npm - @authup/server-core - Versions diffs - 1.0.0-beta.53 → 1.0.0-beta.55 - Mend

@authup/server-core 1.0.0-beta.53 → 1.0.0-beta.55

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1255) hide show

package/dist/core/oauth2/authorization/code/verifier/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["OAuth2AuthorizationCodeChallengeMethod","OAuth2GrantError","buildOAuth2CodeChallenge","OAuth2AuthorizationCodeVerifier","repository","verify","code","options","entity","popOneById","invalid","client_id","clientId","realmId","realm_id","redirect_uri","redirectUri","redirectUriMismatch","clientIsPublic","code_challenge","codeVerifier","code_challenge_method","SHA_256","codeVerifierHash"],"sources":["../../../../../../src/core/oauth2/authorization/code/verifier/module.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2AuthorizationCode } from '@authup/core-kit';\nimport { OAuth2AuthorizationCodeChallengeMethod, OAuth2GrantError } from '@authup/specs';\nimport { buildOAuth2CodeChallenge } from '../../helpers.ts';\n\nimport type { IOAuth2AuthorizationCodeRepository } from '../repository/index.ts';\nimport type { IOAuth2AuthorizationCodeVerifier, IOAuth2AuthorizationCodeVerifyOptions } from './types.ts';\n\nexport class OAuth2AuthorizationCodeVerifier implements IOAuth2AuthorizationCodeVerifier {\n protected repository : IOAuth2AuthorizationCodeRepository;\n\n constructor(repository: IOAuth2AuthorizationCodeRepository) {\n this.repository = repository;\n }\n\n async verify(code: string, options: IOAuth2AuthorizationCodeVerifyOptions) : Promise<OAuth2AuthorizationCode> {\n const entity = await this.repository.popOneById(code);\n if (!entity) {\n throw OAuth2GrantError.invalid();\n }\n\n // RFC 6749 §4.1.3: if the client was issued a client_id, verify the\n // authorization code was issued to the authenticated client. Always\n // require a clientId to be supplied so a malformed token request can't\n // bypass the binding by omitting it.\n if (entity.client_id) {\n if (!options.clientId \|\| options.clientId !== entity.client_id) {\n throw OAuth2GrantError.invalid();\n }\n }\n\n // Realm binding (defense in depth): the code's realm (the authorizing\n // identity's realm) must match the authenticated client's realm. Blocks\n // redeeming a realm-A identity's code against a realm-B client — covers\n // codes minted outside OAuth2Authorization.authorize() (identity-provider\n // callback) and any in-flight codes issued before the authorize-side gate.\n if (options.realmId && entity.realm_id && entity.realm_id !== options.realmId) {\n throw OAuth2GrantError.invalid();\n }\n\n if (entity.redirect_uri) {\n if (!options.redirectUri \|\| entity.redirect_uri !== options.redirectUri) {\n throw OAuth2GrantError.redirectUriMismatch();\n }\n }\n\n // Public clients MUST use PKCE (RFC 7636). Defense in depth in case\n // the authorize-side check was bypassed or the client's\n // auth_method changed between authorize and token.\n if (options.clientIsPublic && !entity.code_challenge) {\n throw OAuth2GrantError.invalid('PKCE is required for public clients.');\n }\n\n if (entity.code_challenge) {\n if (!options.codeVerifier) {\n throw OAuth2GrantError.invalid('Code verifier invalid.');\n }\n\n // RFC 7636 §4.3: code_challenge_method defaults to \"plain\" when\n // absent. Only treat the challenge as S256 when the client\n // explicitly sent code_challenge_method=S256.\n if (entity.code_challenge_method === OAuth2AuthorizationCodeChallengeMethod.SHA_256) {\n const codeVerifierHash = await buildOAuth2CodeChallenge(options.codeVerifier);\n if (codeVerifierHash !== entity.code_challenge) {\n throw OAuth2GrantError.invalid('PKCE code_verifier mismatch.');\n }\n } else if (options.codeVerifier !== entity.code_challenge) {\n throw OAuth2GrantError.invalid('PKCE code_verifier mismatch.');\n }\n }\n\n return entity;\n }\n}\n"],"mappings":";;;;;;AAcA,IAAaG,kCAAb,MAAaA;CACCC;CAEV,YAAYA,YAAgD;EACxD,KAAKA,aAAaA;CACtB;CAEA,MAAMC,OAAOC,MAAcC,SAAmF;EAC1G,MAAMC,SAAS,MAAM,KAAKJ,WAAWK,WAAWH,IAAAA;EAChD,IAAI,CAACE,QACD,MAAMP,iBAAiBS,QAAO;EAOlC,IAAIF,OAAOG;~~OACH~~,CAACJ,QAAQK,YAAYL,QAAQK,aAAaJ,OAAOG,WACjD,MAAMV,iBAAiBS,QAAO;EAAA;EAStC,IAAIH,QAAQM,WAAWL,OAAOM,YAAYN,OAAOM,aAAaP,QAAQM,SAClE,MAAMZ,iBAAiBS,QAAO;EAGlC,IAAIF,OAAOO;~~OACH~~,CAACR,QAAQS,eAAeR,OAAOO,iBAAiBR,QAAQS,aACxD,MAAMf,iBAAiBgB,oBAAmB;EAAA;EAOlD,IAAIV,QAAQW,kBAAkB,CAACV,OAAOW,gBAClC,MAAMlB,iBAAiBS,QAAQ,sCAAA;EAGnC,IAAIF,OAAOW,gBAAgB;GACvB,IAAI,CAACZ,QAAQa,cACT,MAAMnB,iBAAiBS,QAAQ,wBAAA;GAMnC,IAAIF,OAAOa,0BAA0BrB,uCAAuCsB;~~QAEpEC~~,MAD2BrB,yBAAyBK,QAAQa,YAAY,MACnDZ,OAAOW,gBAC5B,MAAMlB,iBAAiBS,QAAQ,8BAAA;GAAA,OAEhC,IAAIH,QAAQa,iBAAiBZ,OAAOW,gBACvC,MAAMlB,iBAAiBS,QAAQ,8BAAA;EAEvC;EAEA,OAAOF;CACX;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["OAuth2AuthorizationCodeChallengeMethod","OAuth2GrantError","buildOAuth2CodeChallenge","OAuth2AuthorizationCodeVerifier","repository","verify","code","options","entity","popOneById","invalid","client_id","clientId","realmId","realm_id","redirect_uri","redirectUri","redirectUriMismatch","clientIsPublic","code_challenge","codeVerifier","code_challenge_method","SHA_256","codeVerifierHash"],"sources":["../../../../../../src/core/oauth2/authorization/code/verifier/module.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2AuthorizationCode } from '@authup/core-kit';\nimport { OAuth2AuthorizationCodeChallengeMethod, OAuth2GrantError } from '@authup/specs';\nimport { buildOAuth2CodeChallenge } from '../../helpers.ts';\n\nimport type { IOAuth2AuthorizationCodeRepository } from '../repository/index.ts';\nimport type { IOAuth2AuthorizationCodeVerifier, IOAuth2AuthorizationCodeVerifyOptions } from './types.ts';\n\nexport class OAuth2AuthorizationCodeVerifier implements IOAuth2AuthorizationCodeVerifier {\n protected repository : IOAuth2AuthorizationCodeRepository;\n\n constructor(repository: IOAuth2AuthorizationCodeRepository) {\n this.repository = repository;\n }\n\n async verify(code: string, options: IOAuth2AuthorizationCodeVerifyOptions) : Promise<OAuth2AuthorizationCode> {\n const entity = await this.repository.popOneById(code);\n if (!entity) {\n throw OAuth2GrantError.invalid();\n }\n\n // RFC 6749 §4.1.3: if the client was issued a client_id, verify the\n // authorization code was issued to the authenticated client. Always\n // require a clientId to be supplied so a malformed token request can't\n // bypass the binding by omitting it.\n if (entity.client_id) {\n if (!options.clientId \|\| options.clientId !== entity.client_id) {\n throw OAuth2GrantError.invalid();\n }\n }\n\n // Realm binding (defense in depth): the code's realm (the authorizing\n // identity's realm) must match the authenticated client's realm. Blocks\n // redeeming a realm-A identity's code against a realm-B client — covers\n // codes minted outside OAuth2Authorization.authorize() (identity-provider\n // callback) and any in-flight codes issued before the authorize-side gate.\n if (options.realmId && entity.realm_id && entity.realm_id !== options.realmId) {\n throw OAuth2GrantError.invalid();\n }\n\n if (entity.redirect_uri) {\n if (!options.redirectUri \|\| entity.redirect_uri !== options.redirectUri) {\n throw OAuth2GrantError.redirectUriMismatch();\n }\n }\n\n // Public clients MUST use PKCE (RFC 7636). Defense in depth in case\n // the authorize-side check was bypassed or the client's\n // auth_method changed between authorize and token.\n if (options.clientIsPublic && !entity.code_challenge) {\n throw OAuth2GrantError.invalid('PKCE is required for public clients.');\n }\n\n if (entity.code_challenge) {\n if (!options.codeVerifier) {\n throw OAuth2GrantError.invalid('Code verifier invalid.');\n }\n\n // RFC 7636 §4.3: code_challenge_method defaults to \"plain\" when\n // absent. Only treat the challenge as S256 when the client\n // explicitly sent code_challenge_method=S256.\n if (entity.code_challenge_method === OAuth2AuthorizationCodeChallengeMethod.SHA_256) {\n const codeVerifierHash = await buildOAuth2CodeChallenge(options.codeVerifier);\n if (codeVerifierHash !== entity.code_challenge) {\n throw OAuth2GrantError.invalid('PKCE code_verifier mismatch.');\n }\n } else if (options.codeVerifier !== entity.code_challenge) {\n throw OAuth2GrantError.invalid('PKCE code_verifier mismatch.');\n }\n }\n\n return entity;\n }\n}\n"],"mappings":";;;;;;AAcA,IAAaG,kCAAb,MAAaA;CACCC;CAEV,YAAYA,YAAgD;EACxD,KAAKA,aAAaA;CACtB;CAEA,MAAMC,OAAOC,MAAcC,SAAmF;EAC1G,MAAMC,SAAS,MAAM,KAAKJ,WAAWK,WAAWH,IAAAA;EAChD,IAAI,CAACE,QACD,MAAMP,iBAAiBS,QAAO;EAOlC,IAAIF,OAAOG,WACH;OAAA,CAACJ,QAAQK,YAAYL,QAAQK,aAAaJ,OAAOG,WACjD,MAAMV,iBAAiBS,QAAO;EAAA;EAStC,IAAIH,QAAQM,WAAWL,OAAOM,YAAYN,OAAOM,aAAaP,QAAQM,SAClE,MAAMZ,iBAAiBS,QAAO;EAGlC,IAAIF,OAAOO,cACH;OAAA,CAACR,QAAQS,eAAeR,OAAOO,iBAAiBR,QAAQS,aACxD,MAAMf,iBAAiBgB,oBAAmB;EAAA;EAOlD,IAAIV,QAAQW,kBAAkB,CAACV,OAAOW,gBAClC,MAAMlB,iBAAiBS,QAAQ,sCAAA;EAGnC,IAAIF,OAAOW,gBAAgB;GACvB,IAAI,CAACZ,QAAQa,cACT,MAAMnB,iBAAiBS,QAAQ,wBAAA;GAMnC,IAAIF,OAAOa,0BAA0BrB,uCAAuCsB,SAEpEC;QAAAA,MAD2BrB,yBAAyBK,QAAQa,YAAY,MACnDZ,OAAOW,gBAC5B,MAAMlB,iBAAiBS,QAAQ,8BAAA;GAAA,OAEhC,IAAIH,QAAQa,iBAAiBZ,OAAOW,gBACvC,MAAMlB,iBAAiBS,QAAQ,8BAAA;EAEvC;EAEA,OAAOF;CACX;AACJ"}

package/dist/core/oauth2/authorization/code-request/verifier/module.mjs CHANGED Viewed

@@ -24,11 +24,11 @@ var OAuth2AuthorizationCodeRequestVerifier = class {
 		if (!client) throw OAuth2ClientError.invalid();
 		if (!client.active) throw OAuth2ClientError.inactive();
 		assertClientGrantAllowed(client, OAuth2TokenGrant.AUTHORIZATION_CODE);
-		if (!client.redirect_uri) throw OAuth2GrantError.redirectUriMismatch();
+		if (!client.redirectUri) throw OAuth2GrantError.redirectUriMismatch();
 		if (isClientPublic(client) && !data.code_challenge) throw OAuth2RequestError.malformed("PKCE code_challenge is required for public clients.");
 		if (isClientPublic(client) && !data.state) throw OAuth2RequestError.malformed("state is required for public clients in the code flow.");
 		data.client_id = client.id;
-		data.realm_id = client.realm_id;
+		data.realm_id = client.realmId;
 		const scopes = await this.scopeRepository.findByClientId(client.id);
 		const scopeNames = scopes.map((scope) => scope.name);
 		if (data.scope) {
@@ -36,7 +36,7 @@ var OAuth2AuthorizationCodeRequestVerifier = class {
 		} else data.scope = scopeNames.join(" ");
 		const redirectUriVerified = !!data.redirect_uri;
 		if (data.redirect_uri) {
-			const redirectUris = client.redirect_uri.split(",");
+			const redirectUris = client.redirectUri.split(",");
 			if (!isSimpleMatch(data.redirect_uri, redirectUris)) throw OAuth2GrantError.redirectUriMismatch();
 		}
 		return {

package/dist/core/oauth2/authorization/code-request/verifier/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["ScopeName","isClientPublic","isSimpleMatch","isUUID","OAuth2ClientError","OAuth2GrantError","OAuth2RequestError","OAuth2ScopeError","OAuth2TokenGrant","hasOAuth2Scopes","assertClientGrantAllowed","OAuth2AuthorizationCodeRequestVerifier","clientRepository","scopeRepository","ctx","verify","data","client_id","invalid","realm_id","malformed","client","findOneByIdOrName","active","inactive","AUTHORIZATION_CODE","~~redirect_uri~~","redirectUriMismatch","code_challenge","state","id","scopes","findByClientId","scopeNames","map","scope","name","GLOBAL","insufficient","join","redirectUriVerified","redirectUris","split"],"sources":["../../../../../../src/core/oauth2/authorization/code-request/verifier/module.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport { ScopeName, isClientPublic } from '@authup/core-kit';\nimport { isSimpleMatch, isUUID } from '@authup/kit';\nimport {\n OAuth2ClientError,\n OAuth2GrantError,\n OAuth2RequestError,\n OAuth2ScopeError,\n OAuth2TokenGrant,\n hasOAuth2Scopes,\n} from '@authup/specs';\nimport type { IOAuth2ClientRepository } from '../../../client/index.ts';\nimport { assertClientGrantAllowed } from '../../../client/index.ts';\nimport type { IOAuth2ScopeRepository } from '../../../scope/index.ts';\nimport type {\n IOAuth2AuthorizationCodeRequestVerifier,\n OAuth2AuthorizationCodeRequestVerificationResult,\n OAuth2AuthorizationCodeRequestVerifierContext,\n} from './types.ts';\n\nexport class OAuth2AuthorizationCodeRequestVerifier implements IOAuth2AuthorizationCodeRequestVerifier {\n protected clientRepository: IOAuth2ClientRepository;\n\n protected scopeRepository: IOAuth2ScopeRepository;\n\n constructor(ctx: OAuth2AuthorizationCodeRequestVerifierContext) {\n this.clientRepository = ctx.clientRepository;\n this.scopeRepository = ctx.scopeRepository;\n }\n\n /\n Verify validated authorization code request.\n * @param data\n */\n async verify(\n data: OAuth2AuthorizationCodeRequest,\n ) : Promise<OAuth2AuthorizationCodeRequestVerificationResult> {\n if (!data.client_id) {\n throw OAuth2ClientError.invalid();\n }\n\n // A name-identified client needs a realm hint to resolve deterministically\n // — every realm has a built-in `web` client, so `client_id=web` without a\n // realm would bind to an arbitrary realm's client (and, post realm-gate,\n // produce a confusing mismatch against a random realm). Require the hint.\n if (!isUUID(data.client_id) && !data.realm_id) {\n throw OAuth2RequestError.malformed('A realm is required to resolve a client by name.');\n }\n\n const client = await this.clientRepository.findOneByIdOrName(data.client_id, data.realm_id);\n if (!client) {\n throw OAuth2ClientError.invalid();\n }\n\n if (!client.active) {\n throw OAuth2ClientError.inactive();\n }\n\n // A non-null grant_types allowlist must cover the code flow — an RP\n // misconfiguration fails at the front door, not at code redemption.\n assertClientGrantAllowed(client, OAuth2TokenGrant.AUTHORIZATION_CODE);\n\n // OAuth 2.1 posture: a client with no registered redirect_uri pattern\n // can never be matched — reject outright instead of trusting whatever\n // redirect_uri the request carries (the server would otherwise issue a\n // code to an attacker-supplied URI).\n if (!client.~~redirect_uri~~) {\n throw OAuth2GrantError.redirectUriMismatch();\n }\n\n // Public clients MUST use PKCE (RFC 7636 §4.4.1, OAuth 2.1). Without\n // PKCE a public client's code flow has no second factor — anyone who\n // intercepts the redirect can redeem the code at /token. The code flow\n // is the only supported response type, so this holds unconditionally.\n if (isClientPublic(client) && !data.code_challenge) {\n throw OAuth2RequestError.malformed('PKCE code_challenge is required for public clients.');\n }\n\n // Public clients SHOULD include state to bind the redirect to the\n // initiating session and prevent CSRF (RFC 6749 §10.12). Confidential\n // clients are exempt because the /token exchange already authenticates\n // them via client_secret.\n if (isClientPublic(client) && !data.state) {\n throw OAuth2RequestError.malformed('state is required for public clients in the code flow.');\n }\n\n data.client_id = client.id;\n data.realm_id = client.~~realm_id~~;\n\n const scopes = await this.scopeRepository.findByClientId(client.id);\n const scopeNames = scopes.map((scope) => scope.name);\n if (data.scope) {\n if (\n !hasOAuth2Scopes(scopeNames, data.scope) &&\n !hasOAuth2Scopes(data.scope, ScopeName.GLOBAL)\n ) {\n throw OAuth2ScopeError.insufficient();\n }\n } else {\n data.scope = scopeNames.join(' ');\n }\n\n // Verified only when the request's redirect_uri matched a registered\n // pattern (pattern-less clients were rejected above). A request without\n // a redirect_uri (e.g. the GET page render) stays unverified so\n // consumers never auto-redirect without a match.\n const redirectUriVerified = !!data.redirect_uri;\n if (data.redirect_uri) {\n const redirectUris = client.~~redirect_uri~~.split(',');\n\n if (!isSimpleMatch(data.redirect_uri, redirectUris)) {\n throw OAuth2GrantError.redirectUriMismatch();\n }\n }\n\n return {\n data,\n client,\n scopes,\n redirectUriVerified,\n };\n }\n}\n"],"mappings":";;;;;;;;;AA2BA,IAAaW,yCAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAoD;EAC5D,KAAKF,mBAAmBE,IAAIF;EAC5B,KAAKC,kBAAkBC,IAAID;CAC/B;;;;IAMA,MAAME,OACFC,MAC0D;EAC1D,IAAI,CAACA,KAAKC,WACN,MAAMb,kBAAkBc,QAAO;EAOnC,IAAI,CAACf,OAAOa,KAAKC,SAAS,KAAK,CAACD,KAAKG,UACjC,MAAMb,mBAAmBc,UAAU,kDAAA;EAGvC,MAAMC,SAAS,MAAM,KAAKT,iBAAiBU,kBAAkBN,KAAKC,WAAWD,KAAKG,QAAQ;EAC1F,IAAI,CAACE,QACD,MAAMjB,kBAAkBc,QAAO;EAGnC,IAAI,CAACG,OAAOE,QACR,MAAMnB,kBAAkBoB,SAAQ;EAKpCd,yBAAyBW,QAAQb,iBAAiBiB,kBAAkB;EAMpE,IAAI,CAACJ,OAAOK,~~cACR~~,MAAMrB,iBAAiBsB,oBAAmB;EAO9C,IAAI1B,eAAeoB,MAAAA,KAAW,CAACL,KAAKY,gBAChC,MAAMtB,mBAAmBc,UAAU,qDAAA;EAOvC,IAAInB,eAAeoB,MAAAA,KAAW,CAACL,KAAKa,OAChC,MAAMvB,mBAAmBc,UAAU,wDAAA;EAGvCJ,KAAKC,YAAYI,OAAOS;EACxBd,KAAKG,WAAWE,~~OAAOF~~;EAEvB,~~MAAMY~~,SAAS,MAAM,~~KAAKlB~~,~~gBAAgBmB~~,~~eAAeX~~,OAAOS,EAAE;EAClE,~~MAAMG~~,aAAaF,OAAOG,KAAKC,UAAUA,MAAMC,IAAI;EACnD,~~IAAIpB~~,~~KAAKmB~~;~~OAED~~,~~CAAC1B~~,~~gBAAgBwB~~,~~YAAYjB~~,~~KAAKmB~~,KAAK,KACvC,~~CAAC1B~~,gBAAgBO,~~KAAKmB~~,~~OAAOnC~~,~~UAAUqC~~,MAAM,GAE7C,~~MAAM9B,iBAAiB+~~B,aAAY;EAAA,~~OAGvCtB~~,~~KAAKmB~~,QAAQF,WAAWM,KAAK,GAAA;EAOjC,MAAMC,sBAAsB,CAAC,~~CAACxB~~,~~KAAKU~~;EACnC,~~IAAIV~~,~~KAAKU~~,cAAc;GACnB,~~MAAMe~~,~~eAAepB~~,OAAOK,~~aAAagB~~,MAAM,GAAA;~~GAE/C~~,IAAI,~~CAACxC~~,cAAcc,~~KAAKU~~,~~cAAce~~,YAAAA,GAClC,~~MAAMpC~~,iBAAiBsB,oBAAmB;EAElD;EAEA,OAAO;GACHX;GACAK;~~GACAU~~;GACAS;EACJ;CACJ;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["ScopeName","isClientPublic","isSimpleMatch","isUUID","OAuth2ClientError","OAuth2GrantError","OAuth2RequestError","OAuth2ScopeError","OAuth2TokenGrant","hasOAuth2Scopes","assertClientGrantAllowed","OAuth2AuthorizationCodeRequestVerifier","clientRepository","scopeRepository","ctx","verify","data","client_id","invalid","realm_id","malformed","client","findOneByIdOrName","active","inactive","AUTHORIZATION_CODE","redirectUri","redirectUriMismatch","code_challenge","state","id","realmId","scopes","findByClientId","scopeNames","map","scope","name","GLOBAL","insufficient","join","redirectUriVerified","redirect_uri","redirectUris","split"],"sources":["../../../../../../src/core/oauth2/authorization/code-request/verifier/module.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport { ScopeName, isClientPublic } from '@authup/core-kit';\nimport { isSimpleMatch, isUUID } from '@authup/kit';\nimport {\n OAuth2ClientError,\n OAuth2GrantError,\n OAuth2RequestError,\n OAuth2ScopeError,\n OAuth2TokenGrant,\n hasOAuth2Scopes,\n} from '@authup/specs';\nimport type { IOAuth2ClientRepository } from '../../../client/index.ts';\nimport { assertClientGrantAllowed } from '../../../client/index.ts';\nimport type { IOAuth2ScopeRepository } from '../../../scope/index.ts';\nimport type {\n IOAuth2AuthorizationCodeRequestVerifier,\n OAuth2AuthorizationCodeRequestVerificationResult,\n OAuth2AuthorizationCodeRequestVerifierContext,\n} from './types.ts';\n\nexport class OAuth2AuthorizationCodeRequestVerifier implements IOAuth2AuthorizationCodeRequestVerifier {\n protected clientRepository: IOAuth2ClientRepository;\n\n protected scopeRepository: IOAuth2ScopeRepository;\n\n constructor(ctx: OAuth2AuthorizationCodeRequestVerifierContext) {\n this.clientRepository = ctx.clientRepository;\n this.scopeRepository = ctx.scopeRepository;\n }\n\n /\n Verify validated authorization code request.\n * @param data\n */\n async verify(\n data: OAuth2AuthorizationCodeRequest,\n ) : Promise<OAuth2AuthorizationCodeRequestVerificationResult> {\n if (!data.client_id) {\n throw OAuth2ClientError.invalid();\n }\n\n // A name-identified client needs a realm hint to resolve deterministically\n // — every realm has a built-in `web` client, so `client_id=web` without a\n // realm would bind to an arbitrary realm's client (and, post realm-gate,\n // produce a confusing mismatch against a random realm). Require the hint.\n if (!isUUID(data.client_id) && !data.realm_id) {\n throw OAuth2RequestError.malformed('A realm is required to resolve a client by name.');\n }\n\n const client = await this.clientRepository.findOneByIdOrName(data.client_id, data.realm_id);\n if (!client) {\n throw OAuth2ClientError.invalid();\n }\n\n if (!client.active) {\n throw OAuth2ClientError.inactive();\n }\n\n // A non-null grant_types allowlist must cover the code flow — an RP\n // misconfiguration fails at the front door, not at code redemption.\n assertClientGrantAllowed(client, OAuth2TokenGrant.AUTHORIZATION_CODE);\n\n // OAuth 2.1 posture: a client with no registered redirect_uri pattern\n // can never be matched — reject outright instead of trusting whatever\n // redirect_uri the request carries (the server would otherwise issue a\n // code to an attacker-supplied URI).\n if (!client.redirectUri) {\n throw OAuth2GrantError.redirectUriMismatch();\n }\n\n // Public clients MUST use PKCE (RFC 7636 §4.4.1, OAuth 2.1). Without\n // PKCE a public client's code flow has no second factor — anyone who\n // intercepts the redirect can redeem the code at /token. The code flow\n // is the only supported response type, so this holds unconditionally.\n if (isClientPublic(client) && !data.code_challenge) {\n throw OAuth2RequestError.malformed('PKCE code_challenge is required for public clients.');\n }\n\n // Public clients SHOULD include state to bind the redirect to the\n // initiating session and prevent CSRF (RFC 6749 §10.12). Confidential\n // clients are exempt because the /token exchange already authenticates\n // them via client_secret.\n if (isClientPublic(client) && !data.state) {\n throw OAuth2RequestError.malformed('state is required for public clients in the code flow.');\n }\n\n data.client_id = client.id;\n data.realm_id = client.realmId;\n\n const scopes = await this.scopeRepository.findByClientId(client.id);\n const scopeNames = scopes.map((scope) => scope.name);\n if (data.scope) {\n if (\n !hasOAuth2Scopes(scopeNames, data.scope) &&\n !hasOAuth2Scopes(data.scope, ScopeName.GLOBAL)\n ) {\n throw OAuth2ScopeError.insufficient();\n }\n } else {\n data.scope = scopeNames.join(' ');\n }\n\n // Verified only when the request's redirect_uri matched a registered\n // pattern (pattern-less clients were rejected above). A request without\n // a redirect_uri (e.g. the GET page render) stays unverified so\n // consumers never auto-redirect without a match.\n const redirectUriVerified = !!data.redirect_uri;\n if (data.redirect_uri) {\n const redirectUris = client.redirectUri.split(',');\n\n if (!isSimpleMatch(data.redirect_uri, redirectUris)) {\n throw OAuth2GrantError.redirectUriMismatch();\n }\n }\n\n return {\n data,\n client,\n scopes,\n redirectUriVerified,\n };\n }\n}\n"],"mappings":";;;;;;;;;AA2BA,IAAaW,yCAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAoD;EAC5D,KAAKF,mBAAmBE,IAAIF;EAC5B,KAAKC,kBAAkBC,IAAID;CAC/B;;;;IAMA,MAAME,OACFC,MAC0D;EAC1D,IAAI,CAACA,KAAKC,WACN,MAAMb,kBAAkBc,QAAO;EAOnC,IAAI,CAACf,OAAOa,KAAKC,SAAS,KAAK,CAACD,KAAKG,UACjC,MAAMb,mBAAmBc,UAAU,kDAAA;EAGvC,MAAMC,SAAS,MAAM,KAAKT,iBAAiBU,kBAAkBN,KAAKC,WAAWD,KAAKG,QAAQ;EAC1F,IAAI,CAACE,QACD,MAAMjB,kBAAkBc,QAAO;EAGnC,IAAI,CAACG,OAAOE,QACR,MAAMnB,kBAAkBoB,SAAQ;EAKpCd,yBAAyBW,QAAQb,iBAAiBiB,kBAAkB;EAMpE,IAAI,CAACJ,OAAOK,aACR,MAAMrB,iBAAiBsB,oBAAmB;EAO9C,IAAI1B,eAAeoB,MAAAA,KAAW,CAACL,KAAKY,gBAChC,MAAMtB,mBAAmBc,UAAU,qDAAA;EAOvC,IAAInB,eAAeoB,MAAAA,KAAW,CAACL,KAAKa,OAChC,MAAMvB,mBAAmBc,UAAU,wDAAA;EAGvCJ,KAAKC,YAAYI,OAAOS;EACxBd,KAAKG,WAAWE,OAAOU;EAEvB,MAAMC,SAAS,MAAM,KAAKnB,gBAAgBoB,eAAeZ,OAAOS,EAAE;EAClE,MAAMI,aAAaF,OAAOG,KAAKC,UAAUA,MAAMC,IAAI;EACnD,IAAIrB,KAAKoB,OAED;OAAA,CAAC3B,gBAAgByB,YAAYlB,KAAKoB,KAAK,KACvC,CAAC3B,gBAAgBO,KAAKoB,OAAOpC,UAAUsC,MAAM,GAE7C,MAAM/B,iBAAiBgC,aAAY;EAAA,OAGvCvB,KAAKoB,QAAQF,WAAWM,KAAK,GAAA;EAOjC,MAAMC,sBAAsB,CAAC,CAACzB,KAAK0B;EACnC,IAAI1B,KAAK0B,cAAc;GACnB,MAAMC,eAAetB,OAAOK,YAAYkB,MAAM,GAAA;GAE9C,IAAI,CAAC1C,cAAcc,KAAK0B,cAAcC,YAAAA,GAClC,MAAMtC,iBAAiBsB,oBAAmB;EAElD;EAEA,OAAO;GACHX;GACAK;GACAW;GACAS;EACJ;CACJ;AACJ"}

package/dist/core/oauth2/authorization/helpers.d.ts CHANGED Viewed

@@ -2,12 +2,12 @@ import type { JWTAlgorithm, OAuth2TokenPayload } from '@authup/specs';
 import type { Session } from '@authup/core-kit';
 /**
  * Derive the OIDC `amr` / `acr` claims from the backing session's
- * auth_method + mfa_at (plan 050). Pre-column sessions (null auth_method)
+ * authMethod + mfaAt (plan 050). Pre-column sessions (null authMethod)
  * yield no claims — authup cannot retroactively know how an old session
  * authenticated. M2M methods yield none either (amr/acr are user-flow
  * claims; those grants mint no id_token).
  */
-export declare function deriveAmrAcr(session: Pick<Session, 'auth_method' | 'mfa_at'> | null): Pick<OAuth2TokenPayload, 'amr' | 'acr'>;
+export declare function deriveAmrAcr(session: Pick<Session, 'authMethod' | 'mfaAt'> | null): Pick<OAuth2TokenPayload, 'amr' | 'acr'>;
 export declare function generateOAuth2CodeVerifier(): string;
 export declare function base64URLEncode(arrayBuffer: ArrayBuffer): string;
 export declare function buildOAuth2TokenHash(value: string, alg?: `${JWTAlgorithm}` | null): Promise<string>;

package/dist/core/oauth2/authorization/helpers.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/authorization/helpers.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAMtE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAIhD;;;;;;GAMG;AACH,wBAAgB,YAAY,CACxB,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,~~aAAa~~,GAAG,~~QAAQ~~,CAAC,GAAG,IAAI,~~GACxD~~,IAAI,CAAC,kBAAkB,EAAE,KAAK,GAAG,KAAK,CAAC,CAiCzC;AAED,wBAAgB,0BAA0B,WAazC;AAED,wBAAgB,eAAe,CAAC,WAAW,EAAE,WAAW,UAWvD;AAWD,wBAAsB,oBAAoB,CACtC,KAAK,EAAE,MAAM,EACb,GAAG,CAAC,EAAE,GAAG,YAAY,EAAE,GAAG,IAAI,GAC9B,OAAO,CAAC,MAAM,CAAC,CAkBlB;AAED,wBAAsB,wBAAwB,CAAC,YAAY,EAAE,MAAM,mBAMlE"}
1	+ {"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/authorization/helpers.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAMtE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAIhD;;;;;;GAMG;AACH,wBAAgB,YAAY,CACxB,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,GAAG,IAAI,GACtD,IAAI,CAAC,kBAAkB,EAAE,KAAK,GAAG,KAAK,CAAC,CAiCzC;AAED,wBAAgB,0BAA0B,WAazC;AAED,wBAAgB,eAAe,CAAC,WAAW,EAAE,WAAW,UAWvD;AAWD,wBAAsB,oBAAoB,CACtC,KAAK,EAAE,MAAM,EACb,GAAG,CAAC,EAAE,GAAG,YAAY,EAAE,GAAG,IAAI,GAC9B,OAAO,CAAC,MAAM,CAAC,CAkBlB;AAED,wBAAsB,wBAAwB,CAAC,YAAY,EAAE,MAAM,mBAMlE"}

package/dist/core/oauth2/authorization/helpers.mjs CHANGED Viewed

@@ -7,14 +7,14 @@ import { subtle } from "uncrypto";
 //#region src/core/oauth2/authorization/helpers.ts
 /**
 * Derive the OIDC `amr` / `acr` claims from the backing session's
-* auth_method + mfa_at (plan 050). Pre-column sessions (null auth_method)
+* authMethod + mfaAt (plan 050). Pre-column sessions (null authMethod)
 * yield no claims — authup cannot retroactively know how an old session
 * authenticated. M2M methods yield none either (amr/acr are user-flow
 * claims; those grants mint no id_token).
 */ function deriveAmrAcr(session) {
-	if (!session || !session.auth_method) return {};
+	if (!session || !session.authMethod) return {};
 	const amr = [];
-	switch (session.auth_method) {
+	switch (session.authMethod) {
 		case SessionAuthMethod.PASSWORD:
 		case SessionAuthMethod.LDAP:
 			amr.push(OAuth2AuthenticationMethodReference.PASSWORD);
@@ -24,10 +24,10 @@ import { subtle } from "uncrypto";
 			break;
 		default: return {};
 	}
-	if (session.mfa_at) amr.push(OAuth2AuthenticationMethodReference.OTP);
+	if (session.mfaAt) amr.push(OAuth2AuthenticationMethodReference.OTP);
 	return {
 		amr,
-		acr: session.mfa_at ? OAuth2AuthenticationContextClass.MFA : OAuth2AuthenticationContextClass.PASSWORD
+		acr: session.mfaAt ? OAuth2AuthenticationContextClass.MFA : OAuth2AuthenticationContextClass.PASSWORD
 	};
 }
 function generateOAuth2CodeVerifier() {

package/dist/core/oauth2/authorization/helpers.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"helpers.mjs","names":["JWTError","OAuth2AuthenticationContextClass","OAuth2AuthenticationMethodReference","SessionAuthMethod","subtle","deriveAmrAcr","session","~~auth_method~~","amr","PASSWORD","LDAP","push","EXTERNAL","~~mfa_at~~","OTP","acr","MFA","generateOAuth2CodeVerifier","length","charset","codeVerifier","randomValues","Uint8Array","crypto","getRandomValues","i","base64URLEncode","arrayBuffer","charCode","Array","from","btoa","String","fromCharCode","apply","replace","TOKEN_HASH_DIGESTS","name","halfLength","buildOAuth2TokenHash","value","alg","digest","slice","headerPropertyInvalid","encoder","TextEncoder","data","encode","hashBuffer","halfHash","buildOAuth2CodeChallenge"],"sources":["../../../../src/core/oauth2/authorization/helpers.ts"],"sourcesContent":["/\n Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { JWTAlgorithm, OAuth2TokenPayload } from '@authup/specs';\nimport {\n JWTError,\n OAuth2AuthenticationContextClass,\n OAuth2AuthenticationMethodReference,\n} from '@authup/specs';\nimport type { Session } from '@authup/core-kit';\nimport { SessionAuthMethod } from '@authup/core-kit';\nimport { subtle } from 'uncrypto';\n\n/\n Derive the OIDC `amr` / `acr` claims from the backing session's\n * ~~auth_method~~ + ~~mfa_at~~ (plan 050). Pre-column sessions (null ~~auth_method~~)\n * yield no claims — authup cannot retroactively know how an old session\n * authenticated. M2M methods yield none either (amr/acr are user-flow\n * claims; those grants mint no id_token).\n /\nexport function deriveAmrAcr(\n session: Pick<Session, '~~auth_method~~' \| '~~mfa_at~~'> \| null,\n): Pick<OAuth2TokenPayload, 'amr' \| 'acr'> {\n if (!session \|\| !session.~~auth_method~~) {\n return {};\n }\n\n const amr : string[] = [];\n switch (session.~~auth_method~~) {\n case SessionAuthMethod.PASSWORD:\n case SessionAuthMethod.LDAP: {\n // LDAP is still a password factor for amr — the finer\n // distinction lives in the authup-local ~~auth_method~~.\n amr.push(OAuth2AuthenticationMethodReference.PASSWORD);\n break;\n }\n case SessionAuthMethod.EXTERNAL: {\n amr.push(OAuth2AuthenticationMethodReference.EXTERNAL);\n break;\n }\n default: {\n return {};\n }\n }\n\n if (session.~~mfa_at~~) {\n amr.push(OAuth2AuthenticationMethodReference.OTP);\n }\n\n return {\n amr,\n acr: session.~~mfa_at~~ ?\n OAuth2AuthenticationContextClass.MFA :\n OAuth2AuthenticationContextClass.PASSWORD,\n };\n}\n\nexport function generateOAuth2CodeVerifier() {\n const length = 64;\n const charset = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';\n\n let codeVerifier = '';\n const randomValues = new Uint8Array(length);\n crypto.getRandomValues(randomValues);\n\n for (let i = 0; i < length; i++) {\n codeVerifier += charset[randomValues[i] % charset.length];\n }\n\n return codeVerifier;\n}\n\nexport function base64URLEncode(arrayBuffer: ArrayBuffer) {\n // Convert the ArrayBuffer to string using Uint8 array.\n // btoa takes chars from 0-255 and base64 encodes.\n // Then convert the base64 encoded to base64url encoded.\n // (replace + with -, replace / with _, trim trailing =)\n const charCode = Array.from(new Uint8Array(arrayBuffer));\n\n return btoa(String.fromCharCode.apply(null, charCode))\n .replace(/\\+/g, '-')\n .replace(/\\//g, '_')\n .replace(/=+$/, '');\n}\n\n// OIDC Core §3.1.3.6: at_hash / c_hash use the hash algorithm of the id_token's\n// JWS alg (…S256 → SHA-256, …S384 → SHA-384, …S512 → SHA-512) and keep the LEFT\n// HALF of the digest — so the half-length follows the digest (16/24/32 bytes).\nconst TOKEN_HASH_DIGESTS : Record<string, { name: string, halfLength: number }> = {\n 256: { name: 'SHA-256', halfLength: 16 },\n 384: { name: 'SHA-384', halfLength: 24 },\n 512: { name: 'SHA-512', halfLength: 32 },\n};\n\nexport async function buildOAuth2TokenHash(\n value: string,\n alg?: `${JWTAlgorithm}` \| null,\n) : Promise<string> {\n // A key row without a persisted alg (nullable legacy column) signs with\n // the signer's 256 default (RS256/ES256/HS256) — derive the matching\n // SHA-256 digest. An unrecognized alg still fails loud — silently\n // defaulting there would mint a hash no conforming verifier accepts.\n const digest = alg ?\n TOKEN_HASH_DIGESTS[alg.slice(-3)] :\n TOKEN_HASH_DIGESTS['256'];\n if (!digest) {\n throw JWTError.headerPropertyInvalid('alg');\n }\n\n const encoder = new TextEncoder();\n const data = encoder.encode(value);\n const hashBuffer = await subtle.digest(digest.name, data);\n const halfHash = hashBuffer.slice(0, digest.halfLength);\n\n return base64URLEncode(halfHash);\n}\n\nexport async function buildOAuth2CodeChallenge(codeVerifier: string) {\n const encoder = new TextEncoder();\n const data = encoder.encode(codeVerifier);\n const arrayBuffer = await subtle.digest('SHA-256', data);\n\n return base64URLEncode(arrayBuffer);\n}\n"],"mappings":";;;;;;;;;;;;;GAwBA,SAAgBK,aACZC,~~SAAuD~~;~~CAEvD~~,IAAI,CAACA,WAAW,CAACA,QAAQC,~~aACrB~~,OAAO,CAAC;CAGZ,MAAMC,MAAiB,CAAA;CACvB,QAAQF,QAAQC,~~aAAhB~~;EACI,KAAKJ,kBAAkBM;EACvB,KAAKN,kBAAkBO;GAGnBF,IAAIG,KAAKT,oCAAoCO,QAAQ;GACrD;EAEJ,KAAKN,kBAAkBS;GACnBJ,IAAIG,KAAKT,oCAAoCU,QAAQ;GACrD;EAEJ,SACI,OAAO,CAAC;CAEhB;CAEA,IAAIN,QAAQO,~~QACRL~~,IAAIG,KAAKT,oCAAoCY,GAAG;CAGpD,OAAO;EACHN;EACAO,KAAKT,QAAQO,~~SACTZ~~,iCAAiCe,MACjCf,iCAAiCQ;CACzC;AACJ;AAEA,SAAgBQ,6BAAAA;CACZ,MAAMC,SAAS;CACf,MAAMC,UAAU;CAEhB,IAAIC,eAAe;CACnB,MAAMC,eAAe,IAAIC,WAAWJ,MAAAA;CACpCK,OAAOC,gBAAgBH,YAAAA;CAEvB,KAAK,IAAII,IAAI,GAAGA,IAAIP,QAAQO,KACxBL,gBAAgBD,QAAQE,aAAaI,KAAKN;CAG9C,OAAOC;AACX;AAEA,SAAgBM,gBAAgBC,aAAwB;CAKpD,MAAMC,WAAWC,MAAMC,KAAK,IAAIR,WAAWK,WAAAA,CAAAA;CAE3C,OAAOI,KAAKC,OAAOC,aAAaC,MAAM,MAAMN,QAAAA,CAAAA,CAAAA,CACvCO,QAAQ,OAAO,GAAA,CAAA,CACfA,QAAQ,OAAO,GAAA,CAAA,CACfA,QAAQ,OAAO,EAAA;AACxB;AAKA,MAAMC,qBAA4E;CAC9E,KAAK;EAAEC,MAAM;EAAWC,YAAY;CAAG;CACvC,KAAK;EAAED,MAAM;EAAWC,YAAY;CAAG;CACvC,KAAK;EAAED,MAAM;EAAWC,YAAY;CAAG;AAC3C;AAEA,eAAsBC,qBAClBC,OACAC,KAA8B;CAM9B,MAAMC,SAASD,MACXL,mBAAmBK,IAAIE,MAAM,EAAC,KAC9BP,mBAAmB;CACvB,IAAI,CAACM,QACD,MAAM1C,SAAS4C,sBAAsB,KAAA;CAIzC,MAAMG,OAAOF,IADOC,YACPD,CAAAA,CAAQG,OAAOR,KAAAA;CAI5B,OAAOd,iBAFUuB,MADQ7C,OAAOsC,OAAOA,OAAOL,MAAMU,IAAAA,EAAAA,CACxBJ,MAAM,GAAGD,OAAOJ,UAErBY,CAAAA;AAC3B;AAEA,eAAsBC,yBAAyB/B,cAAoB;CAE/D,MAAM2B,OAAOF,IADOC,YACPD,CAAAA,CAAQG,OAAO5B,YAAAA;CAG5B,OAAOM,gBAAgBC,MAFGvB,OAAOsC,OAAO,WAAWK,IAAAA,CAE5BpB;AAC3B"}
1	+ {"version":3,"file":"helpers.mjs","names":["JWTError","OAuth2AuthenticationContextClass","OAuth2AuthenticationMethodReference","SessionAuthMethod","subtle","deriveAmrAcr","session","authMethod","amr","PASSWORD","LDAP","push","EXTERNAL","mfaAt","OTP","acr","MFA","generateOAuth2CodeVerifier","length","charset","codeVerifier","randomValues","Uint8Array","crypto","getRandomValues","i","base64URLEncode","arrayBuffer","charCode","Array","from","btoa","String","fromCharCode","apply","replace","TOKEN_HASH_DIGESTS","name","halfLength","buildOAuth2TokenHash","value","alg","digest","slice","headerPropertyInvalid","encoder","TextEncoder","data","encode","hashBuffer","halfHash","buildOAuth2CodeChallenge"],"sources":["../../../../src/core/oauth2/authorization/helpers.ts"],"sourcesContent":["/\n Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { JWTAlgorithm, OAuth2TokenPayload } from '@authup/specs';\nimport {\n JWTError,\n OAuth2AuthenticationContextClass,\n OAuth2AuthenticationMethodReference,\n} from '@authup/specs';\nimport type { Session } from '@authup/core-kit';\nimport { SessionAuthMethod } from '@authup/core-kit';\nimport { subtle } from 'uncrypto';\n\n/\n Derive the OIDC `amr` / `acr` claims from the backing session's\n * authMethod + mfaAt (plan 050). Pre-column sessions (null authMethod)\n * yield no claims — authup cannot retroactively know how an old session\n * authenticated. M2M methods yield none either (amr/acr are user-flow\n * claims; those grants mint no id_token).\n /\nexport function deriveAmrAcr(\n session: Pick<Session, 'authMethod' \| 'mfaAt'> \| null,\n): Pick<OAuth2TokenPayload, 'amr' \| 'acr'> {\n if (!session \|\| !session.authMethod) {\n return {};\n }\n\n const amr : string[] = [];\n switch (session.authMethod) {\n case SessionAuthMethod.PASSWORD:\n case SessionAuthMethod.LDAP: {\n // LDAP is still a password factor for amr — the finer\n // distinction lives in the authup-local authMethod.\n amr.push(OAuth2AuthenticationMethodReference.PASSWORD);\n break;\n }\n case SessionAuthMethod.EXTERNAL: {\n amr.push(OAuth2AuthenticationMethodReference.EXTERNAL);\n break;\n }\n default: {\n return {};\n }\n }\n\n if (session.mfaAt) {\n amr.push(OAuth2AuthenticationMethodReference.OTP);\n }\n\n return {\n amr,\n acr: session.mfaAt ?\n OAuth2AuthenticationContextClass.MFA :\n OAuth2AuthenticationContextClass.PASSWORD,\n };\n}\n\nexport function generateOAuth2CodeVerifier() {\n const length = 64;\n const charset = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';\n\n let codeVerifier = '';\n const randomValues = new Uint8Array(length);\n crypto.getRandomValues(randomValues);\n\n for (let i = 0; i < length; i++) {\n codeVerifier += charset[randomValues[i] % charset.length];\n }\n\n return codeVerifier;\n}\n\nexport function base64URLEncode(arrayBuffer: ArrayBuffer) {\n // Convert the ArrayBuffer to string using Uint8 array.\n // btoa takes chars from 0-255 and base64 encodes.\n // Then convert the base64 encoded to base64url encoded.\n // (replace + with -, replace / with _, trim trailing =)\n const charCode = Array.from(new Uint8Array(arrayBuffer));\n\n return btoa(String.fromCharCode.apply(null, charCode))\n .replace(/\\+/g, '-')\n .replace(/\\//g, '_')\n .replace(/=+$/, '');\n}\n\n// OIDC Core §3.1.3.6: at_hash / c_hash use the hash algorithm of the id_token's\n// JWS alg (…S256 → SHA-256, …S384 → SHA-384, …S512 → SHA-512) and keep the LEFT\n// HALF of the digest — so the half-length follows the digest (16/24/32 bytes).\nconst TOKEN_HASH_DIGESTS : Record<string, { name: string, halfLength: number }> = {\n 256: { name: 'SHA-256', halfLength: 16 },\n 384: { name: 'SHA-384', halfLength: 24 },\n 512: { name: 'SHA-512', halfLength: 32 },\n};\n\nexport async function buildOAuth2TokenHash(\n value: string,\n alg?: `${JWTAlgorithm}` \| null,\n) : Promise<string> {\n // A key row without a persisted alg (nullable legacy column) signs with\n // the signer's 256 default (RS256/ES256/HS256) — derive the matching\n // SHA-256 digest. An unrecognized alg still fails loud — silently\n // defaulting there would mint a hash no conforming verifier accepts.\n const digest = alg ?\n TOKEN_HASH_DIGESTS[alg.slice(-3)] :\n TOKEN_HASH_DIGESTS['256'];\n if (!digest) {\n throw JWTError.headerPropertyInvalid('alg');\n }\n\n const encoder = new TextEncoder();\n const data = encoder.encode(value);\n const hashBuffer = await subtle.digest(digest.name, data);\n const halfHash = hashBuffer.slice(0, digest.halfLength);\n\n return base64URLEncode(halfHash);\n}\n\nexport async function buildOAuth2CodeChallenge(codeVerifier: string) {\n const encoder = new TextEncoder();\n const data = encoder.encode(codeVerifier);\n const arrayBuffer = await subtle.digest('SHA-256', data);\n\n return base64URLEncode(arrayBuffer);\n}\n"],"mappings":";;;;;;;;;;;;;GAwBA,SAAgBK,aACZC,SAAqD;CAErD,IAAI,CAACA,WAAW,CAACA,QAAQC,YACrB,OAAO,CAAC;CAGZ,MAAMC,MAAiB,CAAA;CACvB,QAAQF,QAAQC,YAAhB;EACI,KAAKJ,kBAAkBM;EACvB,KAAKN,kBAAkBO;GAGnBF,IAAIG,KAAKT,oCAAoCO,QAAQ;GACrD;EAEJ,KAAKN,kBAAkBS;GACnBJ,IAAIG,KAAKT,oCAAoCU,QAAQ;GACrD;EAEJ,SACI,OAAO,CAAC;CAEhB;CAEA,IAAIN,QAAQO,OACRL,IAAIG,KAAKT,oCAAoCY,GAAG;CAGpD,OAAO;EACHN;EACAO,KAAKT,QAAQO,QACTZ,iCAAiCe,MACjCf,iCAAiCQ;CACzC;AACJ;AAEA,SAAgBQ,6BAAAA;CACZ,MAAMC,SAAS;CACf,MAAMC,UAAU;CAEhB,IAAIC,eAAe;CACnB,MAAMC,eAAe,IAAIC,WAAWJ,MAAAA;CACpCK,OAAOC,gBAAgBH,YAAAA;CAEvB,KAAK,IAAII,IAAI,GAAGA,IAAIP,QAAQO,KACxBL,gBAAgBD,QAAQE,aAAaI,KAAKN;CAG9C,OAAOC;AACX;AAEA,SAAgBM,gBAAgBC,aAAwB;CAKpD,MAAMC,WAAWC,MAAMC,KAAK,IAAIR,WAAWK,WAAAA,CAAAA;CAE3C,OAAOI,KAAKC,OAAOC,aAAaC,MAAM,MAAMN,QAAAA,CAAAA,CAAAA,CACvCO,QAAQ,OAAO,GAAA,CAAA,CACfA,QAAQ,OAAO,GAAA,CAAA,CACfA,QAAQ,OAAO,EAAA;AACxB;AAKA,MAAMC,qBAA4E;CAC9E,KAAK;EAAEC,MAAM;EAAWC,YAAY;CAAG;CACvC,KAAK;EAAED,MAAM;EAAWC,YAAY;CAAG;CACvC,KAAK;EAAED,MAAM;EAAWC,YAAY;CAAG;AAC3C;AAEA,eAAsBC,qBAClBC,OACAC,KAA8B;CAM9B,MAAMC,SAASD,MACXL,mBAAmBK,IAAIE,MAAM,EAAC,KAC9BP,mBAAmB;CACvB,IAAI,CAACM,QACD,MAAM1C,SAAS4C,sBAAsB,KAAA;CAIzC,MAAMG,OAAOF,IADOC,YACPD,CAAAA,CAAQG,OAAOR,KAAAA;CAI5B,OAAOd,iBAFUuB,MADQ7C,OAAOsC,OAAOA,OAAOL,MAAMU,IAAAA,EAAAA,CACxBJ,MAAM,GAAGD,OAAOJ,UAErBY,CAAAA;AAC3B;AAEA,eAAsBC,yBAAyB/B,cAAoB;CAE/D,MAAM2B,OAAOF,IADOC,YACPD,CAAAA,CAAQG,OAAO5B,YAAAA;CAG5B,OAAOM,gBAAgBC,MAFGvB,OAAOsC,OAAO,WAAWK,IAAAA,CAE5BpB;AAC3B"}

package/dist/core/oauth2/authorization/module.mjs CHANGED Viewed

@@ -47,7 +47,7 @@ var OAuth2Authorization = class {
 				actorName: identity.data.name,
 				realmId: data.realm_id ?? null,
 				data: {
-					reason: options.client?.built_in ? "autoConsent" : "consent",
+					reason: options.client?.builtIn ? "autoConsent" : "consent",
 					...data.scope ? { scope: data.scope } : {}
 				}
 			});
@@ -85,21 +85,21 @@ var OAuth2Authorization = class {
 			...data.state ? { state: data.state } : {}
 		};
 		if (!identity) throw OAuth2RequestError.identityInvalid();
-		if (data.realm_id && identity.data.realm_id !== data.realm_id) throw OAuth2LoginRequiredError.realmMismatch();
+		if (data.realm_id && identity.data.realmId !== data.realm_id) throw OAuth2LoginRequiredError.realmMismatch();
 		const nowSeconds = Math.floor(Date.now() / 1e3);
 		let authTime = nowSeconds;
 		let session = null;
 		if (options.sessionId) {
 			session = await this.sessionManager.findOneById(options.sessionId);
-			if (session && session.created_at) authTime = Math.floor(new Date(session.created_at).getTime() / 1e3);
+			if (session && session.createdAt) authTime = Math.floor(new Date(session.createdAt).getTime() / 1e3);
 		}
 		if (this.mfaChallengeProvider && identity.type === IdentityType.USER) {
 			const challenge = await this.mfaChallengeProvider.challenge(identity.data.id, { issueMaterial: false });
-			if (challenge.required && !session?.mfa_at) throw OAuth2MfaRequiredError.challengeRequired();
+			if (challenge.required && !session?.mfaAt) throw OAuth2MfaRequiredError.challengeRequired();
 			if (challenge.enrollmentRequired) throw OAuth2MfaRequiredError.enrollmentRequired();
 			if (challenge.required && data.acr_values) {
 				if (data.acr_values.split(" ").includes(OAuth2AuthenticationContextClass.MFA)) {
-					const mfaAtSeconds = session?.mfa_at ? Math.floor(new Date(session.mfa_at).getTime() / 1e3) : null;
+					const mfaAtSeconds = session?.mfaAt ? Math.floor(new Date(session.mfaAt).getTime() / 1e3) : null;
 					if (mfaAtSeconds === null || nowSeconds - mfaAtSeconds > this.mfaFreshnessMaxAge) throw OAuth2MfaRequiredError.stepUpRequired();
 				}
 			}
@@ -109,10 +109,10 @@ var OAuth2Authorization = class {
 			const maxAge = Number(data.max_age);
 			if (Number.isFinite(maxAge) && nowSeconds - authTime > maxAge) throw OAuth2LoginRequiredError.reauthenticationRequired();
 		}
-		if (options.client?.access_policy_id) {
+		if (options.client?.accessPolicyId) {
 			let allowed = false;
 			const subject = toIdentityPolicyData(identity);
-			if (this.accessPolicyEvaluator && subject) allowed = await this.accessPolicyEvaluator.evaluate(options.client.access_policy_id, subject);
+			if (this.accessPolicyEvaluator && subject) allowed = await this.accessPolicyEvaluator.evaluate(options.client.accessPolicyId, subject);
 			if (!allowed) throw OAuth2AccessDeniedError.forClient(options.redirectUriVerified && data.redirect_uri ? {
 				redirectUri: data.redirect_uri,
 				state: data.state ?? null
@@ -121,7 +121,7 @@ var OAuth2Authorization = class {
 		output.authorizationCode = (await this.codeIssuer.issue(data, identity, {
 			sessionId: options.sessionId,
 			authTime,
-			authMethod: session?.auth_method ?? null
+			authMethod: session?.authMethod ?? null
 		})).id;
 		return output;
 	}

package/dist/core/oauth2/authorization/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["EventName","EventRefType","EventScope","IdentityType","hasInstanceof","OAUTH2_ACCESS_DENIED_ERROR_INSTANCE","OAUTH2_LOGIN_REQUIRED_ERROR_INSTANCE","OAUTH2_MFA_REQUIRED_ERROR_INSTANCE","OAuth2AccessDeniedError","OAuth2AuthenticationContextClass","OAuth2AuthorizationPrompt","OAuth2AuthorizationResponseType","OAuth2GrantError","OAuth2LoginRequiredError","OAuth2MfaRequiredError","OAuth2RequestError","OAuth2ResponseTypeError","toIdentityPolicyData","DEFAULT_PROMPT_LOGIN_MAX_AGE","DEFAULT_MFA_FRESHNESS_MAX_AGE","OAuth2Authorization","codeIssuer","sessionManager","eventService","metrics","promptLoginMaxAge","mfaFreshnessMaxAge","mfaChallengeProvider","accessPolicyEvaluator","ctx","authorize","data","identity","options","result","authorizeInner","record","scope","OAUTH2","name","AUTHORIZE","refType","CLIENT","refId","client","id","client_id","clientId","actorType","type","actorId","actorName","realmId","realm_id","reason","built_in","recordAuthorize","e","AUTHORIZE_FAILED","responseTypes","response_type","Array","isArray","split","responseType","CODE","unsupported","includes","redirect_uri","redirectUriMismatch","output","redirectUri","state","identityInvalid","realmMismatch","nowSeconds","Math","floor","Date","now","authTime","session","sessionId","findOneById","created_at","getTime","USER","challenge","issueMaterial","required","mfa_at","challengeRequired","enrollmentRequired","acr_values","acrValues","MFA","mfaAtSeconds","stepUpRequired","prompts","prompt","LOGIN","reauthenticationRequired","max_age","maxAge","Number","isFinite","access_policy_id","allowed","subject","evaluate","forClient","redirectUriVerified","undefined","codeEntity","issue","authMethod","auth_method","authorizationCode"],"sources":["../../../../src/core/oauth2/authorization/module.ts"],"sourcesContent":["/\n Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type {\n Identity, \n OAuth2AuthorizationCode, \n OAuth2AuthorizationCodeRequest, \n Session,\n} from '@authup/core-kit';\nimport {\n EventName, \n EventRefType, \n EventScope, \n IdentityType,\n} from '@authup/core-kit';\nimport { hasInstanceof } from '@authup/errors';\nimport {\n OAUTH2_ACCESS_DENIED_ERROR_INSTANCE,\n OAUTH2_LOGIN_REQUIRED_ERROR_INSTANCE,\n OAUTH2_MFA_REQUIRED_ERROR_INSTANCE,\n OAuth2AccessDeniedError,\n OAuth2AuthenticationContextClass,\n OAuth2AuthorizationPrompt,\n OAuth2AuthorizationResponseType,\n OAuth2GrantError,\n OAuth2LoginRequiredError,\n OAuth2MfaRequiredError,\n OAuth2RequestError,\n OAuth2ResponseTypeError,\n} from '@authup/specs';\nimport type { IOAuth2AuthorizationCodeIssuer } from './code/index.ts';\nimport type { IOAuth2AccessPolicyEvaluator } from '../access-policy/index.ts';\nimport { toIdentityPolicyData } from '../../identity/permission/identity-policy-data.ts';\nimport type {\n OAuth2AuthorizationManagerContext,\n OAuth2AuthorizationOptions,\n OAuth2AuthorizationResult,\n} from './types.ts';\nimport type { ISessionManager } from '../../authentication/index.ts';\nimport type { IEventService, IUserAuthenticatorChallengeProvider } from '../../entities/index.ts';\nimport type { IAuthFlowMetrics } from '../../metrics/index.ts';\n\nconst DEFAULT_PROMPT_LOGIN_MAX_AGE = 60;\n\n// Deliberately 60 (not 0, deviating from the plan-050 sketch): the hosted\n// challenge round-trip (stamp mfa_at → retry POST /authorize) takes seconds,\n// so a 0-window step-up could never be satisfied and would loop the ladder.\nconst DEFAULT_MFA_FRESHNESS_MAX_AGE = 60;\n\nexport class OAuth2Authorization {\n protected codeIssuer : IOAuth2AuthorizationCodeIssuer;\n\n protected sessionManager : ISessionManager;\n\n protected eventService? : IEventService;\n\n protected metrics? : IAuthFlowMetrics;\n\n protected promptLoginMaxAge : number;\n\n protected mfaFreshnessMaxAge : number;\n\n protected mfaChallengeProvider? : IUserAuthenticatorChallengeProvider;\n\n protected accessPolicyEvaluator? : IOAuth2AccessPolicyEvaluator;\n\n constructor(ctx: OAuth2AuthorizationManagerContext) {\n this.codeIssuer = ctx.codeIssuer;\n this.sessionManager = ctx.sessionManager;\n this.eventService = ctx.eventService;\n this.metrics = ctx.metrics;\n this.accessPolicyEvaluator = ctx.accessPolicyEvaluator;\n this.promptLoginMaxAge = ctx.promptLoginMaxAge ?? DEFAULT_PROMPT_LOGIN_MAX_AGE;\n this.mfaFreshnessMaxAge = ctx.mfaFreshnessMaxAge ?? DEFAULT_MFA_FRESHNESS_MAX_AGE;\n this.mfaChallengeProvider = ctx.mfaChallengeProvider;\n }\n\n /\n Authorize with validated codeRequest.\n \n @param data\n * @param identity\n * @param options\n */\n async authorize(\n data: OAuth2AuthorizationCodeRequest,\n identity: Identity,\n options: OAuth2AuthorizationOptions = {},\n ) : Promise<OAuth2AuthorizationResult> {\n try {\n const result = await this.authorizeInner(data, identity, options);\n\n await this.eventService?.record({\n scope: EventScope.OAUTH2,\n name: EventName.AUTHORIZE,\n refType: EventRefType.CLIENT,\n refId: options.client?.id ?? data.client_id ?? null,\n clientId: options.client?.id ?? data.client_id ?? null,\n actorType: identity.type,\n actorId: identity.data.id,\n actorName: identity.data.name,\n realmId: data.realm_id ?? null,\n data: {\n reason: options.client?.built_in ? 'autoConsent' : 'consent',\n ...(data.scope ? { scope: data.scope } : {}),\n },\n });\n this.metrics?.recordAuthorize('issued');\n\n return result;\n } catch (e) {\n if (hasInstanceof(e, OAUTH2_ACCESS_DENIED_ERROR_INSTANCE)) {\n await this.eventService?.record({\n scope: EventScope.OAUTH2,\n name: EventName.AUTHORIZE_FAILED,\n refType: EventRefType.CLIENT,\n refId: options.client?.id ?? data.client_id ?? null,\n clientId: options.client?.id ?? data.client_id ?? null,\n actorType: identity.type,\n actorId: identity.data.id,\n actorName: identity.data.name,\n realmId: data.realm_id ?? null,\n data: { reason: 'accessPolicy' },\n });\n this.metrics?.recordAuthorize('denied');\n } else if (hasInstanceof(e, OAUTH2_LOGIN_REQUIRED_ERROR_INSTANCE)) {\n this.metrics?.recordAuthorize('login_required');\n } else if (hasInstanceof(e, OAUTH2_MFA_REQUIRED_ERROR_INSTANCE)) {\n this.metrics?.recordAuthorize('mfa_required');\n } else {\n this.metrics?.recordAuthorize('error');\n }\n\n throw e;\n }\n }\n\n protected async authorizeInner(\n data: OAuth2AuthorizationCodeRequest,\n identity: Identity,\n options: OAuth2AuthorizationOptions = {},\n ) : Promise<OAuth2AuthorizationResult> {\n // OAuth 2.1 posture: only the authorization-code response type is\n // supported — implicit/hybrid (token, id_token, none) were dropped\n // (plan 042 item 3). Defense in depth behind the request validator.\n let responseTypes : string[] = [];\n if (data.response_type) {\n responseTypes = Array.isArray(data.response_type) ?\n data.response_type :\n data.response_type.split(' ');\n }\n\n for (const responseType of responseTypes) {\n if (responseType !== OAuth2AuthorizationResponseType.CODE) {\n throw OAuth2ResponseTypeError.unsupported();\n }\n }\n\n if (!responseTypes.includes(OAuth2AuthorizationResponseType.CODE)) {\n throw OAuth2ResponseTypeError.unsupported();\n }\n\n if (!data.redirect_uri) {\n throw OAuth2GrantError.redirectUriMismatch();\n }\n\n const output : OAuth2AuthorizationResult = {\n redirectUri: data.redirect_uri,\n ...(data.state ? { state: data.state } : {}),\n };\n\n if (!identity) {\n throw OAuth2RequestError.identityInvalid();\n }\n\n // Realm binding: the code-request verifier stamped data.realm_id with the\n // resolved client's realm. The authenticated identity must belong to that\n // same realm — otherwise a lingering session for realm A could silently\n // mint a code/token for realm B's client (confused deputy). The error body\n // deliberately carries no identity data (no realm-enumeration oracle).\n // The comparison reads the scalar realm_id column, NOT the realm\n // relation — the relation may simply not be loaded on the resolved\n // identity. An identity without a realm_id fails closed the same way —\n // clean login_required, never a TypeError.\n if (\n data.realm_id &&\n identity.data.realm_id !== data.realm_id\n ) {\n throw OAuth2LoginRequiredError.realmMismatch();\n }\n\n // Authentication time = the backing session's creation instant (NOT\n // refreshed_at — a token refresh must not reset it). Session-less flows\n // (e.g. HTTP Basic authorize) present live credentials on this request,\n // so the authentication time is \"now\".\n const nowSeconds = Math.floor(Date.now() / 1000);\n let authTime = nowSeconds;\n let session : Session \| null = null;\n if (options.sessionId) {\n session = await this.sessionManager.findOneById(options.sessionId);\n if (session && session.created_at) {\n authTime = Math.floor(new Date(session.created_at).getTime() / 1000);\n }\n }\n\n // MFA backstop (plan 049) — the authoritative server-side gate; the\n // hosted UI's challenge step is convenience. The proof is session-bound\n // (mfa_at — stamped by the challenge endpoint or the password grant's\n // otp param), so a session-less flow (HTTP Basic) cannot carry one and\n // fails closed while the user holds a confirmed device. A user without\n // a device under mfaRequired is routed to inline enrollment.\n if (this.mfaChallengeProvider && identity.type === IdentityType.USER) {\n // requirement flags only — the interactive challenge material (the\n // webauthn nonce) is issued by the status endpoint, not this backstop.\n const challenge = await this.mfaChallengeProvider.challenge(\n identity.data.id,\n { issueMaterial: false },\n );\n if (challenge.required && !session?.mfa_at) {\n throw OAuth2MfaRequiredError.challengeRequired();\n }\n\n if (challenge.enrollmentRequired) {\n throw OAuth2MfaRequiredError.enrollmentRequired();\n }\n\n // Step-up (plan 050 stage 3): a requested `acr_values` containing\n // urn:authup:mfa is a TRIGGER (Auth0/Keycloak stance) — the proof\n // must additionally be FRESH (mfaFreshnessMaxAge window, mirroring\n // promptLoginMaxAge's absorb-the-round-trip semantics). Enforced\n // only while the user actually holds a factor — per OIDC Core\n // §5.5.1.1 acr is voluntary, so an unsatisfiable request degrades\n // to the achieved acr instead of bricking the RP.\n if (challenge.required && data.acr_values) {\n const acrValues = data.acr_values.split(' ');\n if (acrValues.includes(OAuth2AuthenticationContextClass.MFA)) {\n const mfaAtSeconds = session?.mfa_at ?\n Math.floor(new Date(session.mfa_at).getTime() / 1000) :\n null;\n if (mfaAtSeconds === null \|\| nowSeconds - mfaAtSeconds > this.mfaFreshnessMaxAge) {\n throw OAuth2MfaRequiredError.stepUpRequired();\n }\n }\n }\n }\n\n // OIDC §3.1.2.1 prompt=login / max_age freshness (enforced only when\n // requested — a plain authorize never throws here). The hosted page\n // renders the login form for prompt=login; this is the server backstop.\n const prompts = data.prompt ? data.prompt.split(' ') : [];\n if (\n prompts.includes(OAuth2AuthorizationPrompt.LOGIN) &&\n nowSeconds - authTime > this.promptLoginMaxAge\n ) {\n throw OAuth2LoginRequiredError.reauthenticationRequired();\n }\n\n if (\n typeof data.max_age !== 'undefined' &&\n data.max_age !== null\n ) {\n const maxAge = Number(data.max_age);\n if (\n Number.isFinite(maxAge) &&\n nowSeconds - authTime > maxAge\n ) {\n throw OAuth2LoginRequiredError.reauthenticationRequired();\n }\n }\n\n // Application access policy (plan 052) — the last gate before\n // issuance: a denial is only revealed to a fully-authenticated\n // (incl. second-factor) identity. A client carrying a policy id with\n // no wired evaluator denies too (never silently allow a configured\n // gate). The redirect target rides the error only when the\n // redirect_uri was pattern-verified (RFC 6749 §4.1.2.1).\n if (options.client?.access_policy_id) {\n let allowed = false;\n\n const subject = toIdentityPolicyData(identity);\n if (this.accessPolicyEvaluator && subject) {\n allowed = await this.accessPolicyEvaluator.evaluate(\n options.client.access_policy_id,\n subject,\n );\n }\n\n if (!allowed) {\n throw OAuth2AccessDeniedError.forClient(\n options.redirectUriVerified && data.redirect_uri ?\n { redirectUri: data.redirect_uri, state: data.state ?? null } :\n undefined,\n );\n }\n }\n\n // The id_token is NOT minted here — the /token exchange mints it after\n // resolving the real backing session, so its `sid` is authoritative\n // (plan 042 item 6). The code carries the authentication instant.\n const codeEntity : OAuth2AuthorizationCode = await this.codeIssuer.issue(\n data,\n identity,\n {\n sessionId: options.sessionId,\n authTime,\n authMethod: session?.auth_method ?? null,\n },\n );\n\n output.authorizationCode = codeEntity.id;\n\n return output;\n }\n}\n"],"mappings":";;;;;;;;AA8CA,MAAMkB,+BAA+B;AAKrC,MAAMC,gCAAgC;AAEtC,IAAaC,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAwC;EAChD,KAAKR,aAAaQ,IAAIR;EACtB,KAAKC,iBAAiBO,IAAIP;EAC1B,KAAKC,eAAeM,IAAIN;EACxB,KAAKC,UAAUK,IAAIL;EACnB,KAAKI,wBAAwBC,IAAID;EACjC,KAAKH,oBAAoBI,IAAIJ,qBAAqBP;EAClD,KAAKQ,qBAAqBG,IAAIH,sBAAsBP;EACpD,KAAKQ,uBAAuBE,IAAIF;CACpC;;;;;;;IASA,MAAMG,UACFC,MACAC,UACAC,UAAsC,CAAC,GACJ;EACnC,IAAI;GACA,MAAMC,SAAS,MAAM,KAAKC,eAAeJ,MAAMC,UAAUC,OAAAA;GAEzD,MAAM,KAAKV,cAAca,OAAO;IAC5BC,OAAOnC,WAAWoC;IAClBC,MAAMvC,UAAUwC;IAChBC,SAASxC,aAAayC;IACtBC,OAAOV,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;IAC/CC,UAAUd,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;IAClDE,WAAWhB,SAASiB;IACpBC,SAASlB,SAASD,KAAKc;IACvBM,WAAWnB,SAASD,KAAKQ;IACzBa,SAASrB,KAAKsB,YAAY;IAC1BtB,MAAM;KACFuB,QAAQrB,QAAQW,QAAQW,WAAW,gBAAgB;KACnD,GAAIxB,KAAKM,QAAQ,EAAEA,OAAON,KAAKM,MAAM,IAAI,CAAC;IAC9C;GACJ,CAAA;GACA,KAAKb,SAASgC,gBAAgB,QAAA;GAE9B,OAAOtB;EACX,SAASuB,GAAG;GACR,IAAIrD,cAAcqD,GAAGpD,mCAAAA,GAAsC;IACvD,MAAM,KAAKkB,cAAca,OAAO;KAC5BC,OAAOnC,WAAWoC;KAClBC,MAAMvC,UAAU0D;KAChBjB,SAASxC,aAAayC;KACtBC,OAAOV,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;KAC/CC,UAAUd,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;KAClDE,WAAWhB,SAASiB;KACpBC,SAASlB,SAASD,KAAKc;KACvBM,WAAWnB,SAASD,KAAKQ;KACzBa,SAASrB,KAAKsB,YAAY;KAC1BtB,MAAM,EAAEuB,QAAQ,eAAe;IACnC,CAAA;IACA,KAAK9B,SAASgC,gBAAgB,QAAA;GAClC,OAAO,IAAIpD,cAAcqD,GAAGnD,oCAAAA,GACxB,KAAKkB,SAASgC,gBAAgB,gBAAA;QAC3B,IAAIpD,cAAcqD,GAAGlD,kCAAAA,GACxB,KAAKiB,SAASgC,gBAAgB,cAAA;QAE9B,KAAKhC,SAASgC,gBAAgB,OAAA;GAGlC,MAAMC;EACV;CACJ;CAEA,MAAgBtB,eACZJ,MACAC,UACAC,UAAsC,CAAC,GACJ;EAInC,IAAI0B,gBAA2B,CAAA;EAC/B,IAAI5B,KAAK6B,eACLD,gBAAgBE,MAAMC,QAAQ/B,KAAK6B,aAAa,IAC5C7B,KAAK6B,gBACL7B,KAAK6B,cAAcG,MAAM,GAAA;EAGjC,KAAK,MAAMC,gBAAgBL,eACvB,IAAIK,iBAAiBrD,gCAAgCsD,MACjD,MAAMjD,wBAAwBkD,YAAW;EAIjD,IAAI,CAACP,cAAcQ,SAASxD,gCAAgCsD,IAAI,GAC5D,MAAMjD,wBAAwBkD,YAAW;EAG7C,IAAI,CAACnC,KAAKqC,cACN,MAAMxD,iBAAiByD,oBAAmB;EAG9C,MAAMC,SAAqC;GACvCC,aAAaxC,KAAKqC;GAClB,GAAIrC,KAAKyC,QAAQ,EAAEA,OAAOzC,KAAKyC,MAAM,IAAI,CAAC;EAC9C;EAEA,IAAI,CAACxC,UACD,MAAMjB,mBAAmB0D,gBAAe;EAY5C,IACI1C,KAAKsB,YACLrB,SAASD,KAAKsB,aAAatB,KAAKsB,UAEhC,MAAMxC,yBAAyB6D,cAAa;EAOhD,MAAMC,aAAaC,KAAKC,MAAMC,KAAKC,IAAG,IAAK,GAAA;EAC3C,IAAIC,WAAWL;EACf,IAAIM,UAA2B;EAC/B,IAAIhD,QAAQiD,WAAW;GACnBD,UAAU,MAAM,KAAK3D,eAAe6D,YAAYlD,QAAQiD,SAAS;GACjE,IAAID,WAAWA,QAAQG,YACnBJ,WAAWJ,KAAKC,MAAM,IAAIC,KAAKG,QAAQG,UAAU,CAAA,CAAEC,QAAO,IAAK,GAAA;EAEvE;EAQA,IAAI,KAAK1D,wBAAwBK,SAASiB,SAAS9C,aAAamF,MAAM;GAGlE,MAAMC,YAAY,MAAM,KAAK5D,qBAAqB4D,UAC9CvD,SAASD,KAAKc,IACd,EAAE2C,eAAe,MAAM,CAAA;GAE3B,IAAID,UAAUE,YAAY,CAACR,SAASS,QAChC,MAAM5E,uBAAuB6E,kBAAiB;GAGlD,IAAIJ,UAAUK,oBACV,MAAM9E,uBAAuB8E,mBAAkB;GAUnD,IAAIL,UAAUE,YAAY1D,KAAK8D;QACT9D,KAAK8D,WAAW9B,MAAM,GACpC+B,CAAAA,CAAU3B,SAAS1D,iCAAiCsF,GAAG,GAAG;KAC1D,MAAMC,eAAef,SAASS,SAC1Bd,KAAKC,MAAM,IAAIC,KAAKG,QAAQS,MAAM,CAAA,CAAEL,QAAO,IAAK,GAAA,IAChD;KACJ,IAAIW,iBAAiB,QAAQrB,aAAaqB,eAAe,KAAKtE,oBAC1D,MAAMZ,uBAAuBmF,eAAc;IAEnD;;EAER;EAMA,KADgBlE,KAAKoE,SAASpE,KAAKoE,OAAOpC,MAAM,GAAA,IAAO,CAAA,EAAA,CAE3CI,SAASzD,0BAA0B0F,KAAK,KAChDzB,aAAaK,WAAW,KAAKvD,mBAE7B,MAAMZ,yBAAyBwF,yBAAwB;EAG3D,IACI,OAAOtE,KAAKuE,YAAY,eACxBvE,KAAKuE,YAAY,MACnB;GACE,MAAMC,SAASC,OAAOzE,KAAKuE,OAAO;GAClC,IACIE,OAAOC,SAASF,MAAAA,KAChB5B,aAAaK,WAAWuB,QAExB,MAAM1F,yBAAyBwF,yBAAwB;EAE/D;EAQA,IAAIpE,QAAQW,QAAQ8D,kBAAkB;GAClC,IAAIC,UAAU;GAEd,MAAMC,UAAU3F,qBAAqBe,QAAAA;GACrC,IAAI,KAAKJ,yBAAyBgF,SAC9BD,UAAU,MAAM,KAAK/E,sBAAsBiF,SACvC5E,QAAQW,OAAO8D,kBACfE,OAAAA;GAIR,IAAI,CAACD,SACD,MAAMnG,wBAAwBsG,UAC1B7E,QAAQ8E,uBAAuBhF,KAAKqC,eAChC;IAAEG,aAAaxC,KAAKqC;IAAcI,OAAOzC,KAAKyC,SAAS;GAAK,IAC5DwC,KAAAA,CAAAA;EAGhB;EAeA1C,OAAO+C,qBAAoBJ,MAVwB,KAAK5F,WAAW6F,MAC/DnF,MACAC,UACA;GACIkD,WAAWjD,QAAQiD;GACnBF;GACAmC,YAAYlC,SAASmC,eAAe;EACxC,CAAA,EAAA,CAGkCvE;EAEtC,OAAOyB;CACX;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["EventName","EventRefType","EventScope","IdentityType","hasInstanceof","OAUTH2_ACCESS_DENIED_ERROR_INSTANCE","OAUTH2_LOGIN_REQUIRED_ERROR_INSTANCE","OAUTH2_MFA_REQUIRED_ERROR_INSTANCE","OAuth2AccessDeniedError","OAuth2AuthenticationContextClass","OAuth2AuthorizationPrompt","OAuth2AuthorizationResponseType","OAuth2GrantError","OAuth2LoginRequiredError","OAuth2MfaRequiredError","OAuth2RequestError","OAuth2ResponseTypeError","toIdentityPolicyData","DEFAULT_PROMPT_LOGIN_MAX_AGE","DEFAULT_MFA_FRESHNESS_MAX_AGE","OAuth2Authorization","codeIssuer","sessionManager","eventService","metrics","promptLoginMaxAge","mfaFreshnessMaxAge","mfaChallengeProvider","accessPolicyEvaluator","ctx","authorize","data","identity","options","result","authorizeInner","record","scope","OAUTH2","name","AUTHORIZE","refType","CLIENT","refId","client","id","client_id","clientId","actorType","type","actorId","actorName","realmId","realm_id","reason","builtIn","recordAuthorize","e","AUTHORIZE_FAILED","responseTypes","response_type","Array","isArray","split","responseType","CODE","unsupported","includes","redirect_uri","redirectUriMismatch","output","redirectUri","state","identityInvalid","realmMismatch","nowSeconds","Math","floor","Date","now","authTime","session","sessionId","findOneById","createdAt","getTime","USER","challenge","issueMaterial","required","mfaAt","challengeRequired","enrollmentRequired","acr_values","acrValues","MFA","mfaAtSeconds","stepUpRequired","prompts","prompt","LOGIN","reauthenticationRequired","max_age","maxAge","Number","isFinite","accessPolicyId","allowed","subject","evaluate","forClient","redirectUriVerified","undefined","codeEntity","issue","authMethod","authorizationCode"],"sources":["../../../../src/core/oauth2/authorization/module.ts"],"sourcesContent":["/\n Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type {\n Identity, \n OAuth2AuthorizationCode, \n OAuth2AuthorizationCodeRequest, \n Session,\n} from '@authup/core-kit';\nimport {\n EventName, \n EventRefType, \n EventScope, \n IdentityType,\n} from '@authup/core-kit';\nimport { hasInstanceof } from '@authup/errors';\nimport {\n OAUTH2_ACCESS_DENIED_ERROR_INSTANCE,\n OAUTH2_LOGIN_REQUIRED_ERROR_INSTANCE,\n OAUTH2_MFA_REQUIRED_ERROR_INSTANCE,\n OAuth2AccessDeniedError,\n OAuth2AuthenticationContextClass,\n OAuth2AuthorizationPrompt,\n OAuth2AuthorizationResponseType,\n OAuth2GrantError,\n OAuth2LoginRequiredError,\n OAuth2MfaRequiredError,\n OAuth2RequestError,\n OAuth2ResponseTypeError,\n} from '@authup/specs';\nimport type { IOAuth2AuthorizationCodeIssuer } from './code/index.ts';\nimport type { IOAuth2AccessPolicyEvaluator } from '../access-policy/index.ts';\nimport { toIdentityPolicyData } from '../../identity/permission/identity-policy-data.ts';\nimport type {\n OAuth2AuthorizationManagerContext,\n OAuth2AuthorizationOptions,\n OAuth2AuthorizationResult,\n} from './types.ts';\nimport type { ISessionManager } from '../../authentication/index.ts';\nimport type { IEventService, IUserAuthenticatorChallengeProvider } from '../../entities/index.ts';\nimport type { IAuthFlowMetrics } from '../../metrics/index.ts';\n\nconst DEFAULT_PROMPT_LOGIN_MAX_AGE = 60;\n\n// Deliberately 60 (not 0, deviating from the plan-050 sketch): the hosted\n// challenge round-trip (stamp mfa_at → retry POST /authorize) takes seconds,\n// so a 0-window step-up could never be satisfied and would loop the ladder.\nconst DEFAULT_MFA_FRESHNESS_MAX_AGE = 60;\n\nexport class OAuth2Authorization {\n protected codeIssuer : IOAuth2AuthorizationCodeIssuer;\n\n protected sessionManager : ISessionManager;\n\n protected eventService? : IEventService;\n\n protected metrics? : IAuthFlowMetrics;\n\n protected promptLoginMaxAge : number;\n\n protected mfaFreshnessMaxAge : number;\n\n protected mfaChallengeProvider? : IUserAuthenticatorChallengeProvider;\n\n protected accessPolicyEvaluator? : IOAuth2AccessPolicyEvaluator;\n\n constructor(ctx: OAuth2AuthorizationManagerContext) {\n this.codeIssuer = ctx.codeIssuer;\n this.sessionManager = ctx.sessionManager;\n this.eventService = ctx.eventService;\n this.metrics = ctx.metrics;\n this.accessPolicyEvaluator = ctx.accessPolicyEvaluator;\n this.promptLoginMaxAge = ctx.promptLoginMaxAge ?? DEFAULT_PROMPT_LOGIN_MAX_AGE;\n this.mfaFreshnessMaxAge = ctx.mfaFreshnessMaxAge ?? DEFAULT_MFA_FRESHNESS_MAX_AGE;\n this.mfaChallengeProvider = ctx.mfaChallengeProvider;\n }\n\n /\n Authorize with validated codeRequest.\n \n @param data\n * @param identity\n * @param options\n */\n async authorize(\n data: OAuth2AuthorizationCodeRequest,\n identity: Identity,\n options: OAuth2AuthorizationOptions = {},\n ) : Promise<OAuth2AuthorizationResult> {\n try {\n const result = await this.authorizeInner(data, identity, options);\n\n await this.eventService?.record({\n scope: EventScope.OAUTH2,\n name: EventName.AUTHORIZE,\n refType: EventRefType.CLIENT,\n refId: options.client?.id ?? data.client_id ?? null,\n clientId: options.client?.id ?? data.client_id ?? null,\n actorType: identity.type,\n actorId: identity.data.id,\n actorName: identity.data.name,\n realmId: data.realm_id ?? null,\n data: {\n reason: options.client?.builtIn ? 'autoConsent' : 'consent',\n ...(data.scope ? { scope: data.scope } : {}),\n },\n });\n this.metrics?.recordAuthorize('issued');\n\n return result;\n } catch (e) {\n if (hasInstanceof(e, OAUTH2_ACCESS_DENIED_ERROR_INSTANCE)) {\n await this.eventService?.record({\n scope: EventScope.OAUTH2,\n name: EventName.AUTHORIZE_FAILED,\n refType: EventRefType.CLIENT,\n refId: options.client?.id ?? data.client_id ?? null,\n clientId: options.client?.id ?? data.client_id ?? null,\n actorType: identity.type,\n actorId: identity.data.id,\n actorName: identity.data.name,\n realmId: data.realm_id ?? null,\n data: { reason: 'accessPolicy' },\n });\n this.metrics?.recordAuthorize('denied');\n } else if (hasInstanceof(e, OAUTH2_LOGIN_REQUIRED_ERROR_INSTANCE)) {\n this.metrics?.recordAuthorize('login_required');\n } else if (hasInstanceof(e, OAUTH2_MFA_REQUIRED_ERROR_INSTANCE)) {\n this.metrics?.recordAuthorize('mfa_required');\n } else {\n this.metrics?.recordAuthorize('error');\n }\n\n throw e;\n }\n }\n\n protected async authorizeInner(\n data: OAuth2AuthorizationCodeRequest,\n identity: Identity,\n options: OAuth2AuthorizationOptions = {},\n ) : Promise<OAuth2AuthorizationResult> {\n // OAuth 2.1 posture: only the authorization-code response type is\n // supported — implicit/hybrid (token, id_token, none) were dropped\n // (plan 042 item 3). Defense in depth behind the request validator.\n let responseTypes : string[] = [];\n if (data.response_type) {\n responseTypes = Array.isArray(data.response_type) ?\n data.response_type :\n data.response_type.split(' ');\n }\n\n for (const responseType of responseTypes) {\n if (responseType !== OAuth2AuthorizationResponseType.CODE) {\n throw OAuth2ResponseTypeError.unsupported();\n }\n }\n\n if (!responseTypes.includes(OAuth2AuthorizationResponseType.CODE)) {\n throw OAuth2ResponseTypeError.unsupported();\n }\n\n if (!data.redirect_uri) {\n throw OAuth2GrantError.redirectUriMismatch();\n }\n\n const output : OAuth2AuthorizationResult = {\n redirectUri: data.redirect_uri,\n ...(data.state ? { state: data.state } : {}),\n };\n\n if (!identity) {\n throw OAuth2RequestError.identityInvalid();\n }\n\n // Realm binding: the code-request verifier stamped data.realm_id with the\n // resolved client's realm. The authenticated identity must belong to that\n // same realm — otherwise a lingering session for realm A could silently\n // mint a code/token for realm B's client (confused deputy). The error body\n // deliberately carries no identity data (no realm-enumeration oracle).\n // The comparison reads the scalar realmId column, NOT the realm\n // relation — the relation may simply not be loaded on the resolved\n // identity. An identity without a realmId fails closed the same way —\n // clean login_required, never a TypeError.\n if (\n data.realm_id &&\n identity.data.realmId !== data.realm_id\n ) {\n throw OAuth2LoginRequiredError.realmMismatch();\n }\n\n // Authentication time = the backing session's creation instant (NOT\n // refreshed_at — a token refresh must not reset it). Session-less flows\n // (e.g. HTTP Basic authorize) present live credentials on this request,\n // so the authentication time is \"now\".\n const nowSeconds = Math.floor(Date.now() / 1000);\n let authTime = nowSeconds;\n let session : Session \| null = null;\n if (options.sessionId) {\n session = await this.sessionManager.findOneById(options.sessionId);\n if (session && session.createdAt) {\n authTime = Math.floor(new Date(session.createdAt).getTime() / 1000);\n }\n }\n\n // MFA backstop (plan 049) — the authoritative server-side gate; the\n // hosted UI's challenge step is convenience. The proof is session-bound\n // (mfa_at — stamped by the challenge endpoint or the password grant's\n // otp param), so a session-less flow (HTTP Basic) cannot carry one and\n // fails closed while the user holds a confirmed device. A user without\n // a device under mfaRequired is routed to inline enrollment.\n if (this.mfaChallengeProvider && identity.type === IdentityType.USER) {\n // requirement flags only — the interactive challenge material (the\n // webauthn nonce) is issued by the status endpoint, not this backstop.\n const challenge = await this.mfaChallengeProvider.challenge(\n identity.data.id,\n { issueMaterial: false },\n );\n if (challenge.required && !session?.mfaAt) {\n throw OAuth2MfaRequiredError.challengeRequired();\n }\n\n if (challenge.enrollmentRequired) {\n throw OAuth2MfaRequiredError.enrollmentRequired();\n }\n\n // Step-up (plan 050 stage 3): a requested `acr_values` containing\n // urn:authup:mfa is a TRIGGER (Auth0/Keycloak stance) — the proof\n // must additionally be FRESH (mfaFreshnessMaxAge window, mirroring\n // promptLoginMaxAge's absorb-the-round-trip semantics). Enforced\n // only while the user actually holds a factor — per OIDC Core\n // §5.5.1.1 acr is voluntary, so an unsatisfiable request degrades\n // to the achieved acr instead of bricking the RP.\n if (challenge.required && data.acr_values) {\n const acrValues = data.acr_values.split(' ');\n if (acrValues.includes(OAuth2AuthenticationContextClass.MFA)) {\n const mfaAtSeconds = session?.mfaAt ?\n Math.floor(new Date(session.mfaAt).getTime() / 1000) :\n null;\n if (mfaAtSeconds === null \|\| nowSeconds - mfaAtSeconds > this.mfaFreshnessMaxAge) {\n throw OAuth2MfaRequiredError.stepUpRequired();\n }\n }\n }\n }\n\n // OIDC §3.1.2.1 prompt=login / max_age freshness (enforced only when\n // requested — a plain authorize never throws here). The hosted page\n // renders the login form for prompt=login; this is the server backstop.\n const prompts = data.prompt ? data.prompt.split(' ') : [];\n if (\n prompts.includes(OAuth2AuthorizationPrompt.LOGIN) &&\n nowSeconds - authTime > this.promptLoginMaxAge\n ) {\n throw OAuth2LoginRequiredError.reauthenticationRequired();\n }\n\n if (\n typeof data.max_age !== 'undefined' &&\n data.max_age !== null\n ) {\n const maxAge = Number(data.max_age);\n if (\n Number.isFinite(maxAge) &&\n nowSeconds - authTime > maxAge\n ) {\n throw OAuth2LoginRequiredError.reauthenticationRequired();\n }\n }\n\n // Application access policy (plan 052) — the last gate before\n // issuance: a denial is only revealed to a fully-authenticated\n // (incl. second-factor) identity. A client carrying a policy id with\n // no wired evaluator denies too (never silently allow a configured\n // gate). The redirect target rides the error only when the\n // redirect_uri was pattern-verified (RFC 6749 §4.1.2.1).\n if (options.client?.accessPolicyId) {\n let allowed = false;\n\n const subject = toIdentityPolicyData(identity);\n if (this.accessPolicyEvaluator && subject) {\n allowed = await this.accessPolicyEvaluator.evaluate(\n options.client.accessPolicyId,\n subject,\n );\n }\n\n if (!allowed) {\n throw OAuth2AccessDeniedError.forClient(\n options.redirectUriVerified && data.redirect_uri ?\n { redirectUri: data.redirect_uri, state: data.state ?? null } :\n undefined,\n );\n }\n }\n\n // The id_token is NOT minted here — the /token exchange mints it after\n // resolving the real backing session, so its `sid` is authoritative\n // (plan 042 item 6). The code carries the authentication instant.\n const codeEntity : OAuth2AuthorizationCode = await this.codeIssuer.issue(\n data,\n identity,\n {\n sessionId: options.sessionId,\n authTime,\n authMethod: session?.authMethod ?? null,\n },\n );\n\n output.authorizationCode = codeEntity.id;\n\n return output;\n }\n}\n"],"mappings":";;;;;;;;AA8CA,MAAMkB,+BAA+B;AAKrC,MAAMC,gCAAgC;AAEtC,IAAaC,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAwC;EAChD,KAAKR,aAAaQ,IAAIR;EACtB,KAAKC,iBAAiBO,IAAIP;EAC1B,KAAKC,eAAeM,IAAIN;EACxB,KAAKC,UAAUK,IAAIL;EACnB,KAAKI,wBAAwBC,IAAID;EACjC,KAAKH,oBAAoBI,IAAIJ,qBAAqBP;EAClD,KAAKQ,qBAAqBG,IAAIH,sBAAsBP;EACpD,KAAKQ,uBAAuBE,IAAIF;CACpC;;;;;;;IASA,MAAMG,UACFC,MACAC,UACAC,UAAsC,CAAC,GACJ;EACnC,IAAI;GACA,MAAMC,SAAS,MAAM,KAAKC,eAAeJ,MAAMC,UAAUC,OAAAA;GAEzD,MAAM,KAAKV,cAAca,OAAO;IAC5BC,OAAOnC,WAAWoC;IAClBC,MAAMvC,UAAUwC;IAChBC,SAASxC,aAAayC;IACtBC,OAAOV,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;IAC/CC,UAAUd,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;IAClDE,WAAWhB,SAASiB;IACpBC,SAASlB,SAASD,KAAKc;IACvBM,WAAWnB,SAASD,KAAKQ;IACzBa,SAASrB,KAAKsB,YAAY;IAC1BtB,MAAM;KACFuB,QAAQrB,QAAQW,QAAQW,UAAU,gBAAgB;KAClD,GAAIxB,KAAKM,QAAQ,EAAEA,OAAON,KAAKM,MAAM,IAAI,CAAC;IAC9C;GACJ,CAAA;GACA,KAAKb,SAASgC,gBAAgB,QAAA;GAE9B,OAAOtB;EACX,SAASuB,GAAG;GACR,IAAIrD,cAAcqD,GAAGpD,mCAAAA,GAAsC;IACvD,MAAM,KAAKkB,cAAca,OAAO;KAC5BC,OAAOnC,WAAWoC;KAClBC,MAAMvC,UAAU0D;KAChBjB,SAASxC,aAAayC;KACtBC,OAAOV,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;KAC/CC,UAAUd,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;KAClDE,WAAWhB,SAASiB;KACpBC,SAASlB,SAASD,KAAKc;KACvBM,WAAWnB,SAASD,KAAKQ;KACzBa,SAASrB,KAAKsB,YAAY;KAC1BtB,MAAM,EAAEuB,QAAQ,eAAe;IACnC,CAAA;IACA,KAAK9B,SAASgC,gBAAgB,QAAA;GAClC,OAAO,IAAIpD,cAAcqD,GAAGnD,oCAAAA,GACxB,KAAKkB,SAASgC,gBAAgB,gBAAA;QAC3B,IAAIpD,cAAcqD,GAAGlD,kCAAAA,GACxB,KAAKiB,SAASgC,gBAAgB,cAAA;QAE9B,KAAKhC,SAASgC,gBAAgB,OAAA;GAGlC,MAAMC;EACV;CACJ;CAEA,MAAgBtB,eACZJ,MACAC,UACAC,UAAsC,CAAC,GACJ;EAInC,IAAI0B,gBAA2B,CAAA;EAC/B,IAAI5B,KAAK6B,eACLD,gBAAgBE,MAAMC,QAAQ/B,KAAK6B,aAAa,IAC5C7B,KAAK6B,gBACL7B,KAAK6B,cAAcG,MAAM,GAAA;EAGjC,KAAK,MAAMC,gBAAgBL,eACvB,IAAIK,iBAAiBrD,gCAAgCsD,MACjD,MAAMjD,wBAAwBkD,YAAW;EAIjD,IAAI,CAACP,cAAcQ,SAASxD,gCAAgCsD,IAAI,GAC5D,MAAMjD,wBAAwBkD,YAAW;EAG7C,IAAI,CAACnC,KAAKqC,cACN,MAAMxD,iBAAiByD,oBAAmB;EAG9C,MAAMC,SAAqC;GACvCC,aAAaxC,KAAKqC;GAClB,GAAIrC,KAAKyC,QAAQ,EAAEA,OAAOzC,KAAKyC,MAAM,IAAI,CAAC;EAC9C;EAEA,IAAI,CAACxC,UACD,MAAMjB,mBAAmB0D,gBAAe;EAY5C,IACI1C,KAAKsB,YACLrB,SAASD,KAAKqB,YAAYrB,KAAKsB,UAE/B,MAAMxC,yBAAyB6D,cAAa;EAOhD,MAAMC,aAAaC,KAAKC,MAAMC,KAAKC,IAAG,IAAK,GAAA;EAC3C,IAAIC,WAAWL;EACf,IAAIM,UAA2B;EAC/B,IAAIhD,QAAQiD,WAAW;GACnBD,UAAU,MAAM,KAAK3D,eAAe6D,YAAYlD,QAAQiD,SAAS;GACjE,IAAID,WAAWA,QAAQG,WACnBJ,WAAWJ,KAAKC,MAAM,IAAIC,KAAKG,QAAQG,SAAS,CAAA,CAAEC,QAAO,IAAK,GAAA;EAEtE;EAQA,IAAI,KAAK1D,wBAAwBK,SAASiB,SAAS9C,aAAamF,MAAM;GAGlE,MAAMC,YAAY,MAAM,KAAK5D,qBAAqB4D,UAC9CvD,SAASD,KAAKc,IACd,EAAE2C,eAAe,MAAM,CAAA;GAE3B,IAAID,UAAUE,YAAY,CAACR,SAASS,OAChC,MAAM5E,uBAAuB6E,kBAAiB;GAGlD,IAAIJ,UAAUK,oBACV,MAAM9E,uBAAuB8E,mBAAkB;GAUnD,IAAIL,UAAUE,YAAY1D,KAAK8D,YACT9D;QAAAA,KAAK8D,WAAW9B,MAAM,GACpC+B,CAAAA,CAAU3B,SAAS1D,iCAAiCsF,GAAG,GAAG;KAC1D,MAAMC,eAAef,SAASS,QAC1Bd,KAAKC,MAAM,IAAIC,KAAKG,QAAQS,KAAK,CAAA,CAAEL,QAAO,IAAK,GAAA,IAC/C;KACJ,IAAIW,iBAAiB,QAAQrB,aAAaqB,eAAe,KAAKtE,oBAC1D,MAAMZ,uBAAuBmF,eAAc;IAEnD;;EAER;EAMA,KADgBlE,KAAKoE,SAASpE,KAAKoE,OAAOpC,MAAM,GAAA,IAAO,CAAA,EAAA,CAE3CI,SAASzD,0BAA0B0F,KAAK,KAChDzB,aAAaK,WAAW,KAAKvD,mBAE7B,MAAMZ,yBAAyBwF,yBAAwB;EAG3D,IACI,OAAOtE,KAAKuE,YAAY,eACxBvE,KAAKuE,YAAY,MACnB;GACE,MAAMC,SAASC,OAAOzE,KAAKuE,OAAO;GAClC,IACIE,OAAOC,SAASF,MAAAA,KAChB5B,aAAaK,WAAWuB,QAExB,MAAM1F,yBAAyBwF,yBAAwB;EAE/D;EAQA,IAAIpE,QAAQW,QAAQ8D,gBAAgB;GAChC,IAAIC,UAAU;GAEd,MAAMC,UAAU3F,qBAAqBe,QAAAA;GACrC,IAAI,KAAKJ,yBAAyBgF,SAC9BD,UAAU,MAAM,KAAK/E,sBAAsBiF,SACvC5E,QAAQW,OAAO8D,gBACfE,OAAAA;GAIR,IAAI,CAACD,SACD,MAAMnG,wBAAwBsG,UAC1B7E,QAAQ8E,uBAAuBhF,KAAKqC,eAChC;IAAEG,aAAaxC,KAAKqC;IAAcI,OAAOzC,KAAKyC,SAAS;GAAK,IAC5DwC,KAAAA,CAAAA;EAGhB;EAeA1C,OAAO8C,qBAAoBH,MAVwB,KAAK5F,WAAW6F,MAC/DnF,MACAC,UACA;GACIkD,WAAWjD,QAAQiD;GACnBF;GACAmC,YAAYlC,SAASkC,cAAc;EACvC,CAAA,EAAA,CAGkCtE;EAEtC,OAAOyB;CACX;AACJ"}

package/dist/core/oauth2/client/authenticator.d.ts CHANGED Viewed

@@ -20,7 +20,7 @@ export declare class OAuth2ClientAuthenticator {
     constructor(ctx: IIdentityResolver | OAuth2ClientAuthenticatorContext);
     authenticate(clientId: string | undefined, clientSecret?: string, realmId?: string, certificateEvidence?: ClientCertificateEvidence): Promise<Client>;
     resolve(clientId: string, realmId?: string): Promise<Client>;
-    resolveTokenBinding(client: Pick<Client, 'token_binding_method'>, certificateEvidence?: ClientCertificateEvidence): OAuth2TokenConfirmation | undefined;
+    resolveTokenBinding(client: Pick<Client, 'tokenBindingMethod'>, certificateEvidence?: ClientCertificateEvidence): OAuth2TokenConfirmation | undefined;
     validateCertificateEvidenceForBinding(certificateEvidence?: ClientCertificateEvidence): OAuth2TokenConfirmation;
 }
 //# sourceMappingURL=authenticator.d.ts.map

package/dist/core/oauth2/client/authenticator.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"authenticator.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/client/authenticator.ts"],"names":[],"mappings":"AAOA,OAAO,EACH,KAAK,MAAM,EAId,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAG7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,KAAK,EACR,yBAAyB,EACzB,2BAA2B,EAC9B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,MAAM,MAAM,gCAAgC,GAAG;IAC3C,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,oBAAoB,EAAE,2BAA2B,CAAC;CACrD,CAAC;AAEF;;;;;GAKG;AACH,qBAAa,yBAAyB;IAClC,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IAEvD,SAAS,CAAC,oBAAoB,CAAC,EAAE,2BAA2B,CAAC;gBAEjD,GAAG,EAAE,iBAAiB,GAAG,gCAAgC;IAY/D,YAAY,CACd,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,YAAY,CAAC,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE,MAAM,EAChB,mBAAmB,CAAC,EAAE,yBAAyB,GAChD,OAAO,CAAC,MAAM,CAAC;IAsDZ,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAalE,mBAAmB,CACf,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,~~sBAAsB~~,CAAC,~~EAC5C~~,mBAAmB,CAAC,EAAE,yBAAyB,GAChD,uBAAuB,GAAG,SAAS;IAYtC,qCAAqC,CACjC,mBAAmB,CAAC,EAAE,yBAAyB,GAChD,uBAAuB;CAa7B"}
1	+ {"version":3,"file":"authenticator.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/client/authenticator.ts"],"names":[],"mappings":"AAOA,OAAO,EACH,KAAK,MAAM,EAId,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAG7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,KAAK,EACR,yBAAyB,EACzB,2BAA2B,EAC9B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,MAAM,MAAM,gCAAgC,GAAG;IAC3C,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,oBAAoB,EAAE,2BAA2B,CAAC;CACrD,CAAC;AAEF;;;;;GAKG;AACH,qBAAa,yBAAyB;IAClC,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IAEvD,SAAS,CAAC,oBAAoB,CAAC,EAAE,2BAA2B,CAAC;gBAEjD,GAAG,EAAE,iBAAiB,GAAG,gCAAgC;IAY/D,YAAY,CACd,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,YAAY,CAAC,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE,MAAM,EAChB,mBAAmB,CAAC,EAAE,yBAAyB,GAChD,OAAO,CAAC,MAAM,CAAC;IAsDZ,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAalE,mBAAmB,CACf,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,oBAAoB,CAAC,EAC1C,mBAAmB,CAAC,EAAE,yBAAyB,GAChD,uBAAuB,GAAG,SAAS;IAYtC,qCAAqC,CACjC,mBAAmB,CAAC,EAAE,yBAAyB,GAChD,uBAAuB;CAa7B"}

package/dist/core/oauth2/client/authenticator.mjs CHANGED Viewed

@@ -26,7 +26,7 @@ import { OAuth2ClientError } from "@authup/specs";
 	async authenticate(clientId, clientSecret, realmId, certificateEvidence) {
 		if (!clientId) throw OAuth2ClientError.invalid();
 		const client = await this.resolve(clientId, realmId);
-		switch (client.auth_method) {
+		switch (client.authMethod) {
 			case ClientAuthMethod.NONE:
 				if (typeof clientSecret === "string") throw OAuth2ClientError.invalid();
 				break;
@@ -54,8 +54,8 @@ import { OAuth2ClientError } from "@authup/specs";
 		return identity.data;
 	}
 	resolveTokenBinding(client, certificateEvidence) {
-		if (client.token_binding_method === ClientTokenBindingMethod.NONE) return;
-		if (client.token_binding_method !== ClientTokenBindingMethod.TLS) throw OAuth2ClientError.invalid();
+		if (client.tokenBindingMethod === ClientTokenBindingMethod.NONE) return;
+		if (client.tokenBindingMethod !== ClientTokenBindingMethod.TLS) throw OAuth2ClientError.invalid();
 		return this.validateCertificateEvidenceForBinding(certificateEvidence);
 	}
 	validateCertificateEvidenceForBinding(certificateEvidence) {

package/dist/core/oauth2/client/authenticator.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"authenticator.mjs","names":["ClientAuthMethod","ClientTokenBindingMethod","IdentityType","OAuth2ClientError","isValidationError","ClientCredentialsService","OAuth2ClientAuthenticator","identityResolver","credentialsService","certificateValidator","ctx","authenticate","clientId","clientSecret","realmId","certificateEvidence","invalid","client","resolve","~~auth_method~~","NONE","SECRET","verified","verify","TLS","validateForAuthentication","e","identity","CLIENT","type","data","active","inactive","resolveTokenBinding","~~token_binding_method~~","undefined","validateCertificateEvidenceForBinding","validateForBinding","thumbprint"],"sources":["../../../../src/core/oauth2/client/authenticator.ts"],"sourcesContent":["/\n Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport {\n type Client,\n ClientAuthMethod,\n ClientTokenBindingMethod,\n IdentityType,\n} from '@authup/core-kit';\nimport type { OAuth2TokenConfirmation } from '@authup/specs';\nimport { OAuth2ClientError } from '@authup/specs';\nimport { isValidationError } from '@authup/errors';\nimport { ClientCredentialsService } from '../../authentication/credential/index.ts';\nimport type {\n ClientCertificateEvidence,\n IClientCertificateValidator,\n} from '../../client-certificate/index.ts';\nimport type { IIdentityResolver } from '../../identity/index.ts';\n\nexport type OAuth2ClientAuthenticatorContext = {\n identityResolver: IIdentityResolver,\n certificateValidator: IClientCertificateValidator,\n};\n\n/\n Authenticates a client at the OAuth2 token endpoint according to its\n * exclusive method: public id only, shared secret, or trusted TLS evidence.\n \n Used by every standard client-resolving grant.\n */\nexport class OAuth2ClientAuthenticator {\n protected identityResolver: IIdentityResolver;\n\n protected credentialsService: ClientCredentialsService;\n\n protected certificateValidator?: IClientCertificateValidator;\n\n constructor(ctx: IIdentityResolver \| OAuth2ClientAuthenticatorContext) {\n if ('identityResolver' in ctx) {\n this.identityResolver = ctx.identityResolver;\n this.certificateValidator = ctx.certificateValidator;\n } else {\n // Kept as a compatibility seam for focused secret/public-client\n // unit tests. Production wiring always supplies the validator.\n this.identityResolver = ctx;\n }\n this.credentialsService = new ClientCredentialsService();\n }\n\n async authenticate(\n clientId: string \| undefined,\n clientSecret?: string,\n realmId?: string,\n certificateEvidence?: ClientCertificateEvidence,\n ): Promise<Client> {\n if (!clientId) {\n throw OAuth2ClientError.invalid();\n }\n\n const client = await this.resolve(clientId, realmId);\n\n switch (client.~~auth_method~~) {\n case ClientAuthMethod.NONE:\n if (typeof clientSecret === 'string') {\n throw OAuth2ClientError.invalid();\n }\n break;\n case ClientAuthMethod.SECRET: {\n if (!clientSecret) {\n throw OAuth2ClientError.invalid();\n }\n\n const verified = await this.credentialsService.verify(clientSecret, client);\n if (!verified) {\n throw OAuth2ClientError.invalid();\n }\n break;\n }\n case ClientAuthMethod.TLS:\n if (\n typeof clientSecret === 'string' \|\|\n !certificateEvidence \|\|\n !this.certificateValidator\n ) {\n throw OAuth2ClientError.invalid();\n }\n\n try {\n await this.certificateValidator.validateForAuthentication(client, certificateEvidence);\n } catch (e) {\n // A validation failure deliberately reveals neither the\n // certificate identity nor which realm anchor failed. An\n // infrastructure fault (e.g. the trust-anchor store being\n // unreachable) must NOT masquerade as a bad certificate —\n // let it surface as a server error instead.\n if (isValidationError(e)) {\n throw OAuth2ClientError.invalid();\n }\n throw e;\n }\n break;\n default:\n throw OAuth2ClientError.invalid();\n }\n\n return client;\n }\n\n async resolve(clientId: string, realmId?: string): Promise<Client> {\n const identity = await this.identityResolver.resolve(IdentityType.CLIENT, clientId, realmId);\n if (!identity \|\| identity.type !== IdentityType.CLIENT) {\n throw OAuth2ClientError.invalid();\n }\n\n if (!identity.data.active) {\n throw OAuth2ClientError.inactive();\n }\n\n return identity.data;\n }\n\n resolveTokenBinding(\n client: Pick<Client, '~~token_binding_method~~'>,\n certificateEvidence?: ClientCertificateEvidence,\n ): OAuth2TokenConfirmation \| undefined {\n if (client.~~token_binding_method~~ === ClientTokenBindingMethod.NONE) {\n return undefined;\n }\n\n if (client.~~token_binding_method~~ !== ClientTokenBindingMethod.TLS) {\n throw OAuth2ClientError.invalid();\n }\n\n return this.validateCertificateEvidenceForBinding(certificateEvidence);\n }\n\n validateCertificateEvidenceForBinding(\n certificateEvidence?: ClientCertificateEvidence,\n ): OAuth2TokenConfirmation {\n if (!certificateEvidence \|\| !this.certificateValidator) {\n throw OAuth2ClientError.invalid();\n }\n\n try {\n this.certificateValidator.validateForBinding(certificateEvidence);\n } catch {\n throw OAuth2ClientError.invalid();\n }\n\n return { 'x5t#S256': certificateEvidence.thumbprint };\n }\n}\n"],"mappings":";;;;;;;;;;;;;;GAkCA,IAAaM,4BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA2D;EACnE,IAAI,sBAAsBA,KAAK;GAC3B,KAAKH,mBAAmBG,IAAIH;GAC5B,KAAKE,uBAAuBC,IAAID;EACpC,OAGI,KAAKF,mBAAmBG;EAE5B,KAAKF,qBAAqB,IAAIH,yBAAAA;CAClC;CAEA,MAAMM,aACFC,UACAC,cACAC,SACAC,qBACe;EACf,IAAI,CAACH,UACD,MAAMT,kBAAkBa,QAAO;EAGnC,MAAMC,SAAS,MAAM,KAAKC,QAAQN,UAAUE,OAAAA;EAE5C,QAAQG,OAAOE,~~aAAf~~;GACI,KAAKnB,iBAAiBoB;IAClB,IAAI,OAAOP,iBAAiB,UACxB,MAAMV,kBAAkBa,QAAO;IAEnC;GACJ,KAAKhB,iBAAiBqB;IAClB,IAAI,CAACR,cACD,MAAMV,kBAAkBa,QAAO;IAInC,IAAI,CAACM,MADkB,KAAKd,mBAAmBe,OAAOV,cAAcI,MAAAA,GAEhE,MAAMd,kBAAkBa,QAAO;IAEnC;GAEJ,KAAKhB,iBAAiBwB;IAClB,IACI,OAAOX,iBAAiB,YACxB,CAACE,uBACD,CAAC,KAAKN,sBAEN,MAAMN,kBAAkBa,QAAO;IAGnC,IAAI;KACA,MAAM,KAAKP,qBAAqBgB,0BAA0BR,QAAQF,mBAAAA;IACtE,SAASW,GAAG;KAMR,IAAItB,kBAAkBsB,CAAAA,GAClB,MAAMvB,kBAAkBa,QAAO;KAEnC,MAAMU;IACV;IACA;GACJ,SACI,MAAMvB,kBAAkBa,QAAO;EACvC;EAEA,OAAOC;CACX;CAEA,MAAMC,QAAQN,UAAkBE,SAAmC;EAC/D,MAAMa,WAAW,MAAM,KAAKpB,iBAAiBW,QAAQhB,aAAa0B,QAAQhB,UAAUE,OAAAA;EACpF,IAAI,CAACa,YAAYA,SAASE,SAAS3B,aAAa0B,QAC5C,MAAMzB,kBAAkBa,QAAO;EAGnC,IAAI,CAACW,SAASG,KAAKC,QACf,MAAM5B,kBAAkB6B,SAAQ;EAGpC,OAAOL,SAASG;CACpB;CAEAG,oBACIhB,QACAF,qBACmC;EACnC,IAAIE,OAAOiB,~~yBAAyBjC~~,yBAAyBmB,~~MACzD~~;EAGJ,IAAIH,OAAOiB,~~yBAAyBjC~~,yBAAyBuB,~~KACzD~~,MAAMrB,kBAAkBa,QAAO;EAGnC,OAAO,KAAKoB,sCAAsCrB,mBAAAA;CACtD;CAEAqB,sCACIrB,qBACuB;EACvB,IAAI,CAACA,uBAAuB,CAAC,KAAKN,sBAC9B,MAAMN,kBAAkBa,QAAO;EAGnC,IAAI;GACA,KAAKP,qBAAqB4B,mBAAmBtB,mBAAAA;EACjD,QAAQ;GACJ,MAAMZ,kBAAkBa,QAAO;EACnC;EAEA,OAAO,EAAE,YAAYD,oBAAoBuB,WAAW;CACxD;AACJ"}
1	+ {"version":3,"file":"authenticator.mjs","names":["ClientAuthMethod","ClientTokenBindingMethod","IdentityType","OAuth2ClientError","isValidationError","ClientCredentialsService","OAuth2ClientAuthenticator","identityResolver","credentialsService","certificateValidator","ctx","authenticate","clientId","clientSecret","realmId","certificateEvidence","invalid","client","resolve","authMethod","NONE","SECRET","verified","verify","TLS","validateForAuthentication","e","identity","CLIENT","type","data","active","inactive","resolveTokenBinding","tokenBindingMethod","undefined","validateCertificateEvidenceForBinding","validateForBinding","thumbprint"],"sources":["../../../../src/core/oauth2/client/authenticator.ts"],"sourcesContent":["/\n Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport {\n type Client,\n ClientAuthMethod,\n ClientTokenBindingMethod,\n IdentityType,\n} from '@authup/core-kit';\nimport type { OAuth2TokenConfirmation } from '@authup/specs';\nimport { OAuth2ClientError } from '@authup/specs';\nimport { isValidationError } from '@authup/errors';\nimport { ClientCredentialsService } from '../../authentication/credential/index.ts';\nimport type {\n ClientCertificateEvidence,\n IClientCertificateValidator,\n} from '../../client-certificate/index.ts';\nimport type { IIdentityResolver } from '../../identity/index.ts';\n\nexport type OAuth2ClientAuthenticatorContext = {\n identityResolver: IIdentityResolver,\n certificateValidator: IClientCertificateValidator,\n};\n\n/\n Authenticates a client at the OAuth2 token endpoint according to its\n * exclusive method: public id only, shared secret, or trusted TLS evidence.\n \n Used by every standard client-resolving grant.\n */\nexport class OAuth2ClientAuthenticator {\n protected identityResolver: IIdentityResolver;\n\n protected credentialsService: ClientCredentialsService;\n\n protected certificateValidator?: IClientCertificateValidator;\n\n constructor(ctx: IIdentityResolver \| OAuth2ClientAuthenticatorContext) {\n if ('identityResolver' in ctx) {\n this.identityResolver = ctx.identityResolver;\n this.certificateValidator = ctx.certificateValidator;\n } else {\n // Kept as a compatibility seam for focused secret/public-client\n // unit tests. Production wiring always supplies the validator.\n this.identityResolver = ctx;\n }\n this.credentialsService = new ClientCredentialsService();\n }\n\n async authenticate(\n clientId: string \| undefined,\n clientSecret?: string,\n realmId?: string,\n certificateEvidence?: ClientCertificateEvidence,\n ): Promise<Client> {\n if (!clientId) {\n throw OAuth2ClientError.invalid();\n }\n\n const client = await this.resolve(clientId, realmId);\n\n switch (client.authMethod) {\n case ClientAuthMethod.NONE:\n if (typeof clientSecret === 'string') {\n throw OAuth2ClientError.invalid();\n }\n break;\n case ClientAuthMethod.SECRET: {\n if (!clientSecret) {\n throw OAuth2ClientError.invalid();\n }\n\n const verified = await this.credentialsService.verify(clientSecret, client);\n if (!verified) {\n throw OAuth2ClientError.invalid();\n }\n break;\n }\n case ClientAuthMethod.TLS:\n if (\n typeof clientSecret === 'string' \|\|\n !certificateEvidence \|\|\n !this.certificateValidator\n ) {\n throw OAuth2ClientError.invalid();\n }\n\n try {\n await this.certificateValidator.validateForAuthentication(client, certificateEvidence);\n } catch (e) {\n // A validation failure deliberately reveals neither the\n // certificate identity nor which realm anchor failed. An\n // infrastructure fault (e.g. the trust-anchor store being\n // unreachable) must NOT masquerade as a bad certificate —\n // let it surface as a server error instead.\n if (isValidationError(e)) {\n throw OAuth2ClientError.invalid();\n }\n throw e;\n }\n break;\n default:\n throw OAuth2ClientError.invalid();\n }\n\n return client;\n }\n\n async resolve(clientId: string, realmId?: string): Promise<Client> {\n const identity = await this.identityResolver.resolve(IdentityType.CLIENT, clientId, realmId);\n if (!identity \|\| identity.type !== IdentityType.CLIENT) {\n throw OAuth2ClientError.invalid();\n }\n\n if (!identity.data.active) {\n throw OAuth2ClientError.inactive();\n }\n\n return identity.data;\n }\n\n resolveTokenBinding(\n client: Pick<Client, 'tokenBindingMethod'>,\n certificateEvidence?: ClientCertificateEvidence,\n ): OAuth2TokenConfirmation \| undefined {\n if (client.tokenBindingMethod === ClientTokenBindingMethod.NONE) {\n return undefined;\n }\n\n if (client.tokenBindingMethod !== ClientTokenBindingMethod.TLS) {\n throw OAuth2ClientError.invalid();\n }\n\n return this.validateCertificateEvidenceForBinding(certificateEvidence);\n }\n\n validateCertificateEvidenceForBinding(\n certificateEvidence?: ClientCertificateEvidence,\n ): OAuth2TokenConfirmation {\n if (!certificateEvidence \|\| !this.certificateValidator) {\n throw OAuth2ClientError.invalid();\n }\n\n try {\n this.certificateValidator.validateForBinding(certificateEvidence);\n } catch {\n throw OAuth2ClientError.invalid();\n }\n\n return { 'x5t#S256': certificateEvidence.thumbprint };\n }\n}\n"],"mappings":";;;;;;;;;;;;;;GAkCA,IAAaM,4BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA2D;EACnE,IAAI,sBAAsBA,KAAK;GAC3B,KAAKH,mBAAmBG,IAAIH;GAC5B,KAAKE,uBAAuBC,IAAID;EACpC,OAGI,KAAKF,mBAAmBG;EAE5B,KAAKF,qBAAqB,IAAIH,yBAAAA;CAClC;CAEA,MAAMM,aACFC,UACAC,cACAC,SACAC,qBACe;EACf,IAAI,CAACH,UACD,MAAMT,kBAAkBa,QAAO;EAGnC,MAAMC,SAAS,MAAM,KAAKC,QAAQN,UAAUE,OAAAA;EAE5C,QAAQG,OAAOE,YAAf;GACI,KAAKnB,iBAAiBoB;IAClB,IAAI,OAAOP,iBAAiB,UACxB,MAAMV,kBAAkBa,QAAO;IAEnC;GACJ,KAAKhB,iBAAiBqB;IAClB,IAAI,CAACR,cACD,MAAMV,kBAAkBa,QAAO;IAInC,IAAI,CAACM,MADkB,KAAKd,mBAAmBe,OAAOV,cAAcI,MAAAA,GAEhE,MAAMd,kBAAkBa,QAAO;IAEnC;GAEJ,KAAKhB,iBAAiBwB;IAClB,IACI,OAAOX,iBAAiB,YACxB,CAACE,uBACD,CAAC,KAAKN,sBAEN,MAAMN,kBAAkBa,QAAO;IAGnC,IAAI;KACA,MAAM,KAAKP,qBAAqBgB,0BAA0BR,QAAQF,mBAAAA;IACtE,SAASW,GAAG;KAMR,IAAItB,kBAAkBsB,CAAAA,GAClB,MAAMvB,kBAAkBa,QAAO;KAEnC,MAAMU;IACV;IACA;GACJ,SACI,MAAMvB,kBAAkBa,QAAO;EACvC;EAEA,OAAOC;CACX;CAEA,MAAMC,QAAQN,UAAkBE,SAAmC;EAC/D,MAAMa,WAAW,MAAM,KAAKpB,iBAAiBW,QAAQhB,aAAa0B,QAAQhB,UAAUE,OAAAA;EACpF,IAAI,CAACa,YAAYA,SAASE,SAAS3B,aAAa0B,QAC5C,MAAMzB,kBAAkBa,QAAO;EAGnC,IAAI,CAACW,SAASG,KAAKC,QACf,MAAM5B,kBAAkB6B,SAAQ;EAGpC,OAAOL,SAASG;CACpB;CAEAG,oBACIhB,QACAF,qBACmC;EACnC,IAAIE,OAAOiB,uBAAuBjC,yBAAyBmB,MACvD;EAGJ,IAAIH,OAAOiB,uBAAuBjC,yBAAyBuB,KACvD,MAAMrB,kBAAkBa,QAAO;EAGnC,OAAO,KAAKoB,sCAAsCrB,mBAAAA;CACtD;CAEAqB,sCACIrB,qBACuB;EACvB,IAAI,CAACA,uBAAuB,CAAC,KAAKN,sBAC9B,MAAMN,kBAAkBa,QAAO;EAGnC,IAAI;GACA,KAAKP,qBAAqB4B,mBAAmBtB,mBAAAA;EACjD,QAAQ;GACJ,MAAMZ,kBAAkBa,QAAO;EACnC;EAEA,OAAO,EAAE,YAAYD,oBAAoBuB,WAAW;CACxD;AACJ"}

package/dist/core/oauth2/client/grant-type.d.ts CHANGED Viewed

@@ -5,5 +5,5 @@ import type { Client } from '@authup/core-kit';
  * enforcement is opt-in per client; unknown values in the list are
  * inert — they can only narrow, never widen.
  */
-export declare function assertClientGrantAllowed(client: Pick<Client, 'grant_types'>, grantType: string): void;
+export declare function assertClientGrantAllowed(client: Pick<Client, 'grantTypes'>, grantType: string): void;
 //# sourceMappingURL=grant-type.d.ts.map

package/dist/core/oauth2/client/grant-type.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"grant-type.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/client/grant-type.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAG/C;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,~~aAAa~~,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,~~CASrG~~"}
1	+ {"version":3,"file":"grant-type.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/client/grant-type.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAG/C;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CASpG"}

package/dist/core/oauth2/client/grant-type.mjs CHANGED Viewed

@@ -9,8 +9,8 @@ import { OAuth2ClientUnauthorizedError } from "@authup/specs";
 * enforcement is opt-in per client; unknown values in the list are
 * inert — they can only narrow, never widen.
 */ function assertClientGrantAllowed(client, grantType) {
-	if (!client.grant_types) return;
-	if (!client.grant_types.split(/[\s,]+/).includes(grantType)) throw OAuth2ClientUnauthorizedError.grantType(grantType);
+	if (!client.grantTypes) return;
+	if (!client.grantTypes.split(/[\s,]+/).includes(grantType)) throw OAuth2ClientUnauthorizedError.grantType(grantType);
 }
 //#endregion
 export { assertClientGrantAllowed };

package/dist/core/oauth2/client/grant-type.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"grant-type.mjs","names":["OAuth2ClientUnauthorizedError","assertClientGrantAllowed","client","grantType","~~grant_types~~","allowed","split","includes"],"sources":["../../../../src/core/oauth2/client/grant-type.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { Client } from '@authup/core-kit';\nimport { OAuth2ClientUnauthorizedError } from '@authup/specs';\n\n/\n Enforce the client's grant_types allowlist (RFC 6749 §5.2\n * unauthorized_client). A null/empty column means allow-all, so\n * enforcement is opt-in per client; unknown values in the list are\n * inert — they can only narrow, never widen.\n */\nexport function assertClientGrantAllowed(client: Pick<Client, '~~grant_types~~'>, grantType: string): void {\n if (!client.~~grant_types~~) {\n return;\n }\n\n const allowed = client.~~grant_types~~.split(/[\\s,]+/);\n if (!allowed.includes(grantType)) {\n throw OAuth2ClientUnauthorizedError.grantType(grantType);\n }\n}\n"],"mappings":";;;;;;;;;;GAgBA,SAAgBC,yBAAyBC,~~QAAqCC~~,WAAiB;~~CAC3F~~,IAAI,CAACD,OAAOE,~~aACR~~;CAIJ,IAAI,CADYF,OAAOE,~~YAAYE~~,MAAM,~~QACpCD~~,CAAAA,CAAQE,SAASJ,SAAAA,GAClB,MAAMH,8BAA8BG,UAAUA,SAAAA;AAEtD"}
1	+ {"version":3,"file":"grant-type.mjs","names":["OAuth2ClientUnauthorizedError","assertClientGrantAllowed","client","grantType","grantTypes","allowed","split","includes"],"sources":["../../../../src/core/oauth2/client/grant-type.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { Client } from '@authup/core-kit';\nimport { OAuth2ClientUnauthorizedError } from '@authup/specs';\n\n/\n Enforce the client's grant_types allowlist (RFC 6749 §5.2\n * unauthorized_client). A null/empty column means allow-all, so\n * enforcement is opt-in per client; unknown values in the list are\n * inert — they can only narrow, never widen.\n */\nexport function assertClientGrantAllowed(client: Pick<Client, 'grantTypes'>, grantType: string): void {\n if (!client.grantTypes) {\n return;\n }\n\n const allowed = client.grantTypes.split(/[\\s,]+/);\n if (!allowed.includes(grantType)) {\n throw OAuth2ClientUnauthorizedError.grantType(grantType);\n }\n}\n"],"mappings":";;;;;;;;;;GAgBA,SAAgBC,yBAAyBC,QAAoCC,WAAiB;CAC1F,IAAI,CAACD,OAAOE,YACR;CAIJ,IAAI,CADYF,OAAOE,WAAWE,MAAM,QACnCD,CAAAA,CAAQE,SAASJ,SAAAA,GAClB,MAAMH,8BAA8BG,UAAUA,SAAAA;AAEtD"}

package/dist/core/oauth2/end-session/service.mjs CHANGED Viewed

@@ -64,7 +64,7 @@ var OAuth2EndSessionService = class {
 		let redirectUri;
 		if (client) {
 			clientName = client.name;
-			if (data.post_logout_redirect_uri && this.isValidPostLogoutRedirect(client.post_logout_redirect_uri, data.post_logout_redirect_uri)) redirectUri = data.post_logout_redirect_uri;
+			if (data.post_logout_redirect_uri && this.isValidPostLogoutRedirect(client.postLogoutRedirectUri, data.post_logout_redirect_uri)) redirectUri = data.post_logout_redirect_uri;
 		}
 		return {
 			hintVerified,
@@ -84,17 +84,17 @@ var OAuth2EndSessionService = class {
 	async revoke(sessionId, sub, subKind) {
 		const session = await this.sessionManager.findOneById(sessionId);
 		if (!session) return false;
-		if (session.sub !== sub || session.sub_kind !== subKind) return false;
+		if (session.sub !== sub || session.subKind !== subKind) return false;
 		await this.sessionManager.revoke(sessionId);
 		await this.eventService?.record({
 			scope: EventScope.OAUTH2,
 			name: EventName.LOGOUT,
 			refType: EventRefType.SESSION,
 			refId: sessionId,
-			actorType: session.sub_kind,
+			actorType: session.subKind,
 			actorId: session.sub,
-			realmId: session.realm_id,
-			data: { revoked_session_id: sessionId }
+			realmId: session.realmId,
+			data: { revokedSessionId: sessionId }
 		});
 		return true;
 	}

package/dist/core/oauth2/end-session/service.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.mjs","names":["isSimpleMatch","isUUID","EventName","EventRefType","EventScope","OAuth2TokenKind","OAuth2EndSessionService","tokenVerifier","sessionManager","clientRepository","realmRepository","eventService","hintGracePeriod","ctx","verify","data","hintVerified","sub","subKind","sessionId","hintRealmId","audiences","id_token_hint","payload","ignoreExpiry","skipActiveCheck","kind","ID_TOKEN","isWithinHintGraceWindow","sub_kind","sid","session_id","undefined","realm_id","aud","Array","isArray","filter","entry","clientId","client_id","length","client","realmKey","realm_name","realm","resolve","findOneByIdOrName","id","expected","includes","clientName","redirectUri","name","post_logout_redirect_uri","isValidPostLogoutRedirect","state","revoke","session","findOneById","record","scope","OAUTH2","LOGOUT","refType","SESSION","refId","actorType","actorId","realmId","revoked_session_id","exp","nowSeconds","Math","floor","Date","now","registered","candidate","parsed","URL","protocol","split"],"sources":["../../../../src/core/oauth2/end-session/service.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { isSimpleMatch, isUUID } from '@authup/kit';\nimport type { Client, IdentityType } from '@authup/core-kit';\nimport { EventName, EventRefType, EventScope } from '@authup/core-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IEventService, IRealmRepository } from '../../entities/index.ts';\nimport type { ISessionManager } from '../../authentication/index.ts';\nimport type { IOAuth2ClientRepository } from '../client/index.ts';\nimport type { IOAuth2TokenVerifier } from '../token/index.ts';\nimport type {\n IOAuth2EndSessionService,\n OAuth2EndSessionRequest,\n OAuth2EndSessionResult,\n OAuth2EndSessionServiceContext,\n} from './types.ts';\n\nexport class OAuth2EndSessionService implements IOAuth2EndSessionService {\n protected tokenVerifier: IOAuth2TokenVerifier;\n\n protected sessionManager: ISessionManager;\n\n protected clientRepository: IOAuth2ClientRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected eventService?: IEventService;\n\n protected hintGracePeriod: number;\n\n constructor(ctx: OAuth2EndSessionServiceContext) {\n this.tokenVerifier = ctx.tokenVerifier;\n this.sessionManager = ctx.sessionManager;\n this.clientRepository = ctx.clientRepository;\n this.realmRepository = ctx.realmRepository;\n this.eventService = ctx.eventService;\n this.hintGracePeriod = ctx.hintGracePeriod ?? 0;\n }\n\n async verify(data: OAuth2EndSessionRequest): Promise<OAuth2EndSessionResult> {\n let hintVerified = false;\n let sub: string \| undefined;\n let subKind: string \| undefined;\n let sessionId: string \| undefined;\n let hintRealmId: string \| undefined;\n let audiences: string[] = [];\n\n if (data.id_token_hint) {\n try {\n // Signature + kind are the anchors; exp is skipped (a logout hint\n // is routinely expired) and the cache blocklist is irrelevant.\n const payload = await this.tokenVerifier.verify(data.id_token_hint, {\n ignoreExpiry: true,\n skipActiveCheck: true,\n });\n\n // MUST be an id_token — access/refresh tokens also carry\n // session_id, so accepting them would let a leaked access token\n // act as a logout weapon.\n if (payload.kind === OAuth2TokenKind.ID_TOKEN && this.isWithinHintGraceWindow(payload)) {\n hintVerified = true;\n sub = payload.sub;\n subKind = payload.sub_kind;\n sessionId = payload.sid ?? payload.session_id ?? undefined;\n hintRealmId = payload.realm_id ?? undefined;\n // aud may be a single string or an array (JWT spec).\n const { aud } = payload;\n if (Array.isArray(aud)) {\n audiences = aud.filter((entry): entry is string => typeof entry === 'string');\n } else if (typeof aud === 'string') {\n audiences = [aud];\n }\n }\n } catch {\n // forged / unverifiable hint → stays unverified (no revoke)\n }\n }\n\n // Resolve a single client for the aud cross-check and redirect\n // validation: the request's client_id, else the hint's sole audience\n // (ambiguous for a multi-aud hint).\n const clientId = data.client_id ?? (audiences.length === 1 ? audiences[0] : undefined);\n\n let client: Client \| null = null;\n if (clientId) {\n // Scope a name-identified client to the request's realm hint; a\n // VERIFIED hint's own realm claim serves as fallback (claims from an\n // unverified hint are never trusted). No master fallback here\n // (unlike /token): a bogus hint must NOT silently resolve a\n // same-named client in master → null realm.\n const realmKey = data.realm_id ?? data.realm_name ?? (hintVerified ? hintRealmId : undefined);\n const realm = await this.realmRepository.resolve(realmKey, false);\n\n // Fail closed instead of dropping the realm predicate: a supplied\n // realm key that does not resolve never degrades to an unscoped\n // lookup, and a NAME-form client_id without any realm key is\n // ambiguous (every realm has a built-in `web` client — same rule as\n // the /authorize verifier). A UUID is globally unique and needs no\n // scope; the sole-aud-derived clientId is always a UUID.\n if (realm) {\n client = await this.clientRepository.findOneByIdOrName(clientId, realm.id);\n } else if (!realmKey && isUUID(clientId)) {\n client = await this.clientRepository.findOneByIdOrName(clientId);\n }\n }\n\n // aud/client_id cross-check: when the request supplies a client_id on a\n // verified hint, it MUST denote one of the hint's audiences. The aud is\n // the client UUID, so a name-form client_id is compared via its resolved\n // client's id. Fail closed: an aud-less hint, or a name that did not\n // resolve, counts as unverified.\n if (hintVerified && data.client_id) {\n const expected = isUUID(data.client_id) ? data.client_id : client?.id;\n if (audiences.length === 0 \|\| !expected \|\| !audiences.includes(expected)) {\n hintVerified = false;\n sub = undefined;\n subKind = undefined;\n sessionId = undefined;\n }\n }\n\n let clientName: string \| undefined;\n let redirectUri: string \| undefined;\n\n // Redirect validation is independent of hint verification — the\n // click-gated confirm page (unverified hint / hint-less request) still\n // honors a registered post-logout redirect.\n if (client) {\n clientName = client.name;\n if (\n data.post_logout_redirect_uri &&\n this.isValidPostLogoutRedirect(client.post_logout_redirect_uri, data.post_logout_redirect_uri)\n ) {\n redirectUri = data.post_logout_redirect_uri;\n }\n }\n\n return {\n hintVerified,\n ...(hintVerified ? {\n sub,\n subKind,\n sessionId,\n } : {}),\n ...(clientId ? { clientId } : {}),\n ...(clientName ? { clientName } : {}),\n ...(redirectUri ? { redirectUri, ...(data.state ? { state: data.state } : {}) } : {}),\n };\n }\n\n async revoke(sessionId: string, sub: string, subKind: string): Promise<boolean> {\n const session = await this.sessionManager.findOneById(sessionId);\n if (!session) {\n return false;\n }\n\n // Never revoke a session that does not belong to the hint's subject.\n if (session.sub !== sub \|\| session.sub_kind !== subKind) {\n return false;\n }\n\n await this.sessionManager.revoke(sessionId);\n\n await this.eventService?.record({\n scope: EventScope.OAUTH2,\n name: EventName.LOGOUT,\n refType: EventRefType.SESSION,\n refId: sessionId,\n actorType: session.sub_kind as `${IdentityType}`,\n actorId: session.sub,\n realmId: session.realm_id,\n data: { revoked_session_id: sessionId },\n });\n\n return true;\n }\n\n /\n With a positive `hintGracePeriod`, an expired hint is honored only within\n * the window past `exp` — beyond it a leaked id_token stops being a\n * replayable remote logout (the hint counts as unverified; the click-gated\n * confirm page still works). 0 keeps spec/Keycloak parity: any expired hint.\n /\n protected isWithinHintGraceWindow(payload: OAuth2TokenPayload): boolean {\n if (this.hintGracePeriod <= 0) {\n return true;\n }\n\n // a bounded window without an exp claim to judge against fails closed\n if (typeof payload.exp !== 'number') {\n return false;\n }\n\n const nowSeconds = Math.floor(Date.now() / 1000);\n return nowSeconds - payload.exp <= this.hintGracePeriod;\n }\n\n /\n A post-logout redirect is honored only when it is an absolute http(s) URL\n * that matches a registered client redirect pattern (defense against open\n * redirects to attacker-controlled URLs).\n */\n protected isValidPostLogoutRedirect(\n registered: string \| null \| undefined,\n candidate: string,\n ): boolean {\n let parsed: URL;\n try {\n parsed = new URL(candidate);\n } catch {\n return false;\n }\n\n if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {\n return false;\n }\n\n if (!registered) {\n return false;\n }\n\n return isSimpleMatch(candidate, registered.split(','));\n }\n}\n"],"mappings":";;;;;;;AAuBA,IAAaM,0BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,KAAKN,gBAAgBM,IAAIN;EACzB,KAAKC,iBAAiBK,IAAIL;EAC1B,KAAKC,mBAAmBI,IAAIJ;EAC5B,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,eAAeE,IAAIF;EACxB,KAAKC,kBAAkBC,IAAID,mBAAmB;CAClD;CAEA,MAAME,OAAOC,MAAgE;EACzE,IAAIC,eAAe;EACnB,IAAIC;EACJ,IAAIC;EACJ,IAAIC;EACJ,IAAIC;EACJ,IAAIC,YAAsB,CAAA;EAE1B,IAAIN,KAAKO,eACL,IAAI;GAGA,MAAMC,UAAU,MAAM,KAAKhB,cAAcO,OAAOC,KAAKO,eAAe;IAChEE,cAAc;IACdC,iBAAiB;GACrB,CAAA;GAKA,IAAIF,QAAQG,SAASrB,gBAAgBsB,YAAY,KAAKC,wBAAwBL,OAAAA,GAAU;IACpFP,eAAe;IACfC,MAAMM,QAAQN;IACdC,UAAUK,QAAQM;IAClBV,YAAYI,QAAQO,OAAOP,QAAQQ,cAAcC,KAAAA;IACjDZ,cAAcG,QAAQU,YAAYD,KAAAA;IAElC,MAAM,EAAEE,QAAQX;IAChB,IAAIY,MAAMC,QAAQF,GAAAA,GACdb,YAAYa,IAAIG,QAAQC,UAA2B,OAAOA,UAAU,QAAA;SACjE,IAAI,OAAOJ,QAAQ,UACtBb,YAAY,CAACa,GAAAA;GAErB;EACJ,QAAQ,CAER;EAMJ,MAAMK,WAAWxB,KAAKyB,cAAcnB,UAAUoB,WAAW,IAAIpB,UAAU,KAAKW,KAAAA;EAE5E,IAAIU,SAAwB;EAC5B,IAAIH,UAAU;GAMV,MAAMI,WAAW5B,KAAKkB,YAAYlB,KAAK6B,eAAe5B,eAAeI,cAAcY,KAAAA;GACnF,MAAMa,QAAQ,MAAM,KAAKnC,gBAAgBoC,QAAQH,UAAU,KAAA;GAQ3D,IAAIE,OACAH,SAAS,MAAM,KAAKjC,iBAAiBsC,kBAAkBR,UAAUM,MAAMG,EAAE;QACtE,IAAI,CAACL,YAAY1C,OAAOsC,QAAAA,GAC3BG,SAAS,MAAM,KAAKjC,iBAAiBsC,kBAAkBR,QAAAA;EAE/D;EAOA,IAAIvB,gBAAgBD,KAAKyB,WAAW;GAChC,MAAMS,WAAWhD,OAAOc,KAAKyB,SAAS,IAAIzB,KAAKyB,YAAYE,QAAQM;GACnE,IAAI3B,UAAUoB,WAAW,KAAK,CAACQ,YAAY,CAAC5B,UAAU6B,SAASD,QAAAA,GAAW;IACtEjC,eAAe;IACfC,MAAMe,KAAAA;IACNd,UAAUc,KAAAA;IACVb,YAAYa,KAAAA;GAChB;EACJ;EAEA,IAAImB;EACJ,IAAIC;EAKJ,IAAIV,QAAQ;GACRS,aAAaT,OAAOW;GACpB,IACItC,KAAKuC,4BACL,KAAKC,0BAA0Bb,OAAOY,0BAA0BvC,KAAKuC,wBAAwB,GAE7FF,cAAcrC,KAAKuC;EAE3B;EAEA,OAAO;GACHtC;GACA,GAAIA,eAAe;IACfC;IACAC;IACAC;GACJ,IAAI,CAAC;GACL,GAAIoB,WAAW,EAAEA,SAAS,IAAI,CAAC;GAC/B,GAAIY,aAAa,EAAEA,WAAW,IAAI,CAAC;GACnC,GAAIC,cAAc;IAAEA;IAAa,GAAIrC,KAAKyC,QAAQ,EAAEA,OAAOzC,KAAKyC,MAAM,IAAI,CAAC;GAAG,IAAI,CAAC;EACvF;CACJ;CAEA,MAAMC,OAAOtC,WAAmBF,KAAaC,SAAmC;EAC5E,MAAMwC,UAAU,MAAM,KAAKlD,eAAemD,YAAYxC,SAAAA;EACtD,IAAI,CAACuC,SACD,OAAO;EAIX,IAAIA,QAAQzC,QAAQA,OAAOyC,QAAQ7B,aAAaX,SAC5C,OAAO;EAGX,MAAM,KAAKV,eAAeiD,OAAOtC,SAAAA;EAEjC,MAAM,KAAKR,cAAciD,OAAO;GAC5BC,OAAOzD,WAAW0D;GAClBT,MAAMnD,UAAU6D;GAChBC,SAAS7D,aAAa8D;GACtBC,OAAO/C;GACPgD,WAAWT,QAAQ7B;GACnBuC,SAASV,QAAQzC;GACjBoD,SAASX,QAAQzB;GACjBlB,MAAM,EAAEuD,oBAAoBnD,UAAU;EAC1C,CAAA;EAEA,OAAO;CACX;;;;;;IAQA,wBAAkCI,SAAsC;EACpE,IAAI,KAAKX,mBAAmB,GACxB,OAAO;EAIX,IAAI,OAAOW,QAAQgD,QAAQ,UACvB,OAAO;EAIX,OADmBE,KAAKC,MAAMC,KAAKC,IAAG,IAAK,GACpCJ,IAAajD,QAAQgD,OAAO,KAAK3D;CAC5C;;;;;IAOA,0BACIiE,YACAC,WACO;EACP,IAAIC;EACJ,IAAI;GACAA,SAAS,IAAIC,IAAIF,SAAAA;EACrB,QAAQ;GACJ,OAAO;EACX;EAEA,IAAIC,OAAOE,aAAa,WAAWF,OAAOE,aAAa,UACnD,OAAO;EAGX,IAAI,CAACJ,YACD,OAAO;EAGX,OAAO7E,cAAc8E,WAAWD,WAAWK,MAAM,GAAA,CAAA;CACrD;AACJ"}
1	+ {"version":3,"file":"service.mjs","names":["isSimpleMatch","isUUID","EventName","EventRefType","EventScope","OAuth2TokenKind","OAuth2EndSessionService","tokenVerifier","sessionManager","clientRepository","realmRepository","eventService","hintGracePeriod","ctx","verify","data","hintVerified","sub","subKind","sessionId","hintRealmId","audiences","id_token_hint","payload","ignoreExpiry","skipActiveCheck","kind","ID_TOKEN","isWithinHintGraceWindow","sub_kind","sid","session_id","undefined","realm_id","aud","Array","isArray","filter","entry","clientId","client_id","length","client","realmKey","realm_name","realm","resolve","findOneByIdOrName","id","expected","includes","clientName","redirectUri","name","post_logout_redirect_uri","isValidPostLogoutRedirect","postLogoutRedirectUri","state","revoke","session","findOneById","record","scope","OAUTH2","LOGOUT","refType","SESSION","refId","actorType","actorId","realmId","revokedSessionId","exp","nowSeconds","Math","floor","Date","now","registered","candidate","parsed","URL","protocol","split"],"sources":["../../../../src/core/oauth2/end-session/service.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { isSimpleMatch, isUUID } from '@authup/kit';\nimport type { Client, IdentityType } from '@authup/core-kit';\nimport { EventName, EventRefType, EventScope } from '@authup/core-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IEventService, IRealmRepository } from '../../entities/index.ts';\nimport type { ISessionManager } from '../../authentication/index.ts';\nimport type { IOAuth2ClientRepository } from '../client/index.ts';\nimport type { IOAuth2TokenVerifier } from '../token/index.ts';\nimport type {\n IOAuth2EndSessionService,\n OAuth2EndSessionRequest,\n OAuth2EndSessionResult,\n OAuth2EndSessionServiceContext,\n} from './types.ts';\n\nexport class OAuth2EndSessionService implements IOAuth2EndSessionService {\n protected tokenVerifier: IOAuth2TokenVerifier;\n\n protected sessionManager: ISessionManager;\n\n protected clientRepository: IOAuth2ClientRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected eventService?: IEventService;\n\n protected hintGracePeriod: number;\n\n constructor(ctx: OAuth2EndSessionServiceContext) {\n this.tokenVerifier = ctx.tokenVerifier;\n this.sessionManager = ctx.sessionManager;\n this.clientRepository = ctx.clientRepository;\n this.realmRepository = ctx.realmRepository;\n this.eventService = ctx.eventService;\n this.hintGracePeriod = ctx.hintGracePeriod ?? 0;\n }\n\n async verify(data: OAuth2EndSessionRequest): Promise<OAuth2EndSessionResult> {\n let hintVerified = false;\n let sub: string \| undefined;\n let subKind: string \| undefined;\n let sessionId: string \| undefined;\n let hintRealmId: string \| undefined;\n let audiences: string[] = [];\n\n if (data.id_token_hint) {\n try {\n // Signature + kind are the anchors; exp is skipped (a logout hint\n // is routinely expired) and the cache blocklist is irrelevant.\n const payload = await this.tokenVerifier.verify(data.id_token_hint, {\n ignoreExpiry: true,\n skipActiveCheck: true,\n });\n\n // MUST be an id_token — access/refresh tokens also carry\n // session_id, so accepting them would let a leaked access token\n // act as a logout weapon.\n if (payload.kind === OAuth2TokenKind.ID_TOKEN && this.isWithinHintGraceWindow(payload)) {\n hintVerified = true;\n sub = payload.sub;\n subKind = payload.sub_kind;\n sessionId = payload.sid ?? payload.session_id ?? undefined;\n hintRealmId = payload.realm_id ?? undefined;\n // aud may be a single string or an array (JWT spec).\n const { aud } = payload;\n if (Array.isArray(aud)) {\n audiences = aud.filter((entry): entry is string => typeof entry === 'string');\n } else if (typeof aud === 'string') {\n audiences = [aud];\n }\n }\n } catch {\n // forged / unverifiable hint → stays unverified (no revoke)\n }\n }\n\n // Resolve a single client for the aud cross-check and redirect\n // validation: the request's client_id, else the hint's sole audience\n // (ambiguous for a multi-aud hint).\n const clientId = data.client_id ?? (audiences.length === 1 ? audiences[0] : undefined);\n\n let client: Client \| null = null;\n if (clientId) {\n // Scope a name-identified client to the request's realm hint; a\n // VERIFIED hint's own realm claim serves as fallback (claims from an\n // unverified hint are never trusted). No master fallback here\n // (unlike /token): a bogus hint must NOT silently resolve a\n // same-named client in master → null realm.\n const realmKey = data.realm_id ?? data.realm_name ?? (hintVerified ? hintRealmId : undefined);\n const realm = await this.realmRepository.resolve(realmKey, false);\n\n // Fail closed instead of dropping the realm predicate: a supplied\n // realm key that does not resolve never degrades to an unscoped\n // lookup, and a NAME-form client_id without any realm key is\n // ambiguous (every realm has a built-in `web` client — same rule as\n // the /authorize verifier). A UUID is globally unique and needs no\n // scope; the sole-aud-derived clientId is always a UUID.\n if (realm) {\n client = await this.clientRepository.findOneByIdOrName(clientId, realm.id);\n } else if (!realmKey && isUUID(clientId)) {\n client = await this.clientRepository.findOneByIdOrName(clientId);\n }\n }\n\n // aud/client_id cross-check: when the request supplies a client_id on a\n // verified hint, it MUST denote one of the hint's audiences. The aud is\n // the client UUID, so a name-form client_id is compared via its resolved\n // client's id. Fail closed: an aud-less hint, or a name that did not\n // resolve, counts as unverified.\n if (hintVerified && data.client_id) {\n const expected = isUUID(data.client_id) ? data.client_id : client?.id;\n if (audiences.length === 0 \|\| !expected \|\| !audiences.includes(expected)) {\n hintVerified = false;\n sub = undefined;\n subKind = undefined;\n sessionId = undefined;\n }\n }\n\n let clientName: string \| undefined;\n let redirectUri: string \| undefined;\n\n // Redirect validation is independent of hint verification — the\n // click-gated confirm page (unverified hint / hint-less request) still\n // honors a registered post-logout redirect.\n if (client) {\n clientName = client.name;\n if (\n data.post_logout_redirect_uri &&\n this.isValidPostLogoutRedirect(client.postLogoutRedirectUri, data.post_logout_redirect_uri)\n ) {\n redirectUri = data.post_logout_redirect_uri;\n }\n }\n\n return {\n hintVerified,\n ...(hintVerified ? {\n sub,\n subKind,\n sessionId,\n } : {}),\n ...(clientId ? { clientId } : {}),\n ...(clientName ? { clientName } : {}),\n ...(redirectUri ? { redirectUri, ...(data.state ? { state: data.state } : {}) } : {}),\n };\n }\n\n async revoke(sessionId: string, sub: string, subKind: string): Promise<boolean> {\n const session = await this.sessionManager.findOneById(sessionId);\n if (!session) {\n return false;\n }\n\n // Never revoke a session that does not belong to the hint's subject.\n if (session.sub !== sub \|\| session.subKind !== subKind) {\n return false;\n }\n\n await this.sessionManager.revoke(sessionId);\n\n await this.eventService?.record({\n scope: EventScope.OAUTH2,\n name: EventName.LOGOUT,\n refType: EventRefType.SESSION,\n refId: sessionId,\n actorType: session.subKind as `${IdentityType}`,\n actorId: session.sub,\n realmId: session.realmId,\n data: { revokedSessionId: sessionId },\n });\n\n return true;\n }\n\n /\n With a positive `hintGracePeriod`, an expired hint is honored only within\n * the window past `exp` — beyond it a leaked id_token stops being a\n * replayable remote logout (the hint counts as unverified; the click-gated\n * confirm page still works). 0 keeps spec/Keycloak parity: any expired hint.\n /\n protected isWithinHintGraceWindow(payload: OAuth2TokenPayload): boolean {\n if (this.hintGracePeriod <= 0) {\n return true;\n }\n\n // a bounded window without an exp claim to judge against fails closed\n if (typeof payload.exp !== 'number') {\n return false;\n }\n\n const nowSeconds = Math.floor(Date.now() / 1000);\n return nowSeconds - payload.exp <= this.hintGracePeriod;\n }\n\n /\n A post-logout redirect is honored only when it is an absolute http(s) URL\n * that matches a registered client redirect pattern (defense against open\n * redirects to attacker-controlled URLs).\n */\n protected isValidPostLogoutRedirect(\n registered: string \| null \| undefined,\n candidate: string,\n ): boolean {\n let parsed: URL;\n try {\n parsed = new URL(candidate);\n } catch {\n return false;\n }\n\n if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {\n return false;\n }\n\n if (!registered) {\n return false;\n }\n\n return isSimpleMatch(candidate, registered.split(','));\n }\n}\n"],"mappings":";;;;;;;AAuBA,IAAaM,0BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,KAAKN,gBAAgBM,IAAIN;EACzB,KAAKC,iBAAiBK,IAAIL;EAC1B,KAAKC,mBAAmBI,IAAIJ;EAC5B,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,eAAeE,IAAIF;EACxB,KAAKC,kBAAkBC,IAAID,mBAAmB;CAClD;CAEA,MAAME,OAAOC,MAAgE;EACzE,IAAIC,eAAe;EACnB,IAAIC;EACJ,IAAIC;EACJ,IAAIC;EACJ,IAAIC;EACJ,IAAIC,YAAsB,CAAA;EAE1B,IAAIN,KAAKO,eACL,IAAI;GAGA,MAAMC,UAAU,MAAM,KAAKhB,cAAcO,OAAOC,KAAKO,eAAe;IAChEE,cAAc;IACdC,iBAAiB;GACrB,CAAA;GAKA,IAAIF,QAAQG,SAASrB,gBAAgBsB,YAAY,KAAKC,wBAAwBL,OAAAA,GAAU;IACpFP,eAAe;IACfC,MAAMM,QAAQN;IACdC,UAAUK,QAAQM;IAClBV,YAAYI,QAAQO,OAAOP,QAAQQ,cAAcC,KAAAA;IACjDZ,cAAcG,QAAQU,YAAYD,KAAAA;IAElC,MAAM,EAAEE,QAAQX;IAChB,IAAIY,MAAMC,QAAQF,GAAAA,GACdb,YAAYa,IAAIG,QAAQC,UAA2B,OAAOA,UAAU,QAAA;SACjE,IAAI,OAAOJ,QAAQ,UACtBb,YAAY,CAACa,GAAI;GAEzB;EACJ,QAAQ,CAER;EAMJ,MAAMK,WAAWxB,KAAKyB,cAAcnB,UAAUoB,WAAW,IAAIpB,UAAU,KAAKW,KAAAA;EAE5E,IAAIU,SAAwB;EAC5B,IAAIH,UAAU;GAMV,MAAMI,WAAW5B,KAAKkB,YAAYlB,KAAK6B,eAAe5B,eAAeI,cAAcY,KAAAA;GACnF,MAAMa,QAAQ,MAAM,KAAKnC,gBAAgBoC,QAAQH,UAAU,KAAA;GAQ3D,IAAIE,OACAH,SAAS,MAAM,KAAKjC,iBAAiBsC,kBAAkBR,UAAUM,MAAMG,EAAE;QACtE,IAAI,CAACL,YAAY1C,OAAOsC,QAAAA,GAC3BG,SAAS,MAAM,KAAKjC,iBAAiBsC,kBAAkBR,QAAAA;EAE/D;EAOA,IAAIvB,gBAAgBD,KAAKyB,WAAW;GAChC,MAAMS,WAAWhD,OAAOc,KAAKyB,SAAS,IAAIzB,KAAKyB,YAAYE,QAAQM;GACnE,IAAI3B,UAAUoB,WAAW,KAAK,CAACQ,YAAY,CAAC5B,UAAU6B,SAASD,QAAAA,GAAW;IACtEjC,eAAe;IACfC,MAAMe,KAAAA;IACNd,UAAUc,KAAAA;IACVb,YAAYa,KAAAA;GAChB;EACJ;EAEA,IAAImB;EACJ,IAAIC;EAKJ,IAAIV,QAAQ;GACRS,aAAaT,OAAOW;GACpB,IACItC,KAAKuC,4BACL,KAAKC,0BAA0Bb,OAAOc,uBAAuBzC,KAAKuC,wBAAwB,GAE1FF,cAAcrC,KAAKuC;EAE3B;EAEA,OAAO;GACHtC;GACA,GAAIA,eAAe;IACfC;IACAC;IACAC;GACJ,IAAI,CAAC;GACL,GAAIoB,WAAW,EAAEA,SAAS,IAAI,CAAC;GAC/B,GAAIY,aAAa,EAAEA,WAAW,IAAI,CAAC;GACnC,GAAIC,cAAc;IAAEA;IAAa,GAAIrC,KAAK0C,QAAQ,EAAEA,OAAO1C,KAAK0C,MAAM,IAAI,CAAC;GAAG,IAAI,CAAC;EACvF;CACJ;CAEA,MAAMC,OAAOvC,WAAmBF,KAAaC,SAAmC;EAC5E,MAAMyC,UAAU,MAAM,KAAKnD,eAAeoD,YAAYzC,SAAAA;EACtD,IAAI,CAACwC,SACD,OAAO;EAIX,IAAIA,QAAQ1C,QAAQA,OAAO0C,QAAQzC,YAAYA,SAC3C,OAAO;EAGX,MAAM,KAAKV,eAAekD,OAAOvC,SAAAA;EAEjC,MAAM,KAAKR,cAAckD,OAAO;GAC5BC,OAAO1D,WAAW2D;GAClBV,MAAMnD,UAAU8D;GAChBC,SAAS9D,aAAa+D;GACtBC,OAAOhD;GACPiD,WAAWT,QAAQzC;GACnBmD,SAASV,QAAQ1C;GACjBqD,SAASX,QAAQW;GACjBvD,MAAM,EAAEwD,kBAAkBpD,UAAU;EACxC,CAAA;EAEA,OAAO;CACX;;;;;;IAQA,wBAAkCI,SAAsC;EACpE,IAAI,KAAKX,mBAAmB,GACxB,OAAO;EAIX,IAAI,OAAOW,QAAQiD,QAAQ,UACvB,OAAO;EAIX,OADmBE,KAAKC,MAAMC,KAAKC,IAAG,IAAK,GACpCJ,IAAalD,QAAQiD,OAAO,KAAK5D;CAC5C;;;;;IAOA,0BACIkE,YACAC,WACO;EACP,IAAIC;EACJ,IAAI;GACAA,SAAS,IAAIC,IAAIF,SAAAA;EACrB,QAAQ;GACJ,OAAO;EACX;EAEA,IAAIC,OAAOE,aAAa,WAAWF,OAAOE,aAAa,UACnD,OAAO;EAGX,IAAI,CAACJ,YACD,OAAO;EAGX,OAAO9E,cAAc+E,WAAWD,WAAWK,MAAM,GAAA,CAAA;CACrD;AACJ"}