npm - @authup/server-core - Versions diffs - 1.0.0-beta.53 → 1.0.0-beta.55 - Mend

@authup/server-core 1.0.0-beta.53 → 1.0.0-beta.55

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1255) hide show

package/dist/adapters/http/middleware/built-in/authorization/module.mjs CHANGED Viewed

@@ -2,7 +2,6 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { ClientAuthenticator } from "../../../../../core/authentication/entities/client/module.mjs";
-import { RobotAuthenticator } from "../../../../../core/authentication/entities/robot/module.mjs";
 import { UserAuthenticator } from "../../../../../core/authentication/entities/user/module.mjs";
 import { assertClientCertificateEvidenceValidForBinding } from "../../../../../core/client-certificate/module.mjs";
 import { PolicyEngine as PolicyEngine$1 } from "../../../../../core/security/policy/engine.mjs";
@@ -29,14 +28,12 @@ var AuthorizationMiddleware = class {
 	identityResolver;
 	sessionManager;
 	clientAuthenticator;
-	robotAuthenticator;
 	userAuthenticator;
 	constructor(ctx) {
 		this.options = ctx.options || {};
 		this.identityResolver = ctx.identityResolver;
 		this.sessionManager = ctx.sessionManager;
 		this.clientAuthenticator = new ClientAuthenticator(ctx.identityResolver);
-		this.robotAuthenticator = new RobotAuthenticator(ctx.identityResolver);
 		this.userAuthenticator = new UserAuthenticator(ctx.identityResolver);
 		this.oauth2TokenVerifier = ctx.oauth2TokenVerifier;
 		this.permissionEvaluator = new PermissionEvaluator({
@@ -122,7 +119,7 @@ var AuthorizationMiddleware = class {
 		} catch {
 			throw JWTError.expired();
 		}
-		if (session.sub !== payload.sub || session.sub_kind !== IdentityType.USER) throw JWTError.expired();
+		if (session.sub !== payload.sub || session.subKind !== IdentityType.USER) throw JWTError.expired();
 		await this.sessionManager.ping(session);
 		const identity = await this.identityResolver.resolve(payload.sub_kind, payload.sub);
 		if (!identity) throw JWTError.expired();
@@ -150,17 +147,6 @@ var AuthorizationMiddleware = class {
 					type: IdentityType.USER,
 					data: authenticated.data
 				});
-				return;
-			}
-		}
-		if (this.options.robotAuthBasic) {
-			const authenticated = await this.robotAuthenticator.safeAuthenticate(header.username, header.password);
-			if (authenticated.success) {
-				setRequestScopes(event, [ScopeName.GLOBAL]);
-				setRequestIdentity(event, {
-					type: IdentityType.ROBOT,
-					data: authenticated.data
-				});
 			}
 		}
 	}

package/dist/adapters/http/middleware/built-in/authorization/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["PermissionEvaluator","IdentityType","ScopeName","AuthHeaderError","JWTError","OAuth2SubKind","OAuth2TokenKind","deserializeOAuth2Scope","AuthorizationHeaderType","parseAuthorizationHeader","ClientAuthenticator","PolicyEngine","RobotAuthenticator","UserAuthenticator","assertClientCertificateEvidenceValidForBinding","RequestIdentity","RequestPermissionEvaluator","extractClientCertificateEvidence","setRequestIdentity","setRequestMfaLoginTicket","setRequestPermissionEvaluator","setRequestScopes","setRequestSessionId","setRequestToken","AuthorizationMiddleware","options","oauth2TokenVerifier","permissionEvaluator","identityResolver","sessionManager","clientAuthenticator","robotAuthenticator","userAuthenticator","ctx","provider","permissionProvider","policyEngine","identityPermissionProvider","realmId","clientId","run","event","requestAccessContext","headerValue","headers","get","header","type","BEARER","verifyBearerAuthorizationHeader","BASIC","verifyBasicAuthorizationHeader","unsupportedType","payload","verify","token","verifyCertificateBinding","kind","MFA","verifyMfaLoginTicket","ACCESS","payloadPropertyInvalid","realm_id","scope","session_id","session","findOneById","expired","ping","sub_kind","sub","identity","resolve","cnf","expectedThumbprint","length","invalid","evidence","certificateSource","thumbprint","USER","clientAuthBasic","authenticator","safeAuthenticate","username","password","success","GLOBAL","CLIENT","data","userAuthBasic","authenticated","robotAuthBasic","ROBOT"],"sources":["../../../../../../src/adapters/http/middleware/built-in/authorization/module.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { IPermissionEvaluator } from '@authup/access';\nimport { PermissionEvaluator } from '@authup/access';\nimport type { Client, Robot, User } from '@authup/core-kit';\nimport {\n IdentityType,\n ScopeName,\n} from '@authup/core-kit';\nimport { AuthHeaderError } from '@authup/errors';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport {\n JWTError,\n OAuth2SubKind,\n OAuth2TokenKind,\n deserializeOAuth2Scope,\n} from '@authup/specs';\nimport type { IAppEvent } from 'routup';\nimport {\n AuthorizationHeaderType,\n type BasicAuthorizationHeader,\n type BearerAuthorizationHeader,\n parseAuthorizationHeader,\n} from 'hapic';\nimport {\n ClientAuthenticator,\n PolicyEngine,\n RobotAuthenticator,\n UserAuthenticator,\n assertClientCertificateEvidenceValidForBinding,\n} from '../../../../../core/index.ts';\nimport type {\n ICredentialsAuthenticator,\n IIdentityResolver,\n IOAuth2TokenVerifier,\n ISessionManager,\n} from '../../../../../core/index.ts';\nimport {\n RequestIdentity,\n RequestPermissionEvaluator,\n extractClientCertificateEvidence,\n setRequestIdentity,\n setRequestMfaLoginTicket,\n setRequestPermissionEvaluator,\n setRequestScopes,\n setRequestSessionId,\n setRequestToken,\n} from '../../../request/index.ts';\nimport type { HTTPAuthorizationMiddlewareContext, HTTPAuthorizationMiddlewareOptions } from './types.ts';\n\nexport class AuthorizationMiddleware {\n protected options: HTTPAuthorizationMiddlewareOptions;\n\n // --------------------------------------\n\n protected oauth2TokenVerifier: IOAuth2TokenVerifier;\n\n protected permissionEvaluator: IPermissionEvaluator;\n\n // --------------------------------------\n\n protected identityResolver: IIdentityResolver;\n\n protected sessionManager : ISessionManager;\n\n // --------------------------------------\n\n protected clientAuthenticator : ICredentialsAuthenticator<Client>;\n\n protected robotAuthenticator : ICredentialsAuthenticator<Robot>;\n\n protected userAuthenticator : ICredentialsAuthenticator<User>;\n\n // --------------------------------------\n\n constructor(ctx: HTTPAuthorizationMiddlewareContext) {\n this.options = ctx.options \|\| {};\n\n this.identityResolver = ctx.identityResolver;\n this.sessionManager = ctx.sessionManager;\n\n this.clientAuthenticator = new ClientAuthenticator(ctx.identityResolver);\n this.robotAuthenticator = new RobotAuthenticator(ctx.identityResolver);\n this.userAuthenticator = new UserAuthenticator(ctx.identityResolver);\n\n this.oauth2TokenVerifier = ctx.oauth2TokenVerifier;\n\n this.permissionEvaluator = new PermissionEvaluator({\n provider: ctx.permissionProvider,\n policyEngine: new PolicyEngine(ctx.identityPermissionProvider),\n realmId: null,\n clientId: null,\n });\n }\n\n // --------------------------------------\n\n async run(event: IAppEvent) {\n const requestAccessContext = new RequestPermissionEvaluator(\n event,\n this.permissionEvaluator,\n );\n setRequestPermissionEvaluator(event, requestAccessContext);\n\n const headerValue = event.headers.get('authorization');\n if (!headerValue) {\n return;\n }\n\n const header = parseAuthorizationHeader(headerValue);\n\n if (header.type === AuthorizationHeaderType.BEARER) {\n await this.verifyBearerAuthorizationHeader(event, header);\n return;\n }\n\n if (header.type === AuthorizationHeaderType.BASIC) {\n await this.verifyBasicAuthorizationHeader(event, header);\n return;\n }\n\n throw AuthHeaderError.unsupportedType(header.type);\n }\n\n /\n @throws JWTError\n /\n protected async verifyBearerAuthorizationHeader(\n event: IAppEvent,\n header: BearerAuthorizationHeader,\n ) {\n const payload = await this.oauth2TokenVerifier.verify(header.token);\n await this.verifyCertificateBinding(event, payload);\n if (payload.kind === OAuth2TokenKind.MFA) {\n await this.verifyMfaLoginTicket(event, payload);\n return;\n }\n\n if (payload.kind !== OAuth2TokenKind.ACCESS) {\n throw JWTError.payloadPropertyInvalid('kind');\n }\n\n if (!payload.realm_id) {\n throw JWTError.payloadPropertyInvalid('realm_id');\n }\n\n setRequestToken(event, header.token);\n\n if (payload.scope) {\n setRequestScopes(event, deserializeOAuth2Scope(payload.scope));\n }\n\n // -------------------------------------------------------\n\n if (!payload.session_id) {\n throw JWTError.payloadPropertyInvalid('session_id');\n }\n\n const session = await this.sessionManager.findOneById(payload.session_id);\n if (!session) {\n throw JWTError.expired();\n }\n\n try {\n await this.sessionManager.verify(session);\n } catch {\n throw JWTError.expired();\n }\n\n await this.sessionManager.ping(session);\n\n setRequestSessionId(event, payload.session_id);\n\n // -------------------------------------------------------\n\n if (!payload.sub_kind) {\n throw JWTError.payloadPropertyInvalid('sub_kind');\n }\n\n if (!payload.sub) {\n throw JWTError.payloadPropertyInvalid('sub');\n }\n\n const identity = await this.identityResolver.resolve(\n payload.sub_kind,\n payload.sub,\n );\n\n if (identity) {\n setRequestIdentity(event, identity);\n }\n }\n\n protected async verifyCertificateBinding(event: IAppEvent, payload: OAuth2TokenPayload): Promise<void> {\n if (!payload.cnf) {\n return;\n }\n\n const expectedThumbprint = payload.cnf['x5t#S256'];\n if (typeof expectedThumbprint !== 'string' \|\| expectedThumbprint.length === 0) {\n throw JWTError.invalid();\n }\n\n try {\n const evidence = await extractClientCertificateEvidence(\n event,\n this.options.certificateSource ?? 'disabled',\n );\n if (!evidence \|\| evidence.thumbprint !== expectedThumbprint) {\n throw JWTError.invalid();\n }\n\n assertClientCertificateEvidenceValidForBinding(evidence);\n } catch {\n throw JWTError.invalid();\n }\n }\n\n /\n An \"MFA-pending\" login ticket (issue #3242). Verified with the same\n * rigor as an access token (session existence + subject match), but\n * stashed on a DEDICATED request slot — the main identity / scope /\n * session slots stay empty, so every identity-gated route rejects a\n * ticket bearer (default-deny); only the challenge routes opt in via\n * useRequestMfaLoginTicket.\n \n @throws JWTError\n */\n protected async verifyMfaLoginTicket(\n event: IAppEvent,\n payload: OAuth2TokenPayload,\n ) {\n if (payload.sub_kind !== OAuth2SubKind.USER) {\n throw JWTError.payloadPropertyInvalid('sub_kind');\n }\n\n if (!payload.sub) {\n throw JWTError.payloadPropertyInvalid('sub');\n }\n\n if (!payload.realm_id) {\n throw JWTError.payloadPropertyInvalid('realm_id');\n }\n\n if (!payload.session_id) {\n throw JWTError.payloadPropertyInvalid('session_id');\n }\n\n const session = await this.sessionManager.findOneById(payload.session_id);\n if (!session) {\n throw JWTError.expired();\n }\n\n try {\n await this.sessionManager.verify(session);\n } catch {\n throw JWTError.expired();\n }\n\n // defense in depth — the pending session must still belong to the\n // ticket subject.\n if (\n session.sub !== payload.sub \|\|\n session.sub_kind !== IdentityType.USER\n ) {\n throw JWTError.expired();\n }\n\n await this.sessionManager.ping(session);\n\n const identity = await this.identityResolver.resolve(\n payload.sub_kind,\n payload.sub,\n );\n if (!identity) {\n throw JWTError.expired();\n }\n\n setRequestMfaLoginTicket(event, {\n identity: new RequestIdentity(identity),\n payload,\n });\n }\n\n protected async verifyBasicAuthorizationHeader(\n event: IAppEvent,\n header: BasicAuthorizationHeader,\n ) {\n if (this.options.clientAuthBasic) {\n const authenticator = await this.clientAuthenticator.safeAuthenticate(\n header.username,\n header.password,\n );\n if (authenticator.success) {\n setRequestScopes(event, [ScopeName.GLOBAL]);\n setRequestIdentity(event, {\n type: IdentityType.CLIENT,\n data: authenticator.data,\n });\n }\n }\n\n if (this.options.userAuthBasic) {\n const authenticated = await this.userAuthenticator.safeAuthenticate(\n header.username,\n header.password,\n );\n\n if (authenticated.success) {\n setRequestScopes(event, [ScopeName.GLOBAL]);\n setRequestIdentity(event, {\n type: IdentityType.USER,\n data: authenticated.data,\n });\n\n return;\n }\n }\n\n if (this.options.robotAuthBasic) {\n const authenticated = await this.robotAuthenticator.safeAuthenticate(\n header.username,\n header.password,\n );\n if (authenticated.success) {\n setRequestScopes(event, [ScopeName.GLOBAL]);\n setRequestIdentity(event, {\n type: IdentityType.ROBOT,\n data: authenticated.data,\n });\n }\n }\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAuDA,IAAawB,0BAAb,MAAaA;CACCC;CAIAC;CAEAC;CAIAC;CAEAC;CAIAC;CAEAC;CAEAC;CAIV,YAAYC,KAAyC;EACjD,KAAKR,UAAUQ,IAAIR,WAAW,CAAC;EAE/B,KAAKG,mBAAmBK,IAAIL;EAC5B,KAAKC,iBAAiBI,IAAIJ;EAE1B,KAAKC,sBAAsB,IAAIpB,oBAAoBuB,IAAIL,gBAAgB;EACvE,KAAKG,qBAAqB,IAAInB,mBAAmBqB,IAAIL,gBAAgB;EACrE,KAAKI,oBAAoB,IAAInB,kBAAkBoB,IAAIL,gBAAgB;EAEnE,KAAKF,sBAAsBO,IAAIP;EAE/B,KAAKC,sBAAsB,IAAI3B,oBAAoB;GAC/CkC,UAAUD,IAAIE;GACdC,cAAc,IAAIzB,eAAasB,IAAII,0BAA0B;GAC7DC,SAAS;GACTC,UAAU;EACd,CAAA;CACJ;CAIA,MAAMC,IAAIC,OAAkB;EAKxBrB,8BAA8BqB,OAAOC,IAJJ1B,2BAC7ByB,OACA,KAAKd,mBAE4Be,CAAAA;EAErC,MAAMC,cAAcF,MAAMG,QAAQC,IAAI,eAAA;EACtC,IAAI,CAACF,aACD;EAGJ,MAAMG,SAASrC,yBAAyBkC,WAAAA;EAExC,IAAIG,OAAOC,SAASvC,wBAAwBwC,QAAQ;GAChD,MAAM,KAAKC,gCAAgCR,OAAOK,MAAAA;GAClD;EACJ;EAEA,IAAIA,OAAOC,SAASvC,wBAAwB0C,OAAO;GAC/C,MAAM,KAAKC,+BAA+BV,OAAOK,MAAAA;GACjD;EACJ;EAEA,MAAM3C,gBAAgBiD,gBAAgBN,OAAOC,IAAI;CACrD;;;IAKA,MAAgBE,gCACZR,OACAK,QACF;EACE,MAAMO,UAAU,MAAM,KAAK3B,oBAAoB4B,OAAOR,OAAOS,KAAK;EAClE,MAAM,KAAKC,yBAAyBf,OAAOY,OAAAA;EAC3C,IAAIA,QAAQI,SAASnD,gBAAgBoD,KAAK;GACtC,MAAM,KAAKC,qBAAqBlB,OAAOY,OAAAA;GACvC;EACJ;EAEA,IAAIA,QAAQI,SAASnD,gBAAgBsD,QACjC,MAAMxD,SAASyD,uBAAuB,MAAA;EAG1C,IAAI,CAACR,QAAQS,UACT,MAAM1D,SAASyD,uBAAuB,UAAA;EAG1CtC,gBAAgBkB,OAAOK,OAAOS,KAAK;EAEnC,IAAIF,QAAQU,OACR1C,iBAAiBoB,OAAOlC,uBAAuB8C,QAAQU,KAAK,CAAA;EAKhE,IAAI,CAACV,QAAQW,YACT,MAAM5D,SAASyD,uBAAuB,YAAA;EAG1C,MAAMI,UAAU,MAAM,KAAKpC,eAAeqC,YAAYb,QAAQW,UAAU;EACxE,IAAI,CAACC,SACD,MAAM7D,SAAS+D,QAAO;EAG1B,IAAI;GACA,MAAM,KAAKtC,eAAeyB,OAAOW,OAAAA;EACrC,QAAQ;GACJ,MAAM7D,SAAS+D,QAAO;EAC1B;EAEA,MAAM,KAAKtC,eAAeuC,KAAKH,OAAAA;EAE/B3C,oBAAoBmB,OAAOY,QAAQW,UAAU;EAI7C,IAAI,CAACX,QAAQgB,UACT,MAAMjE,SAASyD,uBAAuB,UAAA;EAG1C,IAAI,CAACR,QAAQiB,KACT,MAAMlE,SAASyD,uBAAuB,KAAA;EAG1C,MAAMU,WAAW,MAAM,KAAK3C,iBAAiB4C,QACzCnB,QAAQgB,UACRhB,QAAQiB,GAAG;EAGf,IAAIC,UACArD,mBAAmBuB,OAAO8B,QAAAA;CAElC;CAEA,MAAgBf,yBAAyBf,OAAkBY,SAA4C;EACnG,IAAI,CAACA,QAAQoB,KACT;EAGJ,MAAMC,qBAAqBrB,QAAQoB,IAAI;EACvC,IAAI,OAAOC,uBAAuB,YAAYA,mBAAmBC,WAAW,GACxE,MAAMvE,SAASwE,QAAO;EAG1B,IAAI;GACA,MAAMC,WAAW,MAAM5D,iCACnBwB,OACA,KAAKhB,QAAQqD,qBAAqB,UAAA;GAEtC,IAAI,CAACD,YAAYA,SAASE,eAAeL,oBACrC,MAAMtE,SAASwE,QAAO;GAG1B9D,+CAA+C+D,QAAAA;EACnD,QAAQ;GACJ,MAAMzE,SAASwE,QAAO;EAC1B;CACJ;;;;;;;;;;IAYA,MAAgBjB,qBACZlB,OACAY,SACF;EACE,IAAIA,QAAQgB,aAAahE,cAAc2E,MACnC,MAAM5E,SAASyD,uBAAuB,UAAA;EAG1C,IAAI,CAACR,QAAQiB,KACT,MAAMlE,SAASyD,uBAAuB,KAAA;EAG1C,IAAI,CAACR,QAAQS,UACT,MAAM1D,SAASyD,uBAAuB,UAAA;EAG1C,IAAI,CAACR,QAAQW,YACT,MAAM5D,SAASyD,uBAAuB,YAAA;EAG1C,MAAMI,UAAU,MAAM,KAAKpC,eAAeqC,YAAYb,QAAQW,UAAU;EACxE,IAAI,CAACC,SACD,MAAM7D,SAAS+D,QAAO;EAG1B,IAAI;GACA,MAAM,KAAKtC,eAAeyB,OAAOW,OAAAA;EACrC,QAAQ;GACJ,MAAM7D,SAAS+D,QAAO;EAC1B;EAIA,IACIF,QAAQK,QAAQjB,QAAQiB,OACxBL,QAAQI,aAAapE,aAAa+E,MAElC,MAAM5E,SAAS+D,QAAO;EAG1B,MAAM,KAAKtC,eAAeuC,KAAKH,OAAAA;EAE/B,MAAMM,WAAW,MAAM,KAAK3C,iBAAiB4C,QACzCnB,QAAQgB,UACRhB,QAAQiB,GAAG;EAEf,IAAI,CAACC,UACD,MAAMnE,SAAS+D,QAAO;EAG1BhD,yBAAyBsB,OAAO;GAC5B8B,UAAU,IAAIxD,gBAAgBwD,QAAAA;GAC9BlB;EACJ,CAAA;CACJ;CAEA,MAAgBF,+BACZV,OACAK,QACF;EACE,IAAI,KAAKrB,QAAQwD,iBAAiB;GAC9B,MAAMC,gBAAgB,MAAM,KAAKpD,oBAAoBqD,iBACjDrC,OAAOsC,UACPtC,OAAOuC,QAAQ;GAEnB,IAAIH,cAAcI,SAAS;IACvBjE,iBAAiBoB,OAAO,CAACvC,UAAUqF,MAAAA,CAAO;IAC1CrE,mBAAmBuB,OAAO;KACtBM,MAAM9C,aAAauF;KACnBC,MAAMP,cAAcO;IACxB,CAAA;GACJ;EACJ;EAEA,IAAI,KAAKhE,QAAQiE,eAAe;GAC5B,MAAMC,gBAAgB,MAAM,KAAK3D,kBAAkBmD,iBAC/CrC,OAAOsC,UACPtC,OAAOuC,QAAQ;GAGnB,IAAIM,cAAcL,SAAS;IACvBjE,iBAAiBoB,OAAO,CAACvC,UAAUqF,MAAAA,CAAO;IAC1CrE,mBAAmBuB,OAAO;KACtBM,MAAM9C,aAAa+E;KACnBS,MAAME,cAAcF;IACxB,CAAA;IAEA;GACJ;EACJ;EAEA,IAAI,KAAKhE,QAAQmE,gBAAgB;GAC7B,MAAMD,gBAAgB,MAAM,KAAK5D,mBAAmBoD,iBAChDrC,OAAOsC,UACPtC,OAAOuC,QAAQ;GAEnB,IAAIM,cAAcL,SAAS;IACvBjE,iBAAiBoB,OAAO,CAACvC,UAAUqF,MAAAA,CAAO;IAC1CrE,mBAAmBuB,OAAO;KACtBM,MAAM9C,aAAa4F;KACnBJ,MAAME,cAAcF;IACxB,CAAA;GACJ;EACJ;CACJ;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["PermissionEvaluator","IdentityType","ScopeName","AuthHeaderError","JWTError","OAuth2SubKind","OAuth2TokenKind","deserializeOAuth2Scope","AuthorizationHeaderType","parseAuthorizationHeader","ClientAuthenticator","PolicyEngine","UserAuthenticator","assertClientCertificateEvidenceValidForBinding","RequestIdentity","RequestPermissionEvaluator","extractClientCertificateEvidence","setRequestIdentity","setRequestMfaLoginTicket","setRequestPermissionEvaluator","setRequestScopes","setRequestSessionId","setRequestToken","AuthorizationMiddleware","options","oauth2TokenVerifier","permissionEvaluator","identityResolver","sessionManager","clientAuthenticator","userAuthenticator","ctx","provider","permissionProvider","policyEngine","identityPermissionProvider","realmId","clientId","run","event","requestAccessContext","headerValue","headers","get","header","type","BEARER","verifyBearerAuthorizationHeader","BASIC","verifyBasicAuthorizationHeader","unsupportedType","payload","verify","token","verifyCertificateBinding","kind","MFA","verifyMfaLoginTicket","ACCESS","payloadPropertyInvalid","realm_id","scope","session_id","session","findOneById","expired","ping","sub_kind","sub","identity","resolve","cnf","expectedThumbprint","length","invalid","evidence","certificateSource","thumbprint","USER","subKind","clientAuthBasic","authenticator","safeAuthenticate","username","password","success","GLOBAL","CLIENT","data","userAuthBasic","authenticated"],"sources":["../../../../../../src/adapters/http/middleware/built-in/authorization/module.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { IPermissionEvaluator } from '@authup/access';\nimport { PermissionEvaluator } from '@authup/access';\nimport type { Client, User } from '@authup/core-kit';\nimport {\n IdentityType,\n ScopeName,\n} from '@authup/core-kit';\nimport { AuthHeaderError } from '@authup/errors';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport {\n JWTError,\n OAuth2SubKind,\n OAuth2TokenKind,\n deserializeOAuth2Scope,\n} from '@authup/specs';\nimport type { IAppEvent } from 'routup';\nimport {\n AuthorizationHeaderType,\n type BasicAuthorizationHeader,\n type BearerAuthorizationHeader,\n parseAuthorizationHeader,\n} from 'hapic';\nimport {\n ClientAuthenticator,\n PolicyEngine,\n UserAuthenticator,\n assertClientCertificateEvidenceValidForBinding,\n} from '../../../../../core/index.ts';\nimport type {\n ICredentialsAuthenticator,\n IIdentityResolver,\n IOAuth2TokenVerifier,\n ISessionManager,\n} from '../../../../../core/index.ts';\nimport {\n RequestIdentity,\n RequestPermissionEvaluator,\n extractClientCertificateEvidence,\n setRequestIdentity,\n setRequestMfaLoginTicket,\n setRequestPermissionEvaluator,\n setRequestScopes,\n setRequestSessionId,\n setRequestToken,\n} from '../../../request/index.ts';\nimport type { HTTPAuthorizationMiddlewareContext, HTTPAuthorizationMiddlewareOptions } from './types.ts';\n\nexport class AuthorizationMiddleware {\n protected options: HTTPAuthorizationMiddlewareOptions;\n\n // --------------------------------------\n\n protected oauth2TokenVerifier: IOAuth2TokenVerifier;\n\n protected permissionEvaluator: IPermissionEvaluator;\n\n // --------------------------------------\n\n protected identityResolver: IIdentityResolver;\n\n protected sessionManager : ISessionManager;\n\n // --------------------------------------\n\n protected clientAuthenticator : ICredentialsAuthenticator<Client>;\n\n protected userAuthenticator : ICredentialsAuthenticator<User>;\n\n // --------------------------------------\n\n constructor(ctx: HTTPAuthorizationMiddlewareContext) {\n this.options = ctx.options \|\| {};\n\n this.identityResolver = ctx.identityResolver;\n this.sessionManager = ctx.sessionManager;\n\n this.clientAuthenticator = new ClientAuthenticator(ctx.identityResolver);\n this.userAuthenticator = new UserAuthenticator(ctx.identityResolver);\n\n this.oauth2TokenVerifier = ctx.oauth2TokenVerifier;\n\n this.permissionEvaluator = new PermissionEvaluator({\n provider: ctx.permissionProvider,\n policyEngine: new PolicyEngine(ctx.identityPermissionProvider),\n realmId: null,\n clientId: null,\n });\n }\n\n // --------------------------------------\n\n async run(event: IAppEvent) {\n const requestAccessContext = new RequestPermissionEvaluator(\n event,\n this.permissionEvaluator,\n );\n setRequestPermissionEvaluator(event, requestAccessContext);\n\n const headerValue = event.headers.get('authorization');\n if (!headerValue) {\n return;\n }\n\n const header = parseAuthorizationHeader(headerValue);\n\n if (header.type === AuthorizationHeaderType.BEARER) {\n await this.verifyBearerAuthorizationHeader(event, header);\n return;\n }\n\n if (header.type === AuthorizationHeaderType.BASIC) {\n await this.verifyBasicAuthorizationHeader(event, header);\n return;\n }\n\n throw AuthHeaderError.unsupportedType(header.type);\n }\n\n /\n @throws JWTError\n /\n protected async verifyBearerAuthorizationHeader(\n event: IAppEvent,\n header: BearerAuthorizationHeader,\n ) {\n const payload = await this.oauth2TokenVerifier.verify(header.token);\n await this.verifyCertificateBinding(event, payload);\n if (payload.kind === OAuth2TokenKind.MFA) {\n await this.verifyMfaLoginTicket(event, payload);\n return;\n }\n\n if (payload.kind !== OAuth2TokenKind.ACCESS) {\n throw JWTError.payloadPropertyInvalid('kind');\n }\n\n if (!payload.realm_id) {\n throw JWTError.payloadPropertyInvalid('realm_id');\n }\n\n setRequestToken(event, header.token);\n\n if (payload.scope) {\n setRequestScopes(event, deserializeOAuth2Scope(payload.scope));\n }\n\n // -------------------------------------------------------\n\n if (!payload.session_id) {\n throw JWTError.payloadPropertyInvalid('session_id');\n }\n\n const session = await this.sessionManager.findOneById(payload.session_id);\n if (!session) {\n throw JWTError.expired();\n }\n\n try {\n await this.sessionManager.verify(session);\n } catch {\n throw JWTError.expired();\n }\n\n await this.sessionManager.ping(session);\n\n setRequestSessionId(event, payload.session_id);\n\n // -------------------------------------------------------\n\n if (!payload.sub_kind) {\n throw JWTError.payloadPropertyInvalid('sub_kind');\n }\n\n if (!payload.sub) {\n throw JWTError.payloadPropertyInvalid('sub');\n }\n\n const identity = await this.identityResolver.resolve(\n payload.sub_kind,\n payload.sub,\n );\n\n if (identity) {\n setRequestIdentity(event, identity);\n }\n }\n\n protected async verifyCertificateBinding(event: IAppEvent, payload: OAuth2TokenPayload): Promise<void> {\n if (!payload.cnf) {\n return;\n }\n\n const expectedThumbprint = payload.cnf['x5t#S256'];\n if (typeof expectedThumbprint !== 'string' \|\| expectedThumbprint.length === 0) {\n throw JWTError.invalid();\n }\n\n try {\n const evidence = await extractClientCertificateEvidence(\n event,\n this.options.certificateSource ?? 'disabled',\n );\n if (!evidence \|\| evidence.thumbprint !== expectedThumbprint) {\n throw JWTError.invalid();\n }\n\n assertClientCertificateEvidenceValidForBinding(evidence);\n } catch {\n throw JWTError.invalid();\n }\n }\n\n /\n An \"MFA-pending\" login ticket (issue #3242). Verified with the same\n * rigor as an access token (session existence + subject match), but\n * stashed on a DEDICATED request slot — the main identity / scope /\n * session slots stay empty, so every identity-gated route rejects a\n * ticket bearer (default-deny); only the challenge routes opt in via\n * useRequestMfaLoginTicket.\n \n @throws JWTError\n */\n protected async verifyMfaLoginTicket(\n event: IAppEvent,\n payload: OAuth2TokenPayload,\n ) {\n if (payload.sub_kind !== OAuth2SubKind.USER) {\n throw JWTError.payloadPropertyInvalid('sub_kind');\n }\n\n if (!payload.sub) {\n throw JWTError.payloadPropertyInvalid('sub');\n }\n\n if (!payload.realm_id) {\n throw JWTError.payloadPropertyInvalid('realm_id');\n }\n\n if (!payload.session_id) {\n throw JWTError.payloadPropertyInvalid('session_id');\n }\n\n const session = await this.sessionManager.findOneById(payload.session_id);\n if (!session) {\n throw JWTError.expired();\n }\n\n try {\n await this.sessionManager.verify(session);\n } catch {\n throw JWTError.expired();\n }\n\n // defense in depth — the pending session must still belong to the\n // ticket subject.\n if (\n session.sub !== payload.sub \|\|\n session.subKind !== IdentityType.USER\n ) {\n throw JWTError.expired();\n }\n\n await this.sessionManager.ping(session);\n\n const identity = await this.identityResolver.resolve(\n payload.sub_kind,\n payload.sub,\n );\n if (!identity) {\n throw JWTError.expired();\n }\n\n setRequestMfaLoginTicket(event, {\n identity: new RequestIdentity(identity),\n payload,\n });\n }\n\n protected async verifyBasicAuthorizationHeader(\n event: IAppEvent,\n header: BasicAuthorizationHeader,\n ) {\n if (this.options.clientAuthBasic) {\n const authenticator = await this.clientAuthenticator.safeAuthenticate(\n header.username,\n header.password,\n );\n if (authenticator.success) {\n setRequestScopes(event, [ScopeName.GLOBAL]);\n setRequestIdentity(event, {\n type: IdentityType.CLIENT,\n data: authenticator.data,\n });\n }\n }\n\n if (this.options.userAuthBasic) {\n const authenticated = await this.userAuthenticator.safeAuthenticate(\n header.username,\n header.password,\n );\n\n if (authenticated.success) {\n setRequestScopes(event, [ScopeName.GLOBAL]);\n setRequestIdentity(event, {\n type: IdentityType.USER,\n data: authenticated.data,\n });\n }\n }\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAsDA,IAAauB,0BAAb,MAAaA;CACCC;CAIAC;CAEAC;CAIAC;CAEAC;CAIAC;CAEAC;CAIV,YAAYC,KAAyC;EACjD,KAAKP,UAAUO,IAAIP,WAAW,CAAC;EAE/B,KAAKG,mBAAmBI,IAAIJ;EAC5B,KAAKC,iBAAiBG,IAAIH;EAE1B,KAAKC,sBAAsB,IAAInB,oBAAoBqB,IAAIJ,gBAAgB;EACvE,KAAKG,oBAAoB,IAAIlB,kBAAkBmB,IAAIJ,gBAAgB;EAEnE,KAAKF,sBAAsBM,IAAIN;EAE/B,KAAKC,sBAAsB,IAAI1B,oBAAoB;GAC/CgC,UAAUD,IAAIE;GACdC,cAAc,IAAIvB,eAAaoB,IAAII,0BAA0B;GAC7DC,SAAS;GACTC,UAAU;EACd,CAAA;CACJ;CAIA,MAAMC,IAAIC,OAAkB;EAKxBpB,8BAA8BoB,OAAOC,IAJJzB,2BAC7BwB,OACA,KAAKb,mBAE4Bc,CAAAA;EAErC,MAAMC,cAAcF,MAAMG,QAAQC,IAAI,eAAA;EACtC,IAAI,CAACF,aACD;EAGJ,MAAMG,SAASnC,yBAAyBgC,WAAAA;EAExC,IAAIG,OAAOC,SAASrC,wBAAwBsC,QAAQ;GAChD,MAAM,KAAKC,gCAAgCR,OAAOK,MAAAA;GAClD;EACJ;EAEA,IAAIA,OAAOC,SAASrC,wBAAwBwC,OAAO;GAC/C,MAAM,KAAKC,+BAA+BV,OAAOK,MAAAA;GACjD;EACJ;EAEA,MAAMzC,gBAAgB+C,gBAAgBN,OAAOC,IAAI;CACrD;;;IAKA,MAAgBE,gCACZR,OACAK,QACF;EACE,MAAMO,UAAU,MAAM,KAAK1B,oBAAoB2B,OAAOR,OAAOS,KAAK;EAClE,MAAM,KAAKC,yBAAyBf,OAAOY,OAAAA;EAC3C,IAAIA,QAAQI,SAASjD,gBAAgBkD,KAAK;GACtC,MAAM,KAAKC,qBAAqBlB,OAAOY,OAAAA;GACvC;EACJ;EAEA,IAAIA,QAAQI,SAASjD,gBAAgBoD,QACjC,MAAMtD,SAASuD,uBAAuB,MAAA;EAG1C,IAAI,CAACR,QAAQS,UACT,MAAMxD,SAASuD,uBAAuB,UAAA;EAG1CrC,gBAAgBiB,OAAOK,OAAOS,KAAK;EAEnC,IAAIF,QAAQU,OACRzC,iBAAiBmB,OAAOhC,uBAAuB4C,QAAQU,KAAK,CAAA;EAKhE,IAAI,CAACV,QAAQW,YACT,MAAM1D,SAASuD,uBAAuB,YAAA;EAG1C,MAAMI,UAAU,MAAM,KAAKnC,eAAeoC,YAAYb,QAAQW,UAAU;EACxE,IAAI,CAACC,SACD,MAAM3D,SAAS6D,QAAO;EAG1B,IAAI;GACA,MAAM,KAAKrC,eAAewB,OAAOW,OAAAA;EACrC,QAAQ;GACJ,MAAM3D,SAAS6D,QAAO;EAC1B;EAEA,MAAM,KAAKrC,eAAesC,KAAKH,OAAAA;EAE/B1C,oBAAoBkB,OAAOY,QAAQW,UAAU;EAI7C,IAAI,CAACX,QAAQgB,UACT,MAAM/D,SAASuD,uBAAuB,UAAA;EAG1C,IAAI,CAACR,QAAQiB,KACT,MAAMhE,SAASuD,uBAAuB,KAAA;EAG1C,MAAMU,WAAW,MAAM,KAAK1C,iBAAiB2C,QACzCnB,QAAQgB,UACRhB,QAAQiB,GAAG;EAGf,IAAIC,UACApD,mBAAmBsB,OAAO8B,QAAAA;CAElC;CAEA,MAAgBf,yBAAyBf,OAAkBY,SAA4C;EACnG,IAAI,CAACA,QAAQoB,KACT;EAGJ,MAAMC,qBAAqBrB,QAAQoB,IAAI;EACvC,IAAI,OAAOC,uBAAuB,YAAYA,mBAAmBC,WAAW,GACxE,MAAMrE,SAASsE,QAAO;EAG1B,IAAI;GACA,MAAMC,WAAW,MAAM3D,iCACnBuB,OACA,KAAKf,QAAQoD,qBAAqB,UAAA;GAEtC,IAAI,CAACD,YAAYA,SAASE,eAAeL,oBACrC,MAAMpE,SAASsE,QAAO;GAG1B7D,+CAA+C8D,QAAAA;EACnD,QAAQ;GACJ,MAAMvE,SAASsE,QAAO;EAC1B;CACJ;;;;;;;;;;IAYA,MAAgBjB,qBACZlB,OACAY,SACF;EACE,IAAIA,QAAQgB,aAAa9D,cAAcyE,MACnC,MAAM1E,SAASuD,uBAAuB,UAAA;EAG1C,IAAI,CAACR,QAAQiB,KACT,MAAMhE,SAASuD,uBAAuB,KAAA;EAG1C,IAAI,CAACR,QAAQS,UACT,MAAMxD,SAASuD,uBAAuB,UAAA;EAG1C,IAAI,CAACR,QAAQW,YACT,MAAM1D,SAASuD,uBAAuB,YAAA;EAG1C,MAAMI,UAAU,MAAM,KAAKnC,eAAeoC,YAAYb,QAAQW,UAAU;EACxE,IAAI,CAACC,SACD,MAAM3D,SAAS6D,QAAO;EAG1B,IAAI;GACA,MAAM,KAAKrC,eAAewB,OAAOW,OAAAA;EACrC,QAAQ;GACJ,MAAM3D,SAAS6D,QAAO;EAC1B;EAIA,IACIF,QAAQK,QAAQjB,QAAQiB,OACxBL,QAAQgB,YAAY9E,aAAa6E,MAEjC,MAAM1E,SAAS6D,QAAO;EAG1B,MAAM,KAAKrC,eAAesC,KAAKH,OAAAA;EAE/B,MAAMM,WAAW,MAAM,KAAK1C,iBAAiB2C,QACzCnB,QAAQgB,UACRhB,QAAQiB,GAAG;EAEf,IAAI,CAACC,UACD,MAAMjE,SAAS6D,QAAO;EAG1B/C,yBAAyBqB,OAAO;GAC5B8B,UAAU,IAAIvD,gBAAgBuD,QAAAA;GAC9BlB;EACJ,CAAA;CACJ;CAEA,MAAgBF,+BACZV,OACAK,QACF;EACE,IAAI,KAAKpB,QAAQwD,iBAAiB;GAC9B,MAAMC,gBAAgB,MAAM,KAAKpD,oBAAoBqD,iBACjDtC,OAAOuC,UACPvC,OAAOwC,QAAQ;GAEnB,IAAIH,cAAcI,SAAS;IACvBjE,iBAAiBmB,OAAO,CAACrC,UAAUoF,MAAO,CAAA;IAC1CrE,mBAAmBsB,OAAO;KACtBM,MAAM5C,aAAasF;KACnBC,MAAMP,cAAcO;IACxB,CAAA;GACJ;EACJ;EAEA,IAAI,KAAKhE,QAAQiE,eAAe;GAC5B,MAAMC,gBAAgB,MAAM,KAAK5D,kBAAkBoD,iBAC/CtC,OAAOuC,UACPvC,OAAOwC,QAAQ;GAGnB,IAAIM,cAAcL,SAAS;IACvBjE,iBAAiBmB,OAAO,CAACrC,UAAUoF,MAAO,CAAA;IAC1CrE,mBAAmBsB,OAAO;KACtBM,MAAM5C,aAAa6E;KACnBU,MAAME,cAAcF;IACxB,CAAA;GACJ;EACJ;CACJ;AACJ"}

package/dist/adapters/http/middleware/built-in/authorization/types.d.ts CHANGED Viewed

@@ -3,7 +3,6 @@ import type { IIdentityPermissionProvider, IIdentityResolver, IOAuth2TokenVerifi
 import type { CertificateSource } from '../../../request/index.ts';
 export type HTTPAuthorizationMiddlewareOptions = {
     clientAuthBasic?: boolean;
-    robotAuthBasic?: boolean;
     userAuthBasic?: boolean;
     certificateSource?: CertificateSource;
 };

package/dist/adapters/http/middleware/built-in/authorization/types.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/middleware/built-in/authorization/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAER,2BAA2B,EAC3B,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EAClB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,MAAM,MAAM,kCAAkC,GAAG;IAC7C,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,~~cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,~~aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CACzC,CAAC;AAEF,MAAM,MAAM,kCAAkC,GAAG;IAC7C,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,0BAA0B,EAAE,2BAA2B,CAAC;IACxD,cAAc,EAAE,eAAe,CAAC;IAChC,mBAAmB,EAAE,oBAAoB,CAAC;IAC1C,kBAAkB,EAAE,mBAAmB,CAAC;IAExC,OAAO,CAAC,EAAE,kCAAkC,CAAA;CAC/C,CAAC"}
1	+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/middleware/built-in/authorization/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAER,2BAA2B,EAC3B,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EAClB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,MAAM,MAAM,kCAAkC,GAAG;IAC7C,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CACzC,CAAC;AAEF,MAAM,MAAM,kCAAkC,GAAG;IAC7C,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,0BAA0B,EAAE,2BAA2B,CAAC;IACxD,cAAc,EAAE,eAAe,CAAC;IAChC,mBAAmB,EAAE,oBAAoB,CAAC;IAC1C,kBAAkB,EAAE,mBAAmB,CAAC;IAExC,OAAO,CAAC,EAAE,kCAAkC,CAAA;CAC/C,CAAC"}

package/dist/adapters/http/middleware/built-in/cors.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"cors.mjs","names":["cors","registerCorsMiddleware","router","input","use","origin","credentials","exposeHeaders"],"sources":["../../../../../src/adapters/http/middleware/built-in/cors.ts"],"sourcesContent":["/\n Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { Options as CorsOptions } from '@routup/cors';\nimport { cors } from '@routup/cors';\nimport type { App } from 'routup';\n\nexport function registerCorsMiddleware(router: App, input?: CorsOptions) {\n router.use(cors({\n // Reflect any origin by default: OAuth2 clients (and their UIs) are\n // registered at runtime on arbitrary domains, so a startup-time\n // allowlist cannot know them. All authentication is header-based\n // (Bearer/Basic) — no cookie-authenticated endpoint exists — so an\n // origin allowlist would add no security, only break dynamically\n // registered browser clients. Operators can still pass an explicit\n // `origin` via the middlewareCors config options.\n origin: true,\n credentials: true,\n // `credentials: true` is incompatible with the `` wildcard for\n // exposeHeaders, so enumerate the response headers JS clients need.\n exposeHeaders: [\n 'ratelimit-limit',\n 'ratelimit-remaining',\n 'ratelimit-reset',\n 'retry-after',\n 'etag',\n 'content-disposition',\n 'content-range',\n 'accept-ranges',\n 'location',\n 'www-authenticate',\n ],\n ...(input ?? {}),\n }));\n}\n"],"mappings":";;;;;AAWA,SAAgBC,uBAAuBC,QAAaC,OAAmB;CACnED,OAAOE,IAAIJ,KAAK;EAQZK,QAAQ;EACRC,aAAa;EAGbC,eAAe;GACX;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA~~;;EAEJ~~,GAAIJ,SAAS,CAAC;CAClB,CAAA,CAAA;AACJ"}
1	+ {"version":3,"file":"cors.mjs","names":["cors","registerCorsMiddleware","router","input","use","origin","credentials","exposeHeaders"],"sources":["../../../../../src/adapters/http/middleware/built-in/cors.ts"],"sourcesContent":["/\n Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { Options as CorsOptions } from '@routup/cors';\nimport { cors } from '@routup/cors';\nimport type { App } from 'routup';\n\nexport function registerCorsMiddleware(router: App, input?: CorsOptions) {\n router.use(cors({\n // Reflect any origin by default: OAuth2 clients (and their UIs) are\n // registered at runtime on arbitrary domains, so a startup-time\n // allowlist cannot know them. All authentication is header-based\n // (Bearer/Basic) — no cookie-authenticated endpoint exists — so an\n // origin allowlist would add no security, only break dynamically\n // registered browser clients. Operators can still pass an explicit\n // `origin` via the middlewareCors config options.\n origin: true,\n credentials: true,\n // `credentials: true` is incompatible with the `` wildcard for\n // exposeHeaders, so enumerate the response headers JS clients need.\n exposeHeaders: [\n 'ratelimit-limit',\n 'ratelimit-remaining',\n 'ratelimit-reset',\n 'retry-after',\n 'etag',\n 'content-disposition',\n 'content-range',\n 'accept-ranges',\n 'location',\n 'www-authenticate',\n ],\n ...(input ?? {}),\n }));\n}\n"],"mappings":";;;;;AAWA,SAAgBC,uBAAuBC,QAAaC,OAAmB;CACnED,OAAOE,IAAIJ,KAAK;EAQZK,QAAQ;EACRC,aAAa;EAGbC,eAAe;GACX;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACH;EACD,GAAIJ,SAAS,CAAC;CAClB,CAAA,CAAA;AACJ"}

package/dist/adapters/http/middleware/built-in/logger.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"logger.mjs","names":["logger","getRequestIP","EnvironmentName","SENSITIVE_QUERY_PARAMS","redactSensitiveURLParams","url","queryIndex","indexOf","params","URLSearchParams","substring","redacted","name","has","set","toString","createLoggerMiddleware","options","format","tokens","event","response","method","status","join","write","line","env","TEST","http","skip","path","length","PRODUCTION"],"sources":["../../../../../src/adapters/http/middleware/built-in/logger.ts"],"sourcesContent":["/\n Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { logger } from '@routup/logger';\nimport type { Handler } from 'routup';\nimport { getRequestIP } from 'routup';\nimport type { Logger } from '@authup/server-kit';\nimport { EnvironmentName } from '@authup/kit';\n\ntype LoggerMiddlewareOptions = {\n env: string,\n logger: Logger\n};\n\n// Query params whose values are credentials/tokens — the access log must never\n// persist them (a GET /logout?id_token_hint=<jwt> would otherwise write a\n// signature-valid token into the log).\nconst SENSITIVE_QUERY_PARAMS = [\n 'id_token_hint',\n 'id_token',\n 'access_token',\n 'refresh_token',\n 'token',\n 'code',\n 'client_secret',\n];\n\nexport function redactSensitiveURLParams(url: string): string {\n const queryIndex = url.indexOf('?');\n if (queryIndex === -1) {\n return url;\n }\n\n const params = new URLSearchParams(url.substring(queryIndex + 1));\n let redacted = false;\n for (const name of SENSITIVE_QUERY_PARAMS) {\n if (params.has(name)) {\n params.set(name, '**');\n redacted = true;\n }\n }\n\n if (!redacted) {\n return url;\n }\n\n return `${url.substring(0, queryIndex)}?${params.toString()}`;\n}\n\nexport function createLoggerMiddleware(options: LoggerMiddlewareOptions) : Handler {\n return logger({\n format: (tokens, event, response) => [\n getRequestIP(event) \|\| '-',\n '-',\n tokens.method(event, response) ?? '-',\n redactSensitiveURLParams(tokens.url(event, response) ?? '-'),\n tokens.status(event, response) ?? '-',\n '-',\n tokens['response-time'](event, response) ?? '-',\n ].join(' '),\n write(line) {\n if (options.env !== EnvironmentName.TEST) {\n options.logger.http(line);\n }\n },\n skip(event, response): boolean {\n const path = event.path \|\| '';\n if (path.length === 0 \|\| path === '/') {\n return true;\n }\n\n if (options.env === EnvironmentName.PRODUCTION) {\n return (response?.status ?? 0) < 400;\n }\n\n return false;\n },\n });\n}\n"],"mappings":";;;;;;;AAqBA,MAAMG,yBAAyB;CAC3B;CACA;CACA;CACA;CACA;CACA;CACA~~;;AAGJ~~,SAAgBC,yBAAyBC,KAAW;CAChD,MAAMC,aAAaD,IAAIE,QAAQ,GAAA;CAC/B,IAAID,eAAe,IACf,OAAOD;CAGX,MAAMG,SAAS,IAAIC,gBAAgBJ,IAAIK,UAAUJ,aAAa,CAAA,CAAA;CAC9D,IAAIK,WAAW;CACf,KAAK,MAAMC,QAAQT,wBACf,IAAIK,OAAOK,IAAID,IAAAA,GAAO;EAClBJ,OAAOM,IAAIF,MAAM,KAAA;EACjBD,WAAW;CACf;CAGJ,IAAI,CAACA,UACD,OAAON;CAGX,OAAO,GAAGA,IAAIK,UAAU,GAAGJ,UAAAA,EAAY,GAAGE,OAAOO,SAAQ;AAC7D;AAEA,SAAgBC,uBAAuBC,SAAgC;CACnE,OAAOjB,OAAO;EACVkB,SAASC,QAAQC,OAAOC,aAAa;GACjCpB,aAAamB,KAAAA,KAAU;GACvB;GACAD,OAAOG,OAAOF,OAAOC,QAAAA,KAAa;GAClCjB,yBAAyBe,OAAOd,IAAIe,OAAOC,QAAAA,KAAa,GAAA;GACxDF,OAAOI,OAAOH,OAAOC,QAAAA,KAAa;GAClC;GACAF,OAAO,gBAAgB,CAACC,OAAOC,QAAAA,KAAa;~~GAC~~/C,CAACG,KAAK,GAAA;EACPC,MAAMC,MAAI;GACN,IAAIT,QAAQU,QAAQzB,gBAAgB0B,MAChCX,QAAQjB,OAAO6B,KAAKH,IAAAA;EAE5B;EACAI,KAAKV,OAAOC,UAAQ;GAChB,MAAMU,OAAOX,MAAMW,QAAQ;GAC3B,IAAIA,KAAKC,WAAW,KAAKD,SAAS,KAC9B,OAAO;GAGX,IAAId,QAAQU,QAAQzB,gBAAgB+B,YAChC,QAAQZ,UAAUE,UAAU,KAAK;GAGrC,OAAO;EACX;CACJ,CAAA;AACJ"}
1	+ {"version":3,"file":"logger.mjs","names":["logger","getRequestIP","EnvironmentName","SENSITIVE_QUERY_PARAMS","redactSensitiveURLParams","url","queryIndex","indexOf","params","URLSearchParams","substring","redacted","name","has","set","toString","createLoggerMiddleware","options","format","tokens","event","response","method","status","join","write","line","env","TEST","http","skip","path","length","PRODUCTION"],"sources":["../../../../../src/adapters/http/middleware/built-in/logger.ts"],"sourcesContent":["/\n Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { logger } from '@routup/logger';\nimport type { Handler } from 'routup';\nimport { getRequestIP } from 'routup';\nimport type { Logger } from '@authup/server-kit';\nimport { EnvironmentName } from '@authup/kit';\n\ntype LoggerMiddlewareOptions = {\n env: string,\n logger: Logger\n};\n\n// Query params whose values are credentials/tokens — the access log must never\n// persist them (a GET /logout?id_token_hint=<jwt> would otherwise write a\n// signature-valid token into the log).\nconst SENSITIVE_QUERY_PARAMS = [\n 'id_token_hint',\n 'id_token',\n 'access_token',\n 'refresh_token',\n 'token',\n 'code',\n 'client_secret',\n];\n\nexport function redactSensitiveURLParams(url: string): string {\n const queryIndex = url.indexOf('?');\n if (queryIndex === -1) {\n return url;\n }\n\n const params = new URLSearchParams(url.substring(queryIndex + 1));\n let redacted = false;\n for (const name of SENSITIVE_QUERY_PARAMS) {\n if (params.has(name)) {\n params.set(name, '**');\n redacted = true;\n }\n }\n\n if (!redacted) {\n return url;\n }\n\n return `${url.substring(0, queryIndex)}?${params.toString()}`;\n}\n\nexport function createLoggerMiddleware(options: LoggerMiddlewareOptions) : Handler {\n return logger({\n format: (tokens, event, response) => [\n getRequestIP(event) \|\| '-',\n '-',\n tokens.method(event, response) ?? '-',\n redactSensitiveURLParams(tokens.url(event, response) ?? '-'),\n tokens.status(event, response) ?? '-',\n '-',\n tokens['response-time'](event, response) ?? '-',\n ].join(' '),\n write(line) {\n if (options.env !== EnvironmentName.TEST) {\n options.logger.http(line);\n }\n },\n skip(event, response): boolean {\n const path = event.path \|\| '';\n if (path.length === 0 \|\| path === '/') {\n return true;\n }\n\n if (options.env === EnvironmentName.PRODUCTION) {\n return (response?.status ?? 0) < 400;\n }\n\n return false;\n },\n });\n}\n"],"mappings":";;;;;;;AAqBA,MAAMG,yBAAyB;CAC3B;CACA;CACA;CACA;CACA;CACA;CACA;AACH;AAED,SAAgBC,yBAAyBC,KAAW;CAChD,MAAMC,aAAaD,IAAIE,QAAQ,GAAA;CAC/B,IAAID,eAAe,IACf,OAAOD;CAGX,MAAMG,SAAS,IAAIC,gBAAgBJ,IAAIK,UAAUJ,aAAa,CAAA,CAAA;CAC9D,IAAIK,WAAW;CACf,KAAK,MAAMC,QAAQT,wBACf,IAAIK,OAAOK,IAAID,IAAAA,GAAO;EAClBJ,OAAOM,IAAIF,MAAM,KAAA;EACjBD,WAAW;CACf;CAGJ,IAAI,CAACA,UACD,OAAON;CAGX,OAAO,GAAGA,IAAIK,UAAU,GAAGJ,UAAAA,EAAY,GAAGE,OAAOO,SAAQ;AAC7D;AAEA,SAAgBC,uBAAuBC,SAAgC;CACnE,OAAOjB,OAAO;EACVkB,SAASC,QAAQC,OAAOC,aAAa;GACjCpB,aAAamB,KAAAA,KAAU;GACvB;GACAD,OAAOG,OAAOF,OAAOC,QAAAA,KAAa;GAClCjB,yBAAyBe,OAAOd,IAAIe,OAAOC,QAAAA,KAAa,GAAA;GACxDF,OAAOI,OAAOH,OAAOC,QAAAA,KAAa;GAClC;GACAF,OAAO,gBAAgB,CAACC,OAAOC,QAAAA,KAAa;EAC/C,CAAA,CAACG,KAAK,GAAA;EACPC,MAAMC,MAAI;GACN,IAAIT,QAAQU,QAAQzB,gBAAgB0B,MAChCX,QAAQjB,OAAO6B,KAAKH,IAAAA;EAE5B;EACAI,KAAKV,OAAOC,UAAQ;GAChB,MAAMU,OAAOX,MAAMW,QAAQ;GAC3B,IAAIA,KAAKC,WAAW,KAAKD,SAAS,KAC9B,OAAO;GAGX,IAAId,QAAQU,QAAQzB,gBAAgB+B,YAChC,QAAQZ,UAAUE,UAAU,KAAK;GAGrC,OAAO;EACX;CACJ,CAAA;AACJ"}

package/dist/adapters/http/middleware/built-in/rate-limit.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/rate-limit.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAIlC,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,YAAY,~~QAyB5E~~"}
1	+ {"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/rate-limit.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAIlC,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,YAAY,QAwB5E"}

package/dist/adapters/http/middleware/built-in/rate-limit.mjs CHANGED Viewed

@@ -12,7 +12,6 @@ function registerRateLimitMiddleware(router, input) {
 			const identity = useRequestIdentity(event);
 			if (!identity) return 1200;
 			switch (identity.type) {
-				case "robot":
 				case "client": return 60 * 5e3;
 				default: return 6e3;
 			}

package/dist/adapters/http/middleware/built-in/rate-limit.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"rate-limit.mjs","names":["rateLimit","merge","useRequestIdentity","registerRateLimitMiddleware","router","input","options","max","event","identity","type","windowMs","use"],"sources":["../../../../../src/adapters/http/middleware/built-in/rate-limit.ts"],"sourcesContent":["/\n Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { OptionsInput } from '@routup/rate-limit';\nimport { rateLimit } from '@routup/rate-limit';\nimport type { App } from 'routup';\nimport { merge } from 'smob';\nimport { useRequestIdentity } from '../../request/index.ts';\n\nexport function registerRateLimitMiddleware(router: App, input?: OptionsInput) {\n let options : OptionsInput = {\n max(event) {\n const identity = useRequestIdentity(event);\n if (!identity) {\n return 60 20; // 20 req. p. sec\n }\n\n switch (identity.type) {\n case '~~robot':\n case '~~client': {\n return 60 * 5_000; // 1000 req p. sec\n }\n case 'user':\n default: {\n return 60 * 100; // 100 req p. sec\n }\n }\n },\n windowMs: 60 * 1000, // 60 sec\n };\n\n options = merge(input \|\| {}, options);\n\n router.use(rateLimit(options));\n}\n"],"mappings":";;;;;;;;AAaA,SAAgBG,4BAA4BC,QAAaC,OAAoB;CACzE,IAAIC,UAAyB;EACzBC,IAAIC,OAAK;GACL,MAAMC,WAAWP,mBAAmBM,KAAAA;GACpC,IAAI,CAACC,UACD,OAAO;GAGX,QAAQA,SAASC,MAAjB;IACI,KAAK~~;IACL~~,~~KAAK,~~UACD,OAAO,KAAK;IAGhB,SACI,OAAO;GAEf;EACJ;EACAC,UAAU,KAAK;CACnB;CAEAL,UAAUL,MAAMI,SAAS,CAAC,GAAGC,OAAAA;CAE7BF,OAAOQ,IAAIZ,UAAUM,OAAAA,CAAAA;AACzB"}
1	+ {"version":3,"file":"rate-limit.mjs","names":["rateLimit","merge","useRequestIdentity","registerRateLimitMiddleware","router","input","options","max","event","identity","type","windowMs","use"],"sources":["../../../../../src/adapters/http/middleware/built-in/rate-limit.ts"],"sourcesContent":["/\n Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { OptionsInput } from '@routup/rate-limit';\nimport { rateLimit } from '@routup/rate-limit';\nimport type { App } from 'routup';\nimport { merge } from 'smob';\nimport { useRequestIdentity } from '../../request/index.ts';\n\nexport function registerRateLimitMiddleware(router: App, input?: OptionsInput) {\n let options : OptionsInput = {\n max(event) {\n const identity = useRequestIdentity(event);\n if (!identity) {\n return 60 20; // 20 req. p. sec\n }\n\n switch (identity.type) {\n case 'client': {\n return 60 * 5_000; // 1000 req p. sec\n }\n case 'user':\n default: {\n return 60 * 100; // 100 req p. sec\n }\n }\n },\n windowMs: 60 * 1000, // 60 sec\n };\n\n options = merge(input \|\| {}, options);\n\n router.use(rateLimit(options));\n}\n"],"mappings":";;;;;;;;AAaA,SAAgBG,4BAA4BC,QAAaC,OAAoB;CACzE,IAAIC,UAAyB;EACzBC,IAAIC,OAAK;GACL,MAAMC,WAAWP,mBAAmBM,KAAAA;GACpC,IAAI,CAACC,UACD,OAAO;GAGX,QAAQA,SAASC,MAAjB;IACI,KAAK,UACD,OAAO,KAAK;IAGhB,SACI,OAAO;GAEf;EACJ;EACAC,UAAU,KAAK;CACnB;CAEAL,UAAUL,MAAMI,SAAS,CAAC,GAAGC,OAAAA;CAE7BF,OAAOQ,IAAIZ,UAAUM,OAAAA,CAAAA;AACzB"}

package/dist/adapters/http/request/client-certificate.d.ts CHANGED Viewed

@@ -1,3 +1,4 @@
+import '../../../core/client-certificate/reflect.ts';
 import type { IAppEvent } from 'routup';
 import type { ClientCertificateEvidence } from '../../../core/index.ts';
 import type { CertificateSource } from './types.ts';

package/dist/adapters/http/request/client-certificate.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"client-certificate.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/request/client-certificate.ts"],"names":[],"mappings":"~~AAUA~~,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAKxE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAMpD,wBAAsB,gCAAgC,CAClD,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,iBAAiB,GAC1B,OAAO,CAAC,yBAAyB,GAAG,SAAS,CAAC,CAqBhD"}
1	+ {"version":3,"file":"client-certificate.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/request/client-certificate.ts"],"names":[],"mappings":"AAOA,OAAO,6CAA6C,CAAC;AAIrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAKxE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAMpD,wBAAsB,gCAAgC,CAClD,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,iBAAiB,GAC1B,OAAO,CAAC,yBAAyB,GAAG,SAAS,CAAC,CAqBhD"}

package/dist/adapters/http/request/client-certificate.mjs CHANGED Viewed

@@ -1,6 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import "../../../core/client-certificate/reflect.mjs";
 import { buildClientCertificateThumbprint, parseClientCertificateChain } from "../../../core/client-certificate/module.mjs";
 import "../../../core/index.mjs";
 import { base64ToArrayBuffer } from "@authup/kit";

package/dist/adapters/http/request/client-certificate.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"client-certificate.mjs","names":["X509Certificate","BadRequestError","base64ToArrayBuffer","buildClientCertificateThumbprint","parseClientCertificateChain","MAX_CERTIFICATE_HEADER_LENGTH","MAX_CERTIFICATE_CHAIN_LENGTH","STRUCTURED_BINARY_PATTERN","extractClientCertificateEvidence","event","source","undefined","result","extractStandardEvidence","extractForwardedEvidence","thumbprint","certificate","leafHeader","headers","get","chainHeader","certificateHeaderError","assertHeaderLength","parseStructuredCertificate","chain","parseStructuredCertificateList","value","pem","includes","decodeURIComponent","replace","certificates","length","items","split","map","item","trim","some","match","exec","raw","byteLength","toString"],"sources":["../../../../src/adapters/http/request/client-certificate.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { X509Certificate } from '@peculiar/x509';\nimport { BadRequestError } from '@authup/errors';\nimport { base64ToArrayBuffer } from '@authup/kit';\nimport type { IAppEvent } from 'routup';\nimport type { ClientCertificateEvidence } from '../../../core/index.ts';\nimport {\n buildClientCertificateThumbprint,\n parseClientCertificateChain,\n} from '../../../core/index.ts';\nimport type { CertificateSource } from './types.ts';\n\nconst MAX_CERTIFICATE_HEADER_LENGTH = 128 1024;\nconst MAX_CERTIFICATE_CHAIN_LENGTH = 10;\nconst STRUCTURED_BINARY_PATTERN = /^:([A-Za-z0-9+/]*={0,2}):$/;\n\nexport async function extractClientCertificateEvidence(\n event: IAppEvent,\n source: CertificateSource,\n): Promise<ClientCertificateEvidence \| undefined> {\n if (source === 'disabled') {\n return undefined;\n }\n\n let result: Omit<ClientCertificateEvidence, 'thumbprint'> \| undefined;\n if (source === 'standard') {\n result = extractStandardEvidence(event);\n } else if (source === 'forwarded') {\n result = extractForwardedEvidence(event);\n } else {\n throw new BadRequestError('The client certificate source is not configured correctly.');\n }\n if (!result) {\n return undefined;\n }\n\n return {\n ...result,\n thumbprint: await buildClientCertificateThumbprint(result.certificate),\n };\n}\n\nfunction extractStandardEvidence(\n event: IAppEvent,\n): Omit<ClientCertificateEvidence, 'thumbprint'> \| undefined {\n const leafHeader = event.headers.get('client-cert');\n const chainHeader = event.headers.get('client-cert-chain');\n\n if (!leafHeader) {\n if (chainHeader) {\n throw certificateHeaderError();\n }\n return undefined;\n }\n\n assertHeaderLength(leafHeader);\n const certificate = parseStructuredCertificate(leafHeader);\n const chain = chainHeader ? parseStructuredCertificateList(chainHeader) : [];\n\n return { certificate, chain };\n}\n\nfunction extractForwardedEvidence(\n event: IAppEvent,\n): Omit<ClientCertificateEvidence, 'thumbprint'> \| undefined {\n const value = event.headers.get('x-forwarded-tls-client-cert');\n if (!value) {\n return undefined;\n }\n\n assertHeaderLength(value);\n\n let pem: string;\n try {\n // Native raw PEM is useful in tests and a few proxy integrations. The\n // NGINX/Traefik contract is escaped PEM: query-style `+` represents a\n // space, while literal base64 plus signs arrive as `%2B`.\n pem = value.includes('-----BEGIN CERTIFICATE-----') ?\n value :\n decodeURIComponent(value.replace(/\\+/g, '%20'));\n } catch {\n throw certificateHeaderError();\n }\n\n let certificates: X509Certificate[];\n try {\n certificates = parseClientCertificateChain(pem);\n } catch {\n throw certificateHeaderError();\n }\n\n if (certificates.length !== 1 \|\| !certificates[0]) {\n throw certificateHeaderError();\n }\n\n return {\n certificate: certificates[0],\n chain: [],\n };\n}\n\nfunction parseStructuredCertificateList(value: string): X509Certificate[] {\n assertHeaderLength(value);\n const items = value.split(',').map((item) => item.trim());\n if (items.length > MAX_CERTIFICATE_CHAIN_LENGTH \|\| items.some((item) => item.length === 0)) {\n throw certificateHeaderError();\n }\n\n return items.map(parseStructuredCertificate);\n}\n\nfunction parseStructuredCertificate(value: string): X509Certificate {\n const match = STRUCTURED_BINARY_PATTERN.exec(value.trim());\n if (!match?.[1]) {\n throw certificateHeaderError();\n }\n\n try {\n const raw = base64ToArrayBuffer(match[1]);\n if (raw.byteLength === 0) {\n throw certificateHeaderError();\n }\n\n const certificate = new X509Certificate(raw);\n if (\n certificate.toString('base64').replace(/=+$/, '') !==\n match[1].replace(/=+$/, '')\n ) {\n throw certificateHeaderError();\n }\n\n return certificate;\n } catch {\n throw certificateHeaderError();\n }\n}\n\nfunction assertHeaderLength(value: string): void {\n if (value.length > MAX_CERTIFICATE_HEADER_LENGTH) {\n throw certificateHeaderError();\n }\n}\n\nfunction certificateHeaderError(): BadRequestError {\n return new BadRequestError('The forwarded client certificate header is malformed.');\n}\n"],"mappings":"~~;;;;;;;;;AAkBA~~,MAAMK,gCAAgC,MAAM;AAC5C,MAAMC,+BAA+B;AACrC,MAAMC,4BAA4B;AAElC,eAAsBC,iCAClBC,OACAC,QAAyB;CAEzB,IAAIA,WAAW,YACX;CAGJ,IAAIE;CACJ,IAAIF,WAAW,YACXE,SAASC,wBAAwBJ,KAAAA;MAC9B,IAAIC,WAAW,aAClBE,SAASE,yBAAyBL,KAAAA;MAElC,MAAM,IAAIR,gBAAgB,4DAAA;CAE9B,IAAI,CAACW,QACD;CAGJ,OAAO;EACH,GAAGA;EACHG,YAAY,MAAMZ,iCAAiCS,OAAOI,WAAW;CACzE;AACJ;AAEA,SAASH,wBACLJ,OAAgB;CAEhB,MAAMQ,aAAaR,MAAMS,QAAQC,IAAI,aAAA;CACrC,MAAMC,cAAcX,MAAMS,QAAQC,IAAI,mBAAA;CAEtC,IAAI,CAACF,YAAY;EACb,IAAIG,aACA,MAAMC,uBAAAA;EAEV;CACJ;CAEAC,mBAAmBL,UAAAA;CAInB,OAAO;EAAED,aAHWO,2BAA2BN,UAGtCD;EAAaQ,OAFRJ,cAAcK,+BAA+BL,WAAAA,IAAe,CAAA;CAE9C;AAChC;AAEA,SAASN,yBACLL,OAAgB;CAEhB,MAAMiB,QAAQjB,MAAMS,QAAQC,IAAI,6BAAA;CAChC,IAAI,CAACO,OACD;CAGJJ,mBAAmBI,KAAAA;CAEnB,IAAIC;CACJ,IAAI;EAIAA,MAAMD,MAAME,SAAS,6BAAA,IACjBF,QACAG,mBAAmBH,MAAMI,QAAQ,OAAO,KAAA,CAAA;CAChD,QAAQ;EACJ,MAAMT,uBAAAA;CACV;CAEA,IAAIU;CACJ,IAAI;EACAA,eAAe3B,4BAA4BuB,GAAAA;CAC/C,QAAQ;EACJ,MAAMN,uBAAAA;CACV;CAEA,IAAIU,aAAaC,WAAW,KAAK,CAACD,aAAa,IAC3C,MAAMV,uBAAAA;CAGV,OAAO;EACHL,aAAae,aAAa;EAC1BP,OAAO,CAAA;CACX;AACJ;AAEA,SAASC,+BAA+BC,OAAa;CACjDJ,mBAAmBI,KAAAA;CACnB,MAAMO,QAAQP,MAAMQ,MAAM,GAAA,CAAA,CAAKC,KAAKC,SAASA,KAAKC,KAAI,CAAA;CACtD,IAAIJ,MAAMD,SAAS1B,gCAAgC2B,MAAMK,MAAMF,SAASA,KAAKJ,WAAW,CAAA,GACpF,MAAMX,uBAAAA;CAGV,OAAOY,MAAME,IAAIZ,0BAAAA;AACrB;AAEA,SAASA,2BAA2BG,OAAa;CAC7C,MAAMa,QAAQhC,0BAA0BiC,KAAKd,MAAMW,KAAI,CAAA;CACvD,IAAI,CAACE,QAAQ,IACT,MAAMlB,uBAAAA;CAGV,IAAI;EACA,MAAMoB,MAAMvC,oBAAoBqC,MAAM,EAAE;EACxC,IAAIE,IAAIC,eAAe,GACnB,MAAMrB,uBAAAA;EAGV,MAAML,cAAc,IAAIhB,gBAAgByC,GAAAA;EACxC,IACIzB,YAAY2B,SAAS,QAAA,CAAA,CAAUb,QAAQ,OAAO,EAAA,MAC9CS,MAAM,EAAE,CAACT,QAAQ,OAAO,EAAA,GAExB,MAAMT,uBAAAA;EAGV,OAAOL;CACX,QAAQ;EACJ,MAAMK,uBAAAA;CACV;AACJ;AAEA,SAASC,mBAAmBI,OAAa;CACrC,IAAIA,MAAMM,SAAS3B,+BACf,MAAMgB,uBAAAA;AAEd;AAEA,SAASA,yBAAAA;CACL,OAAO,IAAIpB,gBAAgB,uDAAA;AAC/B"}
1	+ {"version":3,"file":"client-certificate.mjs","names":["X509Certificate","BadRequestError","base64ToArrayBuffer","buildClientCertificateThumbprint","parseClientCertificateChain","MAX_CERTIFICATE_HEADER_LENGTH","MAX_CERTIFICATE_CHAIN_LENGTH","STRUCTURED_BINARY_PATTERN","extractClientCertificateEvidence","event","source","undefined","result","extractStandardEvidence","extractForwardedEvidence","thumbprint","certificate","leafHeader","headers","get","chainHeader","certificateHeaderError","assertHeaderLength","parseStructuredCertificate","chain","parseStructuredCertificateList","value","pem","includes","decodeURIComponent","replace","certificates","length","items","split","map","item","trim","some","match","exec","raw","byteLength","toString"],"sources":["../../../../src/adapters/http/request/client-certificate.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport '../../../core/client-certificate/reflect.ts';\nimport { X509Certificate } from '@peculiar/x509';\nimport { BadRequestError } from '@authup/errors';\nimport { base64ToArrayBuffer } from '@authup/kit';\nimport type { IAppEvent } from 'routup';\nimport type { ClientCertificateEvidence } from '../../../core/index.ts';\nimport {\n buildClientCertificateThumbprint,\n parseClientCertificateChain,\n} from '../../../core/index.ts';\nimport type { CertificateSource } from './types.ts';\n\nconst MAX_CERTIFICATE_HEADER_LENGTH = 128 1024;\nconst MAX_CERTIFICATE_CHAIN_LENGTH = 10;\nconst STRUCTURED_BINARY_PATTERN = /^:([A-Za-z0-9+/]*={0,2}):$/;\n\nexport async function extractClientCertificateEvidence(\n event: IAppEvent,\n source: CertificateSource,\n): Promise<ClientCertificateEvidence \| undefined> {\n if (source === 'disabled') {\n return undefined;\n }\n\n let result: Omit<ClientCertificateEvidence, 'thumbprint'> \| undefined;\n if (source === 'standard') {\n result = extractStandardEvidence(event);\n } else if (source === 'forwarded') {\n result = extractForwardedEvidence(event);\n } else {\n throw new BadRequestError('The client certificate source is not configured correctly.');\n }\n if (!result) {\n return undefined;\n }\n\n return {\n ...result,\n thumbprint: await buildClientCertificateThumbprint(result.certificate),\n };\n}\n\nfunction extractStandardEvidence(\n event: IAppEvent,\n): Omit<ClientCertificateEvidence, 'thumbprint'> \| undefined {\n const leafHeader = event.headers.get('client-cert');\n const chainHeader = event.headers.get('client-cert-chain');\n\n if (!leafHeader) {\n if (chainHeader) {\n throw certificateHeaderError();\n }\n return undefined;\n }\n\n assertHeaderLength(leafHeader);\n const certificate = parseStructuredCertificate(leafHeader);\n const chain = chainHeader ? parseStructuredCertificateList(chainHeader) : [];\n\n return { certificate, chain };\n}\n\nfunction extractForwardedEvidence(\n event: IAppEvent,\n): Omit<ClientCertificateEvidence, 'thumbprint'> \| undefined {\n const value = event.headers.get('x-forwarded-tls-client-cert');\n if (!value) {\n return undefined;\n }\n\n assertHeaderLength(value);\n\n let pem: string;\n try {\n // Native raw PEM is useful in tests and a few proxy integrations. The\n // NGINX/Traefik contract is escaped PEM: query-style `+` represents a\n // space, while literal base64 plus signs arrive as `%2B`.\n pem = value.includes('-----BEGIN CERTIFICATE-----') ?\n value :\n decodeURIComponent(value.replace(/\\+/g, '%20'));\n } catch {\n throw certificateHeaderError();\n }\n\n let certificates: X509Certificate[];\n try {\n certificates = parseClientCertificateChain(pem);\n } catch {\n throw certificateHeaderError();\n }\n\n if (certificates.length !== 1 \|\| !certificates[0]) {\n throw certificateHeaderError();\n }\n\n return {\n certificate: certificates[0],\n chain: [],\n };\n}\n\nfunction parseStructuredCertificateList(value: string): X509Certificate[] {\n assertHeaderLength(value);\n const items = value.split(',').map((item) => item.trim());\n if (items.length > MAX_CERTIFICATE_CHAIN_LENGTH \|\| items.some((item) => item.length === 0)) {\n throw certificateHeaderError();\n }\n\n return items.map(parseStructuredCertificate);\n}\n\nfunction parseStructuredCertificate(value: string): X509Certificate {\n const match = STRUCTURED_BINARY_PATTERN.exec(value.trim());\n if (!match?.[1]) {\n throw certificateHeaderError();\n }\n\n try {\n const raw = base64ToArrayBuffer(match[1]);\n if (raw.byteLength === 0) {\n throw certificateHeaderError();\n }\n\n const certificate = new X509Certificate(raw);\n if (\n certificate.toString('base64').replace(/=+$/, '') !==\n match[1].replace(/=+$/, '')\n ) {\n throw certificateHeaderError();\n }\n\n return certificate;\n } catch {\n throw certificateHeaderError();\n }\n}\n\nfunction assertHeaderLength(value: string): void {\n if (value.length > MAX_CERTIFICATE_HEADER_LENGTH) {\n throw certificateHeaderError();\n }\n}\n\nfunction certificateHeaderError(): BadRequestError {\n return new BadRequestError('The forwarded client certificate header is malformed.');\n}\n"],"mappings":";;;;;;;;;;AAmBA,MAAMK,gCAAgC,MAAM;AAC5C,MAAMC,+BAA+B;AACrC,MAAMC,4BAA4B;AAElC,eAAsBC,iCAClBC,OACAC,QAAyB;CAEzB,IAAIA,WAAW,YACX;CAGJ,IAAIE;CACJ,IAAIF,WAAW,YACXE,SAASC,wBAAwBJ,KAAAA;MAC9B,IAAIC,WAAW,aAClBE,SAASE,yBAAyBL,KAAAA;MAElC,MAAM,IAAIR,gBAAgB,4DAAA;CAE9B,IAAI,CAACW,QACD;CAGJ,OAAO;EACH,GAAGA;EACHG,YAAY,MAAMZ,iCAAiCS,OAAOI,WAAW;CACzE;AACJ;AAEA,SAASH,wBACLJ,OAAgB;CAEhB,MAAMQ,aAAaR,MAAMS,QAAQC,IAAI,aAAA;CACrC,MAAMC,cAAcX,MAAMS,QAAQC,IAAI,mBAAA;CAEtC,IAAI,CAACF,YAAY;EACb,IAAIG,aACA,MAAMC,uBAAAA;EAEV;CACJ;CAEAC,mBAAmBL,UAAAA;CAInB,OAAO;EAAED,aAHWO,2BAA2BN,UAGtCD;EAAaQ,OAFRJ,cAAcK,+BAA+BL,WAAAA,IAAe,CAAA;CAE9C;AAChC;AAEA,SAASN,yBACLL,OAAgB;CAEhB,MAAMiB,QAAQjB,MAAMS,QAAQC,IAAI,6BAAA;CAChC,IAAI,CAACO,OACD;CAGJJ,mBAAmBI,KAAAA;CAEnB,IAAIC;CACJ,IAAI;EAIAA,MAAMD,MAAME,SAAS,6BAAA,IACjBF,QACAG,mBAAmBH,MAAMI,QAAQ,OAAO,KAAA,CAAA;CAChD,QAAQ;EACJ,MAAMT,uBAAAA;CACV;CAEA,IAAIU;CACJ,IAAI;EACAA,eAAe3B,4BAA4BuB,GAAAA;CAC/C,QAAQ;EACJ,MAAMN,uBAAAA;CACV;CAEA,IAAIU,aAAaC,WAAW,KAAK,CAACD,aAAa,IAC3C,MAAMV,uBAAAA;CAGV,OAAO;EACHL,aAAae,aAAa;EAC1BP,OAAO,CAAA;CACX;AACJ;AAEA,SAASC,+BAA+BC,OAAa;CACjDJ,mBAAmBI,KAAAA;CACnB,MAAMO,QAAQP,MAAMQ,MAAM,GAAA,CAAA,CAAKC,KAAKC,SAASA,KAAKC,KAAI,CAAA;CACtD,IAAIJ,MAAMD,SAAS1B,gCAAgC2B,MAAMK,MAAMF,SAASA,KAAKJ,WAAW,CAAA,GACpF,MAAMX,uBAAAA;CAGV,OAAOY,MAAME,IAAIZ,0BAAAA;AACrB;AAEA,SAASA,2BAA2BG,OAAa;CAC7C,MAAMa,QAAQhC,0BAA0BiC,KAAKd,MAAMW,KAAI,CAAA;CACvD,IAAI,CAACE,QAAQ,IACT,MAAMlB,uBAAAA;CAGV,IAAI;EACA,MAAMoB,MAAMvC,oBAAoBqC,MAAM,EAAE;EACxC,IAAIE,IAAIC,eAAe,GACnB,MAAMrB,uBAAAA;EAGV,MAAML,cAAc,IAAIhB,gBAAgByC,GAAAA;EACxC,IACIzB,YAAY2B,SAAS,QAAA,CAAA,CAAUb,QAAQ,OAAO,EAAA,MAC9CS,MAAM,EAAE,CAACT,QAAQ,OAAO,EAAA,GAExB,MAAMT,uBAAAA;EAGV,OAAOL;CACX,QAAQ;EACJ,MAAMK,uBAAAA;CACV;AACJ;AAEA,SAASC,mBAAmBI,OAAa;CACrC,IAAIA,MAAMM,SAAS3B,+BACf,MAAMgB,uBAAAA;AAEd;AAEA,SAASA,yBAAAA;CACL,OAAO,IAAIpB,gBAAgB,uDAAA;AAC/B"}

package/dist/adapters/http/request/constants.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"constants.mjs","names":["RequestHandlerOperation","CERTIFICATE_SOURCES"],"sources":["../../../../src/adapters/http/request/constants.ts"],"sourcesContent":["/\n Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nexport enum RequestHandlerOperation {\n COMMAND = 'command',\n CREATE = 'create',\n READ = 'read',\n UPDATE = 'update',\n DELETE = 'delete',\n}\n\nexport const CERTIFICATE_SOURCES = [\n 'disabled',\n 'standard',\n 'forwarded',\n] as const;\n"],"mappings":";;;;AAOA,IAAO,0BAAKA,uBAAAA,yBAAAA;;;;;;~~QAAAA;;AAQZ~~,MAAaC,sBAAsB;CAC/B;CACA;CACA"}
1	+ {"version":3,"file":"constants.mjs","names":["RequestHandlerOperation","CERTIFICATE_SOURCES"],"sources":["../../../../src/adapters/http/request/constants.ts"],"sourcesContent":["/\n Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nexport enum RequestHandlerOperation {\n COMMAND = 'command',\n CREATE = 'create',\n READ = 'read',\n UPDATE = 'update',\n DELETE = 'delete',\n}\n\nexport const CERTIFICATE_SOURCES = [\n 'disabled',\n 'standard',\n 'forwarded',\n] as const;\n"],"mappings":";;;;AAOA,IAAO,0BAAKA,uBAAAA,yBAAAA;;;;;;CAAAA,OAAAA;AAMX,EAAA,CAAA,CAAA;AAED,MAAaC,sBAAsB;CAC/B;CACA;CACA;AACH"}

package/dist/adapters/http/request/helpers/body-realm-id.mjs CHANGED Viewed

@@ -4,7 +4,7 @@ import.meta.url;
 import { isUUID } from "@authup/kit";
 //#region src/adapters/http/request/helpers/body-realm-id.ts
 function getBodyRealmID(body) {
-	const realmId = body?.realm_id;
+	const realmId = body?.realmId;
 	if (typeof realmId !== "string") return;
 	if (!isUUID(realmId)) return;
 	return realmId;

package/dist/adapters/http/request/helpers/body-realm-id.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"body-realm-id.mjs","names":["isUUID","getBodyRealmID","body","realmId","~~realm_id","~~undefined"],"sources":["../../../../../src/adapters/http/request/helpers/body-realm-id.ts"],"sourcesContent":["/\n Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isUUID } from '@authup/kit';\n\nexport function getBodyRealmID(body: Record<string, any> \| undefined) : string \| undefined {\n const realmId = body?.~~realm_id~~;\n if (typeof realmId !== 'string') {\n return undefined;\n }\n\n if (!isUUID(realmId)) {\n return undefined;\n }\n\n return realmId;\n}\n"],"mappings":";;;;;AASA,SAAgBC,eAAeC,MAAqC;CAChE,MAAMC,UAAUD,~~MAAME~~;CACtB,IAAI,~~OAAOD~~,YAAY,UACnB;CAGJ,IAAI,CAACH,OAAOG,OAAAA,GACR;CAGJ,OAAOA;AACX"}
1	+ {"version":3,"file":"body-realm-id.mjs","names":["isUUID","getBodyRealmID","body","realmId","undefined"],"sources":["../../../../../src/adapters/http/request/helpers/body-realm-id.ts"],"sourcesContent":["/\n Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isUUID } from '@authup/kit';\n\nexport function getBodyRealmID(body: Record<string, any> \| undefined) : string \| undefined {\n const realmId = body?.realmId;\n if (typeof realmId !== 'string') {\n return undefined;\n }\n\n if (!isUUID(realmId)) {\n return undefined;\n }\n\n return realmId;\n}\n"],"mappings":";;;;;AASA,SAAgBC,eAAeC,MAAqC;CAChE,MAAMC,UAAUD,MAAMC;CACtB,IAAI,OAAOA,YAAY,UACnB;CAGJ,IAAI,CAACH,OAAOG,OAAAA,GACR;CAGJ,OAAOA;AACX"}

package/dist/adapters/http/request/helpers/identity.d.ts CHANGED Viewed

@@ -4,8 +4,8 @@ export declare class RequestIdentity {
     readonly raw: Identity;
     constructor(identity: Identity);
     get clientId(): any;
-    get data(): import("@authup/core-kit").Client | import("@authup/core-kit").Robot | import("@authup/core-kit").User;
-    get type(): "user" | "client" | "robot";
+    get data(): import("@authup/core-kit").Client | import("@authup/core-kit").User;
+    get type(): "user" | "client";
     get id(): string;
     get realmId(): string;
     get realmName(): string;

package/dist/adapters/http/request/helpers/identity.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/helpers/identity.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAGjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAIxC,qBAAa,eAAe;IACxB,SAAgB,GAAG,EAAG,QAAQ,CAAC;gBAEnB,QAAQ,EAAE,QAAQ;IAI9B,IAAI,QAAQ,QAOX;IAED,IAAI,IAAI,~~2GAEP~~;IAED,IAAI,IAAI,~~gCAEP~~;IAED,IAAI,EAAE,WAEL;IAED,IAAI,OAAO,WAEV;IAED,IAAI,SAAS,WAEZ;CACJ;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,GAAI,eAAe,GAAG,SAAS,CAEjF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,GAAG,eAAe,GAAI,IAAI,CAU7F;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,SAAS,GAAI,eAAe,CAO3E"}
1	+ {"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/helpers/identity.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAGjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAIxC,qBAAa,eAAe;IACxB,SAAgB,GAAG,EAAG,QAAQ,CAAC;gBAEnB,QAAQ,EAAE,QAAQ;IAI9B,IAAI,QAAQ,QAOX;IAED,IAAI,IAAI,wEAEP;IAED,IAAI,IAAI,sBAEP;IAED,IAAI,EAAE,WAEL;IAED,IAAI,OAAO,WAEV;IAED,IAAI,SAAS,WAEZ;CACJ;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,GAAI,eAAe,GAAG,SAAS,CAEjF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,GAAG,eAAe,GAAI,IAAI,CAU7F;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,SAAS,GAAI,eAAe,CAO3E"}

package/dist/adapters/http/request/helpers/identity.mjs CHANGED Viewed

@@ -13,7 +13,7 @@ var RequestIdentity = class {
 	get clientId() {
 		const { raw } = this;
 		if (raw.type === IdentityType.CLIENT) return raw.data.id;
-		return raw.data.client_id || null;
+		return raw.data.clientId || null;
 	}
 	get data() {
 		return this.raw.data;
@@ -25,7 +25,7 @@ var RequestIdentity = class {
 		return this.raw.data.id;
 	}
 	get realmId() {
-		return this.raw.data.realm_id || this.raw.data.realm?.id;
+		return this.raw.data.realmId || this.raw.data.realm?.id;
 	}
 	get realmName() {
 		return this.raw.data.realm?.name;

package/dist/adapters/http/request/helpers/identity.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"identity.mjs","names":["IdentityType","UnauthorizedError","sym","Symbol","RequestIdentity","raw","identity","clientId","type","CLIENT","data","id","~~client_id","~~realmId","~~realm_id","~~realm","realmName","name","useRequestIdentity","event","store","setRequestIdentity","input","useRequestIdentityOrFail"],"sources":["../../../../../src/adapters/http/request/helpers/identity.ts"],"sourcesContent":["/\n Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Identity } from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { UnauthorizedError } from '@authup/errors';\nimport type { IAppEvent } from 'routup';\n\nconst sym = Symbol('RIdentity');\n\nexport class RequestIdentity {\n public readonly raw : Identity;\n\n constructor(identity: Identity) {\n this.raw = identity;\n }\n\n get clientId() {\n const { raw } = this;\n if (raw.type === IdentityType.CLIENT) {\n return raw.data.id;\n }\n\n return raw.data.~~client_id~~ \|\| null;\n }\n\n get data() {\n return this.raw.data;\n }\n\n get type() {\n return this.raw.type;\n }\n\n get id() {\n return this.raw.data.id;\n }\n\n get realmId() {\n return this.raw.data.~~realm_id~~ \|\| this.raw.data.realm?.id;\n }\n\n get realmName() {\n return this.raw.data.realm?.name;\n }\n}\n\nexport function useRequestIdentity(event: IAppEvent) : RequestIdentity \| undefined {\n return event.store[sym] as RequestIdentity \| undefined;\n}\n\nexport function setRequestIdentity(event: IAppEvent, input: Identity \| RequestIdentity) : void {\n let data : RequestIdentity;\n\n if (input instanceof RequestIdentity) {\n data = input;\n } else {\n data = new RequestIdentity(input);\n }\n\n event.store[sym] = data;\n}\n\nexport function useRequestIdentityOrFail(event: IAppEvent) : RequestIdentity {\n const identity = useRequestIdentity(event);\n if (!identity) {\n throw new UnauthorizedError();\n }\n\n return identity;\n}\n"],"mappings":";;;;;;AAYA,MAAME,MAAMC,OAAO,WAAA;AAEnB,IAAaC,kBAAb,MAAaA;CACOC;CAEhB,YAAYC,UAAoB;EAC5B,KAAKD,MAAMC;CACf;CAEA,IAAIC,WAAW;EACX,MAAM,EAAEF,QAAQ;EAChB,IAAIA,IAAIG,SAASR,aAAaS,QAC1B,OAAOJ,IAAIK,KAAKC;EAGpB,OAAON,IAAIK,~~KAAKE~~,~~aAAa~~;~~CACjC~~;CAEA,~~IAAIF~~,OAAO;EACP,OAAO,KAAKL,IAAIK;CACpB;CAEA,IAAIF,OAAO;EACP,OAAO,KAAKH,IAAIG;CACpB;CAEA,IAAIG,KAAK;EACL,OAAO,KAAKN,IAAIK,KAAKC;CACzB;CAEA,~~IAAIE~~,UAAU;EACV,OAAO,~~KAAKR~~,IAAIK,~~KAAKI~~,~~YAAY~~,~~KAAKT~~,IAAIK,~~KAAKK~~,~~OAAOJ~~;~~CAC1D~~;CAEA,~~IAAIK~~,YAAY;EACZ,OAAO,~~KAAKX~~,IAAIK,~~KAAKK~~,OAAOE;CAChC;AACJ;AAEA,SAAgBC,mBAAmBC,OAAgB;CAC/C,OAAOA,MAAMC,~~MAAMlB~~;AACvB;AAEA,~~SAAgBmB~~,mBAAmBF,OAAkBG,OAAiC;CAClF,~~IAAIZ~~;CAEJ,~~IAAIY~~,~~iBAAiBlB~~,iBACjBM,~~OAAOY~~;~~MAEPZ~~,OAAO,IAAIN,~~gBAAgBkB~~,KAAAA;CAG/BH,MAAMC,~~MAAMlB~~,OAAOQ;AACvB;AAEA,~~SAAgBa~~,yBAAyBJ,OAAgB;CACrD,~~MAAMb~~,~~WAAWY~~,mBAAmBC,KAAAA;CACpC,IAAI,~~CAACb~~,UACD,MAAM,IAAIL,kBAAAA;CAGd,OAAOK;AACX"}
1	+ {"version":3,"file":"identity.mjs","names":["IdentityType","UnauthorizedError","sym","Symbol","RequestIdentity","raw","identity","clientId","type","CLIENT","data","id","realmId","realm","realmName","name","useRequestIdentity","event","store","setRequestIdentity","input","useRequestIdentityOrFail"],"sources":["../../../../../src/adapters/http/request/helpers/identity.ts"],"sourcesContent":["/\n Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Identity } from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { UnauthorizedError } from '@authup/errors';\nimport type { IAppEvent } from 'routup';\n\nconst sym = Symbol('RIdentity');\n\nexport class RequestIdentity {\n public readonly raw : Identity;\n\n constructor(identity: Identity) {\n this.raw = identity;\n }\n\n get clientId() {\n const { raw } = this;\n if (raw.type === IdentityType.CLIENT) {\n return raw.data.id;\n }\n\n return raw.data.clientId \|\| null;\n }\n\n get data() {\n return this.raw.data;\n }\n\n get type() {\n return this.raw.type;\n }\n\n get id() {\n return this.raw.data.id;\n }\n\n get realmId() {\n return this.raw.data.realmId \|\| this.raw.data.realm?.id;\n }\n\n get realmName() {\n return this.raw.data.realm?.name;\n }\n}\n\nexport function useRequestIdentity(event: IAppEvent) : RequestIdentity \| undefined {\n return event.store[sym] as RequestIdentity \| undefined;\n}\n\nexport function setRequestIdentity(event: IAppEvent, input: Identity \| RequestIdentity) : void {\n let data : RequestIdentity;\n\n if (input instanceof RequestIdentity) {\n data = input;\n } else {\n data = new RequestIdentity(input);\n }\n\n event.store[sym] = data;\n}\n\nexport function useRequestIdentityOrFail(event: IAppEvent) : RequestIdentity {\n const identity = useRequestIdentity(event);\n if (!identity) {\n throw new UnauthorizedError();\n }\n\n return identity;\n}\n"],"mappings":";;;;;;AAYA,MAAME,MAAMC,OAAO,WAAA;AAEnB,IAAaC,kBAAb,MAAaA;CACOC;CAEhB,YAAYC,UAAoB;EAC5B,KAAKD,MAAMC;CACf;CAEA,IAAIC,WAAW;EACX,MAAM,EAAEF,QAAQ;EAChB,IAAIA,IAAIG,SAASR,aAAaS,QAC1B,OAAOJ,IAAIK,KAAKC;EAGpB,OAAON,IAAIK,KAAKH,YAAY;CAChC;CAEA,IAAIG,OAAO;EACP,OAAO,KAAKL,IAAIK;CACpB;CAEA,IAAIF,OAAO;EACP,OAAO,KAAKH,IAAIG;CACpB;CAEA,IAAIG,KAAK;EACL,OAAO,KAAKN,IAAIK,KAAKC;CACzB;CAEA,IAAIC,UAAU;EACV,OAAO,KAAKP,IAAIK,KAAKE,WAAW,KAAKP,IAAIK,KAAKG,OAAOF;CACzD;CAEA,IAAIG,YAAY;EACZ,OAAO,KAAKT,IAAIK,KAAKG,OAAOE;CAChC;AACJ;AAEA,SAAgBC,mBAAmBC,OAAgB;CAC/C,OAAOA,MAAMC,MAAMhB;AACvB;AAEA,SAAgBiB,mBAAmBF,OAAkBG,OAAiC;CAClF,IAAIV;CAEJ,IAAIU,iBAAiBhB,iBACjBM,OAAOU;MAEPV,OAAO,IAAIN,gBAAgBgB,KAAAA;CAG/BH,MAAMC,MAAMhB,OAAOQ;AACvB;AAEA,SAAgBW,yBAAyBJ,OAAgB;CACrD,MAAMX,WAAWU,mBAAmBC,KAAAA;CACpC,IAAI,CAACX,UACD,MAAM,IAAIL,kBAAAA;CAGd,OAAOK;AACX"}

package/dist/adapters/http/request/helpers/param-id.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"param-id.mjs","names":["isUUID","ValidupError","buildErrorMessageForAttribute","defineIssueItem","useRequestParamID","event","options","id","getRequestParamID","path","message","getRequestStringParam","undefined","key","value","params","length","getRequestStringParamOrFail"],"sources":["../../../../../src/adapters/http/request/helpers/param-id.ts"],"sourcesContent":["/\n Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { isUUID } from '@authup/kit';\nimport type { IAppEvent } from 'routup';\nimport { ValidupError, buildErrorMessageForAttribute, defineIssueItem } from 'validup';\n\ntype RequestIDParamOptions = {\n /\n default: true\n */\n isUUID?: boolean\n};\n\nexport function useRequestParamID(event: IAppEvent, options: RequestIDParamOptions = {}) : string {\n const id = getRequestParamID(event, options);\n if (typeof id === 'undefined') {\n throw new ValidupError([\n defineIssueItem({\n path: ['id'],\n message: buildErrorMessageForAttribute('id'),\n }),\n ]);\n }\n\n return id;\n}\n\nexport function getRequestParamID(event: IAppEvent, options: RequestIDParamOptions = {}) : string \| undefined {\n const id = getRequestStringParam(event, 'id');\n if (!id) {\n return undefined;\n }\n\n options.isUUID = options.isUUID ?? true;\n if (options.isUUID && !isUUID(id)) {\n return undefined;\n }\n\n return id;\n}\n\nexport function getRequestStringParam(event: IAppEvent, key: string) : string \| undefined {\n const value = event.params[key];\n if (typeof value !== 'string' \|\| value.length === 0) {\n return undefined;\n }\n\n return value;\n}\n\nexport function getRequestStringParamOrFail(event: IAppEvent, key: string) : string \| undefined {\n const value = getRequestStringParam(event, key);\n if (typeof value === 'undefined') {\n throw new ValidupError([\n defineIssueItem({\n path: [key],\n message: buildErrorMessageForAttribute(key),\n }),\n ]);\n }\n\n return value;\n}\n"],"mappings":";;;;;;AAkBA,SAAgBI,kBAAkBC,OAAkBC,UAAiC,CAAC,GAAC;CACnF,MAAMC,KAAKC,kBAAkBH,OAAOC,OAAAA;CACpC,IAAI,OAAOC,OAAO,aACd,MAAM,IAAIN,aAAa,CACnBE,gBAAgB;EACZM,MAAM,CAAC,~~IAAA~~;~~EACPC~~,SAASR,8BAA8B,IAAA;CAC3C,CAAA,CAAA~~,CACH~~;CAGL,OAAOK;AACX;AAEA,SAAgBC,kBAAkBH,OAAkBC,UAAiC,CAAC,GAAC;CACnF,MAAMC,KAAKI,sBAAsBN,OAAO,IAAA;CACxC,IAAI,CAACE,IACD;CAGJD,QAAQN,SAASM,QAAQN,UAAU;CACnC,IAAIM,QAAQN,UAAU,CAACA,OAAOO,EAAAA,GAC1B;CAGJ,OAAOA;AACX;AAEA,SAAgBI,sBAAsBN,OAAkBQ,KAAW;CAC/D,MAAMC,QAAQT,MAAMU,OAAOF;CAC3B,IAAI,OAAOC,UAAU,YAAYA,MAAME,WAAW,GAC9C;CAGJ,OAAOF;AACX;AAEA,SAAgBG,4BAA4BZ,OAAkBQ,KAAW;CACrE,MAAMC,QAAQH,sBAAsBN,OAAOQ,GAAAA;CAC3C,IAAI,OAAOC,UAAU,aACjB,MAAM,IAAIb,aAAa,CACnBE,gBAAgB;EACZM,MAAM,CAACI,~~GAAAA~~;~~EACPH~~,SAASR,8BAA8BW,GAAAA;CAC3C,CAAA,CAAA~~,CACH~~;CAGL,OAAOC;AACX"}
1	+ {"version":3,"file":"param-id.mjs","names":["isUUID","ValidupError","buildErrorMessageForAttribute","defineIssueItem","useRequestParamID","event","options","id","getRequestParamID","path","message","getRequestStringParam","undefined","key","value","params","length","getRequestStringParamOrFail"],"sources":["../../../../../src/adapters/http/request/helpers/param-id.ts"],"sourcesContent":["/\n Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { isUUID } from '@authup/kit';\nimport type { IAppEvent } from 'routup';\nimport { ValidupError, buildErrorMessageForAttribute, defineIssueItem } from 'validup';\n\ntype RequestIDParamOptions = {\n /\n default: true\n */\n isUUID?: boolean\n};\n\nexport function useRequestParamID(event: IAppEvent, options: RequestIDParamOptions = {}) : string {\n const id = getRequestParamID(event, options);\n if (typeof id === 'undefined') {\n throw new ValidupError([\n defineIssueItem({\n path: ['id'],\n message: buildErrorMessageForAttribute('id'),\n }),\n ]);\n }\n\n return id;\n}\n\nexport function getRequestParamID(event: IAppEvent, options: RequestIDParamOptions = {}) : string \| undefined {\n const id = getRequestStringParam(event, 'id');\n if (!id) {\n return undefined;\n }\n\n options.isUUID = options.isUUID ?? true;\n if (options.isUUID && !isUUID(id)) {\n return undefined;\n }\n\n return id;\n}\n\nexport function getRequestStringParam(event: IAppEvent, key: string) : string \| undefined {\n const value = event.params[key];\n if (typeof value !== 'string' \|\| value.length === 0) {\n return undefined;\n }\n\n return value;\n}\n\nexport function getRequestStringParamOrFail(event: IAppEvent, key: string) : string \| undefined {\n const value = getRequestStringParam(event, key);\n if (typeof value === 'undefined') {\n throw new ValidupError([\n defineIssueItem({\n path: [key],\n message: buildErrorMessageForAttribute(key),\n }),\n ]);\n }\n\n return value;\n}\n"],"mappings":";;;;;;AAkBA,SAAgBI,kBAAkBC,OAAkBC,UAAiC,CAAC,GAAC;CACnF,MAAMC,KAAKC,kBAAkBH,OAAOC,OAAAA;CACpC,IAAI,OAAOC,OAAO,aACd,MAAM,IAAIN,aAAa,CACnBE,gBAAgB;EACZM,MAAM,CAAC,IAAK;EACZC,SAASR,8BAA8B,IAAA;CAC3C,CAAA,CACH,CAAA;CAGL,OAAOK;AACX;AAEA,SAAgBC,kBAAkBH,OAAkBC,UAAiC,CAAC,GAAC;CACnF,MAAMC,KAAKI,sBAAsBN,OAAO,IAAA;CACxC,IAAI,CAACE,IACD;CAGJD,QAAQN,SAASM,QAAQN,UAAU;CACnC,IAAIM,QAAQN,UAAU,CAACA,OAAOO,EAAAA,GAC1B;CAGJ,OAAOA;AACX;AAEA,SAAgBI,sBAAsBN,OAAkBQ,KAAW;CAC/D,MAAMC,QAAQT,MAAMU,OAAOF;CAC3B,IAAI,OAAOC,UAAU,YAAYA,MAAME,WAAW,GAC9C;CAGJ,OAAOF;AACX;AAEA,SAAgBG,4BAA4BZ,OAAkBQ,KAAW;CACrE,MAAMC,QAAQH,sBAAsBN,OAAOQ,GAAAA;CAC3C,IAAI,OAAOC,UAAU,aACjB,MAAM,IAAIb,aAAa,CACnBE,gBAAgB;EACZM,MAAM,CAACI,GAAI;EACXH,SAASR,8BAA8BW,GAAAA;CAC3C,CAAA,CACH,CAAA;CAGL,OAAOC;AACX"}

package/dist/adapters/http/request/helpers/realm-id.mjs CHANGED Viewed

@@ -14,7 +14,7 @@ function getRequestRealmID(event) {
 }
 function applyRouteRealmIDToBody(event, data) {
 	const routeRealmId = getRequestRealmID(event);
-	if (routeRealmId) data.realm_id = routeRealmId;
+	if (routeRealmId) data.realmId = routeRealmId;
 }
 //#endregion
 export { applyRouteRealmIDToBody, getRequestRealmID, setRequestRealmID };

package/dist/adapters/http/request/helpers/realm-id.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"realm-id.mjs","names":["getRequestStringParam","sym","Symbol","setRequestRealmID","event","id","store","getRequestRealmID","stored","applyRouteRealmIDToBody","data","routeRealmId","~~realm_id~~"],"sources":["../../../../../src/adapters/http/request/helpers/realm-id.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IAppEvent } from 'routup';\nimport { getRequestStringParam } from './param-id.ts';\n\nconst sym = Symbol('RRealmID');\n\nexport function setRequestRealmID(event: IAppEvent, id: string): void {\n event.store[sym] = id;\n}\n\nexport function getRequestRealmID(event: IAppEvent): string \| undefined {\n const stored = event.store[sym] as string \| undefined;\n if (stored) {\n return stored;\n }\n return getRequestStringParam(event, 'realmId');\n}\n\nexport function applyRouteRealmIDToBody(event: IAppEvent, data: Record<string, any>): void {\n const routeRealmId = getRequestRealmID(event);\n if (routeRealmId) {\n data.~~realm_id~~ = routeRealmId;\n }\n}\n"],"mappings":";;;;;AAUA,MAAMC,MAAMC,OAAO,UAAA;AAEnB,SAAgBC,kBAAkBC,OAAkBC,IAAU;CAC1DD,MAAME,MAAML,OAAOI;AACvB;AAEA,SAAgBE,kBAAkBH,OAAgB;CAC9C,MAAMI,SAASJ,MAAME,MAAML;CAC3B,IAAIO,QACA,OAAOA;CAEX,OAAOR,sBAAsBI,OAAO,SAAA;AACxC;AAEA,SAAgBK,wBAAwBL,OAAkBM,MAAyB;CAC/E,MAAMC,eAAeJ,kBAAkBH,KAAAA;CACvC,IAAIO,cACAD,KAAKE,~~WAAWD~~;~~AAExB~~"}
1	+ {"version":3,"file":"realm-id.mjs","names":["getRequestStringParam","sym","Symbol","setRequestRealmID","event","id","store","getRequestRealmID","stored","applyRouteRealmIDToBody","data","routeRealmId","realmId"],"sources":["../../../../../src/adapters/http/request/helpers/realm-id.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IAppEvent } from 'routup';\nimport { getRequestStringParam } from './param-id.ts';\n\nconst sym = Symbol('RRealmID');\n\nexport function setRequestRealmID(event: IAppEvent, id: string): void {\n event.store[sym] = id;\n}\n\nexport function getRequestRealmID(event: IAppEvent): string \| undefined {\n const stored = event.store[sym] as string \| undefined;\n if (stored) {\n return stored;\n }\n return getRequestStringParam(event, 'realmId');\n}\n\nexport function applyRouteRealmIDToBody(event: IAppEvent, data: Record<string, any>): void {\n const routeRealmId = getRequestRealmID(event);\n if (routeRealmId) {\n data.realmId = routeRealmId;\n }\n}\n"],"mappings":";;;;;AAUA,MAAMC,MAAMC,OAAO,UAAA;AAEnB,SAAgBC,kBAAkBC,OAAkBC,IAAU;CAC1DD,MAAME,MAAML,OAAOI;AACvB;AAEA,SAAgBE,kBAAkBH,OAAgB;CAC9C,MAAMI,SAASJ,MAAME,MAAML;CAC3B,IAAIO,QACA,OAAOA;CAEX,OAAOR,sBAAsBI,OAAO,SAAA;AACxC;AAEA,SAAgBK,wBAAwBL,OAAkBM,MAAyB;CAC/E,MAAMC,eAAeJ,kBAAkBH,KAAAA;CACvC,IAAIO,cACAD,KAAKE,UAAUD;AAEvB"}

package/dist/adapters/http/request/helpers/redirect.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"redirect.mjs","names":["sanitizeRelativeRedirect","input","length","undefined","test","decoded","decodeURIComponent","candidate","startsWith","includes"],"sources":["../../../../../src/adapters/http/request/helpers/redirect.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\n/\n Open-redirect guard for the `redirect` query parameter carried by the\n * auth workflow pages: only same-origin relative paths pass through, so the\n * value can be safely reflected into an anchor href / forwarded as a\n * post-login destination.\n \n Rejects: non-strings, control/whitespace chars (browsers strip some,\n * shifting where the URL authority begins), protocol-relative (`//host`),\n * backslash variants (browsers normalise `\\` → `/`), and any scheme\n * (`javascript:`, `http:`) — both on the raw and once-decoded form so a\n * percent-encoded separator (`%2f`, `%5c`) can't slip past.\n */\nexport function sanitizeRelativeRedirect(input: unknown): string \| undefined {\n if (typeof input !== 'string' \|\| input.length === 0) {\n return undefined;\n }\n\n // Raw input: reject control chars AND whitespace (space/tab/newline) — a\n // raw space can shift where the URL authority begins.\n // eslint-disable-next-line no-control-regex\n if (/[\\u0000-\\u0020\\u007f]/.test(input)) {\n return undefined;\n }\n\n let decoded: string;\n try {\n decoded = decodeURIComponent(input);\n } catch {\n return undefined;\n }\n\n // Decoded form: reject C0 controls + DEL (CR/LF/NUL — the header-injection\n // vectors a `%0a`/`%0d` would smuggle past the raw check) but NOT space\n // (0x20), so a legitimate `%20` in the path still passes.\n // eslint-disable-next-line no-control-regex\n if (/[\\u0000-\\u001f\\u007f]/.test(decoded)) {\n return undefined;\n }\n\n for (const candidate of [input, decoded]) {\n if (!candidate.startsWith('/')) {\n return undefined;\n }\n if (candidate.length > 1 && (candidate[1] === '/' \|\| candidate[1] === '\\\\')) {\n return undefined;\n }\n if (candidate.includes('\\\\')) {\n return undefined;\n }\n }\n\n return input;\n}\n"],"mappings":";;;;;;;;;;;;;;;GAmBA,SAAgBA,yBAAyBC,OAAc;CACnD,IAAI,OAAOA,UAAU,YAAYA,MAAMC,WAAW,GAC9C;CAMJ,IAAI,wBAAwBE,KAAKH,KAAAA,GAC7B;CAGJ,IAAII;CACJ,IAAI;EACAA,UAAUC,mBAAmBL,KAAAA;CACjC,QAAQ;EACJ;CACJ;CAMA,IAAI,wBAAwBG,KAAKC,OAAAA,GAC7B;CAGJ,KAAK,MAAME,aAAa,CAACN,OAAOI,~~OAAAA~~,~~GAAU~~;EACtC,IAAI,CAACE,UAAUC,WAAW,GAAA,GACtB;EAEJ,IAAID,UAAUL,SAAS,MAAMK,UAAU,OAAO,OAAOA,UAAU,OAAO,OAClE;EAEJ,IAAIA,UAAUE,SAAS,IAAA,GACnB;CAER;CAEA,OAAOR;AACX"}
1	+ {"version":3,"file":"redirect.mjs","names":["sanitizeRelativeRedirect","input","length","undefined","test","decoded","decodeURIComponent","candidate","startsWith","includes"],"sources":["../../../../../src/adapters/http/request/helpers/redirect.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\n/\n Open-redirect guard for the `redirect` query parameter carried by the\n * auth workflow pages: only same-origin relative paths pass through, so the\n * value can be safely reflected into an anchor href / forwarded as a\n * post-login destination.\n \n Rejects: non-strings, control/whitespace chars (browsers strip some,\n * shifting where the URL authority begins), protocol-relative (`//host`),\n * backslash variants (browsers normalise `\\` → `/`), and any scheme\n * (`javascript:`, `http:`) — both on the raw and once-decoded form so a\n * percent-encoded separator (`%2f`, `%5c`) can't slip past.\n */\nexport function sanitizeRelativeRedirect(input: unknown): string \| undefined {\n if (typeof input !== 'string' \|\| input.length === 0) {\n return undefined;\n }\n\n // Raw input: reject control chars AND whitespace (space/tab/newline) — a\n // raw space can shift where the URL authority begins.\n // eslint-disable-next-line no-control-regex\n if (/[\\u0000-\\u0020\\u007f]/.test(input)) {\n return undefined;\n }\n\n let decoded: string;\n try {\n decoded = decodeURIComponent(input);\n } catch {\n return undefined;\n }\n\n // Decoded form: reject C0 controls + DEL (CR/LF/NUL — the header-injection\n // vectors a `%0a`/`%0d` would smuggle past the raw check) but NOT space\n // (0x20), so a legitimate `%20` in the path still passes.\n // eslint-disable-next-line no-control-regex\n if (/[\\u0000-\\u001f\\u007f]/.test(decoded)) {\n return undefined;\n }\n\n for (const candidate of [input, decoded]) {\n if (!candidate.startsWith('/')) {\n return undefined;\n }\n if (candidate.length > 1 && (candidate[1] === '/' \|\| candidate[1] === '\\\\')) {\n return undefined;\n }\n if (candidate.includes('\\\\')) {\n return undefined;\n }\n }\n\n return input;\n}\n"],"mappings":";;;;;;;;;;;;;;;GAmBA,SAAgBA,yBAAyBC,OAAc;CACnD,IAAI,OAAOA,UAAU,YAAYA,MAAMC,WAAW,GAC9C;CAMJ,IAAI,wBAAwBE,KAAKH,KAAAA,GAC7B;CAGJ,IAAII;CACJ,IAAI;EACAA,UAAUC,mBAAmBL,KAAAA;CACjC,QAAQ;EACJ;CACJ;CAMA,IAAI,wBAAwBG,KAAKC,OAAAA,GAC7B;CAGJ,KAAK,MAAME,aAAa,CAACN,OAAOI,OAAQ,GAAE;EACtC,IAAI,CAACE,UAAUC,WAAW,GAAA,GACtB;EAEJ,IAAID,UAAUL,SAAS,MAAMK,UAAU,OAAO,OAAOA,UAAU,OAAO,OAClE;EAEJ,IAAIA,UAAUE,SAAS,IAAA,GACnB;CAER;CAEA,OAAOR;AACX"}

package/dist/adapters/http/request/permission/module.d.ts CHANGED Viewed

@@ -1,4 +1,4 @@
-import type { IPermissionEvaluator, PermissionEvaluationContext } from '@authup/access';
+import type { IPermissionEvaluator, PermissionCompileContext, PermissionCompileResult, PermissionEvaluationContext } from '@authup/access';
 import type { IAppEvent } from 'routup';
 export declare class RequestPermissionEvaluator implements IPermissionEvaluator {
     protected event: IAppEvent;
@@ -8,6 +8,7 @@ export declare class RequestPermissionEvaluator implements IPermissionEvaluator
     preEvaluate(ctx: PermissionEvaluationContext): Promise<void>;
     preEvaluateOneOf(ctx: PermissionEvaluationContext): Promise<void>;
     evaluateOneOf(ctx: PermissionEvaluationContext): Promise<void>;
-    protected extendContext(ctx: PermissionEvaluationContext): PermissionEvaluationContext;
+    compile(ctx: PermissionCompileContext): Promise<PermissionCompileResult>;
+    protected extendContext<T extends PermissionEvaluationContext | PermissionCompileContext>(ctx: T): T;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/request/permission/module.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/permission/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACR,oBAAoB,EACpB,2BAA2B,EAC9B,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGxC,qBAAa,0BAA2B,YAAW,oBAAoB;IACnE,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC;IAE3B,SAAS,CAAC,SAAS,EAAE,oBAAoB,CAAC;gBAE9B,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,oBAAoB;IAOvD,QAAQ,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAI1D,WAAW,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAM7D,gBAAgB,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAIlE,aAAa,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;~~IAMrE~~,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,~~2BAA2B~~;~~CAiB3D~~"}
1	+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/permission/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACR,oBAAoB,EACpB,wBAAwB,EACxB,uBAAuB,EACvB,2BAA2B,EAC9B,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGxC,qBAAa,0BAA2B,YAAW,oBAAoB;IACnE,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC;IAE3B,SAAS,CAAC,SAAS,EAAE,oBAAoB,CAAC;gBAE9B,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,oBAAoB;IAOvD,QAAQ,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAI1D,WAAW,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAM7D,gBAAgB,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAIlE,aAAa,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAM/D,OAAO,CAAC,GAAG,EAAE,wBAAwB,GAAI,OAAO,CAAC,uBAAuB,CAAC;IAM/E,SAAS,CAAC,aAAa,CAAC,CAAC,SAAS,2BAA2B,GAAG,wBAAwB,EAAE,GAAG,EAAE,CAAC,GAAI,CAAC;CAiBxG"}

package/dist/adapters/http/request/permission/module.mjs CHANGED Viewed

@@ -26,6 +26,9 @@ var RequestPermissionEvaluator = class {
 	async evaluateOneOf(ctx) {
 		return this.evaluator.evaluateOneOf(this.extendContext(ctx));
 	}
+	async compile(ctx) {
+		return this.evaluator.compile(this.extendContext(ctx));
+	}
 	extendContext(ctx) {
 		const scopes = useRequestScopes(this.event);
 		const identity = useRequestIdentity(this.event);

package/dist/adapters/http/request/permission/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["ScopeName","BuiltInPolicyType","PolicyData","useRequestIdentity","useRequestScopes","RequestPermissionEvaluator","event","evaluator","evaluate","ctx","extendContext","preEvaluate","preEvaluateOneOf","evaluateOneOf","scopes","identity","includes","GLOBAL","data","set","IDENTITY"],"sources":["../../../../../src/adapters/http/request/permission/module.ts"],"sourcesContent":["/\n Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ScopeName } from '@authup/core-kit';\nimport type {\n IPermissionEvaluator,\n PermissionEvaluationContext,\n} from '@authup/access';\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport type { IAppEvent } from 'routup';\nimport { useRequestIdentity, useRequestScopes } from '../helpers/index.ts';\n\nexport class RequestPermissionEvaluator implements IPermissionEvaluator {\n protected event: IAppEvent;\n\n protected evaluator: IPermissionEvaluator;\n\n constructor(event: IAppEvent, evaluator: IPermissionEvaluator) {\n this.event = event;\n this.evaluator = evaluator;\n }\n\n // --------------------------------------------------------------\n\n async evaluate(ctx: PermissionEvaluationContext) : Promise<void> {\n return this.evaluator.evaluate(this.extendContext(ctx));\n }\n\n async preEvaluate(ctx: PermissionEvaluationContext) : Promise<void> {\n return this.evaluator.preEvaluate(this.extendContext(ctx));\n }\n\n // --------------------------------------------------------------\n\n async preEvaluateOneOf(ctx: PermissionEvaluationContext) : Promise<void> {\n return this.evaluator.preEvaluateOneOf(this.extendContext(ctx));\n }\n\n async evaluateOneOf(ctx: PermissionEvaluationContext) : Promise<void> {\n return this.evaluator.evaluateOneOf(this.extendContext(ctx));\n }\n\n // --------------------------------------------------------------\n\n protected extendContext(ctx: ~~PermissionEvaluationContext~~) {\n const scopes = useRequestScopes(this.event);\n const identity = useRequestIdentity(this.event);\n\n // Only attach the identity policy data when an identity was actually\n // resolved. Setting it to `undefined` would still make\n // `PolicyData.has('identity')` true (key presence), so the built-in\n // identity evaluator would run its validator against `undefined` and\n // throw an uncaught error instead of a clean permission denial — see\n // the deleted-subject edge case in issue #3184.\n if (scopes.includes(ScopeName.GLOBAL) && identity) {\n ctx.data = ctx.data \|\| new PolicyData();\n ctx.data.set(BuiltInPolicyType.IDENTITY, identity);\n }\n\n return ctx;\n }\n}\n"],"mappings":";;;;;;;;;~~AAgBA~~,IAAaK,6BAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,OAAkBC,WAAiC;EAC3D,KAAKD,QAAQA;EACb,KAAKC,YAAYA;CACrB;CAIA,MAAMC,SAASC,KAAkD;EAC7D,OAAO,KAAKF,UAAUC,SAAS,KAAKE,cAAcD,GAAAA,CAAAA;CACtD;CAEA,MAAME,YAAYF,KAAkD;EAChE,OAAO,KAAKF,UAAUI,YAAY,KAAKD,cAAcD,GAAAA,CAAAA;CACzD;CAIA,MAAMG,iBAAiBH,KAAkD;EACrE,OAAO,KAAKF,UAAUK,iBAAiB,KAAKF,cAAcD,GAAAA,CAAAA;CAC9D;CAEA,MAAMI,cAAcJ,KAAkD;EAClE,OAAO,KAAKF,UAAUM,cAAc,KAAKH,cAAcD,GAAAA,CAAAA;CAC3D;~~CAIUC~~,cAAcD,~~KAAkC~~;~~EACtD~~,~~MAAMK~~,~~SAASV~~,iBAAiB,KAAKE,KAAK;EAC1C,~~MAAMS~~,~~WAAWZ~~,mBAAmB,KAAKG,KAAK;EAQ9C,~~IAAIQ~~,OAAOE,~~SAAShB~~,~~UAAUiB~~,MAAM,KAAKF,UAAU;GAC/CN,~~IAAIS~~,~~OAAOT~~,~~IAAIS~~,QAAQ,~~IAAIhB~~,WAAAA;GAC3BO,~~IAAIS~~,KAAKC,~~IAAIlB~~,~~kBAAkBmB~~,UAAUL,QAAAA;EAC7C;EAEA,~~OAAON~~;CACX;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["ScopeName","BuiltInPolicyType","PolicyData","useRequestIdentity","useRequestScopes","RequestPermissionEvaluator","event","evaluator","evaluate","ctx","extendContext","preEvaluate","preEvaluateOneOf","evaluateOneOf","compile","scopes","identity","includes","GLOBAL","data","set","IDENTITY"],"sources":["../../../../../src/adapters/http/request/permission/module.ts"],"sourcesContent":["/\n Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ScopeName } from '@authup/core-kit';\nimport type {\n IPermissionEvaluator,\n PermissionCompileContext,\n PermissionCompileResult,\n PermissionEvaluationContext,\n} from '@authup/access';\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport type { IAppEvent } from 'routup';\nimport { useRequestIdentity, useRequestScopes } from '../helpers/index.ts';\n\nexport class RequestPermissionEvaluator implements IPermissionEvaluator {\n protected event: IAppEvent;\n\n protected evaluator: IPermissionEvaluator;\n\n constructor(event: IAppEvent, evaluator: IPermissionEvaluator) {\n this.event = event;\n this.evaluator = evaluator;\n }\n\n // --------------------------------------------------------------\n\n async evaluate(ctx: PermissionEvaluationContext) : Promise<void> {\n return this.evaluator.evaluate(this.extendContext(ctx));\n }\n\n async preEvaluate(ctx: PermissionEvaluationContext) : Promise<void> {\n return this.evaluator.preEvaluate(this.extendContext(ctx));\n }\n\n // --------------------------------------------------------------\n\n async preEvaluateOneOf(ctx: PermissionEvaluationContext) : Promise<void> {\n return this.evaluator.preEvaluateOneOf(this.extendContext(ctx));\n }\n\n async evaluateOneOf(ctx: PermissionEvaluationContext) : Promise<void> {\n return this.evaluator.evaluateOneOf(this.extendContext(ctx));\n }\n\n // --------------------------------------------------------------\n\n async compile(ctx: PermissionCompileContext) : Promise<PermissionCompileResult> {\n return this.evaluator.compile(this.extendContext(ctx));\n }\n\n // --------------------------------------------------------------\n\n protected extendContext<T extends PermissionEvaluationContext \| PermissionCompileContext>(ctx: T) : T {\n const scopes = useRequestScopes(this.event);\n const identity = useRequestIdentity(this.event);\n\n // Only attach the identity policy data when an identity was actually\n // resolved. Setting it to `undefined` would still make\n // `PolicyData.has('identity')` true (key presence), so the built-in\n // identity evaluator would run its validator against `undefined` and\n // throw an uncaught error instead of a clean permission denial — see\n // the deleted-subject edge case in issue #3184.\n if (scopes.includes(ScopeName.GLOBAL) && identity) {\n ctx.data = ctx.data \|\| new PolicyData();\n ctx.data.set(BuiltInPolicyType.IDENTITY, identity);\n }\n\n return ctx;\n }\n}\n"],"mappings":";;;;;;;;;AAkBA,IAAaK,6BAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,OAAkBC,WAAiC;EAC3D,KAAKD,QAAQA;EACb,KAAKC,YAAYA;CACrB;CAIA,MAAMC,SAASC,KAAkD;EAC7D,OAAO,KAAKF,UAAUC,SAAS,KAAKE,cAAcD,GAAAA,CAAAA;CACtD;CAEA,MAAME,YAAYF,KAAkD;EAChE,OAAO,KAAKF,UAAUI,YAAY,KAAKD,cAAcD,GAAAA,CAAAA;CACzD;CAIA,MAAMG,iBAAiBH,KAAkD;EACrE,OAAO,KAAKF,UAAUK,iBAAiB,KAAKF,cAAcD,GAAAA,CAAAA;CAC9D;CAEA,MAAMI,cAAcJ,KAAkD;EAClE,OAAO,KAAKF,UAAUM,cAAc,KAAKH,cAAcD,GAAAA,CAAAA;CAC3D;CAIA,MAAMK,QAAQL,KAAkE;EAC5E,OAAO,KAAKF,UAAUO,QAAQ,KAAKJ,cAAcD,GAAAA,CAAAA;CACrD;CAIUC,cAAgFD,KAAY;EAClG,MAAMM,SAASX,iBAAiB,KAAKE,KAAK;EAC1C,MAAMU,WAAWb,mBAAmB,KAAKG,KAAK;EAQ9C,IAAIS,OAAOE,SAASjB,UAAUkB,MAAM,KAAKF,UAAU;GAC/CP,IAAIU,OAAOV,IAAIU,QAAQ,IAAIjB,WAAAA;GAC3BO,IAAIU,KAAKC,IAAInB,kBAAkBoB,UAAUL,QAAAA;EAC7C;EAEA,OAAOP;CACX;AACJ"}

package/dist/adapters/http/ui/render.mjs CHANGED Viewed

@@ -11,7 +11,7 @@ import { getURLBasePath } from "@authup/kit";
 import path from "node:path";
 import { useRequestCookie } from "@routup/basic/cookie";
 import { CodeTransformation, isCodeTransformation } from "typeorm-extension";
-import { load } from "locter";
+import { read } from "locter";
 import fs from "node:fs";
 //#region src/adapters/http/ui/render.ts
 const COLOR_MODE_COOKIE = "vc-color-mode";
@@ -36,7 +36,7 @@ async function renderUIPage(event, ctx) {
 	} else {
 		html = cachedHtml ??= await fs.promises.readFile(path.join(UI_DIST_PATH, "client", "index.html"), "utf-8");
 		manifest = cachedManifest ??= JSON.parse(await fs.promises.readFile(path.join(UI_DIST_PATH, "client", ".vite", "ssr-manifest.json"), "utf-8"));
-		render = cachedRender ??= (await load(path.join(UI_DIST_PATH, "server", "server.js"))).render;
+		render = cachedRender ??= (await read(path.join(UI_DIST_PATH, "server", "server.js"))).render;
 	}
 	const httpClientFactory = event.store[UI_HTTP_CLIENT_FACTORY_STORE_KEY];
 	const [appHtml, preloadLinks] = await render({

package/dist/adapters/http/ui/render.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"render.mjs","names":["getURLBasePath","useRequestCookie","~~load~~","fs","path","CodeTransformation","isCodeTransformation","UI_DIST_PATH","UI_SOURCE_PATH","UI_HTTP_CLIENT_FACTORY_STORE_KEY","VITE_SERVER_STORE_KEY","LOCALE_COOKIE","rebasePublicAssetURLs","COLOR_MODE_COOKIE","cachedHtml","cachedManifest","cachedRender","renderUIPage","event","ctx","isJIT","JUST_IN_TIME","colorMode","payload","config","locale","html","manifest","render","vite","store","promises","readFile","join","transformIndexHtml","ssrLoadModule","JSON","parse","httpClientFactory","appHtml","preloadLinks","url","httpClient","undefined","body","replace","htmlAttrs","test","baseURL","response","headers","set"],"sources":["../../../../src/adapters/http/ui/render.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { getURLBasePath } from '@authup/kit';\nimport { useRequestCookie } from '@routup/basic/cookie';\nimport { ~~load~~ } from 'locter';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport type { IAppEvent } from 'routup';\nimport type { ViteDevServer } from 'vite';\nimport { CodeTransformation, isCodeTransformation } from 'typeorm-extension';\nimport type { IClient } from '@authup/core-http-kit';\nimport { UI_DIST_PATH, UI_SOURCE_PATH } from '../../../path.ts';\nimport { UI_HTTP_CLIENT_FACTORY_STORE_KEY, VITE_SERVER_STORE_KEY } from '../middleware/index.ts';\nimport { LOCALE_COOKIE } from '../request/helpers/locale.ts';\nimport { rebasePublicAssetURLs } from './base-path.ts';\nimport type { UIRenderContext } from './types.ts';\n\nconst COLOR_MODE_COOKIE = 'vc-color-mode';\n\n// Process-lifetime caches for the immutable production SSR assets. The dist\n// template, manifest and server bundle don't change after boot, so read them\n// once instead of per request (the auth/login routes are hot paths). The JIT\n// (dev) path deliberately re-reads so HMR keeps working.\nlet cachedHtml: string \| undefined;\nlet cachedManifest: Record<string, any> \| undefined;\nlet cachedRender: CallableFunction \| undefined;\n\nexport async function renderUIPage(event: IAppEvent, ctx: UIRenderContext): Promise<string> {\n const isJIT = isCodeTransformation(CodeTransformation.JUST_IN_TIME);\n\n // Mirror @vuecs/nuxt's SSR plugins: resolve the cookies server-side so\n // the HTML shell already carries the `.dark`/`.light` class and lang\n // attribute (no flash) and the client app hydrates from the same values.\n const colorMode = useRequestCookie(event, COLOR_MODE_COOKIE);\n ctx.payload.config.colorMode = colorMode;\n\n const locale = useRequestCookie(event, LOCALE_COOKIE);\n ctx.payload.config.locale = locale;\n\n let html : string;\n let manifest : Record<string, any>;\n let render : CallableFunction;\n\n if (isJIT) {\n const vite = event.store[VITE_SERVER_STORE_KEY] as ViteDevServer;\n\n html = await fs.promises.readFile(\n path.join(UI_SOURCE_PATH, 'index.html'),\n 'utf-8',\n );\n html = await vite.transformIndexHtml('/', html);\n manifest = {};\n render = (await vite.ssrLoadModule('/src/server.ts')).render;\n } else {\n html = (cachedHtml ??= await fs.promises.readFile(\n path.join(UI_DIST_PATH, 'client', 'index.html'),\n 'utf-8',\n ));\n manifest = (cachedManifest ??= JSON.parse(await fs.promises.readFile(\n path.join(UI_DIST_PATH, 'client', '.vite', 'ssr-manifest.json'),\n 'utf-8',\n )));\n render = (cachedRender ??= (await ~~load~~(\n path.join(UI_DIST_PATH, 'server', 'server.js'),\n )).render);\n }\n\n const httpClientFactory = event.store[UI_HTTP_CLIENT_FACTORY_STORE_KEY] as (() => IClient) \| undefined;\n\n const [appHtml, preloadLinks] = await render({\n url: ctx.url,\n manifest,\n payload: ctx.payload,\n httpClient: httpClientFactory ? httpClientFactory() : undefined,\n });\n\n let body = html\n .replace('<!--preload-links-->', preloadLinks)\n .replace('<!--app-html-->', appHtml);\n\n let htmlAttrs = 'lang=\"en\"';\n if (locale && /^[a-zA-Z]{2,3}(-[a-zA-Z0-9]+)$/.test(locale)) {\n htmlAttrs = `lang=\"${locale}\"`;\n }\n if (colorMode === 'dark' \|\| colorMode === 'light') {\n htmlAttrs += ` class=\"${colorMode}\"`;\n }\n // Match the opening <html> tag by pattern rather than an exact literal,\n // so a reformatted tag / dev-mode transformIndexHtml rewrite still gets\n // the lang + color-mode attributes (no silent FOUC).\n body = body.replace(/<html\\b[^>]*>/i, `<html ${htmlAttrs}>`);\n\n // When authup is publicly served under a sub-path (publicUrl carries a\n // pathname, e.g. https://example.com/auth), the fixed /public/ vite base\n // would bypass the proxy mapping — rebase asset URLs onto the prefix.\n body = rebasePublicAssetURLs(body, getURLBasePath(ctx.payload.config.baseURL));\n\n event.response.headers.set('content-type', 'text/html; charset=utf-8');\n\n // Clickjacking guard: the SSR auth pages (login, consent, realm-mismatch,\n // logout) mutate state behind explicit clicks and hydrate the logged-in\n // session from first-party cookies. Framing them would make click-gating\n // defeatable via overlay attacks, so deny embedding entirely. (Iframe-based\n // silent renew is therefore unsupported — auth state is JS-readable anyway.)\n event.response.headers.set('content-security-policy', \"frame-ancestors 'none'\");\n event.response.headers.set('x-frame-options', 'DENY');\n\n // The auth pages' URLs routinely carry sensitive query params\n // (id_token_hint, code, redirect, state) — never leak them via Referer.\n event.response.headers.set('referrer-policy', 'no-referrer');\n\n return body;\n}\n\n"],"mappings":";;;;;;;;;;;;;;;;AAsBA,MAAMa,oBAAoB;AAM1B,IAAIC;AACJ,IAAIC;AACJ,IAAIC;AAEJ,eAAsBC,aAAaC,OAAkBC,KAAoB;CACrE,MAAMC,QAAQd,qBAAqBD,mBAAmBgB,YAAY;CAKlE,MAAMC,YAAYrB,iBAAiBiB,OAAOL,iBAAAA;CAC1CM,IAAII,QAAQC,OAAOF,YAAYA;CAE/B,MAAMG,SAASxB,iBAAiBiB,OAAOP,aAAAA;CACvCQ,IAAII,QAAQC,OAAOC,SAASA;CAE5B,IAAIC;CACJ,IAAIC;CACJ,IAAIC;CAEJ,IAAIR,OAAO;EACP,MAAMS,OAAOX,MAAMY,MAAMpB;EAEzBgB,OAAO,MAAMvB,GAAG4B,SAASC,SACrB5B,KAAK6B,KAAKzB,gBAAgB,YAAA,GAC1B,OAAA;EAEJkB,OAAO,MAAMG,KAAKK,mBAAmB,KAAKR,IAAAA;EAC1CC,WAAW,CAAC;EACZC,UAAU,MAAMC,KAAKM,cAAc,gBAAA,EAAA,CAAmBP;CAC1D,OAAO;EACHF,OAAQZ,eAAe,MAAMX,GAAG4B,SAASC,SACrC5B,KAAK6B,KAAK1B,cAAc,UAAU,YAAA,GAClC,OAAA;EAEJoB,WAAYZ,mBAAmBqB,KAAKC,MAAM,MAAMlC,GAAG4B,SAASC,SACxD5B,KAAK6B,KAAK1B,cAAc,UAAU,SAAS,mBAAA,GAC3C,OAAA,CAAA;EAEJqB,SAAUZ,kBAAkB,MAAMd,KAC9BE,KAAK6B,KAAK1B,cAAc,UAAU,WAAA,CAAA,EAAA,CACnCqB;CACP;CAEA,MAAMU,oBAAoBpB,MAAMY,MAAMrB;CAEtC,MAAM,CAAC8B,SAASC,gBAAgB,MAAMZ,OAAO;EACzCa,KAAKtB,IAAIsB;EACTd;EACAJ,SAASJ,IAAII;EACbmB,YAAYJ,oBAAoBA,kBAAAA,IAAsBK,KAAAA;CAC1D,CAAA;CAEA,IAAIC,OAAOlB,KACNmB,QAAQ,wBAAwBL,YAAAA,CAAAA,CAChCK,QAAQ,mBAAmBN,OAAAA;CAEhC,IAAIO,YAAY;CAChB,IAAIrB,UAAU,kCAAkCsB,KAAKtB,MAAAA,GACjDqB,YAAY,SAASrB,OAAO;CAEhC,IAAIH,cAAc,UAAUA,cAAc,SACtCwB,aAAa,WAAWxB,UAAU;CAKtCsB,OAAOA,KAAKC,QAAQ,kBAAkB,SAASC,UAAU,EAAE;CAK3DF,OAAOhC,sBAAsBgC,MAAM5C,eAAemB,IAAII,QAAQC,OAAOwB,OAAO,CAAA;CAE5E9B,MAAM+B,SAASC,QAAQC,IAAI,gBAAgB,0BAAA;CAO3CjC,MAAM+B,SAASC,QAAQC,IAAI,2BAA2B,wBAAA;CACtDjC,MAAM+B,SAASC,QAAQC,IAAI,mBAAmB,MAAA;CAI9CjC,MAAM+B,SAASC,QAAQC,IAAI,mBAAmB,aAAA;CAE9C,OAAOP;AACX"}
1	+ {"version":3,"file":"render.mjs","names":["getURLBasePath","useRequestCookie","read","fs","path","CodeTransformation","isCodeTransformation","UI_DIST_PATH","UI_SOURCE_PATH","UI_HTTP_CLIENT_FACTORY_STORE_KEY","VITE_SERVER_STORE_KEY","LOCALE_COOKIE","rebasePublicAssetURLs","COLOR_MODE_COOKIE","cachedHtml","cachedManifest","cachedRender","renderUIPage","event","ctx","isJIT","JUST_IN_TIME","colorMode","payload","config","locale","html","manifest","render","vite","store","promises","readFile","join","transformIndexHtml","ssrLoadModule","JSON","parse","httpClientFactory","appHtml","preloadLinks","url","httpClient","undefined","body","replace","htmlAttrs","test","baseURL","response","headers","set"],"sources":["../../../../src/adapters/http/ui/render.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { getURLBasePath } from '@authup/kit';\nimport { useRequestCookie } from '@routup/basic/cookie';\nimport { read } from 'locter';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport type { IAppEvent } from 'routup';\nimport type { ViteDevServer } from 'vite';\nimport { CodeTransformation, isCodeTransformation } from 'typeorm-extension';\nimport type { IClient } from '@authup/core-http-kit';\nimport { UI_DIST_PATH, UI_SOURCE_PATH } from '../../../path.ts';\nimport { UI_HTTP_CLIENT_FACTORY_STORE_KEY, VITE_SERVER_STORE_KEY } from '../middleware/index.ts';\nimport { LOCALE_COOKIE } from '../request/helpers/locale.ts';\nimport { rebasePublicAssetURLs } from './base-path.ts';\nimport type { UIRenderContext } from './types.ts';\n\nconst COLOR_MODE_COOKIE = 'vc-color-mode';\n\n// Process-lifetime caches for the immutable production SSR assets. The dist\n// template, manifest and server bundle don't change after boot, so read them\n// once instead of per request (the auth/login routes are hot paths). The JIT\n// (dev) path deliberately re-reads so HMR keeps working.\nlet cachedHtml: string \| undefined;\nlet cachedManifest: Record<string, any> \| undefined;\nlet cachedRender: CallableFunction \| undefined;\n\nexport async function renderUIPage(event: IAppEvent, ctx: UIRenderContext): Promise<string> {\n const isJIT = isCodeTransformation(CodeTransformation.JUST_IN_TIME);\n\n // Mirror @vuecs/nuxt's SSR plugins: resolve the cookies server-side so\n // the HTML shell already carries the `.dark`/`.light` class and lang\n // attribute (no flash) and the client app hydrates from the same values.\n const colorMode = useRequestCookie(event, COLOR_MODE_COOKIE);\n ctx.payload.config.colorMode = colorMode;\n\n const locale = useRequestCookie(event, LOCALE_COOKIE);\n ctx.payload.config.locale = locale;\n\n let html : string;\n let manifest : Record<string, any>;\n let render : CallableFunction;\n\n if (isJIT) {\n const vite = event.store[VITE_SERVER_STORE_KEY] as ViteDevServer;\n\n html = await fs.promises.readFile(\n path.join(UI_SOURCE_PATH, 'index.html'),\n 'utf-8',\n );\n html = await vite.transformIndexHtml('/', html);\n manifest = {};\n render = (await vite.ssrLoadModule('/src/server.ts')).render;\n } else {\n html = (cachedHtml ??= await fs.promises.readFile(\n path.join(UI_DIST_PATH, 'client', 'index.html'),\n 'utf-8',\n ));\n manifest = (cachedManifest ??= JSON.parse(await fs.promises.readFile(\n path.join(UI_DIST_PATH, 'client', '.vite', 'ssr-manifest.json'),\n 'utf-8',\n )));\n render = (cachedRender ??= (await read(\n path.join(UI_DIST_PATH, 'server', 'server.js'),\n )).render);\n }\n\n const httpClientFactory = event.store[UI_HTTP_CLIENT_FACTORY_STORE_KEY] as (() => IClient) \| undefined;\n\n const [appHtml, preloadLinks] = await render({\n url: ctx.url,\n manifest,\n payload: ctx.payload,\n httpClient: httpClientFactory ? httpClientFactory() : undefined,\n });\n\n let body = html\n .replace('<!--preload-links-->', preloadLinks)\n .replace('<!--app-html-->', appHtml);\n\n let htmlAttrs = 'lang=\"en\"';\n if (locale && /^[a-zA-Z]{2,3}(-[a-zA-Z0-9]+)$/.test(locale)) {\n htmlAttrs = `lang=\"${locale}\"`;\n }\n if (colorMode === 'dark' \|\| colorMode === 'light') {\n htmlAttrs += ` class=\"${colorMode}\"`;\n }\n // Match the opening <html> tag by pattern rather than an exact literal,\n // so a reformatted tag / dev-mode transformIndexHtml rewrite still gets\n // the lang + color-mode attributes (no silent FOUC).\n body = body.replace(/<html\\b[^>]*>/i, `<html ${htmlAttrs}>`);\n\n // When authup is publicly served under a sub-path (publicUrl carries a\n // pathname, e.g. https://example.com/auth), the fixed /public/ vite base\n // would bypass the proxy mapping — rebase asset URLs onto the prefix.\n body = rebasePublicAssetURLs(body, getURLBasePath(ctx.payload.config.baseURL));\n\n event.response.headers.set('content-type', 'text/html; charset=utf-8');\n\n // Clickjacking guard: the SSR auth pages (login, consent, realm-mismatch,\n // logout) mutate state behind explicit clicks and hydrate the logged-in\n // session from first-party cookies. Framing them would make click-gating\n // defeatable via overlay attacks, so deny embedding entirely. (Iframe-based\n // silent renew is therefore unsupported — auth state is JS-readable anyway.)\n event.response.headers.set('content-security-policy', \"frame-ancestors 'none'\");\n event.response.headers.set('x-frame-options', 'DENY');\n\n // The auth pages' URLs routinely carry sensitive query params\n // (id_token_hint, code, redirect, state) — never leak them via Referer.\n event.response.headers.set('referrer-policy', 'no-referrer');\n\n return body;\n}\n\n"],"mappings":";;;;;;;;;;;;;;;;AAsBA,MAAMa,oBAAoB;AAM1B,IAAIC;AACJ,IAAIC;AACJ,IAAIC;AAEJ,eAAsBC,aAAaC,OAAkBC,KAAoB;CACrE,MAAMC,QAAQd,qBAAqBD,mBAAmBgB,YAAY;CAKlE,MAAMC,YAAYrB,iBAAiBiB,OAAOL,iBAAAA;CAC1CM,IAAII,QAAQC,OAAOF,YAAYA;CAE/B,MAAMG,SAASxB,iBAAiBiB,OAAOP,aAAAA;CACvCQ,IAAII,QAAQC,OAAOC,SAASA;CAE5B,IAAIC;CACJ,IAAIC;CACJ,IAAIC;CAEJ,IAAIR,OAAO;EACP,MAAMS,OAAOX,MAAMY,MAAMpB;EAEzBgB,OAAO,MAAMvB,GAAG4B,SAASC,SACrB5B,KAAK6B,KAAKzB,gBAAgB,YAAA,GAC1B,OAAA;EAEJkB,OAAO,MAAMG,KAAKK,mBAAmB,KAAKR,IAAAA;EAC1CC,WAAW,CAAC;EACZC,UAAU,MAAMC,KAAKM,cAAc,gBAAA,EAAA,CAAmBP;CAC1D,OAAO;EACHF,OAAQZ,eAAe,MAAMX,GAAG4B,SAASC,SACrC5B,KAAK6B,KAAK1B,cAAc,UAAU,YAAA,GAClC,OAAA;EAEJoB,WAAYZ,mBAAmBqB,KAAKC,MAAM,MAAMlC,GAAG4B,SAASC,SACxD5B,KAAK6B,KAAK1B,cAAc,UAAU,SAAS,mBAAA,GAC3C,OAAA,CAAA;EAEJqB,SAAUZ,kBAAkB,MAAMd,KAC9BE,KAAK6B,KAAK1B,cAAc,UAAU,WAAA,CAAA,EAAA,CACnCqB;CACP;CAEA,MAAMU,oBAAoBpB,MAAMY,MAAMrB;CAEtC,MAAM,CAAC8B,SAASC,gBAAgB,MAAMZ,OAAO;EACzCa,KAAKtB,IAAIsB;EACTd;EACAJ,SAASJ,IAAII;EACbmB,YAAYJ,oBAAoBA,kBAAAA,IAAsBK,KAAAA;CAC1D,CAAA;CAEA,IAAIC,OAAOlB,KACNmB,QAAQ,wBAAwBL,YAAAA,CAAAA,CAChCK,QAAQ,mBAAmBN,OAAAA;CAEhC,IAAIO,YAAY;CAChB,IAAIrB,UAAU,kCAAkCsB,KAAKtB,MAAAA,GACjDqB,YAAY,SAASrB,OAAO;CAEhC,IAAIH,cAAc,UAAUA,cAAc,SACtCwB,aAAa,WAAWxB,UAAU;CAKtCsB,OAAOA,KAAKC,QAAQ,kBAAkB,SAASC,UAAU,EAAE;CAK3DF,OAAOhC,sBAAsBgC,MAAM5C,eAAemB,IAAII,QAAQC,OAAOwB,OAAO,CAAA;CAE5E9B,MAAM+B,SAASC,QAAQC,IAAI,gBAAgB,0BAAA;CAO3CjC,MAAM+B,SAASC,QAAQC,IAAI,2BAA2B,wBAAA;CACtDjC,MAAM+B,SAASC,QAAQC,IAAI,mBAAmB,MAAA;CAI9CjC,MAAM+B,SAASC,QAAQC,IAAI,mBAAmB,aAAA;CAE9C,OAAOP;AACX"}

package/dist/adapters/http/ui/serve.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/ui/serve.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAEpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAIxC,MAAM,MAAM,wBAAwB,GAAG;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,sBAAsB,CAAC;IAIjC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC7B,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,wBAAwB,GAClC,OAAO,CAAC,MAAM,CAAC,~~CAuBjB~~"}
1	+ {"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/ui/serve.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAEpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAIxC,MAAM,MAAM,wBAAwB,GAAG;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,sBAAsB,CAAC;IAIjC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC7B,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,wBAAwB,GAClC,OAAO,CAAC,MAAM,CAAC,CAwBjB"}

package/dist/adapters/http/ui/serve.mjs CHANGED Viewed

@@ -16,7 +16,10 @@ import { useRequestQuery } from "@routup/basic/query";
 		features: options.features,
 		redirect: sanitizeRelativeRedirect(query.redirect)
 	};
-	if (options.realmAware) data.realmId = typeof query.realm_id === "string" ? query.realm_id : void 0;
+	if (options.realmAware) {
+		const realmId = typeof query.realmId === "string" ? query.realmId : query.realm_id;
+		data.realmId = typeof realmId === "string" ? realmId : void 0;
+	}
 	if (options.tokenAware) data.token = typeof query.token === "string" ? query.token : void 0;
 	return renderUIPage(event, {
 		url: options.url,

package/dist/adapters/http/ui/serve.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"serve.mjs","names":["useRequestQuery","sanitizeRelativeRedirect","renderUIPage","serveWorkflowPage","event","options","query","data","features","redirect","realmAware","realmId","realm_id","undefined","tokenAware","token","url","payload","config","baseURL"],"sources":["../../../../src/adapters/http/ui/serve.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { StatusResponseFeatures } from '@authup/core-http-kit';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { IAppEvent } from 'routup';\nimport { sanitizeRelativeRedirect } from '../request/index.ts';\nimport { renderUIPage } from './render.ts';\n\nexport type ServeWorkflowPageOptions = {\n url: string,\n baseURL: string,\n features: StatusResponseFeatures,\n // Whether the page consumes the `realm_id` / `token` query params (e.g~~.\n //~~ prefill from an email deep link). Off by default so a page never~~\n //~~ reflects a param it doesn't use.\n realmAware?: boolean,\n tokenAware?: boolean,\n};\n\n/\n Single SSR payload-assembly path for the auth workflow GET routes:\n * whitelists query params, applies the open-redirect guard, and renders.\n * Keeps the four workflow controllers as thin POST adapters.\n */\nexport function serveWorkflowPage(\n event: IAppEvent,\n options: ServeWorkflowPageOptions,\n): Promise<string> {\n const query = useRequestQuery(event);\n\n const data: Record<string, any> = {\n features: options.features,\n redirect: sanitizeRelativeRedirect(query.redirect),\n };\n\n if (options.realmAware) {\n ~~data.~~realmId = typeof query.~~realm_id~~ === 'string' ? query.realm_id : undefined;\n }\n\n if (options.tokenAware) {\n data.token = typeof query.token === 'string' ? query.token : undefined;\n }\n\n return renderUIPage(event, {\n url: options.url,\n payload: {\n config: { baseURL: options.baseURL },\n data,\n },\n });\n}\n"],"mappings":";;;;;;;;;;;;GA6BA,SAAgBG,kBACZC,OACAC,SAAiC;CAEjC,MAAMC,QAAQN,gBAAgBI,KAAAA;CAE9B,MAAMG,OAA4B;EAC9BC,UAAUH,QAAQG;EAClBC,UAAUR,yBAAyBK,MAAMG,QAAQ;CACrD;CAEA,IAAIJ,QAAQK,~~YACRH~~,~~KAAKI~~,UAAU,OAAOL,~~MAAMM~~,~~aAAa~~,~~WAAWN~~,MAAMM,~~WAAWC~~,KAAAA;~~CAGzE~~,IAAIR,QAAQS,YACRP,KAAKQ,QAAQ,OAAOT,MAAMS,UAAU,WAAWT,MAAMS,QAAQF,KAAAA;CAGjE,OAAOX,aAAaE,OAAO;EACvBY,KAAKX,QAAQW;EACbC,SAAS;GACLC,QAAQ,EAAEC,SAASd,QAAQc,QAAQ;GACnCZ;EACJ;CACJ,CAAA;AACJ"}
1	+ {"version":3,"file":"serve.mjs","names":["useRequestQuery","sanitizeRelativeRedirect","renderUIPage","serveWorkflowPage","event","options","query","data","features","redirect","realmAware","realmId","realm_id","undefined","tokenAware","token","url","payload","config","baseURL"],"sources":["../../../../src/adapters/http/ui/serve.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { StatusResponseFeatures } from '@authup/core-http-kit';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { IAppEvent } from 'routup';\nimport { sanitizeRelativeRedirect } from '../request/index.ts';\nimport { renderUIPage } from './render.ts';\n\nexport type ServeWorkflowPageOptions = {\n url: string,\n baseURL: string,\n features: StatusResponseFeatures,\n // Whether the page consumes the `realmId` (legacy `realm_id`) / `token`\n // query params (e.g. prefill from an email deep link). Off by default so\n // a page never reflects a param it doesn't use.\n realmAware?: boolean,\n tokenAware?: boolean,\n};\n\n/\n Single SSR payload-assembly path for the auth workflow GET routes:\n * whitelists query params, applies the open-redirect guard, and renders.\n * Keeps the four workflow controllers as thin POST adapters.\n */\nexport function serveWorkflowPage(\n event: IAppEvent,\n options: ServeWorkflowPageOptions,\n): Promise<string> {\n const query = useRequestQuery(event);\n\n const data: Record<string, any> = {\n features: options.features,\n redirect: sanitizeRelativeRedirect(query.redirect),\n };\n\n if (options.realmAware) {\n const realmId = typeof query.realmId === 'string' ? query.realmId : query.realm_id;\n data.realmId = typeof realmId === 'string' ? realmId : undefined;\n }\n\n if (options.tokenAware) {\n data.token = typeof query.token === 'string' ? query.token : undefined;\n }\n\n return renderUIPage(event, {\n url: options.url,\n payload: {\n config: { baseURL: options.baseURL },\n data,\n },\n });\n}\n"],"mappings":";;;;;;;;;;;;GA6BA,SAAgBG,kBACZC,OACAC,SAAiC;CAEjC,MAAMC,QAAQN,gBAAgBI,KAAAA;CAE9B,MAAMG,OAA4B;EAC9BC,UAAUH,QAAQG;EAClBC,UAAUR,yBAAyBK,MAAMG,QAAQ;CACrD;CAEA,IAAIJ,QAAQK,YAAY;EACpB,MAAMC,UAAU,OAAOL,MAAMK,YAAY,WAAWL,MAAMK,UAAUL,MAAMM;EAC1EL,KAAKI,UAAU,OAAOA,YAAY,WAAWA,UAAUE,KAAAA;CAC3D;CAEA,IAAIR,QAAQS,YACRP,KAAKQ,QAAQ,OAAOT,MAAMS,UAAU,WAAWT,MAAMS,QAAQF,KAAAA;CAGjE,OAAOX,aAAaE,OAAO;EACvBY,KAAKX,QAAQW;EACbC,SAAS;GACLC,QAAQ,EAAEC,SAASd,QAAQc,QAAQ;GACnCZ;EACJ;CACJ,CAAA;AACJ"}