npm - @authup/server-core - Versions diffs - 1.0.0-beta.53 → 1.0.0-beta.55 - Mend

@authup/server-core 1.0.0-beta.53 → 1.0.0-beta.55

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1255) hide show

package/dist/adapters/http/controllers/workflows/jwks/handlers/read.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"read.mjs","names":["KeyStatus","AsymmetricKey","JWKError","JWKType","JWKUse","In","buildCertificateJwkFields","getJwksRouteHandler","repository","realmId","entities","find","where","type","RSA","EC","use","SIGNATURE","status","ACTIVE","PASSIVE","~~realm_id","~~order","priority","promises","filter","entity","~~encryption_key~~","~~signature_algorithm~~","map","fromBase64","format","key","options","buildImportOptionsForJWTAlgorithm","then","container","toJWK","certificateFields","certificate","kid","id","alg","keys","Promise","all","getJwkRouteHandler","keyId","findOne","notFound","encryptionKeyMissing","jsonWebKey"],"sources":["../../../../../../../src/adapters/http/controllers/workflows/jwks/handlers/read.ts"],"sourcesContent":["/\n Copyright (c) 2022-2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { KeyStatus } from '@authup/core-kit';\nimport { AsymmetricKey } from '@authup/server-kit';\nimport type { JWTAlgorithm, OAuth2JsonWebKey } from '@authup/specs';\nimport { JWKError, JWKType, JWKUse } from '@authup/specs';\nimport type { Repository } from 'typeorm';\nimport { In } from 'typeorm';\nimport type { KeyEntity } from '../../../../../database/domains/index.ts';\nimport { buildCertificateJwkFields } from '../../../../../../core/index.ts';\n\nexport async function getJwksRouteHandler(\n repository: Repository<KeyEntity>,\n realmId?: string,\n) : Promise<{ keys: OAuth2JsonWebKey[] }> {\n const entities = await repository.find({\n where: {\n type: In([JWKType.RSA, JWKType.EC]),\n use: JWKUse.SIGNATURE,\n // active + passive verify; disabled keys never publish.\n status: In([KeyStatus.ACTIVE, KeyStatus.PASSIVE]),\n ...(realmId ? { ~~realm_id:~~ realmId } : {}),\n },\n order: { priority: 'DESC' },\n });\n\n const promises = entities\n .filter(\n (entity): entity is KeyEntity & { ~~encryption_key~~: string, ~~signature_algorithm~~: `${JWTAlgorithm}` } => !!entity.~~encryption_key~~ &&\n !!entity.~~signature_algorithm~~,\n )\n .map(\n (entity) => AsymmetricKey\n .fromBase64({\n format: 'spki',\n key: entity.~~encryption_key~~,\n options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.~~signature_algorithm~~),\n })\n .then((container) => container.toJWK())\n .then(async (key) => {\n const certificateFields = await buildCertificateJwkFields(entity.certificate);\n\n return {\n ...key,\n kid: entity.id,\n alg: entity.~~signature_algorithm~~,\n ...certificateFields,\n };\n }),\n );\n\n const keys = await Promise.all(promises);\n\n return { keys };\n}\n\nexport async function getJwkRouteHandler(\n repository: Repository<KeyEntity>,\n keyId: string,\n realmId?: string,\n) : Promise<OAuth2JsonWebKey> {\n const entity = await repository.findOne({\n where: {\n type: In([JWKType.RSA, JWKType.EC]),\n use: JWKUse.SIGNATURE,\n status: In([KeyStatus.ACTIVE, KeyStatus.PASSIVE]),\n id: keyId,\n ...(realmId ? { ~~realm_id:~~ realmId } : {}),\n },\n });\n\n if (!entity) {\n throw JWKError.notFound(keyId);\n }\n\n if (!entity.~~encryption_key~~ \|\| !entity.~~signature_algorithm~~) {\n throw JWKError.encryptionKeyMissing();\n }\n\n const container = await AsymmetricKey\n .fromBase64({\n format: 'spki',\n key: entity.~~encryption_key~~,\n options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.~~signature_algorithm~~),\n });\n\n const jsonWebKey = await container.toJWK();\n const certificateFields = await buildCertificateJwkFields(entity.certificate);\n\n return {\n ...jsonWebKey,\n kid: entity.id,\n alg: entity.~~signature_algorithm~~,\n ...certificateFields,\n };\n}\n"],"mappings":";;;;;;;;;;AAgBA,eAAsBO,oBAClBC,YACAC,SAAgB;CAahB,~~MAAMe~~,~~YAAWd~~,MAXMF,WAAWG,KAAK;EACnCC,OAAO;GACHC,MAAMR,GAAG,CAACF,QAAQW,KAAKX,QAAQY,~~EAAAA~~,~~CAAG~~;GAClCC,KAAKZ,OAAOa;GAEZC,QAAQb,GAAG,CAACL,UAAUmB,QAAQnB,UAAUoB,~~OAAAA~~,~~CAAQ~~;GAChD,GAAIX,UAAU,~~EAAEY~~,~~UAAUZ,~~QAAQ,IAAI,CAAC;~~EAC3C~~;~~EACAa~~,OAAO,EAAEC,UAAU,OAAO;CAC9B,CAAA,EAAA,CAGKE,QACIC,~~WAAqG~~,CAAC,CAACA,OAAOC,~~kBAC3G~~,CAAC,CAACD,OAAOE,~~mBAAmB~~,CAAA,~~CAEnCC~~,KACIH,~~WAAWzB~~,~~cACP6B~~,WAAW;EACRC,QAAQ;EACRC,KAAKN,OAAOC;EACZM,~~SAAShC~~,~~cAAciC~~,kCAAkCR,OAAOE,~~mBAAmB~~;~~CACvF~~,CAAA,CAAA,CACCO,MAAMC,cAAcA,UAAUC,MAAK,CAAA,CAAA,CACnCF,KAAK,OAAOH,QAAAA;EACT,MAAMM,oBAAoB,~~MAAMhC~~,~~0BAA0BoB~~,OAAOa,WAAW;EAE5E,OAAO;GACH,GAAGP;GACHQ,KAAKd,OAAOe;GACZC,KAAKhB,OAAOE;GACZ,GAAGU;EACP;CACJ,CAAA,CAAA;CAKZ,OAAO,EAAEK,MAAAA,MAFUC,QAAQC,IAAIrB,QAAAA,EAEjB;AAClB;AAEA,eAAsBsB,~~mBAClBtC~~,~~YACAuC~~,~~OACAtC~~,SAAgB;CAEhB,~~MAAMiB~~,SAAS,~~MAAMlB~~,~~WAAWwC~~,QAAQ,~~EACpCpC~~,OAAO;EACHC,MAAMR,GAAG,CAACF,QAAQW,KAAKX,QAAQY,~~EAAAA~~,~~CAAG~~;EAClCC,KAAKZ,OAAOa;EACZC,QAAQb,GAAG,CAACL,UAAUmB,QAAQnB,UAAUoB,~~OAAAA~~,~~CAAQ~~;~~EAChDqB~~,IAAIM;EACJ,~~GAAItC~~,UAAU,~~EAAEY~~,~~UAAUZ,~~QAAQ,IAAI,CAAC;~~CAC3C~~,EACJ,CAAA;CAEA,IAAI,~~CAACiB~~,QACD,~~MAAMxB~~,~~SAAS+C~~,SAASF,KAAAA;CAG5B,IAAI,CAACrB,OAAOC,~~kBAAkB~~,CAACD,OAAOE,~~qBAClC~~,~~MAAM1B~~,~~SAASgD~~,qBAAoB;CAUvC,MAAMC,aAAa,OAAMf,~~MAPDnC~~,~~cACnB6B~~,WAAW;EACRC,QAAQ;EACRC,KAAKN,OAAOC;EACZM,~~SAAShC~~,~~cAAciC~~,kCAAkCR,OAAOE,~~mBAAmB~~;~~CACvF~~,CAAA,EAAA,CAE+BS,MAAK;CACxC,MAAMC,oBAAoB,~~MAAMhC~~,~~0BAA0BoB~~,OAAOa,WAAW;CAE5E,OAAO;EACH,GAAGY;EACHX,KAAKd,OAAOe;EACZC,KAAKhB,OAAOE;EACZ,GAAGU;CACP;AACJ"}
1	+ {"version":3,"file":"read.mjs","names":["KeyStatus","AsymmetricKey","JWKError","JWKType","JWKUse","In","buildCertificateJwkFields","getJwksRouteHandler","repository","realmId","entities","find","where","type","RSA","EC","use","SIGNATURE","status","ACTIVE","PASSIVE","order","priority","promises","filter","entity","encryptionKey","signatureAlgorithm","map","fromBase64","format","key","options","buildImportOptionsForJWTAlgorithm","then","container","toJWK","certificateFields","certificate","kid","id","alg","keys","Promise","all","getJwkRouteHandler","keyId","findOne","notFound","encryptionKeyMissing","jsonWebKey"],"sources":["../../../../../../../src/adapters/http/controllers/workflows/jwks/handlers/read.ts"],"sourcesContent":["/\n Copyright (c) 2022-2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { KeyStatus } from '@authup/core-kit';\nimport { AsymmetricKey } from '@authup/server-kit';\nimport type { JWTAlgorithm, OAuth2JsonWebKey } from '@authup/specs';\nimport { JWKError, JWKType, JWKUse } from '@authup/specs';\nimport type { Repository } from 'typeorm';\nimport { In } from 'typeorm';\nimport type { KeyEntity } from '../../../../../database/domains/index.ts';\nimport { buildCertificateJwkFields } from '../../../../../../core/index.ts';\n\nexport async function getJwksRouteHandler(\n repository: Repository<KeyEntity>,\n realmId?: string,\n) : Promise<{ keys: OAuth2JsonWebKey[] }> {\n const entities = await repository.find({\n where: {\n type: In([JWKType.RSA, JWKType.EC]),\n use: JWKUse.SIGNATURE,\n // active + passive verify; disabled keys never publish.\n status: In([KeyStatus.ACTIVE, KeyStatus.PASSIVE]),\n ...(realmId ? { realmId } : {}),\n },\n order: { priority: 'DESC' },\n });\n\n const promises = entities\n .filter(\n (entity): entity is KeyEntity & { encryptionKey: string, signatureAlgorithm: `${JWTAlgorithm}` } => !!entity.encryptionKey &&\n !!entity.signatureAlgorithm,\n )\n .map(\n (entity) => AsymmetricKey\n .fromBase64({\n format: 'spki',\n key: entity.encryptionKey,\n options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signatureAlgorithm),\n })\n .then((container) => container.toJWK())\n .then(async (key) => {\n const certificateFields = await buildCertificateJwkFields(entity.certificate);\n\n return {\n ...key,\n kid: entity.id,\n alg: entity.signatureAlgorithm,\n ...certificateFields,\n };\n }),\n );\n\n const keys = await Promise.all(promises);\n\n return { keys };\n}\n\nexport async function getJwkRouteHandler(\n repository: Repository<KeyEntity>,\n keyId: string,\n realmId?: string,\n) : Promise<OAuth2JsonWebKey> {\n const entity = await repository.findOne({\n where: {\n type: In([JWKType.RSA, JWKType.EC]),\n use: JWKUse.SIGNATURE,\n status: In([KeyStatus.ACTIVE, KeyStatus.PASSIVE]),\n id: keyId,\n ...(realmId ? { realmId } : {}),\n },\n });\n\n if (!entity) {\n throw JWKError.notFound(keyId);\n }\n\n if (!entity.encryptionKey \|\| !entity.signatureAlgorithm) {\n throw JWKError.encryptionKeyMissing();\n }\n\n const container = await AsymmetricKey\n .fromBase64({\n format: 'spki',\n key: entity.encryptionKey,\n options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signatureAlgorithm),\n });\n\n const jsonWebKey = await container.toJWK();\n const certificateFields = await buildCertificateJwkFields(entity.certificate);\n\n return {\n ...jsonWebKey,\n kid: entity.id,\n alg: entity.signatureAlgorithm,\n ...certificateFields,\n };\n}\n"],"mappings":";;;;;;;;;;AAgBA,eAAsBO,oBAClBC,YACAC,SAAgB;CAahB,MAAMc,YAAWb,MAXMF,WAAWG,KAAK;EACnCC,OAAO;GACHC,MAAMR,GAAG,CAACF,QAAQW,KAAKX,QAAQY,EAAG,CAAA;GAClCC,KAAKZ,OAAOa;GAEZC,QAAQb,GAAG,CAACL,UAAUmB,QAAQnB,UAAUoB,OAAQ,CAAA;GAChD,GAAIX,UAAU,EAAEA,QAAQ,IAAI,CAAC;EACjC;EACAY,OAAO,EAAEC,UAAU,OAAO;CAC9B,CAAA,EAAA,CAGKE,QACIC,WAAmG,CAAC,CAACA,OAAOC,iBACzG,CAAC,CAACD,OAAOE,kBAAkB,CAAA,CAElCC,KACIH,WAAWxB,cACP4B,WAAW;EACRC,QAAQ;EACRC,KAAKN,OAAOC;EACZM,SAAS/B,cAAcgC,kCAAkCR,OAAOE,kBAAkB;CACtF,CAAA,CAAA,CACCO,MAAMC,cAAcA,UAAUC,MAAK,CAAA,CAAA,CACnCF,KAAK,OAAOH,QAAAA;EACT,MAAMM,oBAAoB,MAAM/B,0BAA0BmB,OAAOa,WAAW;EAE5E,OAAO;GACH,GAAGP;GACHQ,KAAKd,OAAOe;GACZC,KAAKhB,OAAOE;GACZ,GAAGU;EACP;CACJ,CAAA,CAAA;CAKZ,OAAO,EAAEK,MAAAA,MAFUC,QAAQC,IAAIrB,QAAAA,EAEjB;AAClB;AAEA,eAAsBsB,mBAClBrC,YACAsC,OACArC,SAAgB;CAEhB,MAAMgB,SAAS,MAAMjB,WAAWuC,QAAQ,EACpCnC,OAAO;EACHC,MAAMR,GAAG,CAACF,QAAQW,KAAKX,QAAQY,EAAG,CAAA;EAClCC,KAAKZ,OAAOa;EACZC,QAAQb,GAAG,CAACL,UAAUmB,QAAQnB,UAAUoB,OAAQ,CAAA;EAChDoB,IAAIM;EACJ,GAAIrC,UAAU,EAAEA,QAAQ,IAAI,CAAC;CACjC,EACJ,CAAA;CAEA,IAAI,CAACgB,QACD,MAAMvB,SAAS8C,SAASF,KAAAA;CAG5B,IAAI,CAACrB,OAAOC,iBAAiB,CAACD,OAAOE,oBACjC,MAAMzB,SAAS+C,qBAAoB;CAUvC,MAAMC,aAAa,OAAMf,MAPDlC,cACnB4B,WAAW;EACRC,QAAQ;EACRC,KAAKN,OAAOC;EACZM,SAAS/B,cAAcgC,kCAAkCR,OAAOE,kBAAkB;CACtF,CAAA,EAAA,CAE+BS,MAAK;CACxC,MAAMC,oBAAoB,MAAM/B,0BAA0BmB,OAAOa,WAAW;CAE5E,OAAO;EACH,GAAGY;EACHX,KAAKd,OAAOe;EACZC,KAAKhB,OAAOE;EACZ,GAAGU;CACP;AACJ"}

package/dist/adapters/http/controllers/workflows/jwks/module.mjs CHANGED Viewed

@@ -17,8 +17,8 @@ function _ts_decorate(decorators, target, key, desc) {
 	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
 	return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-function _ts_metadata(k, v) {
-	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+function _ts_metadata(metadataKey, metadataValue) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(metadataKey, metadataValue);
 }
 function _ts_param(paramIndex, decorator) {
 	return function(target, key) {
@@ -37,19 +37,19 @@ var JwkController = class {
 				type: In([JWKType.RSA, JWKType.EC]),
 				use: JWKUse.SIGNATURE,
 				status: In([KeyStatus.ACTIVE, KeyStatus.PASSIVE]),
-				...realmId ? { realm_id: realmId } : {}
+				...realmId ? { realmId } : {}
 			},
 			order: { priority: "DESC" }
-		})).filter((entity) => !!entity.encryption_key && !!entity.signature_algorithm).map((entity) => AsymmetricKey.fromBase64({
+		})).filter((entity) => !!entity.encryptionKey && !!entity.signatureAlgorithm).map((entity) => AsymmetricKey.fromBase64({
 			format: "spki",
-			key: entity.encryption_key,
-			options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signature_algorithm)
+			key: entity.encryptionKey,
+			options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signatureAlgorithm)
 		}).then((container) => container.toJWK()).then(async (key) => {
 			const certificateFields = await buildCertificateJwkFields(entity.certificate);
 			return {
 				...key,
 				kid: entity.id,
-				alg: entity.signature_algorithm,
+				alg: entity.signatureAlgorithm,
 				...certificateFields
 			};
 		}));
@@ -63,17 +63,17 @@ var JwkController = class {
 			id
 		} });
 		if (!entity) throw JWKError.notFound(id);
-		if (!entity.encryption_key || !entity.signature_algorithm) throw JWKError.encryptionKeyMissing();
+		if (!entity.encryptionKey || !entity.signatureAlgorithm) throw JWKError.encryptionKeyMissing();
 		const jsonWebKey = await (await AsymmetricKey.fromBase64({
 			format: "spki",
-			key: entity.encryption_key,
-			options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signature_algorithm)
+			key: entity.encryptionKey,
+			options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signatureAlgorithm)
 		})).toJWK();
 		const certificateFields = await buildCertificateJwkFields(entity.certificate);
 		return {
 			...jsonWebKey,
 			kid: entity.id,
-			alg: entity.signature_algorithm,
+			alg: entity.signatureAlgorithm,
 			...certificateFields
 		};
 	}

package/dist/adapters/http/controllers/workflows/jwks/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["KeyStatus","JWKError","JWKType","JWKUse","AsymmetricKey","DContext","DController","DGet","DPath","In","buildCertificateJwkFields","getRequestStringParam","JwkController","repository","ctx","getManyJwks","event","realmId","entities","find","where","type","RSA","EC","use","SIGNATURE","status","ACTIVE","PASSIVE","~~realm_id","~~order","priority","promises","filter","entity","~~encryption_key~~","~~signature_algorithm~~","map","fromBase64","format","key","options","buildImportOptionsForJWTAlgorithm","then","container","toJWK","certificateFields","certificate","kid","id","alg","keys","Promise","all","getOneJwks","findOne","notFound","encryptionKeyMissing","jsonWebKey"],"sources":["../../../../../../src/adapters/http/controllers/workflows/jwks/module.ts"],"sourcesContent":["/\n Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { KeyStatus } from '@authup/core-kit';\nimport type { JWTAlgorithm, OAuth2JsonWebKey } from '@authup/specs';\nimport { JWKError, JWKType, JWKUse } from '@authup/specs';\nimport { AsymmetricKey } from '@authup/server-kit';\nimport {\n DContext,\n DController,\n DGet,\n DPath,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport type { Repository } from 'typeorm';\nimport { In } from 'typeorm';\nimport type { KeyEntity } from '../../../../database/domains/index.ts';\nimport { buildCertificateJwkFields } from '../../../../../core/index.ts';\nimport { getRequestStringParam } from '../../../request/index.ts';\n\nexport type JwkControllerContext = {\n repository: Repository<KeyEntity>\n};\n\n@DController('')\nexport class JwkController {\n protected repository: Repository<KeyEntity>;\n\n constructor(ctx: JwkControllerContext) {\n this.repository = ctx.repository;\n }\n\n @DGet('/jwks', [])\n async getManyJwks(\n @DContext() event: IAppEvent,\n ): Promise<{ keys: OAuth2JsonWebKey[] }> {\n const realmId = getRequestStringParam(event, 'realmId');\n\n const entities = await this.repository.find({\n where: {\n type: In([JWKType.RSA, JWKType.EC]),\n use: JWKUse.SIGNATURE,\n // active + passive verify; disabled keys never publish.\n status: In([KeyStatus.ACTIVE, KeyStatus.PASSIVE]),\n ...(realmId ? { ~~realm_id:~~ realmId } : {}),\n },\n order: { priority: 'DESC' },\n });\n\n const promises = entities\n .filter(\n (entity): entity is KeyEntity & { ~~encryption_key~~: string, ~~signature_algorithm~~: `${JWTAlgorithm}` } => !!entity.~~encryption_key~~ &&\n !!entity.~~signature_algorithm~~,\n )\n .map(\n (entity) => AsymmetricKey\n .fromBase64({\n format: 'spki',\n key: entity.~~encryption_key~~,\n options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.~~signature_algorithm~~),\n })\n .then((container) => container.toJWK())\n .then(async (key) => {\n const certificateFields = await buildCertificateJwkFields(entity.certificate);\n\n return {\n ...key,\n kid: entity.id,\n alg: entity.~~signature_algorithm~~,\n ...certificateFields,\n };\n }),\n );\n\n const keys = await Promise.all(promises);\n\n return { keys };\n }\n\n @DGet('/jwks/:id', [])\n async getOneJwks(@DPath('id') id: string): Promise<OAuth2JsonWebKey> {\n const entity = await this.repository.findOne({\n where: {\n type: In([JWKType.RSA, JWKType.EC]),\n use: JWKUse.SIGNATURE,\n status: In([KeyStatus.ACTIVE, KeyStatus.PASSIVE]),\n id,\n },\n });\n\n if (!entity) {\n throw JWKError.notFound(id);\n }\n\n if (!entity.~~encryption_key~~ \|\| !entity.~~signature_algorithm~~) {\n throw JWKError.encryptionKeyMissing();\n }\n\n const container = await AsymmetricKey\n .fromBase64({\n format: 'spki',\n key: entity.~~encryption_key~~,\n options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.~~signature_algorithm~~),\n });\n\n const jsonWebKey = await container.toJWK();\n const certificateFields = await buildCertificateJwkFields(entity.certificate);\n\n return {\n ...jsonWebKey,\n kid: entity.id,\n alg: entity.~~signature_algorithm~~,\n ...certificateFields,\n };\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,IAAaY,gBAAb,MAAaA;CACCC;CAEV,YAAYC,KAA2B;EACnC,KAAKD,aAAaC,IAAID;CAC1B;CAEA,MACME,YACF,OACqC;EACrC,MAAME,UAAUN,sBAAsBK,OAAO,SAAA;EAa7C,~~MAAMgB~~,~~YAAWd~~,MAXM,KAAKL,WAAWM,KAAK;GACxCC,OAAO;IACHC,MAAMZ,GAAG,CAACP,QAAQoB,KAAKpB,QAAQqB,~~EAAAA~~,~~CAAG~~;IAClCC,KAAKrB,OAAOsB;IAEZC,QAAQjB,GAAG,CAACT,UAAU2B,QAAQ3B,UAAU4B,~~OAAAA~~,~~CAAQ~~;IAChD,GAAIX,UAAU,~~EAAEY~~,~~UAAUZ,~~QAAQ,IAAI,CAAC;~~GAC3C~~;~~GACAa~~,OAAO,EAAEC,UAAU,OAAO;EAC9B,CAAA,EAAA,CAGKE,QACIC,~~WAAqG~~,CAAC,CAACA,OAAOC,~~kBAC3G~~,CAAC,CAACD,OAAOE,~~mBAAmB~~,CAAA,~~CAEnCC~~,KACIH,~~WAAW9B~~,~~cACPkC~~,WAAW;GACRC,QAAQ;GACRC,KAAKN,OAAOC;GACZM,~~SAASrC~~,~~cAAcsC~~,kCAAkCR,OAAOE,~~mBAAmB~~;~~EACvF~~,CAAA,CAAA,CACCO,MAAMC,cAAcA,UAAUC,MAAK,CAAA,CAAA,CACnCF,KAAK,OAAOH,QAAAA;GACT,MAAMM,oBAAoB,~~MAAMpC~~,~~0BAA0BwB~~,OAAOa,WAAW;GAE5E,OAAO;IACH,GAAGP;IACHQ,KAAKd,OAAOe;IACZC,KAAKhB,OAAOE;IACZ,GAAGU;GACP;EACJ,CAAA,CAAA;EAKZ,OAAO,EAAEK,MAAAA,MAFUC,QAAQC,IAAIrB,QAAAA,EAEjB;CAClB;CAEA,MACMsB,WAAW,IAAoD;EACjE,MAAMpB,SAAS,MAAM,~~KAAKrB~~,~~WAAW0C~~,QAAQ,~~EACzCnC~~,OAAO;GACHC,MAAMZ,GAAG,CAACP,QAAQoB,KAAKpB,QAAQqB,~~EAAAA~~,~~CAAG~~;GAClCC,KAAKrB,OAAOsB;GACZC,QAAQjB,GAAG,CAACT,UAAU2B,QAAQ3B,UAAU4B,~~OAAAA~~,~~CAAQ~~;~~GAChDqB~~;EACJ,EACJ,CAAA;EAEA,IAAI,CAACf,QACD,~~MAAMjC~~,~~SAASuD~~,SAASP,EAAAA;EAG5B,IAAI,CAACf,OAAOC,~~kBAAkB~~,CAACD,OAAOE,~~qBAClC~~,~~MAAMnC~~,~~SAASwD~~,qBAAoB;EAUvC,MAAMC,aAAa,OAAMd,~~MAPDxC~~,~~cACnBkC~~,WAAW;GACRC,QAAQ;GACRC,KAAKN,OAAOC;GACZM,~~SAASrC~~,~~cAAcsC~~,kCAAkCR,OAAOE,~~mBAAmB~~;~~EACvF~~,CAAA,EAAA,CAE+BS,MAAK;EACxC,MAAMC,oBAAoB,~~MAAMpC~~,~~0BAA0BwB~~,OAAOa,WAAW;EAE5E,OAAO;GACH,GAAGW;GACHV,KAAKd,OAAOe;GACZC,KAAKhB,OAAOE;GACZ,GAAGU;EACP;CACJ;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["KeyStatus","JWKError","JWKType","JWKUse","AsymmetricKey","DContext","DController","DGet","DPath","In","buildCertificateJwkFields","getRequestStringParam","JwkController","repository","ctx","getManyJwks","event","realmId","entities","find","where","type","RSA","EC","use","SIGNATURE","status","ACTIVE","PASSIVE","order","priority","promises","filter","entity","encryptionKey","signatureAlgorithm","map","fromBase64","format","key","options","buildImportOptionsForJWTAlgorithm","then","container","toJWK","certificateFields","certificate","kid","id","alg","keys","Promise","all","getOneJwks","findOne","notFound","encryptionKeyMissing","jsonWebKey"],"sources":["../../../../../../src/adapters/http/controllers/workflows/jwks/module.ts"],"sourcesContent":["/\n Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { KeyStatus } from '@authup/core-kit';\nimport type { JWTAlgorithm, OAuth2JsonWebKey } from '@authup/specs';\nimport { JWKError, JWKType, JWKUse } from '@authup/specs';\nimport { AsymmetricKey } from '@authup/server-kit';\nimport {\n DContext,\n DController,\n DGet,\n DPath,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport type { Repository } from 'typeorm';\nimport { In } from 'typeorm';\nimport type { KeyEntity } from '../../../../database/domains/index.ts';\nimport { buildCertificateJwkFields } from '../../../../../core/index.ts';\nimport { getRequestStringParam } from '../../../request/index.ts';\n\nexport type JwkControllerContext = {\n repository: Repository<KeyEntity>\n};\n\n@DController('')\nexport class JwkController {\n protected repository: Repository<KeyEntity>;\n\n constructor(ctx: JwkControllerContext) {\n this.repository = ctx.repository;\n }\n\n @DGet('/jwks', [])\n async getManyJwks(\n @DContext() event: IAppEvent,\n ): Promise<{ keys: OAuth2JsonWebKey[] }> {\n const realmId = getRequestStringParam(event, 'realmId');\n\n const entities = await this.repository.find({\n where: {\n type: In([JWKType.RSA, JWKType.EC]),\n use: JWKUse.SIGNATURE,\n // active + passive verify; disabled keys never publish.\n status: In([KeyStatus.ACTIVE, KeyStatus.PASSIVE]),\n ...(realmId ? { realmId } : {}),\n },\n order: { priority: 'DESC' },\n });\n\n const promises = entities\n .filter(\n (entity): entity is KeyEntity & { encryptionKey: string, signatureAlgorithm: `${JWTAlgorithm}` } => !!entity.encryptionKey &&\n !!entity.signatureAlgorithm,\n )\n .map(\n (entity) => AsymmetricKey\n .fromBase64({\n format: 'spki',\n key: entity.encryptionKey,\n options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signatureAlgorithm),\n })\n .then((container) => container.toJWK())\n .then(async (key) => {\n const certificateFields = await buildCertificateJwkFields(entity.certificate);\n\n return {\n ...key,\n kid: entity.id,\n alg: entity.signatureAlgorithm,\n ...certificateFields,\n };\n }),\n );\n\n const keys = await Promise.all(promises);\n\n return { keys };\n }\n\n @DGet('/jwks/:id', [])\n async getOneJwks(@DPath('id') id: string): Promise<OAuth2JsonWebKey> {\n const entity = await this.repository.findOne({\n where: {\n type: In([JWKType.RSA, JWKType.EC]),\n use: JWKUse.SIGNATURE,\n status: In([KeyStatus.ACTIVE, KeyStatus.PASSIVE]),\n id,\n },\n });\n\n if (!entity) {\n throw JWKError.notFound(id);\n }\n\n if (!entity.encryptionKey \|\| !entity.signatureAlgorithm) {\n throw JWKError.encryptionKeyMissing();\n }\n\n const container = await AsymmetricKey\n .fromBase64({\n format: 'spki',\n key: entity.encryptionKey,\n options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signatureAlgorithm),\n });\n\n const jsonWebKey = await container.toJWK();\n const certificateFields = await buildCertificateJwkFields(entity.certificate);\n\n return {\n ...jsonWebKey,\n kid: entity.id,\n alg: entity.signatureAlgorithm,\n ...certificateFields,\n };\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,IAAaY,gBAAb,MAAaA;CACCC;CAEV,YAAYC,KAA2B;EACnC,KAAKD,aAAaC,IAAID;CAC1B;CAEA,MACME,YACF,OACqC;EACrC,MAAME,UAAUN,sBAAsBK,OAAO,SAAA;EAa7C,MAAMe,YAAWb,MAXM,KAAKL,WAAWM,KAAK;GACxCC,OAAO;IACHC,MAAMZ,GAAG,CAACP,QAAQoB,KAAKpB,QAAQqB,EAAG,CAAA;IAClCC,KAAKrB,OAAOsB;IAEZC,QAAQjB,GAAG,CAACT,UAAU2B,QAAQ3B,UAAU4B,OAAQ,CAAA;IAChD,GAAIX,UAAU,EAAEA,QAAQ,IAAI,CAAC;GACjC;GACAY,OAAO,EAAEC,UAAU,OAAO;EAC9B,CAAA,EAAA,CAGKE,QACIC,WAAmG,CAAC,CAACA,OAAOC,iBACzG,CAAC,CAACD,OAAOE,kBAAkB,CAAA,CAElCC,KACIH,WAAW7B,cACPiC,WAAW;GACRC,QAAQ;GACRC,KAAKN,OAAOC;GACZM,SAASpC,cAAcqC,kCAAkCR,OAAOE,kBAAkB;EACtF,CAAA,CAAA,CACCO,MAAMC,cAAcA,UAAUC,MAAK,CAAA,CAAA,CACnCF,KAAK,OAAOH,QAAAA;GACT,MAAMM,oBAAoB,MAAMnC,0BAA0BuB,OAAOa,WAAW;GAE5E,OAAO;IACH,GAAGP;IACHQ,KAAKd,OAAOe;IACZC,KAAKhB,OAAOE;IACZ,GAAGU;GACP;EACJ,CAAA,CAAA;EAKZ,OAAO,EAAEK,MAAAA,MAFUC,QAAQC,IAAIrB,QAAAA,EAEjB;CAClB;CAEA,MACMsB,WAAW,IAAoD;EACjE,MAAMpB,SAAS,MAAM,KAAKpB,WAAWyC,QAAQ,EACzClC,OAAO;GACHC,MAAMZ,GAAG,CAACP,QAAQoB,KAAKpB,QAAQqB,EAAG,CAAA;GAClCC,KAAKrB,OAAOsB;GACZC,QAAQjB,GAAG,CAACT,UAAU2B,QAAQ3B,UAAU4B,OAAQ,CAAA;GAChDoB;EACJ,EACJ,CAAA;EAEA,IAAI,CAACf,QACD,MAAMhC,SAASsD,SAASP,EAAAA;EAG5B,IAAI,CAACf,OAAOC,iBAAiB,CAACD,OAAOE,oBACjC,MAAMlC,SAASuD,qBAAoB;EAUvC,MAAMC,aAAa,OAAMd,MAPDvC,cACnBiC,WAAW;GACRC,QAAQ;GACRC,KAAKN,OAAOC;GACZM,SAASpC,cAAcqC,kCAAkCR,OAAOE,kBAAkB;EACtF,CAAA,EAAA,CAE+BS,MAAK;EACxC,MAAMC,oBAAoB,MAAMnC,0BAA0BuB,OAAOa,WAAW;EAE5E,OAAO;GACH,GAAGW;GACHV,KAAKd,OAAOe;GACZC,KAAKhB,OAAOE;GACZ,GAAGU;EACP;CACJ;AACJ"}

package/dist/adapters/http/controllers/workflows/logout/module.mjs CHANGED Viewed

@@ -17,8 +17,8 @@ function _ts_decorate(decorators, target, key, desc) {
 	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
 	return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-function _ts_metadata(k, v) {
-	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+function _ts_metadata(metadataKey, metadataValue) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(metadataKey, metadataValue);
 }
 function _ts_param(paramIndex, decorator) {
 	return function(target, key) {

package/dist/adapters/http/controllers/workflows/logout/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["DContext","DController","DGet","DPost","URL","sendRedirect","OAuth2EndSessionRequestValidator","readFromLocations","renderUIPage","LogoutController","options","endSessionService","validator","ctx","serve","event","handle","execute","merged","data","run","result","verify","serverRevoked","hintVerified","sessionId","sub","subKind","revoke","redirect","redirectUri","url","state","searchParams","set","href","requestURL","request","payload","config","baseURL","client","clientName","name","undefined","hintSub","hintSubKind","requestPath","pathname","search"],"sources":["../../../../../../src/adapters/http/controllers/workflows/logout/module.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n DContext,\n DController,\n DGet,\n DPost,\n} from '@routup/decorators';\nimport { URL } from 'node:url';\nimport type { IAppEvent } from 'routup';\nimport { sendRedirect } from 'routup';\nimport type { IOAuth2EndSessionService, OAuth2EndSessionRequest } from '../../../../../core/index.ts';\nimport { OAuth2EndSessionRequestValidator } from '../../../../../core/index.ts';\nimport { readFromLocations } from '../../../request/index.ts';\nimport { renderUIPage } from '../../../ui/index.ts';\nimport type { LogoutControllerContext, LogoutControllerOptions } from './types.ts';\n\n@DController('/logout')\nexport class LogoutController {\n protected options: LogoutControllerOptions;\n\n protected endSessionService: IOAuth2EndSessionService;\n\n protected validator: OAuth2EndSessionRequestValidator;\n\n constructor(ctx: LogoutControllerContext) {\n this.options = ctx.options;\n this.endSessionService = ctx.endSessionService;\n this.validator = new OAuth2EndSessionRequestValidator();\n }\n\n @DGet('', [])\n async serve(@DContext() event: IAppEvent): Promise<string \| Response> {\n return this.handle(event);\n }\n\n // OIDC RP-Initiated Logout allows form_post on the same endpoint.\n @DPost('', [])\n async execute(@DContext() event: IAppEvent): Promise<string \| Response> {\n return this.handle(event);\n }\n\n protected async handle(event: IAppEvent): Promise<string \| Response> {\n const merged = await readFromLocations(event, ['body', 'query']);\n\n // Malformed input (oversized / duplicated params) must never dead-end\n // the human behind the browser on a JSON error: fall back to a\n // parameter-less confirm page — every attacker-controlled value is\n // dropped, the click-gated sign-out keeps working.\n let data: OAuth2EndSessionRequest;\n try {\n data = await this.validator.run(merged);\n } catch {\n data = {};\n }\n\n const result = await this.endSessionService.verify(data);\n\n // A signature-verified id_token_hint proves possession — revoke the\n // referenced session server-side immediately (only if it belongs to the\n // hint's subject). Without a hint we mutate nothing; the SSR page's\n // sign-out is a click-gated, bearer-authenticated action.\n let serverRevoked = false;\n if (result.hintVerified && result.sessionId && result.sub && result.subKind) {\n serverRevoked = await this.endSessionService.revoke(\n result.sessionId,\n result.sub,\n result.subKind,\n );\n }\n\n // Build the validated post-logout redirect (the open-redirect guard\n // lives in the service; `state` rides only alongside a validated uri).\n let redirect: string \| undefined;\n if (result.redirectUri) {\n const url = new URL(result.redirectUri);\n if (result.state) {\n url.searchParams.set('state', result.state);\n }\n\n redirect = url.href;\n }\n\n // Bounce straight back to the RP ONLY when the logout was actually\n // performed server-side (a verified hint revoked the session). A\n // hint-less or forged request MUST NOT silently redirect without ending\n // the session — otherwise the RP treats a no-op round-trip as a\n // successful logout while the authup session survives. Instead render\n // the click-gated confirm page, which performs the bearer-authenticated\n // sign-out and then redirects.\n if (serverRevoked && redirect) {\n return sendRedirect(event, redirect);\n }\n\n const requestURL = new URL(event.request.url);\n\n return renderUIPage(event, {\n url: '/logout',\n payload: {\n config: { baseURL: this.options.baseURL },\n data: {\n client: result.clientName ? { name: result.clientName } : undefined,\n hintVerified: result.hintVerified,\n // never reflect an unverified hint's claims\n hintSub: result.hintVerified ? result.sub : undefined,\n hintSubKind: result.hintVerified ? result.subKind : undefined,\n serverRevoked,\n // the (already validated) uri to return to after a click-gated\n // sign-out; carries `state` when present\n redirect,\n requestPath: `${requestURL.pathname}${requestURL.search}`,\n },\n },\n });\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAuBA,IAAaS,mBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA8B;EACtC,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,oBAAoBE,IAAIF;EAC7B,KAAKC,YAAY,IAAIN,iCAAAA;CACzB;CAEA,MACMQ,MAAM,OAA0D;EAClE,OAAO,KAAKE,OAAOD,KAAAA;CACvB;CAGA,MACME,QAAQ,OAA0D;EACpE,OAAO,KAAKD,OAAOD,KAAAA;CACvB;CAEA,MAAgBC,OAAOD,OAA8C;EACjE,MAAMG,SAAS,MAAMX,kBAAkBQ,OAAO,CAAC,QAAQ,~~OAAA~~,~~CAAQ~~;EAM/D,IAAII;EACJ,IAAI;GACAA,OAAO,MAAM,KAAKP,UAAUQ,IAAIF,MAAAA;EACpC,QAAQ;GACJC,OAAO,CAAC;EACZ;EAEA,MAAME,SAAS,MAAM,KAAKV,kBAAkBW,OAAOH,IAAAA;EAMnD,IAAII,gBAAgB;EACpB,IAAIF,OAAOG,gBAAgBH,OAAOI,aAAaJ,OAAOK,OAAOL,OAAOM,SAChEJ,gBAAgB,MAAM,KAAKZ,kBAAkBiB,OACzCP,OAAOI,WACPJ,OAAOK,KACPL,OAAOM,OAAO;EAMtB,IAAIE;EACJ,IAAIR,OAAOS,aAAa;GACpB,MAAMC,MAAM,IAAI3B,IAAIiB,OAAOS,WAAW;GACtC,IAAIT,OAAOW,OACPD,IAAIE,aAAaC,IAAI,SAASb,OAAOW,KAAK;GAG9CH,WAAWE,IAAII;EACnB;EASA,IAAIZ,iBAAiBM,UACjB,OAAOxB,aAAaU,OAAOc,QAAAA;EAG/B,MAAMO,aAAa,IAAIhC,IAAIW,MAAMsB,QAAQN,GAAG;EAE5C,OAAOvB,aAAaO,OAAO;GACvBgB,KAAK;GACLO,SAAS;IACLC,QAAQ,EAAEC,SAAS,KAAK9B,QAAQ8B,QAAQ;IACxCrB,MAAM;KACFsB,QAAQpB,OAAOqB,aAAa,EAAEC,MAAMtB,OAAOqB,WAAW,IAAIE,KAAAA;KAC1DpB,cAAcH,OAAOG;KAErBqB,SAASxB,OAAOG,eAAeH,OAAOK,MAAMkB,KAAAA;KAC5CE,aAAazB,OAAOG,eAAeH,OAAOM,UAAUiB,KAAAA;KACpDrB;KAGAM;KACAkB,aAAa,GAAGX,WAAWY,WAAWZ,WAAWa;IACrD;GACJ;EACJ,CAAA;CACJ;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["DContext","DController","DGet","DPost","URL","sendRedirect","OAuth2EndSessionRequestValidator","readFromLocations","renderUIPage","LogoutController","options","endSessionService","validator","ctx","serve","event","handle","execute","merged","data","run","result","verify","serverRevoked","hintVerified","sessionId","sub","subKind","revoke","redirect","redirectUri","url","state","searchParams","set","href","requestURL","request","payload","config","baseURL","client","clientName","name","undefined","hintSub","hintSubKind","requestPath","pathname","search"],"sources":["../../../../../../src/adapters/http/controllers/workflows/logout/module.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n DContext,\n DController,\n DGet,\n DPost,\n} from '@routup/decorators';\nimport { URL } from 'node:url';\nimport type { IAppEvent } from 'routup';\nimport { sendRedirect } from 'routup';\nimport type { IOAuth2EndSessionService, OAuth2EndSessionRequest } from '../../../../../core/index.ts';\nimport { OAuth2EndSessionRequestValidator } from '../../../../../core/index.ts';\nimport { readFromLocations } from '../../../request/index.ts';\nimport { renderUIPage } from '../../../ui/index.ts';\nimport type { LogoutControllerContext, LogoutControllerOptions } from './types.ts';\n\n@DController('/logout')\nexport class LogoutController {\n protected options: LogoutControllerOptions;\n\n protected endSessionService: IOAuth2EndSessionService;\n\n protected validator: OAuth2EndSessionRequestValidator;\n\n constructor(ctx: LogoutControllerContext) {\n this.options = ctx.options;\n this.endSessionService = ctx.endSessionService;\n this.validator = new OAuth2EndSessionRequestValidator();\n }\n\n @DGet('', [])\n async serve(@DContext() event: IAppEvent): Promise<string \| Response> {\n return this.handle(event);\n }\n\n // OIDC RP-Initiated Logout allows form_post on the same endpoint.\n @DPost('', [])\n async execute(@DContext() event: IAppEvent): Promise<string \| Response> {\n return this.handle(event);\n }\n\n protected async handle(event: IAppEvent): Promise<string \| Response> {\n const merged = await readFromLocations(event, ['body', 'query']);\n\n // Malformed input (oversized / duplicated params) must never dead-end\n // the human behind the browser on a JSON error: fall back to a\n // parameter-less confirm page — every attacker-controlled value is\n // dropped, the click-gated sign-out keeps working.\n let data: OAuth2EndSessionRequest;\n try {\n data = await this.validator.run(merged);\n } catch {\n data = {};\n }\n\n const result = await this.endSessionService.verify(data);\n\n // A signature-verified id_token_hint proves possession — revoke the\n // referenced session server-side immediately (only if it belongs to the\n // hint's subject). Without a hint we mutate nothing; the SSR page's\n // sign-out is a click-gated, bearer-authenticated action.\n let serverRevoked = false;\n if (result.hintVerified && result.sessionId && result.sub && result.subKind) {\n serverRevoked = await this.endSessionService.revoke(\n result.sessionId,\n result.sub,\n result.subKind,\n );\n }\n\n // Build the validated post-logout redirect (the open-redirect guard\n // lives in the service; `state` rides only alongside a validated uri).\n let redirect: string \| undefined;\n if (result.redirectUri) {\n const url = new URL(result.redirectUri);\n if (result.state) {\n url.searchParams.set('state', result.state);\n }\n\n redirect = url.href;\n }\n\n // Bounce straight back to the RP ONLY when the logout was actually\n // performed server-side (a verified hint revoked the session). A\n // hint-less or forged request MUST NOT silently redirect without ending\n // the session — otherwise the RP treats a no-op round-trip as a\n // successful logout while the authup session survives. Instead render\n // the click-gated confirm page, which performs the bearer-authenticated\n // sign-out and then redirects.\n if (serverRevoked && redirect) {\n return sendRedirect(event, redirect);\n }\n\n const requestURL = new URL(event.request.url);\n\n return renderUIPage(event, {\n url: '/logout',\n payload: {\n config: { baseURL: this.options.baseURL },\n data: {\n client: result.clientName ? { name: result.clientName } : undefined,\n hintVerified: result.hintVerified,\n // never reflect an unverified hint's claims\n hintSub: result.hintVerified ? result.sub : undefined,\n hintSubKind: result.hintVerified ? result.subKind : undefined,\n serverRevoked,\n // the (already validated) uri to return to after a click-gated\n // sign-out; carries `state` when present\n redirect,\n requestPath: `${requestURL.pathname}${requestURL.search}`,\n },\n },\n });\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAuBA,IAAaS,mBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA8B;EACtC,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,oBAAoBE,IAAIF;EAC7B,KAAKC,YAAY,IAAIN,iCAAAA;CACzB;CAEA,MACMQ,MAAM,OAA0D;EAClE,OAAO,KAAKE,OAAOD,KAAAA;CACvB;CAGA,MACME,QAAQ,OAA0D;EACpE,OAAO,KAAKD,OAAOD,KAAAA;CACvB;CAEA,MAAgBC,OAAOD,OAA8C;EACjE,MAAMG,SAAS,MAAMX,kBAAkBQ,OAAO,CAAC,QAAQ,OAAQ,CAAA;EAM/D,IAAII;EACJ,IAAI;GACAA,OAAO,MAAM,KAAKP,UAAUQ,IAAIF,MAAAA;EACpC,QAAQ;GACJC,OAAO,CAAC;EACZ;EAEA,MAAME,SAAS,MAAM,KAAKV,kBAAkBW,OAAOH,IAAAA;EAMnD,IAAII,gBAAgB;EACpB,IAAIF,OAAOG,gBAAgBH,OAAOI,aAAaJ,OAAOK,OAAOL,OAAOM,SAChEJ,gBAAgB,MAAM,KAAKZ,kBAAkBiB,OACzCP,OAAOI,WACPJ,OAAOK,KACPL,OAAOM,OAAO;EAMtB,IAAIE;EACJ,IAAIR,OAAOS,aAAa;GACpB,MAAMC,MAAM,IAAI3B,IAAIiB,OAAOS,WAAW;GACtC,IAAIT,OAAOW,OACPD,IAAIE,aAAaC,IAAI,SAASb,OAAOW,KAAK;GAG9CH,WAAWE,IAAII;EACnB;EASA,IAAIZ,iBAAiBM,UACjB,OAAOxB,aAAaU,OAAOc,QAAAA;EAG/B,MAAMO,aAAa,IAAIhC,IAAIW,MAAMsB,QAAQN,GAAG;EAE5C,OAAOvB,aAAaO,OAAO;GACvBgB,KAAK;GACLO,SAAS;IACLC,QAAQ,EAAEC,SAAS,KAAK9B,QAAQ8B,QAAQ;IACxCrB,MAAM;KACFsB,QAAQpB,OAAOqB,aAAa,EAAEC,MAAMtB,OAAOqB,WAAW,IAAIE,KAAAA;KAC1DpB,cAAcH,OAAOG;KAErBqB,SAASxB,OAAOG,eAAeH,OAAOK,MAAMkB,KAAAA;KAC5CE,aAAazB,OAAOG,eAAeH,OAAOM,UAAUiB,KAAAA;KACpDrB;KAGAM;KACAkB,aAAa,GAAGX,WAAWY,WAAWZ,WAAWa;IACrD;GACJ;EACJ,CAAA;CACJ;AACJ"}

package/dist/adapters/http/controllers/workflows/openid/module.mjs CHANGED Viewed

@@ -13,8 +13,8 @@ function _ts_decorate(decorators, target, key, desc) {
 	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
 	return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-function _ts_metadata(k, v) {
-	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+function _ts_metadata(metadataKey, metadataValue) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(metadataKey, metadataValue);
 }
 function _ts_param(paramIndex, decorator) {
 	return function(target, key) {

package/dist/adapters/http/controllers/workflows/password-forgot/module.mjs CHANGED Viewed

@@ -13,8 +13,8 @@ function _ts_decorate(decorators, target, key, desc) {
 	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
 	return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-function _ts_metadata(k, v) {
-	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+function _ts_metadata(metadataKey, metadataValue) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(metadataKey, metadataValue);
 }
 function _ts_param(paramIndex, decorator) {
 	return function(target, key) {

package/dist/adapters/http/controllers/workflows/password-reset/module.mjs CHANGED Viewed

@@ -11,8 +11,8 @@ function _ts_decorate(decorators, target, key, desc) {
 	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
 	return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-function _ts_metadata(k, v) {
-	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+function _ts_metadata(metadataKey, metadataValue) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(metadataKey, metadataValue);
 }
 function _ts_param(paramIndex, decorator) {
 	return function(target, key) {

package/dist/adapters/http/controllers/workflows/register/module.mjs CHANGED Viewed

@@ -13,8 +13,8 @@ function _ts_decorate(decorators, target, key, desc) {
 	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
 	return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-function _ts_metadata(k, v) {
-	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+function _ts_metadata(metadataKey, metadataValue) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(metadataKey, metadataValue);
 }
 function _ts_param(paramIndex, decorator) {
 	return function(target, key) {

package/dist/adapters/http/controllers/workflows/status/module.mjs CHANGED Viewed

@@ -3,7 +3,7 @@ import "node:url";
 import.meta.url;
 import { PACKAGE_PATH } from "../../../../../path.mjs";
 import path from "node:path";
-import { load } from "locter";
+import { read } from "locter";
 import { DController, DGet } from "@routup/decorators";
 //#region src/adapters/http/controllers/workflows/status/module.ts
 function _ts_decorate(decorators, target, key, desc) {
@@ -12,8 +12,8 @@ function _ts_decorate(decorators, target, key, desc) {
 	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
 	return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-function _ts_metadata(k, v) {
-	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+function _ts_metadata(metadataKey, metadataValue) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(metadataKey, metadataValue);
 }
 var StatusController = class {
 	options;
@@ -22,7 +22,7 @@ var StatusController = class {
 		this.options = ctx.options;
 	}
 	resolveVersion() {
-		if (!this.versionPromise) this.versionPromise = load(path.join(PACKAGE_PATH, "package.json")).then((pkgJson) => pkgJson.version);
+		if (!this.versionPromise) this.versionPromise = read(path.join(PACKAGE_PATH, "package.json")).then((pkgJson) => pkgJson.version);
 		return this.versionPromise;
 	}
 	async status() {

package/dist/adapters/http/controllers/workflows/status/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["DController","DGet","~~load~~","path","PACKAGE_PATH","StatusController","options","versionPromise","ctx","resolveVersion","join","then","pkgJson","version","status","date","Date","toISOString","features"],"sources":["../../../../../../src/adapters/http/controllers/workflows/status/module.ts"],"sourcesContent":["/\n Copyright (c) 2022-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { StatusResponse, StatusResponseFeatures } from '@authup/core-http-kit';\nimport {\n DController,\n DGet,\n} from '@routup/decorators';\nimport { ~~load~~ } from 'locter';\nimport path from 'node:path';\nimport { PACKAGE_PATH } from '../../../../../path.ts';\n\nexport type StatusControllerOptions = {\n features: StatusResponseFeatures,\n};\n\nexport type StatusControllerContext = {\n options: StatusControllerOptions,\n};\n\n@DController('')\nexport class StatusController {\n protected options: StatusControllerOptions;\n\n // The version is constant for the process lifetime — read package.json\n // once and memoize instead of on every GET /.\n protected versionPromise: Promise<string> \| undefined;\n\n constructor(ctx: StatusControllerContext) {\n this.options = ctx.options;\n }\n\n protected resolveVersion(): Promise<string> {\n if (!this.versionPromise) {\n this.versionPromise = ~~load~~(path.join(PACKAGE_PATH, 'package.json'))\n .then((pkgJson) => pkgJson.version);\n }\n\n return this.versionPromise;\n }\n\n @DGet('/', [])\n async status(): Promise<StatusResponse> {\n return {\n version: await this.resolveVersion(),\n date: new Date().toISOString(),\n features: this.options.features,\n };\n }\n}\n"],"mappings":";;;;;;;;AAKC,SAAA,aAAA,YAAA,QAAA,KAAA,MAAA;;;;;;;;;AAoBD,IAAaK,mBAAb,MAAaA;CACCC;CAIAC;CAEV,YAAYC,KAA8B;EACtC,KAAKF,UAAUE,IAAIF;CACvB;CAEUG,iBAAkC;EACxC,IAAI,CAAC,KAAKF,gBACN,KAAKA,iBAAiBL,KAAKC,KAAKO,KAAKN,cAAc,cAAA,CAAA,CAAA,CAC9CO,MAAMC,~~YAAYA~~,QAAQC,OAAO;~~EAG1C~~,OAAO,KAAKN;CAChB;CAEA,MACMO,SAAkC;EACpC,OAAO;GACHD,SAAS,MAAM,KAAKJ,eAAc;GAClCM,uBAAM,IAAIC,KAAAA,EAAAA,CAAOC,YAAW;GAC5BC,UAAU,KAAKZ,QAAQY;EAC3B;CACJ;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["DController","DGet","read","path","PACKAGE_PATH","StatusController","options","versionPromise","ctx","resolveVersion","join","then","pkgJson","version","status","date","Date","toISOString","features"],"sources":["../../../../../../src/adapters/http/controllers/workflows/status/module.ts"],"sourcesContent":["/\n Copyright (c) 2022-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { StatusResponse, StatusResponseFeatures } from '@authup/core-http-kit';\nimport {\n DController,\n DGet,\n} from '@routup/decorators';\nimport { read } from 'locter';\nimport path from 'node:path';\nimport { PACKAGE_PATH } from '../../../../../path.ts';\n\nexport type StatusControllerOptions = {\n features: StatusResponseFeatures,\n};\n\nexport type StatusControllerContext = {\n options: StatusControllerOptions,\n};\n\n@DController('')\nexport class StatusController {\n protected options: StatusControllerOptions;\n\n // The version is constant for the process lifetime — read package.json\n // once and memoize instead of on every GET /.\n protected versionPromise: Promise<string> \| undefined;\n\n constructor(ctx: StatusControllerContext) {\n this.options = ctx.options;\n }\n\n protected resolveVersion(): Promise<string> {\n if (!this.versionPromise) {\n this.versionPromise = read(path.join(PACKAGE_PATH, 'package.json'))\n .then((pkgJson: { version: string }) => pkgJson.version);\n }\n\n return this.versionPromise;\n }\n\n @DGet('/', [])\n async status(): Promise<StatusResponse> {\n return {\n version: await this.resolveVersion(),\n date: new Date().toISOString(),\n features: this.options.features,\n };\n }\n}\n"],"mappings":";;;;;;;;AAKC,SAAA,aAAA,YAAA,QAAA,KAAA,MAAA;;;;;;;;;AAoBD,IAAaK,mBAAb,MAAaA;CACCC;CAIAC;CAEV,YAAYC,KAA8B;EACtC,KAAKF,UAAUE,IAAIF;CACvB;CAEUG,iBAAkC;EACxC,IAAI,CAAC,KAAKF,gBACN,KAAKA,iBAAiBL,KAAKC,KAAKO,KAAKN,cAAc,cAAA,CAAA,CAAA,CAC9CO,MAAMC,YAAiCA,QAAQC,OAAO;EAG/D,OAAO,KAAKN;CAChB;CAEA,MACMO,SAAkC;EACpC,OAAO;GACHD,SAAS,MAAM,KAAKJ,eAAc;GAClCM,uBAAM,IAAIC,KAAAA,EAAAA,CAAOC,YAAW;GAC5BC,UAAU,KAAKZ,QAAQY;EAC3B;CACJ;AACJ"}

package/dist/adapters/http/controllers/workflows/token/module.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/token/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,gCAAgC,EAAyB,MAAM,eAAe,CAAC;AACvH,OAAO,EAA4C,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAQ3F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGxC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,KAAK,EACR,gBAAgB,EAChB,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACvB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;~~AAWnE~~,qBAEa,eAAe;IACxB,SAAS,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;IAEjD,SAAS,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;IAEhD,SAAS,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAE9C,SAAS,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAE5C,SAAS,CAAC,gBAAgB,EAAG,iBAAiB,CAAC;IAE/C,SAAS,CAAC,0BAA0B,EAAG,2BAA2B,CAAC;IAEnE,SAAS,CAAC,OAAO,CAAC,EAAG,gBAAgB,CAAC;IAEtC,SAAS,CAAC,WAAW,EAAG,MAAM,CAAC,GAAG,gBAAgB,EAAE,EAAE,gBAAgB,CAAC,CAAC;gBAI5D,GAAG,EAAE,sBAAsB;~~IAqEjC~~,aAAa,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,gCAAgC,CAAC;IAKtF,cAAc,CACJ,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,gCAAgC,CAAC;IA4DtC,WAAW,CACD,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,IAAI,CAAC;IA+BV,WAAW,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAiBrF"}
1	+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/token/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,gCAAgC,EAAyB,MAAM,eAAe,CAAC;AACvH,OAAO,EAA4C,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAQ3F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGxC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,KAAK,EACR,gBAAgB,EAChB,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACvB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAUnE,qBAEa,eAAe;IACxB,SAAS,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;IAEjD,SAAS,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;IAEhD,SAAS,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAE9C,SAAS,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAE5C,SAAS,CAAC,gBAAgB,EAAG,iBAAiB,CAAC;IAE/C,SAAS,CAAC,0BAA0B,EAAG,2BAA2B,CAAC;IAEnE,SAAS,CAAC,OAAO,CAAC,EAAG,gBAAgB,CAAC;IAEtC,SAAS,CAAC,WAAW,EAAG,MAAM,CAAC,GAAG,gBAAgB,EAAE,EAAE,gBAAgB,CAAC,CAAC;gBAI5D,GAAG,EAAE,sBAAsB;IAgEjC,aAAa,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,gCAAgC,CAAC;IAKtF,cAAc,CACJ,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,gCAAgC,CAAC;IA4DtC,WAAW,CACD,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,IAAI,CAAC;IA+BV,WAAW,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAiBrF"}

package/dist/adapters/http/controllers/workflows/token/module.mjs CHANGED Viewed

@@ -8,7 +8,6 @@ import { HTTPOAuth2AuthorizeGrant } from "../../../adapters/oauth2/grant-types/a
 import { HTTPClientCredentialsGrant } from "../../../adapters/oauth2/grant-types/client-credentials.mjs";
 import { HTTPPasswordGrant } from "../../../adapters/oauth2/grant-types/password.mjs";
 import { HTTPOAuth2RefreshTokenGrant } from "../../../adapters/oauth2/grant-types/refresh_token.mjs";
-import { HTTPRobotCredentialsGrant } from "../../../adapters/oauth2/grant-types/robot-credentials.mjs";
 import "../../../adapters/index.mjs";
 import { toOAuth2Error } from "../../../../../core/oauth2/helpers/error.mjs";
 import "../../../../../core/oauth2/helpers/index.mjs";
@@ -24,8 +23,8 @@ function _ts_decorate(decorators, target, key, desc) {
 	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
 	return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-function _ts_metadata(k, v) {
-	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+function _ts_metadata(metadataKey, metadataValue) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(metadataKey, metadataValue);
 }
 function _ts_param(paramIndex, decorator) {
 	return function(target, key) {
@@ -68,11 +67,6 @@ var TokenController = class {
 				sessionManager: ctx.sessionManager,
 				certificateSource: ctx.certificateSource
 			}),
-			[OAuth2TokenGrant.ROBOT_CREDENTIALS]: new HTTPRobotCredentialsGrant({
-				accessTokenIssuer: ctx.accessTokenIssuer,
-				authenticator: ctx.robotAuthenticator,
-				sessionManager: ctx.sessionManager
-			}),
 			[OAuth2TokenGrant.PASSWORD]: new HTTPPasswordGrant({
 				accessTokenIssuer: ctx.accessTokenIssuer,
 				refreshTokenIssuer: ctx.refreshTokenIssuer,
@@ -131,8 +125,8 @@ var TokenController = class {
 					const key = buildPermissionKey(binding.permission);
 					if (!acc[key]) acc[key] = {
 						name: binding.permission.name,
-						client_id: binding.permission.client_id,
-						realm_id: binding.permission.realm_id
+						client_id: binding.permission.clientId,
+						realm_id: binding.permission.realmId
 					};
 					return acc;
 				}, {})),

package/dist/adapters/http/controllers/workflows/token/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["OAuth2GrantTypeError","OAuth2RequestError","OAuth2TokenGrant","DContext","DController","DGet","DPost","DTags","buildPermissionKey","toOAuth2Error","OAuth2OpenIDClaimsBuilder","HTTPClientCredentialsGrant","HTTPOAuth2AuthorizeGrant","HTTPOAuth2RefreshTokenGrant","HTTPPasswordGrant","HTTPRobotCredentialsGrant","guessOauth2GrantTypeByRequest","extractTokenFromRequest","TokenController","refreshTokenIssuer","accessTokenIssuer","tokenVerifier","tokenRevoker","identityResolver","identityPermissionProvider","metrics","tokenGrants","ctx","AUTHORIZATION_CODE","codeVerifier","clientAuthenticator","oauth2ClientAuthenticator","openIdTokenIssuer","keyStore","sessionManager","realmRepository","accessPolicyEvaluator","certificateSource","CLIENT_CREDENTIALS","ROBOT_CREDENTIALS","authenticator","robotAuthenticator","PASSWORD","userAuthenticator","eventService","loginThrottleService","userAuthenticatorService","mfaLoginService","logger","REFRESH_TOKEN","tokenRepository","sessionTokenRepository","options","gracePeriod","tokenRefreshGracePeriod","getIntrospect","event","postIntrospect","token","payload","verify","skipActiveCheck","sub","sub_kind","identityInvalid","permissions","getFor","id","type","clientId","client_id","realmId","realm_id","identity","resolve","claimsBuilder","claims","fromIdentity","active","jti","isInactive","Object","values","reduce","acc","binding","key","permission","name","e","revokeToken","ignoreExpiry","revoke","response","status","createToken","grantType","unsupported","grant","runWithRequest","recordTokenGrant"],"sources":["../../../../../../src/adapters/http/controllers/workflows/token/module.ts"],"sourcesContent":["/\n Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenIntrospectionResponse, OAuth2TokenPermission } from '@authup/specs';\nimport { OAuth2GrantTypeError, OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport {\n DContext,\n DController,\n DGet,\n DPost,\n DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport { buildPermissionKey } from '@authup/access';\nimport { toOAuth2Error } from '../../../../../core/oauth2/helpers/index.ts';\nimport type { TokenControllerContext } from './types.ts';\nimport type {\n IAuthFlowMetrics,\n IIdentityPermissionProvider,\n IIdentityResolver,\n IOAuth2TokenIssuer,\n IOAuth2TokenRevoker,\n IOAuth2TokenVerifier,\n} from '../../../../../core/index.ts';\nimport { OAuth2OpenIDClaimsBuilder } from '../../../../../core/index.ts';\nimport type { IHTTPOAuth2Grant } from '../../../adapters/index.ts';\nimport {\n HTTPClientCredentialsGrant,\n HTTPOAuth2AuthorizeGrant,\n HTTPOAuth2RefreshTokenGrant,\n HTTPPasswordGrant,\n HTTPRobotCredentialsGrant,\n guessOauth2GrantTypeByRequest,\n} from '../../../adapters/index.ts';\nimport { extractTokenFromRequest } from './utils/index.ts';\n\n@DTags('auth')\n@DController('/token')\nexport class TokenController {\n protected refreshTokenIssuer: IOAuth2TokenIssuer;\n\n protected accessTokenIssuer: IOAuth2TokenIssuer;\n\n protected tokenVerifier: IOAuth2TokenVerifier;\n\n protected tokenRevoker: IOAuth2TokenRevoker;\n\n protected identityResolver : IIdentityResolver;\n\n protected identityPermissionProvider : IIdentityPermissionProvider;\n\n protected metrics? : IAuthFlowMetrics;\n\n protected tokenGrants : Record<`${OAuth2TokenGrant}`, IHTTPOAuth2Grant>;\n\n // -------------------------------------------\n\n constructor(ctx: TokenControllerContext) {\n this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n this.accessTokenIssuer = ctx.accessTokenIssuer;\n this.tokenVerifier = ctx.tokenVerifier;\n this.tokenRevoker = ctx.tokenRevoker;\n this.identityResolver = ctx.identityResolver;\n this.identityPermissionProvider = ctx.identityPermissionProvider;\n this.metrics = ctx.metrics;\n\n this.tokenGrants = {\n [OAuth2TokenGrant.AUTHORIZATION_CODE]: new HTTPOAuth2AuthorizeGrant({\n codeVerifier: ctx.codeVerifier,\n clientAuthenticator: ctx.oauth2ClientAuthenticator,\n accessTokenIssuer: ctx.accessTokenIssuer,\n refreshTokenIssuer: ctx.refreshTokenIssuer,\n openIdTokenIssuer: ctx.openIdTokenIssuer,\n keyStore: ctx.keyStore,\n sessionManager: ctx.sessionManager,\n realmRepository: ctx.realmRepository,\n accessPolicyEvaluator: ctx.accessPolicyEvaluator,\n certificateSource: ctx.certificateSource,\n }),\n [OAuth2TokenGrant.CLIENT_CREDENTIALS]: new HTTPClientCredentialsGrant({\n accessTokenIssuer: ctx.accessTokenIssuer,\n clientAuthenticator: ctx.oauth2ClientAuthenticator,\n sessionManager: ctx.sessionManager,\n certificateSource: ctx.certificateSource,\n }),\n [OAuth2TokenGrant.ROBOT_CREDENTIALS]: new HTTPRobotCredentialsGrant({\n accessTokenIssuer: ctx.accessTokenIssuer,\n authenticator: ctx.robotAuthenticator,\n sessionManager: ctx.sessionManager,\n }),\n [OAuth2TokenGrant.PASSWORD]: new HTTPPasswordGrant({\n accessTokenIssuer: ctx.accessTokenIssuer,\n refreshTokenIssuer: ctx.refreshTokenIssuer,\n authenticator: ctx.userAuthenticator,\n clientAuthenticator: ctx.oauth2ClientAuthenticator,\n sessionManager: ctx.sessionManager,\n realmRepository: ctx.realmRepository,\n eventService: ctx.eventService,\n metrics: ctx.metrics,\n loginThrottleService: ctx.loginThrottleService,\n userAuthenticatorService: ctx.userAuthenticatorService,\n mfaLoginService: ctx.mfaLoginService,\n logger: ctx.logger,\n certificateSource: ctx.certificateSource,\n }),\n [OAuth2TokenGrant.REFRESH_TOKEN]: new HTTPOAuth2RefreshTokenGrant({\n accessTokenIssuer: ctx.accessTokenIssuer,\n refreshTokenIssuer: ctx.refreshTokenIssuer,\n tokenVerifier: ctx.tokenVerifier,\n tokenRepository: ctx.tokenRepository,\n sessionTokenRepository: ctx.sessionTokenRepository,\n sessionManager: ctx.sessionManager,\n clientAuthenticator: ctx.oauth2ClientAuthenticator,\n realmRepository: ctx.realmRepository,\n eventService: ctx.eventService,\n metrics: ctx.metrics,\n logger: ctx.logger,\n options: { gracePeriod: ctx.tokenRefreshGracePeriod },\n certificateSource: ctx.certificateSource,\n }),\n };\n }\n\n // -------------------------------------------\n\n @DGet('/introspect', [])\n async getIntrospect(@DContext() event: IAppEvent): Promise<OAuth2TokenIntrospectionResponse> {\n return this.postIntrospect(event);\n }\n\n @DPost('/introspect', [])\n async postIntrospect(\n @DContext() event: IAppEvent,\n ): Promise<OAuth2TokenIntrospectionResponse> {\n try {\n const token = await extractTokenFromRequest(event);\n const payload = await this.tokenVerifier.verify(token, { skipActiveCheck: true });\n if (!payload.sub \|\| !payload.sub_kind) {\n throw OAuth2RequestError.identityInvalid();\n }\n\n // todo: only receive client specific permissions\n const permissions = await this.identityPermissionProvider.getFor({\n id: payload.sub,\n type: payload.sub_kind,\n clientId: payload.client_id,\n realmId: payload.realm_id,\n });\n\n const identity = await this.identityResolver.resolve(payload.sub_kind, payload.sub);\n if (!identity) {\n // todo: differentiate between client, robot & user\n throw OAuth2RequestError.identityInvalid();\n }\n\n const claimsBuilder = new OAuth2OpenIDClaimsBuilder();\n const claims = claimsBuilder.fromIdentity(identity);\n\n let active : boolean;\n if (payload.jti) {\n const isInactive = await this.tokenVerifier.isInactive(payload.jti);\n active = !isInactive;\n } else {\n active = false;\n }\n\n return {\n active,\n // todo: permissions property should be removed.\n permissions: Object.values(\n permissions.reduce((acc, binding) => {\n const key = buildPermissionKey(binding.permission);\n if (!acc[key]) {\n acc[key] = {\n name: binding.permission.name,\n client_id: binding.permission.client_id,\n realm_id: binding.permission.realm_id,\n } as OAuth2TokenPermission;\n }\n return acc;\n }, {} as Record<string, OAuth2TokenPermission>),\n ),\n ...payload,\n ...claims,\n };\n } catch (e) {\n throw toOAuth2Error(e);\n }\n }\n\n // ----------------------------------------------------------\n\n @DPost('/revoke', [])\n async revokeToken(\n @DContext() event: IAppEvent,\n ): Promise<null> {\n try {\n const token = await extractTokenFromRequest(event);\n\n // RFC 7009 §2.2: revoking an invalid token — here one that is expired\n // or already inactive — MUST still succeed. The client cannot act on\n // an error, and the token's invalidation (the point of the request)\n // is already achieved. Signature + kind still anchor the token, so a\n // forged/garbage token is rejected; `ignoreExpiry` additionally keeps\n // this exp-bypass out of the shared claims cache (see\n // OAuth2TokenVerifier). Without this, revoking a stale refresh token\n // threw `expired_token`, so the caller's revoke-then-clear-cookie\n // flow aborted, the durable row was never soft-revoked, and the stale\n // refresh cookie survived into the next login.\n const payload = await this.tokenVerifier.verify(token, {\n ignoreExpiry: true,\n skipActiveCheck: true,\n });\n\n await this.tokenRevoker.revoke(payload);\n\n event.response.status = 202;\n return null;\n } catch (e) {\n throw toOAuth2Error(e);\n }\n }\n\n // ----------------------------------------------------------\n\n @DPost('', [])\n async createToken(@DContext() event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n const grantType = await guessOauth2GrantTypeByRequest(event);\n if (!grantType) {\n throw OAuth2GrantTypeError.unsupported();\n }\n\n const grant = this.tokenGrants[grantType];\n if (!grant) {\n throw OAuth2GrantTypeError.unsupported();\n }\n\n const response = await grant.runWithRequest(event);\n\n this.metrics?.recordTokenGrant(grantType);\n\n return response;\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAKC,SAAA,aAAA,YAAA,QAAA,KAAA,MAAA;;;;;;;;;;;;;;AAqCD,IAAakB,kBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAA6B;EACrC,KAAKR,qBAAqBQ,IAAIR;EAC9B,KAAKC,oBAAoBO,IAAIP;EAC7B,KAAKC,gBAAgBM,IAAIN;EACzB,KAAKC,eAAeK,IAAIL;EACxB,KAAKC,mBAAmBI,IAAIJ;EAC5B,KAAKC,6BAA6BG,IAAIH;EACtC,KAAKC,UAAUE,IAAIF;EAEnB,KAAKC,cAAc;IACdxB,iBAAiB0B,qBAAqB,IAAIhB,yBAAyB;IAChEiB,cAAcF,IAAIE;IAClBC,qBAAqBH,IAAII;IACzBX,mBAAmBO,IAAIP;IACvBD,oBAAoBQ,IAAIR;IACxBa,mBAAmBL,IAAIK;IACvBC,UAAUN,IAAIM;IACdC,gBAAgBP,IAAIO;IACpBC,iBAAiBR,IAAIQ;IACrBC,uBAAuBT,IAAIS;IAC3BC,mBAAmBV,IAAIU;GAC3B,CAAA;IACCnC,iBAAiBoC,qBAAqB,IAAI3B,2BAA2B;IAClES,mBAAmBO,IAAIP;IACvBU,qBAAqBH,IAAII;IACzBG,gBAAgBP,IAAIO;IACpBG,mBAAmBV,IAAIU;GAC3B,CAAA;IACCnC,iBAAiBqC,oBAAoB,IAAIxB,0BAA0B;IAChEK,mBAAmBO,IAAIP;IACvBoB,eAAeb,IAAIc;IACnBP,gBAAgBP,IAAIO;GACxB,CAAA;IACChC,iBAAiBwC,WAAW,IAAI5B,kBAAkB;IAC/CM,mBAAmBO,IAAIP;IACvBD,oBAAoBQ,IAAIR;IACxBqB,eAAeb,IAAIgB;IACnBb,qBAAqBH,IAAII;IACzBG,gBAAgBP,IAAIO;IACpBC,iBAAiBR,IAAIQ;IACrBS,cAAcjB,IAAIiB;IAClBnB,SAASE,IAAIF;IACboB,sBAAsBlB,IAAIkB;IAC1BC,0BAA0BnB,IAAImB;IAC9BC,iBAAiBpB,IAAIoB;IACrBC,QAAQrB,IAAIqB;IACZX,mBAAmBV,IAAIU;GAC3B,CAAA;IACCnC,iBAAiB+C,gBAAgB,IAAIpC,4BAA4B;IAC9DO,mBAAmBO,IAAIP;IACvBD,oBAAoBQ,IAAIR;IACxBE,eAAeM,IAAIN;IACnB6B,iBAAiBvB,IAAIuB;IACrBC,wBAAwBxB,IAAIwB;IAC5BjB,gBAAgBP,IAAIO;IACpBJ,qBAAqBH,IAAII;IACzBI,iBAAiBR,IAAIQ;IACrBS,cAAcjB,IAAIiB;IAClBnB,SAASE,IAAIF;IACbuB,QAAQrB,IAAIqB;IACZI,SAAS,EAAEC,aAAa1B,IAAI2B,wBAAwB;IACpDjB,mBAAmBV,IAAIU;GAC3B,CAAA;EACJ;CACJ;CAIA,MACMkB,cAAc,OAAyE;EACzF,OAAO,KAAKE,eAAeD,KAAAA;CAC/B;CAEA,MACMC,eACF,OACyC;EACzC,IAAI;GACA,MAAMC,QAAQ,MAAMzC,wBAAwBuC,KAAAA;GAC5C,MAAMG,UAAU,MAAM,KAAKtC,cAAcuC,OAAOF,OAAO,EAAEG,iBAAiB,KAAK,CAAA;GAC/E,IAAI,CAACF,QAAQG,OAAO,CAACH,QAAQI,UACzB,MAAM9D,mBAAmB+D,gBAAe;GAI5C,MAAMC,cAAc,MAAM,KAAKzC,2BAA2B0C,OAAO;IAC7DC,IAAIR,QAAQG;IACZM,MAAMT,QAAQI;IACdM,UAAUV,QAAQW;IAClBC,SAASZ,QAAQa;GACrB,CAAA;GAEA,MAAMC,WAAW,MAAM,KAAKlD,iBAAiBmD,QAAQf,QAAQI,UAAUJ,QAAQG,GAAG;GAClF,IAAI,CAACW,UAED,MAAMxE,mBAAmB+D,gBAAe;GAI5C,MAAMY,SAASD,IADWjE,0BACXiE,CAAAA,CAAcE,aAAaJ,QAAAA;GAE1C,IAAIK;GACJ,IAAInB,QAAQoB,KAERD,SAAS,CAACE,MADe,KAAK3D,cAAc2D,WAAWrB,QAAQoB,GAAG;QAGlED,SAAS;GAGb,OAAO;IACHA;IAEAb,aAAagB,OAAOC,OAChBjB,YAAYkB,QAAQC,KAAKC,YAAAA;KACrB,MAAMC,MAAM9E,mBAAmB6E,QAAQE,UAAU;KACjD,IAAI,CAACH,IAAIE,MACLF,IAAIE,OAAO;MACPE,MAAMH,QAAQE,WAAWC;MACzBlB,WAAWe,QAAQE,WAAWjB;MAC9BE,UAAUa,QAAQE,WAAWf;KACjC;KAEJ,OAAOY;IACX,GAAG,CAAC,CAAA,CAAA;IAER,GAAGzB;IACH,GAAGiB;GACP;EACJ,SAASa,GAAG;GACR,MAAMhF,cAAcgF,CAAAA;EACxB;CACJ;CAIA,MACMC,YACF,OACa;EACb,IAAI;GACA,MAAMhC,QAAQ,MAAMzC,wBAAwBuC,KAAAA;GAY5C,MAAMG,UAAU,MAAM,KAAKtC,cAAcuC,OAAOF,OAAO;IACnDiC,cAAc;IACd9B,iBAAiB;GACrB,CAAA;GAEA,MAAM,KAAKvC,aAAasE,OAAOjC,OAAAA;GAE/BH,MAAMqC,SAASC,SAAS;GACxB,OAAO;EACX,SAASL,GAAG;GACR,MAAMhF,cAAcgF,CAAAA;EACxB;CACJ;CAIA,MACMM,YAAY,OAAiE;EAC/E,MAAMC,YAAY,MAAMhF,8BAA8BwC,KAAAA;EACtD,IAAI,CAACwC,WACD,MAAMhG,qBAAqBiG,YAAW;EAG1C,MAAMC,QAAQ,KAAKxE,YAAYsE;EAC/B,IAAI,CAACE,OACD,MAAMlG,qBAAqBiG,YAAW;EAG1C,MAAMJ,WAAW,MAAMK,MAAMC,eAAe3C,KAAAA;EAE5C,KAAK/B,SAAS2E,iBAAiBJ,SAAAA;EAE/B,OAAOH;CACX;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["OAuth2GrantTypeError","OAuth2RequestError","OAuth2TokenGrant","DContext","DController","DGet","DPost","DTags","buildPermissionKey","toOAuth2Error","OAuth2OpenIDClaimsBuilder","HTTPClientCredentialsGrant","HTTPOAuth2AuthorizeGrant","HTTPOAuth2RefreshTokenGrant","HTTPPasswordGrant","guessOauth2GrantTypeByRequest","extractTokenFromRequest","TokenController","refreshTokenIssuer","accessTokenIssuer","tokenVerifier","tokenRevoker","identityResolver","identityPermissionProvider","metrics","tokenGrants","ctx","AUTHORIZATION_CODE","codeVerifier","clientAuthenticator","oauth2ClientAuthenticator","openIdTokenIssuer","keyStore","sessionManager","realmRepository","accessPolicyEvaluator","certificateSource","CLIENT_CREDENTIALS","PASSWORD","authenticator","userAuthenticator","eventService","loginThrottleService","userAuthenticatorService","mfaLoginService","logger","REFRESH_TOKEN","tokenRepository","sessionTokenRepository","options","gracePeriod","tokenRefreshGracePeriod","getIntrospect","event","postIntrospect","token","payload","verify","skipActiveCheck","sub","sub_kind","identityInvalid","permissions","getFor","id","type","clientId","client_id","realmId","realm_id","identity","resolve","claimsBuilder","claims","fromIdentity","active","jti","isInactive","Object","values","reduce","acc","binding","key","permission","name","e","revokeToken","ignoreExpiry","revoke","response","status","createToken","grantType","unsupported","grant","runWithRequest","recordTokenGrant"],"sources":["../../../../../../src/adapters/http/controllers/workflows/token/module.ts"],"sourcesContent":["/\n Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenIntrospectionResponse, OAuth2TokenPermission } from '@authup/specs';\nimport { OAuth2GrantTypeError, OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport {\n DContext,\n DController,\n DGet,\n DPost,\n DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport { buildPermissionKey } from '@authup/access';\nimport { toOAuth2Error } from '../../../../../core/oauth2/helpers/index.ts';\nimport type { TokenControllerContext } from './types.ts';\nimport type {\n IAuthFlowMetrics,\n IIdentityPermissionProvider,\n IIdentityResolver,\n IOAuth2TokenIssuer,\n IOAuth2TokenRevoker,\n IOAuth2TokenVerifier,\n} from '../../../../../core/index.ts';\nimport { OAuth2OpenIDClaimsBuilder } from '../../../../../core/index.ts';\nimport type { IHTTPOAuth2Grant } from '../../../adapters/index.ts';\nimport {\n HTTPClientCredentialsGrant,\n HTTPOAuth2AuthorizeGrant,\n HTTPOAuth2RefreshTokenGrant,\n HTTPPasswordGrant,\n guessOauth2GrantTypeByRequest,\n} from '../../../adapters/index.ts';\nimport { extractTokenFromRequest } from './utils/index.ts';\n\n@DTags('auth')\n@DController('/token')\nexport class TokenController {\n protected refreshTokenIssuer: IOAuth2TokenIssuer;\n\n protected accessTokenIssuer: IOAuth2TokenIssuer;\n\n protected tokenVerifier: IOAuth2TokenVerifier;\n\n protected tokenRevoker: IOAuth2TokenRevoker;\n\n protected identityResolver : IIdentityResolver;\n\n protected identityPermissionProvider : IIdentityPermissionProvider;\n\n protected metrics? : IAuthFlowMetrics;\n\n protected tokenGrants : Record<`${OAuth2TokenGrant}`, IHTTPOAuth2Grant>;\n\n // -------------------------------------------\n\n constructor(ctx: TokenControllerContext) {\n this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n this.accessTokenIssuer = ctx.accessTokenIssuer;\n this.tokenVerifier = ctx.tokenVerifier;\n this.tokenRevoker = ctx.tokenRevoker;\n this.identityResolver = ctx.identityResolver;\n this.identityPermissionProvider = ctx.identityPermissionProvider;\n this.metrics = ctx.metrics;\n\n this.tokenGrants = {\n [OAuth2TokenGrant.AUTHORIZATION_CODE]: new HTTPOAuth2AuthorizeGrant({\n codeVerifier: ctx.codeVerifier,\n clientAuthenticator: ctx.oauth2ClientAuthenticator,\n accessTokenIssuer: ctx.accessTokenIssuer,\n refreshTokenIssuer: ctx.refreshTokenIssuer,\n openIdTokenIssuer: ctx.openIdTokenIssuer,\n keyStore: ctx.keyStore,\n sessionManager: ctx.sessionManager,\n realmRepository: ctx.realmRepository,\n accessPolicyEvaluator: ctx.accessPolicyEvaluator,\n certificateSource: ctx.certificateSource,\n }),\n [OAuth2TokenGrant.CLIENT_CREDENTIALS]: new HTTPClientCredentialsGrant({\n accessTokenIssuer: ctx.accessTokenIssuer,\n clientAuthenticator: ctx.oauth2ClientAuthenticator,\n sessionManager: ctx.sessionManager,\n certificateSource: ctx.certificateSource,\n }),\n [OAuth2TokenGrant.PASSWORD]: new HTTPPasswordGrant({\n accessTokenIssuer: ctx.accessTokenIssuer,\n refreshTokenIssuer: ctx.refreshTokenIssuer,\n authenticator: ctx.userAuthenticator,\n clientAuthenticator: ctx.oauth2ClientAuthenticator,\n sessionManager: ctx.sessionManager,\n realmRepository: ctx.realmRepository,\n eventService: ctx.eventService,\n metrics: ctx.metrics,\n loginThrottleService: ctx.loginThrottleService,\n userAuthenticatorService: ctx.userAuthenticatorService,\n mfaLoginService: ctx.mfaLoginService,\n logger: ctx.logger,\n certificateSource: ctx.certificateSource,\n }),\n [OAuth2TokenGrant.REFRESH_TOKEN]: new HTTPOAuth2RefreshTokenGrant({\n accessTokenIssuer: ctx.accessTokenIssuer,\n refreshTokenIssuer: ctx.refreshTokenIssuer,\n tokenVerifier: ctx.tokenVerifier,\n tokenRepository: ctx.tokenRepository,\n sessionTokenRepository: ctx.sessionTokenRepository,\n sessionManager: ctx.sessionManager,\n clientAuthenticator: ctx.oauth2ClientAuthenticator,\n realmRepository: ctx.realmRepository,\n eventService: ctx.eventService,\n metrics: ctx.metrics,\n logger: ctx.logger,\n options: { gracePeriod: ctx.tokenRefreshGracePeriod },\n certificateSource: ctx.certificateSource,\n }),\n };\n }\n\n // -------------------------------------------\n\n @DGet('/introspect', [])\n async getIntrospect(@DContext() event: IAppEvent): Promise<OAuth2TokenIntrospectionResponse> {\n return this.postIntrospect(event);\n }\n\n @DPost('/introspect', [])\n async postIntrospect(\n @DContext() event: IAppEvent,\n ): Promise<OAuth2TokenIntrospectionResponse> {\n try {\n const token = await extractTokenFromRequest(event);\n const payload = await this.tokenVerifier.verify(token, { skipActiveCheck: true });\n if (!payload.sub \|\| !payload.sub_kind) {\n throw OAuth2RequestError.identityInvalid();\n }\n\n // todo: only receive client specific permissions\n const permissions = await this.identityPermissionProvider.getFor({\n id: payload.sub,\n type: payload.sub_kind,\n clientId: payload.client_id,\n realmId: payload.realm_id,\n });\n\n const identity = await this.identityResolver.resolve(payload.sub_kind, payload.sub);\n if (!identity) {\n // todo: differentiate between client & user\n throw OAuth2RequestError.identityInvalid();\n }\n\n const claimsBuilder = new OAuth2OpenIDClaimsBuilder();\n const claims = claimsBuilder.fromIdentity(identity);\n\n let active : boolean;\n if (payload.jti) {\n const isInactive = await this.tokenVerifier.isInactive(payload.jti);\n active = !isInactive;\n } else {\n active = false;\n }\n\n return {\n active,\n // todo: permissions property should be removed.\n permissions: Object.values(\n permissions.reduce((acc, binding) => {\n const key = buildPermissionKey(binding.permission);\n if (!acc[key]) {\n acc[key] = {\n name: binding.permission.name,\n client_id: binding.permission.clientId,\n realm_id: binding.permission.realmId,\n } as OAuth2TokenPermission;\n }\n return acc;\n }, {} as Record<string, OAuth2TokenPermission>),\n ),\n ...payload,\n ...claims,\n };\n } catch (e) {\n throw toOAuth2Error(e);\n }\n }\n\n // ----------------------------------------------------------\n\n @DPost('/revoke', [])\n async revokeToken(\n @DContext() event: IAppEvent,\n ): Promise<null> {\n try {\n const token = await extractTokenFromRequest(event);\n\n // RFC 7009 §2.2: revoking an invalid token — here one that is expired\n // or already inactive — MUST still succeed. The client cannot act on\n // an error, and the token's invalidation (the point of the request)\n // is already achieved. Signature + kind still anchor the token, so a\n // forged/garbage token is rejected; `ignoreExpiry` additionally keeps\n // this exp-bypass out of the shared claims cache (see\n // OAuth2TokenVerifier). Without this, revoking a stale refresh token\n // threw `expired_token`, so the caller's revoke-then-clear-cookie\n // flow aborted, the durable row was never soft-revoked, and the stale\n // refresh cookie survived into the next login.\n const payload = await this.tokenVerifier.verify(token, {\n ignoreExpiry: true,\n skipActiveCheck: true,\n });\n\n await this.tokenRevoker.revoke(payload);\n\n event.response.status = 202;\n return null;\n } catch (e) {\n throw toOAuth2Error(e);\n }\n }\n\n // ----------------------------------------------------------\n\n @DPost('', [])\n async createToken(@DContext() event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n const grantType = await guessOauth2GrantTypeByRequest(event);\n if (!grantType) {\n throw OAuth2GrantTypeError.unsupported();\n }\n\n const grant = this.tokenGrants[grantType];\n if (!grant) {\n throw OAuth2GrantTypeError.unsupported();\n }\n\n const response = await grant.runWithRequest(event);\n\n this.metrics?.recordTokenGrant(grantType);\n\n return response;\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAKC,SAAA,aAAA,YAAA,QAAA,KAAA,MAAA;;;;;;;;;;;;;;AAoCD,IAAaiB,kBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAA6B;EACrC,KAAKR,qBAAqBQ,IAAIR;EAC9B,KAAKC,oBAAoBO,IAAIP;EAC7B,KAAKC,gBAAgBM,IAAIN;EACzB,KAAKC,eAAeK,IAAIL;EACxB,KAAKC,mBAAmBI,IAAIJ;EAC5B,KAAKC,6BAA6BG,IAAIH;EACtC,KAAKC,UAAUE,IAAIF;EAEnB,KAAKC,cAAc;IACdvB,iBAAiByB,qBAAqB,IAAIf,yBAAyB;IAChEgB,cAAcF,IAAIE;IAClBC,qBAAqBH,IAAII;IACzBX,mBAAmBO,IAAIP;IACvBD,oBAAoBQ,IAAIR;IACxBa,mBAAmBL,IAAIK;IACvBC,UAAUN,IAAIM;IACdC,gBAAgBP,IAAIO;IACpBC,iBAAiBR,IAAIQ;IACrBC,uBAAuBT,IAAIS;IAC3BC,mBAAmBV,IAAIU;GAC3B,CAAA;IACClC,iBAAiBmC,qBAAqB,IAAI1B,2BAA2B;IAClEQ,mBAAmBO,IAAIP;IACvBU,qBAAqBH,IAAII;IACzBG,gBAAgBP,IAAIO;IACpBG,mBAAmBV,IAAIU;GAC3B,CAAA;IACClC,iBAAiBoC,WAAW,IAAIxB,kBAAkB;IAC/CK,mBAAmBO,IAAIP;IACvBD,oBAAoBQ,IAAIR;IACxBqB,eAAeb,IAAIc;IACnBX,qBAAqBH,IAAII;IACzBG,gBAAgBP,IAAIO;IACpBC,iBAAiBR,IAAIQ;IACrBO,cAAcf,IAAIe;IAClBjB,SAASE,IAAIF;IACbkB,sBAAsBhB,IAAIgB;IAC1BC,0BAA0BjB,IAAIiB;IAC9BC,iBAAiBlB,IAAIkB;IACrBC,QAAQnB,IAAImB;IACZT,mBAAmBV,IAAIU;GAC3B,CAAA;IACClC,iBAAiB4C,gBAAgB,IAAIjC,4BAA4B;IAC9DM,mBAAmBO,IAAIP;IACvBD,oBAAoBQ,IAAIR;IACxBE,eAAeM,IAAIN;IACnB2B,iBAAiBrB,IAAIqB;IACrBC,wBAAwBtB,IAAIsB;IAC5Bf,gBAAgBP,IAAIO;IACpBJ,qBAAqBH,IAAII;IACzBI,iBAAiBR,IAAIQ;IACrBO,cAAcf,IAAIe;IAClBjB,SAASE,IAAIF;IACbqB,QAAQnB,IAAImB;IACZI,SAAS,EAAEC,aAAaxB,IAAIyB,wBAAwB;IACpDf,mBAAmBV,IAAIU;GAC3B,CAAA;EACJ;CACJ;CAIA,MACMgB,cAAc,OAAyE;EACzF,OAAO,KAAKE,eAAeD,KAAAA;CAC/B;CAEA,MACMC,eACF,OACyC;EACzC,IAAI;GACA,MAAMC,QAAQ,MAAMvC,wBAAwBqC,KAAAA;GAC5C,MAAMG,UAAU,MAAM,KAAKpC,cAAcqC,OAAOF,OAAO,EAAEG,iBAAiB,KAAK,CAAA;GAC/E,IAAI,CAACF,QAAQG,OAAO,CAACH,QAAQI,UACzB,MAAM3D,mBAAmB4D,gBAAe;GAI5C,MAAMC,cAAc,MAAM,KAAKvC,2BAA2BwC,OAAO;IAC7DC,IAAIR,QAAQG;IACZM,MAAMT,QAAQI;IACdM,UAAUV,QAAQW;IAClBC,SAASZ,QAAQa;GACrB,CAAA;GAEA,MAAMC,WAAW,MAAM,KAAKhD,iBAAiBiD,QAAQf,QAAQI,UAAUJ,QAAQG,GAAG;GAClF,IAAI,CAACW,UAED,MAAMrE,mBAAmB4D,gBAAe;GAI5C,MAAMY,SAASD,IADW9D,0BACX8D,CAAAA,CAAcE,aAAaJ,QAAAA;GAE1C,IAAIK;GACJ,IAAInB,QAAQoB,KAERD,SAAS,CAACE,MADe,KAAKzD,cAAcyD,WAAWrB,QAAQoB,GAAG;QAGlED,SAAS;GAGb,OAAO;IACHA;IAEAb,aAAagB,OAAOC,OAChBjB,YAAYkB,QAAQC,KAAKC,YAAAA;KACrB,MAAMC,MAAM3E,mBAAmB0E,QAAQE,UAAU;KACjD,IAAI,CAACH,IAAIE,MACLF,IAAIE,OAAO;MACPE,MAAMH,QAAQE,WAAWC;MACzBlB,WAAWe,QAAQE,WAAWlB;MAC9BG,UAAUa,QAAQE,WAAWhB;KACjC;KAEJ,OAAOa;IACX,GAAG,CAAC,CAAA,CAAA;IAER,GAAGzB;IACH,GAAGiB;GACP;EACJ,SAASa,GAAG;GACR,MAAM7E,cAAc6E,CAAAA;EACxB;CACJ;CAIA,MACMC,YACF,OACa;EACb,IAAI;GACA,MAAMhC,QAAQ,MAAMvC,wBAAwBqC,KAAAA;GAY5C,MAAMG,UAAU,MAAM,KAAKpC,cAAcqC,OAAOF,OAAO;IACnDiC,cAAc;IACd9B,iBAAiB;GACrB,CAAA;GAEA,MAAM,KAAKrC,aAAaoE,OAAOjC,OAAAA;GAE/BH,MAAMqC,SAASC,SAAS;GACxB,OAAO;EACX,SAASL,GAAG;GACR,MAAM7E,cAAc6E,CAAAA;EACxB;CACJ;CAIA,MACMM,YAAY,OAAiE;EAC/E,MAAMC,YAAY,MAAM9E,8BAA8BsC,KAAAA;EACtD,IAAI,CAACwC,WACD,MAAM7F,qBAAqB8F,YAAW;EAG1C,MAAMC,QAAQ,KAAKtE,YAAYoE;EAC/B,IAAI,CAACE,OACD,MAAM/F,qBAAqB8F,YAAW;EAG1C,MAAMJ,WAAW,MAAMK,MAAMC,eAAe3C,KAAAA;EAE5C,KAAK7B,SAASyE,iBAAiBJ,SAAAA;EAE/B,OAAOH;CACX;AACJ"}

package/dist/adapters/http/controllers/workflows/token/types.d.ts CHANGED Viewed

@@ -1,4 +1,4 @@
-import type { Robot, User } from '@authup/core-kit';
+import type { User } from '@authup/core-kit';
 import type { Logger } from '@authup/server-kit';
 import type { IAuthFlowMetrics, ICredentialsAuthenticator, IEventService, IIdentityPermissionProvider, IIdentityResolver, IKeyStore, ILoginThrottleService, IOAuth2AccessPolicyEvaluator, IOAuth2AuthorizationCodeVerifier, IOAuth2MfaLoginService, IOAuth2OpenIDTokenIssuer, IOAuth2TokenIssuer, IOAuth2TokenRepository, IOAuth2TokenRevoker, IOAuth2TokenVerifier, IRealmRepository, ISessionManager, ISessionTokenRepository, IUserAuthenticatorService, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';
 import type { CertificateSource } from '../../../request/index.ts';
@@ -23,7 +23,6 @@ export type TokenControllerContext = {
     sessionManager: ISessionManager;
     identityResolver: IIdentityResolver;
     identityPermissionProvider: IIdentityPermissionProvider;
-    robotAuthenticator: ICredentialsAuthenticator<Robot>;
     userAuthenticator: ICredentialsAuthenticator<User>;
     oauth2ClientAuthenticator: OAuth2ClientAuthenticator;
     realmRepository: IRealmRepository;

package/dist/adapters/http/controllers/workflows/token/types.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/token/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,~~KAAK,EAAE,~~IAAI,EAAE,MAAM,kBAAkB,CAAC;~~AACpD~~,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EACR,gBAAgB,EAChB,yBAAyB,EACzB,aAAa,EACb,2BAA2B,EAC3B,iBAAiB,EACjB,SAAS,EACT,qBAAqB,EACrB,4BAA4B,EAC5B,gCAAgC,EAChC,sBAAsB,EACtB,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,uBAAuB,EACvB,yBAAyB,EACzB,yBAAyB,EAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,MAAM,MAAM,sBAAsB,GAAG;IACjC,YAAY,EAAE,gCAAgC,CAAC;IAE/C,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,iBAAiB,EAAE,wBAAwB,CAAC;IAC5C,QAAQ,EAAE,SAAS,CAAC;IACpB,aAAa,EAAE,oBAAoB,CAAC;IACpC,YAAY,EAAE,mBAAmB,CAAC;IAClC,eAAe,EAAE,sBAAsB,CAAC;IACxC,sBAAsB,EAAE,uBAAuB,CAAC;IAEhD,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAC7C,wBAAwB,CAAC,EAAE,yBAAyB,CAAC;IACrD,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,qBAAqB,CAAC,EAAE,4BAA4B,CAAC;IAErD,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,cAAc,EAAE,eAAe,CAAC;IAEhC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,0BAA0B,EAAE,2BAA2B,CAAC;IAExD,~~kBAAkB,EAAE,yBAAyB,CAAC,KAAK,CAAC,CAAA;IACpD,~~iBAAiB,EAAE,yBAAyB,CAAC,IAAI,CAAC,CAAA;IAElD,yBAAyB,EAAE,yBAAyB,CAAA;IAEpD,eAAe,EAAE,gBAAgB,CAAC;IAClC,iBAAiB,EAAE,iBAAiB,CAAC;CACxC,CAAC"}
1	+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/token/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EACR,gBAAgB,EAChB,yBAAyB,EACzB,aAAa,EACb,2BAA2B,EAC3B,iBAAiB,EACjB,SAAS,EACT,qBAAqB,EACrB,4BAA4B,EAC5B,gCAAgC,EAChC,sBAAsB,EACtB,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,uBAAuB,EACvB,yBAAyB,EACzB,yBAAyB,EAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,MAAM,MAAM,sBAAsB,GAAG;IACjC,YAAY,EAAE,gCAAgC,CAAC;IAE/C,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,iBAAiB,EAAE,wBAAwB,CAAC;IAC5C,QAAQ,EAAE,SAAS,CAAC;IACpB,aAAa,EAAE,oBAAoB,CAAC;IACpC,YAAY,EAAE,mBAAmB,CAAC;IAClC,eAAe,EAAE,sBAAsB,CAAC;IACxC,sBAAsB,EAAE,uBAAuB,CAAC;IAEhD,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAC7C,wBAAwB,CAAC,EAAE,yBAAyB,CAAC;IACrD,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,qBAAqB,CAAC,EAAE,4BAA4B,CAAC;IAErD,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,cAAc,EAAE,eAAe,CAAC;IAEhC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,0BAA0B,EAAE,2BAA2B,CAAC;IAExD,iBAAiB,EAAE,yBAAyB,CAAC,IAAI,CAAC,CAAA;IAElD,yBAAyB,EAAE,yBAAyB,CAAA;IAEpD,eAAe,EAAE,gBAAgB,CAAC;IAClC,iBAAiB,EAAE,iBAAiB,CAAC;CACxC,CAAC"}

package/dist/adapters/http/controllers/workflows/token/utils/extract.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"extract.mjs","names":["ValidupError","buildErrorMessageForAttribute","defineIssueItem","isValidupError","readFromLocations","useRequestToken","TokenRequestValidator","extractTokenFromRequest","event","token","validator","data","run","e","path","message"],"sources":["../../../../../../../src/adapters/http/controllers/workflows/token/utils/extract.ts"],"sourcesContent":["/\n Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IAppEvent } from 'routup';\nimport {\n ValidupError, \n buildErrorMessageForAttribute, \n defineIssueItem, \n isValidupError,\n} from 'validup';\nimport { readFromLocations, useRequestToken } from '../../../../request/index.ts';\nimport { TokenRequestValidator } from './validator.ts';\n\nexport async function extractTokenFromRequest(event: IAppEvent) : Promise<string> {\n let token : string \| undefined;\n\n try {\n const validator = new TokenRequestValidator();\n const data = await validator.run(\n await readFromLocations(event, ['body', 'query', 'params']),\n );\n\n token = data.token;\n } catch (e) {\n if (!isValidupError(e)) {\n throw e;\n }\n token = useRequestToken(event);\n }\n\n if (!token) {\n throw new ValidupError([\n defineIssueItem({\n path: ['token'],\n message: buildErrorMessageForAttribute('token'),\n }),\n ]);\n }\n\n return token;\n}\n"],"mappings":";;;;;;;;;AAiBA,eAAsBO,wBAAwBC,OAAgB;CAC1D,IAAIC;CAEJ,IAAI;EAMAA,SAAQE,MAJWD,IADGJ,sBACHI,CAAAA,CAAUE,IACzB,MAAMR,kBAAkBI,OAAO;GAAC;GAAQ;GAAS;~~GAAS~~,CAAA,EAAA,CAGjDC;CACjB,SAASI,GAAG;EACR,IAAI,CAACV,eAAeU,CAAAA,GAChB,MAAMA;EAEVJ,QAAQJ,gBAAgBG,KAAAA;CAC5B;CAEA,IAAI,CAACC,OACD,MAAM,IAAIT,aAAa,CACnBE,gBAAgB;EACZY,MAAM,CAAC,~~OAAA~~;~~EACPC~~,SAASd,8BAA8B,OAAA;CAC3C,CAAA,CAAA~~,CACH~~;CAGL,OAAOQ;AACX"}
1	+ {"version":3,"file":"extract.mjs","names":["ValidupError","buildErrorMessageForAttribute","defineIssueItem","isValidupError","readFromLocations","useRequestToken","TokenRequestValidator","extractTokenFromRequest","event","token","validator","data","run","e","path","message"],"sources":["../../../../../../../src/adapters/http/controllers/workflows/token/utils/extract.ts"],"sourcesContent":["/\n Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IAppEvent } from 'routup';\nimport {\n ValidupError, \n buildErrorMessageForAttribute, \n defineIssueItem, \n isValidupError,\n} from 'validup';\nimport { readFromLocations, useRequestToken } from '../../../../request/index.ts';\nimport { TokenRequestValidator } from './validator.ts';\n\nexport async function extractTokenFromRequest(event: IAppEvent) : Promise<string> {\n let token : string \| undefined;\n\n try {\n const validator = new TokenRequestValidator();\n const data = await validator.run(\n await readFromLocations(event, ['body', 'query', 'params']),\n );\n\n token = data.token;\n } catch (e) {\n if (!isValidupError(e)) {\n throw e;\n }\n token = useRequestToken(event);\n }\n\n if (!token) {\n throw new ValidupError([\n defineIssueItem({\n path: ['token'],\n message: buildErrorMessageForAttribute('token'),\n }),\n ]);\n }\n\n return token;\n}\n"],"mappings":";;;;;;;;;AAiBA,eAAsBO,wBAAwBC,OAAgB;CAC1D,IAAIC;CAEJ,IAAI;EAMAA,SAAQE,MAJWD,IADGJ,sBACHI,CAAAA,CAAUE,IACzB,MAAMR,kBAAkBI,OAAO;GAAC;GAAQ;GAAS;EAAS,CAAA,CAAA,EAAA,CAGjDC;CACjB,SAASI,GAAG;EACR,IAAI,CAACV,eAAeU,CAAAA,GAChB,MAAMA;EAEVJ,QAAQJ,gBAAgBG,KAAAA;CAC5B;CAEA,IAAI,CAACC,OACD,MAAM,IAAIT,aAAa,CACnBE,gBAAgB;EACZY,MAAM,CAAC,OAAQ;EACfC,SAASd,8BAA8B,OAAA;CAC3C,CAAA,CACH,CAAA;CAGL,OAAOQ;AACX"}

package/dist/adapters/http/index.mjs CHANGED Viewed

@@ -45,7 +45,6 @@ import { HTTPClientCredentialsGrant } from "./adapters/oauth2/grant-types/client
 import { HTTPOAuth2IdentityGrantType } from "./adapters/oauth2/grant-types/identity.mjs";
 import { HTTPPasswordGrant } from "./adapters/oauth2/grant-types/password.mjs";
 import { HTTPOAuth2RefreshTokenGrant } from "./adapters/oauth2/grant-types/refresh_token.mjs";
-import { HTTPRobotCredentialsGrant } from "./adapters/oauth2/grant-types/robot-credentials.mjs";
 import "./adapters/index.mjs";
 import { ClientController } from "./controllers/entities/client/module.mjs";
 import { ClientPermissionController } from "./controllers/entities/client-permission/module.mjs";
@@ -74,11 +73,6 @@ import { RegisterController } from "./controllers/workflows/register/module.mjs"
 import { StatusController } from "./controllers/workflows/status/module.mjs";
 import { TokenController } from "./controllers/workflows/token/module.mjs";
 import { RealmController } from "./controllers/entities/realm/module.mjs";
-import { RobotController } from "./controllers/entities/robot/module.mjs";
-import { RobotPermissionController } from "./controllers/entities/robot-permission/module.mjs";
-import { RobotPermissionRequestValidator } from "./controllers/entities/robot-permission/utils/validation.mjs";
-import { RobotRoleController } from "./controllers/entities/robot-role/module.mjs";
-import { RobotRoleRequestValidator } from "./controllers/entities/robot-role/utils/validation.mjs";
 import { RoleController } from "./controllers/entities/role/module.mjs";
 import { RoleAttributeController } from "./controllers/entities/role-attribute/module.mjs";
 import { RoleAttributeRequestValidator } from "./controllers/entities/role-attribute/utils/validation.mjs";
@@ -99,4 +93,4 @@ import { UserPermissionRequestValidator } from "./controllers/entities/user-perm
 import { UserRoleController } from "./controllers/entities/user-role/module.mjs";
 import { UserRoleRequestValidator } from "./controllers/entities/user-role/utils/validation.mjs";
 import "./controllers/index.mjs";
-export { ActivateController, AuthenticatorChallengeController, AuthorizationMiddleware, AuthorizeController, CERTIFICATE_SOURCES, ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ConsentController, EventController, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, IdentityProviderController, IdentityProviderRoleMappingController, JwkController, KeyController, LOCALE_COOKIE, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RealmResolverMiddleware, RegisterController, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, RobotController, RobotPermissionController, RobotPermissionRequestValidator, RobotRoleController, RobotRoleRequestValidator, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, StatusController, TokenController, TrustAnchorController, UI_HTTP_CLIENT_FACTORY_STORE_KEY, UserAttributeController, UserAttributeRequestValidator, UserAuthenticatorController, UserController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator, VITE_SERVER_STORE_KEY, applyRouteRealmIDToBody, buildActorContext, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createRequestEventContextMiddleware, createRouteTemplateNormalizePath, createSwaggerMiddleware, extractClientCertificateEvidence, extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, getBodyRealmID, getJwkRouteHandler, getJwksRouteHandler, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, guessOauth2GrantTypeByRequest, readFromLocations, readRealmHint, readStringField, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerUIHttpClientMiddleware, runWithRequestEventContext, sanitizeRelativeRedirect, setRequestIdentity, setRequestMfaLoginTicket, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestEventContext, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestMfaLoginTicket, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestSessionId, useRequestToken };
+export { ActivateController, AuthenticatorChallengeController, AuthorizationMiddleware, AuthorizeController, CERTIFICATE_SOURCES, ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ConsentController, EventController, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, IdentityProviderController, IdentityProviderRoleMappingController, JwkController, KeyController, LOCALE_COOKIE, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RealmResolverMiddleware, RegisterController, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, StatusController, TokenController, TrustAnchorController, UI_HTTP_CLIENT_FACTORY_STORE_KEY, UserAttributeController, UserAttributeRequestValidator, UserAuthenticatorController, UserController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator, VITE_SERVER_STORE_KEY, applyRouteRealmIDToBody, buildActorContext, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createRequestEventContextMiddleware, createRouteTemplateNormalizePath, createSwaggerMiddleware, extractClientCertificateEvidence, extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, getBodyRealmID, getJwkRouteHandler, getJwksRouteHandler, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, guessOauth2GrantTypeByRequest, readFromLocations, readRealmHint, readStringField, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerUIHttpClientMiddleware, runWithRequestEventContext, sanitizeRelativeRedirect, setRequestIdentity, setRequestMfaLoginTicket, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestEventContext, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestMfaLoginTicket, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestSessionId, useRequestToken };

package/dist/adapters/http/middleware/built-in/assets.mjs CHANGED Viewed

@@ -6,7 +6,7 @@ import path from "node:path";
 import { defineCoreHandler } from "routup";
 import { CodeTransformation, isCodeTransformation } from "typeorm-extension";
 import { fromNodeMiddleware } from "routup/node";
-import { load } from "locter";
+import { read } from "locter";
 import { createHandler } from "@routup/assets";
 //#region src/adapters/http/middleware/built-in/assets.ts
 const VITE_SERVER_STORE_KEY = Symbol("ViteServer");
@@ -22,7 +22,7 @@ async function registerAssetsMiddleware(router) {
 		}));
 		return;
 	}
-	const server = await (await load("vite")).createServer({
+	const server = await (await read("vite")).createServer({
 		root: UI_SOURCE_PATH,
 		base: "/public/",
 		logLevel: "error",

package/dist/adapters/http/middleware/built-in/assets.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"assets.mjs","names":["~~load~~","CodeTransformation","isCodeTransformation","createHandler","path","defineCoreHandler","fromNodeMiddleware","PACKAGE_PATH","UI_DIST_PATH","UI_SOURCE_PATH","VITE_SERVER_STORE_KEY","Symbol","registerAssetsMiddleware","router","JUST_IN_TIME","use","posix","join","fallthrough","scan","vite","server","createServer","root","base","logLevel","middlewareMode","watch","usePolling","interval","appType","middlewares","event","store","next"],"sources":["../../../../../src/adapters/http/middleware/built-in/assets.ts"],"sourcesContent":["/\n Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { ~~load~~ } from 'locter';\nimport { CodeTransformation, isCodeTransformation } from 'typeorm-extension';\nimport { createHandler } from '@routup/assets';\nimport path from 'node:path';\nimport type { App } from 'routup';\nimport { defineCoreHandler } from 'routup';\nimport { fromNodeMiddleware } from 'routup/node';\nimport type as Vite from 'vite';\nimport type { ViteDevServer } from 'vite';\nimport { PACKAGE_PATH, UI_DIST_PATH, UI_SOURCE_PATH } from '../../../../path.ts';\n\nexport const VITE_SERVER_STORE_KEY = Symbol('ViteServer');\n\nexport async function registerAssetsMiddleware(router: App) {\n if (!isCodeTransformation(CodeTransformation.JUST_IN_TIME)) {\n router.use('public', createHandler(\n path.posix.join(PACKAGE_PATH, 'public'),\n {\n fallthrough: true,\n scan: false,\n },\n ));\n\n router.use('public', createHandler(\n path.posix.join(UI_DIST_PATH, 'client'),\n {\n fallthrough: false,\n scan: false,\n },\n ));\n return;\n }\n\n const vite = await ~~load~~('vite') as typeof Vite;\n\n const server: ViteDevServer = await vite.createServer({\n root: UI_SOURCE_PATH,\n base: '/public/',\n logLevel: 'error',\n server: {\n middlewareMode: true,\n watch: {\n usePolling: true,\n interval: 100,\n },\n },\n appType: 'custom',\n });\n\n router.use('public', fromNodeMiddleware(server.middlewares));\n router.use(defineCoreHandler((event) => {\n event.store[VITE_SERVER_STORE_KEY] = server;\n return event.next();\n }));\n}\n"],"mappings":";;;;;;;;;;;AAkBA,MAAaU,wBAAwBC,OAAO,YAAA;AAE5C,eAAsBC,yBAAyBC,QAAW;CACtD,IAAI,CAACX,qBAAqBD,mBAAmBa,YAAY,GAAG;EACxDD,OAAOE,IAAI,UAAUZ,cACjBC,KAAKY,MAAMC,KAAKV,cAAc,QAAA,GAC9B;GACIW,aAAa;GACbC,MAAM;EACV,CAAA,CAAA;EAGJN,OAAOE,IAAI,UAAUZ,cACjBC,KAAKY,MAAMC,KAAKT,cAAc,QAAA,GAC9B;GACIU,aAAa;GACbC,MAAM;EACV,CAAA,CAAA;EAEJ;CACJ;CAIA,MAAME,SAAwB,OAAMD,MAFjBpB,KAAK,MAAA,EAAA,CAEiBsB,aAAa;EAClDC,MAAMd;EACNe,MAAM;EACNC,UAAU;EACVJ,QAAQ;GACJK,gBAAgB;GAChBC,OAAO;IACHC,YAAY;IACZC,UAAU;GACd;EACJ;EACAC,SAAS;CACb,CAAA;CAEAjB,OAAOE,IAAI,UAAUT,mBAAmBe,OAAOU,WAAW,CAAA;CAC1DlB,OAAOE,IAAIV,mBAAmB2B,UAAAA;EAC1BA,MAAMC,MAAMvB,yBAAyBW;EACrC,OAAOW,MAAME,KAAI;CACrB,CAAA,CAAA;AACJ"}
1	+ {"version":3,"file":"assets.mjs","names":["read","CodeTransformation","isCodeTransformation","createHandler","path","defineCoreHandler","fromNodeMiddleware","PACKAGE_PATH","UI_DIST_PATH","UI_SOURCE_PATH","VITE_SERVER_STORE_KEY","Symbol","registerAssetsMiddleware","router","JUST_IN_TIME","use","posix","join","fallthrough","scan","vite","server","createServer","root","base","logLevel","middlewareMode","watch","usePolling","interval","appType","middlewares","event","store","next"],"sources":["../../../../../src/adapters/http/middleware/built-in/assets.ts"],"sourcesContent":["/\n Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { read } from 'locter';\nimport { CodeTransformation, isCodeTransformation } from 'typeorm-extension';\nimport { createHandler } from '@routup/assets';\nimport path from 'node:path';\nimport type { App } from 'routup';\nimport { defineCoreHandler } from 'routup';\nimport { fromNodeMiddleware } from 'routup/node';\nimport type as Vite from 'vite';\nimport type { ViteDevServer } from 'vite';\nimport { PACKAGE_PATH, UI_DIST_PATH, UI_SOURCE_PATH } from '../../../../path.ts';\n\nexport const VITE_SERVER_STORE_KEY = Symbol('ViteServer');\n\nexport async function registerAssetsMiddleware(router: App) {\n if (!isCodeTransformation(CodeTransformation.JUST_IN_TIME)) {\n router.use('public', createHandler(\n path.posix.join(PACKAGE_PATH, 'public'),\n {\n fallthrough: true,\n scan: false,\n },\n ));\n\n router.use('public', createHandler(\n path.posix.join(UI_DIST_PATH, 'client'),\n {\n fallthrough: false,\n scan: false,\n },\n ));\n return;\n }\n\n const vite = await read('vite') as typeof Vite;\n\n const server: ViteDevServer = await vite.createServer({\n root: UI_SOURCE_PATH,\n base: '/public/',\n logLevel: 'error',\n server: {\n middlewareMode: true,\n watch: {\n usePolling: true,\n interval: 100,\n },\n },\n appType: 'custom',\n });\n\n router.use('public', fromNodeMiddleware(server.middlewares));\n router.use(defineCoreHandler((event) => {\n event.store[VITE_SERVER_STORE_KEY] = server;\n return event.next();\n }));\n}\n"],"mappings":";;;;;;;;;;;AAkBA,MAAaU,wBAAwBC,OAAO,YAAA;AAE5C,eAAsBC,yBAAyBC,QAAW;CACtD,IAAI,CAACX,qBAAqBD,mBAAmBa,YAAY,GAAG;EACxDD,OAAOE,IAAI,UAAUZ,cACjBC,KAAKY,MAAMC,KAAKV,cAAc,QAAA,GAC9B;GACIW,aAAa;GACbC,MAAM;EACV,CAAA,CAAA;EAGJN,OAAOE,IAAI,UAAUZ,cACjBC,KAAKY,MAAMC,KAAKT,cAAc,QAAA,GAC9B;GACIU,aAAa;GACbC,MAAM;EACV,CAAA,CAAA;EAEJ;CACJ;CAIA,MAAME,SAAwB,OAAMD,MAFjBpB,KAAK,MAAA,EAAA,CAEiBsB,aAAa;EAClDC,MAAMd;EACNe,MAAM;EACNC,UAAU;EACVJ,QAAQ;GACJK,gBAAgB;GAChBC,OAAO;IACHC,YAAY;IACZC,UAAU;GACd;EACJ;EACAC,SAAS;CACb,CAAA;CAEAjB,OAAOE,IAAI,UAAUT,mBAAmBe,OAAOU,WAAW,CAAA;CAC1DlB,OAAOE,IAAIV,mBAAmB2B,UAAAA;EAC1BA,MAAMC,MAAMvB,yBAAyBW;EACrC,OAAOW,MAAME,KAAI;CACrB,CAAA,CAAA;AACJ"}

package/dist/adapters/http/middleware/built-in/authorization/module.d.ts CHANGED Viewed

@@ -1,5 +1,5 @@
 import type { IPermissionEvaluator } from '@authup/access';
-import type { Client, Robot, User } from '@authup/core-kit';
+import type { Client, User } from '@authup/core-kit';
 import type { OAuth2TokenPayload } from '@authup/specs';
 import type { IAppEvent } from 'routup';
 import { type BasicAuthorizationHeader, type BearerAuthorizationHeader } from 'hapic';
@@ -12,7 +12,6 @@ export declare class AuthorizationMiddleware {
     protected identityResolver: IIdentityResolver;
     protected sessionManager: ISessionManager;
     protected clientAuthenticator: ICredentialsAuthenticator<Client>;
-    protected robotAuthenticator: ICredentialsAuthenticator<Robot>;
     protected userAuthenticator: ICredentialsAuthenticator<User>;
     constructor(ctx: HTTPAuthorizationMiddlewareContext);
     run(event: IAppEvent): Promise<void>;

package/dist/adapters/http/middleware/built-in/authorization/module.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/middleware/built-in/authorization/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAE3D,OAAO,KAAK,EAAE,MAAM,EAAE,~~KAAK,EAAE,~~IAAI,EAAE,MAAM,kBAAkB,CAAC;~~AAM5D~~,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAOxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAEH,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAEjC,MAAM,OAAO,CAAC;~~AAQf~~,OAAO,KAAK,EACR,yBAAyB,EACzB,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EAClB,MAAM,8BAA8B,CAAC;AAYtC,OAAO,KAAK,EAAE,kCAAkC,EAAE,kCAAkC,EAAE,MAAM,YAAY,CAAC;AAEzG,qBAAa,uBAAuB;IAChC,SAAS,CAAC,OAAO,EAAE,kCAAkC,CAAC;IAItD,SAAS,CAAC,mBAAmB,EAAE,oBAAoB,CAAC;IAEpD,SAAS,CAAC,mBAAmB,EAAE,oBAAoB,CAAC;IAIpD,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,cAAc,EAAG,eAAe,CAAC;IAI3C,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAElE,SAAS,CAAC,~~kBAAkB,EAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;IAEhE,SAAS,CAAC,~~iBAAiB,EAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;gBAIlD,GAAG,EAAE,kCAAkC;~~IAsB7C~~,GAAG,CAAC,KAAK,EAAE,SAAS;IA2B1B;;OAEG;cACa,+BAA+B,CAC3C,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,yBAAyB;cAgErB,wBAAwB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAyBtG;;;;;;;;;OASG;cACa,oBAAoB,CAChC,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,kBAAkB;cAsDf,8BAA8B,CAC1C,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,wBAAwB;CA+~~CvC~~"}
1	+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/middleware/built-in/authorization/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAE3D,OAAO,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAMrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAOxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAEH,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAEjC,MAAM,OAAO,CAAC;AAOf,OAAO,KAAK,EACR,yBAAyB,EACzB,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EAClB,MAAM,8BAA8B,CAAC;AAYtC,OAAO,KAAK,EAAE,kCAAkC,EAAE,kCAAkC,EAAE,MAAM,YAAY,CAAC;AAEzG,qBAAa,uBAAuB;IAChC,SAAS,CAAC,OAAO,EAAE,kCAAkC,CAAC;IAItD,SAAS,CAAC,mBAAmB,EAAE,oBAAoB,CAAC;IAEpD,SAAS,CAAC,mBAAmB,EAAE,oBAAoB,CAAC;IAIpD,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,cAAc,EAAG,eAAe,CAAC;IAI3C,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAElE,SAAS,CAAC,iBAAiB,EAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;gBAIlD,GAAG,EAAE,kCAAkC;IAqB7C,GAAG,CAAC,KAAK,EAAE,SAAS;IA2B1B;;OAEG;cACa,+BAA+B,CAC3C,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,yBAAyB;cAgErB,wBAAwB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAyBtG;;;;;;;;;OASG;cACa,oBAAoB,CAChC,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,kBAAkB;cAsDf,8BAA8B,CAC1C,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,wBAAwB;CA+BvC"}