@authup/server-core 1.0.0-beta.54 → 1.0.0-beta.56

package/dist/adapters/http/controllers/entities/user-role/module.mjs

@@ -14,8 +14,8 @@ function _ts_decorate(decorators, target, key, desc) {
 	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
 	return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-function _ts_metadata(k, v) {
-	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+function _ts_metadata(metadataKey, metadataValue) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(metadataKey, metadataValue);
 }
 function _ts_param(paramIndex, decorator) {
 	return function(target, key) {

package/dist/adapters/http/controllers/entities/user-role/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["DBody","DContext","DController","DDelete","DGet","DPath","DPost","DTags","useRequestQuery","ForceLoggedInMiddleware","buildActorContext","UserRoleController","service","ctx","getMany","event","actor","data","meta","add","entity","create","response","status","getOne","id","drop","delete"],"sources":["../../../../../../src/adapters/http/controllers/entities/user-role/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DBody,\n    DContext,\n    DController,\n    DDelete,\n    DGet,\n    DPath,\n    DPost,\n    DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type {\n    EntityCollectionResponse,\n    UserRoleCreatePayload,\n} from '@authup/core-http-kit';\nimport type { UserRole } from '@authup/core-kit';\nimport type { IUserRoleService } from '../../../../../core/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport {\n    buildActorContext,\n} from '../../../request/index.ts';\n\nexport type UserRoleControllerContext = {\n    service: IUserRoleService,\n};\n\n@DTags('user')\n@DController('/user-roles')\nexport class UserRoleController {\n    protected service: IUserRoleService;\n\n    constructor(ctx: UserRoleControllerContext) {\n        this.service = ctx.service;\n    }\n\n    @DGet('', [ForceLoggedInMiddleware])\n    async getMany(\n        @DContext() event: IAppEvent,\n    ): Promise<EntityCollectionResponse<UserRole>> {\n        const actor = buildActorContext(event);\n        const {\n            data,\n            meta,\n        } = await this.service.getMany(useRequestQuery(event), actor);\n\n        return {\n            data,\n            meta,\n        };\n    }\n\n    @DPost('', [ForceLoggedInMiddleware])\n    async add(\n        @DBody() data: UserRoleCreatePayload,\n        @DContext() event: IAppEvent,\n    ): Promise<UserRole> {\n        const actor = buildActorContext(event);\n        const entity = await this.service.create(data, actor);\n\n        event.response.status = 201;\n\n        return entity;\n    }\n\n    @DGet('/:id', [ForceLoggedInMiddleware])\n    async getOne(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ): Promise<UserRole> {\n        const actor = buildActorContext(event);\n        const entity = await this.service.getOne(id, actor);\n\n        return entity;\n    }\n\n    @DDelete('/:id', [ForceLoggedInMiddleware])\n    async drop(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ): Promise<UserRole> {\n        const actor = buildActorContext(event);\n        const entity = await this.service.delete(id, actor);\n\n        event.response.status = 202;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAoCA,IAAaW,qBAAb,MAAaA;CACCC;CAEV,YAAYC,KAAgC;EACxC,KAAKD,UAAUC,IAAID;CACvB;CAEA,MACME,QACF,OAC2C;EAC3C,MAAME,QAAQN,kBAAkBK,KAAAA;EAChC,MAAM,EACFE,MACAC,SACA,MAAM,KAAKN,QAAQE,QAAQN,gBAAgBO,KAAAA,GAAQC,KAAAA;EAEvD,OAAO;GACHC;GACAC;EACJ;CACJ;CAEA,MACMC,IACF,MACA,OACiB;EACjB,MAAMH,QAAQN,kBAAkBK,KAAAA;EAChC,MAAMK,SAAS,MAAM,KAAKR,QAAQS,OAAOJ,MAAMD,KAAAA;EAE/CD,MAAMO,SAASC,SAAS;EAExB,OAAOH;CACX;CAEA,MACMI,OACF,IACA,OACiB;EACjB,MAAMR,QAAQN,kBAAkBK,KAAAA;EAGhC,OAAOK,MAFc,KAAKR,QAAQY,OAAOC,IAAIT,KAAAA;CAGjD;CAEA,MACMU,KACF,IACA,OACiB;EACjB,MAAMV,QAAQN,kBAAkBK,KAAAA;EAChC,MAAMK,SAAS,MAAM,KAAKR,QAAQe,OAAOF,IAAIT,KAAAA;EAE7CD,MAAMO,SAASC,SAAS;EAExB,OAAOH;CACX;AACJ;;WApDeX,uBAAAA,CAAAA;;;;;;;YAgBCA,uBAAAA,CAAAA;;;;;;;;eAaGA,uBAAAA,CAAAA;;;;;;;;kBAWGA,uBAAAA,CAAAA"}
+{"version":3,"file":"module.mjs","names":["DBody","DContext","DController","DDelete","DGet","DPath","DPost","DTags","useRequestQuery","ForceLoggedInMiddleware","buildActorContext","UserRoleController","service","ctx","getMany","event","actor","data","meta","add","entity","create","response","status","getOne","id","drop","delete"],"sources":["../../../../../../src/adapters/http/controllers/entities/user-role/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DBody,\n    DContext,\n    DController,\n    DDelete,\n    DGet,\n    DPath,\n    DPost,\n    DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type {\n    EntityCollectionResponse,\n    UserRoleCreatePayload,\n} from '@authup/core-http-kit';\nimport type { UserRole } from '@authup/core-kit';\nimport type { IUserRoleService } from '../../../../../core/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport {\n    buildActorContext,\n} from '../../../request/index.ts';\n\nexport type UserRoleControllerContext = {\n    service: IUserRoleService,\n};\n\n@DTags('user')\n@DController('/user-roles')\nexport class UserRoleController {\n    protected service: IUserRoleService;\n\n    constructor(ctx: UserRoleControllerContext) {\n        this.service = ctx.service;\n    }\n\n    @DGet('', [ForceLoggedInMiddleware])\n    async getMany(\n        @DContext() event: IAppEvent,\n    ): Promise<EntityCollectionResponse<UserRole>> {\n        const actor = buildActorContext(event);\n        const {\n            data,\n            meta,\n        } = await this.service.getMany(useRequestQuery(event), actor);\n\n        return {\n            data,\n            meta,\n        };\n    }\n\n    @DPost('', [ForceLoggedInMiddleware])\n    async add(\n        @DBody() data: UserRoleCreatePayload,\n        @DContext() event: IAppEvent,\n    ): Promise<UserRole> {\n        const actor = buildActorContext(event);\n        const entity = await this.service.create(data, actor);\n\n        event.response.status = 201;\n\n        return entity;\n    }\n\n    @DGet('/:id', [ForceLoggedInMiddleware])\n    async getOne(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ): Promise<UserRole> {\n        const actor = buildActorContext(event);\n        const entity = await this.service.getOne(id, actor);\n\n        return entity;\n    }\n\n    @DDelete('/:id', [ForceLoggedInMiddleware])\n    async drop(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ): Promise<UserRole> {\n        const actor = buildActorContext(event);\n        const entity = await this.service.delete(id, actor);\n\n        event.response.status = 202;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAoCA,IAAaW,qBAAb,MAAaA;CACCC;CAEV,YAAYC,KAAgC;EACxC,KAAKD,UAAUC,IAAID;CACvB;CAEA,MACME,QACF,OAC2C;EAC3C,MAAME,QAAQN,kBAAkBK,KAAAA;EAChC,MAAM,EACFE,MACAC,SACA,MAAM,KAAKN,QAAQE,QAAQN,gBAAgBO,KAAAA,GAAQC,KAAAA;EAEvD,OAAO;GACHC;GACAC;EACJ;CACJ;CAEA,MACMC,IACF,MACA,OACiB;EACjB,MAAMH,QAAQN,kBAAkBK,KAAAA;EAChC,MAAMK,SAAS,MAAM,KAAKR,QAAQS,OAAOJ,MAAMD,KAAAA;EAE/CD,MAAMO,SAASC,SAAS;EAExB,OAAOH;CACX;CAEA,MACMI,OACF,IACA,OACiB;EACjB,MAAMR,QAAQN,kBAAkBK,KAAAA;EAGhC,OAAOK,MAFc,KAAKR,QAAQY,OAAOC,IAAIT,KAAAA;CAGjD;CAEA,MACMU,KACF,IACA,OACiB;EACjB,MAAMV,QAAQN,kBAAkBK,KAAAA;EAChC,MAAMK,SAAS,MAAM,KAAKR,QAAQe,OAAOF,IAAIT,KAAAA;EAE7CD,MAAMO,SAASC,SAAS;EAExB,OAAOH;CACX;AACJ;;CApDeX,KAAAA,IAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;CAgBCA,MAAAA,IAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;CAaGA,KAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;CAWGA,QAAAA,QAAAA,CAAAA,uBAAAA,CAAAA"}

package/dist/adapters/http/controllers/workflows/activate/module.mjs

@@ -12,8 +12,8 @@ function _ts_decorate(decorators, target, key, desc) {
 	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
 	return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-function _ts_metadata(k, v) {
-	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+function _ts_metadata(metadataKey, metadataValue) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(metadataKey, metadataValue);
 }
 function _ts_param(paramIndex, decorator) {
 	return function(target, key) {

package/dist/adapters/http/controllers/workflows/authenticator-challenge/module.mjs

@@ -17,8 +17,8 @@ function _ts_decorate(decorators, target, key, desc) {
 	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
 	return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-function _ts_metadata(k, v) {
-	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+function _ts_metadata(metadataKey, metadataValue) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(metadataKey, metadataValue);
 }
 function _ts_param(paramIndex, decorator) {
 	return function(target, key) {

package/dist/adapters/http/controllers/workflows/authorize/module.mjs

@@ -24,8 +24,8 @@ function _ts_decorate(decorators, target, key, desc) {
 	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
 	return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-function _ts_metadata(k, v) {
-	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+function _ts_metadata(metadataKey, metadataValue) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(metadataKey, metadataValue);
 }
 function _ts_param(paramIndex, decorator) {
 	return function(target, key) {

package/dist/adapters/http/controllers/workflows/authorize/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["DContext","DController","DGet","DPost","URL","useRequestQuery","OAuth2AccessDeniedError","OAuth2ErrorCode","isOAuth2AccessDeniedError","ForceUserLoggedInMiddleware","HTTPOAuth2Authorizer","renderUIPage","readFromLocations","OAuth2AuthorizationCodeRequestValidator","sanitizeError","AuthorizeController","options","codeRequestVerifier","codeRequestValidator","authorizer","ctx","codeIssuer","sessionManager","eventService","metrics","promptLoginMaxAge","mfaFreshnessMaxAge","mfaChallengeProvider","accessPolicyEvaluator","consentService","logger","confirm","event","result","authorizeWithRequest","url","redirectUri","state","searchParams","set","authorizationCode","href","e","ACCESS_DENIED","serve","codeRequest","client","scopes","realm","redirectUriVerified","error","merged","data","run","verify","id","name","displayName","builtIn","createdAt","normalized","message","query","forClient","requestURL","request","payload","config","baseURL","features","requestPath","pathname","search"],"sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPost,\n} from '@routup/decorators';\nimport { URL } from 'node:url';\n\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type {\n    Client,\n    OAuth2AuthorizationCodeRequest,\n    Realm,\n    Scope,\n} from '@authup/core-kit';\nimport { OAuth2AccessDeniedError, OAuth2ErrorCode, isOAuth2AccessDeniedError } from '@authup/specs';\nimport { ForceUserLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { HTTPOAuth2Authorizer } from '../../../adapters/index.ts';\nimport { renderUIPage } from '../../../ui/index.ts';\nimport { readFromLocations } from '../../../request/index.ts';\nimport type { IOAuth2AuthorizationCodeRequestVerifier } from '../../../../../core/index.ts';\nimport { OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';\nimport type { AuthorizeControllerContext, AuthorizeControllerOptions } from './types.ts';\nimport { sanitizeError } from '../../../../../utils/index.ts';\n\ntype RealmSummary = Pick<Realm, 'id' | 'name' | 'displayName'>;\ntype ClientSummary = Pick<Client, 'id' | 'name' | 'displayName' | 'builtIn' | 'createdAt'>;\n\n@DController('/authorize')\nexport class AuthorizeController {\n    // todo: maybe /realms/<realm>/protocol/openid-connect/authorize\n    // todo: maybe /realms/<realm>/[...]/authorize\n\n    protected options: AuthorizeControllerOptions;\n\n    protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n    protected codeRequestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n    protected authorizer: HTTPOAuth2Authorizer;\n\n    // ---------------------------------------------------------\n\n    constructor(ctx: AuthorizeControllerContext) {\n        this.options = ctx.options;\n\n        this.codeRequestVerifier = ctx.codeRequestVerifier;\n\n        this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();\n\n        this.authorizer = new HTTPOAuth2Authorizer({\n            codeRequestVerifier: this.codeRequestVerifier,\n            codeIssuer: ctx.codeIssuer,\n            sessionManager: ctx.sessionManager,\n            eventService: ctx.eventService,\n            metrics: ctx.metrics,\n            promptLoginMaxAge: ctx.options.promptLoginMaxAge,\n            mfaFreshnessMaxAge: ctx.options.mfaFreshnessMaxAge,\n            mfaChallengeProvider: ctx.mfaChallengeProvider,\n            accessPolicyEvaluator: ctx.accessPolicyEvaluator,\n            consentService: ctx.consentService,\n            logger: ctx.logger,\n        });\n    }\n\n    // ---------------------------------------------------------\n\n    @DPost('', [ForceUserLoggedInMiddleware])\n    async confirm(@DContext() event: IAppEvent): Promise<{ url: string }> {\n        try {\n            const result = await this.authorizer.authorizeWithRequest(event);\n\n            const url = new URL(result.redirectUri);\n            if (result.state) {\n                url.searchParams.set('state', result.state);\n            }\n\n            if (result.authorizationCode) {\n                url.searchParams.set('code', result.authorizationCode);\n            }\n\n            return { url: url.href };\n        } catch (e) {\n            // Access-policy denial (plan 052): with a pattern-verified\n            // redirect_uri the denial is answered as an error redirect\n            // (RFC 6749 §4.1.2.1) — the kit navigates the returned url like\n            // any success. Unverified → rethrow → 400 body → interactive\n            // denial card.\n            if (isOAuth2AccessDeniedError(e) && e.redirectUri) {\n                const url = new URL(e.redirectUri);\n                url.searchParams.set('error', OAuth2ErrorCode.ACCESS_DENIED);\n                if (e.state) {\n                    url.searchParams.set('state', e.state);\n                }\n\n                return { url: url.href };\n            }\n\n            throw e;\n        }\n    }\n\n    @DGet('', [])\n    async serve(@DContext() event: IAppEvent): Promise<string> {\n        let codeRequest : OAuth2AuthorizationCodeRequest | undefined;\n\n        let client : ClientSummary | undefined;\n        let scopes : Scope[] | undefined;\n\n        // Target realm summary (the client's realm) — the UI names it in the\n        // realm-mismatch notice. codeRequest.realm_id is only the id.\n        let realm : RealmSummary | undefined;\n\n        // Whether the request redirect_uri matched a registered client pattern —\n        // the UI must not offer an automatic \"return to application\" redirect to\n        // an unverified (pattern-less-client) redirect_uri.\n        let redirectUriVerified = false;\n\n        let error : Error | undefined;\n\n        try {\n            const merged = await readFromLocations(event, ['body', 'query']);\n            const data = await this.codeRequestValidator.run(merged);\n\n            const result = await this.codeRequestVerifier.verify(data);\n\n            // Trim the client to a deliberate DTO before it reaches the\n            // anonymous SSR hydration payload — never disclose redirect_uri\n            // patterns (the trusted-origin set), grant_types, internal\n            // base/root URLs, auth methods, or the secret storage flags to an\n            // unauthenticated visitor. (ClientEntity.secret is additionally\n            // select:false, so the secret is never loaded — but the DTO must not\n            // rely on that alone: a future entity/query change could unset it.)\n            client = {\n                id: result.client.id,\n                name: result.client.name,\n                displayName: result.client.displayName,\n                builtIn: result.client.builtIn,\n                createdAt: result.client.createdAt,\n            };\n            scopes = result.scopes;\n            redirectUriVerified = result.redirectUriVerified;\n\n            if (result.client.realm) {\n                realm = {\n                    id: result.client.realm.id,\n                    name: result.client.realm.name,\n                    displayName: result.client.realm.displayName,\n                };\n            }\n\n            codeRequest = result.data;\n        } catch (e) {\n            const normalized = sanitizeError(e);\n            error = {\n                ...normalized,\n                message: normalized.message,\n            };\n        }\n\n        // A recognized `error` query param (the federated-IdP callback\n        // redirects back here with error=access_denied on a policy denial)\n        // is mapped onto the hydration payload's error — neutral message,\n        // never attacker-controlled text.\n        if (!error) {\n            const query = useRequestQuery(event);\n            if (query.error === OAuth2ErrorCode.ACCESS_DENIED) {\n                const normalized = sanitizeError(OAuth2AccessDeniedError.forClient());\n                error = {\n                    ...normalized,\n                    message: normalized.message,\n                };\n            }\n        }\n\n        // Path + query of the original request — the SSR page uses it as\n        // the same-origin `redirect` parameter on register / password links\n        // so those pages can lead back into this authorize request.\n        const requestURL = new URL(event.request.url);\n\n        return renderUIPage(event, {\n            url: '/authorize',\n            payload: {\n                config: { baseURL: this.options.baseURL },\n                data: {\n                    codeRequest,\n                    error,\n                    client,\n                    scopes,\n                    realm,\n                    redirectUriVerified,\n                    features: this.options.features,\n                    requestPath: `${requestURL.pathname}${requestURL.search}`,\n                },\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,IAAae,sBAAb,MAAaA;CAICC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAiC;EACzC,KAAKJ,UAAUI,IAAIJ;EAEnB,KAAKC,sBAAsBG,IAAIH;EAE/B,KAAKC,uBAAuB,IAAIL,wCAAAA;EAEhC,KAAKM,aAAa,IAAIT,qBAAqB;GACvCO,qBAAqB,KAAKA;GAC1BI,YAAYD,IAAIC;GAChBC,gBAAgBF,IAAIE;GACpBC,cAAcH,IAAIG;GAClBC,SAASJ,IAAII;GACbC,mBAAmBL,IAAIJ,QAAQS;GAC/BC,oBAAoBN,IAAIJ,QAAQU;GAChCC,sBAAsBP,IAAIO;GAC1BC,uBAAuBR,IAAIQ;GAC3BC,gBAAgBT,IAAIS;GACpBC,QAAQV,IAAIU;EAChB,CAAA;CACJ;CAIA,MACMC,QAAQ,OAAwD;EAClE,IAAI;GACA,MAAME,SAAS,MAAM,KAAKd,WAAWe,qBAAqBF,KAAAA;GAE1D,MAAMG,MAAM,IAAI/B,IAAI6B,OAAOG,WAAW;GACtC,IAAIH,OAAOI,OACPF,IAAIG,aAAaC,IAAI,SAASN,OAAOI,KAAK;GAG9C,IAAIJ,OAAOO,mBACPL,IAAIG,aAAaC,IAAI,QAAQN,OAAOO,iBAAiB;GAGzD,OAAO,EAAEL,KAAKA,IAAIM,KAAK;EAC3B,SAASC,GAAG;GAMR,IAAIlC,0BAA0BkC,CAAAA,KAAMA,EAAEN,aAAa;IAC/C,MAAMD,MAAM,IAAI/B,IAAIsC,EAAEN,WAAW;IACjCD,IAAIG,aAAaC,IAAI,SAAShC,gBAAgBoC,aAAa;IAC3D,IAAID,EAAEL,OACFF,IAAIG,aAAaC,IAAI,SAASG,EAAEL,KAAK;IAGzC,OAAO,EAAEF,KAAKA,IAAIM,KAAK;GAC3B;GAEA,MAAMC;EACV;CACJ;CAEA,MACME,MAAM,OAA+C;EACvD,IAAIC;EAEJ,IAAIC;EACJ,IAAIC;EAIJ,IAAIC;EAKJ,IAAIC,sBAAsB;EAE1B,IAAIC;EAEJ,IAAI;GACA,MAAMC,SAAS,MAAMvC,kBAAkBoB,OAAO,CAAC,QAAQ,OAAA,CAAQ;GAC/D,MAAMoB,OAAO,MAAM,KAAKlC,qBAAqBmC,IAAIF,MAAAA;GAEjD,MAAMlB,SAAS,MAAM,KAAKhB,oBAAoBqC,OAAOF,IAAAA;GASrDN,SAAS;IACLS,IAAItB,OAAOa,OAAOS;IAClBC,MAAMvB,OAAOa,OAAOU;IACpBC,aAAaxB,OAAOa,OAAOW;IAC3BC,SAASzB,OAAOa,OAAOY;IACvBC,WAAW1B,OAAOa,OAAOa;GAC7B;GACAZ,SAASd,OAAOc;GAChBE,sBAAsBhB,OAAOgB;GAE7B,IAAIhB,OAAOa,OAAOE,OACdA,QAAQ;IACJO,IAAItB,OAAOa,OAAOE,MAAMO;IACxBC,MAAMvB,OAAOa,OAAOE,MAAMQ;IAC1BC,aAAaxB,OAAOa,OAAOE,MAAMS;GACrC;GAGJZ,cAAcZ,OAAOmB;EACzB,SAASV,GAAG;GACR,MAAMkB,aAAa9C,cAAc4B,CAAAA;GACjCQ,QAAQ;IACJ,GAAGU;IACHC,SAASD,WAAWC;GACxB;EACJ;EAMA,IAAI,CAACX;OACa7C,gBAAgB2B,KAC1B8B,CAAAA,CAAMZ,UAAU3C,gBAAgBoC,eAAe;IAC/C,MAAMiB,aAAa9C,cAAcR,wBAAwByD,UAAS,CAAA;IAClEb,QAAQ;KACJ,GAAGU;KACHC,SAASD,WAAWC;IACxB;GACJ;;EAMJ,MAAMG,aAAa,IAAI5D,IAAI4B,MAAMiC,QAAQ9B,GAAG;EAE5C,OAAOxB,aAAaqB,OAAO;GACvBG,KAAK;GACL+B,SAAS;IACLC,QAAQ,EAAEC,SAAS,KAAKpD,QAAQoD,QAAQ;IACxChB,MAAM;KACFP;KACAK;KACAJ;KACAC;KACAC;KACAC;KACAoB,UAAU,KAAKrD,QAAQqD;KACvBC,aAAa,GAAGN,WAAWO,WAAWP,WAAWQ;IACrD;GACJ;EACJ,CAAA;CACJ;AACJ;;YAlIgB/D,2BAAAA,CAAAA"}
+{"version":3,"file":"module.mjs","names":["DContext","DController","DGet","DPost","URL","useRequestQuery","OAuth2AccessDeniedError","OAuth2ErrorCode","isOAuth2AccessDeniedError","ForceUserLoggedInMiddleware","HTTPOAuth2Authorizer","renderUIPage","readFromLocations","OAuth2AuthorizationCodeRequestValidator","sanitizeError","AuthorizeController","options","codeRequestVerifier","codeRequestValidator","authorizer","ctx","codeIssuer","sessionManager","eventService","metrics","promptLoginMaxAge","mfaFreshnessMaxAge","mfaChallengeProvider","accessPolicyEvaluator","consentService","logger","confirm","event","result","authorizeWithRequest","url","redirectUri","state","searchParams","set","authorizationCode","href","e","ACCESS_DENIED","serve","codeRequest","client","scopes","realm","redirectUriVerified","error","merged","data","run","verify","id","name","displayName","builtIn","createdAt","normalized","message","query","forClient","requestURL","request","payload","config","baseURL","features","requestPath","pathname","search"],"sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPost,\n} from '@routup/decorators';\nimport { URL } from 'node:url';\n\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type {\n    Client,\n    OAuth2AuthorizationCodeRequest,\n    Realm,\n    Scope,\n} from '@authup/core-kit';\nimport { OAuth2AccessDeniedError, OAuth2ErrorCode, isOAuth2AccessDeniedError } from '@authup/specs';\nimport { ForceUserLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { HTTPOAuth2Authorizer } from '../../../adapters/index.ts';\nimport { renderUIPage } from '../../../ui/index.ts';\nimport { readFromLocations } from '../../../request/index.ts';\nimport type { IOAuth2AuthorizationCodeRequestVerifier } from '../../../../../core/index.ts';\nimport { OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';\nimport type { AuthorizeControllerContext, AuthorizeControllerOptions } from './types.ts';\nimport { sanitizeError } from '../../../../../utils/index.ts';\n\ntype RealmSummary = Pick<Realm, 'id' | 'name' | 'displayName'>;\ntype ClientSummary = Pick<Client, 'id' | 'name' | 'displayName' | 'builtIn' | 'createdAt'>;\n\n@DController('/authorize')\nexport class AuthorizeController {\n    // todo: maybe /realms/<realm>/protocol/openid-connect/authorize\n    // todo: maybe /realms/<realm>/[...]/authorize\n\n    protected options: AuthorizeControllerOptions;\n\n    protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n    protected codeRequestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n    protected authorizer: HTTPOAuth2Authorizer;\n\n    // ---------------------------------------------------------\n\n    constructor(ctx: AuthorizeControllerContext) {\n        this.options = ctx.options;\n\n        this.codeRequestVerifier = ctx.codeRequestVerifier;\n\n        this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();\n\n        this.authorizer = new HTTPOAuth2Authorizer({\n            codeRequestVerifier: this.codeRequestVerifier,\n            codeIssuer: ctx.codeIssuer,\n            sessionManager: ctx.sessionManager,\n            eventService: ctx.eventService,\n            metrics: ctx.metrics,\n            promptLoginMaxAge: ctx.options.promptLoginMaxAge,\n            mfaFreshnessMaxAge: ctx.options.mfaFreshnessMaxAge,\n            mfaChallengeProvider: ctx.mfaChallengeProvider,\n            accessPolicyEvaluator: ctx.accessPolicyEvaluator,\n            consentService: ctx.consentService,\n            logger: ctx.logger,\n        });\n    }\n\n    // ---------------------------------------------------------\n\n    @DPost('', [ForceUserLoggedInMiddleware])\n    async confirm(@DContext() event: IAppEvent): Promise<{ url: string }> {\n        try {\n            const result = await this.authorizer.authorizeWithRequest(event);\n\n            const url = new URL(result.redirectUri);\n            if (result.state) {\n                url.searchParams.set('state', result.state);\n            }\n\n            if (result.authorizationCode) {\n                url.searchParams.set('code', result.authorizationCode);\n            }\n\n            return { url: url.href };\n        } catch (e) {\n            // Access-policy denial (plan 052): with a pattern-verified\n            // redirect_uri the denial is answered as an error redirect\n            // (RFC 6749 §4.1.2.1) — the kit navigates the returned url like\n            // any success. Unverified → rethrow → 400 body → interactive\n            // denial card.\n            if (isOAuth2AccessDeniedError(e) && e.redirectUri) {\n                const url = new URL(e.redirectUri);\n                url.searchParams.set('error', OAuth2ErrorCode.ACCESS_DENIED);\n                if (e.state) {\n                    url.searchParams.set('state', e.state);\n                }\n\n                return { url: url.href };\n            }\n\n            throw e;\n        }\n    }\n\n    @DGet('', [])\n    async serve(@DContext() event: IAppEvent): Promise<string> {\n        let codeRequest : OAuth2AuthorizationCodeRequest | undefined;\n\n        let client : ClientSummary | undefined;\n        let scopes : Scope[] | undefined;\n\n        // Target realm summary (the client's realm) — the UI names it in the\n        // realm-mismatch notice. codeRequest.realm_id is only the id.\n        let realm : RealmSummary | undefined;\n\n        // Whether the request redirect_uri matched a registered client pattern —\n        // the UI must not offer an automatic \"return to application\" redirect to\n        // an unverified (pattern-less-client) redirect_uri.\n        let redirectUriVerified = false;\n\n        let error : Error | undefined;\n\n        try {\n            const merged = await readFromLocations(event, ['body', 'query']);\n            const data = await this.codeRequestValidator.run(merged);\n\n            const result = await this.codeRequestVerifier.verify(data);\n\n            // Trim the client to a deliberate DTO before it reaches the\n            // anonymous SSR hydration payload — never disclose redirect_uri\n            // patterns (the trusted-origin set), grant_types, internal\n            // base/root URLs, auth methods, or the secret storage flags to an\n            // unauthenticated visitor. (ClientEntity.secret is additionally\n            // select:false, so the secret is never loaded — but the DTO must not\n            // rely on that alone: a future entity/query change could unset it.)\n            client = {\n                id: result.client.id,\n                name: result.client.name,\n                displayName: result.client.displayName,\n                builtIn: result.client.builtIn,\n                createdAt: result.client.createdAt,\n            };\n            scopes = result.scopes;\n            redirectUriVerified = result.redirectUriVerified;\n\n            if (result.client.realm) {\n                realm = {\n                    id: result.client.realm.id,\n                    name: result.client.realm.name,\n                    displayName: result.client.realm.displayName,\n                };\n            }\n\n            codeRequest = result.data;\n        } catch (e) {\n            const normalized = sanitizeError(e);\n            error = {\n                ...normalized,\n                message: normalized.message,\n            };\n        }\n\n        // A recognized `error` query param (the federated-IdP callback\n        // redirects back here with error=access_denied on a policy denial)\n        // is mapped onto the hydration payload's error — neutral message,\n        // never attacker-controlled text.\n        if (!error) {\n            const query = useRequestQuery(event);\n            if (query.error === OAuth2ErrorCode.ACCESS_DENIED) {\n                const normalized = sanitizeError(OAuth2AccessDeniedError.forClient());\n                error = {\n                    ...normalized,\n                    message: normalized.message,\n                };\n            }\n        }\n\n        // Path + query of the original request — the SSR page uses it as\n        // the same-origin `redirect` parameter on register / password links\n        // so those pages can lead back into this authorize request.\n        const requestURL = new URL(event.request.url);\n\n        return renderUIPage(event, {\n            url: '/authorize',\n            payload: {\n                config: { baseURL: this.options.baseURL },\n                data: {\n                    codeRequest,\n                    error,\n                    client,\n                    scopes,\n                    realm,\n                    redirectUriVerified,\n                    features: this.options.features,\n                    requestPath: `${requestURL.pathname}${requestURL.search}`,\n                },\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,IAAae,sBAAb,MAAaA;CAICC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAiC;EACzC,KAAKJ,UAAUI,IAAIJ;EAEnB,KAAKC,sBAAsBG,IAAIH;EAE/B,KAAKC,uBAAuB,IAAIL,wCAAAA;EAEhC,KAAKM,aAAa,IAAIT,qBAAqB;GACvCO,qBAAqB,KAAKA;GAC1BI,YAAYD,IAAIC;GAChBC,gBAAgBF,IAAIE;GACpBC,cAAcH,IAAIG;GAClBC,SAASJ,IAAII;GACbC,mBAAmBL,IAAIJ,QAAQS;GAC/BC,oBAAoBN,IAAIJ,QAAQU;GAChCC,sBAAsBP,IAAIO;GAC1BC,uBAAuBR,IAAIQ;GAC3BC,gBAAgBT,IAAIS;GACpBC,QAAQV,IAAIU;EAChB,CAAA;CACJ;CAIA,MACMC,QAAQ,OAAwD;EAClE,IAAI;GACA,MAAME,SAAS,MAAM,KAAKd,WAAWe,qBAAqBF,KAAAA;GAE1D,MAAMG,MAAM,IAAI/B,IAAI6B,OAAOG,WAAW;GACtC,IAAIH,OAAOI,OACPF,IAAIG,aAAaC,IAAI,SAASN,OAAOI,KAAK;GAG9C,IAAIJ,OAAOO,mBACPL,IAAIG,aAAaC,IAAI,QAAQN,OAAOO,iBAAiB;GAGzD,OAAO,EAAEL,KAAKA,IAAIM,KAAK;EAC3B,SAASC,GAAG;GAMR,IAAIlC,0BAA0BkC,CAAAA,KAAMA,EAAEN,aAAa;IAC/C,MAAMD,MAAM,IAAI/B,IAAIsC,EAAEN,WAAW;IACjCD,IAAIG,aAAaC,IAAI,SAAShC,gBAAgBoC,aAAa;IAC3D,IAAID,EAAEL,OACFF,IAAIG,aAAaC,IAAI,SAASG,EAAEL,KAAK;IAGzC,OAAO,EAAEF,KAAKA,IAAIM,KAAK;GAC3B;GAEA,MAAMC;EACV;CACJ;CAEA,MACME,MAAM,OAA+C;EACvD,IAAIC;EAEJ,IAAIC;EACJ,IAAIC;EAIJ,IAAIC;EAKJ,IAAIC,sBAAsB;EAE1B,IAAIC;EAEJ,IAAI;GACA,MAAMC,SAAS,MAAMvC,kBAAkBoB,OAAO,CAAC,QAAQ,OAAQ,CAAA;GAC/D,MAAMoB,OAAO,MAAM,KAAKlC,qBAAqBmC,IAAIF,MAAAA;GAEjD,MAAMlB,SAAS,MAAM,KAAKhB,oBAAoBqC,OAAOF,IAAAA;GASrDN,SAAS;IACLS,IAAItB,OAAOa,OAAOS;IAClBC,MAAMvB,OAAOa,OAAOU;IACpBC,aAAaxB,OAAOa,OAAOW;IAC3BC,SAASzB,OAAOa,OAAOY;IACvBC,WAAW1B,OAAOa,OAAOa;GAC7B;GACAZ,SAASd,OAAOc;GAChBE,sBAAsBhB,OAAOgB;GAE7B,IAAIhB,OAAOa,OAAOE,OACdA,QAAQ;IACJO,IAAItB,OAAOa,OAAOE,MAAMO;IACxBC,MAAMvB,OAAOa,OAAOE,MAAMQ;IAC1BC,aAAaxB,OAAOa,OAAOE,MAAMS;GACrC;GAGJZ,cAAcZ,OAAOmB;EACzB,SAASV,GAAG;GACR,MAAMkB,aAAa9C,cAAc4B,CAAAA;GACjCQ,QAAQ;IACJ,GAAGU;IACHC,SAASD,WAAWC;GACxB;EACJ;EAMA,IAAI,CAACX,OACa7C;OAAAA,gBAAgB2B,KAC1B8B,CAAAA,CAAMZ,UAAU3C,gBAAgBoC,eAAe;IAC/C,MAAMiB,aAAa9C,cAAcR,wBAAwByD,UAAS,CAAA;IAClEb,QAAQ;KACJ,GAAGU;KACHC,SAASD,WAAWC;IACxB;GACJ;;EAMJ,MAAMG,aAAa,IAAI5D,IAAI4B,MAAMiC,QAAQ9B,GAAG;EAE5C,OAAOxB,aAAaqB,OAAO;GACvBG,KAAK;GACL+B,SAAS;IACLC,QAAQ,EAAEC,SAAS,KAAKpD,QAAQoD,QAAQ;IACxChB,MAAM;KACFP;KACAK;KACAJ;KACAC;KACAC;KACAC;KACAoB,UAAU,KAAKrD,QAAQqD;KACvBC,aAAa,GAAGN,WAAWO,WAAWP,WAAWQ;IACrD;GACJ;EACJ,CAAA;CACJ;AACJ;;CAlIgB/D,MAAAA,IAAAA,CAAAA,2BAAAA,CAAAA"}

package/dist/adapters/http/controllers/workflows/jwks/handlers/read.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"read.mjs","names":["KeyStatus","AsymmetricKey","JWKError","JWKType","JWKUse","In","buildCertificateJwkFields","getJwksRouteHandler","repository","realmId","entities","find","where","type","RSA","EC","use","SIGNATURE","status","ACTIVE","PASSIVE","order","priority","promises","filter","entity","encryptionKey","signatureAlgorithm","map","fromBase64","format","key","options","buildImportOptionsForJWTAlgorithm","then","container","toJWK","certificateFields","certificate","kid","id","alg","keys","Promise","all","getJwkRouteHandler","keyId","findOne","notFound","encryptionKeyMissing","jsonWebKey"],"sources":["../../../../../../../src/adapters/http/controllers/workflows/jwks/handlers/read.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { KeyStatus } from '@authup/core-kit';\nimport { AsymmetricKey } from '@authup/server-kit';\nimport type { JWTAlgorithm, OAuth2JsonWebKey } from '@authup/specs';\nimport { JWKError, JWKType, JWKUse } from '@authup/specs';\nimport type { Repository } from 'typeorm';\nimport { In } from 'typeorm';\nimport type { KeyEntity } from '../../../../../database/domains/index.ts';\nimport { buildCertificateJwkFields } from '../../../../../../core/index.ts';\n\nexport async function getJwksRouteHandler(\n    repository: Repository<KeyEntity>,\n    realmId?: string,\n) : Promise<{ keys: OAuth2JsonWebKey[] }> {\n    const entities = await repository.find({\n        where: {\n            type: In([JWKType.RSA, JWKType.EC]),\n            use: JWKUse.SIGNATURE,\n            // active + passive verify; disabled keys never publish.\n            status: In([KeyStatus.ACTIVE, KeyStatus.PASSIVE]),\n            ...(realmId ? { realmId } : {}),\n        },\n        order: { priority: 'DESC' },\n    });\n\n    const promises = entities\n        .filter(\n            (entity): entity is KeyEntity & { encryptionKey: string, signatureAlgorithm: `${JWTAlgorithm}` } => !!entity.encryptionKey &&\n                !!entity.signatureAlgorithm,\n        )\n        .map(\n            (entity) => AsymmetricKey\n                .fromBase64({\n                    format: 'spki',\n                    key: entity.encryptionKey,\n                    options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signatureAlgorithm),\n                })\n                .then((container) => container.toJWK())\n                .then(async (key) => {\n                    const certificateFields = await buildCertificateJwkFields(entity.certificate);\n\n                    return {\n                        ...key,\n                        kid: entity.id,\n                        alg: entity.signatureAlgorithm,\n                        ...certificateFields,\n                    };\n                }),\n        );\n\n    const keys = await Promise.all(promises);\n\n    return { keys };\n}\n\nexport async function getJwkRouteHandler(\n    repository: Repository<KeyEntity>,\n    keyId: string,\n    realmId?: string,\n) : Promise<OAuth2JsonWebKey> {\n    const entity = await repository.findOne({\n        where: {\n            type: In([JWKType.RSA, JWKType.EC]),\n            use: JWKUse.SIGNATURE,\n            status: In([KeyStatus.ACTIVE, KeyStatus.PASSIVE]),\n            id: keyId,\n            ...(realmId ? { realmId } : {}),\n        },\n    });\n\n    if (!entity) {\n        throw JWKError.notFound(keyId);\n    }\n\n    if (!entity.encryptionKey || !entity.signatureAlgorithm) {\n        throw JWKError.encryptionKeyMissing();\n    }\n\n    const container = await AsymmetricKey\n        .fromBase64({\n            format: 'spki',\n            key: entity.encryptionKey,\n            options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signatureAlgorithm),\n        });\n\n    const jsonWebKey = await container.toJWK();\n    const certificateFields = await buildCertificateJwkFields(entity.certificate);\n\n    return {\n        ...jsonWebKey,\n        kid: entity.id,\n        alg: entity.signatureAlgorithm,\n        ...certificateFields,\n    };\n}\n"],"mappings":";;;;;;;;;;AAgBA,eAAsBO,oBAClBC,YACAC,SAAgB;CAahB,MAAMc,YAAWb,MAXMF,WAAWG,KAAK;EACnCC,OAAO;GACHC,MAAMR,GAAG,CAACF,QAAQW,KAAKX,QAAQY,EAAAA,CAAG;GAClCC,KAAKZ,OAAOa;GAEZC,QAAQb,GAAG,CAACL,UAAUmB,QAAQnB,UAAUoB,OAAAA,CAAQ;GAChD,GAAIX,UAAU,EAAEA,QAAQ,IAAI,CAAC;EACjC;EACAY,OAAO,EAAEC,UAAU,OAAO;CAC9B,CAAA,EAAA,CAGKE,QACIC,WAAmG,CAAC,CAACA,OAAOC,iBACzG,CAAC,CAACD,OAAOE,kBAAkB,CAAA,CAElCC,KACIH,WAAWxB,cACP4B,WAAW;EACRC,QAAQ;EACRC,KAAKN,OAAOC;EACZM,SAAS/B,cAAcgC,kCAAkCR,OAAOE,kBAAkB;CACtF,CAAA,CAAA,CACCO,MAAMC,cAAcA,UAAUC,MAAK,CAAA,CAAA,CACnCF,KAAK,OAAOH,QAAAA;EACT,MAAMM,oBAAoB,MAAM/B,0BAA0BmB,OAAOa,WAAW;EAE5E,OAAO;GACH,GAAGP;GACHQ,KAAKd,OAAOe;GACZC,KAAKhB,OAAOE;GACZ,GAAGU;EACP;CACJ,CAAA,CAAA;CAKZ,OAAO,EAAEK,MAAAA,MAFUC,QAAQC,IAAIrB,QAAAA,EAEjB;AAClB;AAEA,eAAsBsB,mBAClBrC,YACAsC,OACArC,SAAgB;CAEhB,MAAMgB,SAAS,MAAMjB,WAAWuC,QAAQ,EACpCnC,OAAO;EACHC,MAAMR,GAAG,CAACF,QAAQW,KAAKX,QAAQY,EAAAA,CAAG;EAClCC,KAAKZ,OAAOa;EACZC,QAAQb,GAAG,CAACL,UAAUmB,QAAQnB,UAAUoB,OAAAA,CAAQ;EAChDoB,IAAIM;EACJ,GAAIrC,UAAU,EAAEA,QAAQ,IAAI,CAAC;CACjC,EACJ,CAAA;CAEA,IAAI,CAACgB,QACD,MAAMvB,SAAS8C,SAASF,KAAAA;CAG5B,IAAI,CAACrB,OAAOC,iBAAiB,CAACD,OAAOE,oBACjC,MAAMzB,SAAS+C,qBAAoB;CAUvC,MAAMC,aAAa,OAAMf,MAPDlC,cACnB4B,WAAW;EACRC,QAAQ;EACRC,KAAKN,OAAOC;EACZM,SAAS/B,cAAcgC,kCAAkCR,OAAOE,kBAAkB;CACtF,CAAA,EAAA,CAE+BS,MAAK;CACxC,MAAMC,oBAAoB,MAAM/B,0BAA0BmB,OAAOa,WAAW;CAE5E,OAAO;EACH,GAAGY;EACHX,KAAKd,OAAOe;EACZC,KAAKhB,OAAOE;EACZ,GAAGU;CACP;AACJ"}
+{"version":3,"file":"read.mjs","names":["KeyStatus","AsymmetricKey","JWKError","JWKType","JWKUse","In","buildCertificateJwkFields","getJwksRouteHandler","repository","realmId","entities","find","where","type","RSA","EC","use","SIGNATURE","status","ACTIVE","PASSIVE","order","priority","promises","filter","entity","encryptionKey","signatureAlgorithm","map","fromBase64","format","key","options","buildImportOptionsForJWTAlgorithm","then","container","toJWK","certificateFields","certificate","kid","id","alg","keys","Promise","all","getJwkRouteHandler","keyId","findOne","notFound","encryptionKeyMissing","jsonWebKey"],"sources":["../../../../../../../src/adapters/http/controllers/workflows/jwks/handlers/read.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { KeyStatus } from '@authup/core-kit';\nimport { AsymmetricKey } from '@authup/server-kit';\nimport type { JWTAlgorithm, OAuth2JsonWebKey } from '@authup/specs';\nimport { JWKError, JWKType, JWKUse } from '@authup/specs';\nimport type { Repository } from 'typeorm';\nimport { In } from 'typeorm';\nimport type { KeyEntity } from '../../../../../database/domains/index.ts';\nimport { buildCertificateJwkFields } from '../../../../../../core/index.ts';\n\nexport async function getJwksRouteHandler(\n    repository: Repository<KeyEntity>,\n    realmId?: string,\n) : Promise<{ keys: OAuth2JsonWebKey[] }> {\n    const entities = await repository.find({\n        where: {\n            type: In([JWKType.RSA, JWKType.EC]),\n            use: JWKUse.SIGNATURE,\n            // active + passive verify; disabled keys never publish.\n            status: In([KeyStatus.ACTIVE, KeyStatus.PASSIVE]),\n            ...(realmId ? { realmId } : {}),\n        },\n        order: { priority: 'DESC' },\n    });\n\n    const promises = entities\n        .filter(\n            (entity): entity is KeyEntity & { encryptionKey: string, signatureAlgorithm: `${JWTAlgorithm}` } => !!entity.encryptionKey &&\n                !!entity.signatureAlgorithm,\n        )\n        .map(\n            (entity) => AsymmetricKey\n                .fromBase64({\n                    format: 'spki',\n                    key: entity.encryptionKey,\n                    options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signatureAlgorithm),\n                })\n                .then((container) => container.toJWK())\n                .then(async (key) => {\n                    const certificateFields = await buildCertificateJwkFields(entity.certificate);\n\n                    return {\n                        ...key,\n                        kid: entity.id,\n                        alg: entity.signatureAlgorithm,\n                        ...certificateFields,\n                    };\n                }),\n        );\n\n    const keys = await Promise.all(promises);\n\n    return { keys };\n}\n\nexport async function getJwkRouteHandler(\n    repository: Repository<KeyEntity>,\n    keyId: string,\n    realmId?: string,\n) : Promise<OAuth2JsonWebKey> {\n    const entity = await repository.findOne({\n        where: {\n            type: In([JWKType.RSA, JWKType.EC]),\n            use: JWKUse.SIGNATURE,\n            status: In([KeyStatus.ACTIVE, KeyStatus.PASSIVE]),\n            id: keyId,\n            ...(realmId ? { realmId } : {}),\n        },\n    });\n\n    if (!entity) {\n        throw JWKError.notFound(keyId);\n    }\n\n    if (!entity.encryptionKey || !entity.signatureAlgorithm) {\n        throw JWKError.encryptionKeyMissing();\n    }\n\n    const container = await AsymmetricKey\n        .fromBase64({\n            format: 'spki',\n            key: entity.encryptionKey,\n            options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signatureAlgorithm),\n        });\n\n    const jsonWebKey = await container.toJWK();\n    const certificateFields = await buildCertificateJwkFields(entity.certificate);\n\n    return {\n        ...jsonWebKey,\n        kid: entity.id,\n        alg: entity.signatureAlgorithm,\n        ...certificateFields,\n    };\n}\n"],"mappings":";;;;;;;;;;AAgBA,eAAsBO,oBAClBC,YACAC,SAAgB;CAahB,MAAMc,YAAWb,MAXMF,WAAWG,KAAK;EACnCC,OAAO;GACHC,MAAMR,GAAG,CAACF,QAAQW,KAAKX,QAAQY,EAAG,CAAA;GAClCC,KAAKZ,OAAOa;GAEZC,QAAQb,GAAG,CAACL,UAAUmB,QAAQnB,UAAUoB,OAAQ,CAAA;GAChD,GAAIX,UAAU,EAAEA,QAAQ,IAAI,CAAC;EACjC;EACAY,OAAO,EAAEC,UAAU,OAAO;CAC9B,CAAA,EAAA,CAGKE,QACIC,WAAmG,CAAC,CAACA,OAAOC,iBACzG,CAAC,CAACD,OAAOE,kBAAkB,CAAA,CAElCC,KACIH,WAAWxB,cACP4B,WAAW;EACRC,QAAQ;EACRC,KAAKN,OAAOC;EACZM,SAAS/B,cAAcgC,kCAAkCR,OAAOE,kBAAkB;CACtF,CAAA,CAAA,CACCO,MAAMC,cAAcA,UAAUC,MAAK,CAAA,CAAA,CACnCF,KAAK,OAAOH,QAAAA;EACT,MAAMM,oBAAoB,MAAM/B,0BAA0BmB,OAAOa,WAAW;EAE5E,OAAO;GACH,GAAGP;GACHQ,KAAKd,OAAOe;GACZC,KAAKhB,OAAOE;GACZ,GAAGU;EACP;CACJ,CAAA,CAAA;CAKZ,OAAO,EAAEK,MAAAA,MAFUC,QAAQC,IAAIrB,QAAAA,EAEjB;AAClB;AAEA,eAAsBsB,mBAClBrC,YACAsC,OACArC,SAAgB;CAEhB,MAAMgB,SAAS,MAAMjB,WAAWuC,QAAQ,EACpCnC,OAAO;EACHC,MAAMR,GAAG,CAACF,QAAQW,KAAKX,QAAQY,EAAG,CAAA;EAClCC,KAAKZ,OAAOa;EACZC,QAAQb,GAAG,CAACL,UAAUmB,QAAQnB,UAAUoB,OAAQ,CAAA;EAChDoB,IAAIM;EACJ,GAAIrC,UAAU,EAAEA,QAAQ,IAAI,CAAC;CACjC,EACJ,CAAA;CAEA,IAAI,CAACgB,QACD,MAAMvB,SAAS8C,SAASF,KAAAA;CAG5B,IAAI,CAACrB,OAAOC,iBAAiB,CAACD,OAAOE,oBACjC,MAAMzB,SAAS+C,qBAAoB;CAUvC,MAAMC,aAAa,OAAMf,MAPDlC,cACnB4B,WAAW;EACRC,QAAQ;EACRC,KAAKN,OAAOC;EACZM,SAAS/B,cAAcgC,kCAAkCR,OAAOE,kBAAkB;CACtF,CAAA,EAAA,CAE+BS,MAAK;CACxC,MAAMC,oBAAoB,MAAM/B,0BAA0BmB,OAAOa,WAAW;CAE5E,OAAO;EACH,GAAGY;EACHX,KAAKd,OAAOe;EACZC,KAAKhB,OAAOE;EACZ,GAAGU;CACP;AACJ"}

package/dist/adapters/http/controllers/workflows/jwks/module.mjs

@@ -17,8 +17,8 @@ function _ts_decorate(decorators, target, key, desc) {
 	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
 	return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-function _ts_metadata(k, v) {
-	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+function _ts_metadata(metadataKey, metadataValue) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(metadataKey, metadataValue);
 }
 function _ts_param(paramIndex, decorator) {
 	return function(target, key) {

package/dist/adapters/http/controllers/workflows/jwks/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["KeyStatus","JWKError","JWKType","JWKUse","AsymmetricKey","DContext","DController","DGet","DPath","In","buildCertificateJwkFields","getRequestStringParam","JwkController","repository","ctx","getManyJwks","event","realmId","entities","find","where","type","RSA","EC","use","SIGNATURE","status","ACTIVE","PASSIVE","order","priority","promises","filter","entity","encryptionKey","signatureAlgorithm","map","fromBase64","format","key","options","buildImportOptionsForJWTAlgorithm","then","container","toJWK","certificateFields","certificate","kid","id","alg","keys","Promise","all","getOneJwks","findOne","notFound","encryptionKeyMissing","jsonWebKey"],"sources":["../../../../../../src/adapters/http/controllers/workflows/jwks/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { KeyStatus } from '@authup/core-kit';\nimport type { JWTAlgorithm, OAuth2JsonWebKey } from '@authup/specs';\nimport { JWKError, JWKType, JWKUse } from '@authup/specs';\nimport { AsymmetricKey } from '@authup/server-kit';\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPath,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport type { Repository } from 'typeorm';\nimport { In } from 'typeorm';\nimport type { KeyEntity } from '../../../../database/domains/index.ts';\nimport { buildCertificateJwkFields } from '../../../../../core/index.ts';\nimport { getRequestStringParam } from '../../../request/index.ts';\n\nexport type JwkControllerContext = {\n    repository: Repository<KeyEntity>\n};\n\n@DController('')\nexport class JwkController {\n    protected repository: Repository<KeyEntity>;\n\n    constructor(ctx: JwkControllerContext) {\n        this.repository = ctx.repository;\n    }\n\n    @DGet('/jwks', [])\n    async getManyJwks(\n        @DContext() event: IAppEvent,\n    ): Promise<{ keys: OAuth2JsonWebKey[] }> {\n        const realmId = getRequestStringParam(event, 'realmId');\n\n        const entities = await this.repository.find({\n            where: {\n                type: In([JWKType.RSA, JWKType.EC]),\n                use: JWKUse.SIGNATURE,\n                // active + passive verify; disabled keys never publish.\n                status: In([KeyStatus.ACTIVE, KeyStatus.PASSIVE]),\n                ...(realmId ? { realmId } : {}),\n            },\n            order: { priority: 'DESC' },\n        });\n\n        const promises = entities\n            .filter(\n                (entity): entity is KeyEntity & { encryptionKey: string, signatureAlgorithm: `${JWTAlgorithm}` } => !!entity.encryptionKey &&\n                    !!entity.signatureAlgorithm,\n            )\n            .map(\n                (entity) => AsymmetricKey\n                    .fromBase64({\n                        format: 'spki',\n                        key: entity.encryptionKey,\n                        options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signatureAlgorithm),\n                    })\n                    .then((container) => container.toJWK())\n                    .then(async (key) => {\n                        const certificateFields = await buildCertificateJwkFields(entity.certificate);\n\n                        return {\n                            ...key,\n                            kid: entity.id,\n                            alg: entity.signatureAlgorithm,\n                            ...certificateFields,\n                        };\n                    }),\n            );\n\n        const keys = await Promise.all(promises);\n\n        return { keys };\n    }\n\n    @DGet('/jwks/:id', [])\n    async getOneJwks(@DPath('id') id: string): Promise<OAuth2JsonWebKey> {\n        const entity = await this.repository.findOne({\n            where: {\n                type: In([JWKType.RSA, JWKType.EC]),\n                use: JWKUse.SIGNATURE,\n                status: In([KeyStatus.ACTIVE, KeyStatus.PASSIVE]),\n                id,\n            },\n        });\n\n        if (!entity) {\n            throw JWKError.notFound(id);\n        }\n\n        if (!entity.encryptionKey || !entity.signatureAlgorithm) {\n            throw JWKError.encryptionKeyMissing();\n        }\n\n        const container = await AsymmetricKey\n            .fromBase64({\n                format: 'spki',\n                key: entity.encryptionKey,\n                options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signatureAlgorithm),\n            });\n\n        const jsonWebKey = await container.toJWK();\n        const certificateFields = await buildCertificateJwkFields(entity.certificate);\n\n        return {\n            ...jsonWebKey,\n            kid: entity.id,\n            alg: entity.signatureAlgorithm,\n            ...certificateFields,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,IAAaY,gBAAb,MAAaA;CACCC;CAEV,YAAYC,KAA2B;EACnC,KAAKD,aAAaC,IAAID;CAC1B;CAEA,MACME,YACF,OACqC;EACrC,MAAME,UAAUN,sBAAsBK,OAAO,SAAA;EAa7C,MAAMe,YAAWb,MAXM,KAAKL,WAAWM,KAAK;GACxCC,OAAO;IACHC,MAAMZ,GAAG,CAACP,QAAQoB,KAAKpB,QAAQqB,EAAAA,CAAG;IAClCC,KAAKrB,OAAOsB;IAEZC,QAAQjB,GAAG,CAACT,UAAU2B,QAAQ3B,UAAU4B,OAAAA,CAAQ;IAChD,GAAIX,UAAU,EAAEA,QAAQ,IAAI,CAAC;GACjC;GACAY,OAAO,EAAEC,UAAU,OAAO;EAC9B,CAAA,EAAA,CAGKE,QACIC,WAAmG,CAAC,CAACA,OAAOC,iBACzG,CAAC,CAACD,OAAOE,kBAAkB,CAAA,CAElCC,KACIH,WAAW7B,cACPiC,WAAW;GACRC,QAAQ;GACRC,KAAKN,OAAOC;GACZM,SAASpC,cAAcqC,kCAAkCR,OAAOE,kBAAkB;EACtF,CAAA,CAAA,CACCO,MAAMC,cAAcA,UAAUC,MAAK,CAAA,CAAA,CACnCF,KAAK,OAAOH,QAAAA;GACT,MAAMM,oBAAoB,MAAMnC,0BAA0BuB,OAAOa,WAAW;GAE5E,OAAO;IACH,GAAGP;IACHQ,KAAKd,OAAOe;IACZC,KAAKhB,OAAOE;IACZ,GAAGU;GACP;EACJ,CAAA,CAAA;EAKZ,OAAO,EAAEK,MAAAA,MAFUC,QAAQC,IAAIrB,QAAAA,EAEjB;CAClB;CAEA,MACMsB,WAAW,IAAoD;EACjE,MAAMpB,SAAS,MAAM,KAAKpB,WAAWyC,QAAQ,EACzClC,OAAO;GACHC,MAAMZ,GAAG,CAACP,QAAQoB,KAAKpB,QAAQqB,EAAAA,CAAG;GAClCC,KAAKrB,OAAOsB;GACZC,QAAQjB,GAAG,CAACT,UAAU2B,QAAQ3B,UAAU4B,OAAAA,CAAQ;GAChDoB;EACJ,EACJ,CAAA;EAEA,IAAI,CAACf,QACD,MAAMhC,SAASsD,SAASP,EAAAA;EAG5B,IAAI,CAACf,OAAOC,iBAAiB,CAACD,OAAOE,oBACjC,MAAMlC,SAASuD,qBAAoB;EAUvC,MAAMC,aAAa,OAAMd,MAPDvC,cACnBiC,WAAW;GACRC,QAAQ;GACRC,KAAKN,OAAOC;GACZM,SAASpC,cAAcqC,kCAAkCR,OAAOE,kBAAkB;EACtF,CAAA,EAAA,CAE+BS,MAAK;EACxC,MAAMC,oBAAoB,MAAMnC,0BAA0BuB,OAAOa,WAAW;EAE5E,OAAO;GACH,GAAGW;GACHV,KAAKd,OAAOe;GACZC,KAAKhB,OAAOE;GACZ,GAAGU;EACP;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["KeyStatus","JWKError","JWKType","JWKUse","AsymmetricKey","DContext","DController","DGet","DPath","In","buildCertificateJwkFields","getRequestStringParam","JwkController","repository","ctx","getManyJwks","event","realmId","entities","find","where","type","RSA","EC","use","SIGNATURE","status","ACTIVE","PASSIVE","order","priority","promises","filter","entity","encryptionKey","signatureAlgorithm","map","fromBase64","format","key","options","buildImportOptionsForJWTAlgorithm","then","container","toJWK","certificateFields","certificate","kid","id","alg","keys","Promise","all","getOneJwks","findOne","notFound","encryptionKeyMissing","jsonWebKey"],"sources":["../../../../../../src/adapters/http/controllers/workflows/jwks/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { KeyStatus } from '@authup/core-kit';\nimport type { JWTAlgorithm, OAuth2JsonWebKey } from '@authup/specs';\nimport { JWKError, JWKType, JWKUse } from '@authup/specs';\nimport { AsymmetricKey } from '@authup/server-kit';\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPath,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport type { Repository } from 'typeorm';\nimport { In } from 'typeorm';\nimport type { KeyEntity } from '../../../../database/domains/index.ts';\nimport { buildCertificateJwkFields } from '../../../../../core/index.ts';\nimport { getRequestStringParam } from '../../../request/index.ts';\n\nexport type JwkControllerContext = {\n    repository: Repository<KeyEntity>\n};\n\n@DController('')\nexport class JwkController {\n    protected repository: Repository<KeyEntity>;\n\n    constructor(ctx: JwkControllerContext) {\n        this.repository = ctx.repository;\n    }\n\n    @DGet('/jwks', [])\n    async getManyJwks(\n        @DContext() event: IAppEvent,\n    ): Promise<{ keys: OAuth2JsonWebKey[] }> {\n        const realmId = getRequestStringParam(event, 'realmId');\n\n        const entities = await this.repository.find({\n            where: {\n                type: In([JWKType.RSA, JWKType.EC]),\n                use: JWKUse.SIGNATURE,\n                // active + passive verify; disabled keys never publish.\n                status: In([KeyStatus.ACTIVE, KeyStatus.PASSIVE]),\n                ...(realmId ? { realmId } : {}),\n            },\n            order: { priority: 'DESC' },\n        });\n\n        const promises = entities\n            .filter(\n                (entity): entity is KeyEntity & { encryptionKey: string, signatureAlgorithm: `${JWTAlgorithm}` } => !!entity.encryptionKey &&\n                    !!entity.signatureAlgorithm,\n            )\n            .map(\n                (entity) => AsymmetricKey\n                    .fromBase64({\n                        format: 'spki',\n                        key: entity.encryptionKey,\n                        options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signatureAlgorithm),\n                    })\n                    .then((container) => container.toJWK())\n                    .then(async (key) => {\n                        const certificateFields = await buildCertificateJwkFields(entity.certificate);\n\n                        return {\n                            ...key,\n                            kid: entity.id,\n                            alg: entity.signatureAlgorithm,\n                            ...certificateFields,\n                        };\n                    }),\n            );\n\n        const keys = await Promise.all(promises);\n\n        return { keys };\n    }\n\n    @DGet('/jwks/:id', [])\n    async getOneJwks(@DPath('id') id: string): Promise<OAuth2JsonWebKey> {\n        const entity = await this.repository.findOne({\n            where: {\n                type: In([JWKType.RSA, JWKType.EC]),\n                use: JWKUse.SIGNATURE,\n                status: In([KeyStatus.ACTIVE, KeyStatus.PASSIVE]),\n                id,\n            },\n        });\n\n        if (!entity) {\n            throw JWKError.notFound(id);\n        }\n\n        if (!entity.encryptionKey || !entity.signatureAlgorithm) {\n            throw JWKError.encryptionKeyMissing();\n        }\n\n        const container = await AsymmetricKey\n            .fromBase64({\n                format: 'spki',\n                key: entity.encryptionKey,\n                options: AsymmetricKey.buildImportOptionsForJWTAlgorithm(entity.signatureAlgorithm),\n            });\n\n        const jsonWebKey = await container.toJWK();\n        const certificateFields = await buildCertificateJwkFields(entity.certificate);\n\n        return {\n            ...jsonWebKey,\n            kid: entity.id,\n            alg: entity.signatureAlgorithm,\n            ...certificateFields,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,IAAaY,gBAAb,MAAaA;CACCC;CAEV,YAAYC,KAA2B;EACnC,KAAKD,aAAaC,IAAID;CAC1B;CAEA,MACME,YACF,OACqC;EACrC,MAAME,UAAUN,sBAAsBK,OAAO,SAAA;EAa7C,MAAMe,YAAWb,MAXM,KAAKL,WAAWM,KAAK;GACxCC,OAAO;IACHC,MAAMZ,GAAG,CAACP,QAAQoB,KAAKpB,QAAQqB,EAAG,CAAA;IAClCC,KAAKrB,OAAOsB;IAEZC,QAAQjB,GAAG,CAACT,UAAU2B,QAAQ3B,UAAU4B,OAAQ,CAAA;IAChD,GAAIX,UAAU,EAAEA,QAAQ,IAAI,CAAC;GACjC;GACAY,OAAO,EAAEC,UAAU,OAAO;EAC9B,CAAA,EAAA,CAGKE,QACIC,WAAmG,CAAC,CAACA,OAAOC,iBACzG,CAAC,CAACD,OAAOE,kBAAkB,CAAA,CAElCC,KACIH,WAAW7B,cACPiC,WAAW;GACRC,QAAQ;GACRC,KAAKN,OAAOC;GACZM,SAASpC,cAAcqC,kCAAkCR,OAAOE,kBAAkB;EACtF,CAAA,CAAA,CACCO,MAAMC,cAAcA,UAAUC,MAAK,CAAA,CAAA,CACnCF,KAAK,OAAOH,QAAAA;GACT,MAAMM,oBAAoB,MAAMnC,0BAA0BuB,OAAOa,WAAW;GAE5E,OAAO;IACH,GAAGP;IACHQ,KAAKd,OAAOe;IACZC,KAAKhB,OAAOE;IACZ,GAAGU;GACP;EACJ,CAAA,CAAA;EAKZ,OAAO,EAAEK,MAAAA,MAFUC,QAAQC,IAAIrB,QAAAA,EAEjB;CAClB;CAEA,MACMsB,WAAW,IAAoD;EACjE,MAAMpB,SAAS,MAAM,KAAKpB,WAAWyC,QAAQ,EACzClC,OAAO;GACHC,MAAMZ,GAAG,CAACP,QAAQoB,KAAKpB,QAAQqB,EAAG,CAAA;GAClCC,KAAKrB,OAAOsB;GACZC,QAAQjB,GAAG,CAACT,UAAU2B,QAAQ3B,UAAU4B,OAAQ,CAAA;GAChDoB;EACJ,EACJ,CAAA;EAEA,IAAI,CAACf,QACD,MAAMhC,SAASsD,SAASP,EAAAA;EAG5B,IAAI,CAACf,OAAOC,iBAAiB,CAACD,OAAOE,oBACjC,MAAMlC,SAASuD,qBAAoB;EAUvC,MAAMC,aAAa,OAAMd,MAPDvC,cACnBiC,WAAW;GACRC,QAAQ;GACRC,KAAKN,OAAOC;GACZM,SAASpC,cAAcqC,kCAAkCR,OAAOE,kBAAkB;EACtF,CAAA,EAAA,CAE+BS,MAAK;EACxC,MAAMC,oBAAoB,MAAMnC,0BAA0BuB,OAAOa,WAAW;EAE5E,OAAO;GACH,GAAGW;GACHV,KAAKd,OAAOe;GACZC,KAAKhB,OAAOE;GACZ,GAAGU;EACP;CACJ;AACJ"}

package/dist/adapters/http/controllers/workflows/logout/module.mjs

@@ -17,8 +17,8 @@ function _ts_decorate(decorators, target, key, desc) {
 	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
 	return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-function _ts_metadata(k, v) {
-	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+function _ts_metadata(metadataKey, metadataValue) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(metadataKey, metadataValue);
 }
 function _ts_param(paramIndex, decorator) {
 	return function(target, key) {

package/dist/adapters/http/controllers/workflows/logout/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["DContext","DController","DGet","DPost","URL","sendRedirect","OAuth2EndSessionRequestValidator","readFromLocations","renderUIPage","LogoutController","options","endSessionService","validator","ctx","serve","event","handle","execute","merged","data","run","result","verify","serverRevoked","hintVerified","sessionId","sub","subKind","revoke","redirect","redirectUri","url","state","searchParams","set","href","requestURL","request","payload","config","baseURL","client","clientName","name","undefined","hintSub","hintSubKind","requestPath","pathname","search"],"sources":["../../../../../../src/adapters/http/controllers/workflows/logout/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPost,\n} from '@routup/decorators';\nimport { URL } from 'node:url';\nimport type { IAppEvent } from 'routup';\nimport { sendRedirect } from 'routup';\nimport type { IOAuth2EndSessionService, OAuth2EndSessionRequest } from '../../../../../core/index.ts';\nimport { OAuth2EndSessionRequestValidator } from '../../../../../core/index.ts';\nimport { readFromLocations } from '../../../request/index.ts';\nimport { renderUIPage } from '../../../ui/index.ts';\nimport type { LogoutControllerContext, LogoutControllerOptions } from './types.ts';\n\n@DController('/logout')\nexport class LogoutController {\n    protected options: LogoutControllerOptions;\n\n    protected endSessionService: IOAuth2EndSessionService;\n\n    protected validator: OAuth2EndSessionRequestValidator;\n\n    constructor(ctx: LogoutControllerContext) {\n        this.options = ctx.options;\n        this.endSessionService = ctx.endSessionService;\n        this.validator = new OAuth2EndSessionRequestValidator();\n    }\n\n    @DGet('', [])\n    async serve(@DContext() event: IAppEvent): Promise<string | Response> {\n        return this.handle(event);\n    }\n\n    // OIDC RP-Initiated Logout allows form_post on the same endpoint.\n    @DPost('', [])\n    async execute(@DContext() event: IAppEvent): Promise<string | Response> {\n        return this.handle(event);\n    }\n\n    protected async handle(event: IAppEvent): Promise<string | Response> {\n        const merged = await readFromLocations(event, ['body', 'query']);\n\n        // Malformed input (oversized / duplicated params) must never dead-end\n        // the human behind the browser on a JSON error: fall back to a\n        // parameter-less confirm page — every attacker-controlled value is\n        // dropped, the click-gated sign-out keeps working.\n        let data: OAuth2EndSessionRequest;\n        try {\n            data = await this.validator.run(merged);\n        } catch {\n            data = {};\n        }\n\n        const result = await this.endSessionService.verify(data);\n\n        // A signature-verified id_token_hint proves possession — revoke the\n        // referenced session server-side immediately (only if it belongs to the\n        // hint's subject). Without a hint we mutate nothing; the SSR page's\n        // sign-out is a click-gated, bearer-authenticated action.\n        let serverRevoked = false;\n        if (result.hintVerified && result.sessionId && result.sub && result.subKind) {\n            serverRevoked = await this.endSessionService.revoke(\n                result.sessionId,\n                result.sub,\n                result.subKind,\n            );\n        }\n\n        // Build the validated post-logout redirect (the open-redirect guard\n        // lives in the service; `state` rides only alongside a validated uri).\n        let redirect: string | undefined;\n        if (result.redirectUri) {\n            const url = new URL(result.redirectUri);\n            if (result.state) {\n                url.searchParams.set('state', result.state);\n            }\n\n            redirect = url.href;\n        }\n\n        // Bounce straight back to the RP ONLY when the logout was actually\n        // performed server-side (a verified hint revoked the session). A\n        // hint-less or forged request MUST NOT silently redirect without ending\n        // the session — otherwise the RP treats a no-op round-trip as a\n        // successful logout while the authup session survives. Instead render\n        // the click-gated confirm page, which performs the bearer-authenticated\n        // sign-out and then redirects.\n        if (serverRevoked && redirect) {\n            return sendRedirect(event, redirect);\n        }\n\n        const requestURL = new URL(event.request.url);\n\n        return renderUIPage(event, {\n            url: '/logout',\n            payload: {\n                config: { baseURL: this.options.baseURL },\n                data: {\n                    client: result.clientName ? { name: result.clientName } : undefined,\n                    hintVerified: result.hintVerified,\n                    // never reflect an unverified hint's claims\n                    hintSub: result.hintVerified ? result.sub : undefined,\n                    hintSubKind: result.hintVerified ? result.subKind : undefined,\n                    serverRevoked,\n                    // the (already validated) uri to return to after a click-gated\n                    // sign-out; carries `state` when present\n                    redirect,\n                    requestPath: `${requestURL.pathname}${requestURL.search}`,\n                },\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAuBA,IAAaS,mBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA8B;EACtC,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,oBAAoBE,IAAIF;EAC7B,KAAKC,YAAY,IAAIN,iCAAAA;CACzB;CAEA,MACMQ,MAAM,OAA0D;EAClE,OAAO,KAAKE,OAAOD,KAAAA;CACvB;CAGA,MACME,QAAQ,OAA0D;EACpE,OAAO,KAAKD,OAAOD,KAAAA;CACvB;CAEA,MAAgBC,OAAOD,OAA8C;EACjE,MAAMG,SAAS,MAAMX,kBAAkBQ,OAAO,CAAC,QAAQ,OAAA,CAAQ;EAM/D,IAAII;EACJ,IAAI;GACAA,OAAO,MAAM,KAAKP,UAAUQ,IAAIF,MAAAA;EACpC,QAAQ;GACJC,OAAO,CAAC;EACZ;EAEA,MAAME,SAAS,MAAM,KAAKV,kBAAkBW,OAAOH,IAAAA;EAMnD,IAAII,gBAAgB;EACpB,IAAIF,OAAOG,gBAAgBH,OAAOI,aAAaJ,OAAOK,OAAOL,OAAOM,SAChEJ,gBAAgB,MAAM,KAAKZ,kBAAkBiB,OACzCP,OAAOI,WACPJ,OAAOK,KACPL,OAAOM,OAAO;EAMtB,IAAIE;EACJ,IAAIR,OAAOS,aAAa;GACpB,MAAMC,MAAM,IAAI3B,IAAIiB,OAAOS,WAAW;GACtC,IAAIT,OAAOW,OACPD,IAAIE,aAAaC,IAAI,SAASb,OAAOW,KAAK;GAG9CH,WAAWE,IAAII;EACnB;EASA,IAAIZ,iBAAiBM,UACjB,OAAOxB,aAAaU,OAAOc,QAAAA;EAG/B,MAAMO,aAAa,IAAIhC,IAAIW,MAAMsB,QAAQN,GAAG;EAE5C,OAAOvB,aAAaO,OAAO;GACvBgB,KAAK;GACLO,SAAS;IACLC,QAAQ,EAAEC,SAAS,KAAK9B,QAAQ8B,QAAQ;IACxCrB,MAAM;KACFsB,QAAQpB,OAAOqB,aAAa,EAAEC,MAAMtB,OAAOqB,WAAW,IAAIE,KAAAA;KAC1DpB,cAAcH,OAAOG;KAErBqB,SAASxB,OAAOG,eAAeH,OAAOK,MAAMkB,KAAAA;KAC5CE,aAAazB,OAAOG,eAAeH,OAAOM,UAAUiB,KAAAA;KACpDrB;KAGAM;KACAkB,aAAa,GAAGX,WAAWY,WAAWZ,WAAWa;IACrD;GACJ;EACJ,CAAA;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["DContext","DController","DGet","DPost","URL","sendRedirect","OAuth2EndSessionRequestValidator","readFromLocations","renderUIPage","LogoutController","options","endSessionService","validator","ctx","serve","event","handle","execute","merged","data","run","result","verify","serverRevoked","hintVerified","sessionId","sub","subKind","revoke","redirect","redirectUri","url","state","searchParams","set","href","requestURL","request","payload","config","baseURL","client","clientName","name","undefined","hintSub","hintSubKind","requestPath","pathname","search"],"sources":["../../../../../../src/adapters/http/controllers/workflows/logout/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPost,\n} from '@routup/decorators';\nimport { URL } from 'node:url';\nimport type { IAppEvent } from 'routup';\nimport { sendRedirect } from 'routup';\nimport type { IOAuth2EndSessionService, OAuth2EndSessionRequest } from '../../../../../core/index.ts';\nimport { OAuth2EndSessionRequestValidator } from '../../../../../core/index.ts';\nimport { readFromLocations } from '../../../request/index.ts';\nimport { renderUIPage } from '../../../ui/index.ts';\nimport type { LogoutControllerContext, LogoutControllerOptions } from './types.ts';\n\n@DController('/logout')\nexport class LogoutController {\n    protected options: LogoutControllerOptions;\n\n    protected endSessionService: IOAuth2EndSessionService;\n\n    protected validator: OAuth2EndSessionRequestValidator;\n\n    constructor(ctx: LogoutControllerContext) {\n        this.options = ctx.options;\n        this.endSessionService = ctx.endSessionService;\n        this.validator = new OAuth2EndSessionRequestValidator();\n    }\n\n    @DGet('', [])\n    async serve(@DContext() event: IAppEvent): Promise<string | Response> {\n        return this.handle(event);\n    }\n\n    // OIDC RP-Initiated Logout allows form_post on the same endpoint.\n    @DPost('', [])\n    async execute(@DContext() event: IAppEvent): Promise<string | Response> {\n        return this.handle(event);\n    }\n\n    protected async handle(event: IAppEvent): Promise<string | Response> {\n        const merged = await readFromLocations(event, ['body', 'query']);\n\n        // Malformed input (oversized / duplicated params) must never dead-end\n        // the human behind the browser on a JSON error: fall back to a\n        // parameter-less confirm page — every attacker-controlled value is\n        // dropped, the click-gated sign-out keeps working.\n        let data: OAuth2EndSessionRequest;\n        try {\n            data = await this.validator.run(merged);\n        } catch {\n            data = {};\n        }\n\n        const result = await this.endSessionService.verify(data);\n\n        // A signature-verified id_token_hint proves possession — revoke the\n        // referenced session server-side immediately (only if it belongs to the\n        // hint's subject). Without a hint we mutate nothing; the SSR page's\n        // sign-out is a click-gated, bearer-authenticated action.\n        let serverRevoked = false;\n        if (result.hintVerified && result.sessionId && result.sub && result.subKind) {\n            serverRevoked = await this.endSessionService.revoke(\n                result.sessionId,\n                result.sub,\n                result.subKind,\n            );\n        }\n\n        // Build the validated post-logout redirect (the open-redirect guard\n        // lives in the service; `state` rides only alongside a validated uri).\n        let redirect: string | undefined;\n        if (result.redirectUri) {\n            const url = new URL(result.redirectUri);\n            if (result.state) {\n                url.searchParams.set('state', result.state);\n            }\n\n            redirect = url.href;\n        }\n\n        // Bounce straight back to the RP ONLY when the logout was actually\n        // performed server-side (a verified hint revoked the session). A\n        // hint-less or forged request MUST NOT silently redirect without ending\n        // the session — otherwise the RP treats a no-op round-trip as a\n        // successful logout while the authup session survives. Instead render\n        // the click-gated confirm page, which performs the bearer-authenticated\n        // sign-out and then redirects.\n        if (serverRevoked && redirect) {\n            return sendRedirect(event, redirect);\n        }\n\n        const requestURL = new URL(event.request.url);\n\n        return renderUIPage(event, {\n            url: '/logout',\n            payload: {\n                config: { baseURL: this.options.baseURL },\n                data: {\n                    client: result.clientName ? { name: result.clientName } : undefined,\n                    hintVerified: result.hintVerified,\n                    // never reflect an unverified hint's claims\n                    hintSub: result.hintVerified ? result.sub : undefined,\n                    hintSubKind: result.hintVerified ? result.subKind : undefined,\n                    serverRevoked,\n                    // the (already validated) uri to return to after a click-gated\n                    // sign-out; carries `state` when present\n                    redirect,\n                    requestPath: `${requestURL.pathname}${requestURL.search}`,\n                },\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAuBA,IAAaS,mBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA8B;EACtC,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,oBAAoBE,IAAIF;EAC7B,KAAKC,YAAY,IAAIN,iCAAAA;CACzB;CAEA,MACMQ,MAAM,OAA0D;EAClE,OAAO,KAAKE,OAAOD,KAAAA;CACvB;CAGA,MACME,QAAQ,OAA0D;EACpE,OAAO,KAAKD,OAAOD,KAAAA;CACvB;CAEA,MAAgBC,OAAOD,OAA8C;EACjE,MAAMG,SAAS,MAAMX,kBAAkBQ,OAAO,CAAC,QAAQ,OAAQ,CAAA;EAM/D,IAAII;EACJ,IAAI;GACAA,OAAO,MAAM,KAAKP,UAAUQ,IAAIF,MAAAA;EACpC,QAAQ;GACJC,OAAO,CAAC;EACZ;EAEA,MAAME,SAAS,MAAM,KAAKV,kBAAkBW,OAAOH,IAAAA;EAMnD,IAAII,gBAAgB;EACpB,IAAIF,OAAOG,gBAAgBH,OAAOI,aAAaJ,OAAOK,OAAOL,OAAOM,SAChEJ,gBAAgB,MAAM,KAAKZ,kBAAkBiB,OACzCP,OAAOI,WACPJ,OAAOK,KACPL,OAAOM,OAAO;EAMtB,IAAIE;EACJ,IAAIR,OAAOS,aAAa;GACpB,MAAMC,MAAM,IAAI3B,IAAIiB,OAAOS,WAAW;GACtC,IAAIT,OAAOW,OACPD,IAAIE,aAAaC,IAAI,SAASb,OAAOW,KAAK;GAG9CH,WAAWE,IAAII;EACnB;EASA,IAAIZ,iBAAiBM,UACjB,OAAOxB,aAAaU,OAAOc,QAAAA;EAG/B,MAAMO,aAAa,IAAIhC,IAAIW,MAAMsB,QAAQN,GAAG;EAE5C,OAAOvB,aAAaO,OAAO;GACvBgB,KAAK;GACLO,SAAS;IACLC,QAAQ,EAAEC,SAAS,KAAK9B,QAAQ8B,QAAQ;IACxCrB,MAAM;KACFsB,QAAQpB,OAAOqB,aAAa,EAAEC,MAAMtB,OAAOqB,WAAW,IAAIE,KAAAA;KAC1DpB,cAAcH,OAAOG;KAErBqB,SAASxB,OAAOG,eAAeH,OAAOK,MAAMkB,KAAAA;KAC5CE,aAAazB,OAAOG,eAAeH,OAAOM,UAAUiB,KAAAA;KACpDrB;KAGAM;KACAkB,aAAa,GAAGX,WAAWY,WAAWZ,WAAWa;IACrD;GACJ;EACJ,CAAA;CACJ;AACJ"}

package/dist/adapters/http/controllers/workflows/openid/module.mjs

@@ -13,8 +13,8 @@ function _ts_decorate(decorators, target, key, desc) {
 	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
 	return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-function _ts_metadata(k, v) {
-	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+function _ts_metadata(metadataKey, metadataValue) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(metadataKey, metadataValue);
 }
 function _ts_param(paramIndex, decorator) {
 	return function(target, key) {

package/dist/adapters/http/controllers/workflows/password-forgot/module.mjs

@@ -13,8 +13,8 @@ function _ts_decorate(decorators, target, key, desc) {
 	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
 	return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-function _ts_metadata(k, v) {
-	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+function _ts_metadata(metadataKey, metadataValue) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(metadataKey, metadataValue);
 }
 function _ts_param(paramIndex, decorator) {
 	return function(target, key) {

package/dist/adapters/http/controllers/workflows/password-reset/module.mjs

@@ -11,8 +11,8 @@ function _ts_decorate(decorators, target, key, desc) {
 	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
 	return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-function _ts_metadata(k, v) {
-	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+function _ts_metadata(metadataKey, metadataValue) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(metadataKey, metadataValue);
 }
 function _ts_param(paramIndex, decorator) {
 	return function(target, key) {

package/dist/adapters/http/controllers/workflows/register/module.mjs

@@ -13,8 +13,8 @@ function _ts_decorate(decorators, target, key, desc) {
 	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
 	return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-function _ts_metadata(k, v) {
-	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+function _ts_metadata(metadataKey, metadataValue) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(metadataKey, metadataValue);
 }
 function _ts_param(paramIndex, decorator) {
 	return function(target, key) {

package/dist/adapters/http/controllers/workflows/status/module.mjs

@@ -12,8 +12,8 @@ function _ts_decorate(decorators, target, key, desc) {
 	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
 	return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-function _ts_metadata(k, v) {
-	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+function _ts_metadata(metadataKey, metadataValue) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(metadataKey, metadataValue);
 }
 var StatusController = class {
 	options;

package/dist/adapters/http/controllers/workflows/token/module.mjs

@@ -23,8 +23,8 @@ function _ts_decorate(decorators, target, key, desc) {
 	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
 	return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-function _ts_metadata(k, v) {
-	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+function _ts_metadata(metadataKey, metadataValue) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(metadataKey, metadataValue);
 }
 function _ts_param(paramIndex, decorator) {
 	return function(target, key) {

package/dist/adapters/http/controllers/workflows/token/utils/extract.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"extract.mjs","names":["ValidupError","buildErrorMessageForAttribute","defineIssueItem","isValidupError","readFromLocations","useRequestToken","TokenRequestValidator","extractTokenFromRequest","event","token","validator","data","run","e","path","message"],"sources":["../../../../../../../src/adapters/http/controllers/workflows/token/utils/extract.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IAppEvent } from 'routup';\nimport {\n    ValidupError, \n    buildErrorMessageForAttribute, \n    defineIssueItem, \n    isValidupError,\n} from 'validup';\nimport { readFromLocations, useRequestToken } from '../../../../request/index.ts';\nimport { TokenRequestValidator } from './validator.ts';\n\nexport async function extractTokenFromRequest(event: IAppEvent) : Promise<string> {\n    let token : string | undefined;\n\n    try {\n        const validator = new TokenRequestValidator();\n        const data = await validator.run(\n            await readFromLocations(event, ['body', 'query', 'params']),\n        );\n\n        token = data.token;\n    } catch (e) {\n        if (!isValidupError(e)) {\n            throw e;\n        }\n        token = useRequestToken(event);\n    }\n\n    if (!token) {\n        throw new ValidupError([\n            defineIssueItem({\n                path: ['token'],\n                message: buildErrorMessageForAttribute('token'),\n            }),\n        ]);\n    }\n\n    return token;\n}\n"],"mappings":";;;;;;;;;AAiBA,eAAsBO,wBAAwBC,OAAgB;CAC1D,IAAIC;CAEJ,IAAI;EAMAA,SAAQE,MAJWD,IADGJ,sBACHI,CAAAA,CAAUE,IACzB,MAAMR,kBAAkBI,OAAO;GAAC;GAAQ;GAAS;GAAS,CAAA,EAAA,CAGjDC;CACjB,SAASI,GAAG;EACR,IAAI,CAACV,eAAeU,CAAAA,GAChB,MAAMA;EAEVJ,QAAQJ,gBAAgBG,KAAAA;CAC5B;CAEA,IAAI,CAACC,OACD,MAAM,IAAIT,aAAa,CACnBE,gBAAgB;EACZY,MAAM,CAAC,OAAA;EACPC,SAASd,8BAA8B,OAAA;CAC3C,CAAA,CAAA,CACH;CAGL,OAAOQ;AACX"}
+{"version":3,"file":"extract.mjs","names":["ValidupError","buildErrorMessageForAttribute","defineIssueItem","isValidupError","readFromLocations","useRequestToken","TokenRequestValidator","extractTokenFromRequest","event","token","validator","data","run","e","path","message"],"sources":["../../../../../../../src/adapters/http/controllers/workflows/token/utils/extract.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IAppEvent } from 'routup';\nimport {\n    ValidupError, \n    buildErrorMessageForAttribute, \n    defineIssueItem, \n    isValidupError,\n} from 'validup';\nimport { readFromLocations, useRequestToken } from '../../../../request/index.ts';\nimport { TokenRequestValidator } from './validator.ts';\n\nexport async function extractTokenFromRequest(event: IAppEvent) : Promise<string> {\n    let token : string | undefined;\n\n    try {\n        const validator = new TokenRequestValidator();\n        const data = await validator.run(\n            await readFromLocations(event, ['body', 'query', 'params']),\n        );\n\n        token = data.token;\n    } catch (e) {\n        if (!isValidupError(e)) {\n            throw e;\n        }\n        token = useRequestToken(event);\n    }\n\n    if (!token) {\n        throw new ValidupError([\n            defineIssueItem({\n                path: ['token'],\n                message: buildErrorMessageForAttribute('token'),\n            }),\n        ]);\n    }\n\n    return token;\n}\n"],"mappings":";;;;;;;;;AAiBA,eAAsBO,wBAAwBC,OAAgB;CAC1D,IAAIC;CAEJ,IAAI;EAMAA,SAAQE,MAJWD,IADGJ,sBACHI,CAAAA,CAAUE,IACzB,MAAMR,kBAAkBI,OAAO;GAAC;GAAQ;GAAS;EAAS,CAAA,CAAA,EAAA,CAGjDC;CACjB,SAASI,GAAG;EACR,IAAI,CAACV,eAAeU,CAAAA,GAChB,MAAMA;EAEVJ,QAAQJ,gBAAgBG,KAAAA;CAC5B;CAEA,IAAI,CAACC,OACD,MAAM,IAAIT,aAAa,CACnBE,gBAAgB;EACZY,MAAM,CAAC,OAAQ;EACfC,SAASd,8BAA8B,OAAA;CAC3C,CAAA,CACH,CAAA;CAGL,OAAOQ;AACX"}

package/dist/adapters/http/middleware/built-in/authorization/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["PermissionEvaluator","IdentityType","ScopeName","AuthHeaderError","JWTError","OAuth2SubKind","OAuth2TokenKind","deserializeOAuth2Scope","AuthorizationHeaderType","parseAuthorizationHeader","ClientAuthenticator","PolicyEngine","UserAuthenticator","assertClientCertificateEvidenceValidForBinding","RequestIdentity","RequestPermissionEvaluator","extractClientCertificateEvidence","setRequestIdentity","setRequestMfaLoginTicket","setRequestPermissionEvaluator","setRequestScopes","setRequestSessionId","setRequestToken","AuthorizationMiddleware","options","oauth2TokenVerifier","permissionEvaluator","identityResolver","sessionManager","clientAuthenticator","userAuthenticator","ctx","provider","permissionProvider","policyEngine","identityPermissionProvider","realmId","clientId","run","event","requestAccessContext","headerValue","headers","get","header","type","BEARER","verifyBearerAuthorizationHeader","BASIC","verifyBasicAuthorizationHeader","unsupportedType","payload","verify","token","verifyCertificateBinding","kind","MFA","verifyMfaLoginTicket","ACCESS","payloadPropertyInvalid","realm_id","scope","session_id","session","findOneById","expired","ping","sub_kind","sub","identity","resolve","cnf","expectedThumbprint","length","invalid","evidence","certificateSource","thumbprint","USER","subKind","clientAuthBasic","authenticator","safeAuthenticate","username","password","success","GLOBAL","CLIENT","data","userAuthBasic","authenticated"],"sources":["../../../../../../src/adapters/http/middleware/built-in/authorization/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IPermissionEvaluator } from '@authup/access';\nimport { PermissionEvaluator } from '@authup/access';\nimport type { Client, User } from '@authup/core-kit';\nimport {\n    IdentityType,\n    ScopeName,\n} from '@authup/core-kit';\nimport { AuthHeaderError } from '@authup/errors';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport {\n    JWTError,\n    OAuth2SubKind,\n    OAuth2TokenKind,\n    deserializeOAuth2Scope,\n} from '@authup/specs';\nimport type { IAppEvent } from 'routup';\nimport {\n    AuthorizationHeaderType,\n    type BasicAuthorizationHeader,\n    type BearerAuthorizationHeader,\n    parseAuthorizationHeader,\n} from 'hapic';\nimport {\n    ClientAuthenticator,\n    PolicyEngine,\n    UserAuthenticator,\n    assertClientCertificateEvidenceValidForBinding,\n} from '../../../../../core/index.ts';\nimport type {\n    ICredentialsAuthenticator,\n    IIdentityResolver,\n    IOAuth2TokenVerifier,\n    ISessionManager,\n} from '../../../../../core/index.ts';\nimport {\n    RequestIdentity,\n    RequestPermissionEvaluator,\n    extractClientCertificateEvidence,\n    setRequestIdentity,\n    setRequestMfaLoginTicket,\n    setRequestPermissionEvaluator,\n    setRequestScopes,\n    setRequestSessionId,\n    setRequestToken,\n} from '../../../request/index.ts';\nimport type { HTTPAuthorizationMiddlewareContext, HTTPAuthorizationMiddlewareOptions } from './types.ts';\n\nexport class AuthorizationMiddleware {\n    protected options: HTTPAuthorizationMiddlewareOptions;\n\n    // --------------------------------------\n\n    protected oauth2TokenVerifier: IOAuth2TokenVerifier;\n\n    protected permissionEvaluator: IPermissionEvaluator;\n\n    // --------------------------------------\n\n    protected identityResolver: IIdentityResolver;\n\n    protected sessionManager : ISessionManager;\n\n    // --------------------------------------\n\n    protected clientAuthenticator : ICredentialsAuthenticator<Client>;\n\n    protected userAuthenticator : ICredentialsAuthenticator<User>;\n\n    // --------------------------------------\n\n    constructor(ctx: HTTPAuthorizationMiddlewareContext) {\n        this.options = ctx.options || {};\n\n        this.identityResolver = ctx.identityResolver;\n        this.sessionManager = ctx.sessionManager;\n\n        this.clientAuthenticator = new ClientAuthenticator(ctx.identityResolver);\n        this.userAuthenticator = new UserAuthenticator(ctx.identityResolver);\n\n        this.oauth2TokenVerifier = ctx.oauth2TokenVerifier;\n\n        this.permissionEvaluator = new PermissionEvaluator({\n            provider: ctx.permissionProvider,\n            policyEngine: new PolicyEngine(ctx.identityPermissionProvider),\n            realmId: null,\n            clientId: null,\n        });\n    }\n\n    // --------------------------------------\n\n    async run(event: IAppEvent) {\n        const requestAccessContext = new RequestPermissionEvaluator(\n            event,\n            this.permissionEvaluator,\n        );\n        setRequestPermissionEvaluator(event, requestAccessContext);\n\n        const headerValue = event.headers.get('authorization');\n        if (!headerValue) {\n            return;\n        }\n\n        const header = parseAuthorizationHeader(headerValue);\n\n        if (header.type === AuthorizationHeaderType.BEARER) {\n            await this.verifyBearerAuthorizationHeader(event, header);\n            return;\n        }\n\n        if (header.type === AuthorizationHeaderType.BASIC) {\n            await this.verifyBasicAuthorizationHeader(event, header);\n            return;\n        }\n\n        throw AuthHeaderError.unsupportedType(header.type);\n    }\n\n    /**\n     * @throws JWTError\n     */\n    protected async verifyBearerAuthorizationHeader(\n        event: IAppEvent,\n        header: BearerAuthorizationHeader,\n    ) {\n        const payload = await this.oauth2TokenVerifier.verify(header.token);\n        await this.verifyCertificateBinding(event, payload);\n        if (payload.kind === OAuth2TokenKind.MFA) {\n            await this.verifyMfaLoginTicket(event, payload);\n            return;\n        }\n\n        if (payload.kind !== OAuth2TokenKind.ACCESS) {\n            throw JWTError.payloadPropertyInvalid('kind');\n        }\n\n        if (!payload.realm_id) {\n            throw JWTError.payloadPropertyInvalid('realm_id');\n        }\n\n        setRequestToken(event, header.token);\n\n        if (payload.scope) {\n            setRequestScopes(event, deserializeOAuth2Scope(payload.scope));\n        }\n\n        // -------------------------------------------------------\n\n        if (!payload.session_id) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        const session = await this.sessionManager.findOneById(payload.session_id);\n        if (!session) {\n            throw JWTError.expired();\n        }\n\n        try {\n            await this.sessionManager.verify(session);\n        } catch {\n            throw JWTError.expired();\n        }\n\n        await this.sessionManager.ping(session);\n\n        setRequestSessionId(event, payload.session_id);\n\n        // -------------------------------------------------------\n\n        if (!payload.sub_kind) {\n            throw JWTError.payloadPropertyInvalid('sub_kind');\n        }\n\n        if (!payload.sub) {\n            throw JWTError.payloadPropertyInvalid('sub');\n        }\n\n        const identity = await this.identityResolver.resolve(\n            payload.sub_kind,\n            payload.sub,\n        );\n\n        if (identity) {\n            setRequestIdentity(event, identity);\n        }\n    }\n\n    protected async verifyCertificateBinding(event: IAppEvent, payload: OAuth2TokenPayload): Promise<void> {\n        if (!payload.cnf) {\n            return;\n        }\n\n        const expectedThumbprint = payload.cnf['x5t#S256'];\n        if (typeof expectedThumbprint !== 'string' || expectedThumbprint.length === 0) {\n            throw JWTError.invalid();\n        }\n\n        try {\n            const evidence = await extractClientCertificateEvidence(\n                event,\n                this.options.certificateSource ?? 'disabled',\n            );\n            if (!evidence || evidence.thumbprint !== expectedThumbprint) {\n                throw JWTError.invalid();\n            }\n\n            assertClientCertificateEvidenceValidForBinding(evidence);\n        } catch {\n            throw JWTError.invalid();\n        }\n    }\n\n    /**\n     * An \"MFA-pending\" login ticket (issue #3242). Verified with the same\n     * rigor as an access token (session existence + subject match), but\n     * stashed on a DEDICATED request slot — the main identity / scope /\n     * session slots stay empty, so every identity-gated route rejects a\n     * ticket bearer (default-deny); only the challenge routes opt in via\n     * useRequestMfaLoginTicket.\n     *\n     * @throws JWTError\n     */\n    protected async verifyMfaLoginTicket(\n        event: IAppEvent,\n        payload: OAuth2TokenPayload,\n    ) {\n        if (payload.sub_kind !== OAuth2SubKind.USER) {\n            throw JWTError.payloadPropertyInvalid('sub_kind');\n        }\n\n        if (!payload.sub) {\n            throw JWTError.payloadPropertyInvalid('sub');\n        }\n\n        if (!payload.realm_id) {\n            throw JWTError.payloadPropertyInvalid('realm_id');\n        }\n\n        if (!payload.session_id) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        const session = await this.sessionManager.findOneById(payload.session_id);\n        if (!session) {\n            throw JWTError.expired();\n        }\n\n        try {\n            await this.sessionManager.verify(session);\n        } catch {\n            throw JWTError.expired();\n        }\n\n        // defense in depth — the pending session must still belong to the\n        // ticket subject.\n        if (\n            session.sub !== payload.sub ||\n            session.subKind !== IdentityType.USER\n        ) {\n            throw JWTError.expired();\n        }\n\n        await this.sessionManager.ping(session);\n\n        const identity = await this.identityResolver.resolve(\n            payload.sub_kind,\n            payload.sub,\n        );\n        if (!identity) {\n            throw JWTError.expired();\n        }\n\n        setRequestMfaLoginTicket(event, {\n            identity: new RequestIdentity(identity),\n            payload,\n        });\n    }\n\n    protected async verifyBasicAuthorizationHeader(\n        event: IAppEvent,\n        header: BasicAuthorizationHeader,\n    ) {\n        if (this.options.clientAuthBasic) {\n            const authenticator = await this.clientAuthenticator.safeAuthenticate(\n                header.username,\n                header.password,\n            );\n            if (authenticator.success) {\n                setRequestScopes(event, [ScopeName.GLOBAL]);\n                setRequestIdentity(event, {\n                    type: IdentityType.CLIENT,\n                    data: authenticator.data,\n                });\n            }\n        }\n\n        if (this.options.userAuthBasic) {\n            const authenticated = await this.userAuthenticator.safeAuthenticate(\n                header.username,\n                header.password,\n            );\n\n            if (authenticated.success) {\n                setRequestScopes(event, [ScopeName.GLOBAL]);\n                setRequestIdentity(event, {\n                    type: IdentityType.USER,\n                    data: authenticated.data,\n                });\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAsDA,IAAauB,0BAAb,MAAaA;CACCC;CAIAC;CAEAC;CAIAC;CAEAC;CAIAC;CAEAC;CAIV,YAAYC,KAAyC;EACjD,KAAKP,UAAUO,IAAIP,WAAW,CAAC;EAE/B,KAAKG,mBAAmBI,IAAIJ;EAC5B,KAAKC,iBAAiBG,IAAIH;EAE1B,KAAKC,sBAAsB,IAAInB,oBAAoBqB,IAAIJ,gBAAgB;EACvE,KAAKG,oBAAoB,IAAIlB,kBAAkBmB,IAAIJ,gBAAgB;EAEnE,KAAKF,sBAAsBM,IAAIN;EAE/B,KAAKC,sBAAsB,IAAI1B,oBAAoB;GAC/CgC,UAAUD,IAAIE;GACdC,cAAc,IAAIvB,eAAaoB,IAAII,0BAA0B;GAC7DC,SAAS;GACTC,UAAU;EACd,CAAA;CACJ;CAIA,MAAMC,IAAIC,OAAkB;EAKxBpB,8BAA8BoB,OAAOC,IAJJzB,2BAC7BwB,OACA,KAAKb,mBAE4Bc,CAAAA;EAErC,MAAMC,cAAcF,MAAMG,QAAQC,IAAI,eAAA;EACtC,IAAI,CAACF,aACD;EAGJ,MAAMG,SAASnC,yBAAyBgC,WAAAA;EAExC,IAAIG,OAAOC,SAASrC,wBAAwBsC,QAAQ;GAChD,MAAM,KAAKC,gCAAgCR,OAAOK,MAAAA;GAClD;EACJ;EAEA,IAAIA,OAAOC,SAASrC,wBAAwBwC,OAAO;GAC/C,MAAM,KAAKC,+BAA+BV,OAAOK,MAAAA;GACjD;EACJ;EAEA,MAAMzC,gBAAgB+C,gBAAgBN,OAAOC,IAAI;CACrD;;;IAKA,MAAgBE,gCACZR,OACAK,QACF;EACE,MAAMO,UAAU,MAAM,KAAK1B,oBAAoB2B,OAAOR,OAAOS,KAAK;EAClE,MAAM,KAAKC,yBAAyBf,OAAOY,OAAAA;EAC3C,IAAIA,QAAQI,SAASjD,gBAAgBkD,KAAK;GACtC,MAAM,KAAKC,qBAAqBlB,OAAOY,OAAAA;GACvC;EACJ;EAEA,IAAIA,QAAQI,SAASjD,gBAAgBoD,QACjC,MAAMtD,SAASuD,uBAAuB,MAAA;EAG1C,IAAI,CAACR,QAAQS,UACT,MAAMxD,SAASuD,uBAAuB,UAAA;EAG1CrC,gBAAgBiB,OAAOK,OAAOS,KAAK;EAEnC,IAAIF,QAAQU,OACRzC,iBAAiBmB,OAAOhC,uBAAuB4C,QAAQU,KAAK,CAAA;EAKhE,IAAI,CAACV,QAAQW,YACT,MAAM1D,SAASuD,uBAAuB,YAAA;EAG1C,MAAMI,UAAU,MAAM,KAAKnC,eAAeoC,YAAYb,QAAQW,UAAU;EACxE,IAAI,CAACC,SACD,MAAM3D,SAAS6D,QAAO;EAG1B,IAAI;GACA,MAAM,KAAKrC,eAAewB,OAAOW,OAAAA;EACrC,QAAQ;GACJ,MAAM3D,SAAS6D,QAAO;EAC1B;EAEA,MAAM,KAAKrC,eAAesC,KAAKH,OAAAA;EAE/B1C,oBAAoBkB,OAAOY,QAAQW,UAAU;EAI7C,IAAI,CAACX,QAAQgB,UACT,MAAM/D,SAASuD,uBAAuB,UAAA;EAG1C,IAAI,CAACR,QAAQiB,KACT,MAAMhE,SAASuD,uBAAuB,KAAA;EAG1C,MAAMU,WAAW,MAAM,KAAK1C,iBAAiB2C,QACzCnB,QAAQgB,UACRhB,QAAQiB,GAAG;EAGf,IAAIC,UACApD,mBAAmBsB,OAAO8B,QAAAA;CAElC;CAEA,MAAgBf,yBAAyBf,OAAkBY,SAA4C;EACnG,IAAI,CAACA,QAAQoB,KACT;EAGJ,MAAMC,qBAAqBrB,QAAQoB,IAAI;EACvC,IAAI,OAAOC,uBAAuB,YAAYA,mBAAmBC,WAAW,GACxE,MAAMrE,SAASsE,QAAO;EAG1B,IAAI;GACA,MAAMC,WAAW,MAAM3D,iCACnBuB,OACA,KAAKf,QAAQoD,qBAAqB,UAAA;GAEtC,IAAI,CAACD,YAAYA,SAASE,eAAeL,oBACrC,MAAMpE,SAASsE,QAAO;GAG1B7D,+CAA+C8D,QAAAA;EACnD,QAAQ;GACJ,MAAMvE,SAASsE,QAAO;EAC1B;CACJ;;;;;;;;;;IAYA,MAAgBjB,qBACZlB,OACAY,SACF;EACE,IAAIA,QAAQgB,aAAa9D,cAAcyE,MACnC,MAAM1E,SAASuD,uBAAuB,UAAA;EAG1C,IAAI,CAACR,QAAQiB,KACT,MAAMhE,SAASuD,uBAAuB,KAAA;EAG1C,IAAI,CAACR,QAAQS,UACT,MAAMxD,SAASuD,uBAAuB,UAAA;EAG1C,IAAI,CAACR,QAAQW,YACT,MAAM1D,SAASuD,uBAAuB,YAAA;EAG1C,MAAMI,UAAU,MAAM,KAAKnC,eAAeoC,YAAYb,QAAQW,UAAU;EACxE,IAAI,CAACC,SACD,MAAM3D,SAAS6D,QAAO;EAG1B,IAAI;GACA,MAAM,KAAKrC,eAAewB,OAAOW,OAAAA;EACrC,QAAQ;GACJ,MAAM3D,SAAS6D,QAAO;EAC1B;EAIA,IACIF,QAAQK,QAAQjB,QAAQiB,OACxBL,QAAQgB,YAAY9E,aAAa6E,MAEjC,MAAM1E,SAAS6D,QAAO;EAG1B,MAAM,KAAKrC,eAAesC,KAAKH,OAAAA;EAE/B,MAAMM,WAAW,MAAM,KAAK1C,iBAAiB2C,QACzCnB,QAAQgB,UACRhB,QAAQiB,GAAG;EAEf,IAAI,CAACC,UACD,MAAMjE,SAAS6D,QAAO;EAG1B/C,yBAAyBqB,OAAO;GAC5B8B,UAAU,IAAIvD,gBAAgBuD,QAAAA;GAC9BlB;EACJ,CAAA;CACJ;CAEA,MAAgBF,+BACZV,OACAK,QACF;EACE,IAAI,KAAKpB,QAAQwD,iBAAiB;GAC9B,MAAMC,gBAAgB,MAAM,KAAKpD,oBAAoBqD,iBACjDtC,OAAOuC,UACPvC,OAAOwC,QAAQ;GAEnB,IAAIH,cAAcI,SAAS;IACvBjE,iBAAiBmB,OAAO,CAACrC,UAAUoF,MAAAA,CAAO;IAC1CrE,mBAAmBsB,OAAO;KACtBM,MAAM5C,aAAasF;KACnBC,MAAMP,cAAcO;IACxB,CAAA;GACJ;EACJ;EAEA,IAAI,KAAKhE,QAAQiE,eAAe;GAC5B,MAAMC,gBAAgB,MAAM,KAAK5D,kBAAkBoD,iBAC/CtC,OAAOuC,UACPvC,OAAOwC,QAAQ;GAGnB,IAAIM,cAAcL,SAAS;IACvBjE,iBAAiBmB,OAAO,CAACrC,UAAUoF,MAAAA,CAAO;IAC1CrE,mBAAmBsB,OAAO;KACtBM,MAAM5C,aAAa6E;KACnBU,MAAME,cAAcF;IACxB,CAAA;GACJ;EACJ;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["PermissionEvaluator","IdentityType","ScopeName","AuthHeaderError","JWTError","OAuth2SubKind","OAuth2TokenKind","deserializeOAuth2Scope","AuthorizationHeaderType","parseAuthorizationHeader","ClientAuthenticator","PolicyEngine","UserAuthenticator","assertClientCertificateEvidenceValidForBinding","RequestIdentity","RequestPermissionEvaluator","extractClientCertificateEvidence","setRequestIdentity","setRequestMfaLoginTicket","setRequestPermissionEvaluator","setRequestScopes","setRequestSessionId","setRequestToken","AuthorizationMiddleware","options","oauth2TokenVerifier","permissionEvaluator","identityResolver","sessionManager","clientAuthenticator","userAuthenticator","ctx","provider","permissionProvider","policyEngine","identityPermissionProvider","realmId","clientId","run","event","requestAccessContext","headerValue","headers","get","header","type","BEARER","verifyBearerAuthorizationHeader","BASIC","verifyBasicAuthorizationHeader","unsupportedType","payload","verify","token","verifyCertificateBinding","kind","MFA","verifyMfaLoginTicket","ACCESS","payloadPropertyInvalid","realm_id","scope","session_id","session","findOneById","expired","ping","sub_kind","sub","identity","resolve","cnf","expectedThumbprint","length","invalid","evidence","certificateSource","thumbprint","USER","subKind","clientAuthBasic","authenticator","safeAuthenticate","username","password","success","GLOBAL","CLIENT","data","userAuthBasic","authenticated"],"sources":["../../../../../../src/adapters/http/middleware/built-in/authorization/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IPermissionEvaluator } from '@authup/access';\nimport { PermissionEvaluator } from '@authup/access';\nimport type { Client, User } from '@authup/core-kit';\nimport {\n    IdentityType,\n    ScopeName,\n} from '@authup/core-kit';\nimport { AuthHeaderError } from '@authup/errors';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport {\n    JWTError,\n    OAuth2SubKind,\n    OAuth2TokenKind,\n    deserializeOAuth2Scope,\n} from '@authup/specs';\nimport type { IAppEvent } from 'routup';\nimport {\n    AuthorizationHeaderType,\n    type BasicAuthorizationHeader,\n    type BearerAuthorizationHeader,\n    parseAuthorizationHeader,\n} from 'hapic';\nimport {\n    ClientAuthenticator,\n    PolicyEngine,\n    UserAuthenticator,\n    assertClientCertificateEvidenceValidForBinding,\n} from '../../../../../core/index.ts';\nimport type {\n    ICredentialsAuthenticator,\n    IIdentityResolver,\n    IOAuth2TokenVerifier,\n    ISessionManager,\n} from '../../../../../core/index.ts';\nimport {\n    RequestIdentity,\n    RequestPermissionEvaluator,\n    extractClientCertificateEvidence,\n    setRequestIdentity,\n    setRequestMfaLoginTicket,\n    setRequestPermissionEvaluator,\n    setRequestScopes,\n    setRequestSessionId,\n    setRequestToken,\n} from '../../../request/index.ts';\nimport type { HTTPAuthorizationMiddlewareContext, HTTPAuthorizationMiddlewareOptions } from './types.ts';\n\nexport class AuthorizationMiddleware {\n    protected options: HTTPAuthorizationMiddlewareOptions;\n\n    // --------------------------------------\n\n    protected oauth2TokenVerifier: IOAuth2TokenVerifier;\n\n    protected permissionEvaluator: IPermissionEvaluator;\n\n    // --------------------------------------\n\n    protected identityResolver: IIdentityResolver;\n\n    protected sessionManager : ISessionManager;\n\n    // --------------------------------------\n\n    protected clientAuthenticator : ICredentialsAuthenticator<Client>;\n\n    protected userAuthenticator : ICredentialsAuthenticator<User>;\n\n    // --------------------------------------\n\n    constructor(ctx: HTTPAuthorizationMiddlewareContext) {\n        this.options = ctx.options || {};\n\n        this.identityResolver = ctx.identityResolver;\n        this.sessionManager = ctx.sessionManager;\n\n        this.clientAuthenticator = new ClientAuthenticator(ctx.identityResolver);\n        this.userAuthenticator = new UserAuthenticator(ctx.identityResolver);\n\n        this.oauth2TokenVerifier = ctx.oauth2TokenVerifier;\n\n        this.permissionEvaluator = new PermissionEvaluator({\n            provider: ctx.permissionProvider,\n            policyEngine: new PolicyEngine(ctx.identityPermissionProvider),\n            realmId: null,\n            clientId: null,\n        });\n    }\n\n    // --------------------------------------\n\n    async run(event: IAppEvent) {\n        const requestAccessContext = new RequestPermissionEvaluator(\n            event,\n            this.permissionEvaluator,\n        );\n        setRequestPermissionEvaluator(event, requestAccessContext);\n\n        const headerValue = event.headers.get('authorization');\n        if (!headerValue) {\n            return;\n        }\n\n        const header = parseAuthorizationHeader(headerValue);\n\n        if (header.type === AuthorizationHeaderType.BEARER) {\n            await this.verifyBearerAuthorizationHeader(event, header);\n            return;\n        }\n\n        if (header.type === AuthorizationHeaderType.BASIC) {\n            await this.verifyBasicAuthorizationHeader(event, header);\n            return;\n        }\n\n        throw AuthHeaderError.unsupportedType(header.type);\n    }\n\n    /**\n     * @throws JWTError\n     */\n    protected async verifyBearerAuthorizationHeader(\n        event: IAppEvent,\n        header: BearerAuthorizationHeader,\n    ) {\n        const payload = await this.oauth2TokenVerifier.verify(header.token);\n        await this.verifyCertificateBinding(event, payload);\n        if (payload.kind === OAuth2TokenKind.MFA) {\n            await this.verifyMfaLoginTicket(event, payload);\n            return;\n        }\n\n        if (payload.kind !== OAuth2TokenKind.ACCESS) {\n            throw JWTError.payloadPropertyInvalid('kind');\n        }\n\n        if (!payload.realm_id) {\n            throw JWTError.payloadPropertyInvalid('realm_id');\n        }\n\n        setRequestToken(event, header.token);\n\n        if (payload.scope) {\n            setRequestScopes(event, deserializeOAuth2Scope(payload.scope));\n        }\n\n        // -------------------------------------------------------\n\n        if (!payload.session_id) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        const session = await this.sessionManager.findOneById(payload.session_id);\n        if (!session) {\n            throw JWTError.expired();\n        }\n\n        try {\n            await this.sessionManager.verify(session);\n        } catch {\n            throw JWTError.expired();\n        }\n\n        await this.sessionManager.ping(session);\n\n        setRequestSessionId(event, payload.session_id);\n\n        // -------------------------------------------------------\n\n        if (!payload.sub_kind) {\n            throw JWTError.payloadPropertyInvalid('sub_kind');\n        }\n\n        if (!payload.sub) {\n            throw JWTError.payloadPropertyInvalid('sub');\n        }\n\n        const identity = await this.identityResolver.resolve(\n            payload.sub_kind,\n            payload.sub,\n        );\n\n        if (identity) {\n            setRequestIdentity(event, identity);\n        }\n    }\n\n    protected async verifyCertificateBinding(event: IAppEvent, payload: OAuth2TokenPayload): Promise<void> {\n        if (!payload.cnf) {\n            return;\n        }\n\n        const expectedThumbprint = payload.cnf['x5t#S256'];\n        if (typeof expectedThumbprint !== 'string' || expectedThumbprint.length === 0) {\n            throw JWTError.invalid();\n        }\n\n        try {\n            const evidence = await extractClientCertificateEvidence(\n                event,\n                this.options.certificateSource ?? 'disabled',\n            );\n            if (!evidence || evidence.thumbprint !== expectedThumbprint) {\n                throw JWTError.invalid();\n            }\n\n            assertClientCertificateEvidenceValidForBinding(evidence);\n        } catch {\n            throw JWTError.invalid();\n        }\n    }\n\n    /**\n     * An \"MFA-pending\" login ticket (issue #3242). Verified with the same\n     * rigor as an access token (session existence + subject match), but\n     * stashed on a DEDICATED request slot — the main identity / scope /\n     * session slots stay empty, so every identity-gated route rejects a\n     * ticket bearer (default-deny); only the challenge routes opt in via\n     * useRequestMfaLoginTicket.\n     *\n     * @throws JWTError\n     */\n    protected async verifyMfaLoginTicket(\n        event: IAppEvent,\n        payload: OAuth2TokenPayload,\n    ) {\n        if (payload.sub_kind !== OAuth2SubKind.USER) {\n            throw JWTError.payloadPropertyInvalid('sub_kind');\n        }\n\n        if (!payload.sub) {\n            throw JWTError.payloadPropertyInvalid('sub');\n        }\n\n        if (!payload.realm_id) {\n            throw JWTError.payloadPropertyInvalid('realm_id');\n        }\n\n        if (!payload.session_id) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        const session = await this.sessionManager.findOneById(payload.session_id);\n        if (!session) {\n            throw JWTError.expired();\n        }\n\n        try {\n            await this.sessionManager.verify(session);\n        } catch {\n            throw JWTError.expired();\n        }\n\n        // defense in depth — the pending session must still belong to the\n        // ticket subject.\n        if (\n            session.sub !== payload.sub ||\n            session.subKind !== IdentityType.USER\n        ) {\n            throw JWTError.expired();\n        }\n\n        await this.sessionManager.ping(session);\n\n        const identity = await this.identityResolver.resolve(\n            payload.sub_kind,\n            payload.sub,\n        );\n        if (!identity) {\n            throw JWTError.expired();\n        }\n\n        setRequestMfaLoginTicket(event, {\n            identity: new RequestIdentity(identity),\n            payload,\n        });\n    }\n\n    protected async verifyBasicAuthorizationHeader(\n        event: IAppEvent,\n        header: BasicAuthorizationHeader,\n    ) {\n        if (this.options.clientAuthBasic) {\n            const authenticator = await this.clientAuthenticator.safeAuthenticate(\n                header.username,\n                header.password,\n            );\n            if (authenticator.success) {\n                setRequestScopes(event, [ScopeName.GLOBAL]);\n                setRequestIdentity(event, {\n                    type: IdentityType.CLIENT,\n                    data: authenticator.data,\n                });\n            }\n        }\n\n        if (this.options.userAuthBasic) {\n            const authenticated = await this.userAuthenticator.safeAuthenticate(\n                header.username,\n                header.password,\n            );\n\n            if (authenticated.success) {\n                setRequestScopes(event, [ScopeName.GLOBAL]);\n                setRequestIdentity(event, {\n                    type: IdentityType.USER,\n                    data: authenticated.data,\n                });\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAsDA,IAAauB,0BAAb,MAAaA;CACCC;CAIAC;CAEAC;CAIAC;CAEAC;CAIAC;CAEAC;CAIV,YAAYC,KAAyC;EACjD,KAAKP,UAAUO,IAAIP,WAAW,CAAC;EAE/B,KAAKG,mBAAmBI,IAAIJ;EAC5B,KAAKC,iBAAiBG,IAAIH;EAE1B,KAAKC,sBAAsB,IAAInB,oBAAoBqB,IAAIJ,gBAAgB;EACvE,KAAKG,oBAAoB,IAAIlB,kBAAkBmB,IAAIJ,gBAAgB;EAEnE,KAAKF,sBAAsBM,IAAIN;EAE/B,KAAKC,sBAAsB,IAAI1B,oBAAoB;GAC/CgC,UAAUD,IAAIE;GACdC,cAAc,IAAIvB,eAAaoB,IAAII,0BAA0B;GAC7DC,SAAS;GACTC,UAAU;EACd,CAAA;CACJ;CAIA,MAAMC,IAAIC,OAAkB;EAKxBpB,8BAA8BoB,OAAOC,IAJJzB,2BAC7BwB,OACA,KAAKb,mBAE4Bc,CAAAA;EAErC,MAAMC,cAAcF,MAAMG,QAAQC,IAAI,eAAA;EACtC,IAAI,CAACF,aACD;EAGJ,MAAMG,SAASnC,yBAAyBgC,WAAAA;EAExC,IAAIG,OAAOC,SAASrC,wBAAwBsC,QAAQ;GAChD,MAAM,KAAKC,gCAAgCR,OAAOK,MAAAA;GAClD;EACJ;EAEA,IAAIA,OAAOC,SAASrC,wBAAwBwC,OAAO;GAC/C,MAAM,KAAKC,+BAA+BV,OAAOK,MAAAA;GACjD;EACJ;EAEA,MAAMzC,gBAAgB+C,gBAAgBN,OAAOC,IAAI;CACrD;;;IAKA,MAAgBE,gCACZR,OACAK,QACF;EACE,MAAMO,UAAU,MAAM,KAAK1B,oBAAoB2B,OAAOR,OAAOS,KAAK;EAClE,MAAM,KAAKC,yBAAyBf,OAAOY,OAAAA;EAC3C,IAAIA,QAAQI,SAASjD,gBAAgBkD,KAAK;GACtC,MAAM,KAAKC,qBAAqBlB,OAAOY,OAAAA;GACvC;EACJ;EAEA,IAAIA,QAAQI,SAASjD,gBAAgBoD,QACjC,MAAMtD,SAASuD,uBAAuB,MAAA;EAG1C,IAAI,CAACR,QAAQS,UACT,MAAMxD,SAASuD,uBAAuB,UAAA;EAG1CrC,gBAAgBiB,OAAOK,OAAOS,KAAK;EAEnC,IAAIF,QAAQU,OACRzC,iBAAiBmB,OAAOhC,uBAAuB4C,QAAQU,KAAK,CAAA;EAKhE,IAAI,CAACV,QAAQW,YACT,MAAM1D,SAASuD,uBAAuB,YAAA;EAG1C,MAAMI,UAAU,MAAM,KAAKnC,eAAeoC,YAAYb,QAAQW,UAAU;EACxE,IAAI,CAACC,SACD,MAAM3D,SAAS6D,QAAO;EAG1B,IAAI;GACA,MAAM,KAAKrC,eAAewB,OAAOW,OAAAA;EACrC,QAAQ;GACJ,MAAM3D,SAAS6D,QAAO;EAC1B;EAEA,MAAM,KAAKrC,eAAesC,KAAKH,OAAAA;EAE/B1C,oBAAoBkB,OAAOY,QAAQW,UAAU;EAI7C,IAAI,CAACX,QAAQgB,UACT,MAAM/D,SAASuD,uBAAuB,UAAA;EAG1C,IAAI,CAACR,QAAQiB,KACT,MAAMhE,SAASuD,uBAAuB,KAAA;EAG1C,MAAMU,WAAW,MAAM,KAAK1C,iBAAiB2C,QACzCnB,QAAQgB,UACRhB,QAAQiB,GAAG;EAGf,IAAIC,UACApD,mBAAmBsB,OAAO8B,QAAAA;CAElC;CAEA,MAAgBf,yBAAyBf,OAAkBY,SAA4C;EACnG,IAAI,CAACA,QAAQoB,KACT;EAGJ,MAAMC,qBAAqBrB,QAAQoB,IAAI;EACvC,IAAI,OAAOC,uBAAuB,YAAYA,mBAAmBC,WAAW,GACxE,MAAMrE,SAASsE,QAAO;EAG1B,IAAI;GACA,MAAMC,WAAW,MAAM3D,iCACnBuB,OACA,KAAKf,QAAQoD,qBAAqB,UAAA;GAEtC,IAAI,CAACD,YAAYA,SAASE,eAAeL,oBACrC,MAAMpE,SAASsE,QAAO;GAG1B7D,+CAA+C8D,QAAAA;EACnD,QAAQ;GACJ,MAAMvE,SAASsE,QAAO;EAC1B;CACJ;;;;;;;;;;IAYA,MAAgBjB,qBACZlB,OACAY,SACF;EACE,IAAIA,QAAQgB,aAAa9D,cAAcyE,MACnC,MAAM1E,SAASuD,uBAAuB,UAAA;EAG1C,IAAI,CAACR,QAAQiB,KACT,MAAMhE,SAASuD,uBAAuB,KAAA;EAG1C,IAAI,CAACR,QAAQS,UACT,MAAMxD,SAASuD,uBAAuB,UAAA;EAG1C,IAAI,CAACR,QAAQW,YACT,MAAM1D,SAASuD,uBAAuB,YAAA;EAG1C,MAAMI,UAAU,MAAM,KAAKnC,eAAeoC,YAAYb,QAAQW,UAAU;EACxE,IAAI,CAACC,SACD,MAAM3D,SAAS6D,QAAO;EAG1B,IAAI;GACA,MAAM,KAAKrC,eAAewB,OAAOW,OAAAA;EACrC,QAAQ;GACJ,MAAM3D,SAAS6D,QAAO;EAC1B;EAIA,IACIF,QAAQK,QAAQjB,QAAQiB,OACxBL,QAAQgB,YAAY9E,aAAa6E,MAEjC,MAAM1E,SAAS6D,QAAO;EAG1B,MAAM,KAAKrC,eAAesC,KAAKH,OAAAA;EAE/B,MAAMM,WAAW,MAAM,KAAK1C,iBAAiB2C,QACzCnB,QAAQgB,UACRhB,QAAQiB,GAAG;EAEf,IAAI,CAACC,UACD,MAAMjE,SAAS6D,QAAO;EAG1B/C,yBAAyBqB,OAAO;GAC5B8B,UAAU,IAAIvD,gBAAgBuD,QAAAA;GAC9BlB;EACJ,CAAA;CACJ;CAEA,MAAgBF,+BACZV,OACAK,QACF;EACE,IAAI,KAAKpB,QAAQwD,iBAAiB;GAC9B,MAAMC,gBAAgB,MAAM,KAAKpD,oBAAoBqD,iBACjDtC,OAAOuC,UACPvC,OAAOwC,QAAQ;GAEnB,IAAIH,cAAcI,SAAS;IACvBjE,iBAAiBmB,OAAO,CAACrC,UAAUoF,MAAO,CAAA;IAC1CrE,mBAAmBsB,OAAO;KACtBM,MAAM5C,aAAasF;KACnBC,MAAMP,cAAcO;IACxB,CAAA;GACJ;EACJ;EAEA,IAAI,KAAKhE,QAAQiE,eAAe;GAC5B,MAAMC,gBAAgB,MAAM,KAAK5D,kBAAkBoD,iBAC/CtC,OAAOuC,UACPvC,OAAOwC,QAAQ;GAGnB,IAAIM,cAAcL,SAAS;IACvBjE,iBAAiBmB,OAAO,CAACrC,UAAUoF,MAAO,CAAA;IAC1CrE,mBAAmBsB,OAAO;KACtBM,MAAM5C,aAAa6E;KACnBU,MAAME,cAAcF;IACxB,CAAA;GACJ;EACJ;CACJ;AACJ"}

package/dist/adapters/http/middleware/built-in/cors.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"cors.mjs","names":["cors","registerCorsMiddleware","router","input","use","origin","credentials","exposeHeaders"],"sources":["../../../../../src/adapters/http/middleware/built-in/cors.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Options as CorsOptions } from '@routup/cors';\nimport { cors } from '@routup/cors';\nimport type { App } from 'routup';\n\nexport function registerCorsMiddleware(router: App, input?: CorsOptions) {\n    router.use(cors({\n        // Reflect any origin by default: OAuth2 clients (and their UIs) are\n        // registered at runtime on arbitrary domains, so a startup-time\n        // allowlist cannot know them. All authentication is header-based\n        // (Bearer/Basic) — no cookie-authenticated endpoint exists — so an\n        // origin allowlist would add no security, only break dynamically\n        // registered browser clients. Operators can still pass an explicit\n        // `origin` via the middlewareCors config options.\n        origin: true,\n        credentials: true,\n        // `credentials: true` is incompatible with the `*` wildcard for\n        // exposeHeaders, so enumerate the response headers JS clients need.\n        exposeHeaders: [\n            'ratelimit-limit',\n            'ratelimit-remaining',\n            'ratelimit-reset',\n            'retry-after',\n            'etag',\n            'content-disposition',\n            'content-range',\n            'accept-ranges',\n            'location',\n            'www-authenticate',\n        ],\n        ...(input ?? {}),\n    }));\n}\n"],"mappings":";;;;;AAWA,SAAgBC,uBAAuBC,QAAaC,OAAmB;CACnED,OAAOE,IAAIJ,KAAK;EAQZK,QAAQ;EACRC,aAAa;EAGbC,eAAe;GACX;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;;EAEJ,GAAIJ,SAAS,CAAC;CAClB,CAAA,CAAA;AACJ"}
+{"version":3,"file":"cors.mjs","names":["cors","registerCorsMiddleware","router","input","use","origin","credentials","exposeHeaders"],"sources":["../../../../../src/adapters/http/middleware/built-in/cors.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Options as CorsOptions } from '@routup/cors';\nimport { cors } from '@routup/cors';\nimport type { App } from 'routup';\n\nexport function registerCorsMiddleware(router: App, input?: CorsOptions) {\n    router.use(cors({\n        // Reflect any origin by default: OAuth2 clients (and their UIs) are\n        // registered at runtime on arbitrary domains, so a startup-time\n        // allowlist cannot know them. All authentication is header-based\n        // (Bearer/Basic) — no cookie-authenticated endpoint exists — so an\n        // origin allowlist would add no security, only break dynamically\n        // registered browser clients. Operators can still pass an explicit\n        // `origin` via the middlewareCors config options.\n        origin: true,\n        credentials: true,\n        // `credentials: true` is incompatible with the `*` wildcard for\n        // exposeHeaders, so enumerate the response headers JS clients need.\n        exposeHeaders: [\n            'ratelimit-limit',\n            'ratelimit-remaining',\n            'ratelimit-reset',\n            'retry-after',\n            'etag',\n            'content-disposition',\n            'content-range',\n            'accept-ranges',\n            'location',\n            'www-authenticate',\n        ],\n        ...(input ?? {}),\n    }));\n}\n"],"mappings":";;;;;AAWA,SAAgBC,uBAAuBC,QAAaC,OAAmB;CACnED,OAAOE,IAAIJ,KAAK;EAQZK,QAAQ;EACRC,aAAa;EAGbC,eAAe;GACX;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACH;EACD,GAAIJ,SAAS,CAAC;CAClB,CAAA,CAAA;AACJ"}

package/dist/adapters/http/middleware/built-in/logger.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"logger.mjs","names":["logger","getRequestIP","EnvironmentName","SENSITIVE_QUERY_PARAMS","redactSensitiveURLParams","url","queryIndex","indexOf","params","URLSearchParams","substring","redacted","name","has","set","toString","createLoggerMiddleware","options","format","tokens","event","response","method","status","join","write","line","env","TEST","http","skip","path","length","PRODUCTION"],"sources":["../../../../../src/adapters/http/middleware/built-in/logger.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { logger } from '@routup/logger';\nimport type { Handler } from 'routup';\nimport { getRequestIP } from 'routup';\nimport type { Logger } from '@authup/server-kit';\nimport { EnvironmentName } from '@authup/kit';\n\ntype LoggerMiddlewareOptions = {\n    env: string,\n    logger: Logger\n};\n\n// Query params whose values are credentials/tokens — the access log must never\n// persist them (a GET /logout?id_token_hint=<jwt> would otherwise write a\n// signature-valid token into the log).\nconst SENSITIVE_QUERY_PARAMS = [\n    'id_token_hint',\n    'id_token',\n    'access_token',\n    'refresh_token',\n    'token',\n    'code',\n    'client_secret',\n];\n\nexport function redactSensitiveURLParams(url: string): string {\n    const queryIndex = url.indexOf('?');\n    if (queryIndex === -1) {\n        return url;\n    }\n\n    const params = new URLSearchParams(url.substring(queryIndex + 1));\n    let redacted = false;\n    for (const name of SENSITIVE_QUERY_PARAMS) {\n        if (params.has(name)) {\n            params.set(name, '***');\n            redacted = true;\n        }\n    }\n\n    if (!redacted) {\n        return url;\n    }\n\n    return `${url.substring(0, queryIndex)}?${params.toString()}`;\n}\n\nexport function createLoggerMiddleware(options: LoggerMiddlewareOptions) : Handler {\n    return logger({\n        format: (tokens, event, response) => [\n            getRequestIP(event) || '-',\n            '-',\n            tokens.method(event, response) ?? '-',\n            redactSensitiveURLParams(tokens.url(event, response) ?? '-'),\n            tokens.status(event, response) ?? '-',\n            '-',\n            tokens['response-time'](event, response) ?? '-',\n        ].join(' '),\n        write(line) {\n            if (options.env !== EnvironmentName.TEST) {\n                options.logger.http(line);\n            }\n        },\n        skip(event, response): boolean {\n            const path = event.path || '';\n            if (path.length === 0 || path === '/') {\n                return true;\n            }\n\n            if (options.env === EnvironmentName.PRODUCTION) {\n                return (response?.status ?? 0) < 400;\n            }\n\n            return false;\n        },\n    });\n}\n"],"mappings":";;;;;;;AAqBA,MAAMG,yBAAyB;CAC3B;CACA;CACA;CACA;CACA;CACA;CACA;;AAGJ,SAAgBC,yBAAyBC,KAAW;CAChD,MAAMC,aAAaD,IAAIE,QAAQ,GAAA;CAC/B,IAAID,eAAe,IACf,OAAOD;CAGX,MAAMG,SAAS,IAAIC,gBAAgBJ,IAAIK,UAAUJ,aAAa,CAAA,CAAA;CAC9D,IAAIK,WAAW;CACf,KAAK,MAAMC,QAAQT,wBACf,IAAIK,OAAOK,IAAID,IAAAA,GAAO;EAClBJ,OAAOM,IAAIF,MAAM,KAAA;EACjBD,WAAW;CACf;CAGJ,IAAI,CAACA,UACD,OAAON;CAGX,OAAO,GAAGA,IAAIK,UAAU,GAAGJ,UAAAA,EAAY,GAAGE,OAAOO,SAAQ;AAC7D;AAEA,SAAgBC,uBAAuBC,SAAgC;CACnE,OAAOjB,OAAO;EACVkB,SAASC,QAAQC,OAAOC,aAAa;GACjCpB,aAAamB,KAAAA,KAAU;GACvB;GACAD,OAAOG,OAAOF,OAAOC,QAAAA,KAAa;GAClCjB,yBAAyBe,OAAOd,IAAIe,OAAOC,QAAAA,KAAa,GAAA;GACxDF,OAAOI,OAAOH,OAAOC,QAAAA,KAAa;GAClC;GACAF,OAAO,gBAAgB,CAACC,OAAOC,QAAAA,KAAa;GAC/C,CAACG,KAAK,GAAA;EACPC,MAAMC,MAAI;GACN,IAAIT,QAAQU,QAAQzB,gBAAgB0B,MAChCX,QAAQjB,OAAO6B,KAAKH,IAAAA;EAE5B;EACAI,KAAKV,OAAOC,UAAQ;GAChB,MAAMU,OAAOX,MAAMW,QAAQ;GAC3B,IAAIA,KAAKC,WAAW,KAAKD,SAAS,KAC9B,OAAO;GAGX,IAAId,QAAQU,QAAQzB,gBAAgB+B,YAChC,QAAQZ,UAAUE,UAAU,KAAK;GAGrC,OAAO;EACX;CACJ,CAAA;AACJ"}
+{"version":3,"file":"logger.mjs","names":["logger","getRequestIP","EnvironmentName","SENSITIVE_QUERY_PARAMS","redactSensitiveURLParams","url","queryIndex","indexOf","params","URLSearchParams","substring","redacted","name","has","set","toString","createLoggerMiddleware","options","format","tokens","event","response","method","status","join","write","line","env","TEST","http","skip","path","length","PRODUCTION"],"sources":["../../../../../src/adapters/http/middleware/built-in/logger.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { logger } from '@routup/logger';\nimport type { Handler } from 'routup';\nimport { getRequestIP } from 'routup';\nimport type { Logger } from '@authup/server-kit';\nimport { EnvironmentName } from '@authup/kit';\n\ntype LoggerMiddlewareOptions = {\n    env: string,\n    logger: Logger\n};\n\n// Query params whose values are credentials/tokens — the access log must never\n// persist them (a GET /logout?id_token_hint=<jwt> would otherwise write a\n// signature-valid token into the log).\nconst SENSITIVE_QUERY_PARAMS = [\n    'id_token_hint',\n    'id_token',\n    'access_token',\n    'refresh_token',\n    'token',\n    'code',\n    'client_secret',\n];\n\nexport function redactSensitiveURLParams(url: string): string {\n    const queryIndex = url.indexOf('?');\n    if (queryIndex === -1) {\n        return url;\n    }\n\n    const params = new URLSearchParams(url.substring(queryIndex + 1));\n    let redacted = false;\n    for (const name of SENSITIVE_QUERY_PARAMS) {\n        if (params.has(name)) {\n            params.set(name, '***');\n            redacted = true;\n        }\n    }\n\n    if (!redacted) {\n        return url;\n    }\n\n    return `${url.substring(0, queryIndex)}?${params.toString()}`;\n}\n\nexport function createLoggerMiddleware(options: LoggerMiddlewareOptions) : Handler {\n    return logger({\n        format: (tokens, event, response) => [\n            getRequestIP(event) || '-',\n            '-',\n            tokens.method(event, response) ?? '-',\n            redactSensitiveURLParams(tokens.url(event, response) ?? '-'),\n            tokens.status(event, response) ?? '-',\n            '-',\n            tokens['response-time'](event, response) ?? '-',\n        ].join(' '),\n        write(line) {\n            if (options.env !== EnvironmentName.TEST) {\n                options.logger.http(line);\n            }\n        },\n        skip(event, response): boolean {\n            const path = event.path || '';\n            if (path.length === 0 || path === '/') {\n                return true;\n            }\n\n            if (options.env === EnvironmentName.PRODUCTION) {\n                return (response?.status ?? 0) < 400;\n            }\n\n            return false;\n        },\n    });\n}\n"],"mappings":";;;;;;;AAqBA,MAAMG,yBAAyB;CAC3B;CACA;CACA;CACA;CACA;CACA;CACA;AACH;AAED,SAAgBC,yBAAyBC,KAAW;CAChD,MAAMC,aAAaD,IAAIE,QAAQ,GAAA;CAC/B,IAAID,eAAe,IACf,OAAOD;CAGX,MAAMG,SAAS,IAAIC,gBAAgBJ,IAAIK,UAAUJ,aAAa,CAAA,CAAA;CAC9D,IAAIK,WAAW;CACf,KAAK,MAAMC,QAAQT,wBACf,IAAIK,OAAOK,IAAID,IAAAA,GAAO;EAClBJ,OAAOM,IAAIF,MAAM,KAAA;EACjBD,WAAW;CACf;CAGJ,IAAI,CAACA,UACD,OAAON;CAGX,OAAO,GAAGA,IAAIK,UAAU,GAAGJ,UAAAA,EAAY,GAAGE,OAAOO,SAAQ;AAC7D;AAEA,SAAgBC,uBAAuBC,SAAgC;CACnE,OAAOjB,OAAO;EACVkB,SAASC,QAAQC,OAAOC,aAAa;GACjCpB,aAAamB,KAAAA,KAAU;GACvB;GACAD,OAAOG,OAAOF,OAAOC,QAAAA,KAAa;GAClCjB,yBAAyBe,OAAOd,IAAIe,OAAOC,QAAAA,KAAa,GAAA;GACxDF,OAAOI,OAAOH,OAAOC,QAAAA,KAAa;GAClC;GACAF,OAAO,gBAAgB,CAACC,OAAOC,QAAAA,KAAa;EAC/C,CAAA,CAACG,KAAK,GAAA;EACPC,MAAMC,MAAI;GACN,IAAIT,QAAQU,QAAQzB,gBAAgB0B,MAChCX,QAAQjB,OAAO6B,KAAKH,IAAAA;EAE5B;EACAI,KAAKV,OAAOC,UAAQ;GAChB,MAAMU,OAAOX,MAAMW,QAAQ;GAC3B,IAAIA,KAAKC,WAAW,KAAKD,SAAS,KAC9B,OAAO;GAGX,IAAId,QAAQU,QAAQzB,gBAAgB+B,YAChC,QAAQZ,UAAUE,UAAU,KAAK;GAGrC,OAAO;EACX;CACJ,CAAA;AACJ"}

package/dist/adapters/http/request/constants.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"constants.mjs","names":["RequestHandlerOperation","CERTIFICATE_SOURCES"],"sources":["../../../../src/adapters/http/request/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nexport enum RequestHandlerOperation {\n    COMMAND = 'command',\n    CREATE = 'create',\n    READ = 'read',\n    UPDATE = 'update',\n    DELETE = 'delete',\n}\n\nexport const CERTIFICATE_SOURCES = [\n    'disabled',\n    'standard',\n    'forwarded',\n] as const;\n"],"mappings":";;;;AAOA,IAAO,0BAAKA,uBAAAA,yBAAAA;;;;;;QAAAA;;AAQZ,MAAaC,sBAAsB;CAC/B;CACA;CACA"}
+{"version":3,"file":"constants.mjs","names":["RequestHandlerOperation","CERTIFICATE_SOURCES"],"sources":["../../../../src/adapters/http/request/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nexport enum RequestHandlerOperation {\n    COMMAND = 'command',\n    CREATE = 'create',\n    READ = 'read',\n    UPDATE = 'update',\n    DELETE = 'delete',\n}\n\nexport const CERTIFICATE_SOURCES = [\n    'disabled',\n    'standard',\n    'forwarded',\n] as const;\n"],"mappings":";;;;AAOA,IAAO,0BAAKA,uBAAAA,yBAAAA;;;;;;CAAAA,OAAAA;AAMX,EAAA,CAAA,CAAA;AAED,MAAaC,sBAAsB;CAC/B;CACA;CACA;AACH"}

package/dist/adapters/http/request/helpers/param-id.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"param-id.mjs","names":["isUUID","ValidupError","buildErrorMessageForAttribute","defineIssueItem","useRequestParamID","event","options","id","getRequestParamID","path","message","getRequestStringParam","undefined","key","value","params","length","getRequestStringParamOrFail"],"sources":["../../../../../src/adapters/http/request/helpers/param-id.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isUUID } from '@authup/kit';\nimport type { IAppEvent } from 'routup';\nimport { ValidupError, buildErrorMessageForAttribute, defineIssueItem } from 'validup';\n\ntype RequestIDParamOptions = {\n    /**\n     * default: true\n     */\n    isUUID?: boolean\n};\n\nexport function useRequestParamID(event: IAppEvent, options: RequestIDParamOptions = {}) : string {\n    const id = getRequestParamID(event, options);\n    if (typeof id === 'undefined') {\n        throw new ValidupError([\n            defineIssueItem({\n                path: ['id'],\n                message: buildErrorMessageForAttribute('id'),\n            }),\n        ]);\n    }\n\n    return id;\n}\n\nexport function getRequestParamID(event: IAppEvent, options: RequestIDParamOptions = {}) : string | undefined {\n    const id = getRequestStringParam(event, 'id');\n    if (!id) {\n        return undefined;\n    }\n\n    options.isUUID = options.isUUID ?? true;\n    if (options.isUUID && !isUUID(id)) {\n        return undefined;\n    }\n\n    return id;\n}\n\nexport function getRequestStringParam(event: IAppEvent, key: string) : string | undefined {\n    const value = event.params[key];\n    if (typeof value !== 'string' || value.length === 0) {\n        return undefined;\n    }\n\n    return value;\n}\n\nexport function getRequestStringParamOrFail(event: IAppEvent, key: string) : string | undefined {\n    const value = getRequestStringParam(event, key);\n    if (typeof value === 'undefined') {\n        throw new ValidupError([\n            defineIssueItem({\n                path: [key],\n                message: buildErrorMessageForAttribute(key),\n            }),\n        ]);\n    }\n\n    return value;\n}\n"],"mappings":";;;;;;AAkBA,SAAgBI,kBAAkBC,OAAkBC,UAAiC,CAAC,GAAC;CACnF,MAAMC,KAAKC,kBAAkBH,OAAOC,OAAAA;CACpC,IAAI,OAAOC,OAAO,aACd,MAAM,IAAIN,aAAa,CACnBE,gBAAgB;EACZM,MAAM,CAAC,IAAA;EACPC,SAASR,8BAA8B,IAAA;CAC3C,CAAA,CAAA,CACH;CAGL,OAAOK;AACX;AAEA,SAAgBC,kBAAkBH,OAAkBC,UAAiC,CAAC,GAAC;CACnF,MAAMC,KAAKI,sBAAsBN,OAAO,IAAA;CACxC,IAAI,CAACE,IACD;CAGJD,QAAQN,SAASM,QAAQN,UAAU;CACnC,IAAIM,QAAQN,UAAU,CAACA,OAAOO,EAAAA,GAC1B;CAGJ,OAAOA;AACX;AAEA,SAAgBI,sBAAsBN,OAAkBQ,KAAW;CAC/D,MAAMC,QAAQT,MAAMU,OAAOF;CAC3B,IAAI,OAAOC,UAAU,YAAYA,MAAME,WAAW,GAC9C;CAGJ,OAAOF;AACX;AAEA,SAAgBG,4BAA4BZ,OAAkBQ,KAAW;CACrE,MAAMC,QAAQH,sBAAsBN,OAAOQ,GAAAA;CAC3C,IAAI,OAAOC,UAAU,aACjB,MAAM,IAAIb,aAAa,CACnBE,gBAAgB;EACZM,MAAM,CAACI,GAAAA;EACPH,SAASR,8BAA8BW,GAAAA;CAC3C,CAAA,CAAA,CACH;CAGL,OAAOC;AACX"}
+{"version":3,"file":"param-id.mjs","names":["isUUID","ValidupError","buildErrorMessageForAttribute","defineIssueItem","useRequestParamID","event","options","id","getRequestParamID","path","message","getRequestStringParam","undefined","key","value","params","length","getRequestStringParamOrFail"],"sources":["../../../../../src/adapters/http/request/helpers/param-id.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isUUID } from '@authup/kit';\nimport type { IAppEvent } from 'routup';\nimport { ValidupError, buildErrorMessageForAttribute, defineIssueItem } from 'validup';\n\ntype RequestIDParamOptions = {\n    /**\n     * default: true\n     */\n    isUUID?: boolean\n};\n\nexport function useRequestParamID(event: IAppEvent, options: RequestIDParamOptions = {}) : string {\n    const id = getRequestParamID(event, options);\n    if (typeof id === 'undefined') {\n        throw new ValidupError([\n            defineIssueItem({\n                path: ['id'],\n                message: buildErrorMessageForAttribute('id'),\n            }),\n        ]);\n    }\n\n    return id;\n}\n\nexport function getRequestParamID(event: IAppEvent, options: RequestIDParamOptions = {}) : string | undefined {\n    const id = getRequestStringParam(event, 'id');\n    if (!id) {\n        return undefined;\n    }\n\n    options.isUUID = options.isUUID ?? true;\n    if (options.isUUID && !isUUID(id)) {\n        return undefined;\n    }\n\n    return id;\n}\n\nexport function getRequestStringParam(event: IAppEvent, key: string) : string | undefined {\n    const value = event.params[key];\n    if (typeof value !== 'string' || value.length === 0) {\n        return undefined;\n    }\n\n    return value;\n}\n\nexport function getRequestStringParamOrFail(event: IAppEvent, key: string) : string | undefined {\n    const value = getRequestStringParam(event, key);\n    if (typeof value === 'undefined') {\n        throw new ValidupError([\n            defineIssueItem({\n                path: [key],\n                message: buildErrorMessageForAttribute(key),\n            }),\n        ]);\n    }\n\n    return value;\n}\n"],"mappings":";;;;;;AAkBA,SAAgBI,kBAAkBC,OAAkBC,UAAiC,CAAC,GAAC;CACnF,MAAMC,KAAKC,kBAAkBH,OAAOC,OAAAA;CACpC,IAAI,OAAOC,OAAO,aACd,MAAM,IAAIN,aAAa,CACnBE,gBAAgB;EACZM,MAAM,CAAC,IAAK;EACZC,SAASR,8BAA8B,IAAA;CAC3C,CAAA,CACH,CAAA;CAGL,OAAOK;AACX;AAEA,SAAgBC,kBAAkBH,OAAkBC,UAAiC,CAAC,GAAC;CACnF,MAAMC,KAAKI,sBAAsBN,OAAO,IAAA;CACxC,IAAI,CAACE,IACD;CAGJD,QAAQN,SAASM,QAAQN,UAAU;CACnC,IAAIM,QAAQN,UAAU,CAACA,OAAOO,EAAAA,GAC1B;CAGJ,OAAOA;AACX;AAEA,SAAgBI,sBAAsBN,OAAkBQ,KAAW;CAC/D,MAAMC,QAAQT,MAAMU,OAAOF;CAC3B,IAAI,OAAOC,UAAU,YAAYA,MAAME,WAAW,GAC9C;CAGJ,OAAOF;AACX;AAEA,SAAgBG,4BAA4BZ,OAAkBQ,KAAW;CACrE,MAAMC,QAAQH,sBAAsBN,OAAOQ,GAAAA;CAC3C,IAAI,OAAOC,UAAU,aACjB,MAAM,IAAIb,aAAa,CACnBE,gBAAgB;EACZM,MAAM,CAACI,GAAI;EACXH,SAASR,8BAA8BW,GAAAA;CAC3C,CAAA,CACH,CAAA;CAGL,OAAOC;AACX"}

package/dist/adapters/http/request/helpers/redirect.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"redirect.mjs","names":["sanitizeRelativeRedirect","input","length","undefined","test","decoded","decodeURIComponent","candidate","startsWith","includes"],"sources":["../../../../../src/adapters/http/request/helpers/redirect.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * Open-redirect guard for the `redirect` query parameter carried by the\n * auth workflow pages: only same-origin relative paths pass through, so the\n * value can be safely reflected into an anchor href / forwarded as a\n * post-login destination.\n *\n * Rejects: non-strings, control/whitespace chars (browsers strip some,\n * shifting where the URL authority begins), protocol-relative (`//host`),\n * backslash variants (browsers normalise `\\` → `/`), and any scheme\n * (`javascript:`, `http:`) — both on the raw and once-decoded form so a\n * percent-encoded separator (`%2f`, `%5c`) can't slip past.\n */\nexport function sanitizeRelativeRedirect(input: unknown): string | undefined {\n    if (typeof input !== 'string' || input.length === 0) {\n        return undefined;\n    }\n\n    // Raw input: reject control chars AND whitespace (space/tab/newline) — a\n    // raw space can shift where the URL authority begins.\n    // eslint-disable-next-line no-control-regex\n    if (/[\\u0000-\\u0020\\u007f]/.test(input)) {\n        return undefined;\n    }\n\n    let decoded: string;\n    try {\n        decoded = decodeURIComponent(input);\n    } catch {\n        return undefined;\n    }\n\n    // Decoded form: reject C0 controls + DEL (CR/LF/NUL — the header-injection\n    // vectors a `%0a`/`%0d` would smuggle past the raw check) but NOT space\n    // (0x20), so a legitimate `%20` in the path still passes.\n    // eslint-disable-next-line no-control-regex\n    if (/[\\u0000-\\u001f\\u007f]/.test(decoded)) {\n        return undefined;\n    }\n\n    for (const candidate of [input, decoded]) {\n        if (!candidate.startsWith('/')) {\n            return undefined;\n        }\n        if (candidate.length > 1 && (candidate[1] === '/' || candidate[1] === '\\\\')) {\n            return undefined;\n        }\n        if (candidate.includes('\\\\')) {\n            return undefined;\n        }\n    }\n\n    return input;\n}\n"],"mappings":";;;;;;;;;;;;;;;GAmBA,SAAgBA,yBAAyBC,OAAc;CACnD,IAAI,OAAOA,UAAU,YAAYA,MAAMC,WAAW,GAC9C;CAMJ,IAAI,wBAAwBE,KAAKH,KAAAA,GAC7B;CAGJ,IAAII;CACJ,IAAI;EACAA,UAAUC,mBAAmBL,KAAAA;CACjC,QAAQ;EACJ;CACJ;CAMA,IAAI,wBAAwBG,KAAKC,OAAAA,GAC7B;CAGJ,KAAK,MAAME,aAAa,CAACN,OAAOI,OAAAA,GAAU;EACtC,IAAI,CAACE,UAAUC,WAAW,GAAA,GACtB;EAEJ,IAAID,UAAUL,SAAS,MAAMK,UAAU,OAAO,OAAOA,UAAU,OAAO,OAClE;EAEJ,IAAIA,UAAUE,SAAS,IAAA,GACnB;CAER;CAEA,OAAOR;AACX"}
+{"version":3,"file":"redirect.mjs","names":["sanitizeRelativeRedirect","input","length","undefined","test","decoded","decodeURIComponent","candidate","startsWith","includes"],"sources":["../../../../../src/adapters/http/request/helpers/redirect.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * Open-redirect guard for the `redirect` query parameter carried by the\n * auth workflow pages: only same-origin relative paths pass through, so the\n * value can be safely reflected into an anchor href / forwarded as a\n * post-login destination.\n *\n * Rejects: non-strings, control/whitespace chars (browsers strip some,\n * shifting where the URL authority begins), protocol-relative (`//host`),\n * backslash variants (browsers normalise `\\` → `/`), and any scheme\n * (`javascript:`, `http:`) — both on the raw and once-decoded form so a\n * percent-encoded separator (`%2f`, `%5c`) can't slip past.\n */\nexport function sanitizeRelativeRedirect(input: unknown): string | undefined {\n    if (typeof input !== 'string' || input.length === 0) {\n        return undefined;\n    }\n\n    // Raw input: reject control chars AND whitespace (space/tab/newline) — a\n    // raw space can shift where the URL authority begins.\n    // eslint-disable-next-line no-control-regex\n    if (/[\\u0000-\\u0020\\u007f]/.test(input)) {\n        return undefined;\n    }\n\n    let decoded: string;\n    try {\n        decoded = decodeURIComponent(input);\n    } catch {\n        return undefined;\n    }\n\n    // Decoded form: reject C0 controls + DEL (CR/LF/NUL — the header-injection\n    // vectors a `%0a`/`%0d` would smuggle past the raw check) but NOT space\n    // (0x20), so a legitimate `%20` in the path still passes.\n    // eslint-disable-next-line no-control-regex\n    if (/[\\u0000-\\u001f\\u007f]/.test(decoded)) {\n        return undefined;\n    }\n\n    for (const candidate of [input, decoded]) {\n        if (!candidate.startsWith('/')) {\n            return undefined;\n        }\n        if (candidate.length > 1 && (candidate[1] === '/' || candidate[1] === '\\\\')) {\n            return undefined;\n        }\n        if (candidate.includes('\\\\')) {\n            return undefined;\n        }\n    }\n\n    return input;\n}\n"],"mappings":";;;;;;;;;;;;;;;GAmBA,SAAgBA,yBAAyBC,OAAc;CACnD,IAAI,OAAOA,UAAU,YAAYA,MAAMC,WAAW,GAC9C;CAMJ,IAAI,wBAAwBE,KAAKH,KAAAA,GAC7B;CAGJ,IAAII;CACJ,IAAI;EACAA,UAAUC,mBAAmBL,KAAAA;CACjC,QAAQ;EACJ;CACJ;CAMA,IAAI,wBAAwBG,KAAKC,OAAAA,GAC7B;CAGJ,KAAK,MAAME,aAAa,CAACN,OAAOI,OAAQ,GAAE;EACtC,IAAI,CAACE,UAAUC,WAAW,GAAA,GACtB;EAEJ,IAAID,UAAUL,SAAS,MAAMK,UAAU,OAAO,OAAOA,UAAU,OAAO,OAClE;EAEJ,IAAIA,UAAUE,SAAS,IAAA,GACnB;CAER;CAEA,OAAOR;AACX"}

package/dist/app/factory.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"factory.mjs","names":["ApplicationBuilder","DefaultProvisioningSource","ProvisionerModule","createApplication","withConfig","withLogger","withCache","withMail","withRuntime","withDatabase","withProvisioning","withLdap","withAuthentication","withIdentity","withOAuth2","withComponents","withHTTP","build"],"sources":["../../src/app/factory.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ApplicationBuilder } from './builder.ts';\nimport {\n    DefaultProvisioningSource,\n    ProvisionerModule,\n} from './modules/index.ts';\n\nexport function createApplication() {\n    return new ApplicationBuilder()\n        .withConfig()\n        .withLogger()\n        .withCache()\n        .withMail()\n        .withRuntime()\n        .withDatabase()\n        .withProvisioning(new ProvisionerModule([\n            new DefaultProvisioningSource(),\n        ]))\n        .withLdap()\n        .withAuthentication()\n        .withIdentity()\n        .withOAuth2()\n        .withComponents()\n        .withHTTP()\n        .build();\n}\n"],"mappings":";;;;;;;;AAaA,SAAgBG,oBAAAA;CACZ,OAAO,IAAIH,mBAAAA,CAAAA,CACNI,WAAU,CAAA,CACVC,WAAU,CAAA,CACVC,UAAS,CAAA,CACTC,SAAQ,CAAA,CACRC,YAAW,CAAA,CACXC,aAAY,CAAA,CACZC,iBAAiB,IAAIR,kBAAkB,CACpC,IAAID,0BAAAA,CAAAA,CACP,CAAA,CAAA,CACAU,SAAQ,CAAA,CACRC,mBAAkB,CAAA,CAClBC,aAAY,CAAA,CACZC,WAAU,CAAA,CACVC,eAAc,CAAA,CACdC,SAAQ,CAAA,CACRC,MAAK;AACd"}
+{"version":3,"file":"factory.mjs","names":["ApplicationBuilder","DefaultProvisioningSource","ProvisionerModule","createApplication","withConfig","withLogger","withCache","withMail","withRuntime","withDatabase","withProvisioning","withLdap","withAuthentication","withIdentity","withOAuth2","withComponents","withHTTP","build"],"sources":["../../src/app/factory.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ApplicationBuilder } from './builder.ts';\nimport {\n    DefaultProvisioningSource,\n    ProvisionerModule,\n} from './modules/index.ts';\n\nexport function createApplication() {\n    return new ApplicationBuilder()\n        .withConfig()\n        .withLogger()\n        .withCache()\n        .withMail()\n        .withRuntime()\n        .withDatabase()\n        .withProvisioning(new ProvisionerModule([\n            new DefaultProvisioningSource(),\n        ]))\n        .withLdap()\n        .withAuthentication()\n        .withIdentity()\n        .withOAuth2()\n        .withComponents()\n        .withHTTP()\n        .build();\n}\n"],"mappings":";;;;;;;;AAaA,SAAgBG,oBAAAA;CACZ,OAAO,IAAIH,mBAAAA,CAAAA,CACNI,WAAU,CAAA,CACVC,WAAU,CAAA,CACVC,UAAS,CAAA,CACTC,SAAQ,CAAA,CACRC,YAAW,CAAA,CACXC,aAAY,CAAA,CACZC,iBAAiB,IAAIR,kBAAkB,CACpC,IAAID,0BAAAA,CACP,CAAA,CAAA,CAAA,CACAU,SAAQ,CAAA,CACRC,mBAAkB,CAAA,CAClBC,aAAY,CAAA,CACZC,WAAU,CAAA,CACVC,eAAc,CAAA,CACdC,SAAQ,CAAA,CACRC,MAAK;AACd"}

package/dist/app/modules/authentication/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["SessionEntity","SessionManager","CacheInjectionKey","ConfigInjectionKey","ModuleName","AuthenticationInjectionKey","SessionRepository","AuthenticationModule","name","dependencies","AUTHENTICATION","DATABASE","CACHE","CONFIG","setup","container","register","useFactory","c","cache","resolve","repository","config","options","maxAge","tokenRefreshMaxAge"],"sources":["../../../../src/app/modules/authentication/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Session } from '@authup/core-kit';\nimport type { Repository } from 'typeorm';\nimport { SessionEntity } from '../../../adapters/database/domains/index.ts';\nimport type { IContainer } from 'eldin';\nimport { SessionManager } from '../../../core/index.ts';\nimport { CacheInjectionKey } from '../cache/index.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\n\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport { AuthenticationInjectionKey } from './constants.ts';\nimport { SessionRepository } from './repositories/index.ts';\n\nexport class AuthenticationModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    constructor() {\n        this.name = ModuleName.AUTHENTICATION;\n        this.dependencies = [ModuleName.DATABASE, ModuleName.CACHE, ModuleName.CONFIG];\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        container.register(AuthenticationInjectionKey.SessionRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                const repository = c.resolve<Repository<Session>>(SessionEntity);\n                return new SessionRepository({\n                    cache,\n                    repository,\n                });\n            },\n        });\n\n        container.register(AuthenticationInjectionKey.SessionManager, {\n            useFactory: (c) => {\n                const config = c.resolve(ConfigInjectionKey);\n                const repository = c.resolve(AuthenticationInjectionKey.SessionRepository);\n                return new SessionManager({\n                    repository,\n                    options: { maxAge: config.tokenRefreshMaxAge + 3_600 },\n                });\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAoBA,IAAaO,uBAAb,MAAaA;CACAC;CAEAC;CAET,cAAc;EACV,KAAKD,OAAOJ,WAAWM;EACvB,KAAKD,eAAe;GAACL,WAAWO;GAAUP,WAAWQ;GAAOR,WAAWS;;CAC3E;CAEA,MAAMC,MAAMC,WAAsC;EAC9CA,UAAUC,SAASX,2BAA2BC,mBAAmB,EAC7DW,aAAaC,MAAAA;GAGT,OAAO,IAAIZ,kBAAkB;IACzBa,OAHUD,EAAEE,QAAQlB,iBAGpBiB;IACAE,YAHeH,EAAEE,QAA6BpB,aAG9CqB;GACJ,CAAA;EACJ,EACJ,CAAA;EAEAN,UAAUC,SAASX,2BAA2BJ,gBAAgB,EAC1DgB,aAAaC,MAAAA;GACT,MAAMI,SAASJ,EAAEE,QAAQjB,kBAAAA;GAEzB,OAAO,IAAIF,eAAe;IACtBoB,YAFeH,EAAEE,QAAQf,2BAA2BC,iBAEpDe;IACAE,SAAS,EAAEC,QAAQF,OAAOG,qBAAqB,KAAM;GACzD,CAAA;EACJ,EACJ,CAAA;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["SessionEntity","SessionManager","CacheInjectionKey","ConfigInjectionKey","ModuleName","AuthenticationInjectionKey","SessionRepository","AuthenticationModule","name","dependencies","AUTHENTICATION","DATABASE","CACHE","CONFIG","setup","container","register","useFactory","c","cache","resolve","repository","config","options","maxAge","tokenRefreshMaxAge"],"sources":["../../../../src/app/modules/authentication/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Session } from '@authup/core-kit';\nimport type { Repository } from 'typeorm';\nimport { SessionEntity } from '../../../adapters/database/domains/index.ts';\nimport type { IContainer } from 'eldin';\nimport { SessionManager } from '../../../core/index.ts';\nimport { CacheInjectionKey } from '../cache/index.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\n\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport { AuthenticationInjectionKey } from './constants.ts';\nimport { SessionRepository } from './repositories/index.ts';\n\nexport class AuthenticationModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    constructor() {\n        this.name = ModuleName.AUTHENTICATION;\n        this.dependencies = [ModuleName.DATABASE, ModuleName.CACHE, ModuleName.CONFIG];\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        container.register(AuthenticationInjectionKey.SessionRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                const repository = c.resolve<Repository<Session>>(SessionEntity);\n                return new SessionRepository({\n                    cache,\n                    repository,\n                });\n            },\n        });\n\n        container.register(AuthenticationInjectionKey.SessionManager, {\n            useFactory: (c) => {\n                const config = c.resolve(ConfigInjectionKey);\n                const repository = c.resolve(AuthenticationInjectionKey.SessionRepository);\n                return new SessionManager({\n                    repository,\n                    options: { maxAge: config.tokenRefreshMaxAge + 3_600 },\n                });\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAoBA,IAAaO,uBAAb,MAAaA;CACAC;CAEAC;CAET,cAAc;EACV,KAAKD,OAAOJ,WAAWM;EACvB,KAAKD,eAAe;GAACL,WAAWO;GAAUP,WAAWQ;GAAOR,WAAWS;EAAO;CAClF;CAEA,MAAMC,MAAMC,WAAsC;EAC9CA,UAAUC,SAASX,2BAA2BC,mBAAmB,EAC7DW,aAAaC,MAAAA;GAGT,OAAO,IAAIZ,kBAAkB;IACzBa,OAHUD,EAAEE,QAAQlB,iBAGpBiB;IACAE,YAHeH,EAAEE,QAA6BpB,aAG9CqB;GACJ,CAAA;EACJ,EACJ,CAAA;EAEAN,UAAUC,SAASX,2BAA2BJ,gBAAgB,EAC1DgB,aAAaC,MAAAA;GACT,MAAMI,SAASJ,EAAEE,QAAQjB,kBAAAA;GAEzB,OAAO,IAAIF,eAAe;IACtBoB,YAFeH,EAAEE,QAAQf,2BAA2BC,iBAEpDe;IACAE,SAAS,EAAEC,QAAQF,OAAOG,qBAAqB,KAAM;GACzD,CAAA;EACJ,EACJ,CAAA;CACJ;AACJ"}

package/dist/app/modules/authentication/repositories/constants.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"constants.mjs","names":["AuthenticationCachePrefix"],"sources":["../../../../../src/app/modules/authentication/repositories/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nexport enum AuthenticationCachePrefix {\n    SESSION = 'session',\n}\n"],"mappings":";;;;AAOA,IAAO,4BAAKA,uBAAAA,2BAAAA;;QAAAA"}
+{"version":3,"file":"constants.mjs","names":["AuthenticationCachePrefix"],"sources":["../../../../../src/app/modules/authentication/repositories/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nexport enum AuthenticationCachePrefix {\n    SESSION = 'session',\n}\n"],"mappings":";;;;AAOA,IAAO,4BAAKA,uBAAAA,2BAAAA;;CAAAA,OAAAA;AAEX,EAAA,CAAA,CAAA"}