@authup/server-core 1.0.0-beta.53 → 1.0.0-beta.55

package/dist/core/oauth2/mfa-login/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2GrantError","OAuth2SubKind","OAuth2TokenGrant","EventName","EventRefType","EventScope","IdentityType","ScopeName","SessionAuthMethod","deriveAmrAcr","buildOAuth2BearerTokenResponse","OAuth2MfaLoginService","sessionManager","ticketIssuer","accessTokenIssuer","refreshTokenIssuer","tokenRepository","eventService","metrics","ctx","issueTicket","input","options","user","clientId","undefined","expiresAt","buildExp","session","create","user_agent","userAgent","ip_address","ipAddress","realm_id","client_id","sub","id","sub_kind","USER","mfa_at","auth_method","PASSWORD","expires_at","Date","toISOString","token","payload","issue","session_id","remote_address","realm_name","realm","name","confirmation","cnf","exp","expiresIn","Math","floor","now","complete","ticket","refresh","amrAcr","jti","claimed","claimInactive","invalid","issuePayload","scope","GLOBAL","accessToken","accessTokenPayload","refreshToken","refreshTokenPayload","record","OAUTH2","LOGIN","refType","SESSION","refId","actorType","actorId","actorName","userName","realmId","requestIpAddress","requestUserAgent","data","grant_type","recordLogin"],"sources":["../../../../src/core/oauth2/mfa-login/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2GrantError, OAuth2SubKind, OAuth2TokenGrant } from '@authup/specs';\nimport {\n    EventName,\n    EventRefType,\n    EventScope,\n    IdentityType,\n    ScopeName,\n    SessionAuthMethod,\n} from '@authup/core-kit';\nimport type { IEventService } from '../../entities/index.ts';\nimport type { IAuthFlowMetrics } from '../../metrics/index.ts';\nimport type { ISessionManager } from '../../authentication/index.ts';\nimport { deriveAmrAcr } from '../authorization/helpers.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { IOAuth2TokenIssuer, IOAuth2TokenRepository } from '../token/index.ts';\nimport type {\n    IOAuth2MfaLoginService,\n    OAuth2MfaLoginCompleteInput,\n    OAuth2MfaLoginServiceContext,\n    OAuth2MfaLoginTicket,\n    OAuth2MfaLoginTicketIssueInput,\n    OAuth2MfaLoginTicketIssueOptions,\n} from './types.ts';\n\nexport class OAuth2MfaLoginService implements IOAuth2MfaLoginService {\n    protected sessionManager : ISessionManager;\n\n    protected ticketIssuer : IOAuth2TokenIssuer;\n\n    protected accessTokenIssuer : IOAuth2TokenIssuer;\n\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    protected tokenRepository : IOAuth2TokenRepository;\n\n    protected eventService? : IEventService;\n\n    protected metrics? : IAuthFlowMetrics;\n\n    constructor(ctx: OAuth2MfaLoginServiceContext) {\n        this.sessionManager = ctx.sessionManager;\n        this.ticketIssuer = ctx.ticketIssuer;\n        this.accessTokenIssuer = ctx.accessTokenIssuer;\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n        this.tokenRepository = ctx.tokenRepository;\n        this.eventService = ctx.eventService;\n        this.metrics = ctx.metrics;\n    }\n\n    async issueTicket(\n        input: OAuth2MfaLoginTicketIssueInput,\n        options: OAuth2MfaLoginTicketIssueOptions = {},\n    ) : Promise<OAuth2MfaLoginTicket> {\n        const { user } = input;\n        const clientId = input.clientId ?? undefined;\n\n        // One expiration instant for BOTH artifacts — the pending session\n        // lives exactly as long as the ticket (an abandoned login\n        // self-expires and is swept with the regular session sweep;\n        // completion extends it to the full lifetime). Computed once so\n        // the two cannot drift.\n        const expiresAt = this.ticketIssuer.buildExp();\n\n        const session = await this.sessionManager.create({\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: user.realm_id,\n            client_id: clientId,\n            sub: user.id,\n            sub_kind: IdentityType.USER,\n            mfa_at: null,\n            auth_method: SessionAuthMethod.PASSWORD,\n            expires_at: new Date(expiresAt * 1000).toISOString(),\n        });\n\n        // No scope, no role claims — the ticket is not a bearer; it only\n        // unlocks the challenge routes (which opt in by kind).\n        const [token, payload] = await this.ticketIssuer.issue({\n            client_id: clientId,\n            session_id: session.id,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            sub: user.id,\n            sub_kind: OAuth2SubKind.USER,\n            realm_id: user.realm_id,\n            realm_name: user.realm?.name,\n            ...(input.confirmation ? { cnf: input.confirmation } : {}),\n            exp: expiresAt,\n        });\n\n        return {\n            token,\n            expiresIn: payload.exp ?\n                payload.exp - Math.floor(Date.now() / 1000) :\n                0,\n        };\n    }\n\n    async complete(input: OAuth2MfaLoginCompleteInput) : Promise<OAuth2TokenGrantResponse> {\n        const { ticket } = input;\n\n        // Extend the ticket-scoped pending session to the regular session\n        // lifetime — the login is complete now.\n        const session = await this.sessionManager.refresh(input.session);\n\n        // mfa_at was stamped inside the verify unit of work, so the claims\n        // advertise the completed factor (amr +otp, acr urn:authup:mfa).\n        const amrAcr = deriveAmrAcr(session);\n\n        // Single use: atomically claim the ticket BEFORE minting so two\n        // concurrent completions (a mixed-kind user presenting two distinct\n        // fresh factors) cannot both issue a token pair — `claimInactive` is a\n        // set-if-absent write, so exactly one racer wins. The trade-off vs.\n        // claiming after minting is that a mint failure burns the ticket — the\n        // safer bias for a single-use login credential (the user re-authenticates).\n        if (ticket.jti) {\n            const claimed = await this.tokenRepository.claimInactive(ticket.jti, ticket.exp);\n            if (!claimed) {\n                throw OAuth2GrantError.invalid('mfa login ticket has already been used');\n            }\n        }\n\n        const issuePayload : Partial<OAuth2TokenPayload> = {\n            client_id: session.client_id ?? undefined,\n            session_id: session.id,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            scope: ScopeName.GLOBAL,\n            sub: session.sub,\n            sub_kind: OAuth2SubKind.USER,\n            realm_id: session.realm_id,\n            realm_name: ticket.realm_name,\n            ...(ticket.cnf ? { cnf: ticket.cnf } : {}),\n            ...amrAcr,\n        };\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);\n\n        await this.eventService?.record({\n            scope: EventScope.OAUTH2,\n            name: EventName.LOGIN,\n            refType: EventRefType.SESSION,\n            refId: session.id,\n            clientId: session.client_id ?? null,\n            actorType: IdentityType.USER,\n            actorId: session.sub,\n            actorName: input.userName ?? null,\n            realmId: session.realm_id,\n            requestIpAddress: session.ip_address ?? null,\n            requestUserAgent: session.user_agent ?? null,\n            data: {\n                grant_type: OAuth2TokenGrant.PASSWORD,\n                session_id: session.id,\n            },\n        });\n        this.metrics?.recordLogin('success');\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;;;;AAgCA,IAAaW,wBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAmC;EAC3C,KAAKP,iBAAiBO,IAAIP;EAC1B,KAAKC,eAAeM,IAAIN;EACxB,KAAKC,oBAAoBK,IAAIL;EAC7B,KAAKC,qBAAqBI,IAAIJ;EAC9B,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,eAAeE,IAAIF;EACxB,KAAKC,UAAUC,IAAID;CACvB;CAEA,MAAME,YACFC,OACAC,UAA4C,CAAC,GACf;EAC9B,MAAM,EAAEC,SAASF;EACjB,MAAMG,WAAWH,MAAMG,YAAYC,KAAAA;EAOnC,MAAMC,YAAY,KAAKb,aAAac,SAAQ;EAE5C,MAAMC,UAAU,MAAM,KAAKhB,eAAeiB,OAAO;GAC7CC,YAAYR,QAAQS;GACpBC,YAAYV,QAAQW;GACpBC,UAAUX,KAAKW;GACfC,WAAWX;GACXY,KAAKb,KAAKc;GACVC,UAAUhC,aAAaiC;GACvBC,QAAQ;GACRC,aAAajC,kBAAkBkC;GAC/BC,6BAAY,IAAIC,KAAKlB,YAAY,GAAA,EAAA,CAAMmB,YAAW;EACtD,CAAA;EAIA,MAAM,CAACC,OAAOC,WAAW,MAAM,KAAKlC,aAAamC,MAAM;GACnDb,WAAWX;GACXyB,YAAYrB,QAAQS;GACpBP,YAAYF,QAAQE;GACpBoB,gBAAgBtB,QAAQI;GACxBI,KAAKb,KAAKc;GACVC,UAAUrC,cAAcsC;GACxBL,UAAUX,KAAKW;GACfiB,YAAY5B,KAAK6B,OAAOC;GACxB,GAAIhC,MAAMiC,eAAe,EAAEC,KAAKlC,MAAMiC,aAAa,IAAI,CAAC;GACxDE,KAAK9B;EACT,CAAA;EAEA,OAAO;GACHoB;GACAW,WAAWV,QAAQS,MACfT,QAAQS,MAAME,KAAKC,MAAMf,KAAKgB,IAAG,IAAK,GAAA,IACtC;EACR;CACJ;CAEA,MAAMC,SAASxC,OAAwE;EACnF,MAAM,EAAEyC,WAAWzC;EAInB,MAAMO,UAAU,MAAM,KAAKhB,eAAemD,QAAQ1C,MAAMO,OAAO;EAI/D,MAAMoC,SAASvD,aAAamB,OAAAA;EAQ5B,IAAIkC,OAAOG;OAEH,CAACC,MADiB,KAAKlD,gBAAgBmD,cAAcL,OAAOG,KAAKH,OAAON,GAAG,GAE3E,MAAMxD,iBAAiBoE,QAAQ,wCAAA;EAAA;EAIvC,MAAMC,eAA6C;GAC/ClC,WAAWP,QAAQO,aAAaV,KAAAA;GAChCwB,YAAYrB,QAAQS;GACpBP,YAAYF,QAAQE;GACpBoB,gBAAgBtB,QAAQI;GACxBsC,OAAO/D,UAAUgE;GACjBnC,KAAKR,QAAQQ;GACbE,UAAUrC,cAAcsC;GACxBL,UAAUN,QAAQM;GAClBiB,YAAYW,OAAOX;GACnB,GAAIW,OAAOP,MAAM,EAAEA,KAAKO,OAAOP,IAAI,IAAI,CAAC;GACxC,GAAGS;EACP;EAEA,MAAM,CAACQ,aAAaC,sBAAsB,MAAM,KAAK3D,kBAAkBkC,MAAMqB,YAAAA;EAC7E,MAAM,CAACK,cAAcC,uBAAuB,MAAM,KAAK5D,mBAAmBiC,MAAMqB,YAAAA;EAEhF,MAAM,KAAKpD,cAAc2D,OAAO;GAC5BN,OAAOjE,WAAWwE;GAClBxB,MAAMlD,UAAU2E;GAChBC,SAAS3E,aAAa4E;GACtBC,OAAOrD,QAAQS;GACfb,UAAUI,QAAQO,aAAa;GAC/B+C,WAAW5E,aAAaiC;GACxB4C,SAASvD,QAAQQ;GACjBgD,WAAW/D,MAAMgE,YAAY;GAC7BC,SAAS1D,QAAQM;GACjBqD,kBAAkB3D,QAAQI,cAAc;GACxCwD,kBAAkB5D,QAAQE,cAAc;GACxC2D,MAAM;IACFC,YAAYxF,iBAAiBwC;IAC7BO,YAAYrB,QAAQS;GACxB;EACJ,CAAA;EACA,KAAKnB,SAASyE,YAAY,SAAA;EAE1B,OAAOjF,+BAA+B;GAClC8D;GACAC;GACAC;GACAC;EACJ,CAAA;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["OAuth2GrantError","OAuth2SubKind","OAuth2TokenGrant","EventName","EventRefType","EventScope","IdentityType","ScopeName","SessionAuthMethod","deriveAmrAcr","buildOAuth2BearerTokenResponse","OAuth2MfaLoginService","sessionManager","ticketIssuer","accessTokenIssuer","refreshTokenIssuer","tokenRepository","eventService","metrics","ctx","issueTicket","input","options","user","clientId","undefined","expiresAt","buildExp","session","create","userAgent","ipAddress","realmId","sub","id","subKind","USER","mfaAt","authMethod","PASSWORD","Date","toISOString","token","payload","issue","client_id","session_id","user_agent","remote_address","sub_kind","realm_id","realm_name","realm","name","confirmation","cnf","exp","expiresIn","Math","floor","now","complete","ticket","refresh","amrAcr","jti","claimed","claimInactive","invalid","issuePayload","scope","GLOBAL","accessToken","accessTokenPayload","refreshToken","refreshTokenPayload","record","OAUTH2","LOGIN","refType","SESSION","refId","actorType","actorId","actorName","userName","requestIpAddress","requestUserAgent","data","grantType","sessionId","recordLogin"],"sources":["../../../../src/core/oauth2/mfa-login/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2GrantError, OAuth2SubKind, OAuth2TokenGrant } from '@authup/specs';\nimport {\n    EventName,\n    EventRefType,\n    EventScope,\n    IdentityType,\n    ScopeName,\n    SessionAuthMethod,\n} from '@authup/core-kit';\nimport type { IEventService } from '../../entities/index.ts';\nimport type { IAuthFlowMetrics } from '../../metrics/index.ts';\nimport type { ISessionManager } from '../../authentication/index.ts';\nimport { deriveAmrAcr } from '../authorization/helpers.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { IOAuth2TokenIssuer, IOAuth2TokenRepository } from '../token/index.ts';\nimport type {\n    IOAuth2MfaLoginService,\n    OAuth2MfaLoginCompleteInput,\n    OAuth2MfaLoginServiceContext,\n    OAuth2MfaLoginTicket,\n    OAuth2MfaLoginTicketIssueInput,\n    OAuth2MfaLoginTicketIssueOptions,\n} from './types.ts';\n\nexport class OAuth2MfaLoginService implements IOAuth2MfaLoginService {\n    protected sessionManager : ISessionManager;\n\n    protected ticketIssuer : IOAuth2TokenIssuer;\n\n    protected accessTokenIssuer : IOAuth2TokenIssuer;\n\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    protected tokenRepository : IOAuth2TokenRepository;\n\n    protected eventService? : IEventService;\n\n    protected metrics? : IAuthFlowMetrics;\n\n    constructor(ctx: OAuth2MfaLoginServiceContext) {\n        this.sessionManager = ctx.sessionManager;\n        this.ticketIssuer = ctx.ticketIssuer;\n        this.accessTokenIssuer = ctx.accessTokenIssuer;\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n        this.tokenRepository = ctx.tokenRepository;\n        this.eventService = ctx.eventService;\n        this.metrics = ctx.metrics;\n    }\n\n    async issueTicket(\n        input: OAuth2MfaLoginTicketIssueInput,\n        options: OAuth2MfaLoginTicketIssueOptions = {},\n    ) : Promise<OAuth2MfaLoginTicket> {\n        const { user } = input;\n        const clientId = input.clientId ?? undefined;\n\n        // One expiration instant for BOTH artifacts — the pending session\n        // lives exactly as long as the ticket (an abandoned login\n        // self-expires and is swept with the regular session sweep;\n        // completion extends it to the full lifetime). Computed once so\n        // the two cannot drift.\n        const expiresAt = this.ticketIssuer.buildExp();\n\n        const session = await this.sessionManager.create({\n            userAgent: options.userAgent,\n            ipAddress: options.ipAddress,\n            realmId: user.realmId,\n            clientId,\n            sub: user.id,\n            subKind: IdentityType.USER,\n            mfaAt: null,\n            authMethod: SessionAuthMethod.PASSWORD,\n            expiresAt: new Date(expiresAt * 1000).toISOString(),\n        });\n\n        // No scope, no role claims — the ticket is not a bearer; it only\n        // unlocks the challenge routes (which opt in by kind).\n        const [token, payload] = await this.ticketIssuer.issue({\n            client_id: clientId,\n            session_id: session.id,\n            user_agent: session.userAgent,\n            remote_address: session.ipAddress,\n            sub: user.id,\n            sub_kind: OAuth2SubKind.USER,\n            realm_id: user.realmId,\n            realm_name: user.realm?.name,\n            ...(input.confirmation ? { cnf: input.confirmation } : {}),\n            exp: expiresAt,\n        });\n\n        return {\n            token,\n            expiresIn: payload.exp ?\n                payload.exp - Math.floor(Date.now() / 1000) :\n                0,\n        };\n    }\n\n    async complete(input: OAuth2MfaLoginCompleteInput) : Promise<OAuth2TokenGrantResponse> {\n        const { ticket } = input;\n\n        // Extend the ticket-scoped pending session to the regular session\n        // lifetime — the login is complete now.\n        const session = await this.sessionManager.refresh(input.session);\n\n        // mfaAt was stamped inside the verify unit of work, so the claims\n        // advertise the completed factor (amr +otp, acr urn:authup:mfa).\n        const amrAcr = deriveAmrAcr(session);\n\n        // Single use: atomically claim the ticket BEFORE minting so two\n        // concurrent completions (a mixed-kind user presenting two distinct\n        // fresh factors) cannot both issue a token pair — `claimInactive` is a\n        // set-if-absent write, so exactly one racer wins. The trade-off vs.\n        // claiming after minting is that a mint failure burns the ticket — the\n        // safer bias for a single-use login credential (the user re-authenticates).\n        if (ticket.jti) {\n            const claimed = await this.tokenRepository.claimInactive(ticket.jti, ticket.exp);\n            if (!claimed) {\n                throw OAuth2GrantError.invalid('mfa login ticket has already been used');\n            }\n        }\n\n        const issuePayload : Partial<OAuth2TokenPayload> = {\n            client_id: session.clientId ?? undefined,\n            session_id: session.id,\n            user_agent: session.userAgent,\n            remote_address: session.ipAddress,\n            scope: ScopeName.GLOBAL,\n            sub: session.sub,\n            sub_kind: OAuth2SubKind.USER,\n            realm_id: session.realmId,\n            realm_name: ticket.realm_name,\n            ...(ticket.cnf ? { cnf: ticket.cnf } : {}),\n            ...amrAcr,\n        };\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);\n\n        await this.eventService?.record({\n            scope: EventScope.OAUTH2,\n            name: EventName.LOGIN,\n            refType: EventRefType.SESSION,\n            refId: session.id,\n            clientId: session.clientId ?? null,\n            actorType: IdentityType.USER,\n            actorId: session.sub,\n            actorName: input.userName ?? null,\n            realmId: session.realmId,\n            requestIpAddress: session.ipAddress ?? null,\n            requestUserAgent: session.userAgent ?? null,\n            data: {\n                grantType: OAuth2TokenGrant.PASSWORD,\n                sessionId: session.id,\n            },\n        });\n        this.metrics?.recordLogin('success');\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;;;;AAgCA,IAAaW,wBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAmC;EAC3C,KAAKP,iBAAiBO,IAAIP;EAC1B,KAAKC,eAAeM,IAAIN;EACxB,KAAKC,oBAAoBK,IAAIL;EAC7B,KAAKC,qBAAqBI,IAAIJ;EAC9B,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,eAAeE,IAAIF;EACxB,KAAKC,UAAUC,IAAID;CACvB;CAEA,MAAME,YACFC,OACAC,UAA4C,CAAC,GACf;EAC9B,MAAM,EAAEC,SAASF;EACjB,MAAMG,WAAWH,MAAMG,YAAYC,KAAAA;EAOnC,MAAMC,YAAY,KAAKb,aAAac,SAAQ;EAE5C,MAAMC,UAAU,MAAM,KAAKhB,eAAeiB,OAAO;GAC7CC,WAAWR,QAAQQ;GACnBC,WAAWT,QAAQS;GACnBC,SAAST,KAAKS;GACdR;GACAS,KAAKV,KAAKW;GACVC,SAAS7B,aAAa8B;GACtBC,OAAO;GACPC,YAAY9B,kBAAkB+B;GAC9Bb,4BAAW,IAAIc,KAAKd,YAAY,GAAA,EAAA,CAAMe,YAAW;EACrD,CAAA;EAIA,MAAM,CAACC,OAAOC,WAAW,MAAM,KAAK9B,aAAa+B,MAAM;GACnDC,WAAWrB;GACXsB,YAAYlB,QAAQM;GACpBa,YAAYnB,QAAQE;GACpBkB,gBAAgBpB,QAAQG;GACxBE,KAAKV,KAAKW;GACVe,UAAUhD,cAAcmC;GACxBc,UAAU3B,KAAKS;GACfmB,YAAY5B,KAAK6B,OAAOC;GACxB,GAAIhC,MAAMiC,eAAe,EAAEC,KAAKlC,MAAMiC,aAAa,IAAI,CAAC;GACxDE,KAAK9B;EACT,CAAA;EAEA,OAAO;GACHgB;GACAe,WAAWd,QAAQa,MACfb,QAAQa,MAAME,KAAKC,MAAMnB,KAAKoB,IAAG,IAAK,GAAA,IACtC;EACR;CACJ;CAEA,MAAMC,SAASxC,OAAwE;EACnF,MAAM,EAAEyC,WAAWzC;EAInB,MAAMO,UAAU,MAAM,KAAKhB,eAAemD,QAAQ1C,MAAMO,OAAO;EAI/D,MAAMoC,SAASvD,aAAamB,OAAAA;EAQ5B,IAAIkC,OAAOG,KAEH;OAAA,CAACC,MADiB,KAAKlD,gBAAgBmD,cAAcL,OAAOG,KAAKH,OAAON,GAAG,GAE3E,MAAMxD,iBAAiBoE,QAAQ,wCAAA;EAAA;EAIvC,MAAMC,eAA6C;GAC/CxB,WAAWjB,QAAQJ,YAAYC,KAAAA;GAC/BqB,YAAYlB,QAAQM;GACpBa,YAAYnB,QAAQE;GACpBkB,gBAAgBpB,QAAQG;GACxBuC,OAAO/D,UAAUgE;GACjBtC,KAAKL,QAAQK;GACbgB,UAAUhD,cAAcmC;GACxBc,UAAUtB,QAAQI;GAClBmB,YAAYW,OAAOX;GACnB,GAAIW,OAAOP,MAAM,EAAEA,KAAKO,OAAOP,IAAI,IAAI,CAAC;GACxC,GAAGS;EACP;EAEA,MAAM,CAACQ,aAAaC,sBAAsB,MAAM,KAAK3D,kBAAkB8B,MAAMyB,YAAAA;EAC7E,MAAM,CAACK,cAAcC,uBAAuB,MAAM,KAAK5D,mBAAmB6B,MAAMyB,YAAAA;EAEhF,MAAM,KAAKpD,cAAc2D,OAAO;GAC5BN,OAAOjE,WAAWwE;GAClBxB,MAAMlD,UAAU2E;GAChBC,SAAS3E,aAAa4E;GACtBC,OAAOrD,QAAQM;GACfV,UAAUI,QAAQJ,YAAY;GAC9B0D,WAAW5E,aAAa8B;GACxB+C,SAASvD,QAAQK;GACjBmD,WAAW/D,MAAMgE,YAAY;GAC7BrD,SAASJ,QAAQI;GACjBsD,kBAAkB1D,QAAQG,aAAa;GACvCwD,kBAAkB3D,QAAQE,aAAa;GACvC0D,MAAM;IACFC,WAAWvF,iBAAiBqC;IAC5BmD,WAAW9D,QAAQM;GACvB;EACJ,CAAA;EACA,KAAKhB,SAASyE,YAAY,SAAA;EAE1B,OAAOjF,+BAA+B;GAClC8D;GACAC;GACAC;GACAC;EACJ,CAAA;CACJ;AACJ"}

package/dist/core/oauth2/mfa-login/types.d.ts

@@ -42,7 +42,7 @@ export type OAuth2MfaLoginCompleteInput = {
  */
 export interface IOAuth2MfaLoginService {
     /**
-     * Create the pending session (mfa_at: null, ticket-scoped lifetime)
+     * Create the pending session (mfaAt: null, ticket-scoped lifetime)
      * and mint the mfa_token bound to it.
      */
     issueTicket(input: OAuth2MfaLoginTicketIssueInput, options?: OAuth2MfaLoginTicketIssueOptions): Promise<OAuth2MfaLoginTicket>;

package/dist/core/oauth2/openid/claims.d.ts

@@ -1,4 +1,4 @@
-import type { Client, Identity, Robot, User } from '@authup/core-kit';
+import type { Client, Identity, User } from '@authup/core-kit';
 import type { OpenIDTokenPayload } from '@authup/specs';
 import type { ObjectLiteral } from 'validup';
 type AttributeMapTuple<T> = {
@@ -7,7 +7,6 @@ type AttributeMapTuple<T> = {
 type AttributeMap<T extends Record<string, any>> = Record<keyof OpenIDTokenPayload, keyof T | AttributeMapTuple<T>>;
 export declare class OAuth2OpenIDClaimsBuilder {
     protected clientMap: AttributeMap<Client>;
-    protected robotMap: AttributeMap<Robot>;
     protected userMap: AttributeMap<User>;
     /**
      * Build OpenID Claims form Oauth2 Identity.
@@ -16,7 +15,6 @@ export declare class OAuth2OpenIDClaimsBuilder {
      */
     fromIdentity(identity: Identity): OpenIDTokenPayload;
     fromClient(input: Client): OpenIDTokenPayload;
-    fromRobot(input: Robot): OpenIDTokenPayload;
     fromUser(input: User): OpenIDTokenPayload;
     protected extract<T extends ObjectLiteral = ObjectLiteral>(attributeMap: AttributeMap<T>, attributes: T): OpenIDTokenPayload;
 }

package/dist/core/oauth2/openid/claims.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claims.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/openid/claims.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,MAAM,EACN,QAAQ,EACR,KAAK,EACL,IAAI,EACP,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C,KAAK,iBAAiB,CAAC,CAAC,IAAI;KACvB,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,GAAG,CAAC;CAC/C,CAAC,MAAM,CAAC,CAAC,CAAC;AAEX,KAAK,YAAY,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,MAAM,CACrD,MAAM,kBAAkB,EAC5B,MAAM,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAC7B,CAAC;AAEF,qBAAa,yBAAyB;IAClC,SAAS,CAAC,SAAS,EAAG,YAAY,CAAC,MAAM,CAAC,CAcxC;IAEF,SAAS,CAAC,QAAQ,EAAG,YAAY,CAAC,KAAK,CAAC,CActC;IAEF,SAAS,CAAC,OAAO,EAAG,YAAY,CAAC,IAAI,CAAC,CAmBpC;IAEF;;;;OAIG;IACH,YAAY,CAAC,QAAQ,EAAE,QAAQ,GAAI,kBAAkB;IAYrD,UAAU,CAAC,KAAK,EAAE,MAAM,GAAI,kBAAkB;IAI9C,SAAS,CAAC,KAAK,EAAE,KAAK,GAAG,kBAAkB;IAI3C,QAAQ,CAAC,KAAK,EAAE,IAAI,GAAI,kBAAkB;IAI1C,SAAS,CAAC,OAAO,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa,EACrD,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,EAC7B,UAAU,EAAE,CAAC,GACb,kBAAkB;CAqBzB"}
+{"version":3,"file":"claims.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/openid/claims.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,MAAM,EACN,QAAQ,EACR,IAAI,EACP,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C,KAAK,iBAAiB,CAAC,CAAC,IAAI;KACvB,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,GAAG,CAAC;CAC/C,CAAC,MAAM,CAAC,CAAC,CAAC;AAEX,KAAK,YAAY,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,MAAM,CACrD,MAAM,kBAAkB,EAC5B,MAAM,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAC7B,CAAC;AAEF,qBAAa,yBAAyB;IAClC,SAAS,CAAC,SAAS,EAAG,YAAY,CAAC,MAAM,CAAC,CAcxC;IAEF,SAAS,CAAC,OAAO,EAAG,YAAY,CAAC,IAAI,CAAC,CAmBpC;IAEF;;;;OAIG;IACH,YAAY,CAAC,QAAQ,EAAE,QAAQ,GAAI,kBAAkB;IAQrD,UAAU,CAAC,KAAK,EAAE,MAAM,GAAI,kBAAkB;IAI9C,QAAQ,CAAC,KAAK,EAAE,IAAI,GAAI,kBAAkB;IAI1C,SAAS,CAAC,OAAO,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa,EACrD,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,EAC7B,UAAU,EAAE,CAAC,GACb,kBAAkB;CAqBzB"}

package/dist/core/oauth2/openid/claims.mjs

@@ -9,27 +9,18 @@ var OAuth2OpenIDClaimsBuilder = class {
 		name: "name",
 		nickname: "name",
 		preferred_username: "name",
-		updated_at: ["updated_at", (value) => {
-			if (typeof value === "string") return Math.floor(new Date(value).getTime() / 1e3);
-			return value;
-		}]
-	};
-	robotMap = {
-		name: "name",
-		nickname: "name",
-		preferred_username: "name",
-		updated_at: ["updated_at", (value) => {
+		updated_at: ["updatedAt", (value) => {
 			if (typeof value === "string") return Math.floor(new Date(value).getTime() / 1e3);
 			return value;
 		}]
 	};
 	userMap = {
 		name: "name",
-		family_name: "last_name",
-		given_name: "first_name",
-		nickname: "display_name",
-		preferred_username: "display_name",
-		updated_at: ["updated_at", (value) => {
+		family_name: "lastName",
+		given_name: "firstName",
+		nickname: "displayName",
+		preferred_username: "displayName",
+		updated_at: ["updatedAt", (value) => {
 			if (typeof value === "string") return Math.floor(new Date(value).getTime() / 1e3);
 			return value;
 		}],
@@ -42,15 +33,11 @@ var OAuth2OpenIDClaimsBuilder = class {
 	* @param identity
 	*/ fromIdentity(identity) {
 		if (identity.type === OAuth2SubKind.CLIENT) return this.fromClient(identity.data);
-		if (identity.type === OAuth2SubKind.ROBOT) return this.fromRobot(identity.data);
 		return this.fromUser(identity.data);
 	}
 	fromClient(input) {
 		return this.extract(this.clientMap, input);
 	}
-	fromRobot(input) {
-		return this.extract(this.robotMap, input);
-	}
 	fromUser(input) {
 		return this.extract(this.userMap, input);
 	}

package/dist/core/oauth2/openid/claims.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"claims.mjs","names":["hasOwnProperty","OAuth2SubKind","OAuth2OpenIDClaimsBuilder","clientMap","name","nickname","preferred_username","updated_at","value","Math","floor","Date","getTime","robotMap","userMap","family_name","given_name","email","email_verified","fromIdentity","identity","type","CLIENT","fromClient","data","ROBOT","fromRobot","fromUser","input","extract","attributeMap","attributes","result","keys","Object","key_","attribute","key","transformer"],"sources":["../../../../src/core/oauth2/openid/claims.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Client, \n    Identity, \n    Robot, \n    User,\n} from '@authup/core-kit';\nimport { hasOwnProperty } from '@authup/kit';\nimport type { OpenIDTokenPayload } from '@authup/specs';\nimport { OAuth2SubKind } from '@authup/specs';\nimport type { ObjectLiteral } from 'validup';\n\ntype AttributeMapTuple<T> = {\n    [K in keyof T]: [K, (value: unknown) => any]\n}[keyof T];\n\ntype AttributeMap<T extends Record<string, any>> = Record<\n    keyof OpenIDTokenPayload,\nkeyof T | AttributeMapTuple<T>\n>;\n\nexport class OAuth2OpenIDClaimsBuilder {\n    protected clientMap : AttributeMap<Client> = {\n        name: 'name',\n        nickname: 'name',\n        preferred_username: 'name',\n        updated_at: [\n            'updated_at',\n            (value: unknown) => {\n                if (typeof value === 'string') {\n                    return Math.floor(new Date(value).getTime() / 1000);\n                }\n\n                return value;\n            },\n        ],\n    };\n\n    protected robotMap : AttributeMap<Robot> = {\n        name: 'name',\n        nickname: 'name',\n        preferred_username: 'name',\n        updated_at: [\n            'updated_at',\n            (value: unknown) => {\n                if (typeof value === 'string') {\n                    return Math.floor(new Date(value).getTime() / 1000);\n                }\n\n                return value;\n            },\n        ],\n    };\n\n    protected userMap : AttributeMap<User> = {\n        name: 'name',\n        family_name: 'last_name',\n        given_name: 'first_name',\n        nickname: 'display_name',\n        preferred_username: 'display_name',\n        updated_at: [\n            'updated_at',\n            (value: unknown) => {\n                if (typeof value === 'string') {\n                    return Math.floor(new Date(value).getTime() / 1000);\n                }\n\n                return value;\n            },\n        ],\n\n        email: 'email',\n        email_verified: 'active',\n    };\n\n    /**\n     * Build OpenID Claims form Oauth2 Identity.\n     *\n     * @param identity\n     */\n    fromIdentity(identity: Identity) : OpenIDTokenPayload {\n        if (identity.type === OAuth2SubKind.CLIENT) {\n            return this.fromClient(identity.data);\n        }\n\n        if (identity.type === OAuth2SubKind.ROBOT) {\n            return this.fromRobot(identity.data);\n        }\n\n        return this.fromUser(identity.data);\n    }\n\n    fromClient(input: Client) : OpenIDTokenPayload {\n        return this.extract(this.clientMap, input);\n    }\n\n    fromRobot(input: Robot): OpenIDTokenPayload {\n        return this.extract(this.robotMap, input);\n    }\n\n    fromUser(input: User) : OpenIDTokenPayload {\n        return this.extract(this.userMap, input);\n    }\n\n    protected extract<T extends ObjectLiteral = ObjectLiteral>(\n        attributeMap: AttributeMap<T>,\n        attributes: T,\n    ) : OpenIDTokenPayload {\n        const result = {} as OpenIDTokenPayload;\n\n        const keys = Object.keys(attributeMap);\n        for (const key_ of keys) {\n            const attribute = attributeMap[key_];\n            if (typeof attribute === 'string') {\n                if (hasOwnProperty(attributes, attribute)) {\n                    result[key_] = attributes[attribute];\n                }\n            } else {\n                const [key, transformer] = attribute as AttributeMapTuple<T>;\n\n                if (hasOwnProperty(attributes, key)) {\n                    result[key_] = transformer(attributes[key]);\n                }\n            }\n        }\n\n        return result;\n    }\n}\n"],"mappings":";;;;;;AA2BA,IAAaE,4BAAb,MAAaA;CACCC,YAAmC;EACzCC,MAAM;EACNC,UAAU;EACVC,oBAAoB;EACpBC,YAAY,CACR,eACCC,UAAAA;GACG,IAAI,OAAOA,UAAU,UACjB,OAAOC,KAAKC,MAAM,IAAIC,KAAKH,KAAAA,CAAAA,CAAOI,QAAO,IAAK,GAAA;GAGlD,OAAOJ;EACX,CAAA;CAER;CAEUK,WAAiC;EACvCT,MAAM;EACNC,UAAU;EACVC,oBAAoB;EACpBC,YAAY,CACR,eACCC,UAAAA;GACG,IAAI,OAAOA,UAAU,UACjB,OAAOC,KAAKC,MAAM,IAAIC,KAAKH,KAAAA,CAAAA,CAAOI,QAAO,IAAK,GAAA;GAGlD,OAAOJ;EACX,CAAA;CAER;CAEUM,UAA+B;EACrCV,MAAM;EACNW,aAAa;EACbC,YAAY;EACZX,UAAU;EACVC,oBAAoB;EACpBC,YAAY,CACR,eACCC,UAAAA;GACG,IAAI,OAAOA,UAAU,UACjB,OAAOC,KAAKC,MAAM,IAAIC,KAAKH,KAAAA,CAAAA,CAAOI,QAAO,IAAK,GAAA;GAGlD,OAAOJ;EACX,CAAA;EAGJS,OAAO;EACPC,gBAAgB;CACpB;;;;;IAOAC,aAAaC,UAAyC;EAClD,IAAIA,SAASC,SAASpB,cAAcqB,QAChC,OAAO,KAAKC,WAAWH,SAASI,IAAI;EAGxC,IAAIJ,SAASC,SAASpB,cAAcwB,OAChC,OAAO,KAAKC,UAAUN,SAASI,IAAI;EAGvC,OAAO,KAAKG,SAASP,SAASI,IAAI;CACtC;CAEAD,WAAWK,OAAoC;EAC3C,OAAO,KAAKC,QAAQ,KAAK1B,WAAWyB,KAAAA;CACxC;CAEAF,UAAUE,OAAkC;EACxC,OAAO,KAAKC,QAAQ,KAAKhB,UAAUe,KAAAA;CACvC;CAEAD,SAASC,OAAkC;EACvC,OAAO,KAAKC,QAAQ,KAAKf,SAASc,KAAAA;CACtC;CAEUC,QACNC,cACAC,YACmB;EACnB,MAAMC,SAAS,CAAC;EAEhB,MAAMC,OAAOC,OAAOD,KAAKH,YAAAA;EACzB,KAAK,MAAMK,QAAQF,MAAM;GACrB,MAAMG,YAAYN,aAAaK;GAC/B,IAAI,OAAOC,cAAc;QACjBpC,eAAe+B,YAAYK,SAAAA,GAC3BJ,OAAOG,QAAQJ,WAAWK;GAAAA,OAE3B;IACH,MAAM,CAACC,KAAKC,eAAeF;IAE3B,IAAIpC,eAAe+B,YAAYM,GAAAA,GAC3BL,OAAOG,QAAQG,YAAYP,WAAWM,IAAI;GAElD;EACJ;EAEA,OAAOL;CACX;AACJ"}
+{"version":3,"file":"claims.mjs","names":["hasOwnProperty","OAuth2SubKind","OAuth2OpenIDClaimsBuilder","clientMap","name","nickname","preferred_username","updated_at","value","Math","floor","Date","getTime","userMap","family_name","given_name","email","email_verified","fromIdentity","identity","type","CLIENT","fromClient","data","fromUser","input","extract","attributeMap","attributes","result","keys","Object","key_","attribute","key","transformer"],"sources":["../../../../src/core/oauth2/openid/claims.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Client, \n    Identity, \n    User,\n} from '@authup/core-kit';\nimport { hasOwnProperty } from '@authup/kit';\nimport type { OpenIDTokenPayload } from '@authup/specs';\nimport { OAuth2SubKind } from '@authup/specs';\nimport type { ObjectLiteral } from 'validup';\n\ntype AttributeMapTuple<T> = {\n    [K in keyof T]: [K, (value: unknown) => any]\n}[keyof T];\n\ntype AttributeMap<T extends Record<string, any>> = Record<\n    keyof OpenIDTokenPayload,\nkeyof T | AttributeMapTuple<T>\n>;\n\nexport class OAuth2OpenIDClaimsBuilder {\n    protected clientMap : AttributeMap<Client> = {\n        name: 'name',\n        nickname: 'name',\n        preferred_username: 'name',\n        updated_at: [\n            'updatedAt',\n            (value: unknown) => {\n                if (typeof value === 'string') {\n                    return Math.floor(new Date(value).getTime() / 1000);\n                }\n\n                return value;\n            },\n        ],\n    };\n\n    protected userMap : AttributeMap<User> = {\n        name: 'name',\n        family_name: 'lastName',\n        given_name: 'firstName',\n        nickname: 'displayName',\n        preferred_username: 'displayName',\n        updated_at: [\n            'updatedAt',\n            (value: unknown) => {\n                if (typeof value === 'string') {\n                    return Math.floor(new Date(value).getTime() / 1000);\n                }\n\n                return value;\n            },\n        ],\n\n        email: 'email',\n        email_verified: 'active',\n    };\n\n    /**\n     * Build OpenID Claims form Oauth2 Identity.\n     *\n     * @param identity\n     */\n    fromIdentity(identity: Identity) : OpenIDTokenPayload {\n        if (identity.type === OAuth2SubKind.CLIENT) {\n            return this.fromClient(identity.data);\n        }\n\n        return this.fromUser(identity.data);\n    }\n\n    fromClient(input: Client) : OpenIDTokenPayload {\n        return this.extract(this.clientMap, input);\n    }\n\n    fromUser(input: User) : OpenIDTokenPayload {\n        return this.extract(this.userMap, input);\n    }\n\n    protected extract<T extends ObjectLiteral = ObjectLiteral>(\n        attributeMap: AttributeMap<T>,\n        attributes: T,\n    ) : OpenIDTokenPayload {\n        const result = {} as OpenIDTokenPayload;\n\n        const keys = Object.keys(attributeMap);\n        for (const key_ of keys) {\n            const attribute = attributeMap[key_];\n            if (typeof attribute === 'string') {\n                if (hasOwnProperty(attributes, attribute)) {\n                    result[key_] = attributes[attribute];\n                }\n            } else {\n                const [key, transformer] = attribute as AttributeMapTuple<T>;\n\n                if (hasOwnProperty(attributes, key)) {\n                    result[key_] = transformer(attributes[key]);\n                }\n            }\n        }\n\n        return result;\n    }\n}\n"],"mappings":";;;;;;AA0BA,IAAaE,4BAAb,MAAaA;CACCC,YAAmC;EACzCC,MAAM;EACNC,UAAU;EACVC,oBAAoB;EACpBC,YAAY,CACR,cACCC,UAAAA;GACG,IAAI,OAAOA,UAAU,UACjB,OAAOC,KAAKC,MAAM,IAAIC,KAAKH,KAAAA,CAAAA,CAAOI,QAAO,IAAK,GAAA;GAGlD,OAAOJ;EACX,CACH;CACL;CAEUK,UAA+B;EACrCT,MAAM;EACNU,aAAa;EACbC,YAAY;EACZV,UAAU;EACVC,oBAAoB;EACpBC,YAAY,CACR,cACCC,UAAAA;GACG,IAAI,OAAOA,UAAU,UACjB,OAAOC,KAAKC,MAAM,IAAIC,KAAKH,KAAAA,CAAAA,CAAOI,QAAO,IAAK,GAAA;GAGlD,OAAOJ;EACX,CACH;EAEDQ,OAAO;EACPC,gBAAgB;CACpB;;;;;IAOAC,aAAaC,UAAyC;EAClD,IAAIA,SAASC,SAASnB,cAAcoB,QAChC,OAAO,KAAKC,WAAWH,SAASI,IAAI;EAGxC,OAAO,KAAKC,SAASL,SAASI,IAAI;CACtC;CAEAD,WAAWG,OAAoC;EAC3C,OAAO,KAAKC,QAAQ,KAAKvB,WAAWsB,KAAAA;CACxC;CAEAD,SAASC,OAAkC;EACvC,OAAO,KAAKC,QAAQ,KAAKb,SAASY,KAAAA;CACtC;CAEUC,QACNC,cACAC,YACmB;EACnB,MAAMC,SAAS,CAAC;EAEhB,MAAMC,OAAOC,OAAOD,KAAKH,YAAAA;EACzB,KAAK,MAAMK,QAAQF,MAAM;GACrB,MAAMG,YAAYN,aAAaK;GAC/B,IAAI,OAAOC,cAAc,UACjBjC;QAAAA,eAAe4B,YAAYK,SAAAA,GAC3BJ,OAAOG,QAAQJ,WAAWK;GAAAA,OAE3B;IACH,MAAM,CAACC,KAAKC,eAAeF;IAE3B,IAAIjC,eAAe4B,YAAYM,GAAAA,GAC3BL,OAAOG,QAAQG,YAAYP,WAAWM,IAAI;GAElD;EACJ;EAEA,OAAOL;CACX;AACJ"}

package/dist/core/oauth2/scope/resolver.d.ts

@@ -1,4 +1,4 @@
-import type { Client, Robot, User } from '@authup/core-kit';
+import type { Client, User } from '@authup/core-kit';
 import { OAuth2SubKind } from '@authup/specs';
 import type { ObjectLiteral } from 'validup';
 type ScopeFields<T extends ObjectLiteral = ObjectLiteral> = {
@@ -6,7 +6,6 @@ type ScopeFields<T extends ObjectLiteral = ObjectLiteral> = {
 };
 export declare class OAuth2ScopeAttributesResolver {
     protected clientAttributes: ScopeFields<Client>;
-    protected robotAttributes: ScopeFields<Robot>;
     protected userAttributes: ScopeFields<User>;
     /**
      * Resolve attributes for sub kind.
@@ -16,7 +15,6 @@ export declare class OAuth2ScopeAttributesResolver {
      */
     resolveFor(type: OAuth2SubKind, scope: string | string[]): string[];
     resolveForClient(scope: string | string[]): string[];
-    resolveForRobot(scope: string | string[]): string[];
     resolveForUser(scope: string | string[]): string[];
 }
 export {};

package/dist/core/oauth2/scope/resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/scope/resolver.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAG5D,OAAO,EAAE,aAAa,EAAqB,MAAM,eAAe,CAAC;AAEjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C,KAAK,WAAW,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa,IAAI;IACxD,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAA;CACtC,CAAC;AAEF,qBAAa,6BAA6B;IACtC,SAAS,CAAC,gBAAgB,EAAG,WAAW,CAAC,MAAM,CAAC,CAG9C;IAEF,SAAS,CAAC,eAAe,EAAG,WAAW,CAAC,KAAK,CAAC,CAG5C;IAEF,SAAS,CAAC,cAAc,EAAG,WAAW,CAAC,IAAI,CAAC,CAI1C;IAEF;;;;;OAKG;IACH,UAAU,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE;IAYxD,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAI,MAAM,EAAE;IAkBrD,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAI,MAAM,EAAE;IAkBpD,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAI,MAAM,EAAE;CAiBtD"}
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/scope/resolver.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAGrD,OAAO,EAAE,aAAa,EAAqB,MAAM,eAAe,CAAC;AAEjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C,KAAK,WAAW,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa,IAAI;IACxD,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAA;CACtC,CAAC;AAEF,qBAAa,6BAA6B;IACtC,SAAS,CAAC,gBAAgB,EAAG,WAAW,CAAC,MAAM,CAAC,CAG9C;IAEF,SAAS,CAAC,cAAc,EAAG,WAAW,CAAC,IAAI,CAAC,CAI1C;IAEF;;;;;OAKG;IACH,UAAU,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE;IAQxD,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAI,MAAM,EAAE;IAkBrD,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAI,MAAM,EAAE;CAiBtD"}

package/dist/core/oauth2/scope/resolver.mjs

@@ -11,34 +11,25 @@ var OAuth2ScopeAttributesResolver = class {
 		[ScopeName.IDENTITY]: ["name"],
 		[ScopeName.OPEN_ID]: [
 			"name",
-			"display_name",
-			"updated_at",
-			"active"
-		]
-	};
-	robotAttributes = {
-		[ScopeName.IDENTITY]: ["name"],
-		[ScopeName.OPEN_ID]: [
-			"name",
-			"display_name",
-			"updated_at",
+			"displayName",
+			"updatedAt",
 			"active"
 		]
 	};
 	userAttributes = {
 		[ScopeName.IDENTITY]: [
 			"name",
-			"display_name",
-			"last_name",
-			"first_name"
+			"displayName",
+			"lastName",
+			"firstName"
 		],
 		[ScopeName.EMAIL]: ["email"],
 		[ScopeName.OPEN_ID]: [
 			"name",
-			"updated_at",
-			"first_name",
-			"last_name",
-			"display_name",
+			"updatedAt",
+			"firstName",
+			"lastName",
+			"displayName",
 			"active",
 			"email"
 		]
@@ -50,7 +41,6 @@ var OAuth2ScopeAttributesResolver = class {
 	* @param scope
 	*/ resolveFor(type, scope) {
 		if (type === OAuth2SubKind.CLIENT) return this.resolveForClient(scope);
-		if (type === OAuth2SubKind.ROBOT) return this.resolveForRobot(scope);
 		return this.resolveForUser(scope);
 	}
 	resolveForClient(scope) {
@@ -65,18 +55,6 @@ var OAuth2ScopeAttributesResolver = class {
 		}
 		return distinctArray(attributes);
 	}
-	resolveForRobot(scope) {
-		const attributes = [];
-		const scopes = unwrapOAuth2Scope(scope);
-		for (const scope of scopes) {
-			if (hasOwnProperty(this.robotAttributes, scope)) attributes.push(...this.robotAttributes[scope]);
-			if (scope === ScopeName.GLOBAL) {
-				attributes.push(...Object.values(this.robotAttributes).flat());
-				break;
-			}
-		}
-		return distinctArray(attributes);
-	}
 	resolveForUser(scope) {
 		const attributes = [];
 		const scopes = unwrapOAuth2Scope(scope);

package/dist/core/oauth2/scope/resolver.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"resolver.mjs","names":["ScopeName","hasOwnProperty","OAuth2SubKind","unwrapOAuth2Scope","distinctArray","OAuth2ScopeAttributesResolver","clientAttributes","IDENTITY","OPEN_ID","robotAttributes","userAttributes","EMAIL","resolveFor","type","scope","CLIENT","resolveForClient","ROBOT","resolveForRobot","resolveForUser","attributes","scopes","push","GLOBAL","Object","values","flat"],"sources":["../../../../src/core/oauth2/scope/resolver.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Client, Robot, User } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport { hasOwnProperty } from '@authup/kit';\nimport { OAuth2SubKind, unwrapOAuth2Scope } from '@authup/specs';\nimport { distinctArray } from 'smob';\nimport type { ObjectLiteral } from 'validup';\n\ntype ScopeFields<T extends ObjectLiteral = ObjectLiteral> = {\n    [key: string]: (keyof T & string)[]\n};\n\nexport class OAuth2ScopeAttributesResolver {\n    protected clientAttributes : ScopeFields<Client> = {\n        [ScopeName.IDENTITY]: ['name'],\n        [ScopeName.OPEN_ID]: ['name', 'display_name', 'updated_at', 'active'],\n    };\n\n    protected robotAttributes : ScopeFields<Robot> = {\n        [ScopeName.IDENTITY]: ['name'],\n        [ScopeName.OPEN_ID]: ['name', 'display_name', 'updated_at', 'active'],\n    };\n\n    protected userAttributes : ScopeFields<User> = {\n        [ScopeName.IDENTITY]: ['name', 'display_name', 'last_name', 'first_name'],\n        [ScopeName.EMAIL]: ['email'],\n        [ScopeName.OPEN_ID]: ['name', 'updated_at', 'first_name', 'last_name', 'display_name', 'active', 'email'],\n    };\n\n    /**\n     * Resolve attributes for sub kind.\n     *\n     * @param type\n     * @param scope\n     */\n    resolveFor(type: OAuth2SubKind, scope: string | string[]) {\n        if (type === OAuth2SubKind.CLIENT) {\n            return this.resolveForClient(scope);\n        }\n\n        if (type === OAuth2SubKind.ROBOT) {\n            return this.resolveForRobot(scope);\n        }\n\n        return this.resolveForUser(scope);\n    }\n\n    resolveForClient(scope: string | string[]) : string[] {\n        const attributes : string[] = [];\n        const scopes = unwrapOAuth2Scope(scope);\n\n        for (const scope of scopes) {\n            if (hasOwnProperty(this.clientAttributes, scope)) {\n                attributes.push(...this.clientAttributes[scope]);\n            }\n\n            if (scope === ScopeName.GLOBAL) {\n                attributes.push(...Object.values(this.clientAttributes).flat());\n                break;\n            }\n        }\n\n        return distinctArray(attributes);\n    }\n\n    resolveForRobot(scope: string | string[]) : string[] {\n        const attributes : string[] = [];\n        const scopes = unwrapOAuth2Scope(scope);\n\n        for (const scope of scopes) {\n            if (hasOwnProperty(this.robotAttributes, scope)) {\n                attributes.push(...this.robotAttributes[scope]);\n            }\n\n            if (scope === ScopeName.GLOBAL) {\n                attributes.push(...Object.values(this.robotAttributes).flat());\n                break;\n            }\n        }\n\n        return distinctArray(attributes);\n    }\n\n    resolveForUser(scope: string | string[]) : string[] {\n        const attributes : string[] = [];\n        const scopes = unwrapOAuth2Scope(scope);\n\n        for (const scope of scopes) {\n            if (hasOwnProperty(this.userAttributes, scope)) {\n                attributes.push(...this.userAttributes[scope]);\n            }\n\n            if (scope === ScopeName.GLOBAL) {\n                attributes.push(...Object.values(this.userAttributes).flat());\n                break;\n            }\n        }\n\n        return distinctArray(attributes);\n    }\n}\n"],"mappings":";;;;;;;;AAkBA,IAAaK,gCAAb,MAAaA;CACCC,mBAAyC;GAC9CN,UAAUO,WAAW,CAAC,MAAA;GACtBP,UAAUQ,UAAU;GAAC;GAAQ;GAAgB;GAAc;;CAChE;CAEUC,kBAAuC;GAC5CT,UAAUO,WAAW,CAAC,MAAA;GACtBP,UAAUQ,UAAU;GAAC;GAAQ;GAAgB;GAAc;;CAChE;CAEUE,iBAAqC;GAC1CV,UAAUO,WAAW;GAAC;GAAQ;GAAgB;GAAa;;GAC3DP,UAAUW,QAAQ,CAAC,OAAA;GACnBX,UAAUQ,UAAU;GAAC;GAAQ;GAAc;GAAc;GAAa;GAAgB;GAAU;;CACrG;;;;;;IAQAI,WAAWC,MAAqBC,OAA0B;EACtD,IAAID,SAASX,cAAca,QACvB,OAAO,KAAKC,iBAAiBF,KAAAA;EAGjC,IAAID,SAASX,cAAce,OACvB,OAAO,KAAKC,gBAAgBJ,KAAAA;EAGhC,OAAO,KAAKK,eAAeL,KAAAA;CAC/B;CAEAE,iBAAiBF,OAAqC;EAClD,MAAMM,aAAwB,CAAA;EAC9B,MAAMC,SAASlB,kBAAkBW,KAAAA;EAEjC,KAAK,MAAMA,SAASO,QAAQ;GACxB,IAAIpB,eAAe,KAAKK,kBAAkBQ,KAAAA,GACtCM,WAAWE,KAAI,GAAI,KAAKhB,iBAAiBQ,MAAM;GAGnD,IAAIA,UAAUd,UAAUuB,QAAQ;IAC5BH,WAAWE,KAAI,GAAIE,OAAOC,OAAO,KAAKnB,gBAAgB,CAAA,CAAEoB,KAAI,CAAA;IAC5D;GACJ;EACJ;EAEA,OAAOtB,cAAcgB,UAAAA;CACzB;CAEAF,gBAAgBJ,OAAqC;EACjD,MAAMM,aAAwB,CAAA;EAC9B,MAAMC,SAASlB,kBAAkBW,KAAAA;EAEjC,KAAK,MAAMA,SAASO,QAAQ;GACxB,IAAIpB,eAAe,KAAKQ,iBAAiBK,KAAAA,GACrCM,WAAWE,KAAI,GAAI,KAAKb,gBAAgBK,MAAM;GAGlD,IAAIA,UAAUd,UAAUuB,QAAQ;IAC5BH,WAAWE,KAAI,GAAIE,OAAOC,OAAO,KAAKhB,eAAe,CAAA,CAAEiB,KAAI,CAAA;IAC3D;GACJ;EACJ;EAEA,OAAOtB,cAAcgB,UAAAA;CACzB;CAEAD,eAAeL,OAAqC;EAChD,MAAMM,aAAwB,CAAA;EAC9B,MAAMC,SAASlB,kBAAkBW,KAAAA;EAEjC,KAAK,MAAMA,SAASO,QAAQ;GACxB,IAAIpB,eAAe,KAAKS,gBAAgBI,KAAAA,GACpCM,WAAWE,KAAI,GAAI,KAAKZ,eAAeI,MAAM;GAGjD,IAAIA,UAAUd,UAAUuB,QAAQ;IAC5BH,WAAWE,KAAI,GAAIE,OAAOC,OAAO,KAAKf,cAAc,CAAA,CAAEgB,KAAI,CAAA;IAC1D;GACJ;EACJ;EAEA,OAAOtB,cAAcgB,UAAAA;CACzB;AACJ"}
+{"version":3,"file":"resolver.mjs","names":["ScopeName","hasOwnProperty","OAuth2SubKind","unwrapOAuth2Scope","distinctArray","OAuth2ScopeAttributesResolver","clientAttributes","IDENTITY","OPEN_ID","userAttributes","EMAIL","resolveFor","type","scope","CLIENT","resolveForClient","resolveForUser","attributes","scopes","push","GLOBAL","Object","values","flat"],"sources":["../../../../src/core/oauth2/scope/resolver.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Client, User } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport { hasOwnProperty } from '@authup/kit';\nimport { OAuth2SubKind, unwrapOAuth2Scope } from '@authup/specs';\nimport { distinctArray } from 'smob';\nimport type { ObjectLiteral } from 'validup';\n\ntype ScopeFields<T extends ObjectLiteral = ObjectLiteral> = {\n    [key: string]: (keyof T & string)[]\n};\n\nexport class OAuth2ScopeAttributesResolver {\n    protected clientAttributes : ScopeFields<Client> = {\n        [ScopeName.IDENTITY]: ['name'],\n        [ScopeName.OPEN_ID]: ['name', 'displayName', 'updatedAt', 'active'],\n    };\n\n    protected userAttributes : ScopeFields<User> = {\n        [ScopeName.IDENTITY]: ['name', 'displayName', 'lastName', 'firstName'],\n        [ScopeName.EMAIL]: ['email'],\n        [ScopeName.OPEN_ID]: ['name', 'updatedAt', 'firstName', 'lastName', 'displayName', 'active', 'email'],\n    };\n\n    /**\n     * Resolve attributes for sub kind.\n     *\n     * @param type\n     * @param scope\n     */\n    resolveFor(type: OAuth2SubKind, scope: string | string[]) {\n        if (type === OAuth2SubKind.CLIENT) {\n            return this.resolveForClient(scope);\n        }\n\n        return this.resolveForUser(scope);\n    }\n\n    resolveForClient(scope: string | string[]) : string[] {\n        const attributes : string[] = [];\n        const scopes = unwrapOAuth2Scope(scope);\n\n        for (const scope of scopes) {\n            if (hasOwnProperty(this.clientAttributes, scope)) {\n                attributes.push(...this.clientAttributes[scope]);\n            }\n\n            if (scope === ScopeName.GLOBAL) {\n                attributes.push(...Object.values(this.clientAttributes).flat());\n                break;\n            }\n        }\n\n        return distinctArray(attributes);\n    }\n\n    resolveForUser(scope: string | string[]) : string[] {\n        const attributes : string[] = [];\n        const scopes = unwrapOAuth2Scope(scope);\n\n        for (const scope of scopes) {\n            if (hasOwnProperty(this.userAttributes, scope)) {\n                attributes.push(...this.userAttributes[scope]);\n            }\n\n            if (scope === ScopeName.GLOBAL) {\n                attributes.push(...Object.values(this.userAttributes).flat());\n                break;\n            }\n        }\n\n        return distinctArray(attributes);\n    }\n}\n"],"mappings":";;;;;;;;AAkBA,IAAaK,gCAAb,MAAaA;CACCC,mBAAyC;GAC9CN,UAAUO,WAAW,CAAC,MAAO;GAC7BP,UAAUQ,UAAU;GAAC;GAAQ;GAAe;GAAa;EAAS;CACvE;CAEUC,iBAAqC;GAC1CT,UAAUO,WAAW;GAAC;GAAQ;GAAe;GAAY;EAAY;GACrEP,UAAUU,QAAQ,CAAC,OAAQ;GAC3BV,UAAUQ,UAAU;GAAC;GAAQ;GAAa;GAAa;GAAY;GAAe;GAAU;EAAQ;CACzG;;;;;;IAQAG,WAAWC,MAAqBC,OAA0B;EACtD,IAAID,SAASV,cAAcY,QACvB,OAAO,KAAKC,iBAAiBF,KAAAA;EAGjC,OAAO,KAAKG,eAAeH,KAAAA;CAC/B;CAEAE,iBAAiBF,OAAqC;EAClD,MAAMI,aAAwB,CAAA;EAC9B,MAAMC,SAASf,kBAAkBU,KAAAA;EAEjC,KAAK,MAAMA,SAASK,QAAQ;GACxB,IAAIjB,eAAe,KAAKK,kBAAkBO,KAAAA,GACtCI,WAAWE,KAAI,GAAI,KAAKb,iBAAiBO,MAAM;GAGnD,IAAIA,UAAUb,UAAUoB,QAAQ;IAC5BH,WAAWE,KAAI,GAAIE,OAAOC,OAAO,KAAKhB,gBAAgB,CAAA,CAAEiB,KAAI,CAAA;IAC5D;GACJ;EACJ;EAEA,OAAOnB,cAAca,UAAAA;CACzB;CAEAD,eAAeH,OAAqC;EAChD,MAAMI,aAAwB,CAAA;EAC9B,MAAMC,SAASf,kBAAkBU,KAAAA;EAEjC,KAAK,MAAMA,SAASK,QAAQ;GACxB,IAAIjB,eAAe,KAAKQ,gBAAgBI,KAAAA,GACpCI,WAAWE,KAAI,GAAI,KAAKV,eAAeI,MAAM;GAGjD,IAAIA,UAAUb,UAAUoB,QAAQ;IAC5BH,WAAWE,KAAI,GAAIE,OAAOC,OAAO,KAAKb,cAAc,CAAA,CAAEc,KAAI,CAAA;IAC1D;GACJ;EACJ;EAEA,OAAOnB,cAAca,UAAAA;CACzB;AACJ"}

package/dist/core/oauth2/session-token/types.d.ts

@@ -1,17 +1,17 @@
 import type { SessionToken, SessionTokenKind } from '@authup/core-kit';
 export type SessionTokenCreateInput = {
     id: string;
-    session_id: string;
+    sessionId: string;
     kind: SessionTokenKind;
-    parent_id?: string | null;
-    refresh_token_id?: string | null;
-    ip_address: string;
-    user_agent: string;
-    expires_at: string;
+    parentId?: string | null;
+    refreshTokenId?: string | null;
+    ipAddress: string;
+    userAgent: string;
+    expiresAt: string;
 };
 export type SessionTokenRef = {
     id: string;
-    expires_at: string;
+    expiresAt: string;
 };
 export interface ISessionTokenRepository {
     /**
@@ -61,7 +61,7 @@ export interface ISessionTokenRepository {
      */
     revokeBySessionId(sessionId: string, at: string): Promise<SessionTokenRef[]>;
     /**
-     * Delete every token row whose `expires_at` is before the given timestamp.
+     * Delete every token row whose `expiresAt` is before the given timestamp.
      *
      * @param before iso timestamp
      */

package/dist/core/oauth2/session-token/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/session-token/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEvE,MAAM,MAAM,uBAAuB,GAAG;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,gBAAgB,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,WAAW,uBAAuB;IACpC;;OAEG;IACH,MAAM,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAE9D;;OAEG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAEtD;;OAEG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAE5D;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE9D;;;;;;;OAOG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAErD;;;;;OAKG;IACH,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElD;;;;;;;OAOG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAE7E;;;;OAIG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAClD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/session-token/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEvE,MAAM,MAAM,uBAAuB,GAAG;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,gBAAgB,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,WAAW,uBAAuB;IACpC;;OAEG;IACH,MAAM,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAE9D;;OAEG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAEtD;;OAEG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAE5D;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE9D;;;;;;;OAOG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAErD;;;;;OAKG;IACH,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElD;;;;;;;OAOG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAE7E;;;;OAIG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAClD"}

package/dist/core/oauth2/token/issuer/access/module.mjs

@@ -30,12 +30,12 @@ var OAuth2AccessTokenIssuer = class extends OAuth2BaseTokenIssuer {
 		await this.repository.saveWithSignature(data, token);
 		if (this.sessionTokenRepository && data.session_id && data.jti && typeof data.exp === "number") await this.sessionTokenRepository.create({
 			id: data.jti,
-			session_id: data.session_id,
+			sessionId: data.session_id,
 			kind: "access",
-			refresh_token_id: input.refresh_token_id ?? null,
-			ip_address: data.remote_address ?? "",
-			user_agent: data.user_agent ?? "",
-			expires_at: (/* @__PURE__ */ new Date(data.exp * 1e3)).toISOString()
+			refreshTokenId: input.refresh_token_id ?? null,
+			ipAddress: data.remote_address ?? "",
+			userAgent: data.user_agent ?? "",
+			expiresAt: (/* @__PURE__ */ new Date(data.exp * 1e3)).toISOString()
 		});
 		return [token, data];
 	}
@@ -50,8 +50,8 @@ var OAuth2AccessTokenIssuer = class extends OAuth2BaseTokenIssuer {
 		});
 		const realmRoles = [];
 		const globalRoles = [];
-		for (const role of roles) if (!role.realm_id) globalRoles.push(role.name);
-		else if (input.realm_id && role.realm_id === input.realm_id) realmRoles.push(role.name);
+		for (const role of roles) if (!role.realmId) globalRoles.push(role.name);
+		else if (input.realm_id && role.realmId === input.realm_id) realmRoles.push(role.name);
 		return {
 			realm_access: { roles: realmRoles },
 			global_access: { roles: globalRoles }

package/dist/core/oauth2/token/issuer/access/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2TokenKind","OAuth2BaseTokenIssuer","OAuth2AccessTokenIssuer","repository","signer","identityRoleProvider","sessionTokenRepository","options","issue","input","iss","buildIss","accessClaims","buildAccessClaims","data","insert","kind","ACCESS","exp","buildExp","token","sign","saveWithSignature","session_id","jti","create","id","refresh_token_id","ip_address","remote_address","user_agent","expires_at","Date","toISOString","sub","sub_kind","roles","getRolesFor","type","clientId","client_id","realmId","realm_id","realmName","realm_name","realmRoles","globalRoles","role","push","name","realm_access","global_access"],"sources":["../../../../../../src/core/oauth2/token/issuer/access/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport type { ISessionTokenRepository } from '../../../session-token/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';\nimport type { IIdentityRoleProvider } from '../../../../identity/index.ts';\n\nexport class OAuth2AccessTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    protected identityRoleProvider?: IIdentityRoleProvider;\n\n    protected sessionTokenRepository?: ISessionTokenRepository;\n\n    constructor(\n        repository: IOAuth2TokenRepository,\n        signer: IOAuth2TokenSigner,\n        options: OAuth2TokenIssuerOptions = {},\n        identityRoleProvider?: IIdentityRoleProvider,\n        sessionTokenRepository?: ISessionTokenRepository,\n    ) {\n        super(options);\n\n        this.repository = repository;\n        this.signer = signer;\n        this.identityRoleProvider = identityRoleProvider;\n        this.sessionTokenRepository = sessionTokenRepository;\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        const iss = this.buildIss(input);\n\n        const accessClaims = await this.buildAccessClaims(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            kind: OAuth2TokenKind.ACCESS,\n            exp: this.buildExp(input),\n            ...(iss ? { iss } : {}),\n            ...accessClaims,\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        if (this.sessionTokenRepository && data.session_id && data.jti && typeof data.exp === 'number') {\n            await this.sessionTokenRepository.create({\n                id: data.jti,\n                session_id: data.session_id,\n                kind: 'access',\n                refresh_token_id: input.refresh_token_id ?? null,\n                ip_address: data.remote_address ?? '',\n                user_agent: data.user_agent ?? '',\n                expires_at: new Date(data.exp * 1000).toISOString(),\n            });\n        }\n\n        return [token, data];\n    }\n\n    protected async buildAccessClaims(input: OAuth2TokenPayload) : Promise<Pick<OAuth2TokenPayload, 'realm_access' | 'global_access'>> {\n        if (!this.identityRoleProvider || !input.sub || !input.sub_kind) {\n            return {};\n        }\n\n        const roles = await this.identityRoleProvider.getRolesFor({\n            type: input.sub_kind,\n            id: input.sub,\n            clientId: input.client_id,\n            realmId: input.realm_id,\n            realmName: input.realm_name,\n        });\n\n        const realmRoles: string[] = [];\n        const globalRoles: string[] = [];\n\n        for (const role of roles) {\n            if (!role.realm_id) {\n                globalRoles.push(role.name);\n            } else if (input.realm_id && role.realm_id === input.realm_id) {\n                realmRoles.push(role.name);\n            }\n        }\n\n        return {\n            realm_access: { roles: realmRoles },\n            global_access: { roles: globalRoles },\n        };\n    }\n}\n"],"mappings":";;;;;;AAgBA,IAAaE,0BAAb,cAA6CD,sBAAAA;CAC/BE;CAEAC;CAEAC;CAEAC;CAEV,YACIH,YACAC,QACAG,UAAoC,CAAC,GACrCF,sBACAC,wBACF;EACE,MAAMC,OAAAA;EAEN,KAAKJ,aAAaA;EAClB,KAAKC,SAASA;EACd,KAAKC,uBAAuBA;EAC5B,KAAKC,yBAAyBA;CAClC;CAEA,MAAME,MAAMC,QAA4B,CAAC,GAAwC;EAC7E,MAAMC,MAAM,KAAKC,SAASF,KAAAA;EAE1B,MAAMG,eAAe,MAAM,KAAKC,kBAAkBJ,KAAAA;EAElD,MAAMK,OAAO,MAAM,KAAKX,WAAWY,OAAO;GACtC,GAAGN;GACHO,MAAMhB,gBAAgBiB;GACtBC,KAAK,KAAKC,SAASV,KAAAA;GACnB,GAAIC,MAAM,EAAEA,IAAI,IAAI,CAAC;GACrB,GAAGE;EACP,CAAA;EAEA,MAAMQ,QAAQ,MAAM,KAAKhB,OAAOiB,KAAKP,IAAAA;EAErC,MAAM,KAAKX,WAAWmB,kBAAkBR,MAAMM,KAAAA;EAE9C,IAAI,KAAKd,0BAA0BQ,KAAKS,cAAcT,KAAKU,OAAO,OAAOV,KAAKI,QAAQ,UAClF,MAAM,KAAKZ,uBAAuBmB,OAAO;GACrCC,IAAIZ,KAAKU;GACTD,YAAYT,KAAKS;GACjBP,MAAM;GACNW,kBAAkBlB,MAAMkB,oBAAoB;GAC5CC,YAAYd,KAAKe,kBAAkB;GACnCC,YAAYhB,KAAKgB,cAAc;GAC/BC,6BAAY,IAAIC,KAAKlB,KAAKI,MAAM,GAAA,EAAA,CAAMe,YAAW;EACrD,CAAA;EAGJ,OAAO,CAACb,OAAON,IAAAA;CACnB;CAEA,MAAgBD,kBAAkBJ,OAAiG;EAC/H,IAAI,CAAC,KAAKJ,wBAAwB,CAACI,MAAMyB,OAAO,CAACzB,MAAM0B,UACnD,OAAO,CAAC;EAGZ,MAAMC,QAAQ,MAAM,KAAK/B,qBAAqBgC,YAAY;GACtDC,MAAM7B,MAAM0B;GACZT,IAAIjB,MAAMyB;GACVK,UAAU9B,MAAM+B;GAChBC,SAAShC,MAAMiC;GACfC,WAAWlC,MAAMmC;EACrB,CAAA;EAEA,MAAMC,aAAuB,CAAA;EAC7B,MAAMC,cAAwB,CAAA;EAE9B,KAAK,MAAMC,QAAQX,OACf,IAAI,CAACW,KAAKL,UACNI,YAAYE,KAAKD,KAAKE,IAAI;OACvB,IAAIxC,MAAMiC,YAAYK,KAAKL,aAAajC,MAAMiC,UACjDG,WAAWG,KAAKD,KAAKE,IAAI;EAIjC,OAAO;GACHC,cAAc,EAAEd,OAAOS,WAAW;GAClCM,eAAe,EAAEf,OAAOU,YAAY;EACxC;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["OAuth2TokenKind","OAuth2BaseTokenIssuer","OAuth2AccessTokenIssuer","repository","signer","identityRoleProvider","sessionTokenRepository","options","issue","input","iss","buildIss","accessClaims","buildAccessClaims","data","insert","kind","ACCESS","exp","buildExp","token","sign","saveWithSignature","session_id","jti","create","id","sessionId","refreshTokenId","refresh_token_id","ipAddress","remote_address","userAgent","user_agent","expiresAt","Date","toISOString","sub","sub_kind","roles","getRolesFor","type","clientId","client_id","realmId","realm_id","realmName","realm_name","realmRoles","globalRoles","role","push","name","realm_access","global_access"],"sources":["../../../../../../src/core/oauth2/token/issuer/access/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport type { ISessionTokenRepository } from '../../../session-token/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';\nimport type { IIdentityRoleProvider } from '../../../../identity/index.ts';\n\nexport class OAuth2AccessTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    protected identityRoleProvider?: IIdentityRoleProvider;\n\n    protected sessionTokenRepository?: ISessionTokenRepository;\n\n    constructor(\n        repository: IOAuth2TokenRepository,\n        signer: IOAuth2TokenSigner,\n        options: OAuth2TokenIssuerOptions = {},\n        identityRoleProvider?: IIdentityRoleProvider,\n        sessionTokenRepository?: ISessionTokenRepository,\n    ) {\n        super(options);\n\n        this.repository = repository;\n        this.signer = signer;\n        this.identityRoleProvider = identityRoleProvider;\n        this.sessionTokenRepository = sessionTokenRepository;\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        const iss = this.buildIss(input);\n\n        const accessClaims = await this.buildAccessClaims(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            kind: OAuth2TokenKind.ACCESS,\n            exp: this.buildExp(input),\n            ...(iss ? { iss } : {}),\n            ...accessClaims,\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        if (this.sessionTokenRepository && data.session_id && data.jti && typeof data.exp === 'number') {\n            await this.sessionTokenRepository.create({\n                id: data.jti,\n                sessionId: data.session_id,\n                kind: 'access',\n                refreshTokenId: input.refresh_token_id ?? null,\n                ipAddress: data.remote_address ?? '',\n                userAgent: data.user_agent ?? '',\n                expiresAt: new Date(data.exp * 1000).toISOString(),\n            });\n        }\n\n        return [token, data];\n    }\n\n    protected async buildAccessClaims(input: OAuth2TokenPayload) : Promise<Pick<OAuth2TokenPayload, 'realm_access' | 'global_access'>> {\n        if (!this.identityRoleProvider || !input.sub || !input.sub_kind) {\n            return {};\n        }\n\n        const roles = await this.identityRoleProvider.getRolesFor({\n            type: input.sub_kind,\n            id: input.sub,\n            clientId: input.client_id,\n            realmId: input.realm_id,\n            realmName: input.realm_name,\n        });\n\n        const realmRoles: string[] = [];\n        const globalRoles: string[] = [];\n\n        for (const role of roles) {\n            if (!role.realmId) {\n                globalRoles.push(role.name);\n            } else if (input.realm_id && role.realmId === input.realm_id) {\n                realmRoles.push(role.name);\n            }\n        }\n\n        return {\n            realm_access: { roles: realmRoles },\n            global_access: { roles: globalRoles },\n        };\n    }\n}\n"],"mappings":";;;;;;AAgBA,IAAaE,0BAAb,cAA6CD,sBAAAA;CAC/BE;CAEAC;CAEAC;CAEAC;CAEV,YACIH,YACAC,QACAG,UAAoC,CAAC,GACrCF,sBACAC,wBACF;EACE,MAAMC,OAAAA;EAEN,KAAKJ,aAAaA;EAClB,KAAKC,SAASA;EACd,KAAKC,uBAAuBA;EAC5B,KAAKC,yBAAyBA;CAClC;CAEA,MAAME,MAAMC,QAA4B,CAAC,GAAwC;EAC7E,MAAMC,MAAM,KAAKC,SAASF,KAAAA;EAE1B,MAAMG,eAAe,MAAM,KAAKC,kBAAkBJ,KAAAA;EAElD,MAAMK,OAAO,MAAM,KAAKX,WAAWY,OAAO;GACtC,GAAGN;GACHO,MAAMhB,gBAAgBiB;GACtBC,KAAK,KAAKC,SAASV,KAAAA;GACnB,GAAIC,MAAM,EAAEA,IAAI,IAAI,CAAC;GACrB,GAAGE;EACP,CAAA;EAEA,MAAMQ,QAAQ,MAAM,KAAKhB,OAAOiB,KAAKP,IAAAA;EAErC,MAAM,KAAKX,WAAWmB,kBAAkBR,MAAMM,KAAAA;EAE9C,IAAI,KAAKd,0BAA0BQ,KAAKS,cAAcT,KAAKU,OAAO,OAAOV,KAAKI,QAAQ,UAClF,MAAM,KAAKZ,uBAAuBmB,OAAO;GACrCC,IAAIZ,KAAKU;GACTG,WAAWb,KAAKS;GAChBP,MAAM;GACNY,gBAAgBnB,MAAMoB,oBAAoB;GAC1CC,WAAWhB,KAAKiB,kBAAkB;GAClCC,WAAWlB,KAAKmB,cAAc;GAC9BC,4BAAW,IAAIC,KAAKrB,KAAKI,MAAM,GAAA,EAAA,CAAMkB,YAAW;EACpD,CAAA;EAGJ,OAAO,CAAChB,OAAON,IAAK;CACxB;CAEA,MAAgBD,kBAAkBJ,OAAiG;EAC/H,IAAI,CAAC,KAAKJ,wBAAwB,CAACI,MAAM4B,OAAO,CAAC5B,MAAM6B,UACnD,OAAO,CAAC;EAGZ,MAAMC,QAAQ,MAAM,KAAKlC,qBAAqBmC,YAAY;GACtDC,MAAMhC,MAAM6B;GACZZ,IAAIjB,MAAM4B;GACVK,UAAUjC,MAAMkC;GAChBC,SAASnC,MAAMoC;GACfC,WAAWrC,MAAMsC;EACrB,CAAA;EAEA,MAAMC,aAAuB,CAAA;EAC7B,MAAMC,cAAwB,CAAA;EAE9B,KAAK,MAAMC,QAAQX,OACf,IAAI,CAACW,KAAKN,SACNK,YAAYE,KAAKD,KAAKE,IAAI;OACvB,IAAI3C,MAAMoC,YAAYK,KAAKN,YAAYnC,MAAMoC,UAChDG,WAAWG,KAAKD,KAAKE,IAAI;EAIjC,OAAO;GACHC,cAAc,EAAEd,OAAOS,WAAW;GAClCM,eAAe,EAAEf,OAAOU,YAAY;EACxC;CACJ;AACJ"}

package/dist/core/oauth2/token/issuer/mfa/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2TokenKind","OAuth2BaseTokenIssuer","OAuth2MfaTokenIssuer","repository","signer","options","issue","input","iss","buildIss","data","insert","kind","MFA","exp","buildExp","token","sign","saveWithSignature"],"sources":["../../../../../../src/core/oauth2/token/issuer/mfa/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';\n\n/**\n * Issues the short-lived \"MFA-pending\" login ticket (kind: mfa_token).\n * Deliberately minimal: no role claims, no scope, no session-token\n * inventory row — the ticket is not a bearer, it only unlocks the\n * challenge routes (which opt in by kind).\n */\nexport class OAuth2MfaTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    constructor(\n        repository: IOAuth2TokenRepository,\n        signer: IOAuth2TokenSigner,\n        options: OAuth2TokenIssuerOptions = {},\n    ) {\n        super(options);\n\n        this.repository = repository;\n        this.signer = signer;\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        const iss = this.buildIss(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            kind: OAuth2TokenKind.MFA,\n            exp: this.buildExp(input),\n            ...(iss ? { iss } : {}),\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        return [token, data];\n    }\n}\n"],"mappings":";;;;;;;;;;;GAoBA,IAAaE,uBAAb,cAA0CD,sBAAAA;CAC5BE;CAEAC;CAEV,YACID,YACAC,QACAC,UAAoC,CAAC,GACvC;EACE,MAAMA,OAAAA;EAEN,KAAKF,aAAaA;EAClB,KAAKC,SAASA;CAClB;CAEA,MAAME,MAAMC,QAA4B,CAAC,GAAwC;EAC7E,MAAMC,MAAM,KAAKC,SAASF,KAAAA;EAE1B,MAAMG,OAAO,MAAM,KAAKP,WAAWQ,OAAO;GACtC,GAAGJ;GACHK,MAAMZ,gBAAgBa;GACtBC,KAAK,KAAKC,SAASR,KAAAA;GACnB,GAAIC,MAAM,EAAEA,IAAI,IAAI,CAAC;EACzB,CAAA;EAEA,MAAMQ,QAAQ,MAAM,KAAKZ,OAAOa,KAAKP,IAAAA;EAErC,MAAM,KAAKP,WAAWe,kBAAkBR,MAAMM,KAAAA;EAE9C,OAAO,CAACA,OAAON,IAAAA;CACnB;AACJ"}
+{"version":3,"file":"module.mjs","names":["OAuth2TokenKind","OAuth2BaseTokenIssuer","OAuth2MfaTokenIssuer","repository","signer","options","issue","input","iss","buildIss","data","insert","kind","MFA","exp","buildExp","token","sign","saveWithSignature"],"sources":["../../../../../../src/core/oauth2/token/issuer/mfa/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';\n\n/**\n * Issues the short-lived \"MFA-pending\" login ticket (kind: mfa_token).\n * Deliberately minimal: no role claims, no scope, no session-token\n * inventory row — the ticket is not a bearer, it only unlocks the\n * challenge routes (which opt in by kind).\n */\nexport class OAuth2MfaTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    constructor(\n        repository: IOAuth2TokenRepository,\n        signer: IOAuth2TokenSigner,\n        options: OAuth2TokenIssuerOptions = {},\n    ) {\n        super(options);\n\n        this.repository = repository;\n        this.signer = signer;\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        const iss = this.buildIss(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            kind: OAuth2TokenKind.MFA,\n            exp: this.buildExp(input),\n            ...(iss ? { iss } : {}),\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        return [token, data];\n    }\n}\n"],"mappings":";;;;;;;;;;;GAoBA,IAAaE,uBAAb,cAA0CD,sBAAAA;CAC5BE;CAEAC;CAEV,YACID,YACAC,QACAC,UAAoC,CAAC,GACvC;EACE,MAAMA,OAAAA;EAEN,KAAKF,aAAaA;EAClB,KAAKC,SAASA;CAClB;CAEA,MAAME,MAAMC,QAA4B,CAAC,GAAwC;EAC7E,MAAMC,MAAM,KAAKC,SAASF,KAAAA;EAE1B,MAAMG,OAAO,MAAM,KAAKP,WAAWQ,OAAO;GACtC,GAAGJ;GACHK,MAAMZ,gBAAgBa;GACtBC,KAAK,KAAKC,SAASR,KAAAA;GACnB,GAAIC,MAAM,EAAEA,IAAI,IAAI,CAAC;EACzB,CAAA;EAEA,MAAMQ,QAAQ,MAAM,KAAKZ,OAAOa,KAAKP,IAAAA;EAErC,MAAM,KAAKP,WAAWe,kBAAkBR,MAAMM,KAAAA;EAE9C,OAAO,CAACA,OAAON,IAAK;CACxB;AACJ"}

package/dist/core/oauth2/token/issuer/open-id/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["JWTError","OAuth2TokenKind","OAuth2OpenIDClaimsBuilder","OAuth2BaseTokenIssuer","OAuth2OpenIDTokenIssuer","repository","signer","identityResolver","claimsBuilder","ctx","options","issue","input","sub_kind","payloadPropertyInvalid","sub","identity","resolve","payloadInvalid","issueWithIdentity","claims","fromIdentity","utc","Math","floor","Date","getTime","iss","buildIss","data","insert","kind","ID_TOKEN","auth_time","exp","buildExp","updated_at","client_id","aud","token","sign","saveWithSignature"],"sources":["../../../../../../src/core/oauth2/token/issuer/open-id/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { JWTError, OAuth2TokenKind } from '@authup/specs';\nimport type { Identity } from '@authup/core-kit';\nimport { OAuth2OpenIDClaimsBuilder } from '../../../openid/index.ts';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { OAuth2TokenIssuerResponse } from '../types.ts';\nimport type { IOAuth2OpenIDTokenIssuer, OAuth2OpenIDTokenIssuerContext } from './types.ts';\nimport type { IIdentityResolver } from '../../../../identity/index.ts';\n\nexport class OAuth2OpenIDTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2OpenIDTokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    protected identityResolver : IIdentityResolver;\n\n    protected claimsBuilder: OAuth2OpenIDClaimsBuilder;\n\n    constructor(ctx: OAuth2OpenIDTokenIssuerContext) {\n        super(ctx.options);\n\n        this.repository = ctx.repository;\n        this.signer = ctx.signer;\n\n        this.identityResolver = ctx.identityResolver;\n        this.claimsBuilder = new OAuth2OpenIDClaimsBuilder();\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        if (!input.sub_kind) {\n            throw JWTError.payloadPropertyInvalid('sub_kind');\n        }\n\n        if (!input.sub) {\n            throw JWTError.payloadPropertyInvalid('sub');\n        }\n\n        const identity = await this.identityResolver.resolve(\n            input.sub_kind,\n            input.sub,\n        );\n\n        if (!identity) {\n            throw JWTError.payloadInvalid();\n        }\n\n        return this.issueWithIdentity(input, identity);\n    }\n\n    async issueWithIdentity(\n        input: OAuth2TokenPayload,\n        identity: Identity,\n    ): Promise<OAuth2TokenIssuerResponse> {\n        const claims = this.claimsBuilder.fromIdentity(identity);\n\n        const utc = Math.floor(new Date().getTime() / 1000);\n\n        const iss = this.buildIss(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            ...claims,\n            kind: OAuth2TokenKind.ID_TOKEN,\n            // Real authentication time when threaded from the authorize flow\n            // (the session's creation instant); fall back to issuance time only\n            // for session-less id_token issuance. `sid` rides via ...input.\n            auth_time: typeof input.auth_time === 'number' ? input.auth_time : utc,\n            exp: this.buildExp(input),\n            updated_at: utc,\n            ...(iss ? { iss } : {}),\n            ...(input.client_id ? { aud: input.client_id } : {}),\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        return [token, data];\n    }\n}\n"],"mappings":";;;;;;;;AAkBA,IAAaI,0BAAb,cAA6CD,sBAAAA;CAC/BE;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAMA,IAAIC,OAAO;EAEjB,KAAKL,aAAaI,IAAIJ;EACtB,KAAKC,SAASG,IAAIH;EAElB,KAAKC,mBAAmBE,IAAIF;EAC5B,KAAKC,gBAAgB,IAAIN,0BAAAA;CAC7B;CAEA,MAAMS,MAAMC,QAA4B,CAAC,GAAwC;EAC7E,IAAI,CAACA,MAAMC,UACP,MAAMb,SAASc,uBAAuB,UAAA;EAG1C,IAAI,CAACF,MAAMG,KACP,MAAMf,SAASc,uBAAuB,KAAA;EAG1C,MAAME,WAAW,MAAM,KAAKT,iBAAiBU,QACzCL,MAAMC,UACND,MAAMG,GAAG;EAGb,IAAI,CAACC,UACD,MAAMhB,SAASkB,eAAc;EAGjC,OAAO,KAAKC,kBAAkBP,OAAOI,QAAAA;CACzC;CAEA,MAAMG,kBACFP,OACAI,UACkC;EAClC,MAAMI,SAAS,KAAKZ,cAAca,aAAaL,QAAAA;EAE/C,MAAMM,MAAMC,KAAKC,uBAAM,IAAIC,KAAAA,EAAAA,CAAOC,QAAO,IAAK,GAAA;EAE9C,MAAMC,MAAM,KAAKC,SAAShB,KAAAA;EAE1B,MAAMiB,OAAO,MAAM,KAAKxB,WAAWyB,OAAO;GACtC,GAAGlB;GACH,GAAGQ;GACHW,MAAM9B,gBAAgB+B;GAItBC,WAAW,OAAOrB,MAAMqB,cAAc,WAAWrB,MAAMqB,YAAYX;GACnEY,KAAK,KAAKC,SAASvB,KAAAA;GACnBwB,YAAYd;GACZ,GAAIK,MAAM,EAAEA,IAAI,IAAI,CAAC;GACrB,GAAIf,MAAMyB,YAAY,EAAEC,KAAK1B,MAAMyB,UAAU,IAAI,CAAC;EACtD,CAAA;EAEA,MAAME,QAAQ,MAAM,KAAKjC,OAAOkC,KAAKX,IAAAA;EAErC,MAAM,KAAKxB,WAAWoC,kBAAkBZ,MAAMU,KAAAA;EAE9C,OAAO,CAACA,OAAOV,IAAAA;CACnB;AACJ"}
+{"version":3,"file":"module.mjs","names":["JWTError","OAuth2TokenKind","OAuth2OpenIDClaimsBuilder","OAuth2BaseTokenIssuer","OAuth2OpenIDTokenIssuer","repository","signer","identityResolver","claimsBuilder","ctx","options","issue","input","sub_kind","payloadPropertyInvalid","sub","identity","resolve","payloadInvalid","issueWithIdentity","claims","fromIdentity","utc","Math","floor","Date","getTime","iss","buildIss","data","insert","kind","ID_TOKEN","auth_time","exp","buildExp","updated_at","client_id","aud","token","sign","saveWithSignature"],"sources":["../../../../../../src/core/oauth2/token/issuer/open-id/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { JWTError, OAuth2TokenKind } from '@authup/specs';\nimport type { Identity } from '@authup/core-kit';\nimport { OAuth2OpenIDClaimsBuilder } from '../../../openid/index.ts';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { OAuth2TokenIssuerResponse } from '../types.ts';\nimport type { IOAuth2OpenIDTokenIssuer, OAuth2OpenIDTokenIssuerContext } from './types.ts';\nimport type { IIdentityResolver } from '../../../../identity/index.ts';\n\nexport class OAuth2OpenIDTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2OpenIDTokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    protected identityResolver : IIdentityResolver;\n\n    protected claimsBuilder: OAuth2OpenIDClaimsBuilder;\n\n    constructor(ctx: OAuth2OpenIDTokenIssuerContext) {\n        super(ctx.options);\n\n        this.repository = ctx.repository;\n        this.signer = ctx.signer;\n\n        this.identityResolver = ctx.identityResolver;\n        this.claimsBuilder = new OAuth2OpenIDClaimsBuilder();\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        if (!input.sub_kind) {\n            throw JWTError.payloadPropertyInvalid('sub_kind');\n        }\n\n        if (!input.sub) {\n            throw JWTError.payloadPropertyInvalid('sub');\n        }\n\n        const identity = await this.identityResolver.resolve(\n            input.sub_kind,\n            input.sub,\n        );\n\n        if (!identity) {\n            throw JWTError.payloadInvalid();\n        }\n\n        return this.issueWithIdentity(input, identity);\n    }\n\n    async issueWithIdentity(\n        input: OAuth2TokenPayload,\n        identity: Identity,\n    ): Promise<OAuth2TokenIssuerResponse> {\n        const claims = this.claimsBuilder.fromIdentity(identity);\n\n        const utc = Math.floor(new Date().getTime() / 1000);\n\n        const iss = this.buildIss(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            ...claims,\n            kind: OAuth2TokenKind.ID_TOKEN,\n            // Real authentication time when threaded from the authorize flow\n            // (the session's creation instant); fall back to issuance time only\n            // for session-less id_token issuance. `sid` rides via ...input.\n            auth_time: typeof input.auth_time === 'number' ? input.auth_time : utc,\n            exp: this.buildExp(input),\n            updated_at: utc,\n            ...(iss ? { iss } : {}),\n            ...(input.client_id ? { aud: input.client_id } : {}),\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        return [token, data];\n    }\n}\n"],"mappings":";;;;;;;;AAkBA,IAAaI,0BAAb,cAA6CD,sBAAAA;CAC/BE;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAMA,IAAIC,OAAO;EAEjB,KAAKL,aAAaI,IAAIJ;EACtB,KAAKC,SAASG,IAAIH;EAElB,KAAKC,mBAAmBE,IAAIF;EAC5B,KAAKC,gBAAgB,IAAIN,0BAAAA;CAC7B;CAEA,MAAMS,MAAMC,QAA4B,CAAC,GAAwC;EAC7E,IAAI,CAACA,MAAMC,UACP,MAAMb,SAASc,uBAAuB,UAAA;EAG1C,IAAI,CAACF,MAAMG,KACP,MAAMf,SAASc,uBAAuB,KAAA;EAG1C,MAAME,WAAW,MAAM,KAAKT,iBAAiBU,QACzCL,MAAMC,UACND,MAAMG,GAAG;EAGb,IAAI,CAACC,UACD,MAAMhB,SAASkB,eAAc;EAGjC,OAAO,KAAKC,kBAAkBP,OAAOI,QAAAA;CACzC;CAEA,MAAMG,kBACFP,OACAI,UACkC;EAClC,MAAMI,SAAS,KAAKZ,cAAca,aAAaL,QAAAA;EAE/C,MAAMM,MAAMC,KAAKC,uBAAM,IAAIC,KAAAA,EAAAA,CAAOC,QAAO,IAAK,GAAA;EAE9C,MAAMC,MAAM,KAAKC,SAAShB,KAAAA;EAE1B,MAAMiB,OAAO,MAAM,KAAKxB,WAAWyB,OAAO;GACtC,GAAGlB;GACH,GAAGQ;GACHW,MAAM9B,gBAAgB+B;GAItBC,WAAW,OAAOrB,MAAMqB,cAAc,WAAWrB,MAAMqB,YAAYX;GACnEY,KAAK,KAAKC,SAASvB,KAAAA;GACnBwB,YAAYd;GACZ,GAAIK,MAAM,EAAEA,IAAI,IAAI,CAAC;GACrB,GAAIf,MAAMyB,YAAY,EAAEC,KAAK1B,MAAMyB,UAAU,IAAI,CAAC;EACtD,CAAA;EAEA,MAAME,QAAQ,MAAM,KAAKjC,OAAOkC,KAAKX,IAAAA;EAErC,MAAM,KAAKxB,WAAWoC,kBAAkBZ,MAAMU,KAAAA;EAE9C,OAAO,CAACA,OAAOV,IAAK;CACxB;AACJ"}

package/dist/core/oauth2/token/issuer/refresh/module.mjs

@@ -26,12 +26,12 @@ var OAuth2RefreshTokenIssuer = class extends OAuth2BaseTokenIssuer {
 		await this.repository.saveWithSignature(data, token);
 		if (this.sessionTokenRepository && data.session_id && data.jti && typeof data.exp === "number") await this.sessionTokenRepository.create({
 			id: data.jti,
-			session_id: data.session_id,
+			sessionId: data.session_id,
 			kind: "refresh",
-			parent_id: input.parent_id ?? null,
-			ip_address: data.remote_address ?? "",
-			user_agent: data.user_agent ?? "",
-			expires_at: (/* @__PURE__ */ new Date(data.exp * 1e3)).toISOString()
+			parentId: input.parent_id ?? null,
+			ipAddress: data.remote_address ?? "",
+			userAgent: data.user_agent ?? "",
+			expiresAt: (/* @__PURE__ */ new Date(data.exp * 1e3)).toISOString()
 		});
 		return [token, data];
 	}

package/dist/core/oauth2/token/issuer/refresh/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2TokenKind","OAuth2BaseTokenIssuer","OAuth2RefreshTokenIssuer","repository","signer","sessionTokenRepository","options","issue","input","iss","buildIss","data","insert","kind","REFRESH","exp","buildExp","token","sign","saveWithSignature","session_id","jti","create","id","parent_id","ip_address","remote_address","user_agent","expires_at","Date","toISOString"],"sources":["../../../../../../src/core/oauth2/token/issuer/refresh/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport type { ISessionTokenRepository } from '../../../session-token/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';\n\nexport class OAuth2RefreshTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    protected sessionTokenRepository?: ISessionTokenRepository;\n\n    constructor(\n        repository: IOAuth2TokenRepository,\n        signer: IOAuth2TokenSigner,\n        options: OAuth2TokenIssuerOptions = {},\n        sessionTokenRepository?: ISessionTokenRepository,\n    ) {\n        super(options);\n\n        this.repository = repository;\n        this.signer = signer;\n        this.sessionTokenRepository = sessionTokenRepository;\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        const iss = this.buildIss(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            kind: OAuth2TokenKind.REFRESH,\n            exp: this.buildExp(input),\n            ...(iss ? { iss } : {}),\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        if (this.sessionTokenRepository && data.session_id && data.jti && typeof data.exp === 'number') {\n            await this.sessionTokenRepository.create({\n                id: data.jti,\n                session_id: data.session_id,\n                kind: 'refresh',\n                parent_id: input.parent_id ?? null,\n                ip_address: data.remote_address ?? '',\n                user_agent: data.user_agent ?? '',\n                expires_at: new Date(data.exp * 1000).toISOString(),\n            });\n        }\n\n        return [token, data];\n    }\n}\n"],"mappings":";;;;;;AAeA,IAAaE,2BAAb,cAA8CD,sBAAAA;CAChCE;CAEAC;CAEAC;CAEV,YACIF,YACAC,QACAE,UAAoC,CAAC,GACrCD,wBACF;EACE,MAAMC,OAAAA;EAEN,KAAKH,aAAaA;EAClB,KAAKC,SAASA;EACd,KAAKC,yBAAyBA;CAClC;CAEA,MAAME,MAAMC,QAA4B,CAAC,GAAwC;EAC7E,MAAMC,MAAM,KAAKC,SAASF,KAAAA;EAE1B,MAAMG,OAAO,MAAM,KAAKR,WAAWS,OAAO;GACtC,GAAGJ;GACHK,MAAMb,gBAAgBc;GACtBC,KAAK,KAAKC,SAASR,KAAAA;GACnB,GAAIC,MAAM,EAAEA,IAAI,IAAI,CAAC;EACzB,CAAA;EAEA,MAAMQ,QAAQ,MAAM,KAAKb,OAAOc,KAAKP,IAAAA;EAErC,MAAM,KAAKR,WAAWgB,kBAAkBR,MAAMM,KAAAA;EAE9C,IAAI,KAAKZ,0BAA0BM,KAAKS,cAAcT,KAAKU,OAAO,OAAOV,KAAKI,QAAQ,UAClF,MAAM,KAAKV,uBAAuBiB,OAAO;GACrCC,IAAIZ,KAAKU;GACTD,YAAYT,KAAKS;GACjBP,MAAM;GACNW,WAAWhB,MAAMgB,aAAa;GAC9BC,YAAYd,KAAKe,kBAAkB;GACnCC,YAAYhB,KAAKgB,cAAc;GAC/BC,6BAAY,IAAIC,KAAKlB,KAAKI,MAAM,GAAA,EAAA,CAAMe,YAAW;EACrD,CAAA;EAGJ,OAAO,CAACb,OAAON,IAAAA;CACnB;AACJ"}
+{"version":3,"file":"module.mjs","names":["OAuth2TokenKind","OAuth2BaseTokenIssuer","OAuth2RefreshTokenIssuer","repository","signer","sessionTokenRepository","options","issue","input","iss","buildIss","data","insert","kind","REFRESH","exp","buildExp","token","sign","saveWithSignature","session_id","jti","create","id","sessionId","parentId","parent_id","ipAddress","remote_address","userAgent","user_agent","expiresAt","Date","toISOString"],"sources":["../../../../../../src/core/oauth2/token/issuer/refresh/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport type { ISessionTokenRepository } from '../../../session-token/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';\n\nexport class OAuth2RefreshTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    protected sessionTokenRepository?: ISessionTokenRepository;\n\n    constructor(\n        repository: IOAuth2TokenRepository,\n        signer: IOAuth2TokenSigner,\n        options: OAuth2TokenIssuerOptions = {},\n        sessionTokenRepository?: ISessionTokenRepository,\n    ) {\n        super(options);\n\n        this.repository = repository;\n        this.signer = signer;\n        this.sessionTokenRepository = sessionTokenRepository;\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        const iss = this.buildIss(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            kind: OAuth2TokenKind.REFRESH,\n            exp: this.buildExp(input),\n            ...(iss ? { iss } : {}),\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        if (this.sessionTokenRepository && data.session_id && data.jti && typeof data.exp === 'number') {\n            await this.sessionTokenRepository.create({\n                id: data.jti,\n                sessionId: data.session_id,\n                kind: 'refresh',\n                parentId: input.parent_id ?? null,\n                ipAddress: data.remote_address ?? '',\n                userAgent: data.user_agent ?? '',\n                expiresAt: new Date(data.exp * 1000).toISOString(),\n            });\n        }\n\n        return [token, data];\n    }\n}\n"],"mappings":";;;;;;AAeA,IAAaE,2BAAb,cAA8CD,sBAAAA;CAChCE;CAEAC;CAEAC;CAEV,YACIF,YACAC,QACAE,UAAoC,CAAC,GACrCD,wBACF;EACE,MAAMC,OAAAA;EAEN,KAAKH,aAAaA;EAClB,KAAKC,SAASA;EACd,KAAKC,yBAAyBA;CAClC;CAEA,MAAME,MAAMC,QAA4B,CAAC,GAAwC;EAC7E,MAAMC,MAAM,KAAKC,SAASF,KAAAA;EAE1B,MAAMG,OAAO,MAAM,KAAKR,WAAWS,OAAO;GACtC,GAAGJ;GACHK,MAAMb,gBAAgBc;GACtBC,KAAK,KAAKC,SAASR,KAAAA;GACnB,GAAIC,MAAM,EAAEA,IAAI,IAAI,CAAC;EACzB,CAAA;EAEA,MAAMQ,QAAQ,MAAM,KAAKb,OAAOc,KAAKP,IAAAA;EAErC,MAAM,KAAKR,WAAWgB,kBAAkBR,MAAMM,KAAAA;EAE9C,IAAI,KAAKZ,0BAA0BM,KAAKS,cAAcT,KAAKU,OAAO,OAAOV,KAAKI,QAAQ,UAClF,MAAM,KAAKV,uBAAuBiB,OAAO;GACrCC,IAAIZ,KAAKU;GACTG,WAAWb,KAAKS;GAChBP,MAAM;GACNY,UAAUjB,MAAMkB,aAAa;GAC7BC,WAAWhB,KAAKiB,kBAAkB;GAClCC,WAAWlB,KAAKmB,cAAc;GAC9BC,4BAAW,IAAIC,KAAKrB,KAAKI,MAAM,GAAA,EAAA,CAAMkB,YAAW;EACpD,CAAA;EAGJ,OAAO,CAAChB,OAAON,IAAK;CACxB;AACJ"}

package/dist/core/oauth2/token/signer/module.mjs

@@ -12,23 +12,23 @@ var OAuth2TokenSigner = class {
 	async sign(payload) {
 		if (!payload.realm_id) throw JWKError.invalidRealm();
 		const key = await this.keyStore.resolveOrCreate(payload.realm_id, JWKUse.SIGNATURE);
-		if (!key.decryption_key) throw JWKError.decryptionKeyMissing();
+		if (!key.decryptionKey) throw JWKError.decryptionKeyMissing();
 		let token;
 		if (key.type === JWKType.OCT) token = await signToken(payload, {
 			type: JWKType.OCT,
-			key: key.decryption_key,
+			key: key.decryptionKey,
 			keyId: key.id
 		});
 		else if (key.type === JWKType.EC) token = await signToken(payload, {
 			type: key.type,
-			key: key.decryption_key,
-			algorithm: key.signature_algorithm,
+			key: key.decryptionKey,
+			algorithm: key.signatureAlgorithm,
 			keyId: key.id
 		});
 		else token = await signToken(payload, {
 			type: key.type,
-			key: key.decryption_key,
-			algorithm: key.signature_algorithm,
+			key: key.decryptionKey,
+			algorithm: key.signatureAlgorithm,
 			keyId: key.id
 		});
 		return token;

package/dist/core/oauth2/token/signer/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["signToken","JWKError","JWKType","JWKUse","OAuth2TokenSigner","keyStore","sign","payload","realm_id","invalidRealm","key","resolveOrCreate","SIGNATURE","decryption_key","decryptionKeyMissing","token","type","OCT","keyId","id","EC","algorithm","signature_algorithm"],"sources":["../../../../../src/core/oauth2/token/signer/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { type TokenECAlgorithm, type TokenRSAAlgorithm, signToken } from '@authup/server-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { JWKError, JWKType, JWKUse } from '@authup/specs';\nimport type { IKeyStore } from '../../../key/index.ts';\nimport type { IOAuth2TokenSigner } from './types.ts';\n\nexport class OAuth2TokenSigner implements IOAuth2TokenSigner {\n    protected keyStore : IKeyStore;\n\n    constructor(keyStore : IKeyStore) {\n        this.keyStore = keyStore;\n    }\n\n    async sign<T extends OAuth2TokenPayload>(payload: T) : Promise<string> {\n        if (!payload.realm_id) {\n            throw JWKError.invalidRealm();\n        }\n\n        // highest-priority ACTIVE key — passive keys only verify, and an\n        // all-disabled realm fails loud inside the store.\n        const key = await this.keyStore.resolveOrCreate(payload.realm_id, JWKUse.SIGNATURE);\n\n        if (!key.decryption_key) {\n            throw JWKError.decryptionKeyMissing();\n        }\n\n        let token : string;\n        if (key.type === JWKType.OCT) {\n            token = await signToken(\n                payload,\n                {\n                    type: JWKType.OCT,\n                    key: key.decryption_key,\n                    keyId: key.id,\n                },\n            );\n        } else if (key.type === JWKType.EC) {\n            token = await signToken(\n                payload,\n                {\n                    type: key.type,\n                    key: key.decryption_key,\n                    algorithm: key.signature_algorithm as TokenECAlgorithm,\n                    keyId: key.id,\n                },\n            );\n        } else {\n            token = await signToken(\n                payload,\n                {\n                    type: key.type,\n                    key: key.decryption_key,\n                    algorithm: key.signature_algorithm as TokenRSAAlgorithm,\n                    keyId: key.id,\n                },\n            );\n        }\n\n        return token;\n    }\n}\n"],"mappings":";;;;;;AAaA,IAAaI,oBAAb,MAAaA;CACCC;CAEV,YAAYA,UAAsB;EAC9B,KAAKA,WAAWA;CACpB;CAEA,MAAMC,KAAmCC,SAA8B;EACnE,IAAI,CAACA,QAAQC,UACT,MAAMP,SAASQ,aAAY;EAK/B,MAAMC,MAAM,MAAM,KAAKL,SAASM,gBAAgBJ,QAAQC,UAAUL,OAAOS,SAAS;EAElF,IAAI,CAACF,IAAIG,gBACL,MAAMZ,SAASa,qBAAoB;EAGvC,IAAIC;EACJ,IAAIL,IAAIM,SAASd,QAAQe,KACrBF,QAAQ,MAAMf,UACVO,SACA;GACIS,MAAMd,QAAQe;GACdP,KAAKA,IAAIG;GACTK,OAAOR,IAAIS;EACf,CAAA;OAED,IAAIT,IAAIM,SAASd,QAAQkB,IAC5BL,QAAQ,MAAMf,UACVO,SACA;GACIS,MAAMN,IAAIM;GACVN,KAAKA,IAAIG;GACTQ,WAAWX,IAAIY;GACfJ,OAAOR,IAAIS;EACf,CAAA;OAGJJ,QAAQ,MAAMf,UACVO,SACA;GACIS,MAAMN,IAAIM;GACVN,KAAKA,IAAIG;GACTQ,WAAWX,IAAIY;GACfJ,OAAOR,IAAIS;EACf,CAAA;EAIR,OAAOJ;CACX;AACJ"}
+{"version":3,"file":"module.mjs","names":["signToken","JWKError","JWKType","JWKUse","OAuth2TokenSigner","keyStore","sign","payload","realm_id","invalidRealm","key","resolveOrCreate","SIGNATURE","decryptionKey","decryptionKeyMissing","token","type","OCT","keyId","id","EC","algorithm","signatureAlgorithm"],"sources":["../../../../../src/core/oauth2/token/signer/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { type TokenECAlgorithm, type TokenRSAAlgorithm, signToken } from '@authup/server-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { JWKError, JWKType, JWKUse } from '@authup/specs';\nimport type { IKeyStore } from '../../../key/index.ts';\nimport type { IOAuth2TokenSigner } from './types.ts';\n\nexport class OAuth2TokenSigner implements IOAuth2TokenSigner {\n    protected keyStore : IKeyStore;\n\n    constructor(keyStore : IKeyStore) {\n        this.keyStore = keyStore;\n    }\n\n    async sign<T extends OAuth2TokenPayload>(payload: T) : Promise<string> {\n        if (!payload.realm_id) {\n            throw JWKError.invalidRealm();\n        }\n\n        // highest-priority ACTIVE key — passive keys only verify, and an\n        // all-disabled realm fails loud inside the store.\n        const key = await this.keyStore.resolveOrCreate(payload.realm_id, JWKUse.SIGNATURE);\n\n        if (!key.decryptionKey) {\n            throw JWKError.decryptionKeyMissing();\n        }\n\n        let token : string;\n        if (key.type === JWKType.OCT) {\n            token = await signToken(\n                payload,\n                {\n                    type: JWKType.OCT,\n                    key: key.decryptionKey,\n                    keyId: key.id,\n                },\n            );\n        } else if (key.type === JWKType.EC) {\n            token = await signToken(\n                payload,\n                {\n                    type: key.type,\n                    key: key.decryptionKey,\n                    algorithm: key.signatureAlgorithm as TokenECAlgorithm,\n                    keyId: key.id,\n                },\n            );\n        } else {\n            token = await signToken(\n                payload,\n                {\n                    type: key.type,\n                    key: key.decryptionKey,\n                    algorithm: key.signatureAlgorithm as TokenRSAAlgorithm,\n                    keyId: key.id,\n                },\n            );\n        }\n\n        return token;\n    }\n}\n"],"mappings":";;;;;;AAaA,IAAaI,oBAAb,MAAaA;CACCC;CAEV,YAAYA,UAAsB;EAC9B,KAAKA,WAAWA;CACpB;CAEA,MAAMC,KAAmCC,SAA8B;EACnE,IAAI,CAACA,QAAQC,UACT,MAAMP,SAASQ,aAAY;EAK/B,MAAMC,MAAM,MAAM,KAAKL,SAASM,gBAAgBJ,QAAQC,UAAUL,OAAOS,SAAS;EAElF,IAAI,CAACF,IAAIG,eACL,MAAMZ,SAASa,qBAAoB;EAGvC,IAAIC;EACJ,IAAIL,IAAIM,SAASd,QAAQe,KACrBF,QAAQ,MAAMf,UACVO,SACA;GACIS,MAAMd,QAAQe;GACdP,KAAKA,IAAIG;GACTK,OAAOR,IAAIS;EACf,CAAA;OAED,IAAIT,IAAIM,SAASd,QAAQkB,IAC5BL,QAAQ,MAAMf,UACVO,SACA;GACIS,MAAMN,IAAIM;GACVN,KAAKA,IAAIG;GACTQ,WAAWX,IAAIY;GACfJ,OAAOR,IAAIS;EACf,CAAA;OAGJJ,QAAQ,MAAMf,UACVO,SACA;GACIS,MAAMN,IAAIM;GACVN,KAAKA,IAAIG;GACTQ,WAAWX,IAAIY;GACfJ,OAAOR,IAAIS;EACf,CAAA;EAIR,OAAOJ;CACX;AACJ"}

package/dist/core/oauth2/token/verifier/module.mjs

@@ -32,26 +32,26 @@ var OAuth2TokenVerifier = class {
 		if (key.status === KeyStatus.DISABLED) throw JWKError.notFound(header.kid);
 		switch (key.type) {
 			case JWKType.OCT:
-				if (!key.decryption_key) throw JWKError.decryptionKeyMissing();
+				if (!key.decryptionKey) throw JWKError.decryptionKeyMissing();
 				payload = await verifyToken(token, {
 					type: JWKType.OCT,
-					key: key.decryption_key
+					key: key.decryptionKey
 				}, { ignoreExpiry: options.ignoreExpiry });
 				break;
 			case JWKType.EC:
-				if (!key.encryption_key) throw JWKError.decryptionKeyMissing();
+				if (!key.encryptionKey) throw JWKError.decryptionKeyMissing();
 				payload = await verifyToken(token, {
 					type: key.type,
-					key: key.encryption_key,
-					...key.signature_algorithm ? { algorithms: [key.signature_algorithm] } : []
+					key: key.encryptionKey,
+					...key.signatureAlgorithm ? { algorithms: [key.signatureAlgorithm] } : []
 				}, { ignoreExpiry: options.ignoreExpiry });
 				break;
 			default:
-				if (!key.encryption_key) throw JWKError.decryptionKeyMissing();
+				if (!key.encryptionKey) throw JWKError.decryptionKeyMissing();
 				payload = await verifyToken(token, {
 					type: key.type,
-					key: key.encryption_key,
-					...key.signature_algorithm ? { algorithms: [key.signature_algorithm] } : []
+					key: key.encryptionKey,
+					...key.signatureAlgorithm ? { algorithms: [key.signatureAlgorithm] } : []
 				}, { ignoreExpiry: options.ignoreExpiry });
 		}
 		if (!payload.jti) throw JWTError.payloadPropertyInvalid("jti");