\n\n return isSimpleMatch(candidate, registered.split(','));\n }\n}\n"],"mappings":";;;;;;;AAuBA,IAAaM,0BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,KAAKN,gBAAgBM,IAAIN;EACzB,KAAKC,iBAAiBK,IAAIL;EAC1B,KAAKC,mBAAmBI,IAAIJ;EAC5B,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,eAAeE,IAAIF;EACxB,KAAKC,kBAAkBC,IAAID,mBAAmB;CAClD;CAEA,MAAME,OAAOC,MAAgE;EACzE,IAAIC,eAAe;EACnB,IAAIC;EACJ,IAAIC;EACJ,IAAIC;EACJ,IAAIC;EACJ,IAAIC,YAAsB,CAAA;EAE1B,IAAIN,KAAKO,eACL,IAAI;GAGA,MAAMC,UAAU,MAAM,KAAKhB,cAAcO,OAAOC,KAAKO,eAAe;IAChEE,cAAc;IACdC,iBAAiB;GACrB,CAAA;GAKA,IAAIF,QAAQG,SAASrB,gBAAgBsB,YAAY,KAAKC,wBAAwBL,OAAAA,GAAU;IACpFP,eAAe;IACfC,MAAMM,QAAQN;IACdC,UAAUK,QAAQM;IAClBV,YAAYI,QAAQO,OAAOP,QAAQQ,cAAcC,KAAAA;IACjDZ,cAAcG,QAAQU,YAAYD,KAAAA;IAElC,MAAM,EAAEE,QAAQX;IAChB,IAAIY,MAAMC,QAAQF,GAAAA,GACdb,YAAYa,IAAIG,QAAQC,UAA2B,OAAOA,UAAU,QAAA;SACjE,IAAI,OAAOJ,QAAQ,UACtBb,YAAY,CAACa,GAAAA;GAErB;EACJ,QAAQ,CAER;EAMJ,MAAMK,WAAWxB,KAAKyB,cAAcnB,UAAUoB,WAAW,IAAIpB,UAAU,KAAKW,KAAAA;EAE5E,IAAIU,SAAwB;EAC5B,IAAIH,UAAU;GAMV,MAAMI,WAAW5B,KAAKkB,YAAYlB,KAAK6B,eAAe5B,eAAeI,cAAcY,KAAAA;GACnF,MAAMa,QAAQ,MAAM,KAAKnC,gBAAgBoC,QAAQH,UAAU,KAAA;GAQ3D,IAAIE,OACAH,SAAS,MAAM,KAAKjC,iBAAiBsC,kBAAkBR,UAAUM,MAAMG,EAAE;QACtE,IAAI,CAACL,YAAY1C,OAAOsC,QAAAA,GAC3BG,SAAS,MAAM,KAAKjC,iBAAiBsC,kBAAkBR,QAAAA;EAE/D;EAOA,IAAIvB,gBAAgBD,KAAKyB,WAAW;GAChC,MAAMS,WAAWhD,OAAOc,KAAKyB,SAAS,IAAIzB,KAAKyB,YAAYE,QAAQM;GACnE,IAAI3B,UAAUoB,WAAW,KAAK,CAACQ,YAAY,CAAC5B,UAAU6B,SAASD,QAAAA,GAAW;IACtEjC,eAAe;IACfC,MAAMe,KAAAA;IACNd,UAAUc,KAAAA;IACVb,YAAYa,KAAAA;GAChB;EACJ;EAEA,IAAImB;EACJ,IAAIC;EAKJ,IAAIV,QAAQ;GACRS,aAAaT,OAAOW;GACpB,IACItC,KAAKuC,4BACL,KAAKC,0BAA0Bb,OAAOY,0BAA0BvC,KAAKuC,wBAAwB,GAE7FF,cAAcrC,KAAKuC;EAE3B;EAEA,OAAO;GACHtC;GACA,GAAIA,eAAe;IACfC;IACAC;IACAC;GACJ,IAAI,CAAC;GACL,GAAIoB,WAAW,EAAEA,SAAS,IAAI,CAAC;GAC/B,GAAIY,aAAa,EAAEA,WAAW,IAAI,CAAC;GACnC,GAAIC,cAAc;IAAEA;IAAa,GAAIrC,KAAKyC,QAAQ,EAAEA,OAAOzC,KAAKyC,MAAM,IAAI,CAAC;GAAG,IAAI,CAAC;EACvF;CACJ;CAEA,MAAMC,OAAOtC,WAAmBF,KAAaC,SAAmC;EAC5E,MAAMwC,UAAU,MAAM,KAAKlD,eAAemD,YAAYxC,SAAAA;EACtD,IAAI,CAACuC,SACD,OAAO;EAIX,IAAIA,QAAQzC,QAAQA,OAAOyC,QAAQ7B,aAAaX,SAC5C,OAAO;EAGX,MAAM,KAAKV,eAAeiD,OAAOtC,SAAAA;EAEjC,MAAM,KAAKR,cAAciD,OAAO;GAC5BC,OAAOzD,WAAW0D;GAClBT,MAAMnD,UAAU6D;GAChBC,SAAS7D,aAAa8D;GACtBC,OAAO/C;GACPgD,WAAWT,QAAQ7B;GACnBuC,SAASV,QAAQzC;GACjBoD,SAASX,QAAQzB;GACjBlB,MAAM,EAAEuD,oBAAoBnD,UAAU;EAC1C,CAAA;EAEA,OAAO;CACX;;;;;;IAQA,wBAAkCI,SAAsC;EACpE,IAAI,KAAKX,mBAAmB,GACxB,OAAO;EAIX,IAAI,OAAOW,QAAQgD,QAAQ,UACvB,OAAO;EAIX,OADmBE,KAAKC,MAAMC,KAAKC,IAAG,IAAK,GACpCJ,IAAajD,QAAQgD,OAAO,KAAK3D;CAC5C;;;;;IAOA,0BACIiE,YACAC,WACO;EACP,IAAIC;EACJ,IAAI;GACAA,SAAS,IAAIC,IAAIF,SAAAA;EACrB,QAAQ;GACJ,OAAO;EACX;EAEA,IAAIC,OAAOE,aAAa,WAAWF,OAAOE,aAAa,UACnD,OAAO;EAGX,IAAI,CAACJ,YACD,OAAO;EAGX,OAAO7E,cAAc8E,WAAWD,WAAWK,MAAM,GAAA,CAAA;CACrD;AACJ"}
1	+ {"version":3,"file":"service.mjs","names":["isSimpleMatch","isUUID","EventName","EventRefType","EventScope","OAuth2TokenKind","OAuth2EndSessionService","tokenVerifier","sessionManager","clientRepository","realmRepository","eventService","hintGracePeriod","ctx","verify","data","hintVerified","sub","subKind","sessionId","hintRealmId","audiences","id_token_hint","payload","ignoreExpiry","skipActiveCheck","kind","ID_TOKEN","isWithinHintGraceWindow","sub_kind","sid","session_id","undefined","realm_id","aud","Array","isArray","filter","entry","clientId","client_id","length","client","realmKey","realm_name","realm","resolve","findOneByIdOrName","id","expected","includes","clientName","redirectUri","name","post_logout_redirect_uri","isValidPostLogoutRedirect","postLogoutRedirectUri","state","revoke","session","findOneById","record","scope","OAUTH2","LOGOUT","refType","SESSION","refId","actorType","actorId","realmId","revokedSessionId","exp","nowSeconds","Math","floor","Date","now","registered","candidate","parsed","URL","protocol","split"],"sources":["../../../../src/core/oauth2/end-session/service.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { isSimpleMatch, isUUID } from '@authup/kit';\nimport type { Client, IdentityType } from '@authup/core-kit';\nimport { EventName, EventRefType, EventScope } from '@authup/core-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IEventService, IRealmRepository } from '../../entities/index.ts';\nimport type { ISessionManager } from '../../authentication/index.ts';\nimport type { IOAuth2ClientRepository } from '../client/index.ts';\nimport type { IOAuth2TokenVerifier } from '../token/index.ts';\nimport type {\n IOAuth2EndSessionService,\n OAuth2EndSessionRequest,\n OAuth2EndSessionResult,\n OAuth2EndSessionServiceContext,\n} from './types.ts';\n\nexport class OAuth2EndSessionService implements IOAuth2EndSessionService {\n protected tokenVerifier: IOAuth2TokenVerifier;\n\n protected sessionManager: ISessionManager;\n\n protected clientRepository: IOAuth2ClientRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected eventService?: IEventService;\n\n protected hintGracePeriod: number;\n\n constructor(ctx: OAuth2EndSessionServiceContext) {\n this.tokenVerifier = ctx.tokenVerifier;\n this.sessionManager = ctx.sessionManager;\n this.clientRepository = ctx.clientRepository;\n this.realmRepository = ctx.realmRepository;\n this.eventService = ctx.eventService;\n this.hintGracePeriod = ctx.hintGracePeriod ?? 0;\n }\n\n async verify(data: OAuth2EndSessionRequest): Promise<OAuth2EndSessionResult> {\n let hintVerified = false;\n let sub: string \| undefined;\n let subKind: string \| undefined;\n let sessionId: string \| undefined;\n let hintRealmId: string \| undefined;\n let audiences: string[] = [];\n\n if (data.id_token_hint) {\n try {\n // Signature + kind are the anchors; exp is skipped (a logout hint\n // is routinely expired) and the cache blocklist is irrelevant.\n const payload = await this.tokenVerifier.verify(data.id_token_hint, {\n ignoreExpiry: true,\n skipActiveCheck: true,\n });\n\n // MUST be an id_token — access/refresh tokens also carry\n // session_id, so accepting them would let a leaked access token\n // act as a logout weapon.\n if (payload.kind === OAuth2TokenKind.ID_TOKEN && this.isWithinHintGraceWindow(payload)) {\n hintVerified = true;\n sub = payload.sub;\n subKind = payload.sub_kind;\n sessionId = payload.sid ?? payload.session_id ?? undefined;\n hintRealmId = payload.realm_id ?? undefined;\n // aud may be a single string or an array (JWT spec).\n const { aud } = payload;\n if (Array.isArray(aud)) {\n audiences = aud.filter((entry): entry is string => typeof entry === 'string');\n } else if (typeof aud === 'string') {\n audiences = [aud];\n }\n }\n } catch {\n // forged / unverifiable hint → stays unverified (no revoke)\n }\n }\n\n // Resolve a single client for the aud cross-check and redirect\n // validation: the request's client_id, else the hint's sole audience\n // (ambiguous for a multi-aud hint).\n const clientId = data.client_id ?? (audiences.length === 1 ? audiences[0] : undefined);\n\n let client: Client \| null = null;\n if (clientId) {\n // Scope a name-identified client to the request's realm hint; a\n // VERIFIED hint's own realm claim serves as fallback (claims from an\n // unverified hint are never trusted). No master fallback here\n // (unlike /token): a bogus hint must NOT silently resolve a\n // same-named client in master → null realm.\n const realmKey = data.realm_id ?? data.realm_name ?? (hintVerified ? hintRealmId : undefined);\n const realm = await this.realmRepository.resolve(realmKey, false);\n\n // Fail closed instead of dropping the realm predicate: a supplied\n // realm key that does not resolve never degrades to an unscoped\n // lookup, and a NAME-form client_id without any realm key is\n // ambiguous (every realm has a built-in `web` client — same rule as\n // the /authorize verifier). A UUID is globally unique and needs no\n // scope; the sole-aud-derived clientId is always a UUID.\n if (realm) {\n client = await this.clientRepository.findOneByIdOrName(clientId, realm.id);\n } else if (!realmKey && isUUID(clientId)) {\n client = await this.clientRepository.findOneByIdOrName(clientId);\n }\n }\n\n // aud/client_id cross-check: when the request supplies a client_id on a\n // verified hint, it MUST denote one of the hint's audiences. The aud is\n // the client UUID, so a name-form client_id is compared via its resolved\n // client's id. Fail closed: an aud-less hint, or a name that did not\n // resolve, counts as unverified.\n if (hintVerified && data.client_id) {\n const expected = isUUID(data.client_id) ? data.client_id : client?.id;\n if (audiences.length === 0 \|\| !expected \|\| !audiences.includes(expected)) {\n hintVerified = false;\n sub = undefined;\n subKind = undefined;\n sessionId = undefined;\n }\n }\n\n let clientName: string \| undefined;\n let redirectUri: string \| undefined;\n\n // Redirect validation is independent of hint verification — the\n // click-gated confirm page (unverified hint / hint-less request) still\n // honors a registered post-logout redirect.\n if (client) {\n clientName = client.name;\n if (\n data.post_logout_redirect_uri &&\n this.isValidPostLogoutRedirect(client.postLogoutRedirectUri, data.post_logout_redirect_uri)\n ) {\n redirectUri = data.post_logout_redirect_uri;\n }\n }\n\n return {\n hintVerified,\n ...(hintVerified ? {\n sub,\n subKind,\n sessionId,\n } : {}),\n ...(clientId ? { clientId } : {}),\n ...(clientName ? { clientName } : {}),\n ...(redirectUri ? { redirectUri, ...(data.state ? { state: data.state } : {}) } : {}),\n };\n }\n\n async revoke(sessionId: string, sub: string, subKind: string): Promise<boolean> {\n const session = await this.sessionManager.findOneById(sessionId);\n if (!session) {\n return false;\n }\n\n // Never revoke a session that does not belong to the hint's subject.\n if (session.sub !== sub \|\| session.subKind !== subKind) {\n return false;\n }\n\n await this.sessionManager.revoke(sessionId);\n\n await this.eventService?.record({\n scope: EventScope.OAUTH2,\n name: EventName.LOGOUT,\n refType: EventRefType.SESSION,\n refId: sessionId,\n actorType: session.subKind as `${IdentityType}`,\n actorId: session.sub,\n realmId: session.realmId,\n data: { revokedSessionId: sessionId },\n });\n\n return true;\n }\n\n /\n With a positive `hintGracePeriod`, an expired hint is honored only within\n * the window past `exp` — beyond it a leaked id_token stops being a\n * replayable remote logout (the hint counts as unverified; the click-gated\n * confirm page still works). 0 keeps spec/Keycloak parity: any expired hint.\n /\n protected isWithinHintGraceWindow(payload: OAuth2TokenPayload): boolean {\n if (this.hintGracePeriod <= 0) {\n return true;\n }\n\n // a bounded window without an exp claim to judge against fails closed\n if (typeof payload.exp !== 'number') {\n return false;\n }\n\n const nowSeconds = Math.floor(Date.now() / 1000);\n return nowSeconds - payload.exp <= this.hintGracePeriod;\n }\n\n /\n A post-logout redirect is honored only when it is an absolute http(s) URL\n * that matches a registered client redirect pattern (defense against open\n * redirects to attacker-controlled URLs).\n */\n protected isValidPostLogoutRedirect(\n registered: string \| null \| undefined,\n candidate: string,\n ): boolean {\n let parsed: URL;\n try {\n parsed = new URL(candidate);\n } catch {\n return false;\n }\n\n if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {\n return false;\n }\n\n if (!registered) {\n return false;\n }\n\n return isSimpleMatch(candidate, registered.split(','));\n }\n}\n"],"mappings":";;;;;;;AAuBA,IAAaM,0BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,KAAKN,gBAAgBM,IAAIN;EACzB,KAAKC,iBAAiBK,IAAIL;EAC1B,KAAKC,mBAAmBI,IAAIJ;EAC5B,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,eAAeE,IAAIF;EACxB,KAAKC,kBAAkBC,IAAID,mBAAmB;CAClD;CAEA,MAAME,OAAOC,MAAgE;EACzE,IAAIC,eAAe;EACnB,IAAIC;EACJ,IAAIC;EACJ,IAAIC;EACJ,IAAIC;EACJ,IAAIC,YAAsB,CAAA;EAE1B,IAAIN,KAAKO,eACL,IAAI;GAGA,MAAMC,UAAU,MAAM,KAAKhB,cAAcO,OAAOC,KAAKO,eAAe;IAChEE,cAAc;IACdC,iBAAiB;GACrB,CAAA;GAKA,IAAIF,QAAQG,SAASrB,gBAAgBsB,YAAY,KAAKC,wBAAwBL,OAAAA,GAAU;IACpFP,eAAe;IACfC,MAAMM,QAAQN;IACdC,UAAUK,QAAQM;IAClBV,YAAYI,QAAQO,OAAOP,QAAQQ,cAAcC,KAAAA;IACjDZ,cAAcG,QAAQU,YAAYD,KAAAA;IAElC,MAAM,EAAEE,QAAQX;IAChB,IAAIY,MAAMC,QAAQF,GAAAA,GACdb,YAAYa,IAAIG,QAAQC,UAA2B,OAAOA,UAAU,QAAA;SACjE,IAAI,OAAOJ,QAAQ,UACtBb,YAAY,CAACa,GAAAA;GAErB;EACJ,QAAQ,CAER;EAMJ,MAAMK,WAAWxB,KAAKyB,cAAcnB,UAAUoB,WAAW,IAAIpB,UAAU,KAAKW,KAAAA;EAE5E,IAAIU,SAAwB;EAC5B,IAAIH,UAAU;GAMV,MAAMI,WAAW5B,KAAKkB,YAAYlB,KAAK6B,eAAe5B,eAAeI,cAAcY,KAAAA;GACnF,MAAMa,QAAQ,MAAM,KAAKnC,gBAAgBoC,QAAQH,UAAU,KAAA;GAQ3D,IAAIE,OACAH,SAAS,MAAM,KAAKjC,iBAAiBsC,kBAAkBR,UAAUM,MAAMG,EAAE;QACtE,IAAI,CAACL,YAAY1C,OAAOsC,QAAAA,GAC3BG,SAAS,MAAM,KAAKjC,iBAAiBsC,kBAAkBR,QAAAA;EAE/D;EAOA,IAAIvB,gBAAgBD,KAAKyB,WAAW;GAChC,MAAMS,WAAWhD,OAAOc,KAAKyB,SAAS,IAAIzB,KAAKyB,YAAYE,QAAQM;GACnE,IAAI3B,UAAUoB,WAAW,KAAK,CAACQ,YAAY,CAAC5B,UAAU6B,SAASD,QAAAA,GAAW;IACtEjC,eAAe;IACfC,MAAMe,KAAAA;IACNd,UAAUc,KAAAA;IACVb,YAAYa,KAAAA;GAChB;EACJ;EAEA,IAAImB;EACJ,IAAIC;EAKJ,IAAIV,QAAQ;GACRS,aAAaT,OAAOW;GACpB,IACItC,KAAKuC,4BACL,KAAKC,0BAA0Bb,OAAOc,uBAAuBzC,KAAKuC,wBAAwB,GAE1FF,cAAcrC,KAAKuC;EAE3B;EAEA,OAAO;GACHtC;GACA,GAAIA,eAAe;IACfC;IACAC;IACAC;GACJ,IAAI,CAAC;GACL,GAAIoB,WAAW,EAAEA,SAAS,IAAI,CAAC;GAC/B,GAAIY,aAAa,EAAEA,WAAW,IAAI,CAAC;GACnC,GAAIC,cAAc;IAAEA;IAAa,GAAIrC,KAAK0C,QAAQ,EAAEA,OAAO1C,KAAK0C,MAAM,IAAI,CAAC;GAAG,IAAI,CAAC;EACvF;CACJ;CAEA,MAAMC,OAAOvC,WAAmBF,KAAaC,SAAmC;EAC5E,MAAMyC,UAAU,MAAM,KAAKnD,eAAeoD,YAAYzC,SAAAA;EACtD,IAAI,CAACwC,SACD,OAAO;EAIX,IAAIA,QAAQ1C,QAAQA,OAAO0C,QAAQzC,YAAYA,SAC3C,OAAO;EAGX,MAAM,KAAKV,eAAekD,OAAOvC,SAAAA;EAEjC,MAAM,KAAKR,cAAckD,OAAO;GAC5BC,OAAO1D,WAAW2D;GAClBV,MAAMnD,UAAU8D;GAChBC,SAAS9D,aAAa+D;GACtBC,OAAOhD;GACPiD,WAAWT,QAAQzC;GACnBmD,SAASV,QAAQ1C;GACjBqD,SAASX,QAAQW;GACjBvD,MAAM,EAAEwD,kBAAkBpD,UAAU;EACxC,CAAA;EAEA,OAAO;CACX;;;;;;IAQA,wBAAkCI,SAAsC;EACpE,IAAI,KAAKX,mBAAmB,GACxB,OAAO;EAIX,IAAI,OAAOW,QAAQiD,QAAQ,UACvB,OAAO;EAIX,OADmBE,KAAKC,MAAMC,KAAKC,IAAG,IAAK,GACpCJ,IAAalD,QAAQiD,OAAO,KAAK5D;CAC5C;;;;;IAOA,0BACIkE,YACAC,WACO;EACP,IAAIC;EACJ,IAAI;GACAA,SAAS,IAAIC,IAAIF,SAAAA;EACrB,QAAQ;GACJ,OAAO;EACX;EAEA,IAAIC,OAAOE,aAAa,WAAWF,OAAOE,aAAa,UACnD,OAAO;EAGX,IAAI,CAACJ,YACD,OAAO;EAGX,OAAO9E,cAAc+E,WAAWD,WAAWK,MAAM,GAAA,CAAA;CACrD;AACJ"}

package/dist/core/oauth2/grant-types/authorize.mjs CHANGED Viewed

@@ -57,7 +57,7 @@ var OAuth2AuthorizeGrant = class extends OAuth2BaseGrant {
 				...typeof authorizationCode.auth_time === "number" ? { auth_time: authorizationCode.auth_time } : {},
 				...amrAcr,
 				sid: session.id,
-				at_hash: await buildOAuth2TokenHash(accessToken, key.signature_algorithm)
+				at_hash: await buildOAuth2TokenHash(accessToken, key.signatureAlgorithm)
 			});
 			buildContext.idToken = idToken;
 		}
@@ -78,19 +78,19 @@ var OAuth2AuthorizeGrant = class extends OAuth2BaseGrant {
 	*/ async resolveSession(authorizationCode, options) {
 		if (authorizationCode.session_id) {
 			const existing = await this.sessionManager.findOneById(authorizationCode.session_id);
-			if (existing && existing.sub === authorizationCode.sub && existing.sub_kind === authorizationCode.sub_kind && existing.realm_id === authorizationCode.realm_id) {
-				existing.client_id = authorizationCode.client_id || null;
+			if (existing && existing.sub === authorizationCode.sub && existing.subKind === authorizationCode.sub_kind && existing.realmId === authorizationCode.realm_id) {
+				existing.clientId = authorizationCode.client_id || null;
 				return this.sessionManager.refresh(existing);
 			}
 		}
 		return this.sessionManager.create({
-			user_agent: options.userAgent,
-			ip_address: options.ipAddress,
-			realm_id: authorizationCode.realm_id,
-			client_id: authorizationCode.client_id,
-			sub_kind: authorizationCode.sub_kind,
+			userAgent: options.userAgent,
+			ipAddress: options.ipAddress,
+			realmId: authorizationCode.realm_id,
+			clientId: authorizationCode.client_id,
+			subKind: authorizationCode.sub_kind,
 			sub: authorizationCode.sub,
-			auth_method: authorizationCode.auth_method ?? null
+			authMethod: authorizationCode.auth_method ?? null
 		});
 	}
 };

package/dist/core/oauth2/grant-types/authorize.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"authorize.mjs","names":["JWKUse","hasOAuth2Scopes","ScopeName","buildOAuth2TokenHash","deriveAmrAcr","OAuth2BaseGrant","buildOAuth2BearerTokenResponse","OAuth2AuthorizeGrant","refreshTokenIssuer","openIdTokenIssuer","keyStore","ctx","accessTokenIssuer","sessionManager","runWith","authorizationCode","options","session","resolveSession","amrAcr","issuePayload","user_agent","userAgent","remote_address","ipAddress","session_id","id","sub","undefined","sub_kind","realm_id","realm_name","scope","client_id","confirmation","cnf","accessToken","accessTokenPayload","issue","refreshToken","refreshTokenPayload","buildContext","OPEN_ID","key","resolveOrCreate","SIGNATURE","idToken","nonce","auth_time","sid","at_hash","~~signature_algorithm~~","existing","findOneById","refresh","create","~~ip_address~~","auth_method"],"sources":["../../../../src/core/oauth2/grant-types/authorize.ts"],"sourcesContent":["/\n Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { JWKUse, hasOAuth2Scopes } from '@authup/specs';\nimport type { OAuth2AuthorizationCode, Session } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport { buildOAuth2TokenHash, deriveAmrAcr } from '../authorization/helpers.ts';\nimport type { IKeyStore } from '../../key/index.ts';\nimport type { IOAuth2OpenIDTokenIssuer, IOAuth2TokenIssuer } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport type { IOAuth2Grant, OAuth2AuthorizeGrantContext, OAuth2GrantRunWIthOptions } from './types.ts';\nimport type { OAuth2BearerResponseBuildContext } from '../response/index.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\n\nexport class OAuth2AuthorizeGrant extends OAuth2BaseGrant<OAuth2AuthorizationCode> implements IOAuth2Grant {\n protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n protected openIdTokenIssuer : IOAuth2OpenIDTokenIssuer;\n\n protected keyStore : IKeyStore;\n\n constructor(ctx: OAuth2AuthorizeGrantContext) {\n super({\n accessTokenIssuer: ctx.accessTokenIssuer,\n sessionManager: ctx.sessionManager,\n });\n\n this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n this.openIdTokenIssuer = ctx.openIdTokenIssuer;\n this.keyStore = ctx.keyStore;\n }\n\n async runWith(\n authorizationCode: OAuth2AuthorizationCode,\n options: OAuth2GrantRunWIthOptions = {},\n ) : Promise<OAuth2TokenGrantResponse> {\n const session = await this.resolveSession(authorizationCode, options);\n\n // amr/acr derive from the RESOLVED session (~~auth_method~~ + ~~mfa_at~~) —\n // deliberately on every token kind, not only the id_token, so\n // resource servers can read the method without parsing an id_token.\n const amrAcr = deriveAmrAcr(session);\n\n const issuePayload : Partial<OAuth2TokenPayload> = {\n user_agent: options.userAgent,\n remote_address: options.ipAddress,\n session_id: session.id,\n sub: authorizationCode.sub \|\| undefined,\n sub_kind: authorizationCode.sub_kind,\n realm_id: authorizationCode.realm_id,\n realm_name: authorizationCode.realm_name,\n scope: authorizationCode.scope \|\| undefined,\n client_id: authorizationCode.client_id \|\| undefined,\n ...(options.confirmation ? { cnf: options.confirmation } : {}),\n ...amrAcr,\n };\n\n const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);\n const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);\n\n const buildContext : OAuth2BearerResponseBuildContext = {\n accessToken,\n accessTokenPayload,\n refreshToken,\n refreshTokenPayload,\n };\n\n // The id_token is minted HERE — after resolveSession — so its `sid`\n // references the real backing session for the reuse branch, the\n // fallback branch, and session-less (federated IdP) codes alike.\n // `auth_time` is the authentication instant captured on the code.\n if (\n authorizationCode.scope &&\n hasOAuth2Scopes(authorizationCode.scope, ScopeName.OPEN_ID)\n ) {\n // The at_hash digest follows the id_token's JWS alg (OIDC Core\n // §3.1.3.6) — the alg of the realm key the openid issuer signs\n // with. The access token above was signed with the same key, so a\n // missing key would already have thrown; this resolves the same\n // active key.\n const key = await this.keyStore.resolveOrCreate(authorizationCode.realm_id, JWKUse.SIGNATURE);\n\n const [idToken] = await this.openIdTokenIssuer.issue({\n sub: authorizationCode.sub \|\| undefined,\n sub_kind: authorizationCode.sub_kind,\n realm_id: authorizationCode.realm_id,\n realm_name: authorizationCode.realm_name,\n scope: authorizationCode.scope \|\| undefined,\n client_id: authorizationCode.client_id \|\| undefined,\n ...(authorizationCode.nonce ? { nonce: authorizationCode.nonce } : {}),\n ...(typeof authorizationCode.auth_time === 'number' ? { auth_time: authorizationCode.auth_time } : {}),\n ...amrAcr,\n sid: session.id,\n at_hash: await buildOAuth2TokenHash(accessToken, key.~~signature_algorithm~~),\n });\n\n buildContext.idToken = idToken;\n }\n\n return buildOAuth2BearerTokenResponse(buildContext);\n }\n\n /\n Reuse the bearer's session when the authorization code was issued from an\n * (interactive) `/authorize` request that carried one — otherwise the\n * interactive login would create a second session (the abandoned bearer\n * session that authenticated `POST /authorize`, plus this one).\n \n The reuse is gated on the session still existing and belonging to the\n * same subject/realm as the code (defense in depth — the id is\n * server-derived from the authenticated bearer, never client input). Any\n * mismatch, or a session-less authorize flow (external IdP, non-interactive\n * clients), falls back to creating a fresh session — preserving prior\n * behavior.\n */\n protected async resolveSession(\n authorizationCode: OAuth2AuthorizationCode,\n options: OAuth2GrantRunWIthOptions,\n ) : Promise<Session> {\n if (authorizationCode.session_id) {\n const existing = await this.sessionManager.findOneById(authorizationCode.session_id);\n if (\n existing &&\n existing.sub === authorizationCode.sub &&\n existing.~~sub_kind~~ === authorizationCode.sub_kind &&\n existing.~~realm_id~~ === authorizationCode.realm_id\n ) {\n existing.~~client_id~~ = authorizationCode.client_id \|\| null;\n\n return this.sessionManager.refresh(existing);\n }\n }\n\n return this.sessionManager.create({\n ~~user_agent~~: options.userAgent,\n ~~ip_address~~: options.ipAddress,\n ~~realm_id~~: authorizationCode.realm_id,\n ~~client_id~~: authorizationCode.client_id,\n ~~sub_kind~~: authorizationCode.sub_kind,\n sub: authorizationCode.sub,\n ~~auth_method~~: authorizationCode.auth_method ?? null,\n });\n }\n}\n"],"mappings":";;;;;;;;;AAmBA,IAAaO,uBAAb,cAA0CF,gBAAAA;CAC5BG;CAEAC;CAEAC;CAEV,YAAYC,KAAkC;EAC1C,MAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;EACxB,CAAA;EAEA,KAAKL,qBAAqBG,IAAIH;EAC9B,KAAKC,oBAAoBE,IAAIF;EAC7B,KAAKC,WAAWC,IAAID;CACxB;CAEA,MAAMI,QACFC,mBACAC,UAAqC,CAAC,GACJ;EAClC,MAAMC,UAAU,MAAM,KAAKC,eAAeH,mBAAmBC,OAAAA;EAK7D,MAAMG,SAASf,aAAaa,OAAAA;EAE5B,MAAMG,eAA6C;GAC/CC,YAAYL,QAAQM;GACpBC,gBAAgBP,QAAQQ;GACxBC,YAAYR,QAAQS;GACpBC,KAAKZ,kBAAkBY,OAAOC,KAAAA;GAC9BC,UAAUd,kBAAkBc;GAC5BC,UAAUf,kBAAkBe;GAC5BC,YAAYhB,kBAAkBgB;GAC9BC,OAAOjB,kBAAkBiB,SAASJ,KAAAA;GAClCK,WAAWlB,kBAAkBkB,aAAaL,KAAAA;GAC1C,GAAIZ,QAAQkB,eAAe,EAAEC,KAAKnB,QAAQkB,aAAa,IAAI,CAAC;GAC5D,GAAGf;EACP;EAEA,MAAM,CAACiB,aAAaC,sBAAsB,MAAM,KAAKzB,kBAAkB0B,MAAMlB,YAAAA;EAC7E,MAAM,CAACmB,cAAcC,uBAAuB,MAAM,KAAKhC,mBAAmB8B,MAAMlB,YAAAA;EAEhF,MAAMqB,eAAkD;GACpDL;GACAC;GACAE;GACAC;EACJ;EAMA,IACIzB,kBAAkBiB,SAClB/B,gBAAgBc,kBAAkBiB,OAAO9B,UAAUwC,OAAO,GAC5D;GAME,MAAMC,MAAM,MAAM,KAAKjC,SAASkC,gBAAgB7B,kBAAkBe,UAAU9B,OAAO6C,SAAS;GAE5F,MAAM,CAACC,WAAW,MAAM,KAAKrC,kBAAkB6B,MAAM;IACjDX,KAAKZ,kBAAkBY,OAAOC,KAAAA;IAC9BC,UAAUd,kBAAkBc;IAC5BC,UAAUf,kBAAkBe;IAC5BC,YAAYhB,kBAAkBgB;IAC9BC,OAAOjB,kBAAkBiB,SAASJ,KAAAA;IAClCK,WAAWlB,kBAAkBkB,aAAaL,KAAAA;IAC1C,GAAIb,kBAAkBgC,QAAQ,EAAEA,OAAOhC,kBAAkBgC,MAAM,IAAI,CAAC;IACpE,GAAI,OAAOhC,kBAAkBiC,cAAc,WAAW,EAAEA,WAAWjC,kBAAkBiC,UAAU,IAAI,CAAC;IACpG,GAAG7B;IACH8B,KAAKhC,QAAQS;IACbwB,SAAS,MAAM/C,qBAAqBiC,aAAaO,IAAIQ,~~mBAAmB~~;~~GAC5E~~,CAAA;GAEAV,aAAaK,UAAUA;EAC3B;EAEA,OAAOxC,+BAA+BmC,YAAAA;CAC1C;;;;;;;;;;;;;IAeA,MAAgBvB,eACZH,mBACAC,SACiB;EACjB,IAAID,kBAAkBU,YAAY;GAC9B,MAAM2B,WAAW,MAAM,KAAKvC,eAAewC,YAAYtC,kBAAkBU,UAAU;GACnF,IACI2B,YACAA,SAASzB,QAAQZ,kBAAkBY,OACnCyB,~~SAASvB~~,~~aAAad~~,kBAAkBc,~~YACxCuB~~,~~SAAStB~~,~~aAAaf~~,kBAAkBe,~~UAC1C~~;IACEsB,~~SAASnB~~,~~YAAYlB~~,kBAAkBkB,aAAa;~~IAEpD~~,OAAO,KAAKpB,~~eAAeyC~~,~~QAAQF~~,QAAAA;GACvC;EACJ;EAEA,OAAO,KAAKvC,~~eAAe0C~~,OAAO;~~GAC9BlC~~,~~YAAYL~~,QAAQM;~~GACpBkC~~,~~YAAYxC~~,QAAQQ;~~GACpBM~~,~~UAAUf~~,kBAAkBe;~~GAC5BG~~,~~WAAWlB~~,kBAAkBkB;~~GAC7BJ~~,~~UAAUd~~,kBAAkBc;~~GAC5BF~~,KAAKZ,kBAAkBY;~~GACvB8B~~,~~aAAa1C~~,~~kBAAkB0C~~,eAAe;~~EAClD~~,CAAA;CACJ;AACJ"}
1	+ {"version":3,"file":"authorize.mjs","names":["JWKUse","hasOAuth2Scopes","ScopeName","buildOAuth2TokenHash","deriveAmrAcr","OAuth2BaseGrant","buildOAuth2BearerTokenResponse","OAuth2AuthorizeGrant","refreshTokenIssuer","openIdTokenIssuer","keyStore","ctx","accessTokenIssuer","sessionManager","runWith","authorizationCode","options","session","resolveSession","amrAcr","issuePayload","user_agent","userAgent","remote_address","ipAddress","session_id","id","sub","undefined","sub_kind","realm_id","realm_name","scope","client_id","confirmation","cnf","accessToken","accessTokenPayload","issue","refreshToken","refreshTokenPayload","buildContext","OPEN_ID","key","resolveOrCreate","SIGNATURE","idToken","nonce","auth_time","sid","at_hash","signatureAlgorithm","existing","findOneById","subKind","realmId","clientId","refresh","create","authMethod","auth_method"],"sources":["../../../../src/core/oauth2/grant-types/authorize.ts"],"sourcesContent":["/\n Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { JWKUse, hasOAuth2Scopes } from '@authup/specs';\nimport type { OAuth2AuthorizationCode, Session } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport { buildOAuth2TokenHash, deriveAmrAcr } from '../authorization/helpers.ts';\nimport type { IKeyStore } from '../../key/index.ts';\nimport type { IOAuth2OpenIDTokenIssuer, IOAuth2TokenIssuer } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport type { IOAuth2Grant, OAuth2AuthorizeGrantContext, OAuth2GrantRunWIthOptions } from './types.ts';\nimport type { OAuth2BearerResponseBuildContext } from '../response/index.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\n\nexport class OAuth2AuthorizeGrant extends OAuth2BaseGrant<OAuth2AuthorizationCode> implements IOAuth2Grant {\n protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n protected openIdTokenIssuer : IOAuth2OpenIDTokenIssuer;\n\n protected keyStore : IKeyStore;\n\n constructor(ctx: OAuth2AuthorizeGrantContext) {\n super({\n accessTokenIssuer: ctx.accessTokenIssuer,\n sessionManager: ctx.sessionManager,\n });\n\n this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n this.openIdTokenIssuer = ctx.openIdTokenIssuer;\n this.keyStore = ctx.keyStore;\n }\n\n async runWith(\n authorizationCode: OAuth2AuthorizationCode,\n options: OAuth2GrantRunWIthOptions = {},\n ) : Promise<OAuth2TokenGrantResponse> {\n const session = await this.resolveSession(authorizationCode, options);\n\n // amr/acr derive from the RESOLVED session (authMethod + mfaAt) —\n // deliberately on every token kind, not only the id_token, so\n // resource servers can read the method without parsing an id_token.\n const amrAcr = deriveAmrAcr(session);\n\n const issuePayload : Partial<OAuth2TokenPayload> = {\n user_agent: options.userAgent,\n remote_address: options.ipAddress,\n session_id: session.id,\n sub: authorizationCode.sub \|\| undefined,\n sub_kind: authorizationCode.sub_kind,\n realm_id: authorizationCode.realm_id,\n realm_name: authorizationCode.realm_name,\n scope: authorizationCode.scope \|\| undefined,\n client_id: authorizationCode.client_id \|\| undefined,\n ...(options.confirmation ? { cnf: options.confirmation } : {}),\n ...amrAcr,\n };\n\n const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);\n const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);\n\n const buildContext : OAuth2BearerResponseBuildContext = {\n accessToken,\n accessTokenPayload,\n refreshToken,\n refreshTokenPayload,\n };\n\n // The id_token is minted HERE — after resolveSession — so its `sid`\n // references the real backing session for the reuse branch, the\n // fallback branch, and session-less (federated IdP) codes alike.\n // `auth_time` is the authentication instant captured on the code.\n if (\n authorizationCode.scope &&\n hasOAuth2Scopes(authorizationCode.scope, ScopeName.OPEN_ID)\n ) {\n // The at_hash digest follows the id_token's JWS alg (OIDC Core\n // §3.1.3.6) — the alg of the realm key the openid issuer signs\n // with. The access token above was signed with the same key, so a\n // missing key would already have thrown; this resolves the same\n // active key.\n const key = await this.keyStore.resolveOrCreate(authorizationCode.realm_id, JWKUse.SIGNATURE);\n\n const [idToken] = await this.openIdTokenIssuer.issue({\n sub: authorizationCode.sub \|\| undefined,\n sub_kind: authorizationCode.sub_kind,\n realm_id: authorizationCode.realm_id,\n realm_name: authorizationCode.realm_name,\n scope: authorizationCode.scope \|\| undefined,\n client_id: authorizationCode.client_id \|\| undefined,\n ...(authorizationCode.nonce ? { nonce: authorizationCode.nonce } : {}),\n ...(typeof authorizationCode.auth_time === 'number' ? { auth_time: authorizationCode.auth_time } : {}),\n ...amrAcr,\n sid: session.id,\n at_hash: await buildOAuth2TokenHash(accessToken, key.signatureAlgorithm),\n });\n\n buildContext.idToken = idToken;\n }\n\n return buildOAuth2BearerTokenResponse(buildContext);\n }\n\n /\n Reuse the bearer's session when the authorization code was issued from an\n * (interactive) `/authorize` request that carried one — otherwise the\n * interactive login would create a second session (the abandoned bearer\n * session that authenticated `POST /authorize`, plus this one).\n \n The reuse is gated on the session still existing and belonging to the\n * same subject/realm as the code (defense in depth — the id is\n * server-derived from the authenticated bearer, never client input). Any\n * mismatch, or a session-less authorize flow (external IdP, non-interactive\n * clients), falls back to creating a fresh session — preserving prior\n * behavior.\n */\n protected async resolveSession(\n authorizationCode: OAuth2AuthorizationCode,\n options: OAuth2GrantRunWIthOptions,\n ) : Promise<Session> {\n if (authorizationCode.session_id) {\n const existing = await this.sessionManager.findOneById(authorizationCode.session_id);\n if (\n existing &&\n existing.sub === authorizationCode.sub &&\n existing.subKind === authorizationCode.sub_kind &&\n existing.realmId === authorizationCode.realm_id\n ) {\n existing.clientId = authorizationCode.client_id \|\| null;\n\n return this.sessionManager.refresh(existing);\n }\n }\n\n return this.sessionManager.create({\n userAgent: options.userAgent,\n ipAddress: options.ipAddress,\n realmId: authorizationCode.realm_id,\n clientId: authorizationCode.client_id,\n subKind: authorizationCode.sub_kind,\n sub: authorizationCode.sub,\n authMethod: authorizationCode.auth_method ?? null,\n });\n }\n}\n"],"mappings":";;;;;;;;;AAmBA,IAAaO,uBAAb,cAA0CF,gBAAAA;CAC5BG;CAEAC;CAEAC;CAEV,YAAYC,KAAkC;EAC1C,MAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;EACxB,CAAA;EAEA,KAAKL,qBAAqBG,IAAIH;EAC9B,KAAKC,oBAAoBE,IAAIF;EAC7B,KAAKC,WAAWC,IAAID;CACxB;CAEA,MAAMI,QACFC,mBACAC,UAAqC,CAAC,GACJ;EAClC,MAAMC,UAAU,MAAM,KAAKC,eAAeH,mBAAmBC,OAAAA;EAK7D,MAAMG,SAASf,aAAaa,OAAAA;EAE5B,MAAMG,eAA6C;GAC/CC,YAAYL,QAAQM;GACpBC,gBAAgBP,QAAQQ;GACxBC,YAAYR,QAAQS;GACpBC,KAAKZ,kBAAkBY,OAAOC,KAAAA;GAC9BC,UAAUd,kBAAkBc;GAC5BC,UAAUf,kBAAkBe;GAC5BC,YAAYhB,kBAAkBgB;GAC9BC,OAAOjB,kBAAkBiB,SAASJ,KAAAA;GAClCK,WAAWlB,kBAAkBkB,aAAaL,KAAAA;GAC1C,GAAIZ,QAAQkB,eAAe,EAAEC,KAAKnB,QAAQkB,aAAa,IAAI,CAAC;GAC5D,GAAGf;EACP;EAEA,MAAM,CAACiB,aAAaC,sBAAsB,MAAM,KAAKzB,kBAAkB0B,MAAMlB,YAAAA;EAC7E,MAAM,CAACmB,cAAcC,uBAAuB,MAAM,KAAKhC,mBAAmB8B,MAAMlB,YAAAA;EAEhF,MAAMqB,eAAkD;GACpDL;GACAC;GACAE;GACAC;EACJ;EAMA,IACIzB,kBAAkBiB,SAClB/B,gBAAgBc,kBAAkBiB,OAAO9B,UAAUwC,OAAO,GAC5D;GAME,MAAMC,MAAM,MAAM,KAAKjC,SAASkC,gBAAgB7B,kBAAkBe,UAAU9B,OAAO6C,SAAS;GAE5F,MAAM,CAACC,WAAW,MAAM,KAAKrC,kBAAkB6B,MAAM;IACjDX,KAAKZ,kBAAkBY,OAAOC,KAAAA;IAC9BC,UAAUd,kBAAkBc;IAC5BC,UAAUf,kBAAkBe;IAC5BC,YAAYhB,kBAAkBgB;IAC9BC,OAAOjB,kBAAkBiB,SAASJ,KAAAA;IAClCK,WAAWlB,kBAAkBkB,aAAaL,KAAAA;IAC1C,GAAIb,kBAAkBgC,QAAQ,EAAEA,OAAOhC,kBAAkBgC,MAAM,IAAI,CAAC;IACpE,GAAI,OAAOhC,kBAAkBiC,cAAc,WAAW,EAAEA,WAAWjC,kBAAkBiC,UAAU,IAAI,CAAC;IACpG,GAAG7B;IACH8B,KAAKhC,QAAQS;IACbwB,SAAS,MAAM/C,qBAAqBiC,aAAaO,IAAIQ,kBAAkB;GAC3E,CAAA;GAEAV,aAAaK,UAAUA;EAC3B;EAEA,OAAOxC,+BAA+BmC,YAAAA;CAC1C;;;;;;;;;;;;;IAeA,MAAgBvB,eACZH,mBACAC,SACiB;EACjB,IAAID,kBAAkBU,YAAY;GAC9B,MAAM2B,WAAW,MAAM,KAAKvC,eAAewC,YAAYtC,kBAAkBU,UAAU;GACnF,IACI2B,YACAA,SAASzB,QAAQZ,kBAAkBY,OACnCyB,SAASE,YAAYvC,kBAAkBc,YACvCuB,SAASG,YAAYxC,kBAAkBe,UACzC;IACEsB,SAASI,WAAWzC,kBAAkBkB,aAAa;IAEnD,OAAO,KAAKpB,eAAe4C,QAAQL,QAAAA;GACvC;EACJ;EAEA,OAAO,KAAKvC,eAAe6C,OAAO;GAC9BpC,WAAWN,QAAQM;GACnBE,WAAWR,QAAQQ;GACnB+B,SAASxC,kBAAkBe;GAC3B0B,UAAUzC,kBAAkBkB;GAC5BqB,SAASvC,kBAAkBc;GAC3BF,KAAKZ,kBAAkBY;GACvBgC,YAAY5C,kBAAkB6C,eAAe;EACjD,CAAA;CACJ;AACJ"}

package/dist/core/oauth2/grant-types/client-credentials.mjs CHANGED Viewed

@@ -9,16 +9,16 @@ import { OAuth2SubKind } from "@authup/specs";
 var ClientCredentialsGrant = class extends OAuth2BaseGrant {
 	async runWith(input, options = {}) {
 		const session = await this.sessionManager.create({
-			user_agent: options.userAgent,
-			ip_address: options.ipAddress,
-			realm_id: input.realm_id,
+			userAgent: options.userAgent,
+			ipAddress: options.ipAddress,
+			realmId: input.realmId,
 			sub: input.id,
-			sub_kind: IdentityType.CLIENT,
-			auth_method: SessionAuthMethod.CLIENT
+			subKind: IdentityType.CLIENT,
+			authMethod: SessionAuthMethod.CLIENT
 		});
 		const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({
-			user_agent: session.user_agent,
-			remote_address: session.ip_address,
+			user_agent: session.userAgent,
+			remote_address: session.ipAddress,
 			session_id: session.id,
 			scope: ScopeName.GLOBAL,
 			sub: input.id,

package/dist/core/oauth2/grant-types/client-credentials.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"client-credentials.mjs","names":["OAuth2SubKind","IdentityType","ScopeName","SessionAuthMethod","OAuth2BaseGrant","buildOAuth2BearerTokenResponse","ClientCredentialsGrant","runWith","input","options","session","sessionManager","create","~~user_agent","~~userAgent","~~ip_address","~~ipAddress","~~realm_id~~","sub","id","~~sub_kind~~","CLIENT","~~auth_method~~","accessToken","accessTokenPayload","accessTokenIssuer","issue","remote_address","session_id","scope","GLOBAL","realm","realm_name","name","client_id","confirmation","cnf"],"sources":["../../../../src/core/oauth2/grant-types/client-credentials.ts"],"sourcesContent":["/\n Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2SubKind } from '@authup/specs';\nimport type { Client } from '@authup/core-kit';\nimport {\n IdentityType,\n ScopeName, \n SessionAuthMethod,\n} from '@authup/core-kit';\nimport { OAuth2BaseGrant } from './base.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { OAuth2GrantRunWIthOptions } from './types.ts';\n\nexport class ClientCredentialsGrant extends OAuth2BaseGrant<Client> {\n async runWith(input: Client, options: OAuth2GrantRunWIthOptions = {}) : Promise<OAuth2TokenGrantResponse> {\n const session = await this.sessionManager.create({\n ~~user_agent~~: options.userAgent,\n ~~ip_address~~: options.ipAddress,\n ~~realm_id~~: input.~~realm_id~~,\n sub: input.id,\n ~~sub_kind~~: IdentityType.CLIENT,\n ~~auth_method~~: SessionAuthMethod.CLIENT,\n });\n\n const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({\n user_agent: session.~~user_agent~~,\n remote_address: session.~~ip_address~~,\n session_id: session.id,\n scope: ScopeName.GLOBAL,\n sub: input.id,\n sub_kind: OAuth2SubKind.CLIENT,\n realm_id: input.realm.id,\n realm_name: input.realm.name,\n client_id: input.id,\n ...(options.confirmation ? { cnf: options.confirmation } : {}),\n });\n\n return buildOAuth2BearerTokenResponse({\n accessToken,\n accessTokenPayload,\n });\n }\n}\n"],"mappings":";;;;;;;;AAmBA,IAAaM,yBAAb,cAA4CF,gBAAAA;CACxC,MAAMG,QAAQC,OAAeC,UAAqC,CAAC,GAAuC;EACtG,MAAMC,UAAU,MAAM,KAAKC,eAAeC,OAAO;GAC7CC,~~YAAYJ~~,~~QAAQK~~;~~GACpBC~~,~~YAAYN~~,~~QAAQO~~;~~GACpBC~~,~~UAAUT~~,~~MAAMS~~;~~GAChBC~~,~~KAAKV~~,~~MAAMW~~;GACXC,~~UAAUnB~~,~~aAAaoB~~;~~GACvBC~~,~~aAAanB~~,~~kBAAkBkB~~;~~EACnC~~,CAAA;EAEA,MAAM,CAACE,aAAaC,sBAAsB,MAAM,KAAKC,kBAAkBC,MAAM;~~GACzEb~~,~~YAAYH~~,QAAQG;~~GACpBc~~,~~gBAAgBjB~~,~~QAAQK~~;GACxBa,~~YAAYlB~~,~~QAAQS~~;~~GACpBU~~,~~OAAO3B~~,~~UAAU4B~~;~~GACjBZ~~,~~KAAKV~~,~~MAAMW~~;~~GACXC~~,~~UAAUpB~~,~~cAAcqB~~;~~GACxBJ~~,~~UAAUT~~,~~MAAMuB~~,~~MAAMZ~~;~~GACtBa~~,~~YAAYxB~~,~~MAAMuB~~,MAAME;GACxBC,~~WAAW1B~~,~~MAAMW~~;GACjB,~~GAAIV~~,~~QAAQ0B~~,eAAe,EAAEC,~~KAAK3B~~,~~QAAQ0B~~,aAAa,IAAI,CAAC;EAChE,CAAA;EAEA,~~OAAO9B~~,+BAA+B;~~GAClCkB~~;GACAC;EACJ,CAAA;CACJ;AACJ"}
1	+ {"version":3,"file":"client-credentials.mjs","names":["OAuth2SubKind","IdentityType","ScopeName","SessionAuthMethod","OAuth2BaseGrant","buildOAuth2BearerTokenResponse","ClientCredentialsGrant","runWith","input","options","session","sessionManager","create","userAgent","ipAddress","realmId","sub","id","subKind","CLIENT","authMethod","accessToken","accessTokenPayload","accessTokenIssuer","issue","user_agent","remote_address","session_id","scope","GLOBAL","sub_kind","realm_id","realm","realm_name","name","client_id","confirmation","cnf"],"sources":["../../../../src/core/oauth2/grant-types/client-credentials.ts"],"sourcesContent":["/\n Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2SubKind } from '@authup/specs';\nimport type { Client } from '@authup/core-kit';\nimport {\n IdentityType,\n ScopeName, \n SessionAuthMethod,\n} from '@authup/core-kit';\nimport { OAuth2BaseGrant } from './base.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { OAuth2GrantRunWIthOptions } from './types.ts';\n\nexport class ClientCredentialsGrant extends OAuth2BaseGrant<Client> {\n async runWith(input: Client, options: OAuth2GrantRunWIthOptions = {}) : Promise<OAuth2TokenGrantResponse> {\n const session = await this.sessionManager.create({\n userAgent: options.userAgent,\n ipAddress: options.ipAddress,\n realmId: input.realmId,\n sub: input.id,\n subKind: IdentityType.CLIENT,\n authMethod: SessionAuthMethod.CLIENT,\n });\n\n const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({\n user_agent: session.userAgent,\n remote_address: session.ipAddress,\n session_id: session.id,\n scope: ScopeName.GLOBAL,\n sub: input.id,\n sub_kind: OAuth2SubKind.CLIENT,\n realm_id: input.realm.id,\n realm_name: input.realm.name,\n client_id: input.id,\n ...(options.confirmation ? { cnf: options.confirmation } : {}),\n });\n\n return buildOAuth2BearerTokenResponse({\n accessToken,\n accessTokenPayload,\n });\n }\n}\n"],"mappings":";;;;;;;;AAmBA,IAAaM,yBAAb,cAA4CF,gBAAAA;CACxC,MAAMG,QAAQC,OAAeC,UAAqC,CAAC,GAAuC;EACtG,MAAMC,UAAU,MAAM,KAAKC,eAAeC,OAAO;GAC7CC,WAAWJ,QAAQI;GACnBC,WAAWL,QAAQK;GACnBC,SAASP,MAAMO;GACfC,KAAKR,MAAMS;GACXC,SAASjB,aAAakB;GACtBC,YAAYjB,kBAAkBgB;EAClC,CAAA;EAEA,MAAM,CAACE,aAAaC,sBAAsB,MAAM,KAAKC,kBAAkBC,MAAM;GACzEC,YAAYf,QAAQG;GACpBa,gBAAgBhB,QAAQI;GACxBa,YAAYjB,QAAQO;GACpBW,OAAO1B,UAAU2B;GACjBb,KAAKR,MAAMS;GACXa,UAAU9B,cAAcmB;GACxBY,UAAUvB,MAAMwB,MAAMf;GACtBgB,YAAYzB,MAAMwB,MAAME;GACxBC,WAAW3B,MAAMS;GACjB,GAAIR,QAAQ2B,eAAe,EAAEC,KAAK5B,QAAQ2B,aAAa,IAAI,CAAC;EAChE,CAAA;EAEA,OAAO/B,+BAA+B;GAClCgB;GACAC;EACJ,CAAA;CACJ;AACJ"}