@authup/server-core 1.0.0-beta.55 → 1.0.0-beta.57

package/dist/adapters/database/domains/role/entity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entity.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/database/domains/role/entity.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAG,MAAM,kBAAkB,CAAC;AAe7D,qBAEa,UAAW,YAAW,IAAI;IAEnC,EAAE,EAAE,MAAM,CAAC;IAOX,OAAO,EAAE,OAAO,CAAC;IAMjB,IAAI,EAAE,MAAM,CAAC;IAQb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAM3B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAO3B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAMtB,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAO9B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAMtB,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAO5B,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IAKpB,SAAS,EAAE,MAAM,CAAC;IAGlB,SAAS,EAAE,MAAM,CAAC;CACrB"}
+{"version":3,"file":"entity.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/database/domains/role/entity.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAG,MAAM,kBAAkB,CAAC;AAgB7D,qBAEa,UAAW,YAAW,IAAI;IAEnC,EAAE,EAAE,MAAM,CAAC;IAOX,OAAO,EAAE,OAAO,CAAC;IAMjB,IAAI,EAAE,MAAM,CAAC;IAQb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAM3B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAO3B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAMtB,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAO9B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAMtB,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAO5B,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IAKpB,SAAS,EAAE,MAAM,CAAC;IAGlB,SAAS,EAAE,MAAM,CAAC;CACrB"}

package/dist/adapters/database/domains/role/entity.mjs

@@ -5,6 +5,7 @@ import { dateToISOStringTransformer } from "../../helpers/date.mjs";
 import "../../helpers/index.mjs";
 import { RealmEntity } from "../realm/entity.mjs";
 import "../realm/index.mjs";
+import { ClientEntity } from "../client/entity.mjs";
 import { Column, CreateDateColumn, Entity, Index, JoinColumn, ManyToOne, PrimaryGeneratedColumn, Unique, UpdateDateColumn } from "typeorm";
 //#region src/adapters/database/domains/role/entity.ts
 function _ts_decorate(decorators, target, key, desc) {
@@ -64,7 +65,7 @@ _ts_decorate([
 	_ts_metadata("design:type", Object)
 ], RoleEntity.prototype, "clientId", void 0);
 _ts_decorate([
-	ManyToOne(() => RealmEntity, {
+	ManyToOne(() => ClientEntity, {
 		onDelete: "SET NULL",
 		nullable: true
 	}),

package/dist/adapters/database/domains/role/entity.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"entity.mjs","names":["Column","CreateDateColumn","Entity","Index","JoinColumn","ManyToOne","PrimaryGeneratedColumn","Unique","UpdateDateColumn","dateToISOStringTransformer","RealmEntity","RoleEntity","id","builtIn","name","displayName","description","target","clientId","client","realmId","realm","createdAt","updatedAt","type","default","length","nullable","onDelete","transformer"],"sources":["../../../../../src/adapters/database/domains/role/entity.ts"],"sourcesContent":["/*\n * Copyright (c) 2021-2021.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Client, Realm, Role  } from '@authup/core-kit';\nimport {\n    Column,\n    CreateDateColumn,\n    Entity,\n    Index,\n    JoinColumn,\n    ManyToOne,\n    PrimaryGeneratedColumn,\n    Unique,\n    UpdateDateColumn,\n} from 'typeorm';\nimport { dateToISOStringTransformer } from '../../helpers/index.ts';\nimport { RealmEntity } from '../realm/index.ts';\n\n@Entity({ name: 'auth_roles' })\n@Unique(['name', 'clientId', 'realmId'])\nexport class RoleEntity implements Role {\n    @PrimaryGeneratedColumn('uuid')\n    id: string;\n\n    @Column({\n        name: 'built_in', \n        type: 'boolean', \n        default: false, \n    })\n    builtIn: boolean;\n\n    @Column({\n        type: 'varchar',\n        length: 128, \n    })\n    name: string;\n\n    @Column({\n        name: 'display_name', \n        type: 'varchar', \n        length: 256, \n        nullable: true, \n    })\n    displayName: string | null;\n\n    @Column({\n        type: 'text',\n        nullable: true, \n    })\n    description: string | null;\n\n    @Column({\n        type: 'varchar',\n        length: 16,\n        nullable: true, \n    })\n    target: string | null;\n\n    // ------------------------------------------------------------------\n\n    @Index()\n    @Column({ name: 'client_id', nullable: true })\n    clientId: Client['id'] | null;\n\n    @ManyToOne(() => RealmEntity, {\n        onDelete: 'SET NULL',\n        nullable: true, \n    })\n    @JoinColumn({ name: 'client_id' })\n    client: Client | null;\n\n    // ------------------------------------------------------------------\n\n    @Index()\n    @Column({ name: 'realm_id', nullable: true })\n    realmId: Realm['id'] | null;\n\n    @ManyToOne(() => RealmEntity, {\n        onDelete: 'CASCADE',\n        nullable: true, \n    })\n    @JoinColumn({ name: 'realm_id' })\n    realm: Realm | null;\n\n    // ------------------------------------------------------------------\n\n    @CreateDateColumn({ name: 'created_at', transformer: dateToISOStringTransformer })\n    createdAt: string;\n\n    @UpdateDateColumn({ name: 'updated_at', transformer: dateToISOStringTransformer })\n    updatedAt: string;\n}\n"],"mappings":";;;;;;;;;AAKC,SAAA,aAAA,YAAA,QAAA,KAAA,MAAA;;;;;;;;;AAmBD,IAAaW,aAAb,MAAaA;CAETC;CAOAC;CAMAC;CAQAC;CAMAC;CAOAC;CAMAC;CAOAC;CAMAC;CAOAC;CAKAC;CAGAC;AACJ;;;CAlEQT,MAAM;CACNU,MAAM;CACNC,SAAS;;;CAKTD,MAAM;CACNE,QAAQ;;;CAKRZ,MAAM;CACNU,MAAM;CACNE,QAAQ;CACRC,UAAU;;;CAKVH,MAAM;CACNG,UAAU;;;CAKVH,MAAM;CACNE,QAAQ;CACRC,UAAU;;;;;EAOJb,MAAM;EAAaa,UAAU;;;;;CAGtBjB,gBAAAA,aAAAA;EACbkB,UAAU;EACVD,UAAU;;CAEAb,WAAAA,EAAAA,MAAM,YAAA,CAAA;;;;;;EAMVA,MAAM;EAAYa,UAAU;;;;;CAGrBjB,gBAAAA,aAAAA;EACbkB,UAAU;EACVD,UAAU;;CAEAb,WAAAA,EAAAA,MAAM,WAAA,CAAA;;;;CAKAA,MAAM;CAAce,aAAapB;;;CAGjCK,MAAM;CAAce,aAAapB;;AAvE/CK,aAAAA,aAAAA,CAAAA,OAAAA,EAAAA,MAAM,aAAA,CAAA,GAAA,OAAA;CACP;CAAQ;CAAY"}
+{"version":3,"file":"entity.mjs","names":["Column","CreateDateColumn","Entity","Index","JoinColumn","ManyToOne","PrimaryGeneratedColumn","Unique","UpdateDateColumn","dateToISOStringTransformer","ClientEntity","RealmEntity","RoleEntity","id","builtIn","name","displayName","description","target","clientId","client","realmId","realm","createdAt","updatedAt","type","default","length","nullable","onDelete","transformer"],"sources":["../../../../../src/adapters/database/domains/role/entity.ts"],"sourcesContent":["/*\n * Copyright (c) 2021-2021.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Client, Realm, Role  } from '@authup/core-kit';\nimport {\n    Column,\n    CreateDateColumn,\n    Entity,\n    Index,\n    JoinColumn,\n    ManyToOne,\n    PrimaryGeneratedColumn,\n    Unique,\n    UpdateDateColumn,\n} from 'typeorm';\nimport { dateToISOStringTransformer } from '../../helpers/index.ts';\nimport { ClientEntity } from '../client/entity.ts';\nimport { RealmEntity } from '../realm/index.ts';\n\n@Entity({ name: 'auth_roles' })\n@Unique(['name', 'clientId', 'realmId'])\nexport class RoleEntity implements Role {\n    @PrimaryGeneratedColumn('uuid')\n    id: string;\n\n    @Column({\n        name: 'built_in', \n        type: 'boolean', \n        default: false, \n    })\n    builtIn: boolean;\n\n    @Column({\n        type: 'varchar',\n        length: 128, \n    })\n    name: string;\n\n    @Column({\n        name: 'display_name', \n        type: 'varchar', \n        length: 256, \n        nullable: true, \n    })\n    displayName: string | null;\n\n    @Column({\n        type: 'text',\n        nullable: true, \n    })\n    description: string | null;\n\n    @Column({\n        type: 'varchar',\n        length: 16,\n        nullable: true, \n    })\n    target: string | null;\n\n    // ------------------------------------------------------------------\n\n    @Index()\n    @Column({ name: 'client_id', nullable: true })\n    clientId: Client['id'] | null;\n\n    @ManyToOne(() => ClientEntity, {\n        onDelete: 'SET NULL',\n        nullable: true,\n    })\n    @JoinColumn({ name: 'client_id' })\n    client: Client | null;\n\n    // ------------------------------------------------------------------\n\n    @Index()\n    @Column({ name: 'realm_id', nullable: true })\n    realmId: Realm['id'] | null;\n\n    @ManyToOne(() => RealmEntity, {\n        onDelete: 'CASCADE',\n        nullable: true, \n    })\n    @JoinColumn({ name: 'realm_id' })\n    realm: Realm | null;\n\n    // ------------------------------------------------------------------\n\n    @CreateDateColumn({ name: 'created_at', transformer: dateToISOStringTransformer })\n    createdAt: string;\n\n    @UpdateDateColumn({ name: 'updated_at', transformer: dateToISOStringTransformer })\n    updatedAt: string;\n}\n"],"mappings":";;;;;;;;;;AAKC,SAAA,aAAA,YAAA,QAAA,KAAA,MAAA;;;;;;;;;AAoBD,IAAaY,aAAb,MAAaA;CAETC;CAOAC;CAMAC;CAQAC;CAMAC;CAOAC;CAMAC;CAOAC;CAMAC;CAOAC;CAKAC;CAGAC;AACJ;;;CAlEQT,MAAM;CACNU,MAAM;CACNC,SAAS;;;CAKTD,MAAM;CACNE,QAAQ;;;CAKRZ,MAAM;CACNU,MAAM;CACNE,QAAQ;CACRC,UAAU;;;CAKVH,MAAM;CACNG,UAAU;;;CAKVH,MAAM;CACNE,QAAQ;CACRC,UAAU;;;;;EAOJb,MAAM;EAAaa,UAAU;;;;;CAGtBlB,gBAAAA,cAAAA;EACbmB,UAAU;EACVD,UAAU;;CAEAb,WAAAA,EAAAA,MAAM,YAAA,CAAA;;;;;;EAMVA,MAAM;EAAYa,UAAU;;;;;CAGrBjB,gBAAAA,aAAAA;EACbkB,UAAU;EACVD,UAAU;;CAEAb,WAAAA,EAAAA,MAAM,WAAA,CAAA;;;;CAKAA,MAAM;CAAce,aAAarB;;;CAGjCM,MAAM;CAAce,aAAarB;;AAvE/CM,aAAAA,aAAAA,CAAAA,OAAAA,EAAAA,MAAM,aAAA,CAAA,GAAA,OAAA;CACP;CAAQ;CAAY"}

package/dist/adapters/database/migrations/mysql/1784970000000-RoleClientForeignKey.d.ts

@@ -0,0 +1,25 @@
+import type { MigrationInterface, QueryRunner } from 'typeorm';
+/**
+ * Re-targets auth_roles.client_id onto auth_clients. The column has
+ * referenced auth_realms(id) since 1740991051622 — a copy-paste of the
+ * realm relation on the entity (`@ManyToOne(() => RealmEntity)` on the
+ * client join column), so a client-scoped role could never store an
+ * actual client id. Same defect (and same fix) as the
+ * auth_permissions.client_id re-target in 1766830857009; the constraint
+ * name is unchanged because TypeORM derives it from the table and
+ * column names, not the referenced table.
+ *
+ * Any surviving non-null client_id is a realm id (that is what the old
+ * FK enforced) and cannot be interpreted as a client, so the reference is
+ * nulled — never the role row itself: the role, its permission junctions
+ * and its user assignments are legitimate, only the column value is
+ * noise (and role.clientId does not scope evaluation-time permission
+ * loading, so nulling widens nothing). down() restores the previous
+ * auth_realms target, nulling values the old constraint would reject.
+ */
+export declare class RoleClientForeignKey1784970000000 implements MigrationInterface {
+    name: string;
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}
+//# sourceMappingURL=1784970000000-RoleClientForeignKey.d.ts.map

package/dist/adapters/database/migrations/mysql/1784970000000-RoleClientForeignKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"1784970000000-RoleClientForeignKey.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/database/migrations/mysql/1784970000000-RoleClientForeignKey.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE/D;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,iCAAkC,YAAW,kBAAkB;IACxE,IAAI,SAAuC;IAE9B,EAAE,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAiB3C,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CAgB7D"}

package/dist/adapters/database/migrations/mysql/1784970000000-RoleClientForeignKey.mjs

@@ -0,0 +1,60 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/adapters/database/migrations/mysql/1784970000000-RoleClientForeignKey.ts
+/**
+* Re-targets auth_roles.client_id onto auth_clients. The column has
+* referenced auth_realms(id) since 1740991051622 — a copy-paste of the
+* realm relation on the entity (`@ManyToOne(() => RealmEntity)` on the
+* client join column), so a client-scoped role could never store an
+* actual client id. Same defect (and same fix) as the
+* auth_permissions.client_id re-target in 1766830857009; the constraint
+* name is unchanged because TypeORM derives it from the table and
+* column names, not the referenced table.
+*
+* Any surviving non-null client_id is a realm id (that is what the old
+* FK enforced) and cannot be interpreted as a client, so the reference is
+* nulled — never the role row itself: the role, its permission junctions
+* and its user assignments are legitimate, only the column value is
+* noise (and role.clientId does not scope evaluation-time permission
+* loading, so nulling widens nothing). down() restores the previous
+* auth_realms target, nulling values the old constraint would reject.
+*/ var RoleClientForeignKey1784970000000 = class {
+	name = "RoleClientForeignKey1784970000000";
+	async up(queryRunner) {
+		await queryRunner.query(`
+            ALTER TABLE \`auth_roles\` DROP FOREIGN KEY \`FK_8f460e65af897b9b049f582ad0e\`
+        `);
+		await queryRunner.query(`
+            UPDATE \`auth_roles\`
+            SET \`client_id\` = NULL
+            WHERE \`client_id\` IS NOT NULL
+                AND \`client_id\` NOT IN (SELECT \`id\` FROM \`auth_clients\`)
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_roles\`
+            ADD CONSTRAINT \`FK_8f460e65af897b9b049f582ad0e\` FOREIGN KEY (\`client_id\`) REFERENCES \`auth_clients\`(\`id\`) ON DELETE
+            SET NULL ON UPDATE NO ACTION
+        `);
+	}
+	async down(queryRunner) {
+		await queryRunner.query(`
+            ALTER TABLE \`auth_roles\` DROP FOREIGN KEY \`FK_8f460e65af897b9b049f582ad0e\`
+        `);
+		await queryRunner.query(`
+            UPDATE \`auth_roles\`
+            SET \`client_id\` = NULL
+            WHERE \`client_id\` IS NOT NULL
+                AND \`client_id\` NOT IN (SELECT \`id\` FROM \`auth_realms\`)
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_roles\`
+            ADD CONSTRAINT \`FK_8f460e65af897b9b049f582ad0e\` FOREIGN KEY (\`client_id\`) REFERENCES \`auth_realms\`(\`id\`) ON DELETE
+            SET NULL ON UPDATE NO ACTION
+        `);
+	}
+};
+//#endregion
+export { RoleClientForeignKey1784970000000 };
+
+//# sourceMappingURL=1784970000000-RoleClientForeignKey.mjs.map

package/dist/adapters/database/migrations/mysql/1784970000000-RoleClientForeignKey.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"1784970000000-RoleClientForeignKey.mjs","names":["RoleClientForeignKey1784970000000","name","up","queryRunner","query","down"],"sources":["../../../../../src/adapters/database/migrations/mysql/1784970000000-RoleClientForeignKey.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { MigrationInterface, QueryRunner } from 'typeorm';\n\n/**\n * Re-targets auth_roles.client_id onto auth_clients. The column has\n * referenced auth_realms(id) since 1740991051622 — a copy-paste of the\n * realm relation on the entity (`@ManyToOne(() => RealmEntity)` on the\n * client join column), so a client-scoped role could never store an\n * actual client id. Same defect (and same fix) as the\n * auth_permissions.client_id re-target in 1766830857009; the constraint\n * name is unchanged because TypeORM derives it from the table and\n * column names, not the referenced table.\n *\n * Any surviving non-null client_id is a realm id (that is what the old\n * FK enforced) and cannot be interpreted as a client, so the reference is\n * nulled — never the role row itself: the role, its permission junctions\n * and its user assignments are legitimate, only the column value is\n * noise (and role.clientId does not scope evaluation-time permission\n * loading, so nulling widens nothing). down() restores the previous\n * auth_realms target, nulling values the old constraint would reject.\n */\nexport class RoleClientForeignKey1784970000000 implements MigrationInterface {\n    name = 'RoleClientForeignKey1784970000000';\n\n    public async up(queryRunner: QueryRunner): Promise<void> {\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_roles\\` DROP FOREIGN KEY \\`FK_8f460e65af897b9b049f582ad0e\\`\n        `);\n        await queryRunner.query(`\n            UPDATE \\`auth_roles\\`\n            SET \\`client_id\\` = NULL\n            WHERE \\`client_id\\` IS NOT NULL\n                AND \\`client_id\\` NOT IN (SELECT \\`id\\` FROM \\`auth_clients\\`)\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_roles\\`\n            ADD CONSTRAINT \\`FK_8f460e65af897b9b049f582ad0e\\` FOREIGN KEY (\\`client_id\\`) REFERENCES \\`auth_clients\\`(\\`id\\`) ON DELETE\n            SET NULL ON UPDATE NO ACTION\n        `);\n    }\n\n    public async down(queryRunner: QueryRunner): Promise<void> {\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_roles\\` DROP FOREIGN KEY \\`FK_8f460e65af897b9b049f582ad0e\\`\n        `);\n        await queryRunner.query(`\n            UPDATE \\`auth_roles\\`\n            SET \\`client_id\\` = NULL\n            WHERE \\`client_id\\` IS NOT NULL\n                AND \\`client_id\\` NOT IN (SELECT \\`id\\` FROM \\`auth_realms\\`)\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_roles\\`\n            ADD CONSTRAINT \\`FK_8f460e65af897b9b049f582ad0e\\` FOREIGN KEY (\\`client_id\\`) REFERENCES \\`auth_realms\\`(\\`id\\`) ON DELETE\n            SET NULL ON UPDATE NO ACTION\n        `);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;GA2BA,IAAaA,oCAAb,MAAaA;CACTC,OAAO;CAEP,MAAaC,GAAGC,aAAyC;EACrD,MAAMA,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;;;;SAKvB;EACD,MAAMD,YAAYC,MAAM;;;;SAIvB;CACL;CAEA,MAAaC,KAAKF,aAAyC;EACvD,MAAMA,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;;;;SAKvB;EACD,MAAMD,YAAYC,MAAM;;;;SAIvB;CACL;AACJ"}

package/dist/adapters/database/migrations/postgres/1784970000000-RoleClientForeignKey.d.ts

@@ -0,0 +1,25 @@
+import type { MigrationInterface, QueryRunner } from 'typeorm';
+/**
+ * Re-targets auth_roles.client_id onto auth_clients. The column has
+ * referenced auth_realms(id) since 1740991051622 — a copy-paste of the
+ * realm relation on the entity (`@ManyToOne(() => RealmEntity)` on the
+ * client join column), so a client-scoped role could never store an
+ * actual client id. Same defect (and same fix) as the
+ * auth_permissions.client_id re-target in 1766830857009; the constraint
+ * name is unchanged because TypeORM derives it from the table and
+ * column names, not the referenced table.
+ *
+ * Any surviving non-null client_id is a realm id (that is what the old
+ * FK enforced) and cannot be interpreted as a client, so the reference is
+ * nulled — never the role row itself: the role, its permission junctions
+ * and its user assignments are legitimate, only the column value is
+ * noise (and role.clientId does not scope evaluation-time permission
+ * loading, so nulling widens nothing). down() restores the previous
+ * auth_realms target, nulling values the old constraint would reject.
+ */
+export declare class RoleClientForeignKey1784970000000 implements MigrationInterface {
+    name: string;
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}
+//# sourceMappingURL=1784970000000-RoleClientForeignKey.d.ts.map

package/dist/adapters/database/migrations/postgres/1784970000000-RoleClientForeignKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"1784970000000-RoleClientForeignKey.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/database/migrations/postgres/1784970000000-RoleClientForeignKey.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE/D;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,iCAAkC,YAAW,kBAAkB;IACxE,IAAI,SAAuC;IAE9B,EAAE,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAiB3C,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CAgB7D"}

package/dist/adapters/database/migrations/postgres/1784970000000-RoleClientForeignKey.mjs

@@ -0,0 +1,60 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/adapters/database/migrations/postgres/1784970000000-RoleClientForeignKey.ts
+/**
+* Re-targets auth_roles.client_id onto auth_clients. The column has
+* referenced auth_realms(id) since 1740991051622 — a copy-paste of the
+* realm relation on the entity (`@ManyToOne(() => RealmEntity)` on the
+* client join column), so a client-scoped role could never store an
+* actual client id. Same defect (and same fix) as the
+* auth_permissions.client_id re-target in 1766830857009; the constraint
+* name is unchanged because TypeORM derives it from the table and
+* column names, not the referenced table.
+*
+* Any surviving non-null client_id is a realm id (that is what the old
+* FK enforced) and cannot be interpreted as a client, so the reference is
+* nulled — never the role row itself: the role, its permission junctions
+* and its user assignments are legitimate, only the column value is
+* noise (and role.clientId does not scope evaluation-time permission
+* loading, so nulling widens nothing). down() restores the previous
+* auth_realms target, nulling values the old constraint would reject.
+*/ var RoleClientForeignKey1784970000000 = class {
+	name = "RoleClientForeignKey1784970000000";
+	async up(queryRunner) {
+		await queryRunner.query(`
+            ALTER TABLE "auth_roles" DROP CONSTRAINT "FK_8f460e65af897b9b049f582ad0e"
+        `);
+		await queryRunner.query(`
+            UPDATE "auth_roles"
+            SET "client_id" = NULL
+            WHERE "client_id" IS NOT NULL
+                AND "client_id" NOT IN (SELECT "id" FROM "auth_clients")
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_roles"
+            ADD CONSTRAINT "FK_8f460e65af897b9b049f582ad0e" FOREIGN KEY ("client_id") REFERENCES "auth_clients"("id") ON DELETE
+            SET NULL ON UPDATE NO ACTION
+        `);
+	}
+	async down(queryRunner) {
+		await queryRunner.query(`
+            ALTER TABLE "auth_roles" DROP CONSTRAINT "FK_8f460e65af897b9b049f582ad0e"
+        `);
+		await queryRunner.query(`
+            UPDATE "auth_roles"
+            SET "client_id" = NULL
+            WHERE "client_id" IS NOT NULL
+                AND "client_id" NOT IN (SELECT "id" FROM "auth_realms")
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_roles"
+            ADD CONSTRAINT "FK_8f460e65af897b9b049f582ad0e" FOREIGN KEY ("client_id") REFERENCES "auth_realms"("id") ON DELETE
+            SET NULL ON UPDATE NO ACTION
+        `);
+	}
+};
+//#endregion
+export { RoleClientForeignKey1784970000000 };
+
+//# sourceMappingURL=1784970000000-RoleClientForeignKey.mjs.map

package/dist/adapters/database/migrations/postgres/1784970000000-RoleClientForeignKey.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"1784970000000-RoleClientForeignKey.mjs","names":["RoleClientForeignKey1784970000000","name","up","queryRunner","query","down"],"sources":["../../../../../src/adapters/database/migrations/postgres/1784970000000-RoleClientForeignKey.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { MigrationInterface, QueryRunner } from 'typeorm';\n\n/**\n * Re-targets auth_roles.client_id onto auth_clients. The column has\n * referenced auth_realms(id) since 1740991051622 — a copy-paste of the\n * realm relation on the entity (`@ManyToOne(() => RealmEntity)` on the\n * client join column), so a client-scoped role could never store an\n * actual client id. Same defect (and same fix) as the\n * auth_permissions.client_id re-target in 1766830857009; the constraint\n * name is unchanged because TypeORM derives it from the table and\n * column names, not the referenced table.\n *\n * Any surviving non-null client_id is a realm id (that is what the old\n * FK enforced) and cannot be interpreted as a client, so the reference is\n * nulled — never the role row itself: the role, its permission junctions\n * and its user assignments are legitimate, only the column value is\n * noise (and role.clientId does not scope evaluation-time permission\n * loading, so nulling widens nothing). down() restores the previous\n * auth_realms target, nulling values the old constraint would reject.\n */\nexport class RoleClientForeignKey1784970000000 implements MigrationInterface {\n    name = 'RoleClientForeignKey1784970000000';\n\n    public async up(queryRunner: QueryRunner): Promise<void> {\n        await queryRunner.query(`\n            ALTER TABLE \"auth_roles\" DROP CONSTRAINT \"FK_8f460e65af897b9b049f582ad0e\"\n        `);\n        await queryRunner.query(`\n            UPDATE \"auth_roles\"\n            SET \"client_id\" = NULL\n            WHERE \"client_id\" IS NOT NULL\n                AND \"client_id\" NOT IN (SELECT \"id\" FROM \"auth_clients\")\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \"auth_roles\"\n            ADD CONSTRAINT \"FK_8f460e65af897b9b049f582ad0e\" FOREIGN KEY (\"client_id\") REFERENCES \"auth_clients\"(\"id\") ON DELETE\n            SET NULL ON UPDATE NO ACTION\n        `);\n    }\n\n    public async down(queryRunner: QueryRunner): Promise<void> {\n        await queryRunner.query(`\n            ALTER TABLE \"auth_roles\" DROP CONSTRAINT \"FK_8f460e65af897b9b049f582ad0e\"\n        `);\n        await queryRunner.query(`\n            UPDATE \"auth_roles\"\n            SET \"client_id\" = NULL\n            WHERE \"client_id\" IS NOT NULL\n                AND \"client_id\" NOT IN (SELECT \"id\" FROM \"auth_realms\")\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \"auth_roles\"\n            ADD CONSTRAINT \"FK_8f460e65af897b9b049f582ad0e\" FOREIGN KEY (\"client_id\") REFERENCES \"auth_realms\"(\"id\") ON DELETE\n            SET NULL ON UPDATE NO ACTION\n        `);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;GA2BA,IAAaA,oCAAb,MAAaA;CACTC,OAAO;CAEP,MAAaC,GAAGC,aAAyC;EACrD,MAAMA,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;;;;SAKvB;EACD,MAAMD,YAAYC,MAAM;;;;SAIvB;CACL;CAEA,MAAaC,KAAKF,aAAyC;EACvD,MAAMA,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;;;;SAKvB;EACD,MAAMD,YAAYC,MAAM;;;;SAIvB;CACL;AACJ"}

package/dist/adapters/http/adapters/oauth2/grant-types/authorize.mjs

@@ -61,7 +61,7 @@ var HTTPOAuth2AuthorizeGrant = class extends OAuth2AuthorizeGrant {
 		}
 		return this.runWith(entity, {
 			confirmation,
-			ipAddress: getRequestIP(event, { trustProxy: true }) ?? void 0,
+			ipAddress: getRequestIP(event) ?? void 0,
 			userAgent: getRequestHeader(event, "user-agent") ?? void 0
 		});
 	}

package/dist/adapters/http/adapters/oauth2/grant-types/authorize.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.mjs","names":["isClientPublic","OAuth2GrantError","OAuth2RequestError","OAuth2TokenGrant","readRequestBody","useRequestQuery","getRequestHeader","getRequestIP","OAuth2AuthorizeGrant","assertClientGrantAllowed","extractClientCredentialsFromRequest","extractOAuth2ClientCertificateEvidence","readRealmHint","HTTPOAuth2AuthorizeGrant","codeVerifier","clientAuthenticator","realmRepository","accessPolicyEvaluator","certificateSource","ctx","runWithRequest","event","body","query","code","pickStringParam","redirectUri","malformed","clientId","clientSecret","realm","resolve","certificateEvidence","client","authenticate","id","confirmation","resolveTokenBinding","AUTHORIZATION_CODE","entity","verify","clientIsPublic","realmId","accessPolicyId","allowed","evaluate","type","sub_kind","sub","realm_id","realmName","realm_name","client_id","invalid","runWith","ipAddress","trustProxy","undefined","userAgent","key","value","length"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/authorize.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { isClientPublic } from '@authup/core-kit';\nimport { OAuth2GrantError, OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport { OAuth2AuthorizeGrant, assertClientGrantAllowed } from '../../../../../core/index.ts';\nimport type {\n    IOAuth2AccessPolicyEvaluator,\n    IOAuth2AuthorizationCodeVerifier,\n    IRealmRepository,\n    OAuth2ClientAuthenticator,\n} from '../../../../../core/index.ts';\nimport type { HTTPOAuth2AuthorizeGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport type { CertificateSource } from '../../../request/index.ts';\nimport {\n    extractClientCredentialsFromRequest,\n    extractOAuth2ClientCertificateEvidence,\n    readRealmHint,\n} from './utils/index.ts';\n\nexport class HTTPOAuth2AuthorizeGrant extends OAuth2AuthorizeGrant implements IHTTPOAuth2Grant {\n    protected codeVerifier : IOAuth2AuthorizationCodeVerifier;\n\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    protected realmRepository : IRealmRepository;\n\n    protected accessPolicyEvaluator? : IOAuth2AccessPolicyEvaluator;\n\n    protected certificateSource: CertificateSource;\n\n    constructor(ctx: HTTPOAuth2AuthorizeGrantContext) {\n        super(ctx);\n\n        this.codeVerifier = ctx.codeVerifier;\n        this.clientAuthenticator = ctx.clientAuthenticator;\n        this.realmRepository = ctx.realmRepository;\n        this.accessPolicyEvaluator = ctx.accessPolicyEvaluator;\n        this.certificateSource = ctx.certificateSource ?? 'disabled';\n    }\n\n    async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const body = await readRequestBody(event);\n        const query = useRequestQuery(event);\n\n        const code = this.pickStringParam(body, query, 'code');\n        const redirectUri = this.pickStringParam(body, query, 'redirect_uri');\n        const codeVerifier = this.pickStringParam(body, query, 'code_verifier');\n        if (!code) {\n            throw OAuth2RequestError.malformed();\n        }\n\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n        const realm = await this.realmRepository.resolve(readRealmHint(body, query), true);\n        const certificateEvidence = await extractOAuth2ClientCertificateEvidence(event, this.certificateSource);\n\n        const client = await this.clientAuthenticator.authenticate(\n            clientId,\n            clientSecret,\n            realm.id,\n            certificateEvidence,\n        );\n        const confirmation = this.clientAuthenticator.resolveTokenBinding(client, certificateEvidence);\n\n        assertClientGrantAllowed(client, OAuth2TokenGrant.AUTHORIZATION_CODE);\n\n        const entity = await this.codeVerifier.verify(code, {\n            redirectUri,\n            codeVerifier,\n            clientId: client.id,\n            clientIsPublic: isClientPublic(client),\n            realmId: client.realmId,\n        });\n\n        // Application access policy (plan 052), /token backstop: a code\n        // minted before the policy was attached (or outside authorize())\n        // must not redeem. The subject is built from the code-blob scalars —\n        // no DB identity load; attribute-rich policies are enforced at the\n        // issuance legs. Denial = invalid_grant, never access_denied here.\n        if (client.accessPolicyId) {\n            let allowed = false;\n            if (this.accessPolicyEvaluator) {\n                allowed = await this.accessPolicyEvaluator.evaluate(client.accessPolicyId, {\n                    type: entity.sub_kind,\n                    id: entity.sub,\n                    realmId: entity.realm_id ?? null,\n                    realmName: entity.realm_name ?? null,\n                    clientId: entity.client_id ?? null,\n                });\n            }\n\n            if (!allowed) {\n                throw OAuth2GrantError.invalid();\n            }\n        }\n\n        return this.runWith(entity, {\n            confirmation,\n            ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n\n    protected pickStringParam(\n        body: Record<string, any> | undefined,\n        query: Record<string, any> | undefined,\n        key: string,\n    ): string | undefined {\n        const value = body?.[key] ?? query?.[key];\n        return typeof value === 'string' && value.length > 0 ? value : undefined;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA6BA,IAAaa,2BAAb,cAA8CL,qBAAAA;CAChCM;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAsC;EAC9C,MAAMA,GAAAA;EAEN,KAAKL,eAAeK,IAAIL;EACxB,KAAKC,sBAAsBI,IAAIJ;EAC/B,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,wBAAwBE,IAAIF;EACjC,KAAKC,oBAAoBC,IAAID,qBAAqB;CACtD;CAEA,MAAME,eAAeC,OAAqD;EACtE,MAAMC,OAAO,MAAMlB,gBAAgBiB,KAAAA;EACnC,MAAME,QAAQlB,gBAAgBgB,KAAAA;EAE9B,MAAMG,OAAO,KAAKC,gBAAgBH,MAAMC,OAAO,MAAA;EAC/C,MAAMG,cAAc,KAAKD,gBAAgBH,MAAMC,OAAO,cAAA;EACtD,MAAMT,eAAe,KAAKW,gBAAgBH,MAAMC,OAAO,eAAA;EACvD,IAAI,CAACC,MACD,MAAMtB,mBAAmByB,UAAS;EAGtC,MAAM,EAAEC,UAAUC,iBAAiB,MAAMnB,oCAAoCW,KAAAA;EAC7E,MAAMS,QAAQ,MAAM,KAAKd,gBAAgBe,QAAQnB,cAAcU,MAAMC,KAAAA,GAAQ,IAAA;EAC7E,MAAMS,sBAAsB,MAAMrB,uCAAuCU,OAAO,KAAKH,iBAAiB;EAEtG,MAAMe,SAAS,MAAM,KAAKlB,oBAAoBmB,aAC1CN,UACAC,cACAC,MAAMK,IACNH,mBAAAA;EAEJ,MAAMI,eAAe,KAAKrB,oBAAoBsB,oBAAoBJ,QAAQD,mBAAAA;EAE1EvB,yBAAyBwB,QAAQ9B,iBAAiBmC,kBAAkB;EAEpE,MAAMC,SAAS,MAAM,KAAKzB,aAAa0B,OAAOhB,MAAM;GAChDE;GACAZ;GACAc,UAAUK,OAAOE;GACjBM,gBAAgBzC,eAAeiC,MAAAA;GAC/BS,SAAST,OAAOS;EACpB,CAAA;EAOA,IAAIT,OAAOU,gBAAgB;GACvB,IAAIC,UAAU;GACd,IAAI,KAAK3B,uBACL2B,UAAU,MAAM,KAAK3B,sBAAsB4B,SAASZ,OAAOU,gBAAgB;IACvEG,MAAMP,OAAOQ;IACbZ,IAAII,OAAOS;IACXN,SAASH,OAAOU,YAAY;IAC5BC,WAAWX,OAAOY,cAAc;IAChCvB,UAAUW,OAAOa,aAAa;GAClC,CAAA;GAGJ,IAAI,CAACR,SACD,MAAM3C,iBAAiBoD,QAAO;EAEtC;EAEA,OAAO,KAAKC,QAAQf,QAAQ;GACxBH;GACAmB,WAAWhD,aAAac,OAAO,EAAEmC,YAAY,KAAK,CAAA,KAAMC,KAAAA;GACxDC,WAAWpD,iBAAiBe,OAAO,YAAA,KAAiBoC,KAAAA;EACxD,CAAA;CACJ;CAEUhC,gBACNH,MACAC,OACAoC,KACkB;EAClB,MAAMC,QAAQtC,OAAOqC,QAAQpC,QAAQoC;EACrC,OAAO,OAAOC,UAAU,YAAYA,MAAMC,SAAS,IAAID,QAAQH,KAAAA;CACnE;AACJ"}
+{"version":3,"file":"authorize.mjs","names":["isClientPublic","OAuth2GrantError","OAuth2RequestError","OAuth2TokenGrant","readRequestBody","useRequestQuery","getRequestHeader","getRequestIP","OAuth2AuthorizeGrant","assertClientGrantAllowed","extractClientCredentialsFromRequest","extractOAuth2ClientCertificateEvidence","readRealmHint","HTTPOAuth2AuthorizeGrant","codeVerifier","clientAuthenticator","realmRepository","accessPolicyEvaluator","certificateSource","ctx","runWithRequest","event","body","query","code","pickStringParam","redirectUri","malformed","clientId","clientSecret","realm","resolve","certificateEvidence","client","authenticate","id","confirmation","resolveTokenBinding","AUTHORIZATION_CODE","entity","verify","clientIsPublic","realmId","accessPolicyId","allowed","evaluate","type","sub_kind","sub","realm_id","realmName","realm_name","client_id","invalid","runWith","ipAddress","undefined","userAgent","key","value","length"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/authorize.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { isClientPublic } from '@authup/core-kit';\nimport { OAuth2GrantError, OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport { OAuth2AuthorizeGrant, assertClientGrantAllowed } from '../../../../../core/index.ts';\nimport type {\n    IOAuth2AccessPolicyEvaluator,\n    IOAuth2AuthorizationCodeVerifier,\n    IRealmRepository,\n    OAuth2ClientAuthenticator,\n} from '../../../../../core/index.ts';\nimport type { HTTPOAuth2AuthorizeGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport type { CertificateSource } from '../../../request/index.ts';\nimport {\n    extractClientCredentialsFromRequest,\n    extractOAuth2ClientCertificateEvidence,\n    readRealmHint,\n} from './utils/index.ts';\n\nexport class HTTPOAuth2AuthorizeGrant extends OAuth2AuthorizeGrant implements IHTTPOAuth2Grant {\n    protected codeVerifier : IOAuth2AuthorizationCodeVerifier;\n\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    protected realmRepository : IRealmRepository;\n\n    protected accessPolicyEvaluator? : IOAuth2AccessPolicyEvaluator;\n\n    protected certificateSource: CertificateSource;\n\n    constructor(ctx: HTTPOAuth2AuthorizeGrantContext) {\n        super(ctx);\n\n        this.codeVerifier = ctx.codeVerifier;\n        this.clientAuthenticator = ctx.clientAuthenticator;\n        this.realmRepository = ctx.realmRepository;\n        this.accessPolicyEvaluator = ctx.accessPolicyEvaluator;\n        this.certificateSource = ctx.certificateSource ?? 'disabled';\n    }\n\n    async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const body = await readRequestBody(event);\n        const query = useRequestQuery(event);\n\n        const code = this.pickStringParam(body, query, 'code');\n        const redirectUri = this.pickStringParam(body, query, 'redirect_uri');\n        const codeVerifier = this.pickStringParam(body, query, 'code_verifier');\n        if (!code) {\n            throw OAuth2RequestError.malformed();\n        }\n\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n        const realm = await this.realmRepository.resolve(readRealmHint(body, query), true);\n        const certificateEvidence = await extractOAuth2ClientCertificateEvidence(event, this.certificateSource);\n\n        const client = await this.clientAuthenticator.authenticate(\n            clientId,\n            clientSecret,\n            realm.id,\n            certificateEvidence,\n        );\n        const confirmation = this.clientAuthenticator.resolveTokenBinding(client, certificateEvidence);\n\n        assertClientGrantAllowed(client, OAuth2TokenGrant.AUTHORIZATION_CODE);\n\n        const entity = await this.codeVerifier.verify(code, {\n            redirectUri,\n            codeVerifier,\n            clientId: client.id,\n            clientIsPublic: isClientPublic(client),\n            realmId: client.realmId,\n        });\n\n        // Application access policy (plan 052), /token backstop: a code\n        // minted before the policy was attached (or outside authorize())\n        // must not redeem. The subject is built from the code-blob scalars —\n        // no DB identity load; attribute-rich policies are enforced at the\n        // issuance legs. Denial = invalid_grant, never access_denied here.\n        if (client.accessPolicyId) {\n            let allowed = false;\n            if (this.accessPolicyEvaluator) {\n                allowed = await this.accessPolicyEvaluator.evaluate(client.accessPolicyId, {\n                    type: entity.sub_kind,\n                    id: entity.sub,\n                    realmId: entity.realm_id ?? null,\n                    realmName: entity.realm_name ?? null,\n                    clientId: entity.client_id ?? null,\n                });\n            }\n\n            if (!allowed) {\n                throw OAuth2GrantError.invalid();\n            }\n        }\n\n        return this.runWith(entity, {\n            confirmation,\n            ipAddress: getRequestIP(event) ?? undefined,\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n\n    protected pickStringParam(\n        body: Record<string, any> | undefined,\n        query: Record<string, any> | undefined,\n        key: string,\n    ): string | undefined {\n        const value = body?.[key] ?? query?.[key];\n        return typeof value === 'string' && value.length > 0 ? value : undefined;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA6BA,IAAaa,2BAAb,cAA8CL,qBAAAA;CAChCM;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAsC;EAC9C,MAAMA,GAAAA;EAEN,KAAKL,eAAeK,IAAIL;EACxB,KAAKC,sBAAsBI,IAAIJ;EAC/B,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,wBAAwBE,IAAIF;EACjC,KAAKC,oBAAoBC,IAAID,qBAAqB;CACtD;CAEA,MAAME,eAAeC,OAAqD;EACtE,MAAMC,OAAO,MAAMlB,gBAAgBiB,KAAAA;EACnC,MAAME,QAAQlB,gBAAgBgB,KAAAA;EAE9B,MAAMG,OAAO,KAAKC,gBAAgBH,MAAMC,OAAO,MAAA;EAC/C,MAAMG,cAAc,KAAKD,gBAAgBH,MAAMC,OAAO,cAAA;EACtD,MAAMT,eAAe,KAAKW,gBAAgBH,MAAMC,OAAO,eAAA;EACvD,IAAI,CAACC,MACD,MAAMtB,mBAAmByB,UAAS;EAGtC,MAAM,EAAEC,UAAUC,iBAAiB,MAAMnB,oCAAoCW,KAAAA;EAC7E,MAAMS,QAAQ,MAAM,KAAKd,gBAAgBe,QAAQnB,cAAcU,MAAMC,KAAAA,GAAQ,IAAA;EAC7E,MAAMS,sBAAsB,MAAMrB,uCAAuCU,OAAO,KAAKH,iBAAiB;EAEtG,MAAMe,SAAS,MAAM,KAAKlB,oBAAoBmB,aAC1CN,UACAC,cACAC,MAAMK,IACNH,mBAAAA;EAEJ,MAAMI,eAAe,KAAKrB,oBAAoBsB,oBAAoBJ,QAAQD,mBAAAA;EAE1EvB,yBAAyBwB,QAAQ9B,iBAAiBmC,kBAAkB;EAEpE,MAAMC,SAAS,MAAM,KAAKzB,aAAa0B,OAAOhB,MAAM;GAChDE;GACAZ;GACAc,UAAUK,OAAOE;GACjBM,gBAAgBzC,eAAeiC,MAAAA;GAC/BS,SAAST,OAAOS;EACpB,CAAA;EAOA,IAAIT,OAAOU,gBAAgB;GACvB,IAAIC,UAAU;GACd,IAAI,KAAK3B,uBACL2B,UAAU,MAAM,KAAK3B,sBAAsB4B,SAASZ,OAAOU,gBAAgB;IACvEG,MAAMP,OAAOQ;IACbZ,IAAII,OAAOS;IACXN,SAASH,OAAOU,YAAY;IAC5BC,WAAWX,OAAOY,cAAc;IAChCvB,UAAUW,OAAOa,aAAa;GAClC,CAAA;GAGJ,IAAI,CAACR,SACD,MAAM3C,iBAAiBoD,QAAO;EAEtC;EAEA,OAAO,KAAKC,QAAQf,QAAQ;GACxBH;GACAmB,WAAWhD,aAAac,KAAAA,KAAUmC,KAAAA;GAClCC,WAAWnD,iBAAiBe,OAAO,YAAA,KAAiBmC,KAAAA;EACxD,CAAA;CACJ;CAEU/B,gBACNH,MACAC,OACAmC,KACkB;EAClB,MAAMC,QAAQrC,OAAOoC,QAAQnC,QAAQmC;EACrC,OAAO,OAAOC,UAAU,YAAYA,MAAMC,SAAS,IAAID,QAAQH,KAAAA;CACnE;AACJ"}

package/dist/adapters/http/adapters/oauth2/grant-types/client-credentials.mjs

@@ -31,7 +31,7 @@ var HTTPClientCredentialsGrant = class extends ClientCredentialsGrant {
 		assertClientGrantAllowed(client, OAuth2TokenGrant.CLIENT_CREDENTIALS);
 		return this.runWith(client, {
 			confirmation,
-			ipAddress: getRequestIP(event, { trustProxy: true }) ?? void 0,
+			ipAddress: getRequestIP(event) ?? void 0,
 			userAgent: getRequestHeader(event, "user-agent") ?? void 0
 		});
 	}

package/dist/adapters/http/adapters/oauth2/grant-types/client-credentials.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"client-credentials.mjs","names":["OAuth2ClientError","OAuth2TokenGrant","readRequestBody","ClientAuthMethod","getRequestHeader","getRequestIP","ClientCredentialsGrant","assertClientGrantAllowed","extractClientCredentialsFromRequest","extractOAuth2ClientCertificateEvidence","HTTPClientCredentialsGrant","clientAuthenticator","certificateSource","ctx","runWithRequest","event","clientId","clientSecret","body","realmId","realm_id","invalid","certificateEvidence","client","authenticate","authMethod","NONE","confirmation","resolveTokenBinding","CLIENT_CREDENTIALS","runWith","ipAddress","trustProxy","undefined","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/client-credentials.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2ClientError, OAuth2TokenGrant  } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport { ClientAuthMethod } from '@authup/core-kit';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type { OAuth2ClientAuthenticator } from '../../../../../core/index.ts';\nimport { ClientCredentialsGrant, assertClientGrantAllowed } from '../../../../../core/index.ts';\nimport type { HTTPOAuth2ClientCredentialsGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport type { CertificateSource } from '../../../request/index.ts';\nimport {\n    extractClientCredentialsFromRequest,\n    extractOAuth2ClientCertificateEvidence,\n} from './utils/index.ts';\n\nexport class HTTPClientCredentialsGrant extends ClientCredentialsGrant implements IHTTPOAuth2Grant {\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    protected certificateSource: CertificateSource;\n\n    constructor(ctx: HTTPOAuth2ClientCredentialsGrantContext) {\n        super(ctx);\n\n        this.clientAuthenticator = ctx.clientAuthenticator;\n        this.certificateSource = ctx.certificateSource ?? 'disabled';\n    }\n\n    async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n        const body = await readRequestBody(event);\n        const realmId = body?.realm_id;\n\n        if (!clientId) {\n            throw OAuth2ClientError.invalid();\n        }\n\n        const certificateEvidence = await extractOAuth2ClientCertificateEvidence(event, this.certificateSource);\n        const client = await this.clientAuthenticator.authenticate(\n            clientId,\n            clientSecret,\n            realmId,\n            certificateEvidence,\n        );\n        if (client.authMethod === ClientAuthMethod.NONE) {\n            throw OAuth2ClientError.invalid();\n        }\n        const confirmation = this.clientAuthenticator.resolveTokenBinding(client, certificateEvidence);\n\n        assertClientGrantAllowed(client, OAuth2TokenGrant.CLIENT_CREDENTIALS);\n\n        return this.runWith(client, {\n            confirmation,\n            ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;AAsBA,IAAaU,6BAAb,cAAgDJ,uBAAAA;CAClCK;CAEAC;CAEV,YAAYC,KAA8C;EACtD,MAAMA,GAAAA;EAEN,KAAKF,sBAAsBE,IAAIF;EAC/B,KAAKC,oBAAoBC,IAAID,qBAAqB;CACtD;CAEA,MAAME,eAAeC,OAAqD;EACtE,MAAM,EAAEC,UAAUC,iBAAiB,MAAMT,oCAAoCO,KAAAA;EAE7E,MAAMI,WAAUD,MADGhB,gBAAgBa,KAAAA,EAAAA,EACbK;EAEtB,IAAI,CAACJ,UACD,MAAMhB,kBAAkBqB,QAAO;EAGnC,MAAMC,sBAAsB,MAAMb,uCAAuCM,OAAO,KAAKH,iBAAiB;EACtG,MAAMW,SAAS,MAAM,KAAKZ,oBAAoBa,aAC1CR,UACAC,cACAE,SACAG,mBAAAA;EAEJ,IAAIC,OAAOE,eAAetB,iBAAiBuB,MACvC,MAAM1B,kBAAkBqB,QAAO;EAEnC,MAAMM,eAAe,KAAKhB,oBAAoBiB,oBAAoBL,QAAQD,mBAAAA;EAE1Ef,yBAAyBgB,QAAQtB,iBAAiB4B,kBAAkB;EAEpE,OAAO,KAAKC,QAAQP,QAAQ;GACxBI;GACAI,WAAW1B,aAAaU,OAAO,EAAEiB,YAAY,KAAK,CAAA,KAAMC,KAAAA;GACxDC,WAAW9B,iBAAiBW,OAAO,YAAA,KAAiBkB,KAAAA;EACxD,CAAA;CACJ;AACJ"}
+{"version":3,"file":"client-credentials.mjs","names":["OAuth2ClientError","OAuth2TokenGrant","readRequestBody","ClientAuthMethod","getRequestHeader","getRequestIP","ClientCredentialsGrant","assertClientGrantAllowed","extractClientCredentialsFromRequest","extractOAuth2ClientCertificateEvidence","HTTPClientCredentialsGrant","clientAuthenticator","certificateSource","ctx","runWithRequest","event","clientId","clientSecret","body","realmId","realm_id","invalid","certificateEvidence","client","authenticate","authMethod","NONE","confirmation","resolveTokenBinding","CLIENT_CREDENTIALS","runWith","ipAddress","undefined","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/client-credentials.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2ClientError, OAuth2TokenGrant  } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport { ClientAuthMethod } from '@authup/core-kit';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type { OAuth2ClientAuthenticator } from '../../../../../core/index.ts';\nimport { ClientCredentialsGrant, assertClientGrantAllowed } from '../../../../../core/index.ts';\nimport type { HTTPOAuth2ClientCredentialsGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport type { CertificateSource } from '../../../request/index.ts';\nimport {\n    extractClientCredentialsFromRequest,\n    extractOAuth2ClientCertificateEvidence,\n} from './utils/index.ts';\n\nexport class HTTPClientCredentialsGrant extends ClientCredentialsGrant implements IHTTPOAuth2Grant {\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    protected certificateSource: CertificateSource;\n\n    constructor(ctx: HTTPOAuth2ClientCredentialsGrantContext) {\n        super(ctx);\n\n        this.clientAuthenticator = ctx.clientAuthenticator;\n        this.certificateSource = ctx.certificateSource ?? 'disabled';\n    }\n\n    async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n        const body = await readRequestBody(event);\n        const realmId = body?.realm_id;\n\n        if (!clientId) {\n            throw OAuth2ClientError.invalid();\n        }\n\n        const certificateEvidence = await extractOAuth2ClientCertificateEvidence(event, this.certificateSource);\n        const client = await this.clientAuthenticator.authenticate(\n            clientId,\n            clientSecret,\n            realmId,\n            certificateEvidence,\n        );\n        if (client.authMethod === ClientAuthMethod.NONE) {\n            throw OAuth2ClientError.invalid();\n        }\n        const confirmation = this.clientAuthenticator.resolveTokenBinding(client, certificateEvidence);\n\n        assertClientGrantAllowed(client, OAuth2TokenGrant.CLIENT_CREDENTIALS);\n\n        return this.runWith(client, {\n            confirmation,\n            ipAddress: getRequestIP(event) ?? undefined,\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;AAsBA,IAAaU,6BAAb,cAAgDJ,uBAAAA;CAClCK;CAEAC;CAEV,YAAYC,KAA8C;EACtD,MAAMA,GAAAA;EAEN,KAAKF,sBAAsBE,IAAIF;EAC/B,KAAKC,oBAAoBC,IAAID,qBAAqB;CACtD;CAEA,MAAME,eAAeC,OAAqD;EACtE,MAAM,EAAEC,UAAUC,iBAAiB,MAAMT,oCAAoCO,KAAAA;EAE7E,MAAMI,WAAUD,MADGhB,gBAAgBa,KAAAA,EAAAA,EACbK;EAEtB,IAAI,CAACJ,UACD,MAAMhB,kBAAkBqB,QAAO;EAGnC,MAAMC,sBAAsB,MAAMb,uCAAuCM,OAAO,KAAKH,iBAAiB;EACtG,MAAMW,SAAS,MAAM,KAAKZ,oBAAoBa,aAC1CR,UACAC,cACAE,SACAG,mBAAAA;EAEJ,IAAIC,OAAOE,eAAetB,iBAAiBuB,MACvC,MAAM1B,kBAAkBqB,QAAO;EAEnC,MAAMM,eAAe,KAAKhB,oBAAoBiB,oBAAoBL,QAAQD,mBAAAA;EAE1Ef,yBAAyBgB,QAAQtB,iBAAiB4B,kBAAkB;EAEpE,OAAO,KAAKC,QAAQP,QAAQ;GACxBI;GACAI,WAAW1B,aAAaU,KAAAA,KAAUiB,KAAAA;GAClCC,WAAW7B,iBAAiBW,OAAO,YAAA,KAAiBiB,KAAAA;EACxD,CAAA;CACJ;AACJ"}

package/dist/adapters/http/adapters/oauth2/grant-types/identity.mjs

@@ -11,7 +11,7 @@ var HTTPOAuth2IdentityGrantType = class extends IdentityGrantType {
 	runWithRequest(event) {
 		const identity = useRequestIdentityOrFail(event);
 		return this.runWith(identity.raw, {
-			ipAddress: getRequestIP(event, { trustProxy: true }) ?? void 0,
+			ipAddress: getRequestIP(event) ?? void 0,
 			userAgent: getRequestHeader(event, "user-agent") ?? void 0
 		});
 	}

package/dist/adapters/http/adapters/oauth2/grant-types/identity.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"identity.mjs","names":["getRequestHeader","getRequestIP","IdentityGrantType","useRequestIdentityOrFail","HTTPOAuth2IdentityGrantType","runWithRequest","event","identity","runWith","raw","ipAddress","trustProxy","undefined","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/identity.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport { IdentityGrantType } from '../../../../../core/index.ts';\nimport { useRequestIdentityOrFail } from '../../../request/index.ts';\nimport type { IHTTPOAuth2Grant } from './types.ts';\n\nexport class HTTPOAuth2IdentityGrantType extends IdentityGrantType implements IHTTPOAuth2Grant {\n    runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const identity = useRequestIdentityOrFail(event);\n\n        return this.runWith(\n            identity.raw,\n            {\n                ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n                userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n            },\n        );\n    }\n}\n"],"mappings":";;;;;;;;;AAcA,IAAaI,8BAAb,cAAiDF,kBAAAA;CAC7CG,eAAeC,OAAqD;EAChE,MAAMC,WAAWJ,yBAAyBG,KAAAA;EAE1C,OAAO,KAAKE,QACRD,SAASE,KACT;GACIC,WAAWT,aAAaK,OAAO,EAAEK,YAAY,KAAK,CAAA,KAAMC,KAAAA;GACxDC,WAAWb,iBAAiBM,OAAO,YAAA,KAAiBM,KAAAA;EACxD,CAAA;CAER;AACJ"}
+{"version":3,"file":"identity.mjs","names":["getRequestHeader","getRequestIP","IdentityGrantType","useRequestIdentityOrFail","HTTPOAuth2IdentityGrantType","runWithRequest","event","identity","runWith","raw","ipAddress","undefined","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/identity.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport { IdentityGrantType } from '../../../../../core/index.ts';\nimport { useRequestIdentityOrFail } from '../../../request/index.ts';\nimport type { IHTTPOAuth2Grant } from './types.ts';\n\nexport class HTTPOAuth2IdentityGrantType extends IdentityGrantType implements IHTTPOAuth2Grant {\n    runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const identity = useRequestIdentityOrFail(event);\n\n        return this.runWith(\n            identity.raw,\n            {\n                ipAddress: getRequestIP(event) ?? undefined,\n                userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n            },\n        );\n    }\n}\n"],"mappings":";;;;;;;;;AAcA,IAAaI,8BAAb,cAAiDF,kBAAAA;CAC7CG,eAAeC,OAAqD;EAChE,MAAMC,WAAWJ,yBAAyBG,KAAAA;EAE1C,OAAO,KAAKE,QACRD,SAASE,KACT;GACIC,WAAWT,aAAaK,KAAAA,KAAUK,KAAAA;GAClCC,WAAWZ,iBAAiBM,OAAO,YAAA,KAAiBK,KAAAA;EACxD,CAAA;CAER;AACJ"}

package/dist/adapters/http/adapters/oauth2/grant-types/password.mjs

@@ -46,7 +46,7 @@ var HTTPPasswordGrant = class extends PasswordGrantType {
 		const client = clientId ? await this.clientAuthenticator.authenticate(clientId, clientSecret, realm.id, certificateEvidence) : void 0;
 		const confirmation = client ? this.clientAuthenticator.resolveTokenBinding(client, certificateEvidence) : void 0;
 		if (client) assertClientGrantAllowed(client, OAuth2TokenGrant.PASSWORD);
-		const ipAddress = getRequestIP(event, { trustProxy: true }) ?? void 0;
+		const ipAddress = getRequestIP(event) ?? void 0;
 		const userAgent = getRequestHeader(event, "user-agent") ?? void 0;
 		const identifier = username.trim().toLowerCase();
 		await this.loginThrottleService?.assertNotThrottled({

package/dist/adapters/http/adapters/oauth2/grant-types/password.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"password.mjs","names":["EventName","EventScope","UserAuthenticatorKind","isEntityCredentialsInvalidError","isEntityInactiveError","OAuth2MfaRequiredError","OAuth2RequestError","OAuth2TokenGrant","readRequestBody","getRequestHeader","getRequestIP","PasswordGrantType","assertClientGrantAllowed","guessUserAuthenticatorKindByResponse","extractClientCredentialsFromRequest","extractOAuth2ClientCertificateEvidence","readRealmHint","readStringField","HTTPPasswordGrant","authenticator","clientAuthenticator","realmRepository","loginThrottleService","userAuthenticatorService","mfaLoginService","logger","certificateSource","ctx","runWithRequest","event","body","username","password","malformed","clientId","clientSecret","realm","resolve","certificateEvidence","client","authenticate","id","undefined","confirmation","resolveTokenBinding","PASSWORD","ipAddress","trustProxy","userAgent","identifier","trim","toLowerCase","assertNotThrottled","realmId","user","e","eventService","record","scope","OAUTH2","name","LOGIN_FAILED","actorType","actorId","actorName","requestIpAddress","requestUserAgent","requestPath","path","requestMethod","method","data","errorCode","code","metrics","recordLogin","mfaVerifiedAt","verifySecondFactor","runWith","status","challenge","issueMaterial","required","otp","ticket","issueMfaTicket","kinds","message","mfa_token","token","mfa_token_expires_in","expiresIn","verified","verify","kind","response","Date","toISOString","interactive","includes","EMAIL","WEBAUTHN","issueTicket","warn","error"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/password.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { User } from '@authup/core-kit';\nimport { EventName, EventScope, UserAuthenticatorKind } from '@authup/core-kit';\nimport type { Logger } from '@authup/server-kit';\nimport { isEntityCredentialsInvalidError, isEntityInactiveError } from '@authup/errors';\nimport type { OAuth2TokenConfirmation, OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2MfaRequiredError, OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type {\n    ICredentialsAuthenticator,\n    ILoginThrottleService,\n    IOAuth2MfaLoginService,\n    IRealmRepository,\n    IUserAuthenticatorService,\n    OAuth2ClientAuthenticator,\n} from '../../../../../core/index.ts';\nimport {\n    PasswordGrantType,\n    assertClientGrantAllowed,\n    guessUserAuthenticatorKindByResponse,\n} from '../../../../../core/index.ts';\nimport type { HTTPOAuth2PasswordGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport type { CertificateSource } from '../../../request/index.ts';\nimport {\n    extractClientCredentialsFromRequest,\n    extractOAuth2ClientCertificateEvidence,\n    readRealmHint,\n    readStringField,\n} from './utils/index.ts';\n\nexport class HTTPPasswordGrant extends PasswordGrantType implements IHTTPOAuth2Grant {\n    protected authenticator : ICredentialsAuthenticator<User>;\n\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    protected realmRepository : IRealmRepository;\n\n    protected loginThrottleService? : ILoginThrottleService;\n\n    protected userAuthenticatorService? : IUserAuthenticatorService;\n\n    protected mfaLoginService? : IOAuth2MfaLoginService;\n\n    protected logger? : Logger;\n\n    protected certificateSource: CertificateSource;\n\n    constructor(ctx: HTTPOAuth2PasswordGrantContext) {\n        super(ctx);\n\n        this.authenticator = ctx.authenticator;\n        this.clientAuthenticator = ctx.clientAuthenticator;\n        this.realmRepository = ctx.realmRepository;\n        this.loginThrottleService = ctx.loginThrottleService;\n        this.userAuthenticatorService = ctx.userAuthenticatorService;\n        this.mfaLoginService = ctx.mfaLoginService;\n        this.logger = ctx.logger;\n        this.certificateSource = ctx.certificateSource ?? 'disabled';\n    }\n\n    async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const body = await readRequestBody(event);\n\n        const username = readStringField(body, 'username');\n        const password = readStringField(body, 'password');\n        if (!username || !password) {\n            throw OAuth2RequestError.malformed('username and password must be provided.');\n        }\n\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n\n        const realm = await this.realmRepository.resolve(readRealmHint(body), true);\n        const certificateEvidence = await extractOAuth2ClientCertificateEvidence(event, this.certificateSource);\n\n        const client = clientId ?\n            await this.clientAuthenticator.authenticate(\n                clientId,\n                clientSecret,\n                realm.id,\n                certificateEvidence,\n            ) :\n            undefined;\n\n        const confirmation = client ?\n            this.clientAuthenticator.resolveTokenBinding(client, certificateEvidence) :\n            undefined;\n\n        if (client) {\n            assertClientGrantAllowed(client, OAuth2TokenGrant.PASSWORD);\n        }\n\n        const ipAddress = getRequestIP(event, { trustProxy: true }) ?? undefined;\n        const userAgent = getRequestHeader(event, 'user-agent') ?? undefined;\n\n        // canonical identifier form (layer 3) — the throttle key and the\n        // loginFailed actorName must match what canonically stored rows carry.\n        const identifier = username.trim().toLowerCase();\n\n        await this.loginThrottleService?.assertNotThrottled({\n            identifier,\n            ipAddress,\n            realmId: realm.id,\n        });\n\n        let user : User;\n        try {\n            user = await this.authenticator.authenticate(username, password, realm.id);\n        } catch (e) {\n            if (isEntityCredentialsInvalidError(e) || isEntityInactiveError(e)) {\n                await this.eventService?.record({\n                    scope: EventScope.OAUTH2,\n                    name: EventName.LOGIN_FAILED,\n                    actorType: null,\n                    actorId: null,\n                    actorName: identifier,\n                    clientId: client?.id ?? null,\n                    realmId: realm.id,\n                    requestIpAddress: ipAddress ?? null,\n                    requestUserAgent: userAgent ?? null,\n                    requestPath: event.path,\n                    requestMethod: event.method,\n                    data: { errorCode: e.code },\n                });\n                this.metrics?.recordLogin('failure');\n            }\n\n            throw e;\n        }\n\n        const mfaVerifiedAt = await this.verifySecondFactor(user, body, {\n            ipAddress,\n            userAgent,\n            clientId: client?.id ?? null,\n            confirmation,\n        });\n\n        return this.runWith(\n            {\n                user, \n                client, \n                mfaVerifiedAt, \n            },\n            {\n                confirmation,\n                ipAddress,\n                userAgent,\n            },\n        );\n    }\n\n    /**\n     * MFA gate on the direct password grant: a user holding a confirmed\n     * device must send a valid `otp` form parameter (TOTP or recovery\n     * code, classified by shape) — otherwise `mfa_required`. Users\n     * without a device pass through (they could never enroll otherwise).\n     */\n    protected async verifySecondFactor(\n        user: User,\n        body: Record<string, any>,\n        ctx: {\n            ipAddress?: string, \n            userAgent?: string, \n            clientId: string | null,\n            confirmation?: OAuth2TokenConfirmation,\n        },\n    ): Promise<string | undefined> {\n        if (!this.userAuthenticatorService) {\n            return undefined;\n        }\n\n        // requirement flags + kinds only — no webauthn material on the token path.\n        const status = await this.userAuthenticatorService.challenge(user.id, { issueMaterial: false });\n        if (!status.required) {\n            return undefined;\n        }\n\n        const otp = readStringField(body, 'otp');\n        if (!otp) {\n            // carry the challengeable kinds so a client (the hosted login form)\n            // can tell whether a single-POST factor (totp/recovery) is on offer\n            // or the user must complete an interactive challenge (email/webauthn).\n            // For the interactive kinds an \"MFA-pending\" ticket (issue #3242)\n            // rides along: a restricted mfa_token-kind bearer accepted ONLY by\n            // the challenge routes, backed by a short-lived pending session\n            // (mfa_at: null) — never a usable access/refresh pair.\n            const ticket = await this.issueMfaTicket(user, status.kinds, ctx);\n\n            throw new OAuth2MfaRequiredError({\n                message: 'Complete a second-factor challenge to continue.',\n                data: {\n                    kinds: status.kinds,\n                    ...(ticket ? {\n                        mfa_token: ticket.token,\n                        mfa_token_expires_in: ticket.expiresIn,\n                    } : {}),\n                },\n            });\n        }\n\n        const verified = await this.userAuthenticatorService.verify(\n            user.id,\n            {\n                kind: guessUserAuthenticatorKindByResponse(otp),\n                response: otp,\n            },\n            {\n                ipAddress: ctx.ipAddress ?? null,\n                userAgent: ctx.userAgent ?? null,\n                clientId: ctx.clientId,\n            },\n        );\n        if (!verified) {\n            throw new OAuth2MfaRequiredError({\n                message: 'The provided second factor is not valid.',\n                data: { kinds: status.kinds },\n            });\n        }\n\n        return new Date().toISOString();\n    }\n\n    /**\n     * Issue the MFA-pending ticket for factor kinds that cannot complete\n     * inside the single grant POST (email needs a server-sent code,\n     * WebAuthn an interactive ceremony). TOTP/recovery-only users keep\n     * the inline `otp` fast-path and get no ticket — a pending session\n     * per plain code entry would be pure churn.\n     */\n    protected async issueMfaTicket(\n        user: User,\n        kinds: `${UserAuthenticatorKind}`[],\n        ctx: {\n            ipAddress?: string,\n            userAgent?: string,\n            clientId: string | null,\n            confirmation?: OAuth2TokenConfirmation,\n        },\n    ) : Promise<{ token: string, expiresIn: number } | null> {\n        if (!this.mfaLoginService) {\n            return null;\n        }\n\n        const interactive = kinds.includes(UserAuthenticatorKind.EMAIL) ||\n            kinds.includes(UserAuthenticatorKind.WEBAUTHN);\n        if (!interactive) {\n            return null;\n        }\n\n        try {\n            return await this.mfaLoginService.issueTicket(\n                {\n                    user,\n                    clientId: ctx.clientId,\n                    confirmation: ctx.confirmation,\n                },\n                {\n                    ipAddress: ctx.ipAddress,\n                    userAgent: ctx.userAgent,\n                },\n            );\n        } catch (e) {\n            // degrade to a ticket-less mfa_required rather than letting a\n            // transient issuance failure (pending-session write, cache,\n            // signer) escape as a raw 500 from a controlled response path —\n            // an otp-capable device can still complete, and the credential\n            // retry re-attempts the ticket.\n            this.logger?.warn('Issuing the MFA-pending login ticket failed.', { error: e });\n\n            return null;\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAsCA,IAAakB,oBAAb,cAAuCP,kBAAAA;CACzBQ;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAMA,GAAAA;EAEN,KAAKR,gBAAgBQ,IAAIR;EACzB,KAAKC,sBAAsBO,IAAIP;EAC/B,KAAKC,kBAAkBM,IAAIN;EAC3B,KAAKC,uBAAuBK,IAAIL;EAChC,KAAKC,2BAA2BI,IAAIJ;EACpC,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,SAASE,IAAIF;EAClB,KAAKC,oBAAoBC,IAAID,qBAAqB;CACtD;CAEA,MAAME,eAAeC,OAAqD;EACtE,MAAMC,OAAO,MAAMtB,gBAAgBqB,KAAAA;EAEnC,MAAME,WAAWd,gBAAgBa,MAAM,UAAA;EACvC,MAAME,WAAWf,gBAAgBa,MAAM,UAAA;EACvC,IAAI,CAACC,YAAY,CAACC,UACd,MAAM1B,mBAAmB2B,UAAU,yCAAA;EAGvC,MAAM,EAAEC,UAAUC,iBAAiB,MAAMrB,oCAAoCe,KAAAA;EAE7E,MAAMO,QAAQ,MAAM,KAAKf,gBAAgBgB,QAAQrB,cAAcc,IAAAA,GAAO,IAAA;EACtE,MAAMQ,sBAAsB,MAAMvB,uCAAuCc,OAAO,KAAKH,iBAAiB;EAEtG,MAAMa,SAASL,WACX,MAAM,KAAKd,oBAAoBoB,aAC3BN,UACAC,cACAC,MAAMK,IACNH,mBAAAA,IAEJI,KAAAA;EAEJ,MAAMC,eAAeJ,SACjB,KAAKnB,oBAAoBwB,oBAAoBL,QAAQD,mBAAAA,IACrDI,KAAAA;EAEJ,IAAIH,QACA3B,yBAAyB2B,QAAQhC,iBAAiBsC,QAAQ;EAG9D,MAAMC,YAAYpC,aAAamB,OAAO,EAAEkB,YAAY,KAAK,CAAA,KAAML,KAAAA;EAC/D,MAAMM,YAAYvC,iBAAiBoB,OAAO,YAAA,KAAiBa,KAAAA;EAI3D,MAAMO,aAAalB,SAASmB,KAAI,CAAA,CAAGC,YAAW;EAE9C,MAAM,KAAK7B,sBAAsB8B,mBAAmB;GAChDH;GACAH;GACAO,SAASjB,MAAMK;EACnB,CAAA;EAEA,IAAIa;EACJ,IAAI;GACAA,OAAO,MAAM,KAAKnC,cAAcqB,aAAaT,UAAUC,UAAUI,MAAMK,EAAE;EAC7E,SAASc,GAAG;GACR,IAAIpD,gCAAgCoD,CAAAA,KAAMnD,sBAAsBmD,CAAAA,GAAI;IAChE,MAAM,KAAKC,cAAcC,OAAO;KAC5BC,OAAOzD,WAAW0D;KAClBC,MAAM5D,UAAU6D;KAChBC,WAAW;KACXC,SAAS;KACTC,WAAWf;KACXf,UAAUK,QAAQE,MAAM;KACxBY,SAASjB,MAAMK;KACfwB,kBAAkBnB,aAAa;KAC/BoB,kBAAkBlB,aAAa;KAC/BmB,aAAatC,MAAMuC;KACnBC,eAAexC,MAAMyC;KACrBC,MAAM,EAAEC,WAAWjB,EAAEkB,KAAK;IAC9B,CAAA;IACA,KAAKC,SAASC,YAAY,SAAA;GAC9B;GAEA,MAAMpB;EACV;EAEA,MAAMqB,gBAAgB,MAAM,KAAKC,mBAAmBvB,MAAMxB,MAAM;GAC5DgB;GACAE;GACAd,UAAUK,QAAQE,MAAM;GACxBE;EACJ,CAAA;EAEA,OAAO,KAAKmC,QACR;GACIxB;GACAf;GACAqC;EACJ,GACA;GACIjC;GACAG;GACAE;EACJ,CAAA;CAER;;;;;;IAQA,MAAgB6B,mBACZvB,MACAxB,MACAH,KAM2B;EAC3B,IAAI,CAAC,KAAKJ,0BACN;EAIJ,MAAMwD,SAAS,MAAM,KAAKxD,yBAAyByD,UAAU1B,KAAKb,IAAI,EAAEwC,eAAe,MAAM,CAAA;EAC7F,IAAI,CAACF,OAAOG,UACR;EAGJ,MAAMC,MAAMlE,gBAAgBa,MAAM,KAAA;EAClC,IAAI,CAACqD,KAAK;GAQN,MAAMC,SAAS,MAAM,KAAKC,eAAe/B,MAAMyB,OAAOO,OAAO3D,GAAAA;GAE7D,MAAM,IAAItB,uBAAuB;IAC7BkF,SAAS;IACThB,MAAM;KACFe,OAAOP,OAAOO;KACd,GAAIF,SAAS;MACTI,WAAWJ,OAAOK;MAClBC,sBAAsBN,OAAOO;KACjC,IAAI,CAAC;IACT;GACJ,CAAA;EACJ;EAcA,IAAI,CAACC,MAZkB,KAAKrE,yBAAyBsE,OACjDvC,KAAKb,IACL;GACIqD,MAAMjF,qCAAqCsE,GAAAA;GAC3CY,UAAUZ;EACd,GACA;GACIrC,WAAWnB,IAAImB,aAAa;GAC5BE,WAAWrB,IAAIqB,aAAa;GAC5Bd,UAAUP,IAAIO;EAClB,CAAA,GAGA,MAAM,IAAI7B,uBAAuB;GAC7BkF,SAAS;GACThB,MAAM,EAAEe,OAAOP,OAAOO,MAAM;EAChC,CAAA;EAGJ,wBAAO,IAAIU,KAAAA,EAAAA,CAAOC,YAAW;CACjC;;;;;;;IASA,MAAgBZ,eACZ/B,MACAgC,OACA3D,KAMqD;EACrD,IAAI,CAAC,KAAKH,iBACN,OAAO;EAKX,IAAI,EAFgB8D,MAAMa,SAASjG,sBAAsBkG,KAAK,KAC1Dd,MAAMa,SAASjG,sBAAsBmG,QAAQ,IAE7C,OAAO;EAGX,IAAI;GACA,OAAO,MAAM,KAAK7E,gBAAgB8E,YAC9B;IACIhD;IACApB,UAAUP,IAAIO;IACdS,cAAchB,IAAIgB;GACtB,GACA;IACIG,WAAWnB,IAAImB;IACfE,WAAWrB,IAAIqB;GACnB,CAAA;EAER,SAASO,GAAG;GAMR,KAAK9B,QAAQ8E,KAAK,gDAAgD,EAAEC,OAAOjD,EAAE,CAAA;GAE7E,OAAO;EACX;CACJ;AACJ"}
+{"version":3,"file":"password.mjs","names":["EventName","EventScope","UserAuthenticatorKind","isEntityCredentialsInvalidError","isEntityInactiveError","OAuth2MfaRequiredError","OAuth2RequestError","OAuth2TokenGrant","readRequestBody","getRequestHeader","getRequestIP","PasswordGrantType","assertClientGrantAllowed","guessUserAuthenticatorKindByResponse","extractClientCredentialsFromRequest","extractOAuth2ClientCertificateEvidence","readRealmHint","readStringField","HTTPPasswordGrant","authenticator","clientAuthenticator","realmRepository","loginThrottleService","userAuthenticatorService","mfaLoginService","logger","certificateSource","ctx","runWithRequest","event","body","username","password","malformed","clientId","clientSecret","realm","resolve","certificateEvidence","client","authenticate","id","undefined","confirmation","resolveTokenBinding","PASSWORD","ipAddress","userAgent","identifier","trim","toLowerCase","assertNotThrottled","realmId","user","e","eventService","record","scope","OAUTH2","name","LOGIN_FAILED","actorType","actorId","actorName","requestIpAddress","requestUserAgent","requestPath","path","requestMethod","method","data","errorCode","code","metrics","recordLogin","mfaVerifiedAt","verifySecondFactor","runWith","status","challenge","issueMaterial","required","otp","ticket","issueMfaTicket","kinds","message","mfa_token","token","mfa_token_expires_in","expiresIn","verified","verify","kind","response","Date","toISOString","interactive","includes","EMAIL","WEBAUTHN","issueTicket","warn","error"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/password.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { User } from '@authup/core-kit';\nimport { EventName, EventScope, UserAuthenticatorKind } from '@authup/core-kit';\nimport type { Logger } from '@authup/server-kit';\nimport { isEntityCredentialsInvalidError, isEntityInactiveError } from '@authup/errors';\nimport type { OAuth2TokenConfirmation, OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2MfaRequiredError, OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type {\n    ICredentialsAuthenticator,\n    ILoginThrottleService,\n    IOAuth2MfaLoginService,\n    IRealmRepository,\n    IUserAuthenticatorService,\n    OAuth2ClientAuthenticator,\n} from '../../../../../core/index.ts';\nimport {\n    PasswordGrantType,\n    assertClientGrantAllowed,\n    guessUserAuthenticatorKindByResponse,\n} from '../../../../../core/index.ts';\nimport type { HTTPOAuth2PasswordGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport type { CertificateSource } from '../../../request/index.ts';\nimport {\n    extractClientCredentialsFromRequest,\n    extractOAuth2ClientCertificateEvidence,\n    readRealmHint,\n    readStringField,\n} from './utils/index.ts';\n\nexport class HTTPPasswordGrant extends PasswordGrantType implements IHTTPOAuth2Grant {\n    protected authenticator : ICredentialsAuthenticator<User>;\n\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    protected realmRepository : IRealmRepository;\n\n    protected loginThrottleService? : ILoginThrottleService;\n\n    protected userAuthenticatorService? : IUserAuthenticatorService;\n\n    protected mfaLoginService? : IOAuth2MfaLoginService;\n\n    protected logger? : Logger;\n\n    protected certificateSource: CertificateSource;\n\n    constructor(ctx: HTTPOAuth2PasswordGrantContext) {\n        super(ctx);\n\n        this.authenticator = ctx.authenticator;\n        this.clientAuthenticator = ctx.clientAuthenticator;\n        this.realmRepository = ctx.realmRepository;\n        this.loginThrottleService = ctx.loginThrottleService;\n        this.userAuthenticatorService = ctx.userAuthenticatorService;\n        this.mfaLoginService = ctx.mfaLoginService;\n        this.logger = ctx.logger;\n        this.certificateSource = ctx.certificateSource ?? 'disabled';\n    }\n\n    async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const body = await readRequestBody(event);\n\n        const username = readStringField(body, 'username');\n        const password = readStringField(body, 'password');\n        if (!username || !password) {\n            throw OAuth2RequestError.malformed('username and password must be provided.');\n        }\n\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n\n        const realm = await this.realmRepository.resolve(readRealmHint(body), true);\n        const certificateEvidence = await extractOAuth2ClientCertificateEvidence(event, this.certificateSource);\n\n        const client = clientId ?\n            await this.clientAuthenticator.authenticate(\n                clientId,\n                clientSecret,\n                realm.id,\n                certificateEvidence,\n            ) :\n            undefined;\n\n        const confirmation = client ?\n            this.clientAuthenticator.resolveTokenBinding(client, certificateEvidence) :\n            undefined;\n\n        if (client) {\n            assertClientGrantAllowed(client, OAuth2TokenGrant.PASSWORD);\n        }\n\n        const ipAddress = getRequestIP(event) ?? undefined;\n        const userAgent = getRequestHeader(event, 'user-agent') ?? undefined;\n\n        // canonical identifier form (layer 3) — the throttle key and the\n        // loginFailed actorName must match what canonically stored rows carry.\n        const identifier = username.trim().toLowerCase();\n\n        await this.loginThrottleService?.assertNotThrottled({\n            identifier,\n            ipAddress,\n            realmId: realm.id,\n        });\n\n        let user : User;\n        try {\n            user = await this.authenticator.authenticate(username, password, realm.id);\n        } catch (e) {\n            if (isEntityCredentialsInvalidError(e) || isEntityInactiveError(e)) {\n                await this.eventService?.record({\n                    scope: EventScope.OAUTH2,\n                    name: EventName.LOGIN_FAILED,\n                    actorType: null,\n                    actorId: null,\n                    actorName: identifier,\n                    clientId: client?.id ?? null,\n                    realmId: realm.id,\n                    requestIpAddress: ipAddress ?? null,\n                    requestUserAgent: userAgent ?? null,\n                    requestPath: event.path,\n                    requestMethod: event.method,\n                    data: { errorCode: e.code },\n                });\n                this.metrics?.recordLogin('failure');\n            }\n\n            throw e;\n        }\n\n        const mfaVerifiedAt = await this.verifySecondFactor(user, body, {\n            ipAddress,\n            userAgent,\n            clientId: client?.id ?? null,\n            confirmation,\n        });\n\n        return this.runWith(\n            {\n                user, \n                client, \n                mfaVerifiedAt, \n            },\n            {\n                confirmation,\n                ipAddress,\n                userAgent,\n            },\n        );\n    }\n\n    /**\n     * MFA gate on the direct password grant: a user holding a confirmed\n     * device must send a valid `otp` form parameter (TOTP or recovery\n     * code, classified by shape) — otherwise `mfa_required`. Users\n     * without a device pass through (they could never enroll otherwise).\n     */\n    protected async verifySecondFactor(\n        user: User,\n        body: Record<string, any>,\n        ctx: {\n            ipAddress?: string, \n            userAgent?: string, \n            clientId: string | null,\n            confirmation?: OAuth2TokenConfirmation,\n        },\n    ): Promise<string | undefined> {\n        if (!this.userAuthenticatorService) {\n            return undefined;\n        }\n\n        // requirement flags + kinds only — no webauthn material on the token path.\n        const status = await this.userAuthenticatorService.challenge(user.id, { issueMaterial: false });\n        if (!status.required) {\n            return undefined;\n        }\n\n        const otp = readStringField(body, 'otp');\n        if (!otp) {\n            // carry the challengeable kinds so a client (the hosted login form)\n            // can tell whether a single-POST factor (totp/recovery) is on offer\n            // or the user must complete an interactive challenge (email/webauthn).\n            // For the interactive kinds an \"MFA-pending\" ticket (issue #3242)\n            // rides along: a restricted mfa_token-kind bearer accepted ONLY by\n            // the challenge routes, backed by a short-lived pending session\n            // (mfa_at: null) — never a usable access/refresh pair.\n            const ticket = await this.issueMfaTicket(user, status.kinds, ctx);\n\n            throw new OAuth2MfaRequiredError({\n                message: 'Complete a second-factor challenge to continue.',\n                data: {\n                    kinds: status.kinds,\n                    ...(ticket ? {\n                        mfa_token: ticket.token,\n                        mfa_token_expires_in: ticket.expiresIn,\n                    } : {}),\n                },\n            });\n        }\n\n        const verified = await this.userAuthenticatorService.verify(\n            user.id,\n            {\n                kind: guessUserAuthenticatorKindByResponse(otp),\n                response: otp,\n            },\n            {\n                ipAddress: ctx.ipAddress ?? null,\n                userAgent: ctx.userAgent ?? null,\n                clientId: ctx.clientId,\n            },\n        );\n        if (!verified) {\n            throw new OAuth2MfaRequiredError({\n                message: 'The provided second factor is not valid.',\n                data: { kinds: status.kinds },\n            });\n        }\n\n        return new Date().toISOString();\n    }\n\n    /**\n     * Issue the MFA-pending ticket for factor kinds that cannot complete\n     * inside the single grant POST (email needs a server-sent code,\n     * WebAuthn an interactive ceremony). TOTP/recovery-only users keep\n     * the inline `otp` fast-path and get no ticket — a pending session\n     * per plain code entry would be pure churn.\n     */\n    protected async issueMfaTicket(\n        user: User,\n        kinds: `${UserAuthenticatorKind}`[],\n        ctx: {\n            ipAddress?: string,\n            userAgent?: string,\n            clientId: string | null,\n            confirmation?: OAuth2TokenConfirmation,\n        },\n    ) : Promise<{ token: string, expiresIn: number } | null> {\n        if (!this.mfaLoginService) {\n            return null;\n        }\n\n        const interactive = kinds.includes(UserAuthenticatorKind.EMAIL) ||\n            kinds.includes(UserAuthenticatorKind.WEBAUTHN);\n        if (!interactive) {\n            return null;\n        }\n\n        try {\n            return await this.mfaLoginService.issueTicket(\n                {\n                    user,\n                    clientId: ctx.clientId,\n                    confirmation: ctx.confirmation,\n                },\n                {\n                    ipAddress: ctx.ipAddress,\n                    userAgent: ctx.userAgent,\n                },\n            );\n        } catch (e) {\n            // degrade to a ticket-less mfa_required rather than letting a\n            // transient issuance failure (pending-session write, cache,\n            // signer) escape as a raw 500 from a controlled response path —\n            // an otp-capable device can still complete, and the credential\n            // retry re-attempts the ticket.\n            this.logger?.warn('Issuing the MFA-pending login ticket failed.', { error: e });\n\n            return null;\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAsCA,IAAakB,oBAAb,cAAuCP,kBAAAA;CACzBQ;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAMA,GAAAA;EAEN,KAAKR,gBAAgBQ,IAAIR;EACzB,KAAKC,sBAAsBO,IAAIP;EAC/B,KAAKC,kBAAkBM,IAAIN;EAC3B,KAAKC,uBAAuBK,IAAIL;EAChC,KAAKC,2BAA2BI,IAAIJ;EACpC,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,SAASE,IAAIF;EAClB,KAAKC,oBAAoBC,IAAID,qBAAqB;CACtD;CAEA,MAAME,eAAeC,OAAqD;EACtE,MAAMC,OAAO,MAAMtB,gBAAgBqB,KAAAA;EAEnC,MAAME,WAAWd,gBAAgBa,MAAM,UAAA;EACvC,MAAME,WAAWf,gBAAgBa,MAAM,UAAA;EACvC,IAAI,CAACC,YAAY,CAACC,UACd,MAAM1B,mBAAmB2B,UAAU,yCAAA;EAGvC,MAAM,EAAEC,UAAUC,iBAAiB,MAAMrB,oCAAoCe,KAAAA;EAE7E,MAAMO,QAAQ,MAAM,KAAKf,gBAAgBgB,QAAQrB,cAAcc,IAAAA,GAAO,IAAA;EACtE,MAAMQ,sBAAsB,MAAMvB,uCAAuCc,OAAO,KAAKH,iBAAiB;EAEtG,MAAMa,SAASL,WACX,MAAM,KAAKd,oBAAoBoB,aAC3BN,UACAC,cACAC,MAAMK,IACNH,mBAAAA,IAEJI,KAAAA;EAEJ,MAAMC,eAAeJ,SACjB,KAAKnB,oBAAoBwB,oBAAoBL,QAAQD,mBAAAA,IACrDI,KAAAA;EAEJ,IAAIH,QACA3B,yBAAyB2B,QAAQhC,iBAAiBsC,QAAQ;EAG9D,MAAMC,YAAYpC,aAAamB,KAAAA,KAAUa,KAAAA;EACzC,MAAMK,YAAYtC,iBAAiBoB,OAAO,YAAA,KAAiBa,KAAAA;EAI3D,MAAMM,aAAajB,SAASkB,KAAI,CAAA,CAAGC,YAAW;EAE9C,MAAM,KAAK5B,sBAAsB6B,mBAAmB;GAChDH;GACAF;GACAM,SAAShB,MAAMK;EACnB,CAAA;EAEA,IAAIY;EACJ,IAAI;GACAA,OAAO,MAAM,KAAKlC,cAAcqB,aAAaT,UAAUC,UAAUI,MAAMK,EAAE;EAC7E,SAASa,GAAG;GACR,IAAInD,gCAAgCmD,CAAAA,KAAMlD,sBAAsBkD,CAAAA,GAAI;IAChE,MAAM,KAAKC,cAAcC,OAAO;KAC5BC,OAAOxD,WAAWyD;KAClBC,MAAM3D,UAAU4D;KAChBC,WAAW;KACXC,SAAS;KACTC,WAAWf;KACXd,UAAUK,QAAQE,MAAM;KACxBW,SAAShB,MAAMK;KACfuB,kBAAkBlB,aAAa;KAC/BmB,kBAAkBlB,aAAa;KAC/BmB,aAAarC,MAAMsC;KACnBC,eAAevC,MAAMwC;KACrBC,MAAM,EAAEC,WAAWjB,EAAEkB,KAAK;IAC9B,CAAA;IACA,KAAKC,SAASC,YAAY,SAAA;GAC9B;GAEA,MAAMpB;EACV;EAEA,MAAMqB,gBAAgB,MAAM,KAAKC,mBAAmBvB,MAAMvB,MAAM;GAC5DgB;GACAC;GACAb,UAAUK,QAAQE,MAAM;GACxBE;EACJ,CAAA;EAEA,OAAO,KAAKkC,QACR;GACIxB;GACAd;GACAoC;EACJ,GACA;GACIhC;GACAG;GACAC;EACJ,CAAA;CAER;;;;;;IAQA,MAAgB6B,mBACZvB,MACAvB,MACAH,KAM2B;EAC3B,IAAI,CAAC,KAAKJ,0BACN;EAIJ,MAAMuD,SAAS,MAAM,KAAKvD,yBAAyBwD,UAAU1B,KAAKZ,IAAI,EAAEuC,eAAe,MAAM,CAAA;EAC7F,IAAI,CAACF,OAAOG,UACR;EAGJ,MAAMC,MAAMjE,gBAAgBa,MAAM,KAAA;EAClC,IAAI,CAACoD,KAAK;GAQN,MAAMC,SAAS,MAAM,KAAKC,eAAe/B,MAAMyB,OAAOO,OAAO1D,GAAAA;GAE7D,MAAM,IAAItB,uBAAuB;IAC7BiF,SAAS;IACThB,MAAM;KACFe,OAAOP,OAAOO;KACd,GAAIF,SAAS;MACTI,WAAWJ,OAAOK;MAClBC,sBAAsBN,OAAOO;KACjC,IAAI,CAAC;IACT;GACJ,CAAA;EACJ;EAcA,IAAI,CAACC,MAZkB,KAAKpE,yBAAyBqE,OACjDvC,KAAKZ,IACL;GACIoD,MAAMhF,qCAAqCqE,GAAAA;GAC3CY,UAAUZ;EACd,GACA;GACIpC,WAAWnB,IAAImB,aAAa;GAC5BC,WAAWpB,IAAIoB,aAAa;GAC5Bb,UAAUP,IAAIO;EAClB,CAAA,GAGA,MAAM,IAAI7B,uBAAuB;GAC7BiF,SAAS;GACThB,MAAM,EAAEe,OAAOP,OAAOO,MAAM;EAChC,CAAA;EAGJ,wBAAO,IAAIU,KAAAA,EAAAA,CAAOC,YAAW;CACjC;;;;;;;IASA,MAAgBZ,eACZ/B,MACAgC,OACA1D,KAMqD;EACrD,IAAI,CAAC,KAAKH,iBACN,OAAO;EAKX,IAAI,EAFgB6D,MAAMa,SAAShG,sBAAsBiG,KAAK,KAC1Dd,MAAMa,SAAShG,sBAAsBkG,QAAQ,IAE7C,OAAO;EAGX,IAAI;GACA,OAAO,MAAM,KAAK5E,gBAAgB6E,YAC9B;IACIhD;IACAnB,UAAUP,IAAIO;IACdS,cAAchB,IAAIgB;GACtB,GACA;IACIG,WAAWnB,IAAImB;IACfC,WAAWpB,IAAIoB;GACnB,CAAA;EAER,SAASO,GAAG;GAMR,KAAK7B,QAAQ6E,KAAK,gDAAgD,EAAEC,OAAOjD,EAAE,CAAA;GAE7E,OAAO;EACX;CACJ;AACJ"}

package/dist/adapters/http/adapters/oauth2/grant-types/refresh_token.mjs

@@ -49,7 +49,7 @@ var HTTPOAuth2RefreshTokenGrant = class extends OAuth2RefreshTokenGrant {
 		if (client && isClientPublic(client) && payload.realm_id && payload.realm_id !== client.realmId) throw OAuth2GrantError.invalid();
 		return this.runWith(payload, {
 			confirmation,
-			ipAddress: getRequestIP(event, { trustProxy: true }) ?? void 0,
+			ipAddress: getRequestIP(event) ?? void 0,
 			userAgent: getRequestHeader(event, "user-agent") ?? void 0
 		});
 	}

package/dist/adapters/http/adapters/oauth2/grant-types/refresh_token.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"refresh_token.mjs","names":["isClientPublic","OAuth2GrantError","OAuth2RequestError","OAuth2TokenGrant","readRequestBody","getRequestHeader","getRequestIP","OAuth2RefreshTokenGrant","assertClientGrantAllowed","extractClientCredentialsFromRequest","extractOAuth2ClientCertificateEvidence","readRealmHint","HTTPOAuth2RefreshTokenGrant","clientAuthenticator","refreshTokenVerifier","realmRepository","certificateSource","ctx","tokenVerifier","runWithRequest","event","body","refreshToken","refresh_token","length","malformed","clientId","clientSecret","certificateEvidence","payload","verify","skipActiveCheck","client","realm","resolve","authenticate","id","client_id","invalid","undefined","REFRESH_TOKEN","confirmation","cnf","expectedThumbprint","validateCertificateEvidenceForBinding","resolveTokenBinding","realm_id","realmId","runWith","ipAddress","trustProxy","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/refresh_token.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { type Client, isClientPublic } from '@authup/core-kit';\nimport type { OAuth2TokenConfirmation, OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2GrantError, OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport { OAuth2RefreshTokenGrant, assertClientGrantAllowed } from '../../../../../core/index.ts';\nimport type {\n    IOAuth2TokenVerifier,\n    IRealmRepository,\n    OAuth2ClientAuthenticator,\n} from '../../../../../core/index.ts';\nimport type { HTTPOAuth2RefreshTokenGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport type { CertificateSource } from '../../../request/index.ts';\nimport {\n    extractClientCredentialsFromRequest,\n    extractOAuth2ClientCertificateEvidence,\n    readRealmHint,\n} from './utils/index.ts';\n\nexport class HTTPOAuth2RefreshTokenGrant extends OAuth2RefreshTokenGrant implements IHTTPOAuth2Grant {\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    protected refreshTokenVerifier : IOAuth2TokenVerifier;\n\n    protected realmRepository : IRealmRepository;\n\n    protected certificateSource: CertificateSource;\n\n    constructor(ctx: HTTPOAuth2RefreshTokenGrantContext) {\n        super(ctx);\n\n        this.clientAuthenticator = ctx.clientAuthenticator;\n        this.refreshTokenVerifier = ctx.tokenVerifier;\n        this.realmRepository = ctx.realmRepository;\n        this.certificateSource = ctx.certificateSource ?? 'disabled';\n    }\n\n    async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const body = await readRequestBody(event);\n        const refreshToken = body?.refresh_token;\n        if (typeof refreshToken !== 'string' || refreshToken.length === 0) {\n            throw OAuth2RequestError.malformed();\n        }\n\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n        const certificateEvidence = await extractOAuth2ClientCertificateEvidence(event, this.certificateSource);\n\n        // RFC 6749 §6: verify the refresh token first to learn its bound\n        // client (if any), then enforce binding. Authenticate the requesting\n        // client when credentials are present, or when the token requires\n        // a client binding.\n        //\n        // skipActiveCheck: the durable auth_session_tokens row (not the cache\n        // blocklist) is the refresh-token authority, so a replayed/consumed\n        // token must reach runWith() to trigger family revocation instead of\n        // being rejected here with JWT_INACTIVE.\n        const payload = await this.refreshTokenVerifier.verify(refreshToken, { skipActiveCheck: true });\n\n        let client: Client | undefined;\n\n        if (clientId) {\n            // A client authenticated itself. Resolve by the presented\n            // id/secret (name resolution scoped by the realm hint — resolved\n            // lazily so a bare refresh skips the SELECT) and enforce the\n            // token↔client binding.\n            const realm = await this.realmRepository.resolve(readRealmHint(body), true);\n\n            client = await this.clientAuthenticator.authenticate(\n                clientId,\n                clientSecret,\n                realm.id,\n                certificateEvidence,\n            );\n\n            if (payload.client_id && payload.client_id !== client.id) {\n                throw OAuth2GrantError.invalid();\n            }\n        } else if (payload.client_id) {\n            // No client credentials were presented, but the token is bound to\n            // a client. RFC 6749 §10.4: a public client cannot authenticate\n            // (no secret) and is not required to — the bound identity is read\n            // from the signed token (client_id is server-minted, so trusted)\n            // and refresh-token rotation/replay detection is the abuse control.\n            // A client with an authentication method MUST still authenticate.\n            // Supplying the server-minted client id lets TLS clients prove\n            // themselves with the request certificate, while a secret client\n            // still fails because its secret is absent.\n            client = await this.clientAuthenticator.authenticate(\n                payload.client_id,\n                undefined,\n                undefined,\n                certificateEvidence,\n            );\n        }\n\n        if (client) {\n            assertClientGrantAllowed(client, OAuth2TokenGrant.REFRESH_TOKEN);\n        }\n\n        let confirmation: OAuth2TokenConfirmation | undefined;\n        if (payload.cnf) {\n            const expectedThumbprint = payload.cnf['x5t#S256'];\n            if (typeof expectedThumbprint !== 'string' || expectedThumbprint.length === 0) {\n                throw OAuth2GrantError.invalid();\n            }\n\n            confirmation = this.clientAuthenticator.validateCertificateEvidenceForBinding(\n                certificateEvidence,\n            );\n            if (confirmation['x5t#S256'] !== expectedThumbprint) {\n                throw OAuth2GrantError.invalid();\n            }\n        } else if (client) {\n            confirmation = this.clientAuthenticator.resolveTokenBinding(client, certificateEvidence);\n        }\n\n        // Realm parity for PUBLIC clients only: a public client may not refresh\n        // a token whose realm differs from the (bound) client's own realm.\n        // Kills cross-realm refresh tokens minted for a public `web` client\n        // before the authorize-side realm gate existed. Authenticated clients\n        // are exempt — the configured secret/certificate proves identity, and the\n        // documented cross-realm password grant (UUID-identified user against a\n        // master-realm client) depends on that exemption.\n        if (\n            client &&\n            isClientPublic(client) &&\n            payload.realm_id &&\n            payload.realm_id !== client.realmId\n        ) {\n            throw OAuth2GrantError.invalid();\n        }\n\n        return this.runWith(payload, {\n            confirmation,\n            ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;AA2BA,IAAaY,8BAAb,cAAiDL,wBAAAA;CACnCM;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAyC;EACjD,MAAMA,GAAAA;EAEN,KAAKJ,sBAAsBI,IAAIJ;EAC/B,KAAKC,uBAAuBG,IAAIC;EAChC,KAAKH,kBAAkBE,IAAIF;EAC3B,KAAKC,oBAAoBC,IAAID,qBAAqB;CACtD;CAEA,MAAMG,eAAeC,OAAqD;EACtE,MAAMC,OAAO,MAAMjB,gBAAgBgB,KAAAA;EACnC,MAAME,eAAeD,MAAME;EAC3B,IAAI,OAAOD,iBAAiB,YAAYA,aAAaE,WAAW,GAC5D,MAAMtB,mBAAmBuB,UAAS;EAGtC,MAAM,EAAEC,UAAUC,iBAAiB,MAAMlB,oCAAoCW,KAAAA;EAC7E,MAAMQ,sBAAsB,MAAMlB,uCAAuCU,OAAO,KAAKJ,iBAAiB;EAWtG,MAAMa,UAAU,MAAM,KAAKf,qBAAqBgB,OAAOR,cAAc,EAAES,iBAAiB,KAAK,CAAA;EAE7F,IAAIC;EAEJ,IAAIN,UAAU;GAKV,MAAMO,QAAQ,MAAM,KAAKlB,gBAAgBmB,QAAQvB,cAAcU,IAAAA,GAAO,IAAA;GAEtEW,SAAS,MAAM,KAAKnB,oBAAoBsB,aACpCT,UACAC,cACAM,MAAMG,IACNR,mBAAAA;GAGJ,IAAIC,QAAQQ,aAAaR,QAAQQ,cAAcL,OAAOI,IAClD,MAAMnC,iBAAiBqC,QAAO;EAEtC,OAAO,IAAIT,QAAQQ,WAUfL,SAAS,MAAM,KAAKnB,oBAAoBsB,aACpCN,QAAQQ,WACRE,KAAAA,GACAA,KAAAA,GACAX,mBAAAA;EAIR,IAAII,QACAxB,yBAAyBwB,QAAQ7B,iBAAiBqC,aAAa;EAGnE,IAAIC;EACJ,IAAIZ,QAAQa,KAAK;GACb,MAAMC,qBAAqBd,QAAQa,IAAI;GACvC,IAAI,OAAOC,uBAAuB,YAAYA,mBAAmBnB,WAAW,GACxE,MAAMvB,iBAAiBqC,QAAO;GAGlCG,eAAe,KAAK5B,oBAAoB+B,sCACpChB,mBAAAA;GAEJ,IAAIa,aAAa,gBAAgBE,oBAC7B,MAAM1C,iBAAiBqC,QAAO;EAEtC,OAAO,IAAIN,QACPS,eAAe,KAAK5B,oBAAoBgC,oBAAoBb,QAAQJ,mBAAAA;EAUxE,IACII,UACAhC,eAAegC,MAAAA,KACfH,QAAQiB,YACRjB,QAAQiB,aAAad,OAAOe,SAE5B,MAAM9C,iBAAiBqC,QAAO;EAGlC,OAAO,KAAKU,QAAQnB,SAAS;GACzBY;GACAQ,WAAW3C,aAAac,OAAO,EAAE8B,YAAY,KAAK,CAAA,KAAMX,KAAAA;GACxDY,WAAW9C,iBAAiBe,OAAO,YAAA,KAAiBmB,KAAAA;EACxD,CAAA;CACJ;AACJ"}
+{"version":3,"file":"refresh_token.mjs","names":["isClientPublic","OAuth2GrantError","OAuth2RequestError","OAuth2TokenGrant","readRequestBody","getRequestHeader","getRequestIP","OAuth2RefreshTokenGrant","assertClientGrantAllowed","extractClientCredentialsFromRequest","extractOAuth2ClientCertificateEvidence","readRealmHint","HTTPOAuth2RefreshTokenGrant","clientAuthenticator","refreshTokenVerifier","realmRepository","certificateSource","ctx","tokenVerifier","runWithRequest","event","body","refreshToken","refresh_token","length","malformed","clientId","clientSecret","certificateEvidence","payload","verify","skipActiveCheck","client","realm","resolve","authenticate","id","client_id","invalid","undefined","REFRESH_TOKEN","confirmation","cnf","expectedThumbprint","validateCertificateEvidenceForBinding","resolveTokenBinding","realm_id","realmId","runWith","ipAddress","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/refresh_token.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { type Client, isClientPublic } from '@authup/core-kit';\nimport type { OAuth2TokenConfirmation, OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2GrantError, OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport { OAuth2RefreshTokenGrant, assertClientGrantAllowed } from '../../../../../core/index.ts';\nimport type {\n    IOAuth2TokenVerifier,\n    IRealmRepository,\n    OAuth2ClientAuthenticator,\n} from '../../../../../core/index.ts';\nimport type { HTTPOAuth2RefreshTokenGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport type { CertificateSource } from '../../../request/index.ts';\nimport {\n    extractClientCredentialsFromRequest,\n    extractOAuth2ClientCertificateEvidence,\n    readRealmHint,\n} from './utils/index.ts';\n\nexport class HTTPOAuth2RefreshTokenGrant extends OAuth2RefreshTokenGrant implements IHTTPOAuth2Grant {\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    protected refreshTokenVerifier : IOAuth2TokenVerifier;\n\n    protected realmRepository : IRealmRepository;\n\n    protected certificateSource: CertificateSource;\n\n    constructor(ctx: HTTPOAuth2RefreshTokenGrantContext) {\n        super(ctx);\n\n        this.clientAuthenticator = ctx.clientAuthenticator;\n        this.refreshTokenVerifier = ctx.tokenVerifier;\n        this.realmRepository = ctx.realmRepository;\n        this.certificateSource = ctx.certificateSource ?? 'disabled';\n    }\n\n    async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const body = await readRequestBody(event);\n        const refreshToken = body?.refresh_token;\n        if (typeof refreshToken !== 'string' || refreshToken.length === 0) {\n            throw OAuth2RequestError.malformed();\n        }\n\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n        const certificateEvidence = await extractOAuth2ClientCertificateEvidence(event, this.certificateSource);\n\n        // RFC 6749 §6: verify the refresh token first to learn its bound\n        // client (if any), then enforce binding. Authenticate the requesting\n        // client when credentials are present, or when the token requires\n        // a client binding.\n        //\n        // skipActiveCheck: the durable auth_session_tokens row (not the cache\n        // blocklist) is the refresh-token authority, so a replayed/consumed\n        // token must reach runWith() to trigger family revocation instead of\n        // being rejected here with JWT_INACTIVE.\n        const payload = await this.refreshTokenVerifier.verify(refreshToken, { skipActiveCheck: true });\n\n        let client: Client | undefined;\n\n        if (clientId) {\n            // A client authenticated itself. Resolve by the presented\n            // id/secret (name resolution scoped by the realm hint — resolved\n            // lazily so a bare refresh skips the SELECT) and enforce the\n            // token↔client binding.\n            const realm = await this.realmRepository.resolve(readRealmHint(body), true);\n\n            client = await this.clientAuthenticator.authenticate(\n                clientId,\n                clientSecret,\n                realm.id,\n                certificateEvidence,\n            );\n\n            if (payload.client_id && payload.client_id !== client.id) {\n                throw OAuth2GrantError.invalid();\n            }\n        } else if (payload.client_id) {\n            // No client credentials were presented, but the token is bound to\n            // a client. RFC 6749 §10.4: a public client cannot authenticate\n            // (no secret) and is not required to — the bound identity is read\n            // from the signed token (client_id is server-minted, so trusted)\n            // and refresh-token rotation/replay detection is the abuse control.\n            // A client with an authentication method MUST still authenticate.\n            // Supplying the server-minted client id lets TLS clients prove\n            // themselves with the request certificate, while a secret client\n            // still fails because its secret is absent.\n            client = await this.clientAuthenticator.authenticate(\n                payload.client_id,\n                undefined,\n                undefined,\n                certificateEvidence,\n            );\n        }\n\n        if (client) {\n            assertClientGrantAllowed(client, OAuth2TokenGrant.REFRESH_TOKEN);\n        }\n\n        let confirmation: OAuth2TokenConfirmation | undefined;\n        if (payload.cnf) {\n            const expectedThumbprint = payload.cnf['x5t#S256'];\n            if (typeof expectedThumbprint !== 'string' || expectedThumbprint.length === 0) {\n                throw OAuth2GrantError.invalid();\n            }\n\n            confirmation = this.clientAuthenticator.validateCertificateEvidenceForBinding(\n                certificateEvidence,\n            );\n            if (confirmation['x5t#S256'] !== expectedThumbprint) {\n                throw OAuth2GrantError.invalid();\n            }\n        } else if (client) {\n            confirmation = this.clientAuthenticator.resolveTokenBinding(client, certificateEvidence);\n        }\n\n        // Realm parity for PUBLIC clients only: a public client may not refresh\n        // a token whose realm differs from the (bound) client's own realm.\n        // Kills cross-realm refresh tokens minted for a public `web` client\n        // before the authorize-side realm gate existed. Authenticated clients\n        // are exempt — the configured secret/certificate proves identity, and the\n        // documented cross-realm password grant (UUID-identified user against a\n        // master-realm client) depends on that exemption.\n        if (\n            client &&\n            isClientPublic(client) &&\n            payload.realm_id &&\n            payload.realm_id !== client.realmId\n        ) {\n            throw OAuth2GrantError.invalid();\n        }\n\n        return this.runWith(payload, {\n            confirmation,\n            ipAddress: getRequestIP(event) ?? undefined,\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;AA2BA,IAAaY,8BAAb,cAAiDL,wBAAAA;CACnCM;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAyC;EACjD,MAAMA,GAAAA;EAEN,KAAKJ,sBAAsBI,IAAIJ;EAC/B,KAAKC,uBAAuBG,IAAIC;EAChC,KAAKH,kBAAkBE,IAAIF;EAC3B,KAAKC,oBAAoBC,IAAID,qBAAqB;CACtD;CAEA,MAAMG,eAAeC,OAAqD;EACtE,MAAMC,OAAO,MAAMjB,gBAAgBgB,KAAAA;EACnC,MAAME,eAAeD,MAAME;EAC3B,IAAI,OAAOD,iBAAiB,YAAYA,aAAaE,WAAW,GAC5D,MAAMtB,mBAAmBuB,UAAS;EAGtC,MAAM,EAAEC,UAAUC,iBAAiB,MAAMlB,oCAAoCW,KAAAA;EAC7E,MAAMQ,sBAAsB,MAAMlB,uCAAuCU,OAAO,KAAKJ,iBAAiB;EAWtG,MAAMa,UAAU,MAAM,KAAKf,qBAAqBgB,OAAOR,cAAc,EAAES,iBAAiB,KAAK,CAAA;EAE7F,IAAIC;EAEJ,IAAIN,UAAU;GAKV,MAAMO,QAAQ,MAAM,KAAKlB,gBAAgBmB,QAAQvB,cAAcU,IAAAA,GAAO,IAAA;GAEtEW,SAAS,MAAM,KAAKnB,oBAAoBsB,aACpCT,UACAC,cACAM,MAAMG,IACNR,mBAAAA;GAGJ,IAAIC,QAAQQ,aAAaR,QAAQQ,cAAcL,OAAOI,IAClD,MAAMnC,iBAAiBqC,QAAO;EAEtC,OAAO,IAAIT,QAAQQ,WAUfL,SAAS,MAAM,KAAKnB,oBAAoBsB,aACpCN,QAAQQ,WACRE,KAAAA,GACAA,KAAAA,GACAX,mBAAAA;EAIR,IAAII,QACAxB,yBAAyBwB,QAAQ7B,iBAAiBqC,aAAa;EAGnE,IAAIC;EACJ,IAAIZ,QAAQa,KAAK;GACb,MAAMC,qBAAqBd,QAAQa,IAAI;GACvC,IAAI,OAAOC,uBAAuB,YAAYA,mBAAmBnB,WAAW,GACxE,MAAMvB,iBAAiBqC,QAAO;GAGlCG,eAAe,KAAK5B,oBAAoB+B,sCACpChB,mBAAAA;GAEJ,IAAIa,aAAa,gBAAgBE,oBAC7B,MAAM1C,iBAAiBqC,QAAO;EAEtC,OAAO,IAAIN,QACPS,eAAe,KAAK5B,oBAAoBgC,oBAAoBb,QAAQJ,mBAAAA;EAUxE,IACII,UACAhC,eAAegC,MAAAA,KACfH,QAAQiB,YACRjB,QAAQiB,aAAad,OAAOe,SAE5B,MAAM9C,iBAAiBqC,QAAO;EAGlC,OAAO,KAAKU,QAAQnB,SAAS;GACzBY;GACAQ,WAAW3C,aAAac,KAAAA,KAAUmB,KAAAA;GAClCW,WAAW7C,iBAAiBe,OAAO,YAAA,KAAiBmB,KAAAA;EACxD,CAAA;CACJ;AACJ"}

package/dist/adapters/http/controllers/entities/client/module.d.ts

@@ -1,6 +1,6 @@
 import type { Client } from '@authup/core-kit';
 import type { IAppEvent } from 'routup';
-import type { ClientCreatePayload, ClientSavePayload, ClientUpdatePayload, EntityCollectionResponse } from '@authup/core-http-kit';
+import type { ClientCreatePayload, ClientSavePayload, ClientUpdatePayload, EntityCollectionResponse, EntityRecordResponse } from '@authup/core-http-kit';
 import type { IClientRepository, IClientService } from '../../../../../core/index.ts';
 export type ClientControllerContext = {
     service: IClientService;
@@ -11,10 +11,10 @@ export declare class ClientController {
     protected repository: IClientRepository;
     constructor(ctx: ClientControllerContext);
     getMany(event: IAppEvent): Promise<EntityCollectionResponse<Client>>;
-    get(id: string, event: IAppEvent): Promise<Client>;
-    add(data: ClientCreatePayload, event: IAppEvent): Promise<Client>;
-    edit(id: string, data: ClientUpdatePayload, event: IAppEvent): Promise<Client>;
-    put(id: string, data: ClientSavePayload, event: IAppEvent): Promise<Client>;
-    drop(id: string, event: IAppEvent): Promise<Client>;
+    get(id: string, event: IAppEvent): Promise<EntityRecordResponse<Client>>;
+    add(data: ClientCreatePayload, event: IAppEvent): Promise<EntityRecordResponse<Client>>;
+    edit(id: string, data: ClientUpdatePayload, event: IAppEvent): Promise<EntityRecordResponse<Client>>;
+    put(id: string, data: ClientSavePayload, event: IAppEvent): Promise<EntityRecordResponse<Client>>;
+    drop(id: string, event: IAppEvent): Promise<EntityRecordResponse<Client>>;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/controllers/entities/client/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/client/module.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EACR,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,EAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAWtF,MAAM,MAAM,uBAAuB,GAAG;IAClC,OAAO,EAAE,cAAc,CAAC;IACxB,UAAU,EAAE,iBAAiB,CAAC;CACjC,CAAC;AAEF,qBAEa,gBAAgB;IACzB,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC;IAElC,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC;gBAE5B,GAAG,EAAE,uBAAuB;IAMlC,OAAO,CACG,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;IActC,GAAG,CACQ,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,MAAM,CAAC;IAiDZ,GAAG,CACI,IAAI,EAAE,mBAAmB,EACtB,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,MAAM,CAAC;IAWZ,IAAI,CACO,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,mBAAmB,EACtB,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,MAAM,CAAC;IAWZ,GAAG,CACQ,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,iBAAiB,EACpB,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,MAAM,CAAC;IAiBZ,IAAI,CACO,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,MAAM,CAAC;CAQrB"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/client/module.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EACR,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAgBtF,MAAM,MAAM,uBAAuB,GAAG;IAClC,OAAO,EAAE,cAAc,CAAC;IACxB,UAAU,EAAE,iBAAiB,CAAC;CACjC,CAAC;AAEF,qBAEa,gBAAgB;IACzB,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC;IAElC,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC;gBAE5B,GAAG,EAAE,uBAAuB;IAMlC,OAAO,CACG,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAiBtC,GAAG,CACQ,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAiDlC,GAAG,CACI,IAAI,EAAE,mBAAmB,EACtB,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAWlC,IAAI,CACO,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,mBAAmB,EACtB,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAWlC,GAAG,CACQ,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,iBAAiB,EACpB,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAiBlC,IAAI,CACO,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;CAQ3C"}