@authup/server-core 1.0.0-beta.58 → 1.0.0-beta.60

package/dist/core/oauth2/grant-types/refresh-token.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"refresh-token.mjs","names":["JWTError","OAuth2GrantError","OAuth2TokenKind","EventName","EventRefType","EventScope","buildOAuth2BearerTokenResponse","OAuth2BaseGrant","OAuth2RefreshTokenGrant","refreshTokenIssuer","tokenVerifier","tokenRepository","sessionTokenRepository","eventService","metrics","logger","gracePeriod","ctx","accessTokenIssuer","sessionManager","options","runWith","input","payload","verify","skipActiveCheck","jti","payloadPropertyInvalid","session_id","kind","REFRESH","invalid","row","findOneById","revokedAt","sessionId","now","Date","nowISO","toISOString","consumed","markRefreshConsumed","withinGrace","isWithinGraceWindow","revokeFamily","setInactive","exp","session","userAgent","ipAddress","refresh","refreshToken","refreshTokenPayload","issue","confirmation","cnf","user_agent","remote_address","buildExp","parent_id","accessToken","accessTokenPayload","refresh_token_id","current","consumedAt","getTime","chainAdvanced","hasConsumedChild","at","warn","record","scope","OAUTH2","name","REFRESH_REPLAY_DETECTED","refType","SESSION","refId","data","recordRefreshReplay","rows","revokeBySessionId","Promise","allSettled","map","id","Math","floor","expiresAt","revoke"],"sources":["../../../../src/core/oauth2/grant-types/refresh-token.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { JWTError, OAuth2GrantError, OAuth2TokenKind } from '@authup/specs';\nimport { EventName, EventRefType, EventScope } from '@authup/core-kit';\nimport type { Logger } from '@authup/server-kit';\nimport type { IEventService } from '../../entities/index.ts';\nimport type { IAuthFlowMetrics } from '../../metrics/index.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { ISessionTokenRepository } from '../session-token/index.ts';\nimport type { IOAuth2TokenIssuer, IOAuth2TokenRepository, IOAuth2TokenVerifier } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport type { IOAuth2Grant, OAuth2GrantRunWIthOptions, OAuth2RefreshTokenGrantContext } from './types.ts';\n\nexport class OAuth2RefreshTokenGrant extends OAuth2BaseGrant<string | OAuth2TokenPayload> implements IOAuth2Grant {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    protected tokenVerifier : IOAuth2TokenVerifier;\n\n    protected tokenRepository : IOAuth2TokenRepository;\n\n    protected sessionTokenRepository : ISessionTokenRepository;\n\n    protected eventService? : IEventService;\n\n    protected metrics? : IAuthFlowMetrics;\n\n    protected logger? : Logger;\n\n    protected gracePeriod : number;\n\n    constructor(ctx: OAuth2RefreshTokenGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n        this.tokenVerifier = ctx.tokenVerifier;\n        this.tokenRepository = ctx.tokenRepository;\n        this.sessionTokenRepository = ctx.sessionTokenRepository;\n        this.eventService = ctx.eventService;\n        this.metrics = ctx.metrics;\n        this.logger = ctx.logger;\n        this.gracePeriod = ctx.options?.gracePeriod ?? 0;\n    }\n\n    async runWith(\n        input: string | OAuth2TokenPayload,\n        options: OAuth2GrantRunWIthOptions = {},\n    ) : Promise<OAuth2TokenGrantResponse> {\n        let payload : OAuth2TokenPayload;\n        if (typeof input === 'string') {\n            // The auth_session_tokens row — not the cache blocklist — is the\n            // authority for refresh-token validity, so skip the active check.\n            payload = await this.tokenVerifier.verify(input, { skipActiveCheck: true });\n        } else {\n            payload = input;\n        }\n\n        if (!payload.jti) {\n            throw JWTError.payloadPropertyInvalid('jti');\n        }\n        if (!payload.session_id) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        // Explicit kind guard (defense in depth). Authup signs access tokens\n        // and the MFA-pending login ticket with the same keys; only a refresh\n        // token may be exchanged here. The ticket is also rejected implicitly\n        // (it writes no auth_session_tokens row), but do not rely on that\n        // second-order fact alone.\n        if (payload.kind && payload.kind !== OAuth2TokenKind.REFRESH) {\n            throw OAuth2GrantError.invalid('unexpected token kind');\n        }\n\n        const row = await this.sessionTokenRepository.findOneById(payload.jti);\n        if (!row || row.kind !== 'refresh') {\n            // Row missing = expired-and-swept or a pre-rotation legacy token\n            // (hard cutover). Either way the client must re-authenticate.\n            throw OAuth2GrantError.invalid('refresh token is unknown');\n        }\n        if (row.revokedAt) {\n            throw OAuth2GrantError.invalid('refresh token has been revoked');\n        }\n        if (row.sessionId !== payload.session_id) {\n            // The row is written with the token's own session_id and jti is\n            // globally unique, so a mismatch means corruption / jti reuse — fail\n            // closed rather than refresh or revoke against the wrong session.\n            throw OAuth2GrantError.invalid('refresh token session mismatch');\n        }\n\n        const now = new Date();\n        const nowISO = now.toISOString();\n\n        const consumed = await this.sessionTokenRepository.markRefreshConsumed(payload.jti, nowISO);\n        if (!consumed) {\n            // Lost the atomic consume — either a replay of an already-rotated\n            // token, or a benign concurrent-refresh race the grace window\n            // absorbs.\n            const withinGrace = await this.isWithinGraceWindow(payload.jti, now);\n            if (!withinGrace) {\n                await this.revokeFamily(row.sessionId, payload.jti, nowISO);\n                throw OAuth2GrantError.invalid('refresh token replay detected; session revoked');\n            }\n        }\n\n        // Blocklist the presented refresh token in the cache so introspection\n        // reports it inactive. Deliberately NOT a DB revoke — that would set\n        // revoked_at and break the grace window.\n        await this.tokenRepository.setInactive(payload.jti, payload.exp);\n\n        const session = await this.sessionManager.findOneById(payload.session_id);\n        if (!session) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        await this.sessionManager.verify(session);\n\n        if (options.userAgent) {\n            session.userAgent = options.userAgent;\n        }\n        if (options.ipAddress) {\n            session.ipAddress = options.ipAddress;\n        }\n        await this.sessionManager.refresh(session);\n\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue({\n            ...payload,\n            ...(options.confirmation ? { cnf: options.confirmation } : {}),\n            user_agent: session.userAgent,\n            remote_address: session.ipAddress,\n            exp: this.refreshTokenIssuer.buildExp(),\n            parent_id: payload.jti,\n        });\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({\n            ...payload,\n            ...(options.confirmation ? { cnf: options.confirmation } : {}),\n            user_agent: session.userAgent,\n            remote_address: session.ipAddress,\n            exp: this.accessTokenIssuer.buildExp(),\n            refresh_token_id: refreshTokenPayload.jti,\n        });\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        });\n    }\n\n    /**\n     * The grace window (opt-in via `tokenRefreshGracePeriod`) absorbs benign\n     * concurrent / multi-tab refreshes of the SAME still-current token. It is\n     * scoped to the chain tip: a token whose descendant has already been\n     * consumed is a stale ancestor (a real replay), never a grace re-use.\n     */\n    protected async isWithinGraceWindow(jti: string, now: Date) : Promise<boolean> {\n        if (this.gracePeriod <= 0) {\n            return false;\n        }\n\n        const current = await this.sessionTokenRepository.findOneById(jti);\n        if (\n            !current ||\n            current.revokedAt !== null ||\n            current.consumedAt === null ||\n            (now.getTime() - new Date(current.consumedAt).getTime()) > this.gracePeriod * 1_000\n        ) {\n            return false;\n        }\n\n        // Grace applies ONLY to the most-recent consumed token: a consumed\n        // descendant proves the rotation advanced past this one (stale replay).\n        const chainAdvanced = await this.sessionTokenRepository.hasConsumedChild(jti);\n        return !chainAdvanced;\n    }\n\n    /**\n     * RFC 6819 §5.2.2.3 reaction strategy — revoke the whole token family\n     * (the auth_sessions row) on replay: soft-revoke every session-token row,\n     * blocklist their jtis in the cache, and delete the session so its access\n     * tokens stop verifying on authup's own API.\n     */\n    protected async revokeFamily(sessionId: string, jti: string, at: string) : Promise<void> {\n        this.logger?.warn('OAuth2 refresh token replay detected; revoking session', {\n            sessionId,\n            jti,\n        });\n\n        await this.eventService?.record({\n            scope: EventScope.OAUTH2,\n            name: EventName.REFRESH_REPLAY_DETECTED,\n            refType: EventRefType.SESSION,\n            refId: sessionId,\n            data: { jti },\n        });\n        this.metrics?.recordRefreshReplay();\n\n        // Blocklisting is best-effort (cache) — settle all of them so one cache\n        // failure cannot skip the rest or, worse, abort the session delete\n        // below (the load-bearing part of the revocation). Pin each TTL to the\n        // token's real expiry (unix seconds) so a long-lived refresh token\n        // cannot resurface as active via introspection after the fallback 1h.\n        const rows = await this.sessionTokenRepository.revokeBySessionId(sessionId, at);\n        await Promise.allSettled(rows.map((row) => this.tokenRepository.setInactive(\n            row.id,\n            Math.floor(new Date(row.expiresAt).getTime() / 1_000),\n        )));\n\n        await this.sessionManager.revoke(sessionId);\n    }\n}\n"],"mappings":";;;;;;;;AAmBA,IAAaQ,0BAAb,cAA6CD,gBAAAA;CAC/BE;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;EACxB,CAAA;EAEA,KAAKV,qBAAqBQ,IAAIR;EAC9B,KAAKC,gBAAgBO,IAAIP;EACzB,KAAKC,kBAAkBM,IAAIN;EAC3B,KAAKC,yBAAyBK,IAAIL;EAClC,KAAKC,eAAeI,IAAIJ;EACxB,KAAKC,UAAUG,IAAIH;EACnB,KAAKC,SAASE,IAAIF;EAClB,KAAKC,cAAcC,IAAIG,SAASJ,eAAe;CACnD;CAEA,MAAMK,QACFC,OACAF,UAAqC,CAAC,GACJ;EAClC,IAAIG;EACJ,IAAI,OAAOD,UAAU,UAGjBC,UAAU,MAAM,KAAKb,cAAcc,OAAOF,OAAO,EAAEG,iBAAiB,KAAK,CAAA;OAEzEF,UAAUD;EAGd,IAAI,CAACC,QAAQG,KACT,MAAM1B,SAAS2B,uBAAuB,KAAA;EAE1C,IAAI,CAACJ,QAAQK,YACT,MAAM5B,SAAS2B,uBAAuB,YAAA;EAQ1C,IAAIJ,QAAQM,QAAQN,QAAQM,SAAS3B,gBAAgB4B,SACjD,MAAM7B,iBAAiB8B,QAAQ,uBAAA;EAGnC,MAAMC,MAAM,MAAM,KAAKpB,uBAAuBqB,YAAYV,QAAQG,GAAG;EACrE,IAAI,CAACM,OAAOA,IAAIH,SAAS,WAGrB,MAAM5B,iBAAiB8B,QAAQ,0BAAA;EAEnC,IAAIC,IAAIE,WACJ,MAAMjC,iBAAiB8B,QAAQ,gCAAA;EAEnC,IAAIC,IAAIG,cAAcZ,QAAQK,YAI1B,MAAM3B,iBAAiB8B,QAAQ,gCAAA;EAGnC,MAAMK,sBAAM,IAAIC,KAAAA;EAChB,MAAMC,SAASF,IAAIG,YAAW;EAG9B,IAAI,CAACC,MADkB,KAAK5B,uBAAuB6B,oBAAoBlB,QAAQG,KAAKY,MAAAA,GAM5E;OAAA,CAACI,MADqB,KAAKC,oBAAoBpB,QAAQG,KAAKU,GAAAA,GAC9C;IACd,MAAM,KAAKQ,aAAaZ,IAAIG,WAAWZ,QAAQG,KAAKY,MAAAA;IACpD,MAAMrC,iBAAiB8B,QAAQ,gDAAA;GACnC;;EAMJ,MAAM,KAAKpB,gBAAgBkC,YAAYtB,QAAQG,KAAKH,QAAQuB,GAAG;EAE/D,MAAMC,UAAU,MAAM,KAAK5B,eAAec,YAAYV,QAAQK,UAAU;EACxE,IAAI,CAACmB,SACD,MAAM/C,SAAS2B,uBAAuB,YAAA;EAG1C,MAAM,KAAKR,eAAeK,OAAOuB,OAAAA;EAEjC,IAAI3B,QAAQ4B,WACRD,QAAQC,YAAY5B,QAAQ4B;EAEhC,IAAI5B,QAAQ6B,WACRF,QAAQE,YAAY7B,QAAQ6B;EAEhC,MAAM,KAAK9B,eAAe+B,QAAQH,OAAAA;EAElC,MAAM,CAACI,cAAcC,uBAAuB,MAAM,KAAK3C,mBAAmB4C,MAAM;GAC5E,GAAG9B;GACH,GAAIH,QAAQkC,eAAe,EAAEC,KAAKnC,QAAQkC,aAAa,IAAI,CAAC;GAC5DE,YAAYT,QAAQC;GACpBS,gBAAgBV,QAAQE;GACxBH,KAAK,KAAKrC,mBAAmBiD,SAAQ;GACrCC,WAAWpC,QAAQG;EACvB,CAAA;EAEA,MAAM,CAACkC,aAAaC,sBAAsB,MAAM,KAAK3C,kBAAkBmC,MAAM;GACzE,GAAG9B;GACH,GAAIH,QAAQkC,eAAe,EAAEC,KAAKnC,QAAQkC,aAAa,IAAI,CAAC;GAC5DE,YAAYT,QAAQC;GACpBS,gBAAgBV,QAAQE;GACxBH,KAAK,KAAK5B,kBAAkBwC,SAAQ;GACpCI,kBAAkBV,oBAAoB1B;EAC1C,CAAA;EAEA,OAAOpB,+BAA+B;GAClCsD;GACAC;GACAV;GACAC;EACJ,CAAA;CACJ;;;;;;IAQA,MAAgBT,oBAAoBjB,KAAaU,KAA8B;EAC3E,IAAI,KAAKpB,eAAe,GACpB,OAAO;EAGX,MAAM+C,UAAU,MAAM,KAAKnD,uBAAuBqB,YAAYP,GAAAA;EAC9D,IACI,CAACqC,WACDA,QAAQ7B,cAAc,QACtB6B,QAAQC,eAAe,QACvB,IAAKC,QAAO,IAAK,IAAI5B,KAAK0B,QAAQC,UAAU,CAAA,CAAEC,QAAO,IAAM,KAAKjD,cAAc,KAE9E,OAAO;EAMX,OAAO,CAACkD,MADoB,KAAKtD,uBAAuBuD,iBAAiBzC,GAAAA;CAE7E;;;;;;IAQA,MAAgBkB,aAAaT,WAAmBT,KAAa0C,IAA4B;EACrF,KAAKrD,QAAQsD,KAAK,0DAA0D;GACxElC;GACAT;EACJ,CAAA;EAEA,MAAM,KAAKb,cAAcyD,OAAO;GAC5BC,OAAOlE,WAAWmE;GAClBC,MAAMtE,UAAUuE;GAChBC,SAASvE,aAAawE;GACtBC,OAAO1C;GACP2C,MAAM,EAAEpD,IAAI;EAChB,CAAA;EACA,KAAKZ,SAASiE,oBAAAA;EAOd,MAAMC,OAAO,MAAM,KAAKpE,uBAAuBqE,kBAAkB9C,WAAWiC,EAAAA;EAC5E,MAAMc,QAAQC,WAAWH,KAAKI,KAAKpD,QAAQ,KAAKrB,gBAAgBkC,YAC5Db,IAAIqD,IACJC,KAAKC,MAAM,IAAIlD,KAAKL,IAAIwD,SAAS,CAAA,CAAEvB,QAAO,IAAK,GAAA,CAAA,CAAA,CAAA;EAGnD,MAAM,KAAK9C,eAAesE,OAAOtD,SAAAA;CACrC;AACJ"}
+{"version":3,"file":"refresh-token.mjs","names":["JWTError","OAuth2GrantError","OAuth2TokenKind","EventName","EventRefType","EventScope","buildOAuth2BearerTokenResponse","isSessionTokenRelationMissingError","OAuth2BaseGrant","OAuth2RefreshTokenGrant","refreshTokenIssuer","tokenVerifier","tokenRepository","sessionTokenRepository","eventService","metrics","logger","gracePeriod","ctx","accessTokenIssuer","sessionManager","options","runWith","input","payload","verify","skipActiveCheck","jti","payloadPropertyInvalid","session_id","kind","REFRESH","invalid","row","findOneById","revokedAt","sessionId","now","Date","nowISO","toISOString","consumed","markRefreshConsumed","withinGrace","isWithinGraceWindow","revokeFamily","setInactive","exp","session","refresh","refreshToken","refreshTokenPayload","issue","confirmation","cnf","user_agent","userAgent","remote_address","ipAddress","buildExp","parent_id","accessToken","accessTokenPayload","refresh_token_id","e","debug","clientId","client_id","current","consumedAt","getTime","chainAdvanced","hasConsumedChild","at","warn","record","scope","OAUTH2","name","REFRESH_REPLAY_DETECTED","refType","SESSION","refId","data","recordRefreshReplay","rows","revokeBySessionId","Promise","allSettled","map","id","Math","floor","expiresAt","revoke"],"sources":["../../../../src/core/oauth2/grant-types/refresh-token.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { JWTError, OAuth2GrantError, OAuth2TokenKind } from '@authup/specs';\nimport { EventName, EventRefType, EventScope } from '@authup/core-kit';\nimport type { Logger } from '@authup/server-kit';\nimport type { IEventService } from '../../entities/index.ts';\nimport type { IAuthFlowMetrics } from '../../metrics/index.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport { isSessionTokenRelationMissingError } from '../session-token/index.ts';\nimport type { ISessionTokenRepository } from '../session-token/index.ts';\nimport type { IOAuth2TokenIssuer, IOAuth2TokenRepository, IOAuth2TokenVerifier } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport type { IOAuth2Grant, OAuth2GrantRunWIthOptions, OAuth2RefreshTokenGrantContext } from './types.ts';\n\nexport class OAuth2RefreshTokenGrant extends OAuth2BaseGrant<string | OAuth2TokenPayload> implements IOAuth2Grant {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    protected tokenVerifier : IOAuth2TokenVerifier;\n\n    protected tokenRepository : IOAuth2TokenRepository;\n\n    protected sessionTokenRepository : ISessionTokenRepository;\n\n    protected eventService? : IEventService;\n\n    protected metrics? : IAuthFlowMetrics;\n\n    protected logger? : Logger;\n\n    protected gracePeriod : number;\n\n    constructor(ctx: OAuth2RefreshTokenGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n        this.tokenVerifier = ctx.tokenVerifier;\n        this.tokenRepository = ctx.tokenRepository;\n        this.sessionTokenRepository = ctx.sessionTokenRepository;\n        this.eventService = ctx.eventService;\n        this.metrics = ctx.metrics;\n        this.logger = ctx.logger;\n        this.gracePeriod = ctx.options?.gracePeriod ?? 0;\n    }\n\n    async runWith(\n        input: string | OAuth2TokenPayload,\n        options: OAuth2GrantRunWIthOptions = {},\n    ) : Promise<OAuth2TokenGrantResponse> {\n        let payload : OAuth2TokenPayload;\n        if (typeof input === 'string') {\n            // The auth_session_tokens row — not the cache blocklist — is the\n            // authority for refresh-token validity, so skip the active check.\n            payload = await this.tokenVerifier.verify(input, { skipActiveCheck: true });\n        } else {\n            payload = input;\n        }\n\n        if (!payload.jti) {\n            throw JWTError.payloadPropertyInvalid('jti');\n        }\n        if (!payload.session_id) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        // Explicit kind guard (defense in depth). Authup signs access tokens\n        // and the MFA-pending login ticket with the same keys; only a refresh\n        // token may be exchanged here. The ticket is also rejected implicitly\n        // (it writes no auth_session_tokens row), but do not rely on that\n        // second-order fact alone.\n        if (payload.kind && payload.kind !== OAuth2TokenKind.REFRESH) {\n            throw OAuth2GrantError.invalid('unexpected token kind');\n        }\n\n        const row = await this.sessionTokenRepository.findOneById(payload.jti);\n        if (!row || row.kind !== 'refresh') {\n            // Row missing = expired-and-swept or a pre-rotation legacy token\n            // (hard cutover). Either way the client must re-authenticate.\n            throw OAuth2GrantError.invalid('refresh token is unknown');\n        }\n        if (row.revokedAt) {\n            throw OAuth2GrantError.invalid('refresh token has been revoked');\n        }\n        if (row.sessionId !== payload.session_id) {\n            // The row is written with the token's own session_id and jti is\n            // globally unique, so a mismatch means corruption / jti reuse — fail\n            // closed rather than refresh or revoke against the wrong session.\n            throw OAuth2GrantError.invalid('refresh token session mismatch');\n        }\n\n        const now = new Date();\n        const nowISO = now.toISOString();\n\n        const consumed = await this.sessionTokenRepository.markRefreshConsumed(payload.jti, nowISO);\n        if (!consumed) {\n            // Lost the atomic consume — either a replay of an already-rotated\n            // token, or a benign concurrent-refresh race the grace window\n            // absorbs.\n            const withinGrace = await this.isWithinGraceWindow(payload.jti, now);\n            if (!withinGrace) {\n                await this.revokeFamily(row.sessionId, payload.jti, nowISO);\n                throw OAuth2GrantError.invalid('refresh token replay detected; session revoked');\n            }\n        }\n\n        // Blocklist the presented refresh token in the cache so introspection\n        // reports it inactive. Deliberately NOT a DB revoke — that would set\n        // revoked_at and break the grace window.\n        await this.tokenRepository.setInactive(payload.jti, payload.exp);\n\n        const session = await this.sessionManager.findOneById(payload.session_id);\n        if (!session) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        await this.sessionManager.verify(session);\n\n        // `userAgent` / `ipAddress` are pinned at creation and deliberately NOT\n        // re-stamped from this request. A refresh does not have to come from the\n        // subject's device: a server-side renderer holding the auth cookies (the\n        // Nuxt admin console resolves the store during SSR) refreshes from its\n        // own process, which used to rewrite the row to `node` plus the\n        // renderer's address. That made the sessions UI show a user's own\n        // session as an unknown device, and would have shown a genuinely foreign\n        // session as theirs. `refresh()` still slides refreshedAt / seenAt /\n        // expiresAt, so \"last active\" stays accurate.\n        await this.sessionManager.refresh(session);\n\n        // The session was resolved above, but nothing holds it. A concurrent\n        // request can revoke it (a replay reaction on this same family, an\n        // explicit logout, an admin force-logout, the sweeper) before the\n        // issuers write their inventory rows, and the write is then rejected by\n        // the session foreign key. The client the tokens are attributed to can\n        // disappear in the same window, which the repository reports the same\n        // way: both parents cascade onto `auth_session_tokens`, so either loss\n        // has already deleted the presented token's own row. Refusing is\n        // therefore correct in both cases, but it has to read as\n        // `invalid_grant` rather than as an internal error: the presented token\n        // is already consumed and cache-blocklisted, so there is nothing left\n        // to retry with and re-authentication is the only way forward (issue\n        // #3435). Anything else is a genuine fault and is rethrown untouched.\n        try {\n            const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue({\n                ...payload,\n                ...(options.confirmation ? { cnf: options.confirmation } : {}),\n                user_agent: options.userAgent ?? session.userAgent,\n                remote_address: options.ipAddress ?? session.ipAddress,\n                exp: this.refreshTokenIssuer.buildExp(),\n                parent_id: payload.jti,\n            });\n\n            const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({\n                ...payload,\n                ...(options.confirmation ? { cnf: options.confirmation } : {}),\n                user_agent: options.userAgent ?? session.userAgent,\n                remote_address: options.ipAddress ?? session.ipAddress,\n                exp: this.accessTokenIssuer.buildExp(),\n                refresh_token_id: refreshTokenPayload.jti,\n            });\n\n            return buildOAuth2BearerTokenResponse({\n                accessToken,\n                accessTokenPayload,\n                refreshToken,\n                refreshTokenPayload,\n            });\n        } catch (e) {\n            if (isSessionTokenRelationMissingError(e)) {\n                this.logger?.debug('OAuth2 refresh token rotation lost a referenced row mid-flight', {\n                    sessionId: payload.session_id,\n                    clientId: payload.client_id,\n                    jti: payload.jti,\n                });\n\n                throw OAuth2GrantError.invalid('the session has been revoked');\n            }\n\n            throw e;\n        }\n    }\n\n    /**\n     * The grace window (opt-in via `tokenRefreshGracePeriod`) absorbs benign\n     * concurrent / multi-tab refreshes of the SAME still-current token. It is\n     * scoped to the chain tip: a token whose descendant has already been\n     * consumed is a stale ancestor (a real replay), never a grace re-use.\n     */\n    protected async isWithinGraceWindow(jti: string, now: Date) : Promise<boolean> {\n        if (this.gracePeriod <= 0) {\n            return false;\n        }\n\n        const current = await this.sessionTokenRepository.findOneById(jti);\n        if (\n            !current ||\n            current.revokedAt !== null ||\n            current.consumedAt === null ||\n            (now.getTime() - new Date(current.consumedAt).getTime()) > this.gracePeriod * 1_000\n        ) {\n            return false;\n        }\n\n        // Grace applies ONLY to the most-recent consumed token: a consumed\n        // descendant proves the rotation advanced past this one (stale replay).\n        const chainAdvanced = await this.sessionTokenRepository.hasConsumedChild(jti);\n        return !chainAdvanced;\n    }\n\n    /**\n     * RFC 6819 §5.2.2.3 reaction strategy — revoke the whole token family\n     * (the auth_sessions row) on replay: soft-revoke every session-token row,\n     * blocklist their jtis in the cache, and delete the session so its access\n     * tokens stop verifying on authup's own API.\n     */\n    protected async revokeFamily(sessionId: string, jti: string, at: string) : Promise<void> {\n        this.logger?.warn('OAuth2 refresh token replay detected; revoking session', {\n            sessionId,\n            jti,\n        });\n\n        await this.eventService?.record({\n            scope: EventScope.OAUTH2,\n            name: EventName.REFRESH_REPLAY_DETECTED,\n            refType: EventRefType.SESSION,\n            refId: sessionId,\n            sessionId,\n            data: { jti },\n        });\n        this.metrics?.recordRefreshReplay();\n\n        // Blocklisting is best-effort (cache) — settle all of them so one cache\n        // failure cannot skip the rest or, worse, abort the session delete\n        // below (the load-bearing part of the revocation). Pin each TTL to the\n        // token's real expiry (unix seconds) so a long-lived refresh token\n        // cannot resurface as active via introspection after the fallback 1h.\n        const rows = await this.sessionTokenRepository.revokeBySessionId(sessionId, at);\n        await Promise.allSettled(rows.map((row) => this.tokenRepository.setInactive(\n            row.id,\n            Math.floor(new Date(row.expiresAt).getTime() / 1_000),\n        )));\n\n        await this.sessionManager.revoke(sessionId);\n    }\n}\n"],"mappings":";;;;;;;;;;AAoBA,IAAaS,0BAAb,cAA6CD,gBAAAA;CAC/BE;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;EACxB,CAAA;EAEA,KAAKV,qBAAqBQ,IAAIR;EAC9B,KAAKC,gBAAgBO,IAAIP;EACzB,KAAKC,kBAAkBM,IAAIN;EAC3B,KAAKC,yBAAyBK,IAAIL;EAClC,KAAKC,eAAeI,IAAIJ;EACxB,KAAKC,UAAUG,IAAIH;EACnB,KAAKC,SAASE,IAAIF;EAClB,KAAKC,cAAcC,IAAIG,SAASJ,eAAe;CACnD;CAEA,MAAMK,QACFC,OACAF,UAAqC,CAAC,GACJ;EAClC,IAAIG;EACJ,IAAI,OAAOD,UAAU,UAGjBC,UAAU,MAAM,KAAKb,cAAcc,OAAOF,OAAO,EAAEG,iBAAiB,KAAK,CAAA;OAEzEF,UAAUD;EAGd,IAAI,CAACC,QAAQG,KACT,MAAM3B,SAAS4B,uBAAuB,KAAA;EAE1C,IAAI,CAACJ,QAAQK,YACT,MAAM7B,SAAS4B,uBAAuB,YAAA;EAQ1C,IAAIJ,QAAQM,QAAQN,QAAQM,SAAS5B,gBAAgB6B,SACjD,MAAM9B,iBAAiB+B,QAAQ,uBAAA;EAGnC,MAAMC,MAAM,MAAM,KAAKpB,uBAAuBqB,YAAYV,QAAQG,GAAG;EACrE,IAAI,CAACM,OAAOA,IAAIH,SAAS,WAGrB,MAAM7B,iBAAiB+B,QAAQ,0BAAA;EAEnC,IAAIC,IAAIE,WACJ,MAAMlC,iBAAiB+B,QAAQ,gCAAA;EAEnC,IAAIC,IAAIG,cAAcZ,QAAQK,YAI1B,MAAM5B,iBAAiB+B,QAAQ,gCAAA;EAGnC,MAAMK,sBAAM,IAAIC,KAAAA;EAChB,MAAMC,SAASF,IAAIG,YAAW;EAG9B,IAAI,CAACC,MADkB,KAAK5B,uBAAuB6B,oBAAoBlB,QAAQG,KAAKY,MAAAA,GAM5E;OAAA,CAACI,MADqB,KAAKC,oBAAoBpB,QAAQG,KAAKU,GAAAA,GAC9C;IACd,MAAM,KAAKQ,aAAaZ,IAAIG,WAAWZ,QAAQG,KAAKY,MAAAA;IACpD,MAAMtC,iBAAiB+B,QAAQ,gDAAA;GACnC;;EAMJ,MAAM,KAAKpB,gBAAgBkC,YAAYtB,QAAQG,KAAKH,QAAQuB,GAAG;EAE/D,MAAMC,UAAU,MAAM,KAAK5B,eAAec,YAAYV,QAAQK,UAAU;EACxE,IAAI,CAACmB,SACD,MAAMhD,SAAS4B,uBAAuB,YAAA;EAG1C,MAAM,KAAKR,eAAeK,OAAOuB,OAAAA;EAWjC,MAAM,KAAK5B,eAAe6B,QAAQD,OAAAA;EAelC,IAAI;GACA,MAAM,CAACE,cAAcC,uBAAuB,MAAM,KAAKzC,mBAAmB0C,MAAM;IAC5E,GAAG5B;IACH,GAAIH,QAAQgC,eAAe,EAAEC,KAAKjC,QAAQgC,aAAa,IAAI,CAAC;IAC5DE,YAAYlC,QAAQmC,aAAaR,QAAQQ;IACzCC,gBAAgBpC,QAAQqC,aAAaV,QAAQU;IAC7CX,KAAK,KAAKrC,mBAAmBiD,SAAQ;IACrCC,WAAWpC,QAAQG;GACvB,CAAA;GAEA,MAAM,CAACkC,aAAaC,sBAAsB,MAAM,KAAK3C,kBAAkBiC,MAAM;IACzE,GAAG5B;IACH,GAAIH,QAAQgC,eAAe,EAAEC,KAAKjC,QAAQgC,aAAa,IAAI,CAAC;IAC5DE,YAAYlC,QAAQmC,aAAaR,QAAQQ;IACzCC,gBAAgBpC,QAAQqC,aAAaV,QAAQU;IAC7CX,KAAK,KAAK5B,kBAAkBwC,SAAQ;IACpCI,kBAAkBZ,oBAAoBxB;GAC1C,CAAA;GAEA,OAAOrB,+BAA+B;IAClCuD;IACAC;IACAZ;IACAC;GACJ,CAAA;EACJ,SAASa,GAAG;GACR,IAAIzD,mCAAmCyD,CAAAA,GAAI;IACvC,KAAKhD,QAAQiD,MAAM,kEAAkE;KACjF7B,WAAWZ,QAAQK;KACnBqC,UAAU1C,QAAQ2C;KAClBxC,KAAKH,QAAQG;IACjB,CAAA;IAEA,MAAM1B,iBAAiB+B,QAAQ,8BAAA;GACnC;GAEA,MAAMgC;EACV;CACJ;;;;;;IAQA,MAAgBpB,oBAAoBjB,KAAaU,KAA8B;EAC3E,IAAI,KAAKpB,eAAe,GACpB,OAAO;EAGX,MAAMmD,UAAU,MAAM,KAAKvD,uBAAuBqB,YAAYP,GAAAA;EAC9D,IACI,CAACyC,WACDA,QAAQjC,cAAc,QACtBiC,QAAQC,eAAe,QACvB,IAAKC,QAAO,IAAK,IAAIhC,KAAK8B,QAAQC,UAAU,CAAA,CAAEC,QAAO,IAAM,KAAKrD,cAAc,KAE9E,OAAO;EAMX,OAAO,CAACsD,MADoB,KAAK1D,uBAAuB2D,iBAAiB7C,GAAAA;CAE7E;;;;;;IAQA,MAAgBkB,aAAaT,WAAmBT,KAAa8C,IAA4B;EACrF,KAAKzD,QAAQ0D,KAAK,0DAA0D;GACxEtC;GACAT;EACJ,CAAA;EAEA,MAAM,KAAKb,cAAc6D,OAAO;GAC5BC,OAAOvE,WAAWwE;GAClBC,MAAM3E,UAAU4E;GAChBC,SAAS5E,aAAa6E;GACtBC,OAAO9C;GACPA;GACA+C,MAAM,EAAExD,IAAI;EAChB,CAAA;EACA,KAAKZ,SAASqE,oBAAAA;EAOd,MAAMC,OAAO,MAAM,KAAKxE,uBAAuByE,kBAAkBlD,WAAWqC,EAAAA;EAC5E,MAAMc,QAAQC,WAAWH,KAAKI,KAAKxD,QAAQ,KAAKrB,gBAAgBkC,YAC5Db,IAAIyD,IACJC,KAAKC,MAAM,IAAItD,KAAKL,IAAI4D,SAAS,CAAA,CAAEvB,QAAO,IAAK,GAAA,CAAA,CAAA,CAAA;EAGnD,MAAM,KAAKlD,eAAe0E,OAAO1D,SAAAA;CACrC;AACJ"}

package/dist/core/oauth2/index.mjs

@@ -22,6 +22,8 @@ import { OAuth2AuthorizeGrant } from "./grant-types/authorize.mjs";
 import { ClientCredentialsGrant } from "./grant-types/client-credentials.mjs";
 import { IdentityGrantType } from "./grant-types/identity.mjs";
 import { PasswordGrantType } from "./grant-types/password.mjs";
+import { SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE, SessionTokenRelationMissingError, isSessionTokenRelationMissingError } from "./session-token/error.mjs";
+import "./session-token/index.mjs";
 import { OAuth2RefreshTokenGrant } from "./grant-types/refresh-token.mjs";
 import "./grant-types/index.mjs";
 import { OAuth2MfaLoginService } from "./mfa-login/module.mjs";
@@ -38,4 +40,4 @@ import { OAuth2TokenRevoker } from "./token/revoker/module.mjs";
 import { OAuth2TokenSigner } from "./token/signer/module.mjs";
 import { OAuth2TokenVerifier } from "./token/verifier/module.mjs";
 import "./token/index.mjs";
-export { ClientCredentialsGrant, IdentityGrantType, OAuth2AccessPolicyEvaluator, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2ClientAuthenticator, OAuth2EndSessionRequestValidator, OAuth2EndSessionService, OAuth2MfaLoginService, OAuth2MfaTokenIssuer, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PasswordGrantType, assertClientGrantAllowed, base64URLEncode, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, deriveAmrAcr, generateOAuth2CodeVerifier };
+export { ClientCredentialsGrant, IdentityGrantType, OAuth2AccessPolicyEvaluator, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2ClientAuthenticator, OAuth2EndSessionRequestValidator, OAuth2EndSessionService, OAuth2MfaLoginService, OAuth2MfaTokenIssuer, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PasswordGrantType, SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE, SessionTokenRelationMissingError, assertClientGrantAllowed, base64URLEncode, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, deriveAmrAcr, generateOAuth2CodeVerifier, isSessionTokenRelationMissingError };

package/dist/core/oauth2/mfa-login/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/mfa-login/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAsB,MAAM,eAAe,CAAC;AAUlF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAGrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AACpF,OAAO,KAAK,EACR,sBAAsB,EACtB,2BAA2B,EAC3B,4BAA4B,EAC5B,oBAAoB,EACpB,8BAA8B,EAC9B,gCAAgC,EACnC,MAAM,YAAY,CAAC;AAEpB,qBAAa,qBAAsB,YAAW,sBAAsB;IAChE,SAAS,CAAC,cAAc,EAAG,eAAe,CAAC;IAE3C,SAAS,CAAC,YAAY,EAAG,kBAAkB,CAAC;IAE5C,SAAS,CAAC,iBAAiB,EAAG,kBAAkB,CAAC;IAEjD,SAAS,CAAC,kBAAkB,EAAG,kBAAkB,CAAC;IAElD,SAAS,CAAC,eAAe,EAAG,sBAAsB,CAAC;IAEnD,SAAS,CAAC,YAAY,CAAC,EAAG,aAAa,CAAC;IAExC,SAAS,CAAC,OAAO,CAAC,EAAG,gBAAgB,CAAC;gBAE1B,GAAG,EAAE,4BAA4B;IAUvC,WAAW,CACb,KAAK,EAAE,8BAA8B,EACrC,OAAO,GAAE,gCAAqC,GAC9C,OAAO,CAAC,oBAAoB,CAAC;IA8C3B,QAAQ,CAAC,KAAK,EAAE,2BAA2B,GAAI,OAAO,CAAC,wBAAwB,CAAC;CAmEzF"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/mfa-login/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAsB,MAAM,eAAe,CAAC;AAUlF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAGrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AACpF,OAAO,KAAK,EACR,sBAAsB,EACtB,2BAA2B,EAC3B,4BAA4B,EAC5B,oBAAoB,EACpB,8BAA8B,EAC9B,gCAAgC,EACnC,MAAM,YAAY,CAAC;AAEpB,qBAAa,qBAAsB,YAAW,sBAAsB;IAChE,SAAS,CAAC,cAAc,EAAG,eAAe,CAAC;IAE3C,SAAS,CAAC,YAAY,EAAG,kBAAkB,CAAC;IAE5C,SAAS,CAAC,iBAAiB,EAAG,kBAAkB,CAAC;IAEjD,SAAS,CAAC,kBAAkB,EAAG,kBAAkB,CAAC;IAElD,SAAS,CAAC,eAAe,EAAG,sBAAsB,CAAC;IAEnD,SAAS,CAAC,YAAY,CAAC,EAAG,aAAa,CAAC;IAExC,SAAS,CAAC,OAAO,CAAC,EAAG,gBAAgB,CAAC;gBAE1B,GAAG,EAAE,4BAA4B;IAUvC,WAAW,CACb,KAAK,EAAE,8BAA8B,EACrC,OAAO,GAAE,gCAAqC,GAC9C,OAAO,CAAC,oBAAoB,CAAC;IAgD3B,QAAQ,CAAC,KAAK,EAAE,2BAA2B,GAAI,OAAO,CAAC,wBAAwB,CAAC;CAiEzF"}

package/dist/core/oauth2/mfa-login/module.mjs

@@ -31,7 +31,6 @@ var OAuth2MfaLoginService = class {
 			userAgent: options.userAgent,
 			ipAddress: options.ipAddress,
 			realmId: user.realmId,
-			clientId,
 			sub: user.id,
 			subKind: IdentityType.USER,
 			mfaAt: null,
@@ -63,7 +62,7 @@ var OAuth2MfaLoginService = class {
 			if (!await this.tokenRepository.claimInactive(ticket.jti, ticket.exp)) throw OAuth2GrantError.invalid("mfa login ticket has already been used");
 		}
 		const issuePayload = {
-			client_id: session.clientId ?? void 0,
+			client_id: ticket.client_id ?? void 0,
 			session_id: session.id,
 			user_agent: session.userAgent,
 			remote_address: session.ipAddress,
@@ -82,17 +81,15 @@ var OAuth2MfaLoginService = class {
 			name: EventName.LOGIN,
 			refType: EventRefType.SESSION,
 			refId: session.id,
-			clientId: session.clientId ?? null,
+			clientId: ticket.client_id ?? null,
+			sessionId: session.id,
 			actorType: IdentityType.USER,
 			actorId: session.sub,
 			actorName: input.userName ?? null,
 			realmId: session.realmId,
 			requestIpAddress: session.ipAddress ?? null,
 			requestUserAgent: session.userAgent ?? null,
-			data: {
-				grantType: OAuth2TokenGrant.PASSWORD,
-				sessionId: session.id
-			}
+			data: { grantType: OAuth2TokenGrant.PASSWORD }
 		});
 		this.metrics?.recordLogin("success");
 		return buildOAuth2BearerTokenResponse({

package/dist/core/oauth2/mfa-login/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2GrantError","OAuth2SubKind","OAuth2TokenGrant","EventName","EventRefType","EventScope","IdentityType","ScopeName","SessionAuthMethod","deriveAmrAcr","buildOAuth2BearerTokenResponse","OAuth2MfaLoginService","sessionManager","ticketIssuer","accessTokenIssuer","refreshTokenIssuer","tokenRepository","eventService","metrics","ctx","issueTicket","input","options","user","clientId","undefined","expiresAt","buildExp","session","create","userAgent","ipAddress","realmId","sub","id","subKind","USER","mfaAt","authMethod","PASSWORD","Date","toISOString","token","payload","issue","client_id","session_id","user_agent","remote_address","sub_kind","realm_id","realm_name","realm","name","confirmation","cnf","exp","expiresIn","Math","floor","now","complete","ticket","refresh","amrAcr","jti","claimed","claimInactive","invalid","issuePayload","scope","GLOBAL","accessToken","accessTokenPayload","refreshToken","refreshTokenPayload","record","OAUTH2","LOGIN","refType","SESSION","refId","actorType","actorId","actorName","userName","requestIpAddress","requestUserAgent","data","grantType","sessionId","recordLogin"],"sources":["../../../../src/core/oauth2/mfa-login/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2GrantError, OAuth2SubKind, OAuth2TokenGrant } from '@authup/specs';\nimport {\n    EventName,\n    EventRefType,\n    EventScope,\n    IdentityType,\n    ScopeName,\n    SessionAuthMethod,\n} from '@authup/core-kit';\nimport type { IEventService } from '../../entities/index.ts';\nimport type { IAuthFlowMetrics } from '../../metrics/index.ts';\nimport type { ISessionManager } from '../../authentication/index.ts';\nimport { deriveAmrAcr } from '../authorization/helpers.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { IOAuth2TokenIssuer, IOAuth2TokenRepository } from '../token/index.ts';\nimport type {\n    IOAuth2MfaLoginService,\n    OAuth2MfaLoginCompleteInput,\n    OAuth2MfaLoginServiceContext,\n    OAuth2MfaLoginTicket,\n    OAuth2MfaLoginTicketIssueInput,\n    OAuth2MfaLoginTicketIssueOptions,\n} from './types.ts';\n\nexport class OAuth2MfaLoginService implements IOAuth2MfaLoginService {\n    protected sessionManager : ISessionManager;\n\n    protected ticketIssuer : IOAuth2TokenIssuer;\n\n    protected accessTokenIssuer : IOAuth2TokenIssuer;\n\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    protected tokenRepository : IOAuth2TokenRepository;\n\n    protected eventService? : IEventService;\n\n    protected metrics? : IAuthFlowMetrics;\n\n    constructor(ctx: OAuth2MfaLoginServiceContext) {\n        this.sessionManager = ctx.sessionManager;\n        this.ticketIssuer = ctx.ticketIssuer;\n        this.accessTokenIssuer = ctx.accessTokenIssuer;\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n        this.tokenRepository = ctx.tokenRepository;\n        this.eventService = ctx.eventService;\n        this.metrics = ctx.metrics;\n    }\n\n    async issueTicket(\n        input: OAuth2MfaLoginTicketIssueInput,\n        options: OAuth2MfaLoginTicketIssueOptions = {},\n    ) : Promise<OAuth2MfaLoginTicket> {\n        const { user } = input;\n        const clientId = input.clientId ?? undefined;\n\n        // One expiration instant for BOTH artifacts — the pending session\n        // lives exactly as long as the ticket (an abandoned login\n        // self-expires and is swept with the regular session sweep;\n        // completion extends it to the full lifetime). Computed once so\n        // the two cannot drift.\n        const expiresAt = this.ticketIssuer.buildExp();\n\n        const session = await this.sessionManager.create({\n            userAgent: options.userAgent,\n            ipAddress: options.ipAddress,\n            realmId: user.realmId,\n            clientId,\n            sub: user.id,\n            subKind: IdentityType.USER,\n            mfaAt: null,\n            authMethod: SessionAuthMethod.PASSWORD,\n            expiresAt: new Date(expiresAt * 1000).toISOString(),\n        });\n\n        // No scope, no role claims — the ticket is not a bearer; it only\n        // unlocks the challenge routes (which opt in by kind).\n        const [token, payload] = await this.ticketIssuer.issue({\n            client_id: clientId,\n            session_id: session.id,\n            user_agent: session.userAgent,\n            remote_address: session.ipAddress,\n            sub: user.id,\n            sub_kind: OAuth2SubKind.USER,\n            realm_id: user.realmId,\n            realm_name: user.realm?.name,\n            ...(input.confirmation ? { cnf: input.confirmation } : {}),\n            exp: expiresAt,\n        });\n\n        return {\n            token,\n            expiresIn: payload.exp ?\n                payload.exp - Math.floor(Date.now() / 1000) :\n                0,\n        };\n    }\n\n    async complete(input: OAuth2MfaLoginCompleteInput) : Promise<OAuth2TokenGrantResponse> {\n        const { ticket } = input;\n\n        // Extend the ticket-scoped pending session to the regular session\n        // lifetime — the login is complete now.\n        const session = await this.sessionManager.refresh(input.session);\n\n        // mfaAt was stamped inside the verify unit of work, so the claims\n        // advertise the completed factor (amr +otp, acr urn:authup:mfa).\n        const amrAcr = deriveAmrAcr(session);\n\n        // Single use: atomically claim the ticket BEFORE minting so two\n        // concurrent completions (a mixed-kind user presenting two distinct\n        // fresh factors) cannot both issue a token pair — `claimInactive` is a\n        // set-if-absent write, so exactly one racer wins. The trade-off vs.\n        // claiming after minting is that a mint failure burns the ticket — the\n        // safer bias for a single-use login credential (the user re-authenticates).\n        if (ticket.jti) {\n            const claimed = await this.tokenRepository.claimInactive(ticket.jti, ticket.exp);\n            if (!claimed) {\n                throw OAuth2GrantError.invalid('mfa login ticket has already been used');\n            }\n        }\n\n        const issuePayload : Partial<OAuth2TokenPayload> = {\n            client_id: session.clientId ?? undefined,\n            session_id: session.id,\n            user_agent: session.userAgent,\n            remote_address: session.ipAddress,\n            scope: ScopeName.GLOBAL,\n            sub: session.sub,\n            sub_kind: OAuth2SubKind.USER,\n            realm_id: session.realmId,\n            realm_name: ticket.realm_name,\n            ...(ticket.cnf ? { cnf: ticket.cnf } : {}),\n            ...amrAcr,\n        };\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);\n\n        await this.eventService?.record({\n            scope: EventScope.OAUTH2,\n            name: EventName.LOGIN,\n            refType: EventRefType.SESSION,\n            refId: session.id,\n            clientId: session.clientId ?? null,\n            actorType: IdentityType.USER,\n            actorId: session.sub,\n            actorName: input.userName ?? null,\n            realmId: session.realmId,\n            requestIpAddress: session.ipAddress ?? null,\n            requestUserAgent: session.userAgent ?? null,\n            data: {\n                grantType: OAuth2TokenGrant.PASSWORD,\n                sessionId: session.id,\n            },\n        });\n        this.metrics?.recordLogin('success');\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;;;;AAgCA,IAAaW,wBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAmC;EAC3C,KAAKP,iBAAiBO,IAAIP;EAC1B,KAAKC,eAAeM,IAAIN;EACxB,KAAKC,oBAAoBK,IAAIL;EAC7B,KAAKC,qBAAqBI,IAAIJ;EAC9B,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,eAAeE,IAAIF;EACxB,KAAKC,UAAUC,IAAID;CACvB;CAEA,MAAME,YACFC,OACAC,UAA4C,CAAC,GACf;EAC9B,MAAM,EAAEC,SAASF;EACjB,MAAMG,WAAWH,MAAMG,YAAYC,KAAAA;EAOnC,MAAMC,YAAY,KAAKb,aAAac,SAAQ;EAE5C,MAAMC,UAAU,MAAM,KAAKhB,eAAeiB,OAAO;GAC7CC,WAAWR,QAAQQ;GACnBC,WAAWT,QAAQS;GACnBC,SAAST,KAAKS;GACdR;GACAS,KAAKV,KAAKW;GACVC,SAAS7B,aAAa8B;GACtBC,OAAO;GACPC,YAAY9B,kBAAkB+B;GAC9Bb,4BAAW,IAAIc,KAAKd,YAAY,GAAA,EAAA,CAAMe,YAAW;EACrD,CAAA;EAIA,MAAM,CAACC,OAAOC,WAAW,MAAM,KAAK9B,aAAa+B,MAAM;GACnDC,WAAWrB;GACXsB,YAAYlB,QAAQM;GACpBa,YAAYnB,QAAQE;GACpBkB,gBAAgBpB,QAAQG;GACxBE,KAAKV,KAAKW;GACVe,UAAUhD,cAAcmC;GACxBc,UAAU3B,KAAKS;GACfmB,YAAY5B,KAAK6B,OAAOC;GACxB,GAAIhC,MAAMiC,eAAe,EAAEC,KAAKlC,MAAMiC,aAAa,IAAI,CAAC;GACxDE,KAAK9B;EACT,CAAA;EAEA,OAAO;GACHgB;GACAe,WAAWd,QAAQa,MACfb,QAAQa,MAAME,KAAKC,MAAMnB,KAAKoB,IAAG,IAAK,GAAA,IACtC;EACR;CACJ;CAEA,MAAMC,SAASxC,OAAwE;EACnF,MAAM,EAAEyC,WAAWzC;EAInB,MAAMO,UAAU,MAAM,KAAKhB,eAAemD,QAAQ1C,MAAMO,OAAO;EAI/D,MAAMoC,SAASvD,aAAamB,OAAAA;EAQ5B,IAAIkC,OAAOG,KAEH;OAAA,CAACC,MADiB,KAAKlD,gBAAgBmD,cAAcL,OAAOG,KAAKH,OAAON,GAAG,GAE3E,MAAMxD,iBAAiBoE,QAAQ,wCAAA;EAAA;EAIvC,MAAMC,eAA6C;GAC/CxB,WAAWjB,QAAQJ,YAAYC,KAAAA;GAC/BqB,YAAYlB,QAAQM;GACpBa,YAAYnB,QAAQE;GACpBkB,gBAAgBpB,QAAQG;GACxBuC,OAAO/D,UAAUgE;GACjBtC,KAAKL,QAAQK;GACbgB,UAAUhD,cAAcmC;GACxBc,UAAUtB,QAAQI;GAClBmB,YAAYW,OAAOX;GACnB,GAAIW,OAAOP,MAAM,EAAEA,KAAKO,OAAOP,IAAI,IAAI,CAAC;GACxC,GAAGS;EACP;EAEA,MAAM,CAACQ,aAAaC,sBAAsB,MAAM,KAAK3D,kBAAkB8B,MAAMyB,YAAAA;EAC7E,MAAM,CAACK,cAAcC,uBAAuB,MAAM,KAAK5D,mBAAmB6B,MAAMyB,YAAAA;EAEhF,MAAM,KAAKpD,cAAc2D,OAAO;GAC5BN,OAAOjE,WAAWwE;GAClBxB,MAAMlD,UAAU2E;GAChBC,SAAS3E,aAAa4E;GACtBC,OAAOrD,QAAQM;GACfV,UAAUI,QAAQJ,YAAY;GAC9B0D,WAAW5E,aAAa8B;GACxB+C,SAASvD,QAAQK;GACjBmD,WAAW/D,MAAMgE,YAAY;GAC7BrD,SAASJ,QAAQI;GACjBsD,kBAAkB1D,QAAQG,aAAa;GACvCwD,kBAAkB3D,QAAQE,aAAa;GACvC0D,MAAM;IACFC,WAAWvF,iBAAiBqC;IAC5BmD,WAAW9D,QAAQM;GACvB;EACJ,CAAA;EACA,KAAKhB,SAASyE,YAAY,SAAA;EAE1B,OAAOjF,+BAA+B;GAClC8D;GACAC;GACAC;GACAC;EACJ,CAAA;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["OAuth2GrantError","OAuth2SubKind","OAuth2TokenGrant","EventName","EventRefType","EventScope","IdentityType","ScopeName","SessionAuthMethod","deriveAmrAcr","buildOAuth2BearerTokenResponse","OAuth2MfaLoginService","sessionManager","ticketIssuer","accessTokenIssuer","refreshTokenIssuer","tokenRepository","eventService","metrics","ctx","issueTicket","input","options","user","clientId","undefined","expiresAt","buildExp","session","create","userAgent","ipAddress","realmId","sub","id","subKind","USER","mfaAt","authMethod","PASSWORD","Date","toISOString","token","payload","issue","client_id","session_id","user_agent","remote_address","sub_kind","realm_id","realm_name","realm","name","confirmation","cnf","exp","expiresIn","Math","floor","now","complete","ticket","refresh","amrAcr","jti","claimed","claimInactive","invalid","issuePayload","scope","GLOBAL","accessToken","accessTokenPayload","refreshToken","refreshTokenPayload","record","OAUTH2","LOGIN","refType","SESSION","refId","sessionId","actorType","actorId","actorName","userName","requestIpAddress","requestUserAgent","data","grantType","recordLogin"],"sources":["../../../../src/core/oauth2/mfa-login/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2GrantError, OAuth2SubKind, OAuth2TokenGrant } from '@authup/specs';\nimport {\n    EventName,\n    EventRefType,\n    EventScope,\n    IdentityType,\n    ScopeName,\n    SessionAuthMethod,\n} from '@authup/core-kit';\nimport type { IEventService } from '../../entities/index.ts';\nimport type { IAuthFlowMetrics } from '../../metrics/index.ts';\nimport type { ISessionManager } from '../../authentication/index.ts';\nimport { deriveAmrAcr } from '../authorization/helpers.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { IOAuth2TokenIssuer, IOAuth2TokenRepository } from '../token/index.ts';\nimport type {\n    IOAuth2MfaLoginService,\n    OAuth2MfaLoginCompleteInput,\n    OAuth2MfaLoginServiceContext,\n    OAuth2MfaLoginTicket,\n    OAuth2MfaLoginTicketIssueInput,\n    OAuth2MfaLoginTicketIssueOptions,\n} from './types.ts';\n\nexport class OAuth2MfaLoginService implements IOAuth2MfaLoginService {\n    protected sessionManager : ISessionManager;\n\n    protected ticketIssuer : IOAuth2TokenIssuer;\n\n    protected accessTokenIssuer : IOAuth2TokenIssuer;\n\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    protected tokenRepository : IOAuth2TokenRepository;\n\n    protected eventService? : IEventService;\n\n    protected metrics? : IAuthFlowMetrics;\n\n    constructor(ctx: OAuth2MfaLoginServiceContext) {\n        this.sessionManager = ctx.sessionManager;\n        this.ticketIssuer = ctx.ticketIssuer;\n        this.accessTokenIssuer = ctx.accessTokenIssuer;\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n        this.tokenRepository = ctx.tokenRepository;\n        this.eventService = ctx.eventService;\n        this.metrics = ctx.metrics;\n    }\n\n    async issueTicket(\n        input: OAuth2MfaLoginTicketIssueInput,\n        options: OAuth2MfaLoginTicketIssueOptions = {},\n    ) : Promise<OAuth2MfaLoginTicket> {\n        const { user } = input;\n        const clientId = input.clientId ?? undefined;\n\n        // One expiration instant for BOTH artifacts — the pending session\n        // lives exactly as long as the ticket (an abandoned login\n        // self-expires and is swept with the regular session sweep;\n        // completion extends it to the full lifetime). Computed once so\n        // the two cannot drift.\n        const expiresAt = this.ticketIssuer.buildExp();\n\n        const session = await this.sessionManager.create({\n            userAgent: options.userAgent,\n            ipAddress: options.ipAddress,\n            realmId: user.realmId,\n            // no `clientId`: a USER-subject session, and the column is the\n            // client-SUBJECT foreign key. The application rides the ticket\n            // and lands on the token rows at completion.\n            sub: user.id,\n            subKind: IdentityType.USER,\n            mfaAt: null,\n            authMethod: SessionAuthMethod.PASSWORD,\n            expiresAt: new Date(expiresAt * 1000).toISOString(),\n        });\n\n        // No scope, no role claims — the ticket is not a bearer; it only\n        // unlocks the challenge routes (which opt in by kind).\n        const [token, payload] = await this.ticketIssuer.issue({\n            client_id: clientId,\n            session_id: session.id,\n            user_agent: session.userAgent,\n            remote_address: session.ipAddress,\n            sub: user.id,\n            sub_kind: OAuth2SubKind.USER,\n            realm_id: user.realmId,\n            realm_name: user.realm?.name,\n            ...(input.confirmation ? { cnf: input.confirmation } : {}),\n            exp: expiresAt,\n        });\n\n        return {\n            token,\n            expiresIn: payload.exp ?\n                payload.exp - Math.floor(Date.now() / 1000) :\n                0,\n        };\n    }\n\n    async complete(input: OAuth2MfaLoginCompleteInput) : Promise<OAuth2TokenGrantResponse> {\n        const { ticket } = input;\n\n        // Extend the ticket-scoped pending session to the regular session\n        // lifetime — the login is complete now.\n        const session = await this.sessionManager.refresh(input.session);\n\n        // mfaAt was stamped inside the verify unit of work, so the claims\n        // advertise the completed factor (amr +otp, acr urn:authup:mfa).\n        const amrAcr = deriveAmrAcr(session);\n\n        // Single use: atomically claim the ticket BEFORE minting so two\n        // concurrent completions (a mixed-kind user presenting two distinct\n        // fresh factors) cannot both issue a token pair — `claimInactive` is a\n        // set-if-absent write, so exactly one racer wins. The trade-off vs.\n        // claiming after minting is that a mint failure burns the ticket — the\n        // safer bias for a single-use login credential (the user re-authenticates).\n        if (ticket.jti) {\n            const claimed = await this.tokenRepository.claimInactive(ticket.jti, ticket.exp);\n            if (!claimed) {\n                throw OAuth2GrantError.invalid('mfa login ticket has already been used');\n            }\n        }\n\n        const issuePayload : Partial<OAuth2TokenPayload> = {\n            client_id: ticket.client_id ?? undefined,\n            session_id: session.id,\n            user_agent: session.userAgent,\n            remote_address: session.ipAddress,\n            scope: ScopeName.GLOBAL,\n            sub: session.sub,\n            sub_kind: OAuth2SubKind.USER,\n            realm_id: session.realmId,\n            realm_name: ticket.realm_name,\n            ...(ticket.cnf ? { cnf: ticket.cnf } : {}),\n            ...amrAcr,\n        };\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);\n\n        await this.eventService?.record({\n            scope: EventScope.OAUTH2,\n            name: EventName.LOGIN,\n            refType: EventRefType.SESSION,\n            refId: session.id,\n            clientId: ticket.client_id ?? null,\n            sessionId: session.id,\n            actorType: IdentityType.USER,\n            actorId: session.sub,\n            actorName: input.userName ?? null,\n            realmId: session.realmId,\n            requestIpAddress: session.ipAddress ?? null,\n            requestUserAgent: session.userAgent ?? null,\n            data: { grantType: OAuth2TokenGrant.PASSWORD },\n        });\n        this.metrics?.recordLogin('success');\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;;;;AAgCA,IAAaW,wBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAmC;EAC3C,KAAKP,iBAAiBO,IAAIP;EAC1B,KAAKC,eAAeM,IAAIN;EACxB,KAAKC,oBAAoBK,IAAIL;EAC7B,KAAKC,qBAAqBI,IAAIJ;EAC9B,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,eAAeE,IAAIF;EACxB,KAAKC,UAAUC,IAAID;CACvB;CAEA,MAAME,YACFC,OACAC,UAA4C,CAAC,GACf;EAC9B,MAAM,EAAEC,SAASF;EACjB,MAAMG,WAAWH,MAAMG,YAAYC,KAAAA;EAOnC,MAAMC,YAAY,KAAKb,aAAac,SAAQ;EAE5C,MAAMC,UAAU,MAAM,KAAKhB,eAAeiB,OAAO;GAC7CC,WAAWR,QAAQQ;GACnBC,WAAWT,QAAQS;GACnBC,SAAST,KAAKS;GAIdC,KAAKV,KAAKW;GACVC,SAAS7B,aAAa8B;GACtBC,OAAO;GACPC,YAAY9B,kBAAkB+B;GAC9Bb,4BAAW,IAAIc,KAAKd,YAAY,GAAA,EAAA,CAAMe,YAAW;EACrD,CAAA;EAIA,MAAM,CAACC,OAAOC,WAAW,MAAM,KAAK9B,aAAa+B,MAAM;GACnDC,WAAWrB;GACXsB,YAAYlB,QAAQM;GACpBa,YAAYnB,QAAQE;GACpBkB,gBAAgBpB,QAAQG;GACxBE,KAAKV,KAAKW;GACVe,UAAUhD,cAAcmC;GACxBc,UAAU3B,KAAKS;GACfmB,YAAY5B,KAAK6B,OAAOC;GACxB,GAAIhC,MAAMiC,eAAe,EAAEC,KAAKlC,MAAMiC,aAAa,IAAI,CAAC;GACxDE,KAAK9B;EACT,CAAA;EAEA,OAAO;GACHgB;GACAe,WAAWd,QAAQa,MACfb,QAAQa,MAAME,KAAKC,MAAMnB,KAAKoB,IAAG,IAAK,GAAA,IACtC;EACR;CACJ;CAEA,MAAMC,SAASxC,OAAwE;EACnF,MAAM,EAAEyC,WAAWzC;EAInB,MAAMO,UAAU,MAAM,KAAKhB,eAAemD,QAAQ1C,MAAMO,OAAO;EAI/D,MAAMoC,SAASvD,aAAamB,OAAAA;EAQ5B,IAAIkC,OAAOG,KAEH;OAAA,CAACC,MADiB,KAAKlD,gBAAgBmD,cAAcL,OAAOG,KAAKH,OAAON,GAAG,GAE3E,MAAMxD,iBAAiBoE,QAAQ,wCAAA;EAAA;EAIvC,MAAMC,eAA6C;GAC/CxB,WAAWiB,OAAOjB,aAAapB,KAAAA;GAC/BqB,YAAYlB,QAAQM;GACpBa,YAAYnB,QAAQE;GACpBkB,gBAAgBpB,QAAQG;GACxBuC,OAAO/D,UAAUgE;GACjBtC,KAAKL,QAAQK;GACbgB,UAAUhD,cAAcmC;GACxBc,UAAUtB,QAAQI;GAClBmB,YAAYW,OAAOX;GACnB,GAAIW,OAAOP,MAAM,EAAEA,KAAKO,OAAOP,IAAI,IAAI,CAAC;GACxC,GAAGS;EACP;EAEA,MAAM,CAACQ,aAAaC,sBAAsB,MAAM,KAAK3D,kBAAkB8B,MAAMyB,YAAAA;EAC7E,MAAM,CAACK,cAAcC,uBAAuB,MAAM,KAAK5D,mBAAmB6B,MAAMyB,YAAAA;EAEhF,MAAM,KAAKpD,cAAc2D,OAAO;GAC5BN,OAAOjE,WAAWwE;GAClBxB,MAAMlD,UAAU2E;GAChBC,SAAS3E,aAAa4E;GACtBC,OAAOrD,QAAQM;GACfV,UAAUsC,OAAOjB,aAAa;GAC9BqC,WAAWtD,QAAQM;GACnBiD,WAAW7E,aAAa8B;GACxBgD,SAASxD,QAAQK;GACjBoD,WAAWhE,MAAMiE,YAAY;GAC7BtD,SAASJ,QAAQI;GACjBuD,kBAAkB3D,QAAQG,aAAa;GACvCyD,kBAAkB5D,QAAQE,aAAa;GACvC2D,MAAM,EAAEC,WAAWxF,iBAAiBqC,SAAS;EACjD,CAAA;EACA,KAAKrB,SAASyE,YAAY,SAAA;EAE1B,OAAOjF,+BAA+B;GAClC8D;GACAC;GACAC;GACAC;EACJ,CAAA;CACJ;AACJ"}

package/dist/core/oauth2/session-token/error.d.ts

@@ -0,0 +1,36 @@
+import { ValidationError } from '@authup/errors';
+export declare const SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE: unique symbol;
+/**
+ * A row the token references no longer exists.
+ *
+ * Raised by the repository adapter when the inventory insert is rejected by a
+ * foreign key. Both parents can vanish between the caller resolving them and
+ * the write landing: the session (a concurrent refresh-token replay reaction,
+ * an explicit logout, an admin force-logout, the session sweeper) and the
+ * client the token is attributed to (an admin deleting the application).
+ *
+ * The error deliberately does NOT name which one. Only postgres reports the
+ * failing constraint as a field; mysql buries it in the message text and sqlite
+ * reports nothing but "FOREIGN KEY constraint failed", so a per-relation
+ * classification would be unimplementable on the dialect the test suite runs
+ * on. It also would not buy anything: both parents cascade onto
+ * `auth_session_tokens`, so either one going missing has already deleted the
+ * token rows, and the answer for the caller is the same.
+ *
+ * Transport-agnostic on purpose: the refresh grant re-raises it as
+ * `invalid_grant`, every other issuing path lets it settle as the 400 its code
+ * maps to.
+ */
+export declare class SessionTokenRelationMissingError extends ValidationError {
+    constructor();
+}
+/**
+ * Deliberately marker-only, with no `code` fallback: `ENTITY_RELATION_INVALID`
+ * is the shared code for every invalid relation reference (`sanitizeError`
+ * assigns it to typeorm-extension's join-column lookup failures too), so
+ * matching on it would claim unrelated errors. The error never crosses a wire
+ * boundary before it is caught, so there is nothing for a rehydrated match to
+ * recover.
+ */
+export declare function isSessionTokenRelationMissingError(input: unknown): input is SessionTokenRelationMissingError;
+//# sourceMappingURL=error.d.ts.map

package/dist/core/oauth2/session-token/error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/session-token/error.ts"],"names":[],"mappings":"AAOA,OAAO,EAEH,eAAe,EAGlB,MAAM,gBAAgB,CAAC;AAExB,eAAO,MAAM,6CAA6C,eAAqE,CAAC;AAEhI;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,gCAAiC,SAAQ,eAAe;;CAQpE;AAED;;;;;;;GAOG;AACH,wBAAgB,kCAAkC,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,gCAAgC,CAE5G"}

package/dist/core/oauth2/session-token/error.mjs

@@ -0,0 +1,49 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { ErrorCode, ValidationError, markInstanceof, matchesInstanceof } from "@authup/errors";
+//#region src/core/oauth2/session-token/error.ts
+const SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE = Symbol.for("@authup/server-core/SessionTokenRelationMissingError");
+/**
+* A row the token references no longer exists.
+*
+* Raised by the repository adapter when the inventory insert is rejected by a
+* foreign key. Both parents can vanish between the caller resolving them and
+* the write landing: the session (a concurrent refresh-token replay reaction,
+* an explicit logout, an admin force-logout, the session sweeper) and the
+* client the token is attributed to (an admin deleting the application).
+*
+* The error deliberately does NOT name which one. Only postgres reports the
+* failing constraint as a field; mysql buries it in the message text and sqlite
+* reports nothing but "FOREIGN KEY constraint failed", so a per-relation
+* classification would be unimplementable on the dialect the test suite runs
+* on. It also would not buy anything: both parents cascade onto
+* `auth_session_tokens`, so either one going missing has already deleted the
+* token rows, and the answer for the caller is the same.
+*
+* Transport-agnostic on purpose: the refresh grant re-raises it as
+* `invalid_grant`, every other issuing path lets it settle as the 400 its code
+* maps to.
+*/ var SessionTokenRelationMissingError = class extends ValidationError {
+	constructor() {
+		super({
+			code: ErrorCode.ENTITY_RELATION_INVALID,
+			message: "A row the token references no longer exists."
+		});
+		markInstanceof(this, SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE);
+	}
+};
+/**
+* Deliberately marker-only, with no `code` fallback: `ENTITY_RELATION_INVALID`
+* is the shared code for every invalid relation reference (`sanitizeError`
+* assigns it to typeorm-extension's join-column lookup failures too), so
+* matching on it would claim unrelated errors. The error never crosses a wire
+* boundary before it is caught, so there is nothing for a rehydrated match to
+* recover.
+*/ function isSessionTokenRelationMissingError(input) {
+	return matchesInstanceof(input, SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE);
+}
+//#endregion
+export { SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE, SessionTokenRelationMissingError, isSessionTokenRelationMissingError };
+
+//# sourceMappingURL=error.mjs.map

package/dist/core/oauth2/session-token/error.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.mjs","names":["ErrorCode","ValidationError","markInstanceof","matchesInstanceof","SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE","Symbol","for","SessionTokenRelationMissingError","code","ENTITY_RELATION_INVALID","message","isSessionTokenRelationMissingError","input"],"sources":["../../../../src/core/oauth2/session-token/error.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    ErrorCode,\n    ValidationError,\n    markInstanceof,\n    matchesInstanceof,\n} from '@authup/errors';\n\nexport const SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE = Symbol.for('@authup/server-core/SessionTokenRelationMissingError');\n\n/**\n * A row the token references no longer exists.\n *\n * Raised by the repository adapter when the inventory insert is rejected by a\n * foreign key. Both parents can vanish between the caller resolving them and\n * the write landing: the session (a concurrent refresh-token replay reaction,\n * an explicit logout, an admin force-logout, the session sweeper) and the\n * client the token is attributed to (an admin deleting the application).\n *\n * The error deliberately does NOT name which one. Only postgres reports the\n * failing constraint as a field; mysql buries it in the message text and sqlite\n * reports nothing but \"FOREIGN KEY constraint failed\", so a per-relation\n * classification would be unimplementable on the dialect the test suite runs\n * on. It also would not buy anything: both parents cascade onto\n * `auth_session_tokens`, so either one going missing has already deleted the\n * token rows, and the answer for the caller is the same.\n *\n * Transport-agnostic on purpose: the refresh grant re-raises it as\n * `invalid_grant`, every other issuing path lets it settle as the 400 its code\n * maps to.\n */\nexport class SessionTokenRelationMissingError extends ValidationError {\n    constructor() {\n        super({\n            code: ErrorCode.ENTITY_RELATION_INVALID,\n            message: 'A row the token references no longer exists.',\n        });\n        markInstanceof(this, SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE);\n    }\n}\n\n/**\n * Deliberately marker-only, with no `code` fallback: `ENTITY_RELATION_INVALID`\n * is the shared code for every invalid relation reference (`sanitizeError`\n * assigns it to typeorm-extension's join-column lookup failures too), so\n * matching on it would claim unrelated errors. The error never crosses a wire\n * boundary before it is caught, so there is nothing for a rehydrated match to\n * recover.\n */\nexport function isSessionTokenRelationMissingError(input: unknown): input is SessionTokenRelationMissingError {\n    return matchesInstanceof(input, SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE);\n}\n"],"mappings":";;;;;AAcA,MAAaI,gDAAgDC,OAAOC,IAAI,sDAAA;;;;;;;;;;;;;;;;;;;;;GAuBxE,IAAaC,mCAAb,cAAsDN,gBAAAA;CAClD,cAAc;EACV,MAAM;GACFO,MAAMR,UAAUS;GAChBC,SAAS;EACb,CAAA;EACAR,eAAe,MAAME,6CAAAA;CACzB;AACJ;;;;;;;;GAUA,SAAgBO,mCAAmCC,OAAc;CAC7D,OAAOT,kBAAkBS,OAAOR,6CAAAA;AACpC"}

package/dist/core/oauth2/session-token/index.d.ts

@@ -1,2 +1,3 @@
+export * from './error.ts';
 export * from './types.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/session-token/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/session-token/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/session-token/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC"}

package/dist/core/oauth2/session-token/index.mjs

@@ -1,4 +1,5 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-export {};
+import { SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE, SessionTokenRelationMissingError, isSessionTokenRelationMissingError } from "./error.mjs";
+export { SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE, SessionTokenRelationMissingError, isSessionTokenRelationMissingError };

package/dist/core/oauth2/session-token/types.d.ts

@@ -1,7 +1,14 @@
 import type { SessionToken, SessionTokenKind } from '@authup/core-kit';
+import type { IQuery } from '@rapiq/core';
+import type { EntityRepositoryFindManyResult } from '@authup/server-kit';
 export type SessionTokenCreateInput = {
     id: string;
     sessionId: string;
+    /**
+     * The client the token is issued for. Optional: a mint site that knows no
+     * client (an MFA-login completion) persists null rather than guessing.
+     */
+    clientId?: string | null;
     kind: SessionTokenKind;
     parentId?: string | null;
     refreshTokenId?: string | null;
@@ -14,8 +21,41 @@ export type SessionTokenRef = {
     expiresAt: string;
 };
 export interface ISessionTokenRepository {
+    /**
+     * Paginated inventory read.
+     *
+     * The `session` relation is joined unconditionally, because the caller's
+     * authorization resolves through it: the rows carry no realm or subject of
+     * their own. A `fields` projection must not be able to strip what the gate
+     * reads (the plan-039 discipline, through a relation instead of a column).
+     */
+    findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<SessionToken>>;
+    /**
+     * Load EVERY row matching a query, unbounded. A bulk revoke must reach
+     * every match, so the schema's pagination cap is deliberately not applied
+     * (same reasoning as `ISessionRepository.findAllByQuery`).
+     */
+    findAllByQuery(query: IQuery): Promise<SessionToken[]>;
+    /**
+     * Load one row by jti WITH its session joined.
+     *
+     * Separate from `findOneById` because authorization resolves through the
+     * session: ownership and realm both live there, and a row without it fails
+     * closed. Deliberately not expressed as a query, so the lookup cannot be
+     * weakened by a decode that silently drops the predicate.
+     */
+    findOneWithSessionById(id: string): Promise<SessionToken | null>;
     /**
      * Persist a newly issued session-token row.
+     *
+     * Throws `SessionTokenRelationMissingError` when a row the token references
+     * is gone: `sessionId`, or the `clientId` it is attributed to. Both are
+     * resolved before the write, so a concurrent delete (a replay reaction, a
+     * logout, the sweeper, an application being removed) can land in between
+     * and the write is then rejected. Which of the two it was is deliberately
+     * not reported, since both cascade onto this table and so leave the token
+     * equally unusable. Callers that own an OAuth2 error vocabulary translate
+     * it; the rest let it settle as a plain validation failure.
      */
     create(input: SessionTokenCreateInput): Promise<SessionToken>;
     /**

package/dist/core/oauth2/session-token/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/session-token/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEvE,MAAM,MAAM,uBAAuB,GAAG;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,gBAAgB,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,WAAW,uBAAuB;IACpC;;OAEG;IACH,MAAM,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAE9D;;OAEG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAEtD;;OAEG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAE5D;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE9D;;;;;;;OAOG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAErD;;;;;OAKG;IACH,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElD;;;;;;;OAOG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAE7E;;;;OAIG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAClD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/session-token/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAEzE,MAAM,MAAM,uBAAuB,GAAG;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,gBAAgB,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,WAAW,uBAAuB;IACpC;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,8BAA8B,CAAC,YAAY,CAAC,CAAC,CAAC;IAE/E;;;;OAIG;IACH,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAEvD;;;;;;;OAOG;IACH,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAEjE;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAE9D;;OAEG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAEtD;;OAEG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAE5D;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE9D;;;;;;;OAOG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAErD;;;;;OAKG;IACH,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElD;;;;;;;OAOG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAE7E;;;;OAIG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAClD"}

package/dist/core/oauth2/token/issuer/access/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/token/issuer/access/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAC3G,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAE3E,qBAAa,uBAAwB,SAAQ,qBAAsB,YAAW,kBAAkB;IAC5F,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,MAAM,EAAG,kBAAkB,CAAC;IAEtC,SAAS,CAAC,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAEvD,SAAS,CAAC,sBAAsB,CAAC,EAAE,uBAAuB,CAAC;gBAGvD,UAAU,EAAE,sBAAsB,EAClC,MAAM,EAAE,kBAAkB,EAC1B,OAAO,GAAE,wBAA6B,EACtC,oBAAoB,CAAC,EAAE,qBAAqB,EAC5C,sBAAsB,CAAC,EAAE,uBAAuB;IAU9C,KAAK,CAAC,KAAK,GAAE,kBAAuB,GAAI,OAAO,CAAC,yBAAyB,CAAC;cAgChE,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,GAAI,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,cAAc,GAAG,eAAe,CAAC,CAAC;CA6BrI"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/token/issuer/access/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EACR,kBAAkB,EAClB,wBAAwB,EACxB,yBAAyB,EAC5B,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAE3E,qBAAa,uBAAwB,SAAQ,qBAAsB,YAAW,kBAAkB;IAC5F,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,MAAM,EAAG,kBAAkB,CAAC;IAEtC,SAAS,CAAC,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAEvD,SAAS,CAAC,sBAAsB,CAAC,EAAE,uBAAuB,CAAC;gBAGvD,UAAU,EAAE,sBAAsB,EAClC,MAAM,EAAE,kBAAkB,EAC1B,OAAO,GAAE,wBAA6B,EACtC,oBAAoB,CAAC,EAAE,qBAAqB,EAC5C,sBAAsB,CAAC,EAAE,uBAAuB;IAU9C,KAAK,CACP,KAAK,GAAE,kBAAuB,GAC9B,OAAO,CAAC,yBAAyB,CAAC;cAwCtB,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,GAAI,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,cAAc,GAAG,eAAe,CAAC,CAAC;CA6BrI"}

package/dist/core/oauth2/token/issuer/access/module.mjs

@@ -31,6 +31,7 @@ var OAuth2AccessTokenIssuer = class extends OAuth2BaseTokenIssuer {
 		if (this.sessionTokenRepository && data.session_id && data.jti && typeof data.exp === "number") await this.sessionTokenRepository.create({
 			id: data.jti,
 			sessionId: data.session_id,
+			clientId: data.client_id ?? null,
 			kind: "access",
 			refreshTokenId: input.refresh_token_id ?? null,
 			ipAddress: data.remote_address ?? "",

package/dist/core/oauth2/token/issuer/access/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2TokenKind","OAuth2BaseTokenIssuer","OAuth2AccessTokenIssuer","repository","signer","identityRoleProvider","sessionTokenRepository","options","issue","input","iss","buildIss","accessClaims","buildAccessClaims","data","insert","kind","ACCESS","exp","buildExp","token","sign","saveWithSignature","session_id","jti","create","id","sessionId","refreshTokenId","refresh_token_id","ipAddress","remote_address","userAgent","user_agent","expiresAt","Date","toISOString","sub","sub_kind","roles","getRolesFor","type","clientId","client_id","realmId","realm_id","realmName","realm_name","realmRoles","globalRoles","role","push","name","realm_access","global_access"],"sources":["../../../../../../src/core/oauth2/token/issuer/access/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport type { ISessionTokenRepository } from '../../../session-token/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';\nimport type { IIdentityRoleProvider } from '../../../../identity/index.ts';\n\nexport class OAuth2AccessTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    protected identityRoleProvider?: IIdentityRoleProvider;\n\n    protected sessionTokenRepository?: ISessionTokenRepository;\n\n    constructor(\n        repository: IOAuth2TokenRepository,\n        signer: IOAuth2TokenSigner,\n        options: OAuth2TokenIssuerOptions = {},\n        identityRoleProvider?: IIdentityRoleProvider,\n        sessionTokenRepository?: ISessionTokenRepository,\n    ) {\n        super(options);\n\n        this.repository = repository;\n        this.signer = signer;\n        this.identityRoleProvider = identityRoleProvider;\n        this.sessionTokenRepository = sessionTokenRepository;\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        const iss = this.buildIss(input);\n\n        const accessClaims = await this.buildAccessClaims(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            kind: OAuth2TokenKind.ACCESS,\n            exp: this.buildExp(input),\n            ...(iss ? { iss } : {}),\n            ...accessClaims,\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        if (this.sessionTokenRepository && data.session_id && data.jti && typeof data.exp === 'number') {\n            await this.sessionTokenRepository.create({\n                id: data.jti,\n                sessionId: data.session_id,\n                kind: 'access',\n                refreshTokenId: input.refresh_token_id ?? null,\n                ipAddress: data.remote_address ?? '',\n                userAgent: data.user_agent ?? '',\n                expiresAt: new Date(data.exp * 1000).toISOString(),\n            });\n        }\n\n        return [token, data];\n    }\n\n    protected async buildAccessClaims(input: OAuth2TokenPayload) : Promise<Pick<OAuth2TokenPayload, 'realm_access' | 'global_access'>> {\n        if (!this.identityRoleProvider || !input.sub || !input.sub_kind) {\n            return {};\n        }\n\n        const roles = await this.identityRoleProvider.getRolesFor({\n            type: input.sub_kind,\n            id: input.sub,\n            clientId: input.client_id,\n            realmId: input.realm_id,\n            realmName: input.realm_name,\n        });\n\n        const realmRoles: string[] = [];\n        const globalRoles: string[] = [];\n\n        for (const role of roles) {\n            if (!role.realmId) {\n                globalRoles.push(role.name);\n            } else if (input.realm_id && role.realmId === input.realm_id) {\n                realmRoles.push(role.name);\n            }\n        }\n\n        return {\n            realm_access: { roles: realmRoles },\n            global_access: { roles: globalRoles },\n        };\n    }\n}\n"],"mappings":";;;;;;AAgBA,IAAaE,0BAAb,cAA6CD,sBAAAA;CAC/BE;CAEAC;CAEAC;CAEAC;CAEV,YACIH,YACAC,QACAG,UAAoC,CAAC,GACrCF,sBACAC,wBACF;EACE,MAAMC,OAAAA;EAEN,KAAKJ,aAAaA;EAClB,KAAKC,SAASA;EACd,KAAKC,uBAAuBA;EAC5B,KAAKC,yBAAyBA;CAClC;CAEA,MAAME,MAAMC,QAA4B,CAAC,GAAwC;EAC7E,MAAMC,MAAM,KAAKC,SAASF,KAAAA;EAE1B,MAAMG,eAAe,MAAM,KAAKC,kBAAkBJ,KAAAA;EAElD,MAAMK,OAAO,MAAM,KAAKX,WAAWY,OAAO;GACtC,GAAGN;GACHO,MAAMhB,gBAAgBiB;GACtBC,KAAK,KAAKC,SAASV,KAAAA;GACnB,GAAIC,MAAM,EAAEA,IAAI,IAAI,CAAC;GACrB,GAAGE;EACP,CAAA;EAEA,MAAMQ,QAAQ,MAAM,KAAKhB,OAAOiB,KAAKP,IAAAA;EAErC,MAAM,KAAKX,WAAWmB,kBAAkBR,MAAMM,KAAAA;EAE9C,IAAI,KAAKd,0BAA0BQ,KAAKS,cAAcT,KAAKU,OAAO,OAAOV,KAAKI,QAAQ,UAClF,MAAM,KAAKZ,uBAAuBmB,OAAO;GACrCC,IAAIZ,KAAKU;GACTG,WAAWb,KAAKS;GAChBP,MAAM;GACNY,gBAAgBnB,MAAMoB,oBAAoB;GAC1CC,WAAWhB,KAAKiB,kBAAkB;GAClCC,WAAWlB,KAAKmB,cAAc;GAC9BC,4BAAW,IAAIC,KAAKrB,KAAKI,MAAM,GAAA,EAAA,CAAMkB,YAAW;EACpD,CAAA;EAGJ,OAAO,CAAChB,OAAON,IAAK;CACxB;CAEA,MAAgBD,kBAAkBJ,OAAiG;EAC/H,IAAI,CAAC,KAAKJ,wBAAwB,CAACI,MAAM4B,OAAO,CAAC5B,MAAM6B,UACnD,OAAO,CAAC;EAGZ,MAAMC,QAAQ,MAAM,KAAKlC,qBAAqBmC,YAAY;GACtDC,MAAMhC,MAAM6B;GACZZ,IAAIjB,MAAM4B;GACVK,UAAUjC,MAAMkC;GAChBC,SAASnC,MAAMoC;GACfC,WAAWrC,MAAMsC;EACrB,CAAA;EAEA,MAAMC,aAAuB,CAAA;EAC7B,MAAMC,cAAwB,CAAA;EAE9B,KAAK,MAAMC,QAAQX,OACf,IAAI,CAACW,KAAKN,SACNK,YAAYE,KAAKD,KAAKE,IAAI;OACvB,IAAI3C,MAAMoC,YAAYK,KAAKN,YAAYnC,MAAMoC,UAChDG,WAAWG,KAAKD,KAAKE,IAAI;EAIjC,OAAO;GACHC,cAAc,EAAEd,OAAOS,WAAW;GAClCM,eAAe,EAAEf,OAAOU,YAAY;EACxC;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["OAuth2TokenKind","OAuth2BaseTokenIssuer","OAuth2AccessTokenIssuer","repository","signer","identityRoleProvider","sessionTokenRepository","options","issue","input","iss","buildIss","accessClaims","buildAccessClaims","data","insert","kind","ACCESS","exp","buildExp","token","sign","saveWithSignature","session_id","jti","create","id","sessionId","clientId","client_id","refreshTokenId","refresh_token_id","ipAddress","remote_address","userAgent","user_agent","expiresAt","Date","toISOString","sub","sub_kind","roles","getRolesFor","type","realmId","realm_id","realmName","realm_name","realmRoles","globalRoles","role","push","name","realm_access","global_access"],"sources":["../../../../../../src/core/oauth2/token/issuer/access/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport type { ISessionTokenRepository } from '../../../session-token/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type {\n    IOAuth2TokenIssuer,\n    OAuth2TokenIssuerOptions,\n    OAuth2TokenIssuerResponse,\n} from '../types.ts';\nimport type { IIdentityRoleProvider } from '../../../../identity/index.ts';\n\nexport class OAuth2AccessTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    protected identityRoleProvider?: IIdentityRoleProvider;\n\n    protected sessionTokenRepository?: ISessionTokenRepository;\n\n    constructor(\n        repository: IOAuth2TokenRepository,\n        signer: IOAuth2TokenSigner,\n        options: OAuth2TokenIssuerOptions = {},\n        identityRoleProvider?: IIdentityRoleProvider,\n        sessionTokenRepository?: ISessionTokenRepository,\n    ) {\n        super(options);\n\n        this.repository = repository;\n        this.signer = signer;\n        this.identityRoleProvider = identityRoleProvider;\n        this.sessionTokenRepository = sessionTokenRepository;\n    }\n\n    async issue(\n        input: OAuth2TokenPayload = {},\n    ) : Promise<OAuth2TokenIssuerResponse> {\n        const iss = this.buildIss(input);\n\n        const accessClaims = await this.buildAccessClaims(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            kind: OAuth2TokenKind.ACCESS,\n            exp: this.buildExp(input),\n            ...(iss ? { iss } : {}),\n            ...accessClaims,\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        if (\n            this.sessionTokenRepository &&\n            data.session_id &&\n            data.jti &&\n            typeof data.exp === 'number'\n        ) {\n            await this.sessionTokenRepository.create({\n                id: data.jti,\n                sessionId: data.session_id,\n                // Per-application attribution (plan 086). The same client the\n                // payload was minted for, so the row needs no extra lookup.\n                clientId: data.client_id ?? null,\n                kind: 'access',\n                refreshTokenId: input.refresh_token_id ?? null,\n                ipAddress: data.remote_address ?? '',\n                userAgent: data.user_agent ?? '',\n                expiresAt: new Date(data.exp * 1000).toISOString(),\n            });\n        }\n\n        return [token, data];\n    }\n\n    protected async buildAccessClaims(input: OAuth2TokenPayload) : Promise<Pick<OAuth2TokenPayload, 'realm_access' | 'global_access'>> {\n        if (!this.identityRoleProvider || !input.sub || !input.sub_kind) {\n            return {};\n        }\n\n        const roles = await this.identityRoleProvider.getRolesFor({\n            type: input.sub_kind,\n            id: input.sub,\n            clientId: input.client_id,\n            realmId: input.realm_id,\n            realmName: input.realm_name,\n        });\n\n        const realmRoles: string[] = [];\n        const globalRoles: string[] = [];\n\n        for (const role of roles) {\n            if (!role.realmId) {\n                globalRoles.push(role.name);\n            } else if (input.realm_id && role.realmId === input.realm_id) {\n                realmRoles.push(role.name);\n            }\n        }\n\n        return {\n            realm_access: { roles: realmRoles },\n            global_access: { roles: globalRoles },\n        };\n    }\n}\n"],"mappings":";;;;;;AAoBA,IAAaE,0BAAb,cAA6CD,sBAAAA;CAC/BE;CAEAC;CAEAC;CAEAC;CAEV,YACIH,YACAC,QACAG,UAAoC,CAAC,GACrCF,sBACAC,wBACF;EACE,MAAMC,OAAAA;EAEN,KAAKJ,aAAaA;EAClB,KAAKC,SAASA;EACd,KAAKC,uBAAuBA;EAC5B,KAAKC,yBAAyBA;CAClC;CAEA,MAAME,MACFC,QAA4B,CAAC,GACM;EACnC,MAAMC,MAAM,KAAKC,SAASF,KAAAA;EAE1B,MAAMG,eAAe,MAAM,KAAKC,kBAAkBJ,KAAAA;EAElD,MAAMK,OAAO,MAAM,KAAKX,WAAWY,OAAO;GACtC,GAAGN;GACHO,MAAMhB,gBAAgBiB;GACtBC,KAAK,KAAKC,SAASV,KAAAA;GACnB,GAAIC,MAAM,EAAEA,IAAI,IAAI,CAAC;GACrB,GAAGE;EACP,CAAA;EAEA,MAAMQ,QAAQ,MAAM,KAAKhB,OAAOiB,KAAKP,IAAAA;EAErC,MAAM,KAAKX,WAAWmB,kBAAkBR,MAAMM,KAAAA;EAE9C,IACI,KAAKd,0BACLQ,KAAKS,cACLT,KAAKU,OACL,OAAOV,KAAKI,QAAQ,UAEpB,MAAM,KAAKZ,uBAAuBmB,OAAO;GACrCC,IAAIZ,KAAKU;GACTG,WAAWb,KAAKS;GAGhBK,UAAUd,KAAKe,aAAa;GAC5Bb,MAAM;GACNc,gBAAgBrB,MAAMsB,oBAAoB;GAC1CC,WAAWlB,KAAKmB,kBAAkB;GAClCC,WAAWpB,KAAKqB,cAAc;GAC9BC,4BAAW,IAAIC,KAAKvB,KAAKI,MAAM,GAAA,EAAA,CAAMoB,YAAW;EACpD,CAAA;EAGJ,OAAO,CAAClB,OAAON,IAAK;CACxB;CAEA,MAAgBD,kBAAkBJ,OAAiG;EAC/H,IAAI,CAAC,KAAKJ,wBAAwB,CAACI,MAAM8B,OAAO,CAAC9B,MAAM+B,UACnD,OAAO,CAAC;EAGZ,MAAMC,QAAQ,MAAM,KAAKpC,qBAAqBqC,YAAY;GACtDC,MAAMlC,MAAM+B;GACZd,IAAIjB,MAAM8B;GACVX,UAAUnB,MAAMoB;GAChBe,SAASnC,MAAMoC;GACfC,WAAWrC,MAAMsC;EACrB,CAAA;EAEA,MAAMC,aAAuB,CAAA;EAC7B,MAAMC,cAAwB,CAAA;EAE9B,KAAK,MAAMC,QAAQT,OACf,IAAI,CAACS,KAAKN,SACNK,YAAYE,KAAKD,KAAKE,IAAI;OACvB,IAAI3C,MAAMoC,YAAYK,KAAKN,YAAYnC,MAAMoC,UAChDG,WAAWG,KAAKD,KAAKE,IAAI;EAIjC,OAAO;GACHC,cAAc,EAAEZ,OAAOO,WAAW;GAClCM,eAAe,EAAEb,OAAOQ,YAAY;EACxC;CACJ;AACJ"}

package/dist/core/oauth2/token/issuer/base.d.ts

@@ -3,7 +3,7 @@ import type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerRes
 export declare abstract class OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {
     protected options: OAuth2TokenIssuerOptions;
     protected constructor(options?: OAuth2TokenIssuerOptions);
-    abstract issue(input: OAuth2TokenPayload, options?: OAuth2TokenIssuerOptions): Promise<OAuth2TokenIssuerResponse>;
+    abstract issue(input: OAuth2TokenPayload): Promise<OAuth2TokenIssuerResponse>;
     buildIss(input?: OAuth2TokenPayload): string | undefined;
     /**
      * Build utc expire time (in seconds).

package/dist/core/oauth2/token/issuer/base.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/token/issuer/base.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAE1G,8BAAsB,qBAAsB,YAAW,kBAAkB;IACrE,SAAS,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAI5C,SAAS,aAAa,OAAO,CAAC,EAAE,wBAAwB;IAMxD,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,kBAAkB,EAAE,OAAO,CAAC,EAAE,wBAAwB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAIjH,QAAQ,CAAC,KAAK,GAAE,kBAAuB,GAAI,MAAM,GAAG,SAAS;IAiB7D;;;;OAIG;IACH,QAAQ,CAAC,KAAK,GAAE,kBAAuB,GAAI,MAAM;CAYpD"}
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/token/issuer/base.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EACR,kBAAkB,EAClB,wBAAwB,EACxB,yBAAyB,EAC5B,MAAM,YAAY,CAAC;AAEpB,8BAAsB,qBAAsB,YAAW,kBAAkB;IACrE,SAAS,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAI5C,SAAS,aAAa,OAAO,CAAC,EAAE,wBAAwB;IAMxD,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAI7E,QAAQ,CAAC,KAAK,GAAE,kBAAuB,GAAI,MAAM,GAAG,SAAS;IAiB7D;;;;OAIG;IACH,QAAQ,CAAC,KAAK,GAAE,kBAAuB,GAAI,MAAM;CAYpD"}

package/dist/core/oauth2/token/issuer/base.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"base.mjs","names":["OAuth2BaseTokenIssuer","options","buildIss","input","issuer","undefined","base","replace","realm_name","buildExp","exp","utc","Math","floor","Date","getTime","maxAge"],"sources":["../../../../../src/core/oauth2/token/issuer/base.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from './types.ts';\n\nexport abstract class OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected options: OAuth2TokenIssuerOptions;\n\n    // ------------------------------------------------------------------\n\n    protected constructor(options?: OAuth2TokenIssuerOptions) {\n        this.options = options || {};\n    }\n\n    // ------------------------------------------------------------------\n\n    abstract issue(input: OAuth2TokenPayload, options?: OAuth2TokenIssuerOptions): Promise<OAuth2TokenIssuerResponse>;\n\n    // ------------------------------------------------------------------\n\n    buildIss(input: OAuth2TokenPayload = {}) : string | undefined {\n        if (!this.options.issuer) {\n            return undefined;\n        }\n\n        // Strip a trailing slash so a configured issuer like\n        // `https://auth.example.com/` doesn't produce a malformed\n        // `https://auth.example.com//realms/master`.\n        const base = this.options.issuer.replace(/\\/+$/, '');\n\n        if (input.realm_name) {\n            return `${base}/realms/${input.realm_name}`;\n        }\n\n        return base;\n    }\n\n    /**\n     * Build utc expire time (in seconds).\n     *\n     * @param input\n     */\n    buildExp(input: OAuth2TokenPayload = {}) : number {\n        if (input.exp) {\n            return input.exp;\n        }\n\n        const utc = Math.floor(new Date().getTime() / 1000);\n        if (this.options.maxAge) {\n            return utc + this.options.maxAge;\n        }\n\n        return utc + 3_600;\n    }\n}\n"],"mappings":";;;;AAUA,IAAsBA,wBAAtB,MAAsBA;CACRC;CAIV,YAAsBA,SAAoC;EACtD,KAAKA,UAAUA,WAAW,CAAC;CAC/B;CAQAC,SAASC,QAA4B,CAAC,GAAwB;EAC1D,IAAI,CAAC,KAAKF,QAAQG,QACd;EAMJ,MAAME,OAAO,KAAKL,QAAQG,OAAOG,QAAQ,QAAQ,EAAA;EAEjD,IAAIJ,MAAMK,YACN,OAAO,GAAGF,KAAK,UAAUH,MAAMK;EAGnC,OAAOF;CACX;;;;;IAOAG,SAASN,QAA4B,CAAC,GAAY;EAC9C,IAAIA,MAAMO,KACN,OAAOP,MAAMO;EAGjB,MAAMC,MAAMC,KAAKC,uBAAM,IAAIC,KAAAA,EAAAA,CAAOC,QAAO,IAAK,GAAA;EAC9C,IAAI,KAAKd,QAAQe,QACb,OAAOL,MAAM,KAAKV,QAAQe;EAG9B,OAAOL,MAAM;CACjB;AACJ"}
+{"version":3,"file":"base.mjs","names":["OAuth2BaseTokenIssuer","options","buildIss","input","issuer","undefined","base","replace","realm_name","buildExp","exp","utc","Math","floor","Date","getTime","maxAge"],"sources":["../../../../../src/core/oauth2/token/issuer/base.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport type {\n    IOAuth2TokenIssuer,\n    OAuth2TokenIssuerOptions,\n    OAuth2TokenIssuerResponse,\n} from './types.ts';\n\nexport abstract class OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected options: OAuth2TokenIssuerOptions;\n\n    // ------------------------------------------------------------------\n\n    protected constructor(options?: OAuth2TokenIssuerOptions) {\n        this.options = options || {};\n    }\n\n    // ------------------------------------------------------------------\n\n    abstract issue(input: OAuth2TokenPayload): Promise<OAuth2TokenIssuerResponse>;\n\n    // ------------------------------------------------------------------\n\n    buildIss(input: OAuth2TokenPayload = {}) : string | undefined {\n        if (!this.options.issuer) {\n            return undefined;\n        }\n\n        // Strip a trailing slash so a configured issuer like\n        // `https://auth.example.com/` doesn't produce a malformed\n        // `https://auth.example.com//realms/master`.\n        const base = this.options.issuer.replace(/\\/+$/, '');\n\n        if (input.realm_name) {\n            return `${base}/realms/${input.realm_name}`;\n        }\n\n        return base;\n    }\n\n    /**\n     * Build utc expire time (in seconds).\n     *\n     * @param input\n     */\n    buildExp(input: OAuth2TokenPayload = {}) : number {\n        if (input.exp) {\n            return input.exp;\n        }\n\n        const utc = Math.floor(new Date().getTime() / 1000);\n        if (this.options.maxAge) {\n            return utc + this.options.maxAge;\n        }\n\n        return utc + 3_600;\n    }\n}\n"],"mappings":";;;;AAcA,IAAsBA,wBAAtB,MAAsBA;CACRC;CAIV,YAAsBA,SAAoC;EACtD,KAAKA,UAAUA,WAAW,CAAC;CAC/B;CAQAC,SAASC,QAA4B,CAAC,GAAwB;EAC1D,IAAI,CAAC,KAAKF,QAAQG,QACd;EAMJ,MAAME,OAAO,KAAKL,QAAQG,OAAOG,QAAQ,QAAQ,EAAA;EAEjD,IAAIJ,MAAMK,YACN,OAAO,GAAGF,KAAK,UAAUH,MAAMK;EAGnC,OAAOF;CACX;;;;;IAOAG,SAASN,QAA4B,CAAC,GAAY;EAC9C,IAAIA,MAAMO,KACN,OAAOP,MAAMO;EAGjB,MAAMC,MAAMC,KAAKC,uBAAM,IAAIC,KAAAA,EAAAA,CAAOC,QAAO,IAAK,GAAA;EAC9C,IAAI,KAAKd,QAAQe,QACb,OAAOL,MAAM,KAAKV,QAAQe;EAG9B,OAAOL,MAAM;CACjB;AACJ"}

package/dist/core/oauth2/token/issuer/refresh/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/token/issuer/refresh/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAE3G,qBAAa,wBAAyB,SAAQ,qBAAsB,YAAW,kBAAkB;IAC7F,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,MAAM,EAAG,kBAAkB,CAAC;IAEtC,SAAS,CAAC,sBAAsB,CAAC,EAAE,uBAAuB,CAAC;gBAGvD,UAAU,EAAE,sBAAsB,EAClC,MAAM,EAAE,kBAAkB,EAC1B,OAAO,GAAE,wBAA6B,EACtC,sBAAsB,CAAC,EAAE,uBAAuB;IAS9C,KAAK,CAAC,KAAK,GAAE,kBAAuB,GAAI,OAAO,CAAC,yBAAyB,CAAC;CA4BnF"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/token/issuer/refresh/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EACR,kBAAkB,EAClB,wBAAwB,EACxB,yBAAyB,EAC5B,MAAM,aAAa,CAAC;AAErB,qBAAa,wBAAyB,SAAQ,qBAAsB,YAAW,kBAAkB;IAC7F,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,MAAM,EAAG,kBAAkB,CAAC;IAEtC,SAAS,CAAC,sBAAsB,CAAC,EAAE,uBAAuB,CAAC;gBAGvD,UAAU,EAAE,sBAAsB,EAClC,MAAM,EAAE,kBAAkB,EAC1B,OAAO,GAAE,wBAA6B,EACtC,sBAAsB,CAAC,EAAE,uBAAuB;IAS9C,KAAK,CACP,KAAK,GAAE,kBAAuB,GAC9B,OAAO,CAAC,yBAAyB,CAAC;CAmCzC"}

package/dist/core/oauth2/token/issuer/refresh/module.mjs

@@ -27,6 +27,7 @@ var OAuth2RefreshTokenIssuer = class extends OAuth2BaseTokenIssuer {
 		if (this.sessionTokenRepository && data.session_id && data.jti && typeof data.exp === "number") await this.sessionTokenRepository.create({
 			id: data.jti,
 			sessionId: data.session_id,
+			clientId: data.client_id ?? null,
 			kind: "refresh",
 			parentId: input.parent_id ?? null,
 			ipAddress: data.remote_address ?? "",

package/dist/core/oauth2/token/issuer/refresh/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2TokenKind","OAuth2BaseTokenIssuer","OAuth2RefreshTokenIssuer","repository","signer","sessionTokenRepository","options","issue","input","iss","buildIss","data","insert","kind","REFRESH","exp","buildExp","token","sign","saveWithSignature","session_id","jti","create","id","sessionId","parentId","parent_id","ipAddress","remote_address","userAgent","user_agent","expiresAt","Date","toISOString"],"sources":["../../../../../../src/core/oauth2/token/issuer/refresh/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport type { ISessionTokenRepository } from '../../../session-token/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';\n\nexport class OAuth2RefreshTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    protected sessionTokenRepository?: ISessionTokenRepository;\n\n    constructor(\n        repository: IOAuth2TokenRepository,\n        signer: IOAuth2TokenSigner,\n        options: OAuth2TokenIssuerOptions = {},\n        sessionTokenRepository?: ISessionTokenRepository,\n    ) {\n        super(options);\n\n        this.repository = repository;\n        this.signer = signer;\n        this.sessionTokenRepository = sessionTokenRepository;\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        const iss = this.buildIss(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            kind: OAuth2TokenKind.REFRESH,\n            exp: this.buildExp(input),\n            ...(iss ? { iss } : {}),\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        if (this.sessionTokenRepository && data.session_id && data.jti && typeof data.exp === 'number') {\n            await this.sessionTokenRepository.create({\n                id: data.jti,\n                sessionId: data.session_id,\n                kind: 'refresh',\n                parentId: input.parent_id ?? null,\n                ipAddress: data.remote_address ?? '',\n                userAgent: data.user_agent ?? '',\n                expiresAt: new Date(data.exp * 1000).toISOString(),\n            });\n        }\n\n        return [token, data];\n    }\n}\n"],"mappings":";;;;;;AAeA,IAAaE,2BAAb,cAA8CD,sBAAAA;CAChCE;CAEAC;CAEAC;CAEV,YACIF,YACAC,QACAE,UAAoC,CAAC,GACrCD,wBACF;EACE,MAAMC,OAAAA;EAEN,KAAKH,aAAaA;EAClB,KAAKC,SAASA;EACd,KAAKC,yBAAyBA;CAClC;CAEA,MAAME,MAAMC,QAA4B,CAAC,GAAwC;EAC7E,MAAMC,MAAM,KAAKC,SAASF,KAAAA;EAE1B,MAAMG,OAAO,MAAM,KAAKR,WAAWS,OAAO;GACtC,GAAGJ;GACHK,MAAMb,gBAAgBc;GACtBC,KAAK,KAAKC,SAASR,KAAAA;GACnB,GAAIC,MAAM,EAAEA,IAAI,IAAI,CAAC;EACzB,CAAA;EAEA,MAAMQ,QAAQ,MAAM,KAAKb,OAAOc,KAAKP,IAAAA;EAErC,MAAM,KAAKR,WAAWgB,kBAAkBR,MAAMM,KAAAA;EAE9C,IAAI,KAAKZ,0BAA0BM,KAAKS,cAAcT,KAAKU,OAAO,OAAOV,KAAKI,QAAQ,UAClF,MAAM,KAAKV,uBAAuBiB,OAAO;GACrCC,IAAIZ,KAAKU;GACTG,WAAWb,KAAKS;GAChBP,MAAM;GACNY,UAAUjB,MAAMkB,aAAa;GAC7BC,WAAWhB,KAAKiB,kBAAkB;GAClCC,WAAWlB,KAAKmB,cAAc;GAC9BC,4BAAW,IAAIC,KAAKrB,KAAKI,MAAM,GAAA,EAAA,CAAMkB,YAAW;EACpD,CAAA;EAGJ,OAAO,CAAChB,OAAON,IAAK;CACxB;AACJ"}
+{"version":3,"file":"module.mjs","names":["OAuth2TokenKind","OAuth2BaseTokenIssuer","OAuth2RefreshTokenIssuer","repository","signer","sessionTokenRepository","options","issue","input","iss","buildIss","data","insert","kind","REFRESH","exp","buildExp","token","sign","saveWithSignature","session_id","jti","create","id","sessionId","clientId","client_id","parentId","parent_id","ipAddress","remote_address","userAgent","user_agent","expiresAt","Date","toISOString"],"sources":["../../../../../../src/core/oauth2/token/issuer/refresh/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport type { ISessionTokenRepository } from '../../../session-token/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type {\n    IOAuth2TokenIssuer,\n    OAuth2TokenIssuerOptions,\n    OAuth2TokenIssuerResponse,\n} from '../types.ts';\n\nexport class OAuth2RefreshTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    protected sessionTokenRepository?: ISessionTokenRepository;\n\n    constructor(\n        repository: IOAuth2TokenRepository,\n        signer: IOAuth2TokenSigner,\n        options: OAuth2TokenIssuerOptions = {},\n        sessionTokenRepository?: ISessionTokenRepository,\n    ) {\n        super(options);\n\n        this.repository = repository;\n        this.signer = signer;\n        this.sessionTokenRepository = sessionTokenRepository;\n    }\n\n    async issue(\n        input: OAuth2TokenPayload = {},\n    ) : Promise<OAuth2TokenIssuerResponse> {\n        const iss = this.buildIss(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            kind: OAuth2TokenKind.REFRESH,\n            exp: this.buildExp(input),\n            ...(iss ? { iss } : {}),\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        if (\n            this.sessionTokenRepository &&\n            data.session_id && data.jti &&\n            typeof data.exp === 'number'\n        ) {\n            await this.sessionTokenRepository.create({\n                id: data.jti,\n                sessionId: data.session_id,\n                // Per-application attribution (plan 086). The same client the\n                // payload was minted for, so the row needs no extra lookup.\n                clientId: data.client_id ?? null,\n                kind: 'refresh',\n                parentId: input.parent_id ?? null,\n                ipAddress: data.remote_address ?? '',\n                userAgent: data.user_agent ?? '',\n                expiresAt: new Date(data.exp * 1000).toISOString(),\n            });\n        }\n\n        return [token, data];\n    }\n}\n"],"mappings":";;;;;;AAmBA,IAAaE,2BAAb,cAA8CD,sBAAAA;CAChCE;CAEAC;CAEAC;CAEV,YACIF,YACAC,QACAE,UAAoC,CAAC,GACrCD,wBACF;EACE,MAAMC,OAAAA;EAEN,KAAKH,aAAaA;EAClB,KAAKC,SAASA;EACd,KAAKC,yBAAyBA;CAClC;CAEA,MAAME,MACFC,QAA4B,CAAC,GACM;EACnC,MAAMC,MAAM,KAAKC,SAASF,KAAAA;EAE1B,MAAMG,OAAO,MAAM,KAAKR,WAAWS,OAAO;GACtC,GAAGJ;GACHK,MAAMb,gBAAgBc;GACtBC,KAAK,KAAKC,SAASR,KAAAA;GACnB,GAAIC,MAAM,EAAEA,IAAI,IAAI,CAAC;EACzB,CAAA;EAEA,MAAMQ,QAAQ,MAAM,KAAKb,OAAOc,KAAKP,IAAAA;EAErC,MAAM,KAAKR,WAAWgB,kBAAkBR,MAAMM,KAAAA;EAE9C,IACI,KAAKZ,0BACLM,KAAKS,cAAcT,KAAKU,OACxB,OAAOV,KAAKI,QAAQ,UAEpB,MAAM,KAAKV,uBAAuBiB,OAAO;GACrCC,IAAIZ,KAAKU;GACTG,WAAWb,KAAKS;GAGhBK,UAAUd,KAAKe,aAAa;GAC5Bb,MAAM;GACNc,UAAUnB,MAAMoB,aAAa;GAC7BC,WAAWlB,KAAKmB,kBAAkB;GAClCC,WAAWpB,KAAKqB,cAAc;GAC9BC,4BAAW,IAAIC,KAAKvB,KAAKI,MAAM,GAAA,EAAA,CAAMoB,YAAW;EACpD,CAAA;EAGJ,OAAO,CAAClB,OAAON,IAAK;CACxB;AACJ"}

package/dist/core/provisioning/constants.d.ts

@@ -0,0 +1,8 @@
+/**
+ * A realm provisioning entry declared with this name is a WILDCARD entry:
+ * its relations are ensured in every realm (existing at boot, new at
+ * creation) instead of declaring one specific realm. Literal only; partial
+ * patterns (`tenant-*`) are not supported.
+ */
+export declare const REALM_WILDCARD_NAME = "*";
+//# sourceMappingURL=constants.d.ts.map

package/dist/core/provisioning/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/core/provisioning/constants.ts"],"names":[],"mappings":"AAOA;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,MAAM,CAAC"}

package/dist/core/provisioning/constants.mjs

@@ -0,0 +1,14 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/provisioning/constants.ts
+/**
+* A realm provisioning entry declared with this name is a WILDCARD entry:
+* its relations are ensured in every realm (existing at boot, new at
+* creation) instead of declaring one specific realm. Literal only; partial
+* patterns (`tenant-*`) are not supported.
+*/ const REALM_WILDCARD_NAME = "*";
+//#endregion
+export { REALM_WILDCARD_NAME };
+
+//# sourceMappingURL=constants.mjs.map

package/dist/core/provisioning/constants.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.mjs","names":["REALM_WILDCARD_NAME"],"sources":["../../../src/core/provisioning/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * A realm provisioning entry declared with this name is a WILDCARD entry:\n * its relations are ensured in every realm (existing at boot, new at\n * creation) instead of declaring one specific realm. Literal only; partial\n * patterns (`tenant-*`) are not supported.\n */\nexport const REALM_WILDCARD_NAME = '*';\n"],"mappings":";;;;;;;;;GAaA,MAAaA,sBAAsB"}

package/dist/core/provisioning/entities/index.mjs

@@ -15,8 +15,9 @@ import { ScopeProvisioningValidator } from "./scope/validator.mjs";
 import "./scope/index.mjs";
 import { UserProvisioningValidator } from "./user/validator.mjs";
 import "./user/index.mjs";
+import { RealmWildcardProvisioningValidator } from "./realm/wildcard-validator.mjs";
 import { RealmProvisioningValidator } from "./realm/validator.mjs";
 import "./realm/index.mjs";
 import { RootProvisioningValidator } from "./root/validator.mjs";
 import "./root/index.mjs";
-export { ClientProvisioningValidator, PermissionProvisioningRelationsValidator, PermissionProvisioningValidator, PolicyProvisioningValidator, RealmProvisioningValidator, RoleProvisioningValidator, RootProvisioningValidator, ScopeProvisioningValidator, UserProvisioningValidator, createProvisioningEntitiesValidator };
+export { ClientProvisioningValidator, PermissionProvisioningRelationsValidator, PermissionProvisioningValidator, PolicyProvisioningValidator, RealmProvisioningValidator, RealmWildcardProvisioningValidator, RoleProvisioningValidator, RootProvisioningValidator, ScopeProvisioningValidator, UserProvisioningValidator, createProvisioningEntitiesValidator };

package/dist/core/provisioning/entities/realm/index.d.ts

@@ -1,3 +1,4 @@
 export * from './types.ts';
 export * from './validator.ts';
+export * from './wildcard-validator.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/provisioning/entities/realm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/realm/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/realm/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC"}

package/dist/core/provisioning/entities/realm/index.mjs

@@ -1,5 +1,6 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { RealmWildcardProvisioningValidator } from "./wildcard-validator.mjs";
 import { RealmProvisioningValidator } from "./validator.mjs";
-export { RealmProvisioningValidator };
+export { RealmProvisioningValidator, RealmWildcardProvisioningValidator };