@authup/server-core 1.0.0-beta.55 → 1.0.0-beta.57

package/dist/adapters/http/controllers/entities/user-permission/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["DBody","DContext","DController","DDelete","DGet","DPath","DPost","DTags","useRequestQuery","ForceLoggedInMiddleware","buildActorContext","UserPermissionController","service","ctx","getMany","event","actor","data","meta","add","entity","create","response","status","edit","id","update","getOne","drop","delete"],"sources":["../../../../../../src/adapters/http/controllers/entities/user-permission/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DBody,\n    DContext,\n    DController,\n    DDelete,\n    DGet,\n    DPath,\n    DPost,\n    DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type {\n    EntityCollectionResponse,\n    UserPermissionCreatePayload,\n    UserPermissionUpdatePayload,\n} from '@authup/core-http-kit';\nimport type { UserPermission } from '@authup/core-kit';\nimport type { IUserPermissionService } from '../../../../../core/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { buildActorContext } from '../../../request/index.ts';\n\nexport type UserPermissionControllerContext = {\n    service: IUserPermissionService,\n};\n\n@DTags('user')\n@DController('/user-permissions')\nexport class UserPermissionController {\n    protected service: IUserPermissionService;\n\n    constructor(ctx: UserPermissionControllerContext) {\n        this.service = ctx.service;\n    }\n\n    @DGet('', [ForceLoggedInMiddleware])\n    async getMany(\n        @DContext() event: IAppEvent,\n    ): Promise<EntityCollectionResponse<UserPermission>> {\n        const actor = buildActorContext(event);\n        const {\n            data,\n            meta,\n        } = await this.service.getMany(useRequestQuery(event), actor);\n\n        return {\n            data,\n            meta,\n        };\n    }\n\n    @DPost('', [ForceLoggedInMiddleware])\n    async add(\n        @DBody() data: UserPermissionCreatePayload,\n        @DContext() event: IAppEvent,\n    ): Promise<UserPermission> {\n        const actor = buildActorContext(event);\n\n        const entity = await this.service.create(data, actor);\n\n        event.response.status = 201;\n\n        return entity;\n    }\n\n    @DPost('/:id', [ForceLoggedInMiddleware])\n    async edit(\n        @DPath('id') id: string,\n        @DBody() data: UserPermissionUpdatePayload,\n        @DContext() event: IAppEvent,\n    ): Promise<UserPermission> {\n        const actor = buildActorContext(event);\n        const entity = await this.service.update(id, data, actor);\n\n        event.response.status = 202;\n\n        return entity;\n    }\n\n    @DGet('/:id', [ForceLoggedInMiddleware])\n    async getOne(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ): Promise<UserPermission> {\n        const actor = buildActorContext(event);\n        const entity = await this.service.getOne(id, actor);\n\n        return entity;\n    }\n\n    @DDelete('/:id', [ForceLoggedInMiddleware])\n    async drop(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ): Promise<UserPermission> {\n        const actor = buildActorContext(event);\n        const entity = await this.service.delete(id, actor);\n\n        event.response.status = 202;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAmCA,IAAaW,2BAAb,MAAaA;CACCC;CAEV,YAAYC,KAAsC;EAC9C,KAAKD,UAAUC,IAAID;CACvB;CAEA,MACME,QACF,OACiD;EACjD,MAAME,QAAQN,kBAAkBK,KAAAA;EAChC,MAAM,EACFE,MACAC,SACA,MAAM,KAAKN,QAAQE,QAAQN,gBAAgBO,KAAAA,GAAQC,KAAAA;EAEvD,OAAO;GACHC;GACAC;EACJ;CACJ;CAEA,MACMC,IACF,MACA,OACuB;EACvB,MAAMH,QAAQN,kBAAkBK,KAAAA;EAEhC,MAAMK,SAAS,MAAM,KAAKR,QAAQS,OAAOJ,MAAMD,KAAAA;EAE/CD,MAAMO,SAASC,SAAS;EAExB,OAAOH;CACX;CAEA,MACMI,KACF,IACA,MACA,OACuB;EACvB,MAAMR,QAAQN,kBAAkBK,KAAAA;EAChC,MAAMK,SAAS,MAAM,KAAKR,QAAQc,OAAOD,IAAIR,MAAMD,KAAAA;EAEnDD,MAAMO,SAASC,SAAS;EAExB,OAAOH;CACX;CAEA,MACMO,OACF,IACA,OACuB;EACvB,MAAMX,QAAQN,kBAAkBK,KAAAA;EAGhC,OAAOK,MAFc,KAAKR,QAAQe,OAAOF,IAAIT,KAAAA;CAGjD;CAEA,MACMY,KACF,IACA,OACuB;EACvB,MAAMZ,QAAQN,kBAAkBK,KAAAA;EAChC,MAAMK,SAAS,MAAM,KAAKR,QAAQiB,OAAOJ,IAAIT,KAAAA;EAE7CD,MAAMO,SAASC,SAAS;EAExB,OAAOH;CACX;AACJ;;CAnEeX,KAAAA,IAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;CAgBCA,MAAAA,IAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;CAcIA,MAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;;;;;CAcDA,KAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;CAWGA,QAAAA,QAAAA,CAAAA,uBAAAA,CAAAA"}
+{"version":3,"file":"module.mjs","names":["DBody","DContext","DController","DDelete","DGet","DPath","DPost","DTags","useRequestQuery","RECORD_QUERY_PARAMETERS","describeQuerySchema","userPermissionSchema","ForceLoggedInMiddleware","buildActorContext","UserPermissionController","service","ctx","getMany","event","actor","data","meta","schema","add","entity","create","response","status","edit","id","update","getOne","drop","delete"],"sources":["../../../../../../src/adapters/http/controllers/entities/user-permission/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DBody,\n    DContext,\n    DController,\n    DDelete,\n    DGet,\n    DPath,\n    DPost,\n    DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type {\n    EntityCollectionResponse,\n    EntityRecordResponse,\n    UserPermissionCreatePayload,\n    UserPermissionUpdatePayload,\n} from '@authup/core-http-kit';\nimport type { UserPermission } from '@authup/core-kit';\nimport type { IUserPermissionService } from '../../../../../core/index.ts';\nimport {\n    RECORD_QUERY_PARAMETERS,\n    describeQuerySchema,\n    userPermissionSchema,\n} from '../../../../../core/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { buildActorContext } from '../../../request/index.ts';\n\nexport type UserPermissionControllerContext = {\n    service: IUserPermissionService,\n};\n\n@DTags('user')\n@DController('/user-permissions')\nexport class UserPermissionController {\n    protected service: IUserPermissionService;\n\n    constructor(ctx: UserPermissionControllerContext) {\n        this.service = ctx.service;\n    }\n\n    @DGet('', [ForceLoggedInMiddleware])\n    async getMany(\n        @DContext() event: IAppEvent,\n    ): Promise<EntityCollectionResponse<UserPermission>> {\n        const actor = buildActorContext(event);\n        const {\n            data,\n            meta,\n        } = await this.service.getMany(useRequestQuery(event), actor);\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                schema: describeQuerySchema(userPermissionSchema),\n            },\n        };\n    }\n\n    @DPost('', [ForceLoggedInMiddleware])\n    async add(\n        @DBody() data: UserPermissionCreatePayload,\n        @DContext() event: IAppEvent,\n    ): Promise<EntityRecordResponse<UserPermission>> {\n        const actor = buildActorContext(event);\n\n        const entity = await this.service.create(data, actor);\n\n        event.response.status = 201;\n\n        return { data: entity, meta: {} };\n    }\n\n    @DPost('/:id', [ForceLoggedInMiddleware])\n    async edit(\n        @DPath('id') id: string,\n        @DBody() data: UserPermissionUpdatePayload,\n        @DContext() event: IAppEvent,\n    ): Promise<EntityRecordResponse<UserPermission>> {\n        const actor = buildActorContext(event);\n        const entity = await this.service.update(id, data, actor);\n\n        event.response.status = 202;\n\n        return { data: entity, meta: {} };\n    }\n\n    @DGet('/:id', [ForceLoggedInMiddleware])\n    async getOne(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ): Promise<EntityRecordResponse<UserPermission>> {\n        const actor = buildActorContext(event);\n        const entity = await this.service.getOne(id, actor);\n\n        return { data: entity, meta: { schema: describeQuerySchema(userPermissionSchema, RECORD_QUERY_PARAMETERS) } };\n    }\n\n    @DDelete('/:id', [ForceLoggedInMiddleware])\n    async drop(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ): Promise<EntityRecordResponse<UserPermission>> {\n        const actor = buildActorContext(event);\n        const entity = await this.service.delete(id, actor);\n\n        event.response.status = 202;\n\n        return { data: entity, meta: {} };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAyCA,IAAac,2BAAb,MAAaA;CACCC;CAEV,YAAYC,KAAsC;EAC9C,KAAKD,UAAUC,IAAID;CACvB;CAEA,MACME,QACF,OACiD;EACjD,MAAME,QAAQN,kBAAkBK,KAAAA;EAChC,MAAM,EACFE,MACAC,SACA,MAAM,KAAKN,QAAQE,QAAQT,gBAAgBU,KAAAA,GAAQC,KAAAA;EAEvD,OAAO;GACHC;GACAC,MAAM;IACF,GAAGA;IACHC,QAAQZ,oBAAoBC,oBAAAA;GAChC;EACJ;CACJ;CAEA,MACMY,IACF,MACA,OAC6C;EAC7C,MAAMJ,QAAQN,kBAAkBK,KAAAA;EAEhC,MAAMM,SAAS,MAAM,KAAKT,QAAQU,OAAOL,MAAMD,KAAAA;EAE/CD,MAAMQ,SAASC,SAAS;EAExB,OAAO;GAAEP,MAAMI;GAAQH,MAAM,CAAC;EAAE;CACpC;CAEA,MACMO,KACF,IACA,MACA,OAC6C;EAC7C,MAAMT,QAAQN,kBAAkBK,KAAAA;EAChC,MAAMM,SAAS,MAAM,KAAKT,QAAQe,OAAOD,IAAIT,MAAMD,KAAAA;EAEnDD,MAAMQ,SAASC,SAAS;EAExB,OAAO;GAAEP,MAAMI;GAAQH,MAAM,CAAC;EAAE;CACpC;CAEA,MACMU,OACF,IACA,OAC6C;EAC7C,MAAMZ,QAAQN,kBAAkBK,KAAAA;EAGhC,OAAO;GAAEE,MAAMI,MAFM,KAAKT,QAAQgB,OAAOF,IAAIV,KAAAA;GAEtBE,MAAM,EAAEC,QAAQZ,oBAAoBC,sBAAsBF,uBAAAA,EAAyB;EAAE;CAChH;CAEA,MACMuB,KACF,IACA,OAC6C;EAC7C,MAAMb,QAAQN,kBAAkBK,KAAAA;EAChC,MAAMM,SAAS,MAAM,KAAKT,QAAQkB,OAAOJ,IAAIV,KAAAA;EAE7CD,MAAMQ,SAASC,SAAS;EAExB,OAAO;GAAEP,MAAMI;GAAQH,MAAM,CAAC;EAAE;CACpC;AACJ;;CAtEeT,KAAAA,IAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;CAmBCA,MAAAA,IAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;CAcIA,MAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;;;;;CAcDA,KAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;CAWGA,QAAAA,QAAAA,CAAAA,uBAAAA,CAAAA"}

package/dist/adapters/http/controllers/entities/user-role/module.d.ts

@@ -1,5 +1,5 @@
 import type { IAppEvent } from 'routup';
-import type { EntityCollectionResponse, UserRoleCreatePayload } from '@authup/core-http-kit';
+import type { EntityCollectionResponse, EntityRecordResponse, UserRoleCreatePayload } from '@authup/core-http-kit';
 import type { UserRole } from '@authup/core-kit';
 import type { IUserRoleService } from '../../../../../core/index.ts';
 export type UserRoleControllerContext = {
@@ -9,8 +9,8 @@ export declare class UserRoleController {
     protected service: IUserRoleService;
     constructor(ctx: UserRoleControllerContext);
     getMany(event: IAppEvent): Promise<EntityCollectionResponse<UserRole>>;
-    add(data: UserRoleCreatePayload, event: IAppEvent): Promise<UserRole>;
-    getOne(id: string, event: IAppEvent): Promise<UserRole>;
-    drop(id: string, event: IAppEvent): Promise<UserRole>;
+    add(data: UserRoleCreatePayload, event: IAppEvent): Promise<EntityRecordResponse<UserRole>>;
+    getOne(id: string, event: IAppEvent): Promise<EntityRecordResponse<UserRole>>;
+    drop(id: string, event: IAppEvent): Promise<EntityRecordResponse<UserRole>>;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/controllers/entities/user-role/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/user-role/module.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EACR,wBAAwB,EACxB,qBAAqB,EACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAMrE,MAAM,MAAM,yBAAyB,GAAG;IACpC,OAAO,EAAE,gBAAgB,CAAC;CAC7B,CAAC;AAEF,qBAEa,kBAAkB;IAC3B,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC;gBAExB,GAAG,EAAE,yBAAyB;IAKpC,OAAO,CACG,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IAcxC,GAAG,CACI,IAAI,EAAE,qBAAqB,EACxB,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,QAAQ,CAAC;IAUd,MAAM,CACK,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,QAAQ,CAAC;IAQd,IAAI,CACO,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,QAAQ,CAAC;CAQvB"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/user-role/module.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EACR,wBAAwB,EACxB,oBAAoB,EACpB,qBAAqB,EACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAWrE,MAAM,MAAM,yBAAyB,GAAG;IACpC,OAAO,EAAE,gBAAgB,CAAC;CAC7B,CAAC;AAEF,qBAEa,kBAAkB;IAC3B,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC;gBAExB,GAAG,EAAE,yBAAyB;IAKpC,OAAO,CACG,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IAiBxC,GAAG,CACI,IAAI,EAAE,qBAAqB,EACxB,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAUpC,MAAM,CACK,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAQpC,IAAI,CACO,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;CAQ7C"}

package/dist/adapters/http/controllers/entities/user-role/module.mjs

@@ -1,6 +1,9 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { RECORD_QUERY_PARAMETERS, describeQuerySchema } from "../../../../../core/query/describe.mjs";
+import { userRoleSchema } from "../../../../../core/entities/user-role/schema.mjs";
+import "../../../../../core/index.mjs";
 import { buildActorContext } from "../../../request/helpers/actor.mjs";
 import "../../../request/index.mjs";
 import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
@@ -32,24 +35,36 @@ var UserRoleController = class {
 		const { data, meta } = await this.service.getMany(useRequestQuery(event), actor);
 		return {
 			data,
-			meta
+			meta: {
+				...meta,
+				schema: describeQuerySchema(userRoleSchema)
+			}
 		};
 	}
 	async add(data, event) {
 		const actor = buildActorContext(event);
 		const entity = await this.service.create(data, actor);
 		event.response.status = 201;
-		return entity;
+		return {
+			data: entity,
+			meta: {}
+		};
 	}
 	async getOne(id, event) {
 		const actor = buildActorContext(event);
-		return await this.service.getOne(id, actor);
+		return {
+			data: await this.service.getOne(id, actor),
+			meta: { schema: describeQuerySchema(userRoleSchema, RECORD_QUERY_PARAMETERS) }
+		};
 	}
 	async drop(id, event) {
 		const actor = buildActorContext(event);
 		const entity = await this.service.delete(id, actor);
 		event.response.status = 202;
-		return entity;
+		return {
+			data: entity,
+			meta: {}
+		};
 	}
 };
 _ts_decorate([

package/dist/adapters/http/controllers/entities/user-role/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["DBody","DContext","DController","DDelete","DGet","DPath","DPost","DTags","useRequestQuery","ForceLoggedInMiddleware","buildActorContext","UserRoleController","service","ctx","getMany","event","actor","data","meta","add","entity","create","response","status","getOne","id","drop","delete"],"sources":["../../../../../../src/adapters/http/controllers/entities/user-role/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DBody,\n    DContext,\n    DController,\n    DDelete,\n    DGet,\n    DPath,\n    DPost,\n    DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type {\n    EntityCollectionResponse,\n    UserRoleCreatePayload,\n} from '@authup/core-http-kit';\nimport type { UserRole } from '@authup/core-kit';\nimport type { IUserRoleService } from '../../../../../core/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport {\n    buildActorContext,\n} from '../../../request/index.ts';\n\nexport type UserRoleControllerContext = {\n    service: IUserRoleService,\n};\n\n@DTags('user')\n@DController('/user-roles')\nexport class UserRoleController {\n    protected service: IUserRoleService;\n\n    constructor(ctx: UserRoleControllerContext) {\n        this.service = ctx.service;\n    }\n\n    @DGet('', [ForceLoggedInMiddleware])\n    async getMany(\n        @DContext() event: IAppEvent,\n    ): Promise<EntityCollectionResponse<UserRole>> {\n        const actor = buildActorContext(event);\n        const {\n            data,\n            meta,\n        } = await this.service.getMany(useRequestQuery(event), actor);\n\n        return {\n            data,\n            meta,\n        };\n    }\n\n    @DPost('', [ForceLoggedInMiddleware])\n    async add(\n        @DBody() data: UserRoleCreatePayload,\n        @DContext() event: IAppEvent,\n    ): Promise<UserRole> {\n        const actor = buildActorContext(event);\n        const entity = await this.service.create(data, actor);\n\n        event.response.status = 201;\n\n        return entity;\n    }\n\n    @DGet('/:id', [ForceLoggedInMiddleware])\n    async getOne(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ): Promise<UserRole> {\n        const actor = buildActorContext(event);\n        const entity = await this.service.getOne(id, actor);\n\n        return entity;\n    }\n\n    @DDelete('/:id', [ForceLoggedInMiddleware])\n    async drop(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ): Promise<UserRole> {\n        const actor = buildActorContext(event);\n        const entity = await this.service.delete(id, actor);\n\n        event.response.status = 202;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAoCA,IAAaW,qBAAb,MAAaA;CACCC;CAEV,YAAYC,KAAgC;EACxC,KAAKD,UAAUC,IAAID;CACvB;CAEA,MACME,QACF,OAC2C;EAC3C,MAAME,QAAQN,kBAAkBK,KAAAA;EAChC,MAAM,EACFE,MACAC,SACA,MAAM,KAAKN,QAAQE,QAAQN,gBAAgBO,KAAAA,GAAQC,KAAAA;EAEvD,OAAO;GACHC;GACAC;EACJ;CACJ;CAEA,MACMC,IACF,MACA,OACiB;EACjB,MAAMH,QAAQN,kBAAkBK,KAAAA;EAChC,MAAMK,SAAS,MAAM,KAAKR,QAAQS,OAAOJ,MAAMD,KAAAA;EAE/CD,MAAMO,SAASC,SAAS;EAExB,OAAOH;CACX;CAEA,MACMI,OACF,IACA,OACiB;EACjB,MAAMR,QAAQN,kBAAkBK,KAAAA;EAGhC,OAAOK,MAFc,KAAKR,QAAQY,OAAOC,IAAIT,KAAAA;CAGjD;CAEA,MACMU,KACF,IACA,OACiB;EACjB,MAAMV,QAAQN,kBAAkBK,KAAAA;EAChC,MAAMK,SAAS,MAAM,KAAKR,QAAQe,OAAOF,IAAIT,KAAAA;EAE7CD,MAAMO,SAASC,SAAS;EAExB,OAAOH;CACX;AACJ;;CApDeX,KAAAA,IAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;CAgBCA,MAAAA,IAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;CAaGA,KAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;CAWGA,QAAAA,QAAAA,CAAAA,uBAAAA,CAAAA"}
+{"version":3,"file":"module.mjs","names":["DBody","DContext","DController","DDelete","DGet","DPath","DPost","DTags","useRequestQuery","RECORD_QUERY_PARAMETERS","describeQuerySchema","userRoleSchema","ForceLoggedInMiddleware","buildActorContext","UserRoleController","service","ctx","getMany","event","actor","data","meta","schema","add","entity","create","response","status","getOne","id","drop","delete"],"sources":["../../../../../../src/adapters/http/controllers/entities/user-role/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DBody,\n    DContext,\n    DController,\n    DDelete,\n    DGet,\n    DPath,\n    DPost,\n    DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type {\n    EntityCollectionResponse,\n    EntityRecordResponse,\n    UserRoleCreatePayload,\n} from '@authup/core-http-kit';\nimport type { UserRole } from '@authup/core-kit';\nimport type { IUserRoleService } from '../../../../../core/index.ts';\nimport {\n    RECORD_QUERY_PARAMETERS,\n    describeQuerySchema,\n    userRoleSchema,\n} from '../../../../../core/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport {\n    buildActorContext,\n} from '../../../request/index.ts';\n\nexport type UserRoleControllerContext = {\n    service: IUserRoleService,\n};\n\n@DTags('user')\n@DController('/user-roles')\nexport class UserRoleController {\n    protected service: IUserRoleService;\n\n    constructor(ctx: UserRoleControllerContext) {\n        this.service = ctx.service;\n    }\n\n    @DGet('', [ForceLoggedInMiddleware])\n    async getMany(\n        @DContext() event: IAppEvent,\n    ): Promise<EntityCollectionResponse<UserRole>> {\n        const actor = buildActorContext(event);\n        const {\n            data,\n            meta,\n        } = await this.service.getMany(useRequestQuery(event), actor);\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                schema: describeQuerySchema(userRoleSchema),\n            },\n        };\n    }\n\n    @DPost('', [ForceLoggedInMiddleware])\n    async add(\n        @DBody() data: UserRoleCreatePayload,\n        @DContext() event: IAppEvent,\n    ): Promise<EntityRecordResponse<UserRole>> {\n        const actor = buildActorContext(event);\n        const entity = await this.service.create(data, actor);\n\n        event.response.status = 201;\n\n        return { data: entity, meta: {} };\n    }\n\n    @DGet('/:id', [ForceLoggedInMiddleware])\n    async getOne(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ): Promise<EntityRecordResponse<UserRole>> {\n        const actor = buildActorContext(event);\n        const entity = await this.service.getOne(id, actor);\n\n        return { data: entity, meta: { schema: describeQuerySchema(userRoleSchema, RECORD_QUERY_PARAMETERS) } };\n    }\n\n    @DDelete('/:id', [ForceLoggedInMiddleware])\n    async drop(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ): Promise<EntityRecordResponse<UserRole>> {\n        const actor = buildActorContext(event);\n        const entity = await this.service.delete(id, actor);\n\n        event.response.status = 202;\n\n        return { data: entity, meta: {} };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AA0CA,IAAac,qBAAb,MAAaA;CACCC;CAEV,YAAYC,KAAgC;EACxC,KAAKD,UAAUC,IAAID;CACvB;CAEA,MACME,QACF,OAC2C;EAC3C,MAAME,QAAQN,kBAAkBK,KAAAA;EAChC,MAAM,EACFE,MACAC,SACA,MAAM,KAAKN,QAAQE,QAAQT,gBAAgBU,KAAAA,GAAQC,KAAAA;EAEvD,OAAO;GACHC;GACAC,MAAM;IACF,GAAGA;IACHC,QAAQZ,oBAAoBC,cAAAA;GAChC;EACJ;CACJ;CAEA,MACMY,IACF,MACA,OACuC;EACvC,MAAMJ,QAAQN,kBAAkBK,KAAAA;EAChC,MAAMM,SAAS,MAAM,KAAKT,QAAQU,OAAOL,MAAMD,KAAAA;EAE/CD,MAAMQ,SAASC,SAAS;EAExB,OAAO;GAAEP,MAAMI;GAAQH,MAAM,CAAC;EAAE;CACpC;CAEA,MACMO,OACF,IACA,OACuC;EACvC,MAAMT,QAAQN,kBAAkBK,KAAAA;EAGhC,OAAO;GAAEE,MAAMI,MAFM,KAAKT,QAAQa,OAAOC,IAAIV,KAAAA;GAEtBE,MAAM,EAAEC,QAAQZ,oBAAoBC,gBAAgBF,uBAAAA,EAAyB;EAAE;CAC1G;CAEA,MACMqB,KACF,IACA,OACuC;EACvC,MAAMX,QAAQN,kBAAkBK,KAAAA;EAChC,MAAMM,SAAS,MAAM,KAAKT,QAAQgB,OAAOF,IAAIV,KAAAA;EAE7CD,MAAMQ,SAASC,SAAS;EAExB,OAAO;GAAEP,MAAMI;GAAQH,MAAM,CAAC;EAAE;CACpC;AACJ;;CAvDeT,KAAAA,IAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;CAmBCA,MAAAA,IAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;CAaGA,KAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;CAWGA,QAAAA,QAAAA,CAAAA,uBAAAA,CAAAA"}

package/dist/adapters/http/controllers/index.mjs

@@ -27,6 +27,7 @@ import { PasswordResetController } from "./workflows/password-reset/module.mjs";
 import { RegisterController } from "./workflows/register/module.mjs";
 import { StatusController } from "./workflows/status/module.mjs";
 import { TokenController } from "./workflows/token/module.mjs";
+import { UserInfoController } from "./workflows/userinfo/module.mjs";
 import "./workflows/index.mjs";
 import { RealmController } from "./entities/realm/module.mjs";
 import { RoleController } from "./entities/role/module.mjs";
@@ -49,4 +50,4 @@ import { UserPermissionRequestValidator } from "./entities/user-permission/utils
 import { UserRoleController } from "./entities/user-role/module.mjs";
 import { UserRoleRequestValidator } from "./entities/user-role/utils/validation.mjs";
 import "./entities/index.mjs";
-export { ActivateController, AuthenticatorChallengeController, AuthorizeController, ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ConsentController, EventController, IdentityProviderController, IdentityProviderRoleMappingController, JwkController, KeyController, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RegisterController, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, StatusController, TokenController, TrustAnchorController, UserAttributeController, UserAttributeRequestValidator, UserAuthenticatorController, UserController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator, getJwkRouteHandler, getJwksRouteHandler };
+export { ActivateController, AuthenticatorChallengeController, AuthorizeController, ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ConsentController, EventController, IdentityProviderController, IdentityProviderRoleMappingController, JwkController, KeyController, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RegisterController, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, StatusController, TokenController, TrustAnchorController, UserAttributeController, UserAttributeRequestValidator, UserAuthenticatorController, UserController, UserInfoController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator, getJwkRouteHandler, getJwksRouteHandler };

package/dist/adapters/http/controllers/workflows/authenticator-challenge/module.mjs

@@ -79,7 +79,7 @@ var AuthenticatorChallengeController = class {
 			kind: data.kind,
 			response: data.response
 		}, {
-			ipAddress: getRequestIP(event, { trustProxy: true }) ?? null,
+			ipAddress: getRequestIP(event) ?? null,
 			userAgent: getRequestHeader(event, "user-agent") ?? null,
 			clientId: identity.clientId,
 			...session ? { onVerified: async () => {

package/dist/adapters/http/controllers/workflows/authenticator-challenge/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["DBody","DContext","DController","DGet","DPost","DTags","IdentityType","UserAuthenticatorKind","BadRequestError","EntityCredentialsInvalidError","UnauthorizedError","getRequestHeader","getRequestIP","useRequestIdentity","useRequestLocale","useRequestMfaLoginTicket","useRequestSessionId","AuthenticatorChallengeController","service","sessionManager","mfaLoginService","ctx","resolveActor","event","identity","ticket","status","type","USER","required","enrollmentRequired","kinds","challenge","id","send","data","Object","values","includes","kind","sendChallenge","locale","success","verify","response","sessionId","payload","session_id","session","findOneById","verified","ipAddress","trustProxy","userAgent","clientId","onVerified","markMfaVerified","token","complete","userName","name"],"sources":["../../../../../../src/adapters/http/controllers/workflows/authenticator-challenge/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DBody,\n    DContext,\n    DController,\n    DGet,\n    DPost,\n    DTags,\n} from '@routup/decorators';\nimport { IdentityType, UserAuthenticatorKind } from '@authup/core-kit';\nimport { BadRequestError, EntityCredentialsInvalidError, UnauthorizedError } from '@authup/errors';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type {\n    UserAuthenticatorChallengeResponse,\n    UserAuthenticatorChallengeSendPayload,\n    UserAuthenticatorChallengeVerifyPayload,\n    UserAuthenticatorChallengeVerifyResponse,\n} from '@authup/core-http-kit';\nimport type { IOAuth2MfaLoginService, ISessionManager, IUserAuthenticatorService } from '../../../../../core/index.ts';\nimport type { RequestIdentity, RequestMfaLoginTicket } from '../../../request/index.ts';\nimport {\n    useRequestIdentity,\n    useRequestLocale,\n    useRequestMfaLoginTicket,\n    useRequestSessionId,\n} from '../../../request/index.ts';\n\nexport type AuthenticatorChallengeControllerContext = {\n    service: IUserAuthenticatorService,\n    sessionManager: ISessionManager,\n    mfaLoginService?: IOAuth2MfaLoginService,\n};\n\ntype ChallengeActor = {\n    identity: RequestIdentity,\n    ticket: RequestMfaLoginTicket | null,\n};\n\n/**\n * Login-time challenge surface, scoped to the CURRENT bearer identity.\n * GET reports whether (and how) the caller must present a second factor;\n * POST verifies a factor and stamps mfa_at onto the backing session so\n * the /authorize backstop passes.\n *\n * Besides a regular access bearer, these routes accept the \"MFA-pending\"\n * login ticket (kind: mfa_token, issue #3242) the password grant issues\n * for factor kinds that cannot ride the single grant POST (email /\n * WebAuthn). A ticket-authenticated verify additionally completes the\n * login: the response carries the full token grant for the now-MFA'd\n * pending session.\n */\n@DTags('userAuthenticator')\n@DController('/authenticators/challenge')\nexport class AuthenticatorChallengeController {\n    protected service: IUserAuthenticatorService;\n\n    protected sessionManager: ISessionManager;\n\n    protected mfaLoginService?: IOAuth2MfaLoginService;\n\n    constructor(ctx: AuthenticatorChallengeControllerContext) {\n        this.service = ctx.service;\n        this.sessionManager = ctx.sessionManager;\n        this.mfaLoginService = ctx.mfaLoginService;\n    }\n\n    /**\n     * Resolve the acting subject: the regular request identity (access\n     * bearer — the middleware never sets it for a ticket) or the stashed\n     * MFA-pending ticket. Anything else is unauthorized — the previous\n     * ForceLoggedInMiddleware contract, widened by exactly one bearer kind.\n     */\n    protected resolveActor(event: IAppEvent) : ChallengeActor {\n        const identity = useRequestIdentity(event);\n        if (identity) {\n            return { identity, ticket: null };\n        }\n\n        const ticket = useRequestMfaLoginTicket(event);\n        if (ticket) {\n            return { identity: ticket.identity, ticket };\n        }\n\n        throw new UnauthorizedError();\n    }\n\n    @DGet('')\n    async status(\n        @DContext() event: IAppEvent,\n    ): Promise<UserAuthenticatorChallengeResponse> {\n        const { identity } = this.resolveActor(event);\n        if (identity.type !== IdentityType.USER) {\n            return {\n                required: false,\n                enrollmentRequired: false,\n                kinds: [],\n            };\n        }\n\n        return this.service.challenge(identity.id);\n    }\n\n    @DPost('/send')\n    async send(\n        @DBody() data: UserAuthenticatorChallengeSendPayload,\n        @DContext() event: IAppEvent,\n    ): Promise<{ success: true }> {\n        const { identity } = this.resolveActor(event);\n        if (identity.type !== IdentityType.USER) {\n            throw new BadRequestError('Only user identities can request a challenge.');\n        }\n\n        if (\n            !data ||\n            !Object.values(UserAuthenticatorKind).includes(data.kind as UserAuthenticatorKind)\n        ) {\n            throw new BadRequestError('A kind must be provided.');\n        }\n\n        await this.service.sendChallenge(identity.id, data.kind, { locale: useRequestLocale(event) });\n\n        // uniform 200 regardless of whether a code was actually mailed —\n        // no enrollment-status oracle for the caller.\n        return { success: true };\n    }\n\n    @DPost('')\n    async verify(\n        @DBody() data: UserAuthenticatorChallengeVerifyPayload,\n        @DContext() event: IAppEvent,\n    ): Promise<UserAuthenticatorChallengeVerifyResponse> {\n        const { identity, ticket } = this.resolveActor(event);\n        if (identity.type !== IdentityType.USER) {\n            throw new BadRequestError('Only user identities can complete a challenge.');\n        }\n\n        if (\n            !data ||\n            typeof data.response !== 'string' ||\n            !data.response ||\n            !Object.values(UserAuthenticatorKind).includes(data.kind as UserAuthenticatorKind)\n        ) {\n            throw new BadRequestError('A kind and response must be provided.');\n        }\n\n        // Bind the proof to the backing session — the /authorize backstop\n        // reads session.mfa_at. The session id is server-derived (stashed\n        // by the authorization middleware / carried by the verified ticket),\n        // never client input. The stamp runs INSIDE the verify unit of work\n        // (before the code consumption persists), so a stamp failure never\n        // burns a single-use code.\n        const sessionId = ticket ?\n            ticket.payload.session_id :\n            useRequestSessionId(event);\n        const session = sessionId ?\n            await this.sessionManager.findOneById(sessionId) :\n            null;\n\n        // a ticket references exactly one pending session — without it\n        // (swept / expired mid-flight) the login can not complete.\n        if (ticket && !session) {\n            throw new UnauthorizedError();\n        }\n\n        const verified = await this.service.verify(\n            identity.id,\n            {\n                kind: data.kind,\n                response: data.response,\n            },\n            {\n                ipAddress: getRequestIP(event, { trustProxy: true }) ?? null,\n                userAgent: getRequestHeader(event, 'user-agent') ?? null,\n                clientId: identity.clientId,\n                ...(session ? {\n                    onVerified: async () => {\n                        await this.sessionManager.markMfaVerified(session);\n                    },\n                } : {}),\n            },\n        );\n        if (!verified) {\n            throw new EntityCredentialsInvalidError();\n        }\n\n        // Ticket flow: the factor is verified and mfa_at stamped — complete\n        // the login by minting the full grant for the pending session and\n        // consuming the ticket (single use).\n        if (ticket && session && this.mfaLoginService) {\n            const token = await this.mfaLoginService.complete({\n                session,\n                ticket: ticket.payload,\n                userName: identity.data.name,\n            });\n\n            return { verified: true, token };\n        }\n\n        return { verified: true };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AA4DA,IAAaiB,mCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA8C;EACtD,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,kBAAkBC,IAAID;CAC/B;;;;;;IAQA,aAAuBG,OAAmC;EACtD,MAAMC,WAAWX,mBAAmBU,KAAAA;EACpC,IAAIC,UACA,OAAO;GAAEA;GAAUC,QAAQ;EAAK;EAGpC,MAAMA,SAASV,yBAAyBQ,KAAAA;EACxC,IAAIE,QACA,OAAO;GAAED,UAAUC,OAAOD;GAAUC;EAAO;EAG/C,MAAM,IAAIf,kBAAAA;CACd;CAEA,MACMgB,OACF,OAC2C;EAC3C,MAAM,EAAEF,aAAa,KAAKF,aAAaC,KAAAA;EACvC,IAAIC,SAASG,SAASrB,aAAasB,MAC/B,OAAO;GACHC,UAAU;GACVC,oBAAoB;GACpBC,OAAO,CAAA;EACX;EAGJ,OAAO,KAAKb,QAAQc,UAAUR,SAASS,EAAE;CAC7C;CAEA,MACMC,KACF,MACA,OAC0B;EAC1B,MAAM,EAAEV,aAAa,KAAKF,aAAaC,KAAAA;EACvC,IAAIC,SAASG,SAASrB,aAAasB,MAC/B,MAAM,IAAIpB,gBAAgB,+CAAA;EAG9B,IACI,CAAC2B,QACD,CAACC,OAAOC,OAAO9B,qBAAAA,CAAAA,CAAuB+B,SAASH,KAAKI,IAAI,GAExD,MAAM,IAAI/B,gBAAgB,0BAAA;EAG9B,MAAM,KAAKU,QAAQsB,cAAchB,SAASS,IAAIE,KAAKI,MAAM,EAAEE,QAAQ3B,iBAAiBS,KAAAA,EAAO,CAAA;EAI3F,OAAO,EAAEmB,SAAS,KAAK;CAC3B;CAEA,MACMC,OACF,MACA,OACiD;EACjD,MAAM,EAAEnB,UAAUC,WAAW,KAAKH,aAAaC,KAAAA;EAC/C,IAAIC,SAASG,SAASrB,aAAasB,MAC/B,MAAM,IAAIpB,gBAAgB,gDAAA;EAG9B,IACI,CAAC2B,QACD,OAAOA,KAAKS,aAAa,YACzB,CAACT,KAAKS,YACN,CAACR,OAAOC,OAAO9B,qBAAAA,CAAAA,CAAuB+B,SAASH,KAAKI,IAAI,GAExD,MAAM,IAAI/B,gBAAgB,uCAAA;EAS9B,MAAMqC,YAAYpB,SACdA,OAAOqB,QAAQC,aACf/B,oBAAoBO,KAAAA;EACxB,MAAMyB,UAAUH,YACZ,MAAM,KAAK1B,eAAe8B,YAAYJ,SAAAA,IACtC;EAIJ,IAAIpB,UAAU,CAACuB,SACX,MAAM,IAAItC,kBAAAA;EAoBd,IAAI,CAACwC,MAjBkB,KAAKhC,QAAQyB,OAChCnB,SAASS,IACT;GACIM,MAAMJ,KAAKI;GACXK,UAAUT,KAAKS;EACnB,GACA;GACIO,WAAWvC,aAAaW,OAAO,EAAE6B,YAAY,KAAK,CAAA,KAAM;GACxDC,WAAW1C,iBAAiBY,OAAO,YAAA,KAAiB;GACpD+B,UAAU9B,SAAS8B;GACnB,GAAIN,UAAU,EACVO,YAAY,YAAA;IACR,MAAM,KAAKpC,eAAeqC,gBAAgBR,OAAAA;GAC9C,EACJ,IAAI,CAAC;EACT,CAAA,GAGA,MAAM,IAAIvC,8BAAAA;EAMd,IAAIgB,UAAUuB,WAAW,KAAK5B,iBAO1B,OAAO;GAAE8B,UAAU;GAAMO,OAAAA,MANL,KAAKrC,gBAAgBsC,SAAS;IAC9CV;IACAvB,QAAQA,OAAOqB;IACfa,UAAUnC,SAASW,KAAKyB;GAC5B,CAAA;EAE+B;EAGnC,OAAO,EAAEV,UAAU,KAAK;CAC5B;AACJ"}
+{"version":3,"file":"module.mjs","names":["DBody","DContext","DController","DGet","DPost","DTags","IdentityType","UserAuthenticatorKind","BadRequestError","EntityCredentialsInvalidError","UnauthorizedError","getRequestHeader","getRequestIP","useRequestIdentity","useRequestLocale","useRequestMfaLoginTicket","useRequestSessionId","AuthenticatorChallengeController","service","sessionManager","mfaLoginService","ctx","resolveActor","event","identity","ticket","status","type","USER","required","enrollmentRequired","kinds","challenge","id","send","data","Object","values","includes","kind","sendChallenge","locale","success","verify","response","sessionId","payload","session_id","session","findOneById","verified","ipAddress","userAgent","clientId","onVerified","markMfaVerified","token","complete","userName","name"],"sources":["../../../../../../src/adapters/http/controllers/workflows/authenticator-challenge/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DBody,\n    DContext,\n    DController,\n    DGet,\n    DPost,\n    DTags,\n} from '@routup/decorators';\nimport { IdentityType, UserAuthenticatorKind } from '@authup/core-kit';\nimport { BadRequestError, EntityCredentialsInvalidError, UnauthorizedError } from '@authup/errors';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type {\n    UserAuthenticatorChallengeResponse,\n    UserAuthenticatorChallengeSendPayload,\n    UserAuthenticatorChallengeVerifyPayload,\n    UserAuthenticatorChallengeVerifyResponse,\n} from '@authup/core-http-kit';\nimport type { IOAuth2MfaLoginService, ISessionManager, IUserAuthenticatorService } from '../../../../../core/index.ts';\nimport type { RequestIdentity, RequestMfaLoginTicket } from '../../../request/index.ts';\nimport {\n    useRequestIdentity,\n    useRequestLocale,\n    useRequestMfaLoginTicket,\n    useRequestSessionId,\n} from '../../../request/index.ts';\n\nexport type AuthenticatorChallengeControllerContext = {\n    service: IUserAuthenticatorService,\n    sessionManager: ISessionManager,\n    mfaLoginService?: IOAuth2MfaLoginService,\n};\n\ntype ChallengeActor = {\n    identity: RequestIdentity,\n    ticket: RequestMfaLoginTicket | null,\n};\n\n/**\n * Login-time challenge surface, scoped to the CURRENT bearer identity.\n * GET reports whether (and how) the caller must present a second factor;\n * POST verifies a factor and stamps mfa_at onto the backing session so\n * the /authorize backstop passes.\n *\n * Besides a regular access bearer, these routes accept the \"MFA-pending\"\n * login ticket (kind: mfa_token, issue #3242) the password grant issues\n * for factor kinds that cannot ride the single grant POST (email /\n * WebAuthn). A ticket-authenticated verify additionally completes the\n * login: the response carries the full token grant for the now-MFA'd\n * pending session.\n */\n@DTags('userAuthenticator')\n@DController('/authenticators/challenge')\nexport class AuthenticatorChallengeController {\n    protected service: IUserAuthenticatorService;\n\n    protected sessionManager: ISessionManager;\n\n    protected mfaLoginService?: IOAuth2MfaLoginService;\n\n    constructor(ctx: AuthenticatorChallengeControllerContext) {\n        this.service = ctx.service;\n        this.sessionManager = ctx.sessionManager;\n        this.mfaLoginService = ctx.mfaLoginService;\n    }\n\n    /**\n     * Resolve the acting subject: the regular request identity (access\n     * bearer — the middleware never sets it for a ticket) or the stashed\n     * MFA-pending ticket. Anything else is unauthorized — the previous\n     * ForceLoggedInMiddleware contract, widened by exactly one bearer kind.\n     */\n    protected resolveActor(event: IAppEvent) : ChallengeActor {\n        const identity = useRequestIdentity(event);\n        if (identity) {\n            return { identity, ticket: null };\n        }\n\n        const ticket = useRequestMfaLoginTicket(event);\n        if (ticket) {\n            return { identity: ticket.identity, ticket };\n        }\n\n        throw new UnauthorizedError();\n    }\n\n    @DGet('')\n    async status(\n        @DContext() event: IAppEvent,\n    ): Promise<UserAuthenticatorChallengeResponse> {\n        const { identity } = this.resolveActor(event);\n        if (identity.type !== IdentityType.USER) {\n            return {\n                required: false,\n                enrollmentRequired: false,\n                kinds: [],\n            };\n        }\n\n        return this.service.challenge(identity.id);\n    }\n\n    @DPost('/send')\n    async send(\n        @DBody() data: UserAuthenticatorChallengeSendPayload,\n        @DContext() event: IAppEvent,\n    ): Promise<{ success: true }> {\n        const { identity } = this.resolveActor(event);\n        if (identity.type !== IdentityType.USER) {\n            throw new BadRequestError('Only user identities can request a challenge.');\n        }\n\n        if (\n            !data ||\n            !Object.values(UserAuthenticatorKind).includes(data.kind as UserAuthenticatorKind)\n        ) {\n            throw new BadRequestError('A kind must be provided.');\n        }\n\n        await this.service.sendChallenge(identity.id, data.kind, { locale: useRequestLocale(event) });\n\n        // uniform 200 regardless of whether a code was actually mailed —\n        // no enrollment-status oracle for the caller.\n        return { success: true };\n    }\n\n    @DPost('')\n    async verify(\n        @DBody() data: UserAuthenticatorChallengeVerifyPayload,\n        @DContext() event: IAppEvent,\n    ): Promise<UserAuthenticatorChallengeVerifyResponse> {\n        const { identity, ticket } = this.resolveActor(event);\n        if (identity.type !== IdentityType.USER) {\n            throw new BadRequestError('Only user identities can complete a challenge.');\n        }\n\n        if (\n            !data ||\n            typeof data.response !== 'string' ||\n            !data.response ||\n            !Object.values(UserAuthenticatorKind).includes(data.kind as UserAuthenticatorKind)\n        ) {\n            throw new BadRequestError('A kind and response must be provided.');\n        }\n\n        // Bind the proof to the backing session — the /authorize backstop\n        // reads session.mfa_at. The session id is server-derived (stashed\n        // by the authorization middleware / carried by the verified ticket),\n        // never client input. The stamp runs INSIDE the verify unit of work\n        // (before the code consumption persists), so a stamp failure never\n        // burns a single-use code.\n        const sessionId = ticket ?\n            ticket.payload.session_id :\n            useRequestSessionId(event);\n        const session = sessionId ?\n            await this.sessionManager.findOneById(sessionId) :\n            null;\n\n        // a ticket references exactly one pending session — without it\n        // (swept / expired mid-flight) the login can not complete.\n        if (ticket && !session) {\n            throw new UnauthorizedError();\n        }\n\n        const verified = await this.service.verify(\n            identity.id,\n            {\n                kind: data.kind,\n                response: data.response,\n            },\n            {\n                ipAddress: getRequestIP(event) ?? null,\n                userAgent: getRequestHeader(event, 'user-agent') ?? null,\n                clientId: identity.clientId,\n                ...(session ? {\n                    onVerified: async () => {\n                        await this.sessionManager.markMfaVerified(session);\n                    },\n                } : {}),\n            },\n        );\n        if (!verified) {\n            throw new EntityCredentialsInvalidError();\n        }\n\n        // Ticket flow: the factor is verified and mfa_at stamped — complete\n        // the login by minting the full grant for the pending session and\n        // consuming the ticket (single use).\n        if (ticket && session && this.mfaLoginService) {\n            const token = await this.mfaLoginService.complete({\n                session,\n                ticket: ticket.payload,\n                userName: identity.data.name,\n            });\n\n            return { verified: true, token };\n        }\n\n        return { verified: true };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AA4DA,IAAaiB,mCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA8C;EACtD,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,kBAAkBC,IAAID;CAC/B;;;;;;IAQA,aAAuBG,OAAmC;EACtD,MAAMC,WAAWX,mBAAmBU,KAAAA;EACpC,IAAIC,UACA,OAAO;GAAEA;GAAUC,QAAQ;EAAK;EAGpC,MAAMA,SAASV,yBAAyBQ,KAAAA;EACxC,IAAIE,QACA,OAAO;GAAED,UAAUC,OAAOD;GAAUC;EAAO;EAG/C,MAAM,IAAIf,kBAAAA;CACd;CAEA,MACMgB,OACF,OAC2C;EAC3C,MAAM,EAAEF,aAAa,KAAKF,aAAaC,KAAAA;EACvC,IAAIC,SAASG,SAASrB,aAAasB,MAC/B,OAAO;GACHC,UAAU;GACVC,oBAAoB;GACpBC,OAAO,CAAA;EACX;EAGJ,OAAO,KAAKb,QAAQc,UAAUR,SAASS,EAAE;CAC7C;CAEA,MACMC,KACF,MACA,OAC0B;EAC1B,MAAM,EAAEV,aAAa,KAAKF,aAAaC,KAAAA;EACvC,IAAIC,SAASG,SAASrB,aAAasB,MAC/B,MAAM,IAAIpB,gBAAgB,+CAAA;EAG9B,IACI,CAAC2B,QACD,CAACC,OAAOC,OAAO9B,qBAAAA,CAAAA,CAAuB+B,SAASH,KAAKI,IAAI,GAExD,MAAM,IAAI/B,gBAAgB,0BAAA;EAG9B,MAAM,KAAKU,QAAQsB,cAAchB,SAASS,IAAIE,KAAKI,MAAM,EAAEE,QAAQ3B,iBAAiBS,KAAAA,EAAO,CAAA;EAI3F,OAAO,EAAEmB,SAAS,KAAK;CAC3B;CAEA,MACMC,OACF,MACA,OACiD;EACjD,MAAM,EAAEnB,UAAUC,WAAW,KAAKH,aAAaC,KAAAA;EAC/C,IAAIC,SAASG,SAASrB,aAAasB,MAC/B,MAAM,IAAIpB,gBAAgB,gDAAA;EAG9B,IACI,CAAC2B,QACD,OAAOA,KAAKS,aAAa,YACzB,CAACT,KAAKS,YACN,CAACR,OAAOC,OAAO9B,qBAAAA,CAAAA,CAAuB+B,SAASH,KAAKI,IAAI,GAExD,MAAM,IAAI/B,gBAAgB,uCAAA;EAS9B,MAAMqC,YAAYpB,SACdA,OAAOqB,QAAQC,aACf/B,oBAAoBO,KAAAA;EACxB,MAAMyB,UAAUH,YACZ,MAAM,KAAK1B,eAAe8B,YAAYJ,SAAAA,IACtC;EAIJ,IAAIpB,UAAU,CAACuB,SACX,MAAM,IAAItC,kBAAAA;EAoBd,IAAI,CAACwC,MAjBkB,KAAKhC,QAAQyB,OAChCnB,SAASS,IACT;GACIM,MAAMJ,KAAKI;GACXK,UAAUT,KAAKS;EACnB,GACA;GACIO,WAAWvC,aAAaW,KAAAA,KAAU;GAClC6B,WAAWzC,iBAAiBY,OAAO,YAAA,KAAiB;GACpD8B,UAAU7B,SAAS6B;GACnB,GAAIL,UAAU,EACVM,YAAY,YAAA;IACR,MAAM,KAAKnC,eAAeoC,gBAAgBP,OAAAA;GAC9C,EACJ,IAAI,CAAC;EACT,CAAA,GAGA,MAAM,IAAIvC,8BAAAA;EAMd,IAAIgB,UAAUuB,WAAW,KAAK5B,iBAO1B,OAAO;GAAE8B,UAAU;GAAMM,OAAAA,MANL,KAAKpC,gBAAgBqC,SAAS;IAC9CT;IACAvB,QAAQA,OAAOqB;IACfY,UAAUlC,SAASW,KAAKwB;GAC5B,CAAA;EAE+B;EAGnC,OAAO,EAAET,UAAU,KAAK;CAC5B;AACJ"}

package/dist/adapters/http/controllers/workflows/index.d.ts

@@ -9,4 +9,5 @@ export * from './password-reset/index.ts';
 export * from './register/index.ts';
 export * from './status/index.ts';
 export * from './token/index.ts';
+export * from './userinfo/index.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/controllers/workflows/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/controllers/workflows/index.ts"],"names":[],"mappings":"AAOA,cAAc,qBAAqB,CAAC;AACpC,cAAc,oCAAoC,CAAC;AACnD,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/controllers/workflows/index.ts"],"names":[],"mappings":"AAOA,cAAc,qBAAqB,CAAC;AACpC,cAAc,oCAAoC,CAAC;AACnD,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC"}

package/dist/adapters/http/controllers/workflows/index.mjs

@@ -24,4 +24,6 @@ import { StatusController } from "./status/module.mjs";
 import "./status/index.mjs";
 import { TokenController } from "./token/module.mjs";
 import "./token/index.mjs";
-export { ActivateController, AuthenticatorChallengeController, AuthorizeController, JwkController, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, RegisterController, StatusController, TokenController, getJwkRouteHandler, getJwksRouteHandler };
+import { UserInfoController } from "./userinfo/module.mjs";
+import "./userinfo/index.mjs";
+export { ActivateController, AuthenticatorChallengeController, AuthorizeController, JwkController, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, RegisterController, StatusController, TokenController, UserInfoController, getJwkRouteHandler, getJwksRouteHandler };

package/dist/adapters/http/controllers/workflows/logout/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/logout/module.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,wBAAwB,EAA2B,MAAM,8BAA8B,CAAC;AACtG,OAAO,EAAE,gCAAgC,EAAE,MAAM,8BAA8B,CAAC;AAGhF,OAAO,KAAK,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAEnF,qBACa,gBAAgB;IACzB,SAAS,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAE3C,SAAS,CAAC,iBAAiB,EAAE,wBAAwB,CAAC;IAEtD,SAAS,CAAC,SAAS,EAAE,gCAAgC,CAAC;gBAE1C,GAAG,EAAE,uBAAuB;IAOlC,KAAK,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC;IAM/D,OAAO,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC;cAIvD,MAAM,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC;CAyEvE"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/logout/module.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,wBAAwB,EAA2B,MAAM,8BAA8B,CAAC;AACtG,OAAO,EAAE,gCAAgC,EAAE,MAAM,8BAA8B,CAAC;AAGhF,OAAO,KAAK,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAEnF,qBACa,gBAAgB;IACzB,SAAS,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAE3C,SAAS,CAAC,iBAAiB,EAAE,wBAAwB,CAAC;IAEtD,SAAS,CAAC,SAAS,EAAE,gCAAgC,CAAC;gBAE1C,GAAG,EAAE,uBAAuB;IAOlC,KAAK,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC;IAM/D,OAAO,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC;cAIvD,MAAM,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC;CAsFvE"}

package/dist/adapters/http/controllers/workflows/logout/module.mjs

@@ -46,7 +46,11 @@ var LogoutController = class {
 		try {
 			data = await this.validator.run(merged);
 		} catch {
-			data = {};
+			try {
+				data = await this.validator.run({ id_token_hint: merged.id_token_hint });
+			} catch {
+				data = {};
+			}
 		}
 		const result = await this.endSessionService.verify(data);
 		let serverRevoked = false;

package/dist/adapters/http/controllers/workflows/logout/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["DContext","DController","DGet","DPost","URL","sendRedirect","OAuth2EndSessionRequestValidator","readFromLocations","renderUIPage","LogoutController","options","endSessionService","validator","ctx","serve","event","handle","execute","merged","data","run","result","verify","serverRevoked","hintVerified","sessionId","sub","subKind","revoke","redirect","redirectUri","url","state","searchParams","set","href","requestURL","request","payload","config","baseURL","client","clientName","name","undefined","hintSub","hintSubKind","requestPath","pathname","search"],"sources":["../../../../../../src/adapters/http/controllers/workflows/logout/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPost,\n} from '@routup/decorators';\nimport { URL } from 'node:url';\nimport type { IAppEvent } from 'routup';\nimport { sendRedirect } from 'routup';\nimport type { IOAuth2EndSessionService, OAuth2EndSessionRequest } from '../../../../../core/index.ts';\nimport { OAuth2EndSessionRequestValidator } from '../../../../../core/index.ts';\nimport { readFromLocations } from '../../../request/index.ts';\nimport { renderUIPage } from '../../../ui/index.ts';\nimport type { LogoutControllerContext, LogoutControllerOptions } from './types.ts';\n\n@DController('/logout')\nexport class LogoutController {\n    protected options: LogoutControllerOptions;\n\n    protected endSessionService: IOAuth2EndSessionService;\n\n    protected validator: OAuth2EndSessionRequestValidator;\n\n    constructor(ctx: LogoutControllerContext) {\n        this.options = ctx.options;\n        this.endSessionService = ctx.endSessionService;\n        this.validator = new OAuth2EndSessionRequestValidator();\n    }\n\n    @DGet('', [])\n    async serve(@DContext() event: IAppEvent): Promise<string | Response> {\n        return this.handle(event);\n    }\n\n    // OIDC RP-Initiated Logout allows form_post on the same endpoint.\n    @DPost('', [])\n    async execute(@DContext() event: IAppEvent): Promise<string | Response> {\n        return this.handle(event);\n    }\n\n    protected async handle(event: IAppEvent): Promise<string | Response> {\n        const merged = await readFromLocations(event, ['body', 'query']);\n\n        // Malformed input (oversized / duplicated params) must never dead-end\n        // the human behind the browser on a JSON error: fall back to a\n        // parameter-less confirm page — every attacker-controlled value is\n        // dropped, the click-gated sign-out keeps working.\n        let data: OAuth2EndSessionRequest;\n        try {\n            data = await this.validator.run(merged);\n        } catch {\n            data = {};\n        }\n\n        const result = await this.endSessionService.verify(data);\n\n        // A signature-verified id_token_hint proves possession — revoke the\n        // referenced session server-side immediately (only if it belongs to the\n        // hint's subject). Without a hint we mutate nothing; the SSR page's\n        // sign-out is a click-gated, bearer-authenticated action.\n        let serverRevoked = false;\n        if (result.hintVerified && result.sessionId && result.sub && result.subKind) {\n            serverRevoked = await this.endSessionService.revoke(\n                result.sessionId,\n                result.sub,\n                result.subKind,\n            );\n        }\n\n        // Build the validated post-logout redirect (the open-redirect guard\n        // lives in the service; `state` rides only alongside a validated uri).\n        let redirect: string | undefined;\n        if (result.redirectUri) {\n            const url = new URL(result.redirectUri);\n            if (result.state) {\n                url.searchParams.set('state', result.state);\n            }\n\n            redirect = url.href;\n        }\n\n        // Bounce straight back to the RP ONLY when the logout was actually\n        // performed server-side (a verified hint revoked the session). A\n        // hint-less or forged request MUST NOT silently redirect without ending\n        // the session — otherwise the RP treats a no-op round-trip as a\n        // successful logout while the authup session survives. Instead render\n        // the click-gated confirm page, which performs the bearer-authenticated\n        // sign-out and then redirects.\n        if (serverRevoked && redirect) {\n            return sendRedirect(event, redirect);\n        }\n\n        const requestURL = new URL(event.request.url);\n\n        return renderUIPage(event, {\n            url: '/logout',\n            payload: {\n                config: { baseURL: this.options.baseURL },\n                data: {\n                    client: result.clientName ? { name: result.clientName } : undefined,\n                    hintVerified: result.hintVerified,\n                    // never reflect an unverified hint's claims\n                    hintSub: result.hintVerified ? result.sub : undefined,\n                    hintSubKind: result.hintVerified ? result.subKind : undefined,\n                    serverRevoked,\n                    // the (already validated) uri to return to after a click-gated\n                    // sign-out; carries `state` when present\n                    redirect,\n                    requestPath: `${requestURL.pathname}${requestURL.search}`,\n                },\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAuBA,IAAaS,mBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA8B;EACtC,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,oBAAoBE,IAAIF;EAC7B,KAAKC,YAAY,IAAIN,iCAAAA;CACzB;CAEA,MACMQ,MAAM,OAA0D;EAClE,OAAO,KAAKE,OAAOD,KAAAA;CACvB;CAGA,MACME,QAAQ,OAA0D;EACpE,OAAO,KAAKD,OAAOD,KAAAA;CACvB;CAEA,MAAgBC,OAAOD,OAA8C;EACjE,MAAMG,SAAS,MAAMX,kBAAkBQ,OAAO,CAAC,QAAQ,OAAQ,CAAA;EAM/D,IAAII;EACJ,IAAI;GACAA,OAAO,MAAM,KAAKP,UAAUQ,IAAIF,MAAAA;EACpC,QAAQ;GACJC,OAAO,CAAC;EACZ;EAEA,MAAME,SAAS,MAAM,KAAKV,kBAAkBW,OAAOH,IAAAA;EAMnD,IAAII,gBAAgB;EACpB,IAAIF,OAAOG,gBAAgBH,OAAOI,aAAaJ,OAAOK,OAAOL,OAAOM,SAChEJ,gBAAgB,MAAM,KAAKZ,kBAAkBiB,OACzCP,OAAOI,WACPJ,OAAOK,KACPL,OAAOM,OAAO;EAMtB,IAAIE;EACJ,IAAIR,OAAOS,aAAa;GACpB,MAAMC,MAAM,IAAI3B,IAAIiB,OAAOS,WAAW;GACtC,IAAIT,OAAOW,OACPD,IAAIE,aAAaC,IAAI,SAASb,OAAOW,KAAK;GAG9CH,WAAWE,IAAII;EACnB;EASA,IAAIZ,iBAAiBM,UACjB,OAAOxB,aAAaU,OAAOc,QAAAA;EAG/B,MAAMO,aAAa,IAAIhC,IAAIW,MAAMsB,QAAQN,GAAG;EAE5C,OAAOvB,aAAaO,OAAO;GACvBgB,KAAK;GACLO,SAAS;IACLC,QAAQ,EAAEC,SAAS,KAAK9B,QAAQ8B,QAAQ;IACxCrB,MAAM;KACFsB,QAAQpB,OAAOqB,aAAa,EAAEC,MAAMtB,OAAOqB,WAAW,IAAIE,KAAAA;KAC1DpB,cAAcH,OAAOG;KAErBqB,SAASxB,OAAOG,eAAeH,OAAOK,MAAMkB,KAAAA;KAC5CE,aAAazB,OAAOG,eAAeH,OAAOM,UAAUiB,KAAAA;KACpDrB;KAGAM;KACAkB,aAAa,GAAGX,WAAWY,WAAWZ,WAAWa;IACrD;GACJ;EACJ,CAAA;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["DContext","DController","DGet","DPost","URL","sendRedirect","OAuth2EndSessionRequestValidator","readFromLocations","renderUIPage","LogoutController","options","endSessionService","validator","ctx","serve","event","handle","execute","merged","data","run","id_token_hint","result","verify","serverRevoked","hintVerified","sessionId","sub","subKind","revoke","redirect","redirectUri","url","state","searchParams","set","href","requestURL","request","payload","config","baseURL","client","clientName","name","undefined","hintSub","hintSubKind","requestPath","pathname","search"],"sources":["../../../../../../src/adapters/http/controllers/workflows/logout/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPost,\n} from '@routup/decorators';\nimport { URL } from 'node:url';\nimport type { IAppEvent } from 'routup';\nimport { sendRedirect } from 'routup';\nimport type { IOAuth2EndSessionService, OAuth2EndSessionRequest } from '../../../../../core/index.ts';\nimport { OAuth2EndSessionRequestValidator } from '../../../../../core/index.ts';\nimport { readFromLocations } from '../../../request/index.ts';\nimport { renderUIPage } from '../../../ui/index.ts';\nimport type { LogoutControllerContext, LogoutControllerOptions } from './types.ts';\n\n@DController('/logout')\nexport class LogoutController {\n    protected options: LogoutControllerOptions;\n\n    protected endSessionService: IOAuth2EndSessionService;\n\n    protected validator: OAuth2EndSessionRequestValidator;\n\n    constructor(ctx: LogoutControllerContext) {\n        this.options = ctx.options;\n        this.endSessionService = ctx.endSessionService;\n        this.validator = new OAuth2EndSessionRequestValidator();\n    }\n\n    @DGet('', [])\n    async serve(@DContext() event: IAppEvent): Promise<string | Response> {\n        return this.handle(event);\n    }\n\n    // OIDC RP-Initiated Logout allows form_post on the same endpoint.\n    @DPost('', [])\n    async execute(@DContext() event: IAppEvent): Promise<string | Response> {\n        return this.handle(event);\n    }\n\n    protected async handle(event: IAppEvent): Promise<string | Response> {\n        const merged = await readFromLocations(event, ['body', 'query']);\n\n        // Malformed input (oversized / duplicated params) must never dead-end\n        // the human behind the browser on a JSON error, nor discard a valid\n        // id_token_hint: a bad *cosmetic* param (post_logout_redirect_uri /\n        // state / client_id / realm hint) must NOT cancel the\n        // security-critical revoke the hint authorizes. So on a full-request\n        // validation failure, retry with the hint ALONE — the revoke needs\n        // nothing else: its subject/session come from the verified hint's\n        // claims, and client resolution degrades gracefully (the service\n        // falls back to the hint's sole `aud`, scoped by the hint's own realm\n        // claim — the dropped request params only affected the confirm page's\n        // client name and the redirect, which is dropped anyway). Only a\n        // malformed hint itself falls through to the parameter-less confirm\n        // page.\n        let data: OAuth2EndSessionRequest;\n        try {\n            data = await this.validator.run(merged);\n        } catch {\n            try {\n                data = await this.validator.run({ id_token_hint: merged.id_token_hint });\n            } catch {\n                data = {};\n            }\n        }\n\n        const result = await this.endSessionService.verify(data);\n\n        // A signature-verified id_token_hint proves possession — revoke the\n        // referenced session server-side immediately (only if it belongs to the\n        // hint's subject). Without a hint we mutate nothing; the SSR page's\n        // sign-out is a click-gated, bearer-authenticated action.\n        let serverRevoked = false;\n        if (result.hintVerified && result.sessionId && result.sub && result.subKind) {\n            serverRevoked = await this.endSessionService.revoke(\n                result.sessionId,\n                result.sub,\n                result.subKind,\n            );\n        }\n\n        // Build the validated post-logout redirect (the open-redirect guard\n        // lives in the service; `state` rides only alongside a validated uri).\n        let redirect: string | undefined;\n        if (result.redirectUri) {\n            const url = new URL(result.redirectUri);\n            if (result.state) {\n                url.searchParams.set('state', result.state);\n            }\n\n            redirect = url.href;\n        }\n\n        // Bounce straight back to the RP ONLY when the logout was actually\n        // performed server-side (a verified hint revoked the session). A\n        // hint-less or forged request MUST NOT silently redirect without ending\n        // the session — otherwise the RP treats a no-op round-trip as a\n        // successful logout while the authup session survives. Instead render\n        // the click-gated confirm page, which performs the bearer-authenticated\n        // sign-out and then redirects.\n        if (serverRevoked && redirect) {\n            return sendRedirect(event, redirect);\n        }\n\n        const requestURL = new URL(event.request.url);\n\n        return renderUIPage(event, {\n            url: '/logout',\n            payload: {\n                config: { baseURL: this.options.baseURL },\n                data: {\n                    client: result.clientName ? { name: result.clientName } : undefined,\n                    hintVerified: result.hintVerified,\n                    // never reflect an unverified hint's claims\n                    hintSub: result.hintVerified ? result.sub : undefined,\n                    hintSubKind: result.hintVerified ? result.subKind : undefined,\n                    serverRevoked,\n                    // the (already validated) uri to return to after a click-gated\n                    // sign-out; carries `state` when present\n                    redirect,\n                    requestPath: `${requestURL.pathname}${requestURL.search}`,\n                },\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAuBA,IAAaS,mBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA8B;EACtC,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,oBAAoBE,IAAIF;EAC7B,KAAKC,YAAY,IAAIN,iCAAAA;CACzB;CAEA,MACMQ,MAAM,OAA0D;EAClE,OAAO,KAAKE,OAAOD,KAAAA;CACvB;CAGA,MACME,QAAQ,OAA0D;EACpE,OAAO,KAAKD,OAAOD,KAAAA;CACvB;CAEA,MAAgBC,OAAOD,OAA8C;EACjE,MAAMG,SAAS,MAAMX,kBAAkBQ,OAAO,CAAC,QAAQ,OAAQ,CAAA;EAe/D,IAAII;EACJ,IAAI;GACAA,OAAO,MAAM,KAAKP,UAAUQ,IAAIF,MAAAA;EACpC,QAAQ;GACJ,IAAI;IACAC,OAAO,MAAM,KAAKP,UAAUQ,IAAI,EAAEC,eAAeH,OAAOG,cAAc,CAAA;GAC1E,QAAQ;IACJF,OAAO,CAAC;GACZ;EACJ;EAEA,MAAMG,SAAS,MAAM,KAAKX,kBAAkBY,OAAOJ,IAAAA;EAMnD,IAAIK,gBAAgB;EACpB,IAAIF,OAAOG,gBAAgBH,OAAOI,aAAaJ,OAAOK,OAAOL,OAAOM,SAChEJ,gBAAgB,MAAM,KAAKb,kBAAkBkB,OACzCP,OAAOI,WACPJ,OAAOK,KACPL,OAAOM,OAAO;EAMtB,IAAIE;EACJ,IAAIR,OAAOS,aAAa;GACpB,MAAMC,MAAM,IAAI5B,IAAIkB,OAAOS,WAAW;GACtC,IAAIT,OAAOW,OACPD,IAAIE,aAAaC,IAAI,SAASb,OAAOW,KAAK;GAG9CH,WAAWE,IAAII;EACnB;EASA,IAAIZ,iBAAiBM,UACjB,OAAOzB,aAAaU,OAAOe,QAAAA;EAG/B,MAAMO,aAAa,IAAIjC,IAAIW,MAAMuB,QAAQN,GAAG;EAE5C,OAAOxB,aAAaO,OAAO;GACvBiB,KAAK;GACLO,SAAS;IACLC,QAAQ,EAAEC,SAAS,KAAK/B,QAAQ+B,QAAQ;IACxCtB,MAAM;KACFuB,QAAQpB,OAAOqB,aAAa,EAAEC,MAAMtB,OAAOqB,WAAW,IAAIE,KAAAA;KAC1DpB,cAAcH,OAAOG;KAErBqB,SAASxB,OAAOG,eAAeH,OAAOK,MAAMkB,KAAAA;KAC5CE,aAAazB,OAAOG,eAAeH,OAAOM,UAAUiB,KAAAA;KACpDrB;KAGAM;KACAkB,aAAa,GAAGX,WAAWY,WAAWZ,WAAWa;IACrD;GACJ;EACJ,CAAA;CACJ;AACJ"}

package/dist/adapters/http/controllers/workflows/userinfo/index.d.ts

@@ -0,0 +1,2 @@
+export * from './module.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/controllers/workflows/userinfo/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/userinfo/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC"}

package/dist/adapters/http/controllers/workflows/userinfo/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { UserInfoController } from "./module.mjs";
+export { UserInfoController };

package/dist/adapters/http/controllers/workflows/userinfo/module.d.ts

@@ -0,0 +1,18 @@
+import type { IAppEvent } from 'routup';
+import type { User } from '@authup/core-kit';
+import type { IUserService } from '../../../../../core/index.ts';
+export type UserInfoControllerContext = {
+    service: IUserService;
+};
+/**
+ * The OIDC userinfo endpoint (advertised via discovery). It serves the
+ * authenticated user's own record as a FLAT claims document — it must
+ * never adopt the `{ data, meta }` entity-record envelope, which is why
+ * it is a dedicated route instead of an alias of `GET /users/@me`.
+ */
+export declare class UserInfoController {
+    protected service: IUserService;
+    constructor(ctx: UserInfoControllerContext);
+    get(event: IAppEvent): Promise<User>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/controllers/workflows/userinfo/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/userinfo/module.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAIjE,MAAM,MAAM,yBAAyB,GAAG;IACpC,OAAO,EAAE,YAAY,CAAC;CACzB,CAAC;AAEF;;;;;GAKG;AACH,qBAEa,kBAAkB;IAC3B,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC;gBAEpB,GAAG,EAAE,yBAAyB;IAKpC,GAAG,CACO,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,IAAI,CAAC;CAanB"}

package/dist/adapters/http/controllers/workflows/userinfo/module.mjs

@@ -0,0 +1,53 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { buildActorContext } from "../../../request/helpers/actor.mjs";
+import "../../../request/index.mjs";
+import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
+import "../../../middleware/index.mjs";
+import { useRequestQuery } from "@routup/basic/query";
+import { DContext, DController, DGet, DTags } from "@routup/decorators";
+//#region src/adapters/http/controllers/workflows/userinfo/module.ts
+function _ts_decorate(decorators, target, key, desc) {
+	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+	return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(metadataKey, metadataValue) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(metadataKey, metadataValue);
+}
+function _ts_param(paramIndex, decorator) {
+	return function(target, key) {
+		decorator(target, key, paramIndex);
+	};
+}
+var UserInfoController = class {
+	service;
+	constructor(ctx) {
+		this.service = ctx.service;
+	}
+	async get(event) {
+		const actor = buildActorContext(event);
+		let id = "@me";
+		if (actor.identity && actor.identity.type === "user") id = actor.identity.data.id;
+		return this.service.getOne(id, actor, useRequestQuery(event));
+	}
+};
+_ts_decorate([
+	DGet("", [ForceLoggedInMiddleware]),
+	_ts_param(0, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], UserInfoController.prototype, "get", null);
+UserInfoController = _ts_decorate([
+	DTags("auth"),
+	DController("/userinfo"),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof UserInfoControllerContext === "undefined" ? Object : UserInfoControllerContext])
+], UserInfoController);
+//#endregion
+export { UserInfoController };
+
+//# sourceMappingURL=module.mjs.map

package/dist/adapters/http/controllers/workflows/userinfo/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["DContext","DController","DGet","DTags","useRequestQuery","ForceLoggedInMiddleware","buildActorContext","UserInfoController","service","ctx","get","event","actor","id","identity","type","data","getOne"],"sources":["../../../../../../src/adapters/http/controllers/workflows/userinfo/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DContext,\n    DController,\n    DGet,\n    DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { User } from '@authup/core-kit';\nimport type { IUserService } from '../../../../../core/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { buildActorContext } from '../../../request/index.ts';\n\nexport type UserInfoControllerContext = {\n    service: IUserService,\n};\n\n/**\n * The OIDC userinfo endpoint (advertised via discovery). It serves the\n * authenticated user's own record as a FLAT claims document — it must\n * never adopt the `{ data, meta }` entity-record envelope, which is why\n * it is a dedicated route instead of an alias of `GET /users/@me`.\n */\n@DTags('auth')\n@DController('/userinfo')\nexport class UserInfoController {\n    protected service: IUserService;\n\n    constructor(ctx: UserInfoControllerContext) {\n        this.service = ctx.service;\n    }\n\n    @DGet('', [ForceLoggedInMiddleware])\n    async get(\n        @DContext() event: IAppEvent,\n    ): Promise<User> {\n        const actor = buildActorContext(event);\n\n        let id = '@me';\n        if (\n            actor.identity &&\n            actor.identity.type === 'user'\n        ) {\n            id = actor.identity.data.id;\n        }\n\n        return this.service.getOne(id, actor, useRequestQuery(event));\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAgCA,IAAaO,qBAAb,MAAaA;CACCC;CAEV,YAAYC,KAAgC;EACxC,KAAKD,UAAUC,IAAID;CACvB;CAEA,MACME,IACF,OACa;EACb,MAAME,QAAQN,kBAAkBK,KAAAA;EAEhC,IAAIE,KAAK;EACT,IACID,MAAME,YACNF,MAAME,SAASC,SAAS,QAExBF,KAAKD,MAAME,SAASE,KAAKH;EAG7B,OAAO,KAAKL,QAAQS,OAAOJ,IAAID,OAAOR,gBAAgBO,KAAAA,CAAAA;CAC1D;AACJ;;CAhBeN,KAAAA,IAAAA,CAAAA,uBAAAA,CAAAA"}

package/dist/adapters/http/index.mjs

@@ -72,6 +72,7 @@ import { PasswordResetController } from "./controllers/workflows/password-reset/
 import { RegisterController } from "./controllers/workflows/register/module.mjs";
 import { StatusController } from "./controllers/workflows/status/module.mjs";
 import { TokenController } from "./controllers/workflows/token/module.mjs";
+import { UserInfoController } from "./controllers/workflows/userinfo/module.mjs";
 import { RealmController } from "./controllers/entities/realm/module.mjs";
 import { RoleController } from "./controllers/entities/role/module.mjs";
 import { RoleAttributeController } from "./controllers/entities/role-attribute/module.mjs";
@@ -93,4 +94,4 @@ import { UserPermissionRequestValidator } from "./controllers/entities/user-perm
 import { UserRoleController } from "./controllers/entities/user-role/module.mjs";
 import { UserRoleRequestValidator } from "./controllers/entities/user-role/utils/validation.mjs";
 import "./controllers/index.mjs";
-export { ActivateController, AuthenticatorChallengeController, AuthorizationMiddleware, AuthorizeController, CERTIFICATE_SOURCES, ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ConsentController, EventController, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, IdentityProviderController, IdentityProviderRoleMappingController, JwkController, KeyController, LOCALE_COOKIE, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RealmResolverMiddleware, RegisterController, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, StatusController, TokenController, TrustAnchorController, UI_HTTP_CLIENT_FACTORY_STORE_KEY, UserAttributeController, UserAttributeRequestValidator, UserAuthenticatorController, UserController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator, VITE_SERVER_STORE_KEY, applyRouteRealmIDToBody, buildActorContext, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createRequestEventContextMiddleware, createRouteTemplateNormalizePath, createSwaggerMiddleware, extractClientCertificateEvidence, extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, getBodyRealmID, getJwkRouteHandler, getJwksRouteHandler, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, guessOauth2GrantTypeByRequest, readFromLocations, readRealmHint, readStringField, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerUIHttpClientMiddleware, runWithRequestEventContext, sanitizeRelativeRedirect, setRequestIdentity, setRequestMfaLoginTicket, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestEventContext, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestMfaLoginTicket, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestSessionId, useRequestToken };
+export { ActivateController, AuthenticatorChallengeController, AuthorizationMiddleware, AuthorizeController, CERTIFICATE_SOURCES, ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ConsentController, EventController, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, IdentityProviderController, IdentityProviderRoleMappingController, JwkController, KeyController, LOCALE_COOKIE, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RealmResolverMiddleware, RegisterController, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, StatusController, TokenController, TrustAnchorController, UI_HTTP_CLIENT_FACTORY_STORE_KEY, UserAttributeController, UserAttributeRequestValidator, UserAuthenticatorController, UserController, UserInfoController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator, VITE_SERVER_STORE_KEY, applyRouteRealmIDToBody, buildActorContext, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createRequestEventContextMiddleware, createRouteTemplateNormalizePath, createSwaggerMiddleware, extractClientCertificateEvidence, extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, getBodyRealmID, getJwkRouteHandler, getJwksRouteHandler, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, guessOauth2GrantTypeByRequest, readFromLocations, readRealmHint, readStringField, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerUIHttpClientMiddleware, runWithRequestEventContext, sanitizeRelativeRedirect, setRequestIdentity, setRequestMfaLoginTicket, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestEventContext, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestMfaLoginTicket, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestSessionId, useRequestToken };

package/dist/adapters/http/middleware/built-in/authorization/module.d.ts

@@ -15,6 +15,7 @@ export declare class AuthorizationMiddleware {
     protected userAuthenticator: ICredentialsAuthenticator<User>;
     constructor(ctx: HTTPAuthorizationMiddlewareContext);
     run(event: IAppEvent): Promise<void>;
+    protected runInner(event: IAppEvent): Promise<void>;
     /**
      * @throws JWTError
      */

package/dist/adapters/http/middleware/built-in/authorization/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/middleware/built-in/authorization/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAE3D,OAAO,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAMrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAOxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAEH,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAEjC,MAAM,OAAO,CAAC;AAOf,OAAO,KAAK,EACR,yBAAyB,EACzB,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EAClB,MAAM,8BAA8B,CAAC;AAYtC,OAAO,KAAK,EAAE,kCAAkC,EAAE,kCAAkC,EAAE,MAAM,YAAY,CAAC;AAEzG,qBAAa,uBAAuB;IAChC,SAAS,CAAC,OAAO,EAAE,kCAAkC,CAAC;IAItD,SAAS,CAAC,mBAAmB,EAAE,oBAAoB,CAAC;IAEpD,SAAS,CAAC,mBAAmB,EAAE,oBAAoB,CAAC;IAIpD,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,cAAc,EAAG,eAAe,CAAC;IAI3C,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAElE,SAAS,CAAC,iBAAiB,EAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;gBAIlD,GAAG,EAAE,kCAAkC;IAqB7C,GAAG,CAAC,KAAK,EAAE,SAAS;IA2B1B;;OAEG;cACa,+BAA+B,CAC3C,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,yBAAyB;cAgErB,wBAAwB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAyBtG;;;;;;;;;OASG;cACa,oBAAoB,CAChC,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,kBAAkB;cAsDf,8BAA8B,CAC1C,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,wBAAwB;CA+BvC"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/middleware/built-in/authorization/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAE3D,OAAO,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAMrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAOxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAEH,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAEjC,MAAM,OAAO,CAAC;AAOf,OAAO,KAAK,EACR,yBAAyB,EACzB,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EAClB,MAAM,8BAA8B,CAAC;AAYtC,OAAO,KAAK,EAAE,kCAAkC,EAAE,kCAAkC,EAAE,MAAM,YAAY,CAAC;AAIzG,qBAAa,uBAAuB;IAChC,SAAS,CAAC,OAAO,EAAE,kCAAkC,CAAC;IAItD,SAAS,CAAC,mBAAmB,EAAE,oBAAoB,CAAC;IAEpD,SAAS,CAAC,mBAAmB,EAAE,oBAAoB,CAAC;IAIpD,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,cAAc,EAAG,eAAe,CAAC;IAI3C,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAElE,SAAS,CAAC,iBAAiB,EAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;gBAIlD,GAAG,EAAE,kCAAkC;IAqB7C,GAAG,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;cAmB1B,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IA2BzD;;OAEG;cACa,+BAA+B,CAC3C,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,yBAAyB;cAgErB,wBAAwB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAyBtG;;;;;;;;;OASG;cACa,oBAAoB,CAChC,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,kBAAkB;cAsDf,8BAA8B,CAC1C,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,wBAAwB;CA+BvC"}

package/dist/adapters/http/middleware/built-in/authorization/module.mjs

@@ -21,6 +21,7 @@ import { AuthHeaderError } from "@authup/errors";
 import { JWTError, OAuth2SubKind, OAuth2TokenKind, deserializeOAuth2Scope } from "@authup/specs";
 import { AuthorizationHeaderType, parseAuthorizationHeader } from "hapic";
 //#region src/adapters/http/middleware/built-in/authorization/module.ts
+const runSymbol = Symbol("RAuthorizationMiddlewareRun");
 var AuthorizationMiddleware = class {
 	options;
 	oauth2TokenVerifier;
@@ -44,6 +45,13 @@ var AuthorizationMiddleware = class {
 		});
 	}
 	async run(event) {
+		const pending = event.store[runSymbol];
+		if (pending) return pending;
+		const promise = this.runInner(event);
+		event.store[runSymbol] = promise;
+		return promise;
+	}
+	async runInner(event) {
 		setRequestPermissionEvaluator(event, new RequestPermissionEvaluator(event, this.permissionEvaluator));
 		const headerValue = event.headers.get("authorization");
 		if (!headerValue) return;

package/dist/adapters/http/middleware/built-in/authorization/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["PermissionEvaluator","IdentityType","ScopeName","AuthHeaderError","JWTError","OAuth2SubKind","OAuth2TokenKind","deserializeOAuth2Scope","AuthorizationHeaderType","parseAuthorizationHeader","ClientAuthenticator","PolicyEngine","UserAuthenticator","assertClientCertificateEvidenceValidForBinding","RequestIdentity","RequestPermissionEvaluator","extractClientCertificateEvidence","setRequestIdentity","setRequestMfaLoginTicket","setRequestPermissionEvaluator","setRequestScopes","setRequestSessionId","setRequestToken","AuthorizationMiddleware","options","oauth2TokenVerifier","permissionEvaluator","identityResolver","sessionManager","clientAuthenticator","userAuthenticator","ctx","provider","permissionProvider","policyEngine","identityPermissionProvider","realmId","clientId","run","event","requestAccessContext","headerValue","headers","get","header","type","BEARER","verifyBearerAuthorizationHeader","BASIC","verifyBasicAuthorizationHeader","unsupportedType","payload","verify","token","verifyCertificateBinding","kind","MFA","verifyMfaLoginTicket","ACCESS","payloadPropertyInvalid","realm_id","scope","session_id","session","findOneById","expired","ping","sub_kind","sub","identity","resolve","cnf","expectedThumbprint","length","invalid","evidence","certificateSource","thumbprint","USER","subKind","clientAuthBasic","authenticator","safeAuthenticate","username","password","success","GLOBAL","CLIENT","data","userAuthBasic","authenticated"],"sources":["../../../../../../src/adapters/http/middleware/built-in/authorization/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IPermissionEvaluator } from '@authup/access';\nimport { PermissionEvaluator } from '@authup/access';\nimport type { Client, User } from '@authup/core-kit';\nimport {\n    IdentityType,\n    ScopeName,\n} from '@authup/core-kit';\nimport { AuthHeaderError } from '@authup/errors';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport {\n    JWTError,\n    OAuth2SubKind,\n    OAuth2TokenKind,\n    deserializeOAuth2Scope,\n} from '@authup/specs';\nimport type { IAppEvent } from 'routup';\nimport {\n    AuthorizationHeaderType,\n    type BasicAuthorizationHeader,\n    type BearerAuthorizationHeader,\n    parseAuthorizationHeader,\n} from 'hapic';\nimport {\n    ClientAuthenticator,\n    PolicyEngine,\n    UserAuthenticator,\n    assertClientCertificateEvidenceValidForBinding,\n} from '../../../../../core/index.ts';\nimport type {\n    ICredentialsAuthenticator,\n    IIdentityResolver,\n    IOAuth2TokenVerifier,\n    ISessionManager,\n} from '../../../../../core/index.ts';\nimport {\n    RequestIdentity,\n    RequestPermissionEvaluator,\n    extractClientCertificateEvidence,\n    setRequestIdentity,\n    setRequestMfaLoginTicket,\n    setRequestPermissionEvaluator,\n    setRequestScopes,\n    setRequestSessionId,\n    setRequestToken,\n} from '../../../request/index.ts';\nimport type { HTTPAuthorizationMiddlewareContext, HTTPAuthorizationMiddlewareOptions } from './types.ts';\n\nexport class AuthorizationMiddleware {\n    protected options: HTTPAuthorizationMiddlewareOptions;\n\n    // --------------------------------------\n\n    protected oauth2TokenVerifier: IOAuth2TokenVerifier;\n\n    protected permissionEvaluator: IPermissionEvaluator;\n\n    // --------------------------------------\n\n    protected identityResolver: IIdentityResolver;\n\n    protected sessionManager : ISessionManager;\n\n    // --------------------------------------\n\n    protected clientAuthenticator : ICredentialsAuthenticator<Client>;\n\n    protected userAuthenticator : ICredentialsAuthenticator<User>;\n\n    // --------------------------------------\n\n    constructor(ctx: HTTPAuthorizationMiddlewareContext) {\n        this.options = ctx.options || {};\n\n        this.identityResolver = ctx.identityResolver;\n        this.sessionManager = ctx.sessionManager;\n\n        this.clientAuthenticator = new ClientAuthenticator(ctx.identityResolver);\n        this.userAuthenticator = new UserAuthenticator(ctx.identityResolver);\n\n        this.oauth2TokenVerifier = ctx.oauth2TokenVerifier;\n\n        this.permissionEvaluator = new PermissionEvaluator({\n            provider: ctx.permissionProvider,\n            policyEngine: new PolicyEngine(ctx.identityPermissionProvider),\n            realmId: null,\n            clientId: null,\n        });\n    }\n\n    // --------------------------------------\n\n    async run(event: IAppEvent) {\n        const requestAccessContext = new RequestPermissionEvaluator(\n            event,\n            this.permissionEvaluator,\n        );\n        setRequestPermissionEvaluator(event, requestAccessContext);\n\n        const headerValue = event.headers.get('authorization');\n        if (!headerValue) {\n            return;\n        }\n\n        const header = parseAuthorizationHeader(headerValue);\n\n        if (header.type === AuthorizationHeaderType.BEARER) {\n            await this.verifyBearerAuthorizationHeader(event, header);\n            return;\n        }\n\n        if (header.type === AuthorizationHeaderType.BASIC) {\n            await this.verifyBasicAuthorizationHeader(event, header);\n            return;\n        }\n\n        throw AuthHeaderError.unsupportedType(header.type);\n    }\n\n    /**\n     * @throws JWTError\n     */\n    protected async verifyBearerAuthorizationHeader(\n        event: IAppEvent,\n        header: BearerAuthorizationHeader,\n    ) {\n        const payload = await this.oauth2TokenVerifier.verify(header.token);\n        await this.verifyCertificateBinding(event, payload);\n        if (payload.kind === OAuth2TokenKind.MFA) {\n            await this.verifyMfaLoginTicket(event, payload);\n            return;\n        }\n\n        if (payload.kind !== OAuth2TokenKind.ACCESS) {\n            throw JWTError.payloadPropertyInvalid('kind');\n        }\n\n        if (!payload.realm_id) {\n            throw JWTError.payloadPropertyInvalid('realm_id');\n        }\n\n        setRequestToken(event, header.token);\n\n        if (payload.scope) {\n            setRequestScopes(event, deserializeOAuth2Scope(payload.scope));\n        }\n\n        // -------------------------------------------------------\n\n        if (!payload.session_id) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        const session = await this.sessionManager.findOneById(payload.session_id);\n        if (!session) {\n            throw JWTError.expired();\n        }\n\n        try {\n            await this.sessionManager.verify(session);\n        } catch {\n            throw JWTError.expired();\n        }\n\n        await this.sessionManager.ping(session);\n\n        setRequestSessionId(event, payload.session_id);\n\n        // -------------------------------------------------------\n\n        if (!payload.sub_kind) {\n            throw JWTError.payloadPropertyInvalid('sub_kind');\n        }\n\n        if (!payload.sub) {\n            throw JWTError.payloadPropertyInvalid('sub');\n        }\n\n        const identity = await this.identityResolver.resolve(\n            payload.sub_kind,\n            payload.sub,\n        );\n\n        if (identity) {\n            setRequestIdentity(event, identity);\n        }\n    }\n\n    protected async verifyCertificateBinding(event: IAppEvent, payload: OAuth2TokenPayload): Promise<void> {\n        if (!payload.cnf) {\n            return;\n        }\n\n        const expectedThumbprint = payload.cnf['x5t#S256'];\n        if (typeof expectedThumbprint !== 'string' || expectedThumbprint.length === 0) {\n            throw JWTError.invalid();\n        }\n\n        try {\n            const evidence = await extractClientCertificateEvidence(\n                event,\n                this.options.certificateSource ?? 'disabled',\n            );\n            if (!evidence || evidence.thumbprint !== expectedThumbprint) {\n                throw JWTError.invalid();\n            }\n\n            assertClientCertificateEvidenceValidForBinding(evidence);\n        } catch {\n            throw JWTError.invalid();\n        }\n    }\n\n    /**\n     * An \"MFA-pending\" login ticket (issue #3242). Verified with the same\n     * rigor as an access token (session existence + subject match), but\n     * stashed on a DEDICATED request slot — the main identity / scope /\n     * session slots stay empty, so every identity-gated route rejects a\n     * ticket bearer (default-deny); only the challenge routes opt in via\n     * useRequestMfaLoginTicket.\n     *\n     * @throws JWTError\n     */\n    protected async verifyMfaLoginTicket(\n        event: IAppEvent,\n        payload: OAuth2TokenPayload,\n    ) {\n        if (payload.sub_kind !== OAuth2SubKind.USER) {\n            throw JWTError.payloadPropertyInvalid('sub_kind');\n        }\n\n        if (!payload.sub) {\n            throw JWTError.payloadPropertyInvalid('sub');\n        }\n\n        if (!payload.realm_id) {\n            throw JWTError.payloadPropertyInvalid('realm_id');\n        }\n\n        if (!payload.session_id) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        const session = await this.sessionManager.findOneById(payload.session_id);\n        if (!session) {\n            throw JWTError.expired();\n        }\n\n        try {\n            await this.sessionManager.verify(session);\n        } catch {\n            throw JWTError.expired();\n        }\n\n        // defense in depth — the pending session must still belong to the\n        // ticket subject.\n        if (\n            session.sub !== payload.sub ||\n            session.subKind !== IdentityType.USER\n        ) {\n            throw JWTError.expired();\n        }\n\n        await this.sessionManager.ping(session);\n\n        const identity = await this.identityResolver.resolve(\n            payload.sub_kind,\n            payload.sub,\n        );\n        if (!identity) {\n            throw JWTError.expired();\n        }\n\n        setRequestMfaLoginTicket(event, {\n            identity: new RequestIdentity(identity),\n            payload,\n        });\n    }\n\n    protected async verifyBasicAuthorizationHeader(\n        event: IAppEvent,\n        header: BasicAuthorizationHeader,\n    ) {\n        if (this.options.clientAuthBasic) {\n            const authenticator = await this.clientAuthenticator.safeAuthenticate(\n                header.username,\n                header.password,\n            );\n            if (authenticator.success) {\n                setRequestScopes(event, [ScopeName.GLOBAL]);\n                setRequestIdentity(event, {\n                    type: IdentityType.CLIENT,\n                    data: authenticator.data,\n                });\n            }\n        }\n\n        if (this.options.userAuthBasic) {\n            const authenticated = await this.userAuthenticator.safeAuthenticate(\n                header.username,\n                header.password,\n            );\n\n            if (authenticated.success) {\n                setRequestScopes(event, [ScopeName.GLOBAL]);\n                setRequestIdentity(event, {\n                    type: IdentityType.USER,\n                    data: authenticated.data,\n                });\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAsDA,IAAauB,0BAAb,MAAaA;CACCC;CAIAC;CAEAC;CAIAC;CAEAC;CAIAC;CAEAC;CAIV,YAAYC,KAAyC;EACjD,KAAKP,UAAUO,IAAIP,WAAW,CAAC;EAE/B,KAAKG,mBAAmBI,IAAIJ;EAC5B,KAAKC,iBAAiBG,IAAIH;EAE1B,KAAKC,sBAAsB,IAAInB,oBAAoBqB,IAAIJ,gBAAgB;EACvE,KAAKG,oBAAoB,IAAIlB,kBAAkBmB,IAAIJ,gBAAgB;EAEnE,KAAKF,sBAAsBM,IAAIN;EAE/B,KAAKC,sBAAsB,IAAI1B,oBAAoB;GAC/CgC,UAAUD,IAAIE;GACdC,cAAc,IAAIvB,eAAaoB,IAAII,0BAA0B;GAC7DC,SAAS;GACTC,UAAU;EACd,CAAA;CACJ;CAIA,MAAMC,IAAIC,OAAkB;EAKxBpB,8BAA8BoB,OAAOC,IAJJzB,2BAC7BwB,OACA,KAAKb,mBAE4Bc,CAAAA;EAErC,MAAMC,cAAcF,MAAMG,QAAQC,IAAI,eAAA;EACtC,IAAI,CAACF,aACD;EAGJ,MAAMG,SAASnC,yBAAyBgC,WAAAA;EAExC,IAAIG,OAAOC,SAASrC,wBAAwBsC,QAAQ;GAChD,MAAM,KAAKC,gCAAgCR,OAAOK,MAAAA;GAClD;EACJ;EAEA,IAAIA,OAAOC,SAASrC,wBAAwBwC,OAAO;GAC/C,MAAM,KAAKC,+BAA+BV,OAAOK,MAAAA;GACjD;EACJ;EAEA,MAAMzC,gBAAgB+C,gBAAgBN,OAAOC,IAAI;CACrD;;;IAKA,MAAgBE,gCACZR,OACAK,QACF;EACE,MAAMO,UAAU,MAAM,KAAK1B,oBAAoB2B,OAAOR,OAAOS,KAAK;EAClE,MAAM,KAAKC,yBAAyBf,OAAOY,OAAAA;EAC3C,IAAIA,QAAQI,SAASjD,gBAAgBkD,KAAK;GACtC,MAAM,KAAKC,qBAAqBlB,OAAOY,OAAAA;GACvC;EACJ;EAEA,IAAIA,QAAQI,SAASjD,gBAAgBoD,QACjC,MAAMtD,SAASuD,uBAAuB,MAAA;EAG1C,IAAI,CAACR,QAAQS,UACT,MAAMxD,SAASuD,uBAAuB,UAAA;EAG1CrC,gBAAgBiB,OAAOK,OAAOS,KAAK;EAEnC,IAAIF,QAAQU,OACRzC,iBAAiBmB,OAAOhC,uBAAuB4C,QAAQU,KAAK,CAAA;EAKhE,IAAI,CAACV,QAAQW,YACT,MAAM1D,SAASuD,uBAAuB,YAAA;EAG1C,MAAMI,UAAU,MAAM,KAAKnC,eAAeoC,YAAYb,QAAQW,UAAU;EACxE,IAAI,CAACC,SACD,MAAM3D,SAAS6D,QAAO;EAG1B,IAAI;GACA,MAAM,KAAKrC,eAAewB,OAAOW,OAAAA;EACrC,QAAQ;GACJ,MAAM3D,SAAS6D,QAAO;EAC1B;EAEA,MAAM,KAAKrC,eAAesC,KAAKH,OAAAA;EAE/B1C,oBAAoBkB,OAAOY,QAAQW,UAAU;EAI7C,IAAI,CAACX,QAAQgB,UACT,MAAM/D,SAASuD,uBAAuB,UAAA;EAG1C,IAAI,CAACR,QAAQiB,KACT,MAAMhE,SAASuD,uBAAuB,KAAA;EAG1C,MAAMU,WAAW,MAAM,KAAK1C,iBAAiB2C,QACzCnB,QAAQgB,UACRhB,QAAQiB,GAAG;EAGf,IAAIC,UACApD,mBAAmBsB,OAAO8B,QAAAA;CAElC;CAEA,MAAgBf,yBAAyBf,OAAkBY,SAA4C;EACnG,IAAI,CAACA,QAAQoB,KACT;EAGJ,MAAMC,qBAAqBrB,QAAQoB,IAAI;EACvC,IAAI,OAAOC,uBAAuB,YAAYA,mBAAmBC,WAAW,GACxE,MAAMrE,SAASsE,QAAO;EAG1B,IAAI;GACA,MAAMC,WAAW,MAAM3D,iCACnBuB,OACA,KAAKf,QAAQoD,qBAAqB,UAAA;GAEtC,IAAI,CAACD,YAAYA,SAASE,eAAeL,oBACrC,MAAMpE,SAASsE,QAAO;GAG1B7D,+CAA+C8D,QAAAA;EACnD,QAAQ;GACJ,MAAMvE,SAASsE,QAAO;EAC1B;CACJ;;;;;;;;;;IAYA,MAAgBjB,qBACZlB,OACAY,SACF;EACE,IAAIA,QAAQgB,aAAa9D,cAAcyE,MACnC,MAAM1E,SAASuD,uBAAuB,UAAA;EAG1C,IAAI,CAACR,QAAQiB,KACT,MAAMhE,SAASuD,uBAAuB,KAAA;EAG1C,IAAI,CAACR,QAAQS,UACT,MAAMxD,SAASuD,uBAAuB,UAAA;EAG1C,IAAI,CAACR,QAAQW,YACT,MAAM1D,SAASuD,uBAAuB,YAAA;EAG1C,MAAMI,UAAU,MAAM,KAAKnC,eAAeoC,YAAYb,QAAQW,UAAU;EACxE,IAAI,CAACC,SACD,MAAM3D,SAAS6D,QAAO;EAG1B,IAAI;GACA,MAAM,KAAKrC,eAAewB,OAAOW,OAAAA;EACrC,QAAQ;GACJ,MAAM3D,SAAS6D,QAAO;EAC1B;EAIA,IACIF,QAAQK,QAAQjB,QAAQiB,OACxBL,QAAQgB,YAAY9E,aAAa6E,MAEjC,MAAM1E,SAAS6D,QAAO;EAG1B,MAAM,KAAKrC,eAAesC,KAAKH,OAAAA;EAE/B,MAAMM,WAAW,MAAM,KAAK1C,iBAAiB2C,QACzCnB,QAAQgB,UACRhB,QAAQiB,GAAG;EAEf,IAAI,CAACC,UACD,MAAMjE,SAAS6D,QAAO;EAG1B/C,yBAAyBqB,OAAO;GAC5B8B,UAAU,IAAIvD,gBAAgBuD,QAAAA;GAC9BlB;EACJ,CAAA;CACJ;CAEA,MAAgBF,+BACZV,OACAK,QACF;EACE,IAAI,KAAKpB,QAAQwD,iBAAiB;GAC9B,MAAMC,gBAAgB,MAAM,KAAKpD,oBAAoBqD,iBACjDtC,OAAOuC,UACPvC,OAAOwC,QAAQ;GAEnB,IAAIH,cAAcI,SAAS;IACvBjE,iBAAiBmB,OAAO,CAACrC,UAAUoF,MAAO,CAAA;IAC1CrE,mBAAmBsB,OAAO;KACtBM,MAAM5C,aAAasF;KACnBC,MAAMP,cAAcO;IACxB,CAAA;GACJ;EACJ;EAEA,IAAI,KAAKhE,QAAQiE,eAAe;GAC5B,MAAMC,gBAAgB,MAAM,KAAK5D,kBAAkBoD,iBAC/CtC,OAAOuC,UACPvC,OAAOwC,QAAQ;GAGnB,IAAIM,cAAcL,SAAS;IACvBjE,iBAAiBmB,OAAO,CAACrC,UAAUoF,MAAO,CAAA;IAC1CrE,mBAAmBsB,OAAO;KACtBM,MAAM5C,aAAa6E;KACnBU,MAAME,cAAcF;IACxB,CAAA;GACJ;EACJ;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["PermissionEvaluator","IdentityType","ScopeName","AuthHeaderError","JWTError","OAuth2SubKind","OAuth2TokenKind","deserializeOAuth2Scope","AuthorizationHeaderType","parseAuthorizationHeader","ClientAuthenticator","PolicyEngine","UserAuthenticator","assertClientCertificateEvidenceValidForBinding","RequestIdentity","RequestPermissionEvaluator","extractClientCertificateEvidence","setRequestIdentity","setRequestMfaLoginTicket","setRequestPermissionEvaluator","setRequestScopes","setRequestSessionId","setRequestToken","runSymbol","Symbol","AuthorizationMiddleware","options","oauth2TokenVerifier","permissionEvaluator","identityResolver","sessionManager","clientAuthenticator","userAuthenticator","ctx","provider","permissionProvider","policyEngine","identityPermissionProvider","realmId","clientId","run","event","pending","store","promise","runInner","requestAccessContext","headerValue","headers","get","header","type","BEARER","verifyBearerAuthorizationHeader","BASIC","verifyBasicAuthorizationHeader","unsupportedType","payload","verify","token","verifyCertificateBinding","kind","MFA","verifyMfaLoginTicket","ACCESS","payloadPropertyInvalid","realm_id","scope","session_id","session","findOneById","expired","ping","sub_kind","sub","identity","resolve","cnf","expectedThumbprint","length","invalid","evidence","certificateSource","thumbprint","USER","subKind","clientAuthBasic","authenticator","safeAuthenticate","username","password","success","GLOBAL","CLIENT","data","userAuthBasic","authenticated"],"sources":["../../../../../../src/adapters/http/middleware/built-in/authorization/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IPermissionEvaluator } from '@authup/access';\nimport { PermissionEvaluator } from '@authup/access';\nimport type { Client, User } from '@authup/core-kit';\nimport {\n    IdentityType,\n    ScopeName,\n} from '@authup/core-kit';\nimport { AuthHeaderError } from '@authup/errors';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport {\n    JWTError,\n    OAuth2SubKind,\n    OAuth2TokenKind,\n    deserializeOAuth2Scope,\n} from '@authup/specs';\nimport type { IAppEvent } from 'routup';\nimport {\n    AuthorizationHeaderType,\n    type BasicAuthorizationHeader,\n    type BearerAuthorizationHeader,\n    parseAuthorizationHeader,\n} from 'hapic';\nimport {\n    ClientAuthenticator,\n    PolicyEngine,\n    UserAuthenticator,\n    assertClientCertificateEvidenceValidForBinding,\n} from '../../../../../core/index.ts';\nimport type {\n    ICredentialsAuthenticator,\n    IIdentityResolver,\n    IOAuth2TokenVerifier,\n    ISessionManager,\n} from '../../../../../core/index.ts';\nimport {\n    RequestIdentity,\n    RequestPermissionEvaluator,\n    extractClientCertificateEvidence,\n    setRequestIdentity,\n    setRequestMfaLoginTicket,\n    setRequestPermissionEvaluator,\n    setRequestScopes,\n    setRequestSessionId,\n    setRequestToken,\n} from '../../../request/index.ts';\nimport type { HTTPAuthorizationMiddlewareContext, HTTPAuthorizationMiddlewareOptions } from './types.ts';\n\nconst runSymbol = Symbol('RAuthorizationMiddlewareRun');\n\nexport class AuthorizationMiddleware {\n    protected options: HTTPAuthorizationMiddlewareOptions;\n\n    // --------------------------------------\n\n    protected oauth2TokenVerifier: IOAuth2TokenVerifier;\n\n    protected permissionEvaluator: IPermissionEvaluator;\n\n    // --------------------------------------\n\n    protected identityResolver: IIdentityResolver;\n\n    protected sessionManager : ISessionManager;\n\n    // --------------------------------------\n\n    protected clientAuthenticator : ICredentialsAuthenticator<Client>;\n\n    protected userAuthenticator : ICredentialsAuthenticator<User>;\n\n    // --------------------------------------\n\n    constructor(ctx: HTTPAuthorizationMiddlewareContext) {\n        this.options = ctx.options || {};\n\n        this.identityResolver = ctx.identityResolver;\n        this.sessionManager = ctx.sessionManager;\n\n        this.clientAuthenticator = new ClientAuthenticator(ctx.identityResolver);\n        this.userAuthenticator = new UserAuthenticator(ctx.identityResolver);\n\n        this.oauth2TokenVerifier = ctx.oauth2TokenVerifier;\n\n        this.permissionEvaluator = new PermissionEvaluator({\n            provider: ctx.permissionProvider,\n            policyEngine: new PolicyEngine(ctx.identityPermissionProvider),\n            realmId: null,\n            clientId: null,\n        });\n    }\n\n    // --------------------------------------\n\n    async run(event: IAppEvent): Promise<void> {\n        // routup's dispatch walk re-enters earlier middlewares once per\n        // remaining match when no handler produces a response — exponentially\n        // (routup/routup#946), so an unmatched authenticated request re-ran\n        // this middleware ~100+ times, re-verifying Basic credentials (bcrypt)\n        // on every re-entry (~4s per 404). Authorization is a pure function of\n        // the request: the first run's settlement — including a rejection —\n        // is authoritative, so memoize the promise on the request store (the\n        // store is shared by every re-entry of the same request).\n        const pending = event.store[runSymbol] as Promise<void> | undefined;\n        if (pending) {\n            return pending;\n        }\n\n        const promise = this.runInner(event);\n        event.store[runSymbol] = promise;\n        return promise;\n    }\n\n    protected async runInner(event: IAppEvent): Promise<void> {\n        const requestAccessContext = new RequestPermissionEvaluator(\n            event,\n            this.permissionEvaluator,\n        );\n        setRequestPermissionEvaluator(event, requestAccessContext);\n\n        const headerValue = event.headers.get('authorization');\n        if (!headerValue) {\n            return;\n        }\n\n        const header = parseAuthorizationHeader(headerValue);\n\n        if (header.type === AuthorizationHeaderType.BEARER) {\n            await this.verifyBearerAuthorizationHeader(event, header);\n            return;\n        }\n\n        if (header.type === AuthorizationHeaderType.BASIC) {\n            await this.verifyBasicAuthorizationHeader(event, header);\n            return;\n        }\n\n        throw AuthHeaderError.unsupportedType(header.type);\n    }\n\n    /**\n     * @throws JWTError\n     */\n    protected async verifyBearerAuthorizationHeader(\n        event: IAppEvent,\n        header: BearerAuthorizationHeader,\n    ) {\n        const payload = await this.oauth2TokenVerifier.verify(header.token);\n        await this.verifyCertificateBinding(event, payload);\n        if (payload.kind === OAuth2TokenKind.MFA) {\n            await this.verifyMfaLoginTicket(event, payload);\n            return;\n        }\n\n        if (payload.kind !== OAuth2TokenKind.ACCESS) {\n            throw JWTError.payloadPropertyInvalid('kind');\n        }\n\n        if (!payload.realm_id) {\n            throw JWTError.payloadPropertyInvalid('realm_id');\n        }\n\n        setRequestToken(event, header.token);\n\n        if (payload.scope) {\n            setRequestScopes(event, deserializeOAuth2Scope(payload.scope));\n        }\n\n        // -------------------------------------------------------\n\n        if (!payload.session_id) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        const session = await this.sessionManager.findOneById(payload.session_id);\n        if (!session) {\n            throw JWTError.expired();\n        }\n\n        try {\n            await this.sessionManager.verify(session);\n        } catch {\n            throw JWTError.expired();\n        }\n\n        await this.sessionManager.ping(session);\n\n        setRequestSessionId(event, payload.session_id);\n\n        // -------------------------------------------------------\n\n        if (!payload.sub_kind) {\n            throw JWTError.payloadPropertyInvalid('sub_kind');\n        }\n\n        if (!payload.sub) {\n            throw JWTError.payloadPropertyInvalid('sub');\n        }\n\n        const identity = await this.identityResolver.resolve(\n            payload.sub_kind,\n            payload.sub,\n        );\n\n        if (identity) {\n            setRequestIdentity(event, identity);\n        }\n    }\n\n    protected async verifyCertificateBinding(event: IAppEvent, payload: OAuth2TokenPayload): Promise<void> {\n        if (!payload.cnf) {\n            return;\n        }\n\n        const expectedThumbprint = payload.cnf['x5t#S256'];\n        if (typeof expectedThumbprint !== 'string' || expectedThumbprint.length === 0) {\n            throw JWTError.invalid();\n        }\n\n        try {\n            const evidence = await extractClientCertificateEvidence(\n                event,\n                this.options.certificateSource ?? 'disabled',\n            );\n            if (!evidence || evidence.thumbprint !== expectedThumbprint) {\n                throw JWTError.invalid();\n            }\n\n            assertClientCertificateEvidenceValidForBinding(evidence);\n        } catch {\n            throw JWTError.invalid();\n        }\n    }\n\n    /**\n     * An \"MFA-pending\" login ticket (issue #3242). Verified with the same\n     * rigor as an access token (session existence + subject match), but\n     * stashed on a DEDICATED request slot — the main identity / scope /\n     * session slots stay empty, so every identity-gated route rejects a\n     * ticket bearer (default-deny); only the challenge routes opt in via\n     * useRequestMfaLoginTicket.\n     *\n     * @throws JWTError\n     */\n    protected async verifyMfaLoginTicket(\n        event: IAppEvent,\n        payload: OAuth2TokenPayload,\n    ) {\n        if (payload.sub_kind !== OAuth2SubKind.USER) {\n            throw JWTError.payloadPropertyInvalid('sub_kind');\n        }\n\n        if (!payload.sub) {\n            throw JWTError.payloadPropertyInvalid('sub');\n        }\n\n        if (!payload.realm_id) {\n            throw JWTError.payloadPropertyInvalid('realm_id');\n        }\n\n        if (!payload.session_id) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        const session = await this.sessionManager.findOneById(payload.session_id);\n        if (!session) {\n            throw JWTError.expired();\n        }\n\n        try {\n            await this.sessionManager.verify(session);\n        } catch {\n            throw JWTError.expired();\n        }\n\n        // defense in depth — the pending session must still belong to the\n        // ticket subject.\n        if (\n            session.sub !== payload.sub ||\n            session.subKind !== IdentityType.USER\n        ) {\n            throw JWTError.expired();\n        }\n\n        await this.sessionManager.ping(session);\n\n        const identity = await this.identityResolver.resolve(\n            payload.sub_kind,\n            payload.sub,\n        );\n        if (!identity) {\n            throw JWTError.expired();\n        }\n\n        setRequestMfaLoginTicket(event, {\n            identity: new RequestIdentity(identity),\n            payload,\n        });\n    }\n\n    protected async verifyBasicAuthorizationHeader(\n        event: IAppEvent,\n        header: BasicAuthorizationHeader,\n    ) {\n        if (this.options.clientAuthBasic) {\n            const authenticator = await this.clientAuthenticator.safeAuthenticate(\n                header.username,\n                header.password,\n            );\n            if (authenticator.success) {\n                setRequestScopes(event, [ScopeName.GLOBAL]);\n                setRequestIdentity(event, {\n                    type: IdentityType.CLIENT,\n                    data: authenticator.data,\n                });\n            }\n        }\n\n        if (this.options.userAuthBasic) {\n            const authenticated = await this.userAuthenticator.safeAuthenticate(\n                header.username,\n                header.password,\n            );\n\n            if (authenticated.success) {\n                setRequestScopes(event, [ScopeName.GLOBAL]);\n                setRequestIdentity(event, {\n                    type: IdentityType.USER,\n                    data: authenticated.data,\n                });\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAsDA,MAAMuB,YAAYC,OAAO,6BAAA;AAEzB,IAAaC,0BAAb,MAAaA;CACCC;CAIAC;CAEAC;CAIAC;CAEAC;CAIAC;CAEAC;CAIV,YAAYC,KAAyC;EACjD,KAAKP,UAAUO,IAAIP,WAAW,CAAC;EAE/B,KAAKG,mBAAmBI,IAAIJ;EAC5B,KAAKC,iBAAiBG,IAAIH;EAE1B,KAAKC,sBAAsB,IAAIrB,oBAAoBuB,IAAIJ,gBAAgB;EACvE,KAAKG,oBAAoB,IAAIpB,kBAAkBqB,IAAIJ,gBAAgB;EAEnE,KAAKF,sBAAsBM,IAAIN;EAE/B,KAAKC,sBAAsB,IAAI5B,oBAAoB;GAC/CkC,UAAUD,IAAIE;GACdC,cAAc,IAAIzB,eAAasB,IAAII,0BAA0B;GAC7DC,SAAS;GACTC,UAAU;EACd,CAAA;CACJ;CAIA,MAAMC,IAAIC,OAAiC;EASvC,MAAMC,UAAUD,MAAME,MAAMpB;EAC5B,IAAImB,SACA,OAAOA;EAGX,MAAME,UAAU,KAAKC,SAASJ,KAAAA;EAC9BA,MAAME,MAAMpB,aAAaqB;EACzB,OAAOA;CACX;CAEA,MAAgBC,SAASJ,OAAiC;EAKtDtB,8BAA8BsB,OAAOK,IAJJ/B,2BAC7B0B,OACA,KAAKb,mBAE4BkB,CAAAA;EAErC,MAAMC,cAAcN,MAAMO,QAAQC,IAAI,eAAA;EACtC,IAAI,CAACF,aACD;EAGJ,MAAMG,SAASzC,yBAAyBsC,WAAAA;EAExC,IAAIG,OAAOC,SAAS3C,wBAAwB4C,QAAQ;GAChD,MAAM,KAAKC,gCAAgCZ,OAAOS,MAAAA;GAClD;EACJ;EAEA,IAAIA,OAAOC,SAAS3C,wBAAwB8C,OAAO;GAC/C,MAAM,KAAKC,+BAA+Bd,OAAOS,MAAAA;GACjD;EACJ;EAEA,MAAM/C,gBAAgBqD,gBAAgBN,OAAOC,IAAI;CACrD;;;IAKA,MAAgBE,gCACZZ,OACAS,QACF;EACE,MAAMO,UAAU,MAAM,KAAK9B,oBAAoB+B,OAAOR,OAAOS,KAAK;EAClE,MAAM,KAAKC,yBAAyBnB,OAAOgB,OAAAA;EAC3C,IAAIA,QAAQI,SAASvD,gBAAgBwD,KAAK;GACtC,MAAM,KAAKC,qBAAqBtB,OAAOgB,OAAAA;GACvC;EACJ;EAEA,IAAIA,QAAQI,SAASvD,gBAAgB0D,QACjC,MAAM5D,SAAS6D,uBAAuB,MAAA;EAG1C,IAAI,CAACR,QAAQS,UACT,MAAM9D,SAAS6D,uBAAuB,UAAA;EAG1C3C,gBAAgBmB,OAAOS,OAAOS,KAAK;EAEnC,IAAIF,QAAQU,OACR/C,iBAAiBqB,OAAOlC,uBAAuBkD,QAAQU,KAAK,CAAA;EAKhE,IAAI,CAACV,QAAQW,YACT,MAAMhE,SAAS6D,uBAAuB,YAAA;EAG1C,MAAMI,UAAU,MAAM,KAAKvC,eAAewC,YAAYb,QAAQW,UAAU;EACxE,IAAI,CAACC,SACD,MAAMjE,SAASmE,QAAO;EAG1B,IAAI;GACA,MAAM,KAAKzC,eAAe4B,OAAOW,OAAAA;EACrC,QAAQ;GACJ,MAAMjE,SAASmE,QAAO;EAC1B;EAEA,MAAM,KAAKzC,eAAe0C,KAAKH,OAAAA;EAE/BhD,oBAAoBoB,OAAOgB,QAAQW,UAAU;EAI7C,IAAI,CAACX,QAAQgB,UACT,MAAMrE,SAAS6D,uBAAuB,UAAA;EAG1C,IAAI,CAACR,QAAQiB,KACT,MAAMtE,SAAS6D,uBAAuB,KAAA;EAG1C,MAAMU,WAAW,MAAM,KAAK9C,iBAAiB+C,QACzCnB,QAAQgB,UACRhB,QAAQiB,GAAG;EAGf,IAAIC,UACA1D,mBAAmBwB,OAAOkC,QAAAA;CAElC;CAEA,MAAgBf,yBAAyBnB,OAAkBgB,SAA4C;EACnG,IAAI,CAACA,QAAQoB,KACT;EAGJ,MAAMC,qBAAqBrB,QAAQoB,IAAI;EACvC,IAAI,OAAOC,uBAAuB,YAAYA,mBAAmBC,WAAW,GACxE,MAAM3E,SAAS4E,QAAO;EAG1B,IAAI;GACA,MAAMC,WAAW,MAAMjE,iCACnByB,OACA,KAAKf,QAAQwD,qBAAqB,UAAA;GAEtC,IAAI,CAACD,YAAYA,SAASE,eAAeL,oBACrC,MAAM1E,SAAS4E,QAAO;GAG1BnE,+CAA+CoE,QAAAA;EACnD,QAAQ;GACJ,MAAM7E,SAAS4E,QAAO;EAC1B;CACJ;;;;;;;;;;IAYA,MAAgBjB,qBACZtB,OACAgB,SACF;EACE,IAAIA,QAAQgB,aAAapE,cAAc+E,MACnC,MAAMhF,SAAS6D,uBAAuB,UAAA;EAG1C,IAAI,CAACR,QAAQiB,KACT,MAAMtE,SAAS6D,uBAAuB,KAAA;EAG1C,IAAI,CAACR,QAAQS,UACT,MAAM9D,SAAS6D,uBAAuB,UAAA;EAG1C,IAAI,CAACR,QAAQW,YACT,MAAMhE,SAAS6D,uBAAuB,YAAA;EAG1C,MAAMI,UAAU,MAAM,KAAKvC,eAAewC,YAAYb,QAAQW,UAAU;EACxE,IAAI,CAACC,SACD,MAAMjE,SAASmE,QAAO;EAG1B,IAAI;GACA,MAAM,KAAKzC,eAAe4B,OAAOW,OAAAA;EACrC,QAAQ;GACJ,MAAMjE,SAASmE,QAAO;EAC1B;EAIA,IACIF,QAAQK,QAAQjB,QAAQiB,OACxBL,QAAQgB,YAAYpF,aAAamF,MAEjC,MAAMhF,SAASmE,QAAO;EAG1B,MAAM,KAAKzC,eAAe0C,KAAKH,OAAAA;EAE/B,MAAMM,WAAW,MAAM,KAAK9C,iBAAiB+C,QACzCnB,QAAQgB,UACRhB,QAAQiB,GAAG;EAEf,IAAI,CAACC,UACD,MAAMvE,SAASmE,QAAO;EAG1BrD,yBAAyBuB,OAAO;GAC5BkC,UAAU,IAAI7D,gBAAgB6D,QAAAA;GAC9BlB;EACJ,CAAA;CACJ;CAEA,MAAgBF,+BACZd,OACAS,QACF;EACE,IAAI,KAAKxB,QAAQ4D,iBAAiB;GAC9B,MAAMC,gBAAgB,MAAM,KAAKxD,oBAAoByD,iBACjDtC,OAAOuC,UACPvC,OAAOwC,QAAQ;GAEnB,IAAIH,cAAcI,SAAS;IACvBvE,iBAAiBqB,OAAO,CAACvC,UAAU0F,MAAO,CAAA;IAC1C3E,mBAAmBwB,OAAO;KACtBU,MAAMlD,aAAa4F;KACnBC,MAAMP,cAAcO;IACxB,CAAA;GACJ;EACJ;EAEA,IAAI,KAAKpE,QAAQqE,eAAe;GAC5B,MAAMC,gBAAgB,MAAM,KAAKhE,kBAAkBwD,iBAC/CtC,OAAOuC,UACPvC,OAAOwC,QAAQ;GAGnB,IAAIM,cAAcL,SAAS;IACvBvE,iBAAiBqB,OAAO,CAACvC,UAAU0F,MAAO,CAAA;IAC1C3E,mBAAmBwB,OAAO;KACtBU,MAAMlD,aAAamF;KACnBU,MAAME,cAAcF;IACxB,CAAA;GACJ;EACJ;CACJ;AACJ"}

package/dist/adapters/http/middleware/built-in/rate-limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/rate-limit.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAIlC,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,YAAY,QAwB5E"}
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/rate-limit.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAKlC,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,YAAY,QA4B5E"}

package/dist/adapters/http/middleware/built-in/rate-limit.mjs

@@ -4,10 +4,12 @@ import.meta.url;
 import { useRequestIdentity } from "../../request/helpers/identity.mjs";
 import "../../request/index.mjs";
 import { merge } from "smob";
+import { getRequestIP } from "routup";
 import { rateLimit } from "@routup/rate-limit";
 //#region src/adapters/http/middleware/built-in/rate-limit.ts
 function registerRateLimitMiddleware(router, input) {
 	let options = {
+		keyGenerator: (event) => getRequestIP(event) || "127.0.0.1",
 		max(event) {
 			const identity = useRequestIdentity(event);
 			if (!identity) return 1200;